Information processing device, information processing method, and program

Abstract

To provide simple and inexpensive security measures for a plurality of monitoring target devices. [Solution] An information processing device comprising: an acquisition unit that acquires report information regarding the security of each of the multiple monitored devices collected by an agent unit which is an application program running on each of the multiple monitored devices; an analysis unit that aggregates the report information regarding the security of each of the multiple monitored devices and performs security analysis on the aggregated report information; and a notification unit that visualizes the results of the security analysis and notifies a terminal device.

Description

[Technical field]

[0001] The present invention relates to an information processing device, an information processing method, and a program. [Background technology]

[0002] Conventionally, in order to respond to security events such as cyber attacks on computer systems built within a company, techniques have been disclosed for monitoring the constituent devices within the computer systems. For example, Patent Document 1 discloses a technique for collecting and analyzing log data from monitored devices within a computer system, and notifying a security officer of the detected fraud if the fraud is detected. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2020-161017 A Summary of the Invention [Problem to be solved by the invention]

[0004] However, the above-mentioned technology only acquires log data from the monitored devices, and there are cases where security events of the monitored devices cannot be analyzed in a high level. Furthermore, the conventional technology, for example, when implementing security measures for multiple systems managed by a group company that provides multiple services, involves complex implementation and high costs for each system. In other words, there are cases where security measures cannot be implemented easily and inexpensively for multiple monitored devices.

[0005] The present invention has been made in consideration of the above circumstances, and one of its objectives is to provide an information processing device, an information processing method, and a program that can implement security measures for multiple monitored devices simply and inexpensively. [Means for solving the problem]

[0006] One aspect of the present invention is an information processing device comprising: an acquisition unit that acquires report information regarding the security of each of a plurality of monitored devices collected by an agent unit that is an application program running on each of the plurality of monitored devices; an analysis unit that aggregates the report information regarding the security of each of the plurality of monitored devices and performs security analysis on the aggregated report information; and a notification unit that visualizes the results of the security analysis and notifies a terminal device. Effect of the Invention

[0007] According to one aspect of the present invention, it is possible to provide an information processing device, an information processing method, and a program that can easily and inexpensively implement security measures for a plurality of monitoring target devices. [Brief description of the drawings]

[0008] [Figure 1] 1 is an exemplary configuration diagram of a system 1 including an information processing device 100 according to the present embodiment. [Diagram 2] 1 is an exemplary configuration diagram of an information processing device 100 according to an embodiment of the present invention. [Diagram 3] FIG. 2 is an exemplary configuration diagram of a service server 200 according to the present embodiment. [Figure 4] 2 is a diagram showing an example of log data 222 collected by a log data collection function 212 of an agent unit 210. FIG. [Diagram 5] 2 is a diagram showing an example of file monitoring data 224 collected by a file monitoring function 214 of an agent unit 210. FIG. [Figure 6] 2 is a diagram showing an example of security setting evaluation data 226 collected by a security setting evaluation function 216 of an agent unit 210. FIG. [Figure 7] 2 is a diagram showing an example of vulnerability assessment data 228 collected by a vulnerability assessment function 218 of an agent unit 210. FIG. [Figure 8] 1 is a diagram showing an example of a result of security analysis by an analysis unit 120, displayed on the terminal device 10. FIG. [Figure 9] 13 is a diagram showing another example of the result of security analysis by the analysis unit 120, displayed by the terminal device 10. FIG. [Figure 10] 13 is a diagram showing another example of the result of security analysis by the analysis unit 120, displayed by the terminal device 10. FIG. [Figure 11] 10 is a flowchart showing an example of the flow of processing executed by the information processing device 100 according to the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, an information processing device, an information processing method, and a program according to an embodiment of the present invention will be described with reference to the drawings.

[0010] [Overall configuration] FIG. 1 is an exemplary configuration diagram of a system 1 including an information processing device 100 according to this embodiment. The system 1 includes, for example, a terminal device 10, one or more service systems 20, and the information processing device 100. In this embodiment, as an example, a case will be described in which the one or more service systems 20 are configured by a service system 20A that provides an electronic payment service and a service system 20B that provides a shopping site service. These service systems 20A and 20B are operated, for example, by the same group company. The same group company may provide a different number or types of service systems.

[0011] The terminal device 10 is a computer device such as a smartphone, a tablet terminal, or a personal computer. As described later, the terminal device 10 receives the result of the security analysis performed by the information processing device 100 via the network NW and displays it on a display unit such as a display. The network NW includes, for example, the Internet, a LAN (Local Area Network), a wireless base station, a provider device, and the like. In particular, as shown in FIG. 1, the terminal device 10 includes not only a user terminal device (i.e., a terminal device of a user who manages the security of the entire group company) that uses the information processing device 100, but also a terminal device 10A (hereinafter, a service system terminal device) of a user who manages the security of the service system 20A and a terminal device 10B of a user who manages the security of the service system 20B. The service system terminal devices 10A and 10B are examples of the "security management terminal" in the claims.

[0012] The service system 20 includes components such as a plurality of servers and network devices for realizing a function of providing a predetermined service (for example, an electronic payment service, a shopping site service, a communication service, etc.). For example, in FIG. 1, the service system 20A includes components such as a service server 200A_1 and a service server 200A_2 that cooperate to realize an electronic payment service, and an information linking server 200A_C for linking information related to the security of the service system 20A to the information processing device 100, and the service system 20B includes components such as a service server 200B_1, a service server 200B_2, and a service server 200B_3 that cooperate to realize a shopping site service, and an information linking server 200B_C for linking information related to the security of the service system 20B to the information processing device 100. In the following description, when the service servers are not distinguished from each other, they are collectively referred to as the service server 200. The service server 200 is an example of a "monitored device" in the claims.

[0013] The service server 200 is equipped with a server function for providing a predetermined service in cooperation with other servers and network devices, and is equipped with an agent unit 210, which is an application program that collects information on security occurring in the service server 200. In FIG. 1, for the sake of simplicity of explanation, one agent unit 210 is equipped (installed) for each service server 200. However, the present invention is not limited to such a configuration, and the agent unit 210 may be provided in devices (e.g., network devices) other than the servers constituting the service system 20, or the agent unit 210 may be provided only in some of the service servers 200 that require monitoring. Each agent unit 210 collects information on security occurring in the service server 200 on which it operates, and transmits the collected information to the information linking server 200_C. The information linking server 200_C aggregates the information on security collected from the agent units 210 belonging to each service system 20, and transmits it to the information processing device 100. FIG. 1 shows an example in which information linking server 200A_C and information linking server 200B_C transmit collected information to information processing device 100 on behalf of service system 20A and service system 20B, respectively. However, each service server 200 may transmit collected information to information processing device 100 independently.

[0014] [Information processing device] FIG. 2 is an exemplary configuration diagram of the information processing device 100 according to the present embodiment. The information processing device 100 includes, for example, an acquisition unit 110, an analysis unit 120, a notification unit 130, and a storage unit 140. The acquisition unit 110, the analysis unit 120, and the notification unit 130 are realized by, for example, a hardware processor such as a CPU executing a program (software). Some or all of these components may be realized by hardware (including circuitry) such as an LSI (Large Scale Integration), an ASIC (Application Specific Integrated Circuit), an FPGA (Field-Programmable Gate Array), or a GPU (Graphics Processing Unit), or may be realized by cooperation between software and hardware. The program may be stored in advance in a storage device (a storage device having a non-transient storage medium) such as an HDD (Hard Disk Drive) or a flash memory, or may be stored in a removable storage medium (non-transient storage medium) such as a DVD or a CD-ROM, and installed in the storage device by mounting the storage medium in a drive device. The storage unit 140 is a HDD, a flash memory, a RAM (Random Access Memory), etc. The storage unit 140 may be a NAS (Network Attached Storage) device that the information processing device 100 can access via a network. The storage unit 140 stores information such as agent report information 142, security rule information 144, and analysis information 146.

[0015] The acquisition unit 110 acquires information related to the security of the service server 200 collected by the agent unit 210. The analysis unit 120 aggregates report information related to each of the one or more service servers 200 acquired by the acquisition unit 110, and performs security analysis on the aggregated report information. The notification unit 130 visualizes the results of the security analysis and notifies the terminal device 10. The operations of the acquisition unit 110, the analysis unit 120, and the notification unit 130 will be described in detail later.

[0016] [Service Server] 3 is an exemplary configuration diagram of the service server 200 according to this embodiment. The storage unit 220 is a HDD, a flash memory, a RAM (Random Access Memory), etc. The storage unit 220 may be a NAS (Network Attached Storage) device that the service server 200 can access via a network.

[0017] 3, the agent unit 210 has, as the functions of the application program, for example, a log data collection function 212, a file monitoring function 214, a security setting evaluation function 216, and a vulnerability evaluation function 218. As the execution results of these functions, the agent unit 210 stores information such as log data 222, file monitoring data 224, security setting evaluation data 226, and vulnerability evaluation data 228 in the storage unit 220. Thereafter, the agent unit 210 transmits the information stored in the storage unit 220 as report information to the information processing device 100 via the network NW. The acquisition unit 110 of the information processing device 100 stores the received report information in the storage unit 140 as agent report information 142. The above functions executed by the agent unit 210 will be described in detail below.

[0018] [Log data collection function] 4 is a diagram showing an example of log data 222 collected by the log data collection function 212 of the agent unit 210. The log data 222 includes information such as an IP address, date and time, user name, action, transfer amount, OS, browser, etc. The IP address indicates the IP address of the access source user who accessed the service server 200. By collecting the IP address, for example, regional information (country, city, town, village, etc.) of the access source can be identified. The date and time indicates the date and / or time when the access source user accessed the service server 200.

[0019] The user name indicates an authenticated user name when authentication is required to access the service server 200. On the other hand, when authentication is not required to access the service server 200, the user name is set to, for example, blank. The action indicates an action performed on the service server 200 by a user (or an unspecified user) associated with the user name. The action indicates, for example, an HTTP method such as GET, POST, PUT, or DELETE. The status indicates a status code for the performed action. The status code identifies, for example, the success / failure of the performed action. The transfer amount indicates the amount of data (for example, in bytes) transmitted and received by the service server 200 in association with the action. The OS and browser indicate the OS and browser used by the access source. The agent unit 210 uses the log data collection function 212 to collect log data 222 every time an access to the service server 200 occurs, and stores the log data 222 in the storage unit 220.

[0020] [File monitoring function] 5 is a diagram showing an example of file monitoring data 224 collected by the file monitoring function 214 of the agent unit 210. The file monitoring data 224 includes information such as a monitoring target folder path, a latest check date and time, a file name, a hash value, and a check result. The monitoring target folder path indicates a path to a folder set as a monitoring target among folders managed by the service server 200. When the monitoring target folder path is set by the administrator of the information processing device 100, for example, the agent unit 210 accesses the monitoring target folder path at a predetermined cycle (for example, once a day) and checks the consistency of the stored files.

[0021] More specifically, for example, the agent unit 210 calculates a hash value from each file stored in the monitored folder according to a predetermined algorithm, and judges whether the calculated hash value matches the hash value calculated in the previous cycle (if the file has been modified by an authenticated user, the match judgment may be performed taking into account the modification). If it is judged that the hash values ​​match, the agent unit 210 records in the file monitoring data 224 that the file is consistent as a check result, whereas if it is judged that the hash values ​​do not match, the agent unit 210 records in the file monitoring data 224 that the file is inconsistent as a check result. The agent unit 210 stores the file monitoring data 224 in the storage unit 220 every time it checks the consistency of the monitored folder. As another example of the file monitoring function 214, the agent unit 210 may record file operations (creating a new file, modifying and deleting an existing file, etc.) performed in the monitored folder as a log in the file monitoring data 224.

[0022] [Security settings evaluation function] FIG. 6 is a diagram showing an example of security setting evaluation data 226 collected by the security setting evaluation function 216 of the agent unit 210. The security setting evaluation data 226 is data obtained by evaluating whether or not a file / program managed by the service server 200 matches a rule set in advance by the administrator of the information processing device 100. For example, in FIG. 6, rule R1 represents a rule for extracting a file whose password has not been changed for a predetermined period (e.g., 100 days), and rule R2 represents a rule for extracting a file / program whose access has not been made for a predetermined period (e.g., 100 days). When a rule is set by the administrator of the information processing device 100, the agent unit 210 determines whether or not a file / program matching the set rule exists at a predetermined cycle (e.g., once a day), and when a file / program matching the set rule is identified, the agent unit 210 stores identification information of the identified file / program in the storage unit 220 as the security setting evaluation data 226. At this time, the agent unit 210 may also record the number of files / programs that match the rule out of all the files / programs that were evaluated (for example, 2 / 76 and 1 / 76, respectively), as shown in FIG. 6.

[0023] 6, the security setting evaluation function 216 includes, for example, an information area I1 relating to a change in security measures executed by the service server 200. For example, when the service server 200 updates a security program or creates, changes, or deletes a setting file, the agent unit 210 collects the file that is the target of the change and detailed information about the file.

[0024] [Vulnerability assessment data] FIG. 7 is a diagram showing an example of vulnerability assessment data 228 collected by the vulnerability assessment function 218 of the agent unit 210. The vulnerability assessment data 228 is data obtained by the agent unit 210 performing a predetermined vulnerability assessment on a program managed by the service server 200. For example, the agent unit 210 acquires information on the program stored in the service server 200 (e.g., program code) and OS information on the service server 200 (e.g., OS name and version), and compares the information with a vulnerability database (here, the vulnerability database may be provided by any of the information processing device 100, the service server 200, or an external cloud server), thereby assessing the vulnerability of the program for each item. When the assessment is completed, the agent unit 210 stores the assessment result for each vulnerability item evaluated as vulnerability assessment data 228 in the storage unit 220. FIG. 7 shows an example in which the agent unit 210 has assessed the vulnerability of 25 files for the items "SQL injection" and "cross-site scripting". At this time, the agent unit 210 may also record the number of programs that have been evaluated as having vulnerabilities (the number of "fails" in FIG. 7) detected among all the programs that have been evaluated, as shown in FIG.

[0025] [Security Analysis] When the acquiring unit 110 acquires the log data 222, the file monitoring data 224, the security setting evaluation data 226, and the vulnerability assessment data 228 from the agent unit 210, the acquiring unit 110 consolidates the data as agent report information 142 and stores the data in the storage unit 140. The analyzing unit 120 performs a security analysis on the agent report information 142, and stores the result of the security analysis in the storage unit 140 as analysis information 146. The notifying unit 130 visualizes the result of the security analysis and notifies the terminal device 10.

[0026] FIG. 8 is a diagram showing an example of the result of security analysis by the analysis unit 120 displayed by the terminal device 10. FIG. 8 shows, as an example, the result of security analysis performed by the analysis unit 120 on the log data 222. In FIG. 8, an area AR1 represents an area for selecting a target period for security analysis, an area AR2 represents an area for selecting a target service system for security analysis, and an area AR3 represents an area for selecting a target agent unit for security analysis. Areas AR4 to AR9 each represent the result of security analysis performed on the log data 222. FIG. 8 shows a case in which a user of the terminal device 10 selects February 1, 2024 to February 29, 2024 as a target period and selects all agent units 210 included in all service systems 20A and 20B of the electronic payment service and shopping site service as analysis targets.

[0027] For example, as shown in area AR4, the analysis unit 120 can identify the number of unique visitors in the target period by tallying up the user name data and date and time data included in the log data 222, and the notification unit 130 can notify the terminal device 10 of information related to the identified number of unique visitors. Here, the unique visitors refer to the number of users who accessed the service server 200 in the target period (excluding multiple overlapping accesses by the same user). As another aspect, the analysis unit 120 may identify the number of accesses to the service server 200 in the target period (including multiple overlapping accesses by the same user) and have the notification unit 130 notify the number.

[0028] Also, for example, as shown in area AR5, the analysis unit 120 can identify the breakdown of OSs used by unique visitors in the target period by aggregating OS data included in the log data 222, and the notification unit 130 can notify the terminal device 10 of information related to the identified breakdown of OSs. As another aspect, the analysis unit 120 can identify the breakdown of browsers used by unique visitors in the target period by aggregating browser data included in the log data 222.

[0029] Also, for example, as shown in area AR6, the analysis unit 120 can identify country information from which unique visitors access during the target period by aggregating IP addresses included in the log data 222, and the notification unit 130 can notify the terminal device 10 of the nationality information. As another aspect, the analysis unit 120 may identify the access source of unique visitors during the target period at a level different from the country (for example, the city / town / village level) and notify the terminal device 10. In addition to notifying information on the access source, the notification unit 130 may determine that a security threat has occurred when the number of visits or the visit ratio from a specific country or region exceeds a threshold value, and notify the terminal device 10 of that fact.

[0030] Also, for example, as shown in area AR7, the analysis unit 120 can identify a transition in the number of issued status codes for actions taken by a user on the service server 200 by aggregating status data included in the log data 222, and the notification unit 130 can notify the terminal device 10 of the identified transition in the status codes. In FIG. 8, as an example, the notification unit 130 notifies the terminal device 10 of the HTTP status code 200 indicating a successful request from the client and the HTTP status code 400 indicating a failed request from the client, but the notification unit 130 may identify a transition in the number of issued status codes of other status codes. In addition to notifying the transition in the number of issued status codes, the notification unit 130 may determine that a security threat has occurred and notify the terminal device 10 of the occurrence when the number or rate of issued status codes indicating an error, such as the HTTP status code 400, exceeds a threshold value.

[0031] Also, for example, as shown in area AR8, the analysis unit 120 can identify the transition of the amount of data that the service server 200 has transmitted and received with an external terminal by aggregating the transfer amounts included in the log data 222, and the notification unit 130 can notify the terminal device 10 of the identified transition of the transfer amount. In addition to notifying the transition of the transfer amount, the notification unit 130 may determine that a security threat has occurred and notify the terminal device 10 when the transfer amount or a deviation from a standard transfer amount (for example, a moving average) exceeds a threshold value.

[0032] Also, for example, as shown in area AR9, the analysis unit 120 can identify a transition in the file type transferred by the service server 200 to an external terminal by tallying up the actions included in the log data 222, and the notification unit 130 can notify the terminal device 10 of the transition in the identified file type. When the number of transfers or the transfer rate of the identified file type reaches or exceeds a threshold, the notification unit 130 may determine that a security threat has occurred and notify the terminal device 10 of that fact.

[0033] Also, for example, as shown in area AR10, the analysis unit 120 may generate notification information related to security by comparing the log data 222 with a predetermined rule or by using other data (at least one of the file monitoring data 224, the security setting evaluation data 226, and the vulnerability assessment data 228). For example, as shown in Fig. 8, the analysis unit 120 may generate alert information related to unauthorized access by comparing the log data 222 with a rule related to the IP address of the access source (for example, a whitelist). Also, for example, the analysis unit 120 may generate information on changes to security measures that have occurred in each service based on the security setting evaluation data 226.

[0034] 8, the result of security analysis by the analysis unit 120 for all services is displayed. For example, when a user operates the selection area AR2 to select the first service or the second service, the notification unit 130 filters the selected first service or second service and displays it on the terminal device 10. At this time, the notification unit 130 may enable the terminal device 10 to select all services, the first service, and the second service, while enabling the service system terminal device 10A to select only the first service and the service system terminal device 10B to select only the second service.

[0035] In this way, the security personnel of a group company operating a plurality of service systems 20 (for example, an electronic payment service system, a shopping site service system, etc.) do not need to perform security analysis for each of the different service systems 20 separately, but install a common agent unit 210 in the service servers 200 and network devices that constitute those systems, and the analysis unit 120 performs an integrated analysis of log data collected from these agent units 210. This allows the security personnel of the group company to easily and inexpensively monitor security events for a plurality of different services on the same interface, thereby reducing the burden on the security personnel and the group company. Furthermore, the security administrator of the entire group company, the security administrator of the first service, and the security administrator of the second service can view the results of security analysis using the common information processing device 100 (i.e., as a multi-tenant), thereby reducing the effort and cost required for each service to perform its own security analysis. At this time, the security administrator of a specific service can restrict access so that only the security information of that service can be viewed, thereby reducing the risk of security information leaking between group companies and security violations occurring.

[0036] Fig. 9 is a diagram showing another example of the result of security analysis by the analysis unit 120, displayed by the terminal device 10. Fig. 9 shows, as an example, the result of security analysis performed by the analysis unit 120 to determine whether the service system 20A providing an electronic payment service satisfies the requirements stipulated in the Payment Card Industry Data Security Standard (PCI DSS), which is a global security standard in the credit card industry. The requirements stipulated in the PCI DSS are an example of the security rule information 144 in this embodiment.

[0037] For example, requirement 11.5.2 of PCI DSS requires a service provider that provides a credit card payment service to implement a file change detection mechanism. As shown in FIG. 5, the agent unit 210 monitors files in a folder managed by the service server 200 by the file monitoring function 214. Therefore, when the file monitoring data 224 contains a description of "inconsistency", the analysis unit 120 detects the possibility that the service server 200 violates requirement 11.5.2 of PCI DSS, and the notification unit 130 can notify the terminal device 10 of the possibility. At this time, as shown in the right part of the area AR11, the notification unit 130 may display a send button as an interface to notify a person in charge of the possibility of a violation of the requirements of PCI DSS. When the send button is pressed, for example, the terminal device 10 may notify the possibility of a violation of the requirements of PCI DSS to an email address of a person in charge of the service server 200 registered in advance (more precisely, a person in charge of the service server 200A_1 that includes the agent 210A_1).

[0038] Also, for example, requirement 2.2.4 of PCI DSS requires service providers providing credit card settlement services to implement only functions necessary for providing the service. As shown in Fig. 6, the agent unit 210 monitors the access status to files / programs managed by the service server 200 by the security setting evaluation function 216. Therefore, when the security setting evaluation data 226 contains a description of "files / programs not accessed for a specified period of time," the analysis unit 120 detects that the service server 200 may be in violation of requirement 2.2.4 of PCI DSS, and the notification unit 130 can notify the terminal device 10 of the possibility.

[0039] Also, for example, requirement 6.3.3 of PCI DSS requires service providers providing credit card settlement services to implement security measures to protect against system vulnerabilities. As shown in Fig. 7, the agent unit 210 evaluates vulnerabilities in programs managed by the service server 200 using the vulnerability assessment function 218. Therefore, when there is a description indicating a vulnerability in the vulnerability assessment data 228, the analysis unit 120 detects the possibility that the service server 200 may be in violation of requirement 6.3.3 of PCI DSS, and the notification unit 130 can notify the terminal device 10 of the possibility.

[0040] 9, the result of the compliance check performed by the analysis unit 120 on the first service is displayed. For example, when the user operates the selection area AR2 to select all services or the second service, the analysis unit 120 may perform a compliance check on the selected all services or the second service, and the notification unit 130 may display the result on the terminal device 10. At this time, similar to FIG. 8, the notification unit 130 may enable the terminal device 10 to select all services, the first service, and the second service, while enabling the service system terminal device 10A to select only the first service, and the service system terminal device 10B to select only the second service.

[0041] In this way, the analysis unit 120 analyzes whether the service system 20 providing the specific service complies with the security requirements related to the business type of the specific service based on the report information collected from the agent unit, and the notification unit 130 visualizes the analysis result and notifies the terminal device 10. This allows the security personnel of the company that develops the specific service to easily understand whether the service system 20 providing the specific service properly complies with the security requirements. Furthermore, the security administrator of the entire group of companies, the security administrator of the first service, and the security administrator of the second service can view the results of the compliance check using the common information processing device 100 (i.e., as a multi-tenant), thereby reducing the effort and cost required for each service to independently perform a compliance check. At this time, the security administrator of the specific service can limit access so that only the results of the compliance check for that service can be viewed, thereby reducing the risk of security information leaking between group companies and security violations occurring.

[0042] In the present embodiment, an example has been described in which it is determined whether or not the service system 20A providing an electronic payment service satisfies the requirements of PCI DSS, which is the security rule information 144. However, the present invention is not limited to such a configuration, and for example, in the case where the service system 20 provides a medical information service, it may be determined whether or not the service system 20 satisfies the requirements of HIPAA (Health Insurance Portability and Accountability), which is the security rule information 144. More generally, the security rule information 144 does not need to be a rule specialized for a specific industry such as PCI DSS or HIPAA, but may be defined as a CIS (Center of Internet Security) benchmark that is universally applicable to all industries, and may be compared with the report information by the analysis unit 120.

[0043] Fig. 10 is a diagram showing another example of the result of security analysis by the analysis unit 120, displayed by the terminal device 10. Fig. 10 shows, as an example, the result of a unified vulnerability check performed by the analysis unit 120 on all agents of all services operated by a group company.

[0044] The analysis unit 120, for example, determines whether or not there is a description indicating a vulnerability in the vulnerability assessment data 228 based on the vulnerability assessment data 228 acquired from each agent unit 210 of each service system 20. When it is determined that there is a description indicating a vulnerability in the vulnerability assessment data 228, the analysis unit 120, for example, consolidates target files and detailed information for each service and agent for which a vulnerability has been determined as a list, stores the list as analysis information 146, and notifies the notification unit 130. At this time, similarly to the case of FIG. 10, the notification unit 130 may display, as an interface, a send button for notifying a person in charge of a concern about a vulnerability.

[0045] 10, the result of the vulnerability check performed by the analysis unit 120 on all services is displayed. For example, when a user operates the selection area AR2 to select the first service or the second service, the analysis unit 120 may perform a vulnerability check on the selected first service or the second service, and the notification unit 130 may display the result on the terminal device 10. At this time, similarly to FIG. 8, the notification unit 130 may enable the terminal device 10 to select all services, the first service, and the second service, while enabling the service system terminal device 10A to select only the first service, and enabling the service system terminal device 10B to select only the second service.

[0046] In this way, a security officer of a group company that operates multiple service systems 20 can instruct the execution of security analysis for multiple service systems 20 on the same interface and grasp the execution results, without having to perform security analysis separately for each different service system 20. This allows the security officer of the group company to easily and inexpensively perform security analysis for multiple different services, reducing the burden on the security officer and the group company. Furthermore, the security administrator of the first service and the security administrator of the second service can view the results of the security analysis using the information processing device 100 that is shared with the security administrator of the entire group company (i.e., as a multi-tenant), reducing the effort and cost required for each service to perform its own security analysis.

[0047] [Processing flow] Next, the flow of processing executed by the information processing device 100 according to this embodiment will be described with reference to Fig. 11. Fig. 11 is a flowchart showing an example of the flow of processing executed by the information processing device 100 according to this embodiment.

[0048] First, the acquisition unit 110 acquires agent report information 142 from multiple agent units 210 (step S100). Next, the analysis unit 120 aggregates the acquired agent report information and executes security analysis (step S102). Next, the notification unit 130 visualizes the results of the security analysis and notifies the terminal device 10 (step S104). This ends the processing of this flowchart.

[0049] According to the embodiment described above, report information on the security of each of the multiple monitored devices is acquired, collected by an agent unit that is an application program that runs on each of the multiple monitored devices, the report information on the security of each of the multiple monitored devices is aggregated, security analysis is performed on the aggregated report information, and the results of the security analysis are visualized and notified to a terminal device. This makes it possible to implement security measures for the multiple monitored devices simply and inexpensively.

[0050] The above describes the form for carrying out the present invention using an embodiment, but the present invention is not limited to such an embodiment, and various modifications and substitutions can be made within the scope that does not deviate from the gist of the present invention. [Explanation of symbols]

[0051] 10 Terminal Equipment 20 Service System 100 Information processing device 110 Acquisition Department 120 Analysis Department 130 Notification Department 140, 220 storage section 200 Service Server 210 Agent Department

Claims

1. an acquisition unit that acquires report information on security of each of a plurality of monitored devices, the report information being collected by an agent unit that is an application program that runs on each of a plurality of monitored devices that belong to each of a plurality of service systems that provide different services; an analysis unit that aggregates report information regarding security of each of the plurality of monitored devices and performs a security analysis on the aggregated report information; a notification unit that visualizes a result of the security analysis and notifies a terminal device that manages security of the entirety of the plurality of service systems, the notification unit visualizes a result of the security analysis regarding the plurality of monitored devices included in each of the plurality of service systems and notifies the terminal device of the visualized result, The analysis unit performs the security analysis for each of the plurality of service systems; the notification unit notifies a result of the security analysis executed for each of the plurality of service systems to a security management terminal for managing security of each of the plurality of service systems in response to an operation executed on the terminal device. Information processing device.

2. each of the plurality of monitored devices belongs to any one of a plurality of service systems that provide different services; the analysis unit aggregates the report information acquired from each of the plurality of monitored devices belonging to the different service systems and performs the security analysis. The information processing device according to claim 1 .

3. The analysis unit performs the security analysis for each of the plurality of service systems; the notification unit notifies a result of the security analysis executed for each of the plurality of service systems to a security management terminal of each of the plurality of service systems. The information processing device according to claim 2 .

4. the report information includes log data regarding access to each of the plurality of monitoring target devices; The analysis unit performs the security analysis on the aggregated log data. The information processing device according to claim 1 .

5. the analysis unit determines, as the security analysis, based on the report information, whether or not the plurality of monitored target devices satisfy security requirements for services provided by the plurality of monitored target devices; The information processing device according to claim 1 .

6. the report information includes at least one of file monitoring data, security setting evaluation data, and vulnerability evaluation data related to files or programs managed in each of the plurality of monitoring target devices; The information processing device according to claim 5 .

7. the service is an electronic payment service; the analysis unit determines whether the plurality of monitoring target devices satisfy security requirements of an electronic payment service based on the report information. The information processing device according to claim 5 .

8. The computer acquiring report information on security of each of a plurality of monitored devices, the report information being collected by an agent unit which is an application program running on each of a plurality of monitored devices belonging to each of a plurality of service systems which provide different services; aggregating report information regarding security of each of the plurality of monitored devices, and performing a security analysis on the aggregated report information; visualizing a result of the security analysis and notifying the result to a terminal device for managing security of the entirety of the plurality of service systems; visualizing a result of the security analysis regarding the plurality of monitored devices included in each of the plurality of service systems and notifying the terminal device of the visualizing result; performing the security analysis for each of the plurality of service systems; notifying a result of the security analysis executed for each of the plurality of service systems to a security management terminal for managing the security of each of the plurality of service systems in response to an operation executed on the terminal device; Information processing methods.

9. an acquisition unit that acquires report information on security of each of a plurality of monitored devices, the report information being collected by an agent unit that is an application program that runs on each of a plurality of monitored devices that belong to each of a plurality of service systems that provide different services; an analysis unit that aggregates report information regarding security of each of the plurality of monitored devices and performs a security analysis on the aggregated report information; a notification unit that visualizes a result of the security analysis and notifies a terminal device that manages security of the entirety of the plurality of service systems, the notification unit, in response to a selection of any one of the plurality of service systems on the terminal device, visualizes a result of the security analysis regarding the plurality of monitored devices included in the selected service system and notifies the terminal device of the visualized result; The analysis unit performs the security analysis for each of the plurality of service systems; the notification unit notifies a result of the security analysis executed for each of the plurality of service systems to a security management terminal for managing security of each of the plurality of service systems in response to an operation executed on the terminal device. Information processing device.

10. The computer acquiring report information on security of each of a plurality of monitored devices, the report information being collected by an agent unit which is an application program running on each of a plurality of monitored devices belonging to each of a plurality of service systems which provide different services; aggregating report information regarding security of each of the plurality of monitored devices, and performing a security analysis on the aggregated report information; visualizing a result of the security analysis and notifying the result to a terminal device for managing security of the entirety of the plurality of service systems; In response to a selection of any one of the plurality of service systems on the terminal device, visualizing a result of the security analysis regarding the plurality of monitored devices included in the selected service system and notifying the terminal device of the result; performing the security analysis for each of the plurality of service systems; notifying a result of the security analysis executed for each of the plurality of service systems to a security management terminal for managing the security of each of the plurality of service systems in response to an operation executed on the terminal device; Information processing methods.

11. an acquisition unit that acquires report information on security of each of a plurality of monitored devices, the report information being collected by an agent unit that is an application program that runs on each of a plurality of monitored devices that belong to each of a plurality of service systems that provide different services; an analysis unit that aggregates report information regarding security of each of the plurality of monitored devices and performs a security analysis on the aggregated report information; a notification unit that visualizes a result of the security analysis and notifies a terminal device that manages security of the entirety of the plurality of service systems, the notification unit, in response to a selection on the terminal device of a check item of the security analysis and any one of the plurality of service systems, visualizes a result of the security analysis related to the check item for the plurality of monitored devices included in the selected service system, and notifies the terminal device of the visualized result; The analysis unit performs the security analysis for each of the plurality of service systems; the notification unit notifies a result of the security analysis executed for each of the plurality of service systems to a security management terminal for managing security of each of the plurality of service systems in response to an operation executed on the terminal device. Information processing device.

12. The computer acquiring report information on security of each of a plurality of monitored devices, the report information being collected by an agent unit which is an application program running on each of a plurality of monitored devices belonging to each of a plurality of service systems which provide different services; aggregating report information regarding security of each of the plurality of monitored devices, and performing a security analysis on the aggregated report information; visualizing a result of the security analysis and notifying the result to a terminal device for managing security of the entirety of the plurality of service systems; In response to a selection on the terminal device of a check item of the security analysis and any one of the plurality of service systems, visualizing a result of the security analysis related to the check item for the plurality of monitored devices included in the selected service system and notifying the terminal device; performing the security analysis for each of the plurality of service systems; notifying a result of the security analysis executed for each of the plurality of service systems to a security management terminal for managing the security of each of the plurality of service systems in response to an operation executed on the terminal device; Information processing methods.

Images