Information security management device, information security management method, and program

Abstract

To provide an information security management device, an information security management method, and a program which are capable of accurately confirming whether an information security policy functions properly.SOLUTION: An information security management device according to the present disclosure includes: a data collection unit 131 which collects operation record information indicating processing contents that are subject to rules regarding information security; an evaluation unit 133 which determines whether the rules are violated based on the operation record information and evaluation criteria; a result analysis unit 134 which identifies a cause of the violation based on the operation record information if the rules are violated; and an improvement proposal unit 1336 which obtains an improvement proposal to resolve the violation based on the identified cause of the violation.SELECTED DRAWING: Figure 6

Description

[Technical field]

[0001] The present disclosure relates to an information security management device, an information security management method, and a program. [Background technology]

[0002] The information security policy review system is used to check whether the information security policy in an organization is functioning properly. The system monitors whether the policies and rules set by the organization are being followed, and automatically issues a warning if a violation occurs or provides information to identify the cause of the violation.

[0003] For example, Patent Document 1 below discloses a system that uses a computer to calculate an index for evaluating trading rules from the perspective of the degree of violation. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2008-40847 A Summary of the Invention [Problem to be solved by the invention]

[0005] However, although the system described in the above Patent Document 1 can evaluate violations of rules in business transactions, it cannot accurately confirm whether information security policies are functioning properly within an organization.

[0006] In view of the above-mentioned problems, the present disclosure aims to provide an information security management device, an information security management method, and a program that can accurately confirm that a security policy is functioning properly. [Means for solving the problem]

[0007] In order to solve the above-mentioned problems and achieve the objectives, the information security management device disclosed herein comprises a data collection unit that collects operation record information indicating processing contents that are subject to rules regarding information security, an evaluation unit that determines whether the rules are violated based on the operation record information and evaluation criteria, a result analysis unit that, if the rules are violated, identifies the cause of the violation based on the operation record information, and an improvement proposal unit that obtains improvement proposals to resolve the violation based on the identified cause of the violation.

[0008] In order to solve the above-mentioned problems and achieve the objectives, the information security management method disclosed herein includes the steps of collecting operation record information indicating processing content that is subject to rules regarding information security, determining whether the rules are violated based on the operation record information and an evaluation criterion, identifying the cause of the violation based on the operation record information if the rules are violated, and obtaining an improvement proposal to resolve the violation based on the identified cause of the violation.

[0009] In order to solve the above-mentioned problems and achieve the objectives, the program disclosed herein causes a computer to execute the following steps: collecting operation record information indicating processing content that is subject to rules regarding information security; determining whether the rules have been violated based on the operation record information and evaluation criteria; if the rules have been violated, identifying the cause of the violation based on the operation record information; and obtaining an improvement proposal to resolve the violation based on the identified cause of the violation. Effect of the Invention

[0010] According to the present disclosure, it is possible to provide an information security management device, an information security management method, and a program that can accurately confirm that an information security policy is functioning properly. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram showing an overview of the information security policy review according to the present disclosure. [Diagram 2] FIG. 2 is a diagram illustrating the process of reviewing an information security policy according to the present disclosure. [Diagram 3] FIG. 3 is a diagram showing the process of formulating an information security policy according to the present disclosure. [Figure 4] FIG. 4 is a diagram showing the roles of each person in the process of formulating the information security policy according to the present disclosure. [Diagram 5] FIG. 5 is a diagram illustrating a configuration example of an information security policy implementation status evaluation system according to the present disclosure. [Figure 6] FIG. 6 is a schematic block diagram of an information security management device according to the present disclosure. [Figure 7] FIG. 7 is a diagram illustrating an example of information stored in the operation record information storage unit of the information security management device according to the present disclosure. [Figure 8] FIG. 8 is a diagram illustrating an example of information stored in the evaluation criterion storage unit of the information security management device according to the present disclosure. [Figure 9] FIG. 9 is a diagram illustrating an example of information stored in the policy implementation status storage unit of the information security management device according to the present disclosure. [Figure 10] FIG. 10 is a diagram illustrating the configuration and processing of the policy update unit of the information security management device according to the present disclosure. [Figure 11] FIG. 11 is a diagram showing an example of a policy change request received by the policy change receiving unit of the information security management device according to the present disclosure. [Figure 12] FIG. 12 is a flowchart showing a process flow of the information security management device according to the present disclosure. [Figure 13] FIG. 13 is a diagram illustrating a configuration example of an information processing system according to the present disclosure. [Figure 14] FIG. 14 is a diagram illustrating a configuration example of an administrator terminal according to the present disclosure. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. Note that the present disclosure is not limited to the embodiments described below.

[0013] (Information Security Policy) An information security policy is a policy regarding information security established by an organization, and can also be said to be a set of rules that must be followed within an organization. In other words, an information security policy refers to rules regarding information security.

[0014] Next, an overview of the information security policy review will be described with reference to FIG. 1. The information security policy is usually formally approved after a review. FIG. 1 is a diagram showing an overview of the information security policy review according to the present disclosure. In this example, the information security policy review is performed by a security manager and a security auditor. When setting an information security policy, the security manager and the security auditor read out and review the information security policy stored in a database as a document. For example, the security manager and the security auditor evaluate the suitability, feasibility, and completeness of the information security policy. The security manager and the security auditor update the information security policy as necessary based on the review results. In other words, the information security policy is formally approved after a review.

[0015] The security manager is the person who manages the security of the system and oversees the document review of the information security policy. The security auditor is the person who audits the system and participates in the review of the information security policy to evaluate the policy's suitability, enforceability, and completeness.

[0016] When checking the conformance of the policy, check whether the information security policy complies with relevant laws, regulations, industry standards, etc. When checking the enforceability of the information security policy, check whether the information security policy is enforceable. If the information security policy is not enforceable, changes are required. When checking the completeness of the information security policy, check whether the information security policy is complete. If the information security policy is incomplete, add the necessary information.

[0017] In deciding on changes to the information security policy, changes to the information security policy are decided. This process is based on the suitability, feasibility, and completeness of the information security policy mentioned above. In updating the information security policy, changes are made to the information security policy and a new version is created.

[0018] The information security policy is then approved, and the security manager approves the information security policy after the review is complete. When publishing the information security policy, the approved information security policy is published within the system and notified to the relevant parties.

[0019] (About the information security policy review process) Next, a detailed example of the information security policy review process will be described with reference to Fig. 2. Fig. 2 is a diagram showing an example of the information security policy review process according to the present disclosure. The information security policy review process will be described below along the flow shown in Fig. 2.

[0020] 1. Policy Development: First, an information security policy to be reviewed is formulated (Step S1). That is, in this step, an already formulated information security policy to be reviewed is selected. In this process, the type of policy, update frequency, systems and applications that must comply with the policy, audit items, etc. are clarified.

[0021] 2. Assessing the implementation of the policy: Next, the implementation status of the information security policy is evaluated (Step S2). In this process, a plan is formulated that defines the review implementation method, period, and roles of the relevant parties, and based on the formulated plan, the systems and applications that are subject to the information security policy are accessed to check whether the policy is being implemented appropriately. The relevant parties who will carry out the review include security auditors, system administrators, and security managers. The audit methods used include the use of security audit checklists and verification of whether the policy is actually being complied with.

[0022] 3. Review the evaluation results: Next, the evaluation results of the implementation status of the information security policy are reviewed (step S3).

[0023] 4. Identify the problem: Next, the review results are analyzed to identify problems with the implementation of the information security policy (step S4). In other words, deficiencies and areas for improvement in the information security policy are identified. If revisions or modifications to the information security policy are required in this process, the security manager decides how to deal with the problem and notifies the relevant parties.

[0024] 5. Develop an improvement plan: Next, based on the results of identifying the problems, an improvement plan for the information security policy is formulated (step S5). The improvement plan defines countermeasure actions such as revising or amending the policy, adding systems, and implementing security training.

[0025] 6. Implementing improvements Next, the created improvement plan is implemented (step S6).

[0026] 7. Monitoring improvements Next, the effect of implementing the improvement plan is monitored (Step S7). In this process, reviews are conducted periodically to check whether the improvement is proceeding appropriately.

[0027] (Information Security Policy Formulation Process) Next, an example of the information security policy formulation process will be described with reference to Fig. 3 and Fig. 4. Fig. 3 is a diagram showing the process of formulating the information security policy according to the present disclosure. Fig. 4 is a diagram showing the role of each person in the process of formulating the information security policy according to the present disclosure.

[0028] As shown in Figure 3, in the information security policy formulation process of this example, the following processes are carried out in order: setting objectives (step S11), determining the scope (step S12), formulating a policy (step S13), creating an information security policy (step S14), and approving and publishing (step S15).

[0029] As shown in Figure 4, in the information security policy formulation process, policy makers, security personnel, and engineers each play their own roles. In other words, policy makers are responsible for determining the purpose and scope of the policy, formulating the policy, and approving and publishing the policy. Security personnel and engineers are responsible for creating the policy and providing the technical support required for creating the policy.

[0030] (About the Information Security Policy Implementation Status Assessment System) It is necessary to confirm whether the information security policy is functioning properly, in other words, whether it is being complied with within an organization. In the present disclosure, the information security management device 100 automatically checks whether the information security policy is being complied with, so that it is possible to accurately check whether the information security policy is functioning properly.

[0031] In this embodiment, the information security management device 100 is included in an information security policy implementation status evaluation system 1. Fig. 5 is a diagram showing a configuration example of an information security policy implementation status evaluation system according to the present disclosure. As shown in Fig. 5, the information security policy implementation status evaluation system 1 includes an information security management device 100, an information processing system 200, an administrator terminal 300, and a network N. The configuration of these components will be briefly described below.

[0032] The information security management device 100 is an information processing device that executes various information processing related to information security management. The information security management device 100 may be realized by an information processing device such as a PC (Personal Computer), a WS (Work Station), or a computer having a server function. The information security management device 100 is not limited to being incorporated into the information security policy implementation status evaluation system 1, and can function independently.

[0033] The information processing system 200 is an information processing device that executes information processing related to various business operations. For example, the information processing system 200 executes information processing related to business operations such as product design, quality inspection before product shipment, document management such as reports, order management, and attendance management. The information processing system 200 may be configured with a plurality of information processing devices, and may be realized by these devices transmitting and receiving information to each other through electric communication lines.

[0034] The administrator terminal 300 is an information processing device used by an administrator of an information security policy. The administrator terminal 300 is used for processing such as operating the information security management device 100 via the network N to cause the information security management device 100 to execute various information processing operations and displaying the results of the information processing operations. The administrator terminal 300 may be realized by an information processing device such as a computer having the functions of a PC, a WS, or a server.

[0035] The network N connects the information security management device 100, the information processing system 200, and the administrator terminal 300 in a wired or wireless manner so that they can communicate with each other. If the network N is wired, it may be realized by Ethernet (registered trademark) defined in IEEE802.3. If the network N is wireless, it may be realized by a wireless LAN (Local Area Network) defined in IEEE802.11.

[0036] (Configuration of Information Security Management Device) Next, the configuration of the information security management device 100 according to the present disclosure will be described with reference to Fig. 6. Fig. 6 is a schematic block diagram of the information security management device according to the present disclosure. The information security management device 100 according to the present disclosure is a computer, and includes an input unit 102, an output unit 104, a communication unit 110, a storage unit 120, and a control unit 130, as shown in Fig. 6. The configuration of these components will be described below in order.

[0037] The input unit 102 is a mechanism for accepting input from a user. Examples of the input unit 102 include a mouse, a keyboard, and a touch panel. The output unit 104 is a device for outputting information. The output unit 104 includes a display for displaying images, and may further include a speaker for outputting sound.

[0038] The communication unit 110 is responsible for transmitting and receiving information to and from an external device. The communication unit 110 is realized, for example, by a NIC (Network Interface Card) equipped with a wired LAN terminal, a wireless LAN card, etc. The communication unit 110 is connected to the network N by wire or wirelessly, and transmits and receives information to and from the information processing system 200, the administrator terminal 300, etc.

[0039] The memory unit 120 is a storage device that stores various information such as the contents of calculations and programs of the control unit 130. The memory unit 120 includes a main storage device and an auxiliary storage device. The main storage device may be realized by a semiconductor memory element such as a random access memory (RAM), a read only memory (ROM), or a flash memory. The auxiliary storage device may be realized by a hard disk, a solid state drive (SSD), or an optical disk. The programs for the control unit 130 saved in the memory unit 120 may be stored in a recording medium readable by the information security management device 100.

[0040] 6, the storage unit 120 may include an operation record information storage unit 121, an evaluation criterion storage unit 122, and a policy implementation status storage unit 123. An example of information stored in these components will be described below in order.

[0041] The operation record information storage unit 121 stores the operation record information. The operation record information is information for confirming whether the information security policy is complied with. The operation record information can also be said to be information indicating the processing content that is the subject of the information security policy, which is executed within an organization. The operation record information may be any information as long as it is such information, but in this embodiment, it is information on the operation history (operation history) of the information processing system 200, and refers to information related to the information security policy among various operation histories of the information processing system 200. Here, an example of information stored in the operation record information storage unit 121 will be described with reference to FIG. 7. FIG. 7 is a diagram showing an example of information stored in the operation record information storage unit of the information security management device according to the present disclosure.

[0042] As shown in FIG. 7, the operation record information stored in the operation record information storage unit 121 includes information relating to the items of "operation log", "alert", "access history", and "vulnerability scan result".

[0043] The "operation log" is information relating to records of operations performed on the information processing system 200, and may include, for example, commands to cause the information processing system 200 to execute processing. The "alert" is information relating to a warning that has occurred in the information processing system 200, and may include, for example, the type of warning and text data of the warning message. The "access history" is information relating to records of access to the information processing system 200, and may include, for example, a user ID that identifies the user who accessed the system, the login date and time, the logout date and time, and the like. The "vulnerability scan result" is information relating to the result of a vulnerability scan performed on the information processing system 200.

[0044] In addition, these pieces of information may be stored in association with an identifier or the like that identifies each information processing system 200.

[0045] The evaluation criteria storage unit 122 stores information related to evaluation criteria. Evaluation criteria are information indicating criteria for evaluating whether an information security policy is being complied with. Evaluation criteria are set for each evaluation item. In other words, evaluation criteria indicate criteria indicating whether or not an evaluation item assigned to that evaluation criterion is satisfied.

[0046] The evaluation items refer to the contents to be checked to evaluate whether the information security policy is complied with, and are, for example, information on the items that are the viewpoints and factors of the evaluation. The evaluation items may be any contents, and may be, for example, at least one of the following: the degree of education on information security of personnel in an organization (for example, users of the information processing system 200), the appropriateness of the operation of the information processing system 200, the appropriateness of the information security policy, and the safety of the information processing system 200 against information leakage. In addition, for example, the evaluation items may be items related to confidentiality, which means that only authorized persons can access and use information, integrity, which means that information is accurate and has not been tampered with, and availability, which means that authorized persons can access and use information when necessary.

[0047] Fig. 8 is a diagram showing an example of information stored in the evaluation criterion storage unit of the information security management device according to the present disclosure. As shown in Fig. 8, the evaluation criterion storage unit 122 stores evaluation criteria for each evaluation item. In the example of Fig. 8, eight types of evaluation criteria, evaluation criterion 1 to evaluation criterion 8, are stored, but this is merely an example, and the number of evaluation criteria and evaluation items may be arbitrary.

[0048] The evaluation items may be, for example, items related to "degree of compliance with security policy," "risk management," "access control," "encryption," and "system settings." "Degree of compliance with security policy" is an evaluation item that evaluates whether or not a company's security policy is followed. For example, it checks whether password expiration dates are observed and whether a strong password policy is applied. "Risk management" is an evaluation item that evaluates the risk management of the system. For example, it evaluates whether risk assessments are performed for important systems and whether security incident reporting and response processes are properly performed. "Access control" is an evaluation item that evaluates the access control to the system. For example, it checks whether access permissions are properly set, whether unnecessary access is restricted, whether authority delegation is properly performed, and so on. "Encryption" is an evaluation item that evaluates the encryption of important data. For example, it evaluates whether data that requires encryption in the security policy is properly encrypted and whether the algorithm used for encryption is appropriate. "System settings" is an evaluation item that evaluates the settings of the system. For example, it checks whether security settings required in the security policy are performed, whether unnecessary services are not installed, and whether ports are closed.

[0049] The policy enforcement status storage unit 123 stores information related to the evaluation result of the policy enforcement status. Here, an example of the information stored in the policy enforcement status storage unit 123 will be described with reference to Fig. 9. Fig. 9 is a diagram showing an example of the information stored in the policy enforcement status storage unit of the information security management device according to the present disclosure.

[0050] As shown in FIG. 9, the policy implementation status memory unit 123 stores information relating to the items "evaluation date," "person in charge," "policy ID," "evaluation ID," "improvement plan," "evaluation result," "target system ID," "evaluator," "evaluation item ID," "evaluation item," "remarks," "improvement completion date," and "evaluation item name."

[0051] The "evaluation date" is information indicating the date on which the evaluation of the policy implementation status was performed. The "person in charge" is information indicating the name of the person in charge of the evaluation of the policy implementation status. The "policy ID" is an identifier for identifying the information security policy on which the evaluation of the policy implementation status is based, and is represented by a character string, a number, or the like. The "evaluation ID" is an identifier for identifying the evaluation of the policy implementation status, and is represented by a character string, a number, or the like. The "improvement plan" is information on the improvement plan proposed based on the evaluation of the policy implementation status. The "evaluation result" is information on the evaluation result of the policy implementation status. The "target system ID" is an identifier for identifying the information processing system 200 that is the target of the evaluation of the policy implementation status, and is represented by a character string, a number, or the like. The "evaluator" is a person who actually performed the evaluation of the policy implementation status, and if the "person in charge" has the authority to give directions to the evaluation of the policy implementation status, a name different from that is stored. The "evaluation item ID" is an identifier for identifying the evaluation item used in the evaluation of the policy implementation status, and is represented by a character string, a number, or the like. The "evaluation item" is information indicating the content of the evaluation item identified by the "evaluation item ID". "Notes" is information entered by the person in charge or the evaluator in relation to the evaluation of the policy implementation status. "Improvement Completion Date" is information indicating the date on which the improvement plan indicated by "Improvement Plan" was completed. "Evaluation Item Name" is information indicating the item evaluated in the evaluation of the policy implementation status.

[0052] The information stored in the policy enforcement status storage unit 123 is not limited to the above-mentioned information, and any other information related to the evaluation result of the policy enforcement status may be stored.

[0053] Next, returning to Fig. 6, the control unit 130 will be described. The control unit 130 is a controller that manages and controls the information security management device 100. The control unit 130 is realized by a CPU (Central Processing Unit), an MPU (Micro Processing Unit), or the like, executing various programs stored in the storage unit 120 using a RAM as a working area. The control unit 130 may also be realized by an integrated circuit, such as an ASIC (Application Specific Integrated Circuit) or an FPGA (Field Programmable Gate Array).

[0054] As shown in Fig. 6, the control unit 130 includes a data collection unit 131, a criterion acquisition unit 132, an evaluation unit 133, a result analysis unit 134, an output control unit 135, an improvement proposal unit 136, and a policy update unit 137. The control unit 130 realizes these functions and executes these processes by reading and executing a program (software) from the storage unit 120. Note that these functions of the control unit 130 may be realized by electronic circuits. Furthermore, the control unit 130 may execute these processes by one CPU, or may include multiple CPUs and execute these processes in parallel by the multiple CPUs.

[0055] (Processing contents of information security management device) The processing contents of the information security management device 100 will be explained below.

[0056] (Collection of operational record information) The data collection unit 131 collects operation record information. Any method for acquiring the operation record information by the data collection unit 131 may be used, but in this embodiment, the data collection unit 131 accesses an external information processing system 200 via the network N to collect operation record information stored in the information processing system 200. After acquiring the operation record information from the information processing system 200, the data collection unit 131 stores the acquired operation record information in the operation record information storage unit 121.

[0057] In this embodiment, it is preferable that the data collection unit 131 acquires information on an evaluation target of an information security policy, and acquires operation record information to be used for judgment (evaluation) by the evaluation unit 133 based on the evaluation target. The evaluation target refers to an object for which an information security policy is evaluated, in other words, the compliance status of the information security policy related to the evaluation target is evaluated. In other words, the information on the evaluation target refers to information that specifies the processing content that is the target of the information security policy. The evaluation target refers to, for example, the content of a business performed by an organization (e.g., product design, etc.). The data collection unit 131 may acquire information on the evaluation target by any method, for example, the evaluation target may be input by a user to the input unit 102, and the information on the evaluation target input to the input unit 102 may be acquired.

[0058] The data collection unit 131 acquires operation record information to be used for judgment (evaluation) by the evaluation unit 133 based on the evaluation target. In this case, for example, the type of evaluation target and the type of operation record information are associated with each other, and the data collection unit 131 acquires operation record information of the type corresponding to the acquired evaluation target. Also, for example, the data collection unit 131 may select operation record information to be used for evaluation based on the evaluation target, and acquire the selected operation record information. That is, for example, if the evaluation target is product design, operation record information (for example, log data) executed when designing the product is collected.

[0059] (Obtaining evaluation criteria) The criterion acquisition unit 132 acquires evaluation criteria. The criterion acquisition unit 132 acquires evaluation criteria corresponding to the operation record information acquired by the data collection unit 131. The method of acquiring the evaluation criteria by the criterion acquisition unit 132 may be arbitrary, but in this embodiment, the criterion acquisition unit 132 may access an external device via the network N to acquire the evaluation criteria, and store the acquired evaluation criteria in the evaluation criterion storage unit 122. Also, for example, the evaluation criteria may be stored in advance in the evaluation criterion storage unit 122, and the criterion acquisition unit 132 may read out the evaluation criteria from the evaluation criterion storage unit 122.

[0060] In this embodiment, it is preferable that the criteria acquisition unit 132 acquires information on an evaluation target of an information security policy, and acquires evaluation criteria to be used for judgment (evaluation) by the evaluation unit 133 based on the evaluation target. In this case, for example, the type of evaluation target and the type of evaluation item are associated with each other, and the data collection unit 131 acquires evaluation criteria for the evaluation item corresponding to the acquired evaluation target. Also, for example, the data collection unit 131 may select evaluation items to be used for evaluation based on the evaluation target, and acquire evaluation criteria for the selected evaluation items. That is, for example, when the evaluation target is a product design, evaluation criteria for evaluation items required when designing the product (for example, execution of a predetermined operation on the information processing system 200) are acquired.

[0061] (evaluation) The evaluation unit 133 judges whether the information security policy is violated based on the operation record information acquired by the data collection unit 131 and the evaluation criterion acquired by the criterion acquisition unit 132. That is, the evaluation unit 133 judges whether the operation record information satisfies the evaluation criterion. When the operation record information satisfies the evaluation criterion, the evaluation unit 133 judges that the information security policy is not violated, and when the operation record information does not satisfy the evaluation criterion, the evaluation unit 133 judges that the information security policy is violated. The method of judging whether the operation record information satisfies the evaluation criterion may be arbitrary. For example, when the operation record information is log information and the evaluation criterion is that a predetermined operation is executed in the information processing system 200, the evaluation unit 133 may judge that the log information does not satisfy the evaluation criterion when it indicates that the predetermined operation is not executed.

[0062] Furthermore, when an information security policy is violated, the evaluation unit 133 may evaluate a security risk indicating the seriousness of the violation. That is, the evaluation unit 133 may determine the level of the security risk based on the operation record information and the evaluation criteria. The method of determining the level of the security risk may be arbitrary, and may be set according to the evaluation item to which the evaluation criteria belong, or the higher the degree of deviation between the operation record information and the evaluation criteria, the higher the level of the security risk (so that it is considered to be more serious). For example, when the access history included in the operation record information is evaluated and the existence of unauthorized access by a person other than an authorized person is recognized, the security risk is evaluated as level 4. Here, the level indicating the degree of the security risk may be set arbitrarily, and may be evaluated in five stages, for example.

[0063] The output control unit 135 outputs the evaluation result by the evaluation unit 133 (information indicating whether there is a violation of the information security policy). The output control unit 135 may also output the security risk. The output method by the output control unit 135 may be arbitrary, and for example, the output control unit 135 may output information such as the evaluation result to an external device (administrator terminal 300) or may cause the output unit 104 to output information such as the evaluation result. The same applies to each output by the output control unit 135 below.

[0064] (Identifying the cause) When the evaluation unit 133 determines that the information security policy has been violated, the result analysis unit 134 identifies the cause of the information security policy violation based on the operation record information. The cause of the violation refers to the presumed cause of the occurrence of the information security policy violation. The result analysis unit 134 may identify the cause by any method based on the operation record information, but in this embodiment, the result analysis unit 134 identifies the cause by machine learning. An example of a method for identifying the cause by machine learning will be described below.

[0065] The result analysis unit 134 acquires violation information, which is information based on the operation record information, based on the operation record information used when it was determined that a violation occurred. The violation information may be any information indicating a violation of an information security policy, but may include the operation record information itself, the type of information security policy that has been violated, the time of the violation, and the location where the violation occurred. The information based on the operation record information is preferably at least one of the type of information security policy that has been violated, the time of the violation, and the location where the violation occurred, and more preferably all of these.

[0066] Then, the result analysis unit 134 inputs the currently acquired violation information into a learning model that has already learned the correspondence between the violation information and the cause of the violation by machine learning, thereby acquiring the cause of the violation from the learning model. The result analysis unit 134 identifies the cause of the violation against the information security policy based on the cause of the violation acquired from the learning model. For example, the result analysis unit 134 may use the cause of the violation acquired from the learning model as an identification result of the cause of the violation against the information security policy. Also, for example, when multiple violation causes (labels) are output from the learning model, the cause whose probability of being the cause is equal to or greater than a predetermined value and whose probability is the highest among the causes may be used as an identification result of the cause of the violation against the information security policy.

[0067] The learning model is an AI (Artificial Intelligence) model, i.e., a program, that can output the cause of a violation when violation information is input. Any AI model can be applied as the learning model, but for example, a model for supervised learning (e.g., multiple regression analysis, deep learning) may be used. When using such a learning model, the correspondence between violation information and the cause of the violation is machine-learned in advance in the learning model. In this case, a data set of known causes of violations and violation information at the time the violation occurred is used as one set of training data, and multiple sets of training data are input to an untrained learning model. As a result, the learning model becomes a model in which the correspondence between violation information and the cause of the violation has been machine-learned.

[0068] Furthermore, the result analysis unit 134 may analyze the results of the security risk evaluation performed by the evaluation unit 133. The analysis results of the result analysis unit 134 include scores and evaluation comments for each evaluation item. For example, scores and evaluation comments may be determined in advance for each security risk level and stored in the storage unit 120, and the result analysis unit 134 may generate scores and evaluation comments according to the security risk level.

[0069] The output control unit 135 outputs the identification result (information indicating the cause of the violation) by the result analysis unit 134. The output control unit 135 may also output the analysis result of the security risk evaluation (such as the score of each evaluation item and evaluation comments). The output control unit 135 may create and output a report including text data and charts indicating this information. The output control unit 135 may provide the report to an administrator terminal 300 used by related parties such as a security officer or a system administrator.

[0070] Furthermore, the output control unit 135 may output an alert when the evaluation unit 133 evaluates the security risk to be equal to or greater than a predetermined value. That is, the output control unit 135 generates and outputs an alert when the evaluation unit 133 evaluates the security risk to be equal to or greater than a predetermined value. The alert may be a sound warning or a text warning. The output control unit 135 may output the generated alert to the administrator terminal 300 used by the system administrator or security officer. The predetermined value may be set arbitrarily, and may be level 4 when the security risk is evaluated on a five-point scale.

[0071] (Obtaining improvement proposals) The improvement proposal unit 136 acquires an improvement plan based on the cause of the violation identified by the result analysis unit 134. The improvement plan is information indicating a plan for resolving the violation of the information security policy. Examples of the improvement plan include promoting education on information security, correcting human error, updating the information processing system 200, and updating the information security policy itself.

[0072] The improvement proposal unit 136 inputs the cause of the current violation into a learning model that has already learned the correspondence between the cause of the violation and the improvement proposal, thereby acquiring the improvement proposal from the learning model. That is, the learning model selects and outputs an improvement proposal corresponding to the feature amount of the cause of the violation input this time. The improvement proposal unit 136 specifies the improvement proposal based on the improvement proposal acquired from the learning model. For example, the improvement proposal unit 136 may use the improvement proposal acquired from the learning model as the actual improvement proposal. Also, for example, when multiple improvement proposals (labels) are output from the learning model, the improvement proposal that has a probability of becoming the improvement proposal equal to or greater than a predetermined value and has the highest probability among the improvement proposals may be used as the actual improvement proposal.

[0073] The learning model is an AI model, i.e., a program, that can output an improvement plan when the cause of a violation is input. Any AI model can be applied as the learning model, but for example, a model for supervised learning (e.g., multiple regression analysis, deep learning) may be used. When using such a learning model, the correspondence between the cause of a violation and the improvement plan is machine-learned in advance in the learning model. In this case, a data set of known causes of violations and improvement plans that can resolve the violations is used as one set of training data, and multiple sets of training data are input to an untrained learning model. As a result, the learning model becomes a model in which the correspondence between the cause of violations and the improvement plans has been machine-learned.

[0074] The output control unit 135 outputs the improvement proposal acquired by the improvement proposing unit 136 .

[0075] (Processing when the cause cannot be identified) Here, the result analysis unit 134 may not be able to identify the cause of the violation. For example, the learning model for identifying the cause of the violation may output only causes (labels) whose probabilities are less than a predetermined value, and in such cases, the cause of the violation cannot be identified. In such a case where the result analysis unit 134 is unable to identify the cause of the violation, the improvement suggestion unit 136 may obtain an improvement proposal based on information indicating the cause of the violation input by the user.

[0076] More specifically, if the result analysis unit 134 cannot identify the cause of the violation, the output control unit 135 outputs information to the effect that the cause of the violation cannot be identified. After confirming the information, the user identifies the cause of the violation and inputs information indicating the identified cause of the violation. The improvement proposal unit 136 acquires the information on the cause of the violation input by the user and acquires an improvement plan based on the acquired cause. The method of acquiring the improvement plan in this case is the same as above except that the information input by the user is used as the cause of the violation, so the explanation will be omitted. Note that the input by the user may be made to the input unit 102 of the information security management device 100, or may be made to an input unit of another device such as the information processing system 200 or the administrator terminal 300.

[0077] Furthermore, if the cause of the violation is not identified by the user, that is, if the user does not input the cause of the violation (for example, if there is an input indicating that the cause of the violation cannot be identified), the improvement suggestion unit 136 does not acquire an improvement proposal. In this case, the output control unit 135 does not output an improvement proposal. The output control unit 135 may output at least one of information indicating that the cause cannot be identified and information indicating that the improvement proposal cannot be identified.

[0078] (Update of Information Security Policy) If the improvement proposal acquired by the improvement suggestion unit 136 is an update of the information security policy, the policy update unit 137 updates the information security policy based on the improvement proposal. The output control unit 135 outputs the information security policy updated by the policy update unit 137. In this case, the updated information security policy is reviewed, and if approved, the information security policy is actually updated.

[0079] Another example of the configuration and processing of the policy update unit 137 will be described with reference to Fig. 10. Fig. 10 is a diagram illustrating the configuration and processing of the policy update unit of the information security management device according to the present disclosure. As shown in Fig. 10, the policy update unit 137 includes a policy change receiving unit 1361 and a policy evaluation unit 1362. Note that the policy change request database and the policy storage database shown in Fig. 10 may be provided in any storage area, and may be provided in the storage unit 120 of the information security management device 100, for example.

[0080] The policy change receiving unit 1361 receives a policy change request from a user. The policy change receiving unit 1361 then stores the policy change request in a policy change request database. Specifically, the policy change request may include the information described below.

[0081] A policy change request accepted by the policy change accepting unit 1361 will be described with reference to Fig. 11. Fig. 11 is a diagram showing an example of a policy change request accepted by the policy change accepting unit of the information security management device according to the present disclosure. As shown in Fig. 11, the policy change request may include information relating to items such as the requester, policy change content, reason for proposed change, proposed date and time of change, policy before change, policy after change, scope of impact, urgency of change, importance of change, impact of change, and remarks for change.

[0082] The policy evaluation unit 1362 obtains a policy change request from the policy change request database and verifies the policy change. If the policy evaluation unit 1362 determines that the policy change is appropriate, it stores the policy change in the policy storage database. Then, when the policy evaluation unit 1362 receives the update result from the policy storage database, it updates the status of the policy change request in the policy change database. Then, the policy evaluation unit 1362 notifies the user of the update result.

[0083] (Processing flow) Next, the processing flow of the information security management device 100 according to this embodiment will be described with reference to the flowchart shown in Fig. 12. Fig. 12 is a flowchart showing the processing flow of the information security management device according to this embodiment.

[0084] The information security management device 100 uses the evaluation unit 133 to determine whether there is an information security policy violation based on the operation record information and the evaluation criteria (determines whether a policy violation has been detected) (step S101). If a policy violation is detected (step S101: Yes), the information security management device 100 executes data collection and analysis of the operation record information in which the policy violation was detected (step S102). That is, in step S102, the result analysis unit 134 identifies the cause of the information security policy violation. If the result analysis unit 134 can identify the cause of the information security policy violation (step S104: Yes), the information security management device 100 uses the improvement proposal unit 136 to generate an improvement proposal based on the identified cause (step S105).

[0085] If no policy violation is detected in step S101 (step S101: No), the information security management device 100 reports that no policy violation is detected (step S103).

[0086] Furthermore, in step S104, if the result analysis unit 134 is unable to identify the cause of the violation of the information security policy (step S104: No), the improvement proposal unit 136 identifies the cause using the output control unit 135 and the input unit 102 (step S106). That is, the output control unit 135 outputs information to the effect that the cause of the violation cannot be identified, and the input unit 102 accepts input of information indicating the cause of the violation. The improvement proposal unit 136 attempts to acquire information indicating the cause of the violation input by the user via the input unit 102. If the cause can be identified (step S107: Yes), the improvement proposal unit 136 generates an improvement proposal based on the identified cause (step S108).

[0087] If the cause cannot be identified in step S107 (step S107: No), the information security management device 100 notifies the user that an improvement plan could not be generated (step S109).

[0088] (Configuration of Information Processing System) Next, the configuration of the information processing system 200 according to the present disclosure will be described with reference to FIG. 13. FIG. 13 is a diagram showing a configuration example of the information processing system according to the present disclosure. As shown in FIG. 13, the information processing system 200 according to the present disclosure includes a communication unit 210, a storage unit 220, and a control unit 230. The configuration of these units will be described in order below. Specifically, the information processing system 200 refers to a server, but is not limited to this. The information processing system 200 may include at least the communication unit 210, the storage unit 220, and the control unit 230. The information processing system 200 may also include an input unit.

[0089] The communication unit 210 is responsible for transmitting and receiving information to and from an external device. The communication unit 210 is realized, for example, by a NIC equipped with a wired LAN terminal, a wireless LAN card, etc. The communication unit 210 is connected to the network N by wire or wirelessly, and transmits and receives information to and from the information security management device 100, the administrator terminal 300, etc.

[0090] The storage unit 220 is a storage device that stores various types of information. The storage unit 220 includes a main storage device and an auxiliary storage device. The main storage device may be realized by a semiconductor memory element such as a RAM, a ROM, or a flash memory. The auxiliary storage device may be realized by a hard disk, an SSD, an optical disk, or the like.

[0091] 13, the storage unit 220 includes an operation record information storage unit 221. The information items stored in the operation record information storage unit 221 are the same as the information items stored in the operation record information storage unit 121 of the information security management device 100, and therefore detailed description of the information items stored in the operation record information storage unit 221 will be omitted.

[0092] The control unit 230 is a controller that manages and controls the information processing system 200. The control unit 230 is realized by a CPU, an MPU, or the like executing various programs stored in the storage unit 220 using the RAM as a working area. The control unit 230 may also be realized by an integrated circuit such as an ASIC or an FPGA.

[0093] As shown in Fig. 13, the control unit 230 includes a receiving unit 231 and a providing unit 232. The control unit 230 realizes these functions and executes these processes by reading and executing a program (software) from the storage unit 220. Note that these functions of the control unit 230 may be realized by an electronic circuit. Furthermore, the control unit 230 may execute these processes by one CPU, or may include multiple CPUs and execute these processes in parallel by the multiple CPUs. Below, these configurations will be explained in order.

[0094] The receiving unit 231 receives requests to provide various types of information. For example, the receiving unit 231 receives a request to provide operation record information from the information security management device 100. The request to provide operation record information may include the recording period of the operation record information, items of information included in the operation record information, and the like.

[0095] The providing unit 232 provides various information. For example, when the receiving unit 231 receives a request for providing operation record information from the information security management device 100, the providing unit 232 reads the operation record information for which the request for providing is received from the operation record information storage unit 221, and provides the operation record information to the information security management device 100 via the network N.

[0096] (Administrator terminal configuration) Next, the configuration of the administrator terminal 300 according to the present disclosure will be described with reference to FIG. 14. FIG. 17 is a diagram showing an example of the configuration of the administrator terminal according to the present disclosure. As shown in FIG. 14, the administrator terminal 300 according to the present disclosure includes a communication unit 310, a storage unit 320, a control unit 330, a sound output unit 340, and a display unit 350. Although not shown in FIG. 14, an input unit realized by a keyboard, a mouse, or the like may be included. Below, these configurations will be described in order.

[0097] The communication unit 310 is responsible for transmitting and receiving information to and from an external device. The communication unit 310 is realized, for example, by a NIC equipped with a wired LAN terminal, a wireless LAN card, etc. The communication unit 310 is connected to the network N by wire or wirelessly, and transmits and receives information to and from the information security management device 100, the information processing system 200, etc.

[0098] The storage unit 320 is a storage device that stores various types of information. The storage unit 320 includes a main storage device and an auxiliary storage device. The main storage device may be realized by a semiconductor memory element such as a RAM, a ROM, or a flash memory. The auxiliary storage device may be realized by a hard disk, an SSD, an optical disk, or the like.

[0099] The control unit 330 is a controller that manages and controls the administrator terminal 300. The control unit 330 is realized by a CPU, an MPU, or the like executing various programs stored in the storage unit 320 using the RAM as a working area. The control unit 330 may also be realized by an integrated circuit such as an ASIC or an FPGA.

[0100] As shown in Fig. 14, the control unit 330 includes a receiving unit 331 and a providing unit 332. The control unit 330 realizes these functions and executes these processes by reading and executing a program (software) from the storage unit 320. Note that these functions of the control unit 330 may be realized by an electronic circuit. The control unit 330 may execute these processes by one CPU, or may include multiple CPUs and execute these processes in parallel by the multiple CPUs. Below, these configurations will be explained in order.

[0101] The reception unit 331 receives various operations from the administrator. For example, the reception unit 331 receives a request to provide an evaluation result of the implementation status of the information security policy and a request to provide improvement suggestions. The reception unit 331 may receive such information from the administrator via the input unit.

[0102] The providing unit 332 provides various information to the administrator. For example, when the receiving unit 331 receives a request for providing the confirmation result of the implementation status of the information security policy from the administrator, the providing unit 332 provides the confirmation result of the implementation status of the information security policy to the administrator by displaying the confirmation result of the implementation status of the information security policy provided from the information security management device 100 on the display unit 350.

[0103] The sound output unit 340 outputs various sounds. For example, the sound output unit 340 may output sounds notifying the completion of various information processes or alerts. The sound output unit 340 may be a speaker, and the speaker converts an electric signal into sound using a diaphragm. That is, the speaker vibrates the diaphragm with a predetermined amplitude and frequency based on a control command given by an electric signal, thereby vibrating the air in contact with the diaphragm to output sound.

[0104] The display unit 350 displays various information. For example, the display unit 350 may display a GUI (Graphical User Interface) for executing various processes in the administrator terminal 300. The display unit 350 may be realized by a liquid crystal display, an organic EL (Electro Luminescence) display, a micro LED (Light Emitting Diode) display, or the like.

[0105] (Composition and Effects) The information security management device 100 disclosed herein includes a data collection unit 131 that collects operation record information indicating the processing contents that are subject to rules regarding information security, an evaluation unit 133 that determines whether the rules have been violated based on operation record information evaluation criteria, a result analysis unit 134 that identifies the cause of the violation based on the operation record information if the rules have been violated, and an improvement proposal unit 136 that obtains an improvement proposal to resolve the violation based on the identified cause of the violation.

[0106] According to this configuration, by using the operation record information and the evaluation criteria, it is possible to automatically and accurately determine whether the information security policy is violated. Furthermore, if a violation is found, it is possible to automatically generate an appropriate improvement plan by identifying the cause from the operation record information and generating an improvement plan. Therefore, it is possible to provide an information security management device 100 that can accurately confirm that the information security policy is functioning properly.

[0107] The information security management device 100 according to the present disclosure further includes an output control unit 135 that outputs information, and when the result analysis unit 134 cannot identify the cause of the violation, the output control unit 135 outputs information indicating the cause of the violation.

[0108] According to this configuration, even if the cause cannot be automatically identified, an improvement plan can be appropriately generated using the user's cause analysis results.

[0109] The information security management device 100 according to the present disclosure acquires information on an evaluation target that specifies the processing content that is the subject of a rule, and acquires evaluation criteria to be used for judgment from the operation history of a specified device based on the evaluation target.

[0110] According to this configuration, the operation information and evaluation criteria used for the violation of the information security policy are selected depending on the evaluation target, so that it is possible to confirm with a high degree of accuracy that the information security policy is functioning properly.

[0111] The information security management method disclosed herein includes the steps of collecting operation record information that identifies the processing content that is subject to the rules, determining whether the rules have been violated based on the operation record information and evaluation criteria, and, if the rules have been violated, identifying the cause of the violation based on the operation record information, and obtaining an improvement proposal to resolve the violation based on the identified cause of the violation.

[0112] According to this configuration, it is possible to accurately confirm that the information security policy is functioning properly.

[0113] The program disclosed herein causes a computer to execute the steps of collecting operation record information that identifies the processing content that is the subject of the rule, determining whether the rule has been violated based on the operation record information and an evaluation criterion, identifying the cause of the violation based on the operation record information if the rule has been violated, and obtaining an improvement proposal to resolve the violation based on the identified cause of the violation.

[0114] According to this configuration, it is possible to accurately confirm that the information security policy is functioning properly.

[0115] Although the embodiment of the present invention has been described above, the embodiment is not limited to the contents of this embodiment. The above-mentioned components include those that a person skilled in the art can easily imagine, those that are substantially the same, and those that are within the so-called equivalent range. Furthermore, the above-mentioned components can be appropriately combined. Furthermore, various omissions, substitutions, or modifications of the components can be made without departing from the gist of the above-mentioned embodiment. [Explanation of symbols]

[0116] 1. Information Security Policy Implementation Status Evaluation System 100 Information security management device 102 Input section 104 Output section 110 Communications Department 120 Storage section 121 Operation record information storage unit 122 Evaluation criteria memory unit 123 Policy implementation status memory unit 130 Control section 131 Data Collection Department 132 Standard Acquisition Department 133 Evaluation Department 134 Results Analysis Department 135 Output control section 136 Improvement Suggestions Department 137 Policy Update Section 200 Information Processing Systems 210 Communications Department 220 Storage section 221 Operation record information storage unit 230 Control Unit 231 Reception 232 Provision Department 300 Administrator terminal 310 Communications Department 320 Storage section 330 Control Unit 331 Reception 332 Providing Department 340 Sound output section 350 Display section N Network

Claims

1. a data collection unit that collects operation record information indicating processing contents that are subject to rules regarding information security; an evaluation unit that judges whether the rule is violated based on the operation record information and an evaluation criterion; a result analysis unit that identifies a cause of the violation based on the operation record information when the rule is violated; an improvement proposal unit that obtains an improvement proposal for resolving the violation based on the identified cause of the violation; Equipped with Information security management device.

2. An output control unit that outputs information, the output control unit outputs information indicating the cause of the violation when the result analysis unit cannot identify the cause of the violation.

2. The information security management device according to claim 1.

3. a criterion acquisition unit that acquires information on an evaluation target that identifies a processing content that is a target of the rule, and acquires the evaluation criterion to be used for judgment based on the evaluation target; the data collection unit collects the operation record information to be used for judgment from an operation history of a predetermined device based on the evaluation target; 3. An information security management device according to claim 1 or 2.

4. collecting operational record information indicating processing content that is subject to rules regarding information security; determining whether the rule is violated based on the operation record information and an evaluation criterion; If the rule is violated, identifying the cause of the violation based on the operation record information; obtaining a remediation plan for resolving the violation based on the identified cause of the violation; Information security management methods, including:

5. collecting operational record information indicating processing content that is subject to rules regarding information security; determining whether the rule is violated based on the operation record information and an evaluation criterion; If the rule is violated, identifying the cause of the violation based on the operation record information; obtaining a remediation plan for resolving the violation based on the identified cause of the violation; A program that causes a computer to execute the following.

Images