Information processing device, information processing method, and program

Abstract

This invention provides an information processing device, an information processing method, and a program that appropriately identify security risks related to a target entity. [Solution] In an information processing system in which an information processing device, a providing server, a first terminal, and a second terminal are connected by a network, the information processing device 10 includes a receiving unit 12 that receives answers to security-related questions from a target entity, a storage unit 13 that stores the answers in association with the target entity, a control unit 14 that calculates a security countermeasure score regarding security measures based on the aggregated results of the answers, and calculates a security risk score regarding residual security risks based on the security countermeasure score, and an output unit 11 that outputs a security score identified based on at least one of the security countermeasure score and the security risk score.

Description

Technical Field

[0001] The present invention relates to an information processing apparatus, an information processing method, and a program.

Background Art

[0002] Conventionally, a technique has been known in which an IT service provider or the like is requested to answer questions regarding security and checks such as security are performed (for example, Patent Document 1).

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] For example, there may be a case where it is required to appropriately grasp security based on the answer to a question.

[0005] Therefore, an object of the present invention is to provide an information processing apparatus, an information processing method, and a program that enable appropriate grasping of information regarding security.

Means for Solving the Problems

[0006] The disclosed form is an information processing device comprising: a receiving unit that receives answers to security-related questions from a target entity; a storage unit that stores the answers in association with the target entity; a control unit that calculates a security countermeasure score for security measures based on the aggregated results of the answers, and calculates a security risk score for residual security risks based on the security countermeasure score; and an output unit that outputs a security score identified based on at least one of the security countermeasure score and the security risk score, wherein the storage unit stores the security countermeasure score and the security risk score in association with the target entity, the security countermeasure score is a score that increases as the security risk decreases, and the security risk score is a score that increases as the security risk increases.

[0007] The disclosure is an information processing method comprising the steps of: receiving answers to security questions from a target entity; storing the answers in association with the target entity; calculating a security measure score for security measures based on the aggregated results of the answers; calculating a security risk score for residual security risks based on the security measure score; outputting a security score identified based on at least one of the security measure score and the security risk score; and storing the security measure score and the security risk score in association with the target entity, wherein the security measure score is a score that increases as the security risk decreases, and the security risk score is a score that increases as the security risk increases.

[0008] The disclosure is a program that includes the steps of: receiving answers to security questions from a target entity; storing the answers in association with the target entity; calculating a security measure score for security measures based on the aggregated results of the answers; calculating a security risk score for residual security risks based on the security measure score; outputting a security score identified based on at least one of the security measure score and the security risk score; storing the security measure score and the security risk score in association with the target entity; and causing a computer to execute the program, wherein the security measure score is a score that increases as the security risk decreases, and the security risk score is a score that increases as the security risk increases. [Effects of the Invention]

[0009] According to the present invention, it is possible to provide an information processing device and an information processing method that enable the appropriate identification of security risks of a target entity. [Brief explanation of the drawing]

[0010] [Figure 1] Figure 1 shows an information processing system 100 according to an embodiment. [Figure 2] Figure 2 shows an information processing device 10 according to an embodiment of the present invention. [Figure 3] Figure 3 is a diagram illustrating an application scenario according to this embodiment. [Figure 4] Figure 4 is a diagram illustrating the security score according to the embodiment. [Figure 5] Figure 5 shows an information processing method according to an embodiment of this invention. [Figure 6] Figure 6 is a diagram illustrating Example 1. [Figure 7] Figure 7 is a diagram illustrating Example 1. [Figure 8] Figure 8 is a diagram illustrating Example 1. [Figure 9] Figure 9 is a diagram illustrating Example 2. [Figure 10] Figure 10 is a diagram illustrating Example 2. [Figure 11] Figure 11 is a diagram illustrating Example 2. [Modes for carrying out the invention]

[0011] Embodiments will be described below with reference to the drawings. In the following drawings, identical or similar parts are denoted by the same or similar reference numerals.

[0012] However, it should be noted that the drawings are schematic, and the proportions of each dimension may differ from those in reality. Therefore, specific dimensions should be determined by referring to the explanation below. Furthermore, it is also important to note that there may be differences in the relationships or proportions of dimensions between different drawings.

[0013] [Summary of Disclosure] The information processing device relating to the disclosure summary includes a receiving unit that receives answers to security questions from a target entity, a storage unit that stores the answers in association with the target entity, a control unit that calculates a security countermeasure score relating to security measures based on the aggregated results of the answers and calculates a security risk score relating to residual security risk based on the security countermeasure score, and an output unit that outputs a security score identified based on at least one of the security countermeasure score and the security risk score, wherein the storage unit stores the security countermeasure score and the security risk score in association with the target entity, the security countermeasure score is a score that increases as the security risk decreases, and the security risk score is a score that increases as the security risk increases.

[0014] The information processing method related to the disclosure summary includes the steps of receiving, from a target entity, an answer to a security-related question, storing the answer in association with the target entity, calculating a security countermeasure score related to security countermeasures based on the aggregation result of the answers, calculating a security risk score related to the residual risk of the security based on the security countermeasure score, outputting a security score specified based on at least one of the security countermeasure score and the security risk score, and storing the security countermeasure score and the security risk score in association with the target entity. The security countermeasure score is a score that becomes higher as the risk of the security is lower, and the security risk score is a score that becomes higher as the risk of the security is higher.

[0015] The program related to the disclosure summary includes the steps of receiving, from a target entity, an answer to a security-related question, storing the answer in association with the target entity, calculating a security countermeasure score related to security countermeasures based on the aggregation result of the answers, calculating a security risk score related to the residual risk of the security based on the security countermeasure score, outputting a security score specified based on at least one of the security countermeasure score and the security risk score, and storing the security countermeasure score and the security risk score in association with the target entity, and causing a computer to execute. The security countermeasure score is a score that becomes higher as the risk of the security is lower, and the security risk score is a score that becomes higher as the risk of the security is higher.

[0016] In the summary of the disclosure, in addition to calculating a security measure score related to security measures based on the aggregation result of responses, the information processing apparatus executes an operation of calculating a security risk score related to the remaining risk of security based on the security measure score, and stores the security measure score and the security risk score in association with a target entity. The information processing apparatus outputs a security score specified based on at least one of the security measure score and the security risk score. According to such a configuration, by calculating the security measure score and the security risk score, security scores from different viewpoints can be output, and the risk related to the security of the target entity can be appropriately grasped.

[0017] [Embodiment] (Information Processing System) Hereinafter, the information processing system according to the embodiment will be described. FIG. 1 is a diagram showing an information processing system 100 according to the embodiment.

[0018] As shown in FIG. 1, the information processing system 100 includes an information processing apparatus 10, a providing server 30, a first terminal 40, and a second terminal 50. The information processing apparatus 10, the providing server 30, the first terminal 40, and the second terminal 50 are connected by a network 200. Although not particularly limited, the network 200 may be configured by the Internet. The network 200 may include a local area network, may include a mobile communication network, and may include a VPN (Virtual Private Network).

[0019] The information processing device 10 may evaluate the security relating to the target entity. The security relating to the target entity may also be the security relating to the goods that the target entity provides to the user entity. The goods provided by the target entity may be interpreted as the subject of a transaction between the target entity and the user entity. The goods provided by the target entity may be a service or a physical object. In this case, for example, the target entity may be a manufacturer that produces physical objects. Services may also include SaaS (Software as a Service), IaaS (Infrastructure as a Service), PaaS (Platform as a Service), etc. In this case, for example, the target entity may be a SaaS provider that provides SaaS. The subject of a transaction provided by the target entity may be a specific task or business. Details of the information processing device 10 will be described later (see Figure 2).

[0020] The providing server 30 may be a server belonging to the target entity that provides services via the network 200 when the goods or services provided by the target entity are services.

[0021] The first terminal 40 is a terminal used by the target entity. The first terminal 40 may have a display unit 41. The display unit 41 may consist of a liquid crystal panel, an organic EL (electroluminescence) panel, an LED (light-emitting diode), or the like. For example, the first terminal 40 may be a personal computer, a smartphone, or a tablet terminal. The first terminal 40 may also be referred to as the target entity.

[0022] The second terminal 50 is a terminal used by a third party different from the target entity. The third party may include a user entity that uses the products provided by the target entity. The second terminal 50 may have a display unit 51. The display unit 51 may be composed of a display such as an LCD panel, an organic EL panel, or an LED. For example, the second terminal 50 may be a personal computer, a smartphone, or a tablet terminal. The second terminal 50 may also be referred to as a user entity.

[0023] (Information processing device) The information processing device 10 according to the embodiment will be described below. Figure 2 is a diagram showing the information processing device 10 according to the embodiment.

[0024] As shown in Figure 2, the information processing device 10 includes a transmitting unit 11, a receiving unit 12, a storage unit 13, and a control unit 14.

[0025] The transmitting unit 11 may be composed of a communication module. The communication module may be a wireless communication module compliant with standards such as IEEE 802.11a / b / g / n / ac / ax, LTE, 5G, 6G, or a wired communication module compliant with standards such as IEEE 802.3.

[0026] The transmitting unit 11 may transmit various information to the first terminal 40 (target entity) and the second terminal 50 (user entity). For example, the transmitting unit 11 may transmit security questions to the first terminal 40. The questions may be transmitted in list format. For example, the transmitting unit 11 may transmit a security response, including a security score for the target entity, to the second terminal 50.

[0027] The receiving unit 12 may be composed of a communication module. The communication module may be a wireless communication module compliant with standards such as IEEE 802.11a / b / g / n / ac / ax, LTE, 5G, 6G, or a wired communication module compliant with standards such as IEEE 802.3.

[0028] The receiving unit 12 may receive various information from the first terminal 40 (target entity) and the second terminal 50 (user entity). For example, the receiving unit 12 may receive answers to security-related questions from the first terminal 40. The answers may be received in list format. For example, the receiving unit 12 may receive a security request from the second terminal 50 requesting a security score for the target entity.

[0029] The storage unit 13 is composed of storage media such as SSDs (Solid State Drives) and HDDs (Hard Disk Drives), and stores various types of information.

[0030] The storage unit 13 stores answers to security-related questions in association with the target entities. The storage unit 13 may also store security countermeasure scores calculated by the control unit 14 (described later) in association with the target entities. The storage unit 13 may also store security risk scores calculated by the control unit 14 (described later) in association with the target entities. The database (DB) stored in the storage unit 13 may be called the entity information DB.

[0031] The control unit 14 may include at least one processor. The at least one processor may consist of a CPU (Central Processing Unit), an MPU (Micro Processing Unit), a GPU (Graphics Processing Unit), one or more Integrated Circuits, one or more Discrete Circuits, and combinations thereof.

[0032] The control unit 14 calculates a security score for the target entity. Specifically, the control unit 14 may calculate a security countermeasure score for security measures based on the aggregated results of answers to security questions. The control unit 14 may also calculate a security risk score for residual security risks based on the security countermeasure score. The control unit 14 may identify a security score for the target entity based on at least one of the security countermeasure score and the security risk score. The control unit 14 may instruct the transmission unit 11 to transmit (output) the identified security score. The security score may be a security countermeasure score, a security risk score, or both.

[0033] Here, the security measures score is a score that increases as the security risk decreases. Alternatively, the security measures score can be interpreted as a score that increases as the level of security measures increases. The security risk score is a score that increases as the security risk increases. Further details on the security measures score and security risk score will be discussed later (see Figure 4).

[0034] In this embodiment, the receiving unit 12 is configured to receive answers to security-related questions from the target entity. The storage unit 13 is configured to store the answers in association with the target entity. The control unit 14 is configured to calculate a security countermeasure score regarding security measures based on the aggregated results of the answers, and to calculate a security risk score regarding residual security risks based on the security countermeasure score. The transmitting unit 11 is configured to output a security score identified based on at least one of the security countermeasure score and the security risk score.

[0035] (Applicable scenarios) The following describes application scenarios according to the embodiment. Figure 3 is a diagram illustrating an application scenario according to the embodiment.

[0036] As shown in Figure 3, in the application scenario, when the target entity provides goods (including products and services) to the user entity, it is assumed that there is a counterparty (customer entity) with which the target entity conducts transactions in the provision of goods. Here, entities (including the target entity and the customer entity) may be organizations, groups, departments, individuals, etc., and for example, the target entity may be read as the target organization or target company, and the customer entity may be read as the customer organization or customer company.

[0037] For example, as shown in Figure 3, there may be trading partners #1 and #2 as counterparties to the target entity. Trade partners #1 and #2 may be referred to as primary trading partners. Trade partners #1-1 and #1-2 may be referred to as counterparties to trade with trade partner #1. Trade partners #1-1 and #1-2 may be referred to as secondary trading partners. There may be n (where n is an integer greater than or equal to 1)th-order trading partners as trading partners.

[0038] Here, the target entity, trading partner entity #1, trading partner entity #1-1, and trading partner entity #1-2 can be considered to constitute one supply chain. Similarly, the target entity and trading partner entity #2 can be considered to constitute one supply chain. Furthermore, trading partner entity #1 and trading partner entity #1-1 can be considered to constitute one supply chain (sub-supply chain), and trading partner entity #1 and trading partner entity #1-2 can be considered to constitute one supply chain (sub-supply chain). Note that the supply chain shown in Figure 3 is an example and is not limited to this. Here, a supply chain may be a chain of supply for the flow of goods or services, and may be constructed by entities such as multiple organizations. In a supply chain, the relationship between a target entity such as a cloud service provider and its trading partner entities such as its outsourced service providers is defined.

[0039] A user entity is an entity that uses a product or service from the target entity. If the product or service is a cloud service, the user entity may be a cloud service user. If the product or service is a physical item such as a finished product or parts, the user entity may be a purchaser of the item. If the product or service (the object of the transaction) is a business or work, the user entity may be the service provider or contractor requesting the business or work. From the perspective of the target entity, the user entity may be the trading partner, buyer, or parent company.

[0040] The target entity is an entity that provides goods or services to the user entity. If the goods or services are cloud services, the target entity may be a cloud service provider. From the user entity's perspective, the target entity may be a trading partner, a contractor (subcontractor, sub-subcontractor), a vendor, a supplier, etc. From the trading partner entity's perspective, the target entity may be a trading partner, a contractor, a seller, a subsidiary, etc.

[0041] A trading partner entity is an entity involved in the goods and services provided from the target entity to the user entity. From the perspective of the target entity, a trading partner entity may also be a trading partner, a contractor (subcontractor, sub-subcontractor, sub-sub-subcontractor, etc.), a vendor, a supplier, etc.

[0042] Here, the storage unit 13 (entity information DB) described above stores the business partner entities associated with the target entity in association with the target entity. The storage unit 13 (entity information DB) stores the hierarchical relationships of the supply chain, which consists of business partner entities and target entities having one or more levels. Such supply chain information may be registered by user entities or target entities. A target entity may register all information about the supply chain, including itself, or a business partner entity included in the supply chain may register other business partner entities that are in a lower level (downstream) than itself. The storage unit 13 (entity information DB) stores the business partner security measures score, which relates to security measures for business partner entities, in association with the business partner entity. The storage unit 13 (entity information DB) stores the business partner security risk score, which relates to security measures for business partner entities, in association with the business partner entity.

[0043] Furthermore, the related business partner entities may be business partner entities that, from the perspective of the target entity, have the aforementioned transaction relationships, consignment relationships, contracting relationships, sales relationships, group company relationships, etc. The storage unit 13 (entity information DB) described above may also store other business partner entities related to the business partner entity in association with the business partner entity.

[0044] Specifically, the entity information database may store information about entities that constitute the supply chain. This information may include entity identification information, company information (such as capital, president, risk information, service information, and location information). It may also include information about the transaction hierarchy to which the entity belongs in the supply chain, information about entities higher up in the supply chain, and information about entities lower down in the supply chain. Furthermore, it may include information about the goods and services provided by the entity, transaction amounts, and risk assessment information. Risk assessment information may include security measures scores and security risk scores. Finally, it may include the trading partner security measures scores and trading partner security risk scores described later.

[0045] (Security score) The security score according to the embodiment will be described below. Figure 4 is a diagram illustrating the security score according to the embodiment. As shown in Figure 4, several methods for calculating the security score are possible. In Figure 4, for the sake of simplicity, an example is given of a case where there is only one trading partner entity.

[0046] In Method 1, the information processing device 10 calculates a security countermeasure score based on the aggregated results of answers to security-related questions. For example, the information processing device 10 may calculate the security countermeasure score according to the number of questions in the security checklist for which the answers are predetermined (e.g., "Yes"). If the questions are classified by item, the information processing device 10 may aggregate the number for each item. The information processing device 10 manages weighting values ​​for each item and may calculate the security countermeasure score after correcting the numerical values ​​for each item based on the weighting values. The security countermeasure score is a score that increases as the security risk decreases. The information processing device 10 stores the customer security countermeasure score for security measures related to the customer entity. The customer security countermeasure score is a score that increases as the security risk decreases.

[0047] In Method 1, the security measures score may be quantified or indexed such that a base score common to all entities (e.g., 100) is used as the upper limit, so that the security measures scores of each entity can be compared.

[0048] For example, the information processing device 10 may output 70 / 100 as the security measures score for the target entity. The information processing device 10 may also output 40 / 100 as the customer security measures score for the customer entity.

[0049] In Method 1, the information processing device 10 may output the security measures score of the target entity (e.g., 70) as the security score for the target entity. The information processing device 10 may also output the business partner security measures score of the business partner entity (e.g., 40) as the business partner security score for the business partner entity.

[0050] In Method 1, the information processing device 10 may identify the highest-risk score included in the supplier security score of the supplier entities constituting the supply chain and output it in association with the supplier entity having the highest-risk score. The highest-risk score corresponds to the lowest supplier security measures score.

[0051] In Method 2, the information processing device 10 identifies a security risk score related to residual security risk based on the security countermeasure score. The security risk score is higher as the security risk increases. The information processing device 10 stores a customer security risk score related to the security risk of the customer entity. The customer security risk score is higher as the security risk increases.

[0052] In Method 2, the security score may be quantified or indexed such that each entity has a different base score as its upper limit. For example, the base score for the target entity may be 150, and the base score for the trading partner entity may be 100. The base score for the target entity may be set based on at least the data handled by the target entity. The base score for the trading partner entity may be set based on at least the data handled by the trading partner entity.

[0053] For example, the base score of an entity that handles personal information may be higher than the base score of an entity that does not handle personal information. The base score of an entity that handles sensitive information may also be higher than the base score of an entity that does not handle sensitive information.

[0054] For example, if the security measures score of the target entity is 110, the information processing device 10 may output 40 (150-110), which is the base score minus the security measures score, as the security risk score of the target entity. The information processing device 10 may also output 60 (100-40) as the customer security risk score of the customer entity.

[0055] In other words, the security risk score is the base score of the target entity minus the security measures score. Similarly, the trading partner security risk score is the base score of the trading partner entity minus the trading partner security measures score. By subtracting the security measures score, which indicates the degree of security measures taken, from the base score, which is the baseline value of the security risks that an entity possesses, it is possible to grasp the actual security risks that an entity possesses in the form of a score.

[0056] In method 2, the information processing device 10 may output the security risk score of the target entity (e.g., 40) as the security score for the target entity. The information processing device 10 may also output the customer security risk score of the customer entity (e.g., 60) as the customer security score for the customer entity.

[0057] In method 2, the information processing device 10 may identify the highest-risk score included in the supplier security score of the supplier entities that constitute the supply chain and output it in association with the supplier entity that has the highest-risk score. The highest-risk score is the one with the highest supplier security risk score.

[0058] In method 3, the information processing device 10 calculates a supply chain security score for the entire supply chain based on the security score, the supplier security score, and the hierarchical relationships. The supply chain may include the sub-supply chains described above. In other words, the supply chain may be interpreted as a sub-supply chain.

[0059] In method 3, the information processing device 10 may calculate a supply chain security score based on coefficients between entities constituting the supply chain. For example, the information processing device 10 may calculate a supply chain security score by multiplying at least one of the security score and the trading partner security score by a coefficient. The following options are possible for the coefficient.

[0060] In Option 1, the coefficient may be set based on a dependency coefficient between entities that make up the supply chain. The dependency coefficient may be set based on the proportion that each entity contributes to the supply of goods.

[0061] For example, the higher the proportion of an entity that contributes to the provision of goods, the larger the dependency coefficient of that entity may be set to. The larger the dependency coefficient, the larger the value of the coefficient may be set to.

[0062] In Option 2, the coefficient may be set based on weighting coefficients assigned to entities constituting the supply chain. The weighting coefficient is information about entities constituting the supply chain and is set based on at least one of the following pieces of information: personal information deposits, important information deposits, number of data handled, contract amount, business type, country of location, and technology used. Note that personal information deposits, important information deposits, number of data handled, contract amount, business type, country of location, and technology used are examples of information about entities.

[0063] The weighting coefficients, which are set based on information such as the deposit of personal information, the deposit of important information, the number of data handled, the contract amount, the business model, the country of location, and the technology used, may be set to be larger in proportion to the expected extent of damage and losses in the event of a security incident such as a data breach.

[0064] For example, the weight coefficient for an entity that has personal information deposited may be greater than the weight coefficient for an entity that does not have personal information deposited.

[0065] For example, the weight coefficient for an entity with a sensitive information deposit may be greater than the weight coefficient for an entity without a sensitive information deposit.

[0066] For example, the larger the amount of data an entity handles, the larger the value of the entity's weight coefficient may be set.

[0067] For example, a larger contract amount for an entity may be assigned a larger value as its weighting coefficient.

[0068] For example, the weighting coefficient for an entity whose business form is a corporation may be greater than the weighting coefficient for an entity whose business form is an individual.

[0069] For example, the weighting coefficient for entities located in countries with relatively high geopolitical risk may be greater than the weighting coefficient for entities located in countries with relatively low geopolitical risk.

[0070] For example, the weight coefficient for entities whose technologies are technologies that should be protected or are important from a national security perspective (e.g., AI technology, military technology, etc.) may be greater than the weight coefficient for entities whose technologies are not technologies that should be protected from a national security perspective.

[0071] Option 3 may be a combination of Option 1 and Option 2.

[0072] In Method 3, Method 1 (security measures score and supplier security measures score) may be used, or Method 2 (security risk score and supplier security risk score) may be used, in calculating the supply chain security score.

[0073] For example, when Method 1 is used, if the security measures score is 70, the supplier security measures score is 40, and the relationship between the coefficients of the target entity and the supplier entity is 20:80, the information processing device 10 may output 46 (70 * 0.2 + 40 * 0.8) as the supply chain security score. In such a case, the supply chain security score is a score that increases as the security risk decreases.

[0074] For example, when Method 2 is used, if the security risk score is 40, the supplier security risk score is 60, and the relationship between the coefficients of the target entity and the supplier entity is 20:80, the information processing device 10 may output 56 (40 * 0.2 + 40 * 0.8) as the supply chain security score. In such a case, the supply chain security score is a score that increases as the security risk increases.

[0075] In method 3, the information processing device 10 may identify the highest-risk score included in the supplier security score of the supplier entities that constitute the supply chain and output it in association with the supplier entity having the highest-risk score.

[0076] In method 3, if the supply chain includes multiple subsupply chains, the information processing device 10 may identify the highest-risk score included in the supply chain security score for each subsupply chain and output it in association with the subsupply chain having the highest-risk score.

[0077] (Information processing methods) The information processing method according to the embodiment will be described below. Figure 5 is a diagram showing the information processing method according to the embodiment.

[0078] As shown in Figure 5, in step S10, the information processing device 10 sends a security-related question to the target entity (first terminal 40).

[0079] In step S11, the information processing device 10 receives answers to security questions from the target entity (first terminal 40). The information processing device 10 may also receive information from the target entity (first terminal 40) regarding entities that constitute the supply chain.

[0080] In step S12, the information processing device 10 stores the answers to security questions in association with the target entities. Based on the information about the entities, the information processing device 10 may also store the trading partner entities associated with the target entities in association with the target entities. Based on the information about the entities, the information processing device 10 may also store the hierarchical relationships of the supply chain, which consist of trading partner entities and the target entities having one or more levels.

[0081] In step S13, the information processing device 10 calculates a security score for the target entity. For example, the information processing device 10 calculates a security countermeasure score and a security risk score.

[0082] The information processing device 10 may store a customer security score for a customer entity if the customer entity has a related customer entity. For example, the information processing device 10 may store a customer security measures score and a customer security risk score.

[0083] The information processing device 10 may calculate a supply chain security score for the entire supply chain based on the security score, the supplier security score, and the hierarchical relationships.

[0084] In step S21, the information processing device 10 receives a score request from the user entity (second terminal 50). The score request may include the type of score requested by the user entity. The types of scores may include security measures score and supplier security measures score (method 1), security risk score and supplier security risk score (method 2), method 1-based supply chain security score (method 3), method 2-based supply chain security score (method 3), and so on.

[0085] In step S22, the information processing device 10 sends a score response to the score request to the user entity (second terminal 50). The score response may include a score of the type requested by the score request.

[0086] In step S23, the user entity (second terminal 50) displays a security score based on the score response received from the information processing device 10.

[0087] (Example of operation) The following describes an example of operation relating to the above-described embodiment.

[0088] Firstly, the information processing device 10 may, in response to the input or selection of information about a first entity at a lower hierarchical level than the target entity (such as identification information, company name, or products handled), send a signal to the first entity requesting the input of information about a second entity at a lower hierarchical level than the first entity (for example, a URL for an input form).

[0089] For example, cloud service provider A, which is the target entity, may input information about provider B, which is the primary trading partner entity, into the information processing device 10. The information processing device 10 may send a signal to provider B requesting that it input information about entities at a lower level than provider B (such as subcontractors and sub-subcontractors). Provider B may input information about providers D, E, and F, which are connected in the supply chain, into the information processing device 10.

[0090] Alternatively, the target entity, cloud service provider A, may input information about all entities constituting the supply chain (provider B, providers D, E, and F) into the information processing device 10.

[0091] Secondly, the information processing device 10 retrieves risk assessment information for the input / selected entity. The risk assessment information may be calculated based on the latest security checklist or answers to security-related questions stored in association with the entity.

[0092] Thirdly, the target entity or trading partner entity inputs coefficients such as a dependency coefficient or a weight coefficient into the information processing device 10. Alternatively, the information processing device 10 may set coefficients such as a dependency coefficient or a weight coefficient based on information about entities constituting the supply chain (personal information deposit, important information deposit, number of data handled, contract amount, business type, country of location, and technology used). For example, the information processing device 10 may identify the weight coefficient from the information about the entity using a table that defines the relationship between the information about the entity and the weight coefficient. The table may be stored in the storage unit 13.

[0093] For example, if the supply chain consists of N entities, the storage unit 13 stores risk assessment information for entities 1 to N, and coefficients such as dependency coefficients or weight coefficients may be set for the nodes connecting each layer. Alternatively, the information processing device 10 may set coefficients such as dependency coefficients or weight coefficients based on information about entities 1 to N.

[0094] Fourth, the information processing device 10 may calculate a supply chain security score based on the risk assessment information and coefficients. The information processing device 10 may identify the highest risk score included in the supplier security score of the supplier entities that constitute the supply chain and output it in association with the supplier entity having the highest risk score.

[0095] Fifth, if the supply chain includes multiple sub-supply chains, the information processing device 10 may calculate a supply chain security score for each sub-supply chain. The information processing device 10 may identify the highest-risk score included in the supply chain security score for each sub-supply chain and output it in association with the sub-supply chain having the highest-risk score.

[0096] This configuration allows for improvements to security risks related to merchandise by taking measures such as discontinuing the use of the highest-risk subsupply chains or reviewing trading partners with the highest risk scores.

[0097] (Use case) The use cases of the embodiments will be described below.

[0098] For example, a use case might be a company using cloud services that wants to understand the supply chain risks of the cloud service provider. The company using cloud services is an example of a user entity, and the cloud service provider is an example of a target entity.

[0099] For example, a use case might be one where a parent company assesses the risks of its group company chain, which includes subsidiaries, sub-subsidiaries, etc. The parent company is an example of a user entity, and the subsidiaries, sub-subsidiaries, etc., are examples of target entities and trading partner entities.

[0100] For example, a use case might be one in which a client company evaluates the supply chain risks not only of the client company but also of subcontractors, sub-subcontractors, etc. The client company is an example of a user entity, the client company is an example of a target entity, and subcontractors, sub-subcontractors, etc. are examples of trading partner entities. In such a case, the user entity may be a cloud service user, the target entity may be a cloud service provider (the client company is the target entity), and the trading partner entity may be a client company that does business with the cloud service provider (the primary client is the trading partner entity). If there are further lower-level client companies, secondary, tertiary, ... nth-tier client companies may also be considered trading partner entities.

[0101] For example, a use case might be one in which a primary subcontractor assesses the supply chain risks of secondary, tertiary, etc. subcontractors. The primary subcontractor is an example of a user entity, and the secondary, tertiary, etc. subcontractors are examples of target entities and trading partner entities. In such a case, the user entity may be a user of a cloud service, the target entity may be a cloud service provider, and the trading partner entities may be subcontractors (primary subcontractors), secondary subcontractors, tertiary subcontractors, etc. subcontractors of the cloud service provider.

[0102] For example, a user entity could be someone who reviews risk assessments (e.g., a person in charge or manager of the entity's IT department).

[0103] For example, the supply chain could be a supplier-manufacturer-wholesale-retail supply chain, a cloud service provider-trading partner-secondary trading partner supply chain, a system development company-contractor-subcontractor supply chain, or a manufacturer-subcontractor-sub-subcontractor supply chain.

[0104] (Display format) The following describes the display modes of the embodiment. The display mode is the mode displayed on the second terminal 50 (user entity) and is the mode displayed based on the data transmitted from the information processing device 10.

[0105] For example, the display method may include displaying the dependency coefficient, weighting coefficient, and score on a supply chain diagram.

[0106] For example, the display method may include changing the appearance of the characters (color, boldness, brightness) depending on the magnitude of the coefficient or score.

[0107] For example, the display method may include a method in which high-risk companies in the supply chain (low security measures score, high security risk score) are displayed in a conspicuous manner (color, font, size, etc.) that distinguishes them from others.

[0108] (others) Other variations of the embodiment will be described below.

[0109] For example, even within the same company, risk assessments may vary depending on the products offered, so risk assessments may be performed for each product. However, risk assessments may also be performed for each entity. For instance, if cloud service provider A handles multiple cloud services as products, risk assessments may be performed for each cloud service, or risk assessments may be performed collectively for cloud service provider A.

[0110] For example, the calculation of a supply chain assessment (supply chain security score) may include the target entity, or it may exclude the target entity and include only the trading partner entity.

[0111] For example, in line with the risk assessment, countermeasures to mitigate risk may be suggested. These countermeasures may include reviewing high-risk entities (such as substituting them with other entities) or reviewing high-risk chains (such as substituting them with other chains). The countermeasures may be stored in a table, associated with scores. The countermeasures may also be output by inputting the risk assessment into an AI.

[0112] To generate countermeasures, a countermeasure generation model that has been trained to take at least one risk assessment as input and output countermeasures may be used. In this case, the control unit 14 may input risk assessments (such as scores and comments on the risk) and other entity information into the countermeasure generation model and cause the countermeasure generation model to output countermeasures. The countermeasure generation model is a learning model for outputting countermeasures for the risk assessments of entities. The countermeasure generation model may be a learning model that has been trained using training risk assessments and data on corresponding countermeasures as training data.

[0113] The countermeasure creation model is an AI (Artificial Intelligence) that includes transformers such as GPT (Generative Pretrained Transformer, including GPT-1, GPT-2, GPT-3, and GPT-4), BERT (Bidirectional Encoder Representations from Transformers), and BART (Bidirectional and Auto-regressive Transformer), as well as language models such as recurrent neural networks (RNNs), and may be a generative AI that includes a large-scale language model. In other words, the language model may not only be one trained for a specific task, but also a general-purpose model that can be used universally for a wide range of tasks, and as artificial intelligence, it may include a general-purpose natural language processing learning model such as a Large Language Model (LLM) that has learned from a vast amount of data. In this case, the control unit may take risk assessments and entity information as input, input prompts to the countermeasure creation model that include instructions to output countermeasures, and have the countermeasure creation model output countermeasures. Furthermore, in addition to instructions for generating and outputting countermeasures and risk assessment, the control unit may input prompts to the countermeasure creation model, for example, inserting one or more risk assessment samples and one or more corresponding countermeasure samples as input and output samples. The countermeasure creation model may output countermeasures based on the risk assessment according to the input prompts.

[0114] The AI ​​may be an external configuration of the service server 30. In that case, the external artificial intelligence is provided, for example, by an artificial intelligence service server, which receives input from each functional unit of the service server 30, receives requests to execute artificial intelligence services, and returns the instructed output as a processing result to the service server 30. The artificial intelligence service server may be a server that provides services using a language model as a learning model, or a server that performs language processing tasks using a language model. The artificial intelligence service server may be constructed using an LLM. The artificial intelligence service server receives prompt input in the form of text, images, audio, etc., and generates and responds with answers to those prompts.

[0115] For example, the risk assessment after implementing countermeasures may be displayed in conjunction with the current risk assessment. For instance, the risk assessment after implementing countermeasures may be identified based on measures such as changing weight coefficients or dependency coefficients, or changing a specific entity to another entity included in the database.

[0116] For example, the weight coefficient and the dependency coefficient may be set as separate coefficients, or they may be set as a single coefficient that reflects both the weight coefficient and the dependency coefficient.

[0117] For example, the information processing device 10 may generate an alert notification if an entity whose security measures score or supplier security measures score is less than or equal to a predetermined value (e.g., 30 points) is included in the supply chain. Alternatively, the information processing device 10 may generate an alert notification if an entity whose security risk score or supplier security risk score is greater than or equal to a predetermined value (e.g., 70 points) is included in the supply chain.

[0118] (Mechanism of Action and Effects) In this embodiment, the information processing device 10 performs an operation to calculate a security countermeasure score related to security measures based on the aggregated results of the responses, and also performs an operation to calculate a security risk score related to residual security risks based on the security countermeasure score, and stores the security countermeasure score and the security risk score in association with the target entity. The information processing device outputs a security score identified based on at least one of the security countermeasure score and the security risk score. With this configuration, by calculating the security countermeasure score and the security risk score, security scores from different perspectives can be output, and the security risks of the target entity can be appropriately grasped.

[0119] In this embodiment, the information processing device 10 may output a customer security score (customer security measures score, customer security risk score) if there is a customer entity related to the target entity. With this configuration, the customer security score can be grasped, and the risks that the supply chain may contain due to the customer entity can be appropriately grasped.

[0120] In this embodiment, the information processing device 10 may calculate a supply chain security score for the entire supply chain based on the security score, the supplier security score, and the hierarchical relationship, and output the calculated supply chain security score. With such a configuration, the overall risks of the supply chain can be appropriately grasped.

[0121] [Example of change 1] The following describes Modification Example 1. The following primarily describes the differences from the embodiment.

[0122] In change example 1, we consider a case where, for example, a specific entity is a trading partner entity in one supply chain, and that specific entity is a target entity in another supply chain, and the information processing device 10 has already received an answer to a security question from the specific entity.

[0123] In Example 1 of the modification, the information processing device 10 may calculate a supplier security score in a risk assessment of the supply chain of a certain product, using at least a portion of the responses received from a supplier entity (a target entity in another supply chain). At least a portion of the responses received from the supplier entity may include answers to security questions common to one product and another product.

[0124] [Example of change 2] The following describes the second modification example. The following primarily describes the differences from the embodiment.

[0125] In the second modification example, the information processing device 10 may output a supply chain security score calculated based on the user entity's selection result, which is either a security measures score or a security risk score, in response to a request from the user entity.

[0126] For example, if the information processing device 10 receives a request for a supply chain security score using method 1 in the score request, it may output a supply chain security score calculated based on the security measures score and the supplier's security measures score.

[0127] For example, if the information processing device 10 receives a request for a supply chain security score using method 2, it may output a supply chain security score calculated based on the security risk score and the supplier security risk score.

[0128] According to change example 2, it is possible to output a score calculated in a way that matches the user entity's intentions.

[0129] [Example of change 3] The following describes the third modification example. The following primarily describes the differences from the embodiment.

[0130] Example 3 of the changes assumes a case where the entities constituting the supply chain include entities that do not authorize the provision of information to user entities (unauthorized entities) and entities that constitute the supply chain that authorize the provision of information to user entities (authorized entities).

[0131] In such cases, the information processing device 10 may, in response to a request from a user entity, output the security score corresponding to an authorized entity in association with the authorized entity, rather than outputting the security score corresponding to an unauthorized entity in association with the unauthorized entity. Similarly, the information processing device 10 may, in response to a request from a user entity, output the customer security score corresponding to an authorized entity in association with the authorized entity, rather than outputting the customer security score corresponding to an unauthorized entity in association with the unauthorized entity.

[0132] Furthermore, the information processing device 10 may output a supply chain security score even if it does not output a security score corresponding to an unauthorized entity in association with the unauthorized entity. Similarly, the information processing device 10 may output a supply chain security score even if it does not output a customer security score corresponding to an unauthorized entity in association with the unauthorized entity.

[0133] According to Example 3 of the changes, it is possible to disclose risks across the entire supply chain while preventing the disclosure of risk assessments to user entities that have not authorized disclosure by the unauthorized entity, thereby supporting user entities in understanding the risks of the supply chain.

[0134] [Example of change 4] The following describes the fourth modification example. The following mainly describes the differences from the embodiment.

[0135] Example 4 of the changes describes how to set the base score. The base score may be set from a similar perspective to the weighting coefficients described above. Specifically, the base score may be set based on at least one of the following pieces of information: deposit of personal information, deposit of sensitive information, number of data handled, contract amount, business type, country of location, and technology used. Note that deposit of personal information, deposit of sensitive information, number of data handled, contract amount, business type, country of location, and technology used are examples of information about the entity. In Example 4 of the changes, for each of the pieces of information described above, the base score may be set so that a higher risk situation results in a higher base score.

[0136] For example, the base score of an entity that has personal information deposited may be higher than the base score of an entity that does not have personal information deposited.

[0137] For example, the base score of an entity with a sensitive information deposit may be higher than the base score of an entity without a sensitive information deposit.

[0138] For example, the larger the amount of data an entity handles, the larger the value that can be set as the entity's base score.

[0139] For example, a larger contract amount for an entity may result in a higher base score being assigned to that entity.

[0140] For example, the base score of an entity whose business form is a corporation may be higher than the base score of an entity whose business form is an individual.

[0141] For example, the base score of an entity located in a country with relatively high geopolitical risk may be higher than the base score of an entity located in a country with relatively low geopolitical risk.

[0142] For example, the base score of an entity whose technologies are technologies that should be protected from a national security perspective (e.g., AI technology, military technology, etc.) may be higher than the base score of an entity whose technologies are not technologies that should be protected from a national security perspective.

[0143] While not particularly limited, the weighting coefficients described above do not need to be used when different base scores are adopted for each entity in calculating the supply chain security score. Alternatively, when the weighting coefficients described above are used in calculating the supply chain security score, a common base score may be adopted for each entity.

[0144] [Examples] The following describes an example. In the example, a supply chain security score (Method 3) based on Method 1 is described. In the example, the entity is assumed to be a company, and the coefficients are set by the dependency coefficient and weight coefficient described above.

[0145] In the following, "constituent companies" refers to the names of the companies that make up the supply chain, "number of constituent companies" refers to the number of companies that make up the supply chain, "coefficient" refers to a predetermined value, "security score" refers to the supply chain security score, "low-scoring company" refers to the company with the lowest supplier security measures score, and "lowest score" refers to the company with the lowest supplier security measures score in the supply chain.

[0146] Note that the lowest supplier security score is an example of the highest-risk score. Also, your company's (standalone) security score is either the company's security score or the supplier's security score.

[0147] (Example 1) Example 1 illustrates a case where the target company A-1, trading partners B, E, F, and H are included in the supply chain, as shown in Figure 6.

[0148] As shown in Figure 6, company A-1 (standalone) has a score of 100 points, company B (standalone) has a score of 95 points, company E (standalone) has a score of 50 points, company F (standalone) has a score of 90 points, and company H (standalone) has a score of 30 points. Between company A-1 and company B, the coefficient for company A-1 is 0.1 and the coefficient for company B is 0.9. This indicates, for example, that in a transaction between company A-1 and company B, company A-1's self-dependence is 0.1 and its dependence on company B is 0.9. Between companies B, E, and F, the coefficient for company B is 0.2, the coefficient for company E is 0.5, and the coefficient for company F is 0.3. This indicates that company B conducts business with multiple companies, including companies E and F, within this supply chain. The dependency of company A on company B, which is 0.9, is then divided and allocated to company B's own dependency, its dependency on company E, and its dependency on company F. The coefficient for company B, 0.2, is assumed to be 0.1 allocated to company E and 0.1 allocated to company F, with a total of 0.2. Similarly, between company E and company H, company E's coefficient (e.g., its dependency) is 0.4, and company H's coefficient (e.g., its dependency) is 0.6.

[0149] Under these premises, the supply chain for company A-1 can be broken down into supply chains 1-1 for A-1, B, E, H, and F, 1-2 for B, E, H, and F, 1-3 for B, E, and H, 1-4 for E and H, 1-5 for H, 1-6 for B and F, and 1-7 for F, as shown in Figure 7.

[0150] Here, Company A-1's (standalone) security measures score is calculated based on its answers to security-related questions. Companies B, E, F, and H's (standalone) security measures scores for their business partners may be obtained from Company A-1, or they may be calculated based on answers to security-related questions obtained in the past. The coefficients are assumed to be predetermined based on factors such as dependency, workload, and the degree of security risk, as described above.

[0151] Under these premises, the information processing device 10 calculates a supply chain security score based on the security measures score, the supplier's security measures score, and coefficients. Specifically, the information processing device 10 calculates the supply chain security score by multiplying the security score of each entity by its respective coefficient, starting from the lower levels of the supply chain, and summing the products (Σ(coefficient × security score)). In the example shown in Figure 7, the information processing device 10 calculates the supply chain security score starting from supply chain 1-7. For example, since supply chain 1-7 contains only company F, the supply chain security score for supply chain 1-7 is 1 * 90 points = 90 points, which matches company F's own security score. Next, the information processing device 10 calculates the supply chain security scores in the order of supply chain 1-6 to supply chain 1-1. At this time, the calculated lower supply chain security scores are used in the calculation of the higher supply chain scores. The method for calculating the supply chain security score for each supply chain is shown in Figure 8. Note that the value of Σ(coefficient × score) may be divided by the sum of the coefficients to ensure that the maximum security score (in this case, 100 points) is equal.

[0152] Next, as shown in Figure 7, the information processing device 10 outputs the supply chain security score for each supply chain as supply chain information for company A-1, as well as the company with the lowest supplier security measures score (company H in Example 1) and the lowest supplier security measures score (30 in Example 1). The information shown in Figure 7 can be considered as an example of the information output to a user entity.

[0153] With this configuration, the user entity can identify that company H poses the highest risk and improve the security risks related to the products by taking measures such as reviewing company H. Even if company H is an unauthorized entity and information about company H (e.g., supplier security measures score) is not provided to the user entity, the user entity can still identify that the supply chain security score of supply chain 1-2 (companies B, E, H, F) is lower than that of supply chain 1-6 (companies B, F), and improve the security risks related to the products by taking measures such as reviewing supply chain 1-2.

[0154] (Example 2) Example 2 illustrates a case where the supply chain includes target company A-2, trading partner companies B, C, F, G, I, J, K, and L, as shown in Figure 9.

[0155] As shown in Figure 9, Company A-2 (standalone) has a score of 100 points, Company B (standalone) has a score of 70 points, Company C (standalone) has a score of 60 points, Company J (standalone) has a score of 90 points, Company F (standalone) has a score of 90 points, Company G (standalone) has a score of 60 points, Company K (standalone) has a score of 60 points, Company I (standalone) has a score of 60 points, and Company L (standalone) has a score of 60 points. Between Company A-2 and Company B, the coefficient for Company A-2 is 0.1 and the coefficient for Company B is 0.9. Between Company A-2 and Company C, the coefficient for Company A-2 is 0.1 and the coefficient for Company B is 0.9. Between Company A-2 and Company J, the coefficient for Company A-2 is 0.1 and the coefficient for Company B is 0.9. The coefficient between company B and company F is 0.2 for company B and 0.8 for company F. The coefficient between company C and company G is 0.1 for company C and 0.9 for company G. The coefficient between company G and company I is 0.1 for company G and 0.9 for company I. The coefficient between company J and company K is 0.1 for company J and 0.9 for company K. The coefficient between company K and company L is 0.7 for company K and 0.3 for company L.

[0156] Under these premises, the supply chain for company A-2 can be decomposed into the following, as shown in Figure 10: Supply chain 1-1 for A-2, B, F; Supply chain 1-2 for B, F; Supply chain 1-3 for F; Supply chain 2-1 for A-2, C, G, I; Supply chain 2-2 for C, G, I; Supply chain 2-3 for G, I; Supply chain 2-4 for I; Supply chain 3-1 for A-2, J, K, L; Supply chain 3-2 for J, K, L; Supply chain 3-3 for K, L; and Supply chain 3-4 for L.

[0157] Here, Company A-2's (standalone) security measures score is calculated based on its answers to security-related questions. Companies B, C, F, G, I, J, K, and L's (standalone) security measures scores for their business partners may be obtained from Company A-2, or they may be calculated based on answers to security-related questions obtained in the past. The coefficients are assumed to be predetermined, as described above.

[0158] Under these premises, the information processing device 10 calculates a supply chain security score based on the security measures score, the supplier's security measures score, and the coefficient. The information processing device 10 calculates Σ(coefficient × score) sequentially for each level of the supply chain, starting from the lower levels. The calculation method is the same as in Example 1. The calculation method for the supply chain security score of each supply chain is shown in Figure 11.

[0159] Next, as shown in Figure 10, the information processing device 10 outputs the supply chain security score for each supply chain as supply chain information for company A-2, as well as the company with the lowest supplier security measures score (company H in Example 2) and the trading partner with the lowest supplier security measures score (30 in Example 2). The information shown in Figure 11 can be considered as an example of the information output to a user entity.

[0160] With this configuration, the user entity can identify that company L poses the highest risk and improve the security risks related to its products by reviewing company L. Alternatively, the user entity can identify that supply chain 2-1 (companies A2, C(, G, I)) poses a high risk and improve the security risks related to its products by discontinuing the use of supply chain 2-1 (companies A2, C(, G, I)). Furthermore, the user entity is provided with information to help it decide whether to prioritize addressing company L or supply chain 2-1.

[0161] [Other embodiments] Although the present invention has been described by the embodiments described above, the descriptions and drawings that constitute part of this disclosure should not be understood as limiting the invention. Various alternative embodiments, examples, and operational techniques will become apparent to those skilled in the art from this disclosure.

[0162] In the disclosure described above, the supplier security score may be identified based on at least one of the supplier security measures score and the supplier security risk score. The supplier security score may be the supplier security measures score, the supplier security risk score, or both of the supplier security measures score and the supplier security risk score.

[0163] In the disclosure described above, the trading partner entity's trading partner security score (trading partner security measures score, trading partner security risk score) may be entered by the target entity and stored in the information processing device 10, or it may be entered by the trading partner entity and stored in the information processing device 10. Alternatively, as explained in Modification Example 1, the trading partner entity's trading partner security score may be calculated using at least a portion of the responses received from the trading partner entity (the target entity in the supply chain of another product).

[0164] In the disclosure described above, the hierarchical relationships of the supply chain may be input by the target entity and stored in the information processing device 10, or they may be input by the trading partner entity and stored in the information processing device 10.

[0165] In the disclosure described above, the dependency coefficient may be input by the target entity and stored in the information processing device 10, or it may be input by the trading partner entity and stored in the information processing device 10.

[0166] In the disclosure described above, the weighting coefficient may be entered by the target entity and stored in the information processing device 10, or it may be entered by the trading partner entity and stored in the information processing device 10. Alternatively, the weighting coefficient may be set based on information about the entity (at least one of the following pieces of information: personal information deposit, important information deposit, number of data handled, contract amount, business type, country of location, and technology used).

[0167] Although not specifically mentioned in the disclosure above, the information processing device 10 may have a display unit that displays risk assessments (security risk score, supplier security score, supply chain security score). The display unit may consist of a liquid crystal panel, an organic EL panel, an LED, or the like.

[0168] Although not specifically mentioned in the embodiment, a program may be provided that causes a computer to execute each of the processes performed by the information processing device 10, the first terminal 40, and the second terminal 50. Furthermore, the program may be recorded on a computer-readable medium. Using a computer-readable medium makes it possible to install the program on a computer. Here, the computer-readable medium on which the program is recorded may be a non-transient recording medium. The non-transient recording medium is not particularly limited, but may be, for example, a CD-ROM or DVD-ROM.

[0169] Alternatively, a chip may be provided comprising a memory for storing programs for executing each of the processes performed by the information processing device 10, the first terminal 40, and the second terminal 50, and a processor for executing the programs stored in the memory.

[0170] [Note] The disclosure described above may also be expressed as follows:

[0171] The first feature is an information processing device comprising: a receiving unit that receives answers to security-related questions from a target entity; a storage unit that stores the answers in association with the target entity; a control unit that calculates a security countermeasure score related to security measures based on the aggregated results of the answers, and calculates a security risk score related to residual security risk based on the security countermeasure score; and an output unit that outputs a security score identified based on at least one of the security countermeasure score and the security risk score, wherein the storage unit stores the security countermeasure score and the security risk score in association with the target entity, the security countermeasure score is a score that increases as the security risk decreases, and the security risk score is a score that increases as the security risk increases.

[0172] The second characteristic is that, in the first characteristic, the security risk score is the score obtained by subtracting the security countermeasure score from the base score for security. The aforementioned base score is set based on, at least, the data handled by the target entity, and is an information processing device.

[0173] The third feature is that, in the first or second feature, the storage unit stores the business partner entities associated with the target entity in association with the target entity, and the storage unit stores the business partner security measures score and the business partner security risk score related to security risks for the business partner entities in association with the business partner entities. The output unit is an information processing device that outputs a customer security score, which is identified based on at least one of the customer security measures score and the customer security risk score, in association with the security score.

[0174] The fourth feature is that, in the third feature, the storage unit stores the hierarchical relationships of the supply chain, which are composed of the trading partner entities and target entities having one or more layers; the control unit calculates a supply chain security score for the entire supply chain based on the security score, the trading partner security score and the hierarchical relationships; and the output unit outputs the supply chain security score.

[0175] The fifth feature is that, in the fourth feature, the control unit is an information processing device that calculates the supply chain security score based on at least one of the dependency coefficients between entities constituting the supply chain and the weight coefficients set for the entities constituting the supply chain.

[0176] The sixth feature is that, in the fifth feature, the control unit is an information processing device that calculates the supply chain security score by multiplying at least one of the security score and the supplier security score by at least one of the dependency coefficient and the weight coefficient.

[0177] The seventh feature is an information processing device in which, in the fifth or sixth feature, the weight coefficient is set based on information relating to entities constituting the supply chain, and is determined based on at least one of the following pieces of information: personal information deposit, important information deposit, number of data handled, contract amount, business type, country of location, and technology used.

[0178] The eighth feature is an information processing device in which, in at least one of the third to seventh features, the control unit identifies the customer security score using at least a portion of the answers received from the customer entity as answers to the security questions.

[0179] The ninth feature is an information processing device in which, in at least one of the third to eighth features, the output unit outputs the highest-risk score included in the customer security score, associating it with the customer entity having the highest-risk score.

[0180] The tenth feature is an information processing device in which, in at least one of the fourth to seventh features, the output unit outputs the supply chain security score calculated based on the selection result of the user entity, which selects either the security countermeasure score or the security risk score in response to a request from the user entity.

[0181] The eleventh feature is an information processing device in which, in at least one of the fourth to seventh features, the output unit, in response to a request from a user entity, does not output a security score or a business partner security score corresponding to an unauthorized entity in association with the unauthorized entity, but outputs a security score or a business partner security score corresponding to an authorized entity in association with the authorized entity, and even if the output unit does not output a security score or a business partner security score corresponding to an unauthorized entity in association with the unauthorized entity, it outputs the supply chain security score, and the unauthorized entity is an entity among the entities constituting the supply chain that has not authorized the provision of information to the user entity, and the authorized entity is an entity among the entities constituting the supply chain that has authorized the provision of information to the user entity.

[0182] The twelfth feature is an information processing method comprising the steps of: receiving answers to security-related questions from a target entity; storing the answers in association with the target entity; calculating a security measure score for security measures based on the aggregated results of the answers; calculating a security risk score for residual security risks based on the security measure score; outputting a security score identified based on at least one of the security measure score and the security risk score; and storing the security measure score and the security risk score in association with the target entity, wherein the security measure score is a score that increases as the security risk decreases, and the security risk score is a score that increases as the security risk increases.

[0183] The thirteenth feature is a program that includes the steps of: receiving answers to security-related questions from a target entity; storing the answers in association with the target entity; calculating a security measure score for security measures based on the aggregated results of the answers; calculating a security risk score for residual security risks based on the security measure score; outputting a security score identified based on at least one of the security measure score and the security risk score; storing the security measure score and the security risk score in association with the target entity; and causing a computer to execute the program, wherein the security measure score is a score that increases as the security risk decreases, and the security risk score is a score that increases as the security risk increases. [Explanation of symbols]

[0184] 10...Information processing device, 11...Transmission unit, 12...Receiving unit, 13...Storage unit, 14...Control unit, 30...Providing server, 40...First terminal, 50...Second terminal, 100...Information processing system, 200...Network

Claims

1. A receiving unit that receives answers to security-related questions from the target entity, A storage unit that stores the aforementioned answer in association with the aforementioned target entity, A control unit calculates a security measures score related to the security measures based on the aggregated results of the above responses, and calculates a security risk score related to the residual security risk based on the security measures score. The system includes an output unit that outputs a security score identified based on at least one of the security countermeasure score and the security risk score, The storage unit stores the security countermeasure score and the security risk score in association with the target entity. The aforementioned security measures score is a score that increases as the security risk decreases. The security risk score is a score that increases as the security risk increases.

2. The aforementioned security risk score is the score obtained by subtracting the security countermeasure score from the base score for security. The information processing apparatus according to claim 1, wherein the base score is set based on at least the data handled by the target entity.

3. The storage unit stores the business partner entities associated with the target entity in association with the target entity. The storage unit stores a customer security measures score related to security measures for the customer entity and a customer security risk score related to security risks for the customer entity, in association with the customer entity. The information processing apparatus according to claim 1, wherein the output unit outputs a customer security score identified based on at least one of the customer security measures score and the customer security risk score, in association with the security score.

4. The storage unit stores the hierarchical relationships of the supply chain, which are composed of the trading partner entities and the target entities having one or more levels. The control unit calculates a supply chain security score for the entire supply chain based on the security score, the supplier security score, and the hierarchical relationship. The information processing apparatus according to claim 3, wherein the output unit outputs the supply chain security score.

5. The information processing apparatus according to claim 4, wherein the control unit calculates the supply chain security score based on at least one of the dependency coefficients between entities constituting the supply chain and the weight coefficients set for the entities constituting the supply chain.

6. The information processing apparatus according to claim 5, wherein the control unit calculates the supply chain security score by multiplying at least one of the security score and the supplier security score by at least one of the dependency coefficient and the weight coefficient.

7. The information processing apparatus according to claim 5, wherein the weight coefficient is set based on information relating to entities constituting the supply chain, and is determined based on at least one of the following pieces of information: personal information deposit, important information deposit, number of data handled, contract amount, business type, country of location, and technology used.

8. The information processing apparatus according to claim 3, wherein the control unit identifies the customer security score using at least a portion of the responses received from the customer entity as answers to the security questions.

9. The information processing apparatus according to claim 3, wherein the output unit outputs the highest risk score included in the customer security score, associating it with the customer entity having the highest risk score.

10. The information processing apparatus according to claim 4, wherein the output unit outputs the supply chain security score calculated based on the selection result of the user entity, which selects either the security countermeasure score or the security risk score in response to a request from the user entity.

11. The output unit, in response to a request from a user entity, does not output the security score or customer security score corresponding to the non-authorized entity in association with the non-authorized entity, but instead outputs the security score or customer security score corresponding to the authorized entity in association with the authorized entity. Even if the output unit does not output the security score or customer security score corresponding to the unauthorized entity in association with the unauthorized entity, it will output the supply chain security score. The aforementioned non-authorized entity is an entity that constitutes the supply chain and has not authorized the provision of information to the user entity. The information processing device according to claim 4, wherein the licensing entity is an entity among the entities constituting the supply chain that has licensed to provide information to the user entity.

12. The steps include receiving answers to security questions from the target entity, A step of storing the aforementioned answer in association with the aforementioned target entity, The steps include: calculating a security measures score related to the security measures based on the aggregated results of the above responses, and calculating a security risk score related to the residual security risk based on the security measures score; A step of outputting a security score identified based on at least one of the security measures score and the security risk score, The process includes the step of storing the security countermeasure score and the security risk score in association with the target entity, The aforementioned security measures score is a score that increases as the security risk decreases. An information processing method wherein the security risk score is a score that increases as the security risk increases.

13. The steps include receiving answers to security questions from the target entity, A step of storing the aforementioned answer in association with the aforementioned target entity, The steps include: calculating a security measures score related to the security measures based on the aggregated results of the above responses, and calculating a security risk score related to the residual security risk based on the security measures score; A step of outputting a security score identified based on at least one of the security measures score and the security risk score, The steps include storing the security countermeasure score and the security risk score in association with the target entity, and having a computer perform the following actions. The aforementioned security measures score is a score that increases as the security risk decreases. The security risk score is a program in which the score increases as the security risk increases.

Images