Program, method, information processing device, and system

Abstract

To provide a technique for further smoothly performing audit work of a system.SOLUTION: A program causes a computer including a processor to execute processing relating to an audit of a system. The program causes the computer to execute the steps of: receiving a setting of a rule definition for a system to be audited; generating an audit rule defined in natural language from the set rule definition and an audit checklist defined in data description language; and verifying whether or not the system comply with items in the audit checklist.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present disclosure relates to a program, a method, an information processing device, and a system. [Background technology]

[0002] Recently, there has been an increasing need for system audits that verify systems introduced in-house against certain criteria (standards to be used as norms) and evaluate the validity of the system from a certain perspective, such as its operation, management structure, and security. For example, Literature 1 discloses an audit system that determines whether the system complies with a policy document written in natural language by allowing the user to associate machine-processable rules with the policy document. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Special Publication No. 2006-518080 Summary of the Invention [Problem to be solved by the invention]

[0004] On the other hand, the above technology requires the user to map policies to machine-processable rules, which is a time-consuming task and can lead to problems such as incorrect mapping.

[0005] An object of the present disclosure is to provide a technique for performing system audit work more smoothly. [Means for solving the problem]

[0006] The present disclosure provides a program that causes a computer having a processor to execute processing related to system auditing, the program executing the steps of accepting setting of rule definitions for the system to be audited, generating audit rules defined in a natural language and an audit checklist defined in a data description language from the set rule definitions, and verifying whether the system complies with the items in the audit checklist. Effect of the Invention

[0007] According to the present disclosure, system auditing can be carried out more smoothly. [Brief description of the drawings]

[0008] [Figure 1] FIG. 2 is a diagram for explaining an overview of functions provided by the system 1. [Diagram 2] FIG. 2 is a block diagram showing the hardware configuration of the system 1. [Diagram 3] 2 is a block diagram showing the functional configuration of the terminal device 10. FIG. [Figure 4] FIG. 2 is a block diagram showing the functional configuration of the server 20. [Diagram 5] 2 is a diagram showing a structure of a regulation database 221 stored in a storage unit 220 of a server 20. FIG. [Figure 6] 2 is a diagram showing the structure of a rule definition database 222 stored in a storage unit 220 of a server 20. FIG. [Figure 7] 2 is a diagram showing a structure of an audit rule database 223 stored in a storage unit 220 of a server 20. FIG. [Figure 8] 2 is a diagram showing the structure of an audit checklist database 224 stored in a memory unit 220 of a server 20. FIG. [Figure 9] FIG. 2 is a flow diagram illustrating an example of a processing flow of the system 1. [Figure 10] FIG. 13 is a flow diagram illustrating the flow of an audit rule generation process (S220). [Figure 11] FIG. 2 is a flow diagram illustrating an example of a processing flow of the system 1. [Figure 12] FIG. 13 is a flow diagram illustrating the flow of a check item verification process (S410). [Figure 13] FIG. 3 shows a regulation confirmation screen 310. [Figure 14] FIG. 3 shows a rule definition creation screen 320. [Figure 15] FIG. 3 shows a parameter input screen 330. [Figure 16] FIG. 3 shows an operation status confirmation screen 340. [Figure 17] FIG. 3 shows a regulation confirmation screen 350. [Figure 18] FIG. 3 shows an audit rule confirmation screen 360. [Figure 19] FIG. 3 shows a log data confirmation screen 370. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, an embodiment of the present disclosure will be described with reference to the drawings. In the following description, the same components are denoted by the same reference numerals. Their names and functions are also the same. Therefore, detailed description thereof will not be repeated.

[0010] <1. Embodiment> (1-1. Overview of System 1) An overview of functions provided by a system 1 in this embodiment will be described with reference to Fig. 1. The system 1 includes a terminal device 10 used by a user, and a server 20 (see Fig. 2). The terminal device 10 receives, from the user, settings of rule definitions related to a computer system that is to be the subject of a security audit (hereinafter, referred to as an audit target system).

[0011] 1, a rule definition can be set in association with one or more regulations (predetermined laws, regulations, standards, or specifications). When the server 20 receives a rule definition set by a user from the terminal device 10, the server 20 generates an audit rule and an audit checklist based on the rule definition.

[0012] The audit rules are generated in a natural language such as Japanese or English, and define the rules to be applied to the audit target system. The audit checklist is generated in a computer language such as a data description language. The server 20 verifies the audit target system by comparing the log data output by the audit target system with the output audit checklist.

[0013] In this way, the system 1 generates audit rules in natural language and audit checklists in computer language based on the rule definitions set by the user, and verifies the audit target system based on the audit checklists. With such specifications, it becomes possible to perform the audit work of the system more smoothly. Details will be explained below.

[0014] (1-2. Hardware configuration of System 1) Fig. 2 is a block diagram showing an example of a hardware configuration of the system 1. The system 1 includes a terminal device 10 and a server 20. The terminal device 10 and the server 20 are communicatively connected via a network 30. Note that in Fig. 2, the system 1 is illustrated as including one terminal device 10 from the viewpoint of visibility, but the number of terminal devices 10 is not limited to this example, and may be two or more.

[0015] In this embodiment, a collection of multiple devices may be one server 20. The method of allocating multiple functions required to realize the server 20 according to this embodiment to one or multiple pieces of hardware can be appropriately determined in consideration of the processing capacity of each piece of hardware and / or the specifications required for the server 20.

[0016] The terminal device 10 is realized as a mobile terminal such as a smartphone or a tablet terminal. The terminal device 10 includes a communication IF (Interface) 12, an input device 13, an output device 14, a memory 15, a storage 16, and a processor 19.

[0017] The communication IF 12 is an interface for inputting and outputting signals so that the terminal device 10 can communicate with an external device.

[0018] The input device 13 is a device (for example, a touch panel, a microphone, etc.) for receiving an input operation from a user.

[0019] The output device 14 is a device (such as a display and a speaker) for presenting information to a user.

[0020] The memory 15 is for temporarily storing programs and data to be processed by the programs, and is a volatile memory such as a DRAM (Dynamic Random Access Memory).

[0021] The storage 16 is for storing data, and is, for example, a flash memory or a hard disk drive (HDD).

[0022] The processor 19 is hardware for executing an instruction set written in a program, and is composed of an arithmetic unit, a register, peripheral circuits, and the like.

[0023] The server 20 is a computer capable of communicating with the terminal device 10 via a network 30 such as the Internet, and may be realized as a so-called cloud server, or may be realized as an on-premise server installed in a specific facility, etc. The server 20 includes a communication IF 22, an input / output IF 24, a memory 25, a storage 26, and a processor 29.

[0024] The input / output IF 24 is an interface for connecting an input / output device when performing some input operation on the server 20 or when outputting information from the server 20.

[0025] The communication IF 22, memory 25, storage 26 and processor 29 are configured similarly to the communication IF 12, memory 15, storage 16 and processor 19 of the terminal device 10, and therefore description thereof will not be repeated.

[0026] (1-3. Functional configuration of terminal device 10) Fig. 3 is a block diagram showing an example of a functional configuration of the terminal device 10. As shown in Fig. 3, the terminal device 10 includes an input device 13, an output device 14, a communication unit 150, an imaging unit 160, an audio processing unit 170, a storage unit 180, and a control unit 200. The blocks included in the terminal device 10 in Fig. 3 are electrically connected to each other via a bus or the like, for example.

[0027] The communication unit 150 performs processing such as modulation and demodulation processing for the terminal device 10 to communicate with other devices. The communication unit 150 performs transmission processing on a signal generated by the control unit 200 and transmits the signal to the outside (for example, another terminal device 10). The communication unit 150 performs reception processing on a signal received from the outside and outputs the signal to the control unit 200.

[0028] The input device 13 is a device for inputting instructions or information by a user who operates the terminal device 10. The input device 13 is realized, for example, by a touch-sensitive device 131 or the like in which instructions are input by touching an operation surface. The input device 13 may include a keyboard or a mouse. The input device 13 converts instructions or information input by a user into an electrical signal, and outputs the electrical signal to the control unit 200. The input device 13 may include, for example, a receiving port that receives an electrical signal input from an external input device.

[0029] The output device 14 is a device for presenting information to a user who operates the terminal device 10. The output device 14 is realized, for example, by a display 141 or the like. The display 141 displays data according to the control of the control unit 200. The display 141 is realized, for example, by an LCD (Liquid Crystal Display) or an organic EL (Electro-Luminescence) display or the like.

[0030] The imaging unit 160 includes a camera, receives light with a light receiving element, and inputs the received light as an imaging signal to capture an image of the surroundings of the terminal device 10.

[0031] The audio processing unit 170 performs, for example, digital-analog conversion processing of an audio signal. The audio processing unit 170 converts a signal provided from the microphone 171 into a digital signal and provides the converted signal to the control unit 200. The audio processing unit 170 also provides the audio signal to the speaker 172. The audio processing unit 170 is realized, for example, by a processor for audio processing. The microphone 171 accepts audio input and provides an audio signal corresponding to the audio input to the audio processing unit 170. The speaker 172 converts the audio signal provided from the audio processing unit 170 into audio and outputs the audio to the outside of the terminal device 10.

[0032] The storage unit 180 is realized by, for example, the memory 15, the storage 16, etc., and stores data and programs used by the terminal device 10.

[0033] The control unit 200 is realized by the processor 19 reading a program stored in the storage unit 180 and executing instructions included in the program. The control unit 200 controls the operation of the terminal device 10. The control unit 200 performs the functions of an operation reception unit 201, a transmission / reception unit 202, and a display control unit 203 by operating according to the program.

[0034] The operation reception unit 201 performs processing for receiving instructions or information input from the input device 13. Specifically, for example, the operation reception unit 201 receives information based on instructions input from the touch-sensitive device 131 or the like.

[0035] The transmitting / receiving unit 202 performs processing for the terminal device 10 to transmit and receive data to and from an external device in accordance with a communication protocol.

[0036] The display control unit 203 controls the display on the display 141 of information to be notified to the user.

[0037] (1-4. Functional configuration of server 20) 4, the server 20 includes a communication unit 210, a storage unit 220, and a control unit 230. The blocks included in the server 20 in FIG 4 are electrically connected to each other via a bus or the like, for example.

[0038] The communication unit 210 performs processing for the server 20 to communicate with external devices.

[0039] The storage unit 220 is realized by, for example, the memory 25 and the storage 26, and stores data and programs used by the server 20. As shown in Fig. 4, the storage unit 220 stores, for example, a regulation database (Data Base / DB) 221, a rule definition database 222, an audit rule database 223, and an audit checklist database 224.

[0040] The regulation database 221 is a database that stores data related to regulations. Regulations are rules (or types of rules) that are predetermined for a given certification, and include laws, regulations, standards, and specifications. For example, if the system to be audited is operated in accordance with a specific regulation, the system can receive certification corresponding to the regulation. The data structure of the regulation database 221 will be described later.

[0041] The rule definition database 222 is a database that stores data related to rule definitions. A rule definition means a collection of rules that is set by a user and applied to an audit target system. One or more rule definitions are applied to one audit target system. A user can associate one or more regulations with one rule definition. The data structure of the rule definition database 222 will be described later.

[0042] The audit rule database 223 is a database that stores data related to audit rules. An audit rule is a specific rule that is generated based on a rule definition and is applied to an audit target system. The contents of the audit rule are written in a natural language such as Japanese or English. The data structure of the audit rule database 223 will be described later.

[0043] The audit checklist database 224 is a database that stores data related to audit checklists. An audit checklist is a list of check items that is generated based on rule definitions and is used when verifying an audit target system. The contents of the audit checklist are described in a data description language such as JSON (JavaScript Object Notation). The data structure of the audit checklist database 224 will be described later.

[0044] The control unit 230 is realized by the processor 29 reading a program stored in the storage unit 220 and executing instructions included in the program. As an example, the control unit 230 performs functions as a transmission / reception module 231, a generation module 232, and a verification module 233 by operating according to the program.

[0045] The transmission / reception module 231 performs processing for the server 20 to transmit and receive data to and from external devices in accordance with a communication protocol.

[0046] The generation module 232 generates audit rules written in a natural language and audit checklists written in a data description language based on rule definitions set by the user. The process of the generation module 232 will be described in detail later.

[0047] The verification module 233 verifies the audit target system by comparing the audit checklist generated by the generation module 232 with log data (data recording the operation and status of the system) output by the audit target system. The details of the processing of the verification module 233 will be described later.

[0048] (1-5. Data Structure) 5 to 8, the data structure of the database used in the system 1 will be described. Note that the data structure described below is merely an example, and does not exclude the possession of other databases and data items.

[0049] FIG. 5 is a diagram showing an example of the data structure of the regulation database 221 stored in the storage unit 220 of the server 20. As shown in FIG.

[0050] As shown in FIG. 5, a record of the regulation database 221 includes an item "regulation ID", an item "name", an item "regulation 1", an item "regulation 2", an item "registration date and time", an item "update date and time", and the like.

[0051] The item “regulation ID” is identification information for identifying a regulation, and is a primary key for uniquely identifying a record in the regulation database 221.

[0052] The item "Name" is information regarding the name of the regulation.

[0053] The items "Regulation 1" and "Regulation 2" are information related to the contents of the regulations included in the regulations. The number of items can be set appropriately according to the number of regulations included in the regulations.

[0054] The item “registration date and time” is information regarding the date and time when the record of the regulation in question was registered in the regulation database 221.

[0055] The item "Update Date and Time" is information regarding the date and time when the regulation record was updated.

[0056] The regulation database 221 may be configured so that, when a new regulation is registered by the administrator of the system 1, a record corresponding to the new regulation is added to the regulation database 221. In addition, each item of the record in the regulation database 221 may be appropriately updated by the administrator of the system 1 in accordance with the revision of the regulation.

[0057] FIG. 6 is a diagram showing an example of the data structure of the rule definition database 222 stored in the storage unit 220 of the server 20. As shown in FIG.

[0058] As shown in FIG. 6, a record of the rule definition database 222 includes an item "rule definition ID," an item "corresponding regulation," an item "rule definition 1," an item "setting parameter 1," an item "audit rule," an item "audit checklist," an item "registration date and time," an item "update date and time," etc.

[0059] The item “rule definition ID” is identification information for identifying a rule definition, and is a primary key for uniquely identifying a record in the rule definition database 222 .

[0060] The item "Corresponding Regulation" is information about the regulation associated with the rule definition.

[0061] The item "rule definition 1" is information about the content of the rule included in the rule definition. The number of items can be set appropriately according to the number of rules included in the rule definition.

[0062] The item "Setting parameters 1" is information on parameters set by the user for the rules included in the rule definition. The number of items can be set appropriately according to the number of parameters set for the rules included in the rule definition.

[0063] The item "audit rule" is information for identifying an audit rule generated based on the rule definition, and the item "audit rule ID" of the audit rule database 223 is held as a foreign key.

[0064] The item "audit checklist" is information for identifying an audit checklist generated based on the rule definition, and the item "audit checklist ID" of audit checklist database 224 is held as a foreign key.

[0065] The item “registration date and time” is information about the date and time when the record of the rule definition in question was registered in the rule definition database 222 .

[0066] The item "Update Date and Time" is information about the date and time when the record of the rule definition in question was updated.

[0067] The rule definition database 222 may be configured so that, when a rule definition setting is received from a user (administrator of the audit target system), a record corresponding to the rule definition is added to the rule definition database 222. Also, each item of the record in the rule definition database 222 may be updated by the user as appropriate.

[0068] FIG. 7 is a diagram showing an example of the data structure of the audit rule database 223 stored in the storage unit 220 of the server 20. As shown in FIG.

[0069] As shown in FIG. 7, a record in the audit rule database 223 includes an item "audit rule ID", an item "rule 1", an item "rule 2", an item "rule 3", an item "registration date and time", an item "update date and time", and the like.

[0070] The item “audit rule ID” is identification information for identifying an audit rule, and is a primary key for uniquely identifying a record in the audit rule database 223 .

[0071] The items "Rule 1," "Rule 2," and "Rule 3" are information about the contents of each rule included in the audit rule. The number of items can be set appropriately according to the number of rules included in the audit rule.

[0072] The item “registration date and time” is information regarding the date and time when the record of the audit rule in question was registered in the audit rule database 223 .

[0073] The item "Update Date and Time" is information regarding the date and time when the record of the audit rule in question was updated.

[0074] The audit rule database 223 may be configured so that a record corresponding to an audit rule is added when the audit rule is generated by the generation module 232. Also, when each item of a record in the rule definition database 222 is updated, the generation module 232 may generate a record of the audit rule in the audit rule database 223 that reflects the updated contents.

[0075] FIG. 8 is a diagram showing an example of the data structure of the inspection checklist database 224 stored in the storage unit 220 of the server 20. As shown in FIG.

[0076] As shown in Figure 8, a record in the audit checklist database 224 includes an item "audit checklist ID," an item "check item 1," an item "check item 2," an item "check item 3," an item "registration date and time," an item "update date and time," etc.

[0077] The item “audit checklist ID” is identification information for identifying an audit checklist, and is a primary key for uniquely identifying a record in audit checklist database 224 .

[0078] The items "Check item 1," "Check item 2," and "Check item 3" are information about the contents of the individual check items included in the audit checklist. The number of items can be set appropriately depending on the number of check items included in the audit checklist.

[0079] The item “registration date and time” is information regarding the date and time when the record of the audit checklist in question was registered in audit checklist database 224 .

[0080] The item "Update Date and Time" is information regarding the date and time when the record of the audit checklist was updated.

[0081] The audit checklist database 224 may be configured so that a record corresponding to the audit checklist is added when the audit checklist is generated by the generation module 232. In addition, when each item of a record in the rule definition database 222 is updated, the generation module 232 may generate in the audit checklist database 224 a record of the audit checklist that reflects the updated contents.

[0082] (1-6. Processing flow) An example of the process flow of the system 1 will be described below. First, the process flow for generating an audit rule and an audit checklist will be described with reference to Fig. 9 and Fig. 10. In step S110 of Fig. 9, the terminal device 10 accepts the setting of a rule definition from the user.

[0083] Fig. 13 is a diagram showing a regulation confirmation screen 310 displayed in step S110. The regulation confirmation screen 310 has regulation information 311, audit rule information 312, and a rule definition creation icon 313. Note that the "company regulations" in Fig. 13 and the following drawings are an example of the "audit rules" in this disclosure.

[0084] The regulation information 311 displays the name of the regulation selected by the user, and the names and contents of the rules included in the regulation. The audit rule information 312 displays information on the audit rule (company regulation) corresponding to the rule displayed in the regulation information 311. When the user presses the rule definition creation icon 313 displayed in the audit rule information 312, a rule definition creation screen 320 is displayed.

[0085] 14, rule definition creation screen 320 has a rule definition selection icon 321 and a next page progress icon 322. The user selects setting items for the rule definition by pressing rule definition selection icon 321. When the user presses next page progress icon 322, a parameter input screen 330 is displayed.

[0086] 15, a parameter input screen 330 has a parameter input area 331 and a create icon 332. The user sets the content of the rule definition by inputting parameters in a predetermined field in the parameter input area 331. Specifically, as the parameters, targets or various numerical values ​​in the operation of the audit target system may be set, or conditions (number of times, frequency, period) related to verification in the audit may be set.

[0087] As an example, the timing of performing the verification process may be set as a parameter. Specifically, the timing may be a specification for performing the verification constantly, or a specification for performing the verification periodically (i.e., at predetermined intervals). Alternatively, the parameter may be set so that the verification process is performed at the timing when an instruction to perform the verification process is received from a user.

[0088] The parameter input area 331 may be configured to display reference information 331a such as parameter conditions and average values ​​of set parameters, so that the user can refer to them when setting parameters. With this configuration, even a user who is not familiar with the regulations can easily generate a rule definition in which appropriate parameters are set. When the user presses the create icon 332, the content of the set rule definition is registered, and the subsequent step S120 is executed.

[0089] Furthermore, a condition for validity may be set for each parameter input in the parameter input area 331, and parameters that do not satisfy the condition may not be registered. By adopting such specifications, it is possible to ensure that the audit rules and audit checks generated from the rule definitions reliably satisfy regulations.

[0090] 9, in step S120, the transmitting / receiving unit 202 of the terminal device transmits the content of the rule definition set by the user to the server 20. In step S210, the transmitting / receiving module 231 of the server 20 receives the setting content from the terminal device .

[0091] In step S220, the generation module 232 of the server 20 executes an audit rule generation process. As shown in Fig. 10, in the audit rule generation process (S220), steps S221 and S222 are executed.

[0092] 10, the generation module 232 of the server 20 generates an audit rule based on the rule definition set by the user. Also, in step S222, the generation module 232 of the server 20 generates an audit checklist based on the rule definition set by the user. In this manner, in this embodiment, the audit rule and the audit checklist are generated based on the rule definition set by the user, so that consistency between the audit rule and the audit checklist is ensured.

[0093] Furthermore, since the generation module 232 generates audit rules and audit checklists by linking them with the regulations associated with the rule definitions, it becomes easy to understand which provision of the regulations each item of the audit checklist (or audit rule) corresponds to in the subsequent verification process. The generation module 232 stores the rule definitions set by the user and the generated audit rules and audit checklists in the rule definition database 222, the audit rule database 223, and the audit checklist database 224 of the storage unit 220.

[0094] In this embodiment, the generation of the audit rule (S221) and the generation of the audit checklist (S222) are executed in parallel at the same time, but this is not limited to this. For example, the generation of the audit rule (S221) may be executed before the generation of the audit checklist (S222), or vice versa.

[0095] 9, when the audit rule generation process (S220) is completed, in step S230, the transmitting / receiving module 231 of the server 20 transmits the generated audit rule to the terminal device 10. In step S130, the transmitting / receiving unit 202 of the terminal device 10 receives the audit rule from the server 20.

[0096] In step S140, the terminal device 10 presents the audit rule received from the server 20 to the user by displaying it on the display 141. The user checks the audit rule generated in natural language based on the rule definition set by the user.

[0097] Next, a verification process of the audit target system based on the generated audit checklist will be described with reference to Fig. 11. As described above, the verification process may be performed at a timing determined based on parameters set by the user.

[0098] A check item verification process is executed in step S410 in Fig. 11. As shown in Fig. 12, in the check item verification process (S410), steps S411 to S413 are executed.

[0099] 12, the verification module 233 of the server 20 acquires log data output by the audit target system. The log data may be, for example, a security log related to the operation of security software or a communication log related to the operation of a communication module.

[0100] In step S412, the verification module 233 of the server 20 compares the acquired log data with the audit checklist to verify whether the audit target system complies with the items in the audit checklist. In this embodiment, since the audit checklist is generated in a data description language, the verification module 233 can execute the comparison between the log data and the audit checklist. In step S413, the verification module 233 of the server 20 generates verification result data based on the comparison result.

[0101] 11, when the check item verification process (S410) ends, in step S420, the transmitting / receiving module 231 of the server 20 transmits the verification result data to the terminal device 10. In step S310, the transmitting / receiving unit 202 of the terminal device 10 receives the verification result data.

[0102] In step S320, the terminal device 10 presents the verification result data received from the server 20 to the user by displaying it on the display 141. The user checks the verification result data for the audit target system.

[0103] Fig. 16 is a diagram showing an example of an operation status confirmation screen 340 showing the operation status of the audit target system as verification result data. As shown in Fig. 16, the operation status confirmation screen may be configured to evaluate the coverage rate and compliance rate as the degree of achievement of the regulation. Here, the coverage rate is a ratio indicating the extent to which the audit rule generated from the rule definition set by the user covers the corresponding regulation. Also, the compliance rate is a ratio indicating the extent to which the operation of the audit target system shown by the log data complies with the regulation.

[0104] 17 is a diagram showing an example of a regulation confirmation screen 350 that shows the coverage rate and compliance rate for each of a plurality of regulations associated by rule definitions as verification result data. By looking at the regulation confirmation screen 350, the user can easily check which regulations the audit target system is complying with (or not complying with), and the degree of compliance. Furthermore, by selecting a regulation displayed on the regulation confirmation screen 350, if there is a defect in an item on the audit checklist, it is also possible to specify which rule of the regulation the item does not comply with.

[0105] 18 is a diagram showing an example of an audit rule confirmation screen 360 for confirming the pass / fail result (whether or not each audit rule is complied with) as verification result data. By looking at the audit rule confirmation screen 360, the user can easily confirm which audit rules the audit target system is complying with (or not complying with), and to what degree.

[0106] 19 is a diagram showing an example of a log data confirmation screen 370 for confirming log data as verification result data. By looking at the log data confirmation screen 370, the user can confirm which log data is to be saved and what kind of verification is being performed based on which log data.

[0107] (1-7.Summary) As described above, in this embodiment, the system 1 executes the steps of accepting the setting of the rule definition for the audit target system, generating the audit rule defined in a natural language and the audit checklist defined in a data description language from the set rule definition, and verifying whether the system 1 conforms to the items in the audit checklist. With this configuration, the system generates a consistent audit rule and audit checklist based on the rule definition set by the user, so that the troublesome task of matching the audit rule and the audit checklist is not required, and the audit work can be performed more smoothly. The audit rule in this embodiment can also be used as a so-called company rule. Specifically, it may be used under the name of "basic rules for information security" or "system management rules". In other words, by using the system 1, it is possible to efficiently create company rules necessary for the operation of an organization.

[0108] In addition, in this embodiment, since the audit checklist is generated in a computer language such as a data description language, it is possible to automatically and immediately determine whether the log data to be verified is normal or abnormal, thereby speeding up the audit work. Note that the audit checklist can use a computer language that matches the file format of the log data as appropriate.

[0109] Furthermore, since the rule definition in this embodiment can be reused after being set, a rule definition set in one organization can be used in another organization after appropriately modifying necessary parts. Using the rule definition in this manner can save the effort of creating audit rules for a system introduced in an organization. Also, it is possible to grasp the extent to which a specific rule definition is adopted in other organizations. For example, a system administrator who creates audit rules for a certain organization can grasp the adoption status of rule definitions in other organizations, set a rule definition that is comparable to other organizations, and generate audit rules and audit checklists based on the rule definition.

[0110] <2 Other embodiments> Although the embodiment and its modified examples of the present invention have been described above, the application of the present disclosure is not limited to the above. For example, the system 1 in the present embodiment is intended for a security audit of an audit target system, but can also be applied to audits of computer systems other than security audits. In addition, the audit target system is not limited to a computer system, and a system other than a computer system may be the audit target. As an example, the audit target system may be an organization such as a company or a department, a base such as a building, an office, or a sales office, or a process (or a collection of processes) such as a business process.

[0111] In the above embodiment, the check item verification process (S410) uses the log data output by the audit target system to perform the verification process, but the present invention is not limited to this specification. For example, the verification process may be performed in such a way that the log file to be verified is input by the user at the timing of executing the verification process.

[0112] The system 1 may also be designed to accept the verification results by the user. That is, when the user manually verifies the audit target system based on a checklist created in natural language, the system 1 may be designed to accept the input of the verification results and evaluate the degree of achievement of the provisions of the regulations. By adopting such specifications, it is possible to realize a combination of the verification process by the verification module 233 of the system 1 and a manual check by the user for check items that are not suitable for checking by the system.

[0113] In the above embodiment, the administrator of the audit target system is assumed to be the user who creates the rule definition, but the present invention is not limited to this. For example, a person in charge of a software or hardware vendor may create the rule definition. As an example, a person in charge of a PC (Personal Computer) vendor may set the security settings recommended for the company's product as a rule definition and distribute it to users who use the product. By operating in this manner, the user who uses the product can check whether the settings based on the vendor's recommendation have been made, and can also improve the rule definition recommended by the vendor by adding their own rules.

[0114] The terminal device 10 may be a tablet terminal, a mobile terminal such as a smartphone, or may be realized by a desktop PC, a laptop PC, etc. In this case, the terminal device 10 may be realized by installing software on a home PC or the like, and may be configured to accept operations of a mouse or the like.

[0115] In addition, sharing of specific information via communication lines is mainly performed via a WAN such as the Internet, but between information processing devices, communication may also be performed only via short-range wireless communication such as Bluetooth (registered trademark) and infrared communication without using a WAN.

[0116] In addition, in the above embodiment, an example of a form in which each function is provided by the terminal device 10 or the server 20 is described, but this is not limited to this form, and some or all of the functions may be provided by the terminal device 10, the server 20, or both the terminal device 10 and the server 20 in a form different from the above embodiment.

[0117] In addition, in the above embodiment, each step described as being executed by the terminal device 10 may be executed by the server 20, and each step described as being executed by the server 20 may be executed by the server 20.

[0118] In the above embodiment, a part or all of the database stored in the storage unit 220 of the server 20 may be stored in the terminal device 10. Alternatively, a part or all of the database may be stored in another storage medium such as an external hard disk, and the control unit 230 of the server 20 may refer to it as necessary.

[0119] Furthermore, the present invention may be realized as a program that causes an information processing device to execute the functions of the above-mentioned terminal device 10 or server 20, or as a computer-readable non-transitory recording medium that stores the program.

[0120] <Additional Notes> The matters described in the above embodiments will be supplemented below. (Appendix 1) A program that causes a computer having a processor to execute processing related to system auditing, the program executing the steps of: accepting the setting of rule definitions for the system to be audited; generating audit rules defined in natural language and an audit checklist defined in computer language from the set rule definitions; and verifying whether the system complies with the items in the audit checklist. (Appendix 2) 2. The program according to claim 1, wherein the step of accepting settings accepts input of parameters required in the rule definition. (Appendix 3) 3. The program of claim 2, wherein the parameters include conditions related to verification. (Appendix 4) 3. The program of claim 2, wherein the parameters include information on the timing of executing the verification. (Appendix 5) The program according to claim 1, wherein in the generating step, the audit rule and the audit checklist are generated by linking them to a regulation corresponding to the rule definition. (Appendix 6) The program according to claim 1, wherein the verifying step performs verification using log data output by the system. (Appendix 7) 2. The program according to claim 1, wherein the verifying step accepts input of a file to be verified. (Appendix 8) The program described in Appendix 1, wherein the verifying step identifies which provision of the regulations is not met if there is an deficiency in an item of the checklist. (Appendix 9) A program for evaluating the degree of achievement of the provisions of the regulations, as described in Appendix 8. (Appendix 10) 2. The program of claim 1, further comprising a step of accepting a verification result by a user.

[0121] Although several embodiments of the present disclosure have been described above, these embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and modifications are within the scope of the invention and its equivalents as described in the claims, as well as the scope and spirit of the invention. [Explanation of symbols]

[0122] 1: system, 10: terminal device, 13: input device, 14: output device, 15: memory, 16: storage, 19: processor, 20: server, 25: memory, 26: storage, 29: processor, 30: network, 131: touch-sensitive device, 141: display, 150: communication unit, 160: imaging unit, 170: audio processing unit, 171: microphone, 172: speaker, 180: storage unit, 200: control unit, 201: operation reception unit, 202: transmission / reception unit, 203: display control unit, 210: communication unit, 220: storage unit, 221: regulation database, 222: rule definition database, 223: audit rule rule database, 224: audit checklist database, 230: control unit, 231: transmission / reception module, 232: generation module, 233: verification module, 310: regulation confirmation screen, 311: regulation information, 312: audit rule information, 313: rule definition creation icon, 320: rule definition creation screen, 321: rule definition selection icon, 322: next page progress icon, 330: parameter input screen, 331: parameter input area, 332: creation icon, 340: operation status confirmation screen, 350: regulation confirmation screen, 360: audit rule confirmation screen, 370: log data confirmation screen.

Claims

1. A program for causing a computer having a processor to execute a process related to a system audit, receiving a rule definition setting for a system to be audited; generating audit rules defined in a natural language and audit checklists defined in a computer language from the set rule definitions; verifying whether the system complies with the audit checklist items; A program that executes the following.

2. In the step of accepting the setting, The program according to claim 1 , further comprising: an input of a parameter required for the rule definition.

3. The program according to claim 2 , wherein the parameters include conditions related to verification.

4. The program according to claim 2 , wherein the parameters include information on a timing for executing the verification.

5. In the generating step, The program according to claim 1 , wherein the audit rule and the audit checklist are generated in association with a regulation associated with the rule definition.

6. In the step of verifying, The program according to claim 1 , wherein verification is performed using log data output by the system.

7. In the step of verifying, 2. The program according to claim 1, further comprising: an input of a file to be verified.

8. In the step of verifying, 2. The program according to claim 1, which, if there is a deficiency in an item of the checklist, identifies which provision of the regulations is not met.

9. 9. The program according to claim 8, which evaluates the degree of achievement of provisions of regulations.

10. The program according to claim 1 , further comprising the step of accepting a verification result by a user.

11. A computer implemented method comprising a processor and a memory, the processor performing all of the steps performed in the invention according to claim 1.

12. 13. An information processing device for running a computer comprising a processor and a memory, the information processing device causing the processor to execute all of the steps executed in the invention according to claim 1.

13. A system comprising means for executing all the steps performed in the invention according to claim 1.

Images