Security Measures Planning Support System and Security Measures Planning Support Method

Abstract

To provide a security measure planning support system and method for supporting proposal of an appropriate security design while adopting cost constraint as an evaluation value.SOLUTION: A security measure planning support system 10 includes: a functional decomposition unit 31 which decomposes an information asset existing in an information system where security measures are to be taken, into functions of the information asset; a threat determination unit 32 which determines a threat related to a cyberattack from the functions of the information asset; a risk calculation unit 33 which calculates a risk value of the information system by quantifying threats based on a risk degree; a preferential threat selection unit 34 which selects a threat against which measures are to be taken, based on the risk value; a measure selection unit 35 which selects a measure against the threat; a product selection unit 36 which selects a list of security measure products to implement the measure; and a cost calculation unit 37 which selects a security product that minimizes the risk value based on the constraint of monetary cost, from the list of security measure products.SELECTED DRAWING: Figure 1

Description

Technical Field

[0001] The present invention relates to a security countermeasure planning support system and a security countermeasure planning support method.

Background Art

[0002] In recent years, with the development of Internet technology, various types of information are being exchanged in the cyber space, and the value of information assets is increasing. On the other hand, due to the increasing value of information assets, cyber attacks such as information leakage and equipment stoppage are also expanding, and the importance of security countermeasures is also increasing.

[0003] As part of such security countermeasures, it is necessary to consider, design, and construct security countermeasures suitable for each system that handles information assets. Although there are standards such as ISO27000 for information system security design, knowledge of advanced security such as cyber attacks and risk analysis is required.

[0004] Due to the large scale and complexity of information systems, it is easy to overlook vulnerable points, and unique security countermeasures cannot be applied due to their diversity. Therefore, appropriate design for each information system is required. Related technologies include Patent Document 1 and Patent Document 2.

[0005] Patent Document 1 derives vulnerable points based on the route information and configuration information of the target information system, sets pre-registered countermeasures, recalculates, visualizes the risk reduction effect of the countermeasures, and proposes appropriate security countermeasures.

[0006] Patent Document 2 generates a scenario of a cyber attack on the target information system and proposes countermeasures that prevent the scenario from being realized.

Prior Art Documents

Patent Documents

[0007] [Patent Document 1] Japanese Patent Publication No. 2018-77597 [Patent Document 2] Japanese Patent Publication No. 2019-219898 [Overview of the project] [Problems that the invention aims to solve]

[0008] Patent Document 1 calculates security measures that fall below a threshold set based on risk, but in actual security design, the cost of building the information system is fixed, and there are situations where the proposed security measures cannot be directly applied.

[0009] While Patent Document 2 includes the cost of the proposed countermeasures in its evaluation, the proposal is at a functional level and does not allow for specific security equipment-level proposals. Since the cost of security construction varies depending on the product vendor, even for equipment with similar functions, Patent Document 2 cannot provide proposals that take equipment costs into account.

[0010] The objective of this invention is a security measures planning support system that supports the proposal of appropriate security designs while adopting cost constraints as an evaluation value. [Means for solving the problem]

[0011] A security countermeasure planning support system according to one aspect of the present invention is characterized by comprising: a function decomposition unit that decomposes information assets present in an information system on which security countermeasures are to be implemented into functions possessed by the information assets; a threat determination unit that determines threats related to cyberattacks from the functions of the information assets; a risk calculation unit that quantifies the threats based on the degree of risk and calculates a risk value for the information system; a priority threat selection unit that selects the threats to be addressed based on the risk value; a countermeasure selection unit that selects countermeasures against the threats; a product selection unit that selects a list of security countermeasure products that realize the countermeasures; and a cost calculation unit that selects a security product from the list of security countermeasure products that minimizes the risk value based on the constraint of monetary cost. [Effects of the Invention]

[0012] According to one aspect of the present invention, a security measures planning support system is available that can support the proposal of an appropriate security design while employing cost constraints as an evaluation value. [Brief explanation of the drawing]

[0013] [Figure 1] This diagram shows the general configuration of the security measures planning support system. [Figure 2] This figure shows an example of the hardware configuration of an information processing device that constitutes a security countermeasure planning support system. [Figure 3] This figure shows an example of an information asset database. [Figure 4] This figure shows an example of a threat database. [Figure 5] This figure shows an example of a countermeasures database. [Figure 6] This figure shows an example of a product database. [Figure 7] This figure shows an example of an input screen. [Figure 8] This figure shows an example of the output screen. [Figure 9] This is a flowchart explaining the main processing steps of the security measures planning support system. [Figure 10] It is a flowchart for explaining risk calculation processing. [Figure 11] It is a flowchart for explaining product selection processing. [Figure 12] It is a flowchart for explaining DB registration processing.

Mode for Carrying Out the Invention

[0014] Hereinafter, embodiments of the present invention will be described with reference to the drawings. Note that the following description and drawings are examples for explaining the present invention, and for the sake of clarity of explanation, omissions and simplifications are made as appropriate. The present invention can be implemented in various other forms. Unless otherwise limited, each component may be singular or plural.

[0015] In the following description, the same or similar configurations may be denoted by the same reference numerals and redundant descriptions may be omitted. Also, in the following description, various types of information may be described using expressions such as "information" and "table", but the various types of information may be represented by other data structures. Also, as expressions for identification information, there are expressions such as "identification information", "identifier", "name", "ID", and "number", and these can be mutually replaced. Also, in the following description, "database" may be abbreviated as "DB" and "table" may be abbreviated as "TBL".

Embodiment

[0016] Referring to FIG. 1, the configuration of the security countermeasure planning support system according to the embodiment will be described. This embodiment relates to a technique for supporting the planning of security countermeasures in the security design of an enterprise system.

[0017] As shown in FIG. 1, the security countermeasure planning support system 10 includes an IF (interface) unit 20, a calculation unit 30, and a DB unit 40. For example, the security countermeasure planning support system 10 is used by a system department of an organization that constructs an information system or a system vendor commissioned by the system department to perform the construction.

[0018] The security measures planning support system 10 receives configuration information about network equipment, servers, and other information assets of the information system to be implemented as security measures, as well as the budget allocated to security measures as defined by the organization, from the user terminal 11 via the network to the input unit 500. Based on this, the result output unit 600 outputs candidate security measures suitable for the information system and budget entered.

[0019] The information systems that this system targets as input are not particularly limited in terms of attributes such as operating only in a private environment or being connected to the internet. For example, they consist of information processing devices (servers, client devices, network devices, etc.) that make up information systems operated in organizations such as companies and government agencies, as well as communication equipment and IoT devices installed in various locations (factories, warehouses, distribution centers, etc.).

[0020] As shown in Figure 1, the IF unit 20 has an input unit 500, a result output unit 600, and an information registration unit 700. The IF unit 20 transmits information such as the configuration information and cost of the information assets of the information system for which security measures are to be implemented to the calculation unit 30 via the input unit 500. The result output unit 600 displays the results from the calculation unit 30 on the user terminal 11. At this time, it may have a function to output as a screen, or it may only notify the user of the results. The information registration unit 700 has a function to register information from the registrant terminal 12 to the database of the DB unit 40. Note that the user terminal 11 and the registrant terminal 12 may be the same person.

[0021] The calculation unit 30 includes a function decomposition unit 31, a threat determination unit 32, a risk calculation unit 33, a priority threat selection unit 34, a countermeasure selection unit 35, a product selection unit 36, and a cost calculation unit 37. The function decomposition unit 31 matches the asset information received from the input unit 500 with the information asset DB 100, and the threat determination unit 31 decomposes the asset information into functions.

[0022] The threat determination unit 32 receives functions from the function decomposition unit 31, matches them with the threat DB 200, and obtains the threats present for each function. The risk calculation unit 33 receives network information of the assets from the input unit 500 and threat information from the threat determination unit 32, and calculates the risk value of the target information system.

[0023] The priority threat selection unit 34 receives risk values ​​from the risk calculation unit 33 and selects the appropriate threats according to predetermined thresholds. The countermeasure selection unit 36 ​​receives a list of threats to be addressed from the priority threat selection unit 34, compares it with the countermeasure DB 300, and selects countermeasures that can reduce the risk of the threats. The product selection unit 36 ​​receives a list of countermeasures from the countermeasure selection unit 35, compares it with the product DB 400, and selects a list of security products to implement the countermeasures.

[0024] The cost calculation unit 37 selects a combination of security products that optimizes the risk calculated by the risk calculation unit 33, using the monetary cost constraint received from the input unit 500 as the upper limit, and selecting security products selected by the product selection unit 36.

[0025] Thus, the security countermeasure planning support system 10 includes a function decomposition unit 31 that decomposes information assets present in an information system to be implemented into functions possessed by the information assets; a threat determination unit 32 that determines threats related to cyberattacks from the functions of the information assets; a risk calculation unit 33 that quantifies the threats based on their risk level and calculates a risk value for the information system; a priority threat selection unit 34 that selects the threats to be addressed based on the risk value; a countermeasure selection unit 35 that selects countermeasures against the threats; a product selection unit 36 ​​that selects a list of security countermeasure products to implement the countermeasures; and a cost calculation unit 37 that selects the security product from the list of security countermeasure products that minimizes the risk value based on monetary cost constraints.

[0026] Figure 2 is a diagram illustrating the hardware configuration of the components of the security countermeasure planning support system 10 (information processing device) shown in Figure 1.

[0027] The hardware consists of a CPU (1), memory (2), external storage device (3), interface (IF) (4), input / output device (5), and bus (6).

[0028] In this embodiment, the security countermeasure planning support system 10 is realized when programs that realize these functions are loaded into memory 2 and executed by CPU 1. These programs may be stored in advance in the external storage device 3 of the information processing device, or they may be introduced into the external storage device 3 from another device via a medium usable by IF 4 or input / output device 5 and the information processing device when necessary.

[0029] The media available to the information processing device refer, for example, to a storage medium that can be attached to or detached from the input / output device 5, or to a carrier wave or digital signal propagating through a network that can be connected to IF4. The program may be stored in the external storage device 3 and then loaded from there onto memory 2 and executed by the CPU 1, or it may be loaded directly onto memory 2 without being stored in the external storage device 3 and executed by the CPU 1.

[0030] Figure 3 shows a portion of the registered information as an example of the information asset DB100. In this embodiment, the means of risk analysis and countermeasure planning are shown using this registered information.

[0031] Asset ID 110 is an identifier used to identify the column number of the data. Information asset name 120 indicates the name of the information equipment that constitutes the information system. Vendor 130 is the product vendor of the information equipment. Function 140 indicates the role function of the information equipment.

[0032] Of the above items, asset ID 110 is assigned automatically when the information is registered. The assignment order does not need to be in a format that overlaps with other IDs; a sequential numbering format, such as items 101 to 106, is acceptable. Information asset name 120 is string information registered by the registrant. It is desirable that this information be the model number of the information asset.

[0033] Vendor 130 is string information registered by the registrant. This information indicates the product vendor name of the registered information asset and will not be used in subsequent processing, but it is registered in the database for management purposes.

[0034] Function 140 is string information registered by the registrant. This information indicates the functional role of the registered information asset. For example, if a product with model number Router-01 manufactured by Company α is registered, the registrant will determine the functional role of this asset and register it as a router. The registrant's determination may be based on the functions of the asset or on the vendor's specifications.

[0035] Figure 4 shows a portion of the registration information as an example of Threat DB200.

[0036] This embodiment demonstrates how to utilize the registered information for risk analysis and countermeasure planning.

[0037] Threat ID 210 is an identifier used to identify the column number of the data. Threat Name 220 indicates the name of a cyber threat that may occur in the information system. Description 230 describes the threat indicated by Threat Name 220. Related Function 240 indicates the functional name of the information device. Related Asset ID 250 indicates the ID that associates the functional name of the information device with the information asset DB 100.

[0038] Of the items listed above, Threat ID 210 is assigned automatically during information registration. The assignment order should not overlap with other IDs; sequential numbering, such as items 201 through 206, is acceptable. Threat Name 220 is a string of information registered by the registrant. This information may utilize classifications from, for example, Microsoft's STRIDE threat analysis framework.

[0039] Description 230 is string information registered by the registrant. This information provides a specific description of the threat; for example, item 201 describes a threat in which a client terminal is infected with malware. Related Function 240 is string information registered by the registrant. This information indicates the information asset that is the main focus when a threat occurs, and the string registered here must match the string registered in Function 140 if the information asset is the same.

[0040] The related asset ID 250 is string information registered by the registrant. This information is an identifier that uniquely links to the related function 240, and if they are the same asset, it must also match the asset ID 110. To ensure this ID matches, it is desirable to coordinate and match the IDs between databases.

[0041] Figure 5 shows a portion of the registered information as an example of the countermeasures DB300. In this embodiment, the means of risk analysis and countermeasure planning are shown using this registered information.

[0042] The countermeasure ID 310 is an identifier used to identify the column number of the data. The countermeasure name 320 indicates the name of the protection mechanism for the information system. The description 330 describes the protection mechanism indicated by the countermeasure name 320. The assumed threat 340 indicates the name of the threat targeted by the protection mechanism. The assumed threat ID 350 indicates the name of the assumed threat and the ID that associates it with the threat DB 200.

[0043] Of the above information, the countermeasure ID 310 is assigned automatically when the information is registered. The order of assignment is not limited to duplicates of other IDs; sequential numbering, such as from item 301 to 306, is acceptable. The countermeasure name 320 is a string of information registered by the registrant. This information indicates the function itself that avoids or reduces the risk of threats to information assets. For example, the name of a function such as IP reputation, as shown in item 301, may be registered, or an identifier assigned to IP reputation may be entered.

[0044] Description 330 is string information registered by the registrant. This information describes the content of the countermeasure name 320. This information will not be used in subsequent processing, but is registered for management purposes.

[0045] The assumed threat 340 is string information registered by the registrant. This information indicates the name of the threat to the information asset whose risk is avoided or reduced by the function described in the countermeasure name 320. The string described here must match the string described in threat name 220 or description 230 if it represents the same threat.

[0046] Furthermore, linking the countermeasure name with the anticipated threat can be based on the threats targeted by the security product in which the function is installed, or on the security expertise of the registrant. The countermeasure threat ID 350 is string information registered by the registrant. This information is an identifier that uniquely links to the anticipated threat 340, and if it is the same threat, it must also match the threat ID 210. It is desirable to coordinate and match these IDs between databases.

[0047] Figure 6 shows a portion of the registration information as an example of product DB400. In this embodiment, the means of risk analysis and countermeasure planning are shown using this registration information.

[0048] Product ID 410 is an identifier used to identify the column number of the data. Security product name 420 indicates the name of the security product targeted at information systems.

[0049] Security product classification 430 indicates the functional role of the security product. Vendor 440 indicates the vendor name of the security product. Cost 450 indicates the cost of the security product. Security features 460 shows a list of features possessed by the security product. Security ID 470 indicates the ID that associates the features possessed by the security product with the security DB 300.

[0050] Of the above information, Product ID 410 is assigned automatically during information registration. The assignment order does not need to be in a format that overlaps with other IDs; a sequential numbering format, such as items 401 to 405, is acceptable. Security product 420 is string information registered by the registrant. This information should preferably be the model number of the security product. Security function classification 430 is string information registered by the registrant.

[0051] This information indicates the functional role of the registered security product. For example, if firewall A1 manufactured by Company A is registered, the registrant will determine the functional role of this asset and register it as a firewall. The registrant's determination may be based on the functions of the asset or on the vendor's specifications. Vendor 440 is string information registered by the registrant.

[0052] This information indicates the product vendor name of the registered information asset and will not be used in subsequent processing, but it is registered in the database for management purposes. The cost of 450 is numerical information registered by the registrant. This information indicates the monetary cost of implementing security measures. It may be standardized in the database to show only the cost of the product itself, or it may show the total cost up to the point of implementation, but the criteria must be standardized.

[0053] The "Possessed Security Measures Function 460" is string information registered by the registrant. This information indicates the security measures included in the security product, and it is desirable to register it from the security product's specifications. The string described here must match the string described in the "Measurement Name 320" or "Description 330" if it indicates the same security measure.

[0054] The acquired countermeasure ID 470 is string information registered by the registrant. This information is an identifier that uniquely links to the acquired security countermeasure function 460, and if it is the same threat, it must also match the countermeasure ID 310. To ensure this ID matches, it is desirable to coordinate and match the IDs between databases.

[0055] Figure 7 shows an example of the screen configuration of the input unit 500.

[0056] This screen configuration consists of the following: This screen, as input table 501, consists of an identification number 502, a product model number input section 503, a placement location input section 504, a monetary cost threshold input section 505, a risk value threshold input section 506, a transmission section (calculation) 507, and a cursor 508.

[0057] The information assets of the target information system are entered into the product model number input section 503, and their location is entered into the location input section 504. The location can be selected as either a location accessible via the internet, a location accessible only from the local network, or a physically isolated location.

[0058] The monetary cost threshold input section 505 is used to input the amount of money that can be spent on security measures, and the risk value threshold input section 506 is used to input the acceptable risk level for the vulnerable area where security measures will be implemented. If neither threshold is required, only one of them can be entered. In this case, the result will be calculated without any thresholds being set. After entering the necessary parameters, the calculation is executed by operating the cursor 508 to select the transmission unit 507.

[0059] Figure 8 shows an example of the screen configuration of the result output unit 600.

[0060] This screen configuration consists of the following: This screen consists of a risk calculation table 601, which includes an identification number 602, a product model number section 603, a location section 604, a vendor name section 605, a function name section 606, an assumed threat section 607, and a risk section 608; and a countermeasure product table 609, which includes an identification number 610, a product name 611, a vendor 612, a monetary cost 613, a total cost output section 614, and a cursor 615.

[0061] The monetary cost threshold unit 603 and the risk value threshold unit 604 output the values ​​entered in Figure 7. The vendor unit 605 and the function name unit 606 refer to the information asset DB 100 from the input information and output the information if it is registered. The assumed threat unit 607 refers to the threat DB 200 from the input information and output the information if it is registered. If multiple threats are referenced at this time, a row is added and the information is output. The risk value unit 608 outputs the result of the risk calculation unit 33.

[0062] The countermeasure product table 609 shows the recommended security countermeasure products for the target information system. The product name section 611, vendor section 612, and cost section 613 indicate the recommended products and are output by referencing the product database 400. The total cost section 614 shows the total cost of the products and is calculated to be below a certain threshold.

[0063] Figure 9 is an example of a flowchart illustrating the main processing steps of a security measures planning support system.

[0064] S1 indicates the input to the security measures planning support system. As shown in Figure 7 above, information assets, network deployment information, monetary cost information, and risk threshold information are input to the input unit 500. At this time, it is not necessary to input monetary cost information and risk threshold information, and they are only input if necessary.

[0065] S2 calculates the risk value of the target information system based on the information entered in S1, using the calculation unit 30. Details will be explained in Figure 10 below.

[0066] Based on the information entered in S1, S3 selects a security product recommended by the calculation unit 30 for the target information system. Details are explained in Figure 11 below.

[0067] Figure 10 shows an example of the risk calculation processing flow shown in S2.

[0068] S11 derives the function 140 by associating the information of the information asset entered in S1 with the information asset name 120 of the information asset DB 100 using the function decomposition unit 31.

[0069] S12 derives threats by linking the asset ID 110 of each function derived in S11 with the related function ID 250 of the threat DB 200 using the threat determination unit 32.

[0070] S13 quantifies each threat calculated in S13 through a risk assessment performed by the risk calculation unit 33. At this time, calculation methods such as CVSS and CRSS are utilized. While input values ​​need to be varied depending on the formula used, this embodiment utilizes CRSS parameters.

[0071] In S14, the priority threat selection unit 34 determines whether the risk value calculated in S13 is equal to or greater than the risk threshold entered in S1. Threats determined to be below the threshold are deemed to require no countermeasures in this flow and are excluded from subsequent processing.

[0072] In S15, the countermeasure is derived by linking the threat ID 210 of the threat to be addressed, which was derived in S14, with the assumed threat ID 350 in the countermeasure DB 300 using the countermeasure selection unit 35.

[0073] S16 executes the processes from S12 to S15 until all functions are completed.

[0074] Figure 11 shows an example of the product selection process flow shown in S3.

[0075] S21 is a process that lists all the countermeasure functions derived in S16. S22 is a process that derives candidate products by linking the countermeasure IDs 310 of the countermeasure functions listed in S21 with the countermeasure IDs held in the product DB 400 by the product selection unit 36.

[0076] In step S23, the cost calculation unit 37 compares the cost of the security product (450) derived in S22 with the monetary cost information entered in S1, and excludes products that exceed the monetary cost information from the candidates.

[0077] In S24, the cost calculation unit 37 compares the existing countermeasure functions 460 and the countermeasure functions listed in S21 from the product list selected in S23, and selects one product that best covers the listed countermeasure functions. If there are multiple products that best cover the functions, the product with the lowest monetary cost is prioritized, and if the monetary costs are the same, the product with the smaller product ID is prioritized. Also, if monetary cost information has been entered, the threshold is lowered by subtracting the monetary cost of the selected product from the monetary cost information value.

[0078] S25 excludes the product selected in S24 from subsequent processing, as it has fulfilled the countermeasure function achieved by that product.

[0079] S26 removes the product selected in S24 from the product selection so that it is not selected again. S27 returns to S22 if there are any candidates with a monetary cost below the amount reduced by S24. If there are no more selectable products, S28 is performed.

[0080] S28 outputs the security product selected in the processing up to S27 to the result output unit 600. Note that the series of operations from S22 to S27 employs a calculation method generally known as the greedy algorithm.

[0081] Figure 12 shows an example of the processing flow for registering information to the database.

[0082] S31 is a process in which the information registration unit 700 registers the parameters necessary for processing the main flow to each DB of the DB unit 40 from the registrant terminal 12.

[0083] According to the above embodiment, by inputting the information assets of the target information system and the acceptable monetary cost, it is possible to propose appropriate security measures within the budget. [Explanation of Symbols]

[0084] 10. Security Measures Planning Support System 11. User terminals 12 Registered User Devices 20 IF section 30 Calculation section 31 Functional Disassembly Section 32 Threat Assessment Unit 33. Risk Calculation Department 34 Priority Threat Selection Department 35. Countermeasure Selection Department 36 Product Selection Department 37 Cost Accounting Department 40 DB section 100 Information Asset Database 200 Threat Database 300 Countermeasures DB 400 product DB 500 Input section 600 Result Output Section 700 Information Registration Department

Claims

1. A function decomposition unit that decomposes information assets present in an information system where security measures are implemented into the functions that the information assets possess, A threat determination unit determines threats related to cyberattacks from the functions of the information asset by linking the functions of the information asset with threats related to cyberattacks, A risk calculation unit that quantifies the aforementioned threats based on their risk level and calculates a risk value for the information system, A priority threat selection unit that selects the threats to be addressed based on the aforementioned risk values, A countermeasure selection unit that selects countermeasures against the aforementioned threat, A product selection unit selects a list of security products that implement the aforementioned measures, A cost calculation unit selects the security product that minimizes the risk value from the list of security products based on the constraint of monetary cost, A security measures planning support system characterized by having the following features.

2. The aforementioned priority threat selection unit, The security countermeasure planning support system according to claim 1, characterized in that it receives the risk value from the risk calculation unit and selects the threat based on a predetermined threshold.

3. The aforementioned countermeasure selection unit, The security countermeasure planning support system according to claim 1, characterized in that it selects the countermeasures that can reduce the aforementioned risk value.

4. The system further includes an information asset database in which the aforementioned information assets are registered in association with the aforementioned functions. The aforementioned functional decomposition unit is The security countermeasure planning support system according to claim 1, characterized in that it uses the information asset database to decompose the information assets into the functions.

5. The system further has a threat database in which the aforementioned threats are registered in association with the aforementioned functions, The aforementioned threat determination unit, The security countermeasure planning support system according to claim 1, characterized in that it determines the threats present for each function using the threat database.

6. The system further has a countermeasures database in which the aforementioned countermeasures are registered in association with the aforementioned threats, The aforementioned countermeasure selection unit, The security countermeasure planning support system according to claim 1, characterized in that it selects the countermeasures against the threat using the countermeasures database.

7. The system further has a product database in which the aforementioned security measures are registered in association with the aforementioned measures. The aforementioned product selection unit is The security countermeasure planning support system according to claim 1, characterized in that it selects a list of security countermeasure products that implement the countermeasure using the product database.

8. It further has an input and output section operated by the user, The aforementioned input unit is The threshold for the risk value and the threshold for the monetary cost are input. The output unit is, The security measures planning support system according to claim 1, characterized in that, based on the input risk value threshold and the monetary cost threshold, it outputs a combination of security measures products that minimizes the risk value as recommended security measures products to the information system.

9. The output unit is, The security measures planning support system according to claim 8, further characterized by outputting the total cost of the combination of security measures products such that the monetary cost is less than or equal to the threshold.

10. A functional decomposition step in which information assets present in an information system on which security measures are implemented are broken down into the functions that the said information assets possess, A threat determination step in which threats related to cyberattacks are determined from the functions of the information asset by linking the functions of the information asset with threats related to cyberattacks, A risk calculation step involves quantifying the aforementioned threat based on its degree of risk and calculating the risk value of the information system. A priority threat selection step in which the threats to be addressed based on the aforementioned risk values ​​are selected, A countermeasure selection step for selecting countermeasures against the aforementioned threat, A product selection step involves selecting a list of security products that implement the aforementioned measures, A cost calculation step of selecting the security product that minimizes the risk value based on monetary cost constraints from the list of security products, A method for supporting the planning of security measures, characterized by having the following features.

11. The aforementioned priority threat selection step is: The security countermeasure planning support method according to claim 10, characterized by receiving the aforementioned risk value and selecting the aforementioned threat based on a predetermined threshold.

12. The aforementioned step for selecting countermeasures is: The method for supporting the planning of security measures according to claim 10, characterized in that it selects the measures that can reduce the aforementioned risk value.

13. It further includes user-operated input and output steps, The aforementioned input step is, The threshold for the risk value and the threshold for the monetary cost are input, The output step is, The security measures planning support method according to claim 10, characterized in that, based on the input risk value threshold and the monetary cost threshold, the combination of security measures products that minimizes the risk value is output as the security measures product recommended to the information system.

14. The output step is, The security measures planning support method according to claim 13, further characterized by outputting the total cost of the combination of security measures products such that the monetary cost is less than or equal to the threshold.

Images