Information processing device, method, and program

Abstract

The present invention enables formulation of a plurality of countermeasures to be introduced into a system without increasing a calculation amount. A countermeasure candidate table (15) contains a plurality of countermeasures and indicators each indicating an effect of each countermeasure. A countermeasure compatibility table (16) contains a combination of two or more countermeasures and an indicator indicating an effect of the combination. A countermeasure calculation means (12) uses the countermeasure candidate table (15) and the countermeasure compatibility table (16) to plan countermeasures against an attack to be used in an attack route. A risk value calculation means (13) calculates a risk value in the attack route in the case in which the planned countermeasures are introduced into a system to be analyzed, on the basis of the indicator indicating the effect of the countermeasure and the indicator indicating the effect of the combination of countermeasures.

Description

Technical Field

[0001] The present disclosure relates to an information processing apparatus, a method, and a computer-readable medium.

Background Art

[0002] In recent years, the threat of cyberattacks has not been limited to the ICT (Information and Communication Technology) field, and damage cases have also occurred in the fields of control systems and IoT (Internet of Things). In particular, in control systems, incidents that threaten the operation of critical infrastructure, such as power system outages and factory shutdowns, have also occurred. Regarding the threat of cyberattacks, it is important to clarify the security risks of the system, implement countermeasures, and reduce the risks.

[0003] As a related technology, Patent Document 1 discloses an information processing apparatus that supports the implementation of security measures for a data system. The information processing apparatus according to Patent Document 1 identifies threats to be addressed in the data system and extracts security measures for each identified threat. The information processing apparatus combines the extracted security measures to generate a combination pattern of security measures for the identified threats. The information processing apparatus calculates an impact value on the data system when the combination is implemented for each combination pattern and selects a specific combination pattern based on the calculated impact value.

Prior Art Documents

Patent Documents

[0004]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0005] Patent Document 1 states that when the number of security measures that can be implemented is large, the number of combinations of security measures increases. In that case, the calculation of the effect (impact value) when security measures are implemented also increases, and the computation cost and computation time increase.

[0006] In view of the above circumstances, one of the objectives of this disclosure is to provide an information processing device, method, and computer-readable medium that can formulate multiple countermeasures to be introduced into a system without increasing the computational load.

[0007] Furthermore, one of the other purposes of this disclosure is to provide an information processing device, method, and computer-readable medium that can visualize the effectiveness of the measures that have been devised. [Means for solving the problem]

[0008] To achieve the above objective, this disclosure provides, in a first aspect, an information processing device (first information processing device). The first information processing device includes: an analysis result acquisition means for acquiring the results of a risk analysis of a system under analysis, including an attack route; a countermeasure calculation means for formulating countermeasures against an attack used in the attack route, using a countermeasure candidate table including a plurality of countermeasures that can be introduced against the attack and an indicator showing the effect of each countermeasure, and a countermeasure compatibility table including combinations of countermeasures in which two or more countermeasures from the plurality of countermeasures are combined and an indicator showing the effect of the combination of countermeasures; and a risk value calculation means for calculating the risk value of the attack route when the formulated countermeasures are introduced to the system under analysis, based on an indicator showing the effect of the countermeasures included in the formulated countermeasures and an indicator showing the effect of the combination of countermeasures included in the formulated countermeasures.

[0009] This disclosure provides, in a second aspect, an information processing device (a second information processing device). The second information processing device includes countermeasure effect calculation means for calculating the effect of countermeasures if a planned countermeasure is implemented for each attack route included in the results of a risk analysis of the system under analysis, and display means for displaying the calculated countermeasure effect in relation to the risk value of the attack route.

[0010] This disclosure provides, in a third aspect, an information processing method. The information processing method includes obtaining the results of a risk analysis of a system under analysis, including an attack route; formulating countermeasures against an attack used in the attack route using a countermeasure candidate table including a plurality of countermeasures that can be introduced against the attack and an indicator showing the effectiveness of each countermeasure, and a countermeasure compatibility table including combinations of countermeasures in which two or more countermeasures from the plurality of countermeasures are combined and an indicator showing the effectiveness of the combination of countermeasures; and calculating the risk value of the attack route when the formulated countermeasures are introduced to the system under analysis, based on an indicator showing the effectiveness of the countermeasures included in the formulated countermeasures and an indicator showing the effectiveness of the combination of countermeasures included in the formulated countermeasures.

[0011] This disclosure provides, in a fourth aspect, an information processing method. The information processing method includes calculating the effectiveness of countermeasures if the planned countermeasures were implemented for each attack route included in the results of the risk analysis of the system under analysis, and displaying the calculated effectiveness of the countermeasures in relation to the risk value of the attack route.

[0012] This disclosure provides a computer-readable medium in a fifth aspect. The computer-readable medium stores a program for causing a computer to execute a process that includes obtaining the results of a risk analysis of a system under analysis, including an attack route; formulating countermeasures against attacks used in the attack route using a countermeasure candidate table including a plurality of countermeasures that can be introduced against the attack and an indicator showing the effectiveness of each countermeasure, and a countermeasure compatibility table including combinations of countermeasures in which two or more countermeasures from the plurality of countermeasures are combined and an indicator showing the effectiveness of the combination of countermeasures; and calculating the risk value of the attack route when the formulated countermeasures are introduced into the system under analysis, based on an indicator showing the effectiveness of the countermeasures included in the formulated countermeasures and an indicator showing the effectiveness of the combination of countermeasures included in the formulated countermeasures.

[0013] In a sixth aspect, this disclosure provides a computer-readable medium. The computer-readable medium stores a program for causing a computer to perform a process that includes calculating the effectiveness of a planned countermeasure if it were implemented for each attack route included in the results of a risk analysis of the system under analysis, and displaying the calculated effectiveness of the countermeasure in relation to the risk value of the attack route. [Effects of the Invention]

[0014] The first information processing device, method, and computer-readable medium relating to this disclosure can be used to design multiple countermeasures to be implemented in a system without increasing the computational load.

[0015] Furthermore, the second information processing device, method, and computer-readable medium relating to this disclosure can visualize the effectiveness of the devised countermeasures. [Brief explanation of the drawing]

[0016] [Figure 1] A block diagram showing the schematic configuration of an information processing device according to one aspect of this disclosure. [Figure 2]Block diagram schematically showing an information processing apparatus according to another aspect of the present disclosure. [Figure 3] Block diagram showing an information processing apparatus according to an embodiment of the present disclosure. [Figure 4] Diagram showing an example of a countermeasure candidate table. [Figure 5] Diagram showing an example of a countermeasure compatibility table. [Figure 6] Diagram showing another example of a countermeasure compatibility table. [Figure 7] Schematic diagram schematically showing the formulation of countermeasures. [Figure 8] Schematic diagram schematically showing the calculation of a risk value. [Figure 9] Diagram showing a map used for determining a risk value. [Figure 10] Diagram showing an example of the display of attack route risk including countermeasure effects. [Figure 11] Flowchart showing an operation procedure in a countermeasure formulation support apparatus. [Figure 12] Block diagram showing a configuration example of a computer device.

Mode for Carrying Out the Invention

[0017] Prior to the description of the embodiments of the present disclosure, an overview of the present disclosure will be described. First, a first information processing apparatus according to the present disclosure will be described. FIG. 1 shows a schematic configuration of the first information processing apparatus. The first information processing apparatus 10 includes an analysis result acquisition unit 11, a countermeasure calculation unit 12, and a risk value calculation unit 13. The first information processing apparatus 10 can function as a device that supports the formulation of security countermeasures.

[0018] The analysis result acquisition means 11 acquires the results of a risk analysis for the system under analysis. The risk analysis results include attack routes. The countermeasure calculation means 12 uses the countermeasure candidate table 15 and the countermeasure compatibility table 16 to devise countermeasures against attacks used in the attack routes included in the risk analysis results. The countermeasure candidate table 15 includes multiple countermeasures that can be implemented against an attack, and an indicator showing the effectiveness of each countermeasure. The countermeasure compatibility table 16 includes combinations of countermeasures in which two or more countermeasures from the multiple countermeasures are combined, and an indicator showing the effectiveness of each combination of countermeasures.

[0019] The risk value calculation means 13 calculates the risk value of an attack route when the countermeasures devised by the countermeasure calculation means 12 are implemented in the system under analysis. The risk value calculation means 13 calculates the risk value based on an index showing the effectiveness of the countermeasures included in the devised countermeasures, and an index showing the effectiveness of the combination of countermeasures included in the devised countermeasures.

[0020] In this disclosure, the countermeasure compatibility table 16 includes an index that shows the effect for each combination of countermeasures. The countermeasure calculation means 12 plans countermeasures using the countermeasure candidate table 15 and the countermeasure compatibility table 16. In this disclosure, for some combinations of countermeasures, countermeasure planning can be carried out using the index that shows the effect included in the countermeasure compatibility table 16. Therefore, the first information processing device 10 can plan multiple countermeasures to be introduced into the system without increasing the computational load.

[0021] Next, a second information processing device relating to this disclosure will be described. Figure 2 shows a schematic representation of the second information processing device. The second information processing device 20 includes a countermeasure effect calculation means 21 and a display means 22. The second information processing device 20 can function as a device for visualizing the effectiveness of security measures. The countermeasure effect calculation means 21 calculates the effectiveness of the countermeasures if the planned countermeasures are implemented for each attack route included in the results of the risk analysis of the system under analysis. The display means 22 displays the calculated countermeasure effects in relation to the risk value of the attack route.

[0022] In this disclosure, the second information processing device 20 displays the effectiveness of countermeasures against an attack route in relation to the risk value of the attack route. The second information processing device 20 presents the results to the user, for example in a table format, including not only the risk value after the countermeasures have been implemented, but also the effectiveness of the countermeasures. In this way, the user can confirm the effectiveness of the planned countermeasures and the risk value.

[0023] Embodiments of the present disclosure will be described in detail below. Figure 3 shows a first information processing device according to one embodiment of the present disclosure. In this embodiment, the first information processing device may also be called a countermeasure planning support device. The countermeasure planning support device 100 includes a collection unit 101, a countermeasure calculation unit 102, a risk value calculation unit 103, and a countermeasure effect visualization unit 104. The countermeasure planning support device 100 includes, for example, one or more memories and one or more processors. At least a portion of the functions of each part in the countermeasure planning support device 100 can be realized by the processor operating according to a program read from the memory.

[0024] The risk analysis results 201 of the system to be analyzed are input to the countermeasure planning support device 100. The collection unit 101 acquires the risk analysis results 201. The risk analysis results 201 include attack routes. Here, "attack route" refers to the route taken by an attacker when attacking a final target using a certain asset as an entry point. An attack route is also called an attack tree. "Attack" refers to an operation performed maliciously on an asset. Attacks include, for example, "data tampering," "unauthorized manipulation," and "DoS (Denial-of-service) attacks." An attack route includes one or more attack steps. Each attack step includes the source, target, and attack. Risk analysis is performed, for example, by creating a virtual model from the configuration information of the actual environment, generating attack routes according to the attack scenario to be analyzed, and calculating a risk value for each attack route. Risk analysis may be performed manually or using a risk analysis device. The collection unit 101 corresponds to the analysis result acquisition means 11 shown in Figure 1.

[0025] The countermeasure candidate table 120 is a table that contains multiple countermeasures (candidates) that may be implemented against an attack, and indicators that show the effectiveness of each countermeasure. Here, "countermeasure" refers to security measures that suppress an attack or mitigate the damage caused by an attack. The countermeasure compatibility table 121 is a table that contains combinations of countermeasures formed by combining two or more countermeasures from the multiple countermeasures that may be implemented against an attack, and indicators that show the effectiveness of the combination of countermeasures. The countermeasure calculation unit 102 uses the countermeasure candidate table 120 and the countermeasure compatibility table 121 to formulate countermeasures against attacks used in the attack routes included in the risk analysis results 201. For each of the multiple attack routes included in the risk analysis results 201, the countermeasure calculation unit 102 formulates countermeasures against the attacks used in each attack route.

[0026] Figure 4 shows an example of a countermeasure candidate table 120. The countermeasure candidate table 120 holds multiple countermeasures as potential countermeasures (candidates). For each of the candidate countermeasures A through E, the countermeasure candidate table 120 holds "effective attack methods," "effectiveness," and "priority." "Effective attack methods" indicates which attack methods the countermeasure is intended to be implemented against. "Effect" and "priority" are indicators of the effect if the countermeasure is implemented. "Effect" indicates the magnitude of the effect if the countermeasure is implemented. "Priority" is set according to the effect and implementation cost of the countermeasure. For example, if a countermeasure has a large effect but a high implementation cost, the "priority" will be set to a value smaller than the "effect." "Effect" and "priority" are represented, for example, as real numbers between 0 and 1.

[0027] Figure 5 shows an example of a countermeasure compatibility table 121. The countermeasure compatibility table 121 is a table that holds information about combinations of two or more countermeasures that have overlaps or constraints, such as whether the combination is possible, the effect when combined, and the priority when combined. In the example in Figure 5, for example, countermeasure A and countermeasure B are defined as being able to be combined, while countermeasure A and countermeasure D are defined as not being able to be combined. The countermeasure compatibility table 121 does not necessarily have to include information on whether the combination is possible or not. For example, an effect of 0 could be defined as a combination of countermeasures that cannot be combined.

[0028] In Figure 5, "Effect" and "Priority" are indicators showing the effect when a combination of countermeasures is implemented. "Effect" indicates the magnitude of the effect when a combination of countermeasures is implemented. "Priority" is set according to the effect and implementation cost of the combination of countermeasures. For example, if a combination of countermeasures has a large effect when implemented, but the implementation cost of one of the combined countermeasures is high, the "Priority" will be set to a smaller value than "Effect". Combinations of countermeasures that do not exist in the Countermeasure Compatibility Table 121 are assumed to have no overlapping effects or constraints on incompatibility.

[0029] Furthermore, the feasibility of possible countermeasures, combinations of countermeasures, their effectiveness, and their priority may vary depending on the area where the system under analysis is installed and the type of system under analysis. At least one of the countermeasure candidate table 120 and the countermeasure compatibility table 121 may retain information for each system condition. Figure 6 shows another example of the countermeasure compatibility table 121. In this example, the countermeasure compatibility table 121 includes the area of ​​the system under analysis. The countermeasure compatibility table 121 retains the effectiveness, priority, and feasibility of countermeasure combinations when the system under analysis is a "factory" system. The countermeasure compatibility table 121 also retains the effectiveness, priority, and feasibility of countermeasure combinations when the system under analysis is an "office" system. As in this example, the countermeasure compatibility table 121 may retain information defined for each area.

[0030] The countermeasure calculation unit 102, in formulating countermeasures, formulates countermeasures that include multiple countermeasures. The countermeasure calculation unit 102 selects the first countermeasure based on an indicator showing the effectiveness of the countermeasures included in the countermeasure candidate table 120. In the following description, the countermeasure calculation unit 102 will refer to priority as the indicator showing effectiveness. For example, the countermeasure calculation unit 102 selects the countermeasure with the highest priority among the countermeasures that are effective against the attack means used in the attack in the countermeasure candidate table 120 as the first countermeasure. The countermeasure calculation unit 102 selects the second and subsequent countermeasures based on at least one of the priorities included in the countermeasure candidate table 120 and the priorities included in the countermeasure compatibility table 121.

[0031] For example, when selecting the second and subsequent countermeasures, the countermeasure calculation unit 102 sequentially selects the unselected countermeasures from among multiple countermeasures effective against the attack means, and checks whether the combination of the selected countermeasure and one or more countermeasures already selected is included in the countermeasure compatibility table 121. As shown in Figure 6, if the countermeasure compatibility table 121 has information on the feasibility of combinations for each area, the countermeasure calculation unit 102 refers to the information corresponding to the area of ​​the system under analysis to check whether the above combination is included in the countermeasure compatibility table 121.

[0032] The countermeasure calculation unit 102, if the combination is included in the countermeasure compatibility table 121, uses the priority of the countermeasure combination included in the countermeasure compatibility table 121 as the priority if the selected countermeasure is implemented. If the combination is not included in the countermeasure compatibility table 121, the countermeasure calculation unit 102 uses the priority of the countermeasure included in the countermeasure candidate table 120 as the priority if the selected countermeasure is implemented. If the combination is "not possible" in the countermeasure compatibility table 121, the countermeasure calculation unit 102 does not include the selected countermeasure in the countermeasures to be formulated. The countermeasure calculation unit 102 corresponds to the countermeasure calculation means 12 shown in Figure 1. The countermeasure candidate table 120 corresponds to the countermeasure candidate table 15 shown in Figure 1. The countermeasure compatibility table 121 corresponds to the countermeasure compatibility table 16 shown in Figure 1.

[0033] The risk value calculation unit 103 calculates the risk value of an attack route if the countermeasures devised by the countermeasure calculation unit 102 are implemented in the system under analysis. The risk value indicates the degree of damage that the attack will inflict on the system. The risk value calculation unit 103 obtains the priority of countermeasures or combinations of countermeasures from at least one of the countermeasure candidate table 120 and the countermeasure compatibility table 121, and calculates the risk value based on the obtained priority. For example, for combinations of countermeasures included in the devised countermeasures that exist in the countermeasure compatibility table 121, the risk value calculation unit 103 obtains the priority from the countermeasure compatibility table 121. For countermeasures included in the devised countermeasures that exist in the countermeasure compatibility table 121, the risk value calculation unit 103 obtains the priority from the countermeasure candidate table 120.

[0034] The risk value calculation unit 103 calculates the risk value each time a countermeasure is added to the countermeasures formulated by the countermeasure calculation unit 102. The countermeasure calculation unit 102 adds countermeasures until the risk value calculated by the risk value calculation unit 103 falls below a predetermined standard. The risk value calculation unit 103 corresponds to the risk value calculation means 13 shown in Figure 1.

[0035] The countermeasure effectiveness visualization unit (countermeasure effectiveness visualization means) 104 displays the risk of the attack route, including the effectiveness of the countermeasures, on the display screen of a display device not shown. The countermeasure effectiveness visualization unit 104 presents the risk of the attack route to the user in a table format, including not only the risk value but also the effectiveness of the countermeasures.

[0036] For example, the countermeasure effectiveness visualization unit 104 calculates the effectiveness of countermeasures when the countermeasures planned for each attack route are implemented. The countermeasure effectiveness visualization unit 104 calculates the sum of the priority of the countermeasures included in the planned countermeasures, and the priority of the combination of countermeasures included in the planned countermeasures, as the countermeasure effectiveness. Alternatively, the countermeasure effectiveness visualization unit 104 calculates the sum of the countermeasures included in the planned countermeasures as the countermeasure effectiveness. The countermeasure effectiveness visualization unit 104 displays the calculated countermeasure effectiveness in relation to the risk value of the attack route. The countermeasure effectiveness visualization unit 104 may, for example, divide the countermeasure effectiveness into multiple intervals and display the number of attack routes corresponding to the interval of countermeasure effectiveness and the risk value in a table format.

[0037] Furthermore, the countermeasure candidate table 120 and the countermeasure compatibility table 121 only need to be accessible from the countermeasure planning support device 100, and do not necessarily need to be included in the countermeasure planning support device 100. For example, at least one of the countermeasure candidate table 120 and the countermeasure compatibility table 121 may be located on the cloud, and the countermeasure planning support device 100 may access the countermeasure candidate table 120 and the countermeasure compatibility table 121 on the cloud via the network.

[0038] Furthermore, in this embodiment, the countermeasure effect visualization unit 104 does not necessarily have to be included in the countermeasure planning support device 100. The countermeasure effect visualization unit 104 may be configured as an independent device separate from the countermeasure planning support device 100. The countermeasure effect visualization unit 104 may be configured as a device having one or more memories and one or more processors. The functions of the countermeasure effect visualization unit 104 may be realized by the processor operating according to a program read from memory. The countermeasure effect visualization unit 104 is not necessarily limited to displaying the risk of the attack route, including the effect of the countermeasure, when the countermeasures planned by the countermeasure calculation unit 102 are implemented. The countermeasure effect visualization unit 104 can display the risk of the attack route, including the effect of the countermeasure, when countermeasures planned by any method are implemented. The countermeasure effect visualization unit 104 may correspond to the second information processing device 20 shown in Figure 2.

[0039] The following is a specific example. Figure 7 schematically illustrates the planning of countermeasures. Figure 7 shows two attack routes, #1 and #2, where host A is the entry point of the attack and host C is the final target of the attack. In selecting the first countermeasure, the countermeasure calculation unit 102 refers to the countermeasure candidate table 120 and selects a countermeasure for the attack step used in the attack route. For example, the countermeasure calculation unit 102 refers to the countermeasure candidate table 120 shown in Figure 4 and selects countermeasure A, which has the highest priority of "0.4", as the first countermeasure. In attack routes #1 and #2 shown in Figure 7, countermeasure A is implemented for the attack step from host A to host B. The risk value calculation unit 103 calculates the risk value when countermeasure A is implemented. If the risk value after countermeasure A is implemented is below a predetermined threshold, the countermeasure calculation unit 102 selects an additional countermeasure.

[0040] In selecting the second countermeasure, the countermeasure calculation unit 102 sequentially selects one unselected countermeasure at a time from the countermeasure candidate table 120. The countermeasure calculation unit 102 selects countermeasure B and checks whether the combination of countermeasure A and countermeasure B, which has already been selected, exists in the countermeasure compatibility table 121. In the countermeasure compatibility table 121 shown in Figure 5, the combination of countermeasure A and countermeasure B exists, and its priority is "0.5". Next, the countermeasure calculation unit 102 selects countermeasure C and checks whether the combination of countermeasure A and countermeasure C, which has already been selected, exists in the countermeasure compatibility table 121. In the countermeasure compatibility table 121 shown in Figure 5, the combination of countermeasure A and countermeasure C exists, and its priority is "0.7".

[0041] The countermeasure calculation unit 102 selects countermeasure D and checks whether the combination of countermeasure A and countermeasure D exists in the countermeasure compatibility table 121. In the countermeasure compatibility table 121 shown in Figure 5, the combination of countermeasure A and countermeasure D is not possible. In this case, the countermeasure calculation unit 102 excludes countermeasure D from the countermeasures to be planned. The countermeasure calculation unit 102 also checks whether the combination of countermeasure A and countermeasure E exists in the countermeasure compatibility table 121. In the countermeasure compatibility table 121 shown in Figure 5, the combination of countermeasure A and countermeasure E does not exist. In that case, the countermeasure calculation unit 102 obtains the priority (0.25) of countermeasure E from the countermeasure candidate table 120 shown in Figure 4.

[0042] The countermeasure calculation unit 102 compares the priorities of the acquired countermeasures B, C, and E. In the example above, the countermeasure with the highest priority is countermeasure C. In that case, the countermeasure calculation unit 102 selects countermeasure C as the second countermeasure. In attack routes #1 and #2 shown in Figure 7, countermeasure C is implemented for the attack step from host A to host B, the attack step from host B to host C, and the attack step from host D to host C. The risk value calculation unit 103 calculates the risk value when countermeasure C is implemented. If the risk value after countermeasure C is implemented is below a predetermined threshold, the countermeasure calculation unit 102 selects additional countermeasures. The countermeasure calculation unit 102 repeats adding countermeasures until the risk value is equal to or greater than the predetermined threshold. When the risk value is equal to or greater than the predetermined threshold, the countermeasure calculation unit 102 terminates the planning of countermeasures.

[0043] Next, we will explain how to calculate the risk value. Figure 8 schematically illustrates the calculation of the risk value. Figure 8 shows two attack routes, #1 and #2, where host A is the entry point of the attack and host B is the final target of the attack. In the example in Figure 8, the effectiveness (priority) of countermeasures for the attack step from host A to host B is set to 0.9, the effectiveness of countermeasures for the attack step from host B to host B is set to 0.6, and the effectiveness of countermeasures for the attack step from host B to host C is set to 0.3. Also, the effectiveness of countermeasures for the attack step from host B to host D is set to 0.8, and the effectiveness of countermeasures for the attack step from host D to host C is set to 0.7. The effectiveness of countermeasures for each attack step is calculated based on the priority included in the countermeasure candidate table 120 and the priority included in the countermeasure compatibility table.

[0044] The risk value calculation unit 103 calculates a risk value for each attack step included in the attack route. For example, the risk value calculation unit 103 calculates the risk value based on the business damage level, threat level, and vulnerability level of the attack step. The business damage level and threat level may be included in the risk analysis result 201, for example. The business damage level and threat level each have, for example, three levels from level 1 to level 3. The risk value calculation unit 103 determines the risk value, for example, based on the business damage level and the combination of the product of the threat level and vulnerability level.

[0045] For example, the risk value calculation unit 103 converts the effectiveness of countermeasures into a vulnerability level according to that value. Here, the vulnerability level is assumed to have three levels, from level 1 to level 3. The risk value calculation unit 103 sets the vulnerability level to level 1 if, for example, the effectiveness of countermeasures is 0.8 or higher. The risk value calculation unit 103 sets the vulnerability level to level 2 if the effectiveness of countermeasures is 0.5 or more but less than 0.8. The risk value calculation unit 103 sets the vulnerability level to level 3 if the effectiveness of countermeasures is less than 0.5. For example, for the attack step from host A to host B, the risk value calculation unit 103 sets the vulnerability level to level 1 because the effectiveness of countermeasures is 0.9.

[0046] Figure 9 shows the map used to determine the risk value. In Figure 9, the horizontal axis corresponds to the business damage level, and the vertical axis corresponds to the product of the threat level and the vulnerability level. Risk value A is the highest risk, and risk value E is the lowest risk. The risk value calculation unit 103 calculates the risk value for each attack step, for example, using the map shown in Figure 9. For example, suppose that for an attack step from host A to host B, the vulnerability level is level 1, the threat level is level 3, and the business damage level is level 2. In that case, the risk value calculation unit 103 determines that the risk value for the attack step from host A to host B is risk value C.

[0047] The risk value calculation unit 103 determines the risk value of an attack route from the risk values ​​calculated for each attack step. For example, the risk value calculation unit 103 determines the risk value of the attack route as the risk value of the attack step with the lowest risk among the risk values ​​of the attack steps included in the attack route. This is because, in order for an attacker to succeed in an attack route, they need to succeed in the attack step with the lowest risk value, or in other words, the attack step that is the most difficult to attack. In the example in Figure 9, the risk value calculation unit 103 determines the risk value of attack route #1 as risk value C. For attack route #2, the risk value calculation unit 103 determines the risk value as risk value D. The method for determining the risk value is not limited to the method described above, and the risk value calculation unit 103 may determine the risk value using a method different from the method described above.

[0048] Figure 10 shows an example of displaying the risk value of an attack route, including the effectiveness of countermeasures. The countermeasure effectiveness visualization unit 104 calculates the total value of the countermeasure effectiveness (priority) for each attack route. For example, for attack route #1 shown in Figure 9, the countermeasure effectiveness visualization unit 104 calculates 0.9 + 0.6 + 0.3 = 1.8 as the total value of the countermeasure effectiveness for attack route #1. The countermeasure effectiveness visualization unit 104 rounds down the decimal part of the total value of the countermeasure effectiveness to make it an integer. The countermeasure effectiveness visualization unit 104 divides the countermeasure effectiveness into five intervals: 0, 1, 2, 3, and 4 or more (4+). For each combination of countermeasure effectiveness interval (integer value) and risk value, the countermeasure effectiveness visualization unit 104 counts the number of attack routes for that combination. The countermeasure effectiveness visualization unit 104 displays the counted number of attack routes in the table format shown in Figure 10.

[0049] The countermeasure effectiveness visualization unit 104 may calculate the number of countermeasures implemented along an attack route instead of the total value of the countermeasure effects along the attack route. In this case, the countermeasure effectiveness visualization unit 104 may divide the number of countermeasures into multiple intervals, such as 0 or more but less than 2, 2 or more but less than 4, and 4 or more, and display the number of attack routes in a table format for each risk value and for each interval.

[0050] Users planning security measures can refer to the table shown in Figure 10 to understand the distribution of attack route risk values. Furthermore, users can find out the number of attack routes for each level of countermeasure effectiveness for each risk value. By referring to the table in Figure 10, users can, for example, find out the number of attack routes with highly effective countermeasures in place, and the number of attack routes without highly effective countermeasures, for high-risk attack routes. Users can also find out the extent to which attack routes with high risk exist that have no countermeasures in place, or where the countermeasures are not sufficiently effective.

[0051] Next, the operating procedure will be explained. Figure 11 shows the operating procedure (information processing method) in the countermeasure planning support device 100. The collection unit 101 acquires the risk analysis results 201 (step S1). The countermeasure calculation unit 102 analyzes the attack route and identifies vulnerabilities used in the attack (step S2). The countermeasure calculation unit 102 selects countermeasures against the attack (step S3). In selecting the first countermeasure, the countermeasure calculation unit 102 refers to the countermeasure candidate table 120 and selects effective countermeasures for each attack step included in the attack route based on priority.

[0052] The risk value calculation unit 103 calculates the risk value if the countermeasure selected in step S3 is implemented in the system under analysis (step S4). The countermeasure calculation unit 102 determines whether the risk value calculated in step S4 is less than a predetermined threshold (step S5). If the countermeasure calculation unit 102 determines in step S5 that the risk value is less than the threshold, it returns to step S3 and selects an additional countermeasure. For the second and subsequent additions of countermeasures, the countermeasure calculation unit 102 uses the countermeasure candidate table 120 and the countermeasure compatibility table 121 to select an additional countermeasure, taking into account its compatibility with the countermeasure already selected.

[0053] If the countermeasure calculation unit 102 determines in step S5 that the risk value is above a predetermined threshold, it terminates the planning of countermeasures. The countermeasure effectiveness visualization unit 104 calculates the effectiveness (priority) of the countermeasures included in the planned countermeasures and their combinations for each attack route (step S6). In step S6, the countermeasure effectiveness visualization unit 104 calculates, for example, the total priority value for each attack route.

[0054] The countermeasure effectiveness visualization unit 104 displays the calculated countermeasure effectiveness in relation to the risk value of the attack route (step S7). In step S7, the countermeasure calculation unit 102 divides the total value of the countermeasure effectiveness into multiple intervals and displays the number of attack routes corresponding to the interval of the countermeasure effectiveness and the risk value in a table format. Steps S6 and S7 correspond to the operation procedure (information processing method) of the countermeasure effectiveness visualization unit 104.

[0055] In this embodiment, the countermeasure compatibility table 121 stores information such as the effectiveness or priority of a particular combination of countermeasures, and whether the combination is feasible. When formulating countermeasures, the countermeasure calculation unit 102 refers to the countermeasure candidate table 120 and selects the first countermeasure. When selecting the second and subsequent countermeasures, the countermeasure calculation unit 102 refers to the countermeasure candidate table 120 and the countermeasure compatibility table 121 and selects additional countermeasures. In this embodiment, the effectiveness or priority of countermeasures is obtained from the countermeasure compatibility table 121 for each combination of countermeasures. In this embodiment, the countermeasure calculation unit 102 does not need to comprehensively calculate the effect of implementing countermeasures for all combinations, and can formulate countermeasures that combine multiple countermeasures with less computation.

[0056] In this embodiment, the countermeasure compatibility table 121 only needs to store the effects or priority of countermeasures, as well as whether or not they can be combined, for several combinations of countermeasures; it does not need to store the effects or priority for all combinations of countermeasures. For combinations of countermeasures that are not in the countermeasure compatibility table 121, the countermeasure calculation unit 102 can select additional countermeasures from the countermeasure candidate table 120, assuming that there is no overlap in countermeasure effects or restrictions on combinations. In this embodiment, information can be sequentially added to the countermeasure compatibility table 121 for combinations of countermeasures for which overlapping effects or whether or not they can be combined has been determined. In that case, the countermeasure calculation unit 102 can use the countermeasure compatibility table 121 with the added information to formulate countermeasures while considering newly determined countermeasures with overlapping effects or whether or not they can be combined.

[0057] Next, the physical configuration of the countermeasure planning support device 100 will be described. Figure 12 shows an example of the configuration of a computer device that can be used as the countermeasure planning support device 100. The computer device 500 has a control unit (CPU: Central Processing Unit) 510, a storage unit 520, a ROM (Read Only Memory) 530, a RAM (Random Access Memory) 540, a communication interface (IF: Interface) 550, and a user interface 560. The computer device 500 may also be used as a countermeasure effect visualization unit 104.

[0058] The communication interface 550 is an interface for connecting the computer device 500 to a communication network via wired communication means or wireless communication means. The user interface 560 includes a display unit, such as a display. The user interface 560 also includes input units such as a keyboard, mouse, and touch panel.

[0059] The storage unit 520 is an auxiliary storage device capable of holding various types of data. The storage unit 520 does not necessarily have to be part of the computer device 500; it may be an external storage device or cloud storage connected to the computer device 500 via a network. The storage unit 520 may be used, for example, to store at least one of the countermeasure candidate table 120 and the countermeasure compatibility table 121 shown in Figure 2.

[0060] ROM 530 is a non-volatile memory device. For example, a semiconductor memory device such as a relatively small-capacity flash memory is used for ROM 530. The program executed by the CPU 510 can be stored in the storage unit 520 or ROM 530. The storage unit 520 or ROM 530 stores various programs, for example, for realizing the functions of each part within the countermeasure planning support device 100.

[0061] The program, when loaded into a computer, includes a set of instructions (or software code) for causing the computer to perform one or more of the functions described in the embodiments. The program may be stored in a non-temporary computer-readable medium or a physical storage medium. Examples, but not limited to, include RAM, ROM, flash memory, solid-state drive (SSD) or other memory technologies, Compact Disc (CD), digital versatile disc (DVD), Blu-ray® disc or other optical disc storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices. The program may be transmitted over a temporary computer-readable medium or a communication medium. Examples, but not limited to, include, a temporary computer-readable medium or a communication medium that includes electrically, optically, acoustically, or otherwise propagating signals.

[0062] RAM 540 is a volatile memory device. Various semiconductor memory devices such as DRAM (Dynamic Random Access Memory) or SRAM (Static Random Access Memory) can be used for RAM 540. RAM 540 can be used as an internal buffer for temporarily storing data. CPU 510 loads the program stored in memory unit 520 or ROM 530 into RAM 540 and executes it. By executing the program, CPU 510 can realize the functions of each part within the countermeasure planning support device 100. CPU 510 may have an internal buffer that can temporarily store data.

[0063] Although embodiments of this disclosure have been described in detail above, this disclosure is not limited to the embodiments described above, and modifications and changes to the embodiments described above, without departing from the spirit of this disclosure, are also included in this disclosure.

[0064] For example, some or all of the above embodiments may also be described as follows, but are not limited to the following.

[0065] [Note 1] An analysis result acquisition means for acquiring the results of a risk analysis on the system under analysis, including attack routes, A countermeasure calculation means for formulating countermeasures against attacks used in the attack route, using a countermeasure candidate table including multiple countermeasures that can be implemented against an attack and an indicator showing the effectiveness of each countermeasure, and a countermeasure compatibility table including combinations of countermeasures in which two or more countermeasures from the multiple countermeasures are combined and an indicator showing the effectiveness of said combination of countermeasures, An information processing apparatus comprising: an indicator showing the effectiveness of the measures included in the planned measures; and a risk value calculation means for calculating the risk value of the attack route when the planned measures are introduced to the system under analysis, based on an indicator showing the effectiveness of the combination of measures included in the planned measures.

[0066] [Note 2] The information processing device according to Appendix 1, wherein the countermeasure calculation means selects the first countermeasure based on an index indicating the effectiveness of the countermeasures included in the countermeasure candidate table, and selects the second and subsequent countermeasures based on at least one of the effectiveness of the countermeasures included in the countermeasure candidate table and the effectiveness of the combination of countermeasures included in the countermeasure compatibility table.

[0067] [Note 3] The countermeasure calculation means, in selecting the second and subsequent countermeasures, sequentially selects the unselected countermeasures from the plurality of countermeasures, checks whether the combination of the selected countermeasures and one or more already selected countermeasures is included in the countermeasure compatibility table, and if it is included, uses an index showing the effect of the combination of countermeasures included in the countermeasure compatibility table as an index showing the effect when the selected countermeasures are introduced, as described in Appendix 2.

[0068] [Note 4] The countermeasure calculation means, if no combination including the selected countermeasure and one or more already selected countermeasures is included in the countermeasure compatibility table, uses an index indicating the effect of a countermeasure included in the countermeasure candidate table as an index indicating the effect when the selected countermeasure is implemented, as described in Appendix 3.

[0069] [Note 5] The aforementioned countermeasure compatibility table further includes information indicating whether combinations of two or more countermeasures are possible, The countermeasure calculation means, if the countermeasure compatibility table contains information indicating that the selected countermeasure cannot be combined with one or more already selected countermeasures, does not include the selected countermeasure in the countermeasure to be planned, as described in Appendix 3 or 4.

[0070] [Note 6] An information processing device described in any one of the appendices 1 to 5, wherein an indicator showing the effect of the aforementioned combination is set according to the effect of the combination of countermeasures and the implementation cost.

[0071] [Note 7] The countermeasure calculation means is an information processing device according to any one of the appendices 1 to 5, which adds the countermeasure until the calculated risk value falls below a predetermined standard.

[0072] [Note 8] The information processing device according to any one of the appendices 1 to 7, further comprising means for visualizing the effectiveness of countermeasures, which calculates the effectiveness of the countermeasures if the countermeasures described above are implemented for each attack route, and displays the calculated effectiveness of the countermeasures in relation to the risk value of the attack route.

[0073] [Note 9] The means for visualizing the effectiveness of the countermeasures is an information processing device as described in Appendix 8, which calculates the effectiveness of the countermeasures as the sum of an index showing the effect of the countermeasures included in the planned countermeasures, the sum of an index showing the effect of a combination of the countermeasures included in the planned countermeasures, or the sum of the countermeasures included in the planned countermeasures.

[0074] [Note 10] The means for visualizing the effectiveness of the countermeasures divides the effectiveness of the countermeasures into multiple intervals and displays the number of attack routes corresponding to the interval of the effectiveness of the countermeasures and the risk value, as described in Appendix 8 or 9.

[0075] [Note 11] A means for calculating the effectiveness of countermeasures if the planned countermeasures are implemented for each attack route included in the risk analysis results for the system under analysis, An information processing apparatus comprising a display means for displaying the calculated countermeasure effect in relation to the risk value of the attack route.

[0076] [Note 12] The countermeasure effect calculation means calculates the sum of the indicators indicating the effect of the countermeasures included in the planned countermeasure, which are included in a countermeasure candidate table that includes a plurality of countermeasures that can be introduced against an attack and an indicator indicating the effect of each countermeasure, and in a countermeasure compatibility table that includes a combination of countermeasures in which two or more countermeasures from the plurality of countermeasures are combined and an indicator indicating the effect of the combination of countermeasures, as the countermeasure effect, as the countermeasure effect, as described in Appendix 11.

[0077] [Note 13] The countermeasure effect calculation means is an information processing device as described in Appendix 11, which calculates the sum of the countermeasures included in the planned countermeasures as the countermeasure effect.

[0078] [Note 14] The display means is an information processing device according to any one of appendices 11 to 13, which divides the countermeasure effect into a plurality of intervals and displays the number of attack routes corresponding to the interval of the countermeasure effect and the risk value.

[0079] [Note 15] Obtain the results of the risk analysis for the system under analysis, including the attack route. Using a countermeasure candidate table that includes multiple countermeasures that can be implemented against an attack and indicators showing the effectiveness of each countermeasure, and a countermeasure compatibility table that includes combinations of countermeasures in which two or more of the above multiple countermeasures are combined and indicators showing the effectiveness of said combinations of countermeasures, countermeasures against attacks used in the attack route are devised. An information processing method comprising calculating the risk value of the attack route when the planned countermeasures are implemented in the system under analysis, based on an index showing the effect of the countermeasures included in the planned countermeasures, and an index showing the effect of the combination of countermeasures included in the planned countermeasures.

[0080] [Note 16] For each attack route included in the risk analysis results for the system under analysis, calculate the effectiveness of the countermeasures if they were implemented. An information processing method comprising displaying the calculated countermeasure effect in relation to the risk value of the attack route.

[0081] [Note 17] Obtain the results of the risk analysis for the system under analysis, including the attack route. Using a countermeasure candidate table that includes multiple countermeasures that can be implemented against an attack and indicators showing the effectiveness of each countermeasure, and a countermeasure compatibility table that includes combinations of countermeasures in which two or more of the above multiple countermeasures are combined and indicators showing the effectiveness of said combinations of countermeasures, countermeasures against attacks used in the attack route are devised. A non-temporary computer-readable medium for storing a program that causes a computer to perform a process including calculating the risk value of the attack route when the planned countermeasures are implemented in the system under analysis, based on an index showing the effectiveness of the countermeasures included in the planned countermeasures, and an index showing the effectiveness of the combination of countermeasures included in the planned countermeasures.

[0082] [Note 18] For each attack route included in the risk analysis results for the system under analysis, calculate the effectiveness of the countermeasures if they were implemented. A non-temporary computer-readable medium for storing a program that causes a computer to perform a process including displaying the calculated countermeasure effect in relation to the risk value of the attack route. [Explanation of symbols]

[0083] 10: First Information Processing Device 11:Analysis result acquisition means 12: Countermeasure calculation method 13: Risk Value Calculation Method 15: Table of potential countermeasures 16: Compatibility Table for Countermeasures 20: Second Information Processing Device 21: Method for calculating the effectiveness of countermeasures 22:Display means 100: Countermeasure planning support device 101: Collection Department 102: Countermeasure Calculation Unit 103: Risk Value Calculation Unit 104: Department for Visualizing the Effectiveness of Countermeasures 120: Table of potential countermeasures 121: Compatibility Table for Countermeasures 201: Risk Analysis Results 500: Computer device 510:CPU 520: Storage section 530:ROM 540: RAM 550: Communication IF 560: User Interface

Claims

1. An analysis result acquisition means for acquiring the results of a risk analysis on the system under analysis, including attack routes, A countermeasure calculation means for formulating countermeasures against attacks used in the attack route, using a countermeasure candidate table including multiple countermeasures that can be implemented against an attack and an indicator showing the effectiveness of each countermeasure, and a countermeasure compatibility table including combinations of countermeasures in which two or more countermeasures from the multiple countermeasures are combined and an indicator showing the effectiveness of said combination of countermeasures, The system comprises a risk value calculation means for calculating the risk value of the attack route when the planned countermeasures are implemented in the system under analysis, based on an index showing the effect of the countermeasures included in the planned countermeasures, and an index showing the effect of the combination of countermeasures included in the planned countermeasures. The countermeasure calculation means selects the first countermeasure based on an index indicating the effectiveness of the countermeasures included in the countermeasure candidate table, and selects the second and subsequent countermeasures based on at least one of the effectiveness of the countermeasures included in the countermeasure candidate table and the effectiveness of the combination of countermeasures included in the countermeasure compatibility table. The countermeasure calculation means, in selecting the second and subsequent countermeasures, sequentially selects the unselected countermeasures from the plurality of countermeasures, checks whether the combination of the selected countermeasures and one or more already selected countermeasures is included in the countermeasure compatibility table, and if it is included, uses an index showing the effect of the combination of countermeasures included in the countermeasure compatibility table as an index showing the effect when the selected countermeasures are introduced.

2. An analysis result acquisition means for acquiring the results of a risk analysis on the system under analysis, including attack routes, A countermeasure calculation means for formulating countermeasures against attacks used in the attack route, using a countermeasure candidate table including multiple countermeasures that can be implemented against an attack and an indicator showing the effectiveness of each countermeasure, and a countermeasure compatibility table including combinations of countermeasures in which two or more countermeasures from the multiple countermeasures are combined and an indicator showing the effectiveness of said combination of countermeasures, A risk value calculation means for calculating the risk value of the attack route when the planned countermeasures are implemented in the system under analysis, based on an index showing the effect of the countermeasures included in the planned countermeasures, and an index showing the effect of the combination of countermeasures included in the planned countermeasures. The system includes means for visualizing the effectiveness of countermeasures, which calculates the effectiveness of the countermeasures if the planned countermeasures are implemented for each attack route, and displays the calculated effectiveness of the countermeasures in relation to the risk value of the attack route. The countermeasure effectiveness visualization means is an information processing device that divides the countermeasure effectiveness into multiple intervals and displays the number of attack routes corresponding to the interval of the countermeasure effectiveness and the risk value.

3. The information processing apparatus according to claim 2, wherein the countermeasure calculation means selects a first countermeasure based on an index indicating the effectiveness of countermeasures included in the countermeasure candidate table, and selects a second and subsequent countermeasures based on at least one of the effectiveness of countermeasures included in the countermeasure candidate table and the effectiveness of combinations of countermeasures included in the countermeasure compatibility table.

4. The information processing apparatus according to claim 1, wherein the countermeasure calculation means, if no combination including the selected countermeasure and one or more already selected countermeasures is included in the countermeasure compatibility table, uses an index indicating the effect of a countermeasure included in the countermeasure candidate table as an index indicating the effect when the selected countermeasure is implemented.

5. The aforementioned countermeasure compatibility table further includes information indicating whether two or more countermeasures can be combined, The information processing apparatus according to claim 1 or 4, wherein the countermeasure calculation means does not include the selected countermeasure in the countermeasures to be formulated if the countermeasure compatibility table contains information indicating that a combination of the selected countermeasure and one or more already selected countermeasures is not possible.

6. The information processing apparatus according to any one of claims 1 to 5, wherein the index showing the effect of the aforementioned combination is set according to the effect of the combination of countermeasures and the implementation cost.

7. The information processing apparatus according to any one of claims 1 to 6, wherein the countermeasure calculation means adds the countermeasure until the calculated risk value falls below a predetermined standard.

8. The information processing apparatus according to claim 1, 4, or 5, further comprising means for visualizing the effectiveness of countermeasures, which calculates the effectiveness of the countermeasures if the planned countermeasures are implemented for each attack route, and displays the calculated effectiveness of the countermeasures in relation to the risk value of the attack route.

9. The information processing device according to claim 2, 3, or 8, wherein the means for visualizing the effectiveness of the countermeasures calculates the sum of indicators showing the effectiveness of the countermeasures for the countermeasures included in the planned countermeasures, and the sum of indicators showing the effectiveness of the combination of countermeasures for the combination of countermeasures included in the planned countermeasures, or the sum of the countermeasures included in the planned countermeasures, as the effectiveness of the countermeasures.

10. A means for calculating the effectiveness of countermeasures if the planned countermeasures are implemented for each attack route included in the risk analysis results for the system under analysis, The system includes a display means that displays the calculated countermeasure effect in relation to the risk value of the attack route, The display means is an information processing device that divides the countermeasure effect into multiple sections and displays the number of attack routes corresponding to the section of the countermeasure effect and the risk value.

11. The information processing apparatus according to claim 10, wherein the countermeasure effect calculation means calculates the sum of the indicators indicating the effect of the countermeasures to the countermeasures included in the planned countermeasure, which are included in a countermeasure candidate table that includes a plurality of countermeasures that can be introduced against an attack and an indicator indicating the effect of each countermeasure, and in a countermeasure compatibility table that includes a combination of countermeasures in which two or more countermeasures from the plurality of countermeasures are combined and an indicator indicating the effect of the combination of countermeasures, as the countermeasure effect.

12. The information processing apparatus according to claim 10, wherein the countermeasure effect calculation means calculates the sum of the countermeasures included in the planned countermeasure as the countermeasure effect.

13. Computers Obtain the results of the risk analysis for the system under analysis, including the attack route. Using a countermeasure candidate table that includes multiple countermeasures that can be implemented against an attack and indicators showing the effectiveness of each countermeasure, and a countermeasure compatibility table that includes combinations of countermeasures in which two or more of the above multiple countermeasures are combined and indicators showing the effectiveness of said combinations of countermeasures, countermeasures against attacks used in the attack route are devised. Based on an index showing the effectiveness of the measures included in the planned measures, and an index showing the effectiveness of the combination of measures included in the planned measures, the risk value of the attack route when the planned measures are implemented in the system under analysis is calculated. In formulating the aforementioned countermeasures, the first countermeasure is selected based on an indicator showing the effectiveness of the countermeasures included in the countermeasure candidate table, and the second and subsequent countermeasures are selected based on at least one of the effectiveness of the countermeasures included in the countermeasure candidate table and the effectiveness of the combination of countermeasures included in the countermeasure compatibility table. An information processing method comprising the following steps in selecting the second and subsequent countermeasures: sequentially selecting the unselected countermeasures from the multiple countermeasures, checking whether the combination of the selected countermeasures and one or more already selected countermeasures is included in the countermeasure compatibility table, and if it is included, using an indicator showing the effect of the combination of countermeasures included in the countermeasure compatibility table as an indicator showing the effect when the selected countermeasures are implemented.

14. Obtain the results of the risk analysis for the system under analysis, including the attack route. Using a countermeasure candidate table that includes multiple countermeasures that can be implemented against an attack and indicators showing the effectiveness of each countermeasure, and a countermeasure compatibility table that includes combinations of countermeasures in which two or more of the above multiple countermeasures are combined and indicators showing the effectiveness of said combinations of countermeasures, countermeasures against attacks used in the attack route are devised. Based on an index showing the effectiveness of the measures included in the planned measures, and an index showing the effectiveness of the combination of measures included in the planned measures, the risk value of the attack route when the planned measures are implemented in the system under analysis is calculated. In formulating the aforementioned countermeasures, the first countermeasure is selected based on an indicator showing the effectiveness of the countermeasures included in the countermeasure candidate table, and the second and subsequent countermeasures are selected based on at least one of the effectiveness of the countermeasures included in the countermeasure candidate table and the effectiveness of the combination of countermeasures included in the countermeasure compatibility table. A program for causing a computer to perform a process that, in selecting the second and subsequent countermeasures, sequentially selects the unselected countermeasures from among the multiple countermeasures, checks whether the combination of the selected countermeasures and one or more already selected countermeasures is included in the countermeasure compatibility table, and, if included, uses an index showing the effect of the combination of countermeasures included in the countermeasure compatibility table as an index showing the effect when the selected countermeasures are implemented.

Images