Analytical device, analytical method, and program

Abstract

Automatically analyze compliance with IT systems To do. A reception unit receives designation of software to be analyzed, and a The equipment used when the target software is operated from the equipment where the target software is installed. The acquisition unit acquires the setting information of the target software, and the analysis unit acquires the setting information of the target software. The development and operation activities of the system meet the compliance standards for IT systems. and an output unit that outputs the analysis result by the analysis unit. The present invention provides an analytical device for

Description

[Technical field]

[0001] The present invention relates to an information processing device, an information processing method, and a program. [Background technology]

[0002] Currently, there are various compliance standards that must be observed in the development and operation of IT systems. For example, Non-Patent Document 1 describes the IT risks associated with financial accounting systems, The control mechanism and the current status of IT control are disclosed. Software that automates parts of code version management, production of deliverables, and delivery to the operating environment The clothing is shown. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] “IT Control and IT Control Criteria”, [online], Financial Services Agency, Internet<URL:https: / / www.fsa.go.jp / singi / singi_kigyou / siryou / naibu / 20050310 / 01.pdf> [Non-Patent Document 2] “Technical report on security considerations in CI / CD pipelines”, [online], Digital Agency, Internet <URL: https: / / www.digital.go.jp / assets / contents / node / basic_page / field_ref_resources / e2a06143-ed29-4f1d-9c31-0f06fca67afc / 33f31336 / 20240329_resources_standard_guidelines_guideline_01.pdf> Summary of the Invention [Problem to be solved by the invention]

[0004] Companies that develop and operate IT systems must comply with various compliance standards. In addition, some companies need multiple auxiliary software to develop and operate their IT systems. By utilizing software, we aim to reduce labor and the risk of operational mistakes. The software that companies use to develop and operate IT systems has a huge number of functions. Furthermore, the requirements of the compliance standards are wide-ranging, To analyze whether IT systems are being developed and operated while complying with the standards, It will require a huge amount of work.

[0005] Therefore, the present invention is a method for complying with compliance standards regarding the development and operation of IT systems. The present invention aims to provide a technology that enables automatic analysis of what is happening in a user's daily life. [Means for solving the problem]

[0006] An analysis device according to one aspect of the present invention receives designation of analysis target software that is to be analyzed. The reception section receives the analysis target software, and the device on which the analysis target software is installed receives the analysis target software. An acquisition unit acquires setting information used when the software is operated, and an analysis target is selected based on the setting information. The development and operation of software is subject to compliance with IT system regulations. The analysis part analyzes whether or not the criteria are met, and the results of the analysis are and an output unit for outputting the signal. Effect of the Invention

[0007] According to the present invention, compliance standards regarding the development and operation of IT systems are observed. It is possible to provide a technique that enables automated analysis of what is happening in a given situation. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a diagram illustrating an example of a system configuration of an analysis system according to an embodiment of the present invention. [Diagram 2] FIG. 2 illustrates an example of a hardware configuration of an analysis apparatus. [Diagram 3] FIG. 2 is a diagram illustrating an example of a functional block configuration of an analysis device. [Figure 4] FIG. 11 is a diagram illustrating an example of acquired data definition information. [Diagram 5] FIG. 11 is a diagram showing an example of first pre-processing information. [Figure 6] FIG. 11 is a diagram showing an example of provision definition information. [Figure 7] FIG. 11 is a diagram illustrating an example of a processing procedure performed by the analysis device. [Figure 8] FIG. 11 is a diagram illustrating an example of a processing procedure performed by the analysis device. [Figure 9] FIG. 11 is a diagram illustrating an example of setting information regarding access authority. [Figure 10] FIG. 11 is a diagram illustrating an example of setting information regarding access authority. [Figure 11] FIG. 11 is a diagram illustrating an example of setting information regarding access authority. [Figure 12] FIG. 13 is a diagram showing an example of a screen for accepting input of second pre-processing information. [Figure 13] FIG. 13 is a diagram illustrating an example of an output of an analysis result. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] An embodiment of the present invention will be described with reference to the accompanying drawings. Those marked with the same symbol have the same or similar configuration.

[0010] <System configuration> FIG. 1 is a diagram showing an example of a system configuration of an analysis system 1 according to the present embodiment. The system 1 includes an analysis device 10 and one or more information processing devices 20. The information processing devices 20 are connected to each other via a wireless or wired communication network N. They can communicate with each other.

[0011] The analysis device 10 is a device for which software running on the information processing device 20 is used for the development and It is a device that analyzes whether various compliance standards related to the operation and management are being observed. The analysis device 10 may be a personal computer, or may be one or more servers, etc. It's fine.

[0012] The information processing device 20 is configured to process software to be analyzed (hereinafter, “analysis target software”). The software to be analyzed is the system in which the company has installed IT systems (e.g., a company's internal systems, internal tools, and the systems that a company uses to provide services to its customers) Software used in the development and operation of software for providing services, etc. For example, source code versioning tools, Tools to help generate, manage development and operation work, and access to IT systems Includes tools to control access and manage permissions.

[0013] Various compliance standards for IT systems consist of multiple clauses that set out specific standards. Compliance standards consist of statements such as information security management. ISO27001 and ISO27002, which are standards related to information security systems (ISMS), ISMAP (Information system Security Assessment Program) ity Management and Assessment Program), FISC(The Center for Financial Indus Security standards for computer systems of financial institutions, etc., established by the Japan Society of Financial Institutions Information Systems (JSS). Examples of such guidelines include, but are not limited to, the FISC guidelines.

[0014] The analysis device 10 is configured to analyze the development and operation activities using the software to be analyzed. Analyze whether or not it is possible to explain whether compliance standards are met, and output the analysis results More specifically, the analysis device 10 receives from the information processing device 20 the information set for the software to be analyzed. By acquiring various setting information set in the software and checking the acquired setting information, Developing and operating activities using software meet the provisions of the compliance standards. The results of the analysis are classified into four categories: explainable, partially explainable, and They may be classified into three types: explainable and inexplicable. The state in which the development and operation activities performed meet the specified compliance standards (i.e. It also means that the department is able to explain to a third party that it meets the standards. Being able to be explained in a definite manner means that the development and operation activities using the software under analysis are A state in which compliance standards are partially met (i.e., the standards are partially met) In addition, the term "unexplainable" refers to the state in which the software being analyzed is If development and operation activities using the software do not meet the specified compliance standards, The term refers to a state where the person is unable to explain to a third party that they meet the criteria. The setting information can be obtained using the API (Application Programming Interface). Alternatively, the setting file may be downloaded from the information processing device 20. In the following explanation, the term "compliance standards" may be used. "Whether or not the company meets the compliance standards" is ... Similarly, "whether the provisions are met" is the same as "whether the provisions are met." This is synonymous with "whether it is possible to explain why something is the case."

[0015] For example, a security compliance standard might state, "Users with administrative privileges must Assume that there is a clause stating that "the number of people is N or less." In this case, the analysis device 10 The setting information regarding the authority setting of the user account is obtained from the information processing device 20. By analyzing the configuration information, it is possible to identify N users who have administrator privileges for the software being analyzed. Analyze whether the number of users with administrator privileges is N or less. The analysis device 10 determines whether the development and operation activities using the software to be analyzed satisfy the provisions. It can be determined that this is the case.

[0016] In addition, the analysis device 10 is configured to check whether development and operation activities using the software to be analyzed are compliant. The software to be analyzed was used alone to determine whether it met the application criteria. The analysis may be performed on development and operation activities, or on multiple software For example, the development and operation activities using "administrator privileges" may be analyzed. In the case where there is a provision that states "the number of users who have the same ID and password shall be four or less," the analysis device 10 Acquire setting information regarding permission settings from each of the software to be analyzed, and By aggregating and analyzing the configuration information of multiple target software, Analyze whether the number of authorized users is four or less. For example, for software A, The users who have administrative privileges are users M, N, and P, and they have administrative rights to software B. The users with administrator privileges are users M, Q, and R. In this case, if the software When analyzing development and operation activities using software A alone, Since there are three users with user authority (users M, N, and P), the provision is met. On the other hand, the development and operation activities using both software A and B are analyzed. When this is done, there are five users (users) who have administrator privileges in either software A or B. M, N, P, Q and R), so the provisions are not met.

[0017] <Hardware configuration> 2 is a diagram showing an example of a hardware configuration of the analysis device 10. The analysis device 10 includes a CPU (Central Processing Unit), GPU (Graphics Processing Unit) and other processors1 1. Memory (e.g. RAM (Random Access Memory) or ROM (Read Only Memory)) , a storage device 12 such as a hard disk drive (HDD) and / or a solid state drive (SSD) A network interface (IF) 13 for wired or wireless communication, and a The input device 14 receives information from the input device 14 and outputs information from the output device 15. For example, the output device 15 is a keyboard, a touch panel, a mouse, and / or a microphone. For example, a display, a touch panel and / or a speaker.

[0018] <Function block configuration> FIG. 3 is a diagram showing an example of a functional block configuration of the analysis device 10. The analysis device 10 includes a storage unit 100 , a receiving unit 101 , an acquiring unit 102 , an analyzing unit 103 , and an output unit 104 . The storage unit 100 can be realized by using the storage device 12 included in the analysis device 10. The reception unit 101, the acquisition unit 102, the analysis unit 103, and the output unit 104 are an analysis device 1. 0 by the processor 11 executing a program stored in the storage device 12. The program can be stored in a storage medium. The storage medium storing the program is a computer-readable non-transitory storage medium (Non- A non-transient storage medium may be used. Although not specified, for example, USB (Universal Serial Bus) memory or CD-ROM (Computer The recording medium may be a storage medium such as a DVD (DVD Read-Only Memory).

[0019] The storage unit 100 stores acquired data definition information 100a, first pre-processing information 100b, clause definition information The acquired data definition information 100a stores the first pre-processing information 100c and the second pre-processing information 100d. In order to analyze whether the software meets the compliance criteria, The first preprocessing information 100b indicates the setting information to be obtained from the software to be analyzed. A method for preprocessing the acquired setting information is defined. Specifically, the first preprocessing information 100 is b) describes the processing method for converting the configuration information into data in a format that can be used for analysis, and the configuration information Define the method of generating data to be used for analysis from the software to be analyzed. The setting information obtained from the software is written in a format specific to the software. Therefore, in this embodiment, the first pretreatment The configuration information is pre-processed using the processing information 100b to obtain compliance standards. It is designed to generate data that can be directly used to analyze whether the requirements are met.

[0020] The provision definition information 100c is a method for analyzing whether or not a compliance standard is met. The second pre-processing information 100d defines a plurality of compliance standards and clauses. The development and operation activities using the software to be analyzed meet the compliance standards. This information is used to analyze whether the first preprocessing information 100b is converted or not. The generated data is only about each individual software being analyzed, and is not shared among multiple software. Whether the development and operation activities using the analyzed software meet the compliance standards Therefore, in this embodiment, the second preprocessing Using the information 100d, the data converted or generated according to the first pre-processing information 100b is duplicated. The number of analyses is directly usable for the analysis of development and operation activities using the target software. The data is converted or processed.

[0021] The reception unit 101 receives the designation of the software to be analyzed. Section 101 specifies the provisions to be analyzed among the multiple provisions contained in the compliance standards. The reception unit 101 is also configured to receive the designation of multiple pieces of software to be analyzed. You can do so.

[0022] The acquisition unit 102 acquires the information processing device 20 (device) in which the software to be analyzed is installed. ) to obtain the setting information used when the target software is running. A reference numeral 102 denotes a software installation unit that installs each of the plurality of software to be analyzed that are received by the reception unit 101. The setting information of each of the plurality of pieces of software to be analyzed is acquired from the information processing device 20. The acquisition unit 102 may be provided by the information processing device 20 or the software to be analyzed. Alternatively, the setting information may be acquired by calling an API corresponding to the information processing device 20. Alternatively, a file in which the setting information is described may be downloaded from the

[0023] The analysis unit 103 analyzes the software to be analyzed based on the setting information acquired by the acquisition unit 102. Analyze whether development and operation activities using the software meet compliance standards More specifically, the analysis unit 103 analyzes the clause definitions corresponding to the specified compliance standards. The information 100c is acquired from the storage unit 100. Next, the analysis unit 103 analyzes the acquired setting information The information is preprocessed according to the first preprocessing information 100b to generate preprocessed setting information. The generated pre-processed configuration information and the pre-processed configuration information meet the compliance criteria. The analysis method for whether the condition is satisfied or not is compared with the provision definition information 100c (definition information) in which the condition is satisfied or not. By doing so, it is possible to analyze whether the configuration information satisfies the compliance standards.

[0024] The analysis unit 103 also analyzes the setting information of each of the plurality of pieces of analysis target software. Then, the configuration information of each of the multiple software to be analyzed is collected and evaluated. A clause that defines how to obtain the results and analyze whether or not they meet compliance standards By comparing the definition information 100c (definition information) with the evaluation result, multiple analysis target solutions are Whether development and operation activities using software meet compliance standards Analyze.

[0025] The output unit 104 outputs the analysis results by the analysis unit 103 to a display, a printer, etc. .

[0026] 4 is a diagram showing an example of the acquired data definition information 100a. Since the acquired data definition information 100a differs for each software to be analyzed, It is prepared for each software. A in Figure 4 is the acquisition data definition corresponding to software A. 4 shows an example of the information 100a. Also, B in FIG. 4 shows the acquired data corresponding to the software B. 1 shows an example of data definition information 100a. "Category" indicates the type of category to which the setting information belongs. The types of categories stored in "Category" are explained in Figure 6 below. It is the same as the category type stored in the "Category" of the provisions of the compliance standards. In the example of A in Figure 4, "accessControlList" is setting information related to access authority. "Acquisition method" means the method for acquiring the setting information. "Setting information" means the acquisition method. For example, in the example in Figure 4, API-A1 is called. You can get the setting information called "accessControlList" by calling API-A2. By calling this command, you can obtain configuration information called "logConfig".

[0027] 5 is a diagram showing an example of the first preprocessing information 100b. Since each software is different, the first preprocessing information 100b is The "setting information" indicates the name of the setting information to be preprocessed. The "setting information" indicates the contents of the data obtained by preprocessing the setting information. " shows a method for generating preprocessed data by preprocessing configuration information. However, for example, the processing may be such that information required for analysis is extracted from the setting information. , converting the format of the setting information into another format, etc.

[0028] In the example of A in Figure 5, the number of users who have the authority to change the authority settings of the user ID (authority C) In the accessControlList, "roles / owner", "roles / iam.roleAdmin" or "roles / iam.roleAdmin" Count the number of user accounts for which either "es / iam.securityAdmin" is set. It is defined that the data can be extracted by

[0029] FIG. 6 is a diagram showing an example of the provision definition information 100c. It represents the category type. Note that all or part of the category types that can be stored in "Category" is the same as the type of category that can be stored in the "category" of the acquired data definition information 100a. "Data to be analyzed" indicates the type of data to be used in analyzing the provisions. If the setting information is set in ", the setting information obtained from the software to be analyzed (more Specifically, this means analyzing the clauses using the preprocessed configuration information. If "Data for Analysis" is set to manual input data, the data is manually input by the user. This means that the provisions are analyzed using the software to be analyzed. The settings obtained from the software being analyzed, such as provisions regarding the physical security of the room in which the software is used, There are provisions that cannot be analyzed from the fixed information. In this case, the analysis will be performed using manually entered data from the user's responses.

[0030] "Analysis method" indicates how to analyze the setting information or manually input data. For example, In the example of A in FIG. 6, the setting information after preprocessing is that the number of users having authority A is 1 or less, and If the number of users with authority B is 1 or less, and the number of users with authority C is 1 or less, If the conditions are met, the development and operation activities using the analyzed software are Compliance with No. 1 (access rights) is considered to be "Green (explainable)". It has been shown that the

[0031] <Processing Procedure> Hereinafter, the analysis device 10 is used to analyze one or more components installed in the information processing device 20. The development and operation activities using the software to be analyzed meet the compliance standards. An example of a processing procedure for analyzing whether or not the above-mentioned item is included will be described.

[0032] FIG. 7 is a diagram showing an example of a processing procedure performed by the analysis device 10. Also, FIGS. 9 and 10 are FIG. 11 shows an example of setting information regarding the access authority of software A. 7 and 9 to 11, which are examples of setting information regarding the access authority of A and B, A processing procedure in which the analysis device 10 acquires the setting information of the software to be analyzed and performs pre-processing. Explain.

[0033] In step S10, the reception unit 101 receives from the user one or more pieces of information to be used in development and operation activities. For example, the reception unit 101 receives the specification of the software to be analyzed. The software defined in the definition information 100a is extracted and displayed in a list on the screen. From the list of software displayed in the It may be possible to attach it.

[0034] In step S11, the reception unit 101 receives, from the user, designation of one or more articles to be analyzed. For example, the reception unit 101 receives the compliance information defined in the provision definition information 100c. The insurance company extracts the insurance company's insurance standards and provisions and displays them on the screen as a list. , accepts one or more compliance standards and one or more articles to be analyzed. This is also fine.

[0035] In step S12, the analysis unit 103 refers to the "analysis target data" in the provision definition information 100c. By checking the data, it is possible to determine whether the data used to analyze the specified provisions of the analysis target is setting information or not. Identify whether the data is manually entered or not. If the data used to analyze the provisions is configuration information If the data is manually input, the process proceeds to step S13. If the data is manually input, the process proceeds to step S17. Proceed in order.

[0036] In step S13, the analysis unit 103 generates an acquisition data definition corresponding to the software to be analyzed. With reference to the information 100a, setting information corresponding to the category of the article to be analyzed and the setting information Identify how to obtain it.

[0037] In step S14, the acquisition unit 102 accesses the information processing device 20 and The setting information specified in the step (a) is acquired according to a specified acquisition method. For example, When the acquisition method is API-A1, the acquisition unit 102 acquires the API- By calling A1, the setting information is obtained. For example, When acquiring setting information related to the access authority, the acquisition unit 102 calls the API-A1. Then, the accessControlList is obtained from the analysis target software A. When acquiring setting information regarding the access authority of the software B, the acquisition unit 102 By calling B1, accessControlConf is obtained from the software B to be analyzed.

[0038] In step S15, the acquisition unit 102 acquires first preprocessing information corresponding to the software to be analyzed. 100b, and obtains a pre-processing method corresponding to the setting information obtained in step S14. do.

[0039] In step S16, the analysis unit 103 converts the setting information acquired in step S14 into By processing according to the preprocessing method acquired in S15, the preprocessed setting information (hereinafter, 1) to generate the post-preprocessing setting information.

[0040] Here, a specific example will be described with reference to Figs. 9 and 10. For example, the analysis unit 103 The setting information (accessControlList) of software A shown in FIG. 10 is preprocessed. In this case, the “pre-processing” of “accessControlList” in the first pre-processing information 100b shown in A of FIG. For example, in the example in Figure 9, the number of users is counted based on the "method of managing users." There are two accounts, p and bbb@example.co.jp, and both accounts have roles / ow Similarly, in the example in Figure 10, one account, ccc@example.co.jp, has the authority to exists and has the role / storage.objectviewer permission. The configuration information (accessControlList) of the software A to be analyzed is There are three users (aaa@example.com) who have the authority to access the data (hereafter referred to as "Authority A"). co.jp, bbb@example.co.jp and ccc@example.co.jp) and change the settings for the commercial environment The number of users with authority (hereinafter referred to as "Authority B") is two (aaa@example.co.jp and bbb@e xample.co.jp) and the authority to change the authority settings of the user ID (hereinafter referred to as "Authority C") This indicates that there are two users who have the same domain name (aaa@example.co.jp and bbb@example.co.jp). Then, the setting information after the first pre-processing is generated.

[0041] In addition, the configuration information (accessControlConf) of software B shown in Figure 11 is preprocessed. When performing the preprocessing, the analysis unit 103 uses the “access The number of users is counted based on the “preprocessing method” of “ControlConf”. For example, in Figure 11 In this example, there are three accounts: aaa0001, ddd1234, and eee2345. 4 has admin authority and eee2345 has read authority. The analysis unit 103 then analyzes the setting information (accessControlConf) of the analysis target software B. Therefore, the number of users with authority A is 0, the number of users with authority B is 0, and the number of users with authority C is 0. The configuration information after the first preprocessing shows that the number of users is two (aaa0001 and ddd1234). Generates information.

[0042] In step S17, the acquisition unit 102 acquires the manual input data necessary for analyzing the article to be analyzed. For example, the acquisition unit 102 receives the input of the analysis method defined in B of FIG. The conditions that have been met are displayed on the screen, and the user is prompted to select which conditions are met. The input of input data may be accepted.

[0043] In step 18, the analysis device 10 receives all the clauses that have been accepted as the analysis target from the user. When the processing procedure of steps S12 to S17 has been executed for this, the processing ends. On the other hand, the analysis device 10 receives a status of a part of a clause accepted as an analysis target from a user. If the processing procedure from step S12 to step S17 has not been executed, the processing procedure of step S12 The process returns to the previous step S12 to step S17 for the remaining clauses. .

[0044] FIG. 8 is a diagram showing an example of a processing procedure performed by the analysis device 10. 10 uses the analysis target software based on the setting information after the first preprocessing and the manually input data. This section explains the procedure for analyzing development and operational activities using the ML model.

[0045] In step S21, the reception unit 101 receives the address specified by the user in step S10 (FIG. 7). It is judged whether the software to be analyzed is multiple. In the case where there are multiple target software, that is, development using multiple target software If an analysis is to be performed on issuance and operation behavior, the process proceeds to step S22. When the analyzed software is a standalone software, that is, when the analyzed software is a standalone software, If an analysis is to be performed on the development and operation actions used in step S22, the process proceeds to step S24.

[0046] In step S22, the reception unit 101 receives a request from the user for using a plurality of pieces of software to be analyzed. The second pre-processing information is then input to analyze the development and operation activities. In addition, the reception unit 101 stores the data input by the user in the second pre-processing information 1 in the storage unit 100. The contents of the second pre-processing information received from the user are stored in The combination of multiple software to be analyzed and the For example, in the case of a clause regarding access rights, the second pre-processing information may be Among multiple users with access rights identified from the software configuration information, multiple The second analysis target software may be used to identify a user. The pre-processing information is not input by the user, but is stored in the storage unit 100 in advance. It's fine.

[0047] Here, an example of a method for receiving input of the second pre-processing information will be specifically described with reference to FIG. The reception unit 101 receives second pre-processing information from the user using the screen shown in FIG. The screen in FIG. 12 shows software A and software B to be analyzed. For each of Software B, the names of users who have accounts and their account details According to the contents entered in FIG. 12, User A is Software A's account (aaa@example.co.jp) and Software B's account (aaa0001 ) for software A. User B also has an account for software A (bbb@example. User C also has an account for Software A (ccc@example.co.jp). User D has an account for Software B (ddd1234). In addition, user E has an account for software B (eee2345).

[0048] From the information entered in Figure 12, the account of software A (aaa@example.co.jp) The account for software B (aaa0001) is the same account for user A. In this way, the second pre-processing information is used to identify the accounts of the same software. The information may be information that can identify an account held by the user.

[0049] In step S23, the analysis unit 103 uses the second preprocessing information and the setting information after the first preprocessing. In this case, the setting information after preprocessing for multiple target software (hereinafter referred to as "second preprocessing") is The second pre-processed setting information described below is generated by generating multiple It can be said that this information is a compilation of the configuration information after the first preprocessing of each software to be analyzed. Therefore, it may be called "aggregated information."

[0050] As described in step S16 (FIG. 7), in the examples of FIGS. 9 to 11, the analysis unit 103 For the configuration information (accessControlList) of the target software A, The number of users is three (aaa@example.co.jp, bbb@example.co.jp, and ccc@example.co.jp). The number of users with authority B is two (aaa@example.co.jp and bbb@example.co.jp). The number of users with limit C is two (aaa@example.co.jp and bbb@example.co.jp). The analysis unit 103 generates the setting information after the first pre-processing shown in FIG. Regarding the setting information (accessControlConf) of A B, the number of users with authority A is 0, The number of users with authority B is 0, and the number of users with authority C is 2 (aaa0001 and ddd12 34), we generated setting information after the first preprocessing.

[0051] As described in step S22, the second pre-processing information is The account (aaa@example.co.jp) and the account (aaa0001) of Software B are the same user. In other words, the information entered indicates that it is the account of User A. A user with authority C in software A and a user with authority C in software B The user of aaa0001 who has C is the same person. For software A and B, the number of users with authority A is three (3+0), and The number of users with authority B is 2 (2+0), and the number of users with authority C is 3 (2+2- 1) The second pre-processed setting information is generated, which indicates that the second pre-processed setting information is the same as the first pre-processed setting information.

[0052] In step S24, the analysis unit 103 analyzes the pre-processed setting information (first pre-processed setting information or The second analyzes the clause based on the clause definition information. In step S21, if the software to be analyzed designated by the user is a single piece of software, The analysis unit 103 analyzes the setting information after the first pre-processing and the clauses corresponding to the one or more clauses to be analyzed. By comparing the analysis information, the development and operation activities using the software to be analyzed On the other hand, in step S21, the system analyzes whether the user-specified clause is satisfied. When there are a plurality of pieces of analysis target software, the analysis unit 103 performs the second pre-processing on the setting information. , and compare the article analysis information corresponding to one or more articles to be analyzed, Analyze whether the development and operation activities using the target software meet the provisions. For example, the setting information after the second pre-processing generated in the example described in step S23 and A in FIG. When comparing the example of the second pre-processing with the article No. 1 of the Compliance Standard A, The number of users with authority C is three, so it falls under Red (unexplainable). It will be determined that:

[0053] In step S25, the output unit 104 outputs the analysis result for the one or more articles to be analyzed. FIG. 13 shows an example of the analysis result output. In the example of FIG. 13, the analysis target software A and The development and operation activities using both A and B meet Article No. 1 of Compliance Standard A. As a result of analyzing whether or not the product complies with the provisions, the analysis result shows that it is impossible to explain whether the product complies with the provisions. In addition, it has been confirmed that the company complies with Article 2 of Compliance Standard A. The analysis results show that it is explainable.

[0054] In the present embodiment described above, the acquired data definition information 100a, the first pre-processing information 10 0b, the provision definition information 100c, and the second pre-processing information 100d are all or part of the information indicated by The processing logic and the program of the analysis device 10 are not stored in the memory unit 100. For example, the acquired data definition information 100a may be embedded in the profile of the analysis device 10. If the processing logic is embedded in the program, the processing procedure in step S13 of FIG. In the analysis, the analysis unit 103 determines the category of the clause to be analyzed according to the processing logic. The setting information corresponding to the above and the method for acquiring the setting information may be specified.

[0055] <Summary> According to the embodiment described above, the analysis device 10 extracts the relevant Whether software development and operation activities meet compliance standards By acquiring the configuration information necessary for the analysis of the software, Analyze whether the development and operation activities used meet compliance standards. This allows software-based development and operation activities to be handled by IT systems. This will enable automated analysis of compliance with applicable standards. The above-described embodiment is intended to facilitate understanding of the present invention and does not limit the present invention. The flowcharts, sequences, and implementations described in the embodiments are not intended to be interpreted as being related to the present invention. The elements of the embodiment, as well as their arrangement, materials, conditions, shapes, sizes, etc. are merely examples. The present invention is not limited to the above and may be modified as appropriate. The components may be partially substituted or combined. [Explanation of symbols]

[0056] 1 Analysis system, 10 Analysis device, 11 Processor, 12 Storage device, 13 Network network IF, 14 input device, 15 output device, 20 information processing device, 100 storage unit , 100a acquired data definition information, 100b first pre-processing information, 100c provision definition information , 100d second pre-processing information, 101 reception unit, 102 acquisition unit, 103 analysis unit, 10 4 Output section

Claims

1. a reception unit that receives designation of software to be analyzed; an acquisition unit that acquires, from a device in which the software to be analyzed is installed, setting information used when the software to be analyzed operates; an analysis unit that analyzes whether or not it is possible to explain whether development and operation actions utilizing the software to be analyzed satisfy compliance standards for IT systems based on the setting information; an output unit that outputs an analysis result by the analysis unit; having the reception unit receives designation of a plurality of pieces of analysis target software to be analyzed, and second preprocessing information for analyzing development and operation actions utilizing the plurality of pieces of analysis target software, the second preprocessing information being determined for each combination of the plurality of pieces of analysis target software; the acquiring unit acquires the setting information of each of the plurality of pieces of analysis target software from a device in which each of the plurality of pieces of analysis target software is installed; The analysis unit includes: generating setting information after a first preprocessing for each of the plurality of software to be analyzed by analyzing the setting information of each of the plurality of software to be analyzed based on first preprocessing information that indicates, for each software to be analyzed, a method of performing preprocessing on the setting information; by analyzing setting information after the first pre-processing for each of the plurality of software to be analyzed based on the second pre-processing information, obtaining setting information after the second pre-processing which is an aggregate of the setting information after the first pre-processing for each of the plurality of software to be analyzed, and by comparing the setting information after the second pre-processing with definition information defining an analysis method for explaining whether or not it is possible to explain whether the compliance standard is satisfied, analyzing whether or not it is possible to explain whether the development and operation actions utilizing the plurality of software to be analyzed are satisfied with the compliance standard; Analyzer.

2. the analysis unit performs preprocessing on the setting information to generate preprocessed setting information, and compares the generated preprocessed setting information with definition information that defines an analysis method for determining whether or not it is possible to explain whether the preprocessed setting information satisfies the compliance standard, thereby analyzing whether or not it is possible to explain whether the setting information satisfies the compliance standard. The analytical device of claim 1 .

3. An analysis method performed by an analysis device, comprising: Receiving designation of software to be analyzed; acquiring setting information used when the analysis target software operates from a device in which the analysis target software is installed; analyzing whether it is possible to explain whether development and operation actions utilizing the software to be analyzed satisfy compliance standards for IT systems based on the setting information; outputting an analysis result from the analyzing step; Including, The receiving step receives designation of a plurality of software to be analyzed, and second preprocessing information for analyzing development and operation actions utilizing the plurality of software to be analyzed, the second preprocessing information being determined for each combination of the plurality of software to be analyzed; The acquiring step includes acquiring the setting information of each of the plurality of pieces of analysis target software from a device in which each of the plurality of pieces of analysis target software is installed, The analyzing step includes: generating setting information after a first preprocessing for each of the plurality of software to be analyzed by analyzing the setting information of each of the plurality of software to be analyzed based on first preprocessing information that indicates, for each software to be analyzed, a method of performing preprocessing on the setting information; by analyzing setting information after the first pre-processing for each of the plurality of software to be analyzed based on the second pre-processing information, obtaining setting information after the second pre-processing which is an aggregate of the setting information after the first pre-processing for each of the plurality of software to be analyzed, and by comparing the setting information after the second pre-processing with definition information defining an analysis method for explaining whether or not it is possible to explain whether the compliance standard is satisfied, analyzing whether or not it is possible to explain whether the development and operation actions utilizing the plurality of software to be analyzed are satisfied with the compliance standard; Analysis method.

4. On the computer, Receiving designation of software to be analyzed; acquiring setting information used when the analysis target software operates from a device in which the analysis target software is installed; analyzing whether it is possible to explain whether development and operation actions utilizing the software to be analyzed satisfy compliance standards for IT systems based on the setting information; outputting an analysis result from the analyzing step; Run the command, The receiving step receives designation of a plurality of software to be analyzed, and second preprocessing information for analyzing development and operation actions utilizing the plurality of software to be analyzed, the second preprocessing information being determined for each combination of the plurality of software to be analyzed; The acquiring step includes acquiring the setting information of each of the plurality of pieces of analysis target software from a device in which each of the plurality of pieces of analysis target software is installed, The analyzing step includes: generating setting information after a first preprocessing for each of the plurality of software to be analyzed by analyzing the setting information of each of the plurality of software to be analyzed based on first preprocessing information that indicates, for each software to be analyzed, a method of performing preprocessing on the setting information; by analyzing setting information after the first pre-processing for each of the plurality of software to be analyzed based on the second pre-processing information, obtaining setting information after the second pre-processing which is an aggregate of the setting information after the first pre-processing for each of the plurality of software to be analyzed, and by comparing the setting information after the second pre-processing with definition information defining an analysis method for explaining whether or not it is possible to explain whether the compliance standard is satisfied, analyzing whether or not it is possible to explain whether the development and operation actions utilizing the plurality of software to be analyzed are satisfied with the compliance standard; program.

Images