Evaluation methods for computer systems and security measures

Abstract

To evaluate the validity of security measures and present the security measures with high validity.SOLUTION: A calculator system maintains configuration management information for managing elements that compose an object to be analyzed of security risk and evaluation rule management information for managing an evaluation rule for calculating indices indicating the validity of security measures for avoiding threats. The calculator system uses the configuration management information to identify the threat to each of the elements, stores evaluation pairs of the elements and threats associated with each other, generates the security measures for the evaluation pairs, consolidates evaluation pairs of which the generated security measures are the same, uses, for each of the security measures, the evaluation pairs associated with the security measures and the evaluation rule management information to calculate the indices, and generates display information for presenting the security measures and the indices.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to a technology for evaluating security measures against cybersecurity threats. [Background technology]

[0002] In recent years, countermeasures against cybersecurity threats have become important in various industries. Well-known threat analysis methods include the STRIDE method and the 5W method.

[0003] Generally, the number of threats extracted through threat analysis is very large. Therefore, the number of security measures for each threat is also very large. However, implementing all security measures is difficult from the standpoint of time and cost. Therefore, in practice, the security measures to be implemented are narrowed down.

[0004] Conventionally, priority has been given to implementing security measures against threats that pose a high degree of danger. As a technique for assessing the degree of danger, for example, the technique described in Patent Document 1 is known.

[0005] Patent Document 1 states that "the current situation analysis input processing unit 11 inputs a question asking about security measures and the answer, and if the weight of the answer is equal to or greater than a predetermined value, the vulnerability analysis unit 13 calculates a vulnerability value for each vulnerability based on the vulnerability corresponding to the question ID from the vulnerability DB 23, its weight, and the corresponding asset value in the asset list input by the asset input processing unit 12. The threat analysis unit 14 calculates a threat value based on the threat corresponding to the vulnerability ID and its weight. The risk calculation unit 15 calculates a risk value for each vulnerability based on the asset value, vulnerability value, and threat value. The countermeasure guideline creation unit 18 extracts a countermeasure guideline corresponding to the vulnerability." [Prior art documents] [Patent documents]

[0006] [Patent Document 1] Japanese Patent Application Laid-Open No. 2005-135239 Summary of the Invention [Problem to be solved by the invention]

[0007] There is not a one-to-one relationship between threats and security measures. Therefore, implementing one security measure may avoid multiple threats. Therefore, the effectiveness of security measures cannot be evaluated by using the risk value of the threat itself.

[0008] The present invention provides a technique for evaluating the effectiveness of multiple security measures and presenting highly effective security measures. [Means for solving the problem]

[0009] A representative example of the invention disclosed in the present application is as follows: That is, a computer system includes at least one computer having a processor, a storage device connected to the processor, and a network interface connected to the processor, and holds configuration management information for managing elements that constitute an object to be analyzed for security risks, and evaluation rule management information for managing evaluation rules for calculating, based on the elements and combinations of threats in the elements, indicators that indicate the effectiveness of security measures for avoiding the threats, wherein the processor performs a threat analysis using the configuration management information to identify the threats for each of the multiple elements, stores evaluation pairs that associate the elements with the threats in the storage device, generates security measures for the evaluation pairs, stores the evaluation pairs in association with the security measures in the storage device, aggregates the evaluation pairs associated with the same security measures, calculates the indicator for each security measure using the evaluation pair associated with the security measure and the evaluation rule management information, and generates display information for presenting the security measures and the indicator. [Effects of the Invention]

[0010] According to the present invention, a computer system can evaluate the effectiveness of a plurality of security measures and present highly effective security measures. Problems, configurations, and effects other than those described above will become apparent from the following description of the embodiments. [Brief explanation of the drawings]

[0011] [Figure 1] FIG. 1 illustrates an example of the configuration of a system according to a first embodiment. [Figure 2] FIG. 2 is a diagram illustrating an example of the configuration of a computer according to a first embodiment. [Figure 3] FIG. 2 is a diagram illustrating an example of a data structure of configuration management information according to the first embodiment. [Figure 4] FIG. 2 is a diagram illustrating an example of a data structure of threat management information according to the first embodiment. [Figure 5] FIG. 2 is a diagram illustrating an example of a data structure of countermeasure management information according to the first embodiment. [Figure 6] FIG. 2 is a diagram illustrating an example of a data structure of evaluation rule management information according to the first embodiment. [Figure 7] FIG. 10 is a diagram showing an example of a screen presented by the security countermeasure evaluation system of the first embodiment. [Figure 8] 10 is a flowchart illustrating an example of a countermeasure analysis process executed by the security countermeasure evaluation system according to the first embodiment. [Figure 9] FIG. 2 is a diagram showing an example of a data structure of aggregated information generated by the security countermeasure evaluation system of the first embodiment. [Figure 10] FIG. 2 is a diagram showing an example of an evaluation result presented by the security countermeasure evaluation system of the first embodiment. [Figure 11] 10 is a flowchart illustrating an example of a countermeasure evaluation process executed by the security countermeasure evaluation system according to the first embodiment. [Figure 12] 10 is a flowchart illustrating an example of a countermeasure evaluation process executed by the security countermeasure evaluation system according to the second embodiment. [Figure 13] FIG. 11 is a diagram showing an example of an evaluation result presented by the security countermeasure evaluation system of the second embodiment. [Figure 14]FIG. 10 is a diagram illustrating an example of the configuration of a system according to a third embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0012] Hereinafter, embodiments of the present invention will be described with reference to the drawings. However, the present invention should not be construed as being limited to the description of the embodiments shown below. Those skilled in the art will readily understand that the specific configuration can be changed without departing from the spirit or intent of the present invention.

[0013] In the configuration of the invention described below, the same or similar configurations or functions are denoted by the same reference numerals, and redundant explanations will be omitted.

[0014] In this specification, the terms "first," "second," "third," etc. are used to identify components and do not necessarily limit the number or order. [Example]

[0015] Fig. 1 is a diagram illustrating an example of the configuration of a system according to the first embodiment. Fig. 2 is a diagram illustrating an example of the configuration of a computer according to the first embodiment.

[0016] The system of the first embodiment is composed of a security countermeasure evaluation system 100, a management terminal 101, and a user terminal 102. The security countermeasure evaluation system 100 is connected to the management terminal 101 and the user terminal 102 via a network (not shown) such as a LAN (Local Area Network) or a WAN (Wide Area Network).

[0017] The management terminal 101 is a terminal operated by an administrator who operates the security countermeasure evaluation system 100. The user terminal 102 is a terminal operated by a user who implements security countermeasures. The management terminal 101 and the user terminal 102 are, for example, general-purpose computers, tablet terminals, smartphones, etc.

[0018] The security countermeasure evaluation system 100 evaluates the effectiveness of security countermeasures against threats in an object to be evaluated. In the following description, security countermeasures will be referred to as countermeasures.

[0019] The object may be a product such as an automobile or an electrical appliance, a system such as a customer management system, or an application. The present invention is not limited to the type of object.

[0020] The security countermeasure evaluation system 100 is configured, for example, from a computer 200 as shown in Fig. 2. The security countermeasure evaluation system 100 may be configured from a single computer 200, or may be configured from two or more computers 200. The security countermeasure evaluation system 100 may also be realized using virtualization technology.

[0021] The computer 200 includes a processor 201, a main memory device 202, a secondary memory device 203, and a network interface 204. The hardware elements are connected to each other via a bus. The computer 200 may include input devices such as a keyboard, a mouse, and a touch panel, and may also include output devices such as a display and a printer.

[0022] The processor 201 executes a program stored in the main memory device 202. The processor 201 executes processing in accordance with the program, thereby operating as a functional unit (module) that realizes a specific function. In the following description, when a processing is described using a functional unit as the subject, it indicates that the processor 201 is executing a program that realizes the functional unit.

[0023] The main memory device 202 is a storage device such as a DRAM (Dynamic Random Access Memory) and stores programs executed by the processor 201 and data used by the programs. The main memory device 202 is also used as a work area. The secondary memory device 203 is a storage device such as an HDD (Hard Disk Drive) or SSD (Solid State Drive) and permanently stores data.

[0024] The programs and data stored in the main memory device 202 may be stored in the secondary memory device 203. In this case, the processor 201 reads the programs and data from the secondary memory device 203 and loads them into the main memory device 202.

[0025] The security countermeasure evaluation system 100 includes an information registration unit 110, a threat analysis unit 111, a countermeasure generation unit 112, and a countermeasure evaluation unit 113. The security countermeasure evaluation system 100 also holds configuration management information 120, threat management information 121, countermeasure management information 122, and evaluation rule management information 123.

[0026] Configuration management information 120 is information for managing elements that make up an object. Threat management information 121 is information for managing threats in an object. Countermeasure management information 122 is information for managing countermeasures to avoid threats. Evaluation rule management information 123 is information for managing rules (evaluation rules) for evaluating the effectiveness of countermeasures.

[0027] The information registration unit 110 provides an interface for inputting information related to the configuration of an object, evaluation rules, etc. The threat analysis unit 111 analyzes threats in objects using configuration management information 120 and outputs the analysis results to threat management information 121. The countermeasure generation unit 112 generates countermeasures to avoid threats using the threat management information 121 and outputs information on the generated countermeasures to countermeasure management information 122. The countermeasure evaluation unit 113 evaluates the effectiveness of the countermeasures using evaluation rule management information 123.

[0028] It should be noted that with regard to each functional unit of the security countermeasure evaluation system 100, multiple functional units may be combined into one functional unit, or one functional unit may be divided into multiple functional units for each function.

[0029] FIG. 3 is a diagram illustrating an example of the data structure of the configuration management information 120 according to the first embodiment.

[0030] The configuration management information 120 stores entries including an element ID 301, an evaluation element type 302, an evaluation element 303, and a hierarchy 304. There is one entry for one element. Note that the fields included in the entry are not limited to those described above.

[0031] Element ID 301 is a field that stores identification information of an element. Evaluation element type 302 is a field that stores the type of element. Evaluation element 303 is a field that stores an element. Hierarchy 304 is a field that stores the hierarchy of an element in an object. The hierarchy of an element is an example of information that indicates the importance of an element.

[0032] The information registration unit 110 displays a screen on the user terminal 102 for inputting information about the configuration of the object. The user inputs information about the configuration of the object using the user terminal 102. The information registration unit 110 registers the information input by the user in the configuration management information 120. Note that the configuration of the object may be registered by an administrator who interviews the user.

[0033] FIG. 4 is a diagram illustrating an example of the data structure of the threat management information 121 according to the first embodiment.

[0034] The threat management information 121 stores entries including a threat ID 401, an element ID 402, and a threat 403. One entry exists for each combination of an element and a threat. In the following description, a combination of an element and a threat is referred to as an evaluation pair. Note that the fields included in an entry are not limited to those described above.

[0035] Threat ID 401 is a field that stores identification information of an evaluation pair. Element ID 402 is a field that stores identification information of an element that is the target of a threat. The element ID 402 stores the identification information set in element ID 301. Threat 403 is a field that stores the specific content of a threat.

[0036] FIG. 5 is a diagram illustrating an example of the data structure of the countermeasure management information 122 according to the first embodiment.

[0037] The countermeasure management information 122 stores entries including a countermeasure ID 501, a threat ID 502, and a countermeasure 503. One entry exists for each combination of an entry and a countermeasure in the threat management information 121. Note that the fields included in an entry are not limited to those described above.

[0038] Countermeasure ID 501 is a field that stores identification information of an entry. Threat ID 502 is a field that stores identification information of an evaluation pair that is associated with a countermeasure. Threat ID 502 stores identification information set in threat ID 401. Countermeasure 503 is a field that stores specific details of the countermeasure.

[0039] In the countermeasure management information 122, there are entries whose evaluation pairs are different but whose countermeasures match.

[0040] Fig. 6 is a diagram showing an example of the data structure of the evaluation rule management information 123 according to the first embodiment. Fig. 7 is a diagram showing an example of a screen presented by the security countermeasure evaluation system 100 according to the first embodiment.

[0041] The evaluation rule management information 123 stores entries each including a rule ID 601, a description 602, a calculation method 603, and a weight 604. There is one entry for each evaluation rule. Note that the fields included in an entry are not limited to those described above.

[0042] Rule ID 601 is a field that stores identification information of the evaluation rule. Description 602 is a field that stores an explanation of the viewpoint of the evaluation rule, etc. Calculation method 603 stores a method for calculating an index (effectiveness) that indicates the effectiveness of a measure. Information related to the data used, the calculation formula, etc. is stored in the calculation method 603. Weight 604 is a field that stores a weight used to calculate the effectiveness.

[0043] The information registration unit 110 displays a screen 700 for inputting information related to evaluation rules on the management terminal 101. The screen 700 includes input fields 701, 702, 703, and 704.

[0044] The input field 701 is a field for inputting the identification information of a rule. The identification information of a rule may be automatically assigned by the security countermeasure evaluation system 100. The input field 702 is a field for inputting a description. The input field 703 is a field for inputting a calculation method. The input field 704 is a field for inputting a weight.

[0045] For example, it is conceivable to set weights for the hierarchy of elements, the content of threats, development costs, the timing of implementing measures, the impact of measures, and the like.

[0046] The administrator uses the management terminal 101 to input various information into the screen 700. The information registration unit 110 registers the information input by the administrator in the evaluation rule management information 123. Note that the evaluation rules may be registered or modified by the user.

[0047] In the first embodiment, it is assumed that the following calculation method is set. (Method 1) Calculate the effectiveness based on the number of evaluation pairs associated with the measure. (Method 2) Calculate the effectiveness based on the risk values ​​of the threats that make up the evaluation pair associated with the countermeasure. (Method 3) Calculate the effectiveness based on the importance of the elements that make up the evaluation pair associated with the measure.

[0048] Even if the calculation method is the same, various evaluation rules can be set by adjusting the calculation formula and weights depending on the evaluation viewpoint. Note that the effectiveness may be calculated by combining various methods.

[0049] Fig. 8 is a flowchart illustrating an example of a countermeasure analysis process executed by the security countermeasure evaluation system 100 of the first embodiment. Fig. 9 is a diagram illustrating an example of a data structure of aggregated information generated by the security countermeasure evaluation system 100 of the first embodiment. Fig. 10 is a diagram illustrating an example of an evaluation result presented by the security countermeasure evaluation system 100 of the first embodiment.

[0050] When an execution trigger is received, the security countermeasure evaluation system 100 starts the countermeasure analysis process described below. The execution trigger may be, for example, the reception of an execution instruction sent from the user terminal 102, or the registration of the configuration management information 120. In the first embodiment, it is assumed that the evaluation rule to be used is specified in advance.

[0051] The threat analysis unit 111 of the security countermeasure evaluation system 100 executes a threat analysis process using the configuration management information 120 (step S101). For example, the threat analysis unit 111 analyzes threats in objects using the STRIDE method, the 5W method, or the like. The threat analysis method is a well-known technique, so a detailed description will be omitted. The threat analysis unit 111 registers the processing result in the threat management information 121.

[0052] The countermeasure generation unit 112 of the security countermeasure evaluation system 100 executes a countermeasure generation process (step S102) to generate countermeasures for avoiding threats in each entry of the threat management information 121. For example, the countermeasure generation unit 112 identifies factors by executing a Fault Tree analysis, and generates countermeasures for eliminating the identified factors.

[0053] The countermeasure evaluation unit 113 of the security countermeasure evaluation system 100 executes a countermeasure aggregation process (step S103).

[0054] Specifically, the countermeasure evaluation unit 113 aggregates evaluation pairs for each countermeasure with the same content, and generates aggregated information 900. The aggregated information 900 stores entries including a countermeasure group ID 901, a countermeasure ID list 902, a threat ID list 903, and an effectiveness 904. There is one entry for each countermeasure.

[0055] Countermeasure group ID 901 is a field that stores identification information of countermeasures. Countermeasure ID list 902 is a field that stores identification information of entries (evaluation pairs) in countermeasure management information 122 in which countermeasures with the same content are set. Threat ID list 903 is a field that stores identification information of threats for which countermeasures are taken. Effectiveness 904 is a field that stores the effectiveness of countermeasures.

[0056] The countermeasure evaluation unit 113 references the countermeasure 503 of each entry in the countermeasure management information 122, extracts entries for which the same countermeasure is set, and generates a group. The countermeasure evaluation unit 113 adds one entry for each group to the aggregation information 900. The countermeasure evaluation unit 113 sets the identification information (countermeasure ID 501) of the entries that make up the group in the countermeasure ID list 902. The countermeasure evaluation unit 113 also sets the threat ID 502 of the entries that make up the group in the threat ID list 903. At this point, the effectiveness 904 is blank.

[0057] The countermeasure evaluation unit 113 of the security countermeasure evaluation system 100 executes a countermeasure evaluation process (step S104). The countermeasure evaluation process will be described in detail later.

[0058] The countermeasure evaluation unit 113 of the security countermeasure evaluation system 100 outputs the evaluation result to the user terminal 102 (step S105), and then ends the process.

[0059] 10 is displayed on the user terminal 102. A table 1010 is displayed on the screen 1000. The table 1010 displays entries including countermeasures 1011, threats 1012, elements 1013, and effectiveness 1014.

[0060] Countermeasure 1011 is a field that displays the content of the countermeasure. Threat 1012 is a field that displays the content of the threat. Element 1013 is a field that displays the element that is the target of the threat. Effectiveness 1014 is a field that displays the effectiveness of the countermeasure.

[0061] The countermeasure evaluation unit 113 generates display information for displaying the table 1010 using the aggregate information 900, the configuration management information 120, the threat management information 121, and the countermeasure management information 122. At this time, the countermeasure evaluation unit 113 presents countermeasures with high effectiveness on a priority basis based on their effectiveness. For example, the countermeasure evaluation unit 113 sorts the entries in descending order of effectiveness. Note that it is also possible to present only countermeasures with effectiveness greater than a threshold.

[0062] FIG. 11 is a flowchart illustrating an example of a countermeasure evaluation process executed by the security countermeasure evaluation system 100 according to the first embodiment.

[0063] The countermeasure evaluation unit 113 starts a loop process of countermeasures (step S201). Specifically, the countermeasure evaluation unit 113 selects one entry from the aggregated information 900.

[0064] The countermeasure evaluation unit 113 acquires the evaluation rule to be used from the evaluation rule management information 123 (step S202).

[0065] The countermeasure evaluation unit 113 calculates the effectiveness of the countermeasure based on the evaluation pair associated with the countermeasure (step S203). At this time, the countermeasure evaluation unit 113 sets the calculated effectiveness to the effectiveness 904 of the entry corresponding to the selected countermeasure in the aggregate information 900.

[0066] In the case of (Method 1), the countermeasure evaluation unit 113 calculates the number of evaluation pairs associated with the countermeasure as the effectiveness, for example. In the case of (Method 2), the countermeasure evaluation unit 113 calculates the effectiveness as the sum of the risk values ​​of the threats that make up each evaluation pair associated with the countermeasure. Note that the sum of risk values ​​multiplied by weights may also be used. In the case of (Method 3), the countermeasure evaluation unit 113 calculates the effectiveness as the sum of the weights of the elements that make up each evaluation pair associated with the countermeasure.

[0067] The countermeasure evaluation unit 113 determines whether or not the processing for all countermeasures has been completed (step S204).

[0068] If the processing has not been completed for all measures, the countermeasure evaluation unit 113 returns to step S201. If the processing has been completed for all measures, the countermeasure evaluation unit 113 ends the countermeasure evaluation processing.

[0069] According to the first embodiment, the security countermeasure evaluation system 100 can calculate the effectiveness of countermeasures. Furthermore, the security countermeasure evaluation system 100 can present highly effective countermeasures to the user based on the priority. [Example]

[0070] In the second embodiment, the processing content of the countermeasure evaluation process is different from that in the first embodiment. The second embodiment will be described below, focusing on the differences from the first embodiment.

[0071] The system configuration of the second embodiment is the same as that of the first embodiment. The configuration of the security countermeasure evaluation system 100 of the second embodiment is the same as that of the first embodiment. The countermeasure analysis process flow executed by the security countermeasure evaluation system 100 of the second embodiment is the same as that of the first embodiment.

[0072] The countermeasure evaluation process is partially different in the second embodiment. Fig. 12 is a flowchart illustrating an example of the countermeasure evaluation process executed by the security countermeasure evaluation system 100 of the second embodiment.

[0073] In the second embodiment, measures are evaluated using all the evaluation rules. Specifically, the measure evaluation unit 113 of the security measure evaluation system 100 starts loop processing of the evaluation rules (step S211). Specifically, the measure evaluation unit 113 selects one entry from the evaluation rule management information 123.

[0074] The countermeasure evaluation unit 113 uses the selected evaluation rule to execute the processes from step S201 to step S204. The processes from step S201 to step S204 are the same as those in the first embodiment.

[0075] If it is determined in the processing of step S204 that processing has been completed for all measures, the measure evaluation unit 113 stores the aggregated information 900 associated with the identification information of the evaluation rule in the work area, and then determines whether processing has been completed for all evaluation rules (step S212).

[0076] If the processing has not been completed for all evaluation rules, the countermeasure evaluation unit 113 returns to step S211. At this time, the countermeasure evaluation unit 113 initializes the effectiveness 904 of the aggregated information 900. If the processing has been completed for all evaluation rules, the countermeasure evaluation unit 113 ends the countermeasure evaluation processing.

[0077] In step S105, the security countermeasure evaluation system 100 of the second embodiment displays a screen 1300 as shown in FIG. 13 . The screen 1300 includes a selection field 1301, a display button 1302, and a display field 1303. The selection field 1301 is a field for selecting an evaluation rule. The selection field 1301 displays the contents and identification information of the evaluation rule in a pull-down format. The display button 1302 is an operation button for displaying the effectiveness of a measure based on the evaluation rule selected in the selection field 1301. The display field 1303 is a field for displaying the effectiveness of a measure based on the evaluation rule selected in the selection field 1301. A table 1310 is displayed in the display field 1303. The table 1310 displays entries including a measure 1311, a threat 1312, an element 1313, and an effectiveness 1314. The countermeasure 1311, threat 1312, element 1313, and effectiveness 1314 are the same fields as the countermeasure 1011, threat 1012, element 1013, and effectiveness 1014.

[0078] When the display button 1302 is operated, the security countermeasure evaluation system 100 obtains the aggregated information 900 associated with the identification information of the selected evaluation rule from the work area, and generates display information for displaying the table 1310 using the aggregated information 900, configuration management information 120, threat management information 121, and countermeasure management information 122.

[0079] According to the second embodiment, the security countermeasure evaluation system 100 can present the effectiveness of countermeasures based on various evaluation rules (evaluation viewpoints), thereby allowing the user to understand the effectiveness of countermeasures from various evaluation viewpoints. [Example]

[0080] In the third embodiment, the security countermeasure evaluation system 100 calculates the effectiveness taking into account whether or not a countermeasure has been implemented. The following describes the third embodiment, focusing on the differences from the first embodiment.

[0081] FIG. 14 is a diagram illustrating an example of the configuration of a system according to the third embodiment.

[0082] The security countermeasure evaluation system 100 of the third embodiment holds countermeasure history management information 124. The countermeasure history management information 124 is information for managing the history of implemented countermeasures. The countermeasure history management information 124 stores a history including identification information of implemented countermeasures and the implementation date and time.

[0083] The flow of the countermeasure analysis process executed by the security countermeasure evaluation system 100 of the third embodiment is the same as that of the first embodiment. Also, the flow of the countermeasure evaluation process executed by the security countermeasure evaluation system 100 of the third embodiment is the same as that of the first embodiment.

[0084] However, the method of calculating the effectiveness is different in the third embodiment. In the third embodiment, the countermeasure evaluation unit 113 calculates the effectiveness of a countermeasure based on an evaluation pair associated with the countermeasure. Furthermore, the countermeasure evaluation unit 113 refers to the countermeasure history management information 124 and determines whether or not the selected countermeasure has been implemented. If the selected countermeasure has been implemented, the countermeasure evaluation unit 113 corrects the effectiveness by multiplying the effectiveness by a coefficient smaller than 1. In other words, the correction is performed so that the effectiveness of the implemented countermeasure becomes smaller.

[0085] According to the third embodiment, the security countermeasure evaluation system 100 can present to the user countermeasures that have not been implemented and are highly effective.

[0086] The present invention is not limited to the above-described embodiments, but includes various modifications. For example, the above-described embodiments are provided to explain the present invention in detail, and the present invention is not necessarily limited to those including all of the described configurations. Furthermore, some of the configurations of each embodiment can be added to, deleted from, or replaced with other configurations.

[0087] Furthermore, the above-described configurations, functions, processing units, processing means, etc. may be partially or entirely implemented in hardware, for example, by designing them as integrated circuits. The present invention can also be realized by software program code that implements the functions of the embodiments. In this case, a storage medium on which the program code is recorded is provided to a computer, and a processor included in the computer reads the program code stored in the storage medium. In this case, the program code itself read from the storage medium implements the functions of the above-described embodiments, and the program code itself and the storage medium on which it is stored constitute the present invention. Examples of storage media for providing such program code include flexible disks, CD-ROMs, DVD-ROMs, hard disks, solid-state drives (SSDs), optical disks, magneto-optical disks, CD-Rs, magnetic tapes, non-volatile memory cards, and ROMs.

[0088] Furthermore, the program code that realizes the functions described in this embodiment can be implemented in a wide range of program or script languages, such as assembler, C / C++, perl, Shell, PHP, Python, and Java (registered trademark).

[0089] Furthermore, the program code of the software that realizes the functions of the embodiments may be distributed via a network and stored in a storage means such as a computer's hard disk or memory, or in a storage medium such as a CD-RW or CD-R, and the processor of the computer may read and execute the program code stored in the storage means or storage medium.

[0090] In the above-described embodiment, the control lines and information lines are those that are considered necessary for the explanation, and not all control lines and information lines are necessarily shown in the product. All components may be interconnected. [Explanation of symbols]

[0091] 100 Security Measures Evaluation System 101 Management terminal 102 User terminal 110 Information Registration Department 111 Threat Analysis Department 112 Countermeasure Generation Unit 113 Countermeasures Evaluation Department 120 Configuration management information 121 Threat Management Information 122 Countermeasure Management Information 123 Evaluation Rule Management Information 124 Countermeasure history management information 200 calculator 201 processor 202 Main storage 203 Secondary storage device 204 Network Interface 700, 1000, 1300 screen

Claims

1. 1. A computer system comprising: at least one computer having a processor, a storage device connected to the processor, and a network interface connected to the processor; The system holds configuration management information for managing elements that constitute an object to be analyzed for security risk, and evaluation rule management information for managing evaluation rules for calculating an index showing the effectiveness of security measures to avoid threats based on a combination of the elements and threats in the elements, The processor: performing a threat analysis using the configuration management information to identify the threats for each of the plurality of elements, and storing evaluation pairs that associate the elements with the threats in the storage device; generating the security measures for the evaluation pair, and storing the evaluation pair in association with the security measures in the storage device; aggregating the evaluation pairs associated with the same security measures; calculating the index for each security measure using the evaluation pair associated with the security measure and the evaluation rule management information; A computer system that generates display information for presenting the security measures and the indicators.

2. 2. The computer system of claim 1, A computer system characterized in that the evaluation rule is a rule for calculating the index using at least one of the number of evaluation pairs associated with the security measure, a risk value representing the degree of risk of the threat that constitutes the evaluation pair associated with the security measure, and the importance of the elements that constitute the evaluation pair associated with the security measure.

3. 3. The computer system according to claim 2, The processor: calculating the index using each of the evaluation rules registered in the evaluation rule management information; A computer system that generates the display information for each of the evaluation rules.

4. 3. The computer system according to claim 2, maintaining history information for managing the security measures implemented on the object; The processor: referring to the history information to determine whether the security measures have been implemented; A computer system characterized in that, when the security measures are implemented, the index is corrected so that the effectiveness of the security measures becomes lower.

5. A method for evaluating security measures implemented by a computer system, comprising: The computer system at least one computer having a processor, a storage device connected to the processor, and a network interface connected to the processor; The system holds configuration management information for managing elements that constitute an object to be analyzed for security risk, and evaluation rule management information for managing evaluation rules for calculating an index showing the effectiveness of security measures to avoid threats based on a combination of the elements and threats in the elements, The method for evaluating security measures includes: a first step in which the processor identifies the threats of each of the plurality of elements by performing a threat analysis using the configuration management information, and stores evaluation pairs that associate the elements with the threats in the storage device; a second step in which the processor generates the security measures for the evaluation pairs and stores the evaluation pairs in association with the security measures in the storage device; a third step in which the processor aggregates the evaluation pairs associated with the same security countermeasure; a fourth step in which the processor calculates the index for each security measure by using the evaluation pair associated with the security measure and the evaluation rule management information; a fifth step in which the processor generates display information for presenting the security measures and the indicators.

6. 6. The method for evaluating security measures according to claim 5, A method for evaluating security measures, characterized in that the evaluation rule is a rule for calculating the index using at least one of the number of evaluation pairs associated with the security measure, a risk value representing the degree of risk of the threat that constitutes the evaluation pair associated with the security measure, and the importance of the elements that constitute the evaluation pair associated with the security measure.

7. 7. The method for evaluating security measures according to claim 6, the fourth step includes a step of calculating the index by the processor using each of the evaluation rules registered in the evaluation rule management information; The method for evaluating security measures, wherein the fifth step includes a step in which the processor generates the display information for each of the evaluation rules.

8. 7. The method for evaluating security measures according to claim 6, the computer system holds history information for managing the security measures implemented for the object; The fourth step includes: a step of the processor referring to the history information to determine whether the security measure has been implemented; and a step by the processor correcting the indicator so that the effectiveness of the security measure becomes lower when the security measure is implemented.

Images