Security measure determination apparatus, and security measure determination method

Abstract

To properly and rapidly determine security measures of a plurality of levels.SOLUTION: A security measure determination apparatus holds: information indicating a target system for security measure, a target component included in the target system, and specifications of the target system and the target component; and information indicating a first level measure for the component, a first restriction condition relating to the specification of the component for implementing the first level measure, a second level measure for the system, and a second restriction condition relating to the specification of the system for implementing the second level measure. The apparatus, based on the specification of the target component and the first restriction condition, specifies the first level measure which can be implemented on the target component, and based on the specification of the target system and the second restriction condition, specifies the second level measure which can be implemented in the target system.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to a security countermeasure decision device and a security countermeasure decision method.

Background Art

[0002] With the advancement of DX (Digital Transformation), the threat of cyberattacks is increasing as various and numerous elements (devices, OS (Operating System), software, subsystems, clouds, etc.) are intricately intertwined.

[0003] Therefore, to realize a safe and secure industrial control system, security measures against cyberattacks are required. As represented by the European Cyber Resilience Act and the Japanese Act on the Promotion of Economic Security, the legal regulation of security measures and the standardization of security measures for industrial control systems represented by ISO / IEC 62443 are also progressing.

[0004] In the future, it will be required to implement security measures that comply with the above-mentioned laws and regulations and standards. However, the security measures required by laws and regulations and standards are abstract in terms of content and expression in order to ensure generality, and there is a deviation from the countermeasure content that can be implemented in the actual system. Therefore, the method of realizing the security measures required by laws and regulations and standards is realized by selecting from a plurality of candidates or a combination thereof. Therefore, a method for determining an appropriate countermeasure or an appropriate combination of countermeasures from a plurality of security countermeasure candidates is required.

[0005] As background art in this technical field, there is Japanese Unexamined Patent Application Publication No. 2015-130152 (Patent Document 1). This publication states that "the risk analysis unit identifies a plurality of threats to be addressed in the data system to be developed as target threats. The countermeasure analysis unit extracts security countermeasures for each target threat. The optimization execution unit combines the security countermeasures extracted by the countermeasure analysis unit to generate a combination pattern of security countermeasures for a plurality of target threats, and for each combination pattern, analyzes the effects caused by the combination of the security countermeasures included in the combination pattern, calculates an implementation impact value representing the impact on the data system to be developed when the combination of the security countermeasures is implemented, and selects a specific combination pattern based on the calculated implementation impact value." (See the abstract).

Prior Art Documents

Patent Documents

[0006]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0007] The technology described in Patent Document 1 determines security countermeasures for the components constituting the system. However, security countermeasures required by many regulations and standards include not only the above-mentioned countermeasures at the component level but also countermeasures at the system level such as those achieved by devising the system configuration and settings, etc. Therefore, in the technology described in Patent Document 1, there is a possibility that security countermeasures at levels other than the component level are not presented, that is, appropriate security countermeasures are not presented. Also, in many regulations and standards, it is not specified which level of security countermeasures should be implemented, and it takes time (man-hours) to determine the security countermeasures to be implemented. Therefore, one aspect of the present invention is to appropriately and quickly determine security countermeasures at multiple levels.

Means for Solving the Problems

[0008] To solve the above problems, one aspect of the present invention adopts the following configuration. The security countermeasure decision device includes a processor and a memory. The memory holds target information indicating a target system for security countermeasures, specifications of the target system, target components included in the target system, and specifications of the target components, countermeasure content information indicating a first-level countermeasure that is a security countermeasure for a component, a first constraint condition regarding the specifications of the components for implementing the first-level countermeasure, a second-level countermeasure that is a security countermeasure for the system, and a second constraint condition regarding the specifications of the system for implementing the second-level countermeasure. The processor executes a first-level countermeasure identification process for identifying a first-level countermeasure that can be implemented for the target component based on the specifications of the target component and the first constraint condition, and a second-level countermeasure identification process for identifying a second-level countermeasure that can be implemented for the target system based on the specifications of the target system and the second constraint condition, and generates data for displaying the identified first-level countermeasure and the identified second-level countermeasure.

Advantages of the Invention

[0009] According to one aspect of the present invention, security countermeasures at multiple levels are determined appropriately and quickly.

[0010] Problems, configurations, and effects other than those described above will be clarified by the description of the following embodiments.

Brief Description of the Drawings

[0011]

Figure 1

Figure 2

Figure 3A

Figure 3B

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Figure 14

Figure 15

Figure 16

Modes for Carrying Out the Invention

[0012] Hereinafter, examples of embodiments for implementing the present invention (hereinafter referred to as "embodiments") will be described with reference to the accompanying drawings. In this specification and the accompanying drawings, the same reference numerals are assigned to the same components or components having substantially the same functions, and redundant descriptions are omitted.

Example

[0013] [Configuration Example of Security Countermeasure Decision Device] FIG. 1 is a block diagram showing a functional configuration example of a security countermeasure decision device. The security countermeasure decision device 100 determines security countermeasures (hereinafter simply referred to as "countermeasures") to be implemented for a security countermeasure target (hereinafter simply referred to as "countermeasure target" or "target"). The operation of a facility such as a factory, a system such as an industrial control system installed in the facility, and components constituting the system are all examples of countermeasure targets. The security countermeasure decision device 100 determines countermeasures for each target level in an inclusion relationship such as the operation of a facility, a system, and a component. The security countermeasure decision device 100 is an example of an information processing device.

[0014] The security countermeasure decision device 100 is connected to a requirement input unit 110 and a countermeasure target information input unit 120. The requirement input unit 110 acquires requirement items in laws, regulations, and standards (for example, by input from a user or reception from an external device) and inputs them to the security countermeasure decision device 100.

[0015] The requirement input unit 110 may acquire the requirement items themselves in laws, regulations, and standards, or may acquire the texts of laws, regulations, and standards. When the requirement input unit 110 acquires the texts of laws, regulations, and standards, it extracts the requirement items from the text by natural language processing using machine learning, deep learning, etc., and inputs the extracted requirement items to the security countermeasure decision device 100.

[0016] Note that the claim items input by the claim item input unit 110 may include any rules regarding security for the countermeasure target, such as domestic laws, international laws, domestic regulations, international regulations, industry regulations, in-house regulations, domestic standards, international standards, industry standards, and in-house standards.

[0017] The countermeasure target information input unit 120 acquires information regarding the countermeasure target (hereinafter also referred to as "target information") (for example, by input from a user or reception from an external device) and inputs it to the security countermeasure determination device 100.

[0018] The target information includes, for example, the name of a facility such as a factory, the operation mode of the facility, and the operation rules of the facility. Further, the target information includes information indicating the type and number of industrial control systems installed in the facility, and information indicating components (devices, OS, software, subsystems, and cloud, etc.) constituting each industrial control system, etc., that is, information indicating the system configuration. The information on the system configuration includes information indicating the connection form between systems and the connection form of a plurality of components within the system.

[0019] Also, although details will be described later, there are constraint conditions regarding the system for implementing countermeasures against the industrial control system and constraint conditions regarding the components for implementing countermeasures against each component included in the industrial control system. The target information includes information for determining whether the industrial control system satisfies the constraint conditions regarding the system and information for determining whether the components included in the industrial control system satisfy the constraint conditions regarding the components.

[0020] Constraints on the system include, for example, information regarding system specifications. Information regarding system specifications includes, for example, information related to communication such as the communication volume of data transmitted and received within or between systems, the transmission and reception cycle, and whether the communication volume and cycle can be changed, information regarding whether components can be added or removed from the system, and information regarding the functions and performance of the system. Therefore, the target information includes this information regarding industrial control systems.

[0021] Constraints on components include, for example, information regarding component specifications. Information regarding component specifications indicates, for example, information related to the elements that make up the component (the elements included in the component, and the type and performance of each element, etc.). Specifically, for example, the type of CPU chip included in the component, the type of OS included in the component, and the capacity of the memory included in the component are all examples of constraints on the component. Therefore, the target information includes this information regarding components.

[0022] The requirement input unit 110 and the countermeasure target information input unit 120 can be configured by, for example, an input device of a communication terminal such as a PC (Personal Computer), or a communication device that communicates with an external device.

[0023] The security countermeasure determination device 100 includes, for example, a threat event analysis unit 130, a countermeasure extraction unit 140, a component countermeasure review unit 150, a system countermeasure review unit 160, and an operation countermeasure review unit 170, all of which are functional units.

[0024] The threat event analysis unit 130 converts the requirements input from the requirement input unit 110 into threat events tailored to the countermeasure target using the target information input from the countermeasure target information input unit 120, and outputs information indicating the threat events to the countermeasure extraction unit 140.

[0025] For example, the threat event analysis unit 130 obtains the text of laws, regulations, and standards from the requirement input unit 110, and uses a predetermined natural language processing algorithm to obtain from the text the reason why the requirement is necessary, that is, information on the threat event to be prevented, thereby identifying the threat event corresponding to the requirement.

[0026] Also, for example, a database showing the correspondence between requirements and threat events may be prepared in advance, and the threat event analysis unit 130 may convert the requirements into threat events according to the correspondence shown in the database. Also, for example, the threat event analysis unit 130 may use external information obtained from websites on the Internet (for example, text showing the relationship between requirements and threat events, information showing the correspondence between requirements and threat events, etc.) to convert the requirements into threat events. Also, for example, the threat event analysis unit 130 may use AI (Artificial Intelligence) to convert the requirements into threat events.

[0027] The countermeasure extraction unit 140 extracts, as a countermeasure content group, all the countermeasure contents effective for the threat event converted by the threat event analysis unit 130 based on the information in the countermeasure content storage unit 190 connected to the security countermeasure decision device 100.

[0028] The countermeasure content storage unit 190 stores a countermeasure content table 400, which will be described later with reference to FIG. 4. The countermeasure content table 400 shows, for example, the content of the countermeasure (specific implementation method), the threat event that can be prevented by the countermeasure, and the target for which the countermeasure can be implemented.

[0029] The component countermeasure examination unit 150 examines, for each component of the industrial control system installed in a facility such as a factory, among the target information input by the countermeasure target information input unit 120, the component-level countermeasures (an example of the first-level countermeasures) that can be implemented from the countermeasure content group extracted by the countermeasure extraction unit 140.

[0030] The component countermeasure study unit 150 outputs component-level countermeasures that can be implemented for each component to the countermeasure content output unit 180. When the component countermeasure study unit 150 determines that there is a component for which no implementable component-level countermeasure exists, it determines that additional countermeasures are necessary and outputs an additional countermeasure request indicating that additional countermeasures are necessary for the system including the component to the system countermeasure study unit 160.

[0031] The system countermeasure study unit 160 uses, among the target information input by the countermeasure target information input unit 120, the target information for each industrial control system installed in a facility such as a factory, and examines system-level countermeasures (an example of the second-level countermeasures) that can be implemented for each system indicated by the additional countermeasure request from the component countermeasure study unit 150 among the countermeasure content groups extracted by the countermeasure extraction unit 140.

[0032] The system countermeasure study unit 160 outputs system-level countermeasures that can be implemented for each system indicated by the additional countermeasure request from the component countermeasure study unit 150 to the countermeasure content output unit 180. When the system countermeasure study unit 160 determines that there is a system for which no implementable system-level countermeasure exists, it determines that additional countermeasures are necessary and outputs an additional countermeasure request indicating that additional countermeasures are necessary for operation to the operation countermeasure study unit 170.

[0033] When receiving the additional countermeasure request from the system countermeasure study unit 160, the operation countermeasure study unit 170 uses, among the target information input by the countermeasure target information input unit 120, the target information related to the operation of the facility such as a factory where the countermeasure is to be implemented, and extracts operation-level countermeasures (an example of the third-level countermeasures) from the countermeasure content groups extracted by the countermeasure extraction unit 140 and outputs them to the countermeasure content output unit 180.

[0034] Note that component-level countermeasures are measures implemented for individual components. System-level countermeasures are measures implemented for individual systems (as a whole system). Operational-level countermeasures are measures related to the operation of a facility (for example, operational measures applied collectively to all systems included in the facility).

[0035] The countermeasure content output unit 180 outputs information indicating the component-level countermeasures output from the component countermeasure study unit 150, the system-level countermeasures output from the system countermeasure study unit 160, and the operational-level countermeasures output from the operation countermeasure study unit 170 to the display screens of the terminal devices 26a and 26b (described later with reference to FIG. 2) connected to the security countermeasure determination device 100. In the example of FIG. 1, the countermeasure content output unit 180 is provided outside the security countermeasure determination device 100, but it may also be built into the security countermeasure determination device 100.

[0036] [Example of Hardware Configuration of Security Countermeasure Determination Device] FIG. 2 is a block diagram showing an example of the hardware configuration of the security countermeasure determination device 100. The security countermeasure determination device 100 includes an information processing device 20 and an auxiliary storage device 24. Note that the information processing device 20 may incorporate the auxiliary storage device 24.

[0037] The information processing device 20 is, for example, a computer including a processing unit 21, a memory 22, and an input / output I / F (interface) 23, each of which is connected to a bus. The processing unit 21, the memory 22, and the input / output I / F 23 are hardware used in a computer.

[0038] The processing unit 21 realizes the functions of the above-described functional units (threat event analysis unit 130, countermeasure extraction unit 140, component countermeasure consideration unit 150, system countermeasure consideration unit 160, and operation countermeasure consideration unit 170) by executing the programs stored in the memory 22. The processing unit 21 includes a processor and is configured by, for example, a CPU (Central Processing Unit). The processing unit 21 may be configured by an MPU (Micro-Processing Unit) or the like instead of the CPU.

[0039] The memory 22 includes, for example, a ROM (Read Only Memory) and a RAM (Random Access Memory). The ROM stores invariant programs (e.g., BIOS (Basic Input / Output System)). The RAM is a high-speed and volatile storage element such as a DRAM (Dynamic Random Access Memory), and the programs executed by the processing unit 21 and the data (variables, parameters, etc. generated during processing) used during the execution of the programs by the processing unit 21 are temporarily written therein.

[0040] The auxiliary storage device 24 uses a large-capacity and non-volatile storage device. The auxiliary storage device 24 is, for example, an HDD (Hard Disk Drive), an SSD (Solid State Drive), an NVRAM (Non-Volatile Random Access Memory), or the like.

[0041] In addition to the OS (Operating System) and various parameters, programs for operating the computer of the information processing apparatus 20 may be recorded in the auxiliary storage device 24. That is, the programs are read from the auxiliary storage device 24, loaded into the memory 22, and executed by the processing unit 21.

[0042] The processor included in the processing unit 21 functions as the threat event analysis unit 130 by operating according to the threat event analysis program loaded in the memory 22, and functions as the countermeasure extraction unit 140 by operating according to the countermeasure extraction unit program loaded in the memory 22. Regarding other functional units included in the security countermeasure determination device 100, the relationship between the program and the functional unit is the same.

[0043] Part or all of the programs executed by the processing unit 21 may be provided to the information processing device 20 via a network from a removable medium (flexible disk, optical disk, magneto-optical disk, CD-ROM, CD-R, non-volatile memory card, etc.), which is a non-temporary storage medium, or an external computer equipped with a non-temporary storage device, and stored in the non-volatile storage device, which is a non-temporary storage medium of the information processing device 20. Therefore, the information processing device 20 may have an interface for reading data from the removable medium.

[0044] The countermeasure content storage unit 190 is realized by a part of the storage area of the auxiliary storage device 24. A countermeasure content table 400 is stored in the countermeasure content storage unit 190. Note that part or all of the information stored in the auxiliary storage device 24 in FIG. 2 may be stored in the memory 22.

[0045] Note that in this embodiment, the information used by the security countermeasure determination device 100 may be expressed in any data structure regardless of the data structure. In this embodiment, the information is expressed in a table format. For example, however, a data structure appropriately selected from a list, a database, or a queue can store the information.

[0046] The input / output I / F 23 is a device that controls the input and output of data performed between the information processing apparatus 20 and other devices. The input / output I / F 23 includes, for example, a network interface device that controls communication with other devices according to a predetermined protocol. Also, for example, the input / output I / F 23 includes an interface device to which, for example, a keyboard, a mouse, etc. are connected and which receives input from an operator. Further, the input / output I / F 23 includes an interface device to which, for example, a display, a printer, etc. are connected and which outputs the execution result of a program in a form visible to the operator. Also, the input / output I / F 23 includes a serial interface such as USB (Universal Serial Bus), for example.

[0047] In the present embodiment, for example, an auxiliary storage device 24, terminal devices 26a, and terminal devices 26b, etc. are connected to the input / output I / F 23. Note that the requirement input unit 110, the countermeasure target information input unit 120, and the countermeasure content output unit 180 may be constituted by the input / output I / F 23.

[0048] Note that the security countermeasure determination apparatus 100 is a computer system constituted on one physical computer or on a plurality of computers configured logically or physically, and may operate in separate threads on the same computer, or may operate on a virtual computer constructed on a plurality of physical computer resources.

[0049] The terminal device 26a communicates with the information processing apparatus 20 using a closed-circuit network such as a dedicated line, for example. The terminal device 26a is used in an on-premises type system. By an engineer, an administrator, etc. operating an input device such as a keyboard connected to the terminal device 26a, information on a countermeasure target and information on requirement items are input, and these pieces of information are transmitted to the information processing apparatus 20 of the security countermeasure determination apparatus 100.

[0050] The terminal device 26b communicates with the information processing device 20 via the network 25. Similar to the terminal device 26a, when an engineer, administrator, or the like operates an input device such as a keyboard connected to the terminal device 26b, information on the countermeasure target and information on the requirements are input, and this information is transmitted to the information processing device 20 of the security countermeasure determination device 100.

[0051] The network 25 may be, for example, a wireless network or a wired LAN (Local Area Network) that provides a plurality of topologies.

[0052] The Internet 27 is an example of a public switched telephone network. The information processing device 20 that constitutes the security countermeasure determination device 100 communicates with communication devices such as a cloud or an external factory via the Internet 27. The public switched telephone network may be a wireless communication infrastructure (wireless network) provided by a line provider.

[0053] Note that each of the terminal device 26a and the terminal device 26b also includes a processing unit (processor), a memory, an input / output I / F, and a storage device (non-volatile storage), and realizes functions by the processing unit executing a program stored in the memory. Each of the terminal device 26a and the terminal device 26b includes a display device (not shown) that displays information such as the state of the target system, and an input device (not shown) that generates an input signal according to the input content by a system administrator or the like.

[0054] [Examples of Countermeasure Targets] Figure 3A is an explanatory diagram showing an example of a target for countermeasures. In Figure 3A, the first factory 310 is an example of a target for countermeasures. The first factory 310 includes a first industrial control system 320 and a second industrial control system 330. The first industrial control system 320 includes a first PC (Personal Computer) 321, a first robot 322, and a first PLC (Programable Logic Controller) 323, all of which are components. The second industrial control system 330 includes a second PC 331, a second robot 332, and a second PLC 333, all of which are components.

[0055] The first industrial control system 320 is a system that manufactures products using the first robot 322. The second industrial control system 330 is a system that transports and sorts products using the second robot 332.

[0056] The first PC 321 is a component that sets the first robot 322 and the first PLC 323. The second PC 331 is a component that sets the second robot 332 and the second PLC 333.

[0057] The first robot 322 is a component that is controlled by the first PLC 323 and is used for manufacturing products. The second robot 332 is a component that is controlled by the second PLC 333 and is used for transporting and sorting products.

[0058] The first PLC 323 is a component that controls the first robot 322 based on the control content set by the first PC 321. The second PLC 333 is a component that controls the second robot 332 based on the control content set by the second PC 331.

[0059] FIG. 3B is a diagram showing an example of the data configuration of the target information input by the target information input unit 120. The example of the target information 350 in FIG. 3B is information corresponding to the target to be countered in FIG. 3A. The target information 350 includes, for example, a facility column 351, a system column 352, a system specification column 353, a component column 354, and a component specification column 355.

[0060] The facility column 351 holds information indicating the facility to be countered. The system column 352 holds information indicating the systems possessed by the facility. The system specification column 353 holds information indicating the specifications of the system (information regarding the constraints of the system). The component column 354 holds information indicating the components included in the system. The component specification column 355 holds information indicating the specifications of the component (information regarding the constraints of the component).

[0061] [Countermeasure Content Table] FIG. 4 is a diagram showing an example of the data configuration of the countermeasure content table 400. The countermeasure content table 400 includes, for example, a countermeasure column 410, a corresponding threat column 420, a target level column 430, and a constraint condition column 440. This countermeasure content table 400 is created in advance and stored in the auxiliary storage device 24 according to the input of, for example, an engineer or an administrator.

[0062] The countermeasure column 410 stores information indicating the content of the countermeasure (hereinafter also referred to as "countermeasure content"). The corresponding threat column 420 stores information indicating the threat events that can be prevented by the countermeasure content.

[0063] In the example of FIG. 4, for the countermeasure content of "using the encryption function", "parameter rewriting" and "information theft" are registered as the corresponding threat events. Similarly, the corresponding threat event for the countermeasure content of "using the restriction of network access" is "parameter rewriting". Also, the corresponding threat element for the countermeasure content of "strengthening authentication during terminal use" is "parameter rewriting". Also, the corresponding threat element for the countermeasure content of "using the input content verification function" is "parameter rewriting".

[0064] In the target level column 430, information indicating the level at which the countermeasure content is implemented is stored. In the example of FIG. 4, for the countermeasure content of "using encryption function", "component" is registered as the target level. Similarly, the target level at which the countermeasure content of "using restriction of network access" is implemented is "system". Also, the target level at which the countermeasure content of "strengthening authentication during terminal use" is implemented is "operation". Also, the target level at which the countermeasure content of "using verification function of input content" is implemented is "component". Note that there may be multiple target levels at which one countermeasure content can be implemented.

[0065] When security countermeasures are taken at the operation level of the entire facility, the effects of the security countermeasures also extend to the systems (and components included in the systems) included in the facility. Also, when security countermeasures are taken at the system level, the effects of the security countermeasures also extend to the components included in the system. Thus, the target levels are in an inclusion relationship ("operation" includes "system" (and "component"), and "system" includes "component").

[0066] In the constraint condition column 440, information indicating the constraint conditions required for the system or component indicated by the target level in order to implement the countermeasure indicated by the countermeasure column 410 is stored. As described above, the constraint conditions related to the system include conditions related to the system specification (an example of the second constraint condition), and the constraint conditions related to the component include conditions related to the component specification (an example of the first constraint condition). Note that since there are no technical constraint conditions for operation, in the example of FIG. 4, the information indicating the constraint conditions corresponding to operation is not stored in the constraint condition column 440.

[0067] [Component Countermeasure Decision Processing] FIG. 5 is a flowchart showing an example of the component countermeasure decision processing by the component countermeasure study unit 150.

[0068] Incidentally, in the following, an example is handled where the claim input unit 110 inputs "ensuring information integrity" as a claim to the security countermeasure determination device 100, and the threat event analysis unit 130 converts "ensuring information integrity", which is the claim, into a threat event "parameter rewriting". Therefore, in this example, the countermeasure extraction unit 140 outputs, as a countermeasure content group, "using an encryption function", "using restrictions on network access", "strengthening authentication during terminal use", and "using an input content verification function", which are the countermeasure contents corresponding to "parameter rewriting" in the corresponding threat column 420 from the countermeasure content table 400. Also, in this example, it is assumed that the countermeasure target information input unit 120 inputs target information 350 regarding the first factory 310 (and the system included in the first factory 310, the components constituting the system) shown in FIG. 3B to the security countermeasure determination device 100.

[0069] The component countermeasure examination unit 150 acquires the target information regarding the components from the target information input by the countermeasure target information input unit 120 (S501). That is, in this example, the component countermeasure examination unit 150 acquires the target information regarding each of the first PC 321, the first robot 322, the first PLC 323, the second PC 331, the second robot 332, and the second PLC 333.

[0070] The component countermeasure examination unit 150 selects one component (for example, randomly) from the unselected components for which countermeasures are to be examined (S502). In the first step S502, it is assumed that the component countermeasure examination unit 150 selects the first PC 321.

[0071] The component countermeasure study unit 150 determines whether there are component-level countermeasures that can be implemented for the component selected in the most recent step S502 (S503). In this example, the component countermeasure study unit 150 refers to the target information regarding the first PC 321 acquired in step S501, and determines whether the component specifications of the first PC 321 satisfy the constraint conditions of each of the countermeasure contents whose target level is "component" among the countermeasure content groups extracted by the countermeasure extraction unit 140, thereby determining whether there are component-level countermeasures that can be implemented for the first PC 321.

[0072] Hereinafter, it is assumed that the component countermeasure study unit 150 determines that for the first PC 321, "use of encryption function" among the component-level countermeasures can be implemented, and "use of input content verification function" cannot be implemented. In this case, since there are component-level countermeasures that can be implemented for the first PC 321, the component countermeasure study unit 150 determines "YES" in step S503 and proceeds to the process of step S504.

[0073] The component countermeasure study unit 150 transmits the "use of encryption function" that can be implemented for the first PC 321 determined in the most recent step S503 to the countermeasure content output unit 180 as a component-level countermeasure (S504).

[0074] The component countermeasure study unit 150 determines whether there are components for which component-level countermeasures have not been considered (S506). In this example, at this stage, only the component-level countermeasures for the first PC 321 among the components are considered, and there are components such as the first robot 322 for which component-level countermeasures have not been considered. Therefore, the component countermeasure study unit 150 determines "YES" in step S506 and returns to step S502.

[0075] The component countermeasure study unit 150 selects one component (e.g., randomly) from the components for which component-level countermeasures have not been studied to study component-level countermeasures (S502). In the second step S502, assume that the component countermeasure study unit 150 selects the first robot 322.

[0076] The component countermeasure study unit 150 determines whether there are component-level countermeasures that can be implemented for the first robot 322 (S503). In this example, the component countermeasure study unit 150 refers to the target information regarding the first robot 322 obtained in step S501, and determines whether the component specifications of the first robot 322 satisfy the constraint conditions of each countermeasure content whose target level is "component" among the countermeasure content groups extracted by the countermeasure extraction unit 140, thereby determining whether there are component-level countermeasures that can be implemented for the first robot 322.

[0077] Hereinafter, assume that the component countermeasure study unit 150 determines that there are no component-level countermeasures that can be implemented for the first robot 322. In this case, the component countermeasure study unit 150 determines "NO" in step S503 and proceeds to the process of step S505.

[0078] The component countermeasure study unit 150 sends an additional countermeasure request including information indicating the component (here, information indicating the first robot 322) determined not to have implementable component-level countermeasures in the most recent step S503 and information indicating that additional countermeasures (at the system level for the system including the component) are required to the system countermeasure study unit 160 (S505).

[0079] The component countermeasure study unit 150 proceeds to the process of step S506 and repeats the above procedure until there are no components for which component-level countermeasures have not been considered. When the component countermeasure study unit 150 determines that there are no components for which countermeasures have not been considered, it determines "NO" in step S506, and the component countermeasure decision process ends.

[0080] [System countermeasure decision process] FIG. 6 is a flowchart showing an example of the system countermeasure study and decision process by the system countermeasure study unit 160.

[0081] The system countermeasure study unit 160 acquires the target information related to the system among the target information input by the target information input unit 120 (S601). That is, in this example, the system countermeasure study unit 160 acquires the target information related to each of the first industrial control system 320 and the second industrial control system 330.

[0082] The system countermeasure study unit 160 refers to the additional countermeasure request from the component countermeasure study unit 150 and identifies the systems that require additional countermeasures at the system level (S602). In this example, since there are no implementable component-level countermeasures for the first robot 322, the system countermeasure study unit 160 identifies the first industrial control system 320 including the first robot 322 as a system that requires additional countermeasures at the system level. Note that in this example, it is assumed that the system countermeasure study unit 160 also identifies the second industrial control system 330 as a system that requires additional countermeasures.

[0083] The system countermeasure study unit 160 selects one system (for example, randomly) from the unselected systems among the systems identified as systems that require additional countermeasures in step S602 for countermeasure study (S603). In the first step S603, it is assumed that the system countermeasure study unit 160 selects the first industrial control system 320.

[0084] The system countermeasure study unit 160 determines whether there are system-level countermeasures that can be implemented for the system selected in the most recent step S603 (S604). In this example, the system countermeasure study unit 160 refers to the target information regarding the first industrial control system 320 obtained in step S601, and determines whether the system specifications of the first industrial control system 320 satisfy the constraint conditions of each countermeasure content whose target level is "system" among the countermeasure content groups extracted by the countermeasure extraction unit 140, thereby determining whether there are system-level countermeasures that can be implemented for the first industrial control system 320.

[0085] The following assumes that the system countermeasure study unit 160 determines that "utilization of network access restriction" among the system-level countermeasures can be implemented for the first industrial control system 320. In this case, since there are system-level countermeasures that can be implemented for the first industrial control system 320, the system countermeasure study unit 160 determines "YES" in step S604 and proceeds to the process of step S605.

[0086] The system countermeasure study unit 160 transmits "utilization of network access restriction" that can be implemented for the first industrial control system 320 determined in the most recent step S604 as a system-level countermeasure to the countermeasure content output unit 180 (S605).

[0087] The system countermeasure study unit 160 determines whether there are systems among the systems identified as systems requiring additional countermeasures in step S602 for which system-level countermeasures have not been considered (S607). In this example, at this stage, among the systems identified in step S602, only the system-level countermeasures for the first industrial control system 320 have been considered, and the system-level countermeasures for the second industrial control system 330 have not been considered. Therefore, the system countermeasure study unit 160 determines "YES" in step S607 and returns to step S603.

[0088] The system countermeasure study unit 160 selects (e.g., randomly) one system from the systems identified as systems requiring additional countermeasures in step S602 and for which system-level countermeasures have not been considered, for which to consider system-level countermeasures (S603). In the second step S603, assume that the system countermeasure study unit 160 selects the second industrial control system 330.

[0089] The system countermeasure study unit 160 determines whether there are system-level countermeasures that can be implemented for the second industrial control system 330 (S604). In this example, the system countermeasure study unit 160 refers to the target information regarding the second industrial control system 330 obtained in step S601, and determines whether the system specifications of the second industrial control system 330 satisfy the constraint conditions of each countermeasure content whose target level is "system" among the countermeasure content groups extracted by the countermeasure extraction unit 140, thereby determining whether there are system-level countermeasures that can be implemented for the second industrial control system 330.

[0090] Hereinafter, assume that the system countermeasure study unit 160 determines that there are no system-level countermeasures that can be implemented for the second industrial control system 330. In this case, the system countermeasure study unit 160 determines "NO" in step S604 and proceeds to the process of step S606.

[0091] The system countermeasure study unit 160 sends an additional countermeasure request including information indicating the system (here, information indicating the second industrial control system 330) determined in the most recent step S604 to have no implementable system-level countermeasures, and information indicating that additional countermeasures (at the operation level for the entire facility equipped with the second industrial control system 330) are required, to the operation countermeasure study unit 170 (S606).

[0092] The system countermeasure study unit 160 proceeds to the process of step S607, and repeats the above procedure until there is no system for which system-level countermeasures have not been considered among the systems identified as systems requiring additional countermeasures in step S602. When the system countermeasure study unit 160 determines that there is no system for which system-level countermeasures have not been considered among the systems identified as systems requiring additional countermeasures in step S602, it determines that the result of the determination in step S607 is "NO", and the system countermeasure decision process ends.

[0093] [Operation countermeasure decision process] FIG. 7 is a flowchart showing an example of the operation countermeasure study and decision process by the operation countermeasure study unit 170.

[0094] The operation countermeasure study unit 170 acquires target information regarding the operation of facilities or equipment provided in the facilities among the target information input by the countermeasure target information input unit 120 (S701). That is, in this example, the operation countermeasure study unit 170 acquires target information regarding the operation of the first factory 310.

[0095] The operation countermeasure study unit 170 determines whether it has received an additional countermeasure request from the system countermeasure study unit 160 (S702). In this example, since the operation countermeasure study unit 170 has received an additional countermeasure request from the system countermeasure study unit 160, it determines that the result of step S702 is "YES", and proceeds to the process of step S703.

[0096] The operation countermeasure study unit 170 transmits "strengthening authentication during terminal use", which is a countermeasure content with a target level of "operation" among the countermeasure content group extracted by the countermeasure extraction unit 140, to the countermeasure content output unit 180 as an operation-level countermeasure (S703).

[0097] On the other hand, when the operation countermeasure study unit 170 determines that it has not received an additional countermeasure request from the system countermeasure study unit 160, it determines that the result of step S702 is "NO", and the operation countermeasure decision process ends.

[0098] Note that in the example of FIG. 6, the system countermeasure study unit 160 examines system-level countermeasures only for the system indicated by the additional countermeasure request from the component countermeasure study unit 150 (i.e., the system including components without component-level countermeasures). However, not only for the system indicated by the additional countermeasure request from the component countermeasure study unit 150, but also for other systems (for example, it may be all other systems, or it may be the system specified by the user among other systems), system-level countermeasures may be examined.

[0099] Also, in the example of FIG. 7, the operation countermeasure study unit 170 examines operation-level countermeasures only when receiving an additional countermeasure request from the system countermeasure study unit 160 (i.e., when there is a system without system-level countermeasures). However, even when not receiving an additional countermeasure request from the system countermeasure study unit 160, operation-level countermeasures may be extracted.

[0100] When the examination of system-level countermeasures does not depend on the examination result of component-level countermeasures, either the component countermeasure examination process or the system countermeasure examination process may be executed first. Also, when the examination of operation-level countermeasures does not depend on the examination result of system-level countermeasures, either the system countermeasure examination process or the operation countermeasure examination process may be executed first. Further, when the examination of system-level countermeasures does not depend on the examination result of component-level countermeasures and the examination of operation-level countermeasures does not depend on the examination result of system-level countermeasures, the execution order of the component countermeasure examination process, the system countermeasure examination process, and the operation countermeasure examination process is not limited.

[0101] [Example of Countermeasure Content Output] FIG. 8 is a diagram showing an example of the screen configuration of the countermeasure content output screen output by the countermeasure content output unit 180.

[0102] The countermeasure content output screen 800 includes, for example, a target facility display area 810 and a countermeasure content display area 820. Information indicating the facility that is the target of the security countermeasure is displayed in the target facility display area 810. In this example, information indicating the first factory 310 is displayed in the target facility display area 810.

[0103] Information indicating the content of the countermeasure is displayed in the countermeasure content display area 820. Specifically, for example, in the countermeasure content display area 820, the requirements obtained by the requirement input unit 110, the threat events converted from the requirements by the threat event analysis unit 130, and the information indicating the countermeasure content determined by the component countermeasure study unit 150, the system countermeasure study unit 160, and the operation countermeasure study unit 170 are displayed in tabular form. Note that the display format in the countermeasure content display area 820 is not limited to the tabular form, and other forms such as a dictionary form may be used.

[0104] As described above, the security countermeasure determination device 100 according to the present embodiment converts the requirements according to laws and regulations and standards into threat events, and examines security countermeasures against the threat events at at least one of the component level, the system level, and the operation level. Thereby, the security countermeasure determination device 100 can satisfy the requirements and obtain implementable countermeasures with low man-hours.

[0105] Note that, for example, if a higher-level countermeasure is taken in the inclusion relationship between target levels such as an operation-level countermeasure, the requirements are satisfied to some extent even if lower-level countermeasures such as component-level and system-level countermeasures are not taken. However, if only higher-level countermeasures are taken, such as when only operation-level countermeasures are taken, when the operation-level countermeasures are breached by an attacker, all components in all systems will be exposed to threats. Therefore, if there are implementable lower-level countermeasures, taking such lower-level countermeasures improves security more than taking higher-level countermeasures. On the other hand, if all implementable countermeasures at all levels are taken, the man-hours and costs required for the countermeasures increase.

[0106] Therefore, the security countermeasure decision device 100 of this embodiment examines security countermeasures against threat events in order from the lower target level (in the order of component level, system level, and operation level). That is, the security countermeasure decision device 100 determines component-level countermeasures for components with component-level countermeasures, and when there are components without component-level countermeasures, it examines system-level countermeasures for the system including the component. When there is a system without system-level countermeasures, it examines operation-level countermeasures. As a result, the security countermeasure decision device 100 can obtain, with a small number of man-hours, an implementable countermeasure that satisfies the requirements and balances security with the man-hours and costs associated with the countermeasure.

[0107] In this embodiment and other embodiments, an example where the facility has an industrial system is described. However, the security countermeasure decision device 100 is also applicable when the facility has any system such as an IT (Information Technology) system instead of or in addition to the industrial system. Note that the specifications of the elements (such as CPU and memory) of the components included in the industrial control system are generally lower than those of the devices included in the IT system. Therefore, by applying the security countermeasure decision device 100 to the industrial control system and the components included in the industrial control system, considering the component specifications, the number of implementable countermeasures can be narrowed down to a smaller number, and ultimately, the man-hours for the user to select a countermeasure can be further reduced.

[0108] In this embodiment and other embodiments, an example where the target level has three levels: component level, system level, and operation level is described. However, for example, it may have two levels with any one of the component level, system level, or operation level excluded. Also, for example, the target level may have four or more levels, such as when a subsystem level is added between the component level and the system level.

Embodiment

[0109] The security measure decision-making device 100 (information processing device 20) of this embodiment makes a decision by directly reflecting the intention of the decision maker in the decision-making of security measures at the component level, system level, and operation level respectively. In this embodiment, the differences from Embodiment 1 will be mainly described, and the description of the same points as in Embodiment 1 will be omitted as appropriate.

[0110] [Configuration example of security measure decision-making device] FIG. 9 is a block diagram showing a functional configuration example of the security measure decision-making device 100. The security measure decision-making device 100 of this embodiment is different from the security measure decision-making device 100 (FIG. 1) of Embodiment 1 in that it includes a component measure candidate examination unit 910 and a system measure candidate examination unit 920, both of which are functional units, instead of the component measure examination unit 150 and the system measure examination unit 160. Also, the security measure decision-making device 100 is connected to a measure selection unit 940.

[0111] The component measure candidate examination unit 910 uses the target information related to components among the target information input by the measure target information input unit 120 to extract component-level measures that can be implemented from the measure content group extracted by the measure extraction unit 140 for each component, and outputs the extracted measures to the measure selection unit 940 as component-level measure candidates.

[0112] The system measure candidate examination unit 920 uses the target information related to the system among the target information input by the measure target information input unit 120 to extract system-level measures that can be implemented from the measure content group extracted by the measure extraction unit 140, and outputs the extracted measures to the measure selection unit 940 as system-level measure candidates.

[0113] The countermeasure selection unit 940 outputs each countermeasure candidate from the component countermeasure candidate examination unit 910 and the system countermeasure candidate examination unit 920, and provides a function that allows a user such as the owner and administrator of the system to select a countermeasure from the countermeasure candidates. The countermeasure content output unit 180 outputs the selected countermeasure. In the example of FIG. 9, the countermeasure selection unit 940 is provided outside the security countermeasure determination device 100, but may be incorporated in the security countermeasure determination device 100. The countermeasure selection unit 940 may be configured by the input / output I / F 23.

[0114] Also, when there is a component for which no countermeasure has been selected from the component-level countermeasure candidates, the countermeasure selection unit 940 outputs an additional countermeasure request indicating that it is necessary to examine system-level countermeasure candidates for the system including the component to the system countermeasure candidate examination unit 920.

[0115] Also, when there is a system for which no countermeasure has been selected from the system-level countermeasure candidates, the countermeasure selection unit 940 outputs an additional countermeasure request indicating that it is necessary to examine operation-level countermeasure candidates for the facility equipped with the system to the operation countermeasure examination unit 170. Regarding the operation countermeasure examination unit 170, although the transmission sources of the additional countermeasure requests it receives are different, the processing it executes is the same as in the first embodiment.

[0116] [Component Countermeasure Candidate Extraction Process] FIG. 10 is a flowchart showing an example of the component countermeasure candidate extraction process by the component countermeasure candidate examination unit 910.

[0117] The component countermeasure candidate examination unit 910 acquires the target information related to the component among the target information input by the countermeasure target information input unit 120 (S1001). That is, in this example, the component countermeasure candidate examination unit 910 acquires the target information related to each of the first PC 321, the first robot 322, the first PLC 323, the second PC 331, the second robot 332, and the second PLC 333.

[0118] The component countermeasure candidate examination unit 910 selects one (for example, randomly) component from the unselected components to examine countermeasure candidates (S1002). Assume that in the first step S1002, the component countermeasure candidate examination unit 910 selects the first PC 321.

[0119] The component countermeasure candidate examination unit 910 determines whether there are component-level countermeasures that can be implemented for the component selected in the most recent step S1002 in the same manner as in step S503, and transmits information indicating the component and the implementable component-level countermeasures to the countermeasure selection unit 940 as component-level countermeasure candidates (S1003). Hereinafter, assume that the component countermeasure candidate examination unit 910 determines that for the first PC 321, "using an encryption function" and "using an input content verification function" among the component-level countermeasures are implementable.

[0120] In step S1003, if the component countermeasure candidate examination unit 910 determines that there are no implementable component-level countermeasures for the component selected in the most recent step S1002, it transmits information indicating that there are no implementable component-level countermeasures for the component to the countermeasure selection unit 940 as component-level countermeasure candidates.

[0121] The component countermeasure candidate examination unit 910 determines whether there are components for which component-level countermeasure candidates have not been examined (S1004). If the component countermeasure candidate examination unit 910 determines that there are components for which component-level countermeasure candidates have not been examined, it determines "YES" in step S1004 and returns to the process of step S1002. If it determines that there are no such components, it determines "NO" in step S1004, and the component countermeasure candidate extraction process ends.

[0122] [System Countermeasure Candidate Extraction Process] FIG. 11 is a flowchart showing an example of system countermeasure candidate extraction processing by the system countermeasure candidate examination unit 920.

[0123] The system countermeasure candidate examination unit 920 acquires target information related to the system among the target information input by the countermeasure target information input unit 120 (S1101).

[0124] The system countermeasure candidate examination unit 920 refers to the additional countermeasure request from the countermeasure selection unit 940 and identifies systems that require additional countermeasures (that is, systems including components for which component-level countermeasures were not selected and systems including components for which there are no component-level countermeasure candidates) (S1102).

[0125] The system countermeasure candidate examination unit 920 selects one system from the unselected systems among the systems that require additional countermeasures identified in step S1102, for which system-level countermeasure candidates are to be examined (S1103).

[0126] The system countermeasure candidate examination unit 920 determines whether there are implementable countermeasures for the system selected in the most recent step S1103 in the same manner as in step S604, and transmits information indicating the system and the implementable system-level countermeasures as system-level countermeasure candidates to the countermeasure selection unit 940 (S1104).

[0127] In step S1104, if the system countermeasure candidate examination unit 920 determines that there are no implementable system-level countermeasures for the system selected in the most recent step S1103, it transmits information indicating that there are no implementable system-level countermeasures for the system as system-level countermeasure candidates to the countermeasure selection unit 940.

[0128] The system countermeasure candidate examination unit 920 determines whether there is a system for which system-level countermeasure candidates have not been examined among the systems that require additional countermeasures identified in step S1102 (S1105). If the system countermeasure candidate examination unit 920 determines that there is a system for which system-level countermeasure candidates have not been examined among the systems that require additional countermeasures identified in step S1102, it determines "YES" in step S1105, returns to the process of step S1103, and if it determines that there is none, it determines "NO" in step S1105, and the system countermeasure candidate extraction process ends.

[0129] [Countermeasure selection process] FIG. 12 is a flowchart showing an example of the countermeasure selection process by the countermeasure selection unit 940.

[0130] The countermeasure selection unit 940 determines the target level of the received countermeasure candidates (S1201). That is, in step S1201, the countermeasure selection unit 940 determines whether it has received component-level countermeasure candidates from the component countermeasure candidate examination unit 910 or system-level countermeasure candidates from the system countermeasure candidate examination unit 920.

[0131] If the countermeasure selection unit 940 determines that it has received component-level countermeasure candidates (S1201: component level), it presents the received component-level countermeasure candidates on a selection screen described later (S1202). Note that for components for which the component countermeasure candidate examination unit 910 has determined that there are no component-level countermeasure candidates, the countermeasure selection unit 940 presents information indicating that there are no component-level countermeasure candidates on the selection screen.

[0132] The countermeasure selection unit 940 accepts the selection of component-level countermeasures from component-level countermeasure candidates according to the input via the selection screen (S1203). Note that although there are component-level countermeasure candidates, it is also possible for the user to reject the selection of component-level countermeasures from the component-level countermeasure candidates (i.e., not select component-level countermeasures for the components).

[0133] In the selection in step S1203, the countermeasure selection unit 940 determines whether there are components for which component-level countermeasures have not been selected (S1204). Note that the countermeasure selection unit 940 also treats components for which it has been determined that there are no component-level countermeasure candidates that can be implemented by the component countermeasure candidate examination unit 910 as components for which no countermeasures have been selected.

[0134] If the countermeasure selection unit 940 determines that there are components for which component-level countermeasures have not been selected (S1204: YES), it sends an additional countermeasure request indicating that system-level countermeasures for the system including the component are required to the system countermeasure candidate examination unit 920 (S1205). For each component for which a component-level countermeasure has been selected, the countermeasure selection unit 940 sends information indicating the content of the selected component-level countermeasure to the countermeasure content output unit 180 (S1206) and ends the selection process.

[0135] If the countermeasure selection unit 940 determines that component-level countermeasures have been selected for all components (S1204: NO), for each of all components, it sends information indicating the content of the selected component-level countermeasure to the countermeasure content output unit 180 (S1206) and ends the selection process.

[0136] When the countermeasure selection unit 940 determines that it has received system-level countermeasure candidates (S1201: system level), it presents the received system-level countermeasure candidates on the selection screen (S1207). Note that for a system determined by the system countermeasure candidate examination unit 920 to have no system-level countermeasure candidates, the countermeasure selection unit 940 presents information indicating the absence of system-level countermeasure candidates on the selection screen.

[0137] The countermeasure selection unit 940 accepts the selection of a system-level countermeasure from the system-level countermeasure candidates according to the input via the selection screen (S1208). Note that even if there are system-level countermeasure candidates, it is also possible for the user to reject the selection of a system-level countermeasure from the system-level countermeasure candidates (i.e., not select a system-level countermeasure for the system).

[0138] The countermeasure selection unit 940 determines whether there is a system for which no system-level countermeasure was selected in the selection in step S1208 (S1209). Note that for a system determined by the system countermeasure candidate examination unit 920 to have no implementable system-level countermeasure candidates, the countermeasure selection unit 940 also treats it as a system for which no countermeasure was selected.

[0139] When the countermeasure selection unit 940 determines that there is a system for which no system-level countermeasure was selected among the systems that received system-level countermeasure candidates (S1209: YES), it transmits an additional countermeasure request indicating the need for an operation-level countermeasure to the operation countermeasure examination unit 170 (S1210). For each system for which a system-level countermeasure was selected, the countermeasure selection unit 940 transmits information indicating the content of the selected system-level countermeasure to the countermeasure content output unit 180 (S1211) and ends the selection process.

[0140] When the countermeasure selection unit 940 determines that system-level countermeasures have been selected for all systems that have received system-level countermeasure candidates (S1204: NO), for each of these systems, it transmits information indicating the content of the selected system-level countermeasures to the countermeasure content output unit 180 (S1211) and ends the selection process.

[0141] [Screen output example of countermeasure selection process] FIG. 13 is a diagram showing an example of the screen configuration of the selection screen output by the countermeasure selection unit 940.

[0142] The selection screen 1300 includes, for example, a requirement display area 1310, a countermeasure content selection area 1320, a rearrangement button 1330, and a decision button 1340. In the requirement display area 1310, the target for selecting countermeasures from security countermeasure candidates and the requirements according to laws, regulations, and standards are displayed. In the countermeasure content selection area 1320, the countermeasure candidates for the target and check boxes for selecting countermeasures from the countermeasure candidates are displayed.

[0143] In the example of FIG. 13, in the requirement display area 1310, information indicating the first PLC 323 as the target of the security countermeasure is displayed, and "Ensuring information integrity" is displayed as the requirement according to laws, regulations, and standards. Also, in the example of FIG. 13, in the countermeasure content selection area 1320, "Using encryption function" and "Using input content verification function" are displayed as countermeasure candidates, and "Using input content verification function" is selected as the countermeasure.

[0144] When the rearrangement button 1330 is selected, the rearrangement of the countermeasure candidates displayed in the countermeasure content selection area 1320 is executed. When the decision button 1340 is selected, for the target shown in the requirement display area 1310, the countermeasure content selected in the countermeasure content selection area 1320 is determined, and the screen transitions to the selection screen 1300 for the next target (for example, the next component or system).

[0145] Note that if the decision button 1340 is selected without any of the check boxes in the countermeasure content selection area 1320 being selected, it is considered that the user has rejected all countermeasure candidates for the target (that is, none of the countermeasure candidates have been selected as countermeasures).

[0146] The security countermeasure decision device 100 of this embodiment enables the determination of security countermeasures at each level of components and systems through user operations, so that security countermeasures that directly reflect the user's intention can be determined. In particular, in this embodiment, even when there are component-level countermeasure candidates for all components of a certain system, system-level countermeasures for the system can also be considered depending on the selection results by the user. Similarly, in this embodiment, even when there are system-level countermeasure candidates for all systems for which system-level countermeasure candidates are considered, operation-level countermeasures can also be considered depending on the selection results by the user.

Embodiment

[0147] In the security countermeasure decision device 100 (information processing device 20) of this embodiment, a user such as an operator, administrator, or system designer of the system evaluates the output content of the countermeasures, and reflects the evaluation on the output screen of the countermeasure content. In this embodiment, the differences from Embodiment 1 will be mainly described, and the description of the same points as in Embodiment 1 will be omitted as appropriate.

[0148] [Configuration of Security Countermeasure Decision Device] FIG. 14 is a block diagram showing a functional configuration example of the security countermeasure decision device 100. The security countermeasure decision device 100 of this embodiment is different from the security countermeasure decision device 100 of Embodiment 1 in that it is connected to a countermeasure content output / evaluation unit 1410 instead of a countermeasure content output unit 180.

[0149] The countermeasure content output / evaluation unit 1410 outputs, to the display screens of the terminal device 26a and the terminal device 26b connected to the security countermeasure determination device 100, information indicating the component-level countermeasures output from the component countermeasure consideration unit 150, the system-level countermeasures output from the system countermeasure consideration unit 160, and the operation-level countermeasures output from the operation countermeasure consideration unit 170, and information indicating the evaluation of each countermeasure.

[0150] In addition, the countermeasure content output / evaluation unit 1410 accepts the input of the evaluation of the component-level countermeasures, the system-level countermeasures, and the operation-level countermeasures, and stores the input evaluation in the countermeasure content table 400.

[0151] In the example of FIG. 14, the countermeasure content output / evaluation unit 1410 is provided outside the security countermeasure determination device 100, but may be incorporated in the security countermeasure determination device 100. The countermeasure content output / evaluation unit 1410 may be configured by the input / output I / F 23.

[0152] [Countermeasure Content Table] FIG. 15 is a diagram showing an example of the data configuration of the countermeasure content table 400. The countermeasure content table 400 of the present embodiment is different from the countermeasure content table 400 of the first embodiment in that it further includes an evaluation value column 450.

[0153] In the evaluation value column 450, information indicating the evaluation value given by the user to each countermeasure content at each target level is stored. In the example of FIG. 15, in the evaluation value column 450, the number of users who gave a GOOD evaluation to the countermeasure and the number of users who gave a BAD evaluation are stored among the users who introduced each countermeasure. Note that, for example, the evaluation value selected by the user who introduced each countermeasure from a predetermined level (for example, a 5-level scale), and the average value of the selected evaluation values may be stored in the evaluation value column 450, and any quantitative or qualitative evaluation value that can express the superiority or inferiority of each countermeasure may be used.

[0154] For example, the countermeasure content output / evaluation unit 1410 displays a screen for receiving input of evaluation values for each countermeasure at each target level, receives input of evaluation values from users who have introduced each countermeasure via the screen, and updates the value in the evaluation value column 450 according to the input evaluation values. The value in the evaluation value column 450 can be referred to by the user as a criterion for the user to judge the superiority or inferiority of the component-level countermeasures determined by the component countermeasure study unit 150, the superiority or inferiority of the system-level countermeasures determined by the system countermeasure study unit 160, the superiority or inferiority of the operation-level countermeasures determined by the operation countermeasure study unit 170, or the superiority or inferiority of the selected countermeasure content determined by the countermeasure selection unit 940.

[0155] [Screen output example of countermeasure selection process] FIG. 16 is a diagram showing an example of the screen configuration of the countermeasure content output screen 800 output by the countermeasure content output / evaluation unit 1410.

[0156] The countermeasure content output screen 800 is different from the countermeasure content output screen 800 of the first embodiment in that it further includes an evaluation value display area 1621. In the evaluation value display area 1621, the evaluation values corresponding to each countermeasure in the countermeasure content table 400 are displayed.

[0157] In the example of FIG. 16, for the countermeasure "Use of encryption function", there are 135 "GOOD" evaluations and 3 "BAD" evaluations, for the countermeasure "Use of restriction on network access", there are 55 "GOOD" evaluations and 15 "BAD" evaluations, and for the countermeasure "Strengthening authentication during terminal use", there are 10 "GOOD" evaluations and 45 "BAD" evaluations.

[0158] As described above, the security countermeasure determination device 100 of the present embodiment allows a user such as an operator, administrator, or system designer of the system to evaluate the output countermeasure content and records the evaluation in the countermeasure content table 400. Thereby, the security countermeasure determination device 100 can present information serving as a criterion for determining the superiority or inferiority of the countermeasure content to the user together with the countermeasure content, and can support the user's countermeasure selection.

[0159] In addition, this embodiment may be applied to Embodiment 2. In this case, for example, in the selection screen 1300 described in FIG. 13, the evaluation value of the countermeasure may be displayed together with the presented countermeasure candidates.

[0160] Note that the present invention is not limited to the above-described embodiments, and it goes without saying that various other application examples and modification examples can be adopted without departing from the gist of the present invention described in the claims. For example, the above-described embodiments have described the configuration in detail and specifically in order to explain the present invention in an easy-to-understand manner, and are not necessarily limited to those having all the components described. Also, a part of the configuration of one embodiment can be replaced with the components of another embodiment. In addition, it is also possible to add the components of another embodiment to the configuration of one embodiment. Also, for a part of the configuration of each embodiment, it is possible to add, replace, or delete other components.

[0161] For example, the functions of the security countermeasure determination device 100 in the above-described embodiments may be incorporated into a main element (for example, the first PC 321) within the target system. Also, one or more elements within the target system or each element may have the functions of the security countermeasure determination device 100.

[0162] Furthermore, each of the above configurations, functions, processing units, etc. may be realized in hardware by designing a part or all of them, for example, by using an integrated circuit. As the hardware, a processor device in a broad sense such as an FPGA (Field Programmable Gate Array) or an ASIC (Application Specific Integrated Circuit) may be used. Also, each of the above configurations, functions, etc. may be realized in software by a processor interpreting and executing a program for realizing each function. Information such as programs, tables, and files for realizing each function can be stored in a memory, a recording device such as a hard disk or an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

[0163] In addition, the control lines and information lines show those considered necessary for explanation, and not all control lines and information lines are necessarily shown on the product. In fact, it may be considered that almost all components are interconnected.

Description of Signs

[0164] 20 Information processing apparatus, 21 Processing unit, 22 Memory, 23 Input / output interface, 24 Auxiliary storage device, 100 Security countermeasure decision device, 150 Component countermeasure study section, 160 System countermeasure study section, 170 Operation countermeasure study section, 190 Countermeasure content memory section, 110 Requirement input section, 120 Countermeasure target information input section, 400 Countermeasure content table, 800 Countermeasure content output screen, 940 Countermeasure selection section, 1300 Selection screen, 1410 Countermeasure content output / evaluation section

Claims

1. A security measure determination device comprising: a processor and a memory, wherein the memory stores: target information indicating a target system for security measures, specifications of the target system, target components included in the target system, and specifications of the target components; countermeasure content information indicating first-level countermeasures that are security measures for components, first constraint conditions regarding the specifications of components for implementing the first-level countermeasures, second-level countermeasures that are security measures for the system, and second constraint conditions regarding the specifications of the system for implementing the second-level countermeasures; wherein the processor performs: a first-level countermeasure identification process for identifying first-level countermeasures implementable for the target components based on the specifications of the target components and the first constraint conditions; a second-level countermeasure identification process for identifying second-level countermeasures implementable for the target system based on the specifications of the target system and the second constraint conditions; and generates data for displaying the identified first-level countermeasures and the identified second-level countermeasures. A security measure determination device.

2. The security measure determination device according to Claim 1, wherein when the processor determines that there are target components for which no implementable first-level countermeasures exist in the first-level countermeasure identification process, the processor performs the second-level countermeasure identification process on the target system including the target components.

3. The security measure determination device according to Claim 1, wherein the countermeasure content information further indicates third-level countermeasures that are security measures for the operation of the facility, and the processor generates data for displaying the third-level countermeasures. A security measure determination device.

4. The security measure determination device according to Claim 3, wherein the target information further indicates a target facility including the target system, and the processor: when determining that there are target components for which no implementable first-level countermeasures exist in the first-level countermeasure identification process, performs the second-level countermeasure identification process on the target system including the target components. A security countermeasure determination device that generates data for displaying the third-level countermeasure when it is determined that there is a target system in which there is no second-level countermeasure that can be implemented in the second-level countermeasure specifying process.

5. The security countermeasure determination device according to claim 1, wherein the processor generates data for displaying a first selection screen for selecting a countermeasure from the specified first-level countermeasures, and executes the second-level countermeasure specifying process on a target system including a component for which selection of a countermeasure has been rejected on the first selection screen.

6. The security countermeasure determination device according to claim 5, wherein the countermeasure content information further shows a third-level countermeasure that is a security countermeasure for the operation of the facility, the target information further shows a target facility including the target system, generates data for displaying a second selection screen for selecting a countermeasure from the specified second-level countermeasures, and generates data for displaying the third-level countermeasure when it is determined that there is a system for which selection of a countermeasure has been rejected on the second selection screen.

7. The security countermeasure determination device according to claim 1, wherein the countermeasure content information shows evaluation values of the first-level countermeasure and the second-level countermeasure respectively, and the processor acquires the evaluation values of the first-level countermeasure and the second-level countermeasure respectively via input to an input device, updates the evaluation values in the countermeasure content information based on the acquired evaluation values, and generates data for displaying the specified first-level countermeasure, the specified second-level countermeasure, and the evaluation values corresponding to each of them with reference to the countermeasure content information.

8. A security countermeasure determination method by a security countermeasure determination device, wherein the security countermeasure determination device includes a processor and a memory, and the memory stores target information indicating a target system of a security countermeasure, the specifications of the target system, target components included in the target system, and the specifications of the target components. The countermeasure content information indicating a first-level countermeasure which is a security measure for components, a first constraint condition regarding the specification of components for implementing the first-level countermeasure, a second-level countermeasure which is a security measure for the system, and a second constraint condition regarding the specification of the system for implementing the second-level countermeasure, is held. The security countermeasure determination method is as follows. The processor executes a first-level countermeasure identification process of identifying a first-level countermeasure that can be implemented for the target component based on the specification of the target component and the first constraint condition; and executes a second-level countermeasure identification process of identifying a second-level countermeasure that can be implemented for the target system based on the specification of the target system and the second constraint condition. The security countermeasure determination method in which the processor generates data for displaying the identified first-level countermeasure and the identified second-level countermeasure.

Images