Information processing apparatus, information processing method, and program

Abstract

To provide an information processor, an information processing method and a program for accurately evaluating the combination of security countermeasure technologies.SOLUTION: An information processing device according to an embodiment includes a satisfaction degree evaluation unit that evaluates a satisfaction degree of a system requirement of a combination, a performance degree evaluation unit that evaluates a performance degree of the combination, and a recommendation degree evaluation unit that evaluates a recommendation degree of the combination. The recommendation degree evaluation unit evaluates a recommendation degree of a combination based on the performance degree information and the satisfaction degree information.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to an information processing device, an information processing method, and a program. [Background technology]

[0002] In recent years, cyber attacks targeting systems such as control systems and information systems have become commonplace, making security measures an urgent necessity. Modern systems have complex system configurations that include multiple devices, so advanced expertise is required to design appropriate security. However, the number of security experts capable of designing appropriate security for such systems is limited. Therefore, there is a demand for technology to automate the security design process, with the aim of shortening development time and reducing the personnel costs of security experts. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Laid-Open No. 2015-130152 Summary of the Invention [Problem to be solved by the invention]

[0004] The problem to be solved by the present invention is to provide an information processing device, an information processing method, and a program that accurately evaluate a combination of security countermeasure technologies. [Means for solving the problem]

[0005] An information processing device according to an embodiment includes a sufficiency evaluation unit, a performance evaluation unit, and a recommendation evaluation unit. The sufficiency evaluation unit evaluates the sufficiency of the system requirements of the combination based on evaluation target information indicating a combination of security measure technologies to be evaluated, system requirement information indicating system requirements that are operational requirements for a target system, and impact information indicating the impact of each security measure technology included in the combination on the target system, and generates sufficiency information indicating the sufficiency of the system requirements of the combination. The performance evaluation unit evaluates the performance of the combination based on performance information indicating the implementation record of the security measure technologies included in the combination in systems with the same system requirements as the target system, calculated based on security design cases, and generates performance information indicating the performance of the combination. The recommendation evaluation unit evaluates the recommendation level of the combination based on the performance information and the sufficiency information. [Brief explanation of the drawings]

[0006] [Figure 1] FIG. 2 is a functional block diagram showing an example of the functional configuration of the information processing apparatus according to the first embodiment. [Figure 2] 5 is a flowchart showing an example of processing executed by the information processing apparatus according to the first embodiment. [Figure 3] FIG. 10 is a diagram showing an example of threat information. [Figure 4] FIG. 10 is a diagram showing an example of threat countermeasure information. [Figure 5] FIG. 10 is a diagram showing an example of security requirement information. [Figure 6] FIG. 4 is a diagram showing an example of characteristic information. [Figure 7] FIG. 10 is a diagram showing an example of system requirement information. [Figure 8] FIG. 10 is a diagram showing an example of impact information. [Figure 9] FIG. 10 is a diagram showing an example of performance information. [Figure 10] FIG. 10 is a diagram showing an example of combination information. [Figure 11] FIG. 10 is a diagram showing an example of evaluation target information. [Figure 12] FIG. 10 is a diagram showing an example of a satisfaction score table. [Figure 13] FIG. 10 is an explanatory diagram of processing by a satisfaction level evaluation unit. [Figure 14] FIG. 10 is an explanatory diagram of processing by a satisfaction level evaluation unit. [Figure 15] FIG. 10 is a diagram showing an example of satisfaction level information. [Figure 16] FIG. 10 is an explanatory diagram of processing by a performance evaluation unit. [Figure 17] FIG. 10 is an explanatory diagram of processing by a performance evaluation unit. [Figure 18] FIG. 10 is a diagram showing an example of performance level information. [Figure 19] FIG. 10 is an explanatory diagram of processing by a recommendation level evaluation unit. [Figure 20] FIG. 10 is an explanatory diagram of processing by a recommendation level evaluation unit. [Figure 21] FIG. 10 is a diagram showing an example of recommendation level information. [Figure 22] FIG. 1 is a diagram showing an example of a hardware configuration of an information processing apparatus according to an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0007] Hereinafter, embodiments for carrying out the invention will be described with reference to the drawings.

[0008] (First embodiment) FIG. 1 is a block diagram showing an example of the functional configuration of an information processing device 10 according to the first embodiment.

[0009] The information processing device 10 is a device that supports the user in security design. Specifically, the information processing device 10 ranks (evaluates) combinations of security measures that are effective (able to deal with) against threats in a system for which security measures are being designed, and presents the results to the user. The user can recognize combinations of security measures that will have the greatest effect when introduced. Furthermore, the user can easily perform security design that is suited to the operation (environment) of the target system by considering the introduction of combinations of measures in order from the highest ranked.

[0010] In this specification, security countermeasure technologies are sometimes referred to as "countermeasure technologies" or "security technologies." In addition, in this specification, a system to which a security countermeasure is to be introduced is sometimes referred to as a "target system." Furthermore, in this specification, a combination of security countermeasure technologies is sometimes referred to as a "combination."

[0011] The information processing device 10 evaluates the recommendation level (recommendation level) of a combination of security countermeasure technologies that are effective against threats to the target system based on the degree of fulfillment of system requirements and the degree of performance. The higher the recommendation level of a combination, the more recommended the combination is for introduction into the target system. In other words, the higher the recommendation level, the higher the ranking of the combination. Since the recommendation level is based on the degree of fulfillment of system requirements and the degree of performance, it is possible to evaluate the combination to be evaluated taking into account the degree of fulfillment of system requirements and the degree of performance.

[0012] The following describes an example in which the information processing device 10 extracts combinations that satisfy security requirements from combinations of security measures that are effective against threats to the target system, and ranks the extracted combinations based on the degree of sufficiency of the system requirements and the track record. However, it is not essential that the information processing device 10 extracts combinations that satisfy security requirements from combinations of security measures that are effective against threats to the target system.

[0013] In this specification, security requirements refer to conditions (requirements) (constraints) on the security characteristics of a security technology to be introduced into a target system. For example, the functions of a security technology (prevention, deterrence, detection, recovery) are examples of the security characteristics of a security technology.

[0014] In addition, in this specification, system requirements are functional conditions that a system must satisfy in order to operate the system. System requirements are constraints (conditions) (constraints) on the operation of the system (operational aspect). System requirements can also be said to be conditions (requirements) regarding the impact on the system of security countermeasure technologies to be introduced into the target system. System requirements are also constraints on the system environment (system environmental aspect). For example, in real-time systems, an "increase in communication delays" is often unacceptable. In this case, a condition that indicates a "large" constraint on the "impact on an increase in communication delays" could be a system requirement.

[0015] As shown in FIG. 1, the information processing device 10 includes a threat information acquisition unit 101, a threat countermeasure information acquisition unit 102, a security requirement information acquisition unit 103, a characteristic information acquisition unit 104, a system requirement information acquisition unit 105, an impact information acquisition unit 106, a performance information acquisition unit 107, a combination generation unit 108, a combination selection unit 109, a satisfaction evaluation unit 110, a performance evaluation unit 111, a recommendation evaluation unit 112, an output unit 113, a memory unit 114, and a display unit 115.

[0016] The threat information acquisition unit 101 acquires threat information indicating threats in the target system through user input or the like. The threat information acquisition unit 101 outputs the acquired threat information to the combination generation unit 108. Fig. 3 is an example of threat information. Fig. 3 will be described separately.

[0017] The threat countermeasure information acquisition unit 102 acquires threat countermeasure information that associates threats with security countermeasure technologies that are effective against those threats from the storage unit 114. The threat countermeasure information acquisition unit 102 outputs the acquired threat countermeasure information to the combination generation unit 108. FIG. 4 shows an example of the threat countermeasure information. FIG. 4 will be described separately. Note that the threat countermeasure information is information listed in a catalog of general-purpose security countermeasure technologies or a database of security countermeasure technologies, for example.

[0018] The security requirement information acquisition unit 103 acquires security requirement information indicating security requirements for performing security design of the target system, for example, through user input. The security requirement information acquisition unit 103 outputs the acquired security requirement information to the combination selection unit 109. Fig. 5 is an example of security requirement information. Fig. 5 will be described separately.

[0019] The characteristic information acquiring unit 104 acquires characteristic information that associates security countermeasure technologies with the security characteristics of the security countermeasure technologies from the storage unit 114 or the like. The characteristic information acquiring unit 104 outputs the characteristic information to the combination selecting unit 109. FIG. 6 shows an example of the characteristic information. FIG. 6 will be described separately. The characteristic information is information listed in a catalog of general-purpose security countermeasure technologies or a database of security countermeasure technologies, for example.

[0020] The system requirement information acquisition unit 105 acquires system requirement information indicating system requirements for performing security design of the target system, through user input or the like. The system requirement information acquisition unit 105 outputs the acquired system requirement information to the satisfaction level evaluation unit 110. Fig. 7 is an example of the system requirement information. Fig. 7 will be described separately.

[0021] The impact information acquisition unit 106 acquires impact information that associates a security measure technology with the "impact on the system" that occurs when the security measure technology is introduced into a target system, from the storage unit 114 or the like. The impact information acquisition unit 106 outputs the acquired impact information to the satisfaction evaluation unit 110. The impact information is information that indicates the "impact on the system" that occurs when the security measure technology is introduced into the system.

[0022] Here, "impact on the system" refers to the impact on the target system that hinders the expected functions of the target system when it is in operation. For example, "impact on increased communication delays." Figure 8 is an example of impact information. Figure 8 will be explained separately. Note that impact information is information found in catalogs of general-purpose security countermeasure technologies and databases of security countermeasure technologies.

[0023] The performance information acquiring unit 107 acquires performance information from the storage unit 114, etc. The performance information acquiring unit 107 outputs the acquired performance information to the performance evaluation unit 111. The performance information is information indicating the performance of security measure technologies. That is, it indicates the performance level (performance degree) (performance value) (value indicating the performance level) of the security measure technologies. The performance level (performance level) can be expressed, for example, as a value indicating the performance level. The performance information is information indicating the performance level (adoption performance level) (performance level) of security measure technologies for systems with the same system requirements as the target system, calculated based on security design cases (sometimes referred to as security design performance). The performance level here indicates the degree of adoption performance (ratio of adoption times) of security measure technologies predicted based on the implementation performance in security design cases. FIG. 9 is an example of performance information. FIG. 9 will be described separately.

[0024] The combination generation unit 108 acquires threat information from the threat information acquisition unit 101 and acquires threat countermeasure information from the threat countermeasure information acquisition unit 102. Based on the threat information and the threat countermeasure information, the combination generation unit 108 generates combinations indicating combinations of security countermeasure technologies that are effective against (can be dealt with) threats to the target system. The combination generation unit 108 then generates combination information indicating combinations of security countermeasure technologies that are effective against (can be dealt with) threats to the target system. Hereinafter, the "combination information" may also be referred to as "second combination information." The combination generation unit 108 outputs the combination information to the combination selection unit 109. Figure 10 is an example of combination information. Figure 10 will be described separately.

[0025] The combination selection unit 109 acquires security requirement information from the security requirement acquisition unit, acquires characteristic information from the characteristic information acquisition unit 104, and acquires combination information from the combination generation unit 108. Based on the security requirement information, characteristic information, and combination information, the combination selection unit 109 selects (extracts) combinations that satisfy the security requirements from among the combinations included in the combination information. The combinations that satisfy the security requirements are evaluated by the recommendation level evaluation unit 112.

[0026] Hereinafter, a combination to be evaluated by the recommendation level evaluation unit 112 may be referred to as a "combination to be evaluated." In this embodiment, the combination to be evaluated is a combination that satisfies security requirements. Then, the combination selection unit 109 generates evaluation target information indicating the combination to be evaluated. Hereinafter, the "evaluation target information" may be referred to as "evaluation target combination information" or "first combination information." The combination selection unit 109 outputs the evaluation target information to the satisfaction level evaluation unit 110 and the performance level evaluation unit. Figure 11 is an example of evaluation target information. Figure 11 will be described separately.

[0027] The sufficiency evaluation unit 110 acquires system requirement information from the system requirement acquisition unit, acquires impact information from the impact information acquisition unit 106, and acquires evaluation target information from the combination selection unit 109. Based on the system requirement information, impact information, and evaluation target information, the sufficiency evaluation unit 110 evaluates (calculates) the sufficiency (degree of sufficiency) (sufficiency value) (value indicating the degree of sufficiency) of the system requirements for each combination included in the evaluation target information. As an example, the sufficiency (degree of sufficiency) can be expressed as a value indicating the degree of sufficiency (sufficiency value). Each combination is evaluated from the perspective of the sufficiency of the system requirements. The sufficiency evaluation unit 110 evaluates the sufficiency of the combination to be evaluated by calculating the sufficiency (sufficiency value). In addition, in this embodiment, the sufficiency evaluation unit 110 uses a sufficiency score table shown in FIG. 12 during evaluation. As an example, the sufficiency evaluation unit 110 may read out a sufficiency score table (sufficiency value score table) stored in the storage unit 114 and use it to evaluate the sufficiency. In the following, the sufficiency of the system requirements is evaluated using the score table shown in FIG. 12, but the method for calculating the sufficiency of the system requirements is not limited to this. Any method for calculating the sufficiency may be used. The sufficiency evaluation unit 110 outputs sufficiency information, which is the evaluation result, to the evaluation unit. Note that the sufficiency evaluation unit 110 may also be referred to as the sufficiency calculation unit 110.

[0028] The performance evaluation unit 111 acquires performance information from the performance information acquisition unit 107 and acquires evaluation target information from the combination selection unit 109. Based on the performance information and the evaluation target information, the performance evaluation unit 111 evaluates (calculates) the performance level (performance degree) (performance value) (value indicating the performance level) for each combination included in the evaluation target information. As an example, the performance level (performance degree) can be expressed as a value indicating the performance level (performance value). The performance level calculation method is arbitrary. Each combination is evaluated from the perspective of the performance level. The performance evaluation unit 111 evaluates the combination to be evaluated by calculating the performance level (performance value). The performance evaluation unit 111 outputs performance level information, which is the evaluation result, to the evaluation unit. Note that the performance evaluation unit 111 may also be referred to as the performance level calculation unit 111.

[0029] The recommendation level evaluation unit 112 acquires performance information from the performance information acquisition unit 107 and acquires performance information from the sufficiency level evaluation unit 110. The recommendation level evaluation unit 112 evaluates the combination to be evaluated based on the performance information and the sufficiency level information. The recommendation level evaluation unit 112 evaluates (calculates) the degree of recommendation (recommendation level) (recommendation value) (value indicating the degree of recommendation) for the combination to be evaluated for introduction into the target system. As an example, the recommendation level (recommendation level) can be expressed as a value indicating the degree of recommendation (recommendation value). Each combination is evaluated from the perspective of the degree of recommendation. The recommendation level evaluation unit 112 evaluates the degree of recommendation of the combination to be evaluated by calculating the recommendation level (recommendation value). The higher the evaluation of the recommendation level by the recommendation level evaluation unit 112, the more recommended the combination is for introduction into the target system. The method of calculating the recommendation level is arbitrary. Hereinafter, information indicating the evaluation result by the recommendation level evaluation unit 112 will be referred to as recommendation information. The recommendation level evaluation unit 112 outputs recommendation information, which is the evaluation result, to the output unit 113. The recommendation level evaluation unit 112 may also be referred to as the recommendation level calculation unit 112.

[0030] The output unit 113 acquires the recommendation information from the recommendation level evaluation unit 112. The output unit 113 outputs the recommendation information. As an example, the output unit 113 outputs the recommendation information to the display unit 115.

[0031] The storage unit 114 stores various types of information used by the information processing apparatus 10 of the embodiment. The storage unit 114 can be realized by an auxiliary storage unit 114 (shown in the figure) such as an HDD (Hard Disk Drive).

[0032] The display unit 115 displays the recommended information acquired from the output unit 113. Here, the display unit 115 is provided inside the information processing device 10, but it may be provided outside the information processing device 10.

[0033] Next, FIGS. 3 to 11 will be explained.

[0034] FIG. 3 is an example of threat information acquired by the threat information acquisition unit 101. As described above, threat information is information indicating threats to the target system. In FIG. 3, threats to the target system are shown as Threat 1: "Unauthorized use over the network," Threat 2: "Hardware failure," and Threat 3: "Disruption by DDoS (Detributed Denial of Service)" (disruption by DDoS attack). Threat information can be input by utilizing the output of results obtained using general risk assessment methods and tools.

[0035] 4 shows an example of threat countermeasure information acquired by the threat countermeasure information acquisition unit 102. As described above, threat information is information that associates threats with security countermeasure technologies that are effective against those threats.

[0036] Figure 4 shows that effective security countermeasure technologies against Threat 1: "Unauthorized use over the network" include "Communication Partner Authentication (SSL / TLS) (Secure Sockets Layer / Transport Layer Security)," "Communication Partner Authentication (VPN) (Virtual Private Network)," "Firewall," and "Personal Firewall." It also shows that security countermeasure technologies against Threat 2: "Hardware Failure" include "Redundancy," "Preventive Maintenance," "Device Anomaly Detection," "Log Collection (Endpoint Detection and Response, etc.) and Analysis," and "Data Backup / Restore." It also shows that a security countermeasure technology against Threat 3: "Disruption by DDoS" is "DDoS Countermeasures."

[0037] Fig. 5 is an example of security requirement information acquired by the security requirement information acquisition unit 103. As shown in Fig. 5, the security requirement information is information in which "security requirement items (requirement items)" and "security requirement contents (requirement contents)" are associated with each other.

[0038] The "requirement items" indicate the security characteristics of the security technology required for the target system. In this specification, security characteristics refer to the overall characteristics of the security technology, such as the strength of the security technology (sometimes referred to as security strength), the functionality of the security technology (sometimes simply referred to as security functionality), and the ease of operation of the security technology.

[0039] "Security strength" indicates the strength of the security countermeasure technology, and can be expressed in multiple levels depending on the strength, such as "high strength," "medium strength," and "low strength." In other words, if the "requirement item" is "security strength," the "requirement content" can be expressed in multiple levels depending on the strength, such as "high strength," "medium strength," and "low strength."

[0040] In Figure 5, the security requirement specifies that the "requirement item" is "security strength" and the "requirement content" corresponding to "security strength" is "medium strength." This means that in the security design of the target system, the security strength required for the security countermeasure technology is "medium strength" or higher.

[0041] In other words, security measures with a security strength of "medium" or "high" will satisfy the security requirements, while security measures with a security strength of "low" will not satisfy the security requirements.

[0042] Furthermore, the above-mentioned "security functions" include, for example, "deterrence," "detection," and "recovery." "Deterrence" refers to a function that "deters" an attack. "Detection" refers to a function that "detects" an attack. "Recovery" refers to a function that "recovers" from an abnormal state caused by an attack. When the "requirement item" of a security requirement is a "security function," the "requirement content" is specified as "deterrence," "detection," "recovery," etc.

[0043] Figure 5 shows that the "requirement content" corresponding to the "security function" is specified as "deterrence." This means that in the security design of the target system, the type of security function required of the security measure technology is "deterrence." In other words, a security measure technology whose security function is "deterrence" will satisfy the security requirement. On the other hand, a security measure technology whose security function is "detection" or "recovery" will not satisfy the security requirement.

[0044] In the following, a security requirement whose "requirement item" is "security strength" and whose "requirement content" is "medium strength" will be referred to as security requirement 1. Also, a security requirement whose "requirement item" is "security function" and whose "requirement content" is "deterrence" will be referred to as security requirement 2.

[0045] 6 shows an example of the characteristic information acquired by the characteristic information acquisition unit 104. As described above, the characteristic information is information that associates security countermeasure technologies with the security characteristics of the security countermeasure technologies. The security characteristics include security strength, security functions, ease of operation of the security countermeasure technologies, etc.

[0046] In Figure 6, "security strength" and "security function" are shown as security characteristics by way of example. As mentioned above, "security function" can be categorized into several types, such as "deterrence," "detection," and "recovery." Furthermore, "security strength" can be expressed in multiple levels, such as "high strength," "medium strength," and "low strength," depending on the level of strength.

[0047] In Figure 6, for example, "Authentication of communication peers (SSL / TLS)" has a security strength of "medium" and a security function of "suppression." Other security measures technologies are also similarly associated with security strength and security functions.

[0048] 7 is an example of system requirement information acquired by the system requirement information acquisition unit 105. As shown in FIG. 7, the system requirement information is information in which "system requirement items (requirement items)" and "system requirement contents (requirement contents)" are associated with each other. The system requirements are requirements on the system environment and operation of the target system. The "requirement items" indicate the types of operational impacts on the target system that need to be considered when designing security for the target system.

[0049] The types of impact include, for example, "impact on increased communication delays," "impact on increased computer load," and "impact on physical space." For these impacts, the magnitude of the requirement (magnitude of constraint) is indicated as "requirement content." The magnitude of the requirement (magnitude of constraint) can be, for example, "large requirement (large constraint)," "medium requirement (medium constraint)," "small requirement (small constraint)," "no requirement (no constraint)," etc.

[0050] In Figure 7, the "requirement items" are shown to be "impact on increased communication delays," "impact on increased computer load," and "impact on physical space." For example, the "requirement content" associated with "impact on increased communication delays" is shown to be "low requirements (low constraints)." The "requirement content" associated with "impact on increased computer load" is shown to be "high requirements (high constraints)." Furthermore, the "requirement content" associated with "impact on physical space" is shown to be "required (constrained)."

[0051] In the following, a system requirement whose "requirement item" is "impact on increased communication delay" and whose "requirement content" is "low requirement (low constraint)" will be referred to as System Requirement 1. A system requirement whose "requirement item" is "impact on increased computer load" and whose "requirement content" is "high requirement (high constraint)" will be referred to as System Requirement 2. A system requirement whose "requirement item" is "impact on physical space" and whose "requirement content" is "medium requirement (medium constraint)" will be referred to as System Requirement 3.

[0052] 8 is an example of impact information acquired by the impact information acquisition unit 106. As described above, the impact information is information that associates security countermeasure technologies with the "impact (degree of impact) on the system" that occurs when the security countermeasure technologies are introduced into a target system. Types of impact on the target system include, for example, "impact on increased communication delays," "impact on increased computer load," and "impact on physical space."

[0053] In FIG. 8, if a security measure technology has an impact on the system, the impact (degree of impact) on the system can be indicated in multiple levels, such as "large," "medium," "small," or "none," depending on the magnitude of the impact.

[0054] Furthermore, if a security measure technology has no effect on the system, the effect (degree of effect) on the system can be displayed as, for example, "none."

[0055] In Figure 8, for "Authentication of communication partners (SSL / TLS)," the "impact on increased communication delay" is "small," the "impact on increased computer load" is "small," and the "impact on physical space" is "none." The degree of each impact is similarly shown for other security countermeasure technologies.

[0056] FIG. 9 shows an example of performance information acquired by the performance information acquiring unit 107. As described above, performance information is information indicating the implementation record (adoption record) (performance record) of security measures for systems with the same system requirements as the target system, calculated based on security design cases. The performance record here also refers to the adoption record of a security measure for a system (the ratio of adoptions) predicted based on the implementation record in the security design cases. Performance information is information indicating the implementation record of a security measure. A security design case is a security design case for a system with at least the same system requirements as the target system (the requirement content (demand level) may be the same or different). A security design case is a security design case for a system in which at least one threat included in the threat information is anticipated. The performance record of a security measure technology capable of dealing with threat 1 and the performance record of a security measure technology capable of dealing with threat 2 may be calculated from different security design cases. This is because even if a security design has the same system requirements as the target system, the anticipated threats may be different. Performance information is information that reflects the number of times a security measure technology has been introduced (adopted) (whether it has been introduced as a security measure technology) in security design cases for systems with the same system requirements as the target system. In other words, a security measure technology with a high performance record is a security measure technology that has been introduced many times in security design cases. Performance information obtained from many security design cases is more preferable.

[0057] There are four security technologies that are effective against Threat 1. The track record of a security technology that can address Threat 1 reflects the number of times that the security technology has been implemented (adopted) in security design cases where Threat 1 is anticipated and the system requirements are the same as those of the target system (at least the system requirements are the same). In other words, the track record of a security technology that can address Threat 1 indicates the degree of implementation in security design cases where Threat 1 is anticipated and the system requirements are the same as those of the target system (at least the system requirements are the same). In other words, the track record information is information that indicates the implementation track record of security technologies. As shown in FIG. 9, the track record information associates, for each threat, a security technology that can (is effective) against the threat, and the (track record) (track record value) of the security technology. As described above, the track record information indicates that the larger the track record value of a security technology, the more frequently it has been implemented (adopted) in security design cases. For example, of the security technologies that can address Threat 1, "Unauthorized use over the network," the one with the highest track record is "Authentication of communication peers (VPN)." The meaning of this is explained below. For example, suppose Threat 1 was anticipated for a system with the same system requirements as the target system. In this case, "Authentication of communication peers (VPN)" is the security technology that was most frequently deployed to address Threat 1. In other words, the higher the track record of a security technology that can address a certain threat, the more frequently it has been deployed under the same system requirements. In other words, track record information reflects the knowledge of security designers and system designers in security design cases.

[0058] It has been stated that a security design case is a case of security design for a system that has at least the same system requirement items as the target system (the requirement content (demand level) may be the same or different). In other words, a security design case has the same system requirement items as the target system, but the demand level may be different.

[0059] Even in this case, it is possible to predict the performance of a system that has the same system requirements as the target system (the same system requirement items and requirements) by using, for example, machine learning or the like. Note that the performance here also means the degree of adoption of a security measure technology (the ratio of adoptions) predicted based on the implementation record in security design cases. In other words, it is possible to predict the performance of a security measure technology for a system that has the same system requirements as the target system (the same system requirement items and requirements), based on security design cases that have the same system requirement items but different requirement contents (requirements), and this performance may be used.

[0060] FIG. 10 is an example of combination information generated by the combination information generation unit. As described above, combination information is information indicating a combination of security measures that are effective (capable of dealing with) threats to the target system. FIG. 10 shows combinations A to T as combinations of security measures that are effective against threats 1 to 3. For example, combination A is a combination that includes three security measures: "authentication of communication peers (SSL / TLS)," "redundancy," and "DDoS countermeasures." Combination A also shows that "authentication of communication peers (SSL / TLS)" is selected as a security measure technology that is effective against threat 1, "unauthorized use over the network," "redundancy" is selected as a security measure technology that is effective against threat 2, "hardware failure," and "DDoS countermeasures" is selected as a security measure technology that is effective against threat 3. Similarly, for each of the other combinations, security measures that are effective against threats 1 to 3 are shown.

[0061] 11 is an example of evaluation target information generated by the combination selection unit 109. As described above, evaluation target information is information indicating a combination of evaluation targets. In the figure, it is shown that there are four combinations of evaluation targets: "Combination A," "Combination B," "Combination F," and "Combination G."

[0062] Next, an example of processing executed by the information processing device 10 according to the first embodiment will be described.

[0063] FIG. 2 is a flowchart showing an example of processing executed by the information processing device 10 according to the first embodiment.

[0064] In step S501 of Figure 2, the threat information acquisition unit 101, the threat countermeasure information acquisition unit 102, the security requirement information acquisition unit 103, the characteristic information acquisition unit 104, the system requirement information acquisition unit 105, the impact information acquisition unit 106, and the performance information acquisition unit 107 acquire various types of information.

[0065] The threat information acquisition unit 101 acquires threat information and outputs it to the combination generation unit 108. The threat countermeasure information acquisition unit 102 acquires threat countermeasure information and outputs it to the combination generation unit 108. The security requirement information acquisition unit 103 acquires security requirement information and outputs it to the combination selection unit 109. The characteristic information acquisition unit 104 acquires characteristic information and outputs it to the combination selection unit 109. The system requirement information acquisition unit 105 acquires system requirement information and outputs it to the fulfillment level evaluation unit 110. The impact information acquisition unit 106 acquires impact information and outputs it to the fulfillment level evaluation unit 110. The performance information acquisition unit 107 acquires performance information and outputs it to the performance level evaluation unit 111.

[0066] In step S503 of FIG. 2, the combination generation unit 108 generates combination information indicating a combination of security countermeasure techniques that are effective (capable of dealing with) threats to the target system, based on the threat information and the threat countermeasure information.

[0067] In the threat information in Figure 3, the threats to the target system are shown as Threat 1 "Unauthorized use over the network," Threat 2 "Hardware failure," and Threat 3 "DDoS." In addition, in the threat countermeasure information in Figure 4, four security countermeasure technologies are shown as security countermeasure technologies that can deal with Threat 1 "Unauthorized use over the network." Five security countermeasure technologies are shown as security countermeasure technologies that can deal with Threat 2 "Hardware failure." Similarly, one security countermeasure technology is shown as security countermeasure technology that can deal with Threat 3 "DDoS."

[0068] As an example, the combination generation unit 108 generates a combination of security countermeasure technologies that can deal with threats 1 to 3 by selecting one security countermeasure technology that can deal with each threat. That is, as an example, the combination generation unit 108 generates a combination of security countermeasure technologies that can deal with threats 1 to 3 by selecting one security countermeasure technology that can deal with threat 1, one security countermeasure technology that can deal with threat 2, and one security countermeasure technology that can deal with threat 3. For example, in the threat countermeasure information of FIG. 4, the combination generation unit 108 generates combination A by selecting "authentication of communication peer (SSL / TLS)" as the security countermeasure technology that can deal with threat 1, "redundancy" as the security countermeasure technology that can deal with threat 2, and "DDoS countermeasure" as the security countermeasure technology that can deal with threat 3.

[0069] Since there are four security measures technologies that can deal with threat 1, five security measures technologies that can deal with threat 2, and one security measures technology that can deal with threat 3, the combination generation unit 108 generates a total of 20 combinations (combinations A to J). Then, the combination generation unit 108 generates combination information shown in Fig. 10 as an example, and outputs it to the combination selection unit 109 (step S503).

[0070] In step S505 of FIG. 2, the combination selection unit 109 selects a combination that satisfies the security requirement from among the combinations included in the combination information, based on the security requirement information, the property information, and the combination information.

[0071] The security requirement information in Figure 5 shows that for security requirement 1, the "requirement item" is "security strength" and the "requirement content" corresponding to "security strength" is specified as "medium strength." This means that in the security design of the target system, the security strength required of the security countermeasure technology is "medium strength" or higher. Also, Figure 5 shows that for security requirement 2, the "requirement content" corresponding to "security function" is specified as "deterrence." This means that in the security design of the target system, the type of security function required of the security countermeasure technology is "deterrence." Furthermore, the characteristics information in Figure 6 shows the security strength and security function for each security countermeasure technology.

[0072] For a certain combination included in the combination information, if there is one or more security measures technologies included in the combination that do not satisfy the security requirements, the combination selection unit 109 determines that the combination does not satisfy the security requirements.On the other hand, for a certain combination included in the combination information, if all of the security measures technologies included in the combination satisfy the security requirements, the combination selection unit 109 determines that the combination satisfies the security requirements.

[0073] In this embodiment, there are two security requirements: security requirement 1 and security requirement 2. Here, the number of security requirement items matches the number of security requirements. As an example, the combination selection unit 109 determines that a security measure technology that satisfies two security requirements is a security measure technology that satisfies the security requirements. Furthermore, the combination selection unit 109 determines that a security measure technology that does not satisfy even one of the two security requirements is a security measure technology that does not satisfy the security requirements.

[0074] Next, a description will be given of how to determine whether security requirement 1 is satisfied or not in this embodiment.

[0075] In the security requirement information of FIG. 5, the security requirement item "security strength" indicates that the requirement content is "medium strength." In this case, for example, the combination selection unit 109 determines that security measure technologies with security strengths of "medium strength" or "strong strength" satisfy security requirement 1. On the other hand, for example, the combination selection unit 109 determines that security measure technologies with security strengths of "weak strength" do not satisfy security requirement 1. Therefore, the combination selection unit 109 determines that "authentication of communication peers (SSL / TLS)," "authentication of communication peers (VPN)," "redundancy," "preventive maintenance work," and "DDoS countermeasures" satisfy security requirement 1 in the characteristic information of FIG. 6. On the other hand, the combination selection unit 109 determines that "device anomaly detection," "log collection (EDR, etc.) and analysis," and "data backup / restore" do not satisfy security requirement 1 in the characteristic information of FIG. 6.

[0076] Next, we will explain how to determine whether security requirement 2 is met or not.

[0077] In the security requirement information of FIG. 5, the requirement content for the security requirement item "security function" is indicated as "deterrence." In this case, for example, the combination selection unit 109 determines that a security measure technology whose security function is "deterrence" satisfies security requirement 2. On the other hand, for example, the combination selection unit 109 determines that a security measure technology whose security function is "detection" or "recovery" does not satisfy security requirement 2. Here, there exists a security measure technology that has two functions, "detection" and "recovery," such as "redundancy" shown in FIG. 6. In this case, for example, the combination selection unit 109 determines that security requirement 2 is satisfied.

[0078] Therefore, the combination selection unit 109 determines that the characteristics information in Figure 6, including "Authentication of communication partner (SSL / TLS)," "Authentication of communication partner (VPN)," "Firewall," "Personal firewall," "Redundancy," "Preventive maintenance work," and "DDoS countermeasures," meet security requirement 1.

[0079] On the other hand, the combination selection unit 109 determines that the characteristics information in FIG. 6 does not satisfy security requirement 2 for "device abnormality detection," "log collection (EDR, etc.) and analysis," and "data backup / restore."

[0080] In this embodiment, the combination selection unit 109 determines that a security measure technology that does not satisfy at least one of security requirement 1 and security requirement 2 does not satisfy the security requirements of the security requirement information. Therefore, "firewall," "personal firewall," "device anomaly detection," "log collection (EDR, etc.) and analysis," and "data backup / restore" are determined to be security measure technologies that do not satisfy the security requirements.

[0081] The combination selection unit 109 determines that a combination that includes a security measure technology that is determined not to satisfy the security requirements, among the combinations included in the combination information, is a combination that does not satisfy the security requirements. Therefore, "Combination C," "Combination D," "Combination E," "Combination H," "Combination I," "Combination J," "Combination K," "Combination L," "Combination M," "Combination N," "Combination O," "Combination P," "Combination Q," "Combination R," "Combination S," and "Combination T," which are combinations that include at least one of "firewall," "personal firewall," "device anomaly detection," "log collection (EDR, etc.) and analysis," and "data backup / restore," are determined to be combinations that do not satisfy the security requirements.

[0082] On the other hand, "Combination A," "Combination B," "Combination F," and "Combination G," which are combinations that do not include security measures that do not satisfy the security requirements, will be judged to be combinations that satisfy the security requirements.

[0083] As described above, in this embodiment, combinations that satisfy the security requirements are evaluated by the recommendation level evaluation unit 112. That is, combinations filtered by the security requirements are evaluated. The combination selection unit 109 generates evaluation target information indicating combinations that satisfy the security requirements and outputs it to the satisfaction level evaluation unit 110 (step S505).

[0084] In step S507 of FIG. 2, the fulfillment level evaluation unit 110 evaluates the fulfillment level of the system requirements for each combination included in the evaluation target information, based on the system requirement information, the impact information, and the evaluation target information.

[0085] In the present embodiment, as an example, the sufficiency evaluation unit 110 reads out the sufficiency score table shown in FIG. 12 from the storage unit 114 and calculates the sufficiency using the score table. FIG. 12 is a diagram showing an example of the sufficiency score table. As shown in FIG. 12, the sufficiency score table is information that associates a combination of the impact of a security measure technology on a system and the content of a requirement with a score indicating the sufficiency (sufficiency value) of the system requirement. For a combination in which the impact of a security measure technology on a system is "high" and the content of the system requirement is "high demands" (high constraints), the sufficiency value (sufficiency) is 0.1. This assumes that the content of a certain system requirement is "high demands (high constraints)." Furthermore, assume that the impact of a certain security measure technology on a system corresponding to the system requirement is "high." In this case, the sufficiency evaluation unit 110 calculates the sufficiency value of the security measure technology for the system requirement to be 0.1 based on the sufficiency score table.

[0086] The sufficiency evaluation unit 110 calculates the sufficiency of the security measures included in the combination for each system requirement.

[0087] The sufficiency evaluation unit 110 calculates the average sufficiency of the security measure technologies included in a combination for a certain system requirement. The sufficiency evaluation unit 110 determines the calculated average as the sufficiency (value indicating the sufficiency) (sufficiency value) for the system requirements of the combination. The sufficiency evaluation unit 110 calculates the sufficiency of the system requirements of the combination for each system requirement. As an example, the sufficiency evaluation unit 110 calculates the sum of the sufficiency of the combination for each system requirement. As an example, the sufficiency evaluation unit 110 determines the calculated sum as the system requirement sufficiency of the combination. In other words, the system requirement sufficiency of the combination indicates the sufficiency of the system requirements of the target system of the combination.

[0088] The specific calculation method will be explained below.

[0089] According to the evaluation target information in FIG. 11, combination A includes three security measures: authentication of communication partners (SSL / TLS), redundancy, and DDoS countermeasures.

[0090] The impact information in Figure 8 shows that the authentication of communication partners (SSL / TLS) has a "small" impact on increasing communication latency. It also shows that the "impact on increasing computer load" of the authentication of communication partners (SSL / TLS) is "small." It also shows that the "impact on physical space" of the authentication of communication partners (SSL / TLS) is "none."

[0091] 7 shows a system requirement (System Requirement 1) whose "Requirement Item" is "Impact on Increase in Communication Latency" and whose "Requirement Content" is "Low Requirement (Low Constraint)." It also shows a system requirement (System Requirement 2) whose "Requirement Item" is "Impact on Increase in Computer Load" and whose "Requirement Content" is "High Requirement (High Constraint)." It also shows a system requirement (System Requirement 3) whose "Requirement Item" is "Impact on Physical Space" and whose "Requirement Content" is "Moderate Requirement (Moderate Constraint)."

[0092] Here, for system requirement 1, the "impact on an increase in communication delay" is "low requirement." And for authentication of the communication partner (SSL / TLS), the "impact on an increase in communication delay" is "low." Therefore, the satisfaction level evaluation unit 110 calculates the satisfaction level for system requirement 1 for authentication of the communication partner (SSL / TLS) as 1 from the satisfaction level score table. By performing the same calculation for system requirement 2, the satisfaction level for system requirement 2 for authentication of the communication partner (SSL / TLS) is calculated as 0.7. By performing the same calculation for system requirement 3, the satisfaction level for system requirement 3 for authentication of the communication partner (SSL / TLS) is calculated as 1.

[0093] The same calculations can be done for "redundancy" and "DDoS countermeasures." The sufficiency level for system requirement 1 for redundancy is 1, the sufficiency level for system requirement 2 is 1, and the sufficiency level for system requirement 3 is 0.4. The sufficiency level for system requirement 1 for DDoS countermeasures is 1, the sufficiency level for system requirement 2 is 1, and the sufficiency level for system requirement 3 is 0.7.

[0094] The sufficiency evaluation unit 110 calculates the sufficiency of system requirement 1 for combination A. As an example, the sufficiency evaluation unit 110 calculates the average sufficiency of security measures technologies included in the combination for system requirement 1. For system requirement 1, the sufficiency of authentication of communication partners (SSL / TLS) is 1, the sufficiency of "redundancy" is 1, and the sufficiency of "DDoS countermeasures" is 1.

[0095] Therefore, the average value of these values ​​is (1+1+1) / 3=1. This value is the degree of fulfillment of system requirement 1 for combination A.

[0096] Calculating in the same way, the degree of fulfillment of system requirement 2 for combination A is 0.9, and the degree of fulfillment of system requirement 3 for combination A is 0.7.

[0097] Then, the sufficiency evaluation unit 110 calculates the sufficiency of the system requirements (system requirements 123) (system requirements of the target system) of combination A. As an example, the sufficiency evaluation unit 110 calculates the sufficiency of the system requirements of combination A by calculating the sum of the sufficiency of system requirements 1 to 3 of combination A. The sufficiency of system requirement 2 of combination A is 1, the sufficiency of system requirement 2 is 0.9, and the sufficiency of system requirement 2 is 0.7.

[0098] The sum of these is 1 + 0.9 + 0.7 = 2.6. Therefore, the degree of fulfillment of the system requirements for combination A is 2.6.

[0099] The above results are shown in Figure 13(a). Similar calculations can be performed for combination B, combination F, and combination G. The calculation results for combination B, combination F, and combination G are shown in Figure 13(b), Figure 14(a), and Figure 14(b), respectively.

[0100] Therefore, the system requirement fulfillment level of combination A is "2.6", the system requirement fulfillment level of combination B is "2.8", the system requirement fulfillment level of combination F is "2.5", and the system requirement fulfillment level of combination G is "2.7". The higher the system requirement fulfillment level value of a combination, the more it fulfills the system requirements of the target system requirements.

[0101] The fulfillment level evaluation unit 110 generates fulfillment level information that associates the combination to be evaluated with the system requirement fulfillment level (step S507). Fig. 15 is a diagram showing an example of the fulfillment level information. The fulfillment level information in Fig. 15 shows, as an example, that the system requirement fulfillment level of combination A is 2.6.

[0102] The fulfillment level evaluation unit 110 outputs the fulfillment level information to the recommendation level evaluation unit 112 (step S507).

[0103] 2, the performance evaluation unit 111 evaluates the performance of each combination included in the evaluation target information based on the performance information and the evaluation target information. The performance (performance value) of a combination is, for example, the average performance of the security measure technologies included in the combination.

[0104] According to the evaluation target information in Figure 11, combination A includes three security measures: authentication of communication peers (SSL / TLS), redundancy, and DDoS countermeasures. Furthermore, according to the performance information in Figure 9, the performance score for authentication of communication peers (SSL / TLS) is "0.5." The performance score for redundancy is "0.7." Furthermore, the performance score for DDoS countermeasures is "0.95."

[0105] For example, the performance evaluation unit 111 calculates the average performance of the security measures included in the combination A, and sets the calculated value as the performance of the combination A.

[0106] Therefore, the performance score of combination A is (0.5+0.7+0.95) / 3=0.72.

[0107] The above results are shown in Figure 16(a). Similar calculations can be performed for combination B, combination F, and combination G. The calculation results for combination B, combination F, and combination G are shown in Figure 16(b), Figure 17(a), and Figure 17(b), respectively. Therefore, the performance score for combination A is "0.72," the system requirement fulfillment score for combination B is "0.73," the system requirement fulfillment score for combination F is "0.85," and the system requirement fulfillment score for combination G is "0.86." A combination with a higher performance score value indicates that it includes security measure technologies that have a proven track record of being introduced (adopted).

[0108] The performance evaluation unit 111 generates performance information that associates the combination to be evaluated with the performance level (step S509). Fig. 18 is a diagram showing an example of performance information. The performance information in Fig. 18 indicates, as an example, that the performance level of combination A is 0.72. The performance evaluation unit 111 outputs the performance information to the recommendation level evaluation unit 112 (step S509).

[0109] 2, the recommendation level evaluation unit 112 evaluates the combination of evaluation targets based on the performance information and satisfaction level information. As an example, the recommendation level evaluation unit 112 evaluates the combination of evaluation targets using the following formula 1. Recommendation level = A (optional) × (level of system requirements fulfillment) + B (optional) × (level of performance) (Equation 1)

[0110] Here, A and B are coefficients, and their values ​​are arbitrary. For example, by making the value of A larger than the value of B, the evaluation can be weighted to the degree of fulfillment of system requirements. Also, by making the value of B larger than the value of A, the evaluation can be weighted to the degree of performance.

[0111] In this embodiment, the values ​​of A and B are set to 1. According to the fulfillment level information in Fig. 15, the fulfillment level of combination A is 2.6. According to the performance level information in Fig. 18, the performance level of combination A is 0.72.

[0112] Therefore, from formula (1), the recommendation level of combination A is 2.6+0.72=3.32.

[0113] The above results are shown in Figure 19(a). Similar calculations can be performed for combination B, combination F, and combination G. The calculation results for combination B, combination F, and combination G are shown in Figure 19(b), Figure 20(a), and Figure 20(b), respectively. Therefore, the recommendation level for combination A is "3.32," the system requirement fulfillment level for combination B is "3.53," the system requirement fulfillment level for combination F is "3.35," and the system requirement fulfillment level for combination G is "3.56." The higher the recommendation level value, the more recommended the combination is.

[0114] The satisfaction level evaluation unit 110 generates recommendation level information that associates the combination to be evaluated with the recommendation level (step S511). Fig. 21 is a diagram showing an example of recommendation level information. The recommendation level information in Fig. 21 shows, as an example, that the top-ranked combination is combination A, with a recommendation level of 3.56. It also shows that the system requirement satisfaction level of combination A is 2.6. It also shows that the security measures technologies included in combination A are authentication of communication partners (SSL / TLS), redundancy, and DDoS countermeasures.

[0115] The fulfillment level evaluation unit 110 outputs the fulfillment level information to the recommendation level evaluation unit 112 (step S511).

[0116] 2, the output unit 113 outputs recommendation level information. As an example, the output unit 113 outputs the recommendation information to the display unit 115. Then, the display unit 115 displays the recommendation information. As an example, the user can recognize the recommendation level information from the display on the display unit 115.

[0117] The information processing device 10 according to the first embodiment can evaluate combinations based on the recommendation level taking into consideration the degree of fulfillment of system requirements of the target system and the performance level, and can present combinations that should be introduced to the user.

[0118] By performing an evaluation that takes system requirements into consideration, the information processing device 10 can present to the user a combination that is suited to the operational (environmental) constraints of the target system. Furthermore, by performing an evaluation that takes track record into consideration, the information processing device 10 can present to the user a combination of security measure technologies that has proven proven in security design cases. This means that the information processing device 10 can present to the user an evaluation result of a combination that reflects the knowledge of security experts and security designers. Security design cases include security design cases designed by security experts and security designers. Other security design cases are the result of security experts and security designers determining the appropriateness of the results of using an existing recommendation tool (security measure technology evaluation device) and partially modifying them to create a security design. Here, the security experts and security designers' determination of appropriateness may be based on, for example, the difficulty of introducing or implementing the security measure technologies included in the combination. Furthermore, for example, a combination of security measure technologies may be found to be incompatible with the system after implementation, such as by affecting system availability after actually implementing it. In such cases, the combination may be partially modified to be compatible with the system and then re-implemented. In this case, the combination that is compatible with the modified system can be considered a security design case. By conducting an evaluation that takes into account performance information based on the various security design examples mentioned above, it is possible to present a combination that is more suited to the system and reflects the knowledge of experts, based on security design examples.

[0119] Furthermore, the information processing device 10 according to the first embodiment evaluates combinations that satisfy security requirements. Therefore, the evaluation results presented to the user can present combinations that satisfy security requirements. In other words, more accurate evaluation of combinations is possible.

[0120] As described above, the information processing device 10 according to the first embodiment can accurately evaluate security countermeasure technologies. That is, the information processing device 10 according to the first embodiment can support the user in security design.

[0121] (Variation 1) In the first embodiment, the combination selection unit 109 filters combinations that satisfy security requirements. Then, the combinations that satisfy the security requirements are set as the combinations to be evaluated. Since the evaluation targets are combinations that satisfy the security requirements, a user viewing the final recommendation level information can select a combination that satisfies the security requirements. In other words, a more accurate evaluation of combinations can be performed, taking security requirements into consideration. Meanwhile, the combination selection unit 109, the security requirements 103, and the characteristic information acquisition unit 104 are not necessarily required. If the combination selection unit 109, the security requirements 103, and the characteristic information acquisition unit 104 are omitted, the combinations to be evaluated for recommendation level are the combinations included in the combination information generated by the combination generation unit 108. In this case, the combinations to be evaluated for satisfaction by the satisfaction level evaluation unit 110 are the combinations included in the combination information. The combinations to be evaluated for performance by the performance level evaluation unit 111 are the combinations included in the combination information. In other words, the combination information is used as evaluation target information. Even in this case, the information processing device 10 can evaluate the degree of recommendation taking into consideration the degree of fulfillment of system requirements and the degree of performance.

[0122] (Variation 2) With regard to threat information, threat countermeasure information, security requirement information, characteristic information, system requirement information, impact information, and performance information, the above-mentioned functional units (threat information acquisition unit 101, threat countermeasure information acquisition unit 102, security requirement information acquisition unit 103, characteristic information acquisition unit 104, system requirement information acquisition unit 105, impact information acquisition unit 106, and performance information acquisition unit 107, respectively) may acquire the information from the memory unit 114 or by input by the user. Also, the satisfaction level assessment unit 110 may acquire a satisfaction level score table from the memory unit 114 or by input by the user.

[0123] (Variation 3) In addition to the examples of system requirements described in the first embodiment, the following system requirements can also be used, for example: That is, other examples of system requirements include requirements (conditions) (constraints) regarding the impact on communication performance (latency), the impact on computer resources (CPU / memory / storage), the impact on operation obstruction due to overdetection (communication blocking, program execution denial), the impact on the need to install new physical and network devices, the impact on network configuration, the impact on system availability (the impact on system availability when settings are changed), the impact on the need for network connection (avoiding the need for network connection for operation), etc.

[0124] (Variation 4) The recommendation level of a combination may also be evaluated using constraints on the operators of the security measures. Examples of operators include the design department, security department, information systems department, general affairs department, and security department. For example, the evaluation may be performed so that a combination including a security measure technology that satisfies the constraints is ranked higher. For example, the recommendation level evaluation unit 112 acquires operator constraint information, which is information indicating constraints on the operators of the security measures, as input by the user. The recommendation level evaluation unit 112 may evaluate the security measures included in the combination to be evaluated so that the more the security measure technology satisfies the operator constraints, the higher the recommendation level of the security measure technology. This enables more accurate evaluation of the recommendation level.

[0125] (Variation 5) Combinations may also be evaluated using constraints on the costs of security measures. Examples of costs include implementation costs and operational costs. For example, the recommendation level evaluation unit 112 acquires cost constraint information, which is information indicating constraints on the costs of security measures, through user input. The recommendation level evaluation unit 112 may evaluate security measures included in the combination to be evaluated so that the more the security measures satisfy the operator constraints, the higher the recommendation level. This enables more accurate evaluation of the recommendation level.

[0126] (Variation 6) The performance information is information based on past design cases, and indicates the implementation record (adoption record) of security countermeasure technologies. Any information may be used as performance information as long as it indicates the implementation record (adoption record) of security countermeasure technologies. Various methods can be considered for generating performance information from data of past design cases. For example, a method using machine learning can be considered as a method for generating performance information from data of past design cases. Performance information can also be generated from data of past design cases by using various other known algorithms. The method for generating performance information is arbitrary. However, performance information generated by any method can be applied to the information processing device 10 of this embodiment.

[0127] (Variation 7) When there is one anticipated threat to the target system, the combination of security measures will contain only one security measure technology. Even in this case, the combination can be evaluated in the same manner as in the first embodiment, regarding it as a combination including only one security measure technology (the combination includes one security measure technology). In other words, the combination to be evaluated in the first embodiment is a combination including one or more security measure technologies. In other words, the evaluation method in the first embodiment can be applied not only to combinations including multiple security measure technologies, but also to the evaluation of security measure technologies.

[0128] (Variation 8) In the first embodiment, an example has been described in which one security measure technology can deal with one threat. However, there are cases in which multiple security measure technologies are introduced to deal with one threat. In this case, there are combinations in which the number of security measure technologies included in the combination is greater than the number of anticipated threats. There are also cases in which one security measure technology can deal with multiple threats. In this case, there are combinations in which the number of security measure technologies included in the combination is less than the number of anticipated threats. The evaluation method of the first embodiment can be applied to these combinations as well.

[0129] (Hardware configuration) 22 is a block diagram showing an example of the hardware configuration of an information processing device 10 according to the first embodiment. The information processing device 10 is, for example, a computer. The hardware configuration of the information processing device 10 includes a processor 11, an output unit 12, an input unit 13, a main memory unit 14, an auxiliary memory unit 15, a communication unit 16, and a display unit 17. The processor 11, the output unit 11312, the input unit 13, the main memory unit 14, the auxiliary memory unit 15, the communication unit 16, and the display unit 17 are connected to one another via a bus.

[0130] The information processing device 10 operates by the processor 11 executing a program read from the auxiliary storage unit 15 to the main storage unit 14. The above-mentioned threat information acquisition unit 101, threat countermeasure information acquisition unit 102, security requirement information acquisition unit 103, characteristic information acquisition unit 104, system requirement information acquisition unit 105, impact information acquisition unit 106, performance information acquisition unit 107, combination generation unit 108, combination selection unit 109, satisfaction level evaluation unit 110, performance level evaluation unit 111, recommendation level evaluation unit 112, and output unit 113 are realized by the processor 11 executing the program.

[0131] The processor 11 executes a program read from the auxiliary storage unit 15 to the main storage unit 14. The processor 11 is, for example, a CPU (Central Processing Unit).

[0132] The main storage unit 14 is, for example, a memory such as a ROM (Read Only Memory) and a RAM (Random Access Memory).

[0133] The auxiliary storage unit 11415 is, for example, a hard disk drive (HDD), a solid state drive (SSD), or a memory card.

[0134] The output unit 12 is an interface for outputting information indicating the results of processing by the information processing device 10. The output unit 12 is a port to which a display device such as an external display (not shown) is connected, and is, for example, a USB (Universal Serial Bus) terminal or an HDMI (registered trademark) (High Definition Multimedia interface) terminal.

[0135] The display unit 17 displays display information such as information indicating the processing results of the information processing device 10. The display unit 17 is, for example, a liquid crystal display.

[0136] The input unit 13 is an interface for operating the information processing device 10. A user uses the input unit 13 to input various pieces of information to the information processing device 10. The input unit 13 is, for example, a keyboard or a mouse. If the computer is a smart device such as a smartphone or a tablet terminal, the display unit 17 and the input unit 13 are, for example, a touch panel. The communication unit 16 is an interface for communicating with an external device. The communication unit 16 is, for example, a network interface card (NIC).

[0137] Programs that are executed by a computer are provided as computer program products, recorded in the form of installable or executable files on computer-readable storage media such as CD-ROMs, memory cards, CD-Rs, and DVDs (Digital Versatile Discs).

[0138] The program to be executed by the computer may also be stored on a computer connected to a network such as the Internet, and may be provided by being downloaded via the network.

[0139] The program to be executed by the computer may be provided via a network such as the Internet without being downloaded, or may be provided by being pre-installed in a ROM.

[0140] The program executed by the computer has a modular configuration that includes functional configurations (functional blocks) of the information processing device 10 that can also be realized by the program. As actual hardware, the processor 11 reads the program from a storage medium and executes it, and the functional blocks are loaded onto the main memory unit 14. In other words, the functional blocks are generated on the main memory unit 14.

[0141] Note that some or all of the above-described functional blocks may be realized by hardware such as an integrated circuit (IC) rather than by software. Furthermore, when multiple processors are used to realize the functions, each processor may realize one of the functions, or two or more of the functions.

[0142] The computer that realizes the information processing device 10 may operate in any manner. For example, the information processing device 10 may be realized by a single computer. The information processing device 10 may also be operated as a cloud system on a network.

[0143] Although several embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These novel embodiments can be embodied in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included within the scope and spirit of the invention, and are also included in the scope of the invention and its equivalents as defined in the claims. [Explanation of symbols]

[0144] 10. Information processing device according to the first embodiment 10. Information processing device according to the first embodiment 11. Processor 12. Output section 113 13 Input section 14...Main memory section 14 15... Auxiliary storage section 15 16. Communications Department 17 Display section 101 Threat Information Acquisition Department 102 Threat countermeasure information acquisition unit 102 103 Security requirement information acquisition unit 104 Characteristics information acquisition unit 105 System requirements information acquisition unit 106...Impact Information Acquisition Department 107 Performance Information Acquisition Unit 108 Combination generation unit 109 Combination selection section 110. Satisfaction Assessment Department 111···Performance Evaluation Department 112···Recommendation evaluation section 113 Output section 114···Memory Department 115··· Representation Section

Claims

1. a sufficiency evaluation unit that evaluates the sufficiency of the system requirements for the combination based on evaluation target information indicating a combination of security measure technologies to be evaluated, system requirement information indicating system requirements that are operational requirements for the target system, and impact information indicating the impact of each security measure technology included in the combination on the target system, and generates sufficiency information indicating the sufficiency of the system requirements for the combination; a performance evaluation unit that evaluates a performance level of the combination based on performance information that indicates a performance level of the security measure technologies included in the combination in systems having the same system requirements as the target system, the performance information being calculated based on security design cases, and generates performance level information that indicates the performance level of the combination; a recommendation level evaluation unit that evaluates a recommendation level of the combination based on the performance level information and the satisfaction level information, the recommendation level evaluation unit evaluates the recommendation level such that the recommendation level increases as the combination includes the security measure technology that satisfies a constraint on an operator of the security measure technology. Information processing device.

2. the sufficiency evaluation unit evaluates the sufficiency of the system requirements of each security measure included in the combination based on the system requirement information and the impact information, and evaluates the sufficiency of the system requirements of the combination based on the evaluated sufficiency. The information processing device according to claim 1 .

3. the performance evaluation unit evaluates a performance level of each security measure included in the combination based on the performance information, and evaluates the performance level of the combination based on the evaluated performance levels. The information processing device according to claim 1 .

4. The combination is capable of addressing threats assumed to the target system. The information processing device according to claim 1 .

5. The system requirements are requirements regarding at least one of the following: impact on an increase in communication delay, impact on an increase in computer load, impact on physical space, impact on communication performance, impact on computer resources, impact on operation obstruction due to overdetection, impact on the need to install new equipment, impact on network configuration, impact on system availability, and impact on the need for network connection. The information processing device according to claim 1 .

6. selecting, from the plurality of combinations, a combination whose security characteristics of the security measure technologies included in the combination satisfy the security requirements based on combination information indicating the plurality of combinations, characteristic information indicating the security characteristics of each of the security measure technologies included in the plurality of combinations, and security requirement information indicating the security requirements that are requirements for the security characteristics, and generating the evaluation target information by setting the selected combination as the combination to be evaluated; a combination selection unit; The information processing device according to claim 1 , further comprising:

7. generating the combination information based on threat information indicating threats anticipated to the target system and threat countermeasure information associating the information indicating the threats anticipated to the target system with security countermeasure technologies capable of dealing with the threats; a combination generation unit; The information processing device according to claim 6 , further comprising:

8. the recommendation level evaluation unit acquires the constraints on the operating entity input by a user, and evaluates the recommendation level so that the recommendation level increases as the combination includes the security measure technologies that satisfy the acquired constraints. The information processing device according to claim 1 .

9. The operating entity includes at least a part of the design department, security department, information systems department, general affairs department, and security department, The information processing device according to claim 1 .

10. An information processing method executed in an information processing device, a sufficiency evaluation step of evaluating the sufficiency of the system requirements for the combination based on evaluation target information indicating a combination of security measure technologies to be evaluated, system requirement information indicating system requirements that are operational requirements for the target system, and impact information indicating the impact of each security measure technology included in the combination on the target system, and generating sufficiency information indicating the sufficiency of the system requirements for the combination; a performance evaluation step of evaluating a performance of the combination based on performance information indicating the performance of introducing security measure technologies included in the combination into systems having the same system requirements as the target system, the performance information being calculated based on security design cases, and generating performance information indicating the performance of the combination; a recommendation level evaluation step of evaluating a recommendation level of the combination based on the performance level information and the satisfaction level information, the recommendation level evaluation step evaluates the recommendation level so that the recommendation level increases as the combination includes the security measure technology that satisfies the constraint on the operator of the security measure technology. Information processing methods.

11. Computer, a sufficiency means for evaluating the sufficiency of the system requirements of the combination based on evaluation target information indicating a combination of security measure technologies to be evaluated, system requirement information indicating system requirements that are operational requirements of the target system, and impact information indicating the impact of each security measure technology included in the combination on the target system, and for generating sufficiency information indicating the sufficiency of the system requirements of the combination; a performance evaluation means for evaluating a performance of the combination based on performance information indicating the performance of the security measure technologies included in the combination in systems having the same system requirements as the target system, the performance information being calculated based on security design cases, and generating performance information indicating the performance of the combination; functioning as a recommendation level evaluation means for evaluating the recommendation level of the combination based on the performance level information and the satisfaction level information; the recommendation level evaluation means evaluates the recommendation level so that the recommendation level increases as the combination includes the security measure technology that satisfies the constraint on the operator of the security measure technology. program.

Images