Risk evaluation device, risk evaluation data generation method, and program

Abstract

To obtain a risk evaluation value of a risk evaluation object associated with an asset in consideration of an attack scenario.SOLUTION: The risk evaluation device includes a storage unit that stores evaluation target information, scenario information, and scenario evaluation information, and a processing unit that calculates a risk evaluation value. Each of the plurality of attack scenarios S1, S2, and S3 is represented by at least one of a plurality of risk evaluation target ET1, ET2, ET3, and ET4. The processing unit calculates risk evaluation values RV (ET1), RV (ET2), RV (ET3), and RV (ET4) based on a relationship between the plurality of attack scenarios S1, S2, S3 and the plurality of risk evaluation target ET1, ET2,, and and at least one of the plurality of scenario risk values SR (), SR (), and SR () for each of the plurality of risk evaluation target,,, and. ET1 ET3 ET4 ET2 S3 ET4 ET3 S2 S1.SELECTED DRAWING: Figure 7

Description

[Technical Field]

[0001] The present disclosure relates to a risk assessment device, a risk assessment data generation method, and a program. [Background technology]

[0002] Patent Document 1 discloses a technique for comparing a first risk analysis result with a second risk analysis result and displaying a first risk assessment value based on the comparison result. Patent Document 1 discloses that the first risk analysis result includes a first risk assessment value that assesses the risk when an attack is made on assets that constitute a system, and that the second risk analysis result includes a second risk assessment value that assesses the risk of an attack step when a system is attacked based on a predefined scenario. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] WO2021 / 059516A1 Summary of the Invention [Problem to be solved by the invention]

[0004] According to the technique disclosed in Patent Document 1, the work of separately obtaining the first risk analysis result and the second risk analysis result is troublesome.

[0005] Therefore, an object of the present disclosure is to make it possible to easily determine a risk assessment value of a risk assessment target associated with an asset in consideration of an attack scenario. [Means for solving the problem]

[0006] The risk assessment device includes a memory unit that stores assessment target information including a plurality of risk assessment targets, scenario information including a plurality of attack scenarios, and scenario assessment information including a plurality of scenario risk values ​​each associated with the plurality of attack scenarios, and a processing unit that calculates a risk assessment value for each of the plurality of risk assessment targets, wherein each of the plurality of risk assessment targets is information associated with one of a plurality of assets, and each of the plurality of attack scenarios is a scenario represented by at least one of the plurality of risk assessment targets, and the processing unit calculates the risk assessment value for each of the plurality of risk assessment targets based on the relationship between the plurality of attack scenarios and the plurality of risk assessment targets and at least one of the plurality of scenario risk values.

[0007] A risk assessment data generation method stores in a memory unit assessment target information including a plurality of risk assessment targets, scenario information including a plurality of attack scenarios, and scenario assessment information including a plurality of scenario risk values ​​associated with each of the plurality of attack scenarios, wherein each of the plurality of risk assessment targets is information associated with one of a plurality of assets, and each of the plurality of attack scenarios is a scenario represented by at least one of the plurality of risk assessment targets, and wherein a computer generates risk assessment data by calculating a risk assessment value for each of the plurality of risk assessment targets based on the relationship between the plurality of attack scenarios and the plurality of risk assessment targets and at least one of the plurality of scenario risk values.

[0008] The program causes a computer to execute the following steps: storing evaluation target information including multiple risk evaluation targets, scenario information including multiple attack scenarios, and scenario evaluation information including multiple scenario risk values ​​associated with each of the multiple attack scenarios in a memory unit; and calculating a risk evaluation value for each of the multiple risk evaluation targets, wherein each of the multiple risk evaluation targets is information associated with one of multiple assets, and each of the multiple attack scenarios is a scenario represented by at least one of the multiple risk evaluation targets, and the process of calculating the risk evaluation value is a process of calculating the risk evaluation value for each of the multiple risk evaluation targets based on the relationship between the multiple attack scenarios and the multiple risk evaluation targets and at least one of the multiple scenario risk values. [Effects of the Invention]

[0009] According to the present disclosure, it is possible to easily determine a risk assessment value of a risk assessment object associated with an asset by taking into account an attack scenario. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 1 is a block diagram showing an information processing system that is the target of risk evaluation in the first embodiment. [Figure 2] FIG. 2 is a block diagram showing a risk assessment device. [Figure 3] FIG. 3 is a diagram showing evaluation target information. [Figure 4] FIG. 4 is a diagram showing scenario information. [Figure 5] FIG. 5 is a diagram showing scenario evaluation information. [Figure 6] FIG. 6 is a flowchart showing the processing of the risk calculation device. [Figure 7] FIG. 7 is an explanatory diagram showing the calculation process of the risk assessment value. [Figure 8] FIG. 8 is a diagram showing an example of a display of risk assessment values. [Figure 9] FIG. 9 is a block diagram showing an information processing system that is the target of risk evaluation in the second embodiment. [Figure 10] FIG. 10 is a diagram showing the evaluation target information. [Figure 11] FIG. 11 is a diagram showing scenario information. [Figure 12] FIG. 12 is a diagram showing scenario evaluation information. [Figure 13] FIG. 13 is a flowchart showing the processing of the risk calculation device. [Figure 14] FIG. 14 is an explanatory diagram showing the calculation process of the risk assessment value. [Figure 15] FIG. 15 is a diagram showing an example of display of risk assessment values. [Figure 16] FIG. 16 is a flowchart showing the security countermeasure procedure. DETAILED DESCRIPTION OF THE INVENTION

[0011] {First embodiment} The risk assessment device, risk assessment data production method, and program according to the first embodiment will be described below.

[0012] FIG. 1 is a block diagram showing an information processing system 50 that is the subject of risk assessment. The information processing system 50 is a system that includes multiple assets A1, A2, and A3. The assets A1, A2, and A3 are assumed to be computers such as terminal devices, server devices, and communication processing devices that constitute the information processing system 50. The assets A1, A2, and A3 are connected to each other directly or indirectly so that data can be linked. The assets A1, A2, and A3 link together to realize the processing functions of the information processing system.

[0013] The information processing system may be, for example, an IoT (Internet of Things) system that uses the cloud, or a system for autonomous control or remote operation of a robot.

[0014] In this embodiment, asset A1 has an individual threat ET1 to be assessed, asset A2 has an individual threat ET2 to be assessed, and asset A3 has individual threats ET3 and ET4 to be assessed. In this embodiment, threats ET1, ET2, ET3, and ET4 are examples of risk assessment targets. Hereinafter, risk assessment targets may be simply referred to as assessment targets.

[0015] The target of risk assessment may be an asset that is further differentiated by a threat. A threat may be, for example, a threat to information security, such as information leakage, unauthorized access, or unauthorized control. In other words, the target of risk assessment may be an asset that is further differentiated by information leakage, unauthorized access, or unauthorized control.

[0016] As a security measure for the information processing system 50 described above, an assessment is carried out to reduce the risk to the system as a whole.

[0017] Assessment methods include asset-based risk analysis and business damage-based risk analysis. The asset-based risk analysis method clarifies the assets that make up a system and evaluates the risk of assets by considering the importance of each asset and the likelihood and acceptability (vulnerability) of threats expected to occur against each asset. The business damage-based risk analysis method clarifies the business damage that needs to be avoided and evaluates business risk by considering the magnitude of business damage and the likelihood and acceptability (vulnerability) of attacks that are expected to cause business damage.

[0018] Such a risk analysis method is disclosed, for example, in the Security Risk Analysis Guide for Control Systems, 2nd Edition, by the Information-Technology Promotion Agency, Japan (IPA).

[0019] However, while asset-based risk analysis methods can express security risks and countermeasures for each individual asset with high resolution, they may make it difficult to see the risks of the entire system.Business damage-based risk analysis methods can evaluate business risks with an eye on the entire system, but they may make it difficult to see the risks of each individual asset.

[0020] The present disclosure relates to a technology that enables appropriate evaluation of the security risk of an entire system while taking into account factors of individual assets.

[0021] FIG. 2 is a block diagram showing the risk assessment device 10. The risk assessment device 10 includes a risk calculation device 12. The risk calculation device 12 is a computer including a processor 13 as a processing unit and a memory unit 14. The processor 13 includes an arithmetic circuit. The memory unit 14 is configured by a non-volatile storage device such as an HDD (hard disk drive) or an SSD (solid-state drive). The memory unit 14 stores evaluation target information 14a, scenario information 14b, scenario evaluation information 14c, and a program 14d.

[0022] As shown in FIG. 3, the evaluation target information 14a is information including a plurality of risk evaluation targets ET1, ET2, ET3, and ET4. The evaluation target information may be a list including a plurality of risk evaluation targets ET1, ET2, ET3, and ET4. The plurality of risk evaluation targets ET1, ET2, ET3, and ET4 is information associated with any of a plurality of assets A1, A2, and A3. In the evaluation target information 14a, the risk evaluation targets ET1, ET2, ET3, and ET4 may be associated with any of a plurality of assets A1, A2, and A3. The association information may be managed as other information. The risk evaluation targets may sometimes be simply referred to as evaluation targets.

[0023] The evaluation target information 14 a may be information set and input by the user of the risk assessment device 10 based on the configuration diagram of the information processing system 50 .

[0024] As shown in FIG. 4, the scenario information 14b includes multiple attack scenarios S1, S2, and S3. The attack scenarios S1, S2, and S3 are security attack scenarios represented by at least one of the evaluation targets ET1, ET2, ET3, and ET4. The scenario information 14b may be information that specifies the correspondence between each of the attack scenarios S1, S2, and S3 and at least one of the evaluation targets ET1, ET2, ET3, and ET4. The attack scenarios may be simply referred to as scenarios.

[0025] The attack scenarios S1, S2, and S3 may be information created and input by a user of the risk assessment device 10 based on a configuration diagram of the information processing system 50. The user may create the attack scenarios S1, S2, and S3 while looking at the configuration diagram of the information processing system 50, referring to past actual or assumed security damage cases.

[0026] In this example, scenario S1 is associated with evaluation object ET1, scenario S2 is associated with evaluation objects ET1, ET2, and ET3, and scenario S3 is associated with evaluation objects ET1, ET3, and ET4.

[0027] As shown in Fig. 5, the scenario evaluation information 14c is information including a plurality of scenario risk values. The plurality of scenario risk values ​​are values ​​associated with a plurality of attack scenarios S1, S2, and S3, respectively. The scenario risk value is a value that numerically expresses the degree of security risk of the attack scenarios S1, S2, and S3. The scenario risk value may be a value obtained, for example, by evaluating the attack scenario from multiple perspectives and comprehensively considering all of the multiple evaluation values.

[0028] The perspectives may include, for example, the difficulty of recovering from damage caused by an attack, the degree of economic impact of the damage caused by the attack, and the security safety requirement perspective, as described in the "IoT Security and Safety Framework: Ensuring Reliability in the Connection between Physical and Cyberspace" (https: / / warp.da.ndl.go.jp / info:ndljp / pid / 13120268 / www.meti.go.jp / press / 2020 / 11 / 20201105003 / 20201105003-1.pdf) published by the Cybersecurity Division, Commerce and Information Policy Bureau, Ministry of Economy, Trade and Industry on February 5, 2020. The security safety requirement perspective is evaluated based on verification requirements for devices and systems before operation (such as the design and manufacturing stages), verification requirements for devices and systems during operation, verification requirements for operators (such as licenses), and other social support (such as insurance obligations).

[0029] The perspectives may be, for example, the threat level, vulnerability level, and business damage level, as published by the Information-Technology Promotion Agency, Japan in its Security Risk Analysis Guide for Control Systems (March 2023 edition) (https: / / www.ipa.go.jp / security / controlsystem / ssf7ph00000098vy-att / 000109380.pdf). The threat level is the likelihood of the occurrence of the attack means identified in the attack scenario, the vulnerability level is the acceptability of the attack means identified in the attack scenario, and the business damage level is the magnitude of the business damage.

[0030] The evaluator determines an evaluation value from each perspective for the attack scenario. Each evaluation value is substituted into a predetermined calculation formula to obtain a scenario risk value that reflects the evaluation value from each perspective.

[0031] In the example shown in FIG. 5, a scenario risk value of "20" is associated with scenario S1, a scenario risk value of "15" is associated with scenario S2, and a scenario risk value of "60" is associated with scenario S3.

[0032] As shown in Fig. 2, the program 14d describes a process for the processor 13 to calculate a risk assessment value for each of multiple risk assessment targets ET1, ET2, ET3, and ET4. Therefore, the processor 13 executes the process described in the program 14d, thereby executing the process for calculating each risk assessment value. The number of processors 13 may be one or more. The multiple processors 13 may be incorporated into one computer. The multiple processors 13 may be incorporated into multiple computers, and the multiple computers may perform the process for calculating the risk assessment values ​​in a distributed manner. The process as the risk calculation device 12 may be realized by cloud computing.

[0033] The risk assessment device 10 may include an input interface 18 and a display device 19 .

[0034] The input interface 18 is an input interface for inputting various information and instructions to the risk calculation device 12. The various information is, for example, evaluation target information 14a, scenario information 14b, and scenario evaluation information 14c. The instructions are, for example, commands to calculate a risk evaluation. The input interface 18 may be a switch device such as a keyboard, a pointer device such as a mouse, or a touch panel.

[0035] The display device 19 displays various information, for example, the calculated risk assessment, under control based on instructions from the risk calculation device 12. The display device 19 is, for example, a liquid crystal display device or an organic EL (Electro-luminescence) display device.

[0036] The processing of the risk calculation device 12 will be described with reference to the flowchart shown in FIG.

[0037] In procedure P1, the evaluation target information 14a is input to the risk calculation device 12, and the evaluation target information 14a is stored in the storage unit 14.

[0038] In the next step P2, the scenario information 14b is input to the risk calculation device 12, and the scenario information 14b is stored in the storage unit 14.

[0039] In the next step P3, the scenario evaluation information 14c is input to the risk calculation device 12, and the scenario evaluation information 14c is stored in the storage unit 14.

[0040] The above information 14a, 14b, and 14c may be set by the user of the device and input via the input interface 18 or the like.

[0041] The steps P1, P2, and P3 are not limited to the above order, and can be performed in any order.

[0042] In the next step P4, it is determined whether or not a scenario evaluation command has been issued. For example, if the user inputs a scenario evaluation command via the input interface 18, it is determined in step P4 that a scenario evaluation command has been issued. If it is determined that a scenario evaluation command has been issued, the process proceeds to the next step P5, where the transition process is automatically performed.

[0043] In step P5, the processor 13 executes a process of calculating a risk assessment value for each of the multiple assessment targets ET1, ET2, ET3, ET4 based on the relationship between the multiple attack scenarios S1, S2, S3 and the multiple risk assessment targets ET1, ET2, ET3, ET4, and at least one of the multiple scenario risk values.

[0044] Here, the multiple evaluation targets ET1, ET2, ET3, and ET4 are identified by the evaluation target information 14a. The relationship between the multiple attack scenarios S1, S2, and S3 and the multiple risk evaluation targets ET1, ET2, ET3, and ET4 is identified by the scenario information 14b. At least one of the multiple scenario risk values ​​is identified by the scenario evaluation information 14c. Therefore, the processor 13 can calculate the risk evaluation value based on the evaluation target information 14a, the scenario information 14b, and the scenario evaluation information 14c.

[0045] The process of calculating the risk assessment value will be described in more detail with reference to FIG.

[0046] First, the multiple attack scenarios S1, S2, and S3 may be represented by a single evaluation target or by multiple evaluation targets.

[0047] Here, the attack scenario S1 is represented by a single evaluation target ET1. In this case, it is considered that the degree of risk of the attack scenario S1 directly affects the evaluation of the degree of risk of the single evaluation target ET1. Therefore, for the attack scenario S1 represented by a single evaluation target ET1, the entire scenario risk value SR(S1) of the attack scenario S1 is reflected in the single evaluation target ET1.

[0048] In the example shown in Figure 7, the scenario risk value SR(S1) of the attack scenario S1 is "20", and this value "20" is used as is as an addition value to the risk assessment value RV(ET1) of the evaluation target ET1.

[0049] Attack scenario S2 is represented by multiple evaluation targets ET1, ET2, and ET3. In this case, the degree of risk of attack scenario S2 can be considered to be evaluated by combining the risks of multiple evaluation targets ET1, ET2, and ET3. Therefore, when calculating the scenario risk value corresponding to attack scenario S2, the scenario risk value of attack scenario S2 is apportioned among the two or more risk evaluation targets ET1, ET2, and ET3 that represent attack scenario S2.

[0050] 7, the scenario risk value SR(S2) of the attack scenario S2 is "15," and this value "15" is allocated to the risk assessment targets ET1, ET2, and ET3, and the allocated value "5" is used as the sum of the risk assessment values ​​RV(ET1), RV(ET2), and RV(ET3) of the risk assessment targets ET1, ET2, and ET3, respectively. In this embodiment, the scenario risk value SR(S2) "15" is divided equally by the number of risk assessment targets ET1, ET2, and ET3 associated with the attack scenario S2.

[0051] Furthermore, the attack scenario S3 is represented by multiple evaluation targets ET1, ET3, and ET4. Therefore, when calculating the scenario risk value corresponding to the attack scenario S3, the scenario risk value of the attack scenario S3 is proportionally divided among the two or more risk evaluation targets ET1, ET3, and ET4 that represent the attack scenario S3.

[0052] 7, the scenario risk value SR(S3) of the attack scenario S3 is "60," and this value "60" is allocated to the risk assessment targets ET1, ET3, and ET4, and the allocated value "20" is used as the sum of the risk assessment values ​​RV(ET1), RV(ET3), and RV(ET4) of the risk assessment targets ET1, ET3, and ET4, respectively. In this embodiment, the scenario risk value SR(S3) "60" is divided equally by the number of risk assessment targets ET1, ET3, and ET4 associated with the attack scenario S3.

[0053] It is not necessary that the scenario risk value be equally divided by the number of risk assessment targets associated with the attack scenario. For example, weighting coefficients may be set in advance for the risk assessment targets, and the scenario risk value may be distributed in proportions according to the weighting coefficients of the risk assessment targets associated with the attack scenario.

[0054] An attack scenario represented by two or more assessment targets among a plurality of risk assessment targets, such as attack scenarios S2 and S3, may be called a composite attack scenario.

[0055] Furthermore, multiple evaluation targets ET1, ET2, ET3, and ET4 may represent only a single attack scenario or may represent multiple attack scenarios. In other words, multiple evaluation targets ET1, ET2, ET3, and ET4 may be involved in only a single attack scenario or may be involved in multiple attack scenarios.

[0056] 7, the evaluation target ET2 represents only a single attack scenario S2. In this case, the risk assessment value RV(ET2) of the evaluation target ET2 may be calculated based on the value "5" that is based only on the attack scenario S2 in which the evaluation target ET2 is involved.

[0057] Similarly, the evaluation target ET4 represents only a single attack scenario S3. In this case, the risk assessment value RV(ET4) of the evaluation target ET4 may be calculated based on the value "20" based only on the attack scenario S4 involving the evaluation target ET4.

[0058] Furthermore, the evaluation target ET1 represents two or more attack scenarios S1, S2, and S3. Evaluation targets representing two or more attack scenarios, such as this evaluation target ET1 and ET3 described later, may be understood as multi-involvement risk evaluation targets.

[0059] In this case, the process of calculating the risk assessment value RV(ET1) for the multi-involvement risk assessment target ET1 may include the following process.

[0060] First, based on the scenario information 14b, two or more attack scenarios S1, S2, and S3 that represent the multi-involvement risk assessment target are identified from among a plurality of attack scenarios S1, S2, and S3.

[0061] Next, the intermediate evaluation values ​​"20", "5", and "20" are calculated for the two or more attack scenarios S1, S2, and S3 represented by the multi-participation risk evaluation target ET1.

[0062] Then, a risk assessment value RV(ET1) is calculated based on the two or more calculated intermediate assessment values. In this embodiment, the risk assessment value RV(ET1) "45" is calculated by adding the intermediate assessment values ​​"20", "5", and "20".

[0063] For the multi-participation risk evaluation object ET3, the intermediate evaluation values ​​"20" and "5" are added in the same manner as above, and a risk evaluation value RV(ET2) of "25" is calculated.

[0064] As a result of the processing in step P5, the risk assessment values ​​RV(ET1)=45, RV(ET2)=5, RV(ET3)=25, and RV(ET4)=20 are calculated, and the risk assessment data 14e is generated. The risk assessment data 14e is stored in the memory unit 14.

[0065] The process of step P5 is expressed by the following equation 1.

[0066]

number

[0067] Note that j is a number added after the evaluation target ET and is a number that identifies the evaluation target, and i is a number added after the attack scenario S and is a number that identifies the attack scenario S.

[0068] RV(ETj) is the risk assessment value of the evaluation target ETj, SR(Si) is the scenario risk value of the attack scenario Si, and L(Si) is the number of evaluation targets related to the attack scenario Si.

[0069] In the next step P6, the risk evaluation values ​​for each of the evaluation targets ET1, ET2, ET3, and ET4 are displayed in a table format on the display device 19, as shown in Fig. 8. After this, the processing of the risk calculation device 12 ends.

[0070] According to the risk assessment device 10, the method for generating risk assessment data 14e, and the program 14d configured as described above, based on the relationship between multiple attack scenarios S1, S2, S3 and multiple risk assessment targets ET1, ET2, ET3, ET4, and at least one of multiple scenario risk values ​​SR(S1), SR(S2), SR(S3), the risk assessment values ​​RV(ET1), RV(ET2), RV(ET3), RV(ET4) of the risk assessment targets ET1, ET2, ET3, ET4 associated with assets A1, A2, A3 can be easily determined taking into account the attack scenarios S1, S2, S3.

[0071] In particular, because attack scenarios S1, S2, and S3 are taken into consideration, analysis that takes the entire system into account becomes possible, similar to the business damage-based security risk analysis method.In addition, because risk assessment values ​​RV(ET1), RV(ET2), RV(ET3), and RV(ET4) are calculated for assessment targets ET1, ET2, ET3, and ET4, risk analysis can be performed at a high resolution for each asset, similar to the asset-based risk analysis method.

[0072] In other words, by utilizing asset-based and business damage-based analysis methods, it is possible to evaluate the security risk of the entire system while assessing the risk of individual assets.

[0073] Furthermore, according to Patent Document 1, the first risk analysis result is compared with the second risk analysis result, and the first risk evaluation value is displayed based on the comparison result. However, since two types of risk analysis are performed each time an evaluation is performed, this may be time-consuming. In this embodiment, only one type of risk analysis is required, making the risk analysis easier than in Patent Document 1.

[0074] Furthermore, in this embodiment, even before an actual attack occurs, risk analysis is performed based on the virtual evaluation target information 14a, scenario information 14b, and scenario evaluation information 14c. Therefore, this is also suitable for application to a new system.

[0075] Therefore, this embodiment can be easily applied to a new information processing system 50 as well as to the maintenance, operation, modification, and expansion stages of the information processing system 50.

[0076] Furthermore, the risk assessment values ​​RV(ET1), RV(ET2), RV(ET3), and RV(ET4) of the attack scenarios S1, S2, and S3 can be considered to be values ​​evaluated by accumulating the risk assessment targets ET1, ET2, ET3, and ET4 that represent the attack scenarios S1, S2, and S3. Therefore, the scenario risk values ​​SR(S2) and SR(S3) corresponding to the complex attack scenarios S2 and S3 are proportionally divided by the two or more risk assessment targets that represent the complex attack scenarios S2 and S3. This makes it possible to easily determine the risk assessment values ​​RV(ET1), RV(ET2), RV(ET3), and RV(ET4) of the assessment targets ET1, ET2, ET3, and ET4 in the complex attack scenarios S2 and S3.

[0077] Furthermore, when multiple risk assessment targets ET1 and ET3 are involved in multiple attack scenarios S1, S2, and S3, it can be considered that the greater the number of multiple risk assessment targets ET1 and ET3 involved, the greater the degree of risk. Therefore, the intermediate evaluation values ​​of each of the two or more attack scenarios S1, S2, and S3 represented by the multiple risk assessment targets ET1 and ET3 are calculated, and the risk assessment values ​​RV(ET1) and RV(ET3) are calculated based on the calculated two or more intermediate evaluation values. Here, the risk assessment values ​​RV(ET1) and RV(ET3) are calculated by adding the calculated two or more intermediate evaluation values. Therefore, the risk assessment values ​​RV(ET1) and RV(ET3) of the multiple risk assessment targets ET1 and ET3 can be calculated taking into account multiple attack scenarios S1, S2, and S3.

[0078] As described above, by combining processing for cases including complex attack scenarios and processing for cases including multiple involved risk assessment targets, the scenario risk values ​​SR(S1), SR(S2), SR(S3) of each attack scenario S1, S2, S3 are appropriately apportioned according to the level of involvement in the assessment targets, and the risk assessment values ​​RV(ET1) and RV(ET3) are calculated so that the degree of involvement of the assessment targets ET1, ET2, ET3, ET4 in the attack scenarios S1, S2, S3 is appropriately reflected.

[0079] Furthermore, if at least one of the assets A1, A2, and A3 included in the risk assessment targets ET1, ET2, ET3, and ET4 is classified by threat, the assets A1, A2, and A3 are classified by threat and risk assessed, which makes it easy to implement security measures.

[0080] {Second embodiment} A risk assessment device, a risk assessment data generation method, and a program according to the second embodiment will be described. Fig. 9 is a block diagram showing an information processing system 150 that is the target of risk assessment. In the description of this embodiment, components similar to those described in the first embodiment are given the same reference numerals, and their description will be omitted.

[0081] In this embodiment, the information processing system 150 includes, as multiple assets, a cloud 151, a public core network 152, a mobile core network 153, a parent device 154, a child device 155, and other devices 156. Each asset is realized by a computer or the like.

[0082] A parent device 154, a child device 155, and other devices 156 are connected via a local area network or the like.

[0083] The parent device 154 is connected via wireless communication to a mobile core network 153. The mobile core network 153 is connected to the cloud 151 via a public core network 152.

[0084] For example, the child device 155 can use the processing function of the cloud 151 through the parent device 154, the mobile core network 153, and the public core network 152. This allows the information processing system 150 to provide processing functions as a cloud system.

[0085] In this example, cloud 151 includes evaluation targets classified by threat: information leakage, unauthorized access, and unauthorized operation. Hereinafter, the evaluation targets will be referred to as evaluation targets ET1, ET2, and ET3, in that order. Child device 155 includes evaluation targets classified by threat: unauthorized access, information leakage, and unauthorized control. Hereinafter, the evaluation targets will be referred to as evaluation targets ET4, ET5, and ET6, in that order. Furthermore, parent device 154 includes evaluation targets classified by threat: information leakage, unauthorized access, and unauthorized control. Hereinafter, the evaluation targets will be referred to as evaluation targets ET7, ET8, and ET9, in that order.

[0086] The risk assessment device for assessing the information processing system 150 may be realized by a configuration similar to that of the risk assessment device 10 shown in Fig. 2. The main differences between the information processing systems 50 and 150 are described below.

[0087] The evaluation target information 114a is information including a plurality of risk evaluation targets ET1, ET2, ..., ET6, as shown in Fig. 10. In this embodiment, the plurality of risk evaluation targets ET1, ET2, ..., ET6 are associated with information categories, assets, and threats.

[0088] The information category is a category indicating the type of information. For example, the information category is device information, source code, or device certificate. Note that if an asset includes multiple information categories, the evaluation target may be classified by the information category.

[0089] The asset is any one of the cloud 151, the public core network 152, the mobile core network 153, the parent device 154, the child device 155, and the other device 156.

[0090] A threat is an attack method. For example, evaluation targets ET1, ET2, and ET3 are associated with the cloud 151. The evaluation targets ET1, ET2, and ET3 are distinguished by threat type. In this embodiment, the threat of the evaluation target ET1 is information leakage, the threat of the evaluation target ET2 is unauthorized access, and the threat of the evaluation target ET3 is unauthorized operation. The evaluation targets ET4, ET5, and ET6 of the child device 155 and the evaluation targets ET7, ET8, and ET9 of the parent device 154 are also distinguished by threat type.

[0091] 11, the scenario information 114b is information including a plurality of attack scenarios S1, S2, ..., S5. The attack scenarios S1, S2, ..., S5 are security attack scenarios represented by at least one of the evaluation targets ET1, ET2, ..., ET6.

[0092] In this example, for example, attack scenario S1 is a scenario assumed to be "a malicious insider attempting to leak, falsify, or suspend services of data stored in various cloud services." Based on this assumed scenario, it can be seen that the attack is against the cloud 151. Furthermore, because it is an insider attack, it can be seen that the threat is not due to unauthorized access or unauthorized operation, but rather to information leakage. Therefore, scenario S1 is associated with evaluation target ET1.

[0093] Furthermore, attack scenario S2 is a scenario assumed to be "information leakage, tampering, and functional shutdown of device information logs due to improper cloud resource configuration by an external party." Based on this assumed scenario, it can be seen that it is an attack on cloud 151. Furthermore, because it is an attack by an external party, it can be seen that it is a threat related to threats due to unauthorized access, information leakage, and unauthorized control. Therefore, scenario S2 is associated with evaluation targets ET1, ET2, and ET3.

[0094] Similarly, scenario S3 corresponds to evaluation targets ET1, ET2, and ET3, scenario S4 corresponds to evaluation targets ET4, ET5, and ET6, and scenario S5 corresponds to evaluation targets ET7, ET8, and ET9.

[0095] The scenario evaluation information 114c is information including a plurality of scenario risk values ​​SR(Si), as shown in Fig. 12. The plurality of scenario risk values ​​are values ​​associated with a plurality of attack scenarios S1, S2, ..., S5, respectively.

[0096] In this embodiment, the scenario risk value SR(Si) is calculated based on the difficulty of recovering from the damage caused by the attack (X), the degree of economic impact of the damage caused by the attack (Y), and the security safety requirement perspective (Z).

[0097] That is, for each of the attack scenarios S1, S2, ..., S5, the user sets an evaluation value based on the recovery difficulty (X), the degree of economic impact (Y), and the security safety requirement perspective (Z). Then, the scenario risk value SR(Si) is calculated based on each evaluation value X, Y, Z.

[0098] The calculation formula may be, for example, the following equation 2.

[0099]

number

[0100] According to this calculation formula, the larger the evaluation values ​​X, Y, and Z, the larger the scenario risk value SR(Si).

[0101] 12, evaluation values ​​X, Y, and Z are set for each of the scenarios S1, S2, ..., S5, and the scenario risk value SR(Si) is calculated by substituting the evaluation values ​​X, Y, and Z into Equation 2. The calculation of the scenario risk value SR(Si) may be performed automatically by setting the evaluation values ​​X, Y, and Z.

[0102] In the example shown in Figure 12, scenario S1 is associated with a scenario risk value of "12.2", scenario S2 is associated with a scenario risk value of "12.4", scenario S3 is associated with a scenario risk value of "12.5", scenario S4 is associated with a scenario risk value of "14.2", and scenario S5 is associated with a scenario risk value of "11.1".

[0103] The processing of the risk calculation device 12 in this embodiment will be described with reference to the flowchart shown in FIG.

[0104] Step P11 is a combination of steps P1, P2, and P3. As a result, the evaluation target information 114a, scenario information 114b, and scenario evaluation information 114c are input to the risk calculation device 12, and each piece of information 114a, 114b, and 114c is stored in the memory unit 14.

[0105] In the next step P12, it is determined whether or not a scenario evaluation command has been issued. If it is determined that a scenario evaluation command has been issued, the process proceeds to the next step P13.

[0106] The processing of steps P13 to P20 can be considered as a specific embodiment of the processing of calculating the risk assessment value in step P5. The processing of steps P13 to P20 will be described with reference to FIG.

[0107] That is, in step P13, the processor 13 sets 1 as the initial value to each of the variables i and j.

[0108] In the next step P14, the scenario information 114b is referenced to determine whether or not there is a correspondence between the scenario Si and the evaluation target ETj. If it is determined that there is a correspondence, the process proceeds to step P15.

[0109] In step P15, the allocated value of scenario Si is added to the risk assessment value RV(ETj). The allocated value of scenario Si is a value obtained by allocating the scenario risk value (Si) of scenario Si proportionally by the number of assessment targets related to the scenario Si, as in the case of back-balancing in embodiment 1. The number of assessment targets related to scenario Si is calculated based on the scenario information 114b. The scenario risk value (Si) of scenario Si is calculated based on the scenario assessment information 114c.

[0110] It is assumed that the initial values ​​of the risk evaluation values ​​RV(ET1), RV(ET2), . . . , RV(ET5) are set to "0".

[0111] If it is determined in the next step P14 that there is no correspondence, or after step P15 is completed, the process proceeds to step P16.

[0112] In step P16, it is determined whether i is equal to or less than the maximum value of the scenario, which is the maximum value assigned to the scenarios S1, S2, ..., S5.

[0113] If it is determined that i is equal to or less than the maximum value of the scenario, the process proceeds to step P17, where i is incremented by 1. After this, the process returns to step P14, where the apportioned value of the next scenario Si is added according to the conditions.

[0114] If i exceeds the maximum value of the scenario, the process proceeds to step P18. That is, when the evaluation of the contribution of the evaluation target ETj to all scenarios Si is completed, the process proceeds to step P18.

[0115] In step P18, it is determined whether j is equal to or less than the maximum value of the evaluation object, which is the maximum value assigned to the evaluation objects ET1, ET2, . . . , ET9.

[0116] If it is determined that j is equal to or less than the maximum value of the evaluation target, the process proceeds to step P19, where the value 1 is added to j.

[0117] In the next step P20, i is set to 1.

[0118] After step P20, the process returns to step P14 and the transition process is repeated, whereby the proportional value of each scenario Si is added to the next evaluation target ETj according to the conditions.

[0119] If j exceeds the maximum value of the evaluation target, the process proceeds to step P21. In other words, when the evaluation of the contribution of the evaluation target ETj to all scenarios Si is completed, the process proceeds to step P21.

[0120] By performing the processing of steps P13 to P20, risk assessment values ​​RV(ET1), RV(ET2), ..., RV(ET9) are calculated for each of the evaluation targets ET1, ET2, ..., ET9. For example, as shown in Fig. 14, the risk assessment value RV(ET1) of the evaluation target ET1 is "20.5" obtained by adding "12.2" which is the scenario risk value SR(S1), "4.1" which is obtained by dividing "12.4" which is the scenario risk value SR(S2) by "3", and "4.2" which is obtained by dividing "12.5" which is the scenario risk value SR(S3) by "3". For example, the risk assessment value RV(ET4) of the evaluation target ET4 is "4.7" which is the sum of only "14.2" which is the scenario risk value SR(S4).

[0121] As explained in the first embodiment, the processing of steps P13 to P20 is expressed by the above equation (1).

[0122] In this process, the scenario risk value may be a normalized value so that multiple provisional scenario risk values ​​calculated for multiple attack scenarios can be evaluated using a common standard.

[0123] That is, as described above, the multiple scenario risk values ​​SR(S1), SR(S2), ..., SR(S5) calculated for each of the multiple attack scenarios S1, S2, ..., S5 are considered to be provisional scenario risk values. The provisional scenario risk values ​​may be normalized so that they can be evaluated using a common standard, and used as the scenario risk values ​​for calculating the risk assessment values ​​RV(ET1), RV(ET2), ..., RV(ET9).

[0124] Normalization may be performed, for example, by dividing the scenario risk values ​​SR(S1), SR(S2), ..., SR(S5) by the sum of the scenario risk values ​​SR(S1), SR(S2), ..., SR(S5).

[0125] When normalizing the scenario risk values ​​SR(S1), SR(S2), ..., SR(S5), if the divisor for normalization is N, then Equation 1 can be expressed as the following Equation 3, which is obtained by dividing the scenario risk value SR(Si) by N.

[0126]

number

[0127] Normalization may also be performed by other processes, such as dividing the scenario risk values ​​SR(S1), SR(S2), ..., SR(S5) by the average value of the scenario risk values ​​SR(S1), SR(S2), ..., SR(S5), or dividing the difference from the average value of the scenario risk values ​​SR(S1), SR(S2), ..., SR(S5) by the standard deviation.

[0128] The risk assessment values ​​RV(ET1), RV(ET2), . . . , RV(ET9) may be calculated taking into account the damping factor d, as shown in Equation 4.

[0129]

number

[0130] The damping factor d is a value for adjusting the risk assessment values ​​RV(ET1), RV(ET2), ..., RV(ET9), and is set to a value of 0.85, for example. If there are special circumstances that require reducing or increasing the influence of the risk assessment values ​​RV(ET1), RV(ET2), ..., RV(ET9), the damping factor d may be adjusted to a value other than 0.85.

[0131] When the process proceeds from step P18 to step P21, in step P21 the risk assessment values ​​RV(ET1), RV(ET2), ..., RV(ET9) are compared with preset reference values, and risk assessment values ​​RV(ET1), RV(ET2), ..., RV(ET9) that are outside the acceptable range are extracted.

[0132] The reference value is, for example, a value determined theoretically or empirically, set in advance in the risk calculation device 12 via the input interface 18, and stored in the memory unit 14. For example, when the risk assessment values ​​RV(ET1), RV(ET2), ..., RV(ET9) are equal to or greater than the reference value, they are determined to be outside the allowable range.

[0133] In the next step P22, the risk assessment values ​​RV(ET1), RV(ET2), ..., RV(ET9) of each evaluation target ET1, ET2, ..., ET9 are displayed as shown in Fig. 15. For example, a table may be displayed in which the risk assessment values ​​RV(ET1), RV(ET2), ..., RV(ET9) correspond to each evaluation target ET1, ET2, ..., ET9.

[0134] In this case, the comparison result of step P21 may be displayed on the display device 19. The comparison result may be displayed, for example, so that the risk assessment values ​​RV(ET1), RV(ET2), ..., RV(ET9) that are determined to be outside the allowable range are distinguished from the others. For example, the risk assessment value RV(ET1) that is determined to be outside the allowable range may be surrounded by a mark 19M that can be distinguished from the others, displayed in a different color from the others, displayed in a blinking display, or displayed together with characters indicating that it is outside the allowable range. Alternatively, only the risk assessment value RV(ET1) that is determined to be outside the allowable range may be displayed on the display device 19.

[0135] In the next step P23, it is determined whether the information 114a, 114b, and 114c has been updated. That is, the information 114a, 114b, and 114c can be updated via the input interface 18. If it is determined that the information 114a, 114b, and 114c has been updated, the process returns to step P13 and repeats the subsequent processing. Then, based on the updated information 114a, 114b, and 114c, the risk assessment values ​​RV(ET1), RV(ET2), ..., RV(ET9) are calculated. In other words, the risk assessment values ​​RV(ET1), RV(ET2), ..., RV(ET9) are calculated in response to a change in the evaluation target information 114a, the scenario information 114b, or the scenario evaluation information 114c stored in the storage unit 14.

[0136] Note that steps P21, P22 and P23 may be omitted.

[0137] According to the second embodiment, the same effects as those of the first embodiment can be obtained.

[0138] In addition, when multiple scenario risk values ​​SR(S1), SR(S2), ..., SR(S5) are normalized so that they can be evaluated using a common standard, it becomes easier to evaluate the risk evaluation target using a common standard even when the information processing system 150 is changed or when a different information processing system 150 is evaluated.

[0139] Furthermore, if the risk assessment values ​​RV(ET1), RV(ET2), ..., RV(ET9) are compared with preset reference values ​​and the comparison results are displayed on the display device 19, the assessment results can be easily confirmed. Furthermore, assessment targets ET1, ET2, ..., ET9 that are outside the acceptable range can be easily identified, and security measures can be easily implemented.

[0140] Furthermore, if the system configuration is changed, if the data stored in the system is changed, or if a new threat appears, it is expected that the evaluation target information 114a, the scenario information 114b, or the scenario evaluation information 114c will be changed. In such cases, the risk evaluation values ​​RV(ET1), RV(ET2), ..., RV(ET9) are automatically calculated in response to the change in the evaluation target information 114a, the scenario information 114b, or the scenario evaluation information 114c. This facilitates continuous security measures.

[0141] FIG. 16 is a flowchart showing a security countermeasure procedure using the risk assessment device, risk assessment data generation method, and program according to this embodiment.

[0142] Assume that there is an information processing system 150 for which security measures are to be implemented. For example, security measures are required when the information processing system 150 is newly constructed, the system configuration is changed, data is added, or a new threat appears.

[0143] In step P31, attack scenarios S1, S2, . . . , S5 are created.

[0144] In the next step P32, scenario risk values ​​SR(S1), SR(S2), . . . , SR(S5) of the individual scenarios S1, S2, . . . , S5 are calculated.

[0145] In the next step P33, risk assessment values ​​RV(ET1), RV(ET2), . . . , RV(ET9) are calculated for the assessment targets ET1, ET2, . . . , ET9 in the entire system 150.

[0146] In the next step P34, it is determined whether the risk of each evaluation target ET1, ET2, ..., ET9 is outside the acceptable range based on the risk evaluation values ​​RV(ET1), RV(ET2), ..., RV(ET9).

[0147] The processes of steps P33 and P34 can be performed using the risk assessment device described above.

[0148] If it is outside the allowable range, the process proceeds to step P35, and security measures are implemented for the information processing system 150 in consideration of the evaluation target that is outside the allowable range.

[0149] After this, the process returns to step P31 and the processing from step PS31 onwards is repeated, and again the process of calculating the risk assessment values ​​RV(ET1), RV(ET2), ..., RV(ET9) in step P33 and the process of determining whether the risk of each assessment object ET1, ET2, ..., ET9 is tolerable are repeated.

[0150] If it is determined in step P34 that the result is not outside the acceptable range, the security risk in the system 150 is within the acceptable range, and the process ends.

[0151] In this way, when building a new information processing system, risk assessment can be easily performed using the risk assessment device, risk assessment data generation method, and program according to the present disclosure. Furthermore, security measures and risk assessment can be repeated until a desired risk tolerance is achieved for the entire system, making it easier to implement security measures for the system.

[0152] Furthermore, risk assessment can be performed to ensure security when the system configuration is changed, data is added, or new threats emerge.

[0153] [Note] The present disclosure discloses the following aspects.

[0154] The first aspect is a risk assessment device comprising: a memory unit that stores assessment target information including a plurality of risk assessment targets; scenario information that includes a plurality of attack scenarios; and scenario assessment information that includes a plurality of scenario risk values ​​each associated with the plurality of attack scenarios; and a processing unit that calculates a risk assessment value for each of the plurality of risk assessment targets, wherein each of the plurality of risk assessment targets is information associated with one of a plurality of assets, and each of the plurality of attack scenarios is a scenario represented by at least one of the plurality of risk assessment targets, and the processing unit calculates the risk assessment value for each of the plurality of risk assessment targets based on the relationship between the plurality of attack scenarios and the plurality of risk assessment targets and at least one of the plurality of scenario risk values.

[0155] According to this risk assessment device, based on the relationship between multiple attack scenarios and multiple risk assessment targets and at least one of multiple scenario risk values, it is possible to easily determine the risk assessment value of the risk assessment target associated with an asset taking into account the attack scenario.

[0156] A second aspect is a risk assessment device according to the first aspect, wherein the plurality of attack scenarios includes a composite attack scenario represented by two or more of the plurality of risk assessment objects, and the process by the processing unit to calculate the risk assessment value for each of the plurality of risk assessment objects includes a process of apportioning the scenario risk value corresponding to the composite attack scenario among the two or more risk assessment objects representing the composite attack scenario.

[0157] The risk assessment value of an attack scenario can be considered to be a value evaluated by accumulating the risk assessment objects that represent the attack scenario. Therefore, the scenario risk value corresponding to a complex attack scenario is apportioned among two or more risk assessment objects that represent the complex attack scenario. This makes it easy to determine the risk assessment values ​​of the assessment objects in the complex attack scenario.

[0158] A third aspect is a risk assessment device according to the first aspect, wherein the plurality of risk assessment targets include a multi-involvement risk assessment target representing two or more of the plurality of attack scenarios, and the processing by the processing unit to calculate the risk assessment value for the multi-involvement risk assessment target includes processing to identify the two or more attack scenarios represented by the multi-involvement risk assessment target from the plurality of attack scenarios, calculate an intermediate evaluation value for each of the two or more attack scenarios represented by the multi-involvement risk assessment target, and calculate the risk assessment value based on the calculated two or more intermediate evaluation values.

[0159] In this case, if a multi-involvement risk assessment target is involved in multiple attack scenarios, the risk assessment value of the multi-involvement risk assessment target can be calculated taking into account the multiple attack scenarios.

[0160] A fourth aspect is a risk assessment device according to the first aspect, wherein the plurality of attack scenarios includes a complex attack scenario represented by two or more of the plurality of risk assessment objects, and the plurality of risk assessment objects include multi-involvement risk assessment objects representing two or more of the attack scenarios among the plurality of attack scenarios, and the processing by the processing unit to calculate the risk assessment value for the multi-involvement risk assessment objects includes a processing of apportioning the scenario risk value corresponding to the complex attack scenario among the two or more risk assessment objects representing the complex attack scenario, and a processing of identifying the two or more attack scenarios represented by the multi-involvement risk assessment objects from the plurality of attack scenarios, calculating intermediate evaluation values ​​for each of the two or more attack scenarios represented by the multi-involvement risk assessment objects, and calculating the risk assessment value based on the calculated two or more intermediate evaluation values.

[0161] The risk assessment value of an attack scenario can be considered to be a value assessed by accumulating the risk assessment objects that represent the attack scenario. Therefore, the scenario risk value corresponding to a complex attack scenario is apportioned among two or more risk assessment objects that represent the complex attack scenario. This makes it easy to determine the risk assessment value of the assessment objects in the complex attack scenario. Furthermore, when a multi-involved risk assessment object is involved in multiple attack scenarios, the risk assessment value of the multi-involved risk assessment object can be calculated taking into account the multiple attack scenarios.

[0162] A fifth aspect is a risk assessment device according to any one of the first to fourth aspects, wherein the plurality of risk assessment targets include an object in which at least one of the plurality of assets is distinguished by a threat.

[0163] This allows assets to be differentiated by threat and risk assessed.

[0164] A sixth aspect is a risk assessment device relating to any one of the first to fifth aspects, wherein the multiple scenario risk values ​​are normalized values ​​so that the multiple hypothetical scenario risk values ​​obtained for each of the multiple attack scenarios can be evaluated using a common standard.

[0165] This makes it easier for risk assessment targets to be evaluated using common standards, even if the system is changed or if the system is different.

[0166] A seventh aspect is a risk assessment device relating to any one of the first to sixth aspects, further comprising a display device, wherein the processing unit compares the risk assessment value calculated for each of the multiple risk assessment targets with a predetermined reference value and displays the comparison result on the display device.

[0167] This makes it easy to check the evaluation results.

[0168] An eighth aspect is a risk assessment device relating to any one of the first to seventh aspects, wherein the processing unit calculates the risk assessment value in response to a change in the assessment target information, the scenario information, or the scenario assessment information stored in the memory unit.

[0169] It is expected that the evaluation target information, scenario information, or scenario evaluation information will change if the system configuration is changed, the data stored in the system is changed, or a new threat appears. In such cases, calculating the risk evaluation value will enable continuous security measures.

[0170] A ninth aspect is a risk assessment data generation method that stores in a memory unit assessment target information including a plurality of risk assessment targets, scenario information including a plurality of attack scenarios, and scenario assessment information including a plurality of scenario risk values ​​corresponding to each of the plurality of attack scenarios, wherein each of the plurality of risk assessment targets is information associated with one of a plurality of assets, and each of the plurality of attack scenarios is a scenario represented by at least one of the plurality of risk assessment targets, and a computer generates risk assessment data by calculating a risk assessment value for each of the plurality of risk assessment targets based on the relationship between the plurality of attack scenarios and the plurality of risk assessment targets and at least one of the plurality of scenario risk values.

[0171] According to this risk assessment method, the risk assessment value of the risk assessment object associated with the asset can be easily determined taking into account the attack scenarios based on the relationship between multiple attack scenarios and multiple risk assessment objects and at least one of multiple scenario risk values.

[0172] A tenth aspect is a program for causing a computer to execute the following processes: storing evaluation target information including a plurality of risk evaluation targets, scenario information including a plurality of attack scenarios, and scenario evaluation information including a plurality of scenario risk values ​​associated with each of the plurality of attack scenarios in a memory unit; and calculating a risk evaluation value for each of the plurality of risk evaluation targets; wherein each of the plurality of risk evaluation targets is information associated with one of a plurality of assets, and each of the plurality of attack scenarios is a scenario represented by at least one of the plurality of risk evaluation targets; and the process of calculating the risk evaluation value is a process of calculating the risk evaluation value for each of the plurality of risk evaluation targets based on the relationship between the plurality of attack scenarios and the plurality of risk evaluation targets and at least one of the plurality of scenario risk values.

[0173] According to this program, the risk assessment value of a risk assessment object associated with an asset can be easily determined taking into account the attack scenarios based on the relationship between multiple attack scenarios and multiple risk assessment objects and at least one of multiple scenario risk values.

[0174] The configurations described in the above embodiments and modifications can be combined as appropriate as long as they are not mutually contradictory.

[0175] It should be noted that the functions of the elements disclosed herein can be performed using circuits or processing circuits, including general-purpose processors, special-purpose processors, integrated circuits, application-specific integrated circuits (ASICs), conventional circuits, and / or combinations thereof, configured or programmed to perform the disclosed functions. A processor is considered a processing circuit or circuit because it includes transistors and other circuitry. In this disclosure, a circuit, unit, or means is hardware that performs the recited functions or hardware that is programmed to perform the recited functions. The hardware may be hardware disclosed herein or other known hardware that is programmed or configured to perform the recited functions. Where the hardware is a processor, which is considered a type of circuit, the circuit, means, or unit is a combination of hardware and software, and the software is used to configure the hardware and / or processor.

[0176] The above description is illustrative in all respects and is not intended to limit the scope of the present invention. It is understood that numerous variations not illustrated can be envisaged without departing from the scope of the present invention. [Explanation of symbols]

[0177] 10 Risk Assessment Device 12 Risk Calculator 13 processors 14 Storage section 14a, 114a Evaluation target information 14b, 114b scenario information 14c, 114c Scenario Evaluation Information 14d Program 14e Risk Assessment Data 18 Input Interface 19 Display device 19M mark 50, 150 Information Processing Systems 151 Cloud 152 Public Core Network 153 Mobile Core Network 154 Parent Device 155 child devices A1, A2, A3 Assets ET1, ET2, ... Risk assessment target RV(ET1), RV(ET2), ... Risk assessment value RS(S1), RS(S2), ... Scenario risk value S1, S2, ... attack scenarios

Claims

1. a storage unit that stores evaluation target information including a plurality of risk evaluation targets, scenario information including a plurality of attack scenarios, and scenario evaluation information including a plurality of scenario risk values ​​respectively associated with the plurality of attack scenarios; a processing unit that calculates a risk assessment value for each of the plurality of risk assessment targets; Equipped with each of the plurality of risk assessment targets is information associated with any of a plurality of assets; each of the plurality of attack scenarios is a scenario represented by at least one of the plurality of risk assessment targets; The processing unit calculates the risk assessment value for each of the plurality of risk assessment targets based on the relationship between the plurality of attack scenarios and the plurality of risk assessment targets and at least one of the plurality of scenario risk values.

2. The risk assessment device according to claim 1, the plurality of attack scenarios includes a composite attack scenario represented by two or more of the plurality of risk assessment targets, The process in which the processing unit calculates the risk assessment value for each of the plurality of risk assessment targets includes: A risk assessment device including a process of proportionally dividing the scenario risk value corresponding to the composite attack scenario among the two or more risk assessment targets representing the composite attack scenario.

3. The risk assessment device according to claim 1, the plurality of risk assessment targets include a multi-involvement risk assessment target representing two or more of the plurality of attack scenarios; The process in which the processing unit calculates the risk assessment value for the multi-participation risk assessment target includes: Identifying the two or more attack scenarios represented by the multi-involvement risk assessment target from the plurality of attack scenarios; Calculating an intermediate evaluation value for each of the two or more attack scenarios represented by the multi-participation risk evaluation target; A risk assessment device including a process of calculating the risk assessment value based on the two or more calculated intermediate assessment values.

4. The risk assessment device according to claim 1, the plurality of attack scenarios includes a composite attack scenario represented by two or more of the plurality of risk assessment targets, the plurality of risk assessment targets include a multi-involvement risk assessment target representing two or more of the plurality of attack scenarios; The process in which the processing unit calculates the risk assessment value for the multi-participation risk assessment target includes: a process of proportionally dividing the scenario risk value corresponding to the composite attack scenario among the two or more risk assessment targets representing the composite attack scenario; a process of identifying the two or more attack scenarios represented by the multi-involvement risk assessment target from the plurality of attack scenarios, calculating an intermediate evaluation value for each of the two or more attack scenarios represented by the multi-involvement risk assessment target, and calculating the risk evaluation value based on the calculated two or more intermediate evaluation values; A risk assessment device, including:

5. The risk assessment device according to any one of claims 1 to 4, A risk assessment device, wherein the plurality of risk assessment targets include an object in which at least one of the plurality of assets is differentiated by a threat.

6. The risk assessment device according to any one of claims 1 to 4, A risk assessment device wherein the multiple scenario risk values ​​are normalized values ​​such that multiple provisional scenario risk values ​​calculated for each of the multiple attack scenarios can be evaluated using a common standard.

7. The risk assessment device according to any one of claims 1 to 4, Further comprising a display device, The processing unit compares the risk assessment value calculated for each of the multiple risk assessment targets with a predetermined reference value and displays the comparison result on the display device.

8. The risk assessment device according to any one of claims 1 to 4, The processing unit calculates the risk assessment value in response to a change in the assessment target information, the scenario information, or the scenario assessment information stored in the storage unit.

9. A risk assessment data generation method, comprising: storing, in a storage unit, evaluation target information including a plurality of risk evaluation targets, scenario information including a plurality of attack scenarios, and scenario evaluation information including a plurality of scenario risk values ​​associated with each of the plurality of attack scenarios; wherein each of the plurality of risk assessment targets is information associated with any one of a plurality of assets, each of the plurality of attack scenarios is a scenario represented by at least one of the plurality of risk assessment targets; A risk assessment data generation method in which a computer generates risk assessment data by calculating a risk assessment value for each of the plurality of risk assessment targets based on the relationship between the plurality of attack scenarios and the plurality of risk assessment targets and at least one of the plurality of scenario risk values.

10. On the computer, a process of storing, in a storage unit, evaluation target information including a plurality of risk evaluation targets, scenario information including a plurality of attack scenarios, and scenario evaluation information including a plurality of scenario risk values ​​associated with each of the plurality of attack scenarios; A process of calculating a risk assessment value for each of the plurality of risk assessment targets; It is a program for executing wherein each of the plurality of risk assessment targets is information associated with any one of a plurality of assets, each of the plurality of attack scenarios is a scenario represented by at least one of the plurality of risk assessment targets; A program in which the process of calculating the risk assessment value is a process of calculating the risk assessment value for each of the plurality of risk assessment targets based on the relationship between the plurality of attack scenarios and the plurality of risk assessment targets and at least one of the plurality of scenario risk values.

Images