Security audit device, security audit method and program

Abstract

A security auditing device, a security auditing method, and a program are provided that facilitate security audits. [Solution] The security audit device 2000 acquires answer information 10 indicating the answer given by the target entity to a question regarding the implementation of security measures, and generates audit result information 40 representing the results of the audit regarding the implementation of security measures by the target entity by inputting the answer information and a prompt instructing the audit to be conducted based on the answer information 10 into the audit model 100.

Description

[Technical Field]

[0001] The present disclosure relates to a security auditing device, a security auditing method, and a program. [Background technology]

[0002] Systems have been developed that facilitate evaluation of security measures implemented by companies, etc. (i.e., security audits). For example, Patent Document 1 discloses a system that aggregates information on audit results prepared by auditors using standard item information related to standards. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Japanese Patent Application Publication No. 2018-088039 Summary of the Invention [Problem to be solved by the invention]

[0004] In Patent Document 1, security audits are performed manually. The present disclosure has been made in consideration of this problem, and one of its objectives is to provide a technology that makes security audits easier. [Means for solving the problem]

[0005] The security audit device of the present disclosure includes an acquisition means for acquiring answer information indicating an answer by a target entity to a question regarding the implementation of security measures, and a generation means for generating audit result information representing the results of an audit of the implementation of security measures by the target entity by inputting a prompt instructing the target entity to conduct an audit regarding the implementation of security measures based on the answer information and the answer information into a language model.

[0006] The security audit method according to the present disclosure includes an acquisition step of acquiring answer information indicating an answer by a target entity to a question regarding the implementation of security measures, and a generation step of generating audit result information indicating the results of an audit of the implementation of security measures by the target entity by inputting the answer information and a prompt instructing the target entity to conduct an audit regarding the implementation of security measures based on the answer information into a language model.

[0007] The program according to the present disclosure causes a computer to execute an acquisition step of acquiring answer information indicating an answer by a target entity to a question regarding the implementation of security measures, and a generation step of generating audit result information indicating the results of an audit of the implementation of security measures by the target entity by inputting the answer information and a prompt instructing the target entity to conduct an audit based on the answer information into a language model. [Effects of the Invention]

[0008] According to the present disclosure, a technique is provided that facilitates security audits. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 is a diagram illustrating an example of an outline of the operation of a security auditing device. [Figure 2] FIG. 2 is a block diagram illustrating a functional configuration of a security auditing device. [Figure 3] FIG. 2 is a block diagram illustrating an example of a hardware configuration of a computer that realizes a security auditing device. [Figure 4] 10 is a flowchart illustrating a flow of processing executed by the security auditing device. [Figure 5] FIG. 10 is a diagram illustrating an example of the configuration of response information. [Figure 6] FIG. 10 is a diagram illustrating an example of template information. [Figure 7] FIG. 2 is a second diagram illustrating an example of template information. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, embodiments of the present disclosure will be described in detail with reference to the drawings. In each drawing, the same or corresponding elements are designated by the same reference numerals, and duplicate explanations will be omitted as necessary for clarity. Furthermore, unless otherwise specified, predetermined values ​​such as predetermined values ​​and threshold values ​​are stored in advance in a storage device accessible from a device that uses the values. Furthermore, unless otherwise specified, the storage unit is composed of one or any number of storage devices.

[0011] <Summary> Fig. 1 is a diagram illustrating an example of an outline of the operation of the security auditing device 2000. Note that Fig. 1 is a diagram for facilitating understanding of the outline of the security auditing device 2000, and the operation of the security auditing device 2000 is not limited to the operation shown in Fig. 1.

[0012] The security auditing device 2000 performs a security audit on an entity that is the target of the security audit (hereinafter referred to as the target entity). The term "security" here refers to various types of security, such as information security and cybersecurity. The security audit is performed based on answers obtained from the target entity to questions regarding the implementation of security measures.

[0013] A target entity is any entity that implements security measures. For example, a target entity may be a company, a department, a team, or a single employee. Alternatively, a target entity may be a group consisting of multiple companies, multiple departments, or multiple teams.

[0014] Security measures refer to measures implemented to protect the safety of information and systems. Security measures can be classified into several categories. Categories of security measures include, for example, security governance, information management, defense against security threats, detection, response, and recovery of security threats, and development of security personnel. Response here refers to responding to detected threats. Recovery here refers to recovery that takes place after the threat has been addressed.

[0015] A security audit is an activity that evaluates whether security measures are being implemented correctly. For example, a security audit may include identifying insufficiently implemented security measures and proposing recommended improvements.

[0016] The questions about security measures are questions asking about the implementation status of security measures. The answers to the questions about security measures indicate the implementation status of security measures by the target entity.

[0017] The implementation status of security measures is expressed, for example, by whether or not security measures are implemented, the degree of implementation of the implemented security measures, the specific implementation content of the security measures, etc. The degree of implementation of security measures is expressed, for example, by a rank such as "1: fully implemented," "2: implemented to some extent," "3: not implemented very much," or "4: not implemented at all."

[0018] The security audit device 2000 performs a security audit using an audit model 100. The audit model 100 is a language model configured using any machine learning model such as a neural network. The audit model 100 is pre-trained so that, in response to a prompt representing an instruction being input, the audit model 100 performs processing based on the instruction and outputs output data representing the results of the processing.

[0019] The security auditing device 2000 operates, for example, as follows: The security auditing device 2000 acquires answer information 10. The answer information 10 indicates answers given by the target entity to one or more questions about security measures.

[0020] The security auditing device 2000 uses the audit model 100 to generate audit result information 40 that indicates the results of a security audit on a target entity. For example, the security auditing device 2000 inputs answer information 10 and a prompt 20 that indicates instructions to conduct a security audit into the audit model 100. In response to the input of the answer information 10 and the prompt 20, the audit model 100 performs a security audit on the target entity based on the contents of the answer information 10. Then, the audit model 100 outputs audit result information 40 that indicates the results of the security audit (in other words, the results of the evaluation of the security measures taken by the target entity). In this way, the security auditing device 2000 generates the audit result information 40.

[0021] Here, the audit model 100 may operate inside the security audit device 2000, or may operate outside the security audit device 2000. In the latter case, the audit model 100 operates inside a device other than the security audit device 2000 (hereinafter referred to as a model execution device). Note that the expression "the security audit device 2000 generates the audit result information 40" not only means "the security audit device 2000 generates the audit result information 40 inside itself," but also includes "the security audit device 2000 causes the audit model 100 operating inside the model execution device to generate the audit result information 40 and acquires the generated audit result information 40."

[0022] <Examples of effects> The security audit device 2000 executes a security audit using a language model by using answers to questions about the implementation of security measures and prompts that cause the language model to execute the security audit. This reduces the effort and time required for a security audit compared to when the security audit must be performed manually.

[0023] Furthermore, when security audits are performed manually, it is difficult to completely eliminate the auditor's subjective opinion, which can lead to variations in audit results depending on the auditor. In contrast, the security audit device 2000 performs security audits using the audit model 100, thereby preventing variations in audit results.

[0024] The security audit device 2000 of this embodiment will be described in more detail below.

[0025] <Example of functional configuration> 2 is a block diagram illustrating an example of the functional configuration of the security auditing device 2000. For example, the security auditing device 2000 includes an acquiring unit 2020 and a generating unit 2040. The acquiring unit 2020 acquires answer information 10. The generating unit 2040 inputs the answer information 10 and the prompt 20 into the audit model 100 to generate audit result information 40.

[0026] <Example of hardware configuration> Each functional component of the security auditing device 2000 may be realized by hardware that realizes the functional component (e.g., a hardwired electronic circuit, etc.), or by a combination of hardware and software (e.g., a combination of an electronic circuit and a program that controls it). Below, a case where each functional component of the security auditing device 2000 is realized by a combination of hardware and software will be further described.

[0027] 3 is a block diagram illustrating an example of the hardware configuration of a computer 1000 that realizes the security audit device 2000. The computer 1000 is any computer. For example, the computer 1000 is a stationary computer such as a PC (Personal Computer) or a server machine. Alternatively, the computer 1000 may be a portable computer such as a smartphone or a tablet terminal. The computer 1000 may be a dedicated computer designed to realize the security audit device 2000, or may be a general-purpose computer.

[0028] For example, by installing a predetermined application on the computer 1000, each function of the security audit device 2000 is realized on the computer 1000. The application is configured as a program for realizing each functional component of the security audit device 2000. The method for acquiring the program is arbitrary. For example, the program can be acquired from a storage medium (such as a DVD (Digital Versatile Disc) or a USB (Universal Serial Bus) memory) on which the program is stored. Alternatively, the program can be acquired by downloading the program from a server device that manages the storage device on which the program is stored.

[0029] The computer 1000 has a bus 1020, a processor 1040, a memory 1060, a storage device 1080, an input / output interface 1100, and a network interface 1120. The bus 1020 is a data transmission path for the processor 1040, the memory 1060, the storage device 1080, the input / output interface 1100, and the network interface 1120 to transmit and receive data to and from each other. However, the method for connecting the processor 1040 and the like to each other is not limited to a bus connection.

[0030] The processor 1040 is a variety of processors, such as a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), or a field-programmable gate array (FPGA). The memory 1060 is a main storage device realized using a random access memory (RAM) or the like. The storage device 1080 is an auxiliary storage device realized using a hard disk, a solid state drive (SSD), a memory card, a read only memory (ROM), or the like.

[0031] The input / output interface 1100 is an interface for connecting the computer 1000 to an input / output device. For example, the input / output interface 1100 is connected to an input device such as a keyboard and an output device such as a display device.

[0032] The network interface 1120 is an interface for connecting the computer 1000 to a network. This network may be a LAN (Local Area Network) or a WAN (Wide Area Network).

[0033] The storage device 1080 stores programs (programs that realize the above-mentioned applications) that realize each functional component of the security audit device 2000. The processor 1040 reads these programs into the memory 1060 and executes them to realize each functional component of the security audit device 2000. In addition, when the audit model 100 is realized inside the security audit device 2000, the storage device 1080 also stores a program that realizes the audit model 100.

[0034] The security auditing device 2000 may be realized by one computer 1000 or by multiple computers 1000. In the latter case, the configurations of the computers 1000 do not need to be the same, and can be different from each other.

[0035] <Processing flow> 4 is a flowchart illustrating the flow of processing executed by the security auditing device 2000. The acquiring unit 2020 acquires answer information 10 (S102). The generating unit 2040 inputs the answer information 10 and the prompt 20 into the audit model 100 to generate audit result information 40 (S104).

[0036] <Acquisition of answer information 10: S102> The acquiring unit 2020 acquires the answer information 10 (S102). There are various methods for the acquiring unit 2020 to acquire the answer information 10. For example, the answer information 10 is stored in advance in an arbitrary storage unit in a manner accessible from the security auditing device 2000. In this case, the acquiring unit 2020 acquires the answer information 10 by reading the answer information 10 from the storage unit. The answer information 10 to be read from the storage unit is designated, for example, by the user of the security auditing device 2000.

[0037] Alternatively, for example, the response information 10 may be transmitted from another device to the security auditing device 2000. In this case, the acquiring unit 2020 acquires the response information 10 by receiving the response information 10 transmitted from the other device.

[0038] For example, assume that the security auditing device 2000 is available via a web system. In this case, for example, a user of the security auditing device 2000 accesses the web system from a user terminal (such as a PC or a smartphone) and provides answer information 10 to the security auditing device 2000 via the web system.

[0039] <About the contents of Answer Information 10> The answer information 10 indicates answers to one or more questions regarding the implementation status of security measures. For example, the answer information 10 indicates, for each of one or more questions regarding the implementation status of security measures, a text representing the question and a text representing the answer to the question in association with each other.

[0040] FIG. 5 is a diagram illustrating an example of the configuration of answer information 10. Answer information 10 shows a record in which a question 12 and an answer 14 are associated with each other for a plurality of questions. Question 12 shows text representing the question. For example, a question regarding security measure S1 is a question such as "Is S1 being implemented?" As a more specific example, question 12 in the first record in FIG. 5 shows a question regarding the implementation status of security measures, "Establish an information security policy and manage it appropriately."

[0041] The answer 14 indicates an answer to the corresponding question. The answer 14 may consist of multiple answers. For example, in the example of FIG. 5, the answer 14 consists of a first answer 16 and a second answer 18.

[0042] The first answer 16 indicates the level of security measures implemented by a rank. In this example, the ranks are expressed as 1 to 4. Ranks 1 to 4 represent "1: fully implemented," "2: implemented to some extent," "3: not implemented very much," and "4: not implemented at all," respectively.

[0043] The second answer 18 describes in writing the specific implementation of security measures. If no security measures are implemented, the second answer 18 may be left blank.

[0044] The method of constructing the answer 14 is not limited to the above-described method. For example, the answer 14 may indicate only either the degree of security measures or the specific details of the security measures being implemented. Alternatively, the answer 14 may indicate whether or not security measures are being implemented, instead of the degree of security measures being implemented.

[0045] As described above, questions regarding the implementation status of security measures can be classified into multiple categories. Therefore, the answers shown in the answer information 10 may be classified into multiple categories. For example, the answer information 10 includes a table for each category. Alternatively, for example, the answer information 10 may further include a column indicating a category identifier. That is, the answer information 10 may indicate, for each question, the question category, the question content, and the answer content in association with each other.

[0046] The answer information 10 does not need to indicate the question 12. For example, question information listing questions may be used separately from the answer information 10. In this case, the answer information 10 and the question information are configured so that it is clear to which question in the question information each answer indicated in the answer information 10 corresponds. For example, the answer information 10 and the question information are configured so that the order of questions indicated in the question information matches the order in which answers to those questions are indicated in the answer information 10. That is, the answer to the question indicated in the i-th position in the question information is indicated in the i-th position in the answer information 10. Note that, when questions are classified into multiple categories, it is preferable that the question information further indicates the category of each question.

[0047] The question information may be input to the audit model 100 together with the answer information 10, or may be provided to the audit model 100 in advance as prior knowledge.

[0048] <About creating questions> The questions to be asked to the target entities may be created manually or automatically using a computer. In the latter case, the questions are created automatically using a language model. The language model used to create the questions may be the audit model 100 or a language model other than the audit model 100.

[0049] For example, questions can be created based on security measure standards. When using standards, a prompt such as "Please create 30 questions regarding the implementation status of security measures using the input standards" is input to the language model. This allows a predetermined number of questions regarding the implementation status of security measures to be created based on the standards. The security measure standards can be international standards, domestic standards, or standards established by any organization, etc.

[0050] It is preferable that at least one question be created for each of the multiple categories specified in the standard. Therefore, it is preferable that the prompt for creating questions includes an instruction such as, "Please ensure that at least one question is created for each category specified in the standard."

[0051] <About Audit Model 100> The audit model 100 is a language model that performs the following operation: "in response to input of a sentence (prompt) representing an instruction, executes processing according to the instruction, and outputs output data representing the execution result of the processing." In addition to the prompt, the audit model 100 may also receive additional information (hereinafter, additional information) that is used in processing according to the instruction indicated in the prompt.

[0052] When used by the security audit device 2000, the prompt input to the audit model 100 is a prompt 20. In addition, answer information 10 is input to the audit model 100 as additional information. Then, output data output from the audit model 100 is audit result information 40. Note that standard information and feature information, which will be described later, can also be input to the audit model 100 as additional information.

[0053] The audit model 100 is configured using various machine learning models such as neural networks, etc. For example, the audit model 100 is a language model classified as a large language model (LLM).

[0054] The audit model 100 may be a general-purpose language model or a language model trained for security audits. In the latter case, the audit model 100 is generated by training the general-purpose language model using multiple combinations of input data for performing a security audit and ground truth data corresponding to the input data. The input data for performing a security audit includes a combination of a prompt 20 and answer information 10. The input data may also include reference information and feature information, which will be described later. The ground truth data is ideal output data.

[0055] <Generation of audit result information 40: S104> The generating unit 2040 generates the audit result information 40 by inputting the response information 10 into the audit model 100 (S104). The security audit using the audit model 100 will be described in detail below.

[0056] <<About prompt 20>> The generation unit 2040 inputs a prompt 20 to the audit model 100 in order to have the audit model 100 perform a security audit. As described above, the prompt 20 is text that represents an instruction to have the audit model 100 perform a security audit. An example of an instruction to perform a security audit is, "Please perform a security audit using the input file."

[0057] The text included in the prompt 20 is not limited to instructions for performing a security audit. For example, the prompt 20 includes an explanation of the answer information 10. The explanation of the answer information 10 includes an explanation of the configuration of the answer information 10, such as an explanation of the meaning of the data shown in each column of the answer information 10. For example, the explanation of the configuration of the answer information 10 is as follows:

[0058] · Column 1 shows questions regarding security measures. · Column 2 shows the level of implementation of the security measures asked about. The level of satisfaction is expressed on a scale of 1 to 4. The rankings from 1 to 4 represent "1: Fully implemented," "2: Somewhat implemented," "3: Not very implemented," and "4: Not implemented at all," respectively. Column 3 indicates the specific implementation of the security measures asked about.

[0059] In addition, for example, the prompt 20 may include an explanation about a file to be input into the audit model 100. For example, suppose a file called abc.csv containing answer information 10 is used. In this case, the prompt 20 may include an explanation such as, "abc.csv is a file that contains answers to questions about security measures."

[0060] In addition, for example, the prompt 20 indicates a role assignment for the audit model 100. Specifically, by including text such as "You are an auditor who performs security audits" in the prompt 20, the audit model 100 can be given the virtual role of an auditor who performs security audits.

[0061] Note that some of the information that can be included in the prompt 20 described above is common to security audits using the audit model 100 (in other words, it is not dependent on individual security audits). For example, an explanation of the configuration of the answer information 10 and the role assigned to the audit model 100 are not dependent on individual security audits. In this way, information that is not dependent on individual security audits may not be included in the prompt 20, but may be given to the audit model 100 in advance as prior knowledge.

[0062] <<Use of Reference Information>> For example, the generation unit 2040 causes the audit model 100 to perform a security audit by comparing the answer information 10 with information representing standards for implementing security measures (hereinafter referred to as standard information). In this case, the acquisition unit 2020 may further acquire the standard information in addition to the answer information 10. The method for acquiring the standard information is the same as the method for acquiring the answer information 10.

[0063] As the reference information, for example, information indicating the standard specifications of security measures can be used. As mentioned above, the standard specifications of security measures can be international standards, national standards, or standards established by any organization, etc. By conducting a security audit using a predetermined standard such as an international standard or a national standard, it is possible to easily grasp problems, etc., with respect to the security measures implemented by the target entity from the perspective of the predetermined standard.

[0064] As another example, the reference information may be information that provides model answers to each question. For example, answer information created by a representative entity may be used as the information that provides model answers. The representative entity may be, for example, the parent company of the target entity or a security expert. By conducting a security audit based on model answers in this way, it is possible to easily identify any discrepancies between the security measures implemented by the target entity and the model security measures.

[0065] For example, in a corporate group, subsidiaries may be required to implement security measures that emulate those implemented by the parent company. In such a situation, it is preferable to use model answers prepared by the parent company as baseline information to conduct an audit of the security measures implemented by the subsidiary. Such a security audit makes it easy to determine how closely the security measures implemented by the subsidiary match those implemented by the parent company.

[0066] The security audit device 2000 inputs, for example, answer information 10 and reference information to the audit model 100. In this case, it is preferable that the prompt 20 includes an explanation of the reference information and answer information 10. For example, suppose a file called abc.csv is input as answer information 10 and a file called def.csv is input as reference information. In this case, for example, the following prompt 20 can be used:

[0067] abc.csv shows the answers to questions about security measures. ·def.csv shows the criteria for implementing security measures. ·Compare your answers to the standards and conduct a security audit.

[0068] The reference information may be given in advance as prior knowledge to the inspection model 100. In this case, the generating unit 2040 does not need to input the reference information when inputting the response information 10 to the inspection model 100.

[0069] <<About Audit Result Information 40>> The audit result information 40 indicates the results of a security audit on a target entity. The results of the security audit indicated in the audit result information 40 vary. For example, the audit result information 40 indicates an overall evaluation of the security measures implemented by the target entity. In addition, for example, the audit result information 40 indicates the weak points and strong points of the target entity from the perspective of security measures. In addition, for example, the audit result information 40 indicates recommended measures (improvement measures for security measures) for the target entity.

[0070] Various overall evaluations of the target entity are possible. For example, the audit result information 40 may indicate a summary of the differences between the response information 10 and the reference information as an overall evaluation. Alternatively, the audit result information 40 may indicate the degree to which security measures are implemented by the target entity as an overall evaluation. The degree to which security measures are implemented may be expressed, for example, as a ratio of the number of implemented security measures to the number of required security measures. Alternatively, the degree to which security measures are implemented may be expressed as a rank such as "almost implemented," "somewhat implemented," "not very implemented," or "almost not implemented."

[0071] There are various possible weak points of a target entity. For example, the audit result information 40 indicates, as a weak point, a security measure that is not implemented by the target entity. In addition, for example, the audit result information 40 indicates, as a weak point, a security measure that is not fully implemented among the security measures implemented by the target entity. In addition, for example, the audit result information 40 indicates, as a weak point, a difference between the specific content of the security measure implemented by the target entity and the content indicated in the standard information.

[0072] There are various possible strong points of a target entity. For example, the audit result information 40 indicates, as a strong point, the security measures implemented by the target entity. In another example, the audit result information 40 indicates, as a strong point, the security measures implemented by the target entity that are highly effective. In another example, the audit result information 40 indicates, as a strong point, the points where the specific content of the security measures implemented by the target entity matches the content indicated in the standard information.

[0073] The audit result information 40 may indicate the category of security measures for weak points and strong points. That is, the audit result information 40 may indicate which of multiple categories of security measures is a weak point of the target entity (which category of security measures is insufficient) or which category is a strong point of the target entity (which category of security measures is sufficient).

[0074] There are various possible improvement measures for security measures. For example, the audit result information 40 indicates an improvement measure to implement security measures that have not been implemented by the target entity. Another example is that the audit result information 40 indicates an improvement measure to increase the level of security measures that are implemented by the target entity but are not fully implemented. Another example is that the audit result information 40 indicates, as an improvement measure, the content of security measures implemented by the target entity that differ from the content specified in the standard information.

[0075] In addition, the specific information that should be identified as the overall evaluation, weak points, strong points, and improvement measures of the target entity may be given to the audit model 100 in advance as prior knowledge.

[0076] It is also preferable to specify the type of information to be included in the audit result information 40 for the audit model 100. The type of information to be included in the audit result information 40 can be specified, for example, by a prompt 20. For example, a prompt 20 including a specification such as "Please include an overall evaluation, weak points, and recommended measures in the audit results to be output" is used.

[0077] The type of information to be included in the audit result information 40 may be specified using information representing a template of the audit result information 40 (hereinafter referred to as template information). FIG. 6 is a diagram illustrating an example of template information. The template information 50 includes multiple pairs of item name 52 and content 54. The item name 52 indicates the name of the item. The content 54 indicates a character string to be replaced with the actual content of the item.

[0078] For example, item name 52-1 indicates the name of the item "1. Overall evaluation." Content 54-1 corresponding to item name 52-1 indicates "@overall_evaluation" as a mark to be replaced with text representing the overall evaluation. The audit model 100 generates text representing the overall evaluation and replaces @overall_evaluation with the generated text.

[0079] The audit model 100 can determine what information should be generated by a security audit by referring to the template information 50. For example, by referring to the template information 50 in FIG. 6, the audit model 100 can determine that 1) an overall evaluation of the security measures of the target entity is necessary, 2) weak points of the target entity are necessary, and 3) after identifying all recommended measures, particularly important measures are necessary to be extracted. Furthermore, by referring to the template information 50, the audit model 100 can generate audit result information 40 in a predetermined format. As described above, by using the template information 50, it is possible to provide the user who uses the audit results with the information they need in a format that is easy for the user to use.

[0080] The structure of the audit result information 40 may be given to the audit model 100 in advance as prior knowledge.

[0081] <<Use of feature information>> In addition to the answer information 10, a security audit using the audit model 100 may further utilize information representing the characteristics of the target entity (hereinafter referred to as characteristic information). The characteristic information may indicate, for example, an answer by the target entity to a question about the characteristics of the target entity. The characteristic information may also be expressed as profile information.

[0082] When the characteristic information is used, the acquiring unit 2020 acquires the characteristic information in addition to the answer information 10. The method for acquiring the characteristic information is the same as the method for acquiring the answer information 10.

[0083] The answer information 10 and the feature information may be compiled into a single file (hereinafter referred to as an answer file) that represents the answers to the questions. In this case, the answer file that indicates both the answers to the questions about the implementation status of security measures and the answers to the questions about the features of the target entity is input to the audit model 100.

[0084] When feature information is used, the generation unit 2040 inputs the answer information 10, the feature information, and the prompt 20 into the audit model 100. In this case, it is preferable that the prompt 20 include text instructing the user to conduct a security audit based on the answer information 10 and the feature information. For example, the prompt 20 includes the text "Please conduct a security audit using the answer information and feature information."

[0085] As described above, the question corresponding to the answer may be included in the answer information 10, or may be indicated in question information separate from the answer information 10. Similarly, the question about the characteristics of the target entity may be included in the characteristic information, or may be indicated in information separate from the characteristic information (hereinafter referred to as second question information). The question information and the second question information may be combined into one file representing the question (hereinafter referred to as question file). In this case, a question file indicating both questions about the implementation status of security measures and questions about the characteristics of the target entity is input to the audit model 100.

[0086] The characteristics of the target entity can include various characteristics, such as the name of the target entity, the size of the target entity (hereinafter referred to as entity size), the type of business related to the target entity (hereinafter referred to as industry), the status of various certifications acquired by the target entity (hereinafter referred to as certification status), or the type of information handled by the target entity (hereinafter referred to as information type).

[0087] The size of an entity can be expressed, for example, by the number of members, the number of group companies, the number of members in a group company, the number of outsourced companies, the number of outsourced workers, sales, or profits. The number of members represents the number of people who belong to the target entity (such as the number of employees in a company, the number of members in a department, or the number of members in a project team). The number of group companies represents the number of companies (hereinafter referred to as group companies) that belong to a corporate group that includes the target entity. The number of members in a group company represents the total number of members in each group company. The number of outsourced companies represents the number of external companies to which the target entity outsources work. The number of outsourced workers represents the total number of people engaged in the outsourced work at external companies to which work has been outsourced. Sales and profits represent the sales and profits of the target entity, respectively. For example, sales and profits are represented as figures for the most recent year.

[0088] The industry type is expressed, for example, by the type of business conducted by the target entity itself or the type of business conducted by a company that does business with the target entity. For example, the characteristic information indicates one or more of a predetermined number of types of industry as the industry type. The predetermined types of business may include defense business, space business, infrastructure business, automobile business, or home appliance business.

[0089] It should be noted that the type of business is not limited to the type of business that the target entity is already involved in. The type of business may also include the type of business that the target entity will be involved in in the future or the type of business that the target entity is expected to be involved in in the future.

[0090] The authentication status is expressed by, for example, the type of authentication that has been acquired by the target entity from among a predetermined number of types of security-related authentication.

[0091] The information type is represented by, for example, the type of information handled by the target entity for which security measures are important. Information for which security measures are important is information that would have a large impact if it were to be leaked.

[0092] For example, the characteristic information indicates the type of information handled by the target entity from among a plurality of predetermined types of information. The predetermined types of information may include personal information (such as addresses and personal identification numbers), confidential information, confidential information for the group, information related to defense business, information related to space business, or information related to infrastructure.

[0093] The information type is not limited to the type of information that the target entity already handles, but may also include the type of information that the target entity plans to handle in the future or the type of information that the target entity is expected to handle in the future.

[0094] By providing characteristic information to the audit model 100, the audit model 100 can perform a security audit that takes into account the characteristics of the target entity.

[0095] For example, the name of the target entity may affect the impact that the occurrence of a security problem will have on the company's image. For example, if the name of the target entity includes the name or abbreviation of a parent company, if a security problem occurs at the target entity, not only the target entity's corporate image but also that of the parent company may be significantly damaged. The same is true if the name of the target entity includes the name or abbreviation of a corporate group.

[0096] Therefore, for example, if the name of the target entity includes the name or abbreviation of a parent company or corporate group, the audit model 100 will conduct a security audit under stricter conditions than in other cases.

[0097] The size of the target entity can affect the anticipated risks, the countermeasures that can be implemented, and the magnitude of the impact of an incident. For example, the risk of information leaks increases when there are many people involved in the business, so companies with many employees or many contractors are at a higher risk of information leaks. Also, smaller companies are more likely to have fewer people familiar with security, making it difficult for them to implement detailed countermeasures. Furthermore, listed companies are likely to suffer a greater loss of trust when an incident occurs than unlisted companies.

[0098] The industry of the target entity can affect the expected risk and the magnitude of the impact of an incident. For example, industries that deal with national defense are likely to be targeted by attackers, and the damage caused by an incident is likely to be greater.

[0099] Certification status is useful for understanding the security efforts of the target entity. For example, if a target entity has acquired ISMS(**) certification, it can be considered that the target entity has implemented measures that meet or exceed the standards required by the ISMS regulations within the scope of certification.

[0100] The type of information handled by a target entity can affect the magnitude of the impact of an incident and how the information should be handled appropriately. For example, if a target entity handles personal information such as My Number, it could be a major problem if an incident occurs and the information is leaked. Therefore, the target entity is required to handle information more carefully.

[0101] The security audit device 2000 may cause the audit model 100 to identify security risks derived from the characteristic information. In this case, the audit result information 40 further includes security risks derived from the characteristic information. Examples of security risks derived from the characteristic information include "if there are many subcontractors, there is a risk of supply chain management issues" and "because we are involved in the My Number collection business, there is a risk that the damage will be great if information is leaked."

[0102] In order to ensure that security risks derived from the feature information are included in the audit result information 40, for example, an item such as "security risks derived from the feature information" is included as one of the items shown in the template information 50. By having the audit model 100 use this template information 50, the audit model 100 can identify security risks derived from the feature information.

[0103] FIG. 7 is a second diagram illustrating an example of template information 50. The template information 50 in FIG. 7 shows, as the first item, "risk derived from profile." The profile here refers to the characteristics of the target entity. Therefore, by using the template information 50 illustrated in FIG. 7 in the audit model 100, the audit result information 40 will include security risks derived from the characteristic information.

[0104] The audit result information 40 generated using the template information 50 in Fig. 7 indicates, for example, the following content: However, in the following example, "5. Recommended measures (all)" is omitted.

[0105] 1. Risk derived from profile The key security risk for Company A is the protection of customer information handled by its cloud services. The acquisition of C1 and C2 certifications shows that the company is committed to protecting information, but since the final delivery destination is critical infrastructure, information leakage poses a major risk. Furthermore, given the number of employees, the number of employees of group companies, and the number of workers at outsourced companies, human error is also a risk that cannot be ignored.

[0106] 2. Overall evaluation Company A has implemented security measures across the board, but there are some areas where they are lacking.

[0107] 3. Weak points More action is needed, especially in the information management category.

[0108] 4. Recommended measures (excerpt) Regarding Q2-4, "Is highly confidential information that could have an impact on business if leaked, encrypted?", it is important to apply appropriate encryption technology to highly confidential information and minimize the risk of unauthorized access and information leaks. Refer to the parent company's implementation measures and the international standard S1 and implement encryption when storing and transmitting data to strengthen information security.

[0109] In the above example, Q2-4 represents the question number.

[0110] <<Processing of Audit Result Information 40>> The generation unit 2040 may perform any processing on the audit result information 40 output from the audit model 100. For example, the audit result information 40 output from the audit model 100 indicates, instead of text, an evaluation score that indicates the level of evaluation of the security measures by the target entity as information that indicates the overall evaluation of the target entity. The evaluation score is expressed, for example, as a weighted sum of values ​​that indicate the degree of thoroughness of the security measures.

[0111] If an evaluation score is to be included in the audit result information 40, the prompt 20 preferably includes an instruction to calculate the evaluation score. For example, the prompt 20 may include an instruction such as "Please include an evaluation score in the audit result that indicates the level of evaluation of the security measures."

[0112] The generation unit 2040 uses the evaluation score to generate evaluation text, which is text that represents an overall evaluation of the target entity, and adds the generated evaluation text to the audit result information 40. For example, a plurality of correspondences between numerical ranges of evaluation scores and evaluation texts are defined in advance. Specifically, correspondences such as "x1 or more: measures taken overall," "x2 or more but less than x1: measures taken almost entirely," "x3 or more but less than x2: measures taken not very well," and "less than x3: measures taken at all" are defined in advance.

[0113] The generation unit 2040 identifies which of a plurality of predetermined numerical ranges the evaluation score indicated in the audit result information 40 output from the audit model 100 falls within. Then, the generation unit 2040 adds the evaluation text corresponding to the identified numerical range to the audit result information 40.

[0114] The weight of each answer used to calculate the evaluation score may be either a fixed value or dynamically determined. In the latter case, the weight of each answer is determined, for example, using feature information. In this case, the prompt 20 preferably includes text instructing weighting based on the features, such as "Please determine the weight to be assigned to each answer based on the features indicated in the feature information."

[0115] The evaluation score may be calculated for each category of security measures, in which case the generating unit 2040 identifies evaluation text for each category.

[0116] The above-mentioned process of “identifying the evaluation text from the evaluation score and including the evaluation text in the audit result information 40” may be performed inside the audit model 100 .

[0117] The evaluation score for each category can also be used to identify strong points and weak points. For example, suppose that the audit result information 40 output from the audit model 100 indicates the evaluation score for each category but does not indicate the strong points and weak points. In this case, the generation unit 2040 uses the evaluation score for each category indicated in the audit result information 40 to identify the weak points and strong points. For example, the generation unit 2040 identifies the category with the highest evaluation score as a strong point. On the other hand, the generation unit 2040 identifies the category with the lowest evaluation score as a weak point. Then, the generation unit 2040 adds the strong point category and the weak point category to the audit result information 40.

[0118] The extraction of recommended measures may be performed outside the audit model 100. For example, the audit model 100 associates all recommended measures with their importance and includes them in the audit result information 40. The generation unit 2040 extracts recommended measures indicated in the audit result information 40 based on the importance. Then, the generation unit 2040 adds an item of the excerpt indicating the extracted recommended measure (the third item in the example of FIG. 6 ) to the audit result information 40.

[0119] Prompt 20 preferably includes instructions to calculate the importance of each recommended measure. For example, prompt 20 may include the instruction, "In the results of the security audit, please include the recommended measures along with their importance."

[0120] There are various methods for extracting recommended measures based on importance. For example, the generation unit 2040 extracts the top N recommended measures in order of importance. Alternatively, for example, the generation unit 2040 extracts recommended measures whose importance is equal to or greater than a threshold.

[0121] <Output of audit result information 40> The security auditing device 2000 outputs the audit result information 40 in various ways. For example, the security auditing device 2000 stores the audit result information 40 in an arbitrary storage unit. Alternatively, for example, the security auditing device 2000 outputs the audit result information 40 to a display device or the like, thereby displaying the audit result information 40 on the display device or the like. Alternatively, for example, the security auditing device 2000 transmits the audit result information 40 to another device. For example, as described above, assume that a user of the security auditing device 2000 uses the security auditing device 2000 from a user terminal via a web system. In this case, the security auditing device 2000 transmits the audit result information 40 to the user terminal.

[0122] Although the present disclosure has been described above with reference to the embodiments, the present disclosure is not limited to the above-described embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. Furthermore, each embodiment can be combined with other embodiments as appropriate.

[0123] Each drawing is merely an example for describing one or more embodiments. Each drawing may relate not only to one particular embodiment, but also to one or more other embodiments. As will be understood by those skilled in the art, various features or steps described with reference to any one drawing can be combined with features or steps shown in one or more other drawings to create, for example, an embodiment not explicitly shown or described. Not all features or steps shown in any one drawing are necessary to describe an exemplary embodiment, and some features or steps may be omitted. The order of steps described in any drawing may be changed as appropriate.

[0124] The program includes instructions (or software code) that, when loaded into a computer, cause the computer to perform one or more functions described in the embodiments. The program may be stored in a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, computer-readable media or tangible storage media include random-access memory (RAM), read-only memory (ROM), flash memory, solid-state drive (SSD) or other memory technologies, CD-ROM, digital versatile disc (DVD), Blu-ray® disc or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices. The program may also be transmitted on a transitory computer-readable medium or communication medium. By way of example and not limitation, transitory computer-readable media or communication media include electrical, optical, acoustic, or other forms of propagated signals.

[0125] A part or all of the above-described embodiments can be described as, but not limited to, the following supplementary notes. (Appendix 1) an acquisition means for acquiring answer information indicating an answer by the target entity to a question regarding the implementation of security measures; A security audit device having a generation means for generating audit result information representing the results of an audit of the implementation of security measures by the target entity by inputting a prompt instructing the audit to be conducted based on the answer information and the answer information into a language model. (Appendix 2) the acquiring means acquires standard information indicating standards for implementing security measures; The security audit device described in Appendix 1, wherein the generation means generates the audit result information by inputting the reference information, the answer information, and the prompt that instructs the audit to be performed by comparing the answer information with the reference information into the language model. (Appendix 3) the acquiring means acquires reference information indicating model answers to the questions; The security audit device described in Appendix 1, wherein the generation means generates the audit result information by inputting the reference information, the answer information, and the prompt that instructs the audit to be performed by comparing the answer information with the reference information into the language model. (Appendix 4) 2. The security audit device according to claim 1, wherein the answer information indicates a degree of implementation of security measures and specific implementation details of the security measures for each of the plurality of questions regarding security measures. (Appendix 5) the prompt includes an instruction to calculate an evaluation value representing the level of evaluation of the security measures implemented by the target entity; The security audit device described in Appendix 4, wherein the generation means identifies the evaluation text corresponding to the evaluation value calculated by the language model from the evaluation text defined in correspondence with each of multiple numerical ranges of the evaluation value, and generates the audit result information including the identified evaluation text. (Appendix 6) the prompt includes instructions to identify a security weakness, a security strength, or both, for the target entity; 2. The security auditing device according to claim 1, wherein the audit result information indicates the weak points, the strong points, or both. (Appendix 7) the prompt includes instructions for the target entity to identify recommended improvements to its security measures; 2. The security audit device according to claim 1, wherein the audit result information indicates the remedial measures. (Appendix 8) the acquiring means acquires feature information representing features of the target entity; The security audit device described in Appendix 1, wherein the generation means generates the audit result information by inputting the answer information, the feature information, and a prompt instructing the audit to be performed based on the answer information and the feature information into a language model. (Appendix 9) 9. The security audit device according to claim 8, wherein the characteristic information indicates the name of the target entity. (Appendix 10) A security auditing device as described in Appendix 8, wherein the characteristic information indicates the type of information handled by the target entity. (Appendix 11) 9. The security audit device according to claim 8, wherein the characteristic information indicates the size of the target entity. (Appendix 12) A security audit device as described in Appendix 8, wherein the characteristic information indicates the type of business in which the target entity is involved. (Appendix 13) The security audit device described in Appendix 1, wherein the questions are questions regarding information security governance, questions regarding information management, questions regarding countermeasures against information security threats, questions regarding the detection of the threats, questions regarding dealing with the detected threats, questions regarding recovery after the dealing with the threats, or questions regarding the development of personnel dealing with information security. (Appendix 14) an acquisition step of acquiring answer information indicating an answer by the target entity to a question regarding the implementation of security measures; A security audit method comprising: a generation step of generating audit result information representing the results of an audit of the implementation of security measures by the target entity by inputting a prompt instructing the audit to be conducted based on the answer information and the answer information into a language model. (Appendix 15) an acquisition step of acquiring answer information indicating an answer by the target entity to a question regarding the implementation of security measures; a generation step of generating audit result information representing the results of an audit of the implementation of security measures by the target entity by inputting a prompt instructing the audit to be conducted based on the response information and the response information into a language model.

[0126] Some or all of the elements (e.g., configurations and functions) described in Appendix 2 to Appendix 13 that are dependent on Appendix 1 may also be dependent on Appendix 14 and Appendix 15 in the same dependency relationship as Appendix 2 to Appendix 13. Some or all of the elements described in any appendix may be applied to various hardware, software, recording means for recording software, systems, and methods. [Explanation of symbols]

[0127] 10 Answer information 12 questions 14 answers 16 1st answer 18 Second answer 20 prompts 40 Audit Results Information 50 Template Information 52 Item name 54 Contents 100 Audit Model 1000 computers 1020 Bus 1040 processor 1060 memory 1080 storage device 1100 Input / Output Interface 1120 Network Interface 2000 Security Audit Device 2020 Acquisition Department 2040 Generation part

Claims

1. an acquisition means for acquiring answer information indicating an answer by the target entity to a question regarding the implementation of security measures; A security audit device having a generation means for generating audit result information representing the results of an audit of the implementation of security measures by the target entity by inputting a prompt instructing the audit to be conducted based on the answer information and the answer information into a language model.

2. the acquiring means acquires standard information indicating standards for implementing security measures; 2. The security audit device of claim 1, wherein the generation means generates the audit result information by inputting the reference information, the answer information, and the prompt that instructs the audit to be performed by comparing the answer information with the reference information into the language model.

3. the acquiring means acquires reference information indicating model answers to the questions; 2. The security audit device of claim 1, wherein the generation means generates the audit result information by inputting the reference information, the answer information, and the prompt that instructs the audit to be performed by comparing the answer information with the reference information into the language model.

4. 2. The security audit device according to claim 1, wherein the answer information indicates a degree of implementation of security measures and specific implementation details of the security measures for each of the plurality of questions regarding security measures.

5. the prompt includes an instruction to calculate an evaluation value representing the level of evaluation of the security measures implemented by the target entity; The security audit device of claim 4, wherein the generation means identifies the evaluation text corresponding to the evaluation value calculated by the language model from the evaluation text defined in correspondence with each of multiple numerical ranges of the evaluation value, and generates the audit result information including the identified evaluation text.

6. the prompt includes instructions to identify a security weakness, a security strength, or both, for the target entity; The security audit device according to claim 1 , wherein the audit result information indicates the weak points, the strong points, or both of them.

7. the prompt includes instructions for the target entity to identify recommended improvements to its security measures; The security audit device according to claim 1 , wherein the audit result information indicates the remedial measures.

8. the acquiring means acquires feature information representing features of the target entity; 2. The security audit device according to claim 1, wherein the generation means generates the audit result information by inputting the answer information, the feature information, and a prompt instructing the audit to be performed based on the answer information and the feature information into a language model.

9. The security auditing device according to claim 8 , wherein the characteristic information indicates a name of the target entity.

10. The security auditing device according to claim 8 , wherein the characteristic information indicates a type of information handled by the target entity.

11. The security auditing device according to claim 8 , wherein the characteristic information indicates the size of the target entity.

12. The security audit device according to claim 8 , wherein the characteristic information indicates a type of business related to the target entity.

13. The security audit device of claim 1, wherein the questions are questions regarding information security governance, questions regarding information management, questions regarding countermeasures against information security threats, questions regarding detection of the threats, questions regarding dealing with the detected threats, questions regarding recovery after the dealing with the threats, or questions regarding the development of personnel dealing with information security.

14. an acquisition step of acquiring answer information indicating an answer by the target entity to a question regarding the implementation of security measures; A security audit method comprising: a generation step of generating audit result information representing the results of an audit of the implementation of security measures by the target entity by inputting a prompt instructing the audit to be conducted based on the answer information and the answer information into a language model.

15. an acquisition step of acquiring answer information indicating an answer by the target entity to a question regarding the implementation of security measures; a generation step of generating audit result information representing the results of an audit of the implementation of security measures by the target entity by inputting a prompt instructing the audit to be conducted based on the response information and the response information into a language model.

Images