Security management system, security management method, and program

Abstract

To appropriately perform notification of information on security in security measures.SOLUTION: A security management system includes: an artifact management device that manages a tag for identifying an artifact which is a component for constituting a service and a manager of the artifact; and a security information notification device that notifies a specific device of a tag regarding a specific artifact and security information regarding the specific artifact.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a technique for managing security-related information. [Background technology]

[0002] Security-related information (such as vulnerability information, cyber risk information, and cyber threat intelligence) may be used for cybersecurity measures. For example, patch management using vulnerability information is one example of a cybersecurity measure.

[0003] When the service development team and the security countermeasures team are separate, cybersecurity measures require processes for "notifying security information," "implementing security measures based on the notifications," and "understanding the status of security measure implementation."

[0004] One method for making these processes work well is to use a software bill of materials (SBOM) to manage cybersecurity. For example, in the case of vulnerability management, SBOM can be used to notify service development teams of vulnerability information related to the software they develop. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2016-218964 A Summary of the Invention [Problem to be solved by the invention]

[0006] However, cybersecurity measures using SBOM focus only on software components, and not on the background information on how those software components are used. Therefore, even if problem areas are identified, there is a problem that the service development team cannot determine the priority of the service or the operation cost. If security information cannot be properly notified, neither the implementation of security measures nor the understanding of the implementation status of the measures can be performed properly, so additional work is required for each service development team to investigate and supplement their own unique context.

[0007] The present invention has been made in consideration of the above-mentioned points, and has an object to provide a technique that enables appropriate notification of security-related information as part of security measures. [Means for solving the problem]

[0008] According to the disclosed technology, there is provided an artifact management device that manages tags that identify artifacts that are components that configure a service and managers of the artifacts; a security information notification device that notifies a specific device of the tag for a specific artifact and security information for the specific artifact; A security management system is provided, comprising: Effect of the Invention

[0009] According to the disclosed technology, a technology is provided that enables appropriate notification of security-related information as part of security measures. [Brief description of the drawings]

[0010] [Figure 1] 1 is a diagram showing an example of the overall configuration of a security management system according to an embodiment of the present invention; [Diagram 2] FIG. 13 is a diagram illustrating an example of an artifact tag. [Diagram 3]FIG. 2 is a diagram for explaining an outline of the operation of the security management system. [Figure 4] FIG. 2 is a diagram for explaining an outline of the operation of the security management system. [Diagram 5] FIG. 2 is a diagram showing a processing sequence of the security management system. [Figure 6] FIG. 13 is a diagram for explaining an example of matching. [Figure 7] FIG. 13 is a diagram for explaining an example of matching. [Figure 8] FIG. 13 is a diagram for explaining an example of matching. [Figure 9] FIG. 13 is a diagram for explaining an example of matching. [Figure 10] FIG. 2 is a diagram showing a processing sequence of the security management system. [Figure 11] FIG. 2 is a diagram showing a processing sequence of the security management system. [Figure 12] FIG. 2 is a diagram illustrating an example of a functional configuration of an artifact management device 100. [Figure 13] FIG. 2 is a diagram illustrating an example of a functional configuration of the security topic management device 200. [Figure 14] FIG. 2 is a diagram illustrating an example of a functional configuration of a security alert notification device 300. [Figure 15] FIG. 4 illustrates an example of a functional configuration of a ticket management device 400. [Figure 16] FIG. 2 illustrates an example of a hardware configuration of the apparatus. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, an embodiment of the present invention (the present embodiment) will be described with reference to the drawings. The embodiment described below is merely an example, and the embodiment to which the present invention is applied is not limited to the following embodiment.

[0012] In the following, problems associated with the technology of the present embodiment will be described in detail, and then the technology of the present embodiment will be described.

[0013] (About the assignment) There are two main challenges in cybersecurity measures using SBOM:

[0014] (1) By focusing only on software components, the context of component management is lost.

[0015] (2) There may be components other than software components that make up a service, but SBOM cannot manage components other than software components.

[0016] In relation to the two challenges mentioned above, we will explain the challenges associated with each of the three processes: "notifying security information," "implementing security measures based on the notifications," and "understanding the implementation status of security measures."

[0017] First, we will explain the issue regarding (1).

[0018] As mentioned above, since SBOM focuses only on software components, the context of software component management (package manager) disappears. Specifically, it is as follows.

[0019] The actual software components are software packages and libraries. Software packages and libraries themselves may be distributed with dependencies on other software components, and a method for resolving these dependencies is required to install or uninstall a software component.

[0020] In service development, it is common to use a "package manager" to manage software components in order to automatically resolve dependencies. However, cybersecurity measures using SBOM focus only on software components and do not use manager information for notifications. This leads to the following issues:

[0021] Regarding security notifications: Dependency resolution is a manager-specific event, and if the manager cannot be identified, the state of the software component may not be uniquely determined. This is because the versions and types of dependent libraries installed and the options used may differ depending on the manager.

[0022] Regarding implementation of security measures based on notifications: The lack of manager information means that information about the manager that is the target of operations is also missing in security measures. If a service developer uses multiple managers, it will be necessary to identify which manager manages a software component and then perform operations (such as version updates) via that manager, which increases the amount of work required.

[0023] Regarding understanding the implementation status of security measures: The existence of software components can be identified using SBOM alone, but without manager information, the software component management process becomes unclear. For example, if a vulnerable software component is installed due to the manager during the installation process, it may be difficult to identify the cause. Collecting manager information makes it possible to perform security risk analysis that takes into account the software component management process.

[0024] Next, we explain the issues regarding (2).

[0025] As mentioned above, there are cases where the components that make up a service are not software components. For example, in the case of network services, there are service configurations in which network appliances are deployed for traffic control and then controlled by software, but cybersecurity measures using SBOM cannot fully cover such services. In particular, vulnerability information is often disclosed not on a software component basis but on a product-by-product basis, so a system that can comprehensively cover not only software components but also dedicated appliances is required.

[0026] Furthermore, even when managing things other than software components, the problem of the context of component management being lost similarly occurs.

[0027] (Outline of the embodiment) The following (1) to (4) will be described as the main parts of the technique according to the present embodiment.

[0028] (1) In this embodiment, the components that make up a service are managed in units called "artifacts." Conventionally, only software components could be managed, but this makes it possible to manage hardware products in the same way as software components.

[0029] (2) Artifacts including manager information are managed. Conventionally, the manager information of software components is lost, but in this embodiment, the manager information is not lost. In addition, it is possible to perform risk analysis on the management process of software components by using the manager information.

[0030] (3) In this embodiment, security information is managed using artifacts including manager information, and security alerts are notified. Conventionally, only alerts could be sent to software components, but in this embodiment, security alerts can be sent including hardware products. Also, it becomes possible to notify problems that occur not only in artifacts but also in the combination of artifacts and managers.

[0031] (4) In this embodiment, it is possible to perform ticket management using artifacts that include manager information. Conventionally, in the process of implementing security measures, it was necessary to check the manager to be operated again, but in this embodiment, it is possible to reduce the time and effort required for the confirmation work.

[0032] (Example of overall configuration of security management system) An example of the overall configuration of a security management system according to this embodiment is shown in Fig. 1. As shown in Fig. 1, the security management system according to this embodiment includes an artifact management device 100, a security topic management device 200, a security alert notification device 300, and a ticket management device 400, which are connected to a network 500. Since security topics and security alerts are both examples of security information, the security topic management device 200 and the security alert notification device 300 may also be called the security information management device 200 and the security information notification device 300, respectively.

[0033] A plurality of terminals 10 are connected to a network 500, and each terminal 10 can access any of the artifact management device 100, the security topic management device 200, the security alert notification device 300, and the ticket management device 400 via the network 500. Each terminal 10 is a terminal of a service development team, a terminal of a security countermeasures team (e.g., a security officer), etc.

[0034] (About artifacts and managers) The artifacts and the manager in this embodiment will be described. In this embodiment, the components that make up a service are called artifacts. The artifacts may be software components or hardware components.

[0035] The information that identifies an artifact is called an artifact tag. An example of an artifact tag is shown in Figure 2.

[0036] 2, the artifact tag in this embodiment is information that combines the name of the artifact (Artifact Name), the storage location of the artifact (Artifact Registry), and the artifact manager (Artifact Manager). Note that the actual information is, for example, information that has a Key:Value structure.

[0037] Note that when there is no artifact manager, information consisting of the artifact name and artifact registry is also called an artifact tag. An artifact tag may also be simply called a tag or an associated tag. In the following, an artifact manager is called a manager.

[0038] In the example shown in FIG. 2, the artifact is yaml (an example of a software component), the storage location is npm (an example of a package registry), and the manager is npm (an example of a package manager).

[0039] Managers in this embodiment are roughly divided into two types: package managers and resource managers.

[0040] A package manager is a manager that manages software components. Software components include OS libraries, language libraries, etc. A package manager manages the versions of artifacts and resolves dependencies between artifacts.

[0041] Examples of language package managers that manage language libraries include JavaScript (registered trademark) package managers (e.g., npm, yarn) and Python (registered trademark) package managers (e.g., pipenv, poetry).

[0042] Examples of OS package managers that manage OS libraries include the Ubuntu (registered trademark) package manager (e.g., apt) and the Fedora (registered trademark) package manager (e.g., dnf). Note that if the artifact is an OS, the manager may be omitted from the artifact tag.

[0043] A resource manager is a manager that manages hardware components (such as network appliances) that are components other than software components. The resource manager performs version management of artifacts and acquires metrics. For example, a monitoring tool is used as a resource manager. Examples of resource managers include NetBox and Zabbix (registered trademark).

[0044] When the artifact is a hardware part, the artifact tag takes the form "uuu:vvv:www" just like in the case of a software part. uuu is the Artifact Name, vvv is the Artifact Registry, and www is the Artifact Manager. However, when the artifact is a hardware part, vvv is, for example, the name of the company that provides the artifact. For example, uuu is the product name of the network equipment, vvv is the vendor name of the network equipment, and www is the name of the monitoring tool that monitors the network equipment.

[0045] Furthermore, if the artifact is a hardware part, combining the tag with the CPE (common platform list) makes it possible to identify vulnerabilities in the appliance at an early stage. Furthermore, for example, a tag may be generated from CPE information included in vulnerability information published by the NVD. For example, if the CPE information included in the vulnerability information published by the NVD includes vvv as the vendor name and uuu as the product name, and if the manager is www, it is possible to generate "uuu:vvv:www" from the CPE information. This generation process is performed, for example, by the artifact management device 100.

[0046] (Overview of security management system operations) An overview of the operation of the security management system will be described with reference to Figures 3 and 4. For the sake of convenience, in Figures 3 and 4, the information managed by a device (or the information notified to a terminal by the device) is shown within the device block.

[0047] The security management system of this embodiment is capable of managing both software and hardware components, but for ease of understanding, FIG. 3 focuses on the management of software components, and FIG. 4 focuses on hardware components (such as network appliances).

[0048] First, an overview of operations related to software components will be described with reference to Fig. 3. As shown in Fig. 3, the artifact management device 100 stores artifact tags for all software components included in the services it provides. Here, attention is focused on "xxx:yyy:zzz" as the artifact tag.

[0049] The security topic management device 200 stores data on "vulnerability information, risk information, cyber attack information, etc." provided across companies. "Vulnerability information, risk information, cyber attack information, etc." may be called security information. In the example of Fig. 3, the security topic management device 200 holds vulnerability information on "xxx:yyy:", which is a specific software component, and risk information on "xxx:yyy:zzz", which is a software component managed by a specific manager (zzz). "TO:" indicates that it is addressed to the development team of the artifact it points to.

[0050] 3, the artifact management device 100 notifies the security alert notification device 300 of an artifact (here, a software component) owned by the service development team together with the manager for monitoring registration. Here, it is assumed that "xxx:yyy:zzz" has been notified.

[0051] Furthermore, in S102, the security topic management device 200 notifies the security alert notification device 300 of information (security topic or security action) on software components that have security risks. The information can be conditioned by the manager. Here, it is assumed that "xxx:yyy:" and its vulnerability information, and "xxx:yyy:zzz" and its risk information have been notified. "xxx:yyy:zzz" indicates that there is a risk regarding xxx:yyy managed by a specific manager called zzz.

[0052] In S103, the security alert notification device 300 notifies the ticket management device 400 of the security alert that has been subjected to the matching process.

[0053] Specifically, the security alert notification device 300 matches "xxx:yyy:zzz" notified from the artifact management device 100 with "xxx:yyy:" of the vulnerability information, and matches "xxx:yyy:zzz" notified from the artifact management device 100 with "xxx:yyy:zzz" of the risk information, thereby identifying that the vulnerability information and risk information are security information (information for which an alert is to be issued) about the software component being monitored.

[0054] Then, the security alert management device 300 notifies the ticket management device 400 of "xxx:yyy:" and its vulnerability information, and "xxx:yyy:zzz" and its risk information as a security alert for "xxx:yyy:zzz".

[0055] The ticket management device 400 receives a security alert from the security alert notification device 300 and manages the problem for each software component using a ticket. The ticket management device 400 also generates a security ticket including information (including manager information) and a tag about the artifact that is the subject of the security alert, and notifies the service development team of the artifact of the security ticket. This notification causes the security ticket to be displayed on the terminal of the service development team.

[0056] The ticket management device 400 can use a format with manager information attached as the format of the management label of the software component.

[0057] In the specific example shown in Figure 3, the ticket management device 400 generates a security ticket related to "xxx:yyy:zzz" based on the security alert received from the security alert notification device 300, which describes countermeasures against vulnerabilities and countermeasures against security risks, as shown in Figure 3, and notifies and manages the security ticket.

[0058] Next, an overview of operations related to hardware parts will be described with reference to Fig. 4. As shown in Fig. 4, the artifact management device 100 stores artifact tags for all parts (including software parts and dedicated hardware parts) included in the services it provides. Here, attention is focused on "uuu:vvv:www" as an artifact tag. "uuu:vvv:www" is an artifact tag for a hardware part (e.g., a NW appliance).

[0059] The security topic management device 200 stores data on "vulnerability information, risk information, cyber attack information, etc." provided across companies. "Vulnerability information, risk information, cyber attack information, etc." may be called security information. In the example of Fig. 4, the security topic management device 200 holds vulnerability information on "uuu:vvv:", which is a specific NW appliance, and risk information on "uuu:vvv:www", which indicates the NW appliance managed by a specific resource manager (www).

[0060] 4, the artifact management device 100 notifies the security alert notification device 300, together with the manager, of an artifact (here, focusing on a hardware part) owned by the service development team for monitoring registration. Here, it is assumed that "uuu:vvv:www" has been notified.

[0061] Also, in S102, the security topic management device 200 notifies the security alert notification device 300 of information (security topic or security action) on an artifact (here, a hardware part) that poses a security risk. The information can be conditioned by the manager. Here, it is assumed that "uuu:vvv:" and its vulnerability information, and "uuu:vvv:www" and its risk information have been notified. "uuu:vvv:www" indicates that there is a risk regarding uuu:vvv, which is managed by a specific manager called www.

[0062] In S103, the security alert notification device 300 notifies the ticket management device 400 of the security alert that has been subjected to the matching process.

[0063] Specifically, the security alert notification device 300 matches "uuu:vvv:www" notified by the artifact management device 100 with "uuu:vvv:" in the vulnerability information, and matches "uuu:vvv:www" notified by the artifact management device 100 with "uuu:vvv:www" in the risk information, thereby determining that the vulnerability information and risk information are security information (information for which an alert is to be issued) about the hardware component being monitored.

[0064] Then, the security alert management device 300 notifies the ticket management device 400 of "uuu:vvv:" and its vulnerability information, and "uuu:vvv:www" and its risk information, as a security alert for "uuu:vvv:www".

[0065] The ticket management device 400 receives a security alert from the security alert notification device 300, and manages the problem for each part (here, a hardware part) using a ticket. The ticket management device 400 also notifies the service development team relating to the artifact that is the subject of the security alert of information (including manager information) as a security ticket. This notification causes the security ticket to be displayed on the terminal of the service development team. The ticket management device 400 can use a format with manager information attached as the format of the management label for the hardware part.

[0066] In the specific example shown in Figure 4, the ticket management device 400 generates a security ticket for "uuu:vvv:www" based on the security alert received from the security alert notification device 300, which describes countermeasures against vulnerabilities and countermeasures against security risks, as shown in Figure 4, and notifies and manages the security ticket.

[0067] (Processing sequence) The processing sequence of the security management system according to this embodiment will be described below.

[0068] <Security alert notification control> First, the sequence of security alert notification control will be described with reference to Fig. 5. In S1, a user of the service development team inputs registration information into a terminal, whereby the service development team registers an artifact from the terminal to the artifact management device 100. Specifically, an artifact tag including information about the manager is registered in the artifact management device 100.

[0069] In S2, the artifact management device 100 performs monitoring registration of the artifact with the security alert notification device 300. More specifically, the artifact management device 100 notifies the security alert notification device 300 of the artifact tag of the artifact to be monitored. The security alert notification device 300 registers (saves) the artifact tag as the tag of the artifact to be monitored.

[0070] In S3, the security officer inputs registration information into the terminal, and the security officer registers a security topic from the terminal to the security topic management device 200. In the security topic, an artifact to be notified is specified. In addition, the manager can set conditions in specifying the artifact to be notified.

[0071] In S4, the security topic management device 200 registers a security topic in the security alert notification device 300. More specifically, the security topic management device 200 notifies the security alert notification device 300 of a security topic (including information on a security risk and an artifact tag specifying an artifact) registered by a security officer, and the security alert notification device 300 registers (saves) the security topic.

[0072] In S5, the security alert notification device 300 extracts security topics for the artifacts to be monitored by matching the artifact tags of the artifacts registered for monitoring with the artifact tags of the security topics.

[0073] In this embodiment, since the manager of an artifact can be added to the matching conditions, it is possible to extract security topics taking into account bugs and risks related to the combination of the manager and the artifact. This makes it possible to optimize the notification of security alerts.

[0074] In other words, since security alerts can be conditioned more flexibly, unnecessary security notifications can be reduced.

[0075] In S6, the security alert notification device 300 notifies the ticket management device 400 of the security alert (including the security topic) obtained by the matching process. After that, the ticket management device 400 notifies the security ticket to the terminal of the corresponding service development team.

[0076] Here, an example of the above-mentioned matching will be described. Figure 6 shows that matching has been performed between security topic X about "yaml:npm:" and "yaml:npm:npm" that has been registered for monitoring. This matching makes it possible to notify, for example, the relevant service development team of "yaml:npm:npm", which is artifact information with manager information added, for security topic X about "yaml:npm:", together with information about security topic X (such as vulnerability information). The person in charge who receives "yaml:npm:npm" will understand that the yaml problem can be dealt with, for example, by manipulating npm.

[0077] Figure 7 shows that security topic X about "yaml:npm:" is matched with "yaml:npm:npm" and "yaml:npm:yarn" that are registered for monitoring. This matching makes it possible to notify, for example, a service development team of "yaml:npm:npm" and "yaml:npm:yarn", which are artifact information with manager information added, for security topic X about "yaml:npm:", together with the information about security topic X. In this case, for example, if the service development team uses yarn as a manager, the service development team can know that npm is also used within the company.

[0078] Figure 8 shows that security topic Y for "yaml:npm:yarn" is matched with "yaml:npm:yarn" from among the monitored "yaml:npm:npm" and "yaml:npm:yarn". This matching makes it possible to notify, for example, the relevant service development team of only "yaml:npm:yarn" together with information about security topic Y for "yaml:npm:yarn". This allows the service development team to understand that there is a security risk when using yarn as a manager for yaml.

[0079] Figure 9 shows all the examples shown so far. However, security action X is also shown in Figure 9. The matching shown in A in Figure 9 makes it possible to notify the service development team of security measures that should be taken only when a specific package manager is used. The matching shown in B and C in Figure 9 makes it possible to notify the service development team of all managers used within the company for YAML. The matching shown in D in Figure 9 makes it possible to notify the service development team of bugs that occur due to a specific package manager, for example.

[0080] <Clarification of the manager to be operated> Next, the sequence for clarifying the manager to be operated will be described with reference to FIG.

[0081] The sequence in Fig. 10 starts from S11, which corresponds to S6 in Fig. 5. In S11, the security alert management device 300 notifies the ticket management device 400 of the security alert that has been subjected to the matching process.

[0082] In S12, the ticket management device 400 notifies the terminal of the corresponding service development team of the security ticket information including the artifact tag, which is information about the artifact including the manager.

[0083] In S13, the service development team takes security measures such as updating the artifacts in accordance with the contents of the security ticket.

[0084] As described above, by including manager information about components in the security ticket (which may be called a security alert) sent to the service development team, the manager to be operated (used for updating artifacts, etc.) becomes clear. This reduces the amount of confirmation work required by the service development team.

[0085] <Artifact Manager Analysis> The sequence for the analysis of the manager of artifacts will now be described with reference to FIG.

[0086] In S21 to S22, each service development team (Team A and Team B in the example of FIG. 7) uses a terminal to register an artifact in the artifact management device 100. The information of the artifact to be registered includes information of the manager.

[0087] The artifact management device 100 calculates statistical information about the managers of the registered artifacts. The statistical information is not limited to a specific one, but may be, for example, "the number of types of managers used for each part, and the composition ratio of managers used for each part" for each service development team or for the entire company.

[0088] In S23, for example, a security officer uses a terminal to obtain statistical information on the manager from the artifact management device 100. In S24, the security officer registers a security topic that takes into account the statistical information on the manager in the security topic management device 200. For example, the security officer can register a security topic on a manager that is used frequently in preference to a security topic on a manager that is used less frequently.

[0089] Furthermore, in S24, the security officer can provide support for security countermeasures that take into account the manager's statistical information from the terminal via the ticket management device 400.

[0090] As described above, by acquiring manager statistical information, it becomes possible to distribute security information and support security measures that take into account the artifact management process. It also becomes possible to perform risk analysis that takes into account the actual environment of the service development team.

[0091] (Device configuration example) 12 shows an example of a functional configuration of the artifact management device 100. As shown in FIG. 12, the artifact management device 100 includes an information acquisition unit 110, an information notification unit 120, an analysis unit 130, and a storage unit 140.

[0092] The information acquisition unit 110 receives information on an artifact tag including information on a manager as registration information for an artifact from a terminal of a service development team or the like, and stores the received information in the storage unit 140 .

[0093] The information notification unit 120 notifies the security alert notification device 300 of the artifact tag information read from the storage unit 140. The analysis unit 130 calculates statistical information of the manager based on the multiple tags stored in the storage unit 140.

[0094] 13 shows an example of a functional configuration of the security topic management device 200. As shown in FIG. 13, the security topic management device 200 includes an information acquisition unit 210, an information notification unit 220, and a storage unit 230.

[0095] The information acquisition unit 210 receives information related to the security of an artifact from a terminal such as a security officer, and stores the received information in the storage unit 230. This information may or may not specify a manager.

[0096] The information notification unit 220 notifies the security alert notification device 300 of the information relating to the security of the artifact read from the storage unit 230 .

[0097] 14 shows an example of the functional configuration of the security alert notification device 300. As shown in FIG.

[0098] The information acquiring unit 310 receives information on artifacts to be monitored (including manager information) from the artifact management device 100, and stores the received information in the storage unit 340. The information acquiring unit 310 also receives security information on artifacts with security problems (which may or may not include manager information) from the security topic management device 200, and stores the received information in the storage unit 340.

[0099] The matching processing unit 320 performs a matching process between the artifact information (including the manager information) and the security information stored in the storage unit 340. Examples of matching (combinations of tags and security information) obtained by the matching process are as described above.

[0100] The information notification unit 330 notifies the ticket management device 400 of the information obtained by the matching process as a security alert.

[0101] 15 shows an example of a functional configuration of the ticket management device 400. As shown in FIG. 15, the ticket management device 400 includes an information acquisition unit 410, a security ticket generation unit 420, an information notification unit 430, and a storage unit 440.

[0102] The information acquisition unit 410 receives a security alert including a tag and security information from the security alert notification device 300 , and stores the received information in the storage unit 440 .

[0103] The security ticket generation unit 420 generates a security ticket based on the security alert information stored in the storage unit 440. The information notification unit 430 notifies the security ticket generated by the security ticket generation unit 420 to, for example, a terminal of a team developing a service that uses an artifact that is the subject of the security ticket.

[0104] (Hardware configuration example) Any of the devices described in this embodiment (the artifact management device 100, the security topic management device 200, the security alert notification device 300, and the ticket management device 400) can be realized, for example, by causing a computer to execute a program. This computer may be a physical computer or a virtual machine on the cloud.

[0105] That is, the device can be realized by executing a program corresponding to the processing performed by the device, using hardware resources such as a CPU and memory built into a computer. The program can be recorded on a computer-readable recording medium (such as a portable memory) and stored or distributed. The program can also be provided via a network such as the Internet or email.

[0106] Fig. 16 is a diagram showing an example of the hardware configuration of the computer. The computer in Fig. 16 includes a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, and the like, all of which are connected to one another via a bus B. The computer may further include a GPU.

[0107] The program for realizing the processing on the computer is provided by a recording medium 1001 such as a CD-ROM or a memory card. When the recording medium 1001 storing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001, but may be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files, data, etc.

[0108] The memory device 1003 reads out and stores the program from the auxiliary storage device 1002 when an instruction to start the program is received. The CPU 1004 realizes the functions related to the device in accordance with the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network, etc. The display device 1006 displays a GUI (Graphical User Interface) or the like according to a program. The input device 1007 is composed of a keyboard and mouse, buttons, a touch panel, etc., and is used to input various operation instructions. The output device 1008 outputs the results of calculations.

[0109] (Effects of the embodiment) As described above, the technology described in this embodiment makes it possible to appropriately notify security-related information in security countermeasures. This "notification" is, for example, a notification from the security alert notification device 300 to the ticket management device 400, or a notification from the ticket management device 400 to a service development team.

[0110] More specifically, there are four effects:

[0111] (1) Security management similar to SBOM can be achieved for components other than software.

[0112] (2) It becomes possible to perform security risk analysis taking into account the actual environment (which can also be rephrased as the management process) of the service development team.

[0113] (3) It enables more flexible conditioning of security alerts, thereby reducing unnecessary security notifications.

[0114] (4) It is possible to reduce the amount of verification work required in the process of implementing security measures.

[0115] In other words, the technology according to this embodiment makes it possible to expand the scope of security measures using SBOM and realize more efficient and accurate cybersecurity measures.

[0116] The following supplementary notes are further disclosed regarding the above embodiment.

[0117] <Additional Notes> (Additional note 1) an artifact management device that manages tags that identify artifacts that are components that configure a service and managers of the artifacts; a security information notification device that notifies a specific device of the tag for a specific artifact and security information for the specific artifact; A security management system comprising: (Additional note 2) The security management system further includes a security information management device, The security information notification device extracts the security information about the specific artifact by performing a matching process between the tag about the specific artifact notified by the artifact management device as a monitoring target and one or more pieces of security information notified by the security information management device. 2. A security management system as described in claim 1. (Additional note 3) The security information notification device matches one or more tags specified by a manager with security information notified from the security information management device and for which no manager is specified. Item 2. A security management system according to claim 2. (Additional note 4) The security information notification device matches a tag designated by the manager with the security information designated by the manager and notified by the security information management device. Item 2. A security management system according to claim 2. (Additional note 5) The specific device is a ticket management device, which generates a security ticket based on the tag and security information received from the security information notification device and notifies the service development team of the security ticket. 5. A security management system according to any one of claims 1 to 4. (Additional note 6) The artifact management device calculates manager statistical information based on a plurality of tags managed by the artifact management device. 6. A security management system according to any one of claims 1 to 5. (Additional note 7) A security management method executed in a security management system including an artifact management device and a security information notification device, comprising: the artifact management device manages tags that identify artifacts that are components constituting a service and managers of the artifacts; the artifact management device notifies the security information notification device of the tag for a particular artifact; The security information notification device notifies a specific device of the tag for the specific artifact and the security information for the specific artifact. Security management methods. (Additional note 8) A non-transitory storage medium storing a program for causing a computer to function as the security information notification device according to any one of claims 1 to 5.

[0118] Although the present embodiment has been described above, the present invention is not limited to such a specific embodiment, and various modifications and variations are possible within the scope of the gist of the present invention described in the claims. [Explanation of symbols]

[0119] 10 Terminal 100 Artifact Management Device 110 Information Acquisition Department 120 Information Notification Department 130 Analysis Department 140 Storage section 200 Security Topic Management Device 210 Information Acquisition Department 220 Information Notification Department 230 Storage section 300 Security Alert Notification Device 310 Information Acquisition Department 320 Matching Processing Unit 330 Information Notification Department 340 Storage section 400 Ticket Management Device 410 Information Acquisition Department 420 Security Ticket Generation Unit 430 Information Notification Department 440 Storage section 500 Network 1000 Drive Device 1001 Recording media 1002 Auxiliary storage 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input Device 1008 Output device

Claims

1. an artifact management device that manages tags that identify artifacts that are components that configure a service and managers of the artifacts; a security information notification device that notifies a specific device of the tag for a specific artifact and security information for the specific artifact; A security management system comprising:

2. The security management system further includes a security information management device, The security information notification device extracts the security information about the specific artifact by performing a matching process between the tag about the specific artifact notified by the artifact management device as a monitoring target and one or more pieces of security information notified by the security information management device. The security management system of claim 1 .

3. The security information notification device matches one or more tags specified by a manager with security information notified from the security information management device and for which no manager is specified. The security management system of claim 2 .

4. The security information notification device matches a tag designated by the manager with the security information designated by the manager and notified by the security information management device. The security management system of claim 2 .

5. The specific device is a ticket management device, which generates a security ticket based on the tag and security information received from the security information notification device and notifies the service development team of the security ticket.

5. A security management system according to any one of claims 1 to 4.

6. The artifact management device calculates manager statistical information based on a plurality of tags managed by the artifact management device.

5. A security management system according to any one of claims 1 to 4.

7. A security management method executed in a security management system including an artifact management device and a security information notification device, comprising: the artifact management device manages tags that identify artifacts that are components constituting a service and managers of the artifacts; the artifact management device notifies the security information notification device of the tag for a particular artifact; The security information notification device notifies a specific device of the tag for the specific artifact and the security information for the specific artifact. Security management methods.

8. 5. A program for causing a computer to function as the security information notification device according to claim 1.

Images