Information processing system, information processing method, and information processing program

Abstract

To enable a risk to a target system to be evaluated due to vulnerability of security countermeasure software.SOLUTION: An information processing system 1 comprises a first identification unit 18B, a first calculation unit 18C, a second calculation unit 18D, and an output unit 18E. The first identification unit 18B identifies a menace type which can be addressed by installed software, the installed software being security countermeasure software that has been installed in a target system 30, among the security countermeasure software to which vulnerability has been reported. The first calculation unit 18C calculates a first risk value when addressing menace of the identified menace type by the installed software. The second calculation unit 18D calculates a second risk value when not addressing the menace of the identified menace type by the installed software. The output unit 18E outputs damage possibility information including risk value change information showing a change of the second risk value with respect to the first risk value.SELECTED DRAWING: Figure 2

Description

[Technical Field]

[0001] An embodiment of the present invention relates to an information processing system, an information processing method, and an information processing program. [Background technology]

[0002] Numerous new software vulnerabilities have been reported, and systems that diagnose vulnerability risks for software based on vulnerability information published by vendors and the like are known.

[0003] The impact of vulnerabilities in security software is not limited to the software itself, but also affects the target systems that are protected by the security software. However, with conventional technology, even when a vulnerability is found in security software, it is difficult to assess the risk to the target systems that are protected by the software. In other words, with conventional technology, it is difficult to assess the risk to the target systems caused by vulnerabilities in security software. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2009-217637 [Patent Document 2] Japanese Patent Application Laid-Open No. 2015-138509 Summary of the Invention [Problem to be solved by the invention]

[0005] An object of the present invention is to provide an information processing system, an information processing method, and an information processing program that are capable of evaluating the risk to a target system due to vulnerabilities in security software. [Means for solving the problem]

[0006] An information processing system according to an embodiment includes a first identification unit, a first calculation unit, a second calculation unit, and an output unit. The first identification unit identifies, from among security software for which vulnerabilities have been reported, threat types that can be addressed by installed software, which is the security software already installed in a target system. The first calculation unit calculates a first risk value for a threat of the identified threat type when a countermeasure is taken by the installed software. The second calculation unit calculates a second risk value for a threat of the identified threat type when a countermeasure is not taken by the installed software. The output unit outputs damage possibility information including risk value change information indicating a change in the second risk value relative to the first risk value. [Brief explanation of the drawings]

[0007] [Figure 1] FIG. 1 is a schematic diagram of an information processing system according to an embodiment. [Figure 2] FIG. 1 is a block diagram showing the functional configuration of an information processing device. [Figure 3] 5 is a schematic diagram of the data structure of correspondence information. [Figure 4] Schematic diagram of the data structure of risk analysis result information. [Figure 5] Schematic diagram of a display screen. [Figure 6] An explanatory diagram of the countermeasure levels. [Figure 7] 1 is a flowchart of the flow of information processing. [Figure 8] FIG. 1 is a block diagram showing the functional configuration of an information processing device. [Figure 9] Schematic diagram of the data structure of impact information. [Figure 10] 1 is a flowchart of the flow of information processing. [Figure 11] FIG. 2 is a diagram illustrating a hardware configuration. DETAILED DESCRIPTION OF THE INVENTION

[0008] The information processing system, the information processing method, and the information processing program will be described in detail below with reference to the accompanying drawings.

[0009] (First embodiment) FIG. 1 is a schematic diagram showing an example of an information processing system 1 according to the present embodiment.

[0010] The information processing system 1 includes an information processing device 10 and one or more external devices 20. The information processing device 10 and the external devices 20 are communicably connected via a network NW or the like.

[0011] The information processing system 1 is a system for evaluating the risk posed by the vulnerability of the target system 30.

[0012] The target system 30 is a system that is the target of vulnerability risk assessment. The target system 30 includes one or more computers. One or more pieces of security software have been installed in the target system 30. Furthermore, the target system 30 may be scheduled to have one or more pieces of security software installed. "Installed" means "installed." In this embodiment, an example will be described in which one or more pieces of security software have already been installed in the target system 30.

[0013] The external device 20 is a dedicated or general-purpose computer. The external device 20 is a device that provides vulnerability information to the information processing device 10 and the like, and receives damage possibility information of the target system 30 from the information processing device 10. The damage possibility information will be described later.

[0014] Vulnerability information is information indicating vulnerabilities disclosed by vendors, such as manufacturers or suppliers of software or hardware. Vulnerability information includes publicly known information about vulnerabilities disclosed by vendors. In this embodiment, the vulnerability information includes at least information about vulnerabilities contained in security software.

[0015] Specifically, for example, vulnerability information includes one or more of the following items: evaluation criteria including compatibility conditions for a vulnerability and a risk value for each compatibility condition; the expected impact of the vulnerability on system devices; and countermeasures to address the vulnerability. The compatibility conditions are expressed as a risk value for a software version, such as security software, in the format of [compatibility conditions / risk value], e.g., [Software_A10.1 or earlier / 4.5 (high)]. That is, the compatibility conditions include information about the security software in which the vulnerability has been reported. The impact range is expressed, for example, as "arbitrary code execution" or "possibility of information leakage or tampering." That is, the impact range includes the threat type. The impact range may also include at least one of the information security elements, i.e., confidentiality, integrity, and availability, that are affected by the threat of the threat type. The countermeasures are expressed, for example, as "apply patch_001" or "change settings_001 to 100."

[0016] Every time new vulnerability information is made public by a vendor or the like, the external device 20 transmits the vulnerability information to the information processing device 10. For example, the external device 20 acquires new vulnerability information from a vulnerability database such as CVE (Common Vulnerabilities and Exposures), NVD (National Vulnerability Database), or JVN (Japan Vulnerability Notes) iPedia, and transmits the information processing device 10. Note that the information processing device 10 may acquire vulnerability information directly from these vulnerability databases.

[0017] The information processing device 10 is an information processing device for evaluating, based on vulnerability information, the risk to the target system 30 due to vulnerabilities in security software. The information processing device 10 is a dedicated or general-purpose computer.

[0018] FIG. 2 is a block diagram showing an example of the functional configuration of the information processing device 10. As shown in FIG.

[0019] The information processing device 10 includes a communication unit 12, a UI (user interface) unit 14, a storage unit 16, and a processing unit 18. The communication unit 12, the UI unit 14, the storage unit 16, and the processing unit 18 are connected via a bus or the like so as to be able to exchange data or signals.

[0020] At least one of the UI unit 14 and the storage unit 16 may be communicably connected to the processing unit 18 via a network NW. That is, at least one of the UI unit 14 and the storage unit 16 may be provided in an external information processing device connected to the information processing device 10 via the network NW. Also, at least one of the functional units included in the processing unit 18, which will be described later, may be provided in the external information processing device. The external information processing device may be, for example, an external server, an external device 20, or the like.

[0021] The communication unit 12 communicates with an external information processing device such as an external device 20 via a network NW. The UI unit 14 has a function of accepting operation inputs by a user and a function of outputting various types of information. For example, the UI unit 14 includes a display and an input unit. The display displays various types of information. The display may be, for example, a known organic EL (Electro-Luminescence) display, LCD (Liquid Crystal Display), or a projection device. The input unit accepts various instructions from the user. The input unit may be, for example, a keyboard, a mouse, a touch panel, or a microphone. The UI unit 14 may be configured as a touch panel equipped with an input mechanism and an output mechanism. The UI unit 14 may also be configured to include a speaker that outputs audio.

[0022] The storage unit 16 stores various types of data. The storage unit 16 is, for example, a semiconductor memory element such as a RAM (Random Access Memory), a flash memory, a hard disk, an optical disk, or the like. The storage unit 16 may be a storage device provided outside the information processing device 10. The storage unit 16 may also be a storage medium. Specifically, the storage medium may store or temporarily store programs and various types of information downloaded via a LAN (Local Area Network), the Internet, or the like. The storage unit 16 may also be composed of multiple storage media.

[0023] In this embodiment, the storage unit 16 stores correspondence information 16A and risk analysis result information 16B. The storage unit 16 stores the correspondence information 16A in advance. The correspondence information 16A may be updated by a processing unit 18, which will be described later. The risk analysis result information 16B may be stored in advance in the storage unit 16, or may be created and updated by the processing unit 18, which will be described later, or the like. Details of the correspondence information 16A and the risk analysis result information 16B will be described later.

[0024] The processing unit 18 includes a vulnerability determination unit 18A, a first identification unit 18B, a first calculation unit 18C, a second calculation unit 18D, an output unit 18E, and an update unit 18F.

[0025] At least one of the vulnerability determination unit 18A, the first identification unit 18B, the first calculation unit 18C, the second calculation unit 18D, the output unit 18E, and the update unit 18F is realized, for example, by one or more processors. For example, each of the above units may be realized by having a processor such as a CPU (Central Processing Unit) execute a program, i.e., by software. Each of the above units may be realized by a processor such as a dedicated IC (Integrated Circuit), i.e., by hardware. Each of the above units may be realized by a combination of software and hardware. When multiple processors are used, each processor may realize one of the units, or may realize two or more of the units.

[0026] As described above, at least one of these functional units included in the processing unit 18 may be provided in an information processing device external to the information processing device 10. Furthermore, the processing unit 18 may be configured not to include at least one of the vulnerability determination unit 18A and the update unit 18F.

[0027] The vulnerability determining unit 18A determines whether or not the vulnerability indicated by the newly reported vulnerability information is a vulnerability in the installed software, which is security software that has already been installed in the target system 30.

[0028] The vulnerability determination unit 18A acquires vulnerability information by receiving new vulnerability information from the information processing device 10. The vulnerability determination unit 18A may acquire vulnerability information from a vulnerability database such as CVE, NVD, or JVN iPedia.

[0029] Then, the vulnerability determination unit 18A determines whether or not the vulnerability indicated in the acquired new vulnerability information is a vulnerability in security software that has already been introduced in the target system 30. For example, the vulnerability determination unit 18A reads from the storage unit 16 or the like a list of security software that has already been introduced in or is scheduled to be introduced in the target system 30. Then, the vulnerability determination unit 18A determines whether or not the vulnerability indicated in the vulnerability information is a vulnerability in security software that has already been introduced in or is scheduled to be introduced in the target system 30, for example, by using a CPE (Common Platform Enumeration) listed in the Known Affected Software Configurations column of the NVD.

[0030] The vulnerability determination unit 18A outputs information indicating security software that has been introduced into the target system 30 and for which vulnerabilities have been reported, determined based on the new vulnerability information, to the first identification unit 18B. That is, the vulnerability determination unit 18A selects information on security software that has been introduced into the target system 30 from a large amount of vulnerability information that has been reported, and outputs the information to the first identification unit 18B.

[0031] The first identifying unit 18B identifies the threat type that can be addressed by installed software, which is security software that has already been installed in the target system 30, from among the security software for which vulnerabilities have been reported.

[0032] First, the first identifying unit 18B identifies installed software, which is security software that has already been installed in the target system 30, from among the security software for which vulnerabilities have been reported.

[0033] For example, the first identification unit 18B receives vulnerability information and information about installed software that has a vulnerability and has been installed in the target system 30 from the vulnerability determination unit 18A. The information about the installed software is, for example, identification information about the installed software that is security measure software that has been installed or is scheduled to be installed in the target system 30. In this case, the first identification unit 18B reads the information about the installed software received from the vulnerability determination unit 18A, and identifies the installed software that has been determined by the vulnerability determination unit 18A to have a vulnerability in the installed software that has been installed in the target system 30.

[0034] The processing unit 18 may be configured not to include the vulnerability determination unit 18A. In this case, the first identification unit 18B may identify vulnerable installed software that has been installed in the target system 30 by performing a determination process similar to that of the vulnerability determination unit 18A using new vulnerability information acquired from the external device 20 or an external vulnerability database, etc. That is, in this case, the first identification unit 18B may identify vulnerable installed software that has been installed in the target system 30 from the Known Affected Software Configurations column of CVE or NVD, JVN iPedia, etc.

[0035] Furthermore, the first identifying unit 18B may identify, as installed software, security software registered in the correspondence information 16A, which will be described later, among the security software having the vulnerability indicated in the acquired vulnerability information.

[0036] Then, the first identifying unit 18B identifies a threat type that can be addressed by the installed software, in which the vulnerability has been reported, that has been installed in the target system 30. The first identifying unit 18B identifies the threat type using the correspondence information 16A.

[0037] 3 is a schematic diagram showing an example of the data configuration of the correspondence information 16 A. In this embodiment, the correspondence information 16 A for each target system 30 is described as being stored in the storage unit 16 in advance.

[0038] The correspondence information 16A is a database that associates identification information of security software already installed in the target system 30 with the threat types of threats that can be countered by the security software identified by the identification information. The correspondence information 16A may further register identification information of security software to be installed in the target system 30. That is, the correspondence information 16A registers, in association with each other, the threat types of threats to be protected against in the target system 30 and identification information of security software that has been installed or is to be installed to counter threats of that threat type. The data format of the correspondence information 16A is not limited to a database.

[0039] The correspondence information 16A may be stored in advance in the storage unit 16. The correspondence information 16A may be created in response to a user's operation instruction via the UI unit 14, or may be created in advance by the processing unit 18, the external device 20, or the like and stored in the storage unit 16. The threat types of threats that can be addressed by security software identified by the identification information registered in the correspondence information 16A may be arbitrarily set by the user, or may be set in the correspondence information 16A in an arbitrary manner by the processing unit 18, the external device 20, or the like. For example, the processing unit 18 and the external device 20 may register the threat types in the correspondence information 16A by obtaining information from an arbitrary version of the Security Risk Analysis Guide for Control Systems published by the Information-Technology Promotion Agency, Japan (IPA). Specifically, for example, from among the threats (attack methods) in the Security Risk Analysis Guide for Control Systems, Second Edition, such as unauthorized access, physical intrusion, unauthorized operation, negligent operation, connection of unauthorized media or equipment, unauthorized process execution, malware infection, information theft, information tampering, information destruction, unauthorized transmission, function shutdown, high-load attack, theft, and information theft due to disassembly at the time of theft or disposal, the user or processing unit 18 may select a threat type that can be countered by security software already introduced in the target system 30 and register it in the response information 16A.

[0040] Note that one or more threat types may be registered for one security software in the correspondence information 16A. For example, as shown in Fig. 3, software B, which is security software, may be able to counter threats of both the unauthorized access and information tampering threat types.

[0041] Furthermore, as shown in FIG. 3, multiple types of security software may have already been introduced or are scheduled to be introduced into one target system 30.

[0042] The first identifying unit 18B reads from the correspondence information 16A the threat type associated with the identification information of the installed software, which is the security software that has been installed in the target system 30, among the security software that has the vulnerability indicated in the vulnerability information. Through this reading process, the first identifying unit 18B identifies the threat type of the threat that can be addressed by the installed software.

[0043] Returning to Figure 2, we continue the explanation.

[0044] The first calculation unit 18C calculates a first risk value, which is a risk value for a threat of the threat type identified by the first identification unit 18B, when it is determined that a countermeasure has been taken using installed software. The case where it is determined that a countermeasure has been taken using installed software for which a vulnerability has been reported.

[0045] For example, first calculation unit 18C calculates the first risk value based on risk analysis result information 16B.

[0046] FIG. 4 is a schematic diagram showing an example of the data structure of the risk analysis result information 16B.

[0047] The risk analysis result information 16B is information that represents the results of a risk analysis that compares the risk values ​​before and after countermeasures are taken against a threat of a threat type identified by the first identification unit 18B using installed software.

[0048] The risk analysis can be performed using any analysis method that allows for comparison of risk values ​​before and after implementing countermeasures for installed software. Specifically, for example, the risk analysis can be performed using an analysis method that follows the "Guide to Security Risk Analysis of Control Systems" published by the IPA. Risk analysis result information 16B shown in Figure 4 shows an example of the results of a risk analysis that follows the guide published by the IPA.

[0049] For example, in the "Guide to Security Risk Analysis of Control Systems" published by the IPA, the risk analysis procedure is as follows: Step 1. List the assets on the system; Step 2. Consider the importance of the assets and the threat level for each threat; Step 3. Consider the status of countermeasure implementation and the countermeasure level (vulnerability level); Step 4. Mechanically calculate the risk value for each threat based on the importance of the assets, the threat level, and the countermeasure level (vulnerability level).

[0050] For example, in a risk analysis, the names of devices included in the target system 30 are listed in a target device column, and the importance of the listed devices and the threat level and vulnerability level for each threat type are registered in the risk analysis result information 16B. Then, by registering the presence or absence of countermeasures for each device and threat type (a "circle" mark in FIG. 4 indicates that countermeasures have been taken), the number of countermeasures taken and the countermeasure level corresponding to the threat level are registered in the risk analysis result information 16B for each device and threat type. A higher countermeasure level indicates that more countermeasures have been taken. Furthermore, a lower vulnerability level is registered in the risk analysis result information 16B for each device and threat type. Then, a risk value is automatically determined for each device and threat type based on the registered threat level, vulnerability level, and asset importance, and is registered in the risk analysis result information 16B.

[0051] The risk value determined for each threat type by risk analysis may be expressed alphabetically or numerically. When expressed alphabetically, the closer the risk value is to A, the higher the risk, and the closer the risk value is to Z, the lower the risk. Specifically, for example, the risk value may be expressed on a five-point scale from A to E, with A being the highest risk. On the other hand, when expressed numerically, the higher the risk value is, the higher the risk is, and the lower the risk is, the lower the risk is. Specifically, for example, the risk value may be expressed on a five-point scale from 5 to 1, with 5 being the highest risk. In this embodiment, it is assumed that risk values ​​expressed on a five-point scale from A to E, with A being the highest risk, are registered for each threat type in the risk analysis result information 16B.

[0052] When risk analysis result information 16B is stored in advance in storage unit 16, first calculation unit 18C calculates the first risk value using risk analysis result information 16B.

[0053] For example, it is assumed that the processing unit 18 or an external device such as the external device 20 has performed the risk analysis in advance, and that risk analysis result information 16B representing the risk analysis result has been stored in the storage unit 16 in advance.

[0054] In this case, first calculation unit 18C calculates a first risk value using risk analysis result information 16B. For example, first calculation unit 18C acquires, from risk analysis result information 16B, a risk value associated with a threat type identified by first identification unit 18B in risk analysis result information 16B, the threat type being a countermeasure that can be implemented by the installed software. Through this acquisition process, first calculation unit 18C calculates the read risk value as a first risk value for a threat of that threat type in the event that a countermeasure is implemented by the installed software. In this embodiment, the description will continue assuming that first calculation unit 18C calculates one of risk values ​​A to E, which are expressed on a five-level alphabetical scale, as the first risk value.

[0055] Returning to Figure 2, we continue the explanation.

[0056] The second calculation unit 18D calculates a second risk value that represents the risk value for a threat of the threat type identified by the first identification unit 18B in the case where no countermeasure is taken by the installed software. The case where no countermeasure is taken by the installed software means that it is assumed that no countermeasure is taken for the threat of the threat type identified by the first identification unit 18B in the installed software in which a vulnerability has been reported.

[0057] Second calculation unit 18D calculates the second risk value using the same analysis method as first calculation unit 18C. Therefore, when first calculation unit 18C calculates the first risk value based on risk analysis result information 16B, second calculation unit 18D calculates the second risk value using the analysis method of risk analysis used to create risk analysis result information 16B.

[0058] For example, assume that the risk analysis result information 16B used by the first calculation unit 18C to calculate the first risk value is an analysis method in accordance with the "Guide to Security Risk Analysis of Control Systems" published by the IPA. In this case, the second calculation unit 18D calculates, in accordance with the "Guide to Security Risk Analysis of Control Systems," a second risk value that is a risk value for a threat of the threat type identified by the first identification unit 18B in the case where no countermeasure is taken using installed software.

[0059] In the process of risk analysis, second calculation unit 18D uses information on whether security software against a threat has already been installed, but even if security software has actually been installed in target system 30, second calculation unit 18D performs risk analysis by assuming that the security software has not been installed in target system 30. This allows second calculation unit 18D to calculate a second risk value, which is a risk value against a threat of the threat type identified by first identification unit 18B, for which it is assumed that no countermeasure has been taken by installed software against the threat.

[0060] For example, in the "Guide to Security Risk Analysis of Control Systems" published by the IPA, the risk analysis procedure is to mechanically calculate the risk value for each threat by sequentially executing the above steps 1 to 4. Therefore, the second calculation unit 18D can calculate the second risk value, which is the risk value when it is assumed that no measures have been taken against the threat, by performing a risk analysis assuming that there is no countermeasure implementation status using security software for which vulnerabilities have been reported when examining the countermeasure implementation status and countermeasure level (vulnerability level) in step 3.

[0061] Furthermore, if a risk analysis has been performed in the past by the first calculation unit 18C or the second calculation unit 18D, the second calculation unit 18D may perform the risk analysis from the first step 1 of the risk analysis procedure of steps 1 to 4 described above, or may perform the risk analysis from a necessary part of the middle of step 2 or later. For example, assume that a risk analysis is performed in accordance with the "Guide to Security Risk Analysis of Control Systems" published by the IPA, and risk analysis result information 16B has already been created by the processing unit 18, etc. In this case, the second calculation unit 18D may skip steps 1 and 2 of the risk analysis procedure of steps 1 to 4 described above and perform the risk analysis from step 3. This reduces the processing time required for the second calculation unit 18D to perform the risk analysis and calculate the second risk value.

[0062] In this embodiment, the explanation will be continued assuming that second calculation unit 18D calculates, as the second risk value, one of risk values ​​A to E expressed in a five-level alphabetical scale, similar to first calculation unit 18C.

[0063] There may be cases where the risk analysis result information 16B is not stored in advance in the storage unit 16.

[0064] In such a case, the first calculation unit 18C may calculate the first risk value by executing the risk analysis described above. Specifically, the first calculation unit 18C may calculate the first risk value through risk analysis using any analysis method that has the property of being able to compare risk values ​​before and after the implementation of countermeasures using the introduced software. Specifically, for example, the first calculation unit 18C may calculate the first risk value using the above-described analysis method in accordance with the "Guidelines for Security Risk Analysis of Control Systems" published by the IPA.

[0065] Furthermore, first calculation unit 18C may generate risk analysis result information 16B through the risk analysis and store it in storage unit 16. Then, when first calculation unit 18C calculates the first risk value next time or later, first calculation unit 18C may calculate the first risk value by the same process as above using risk analysis result information 16B stored in storage unit 16.

[0066] In this case, second calculation unit 18D may calculate the second risk value using the same analysis method as first calculation unit 18C. For example, assume that first calculation unit 18C calculates the first risk value through risk analysis using an analysis method in accordance with the "Guidelines for Security Risk Analysis of Control Systems" published by the IPA. In this case, second calculation unit 18D may calculate the second risk value in the same manner as above through risk analysis using an analysis method in accordance with the "Guidelines for Security Risk Analysis of Control Systems" published by the IPA.

[0067] Furthermore, in processing unit 18, if risk analysis result information 16B is not stored in memory unit 16, first calculation unit 18C and second calculation unit 18D may calculate the first risk value and the second risk value in the same manner as described above using the same risk analysis method the first time a vulnerability is reported. Then, when calculating risk values ​​based on the second or subsequent acquisition of vulnerability information, first calculation unit 18C and second calculation unit 18D may calculate the first risk value and the second risk value by the above method using risk analysis result information 16B generated by the first risk analysis.

[0068] Furthermore, second calculation unit 18D may update risk analysis result information 16B stored in storage unit 16 using the analysis results of the risk analysis performed when the second risk value was calculated.

[0069] For example, assume that the second calculation unit 18D calculates the second risk value through risk analysis using an analysis method in accordance with the "Guidelines for Security Risk Analysis of Control Systems" published by the IPA. In this case, the second calculation unit 18D may reflect information representing a change in the risk value when no countermeasures are taken for installed software in the risk analysis result information 16B. Specifically, assume that the second calculation unit 18D calculates a second risk value that assumes no countermeasures are taken against a threat of a given threat type posed by software A, which is installed software already installed in the target system 30, based on certain vulnerability information. In this case, the second calculation unit 18D may perform a process of eliminating the countermeasure corresponding to the threat type in the risk analysis result information 16B (i.e., remove the "o" from the countermeasure column) and register a newly calculated value for the corresponding countermeasure level. Then, the second calculation unit 18D may calculate the second risk value using the newly calculated countermeasure level value.

[0070] Then, when second calculation unit 18D calculates the second risk value next time or later, that is, when calculating the second risk value based on new vulnerability information, second calculation unit 18D may calculate the second risk value using previously updated risk analysis result information 16B. That is, second calculation unit 18D may calculate the second risk value based on the analysis result of the previous risk analysis.

[0071] Specifically, for example, assume a situation in which, due to the reflection of the analysis results from the previous calculation of the second risk value, no countermeasure corresponding to a threat type that can be countered by software A, which is installed software already installed in the target system 30, is registered in the risk analysis result information 16B (i.e., the "O" is removed from the countermeasure column), and a newly calculated countermeasure level value is registered as the corresponding countermeasure level. Then, assume a situation in which the second calculation unit 18D calculates the second risk value using the countermeasure level value. In this case, when calculating the second risk value next time, the second calculation unit 18D may newly calculate a second risk value based on the analysis results reflected last time, i.e., the analysis results of the previous risk analysis in which it was deemed that no countermeasure against the threat by software A was taken.

[0072] More specifically, for example, assume that the installed software in the target system 30 is software G, software H, and software I. Also assume that these installed software are capable of responding to unauthorized access.

[0073] Also, assume that the countermeasures for the threat type "unauthorized access" in the risk analysis result information 16B are "one-way gateway," "WAF," and "authentication of communication partner," and that countermeasures are provided by software G, H, and I, respectively (three "O"s are registered).

[0074] Next, assume that the introduced software having a vulnerability indicated by the vulnerability information acquired the first time is software G. In this case, when calculating the second risk value based on the vulnerability information acquired the first time, for example, the second calculation unit 18D performs risk analysis assuming that no countermeasure has been taken by the "one-way gateway" of software G. In this case, the "○" that indicates the presence of a countermeasure that was registered for the "one-way gateway" of software G is removed, so the number of "○" that indicates the presence of a countermeasure against "unauthorized access" becomes two. Therefore, the second calculation unit 18D calculates, for example, a risk value "C" as the second risk value based on the countermeasure level corresponding to the number of countermeasures taken.

[0075] Next, assume that the introduced software having a vulnerability indicated by the vulnerability information acquired the second time is software H. In this case, when calculating the second risk value based on the vulnerability information acquired the second time, for example, second calculation unit 18D performs risk analysis assuming that no countermeasure has been taken using the "WAF" of software H. In this case, the "◯" indicating that a countermeasure has been taken that is registered in the "WAF" of software H is further removed, so the number of "◯" indicating that a countermeasure has been taken against "unauthorized access" becomes one. Therefore, based on the countermeasure level corresponding to the number of countermeasures taken, second calculation unit 18D calculates a risk value "B" that is increased from the risk value "C" as the second risk value.

[0076] On the other hand, when the second calculation unit 18D calculates the second risk value in the same manner without using the previously updated risk analysis result information 16B, the second risk value calculated based on the vulnerability information acquired the second time will be the risk value "C", unchanged from the first time.

[0077] Therefore, in this way, when the second calculation unit 18D calculates the second risk value next time or later, i.e., when calculating the second risk value based on new vulnerability information, it can calculate the second risk value using the previously updated risk analysis result information 16B, thereby calculating the second risk value based on the analysis results of the previous risk analysis.

[0078] Furthermore, first calculation unit 18C may use risk analysis result information 16B updated by second calculation unit 18D to calculate the first risk value in the same manner as above.

[0079] Therefore, in this case, the second calculation unit 18D updates the risk analysis result information 16B using the analysis results of the risk analysis, so that the first calculation unit 18C and the second calculation unit 18D can calculate risk values ​​(first risk value, second risk value) based on the analysis results of the previous risk analysis when calculating risk values ​​from the next time onwards.

[0080] Next, the output unit 18E will be described.

[0081] The output unit 18E outputs the damage possibility information.

[0082] The damage possibility information is information that indicates the possibility of damage being caused to the target system 30 due to a vulnerability in the installed software.

[0083] The damage possibility information includes at least risk value change information. The risk value change information is information representing a change in the second risk value relative to the first risk value. That is, the risk value change information is information representing a change in the risk value from when a countermeasure is taken against a threat of a threat type that can be addressed by the installed software to when no countermeasure is taken against the threat. For example, assume that the first risk value calculated by the first calculation unit 18C is "B" and the second risk value calculated by the second calculation unit 18D is "A." In this case, the output unit 18E outputs damage possibility information including, as risk value change information, information representing the change from the first risk value "B" to the second risk value "A."

[0084] The damage possibility information may further include a threat type of a threat that has a damage possibility according to the risk value change information. That is, the output unit 18E may output damage possibility information that includes risk value change information for a threat type for which the installed software can take measures and the threat type.

[0085] Furthermore, the damage possibility information may further include damage possibility information. The damage possibility information is information indicating whether there is a possibility of damage or not. The output unit 18E may generate and output damage possibility information that indicates whether there is a possibility of damage when a change in the risk value represented by the risk value change information indicates an increase in risk, and that indicates whether there is no possibility of damage when the change indicates no change or a decrease in risk. For example, assume that the change in the risk value represented by the risk value change information indicates an increase in risk from a first risk value "B" to a second risk value "A." In this case, the output unit 18E may generate damage possibility information indicating whether there is a possibility of damage and output damage possibility information that further includes the damage possibility information.

[0086] The output unit 18E outputs the damage possibility information to at least one of the memory unit 16, the UI unit 14, and an external device such as the external device 20. In other words, outputting the damage possibility means at least one of storing it in the memory unit 16, displaying it on the UI unit 14, and transmitting it to an external device.

[0087] For example, output unit 18E stores the damage possibility information in storage unit 16. By output unit 18E storing the damage possibility information in storage unit 16, it becomes possible to store the analysis results, and it becomes possible to use the data for trend analysis and the like.

[0088] Furthermore, the output unit 18E transmits the damage possibility information to an external information processing device such as an external device via the communication unit 12. By the output unit 18E transmitting the damage possibility information to an external information processing device, the information processing device that receives the damage possibility information can use the data for trend analysis or the like.

[0089] Furthermore, the output unit 18E displays the damage possibility information on the UI unit 14.

[0090] FIG. 5 is a schematic diagram of an example of a display screen 40 displayed on the UI unit 14. As shown in FIG.

[0091] For example, the output unit 18E displays a display screen 40 showing damage possibility information on the UI unit 14. As shown in Fig. 5, for example, the display screen 40 displays on the UI unit 14 the display screen 40 including damage possibility information including a threat type, risk value change information, and damage possibility information. The output unit 18E may also output damage possibility information further including the date and time when the comparison between the first risk value and the second risk value was performed, the CVE number, and the software name of the introduced software.

[0092] By outputting the damage possibility information, the output unit 18E can provide information that makes it easy to identify whether the security risk of the target system 30 will change due to the vulnerability of the installed software for which a vulnerability has been reported, and what kind of damage (threat) the target system 30 may suffer.

[0093] The output unit 18E may output damage possibility information that further includes at least one of the risk value change information, the countermeasure level calculated from the vulnerability level, and information indicating whether or not there is a change in the security risk against the threat.

[0094] In detail, the output unit 18E assumes a risk analysis using an analysis method in accordance with the "Guide to Security Risk Analysis of Control Systems" published by the IPA, and determines whether the security risk of the target system 30 will change due to a change in the countermeasure level, and what kind of damage (threats) may be suffered.

[0095] The countermeasure level is information calculated from the risk value and the vulnerability level, and is expressed, for example, in the matrix shown in Fig. 6. Fig. 6 is an explanatory diagram showing an example of the countermeasure level.

[0096] The output unit 18E compares a first countermeasure level calculated from the first risk value and vulnerability level calculated by the first calculation unit 18C with a second countermeasure level calculated from the second risk value and vulnerability level calculated by the second calculation unit 18D. The first countermeasure level and the second countermeasure level are examples of countermeasure levels.

[0097] The output unit 18E determines that the security risk associated with a threat has changed if the change from the first countermeasure level calculated from the first risk value, which indicates that countermeasures have been implemented, to the second countermeasure level calculated from the second risk value, which indicates that countermeasures have not been implemented, indicates a change to a higher countermeasure level, which indicates a higher risk. Specifically, the output unit 18E determines that the security risk associated with a threat has changed if the change from the first countermeasure level to the second countermeasure level is from the lower risk "countermeasure level is upper limit" to the higher risk "countermeasures required consideration," or from the lower risk "low risk value" to the higher risk "countermeasures required consideration." The output unit 18E outputs damage possibility information that further includes at least one of the countermeasure level and information indicating whether the security risk associated with the threat has changed. In this case, the output unit 18E can further provide a comparison result of the security risk change that takes into account the countermeasure priority determined from the countermeasure level.

[0098] Furthermore, the output unit 18E may further output the threat type to be output by referring to the information in the Description column of the vulnerability information page of NVD or the information in the Expected Impact column of the vulnerability information page of JVN iPedia. This process enables the output unit 18E to output more detailed information for each threat type.

[0099] Returning to Figure 2, we continue the explanation.

[0100] The update unit 18F updates the correspondence information 16A. In particular, the update unit 18F updates the correspondence information 16A so that the correspondence information 16A becomes information that represents the latest state of the target system 30. The update unit 18F updates the correspondence information 16A in response to an operation instruction from the user via the UI unit 14, etc., in at least one of the following cases: when new security software is installed in the target system 30; when new security software is scheduled to be installed in the target system 30; when security software that has been installed in the target system 30 is uninstalled; and when there is a change in the type of threat that the security software can address.

[0101] The update unit 18F updates the correspondence information 16A so that it becomes information that represents the latest state of the target system 30. Note that the processing unit 18 may not necessarily be configured to include the update unit 18F.

[0102] Next, an example of the flow of information processing executed by the information processing device 10 of this embodiment will be described.

[0103] FIG. 7 is a flowchart showing an example of the flow of information processing executed by the information processing device 10 of this embodiment.

[0104] The vulnerability determination unit 18A acquires newly reported vulnerability information (step S100). Then, the vulnerability determination unit 18A determines whether the vulnerability indicated by the vulnerability information acquired in step S100 is a vulnerability in installed software, which is security software that has already been installed in the target system 30 (step S102). The vulnerability determination unit 18A outputs information indicating the security software that has been installed in the target system 30 and for which a vulnerability has been reported, determined based on the new vulnerability information, to the first identification unit 18B.

[0105] The first identifying unit 18B identifies a threat type that can be addressed by installed software, which is security software that has already been installed in the target system 30, from among the security software for which vulnerabilities have been reported (step S104). For example, the first identifying unit 18B receives vulnerability information and information about installed software that has been installed in the target system 30 and has vulnerabilities from the vulnerability determining unit 18A. The first identifying unit 18B reads the information about the installed software received from the vulnerability determining unit 18A, and identifies the installed software that has been determined by the vulnerability determining unit 18A to have a vulnerability in the installed software that has been installed in the target system 30. Then, the first identifying unit 18B identifies a threat type that can be addressed by the identified installed software for which vulnerabilities have been reported.

[0106] The first calculation unit 18C calculates a first risk value, which is a risk value for a threat of the threat type identified in step S104 when a countermeasure is taken by the introduced software against the threat (step S106). For example, the first calculation unit 18C calculates the first risk value based on the threat type identified in step S104 and the risk analysis result information 16B.

[0107] The second calculation unit 18D calculates a second risk value, which is a risk value for a threat of the threat type identified in step S104 when no countermeasure is taken against the threat using introduced software (step S108). The second calculation unit 18D calculates the second risk value using the same analysis method as the analysis method performed by the second calculation unit 19C in step S106.

[0108] The output unit 18E outputs damage possibility information including at least risk value change information indicating the change in the second risk value calculated in step S108 relative to the first risk value calculated in step S106 (step S110), and then ends this routine.

[0109] As described above, the information processing system 1 of this embodiment includes a first identification unit 18B, a first calculation unit 18C, a second calculation unit 18D, and an output unit 18E. The first identification unit 18B identifies, from among the security software for which vulnerabilities have been reported, threat types that can be addressed by installed software, which is the security software already installed in the target system 30. The first calculation unit 18C calculates a first risk value for a threat of the identified threat type when an installed software countermeasure is taken against the threat. The second calculation unit 18D calculates a second risk value for a threat of the identified threat type when an installed software countermeasure is not taken against the threat. The output unit 18E outputs damage possibility information including risk value change information indicating a change in the second risk value relative to the first risk value.

[0110] Here, the impact of vulnerabilities in security software is not limited to the software itself, but also affects the target system 30 that was protected by the security software. However, with conventional technology, even if a vulnerability was found in security software, it was difficult to evaluate the risk to the target system 30 that was protected by the software. In other words, with conventional technology, it was difficult to evaluate the risk to the target system 30 caused by vulnerabilities in security software.

[0111] On the other hand, in the information processing system 1 of this embodiment, among the security countermeasure software for which vulnerabilities have been reported, the threat type that can be countered by the installed software that has already been introduced into the target system 30 is identified, and damage possibility information is output that includes risk value change information that represents the change in the first risk value when countermeasures are taken by the installed software against the threat of the identified threat type, and the second risk value when countermeasures are not taken by the installed software.

[0112] Therefore, the information processing system 1 of this embodiment is capable of outputting damage possibility information, which is information that can identify whether the risk to the target system 30 will increase, when a new vulnerability in security software is reported.

[0113] Therefore, the information processing system 1 of this embodiment can evaluate the risk to the target system 30 due to vulnerabilities in security software.

[0114] (Second embodiment) In this embodiment, a form is described in which a second risk value is calculated for multiple types of threats that can be addressed by installed software, taking into account the impact on information security elements described in vulnerability information, and assuming that measures are needed for threats of some threat types.

[0115] In this embodiment, the same functional components as those in the above embodiment are denoted by the same reference numerals, and detailed description thereof will be omitted.

[0116] 1 is a schematic diagram showing an example of the configuration of an information processing system 2 according to this embodiment. The information processing system 2 has the same configuration as the information processing system 1 according to the above embodiment, except that it includes an information processing device 11 instead of the information processing device 10.

[0117] FIG. 8 is a block diagram showing an example of the functional configuration of the information processing device 11 of this embodiment.

[0118] The information processing device 11 includes a communication unit 12, a UI unit 14, a storage unit 17, and a processing unit 19. The communication unit 12, the UI unit 14, the storage unit 17, and the processing unit 19 are connected via a bus or the like so as to be able to exchange data or signals.

[0119] The information processing device 11 is similar to the information processing device 10 of the above embodiment, except that it includes a storage unit 17 and a processing unit 19 instead of the storage unit 16 and the processing unit 18.

[0120] The storage unit 17 further stores impact information 16C in addition to the response information 16A and the risk analysis result information 16B. Details of the impact information 16C will be described later.

[0121] The processing unit 19 includes a vulnerability determination unit 18A, a first identification unit 18B, a first calculation unit 18C, a second calculation unit 19D, an output unit 18E, an update unit 18F, and a second identification unit 19G.

[0122] At least one of the vulnerability determination unit 18A, the first identification unit 18B, the first calculation unit 18C, the second calculation unit 19D, the output unit 18E, the update unit 18F, and the second identification unit 19G may be realized by, for example, one or more processors. For example, each of the above units may be realized by a processor such as a CPU executing a program, i.e., by software. Each of the above units may be realized by a processor such as a dedicated IC, i.e., by hardware. Each of the above units may be realized by a combination of software and hardware. When multiple processors are used, each processor may realize one of the units or two or more of the units. Furthermore, at least one of the functional units provided in the processing unit 19 may be provided in an external information processing device communicatively connected to the information processing device 11 via the network NW. Furthermore, the impact information 16C may be stored in an external information processing device communicatively connected to the information processing device 11 via the network NW.

[0123] The processing unit 19 is similar to the processing unit 18 of the above embodiment, except that it includes a second calculation unit 19D instead of the second calculation unit 18D, and further includes a second identification unit 19G.

[0124] The second identification unit 19G identifies the threat type of the threat affected by the vulnerability indicated in the vulnerability information, among the threats that can be addressed by the installed software, based on the vulnerability information and the impact information 16C. The vulnerability information used by the second identification unit 19G for identification is the vulnerability information acquired by the vulnerability determination unit 18A.

[0125] As described above, the vulnerability information specifies the threat type of the threat having the vulnerability and the information security element that indicates at least one of confidentiality, integrity, and availability that is affected by the threat of the threat type. Therefore, first, the second identification unit 19G identifies the element that is affected by the newly reported vulnerability from among the three elements of information security, "confidentiality," "integrity," and "availability," based on the vulnerability information.

[0126] In detail, the second identification unit 19G identifies the elements affected by the vulnerability among the three elements of information security, for example, by acquiring information with reference to the Common Vulnerability Scoring System (CVSS). The second identification unit 19G may also identify the elements affected by the vulnerability by acquiring or setting information in other ways. For example, the second identification unit 19G may refer to the CVSS Severity column on the vulnerability information page of the NVD, and identify the vulnerability as having an impact on the corresponding elements if the impact on each of the three elements of information security is rated high or low among high, low, and none. The second identification unit 19G may also identify the vulnerability as having an impact on the corresponding elements if the impact on each of the three elements of information security is rated full or partial among full, partial, and none.

[0127] FIG. 9 is a schematic diagram of an example of the data configuration of impact information 16C. Impact information 16C is information that specifies whether or not each threat type has an impact on an information security element. In other words, impact information 16C is information that indicates which of the three elements of information security a threat type affects. In FIG. 9, "◯" means that a threat of the corresponding threat type affects the relevant information security element. A blank space means that there is no impact.

[0128] The impact information 16C may be created in advance by a user's operation instruction on the UI unit 14 or the like and stored in the storage unit 17. Alternatively, the impact information 16C may be created mechanically and stored in advance in the storage unit 17. That is, the processing unit 19 may create the impact information 16C in advance and store it in the storage unit 17. The correspondence between the threat type and the information security element in the impact information 16C may be arbitrarily set by the user operating the UI unit 14 or the like, or may be set mechanically, or may be set in any manner. Alternatively, one threat type may be set to have an impact on multiple information security elements.

[0129] The second identifying unit 19G identifies, based on the vulnerability information and the impact information 16C, the threat types that are affected by the vulnerability indicated in the vulnerability information, among the threat types that can be addressed by the introduced software.

[0130] For example, assume that the second identification unit 19G identifies, from the vulnerability information, a vulnerability in the "availability" element of the three elements of information security. Also assume that the threat types identified by the first identification unit 18B that can be addressed by the installed software are two threat types: unauthorized access and information tampering. As shown in FIG. 9 , the impact information 16C indicates that unauthorized access affects the three elements of confidentiality, integrity, and availability, and that information tampering affects the two elements of confidentiality and integrity. In this case, the second identification unit 19G identifies, from the impact information 16C, the threat type "unauthorized access" that affects the "availability" element identified as having a vulnerability. Furthermore, the second identification unit 19G identifies threat types other than the threat types identified as having an impact on the vulnerability as threat types that do not have an impact on the vulnerability.

[0131] Then, the second identification unit 19G notifies the second calculation unit 19D of the threat types affected by the vulnerability and the threat types not affected by the vulnerability.

[0132] When multiple threat types are identified by the first identification unit 18B, the second calculation unit 19D calculates a second risk value in the case where no countermeasures are taken for threats of the threat type that are affected by the vulnerability identified by the second identification unit 19G, and countermeasures are taken for threats of the threat type that are not affected by the vulnerability identified by the second identification unit 19G.

[0133] Next, an example of the flow of information processing executed by the information processing device 11 of this embodiment will be described.

[0134] FIG. 10 is a flowchart showing an example of the flow of information processing executed by the information processing device 11 of this embodiment.

[0135] The information processing device 11 executes the processes of steps S200 to S206 in the same manner as the processes of steps S100 to S106 executed by the information processing device 10 (see FIG. 7).

[0136] Specifically, the vulnerability determination unit 18A of the information processing device 11 acquires newly reported vulnerability information (Step S200). Then, the vulnerability determination unit 18A determines whether the vulnerability represented by the vulnerability information acquired in Step S200 is a vulnerability in the installed software (Step S202). The first identification unit 18B identifies a threat type that can be addressed by the installed software, which has been determined to be a vulnerability in the installed software in Step S202 (Step S204). The second calculation unit 18D calculates a first risk value, which is a risk value for the threat of the threat type identified in Step S204, when it is determined that a countermeasure is available by the installed software (Step S206).

[0137] Based on the vulnerability information and impact information 16C acquired in step S200, the second identification unit 19G identifies the threat types that are affected by the vulnerabilities represented in the vulnerability information, among the threat types that can be addressed by the installed software (step S208).

[0138] The second calculation unit 18D calculates a second risk value (step S210) in the case where, among the multiple threat types identified in step S204, no countermeasures are taken for threats of the threat type that is affected by the vulnerability identified in step S208, and countermeasures are taken for threats of other threat types that are not affected by the vulnerability.

[0139] The output unit 18E outputs damage possibility information including at least risk value change information indicating the change in the second risk value calculated in step S210 relative to the first risk value calculated in step S206 (step S212), and then ends this routine.

[0140] As described above, in the information processing system 2 of this embodiment, the second identification unit 19G identifies, from among the threat types for which measures can be taken by the installed software, threat types affected by the vulnerability represented by the vulnerability information, based on the threat type of a threat having a vulnerability and vulnerability information defining information security elements representing at least one of confidentiality, integrity, and availability affected by the threat of that threat type, and on the basis of the impact information 16C. Then, the second calculation unit 19D calculates a second risk value when, from among the multiple threat types identified by the first identification unit 18B, measures are not taken for threats of the threat type affected by the vulnerability identified by the second identification unit 19G, and measures are taken for threats of the threat type not affected by the vulnerability identified by the second identification unit 19G.

[0141] Thus, in this embodiment, the second calculation unit 19D calculates a second risk value that takes into account the impact on the three elements of information security described in the vulnerability information: confidentiality, integrity, and availability, and determines that no countermeasures should be taken for threats of threat types that have an impact on the vulnerability identified by the second identification unit 19G, and that countermeasures should be taken for threats of threat types that do not have an impact on the vulnerability.

[0142] Therefore, the information processing system 2 of this embodiment can provide damage possibility information that is narrowed down to threat types that will truly affect the target system 30, in addition to the effects of the above-described embodiment.

[0143] Next, an example of the hardware configuration of the information processing device 10 and the information processing device 11 in the above embodiment will be described.

[0144] FIG. 11 is a diagram showing an example of the hardware configuration of the information processing device 10 and the information processing device 11 according to the above embodiment.

[0145] The information processing device 10 and the information processing device 11 are equipped with a control device such as a CPU 86, storage devices such as a ROM (Read Only Memory) 88, a RAM (Random Access Memory) 90, and an HDD (Hard Disk Drive) 92, an I / F unit 82 that interfaces with various devices, and a bus 96 that connects each unit, and have a hardware configuration that utilizes a normal computer.

[0146] In the information processing device 10 and the information processing device 11, the CPU 86 reads out a program from the ROM 88 onto the RAM 90 and executes it, thereby realizing the above-mentioned units on the computer.

[0147] The programs for executing the above-described processes executed by the information processing device 10 and the information processing device 11 may be stored in the HDD 92. The programs for executing the above-described processes executed by the information processing device 10 and the information processing device 11 may be provided by being pre-installed in the ROM 88.

[0148] Furthermore, the programs for executing the above processes executed by the information processing device 10 and the information processing device 11 may be stored in an installable or executable file format on a computer-readable storage medium such as a CD-ROM, CD-R, memory card, DVD (Digital Versatile Disk), or flexible disk (FD) and provided as a computer program product. Furthermore, the programs for executing the above processes executed by the information processing device 10 and the information processing device 11 may be stored on a computer connected to a network such as the Internet and provided by downloading via the network. Furthermore, the programs for executing the above processes executed by the information processing device 10 and the information processing device 11 may be provided or distributed via a network such as the Internet.

[0149] Although the embodiments and modifications of the present invention have been described above, these embodiments and modifications are presented as examples and are not intended to limit the scope of the invention. This novel embodiment can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and modifications are included within the scope and spirit of the invention, and are also included in the inventions and their equivalents as defined in the claims. [Explanation of symbols]

[0150] 1. Information Processing Systems 10, 11 Information processing device 16A Compatibility Information 16B Risk Analysis Result Information 16C Impact Information 18A Vulnerability Determination Department 18B 1st Specific Part 18C First Calculation Section 18D, 19D Second calculation section 18E Output section 18F Update Department 19G 2nd Specific Section

Claims

1. a first identification unit that identifies a threat type that can be addressed by installed software, which is the security software already installed in the target system, from among the security software for which vulnerabilities have been reported; a first calculation unit that calculates a first risk value for the identified threat of the threat type when a countermeasure by the installed software is taken; a second calculation unit that calculates a second risk value for the identified threat of the threat type in the case where no countermeasure is taken by the installed software; an output unit that outputs damage possibility information including risk value change information that indicates a change in the second risk value relative to the first risk value; An information processing system comprising:

2. The output unit outputting the damage possibility information, the damage possibility information further including a threat type of the threat having a damage possibility corresponding to the risk value change information; The information processing system according to claim 1 .

3. The output unit outputting the damage possibility information, which further includes damage possibility information that indicates the presence of a damage possibility when a change in the risk value represented by the risk value change information indicates an increase in risk, and indicates the absence of a damage possibility when the change indicates no change or a decrease in risk; The information processing system according to claim 1 .

4. The first calculation unit calculating the first risk value through a risk analysis that compares risk values ​​before and after the countermeasure by the installed software against the identified threat of the threat type; The second calculation unit calculating the second risk value based on the risk analysis in the case where no countermeasure is taken by the installed software against the identified threat of the threat type; The information processing system according to claim 1 .

5. The first calculation unit calculating the first risk value based on risk analysis result information comparing risk values ​​before and after the countermeasure against the threat when the countermeasure is implemented using the installed software; The information processing system according to claim 1 .

6. The second calculation unit updating the risk analysis result information using the analysis result of the risk analysis for calculating the second risk value; The information processing system according to claim 5 .

7. a vulnerability determination unit that determines whether a vulnerability indicated by newly reported vulnerability information is a vulnerability in the installed software, which is security software that has already been installed in the target system; The first identification unit Identifying the installed software that has been installed in the target system and that is determined to be vulnerable to the installed software, and the type of threat that can be addressed by the installed software; The information processing system according to claim 1 .

8. The first identification unit Identifying a threat type that can be addressed by the installed software based on correspondence information that associates the installed software that has been installed in the target system with a threat type that can be addressed by the installed software; The information processing system according to claim 1 .

9. an update unit that updates the correspondence information; The information processing system according to claim 8 , comprising:

10. The output unit outputting the damage possibility information, which further includes a countermeasure level calculated from the risk value change information and the vulnerability level; The information processing system according to claim 1 .

11. The output unit The damage possibility information is displayed on a display unit. The information processing system according to claim 1 .

12. a second identification unit that identifies, among the threat types of threats that can be addressed by the installed software, a threat type affected by a vulnerability represented by the vulnerability information, based on vulnerability information that defines a threat type of a threat having a vulnerability and an information security element that represents at least one of confidentiality, integrity, and availability that is affected by the threat of the threat type, and impact information that defines whether or not each threat has an impact on the information security element; Equipped with The second calculation unit calculating the second risk value in a case where, among the multiple threat types identified by the first identification unit, no countermeasure is taken for threats of a threat type affected by the vulnerability identified by the second identification unit, and countermeasures are taken for threats of a threat type not affected by the vulnerability identified by the second identification unit; The information processing system according to claim 1 .

13. An information processing method executed by an information processing device, Identifying a threat type that can be addressed by installed software, which is the security software already installed in the target system, from among the security software for which vulnerabilities have been reported; calculating a first risk value for the identified threat of the threat type when a countermeasure is taken by the installed software; calculating a second risk value for the identified threat of the threat type in the case where no countermeasure is taken by the installed software; outputting damage possibility information including risk value change information representing a change in the second risk value relative to the first risk value; An information processing method including:

14. Identifying a threat type that can be addressed by installed software, which is the security software already installed in the target system, from among the security software for which vulnerabilities have been reported; calculating a first risk value for the identified threat of the threat type when a countermeasure is taken by the installed software; calculating a second risk value for the identified threat of the threat type in the case where no countermeasure is taken by the installed software; outputting damage possibility information including risk value change information representing a change in the second risk value relative to the first risk value; An information processing program that causes a computer to execute the above.

15. An information processing system including an information processing device and an external device communicably connected to the information processing device, The information processing device includes: a first identification unit that identifies, based on the vulnerability information received from the external device, a threat type that can be addressed by installed software, which is the security software already installed in the target system, from among the security software for which a vulnerability has been reported; a first calculation unit that calculates a first risk value for the identified threat of the threat type when a countermeasure by the installed software is taken; a second calculation unit that calculates a second risk value for the identified threat of the threat type in the case where no countermeasure is taken by the installed software; an output unit that outputs damage possibility information including risk value change information that indicates a change in the second risk value relative to the first risk value to the external device; An information processing system comprising:

Images