Risk evaluation integration device, risk evaluation integration system, and risk evaluation integration method

Abstract

To provide risk evaluation integration means capable of promoting risk management for an organization by generating a comprehensive evaluation result that integrates risk evaluation results from a plurality of different risk management support tools.SOLUTION: A risk evaluation integration device includes: a cyber attack risk evaluation unit configured to generate a first evaluation result including first cyber attack risk information and first impact information indicating the impact of a first cyber attack; a countermeasure generation unit configured to generate a second evaluation result including cyber attack countermeasure information indicating countermeasures against a second cyber attack; a business risk evaluation unit configured to generate a third evaluation result including a guide word indicating the impact of a predetermined business risk; and an integration unit configured to integrate the first evaluation result, the second evaluation result, and the third evaluation result, and generate and output a comprehensive evaluation result including the first cyber attack risk information, the cyber attack countermeasure information indicting countermeasures against the first cyber attack, and business risk information indicating business risks due to the first cyber attack.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present invention relates to a risk assessment integrating device, a risk assessment integrating system, and a risk assessment integrating method. [Background technology]

[0002] In recent years, as social conditions and environments have changed, the proper management of various possible risks has become an important concern for society and organizations.

[0003] For this reason, for example, companies and other organizations may use various risk management support tools to predict possible risks, evaluate the impact of risks, and take measures. However, since most of these risk management support tools analyze specific types of risks from specific perspectives, the scope of evaluation results obtained from a single risk management support tool may be limited. For this reason, in order to determine security measures, etc., taking into account various risks and perspectives, it is necessary to use multiple risk management support tools appropriately.

[0004] For example, a combination of three tools may be used: a CIA (Confidentiality, Integrity, Availability) analysis tool to assess the risk of cyber attacks, a countermeasure planning tool to determine measures to mitigate the impact of cyber attacks, and an enterprise risk management tool to identify risks to business activities.

[0005] However, when multiple risk management support tools are used, the risk analysis of each risk management support tool is performed independently, and each risk assessment result exists independently. Therefore, users who plan security measures must compare and examine each risk assessment result to determine appropriate security measures. However, there is no guarantee that the risk assessment results obtained from the risk analysis tools of different risk management support tools are consistent, and there is an issue that the burden on users is heavy as they have to decipher the correspondence between items included in each risk assessment result.

[0006] Conventionally, several proposals have been made to reduce the burden on a user who has to examine multiple risk analysis results. For example, International Publication No. 2021 / 059516 (Patent Document 1) describes a technology that "enables a user to plan security measures using two risk analysis results. The comparison means (11) compares a first risk analysis result (21) with a second risk analysis result (22). The first risk analysis result (21) includes a first risk assessment value. The second risk analysis result (22) includes a second risk assessment value. The display means (12) displays the first risk assessment value in the second risk analysis result (22) based on the result of the comparison in a manner that makes it possible to distinguish between a first risk assessment value in which a second risk assessment value exists for an attack step whose attack destination matches the asset in the first risk analysis result (21) and whose attack method matches the attack method in the first risk analysis result (21) and does not exist, and a first risk assessment value in which a second risk assessment value does not exist." [Prior art documents] [Patent documents]

[0007] [Patent Document 1] International Publication No. 2021 / 059516 Summary of the Invention [Problem to be solved by the invention]

[0008] The above-mentioned Patent Document 1 describes a means for easily determining whether the attack methods included in the risk analysis results are the same attack method that matches each other or different risk methods by comparing multiple different risk analysis results.

[0009] However, the means described in Patent Document 1 focuses on facilitating the comparison of multiple different risk analysis results related to cyber attacks, and does not consider the relationship between cyber attacks and evaluation results related to risks other than cyber attacks (e.g., business risks, etc.). For this reason, for example, as described above, when three different risk management support tools such as a CIA analysis tool, a countermeasure planning tool, and an enterprise risk management tool are used, even if the means described in Patent Document 1 is introduced, it is time-consuming to decipher the correspondence between risk evaluation items among the three different risk evaluation results, making it difficult to comprehensively grasp various risks that may occur to an organization, etc.

[0010] Therefore, the present disclosure aims to provide a risk assessment integration means that can promote the management of various risks to an organization by generating an overall evaluation result that integrates risk assessment results from multiple different risk management support tools. [Means for solving the problem]

[0011] In order to solve the above problems, one representative risk assessment integration device of the present invention includes a cyber-attack risk assessment unit that generates a first evaluation result including first cyber-attack risk information indicating the risk of a first cyber-attack and first impact information indicating the impact of the first cyber-attack, a countermeasure generation unit that generates a second evaluation result including cyber-attack countermeasure information indicating countermeasures against a second cyber-attack, a business risk assessment unit that generates a third evaluation result for each of a plurality of scenarios related to a specified business, including business risk information indicating the business risk that may occur in the scenario and guide words indicating the impact of the business risk, and an integration unit that integrates the first evaluation result, the second evaluation result, and the third evaluation result to generate and output a comprehensive evaluation result that corresponds the first cyber-attack risk information indicating the risk of the first cyber-attack, the cyber-attack countermeasure information indicating countermeasures against the first cyber-attack, and the business risk information indicating the business risk due to the first cyber-attack. Effect of the Invention

[0012] According to the present disclosure, a risk assessment integration means can be provided that can promote the management of various risks to an organization by generating an overall evaluation result that integrates risk assessment results from multiple different risk management support tools. Other objects, configurations and effects will become apparent from the following description of the preferred embodiment of the invention. [Brief description of the drawings]

[0013] [Figure 1] FIG. 1 illustrates a computer system for implementing an embodiment of the present disclosure. [Diagram 2] FIG. 2 is a diagram illustrating an example of a configuration of a risk assessment integration system according to an embodiment of the present disclosure. [Diagram 3] FIG. 3 is a diagram illustrating an example of a first evaluation result according to an embodiment of the present disclosure. [Figure 4] FIG. 4 is a diagram showing an example of a second evaluation result according to an embodiment of the present disclosure. [Diagram 5] FIG. 5 is a diagram illustrating an example of a third evaluation result according to an embodiment of the present disclosure. [Figure 6] FIG. 6 is a diagram showing an example of the flow of the evaluation result integration process according to the embodiment of the present disclosure. [Figure 7] FIG. 7 is a diagram showing an example of the flow of the first interim evaluation result generating process according to the embodiment of the present disclosure. [Figure 8] FIG. 8 is a diagram illustrating an example of the configuration of cyber-attack mapping information according to an embodiment of the present disclosure. [Figure 9] FIG. 9 is a diagram illustrating an example of a first intermediate evaluation result according to an embodiment of the present disclosure. [Figure 10] FIG. 10 is a diagram showing an example of the flow of the second interim evaluation result generation process according to the embodiment of the present disclosure. [Figure 11] FIG. 11 is a diagram illustrating an example of the influence relationship information according to an embodiment of the present disclosure. [Figure 12] FIG. 12 is a diagram illustrating an example of a second interim evaluation result according to an embodiment of the present disclosure. [Figure 13] FIG. 13 is a diagram illustrating an example of a configuration of a comprehensive evaluation result according to an embodiment of the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0014] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. Note that the present invention is not limited to the embodiment. In addition, in the description of the drawings, the same parts are denoted by the same reference numerals. In addition, terms such as "first," "second," and "third" may be used to describe various elements or components in this disclosure, but it will be understood that these elements or components should not be limited by these terms. These terms are used only to distinguish one element or component from another element or component. Thus, a first element or component discussed below can also be referred to as a second element or component without departing from the teachings of the inventive concept.

[0015] Next, referring to Fig. 1, a computer system 100 for implementing an embodiment of the present disclosure will be described. The mechanisms and devices of the various embodiments disclosed herein may be applied to any suitable computing system. The main components of the computer system 100 include one or more processors 102, memory 104, a terminal interface 112, a storage interface 113, an I / O (input / output) device interface 114, and a network interface 115. These components may be interconnected via a memory bus 106, an I / O bus 108, a bus interface unit 109, and an I / O bus interface unit 110.

[0016] Computer system 100 may include one or more general purpose programmable central processing units (CPUs) 102A and 102B, collectively referred to as processors 102. In some embodiments, computer system 100 may include multiple processors, while in other embodiments, computer system 100 may be a single CPU system. Each processor 102 executes instructions stored in memory 104 and may include an on-board cache.

[0017] In one embodiment, memory 104 may include random access semiconductor memory, storage devices, or storage media (either volatile or non-volatile) for storing data and programs. Memory 104 may store all or a portion of the programs, modules, and data structures that implement the functions described herein. For example, memory 104 may store a risk assessment integration application 150. In one embodiment, risk assessment integration application 150 may include instructions or descriptions that execute on processor 102 the functions described below.

[0018] In some embodiments, risk assessment integration application 150 may be implemented in hardware via semiconductor devices, chips, logic gates, circuits, circuit cards, and / or other physical hardware devices instead of or in addition to a processor-based system. In some embodiments, risk assessment integration application 150 may include data other than instructions or descriptions. In some embodiments, cameras, sensors, or other data input devices (not shown) may be provided to communicate directly with bus interface unit 109, processor 102, or other hardware of computer system 100.

[0019] Computer system 100 may include a bus interface unit 109 that provides communication between processor 102, memory 104, display system 124, and I / O bus interface unit 110. I / O bus interface unit 110 may couple to an I / O bus 108 for transferring data to and from various I / O units. I / O bus interface unit 110 may communicate via I / O bus 108 with multiple I / O interface units 112, 113, 114, and 115, also known as I / O processors (IOPs) or I / O adapters (IOAs).

[0020] Display system 124 may include a display controller, a display memory, or both. The display controller may provide video, audio, or both data to display device 126. Computer system 100 may also include one or more sensors or other devices configured to collect data and provide the data to processor 102.

[0021] For example, computer system 100 may include biometric sensors to collect heart rate data, stress level data, etc., environmental sensors to collect humidity data, temperature data, pressure data, etc., and motion sensors to collect acceleration data, movement data, etc. Other types of sensors may also be used. Display system 124 may be connected to a display device 126, such as a standalone display screen, a television, a tablet, or a handheld device.

[0022] The I / O interface unit provides the ability to communicate with various storage or I / O devices. For example, the terminal interface unit 112 may be attached to user I / O devices 116, such as user output devices, such as a video display, a television with speakers, and user input devices, such as a keyboard, a mouse, a keypad, a touchpad, a trackball, buttons, a light pen, or other pointing device. A user may use a user interface to enter input data or instructions to the user I / O devices 116 and the computer system 100, and receive output data from the computer system 100, by manipulating the user input devices. The user interface may be displayed on a display, played through speakers, or printed via a printer, for example, via the user I / O devices 116.

[0023] Storage interface 113 allows attachment of one or more disk drives or direct access storage device 117 (usually a magnetic disk drive storage device, but may be an array of disk drives or other storage devices configured to appear as a single disk drive). In some embodiments, storage device 117 may be implemented as any secondary storage device. Contents of memory 104 may be stored in storage device 117 and retrieved from storage device 117 as needed. I / O device interface 114 may provide an interface to other I / O devices such as printers, fax machines, etc. Network interface 115 may provide a communications path to allow computer system 100 and other devices to communicate with each other. This communications path may be, for example, network 130.

[0024] In one embodiment, computer system 100 may be a device that receives requests from other computer systems (clients) without a direct user interface, such as a multi-user mainframe computer system, a single-user system, or a server computer, etc. In other embodiments, computer system 100 may be a desktop computer, a portable computer, a laptop, a tablet computer, a pocket computer, a telephone, a smartphone, or any other suitable electronic device.

[0025] Next, a risk assessment integration system according to an embodiment of the present disclosure will be described with reference to FIG.

[0026] Fig. 2 is a diagram showing an example of a configuration of a risk assessment integrating system 200 according to an embodiment of the present disclosure. The risk assessment integrating system 200 is a system for generating a comprehensive assessment result by integrating a plurality of different risk management support tools and providing it to a user, and as shown in Fig. 2, includes a user terminal 210, a communication network 225, and a risk assessment integrating device 230. The user terminal 210 and the risk assessment integrating device 230 may be connected to each other via the communication network 225. Note that the risk management support tool here may include any method that provides insight into risk management, such as predicting possible risks, assessing the impact of risks, and taking countermeasures. However, for the sake of convenience in this disclosure, an example will be described in which three tools are used: a CIA (Confidentiality, Integrity, Availability) analysis tool for assessing the risk of cyber attacks, a countermeasure planning tool for determining measures to mitigate the impact of cyber attacks, and an enterprise risk management tool for identifying risks to business activities.

[0027] The user terminal 210 is a terminal device that can be used by the user 205. As shown in FIG. 2, the user terminal 210 may include an interface unit 215. This interface unit 215 is an interface for inputting and outputting information between the user 205 and the user terminal 210, and may be, for example, a GUI (Graphical User Interface) displayed on a display connected to the user terminal 210. By using the interface unit 215 of the user terminal 210, the user 205 can input information to be input to the risk assessment integrating device 230 and check the overall assessment result output from the risk assessment integrating device. As an example, the user terminal 210 may include, but is not limited to, a smartphone, a smart watch, a tablet, a personal computer, etc.

[0028] The risk assessment integrating device 230 is a device for integrating assessment results generated by a plurality of different risk management support tools. As shown in Fig. 2, the risk assessment integrating device 230 may include a cyber-attack risk assessment unit 232, a countermeasure generation unit 234, a business risk assessment unit 236, an integration unit 238, cyber-attack mapping information 240, and impact relationship information 242. The risk assessment integrating device 230 may be implemented as, for example, the computer system 100 shown in Fig. 1, or may be implemented as a distributed computer system. The various functional units included in the risk assessment integrating device 230 may be software modules constituting the risk assessment integrating application 150 shown in Fig. 1, or may be independent dedicated hardware devices. The above-mentioned functional units may be implemented in the same computing environment, or may be implemented in distributed computing environments.

[0029] The cyber-attack risk assessment unit 232 is a functional unit for generating a first assessment result for assessing the risk of a cyber-attack (for example, a first cyber-attack). In an embodiment, the cyber-attack risk assessment unit 232 may be a so-called CIA (Confidentiality, Integrity, Availability) analysis tool. As an example, the cyber-attack risk assessment unit 232 may be a CIA analysis tool that inputs, via the user terminal 210, information on an asset (specific business) to be assessed, information on components (servers, etc.) constituting the asset, and business flow information indicating the flow of data between each component, and identifies a cyber-attack that poses a threat to the target asset based on the input information, and generates a first assessment result including a score indicating the importance of the identified cyber-attack and information such as security requirements for the identified cyber-attack.

[0030] The countermeasure generating unit 234 is a functional unit for generating a second evaluation result indicating a countermeasure against a cyber-attack (a second cyber-attack). In an embodiment, the countermeasure generating unit 234 may be a countermeasure planning tool for recommending a countermeasure for suppressing the impact of a cyber-attack. As an example, the countermeasure generating unit 234 may be a countermeasure planning tool that inputs information indicating the configuration of a target asset (such as a network or a computer system) and information indicating the characteristics of the asset via the user terminal 210, identifies the risk of a cyber-attack based on the input information, and generates a second evaluation result that proposes a countermeasure against the identified risk.

[0031] Note that the cyberattack identified by the countermeasure generation unit 234 does not necessarily correspond to the cyberattack identified by the cyberattack risk assessment unit 232. In other words, there is a possibility that the cyberattacks identified by the countermeasure generation unit 234 and the cyberattacks identified by the cyberattack risk assessment unit 232 correspond (match) to each other, and there is also a possibility that they do not correspond to each other. Therefore, in the present disclosure, the cyberattack identified by the cyberattack risk assessment unit 232 is distinguished as a "first cyberattack" and the cyberattack identified by the countermeasure generation unit 234 is distinguished as a "second cyberattack". However, the first cyberattack and the second cyberattack may be the same cyberattack or different cyberattacks.

[0032] The business risk assessment unit 236 is a functional unit for generating a third assessment result indicating a business risk that may occur in each of a plurality of scenarios related to a predetermined business. In an embodiment, the business risk assessment unit 236 may be a so-called enterprise risk management tool. As an example, the business risk assessment unit 236 may be an enterprise risk management tool that inputs information related to a target business via the user terminal 210 and generates a third assessment result including information indicating the impact of the risk of each scenario that may occur in the business on a plurality of target ranges such as people, the environment, and organizations based on the input information.

[0033] The integration unit 238 is a functional unit for generating a comprehensive evaluation result by integrating the first evaluation result generated by the countermeasure generation unit 234, the second evaluation result generated by the countermeasure generation unit 234, and the third evaluation result generated by the business risk assessment unit 236. More specifically, the integration unit 238 generates a first interim evaluation result by associating the first evaluation result with the second evaluation result based on the cyber attack mapping information 240 described later, and generates a second interim evaluation result by associating the first evaluation result with the third evaluation result based on the impact relationship information 242 described later. Thereafter, by integrating the first interim evaluation result and the second interim evaluation result thus generated, a comprehensive evaluation result that facilitates a comprehensive understanding of various risks that may occur can be obtained. The details of the processing by the integration unit 238 will be described later, and therefore will not be described here.

[0034] The cyber-attack mapping information 240 is information for associating a plurality of cyber-attacks with each other. In an embodiment, the cyber-attack mapping information 240 may be used for associating a second cyber-attack identified in a second evaluation result generated by the countermeasure generation unit 234 with a first cyber-attack identified in a first evaluation result generated by the cyber-attack risk assessment unit 232. In addition, the cyber-attack mapping information 240 may be created based on cyber-attack diagnosis information for diagnosing the method of a cyber-attack, such as Cyber ​​Kill Chain (registered trademark).

[0035] The impact relationship information 242 is information for associating the impacts of risks identified in different evaluation results. In an embodiment, the impact relationship information 242 may be used for associating the impact of a cyber-attack identified in the first evaluation result generated by the measure generating unit 234 with the impact of a business risk identified in the third evaluation result generated by the business risk assessing unit 236.

[0036] According to the risk assessment integration system 200 described above, it is possible to generate a comprehensive assessment result by integrating risk assessment results from a plurality of different risk management support tools.

[0037] Next, a first evaluation result according to the embodiment of the present disclosure will be described with reference to FIG.

[0038] 3 is a diagram showing an example of a first evaluation result 300 according to an embodiment of the present disclosure. As described above, the first evaluation result 300 is information for evaluating the risk of a first cyber-attack, and is generated by the cyber-attack risk assessment unit 232 described above.

[0039] As shown in FIG. 3, the first evaluation result 300 may be a data structure such as a table that stores information such as a number 305, a component 310, a first cyber attack 315, a risk of the cyber attack 320, and security requirements 325 in a tabular format.

[0040] Number 305 is a number for identifying the identified first cyber attack 315 . Component 310 is a component that may be subject to a first cyber-attack 315 and may be, for example, a database, a computing device, a server, etc. The first cyber attack 315 is a cyber attack identified by the cyber attack risk assessment unit 232 that may pose a threat to the component 310, and may include any cyber attack, such as a DoS (Denial of Service) attack or function tampering.

[0041] The risk of cyber attack 320 is information indicating the risk from the identified first cyber attack 315 and may include, for example, first impact information 322 indicating the impact of the cyber attack, the frequency of the cyber attack 324, and a risk score 326 of the cyber attack. The first impact information 322 indicates the scale of the impact for each element affected by a cyber-attack. As an example, in the case of a so-called CIA analysis tool, the cyber-attack risk assessment unit 232 may indicate the scale of the impact of the cyber-attack on each element in three stages, such as small, medium, and large, for each of three elements, namely, confidentiality, integrity, and availability.

[0042] Generally, confidentiality in information security refers to the property of not making information available or disclosing it to unauthorized individuals, entities, or processes. In addition, integrity in information security refers to the characteristics of accuracy and completeness of information. Furthermore, availability in information security refers to the property of being able to be accessed and used when requested by an authorized entity.

[0043] Frequency 324 may indicate the expected occurrence of a cyber attack on three levels, such as low, medium, or high. The risk score 326 is information that quantitatively indicates the degree of danger of a cyber attack, and may be expressed, for example, as a value within a range of 1 to 5 (the higher the value, the higher the risk).

[0044] The security requirements 325 are information indicating security requirements for preventing cyber attacks. For example, the security requirements 325 may include “SR1.12: Notification of system usage status” and “SR1.13: Monitoring access from untrusted networks”, which are functional requirements of the security standard IEC62443-3-3 for industrial control systems.

[0045] According to the above-described first evaluation result 300, it is possible to evaluate the risks of various cyber attacks and manage information related to the impacts of the risks, etc. Furthermore, as will be described later, by integrating this first evaluation result 300 with different risk management support tools, it is possible to obtain a comprehensive evaluation result that makes it easy to comprehensively grasp various risks that may occur in an organization, for example.

[0046] Next, a second evaluation result according to the embodiment of the present disclosure will be described with reference to FIG.

[0047] 4 is a diagram showing an example of the second evaluation result 400 according to the embodiment of the present disclosure. As described above, the second evaluation result 400 is information indicating countermeasures against the second cyber-attack, and is generated by the countermeasure generation unit 234 described above.

[0048] As shown in FIG. 4, the second evaluation result 400 may have a data structure that stores information such as a number 405, a component 410, a second cyber-attack 415, and countermeasure information 420 in a table format.

[0049] Number 405 is a number for identifying the identified second cyber attack 415 . Component 410 is a component that may be subject to a second cyber-attack 415, and may be, for example, a database, a computing device, a server, etc. The second cyber-attack 415 is information that indicates a cyber-attack that is identified by the countermeasure generator 234 and that may pose a threat to the component 410 .

[0050] Countermeasure information 420 is information regarding countermeasures against the identified second cyber attack 415 and may include, for example, countermeasures 422 and categories 424. Countermeasures 422 are information indicating countermeasures against the second cyber-attack 415. As an example, the countermeasures 422 may indicate appropriate countermeasures according to the type and stage of the cyber-attack, such as "disabling unnecessary applications and services" or "performing user and application account management to prevent privilege escalation." The category 424 is information indicating a category of the measure 422. The category 424 may indicate an appropriate category according to the method of the measure 422, such as attack prevention, damage suppression, or the like.

[0051] According to the above-described second evaluation result 400, information on measures against various cyber attacks can be managed. In addition, as will be described later, by integrating this second evaluation result 400 with different risk management support tools, it is possible to obtain a comprehensive evaluation result that makes it easy to comprehensively grasp various risks that may occur in an organization, for example.

[0052] Next, a third evaluation result according to the embodiment of the present disclosure will be described with reference to FIG.

[0053] 5 is a diagram showing an example of the third evaluation result 500 according to the embodiment of the present disclosure. As described above, the third evaluation result 500 is information indicating a business risk that may occur in each of a plurality of scenarios related to a predetermined business, and is generated by the business risk assessment unit 236 described above.

[0054] As shown in FIG. 5, the third evaluation result 500 may have a data structure that stores information such as output items 505, guide words 510, second impact information 515, target scope 520, business risk 525, degree of impact 530, related departments 535, frequency 540, and risk score 545 in table format.

[0055] Output items 505 indicate items that are output in the course of business operations. These output items 505 may include intended outputs such as "parts" that are the subject of production, and unintended outputs such as "waste" that is discarded during the production process and "design information" that is leaked. Guide words 510 are information that identifies the impact of a scenario or situation that may occur in a given business for each output item 505. As an example, guide words 510 may include, for example, "no output" for identifying a situation in which "production of parts has stopped", "something that is output" for identifying a situation in which "waste has leaked", and "information that is output" for identifying a situation in which "design information has leaked".

[0056] The second impact information 515 is information indicating an impact corresponding to the guide word 510. As an example, as shown in Fig. 5, the second impact information 515 may indicate an impact of "production of parts has stopped" for a scenario of "no output" and an impact of "insufficient production volume" for a scenario of "insufficient output".

[0057] The target range 520 indicates targets that are affected by the second impact information 515, and may include, for example, "people", "environment", and "organization" as shown in FIG. Business risk 525 is information indicating business risks that a business may suffer for each target scope 520 when a scenario indicated in guide word 510 occurs. For example, when a scenario of "production of parts has stopped" occurs, a business risk 525 of "loss of customer trust" may be considered for the target scope 520 of the "organization." As another example, when a scenario of "waste has leaked" occurs, a business risk 525 of "environmental damage" may be considered for the target scope 520 of the "environment," and a business risk 525 of "decline in brand power" may be considered for the target scope 520 of the "organization."

[0058] The impact degree 530 is information indicating the impact degree (importance) of each business risk indicated in the business risk 525. In one embodiment, the impact degree 530 may be expressed in three stages, such as small, medium, and large.

[0059] The related departments 535 indicate departments of an organization that are affected by the scenario shown in the guide word 510. As an example, if a scenario such as "production of parts has stopped" occurs, it is considered that the "parts production" department and the "delivery management" department will be affected.

[0060] Frequency 540 may indicate the expected frequency of occurrence of the scenario depicted in guide word 510 on three levels, such as low, medium, and high. The risk score 545 is information that quantitatively indicates the importance of the business risk 525, and may be expressed, for example, as a value within a range of 1 to 5 (the higher the value, the higher the risk).

[0061] According to the above-described third evaluation result 500, it is possible to manage information on business risks that may occur in each of a plurality of scenarios related to a specific business. In addition, as will be described later, by integrating this third evaluation result 500 with a different risk management support tool, it is possible to obtain a comprehensive evaluation result that makes it easy to comprehensively grasp various risks that may occur in an organization, for example.

[0062] The first evaluation result, the second evaluation result, and the third evaluation result have been described above. However, as described above, these evaluation results are generated independently by different risk management support tools, and therefore the correspondence between the items included in each evaluation result is unclear. For example, the first evaluation result indicates the risk of a first cyber attack, and the second evaluation result indicates measures against a second cyber attack, but it is unclear whether the first cyber attack indicated in the first evaluation result and the second cyber attack indicated in the second evaluation result are the same cyber attack or different cyber attacks. For this reason, it is unclear whether any of the measures indicated in the second evaluation result are applicable to the first cyber attack.

[0063] Similarly, the first evaluation result indicates the risk from the first cyber-attack, and the third evaluation result indicates the business risks in various scenarios, but the business risk from the first cyber-attack is not clear because the correspondence between the risk from the cyber-attack and the business risks is unclear.

[0064] For these reasons, users who plan security measures must carefully consider the results of each risk assessment and decide on appropriate security measures, which places a heavy burden on users.

[0065] Therefore, one aspect of an embodiment of the present disclosure relates to matching and integrating the evaluation results generated by these multiple different risk management support tools to generate a consistent overall evaluation result.

[0066] Next, an evaluation result integration process according to an embodiment of the present disclosure will be described with reference to Fig. 6. Fig. 6 is a diagram showing an example of a flow of an evaluation result integration process 600 according to an embodiment of the present disclosure. The evaluation result integration process 600 shown in Fig. 6 is a process for integrating the first evaluation result, the second evaluation result, and the third evaluation result described above, and is performed by the cyber attack risk assessment unit 232, the countermeasure generation unit 234, the business risk assessment unit 236, and the integration unit 238 shown in Fig. 2.

[0067] First, in step S610, the cyber-attack risk assessment unit 232 generates a first assessment result. Here, the cyber-attack risk assessment unit 232 may input information on the asset (specific business) to be assessed, information on the components (servers, etc.) that constitute the asset, and business flow information indicating the data flow between each component via the user terminal 210, and perform a CIA analysis on the input information to generate, for example, a first assessment result 300 as shown in FIG. 3.

[0068] Next, in step S620, the countermeasure generator 234 generates a second evaluation result. Here, the countermeasure generator 234 may input information indicating the configuration of the target asset (network, computer system, etc.) and information indicating the characteristics of the asset via the user terminal 210, and perform a countermeasure plan analysis for the input information, thereby generating, for example, the second evaluation result 400 as shown in FIG.

[0069] Next, in step S630, the business risk assessment unit 236 generates a third assessment result. Here, the business risk assessment unit 236 may input information about the target business via the user terminal 210 and perform an enterprise risk analysis on the input information to generate a third assessment result 500 as shown in FIG. 5 for each scenario that may occur in the business.

[0070] In step S640, the integration unit 238 generates a first intermediate evaluation result by integrating the first evaluation result generated in step S610 and the second evaluation result generated in step S620. The first intermediate evaluation result here is a data structure that stores information on the first evaluation result and information on the second evaluation result in a form in which they are associated with each other. In an embodiment, the integration unit 238 may generate the first intermediate evaluation result by associating the first cyber-attack in the first evaluation result with the second cyber-attack in the second evaluation result using cyber-attack mapping information created based on a cyber-attack diagnosis method provided by a third party, such as a cyber kill chain. The details of the process for generating the first interim evaluation result will be described with reference to FIGS. 7, 8, and 9, and therefore will not be described here.

[0071] In step S640, the integration unit 238 generates a second interim evaluation result by integrating the first evaluation result generated in step S610 and the third evaluation result generated in step S630. The second interim evaluation result here is a data structure that stores information on the first evaluation result and information on the third evaluation result in a form in which they are associated with each other. In one embodiment, the integration unit 238 may generate the second interim evaluation result by associating the first cyberattack in the first evaluation result with the second cyberattack in the third evaluation result based on impact relationship information indicating the corresponding relationship between the impact of the first cyberattack and the impact of the business risk. The details of the process for generating the second interim evaluation result will be described with reference to FIGS. 10, 11, and 12, and therefore will not be described here.

[0072] In step S660, the integration unit 238 integrates the first interim evaluation result generated in step S640 and the second interim evaluation result generated in step S650 to generate a comprehensive evaluation result. The comprehensive evaluation result here is a data structure that stores information on the first evaluation result, information on the second evaluation result, and information on the third evaluation result in a form in which they are associated with each other. More specifically, in the first interim evaluation result generated in step S640, information on the first evaluation result is associated with information on the second evaluation result, and in the second interim evaluation result generated in step S650, information on the first evaluation result is associated with information on the third evaluation result. Therefore, it is possible to associate information on the second evaluation result with information on the third evaluation result based on information on the first evaluation result included in both the first interim evaluation result and the second interim evaluation result. Therefore, the integration unit 238 generates an overall evaluation result that corresponds the first interim evaluation result and the second interim evaluation result based on the information of the common first evaluation result contained in the first interim evaluation result and the second interim evaluation result.

[0073] According to the evaluation result integration process 600 described above, it is possible to integrate evaluation results obtained from three different risk management support tools, such as a CIA analysis tool, a countermeasure planning tool, and an enterprise risk management tool, into one comprehensive evaluation result. This makes it possible to clarify the correspondence between information such as the risk of cyber attacks, countermeasures against cyber attacks, and business risks caused by cyber attacks, thereby reducing the burden on the user who manually deciphers the correspondence between the evaluation results and making it easy to understand the impact of various risks and countermeasures.

[0074] Next, the first interim evaluation result generating process according to the embodiment of the present disclosure will be described with reference to FIGS.

[0075] 7 is a diagram showing an example of the flow of a first interim evaluation result generation process 700 according to an embodiment of the present disclosure. The first interim evaluation result generation process 700 shown in FIG. 7 is a process for generating a first interim evaluation result based on the first evaluation result and the second evaluation result, and is executed by the integrating unit 238.

[0076] First, in step S710, the integration unit 238 generates the cyber-attack mapping information 240. Here, in order to generate the cyber-attack mapping information 240, the integration unit 238 uses a cyber-attack diagnosis method provided by a third party, such as a cyber kill chain, to associate each of the first cyber-attack and the second cyber-attack with a category or stage of a cyber-attack (third cyber-attack) defined by the cyber-attack diagnosis method. As an example, the integration unit 238 may associate a cyber-attack with a "DoS attack" with a stage of a cyber-attack with a "reconnaissance". After that, the integration unit 238 may store the associated first cyber-attack, second cyber-attack, third cyber-attack, and assets (servers, etc.) that may be targets of these cyber-attacks in a table format.

[0077] Below, with reference to FIG. 8, the cyber-attack mapping information 240 according to an embodiment of the present disclosure will be described. As described above, although the first evaluation result and the second evaluation result are both evaluation results regarding cyberattacks, they are generated independently by different risk management support tools, and therefore the corresponding relationship between the first cyberattack in the first evaluation result and the second cyberattack in the second evaluation result is unclear due to differences in the methods of identifying, categorizing, notation, etc. of cyberattacks. For this reason, it is unclear whether the first cyberattack shown in the first evaluation result and the second cyberattack shown in the second evaluation result are the same cyberattack or different cyberattacks.

[0078] As a result, it becomes unclear whether any of the countermeasures indicated in the second evaluation result are applicable to the first cyber-attack. Therefore, the integration unit 238 according to the embodiment of the present disclosure can generate a first intermediate evaluation result in which information on the first evaluation result and information on the second evaluation result are associated with each other by associating the first cyber-attack and the second cyber-attack with a common third cyber-attack using the cyber-attack mapping information 240 shown in FIG.

[0079] The cyber-attack mapping information 240 shown in Figure 8 is information for matching a second cyber-attack in the second evaluation result (for example, the second cyber-attack 415 in the second evaluation result 400 shown in Figure 4) with a first cyber-attack in the first evaluation result (for example, the first cyber-attack 315 in the first evaluation result 300 shown in Figure 3). As shown in FIG. 8 , the cyber-attack mapping information 240 includes a number 805 , a second cyber-attack 815 , a third cyber-attack 820 and a first cyber-attack 825 .

[0080] The number 805 is a number used to identify a particular cyber attack. The second cyber-attack 815 is a cyber-attack identified by the measure generator 234, and substantially corresponds to the second cyber-attack 415 in the second evaluation result 400 shown in FIG.

[0081] The first cyber-attack 825 is a cyber-attack identified by the cyber-attack risk assessment unit 232, and substantially corresponds to the first cyber-attack 315 in the first assessment result 300 shown in FIG.

[0082] The third cyber attack 820 indicates information of a cyber attack corresponding to both the second cyber attack 815 and the first cyber attack 825. The third cyber attack 820 may be a category, type, or stage of a cyber attack that includes both the second cyber attack 815 and the first cyber attack 825. In one embodiment, the third cyber-attack 820 may be a stage of a cyber-attack based on a cyber-attack diagnostic methodology provided by a third party, such as the so-called cyber kill chain, which classifies cyber-attacks into one of seven stages: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command and Control, and Actions on Objectives.

[0083] The information for associating the second cyber-attack 815 with the first cyber-attack 825 is not particularly limited, but is preferably selected in consideration of the classification granularity (fineness of classification) of the cyber-attacks. For example, in a cyber-attack diagnosis method using STRIDE (registered trademark), the classification of cyber-attacks is rough, while in a cyber-attack diagnosis method using MITRE ATT&CK (registered trademark), the classification of cyber-attacks is fine, so the accuracy of associating the second cyber-attack 815 with the first cyber-attack 825 is limited. Therefore, in view of the above, it is preferable to use the cyber-attack mapping information 240 created based on the cyber kill chain information from the viewpoint of the classification granularity (fineness of classification) of the cyber-attacks.

[0084] By using the cyber-attack mapping information 240 described above, it is possible to associate cyber-attacks in the evaluation results generated by multiple different risk management support tools.

[0085] Returning to the explanation of the first interim evaluation result generation process 700 shown in Fig. 7, in step S720, the integrating unit 238 obtains the first evaluation result 300 and the second evaluation result 400. Here, the integrating unit 238 may obtain the first evaluation result 300 from the cyber-attack risk assessment unit 232, and obtain the second evaluation result 400 from the countermeasure generation unit 234.

[0086] Next, in step S730, the integration unit 238 generates a first intermediate evaluation result by matching the second cyber-attack in the second evaluation result 400 to the first cyber-attack in the first evaluation result 300 based on the cyber-attack mapping information 240 generated in step S710.

[0087] More specifically, the integration unit 238 determines the correspondence between the second cyber-attack and the first cyber-attack by comparing the first evaluation result 300 and the second evaluation result 400 based on the cyber-attack mapping information 240. As an example, since both the first cyber-attack with "DoS attack" and the second cyber-attack with "X" correspond to the third cyber-attack with "reconnaissance" in the cyber-attack mapping information 240, the integration unit 238 can determine that the second cyber-attack with "X" corresponds to a "DoS attack".

[0088] Next, the integration unit 238 integrates the first evaluation result and the second evaluation result based on the correspondence between the determined second cyber-attack and the first cyber-attack. For example, the integration unit 238 may generate, as the first intermediate evaluation result, a table indicating the correspondence between information on the second evaluation result (i.e., information on measures against the second cyber-attack) and the corresponding first cyber-attack.

[0089] Hereinafter, with reference to FIG. 9, an example of a first intermediate evaluation result 900 according to an embodiment of the present disclosure will be described.

[0090] As described above, the first intermediate evaluation result 900 according to the embodiment of the present disclosure is a table including, in a corresponding form, information on the first evaluation result generated by the cyber-attack risk assessment unit 232 and information on the second evaluation result generated by the countermeasure generation unit 234. As shown in FIG. 9 , the first intermediate evaluation result 900 may include a number 905, a component 910, a first cyber-attack 915, a risk of cyber-attack 920, a countermeasure 925, and a category 930.

[0091] The number 905, component 910, first cyber attack 915, risk of cyber attack 920, countermeasures 925, and category 930 stored in the first intermediate evaluation result 900 substantially correspond to the information stored in the first evaluation result 300 shown in Figure 3 and the second evaluation result 400 shown in Figure 4, so their explanation is omitted here.

[0092] 9, in the first interim evaluation result 900, the countermeasure information included in the second evaluation result 400 is associated with the first cyber-attack 915 in the first evaluation result 300. Therefore, the correspondence between the first cyber-attack 915 and the countermeasures against the cyber-attack, which was unclear only from the first evaluation result 300 and the second evaluation result 400, becomes clear, and appropriate countermeasures against the first cyber-attack 915 in the first evaluation result 300 can be easily confirmed.

[0093] Next, the second interim evaluation result generating process according to the embodiment of the present disclosure will be described with reference to FIGS.

[0094] 10 is a diagram showing an example of the flow of a second interim evaluation result generation process 1000 according to an embodiment of the present disclosure. The second interim evaluation result generation process 1000 shown in FIG. 10 is a process for generating a third interim evaluation result based on the first evaluation result and the third evaluation result, and is executed by the integrating unit 238.

[0095] First, in step S1010, the integrating unit 238 generates the impact relationship information 242. Here, in order to generate the impact relationship information 242, the integrating unit 238 may create, as the impact relationship information 242, a diagram or a table showing the correspondence between each piece of first impact information such as each CIA element (confidentiality, integrity, availability) in the CIA analysis and an impact that may occur due to a business risk.

[0096] Hereinafter, the influence relationship information 242 according to the embodiment of the present disclosure will be described with reference to FIG. As described above, although the first evaluation result and the third evaluation result are both evaluation results related to risk, they are generated independently by different risk management support tools, so the correspondence between the first cyber attack in the first evaluation result and the business risk in the third evaluation result is unclear. For this reason, when a certain cyber attack occurs, it is difficult to grasp other business risks caused by this cyber attack. Therefore, the integration unit 238 according to the embodiment of the present disclosure can generate a second intermediate evaluation result in which the information of the first evaluation result and the information of the third evaluation result are associated with each other by using the impact relationship information 242 shown in FIG. 11 to associate the first impact information in the first evaluation result (e.g., CIA elements, etc., corresponding to the first impact information 322 shown in FIG. 3) with the guide word in the third evaluation result (corresponding to the guide word 510 shown in FIG. 5).

[0097] The impact relationship information 242 is information for associating the first impact information (impact due to cyber-attack) 1110 (corresponding to the first impact information 322 in the first evaluation result 300) in the first evaluation result with the guide word 1120 (corresponding to the guide word 510 in the third evaluation result 500) in the third evaluation result, and may be expressed in a diagram form as shown in Fig. 11. As shown in Fig. 11, in an embodiment, the impact relationship information 242 may indicate the correspondence between each of the CIA elements (confidentiality, integrity, availability) in the first evaluation result obtained by the CIA analysis by the above-mentioned cyber-attack risk assessment unit 232 and the guide word indicated in the third evaluation result.

[0098] As an example, if a scenario occurs in which “information is output” in the third evaluation result 500, “confidentiality” in the first evaluation result 300 may be affected, so the impact relationship information 242 may indicate that “confidentiality” in the first evaluation result 300 corresponds to “information is output” in the third evaluation result. Furthermore, if there is a scenario such as "unauthorized output," "excessive output," "insufficient output," or "something to be output" in the third evaluation result 500, the "completeness" in the first evaluation result 300 may be affected, so the impact relationship information 242 may indicate that the "completeness" in the first evaluation result 300 corresponds to the "unauthorized output," "excessive output," "insufficient output," or "something to be output" in the third evaluation result. Furthermore, if “no output” or “insufficient output” occurs in the third evaluation result 500, the “availability” in the first evaluation result 300 may be affected, so the impact relationship information 242 may indicate that “availability” in the first evaluation result 300 corresponds to “no output” and “insufficient output” in the third evaluation result.

[0099] By using the above-described impact relationship information 242, it is possible to associate the impact information in the evaluation results generated by a plurality of different risk management support tools.

[0100] Returning to the explanation of the second interim evaluation result generation process 1000 shown in Fig. 10, in step S1020, the integrating unit 238 obtains the first evaluation result 300 and the third evaluation result 500. Here, the integrating unit 238 may obtain the first evaluation result 300 from the cyber-attack risk assessment unit 232, and obtain the third evaluation result 500 from the business risk assessment unit 236.

[0101] Next, in step S1030, the integration unit 238 generates a second intermediate evaluation result by matching the first impact information (e.g., CIA elements) of the first evaluation result 300 with the guide words (e.g., information that identifies the impact of business risk) of the third evaluation result 500 based on the impact relationship information 242 generated in step S1010.

[0102] More specifically, the integration unit 238 determines the correspondence relationship between the first impact information and the guide word by comparing the first evaluation result 300 and the third evaluation result 500 based on the impact relationship information 242. As an example, the integration unit 238 may determine that the first impact information related to "completeness" and the guide word related to "insufficient output" correspond to each other. Next, the integration unit 238 integrates the first evaluation result and the third evaluation result based on the correspondence between the determined first impact information and the guide word. For example, the integration unit 238 may generate a table indicating the correspondence between the information of the first evaluation result (i.e., information on the risk of the first cyber-attack) and the corresponding information of the second evaluation result (i.e., information on the business risk) as the second interim evaluation result.

[0103] Hereinafter, with reference to FIG. 12, an example of a second interim evaluation result 1200 according to an embodiment of the present disclosure will be described.

[0104] As described above, the second interim evaluation result 1200 according to the embodiment of the present disclosure is a table including, in a corresponding form, information on the first evaluation result generated by the cyber-attack risk assessment unit 232 and information on the third evaluation result generated by the business risk assessment unit 236. As shown in FIG. 12 , the second interim evaluation result 1200 may include a number 1205, a component 1210, a first cyber-attack 1215, a risk of cyber-attack 1220, and a business risk 1225.

[0105] The number 1205, component 1210, first cyber attack 1215, risk of cyber attack 1220, and business risk 1225 stored in the second intermediate evaluation result 1200 substantially correspond to the information stored in the first evaluation result 300 shown in Figure 3 and the third evaluation result 500 shown in Figure 5, so their description is omitted here.

[0106] 12, in the second interim evaluation result 1200, the business risk information included in the third evaluation result 500 is associated with the first cyber-attack 1215 in the first evaluation result 300. Therefore, the business risk due to the first cyber-attack 915, which was unclear only from the first evaluation result 300 and the third evaluation result 500, becomes clear, and the business risk that may occur due to the first cyber-attack 1215 can be easily confirmed.

[0107] Next, a comprehensive evaluation result according to an embodiment of the present disclosure will be described with reference to FIG.

[0108] 13 is a diagram showing an example of the configuration of a comprehensive evaluation result 1300 according to an embodiment of the present disclosure. As described above, the comprehensive evaluation result 1300 is a data structure created by integrating the first interim evaluation result 900 (see FIG. 9) and the second interim evaluation result 1200 (see FIG. 12), and shows information on the first evaluation result, information on the second evaluation result, and information on the third evaluation result in a form in which they are associated with each other.

[0109] As shown in FIG. 13, a comprehensive evaluation result 1300 includes a number 1305 , a component 1310 , a first cyber-attack 1315 , a risk of the cyber-attack 1320 , a business risk 1330 , and countermeasure information 1335 .

[0110] The number 1305, component 1310, first cyber attack 1315, risk of cyber attack 1320, business risk 1330 and countermeasure information 1335 stored in the overall evaluation result 1300 substantially correspond to the information stored in the first evaluation result 300 shown in Figure 3, the second evaluation result 400 shown in Figure 4 and the third evaluation result 500 shown in Figure 5, so their explanation is omitted here.

[0111] 13, in the comprehensive evaluation result 1300, the countermeasure information 1335 from the second evaluation result 400 and the information on the business risk 1330 from the third evaluation result 500 are associated with the information on the first cyber-attack 1315 from the first evaluation result 300. Therefore, compared to the case where the first evaluation result 300, the second evaluation result 400, and the third evaluation result 500 are individually referred to, it is possible to more easily confirm the first cyber-attack 1315, the business risk 1330 that may occur due to the first cyber-attack 1315, and the countermeasure information 1335 for the first cyber-attack 1315.

[0112] As an example, consider "DoS attack" numbered "1" in the overall evaluation result 1300. In the above-mentioned first evaluation result 300, the risks of this cyber attack, such as its impact, frequency, and risk score, are determined, but the business risks of the cyber attack and measures against the cyber attack are unclear, so a user checking the evaluation result needs to examine the results while checking each risk evaluation result, and determine appropriate security measures, etc.

[0113] On the other hand, in the overall evaluation result 1300 generated by the embodiment of the present disclosure, the countermeasure information 1335 from the second evaluation result 400 and the information on the business risk 1330 from the third evaluation result 500 are associated with the information on the first cyber attack 1315 from the first evaluation result 300, so that when a "DoS attack" with the number "1" occurs, a business risk of "parts production being stopped and customer trust being lost" may occur, and it can be easily confirmed that the countermeasure "Engineering Workstation-T06-00-01-1: disable unnecessary applications and services" is recommended. Therefore, the user can efficiently determine appropriate security countermeasures, etc. based on the overall evaluation result 1300 without manually comparing multiple evaluation results.

[0114] According to the risk assessment integration means of the embodiment of the present disclosure described above, it is possible to generate an overall assessment result that integrates risk assessment results from a plurality of different risk management support tools. By using the overall assessment result thus generated, it is possible to easily check not only identified risks such as cyber attacks, but also secondary risks (e.g., business risks) that may occur due to the identified risks, and measures against the identified risks. In this way, it is possible to accurately grasp threats to organizations such as companies and efficiently formulate appropriate security measures.

[0115] Although the above describes an example in which the risk assessment integration means according to the embodiment of the present disclosure is implemented in an apparatus, a system, and a method, the present disclosure is not limited thereto, and may be implemented, for example, as a computer program. This computer program may be introduced into a computer system that implements the risk assessment integration device according to the embodiment of the present disclosure from a storage medium of an external device via a network and / or via a portable storage medium.

[0116] For example, one aspect of an embodiment of the present disclosure is a risk assessment integration computer program, in a computer system including a memory for storing processing instructions and a processor, the processing instructions stored in the memory include a step of generating a first evaluation result including first cyber-attack risk information indicating a risk of a first cyber-attack and first impact information indicating an impact of the first cyber-attack, a step of generating a second evaluation result including cyber-attack countermeasure information indicating countermeasures against a second cyber-attack, a step of generating a third evaluation result for each of a plurality of scenarios related to a predetermined business, the third evaluation result including business risk information indicating a business risk that may occur in the scenario and a guide word indicating an impact of the business risk, a step of generating cyber-attack mapping information that matches the first cyber-attack and the second cyber-attack with a third cyber-attack based on kill chain information that characterizes the cyber-attack, and a step of determining a correspondence between the second cyber-attack and the first cyber-attack by comparing the first evaluation result and the second evaluation result based on the cyber-attack mapping information. a process of combining the first evaluation result and the second evaluation result based on the correspondence between the determined second cyber-attack and the first cyber-attack to generate a first interim evaluation result including the first cyber-attack risk information indicating the risk of the first cyber-attack and the cyber-attack countermeasure information indicating the countermeasure against the first cyber-attack; a process of generating impact relationship information indicating the correspondence between the impact of the first cyber-attack and the impact of the business risk; a process of comparing the first evaluation result and the third evaluation result based on the impact relationship information to determine the correspondence between the first impact information and the guide word; a process of combining the first evaluation result and the third evaluation result based on the correspondence between the determined first impact information and the guide word to generate a second interim evaluation result including the first cyber-attack risk information and the business risk information indicating the business risk due to the first cyber-attack;and generating and outputting a comprehensive evaluation result including the cyber-attack countermeasure information indicating countermeasures against the first cyber-attack and the business risk information indicating the business risk due to the first cyber-attack.

[0117] Although the embodiment of the present invention has been described above, the present invention is not limited to the above-described embodiment, and various modifications are possible without departing from the gist of the present invention. [Explanation of symbols]

[0118] 200 Integrated Risk Assessment System 205 users 210 User terminal 215 Interface section 225 Communication Network 230 Risk Assessment Integration Device 232 Cyber ​​Attack Risk Assessment Department 234 Countermeasure Generation Unit 236 Business Risk Assessment Department 238 Integration Department 240 Cyber ​​Attack Mapping Information 242 Impact information

Claims

1. 1. A risk assessment integrator comprising: A processor and a memory, The memory includes: A cyber-attack risk assessment unit that generates a first assessment result including first cyber-attack risk information indicating a risk of a first cyber-attack and first impact information indicating an impact caused by the first cyber-attack; a countermeasure generation unit that generates a second evaluation result including cyber-attack countermeasure information indicating countermeasures against the second cyber-attack; a business risk assessment unit that generates, for each of a plurality of scenarios related to a predetermined business, a third assessment result including business risk information indicating a business risk that may occur in the scenario and a guide word indicating an impact of the business risk; an integration unit that integrates the first evaluation result, the second evaluation result, and the third evaluation result to generate and output a comprehensive evaluation result in which the first cyber-attack risk information indicating the risk of the first cyber-attack, the cyber-attack countermeasure information indicating countermeasures against the first cyber-attack, and the business risk information indicating the business risk due to the first cyber-attack are associated with each other; and processing instructions for causing the processor to function as a risk assessment integration device.

2. The integration unit includes: generating cyber-attack mapping information that associates the first cyber-attack and the second cyber-attack with a third cyber-attack based on cyber-attack diagnosis information that characterizes the cyber-attack; By comparing the first evaluation result and the second evaluation result based on the cyber-attack mapping information, a correspondence relationship between the second cyber-attack and the first cyber-attack is determined; combining the first evaluation result and the second evaluation result based on the determined correspondence between the second cyber-attack and the first cyber-attack, and generating a first intermediate evaluation result including the first cyber-attack risk information indicating the risk of the first cyber-attack and the cyber-attack countermeasure information indicating countermeasures against the first cyber-attack; The risk assessment integration device according to claim 1 .

3. The integration unit includes: generating impact relationship information indicating a correspondence relationship between an impact of the first cyber-attack and an impact of the business risk; determining a correspondence relationship between the first impact information and the guide word by comparing the first evaluation result and the third evaluation result based on the impact relationship information; combining the first evaluation result and the third evaluation result based on the determined correspondence between the first impact information and the guide word, and generating a second intermediate evaluation result including the first cyber-attack risk information and the business risk information indicating the business risk due to the first cyber-attack; The risk assessment integration device according to claim 2 .

4. The integration unit includes: generating the overall evaluation result by integrating the first interim evaluation result and the second interim evaluation result; The risk assessment integration device according to claim 3 .

5. The first impact information is including confidentiality, integrity and availability of information; The risk assessment integration device according to claim 1 .

6. The guide word is Including unauthorized output, excessive output, insufficient output, and unintended output in said business; The risk assessment integration device according to claim 1 .

7. A user terminal; A risk assessment integration system including a risk assessment integration device, The risk assessment integration device comprises: A processor and a memory, The memory includes: A cyber-attack risk assessment unit that generates a first evaluation result including first cyber-attack risk information indicating the risk of a first cyber-attack and first impact information indicating the impact of the first cyber-attack based on input information input via the user terminal; a countermeasure generation unit that generates a second evaluation result including cyber-attack countermeasure information indicating countermeasures against a second cyber-attack based on the input information; a business risk assessment unit that generates, for each of a plurality of scenarios related to a predetermined business, a third assessment result including business risk information indicating a business risk that may occur in the scenario and a guide word indicating an impact of the business risk, based on the input information; an integration unit that integrates the first evaluation result, the second evaluation result, and the third evaluation result to generate a comprehensive evaluation result including the first cyber-attack risk information indicating the risk of the first cyber-attack, the cyber-attack countermeasure information indicating countermeasures against the first cyber-attack, and the business risk information indicating the business risk due to the first cyber-attack, and outputs the generated comprehensive evaluation result to the user terminal; and processing instructions for causing the processor to function as a risk assessment integration system.

8. In a computer system including a memory for storing processing instructions and a processor, the processing instructions stored in the memory include generating a first evaluation result including first cyber-attack risk information indicating a risk of a first cyber-attack and first impact information indicating an impact of the first cyber-attack; generating a second evaluation result including cyber-attack countermeasure information indicating countermeasures against the second cyber-attack; generating a third evaluation result including, for each of a plurality of scenarios related to a predetermined business, business risk information indicating a business risk that may occur in the scenario and a guide word indicating an impact of the business risk; generating cyber-attack mapping information that maps the first cyber-attack and the second cyber-attack to a third cyber-attack based on kill chain information that characterizes the cyber-attacks; A step of determining a correspondence relationship between the second cyber-attack and the first cyber-attack by comparing the first evaluation result and the second evaluation result based on the cyber-attack mapping information; a step of combining the first evaluation result and the second evaluation result based on the determined correspondence between the second cyber-attack and the first cyber-attack, and generating a first intermediate evaluation result including the first cyber-attack risk information indicating the risk of the first cyber-attack and the cyber-attack countermeasure information indicating countermeasures against the first cyber-attack; generating impact relationship information indicating a correspondence relationship between an impact caused by the first cyber-attack and an impact caused by the business risk; determining a correspondence relationship between the first impact information and the guide word by comparing the first evaluation result and the third evaluation result based on the impact relationship information; A process of combining the first evaluation result and the third evaluation result based on the correspondence between the determined first impact information and the guide word, and generating a second intermediate evaluation result including the first cyber-attack risk information and the business risk information indicating the business risk due to the first cyber-attack; generating and outputting a comprehensive evaluation result including the first cyber-attack risk information indicating the risk of the first cyber-attack, the cyber-attack countermeasure information indicating countermeasures against the first cyber-attack, and the business risk information indicating the business risk due to the first cyber-attack by integrating the first interim evaluation result and the second interim evaluation result; The risk assessment integration method according to claim 1, further comprising:

Images