Display device, display system, display method, and recording medium

Abstract

In order to provide a display device, etc., that make it possible for impacts on an organization to be understood using cybersecurity information, a display device according to the present disclosure comprises: a collecting means for collecting, either online or offline, at least any of the following cybersecurity information, namely information indicating the attack source of a cyberattack, information indicating the attack target of a cyberattack, information indicating the modus operandi of a cyberattack, information indicating the status of defense against cyberattacks, information indicating the occurrence status of cyberattacks, information indicating an evaluation result of vulnerabilities related to cyberattacks, information indicating the status of countermeasures to the vulnerabilities, and information relating to detected email threats; a generating means for generating a screen for displaying the collected cybersecurity information side-by-side; and a display means for displaying the generated screen.

Description

Display device, display system, display method, and recording medium

[0001] The present disclosure relates to a display device, a display system, a display method, and a recording medium.

[0002] There are technologies for providing trends related to cyber attacks. For example, Patent Literature 1 discloses a technology for recommending articles such as threat information related to cyber attacks to users.

[0003] Japanese Patent Application Laid-Open No. 2021-131715

[0004] However, even if the technology described in Patent Document 1 is used, it is difficult to adequately protect an organization from cyber attacks.

[0005] One example of the objective of the present disclosure is to provide a device or the like that increases an organization's defensive capabilities against cyber attacks and the like.

[0006] A display device in one aspect of the present disclosure includes a collection means for collecting, online or offline, at least any of the following cybersecurity information: information representing the source of a cyberattack; information representing the destination of a cyberattack; information representing the method of cyberattack; information representing the status of defense against cyberattacks; information representing the occurrence status of cyberattacks; information representing the results of vulnerability assessments related to cyberattacks; information representing the status of responses to vulnerabilities; and information regarding detected email threats; a generation means for generating a screen that displays the collected cybersecurity information side by side; and a display means for displaying the generated screen.

[0007] A display system in one aspect of the present disclosure includes a collection means for collecting, online or offline, at least one of the following cybersecurity information: information representing the source of a cyberattack; information representing the destination of a cyberattack; information representing the method of cyberattack; information representing the status of defense against cyberattacks; information representing the occurrence status of cyberattacks; information representing the results of vulnerability assessments related to cyberattacks; information representing the status of responses to vulnerabilities; and information regarding detected email threats; a generation means for generating a screen that displays the collected cybersecurity information side by side; and a display means for displaying the generated screen.

[0008] A display method in one aspect of the present disclosure involves a computer collecting, online or offline, at least any of the following cybersecurity information: information representing the source of a cyberattack; information representing the destination of a cyberattack; information representing the method of cyberattack; information representing the status of defense against cyberattacks; information representing the occurrence status of cyberattacks; information representing the results of vulnerability assessments related to cyberattacks; information representing the status of responses to vulnerabilities; and information regarding detected email threats; generating a screen that displays the collected cybersecurity information side by side; and displaying the generated screen.

[0009] In one aspect of the present disclosure, a recording medium records a program that executes the following operations: collecting, online or offline, at least any of the following cybersecurity information: information indicating the source of a cyberattack; information indicating the destination of a cyberattack; information indicating the method of cyberattack; information indicating the status of defense against cyberattacks; information indicating the occurrence status of cyberattacks; information indicating the results of vulnerability assessments related to cyberattacks; information indicating the status of responses to vulnerabilities; and information regarding detected email threats; generating a screen that displays the collected cybersecurity information side by side; and displaying the generated screen.

[0010] According to the present disclosure, it is possible to improve an organization's defensive capabilities against cyber attacks and the like.

[0011] FIG. 1 is a functional block diagram showing an example of the configuration of a display device according to the present disclosure. FIG. 2 is a diagram showing a hardware configuration in which the display device according to the present disclosure is realized by a computer device and its peripheral devices. FIG. 3 is a flowchart showing the operation of the display device according to the present disclosure. FIG. 4 is an example of a layout of a display screen for cyber-attack information according to the present disclosure. FIG. 5 is an example of a display screen displaying cyber-attack information according to the present disclosure. FIG. 6 is an example of a display screen displaying cyber-attack information according to the present disclosure. FIG. 7 is an example of a display screen displaying cyber-attack information according to the present disclosure. FIG. 8 is an example of a layout of a display screen for cyber-attack information according to the present disclosure. FIG. 9 is an example of a display screen displaying cyber-attack information according to the present disclosure. FIG. 10 is an example of a display screen displaying cyber-attack information according to the present disclosure. FIG. 11 is an example of a display screen displaying cyber-attack information according to the present disclosure. FIG. 12 is an example of a display screen displaying cyber-attack information according to the present disclosure. FIG. 13 is an example of a layout of a display screen for cyber-attack information according to the present disclosure. FIG. 14 is an example of a display screen displaying cyberattack information in the present disclosure. FIG. 15 is an example of a display screen displaying cyberattack information in the present disclosure. FIG. 16 is an example of a display screen displaying cyberattack information in the present disclosure. FIG. 17 is an example of a display screen displaying cyberattack information in the present disclosure. FIG. 18 is an example of a layout of a display screen displaying cyberattack information in the present disclosure. FIG. 19 is an example of a display screen displaying cyberattack information in the present disclosure. FIG. 20 is an example of a display screen displaying cyberattack information in the present disclosure. FIG. 21 is an example of a display screen displaying cyberattack information in the present disclosure. FIG. 22 is an example of a layout of a display screen displaying cyberattack information in the present disclosure. FIG. 23 is an example of a display screen displaying cyberattack information in the present disclosure. FIG. 24 is an example of a display screen displaying cyberattack information in the present disclosure. FIG. 25 is an example of a display screen displaying cyberattack information in the present disclosure. 26 and 27 show examples of layouts of a display screen for cyber-attack information in the present disclosure.FIG. 28 is an example of a display screen displaying cyberattack information in the present disclosure. FIG. 29 is an example of a layout of a display screen for cyberattack information in the present disclosure. FIG. 30 is an example of a display screen displaying cyberattack information in the present disclosure. FIG. 31 is an example of a display screen displaying cyberattack information in the present disclosure. FIG. 32 is an example of a display screen displaying cyberattack information in the present disclosure. FIG. 33 is an example of a layout of a display screen for cyberattack information in the present disclosure. FIG. 34 is an example of a display screen displaying cyberattack information in the present disclosure. FIG. 35 is an example of a display screen displaying cyberattack information in the present disclosure. FIG. 36 is an example of a display screen displaying cyberattack information in the present disclosure. FIG. 37 is an example of a display screen displaying cyberattack information in the present disclosure. FIG. 38 is an example of a layout of a display screen for NDR information in the present disclosure. FIG. 39 is an example of a display screen displaying NDR information in the present disclosure. FIG. 40 is an example of a display screen displaying NDR information in the present disclosure. FIG. 41 is an example of a display screen displaying scores obtained by evaluating vulnerabilities held by organizations involved in transactions with a certain organization in the present disclosure. FIG. 42 is an example of a display screen displaying scores obtained by evaluating vulnerabilities held by each organization involved in transactions with a certain organization in the present disclosure. FIG. 43 is an example of a display screen displaying scores obtained by evaluating vulnerabilities held by each organization involved in transactions with a certain organization in the present disclosure. FIG. 44 is an example of a layout of a display screen for response information in the present disclosure. FIG. 45 is an example of a display screen displaying response information in the present disclosure. FIG. 46 is an example of a display screen displaying response information in the present disclosure. FIG. 47 is an example of a display screen displaying response information in the present disclosure. FIG. 48 is an example of a display screen displaying response information in the present disclosure. FIG. 49 is an example of a display screen displaying response information in the present disclosure. FIG. 50 is an example of a display screen displaying response information in the present disclosure. 51 and 52 are examples of a display screen displaying email threat information indicating the status of email threats according to the present disclosure.Fig. 53 is an example of a display screen displaying email threat information in the present disclosure. Fig. 54 is an example of a display screen displaying email threat information in the present disclosure. Fig. 55 is an example of a display screen displaying email threat information in the present disclosure. Fig. 56 is an example of a display screen displaying email threat information in the present disclosure. Fig. 57 is an example of the layout of a display screen for email threat information showing the status of emails reported to the security management department in the present disclosure. Fig. 58 is an example of a display screen displaying email threat information in the present disclosure. Fig. 59 is an example of a display screen displaying email threat information in the present disclosure.

[0012] Hereinafter, embodiments of a display device, a display system, a display method, a program, and a non-transitory recording medium for recording a program according to the present disclosure will be described in detail with reference to the accompanying drawings. The present disclosure does not limit the technology.

[0013] [First Embodiment] Fig. 1 is a functional block diagram showing an example of the configuration of a display device 100 according to the present disclosure. The display device 100 is a device for displaying information about cyber attacks or cybersecurity in order to grasp threats to an organization. Referring to Fig. 1, the display device 100 includes a collection unit 101, a generation unit 102, and a display unit 103.

[0014] 2 is a diagram showing an example of a hardware configuration in which the display device 100 according to the present disclosure is realized by a computer device 500 including a processor. As shown in Fig. 2, the display device 100 includes a central processing unit (CPU) 501, memories such as a read-only memory (ROM) 502 and a random access memory (RAM) 503, a storage device 505 such as a hard disk for storing a program 504, a communication interface 508 for network connection, and an input / output interface 511 for inputting and outputting data.

[0015] The CPU 501 runs an operating system to control the entire display device 100 according to the present disclosure. The CPU 501 also reads programs and data into memory from a recording medium 506 attached to, for example, a drive device 507. The CPU 501 also functions as the collection unit 101, generation unit 102, and display unit 103 according to the present disclosure, or as part of these units, and executes processing or instructions in the flowchart shown in FIG. 3 (described later) based on the program.

[0016] The recording medium 506 is, for example, an optical disk, a flexible disk, a magneto-optical disk, an external hard disk, or a semiconductor memory. A part of the recording medium in the storage device is a non-volatile storage device, and the program is recorded therein. The program may also be downloaded from an external computer (not shown) connected to a communication network.

[0017] The input device 509 is realized by, for example, a mouse, a keyboard, built-in key buttons, etc., and is used for input operations. The input device 509 is not limited to a mouse, a keyboard, or built-in key buttons, and may be, for example, a touch panel. The output device 510 is realized by, for example, a display, and is used to check the display.

[0018] As described above, the display device 100 according to the present disclosure is realized by the computer hardware shown in FIG. 2. However, the means for realizing each unit included in the display device 100 of FIG. 1 is not limited to the configuration described above. Furthermore, the display device 100 may be realized by a single physically coupled device, or may be realized by two or more physically separate devices connected by wire or wirelessly. Furthermore, the display device 100 may further include a display device such as a monitor, or may be configured as a system realized by the display device 100 and a separate device.

[0019] The collection unit 101 is a means for collecting, online or offline, at least any of the following cybersecurity information: information indicating the source of a cyberattack, information indicating the destination of a cyberattack, information indicating the method of cyberattack, information indicating the status of defense against cyberattacks, information indicating the occurrence status of cyberattacks, information indicating the results of vulnerability assessments related to cyberattacks, information indicating the status of responses to vulnerabilities, and information regarding detected email threats. The collection unit 101 collects, for example, information published on the Internet, information collected by external organizations, or information collected within an organization using a known method. This information can also be referred to as information regarding detected cyberattacks, i.e., cyberattack information.

[0020] The collection unit 101 may collect cybersecurity information including at least one of information indicating the evaluation results of vulnerabilities related to cyberattacks, information indicating the response status to vulnerabilities, and information on detected threats related to emails, as described below with reference to the figures. The information indicating the evaluation results of vulnerabilities related to cyberattacks and the information indicating the response status to vulnerabilities are information indicating the status of measures taken by an organization against vulnerabilities used in cyberattacks. Alternatively, the information may be information indicating the percentage of vulnerabilities that have been addressed by an organization out of all vulnerabilities. Alternatively, the information may be information indicating the percentage of vulnerabilities that have not been addressed (i.e., vulnerabilities that have not been addressed) out of all vulnerabilities that an organization has. Alternatively, the information may be information indicating the time required to address vulnerabilities.

[0021] The collection unit 101 may acquire information indicating the results of an analysis by an external organization of logs related to communications performed on the organization's communication network. The collection unit 101 may acquire the information via the communication network, may acquire the information from an input device such as a keyboard, or may read the information from a recording medium on which the information is stored. The collection unit 101 may collect information by, for example, analyzing logs related to communications performed in the organization. The method by which the collection unit 101 acquires information is not limited to the above-mentioned example.

[0022] When the collection unit 101 acquires cyber attack information, i.e., cyber security information, it outputs the information to the generation unit 102.

[0023] The generation unit 102 is a means for generating a screen for displaying cyberattack information, i.e., cybersecurity information, in a row. The generation unit 102 generates a screen for displaying the cyberattack information on the output device 510, for example.

[0024] The generation unit 102 may generate a screen that displays two pieces of cyber attack information (cybersecurity information) side by side, or may generate a screen that displays three or more pieces of cyber attack information (cybersecurity information) side by side.

[0025] The display unit 103 is a means for displaying the generated screen. The display unit 103 may display the generated screen on the output device 510 or the like, or may display the generated screen on a device other than the display device 100.

[0026] The operation of the display device 100 configured as above will be described with reference to the flowchart of FIG.

[0027] 3 is a flowchart showing an outline of the operation of the display device 100 according to the present disclosure. Note that the processing according to this flowchart may be executed based on program control by the processor described above.

[0028] 3, first, the collection unit 101 collects cyberattack information (step S101). Next, the generation unit 102 generates a screen that displays the cyberattack information side by side (step S102). Finally, the display unit 103 displays the generated screen (step S103). This completes the operation of the display device 100.

[0029] In the display device 100 of the present disclosure, the generation unit 102 generates a screen that displays collected cyberattack information in a row, and the display unit 103 displays the generated screen. By displaying specific cyberattack information in a row in this manner, it is possible to understand the impact of cyberattacks, etc. on an organization (a company, a factory, a department, a parent company and subsidiaries, etc.). Examples of screens 1 to 19 displayed on the display device 100 of the present disclosure are described below.

[0030] [Screen 1] Figure 4 is an example of the layout of a display screen for cyber-attack information in the present disclosure. Cyber-attack information [1] to [5] is displayed in [1] to [5] in Figure 4. Figures 5 to 7 are examples of display screens that display cyber-attack information in the present disclosure.

[0031] The cyberattack information display screen does not necessarily have to include all of the cyberattack information [1] to [5], as described below. The cyberattack information display screen may be, for example, a screen that displays two pieces of cyberattack information [1] to [5] side by side, a screen that displays three pieces of cyberattack information [1] to [5] side by side, or a screen that displays four pieces of cyberattack information [1] to [5] side by side.

[0032] As shown in FIG. 5, cyber attack information [1] displays a bar graph with the number of attack information cases divided into existing rules (number of existing cases) and new rules (number of new cases). The rule represents a rule for detecting cyber attacks. Cyber ​​attack information [1] is information indicating the number of cyber attacks detected by at least either existing rules or new rules. Existing rules are, for example, cyber attacks detected by rules available from open source communities. New rules are, for example, cyber attacks detected by rules unique to an organization. Cyber ​​attack information [1] allows you to understand that risk has been reduced by unique measures. It also makes it easier to evaluate the cost-effectiveness of measures.

[0033] As shown in the upper part of Figure 6, Cyber ​​Attack Information [2] displays the number of attack information cases totaled over the past week, past month, and past year. Cyber ​​Attack Information [2] is information showing the number of detected cyber attacks totaled in a predetermined unit. The predetermined unit is not limited to one week, one month, or one year. This allows the total number of attack information cases for each period to be grasped.

[0034] As shown in the lower part of Figure 6, cyber attack information [3] scores each individual piece of attack information and displays a ranking of the top-scoring attack information from the past week. Cyber ​​attack information [3] is scored information about threats caused by cyber attacks. The attack information may be, for example, information about damage caused by a cyber attack or information warning about a cyber attack. The score may be, for example, information indicating the number of times the information has been accessed or information indicating the urgency. Similarly, a ranking of the top-scoring attack information from the past month is displayed. This allows users to understand important attack information for each period. Furthermore, by displaying cyber attack information [2] and cyber attack information [3] side by side, users can associate the number of attack information for each period with the individual details of important attack information, thereby associating the number of risk cases with individual important risks.

[0035] As illustrated in the upper part of Figure 7, cyber attack information [4] displays the cumulative number of threat reports and the cumulative number of attack information items side by side. Cyber ​​attack information [4] may, for example, be information indicating the cumulative number of threat reports. Cyber ​​attack information [4] may also be information indicating the percentage of Internet Protocol (IP) addresses used in cyber attacks by region (or country). A pie chart showing the cumulative percentage of each attack group in the attack information is also displayed. As illustrated in the lower part of Figure 7, cyber attack information [5] compiles a ranking of IP addresses used in attacks by region (region, country, base, continent, etc.), and displays the corresponding region on a world map in a different color according to the ranking. Cyber ​​attack information [5] may be information indicating the number of addresses used in attacks by region, and is not limited to the example illustrated in the upper part of Figure 7. This allows the location of IP addresses (devices) used in attacks to be identified.

[0036] The display screen for cyber attack information may be a screen that includes at least two of the above-mentioned cyber attack information [1], cyber attack information [2], cyber attack information [3], cyber attack information [4], and cyber attack information [5].

[0037] [Screen 2] Figure 8 is an example of the layout of a display screen for cyber-attack information in the present disclosure. Cyber-attack information [6] to

[10] is displayed in [6] to

[10] in Figure 8. Figures 9 and 10 are examples of display screens that display cyber-attack information in the present disclosure.

[0038] The cyberattack information display screen does not necessarily have to include all of the cyberattack information [6] to

[10] , as described below. The cyberattack information display screen may be, for example, a screen that displays two pieces of cyberattack information [6] to

[10] side by side, a screen that displays three pieces of cyberattack information [6] to

[10] side by side, or a screen that displays four pieces of cyberattack information [6] to

[10] side by side.

[0039] As shown in the upper part of Figure 9, the cyberattack information [6] displays the number of blocked cyberattack threats and the number of network terminals installed. For example, the cyberattack information [6] may represent the number of cyberattack damages prevented by implementing countermeasures against cyberattacks. Alternatively, the cyberattack information [6] may represent the number of information processing devices on which countermeasures against cyberattacks have been implemented. This allows the total number of threats and the locations where threats are detected and blocked to be understood. Furthermore, a map of the cyberattack information [5] and circles representing the number of threats by region may be displayed in the background. In this case, it is clear at a glance that the information represents the total number worldwide. Regional trends can also be understood.

[0040] As shown in the center of Figure 9, the cyberattack information [7] displays a pie chart showing the percentage of blocked cyberattack threats by region (e.g., country, region, base, or continent). The cyberattack information [7] may also be information showing the percentage of blocked cyberattack threats by region (e.g., country, region, base, or continent) by implementing countermeasures against cyberattacks. This allows the percentage of blocked threats by region (e.g., country, region, base, or continent).

[0041] As shown in the lower part of Figure 9, the cyber attack information [8] displays a ranking of the number of blocked cyber attack threats by attack method (MITRE ATT&CK techniques). The cyber attack information [8] may be, for example, information indicating the number of attacks carried out using a certain cyber attack method. The cyber attack information [8] may be, for example, information indicating the number of times a certain cyber attack was blocked. This makes it possible to understand the commonly used attack methods among the blocked threats.

[0042] In Figure 8, cyber attack information [6], [7], and [8] are displayed side by side. By viewing these pieces of information in order, you can first understand the total number of threats using cyber attack information [6], then understand where the threats are occurring using cyber attack information [7], and then understand the most common attack methods using cyber attack information [8]. This makes it easy to understand the actual state of the threats.

[0043] As illustrated in the upper part of FIG. 10 , cyberattack information [9] displays the number of organization-specific detection rules and the number of general detection rules set in NDR (Network Detection and Response). General detection rules are, for example, rules available from open source communities. Organization-specific detection rules may be, for example, detection rules established by an organization separately from general detection rules, or detection rules for detecting cyberattacks that are known but for which detection rules have not been made public. Cyberattack information [9] may be information indicating the number of detection rules by the source of the detection rule, and is not limited to the upper part of FIG. 10 . This allows users to understand that threats are being detected using custom rules in addition to general detection rules.

[0044] As shown in the lower part of Figure 10, the cyber attack information

[10] displays the locations where NDRs are installed, and the number of threats observed there that are currently under investigation, the number of threats for which a basic investigation was conducted and the number of threats for which a detailed ... It also allows you to keep track of the progress of the investigation.

[0045] The display screen for cyber attack information may be a screen that includes at least two of the above-mentioned cyber attack information [6], cyber attack information [7], cyber attack information [8], cyber attack information [9], and cyber attack information

[10] .

[0046] [Screen 3] Figure 11 is an example of a display screen displaying cyberattack information in the present disclosure. Cyberattack information

[11] displays the number of blocked threats, such as infections or intrusions, and the number of deployed network terminals (endpoints), overall and by region (country, region, base, continent, etc.). This allows the number of threats and the number of endpoints to be understood overall and by region. The pie chart in the upper right of Figure 11 also displays the regional ratio of blocked threats. This allows the regional ratio of blocked threats to be understood. The bar graph in the lower right of Figure 11 displays the average number of blocks per endpoint (number of blocks divided by number of endpoints) for each region. This allows the degree of threat to be understood for each region, which cannot be understood by the absolute number of blocks alone. For example, a region with a low number of blocks but a high average number of blocks per device can be determined to have a high potential threat. This is because it can be assumed that the number of blocks will increase as the number of endpoints, which is the base number, increases. The cyber attack information

[11] is not limited to the example shown in FIG.

[0047] [Screen 4] Figure 12 is an example of a display screen displaying cyberattack information in the present disclosure. In the cyberattack information

[12] , the left side displays the percentage of file types and operating systems (OSs) targeted by threats by region (country, region, base, continent, etc.) in a bar graph. The cyberattack information

[12] is not limited to the example shown in Figure 12, as long as it displays at least one of the file types targeted by threats or the operating systems targeted by threats by region. This allows users to understand the trends in file types and OSs targeted by attackers by region. Additionally, the right side of Figure 12 displays the percentage of threat types by region in a bar graph. This allows users to understand the trends in attack techniques commonly used by attackers by region.

[0048] [Screen 5] Figure 13 is an example of the layout of a display screen for cyber-attack information in the present disclosure. Cyber-attack information

[13] to

[15] is displayed in

[13] to

[15] in Figure 13. Figures 14 to 16 are examples of display screens that display cyber-attack information in the present disclosure.

[0049] The display screen for cyber-attack information does not necessarily have to include all of the cyber-attack information

[13] to

[15] , as described below. The display screen for cyber-attack information may be, for example, a screen that displays two pieces of information from the cyber-attack information

[13] to

[15] side by side.

[0050] As shown in FIG. 14, cyber attack information

[13] displays the cumulative number of ransomware attacks for a given month for both global and Japanese companies, along with the cumulative total up to that month. Cyber ​​attack information

[13] may also display the number of ransomware attacks by period, such as a given week or date. Cyber ​​attack information

[13] may also be a portion of the example shown in FIG. 14. In this case, by viewing the total number of attacks and those targeting Japanese (home) organizations, users can gain a sense of the threat to their organization. Additionally, by viewing the aggregate and cumulative totals for a given period, users can understand overall and recent trends.

[0051] As shown in FIG. 15, cyber attack information

[14] displays the number of damages caused by ransomware in a bar graph, showing the number of damages by month, the difference from the previous month, and the cumulative number of damages. Cyber ​​attack information

[14] may be, for example, the number of damages by year or by day. Cyber ​​attack information

[14] is not limited to the example shown in FIG. 15, as long as it is information that calculates the difference in the number of damages caused by ransomware by period. This makes it possible to understand the trend in the number of damages by month, the increase or decrease from the previous month, and the trend and speed of the increase in the total number of damages.

[0052] As shown in FIG. 16 , the cyberattack information

[15] displays the number of reported phishing attacks for the most recent month in the upper left. The upper right displays the number of reported phishing attacks by month in a bar graph, along with a line graph showing the moving average over a specified period. The lower left displays the number of suspicious domestic mail servers discovered in attacks against the organization in the most recent month. Cyberattack information

[15] may be, for example, information showing the number of reported phishing attacks or the number of mail servers discovered in attacks against the organization's systems. The lower right displays the number of suspicious domestic mail servers discovered in attacks against the organization by month. This allows users to understand the current phishing threat situation and monthly trends. Furthermore, by viewing this information together with the number of suspicious domestic mail servers discovered in attacks against the organization, users can understand the actual state of attacks against the organization.

[0053] The display screen for cyber attack information may be a screen that includes at least two of the above-mentioned cyber attack information

[13] , cyber attack information

[14] , and cyber attack information

[15] .

[0054] [Screen 6] Figure 17 is an example of a display screen displaying cyberattack information in the present disclosure. Cyberattack information

[16] displays information about suspicious domestic mail servers. Mail servers attacking an organization may be highlighted. Cyberattack information

[16] may include, for example, information indicating at least one of the following: the date the cyberattack was confirmed, the industry affected by the cyberattack, the name of the organization affected by the cyberattack, the addresses affected by the cyberattack, the content of the phishing email, the capital of the organization affected by the cyberattack, the number of employees of the organization affected by the cyberattack, or information indicating the results of phishing analysis. Cyberattack information

[16] may include information different from the example shown in Figure 17. This allows users to understand information about mail servers that may pose a threat. It also allows users to understand mail servers that actually pose a threat to the organization.

[0055] [Screen 7] Figure 18 is an example of the layout of a display screen for cyber-attack information in the present disclosure. Cyber-attack information

[17] to

[19] is displayed in

[17] to

[19] in Figure 18. Figures 19 to 21 are examples of display screens that display cyber-attack information in the present disclosure.

[0056] The display screen for cyber-attack information does not necessarily have to include all of the cyber-attack information

[17] to

[19] , as described below. The display screen for cyber-attack information may be, for example, a screen that displays two pieces of cyber-attack information

[17] to

[19] side by side.

[0057] As shown in FIG. 19, cyberattack information

[17] displays a list of unreported information related to phishing. Cyberattack information

[17] may, for example, be information indicating the content of phishing that is different from previously disclosed phishing. In this case, cyberattack information

[17] is determined to be different from previously disclosed phishing, for example, depending on the determination result of whether the phishing that occurred is a previously disclosed phishing. This allows for identification of highly urgent information.

[0058] As shown in FIG. 20, cyberattack information

[18] displays the number of reported phishing incidents, the number of phishing site URLs (Uniform Resource Locators), and the number of brands exploited in phishing attacks in bar graphs by month. Cyberattack information

[18] may include, for example, information indicating the number of reported phishing incidents, the number of URLs used in phishing attacks, and the number of brands victimized by phishing attacks. Cyberattack information

[18] may include information different from the example shown in FIG. 20, or may include a portion of the example shown in FIG. 20. Cyberattack information

[18] may be a monthly graph, or a graph aggregated by day, week, or year. This allows users to understand the trends or monthly trends in the total number of phishing incidents, the number of phishing site URLs, and the number of brands exploited in phishing attacks.

[0059] As shown in Figure 21, Cyber ​​Attack Information

[19] displays an overall assessment of phishing report trends for a specified month, emergency phishing information, and reference information. Cyber ​​Attack Information

[19] includes, for example, information indicating the number of phishing reports, emergency information on phishing that requires immediate notification, and reference information on phishing. This allows users to examine detailed information on phishing for a specified month based on findings obtained from a graph of Cyber ​​Attack Information

[18] , such as that shown in Figure 20.

[0060] The display screen for cyber attack information may be a screen that includes at least two of the above-mentioned cyber attack information

[17] , cyber attack information

[18] , and cyber attack information

[19] .

[0061] [Screen 8] Figure 22 is an example of the layout of a display screen for cyber-attack information in the present disclosure. Cyber-attack information

[20] to

[28] is displayed in

[20] to

[28] in Figure 22. Figures 23 to 25 are examples of display screens that display cyber-attack information in the present disclosure.

[0062] The cyberattack information display screen does not necessarily have to include all of the cyberattack information

[20] to

[28] , as described below. The cyberattack information display screen may, for example, be a screen that displays two pieces of information from the cyberattack information

[20] to

[28] side by side. The cyberattack information display screen may, for example, be a screen that displays three pieces of information from the cyberattack information

[20] to

[28] side by side. The cyberattack information display screen may be a screen that displays two to eight pieces of information from the cyberattack information

[20] to

[28] side by side.

[0063] As shown in the upper part of Figure 23, the cyber attack information

[20] displays the cumulative number of ransomware-related damages by attacker group in a pie chart, showing the percentage of each attacker group. The cumulative number of damages by attacker group and the difference from 30 days ago are also displayed in a table format. The cyber attack information

[20] may be displayed in a manner different from that shown in Figure 23. Alternatively, the cyber attack information

[20] may be information in which the cumulative number of ransomware damages is aggregated by period, such as by day, week, or year. This allows the activity status of each attack group to be understood, such as which groups are active and how they compare to 30 days ago.

[0064] Cyber ​​attack information

[21] displays the cumulative number of ransomware-related damages by attacker group in a line graph, as shown in the center of Figure 23. Cyber ​​attack information

[21] may be any information that shows the cumulative trend in the number of damages caused by ransomware, and the display format is not limited to the example shown in the center of Figure 23. This allows the transition of activity status for each attack group to be understood.

[0065] Cyberattack information

[22] displays the number of ransomware-related damages per month by attacker group in a line graph, as shown in the example at the bottom of Figure 23. Cyberattack information

[22] only needs to show the number of damages caused by ransomware, and the display format is not limited to the example shown at the bottom of Figure 23. This allows you to understand the monthly activity trends of each attacker group.

[0066] As shown in the upper part of Figure 24, the cyber attack information

[23] displays the cumulative number of ransomware attacks by victim industry in a pie chart. The cumulative number of attacks by victim industry and the difference from the previous 30 days are also displayed in a table. The cyber attack information

[23] may be any information that shows the cumulative number of attacks from ransomware by victim industry, and the display format is not limited to the example shown in the upper part of Figure 24. This allows the damage situation by industry to be understood. Therefore, it is possible to infer whether a specific industry is being targeted and whether security measures are being implemented.

[0067] Cyberattack information

[24] displays the cumulative number of ransomware attacks by type of victim's industry in a line graph, as shown in the center of Figure 24. Cyberattack information

[24] only needs to display information showing the changes in the cumulative number of ransomware attacks by type of victim's industry, and the display format is not limited to the example shown in the center of Figure 24. This allows users to understand the changes in the damage situation by type of industry.

[0068] Cyberattack Information

[25] displays the number of ransomware attacks by month by type of victim's industry in a line graph, as shown in the example at the bottom of Figure 24. Cyberattack Information

[25] may be any information showing the trend in the number of ransomware attacks by type of victim's industry, and the display format is not limited to the example shown at the bottom of Figure 24. This allows users to understand the monthly trends in damage by type of industry.

[0069] As shown in the upper part of Figure 25, the cyber attack information

[26] displays the cumulative number of ransomware attacks by victim country in a pie chart. Additionally, the cumulative number of attacks by victim country and the difference from the previous 30 days are displayed in a table format. This allows the damage situation by country to be understood. The cyber attack information

[26] may be information showing the cumulative number of ransomware attacks by region (e.g., country, region, base, or continent), and the display format is not limited to the example shown in the upper part of Figure 25. Therefore, it is possible to infer whether a specific country is being targeted and whether security measures are being implemented. For example, ransomware is a type of exposing ransomware that exposes confidential information within an organization.

[0070] Cyberattack information

[27] displays the cumulative number of ransomware incidents by victim country in a line graph, as shown in the center of Figure 25. Cyberattack information

[27] may be information showing the cumulative number of ransomware incidents by region (country, region, base, continent, etc.), and the display format is not limited to the example shown in the center of Figure 25. This allows the progress of damage by country to be understood.

[0071] Cyberattack Information

[28] displays the number of ransomware attacks by month by victim country in a line graph, as shown in the example at the bottom of Figure 25. Cyberattack Information

[28] may be any information that shows the number of ransomware attacks by region (country, region, base, continent, etc.), and the display format is not limited to the example shown at the bottom of Figure 25. This allows users to understand the trends in damage by country and month.

[0072] Furthermore, by displaying cyber attack information

[20] to

[28] side by side, as shown in Figure 22, it is possible to infer the countries or industries targeted by specific attack groups. It is also possible to infer changes over time or monthly trends.

[0073] The display screen for cyber attack information may be a screen that includes at least two of the above-mentioned cyber attack information

[20] to cyber attack information

[28] .

[0074] [Screen 9] Figure 26 is an example of the layout of a display screen for cyber-attack information in the present disclosure. Cyber-attack information

[29] to

[30] is displayed in

[29] to

[30] in Figure 26. Figures 27 to 28 are examples of display screens that display cyber-attack information in the present disclosure.

[0075] Cyber ​​attack information

[29] displays the number of network (NW) traffic detection rules, the number of file detection rules, and the total number of threat-related detection rules for the organization's own threat detection rules and the pre-installed threat detection rules, as shown in Fig. 27. Cyber ​​attack information

[29] is not limited to the example shown in Fig. 27, as long as the number of detection rules is classified by the source of the detection rules.

[0076] In addition, in cyber attack information

[29] , detection rules may be displayed in association with attack methods. In this case, for example, a heat map showing the presence or absence of detection rules for each attack method and the number of such rules may be displayed. This allows the status of countermeasures against attack methods to be understood. In addition, in cyber attack information

[29] , detection rules may include AI (artificial intelligence) models, and the number of AI detection models may be displayed. This allows the extent to which AI detection is being performed to be understood. In addition, in cyber attack information

[29] , target protocols may be displayed separately. In this way, by comparing the number of standard detection rules and the number of organization-specific detection rules for network traffic and files, it is possible to understand which areas are being focused on and the status of countermeasures for each protocol.

[0077] As shown in Figure 28, the left side of the cyber attack information

[30] displays the number of threats detected by each region (country, region, base, or continent, etc.) among those observed at the international gateway. The number of detections is displayed by source region. The upper right corner displays the number of threats observed at the international gateway that are currently under investigation, the number of threats that have been completed after basic investigation, the number of threats that have been completed after detailed investigation, the total traffic volume, and the total number of sessions. The lower right corner displays the source, destination, and number of threats observed in a bubble chart. Detailed information by source and destination can be displayed by hovering the mouse over the threats. The detailed information includes the number of threats, the total traffic volume, and the total number of sessions. This allows users to understand the total traffic volume at the international gateway and the number of threats observed within it. Furthermore, users can understand the origin and destination of the threats. The cyber attack information

[30] may be any information indicating threats observed at an international gateway (GW) for each region, and is not limited to the example shown in FIG.

[0078] [Screen 10] Figure 29 is a diagram showing an example of the layout of a display screen for cyber-attack information in the present disclosure. Cyber-attack information

[31] to

[34] is displayed in

[31] to

[34] in Figure 29. Figures 30 to 32 are examples of display screens that display cyber-attack information in the present disclosure.

[0079] The display screen for cyberattack information may be, for example, a screen that displays two pieces of information out of the cyberattack information

[31] to

[34] side by side. The display screen for cyberattack information may be, for example, a screen that displays three pieces of information out of the cyberattack information

[31] to

[34] side by side.

[0080] As shown in FIG. 30, the cyber attack information

[31] displays the number of threats detected by each region (country, region, base, continent, etc.) among those observed at the international gateway. The number of detections is displayed for each region that is the source of the threat. The cyber attack information

[31] is not limited to the example shown in FIG. 30, and may be any information that indicates the number of threats detected by each region that are observed at the international gateway. This is a diagram similar to the diagram displayed on the left side of FIG. 28.

[0081] As shown in the upper part of Figure 31, the cyber attack information

[32] displays the number of threats observed at the international gateway (GW) that are currently under investigation, the number of threats for which investigation has been completed after basic investigation, the number of threats for which investigation has been completed after detailed investigation, the total communication volume, and the total number of sessions. The cyber attack information

[32] may be any information indicating the number of threats observed at the international gateway (GW) or the number of responses to threats, and is not limited to the example shown in the upper part of Figure 31. This is a table similar to the table displayed in the upper right of Figure 28.

[0082] As shown in the example at the bottom of Figure 31, the cyber attack information

[33] displays, among the threats observed at the international gateway (GW), the number of threats under investigation, the number of threats for which investigation has been completed after basic investigation, and the number of threats for which investigation has been completed after detailed investigation, categorized by the detection rule that detected the threat. The detection rules may be, for example, organization-specific detection rules and pre-installed detection rules. The cyber attack information

[33] may be information that indicates the number of detected threats by the source of the detection rule, and is not limited to the example shown at the bottom of Figure 31.

[0083] As shown in FIG. 32, the cyber attack information

[34] displays the source, destination, and total traffic volume of the total traffic volume in a bubble chart on the left side. Detailed information (number of threats, total traffic volume, total number of sessions) for each source and destination can be displayed by hovering the mouse over the information. The right side displays the source, destination, and number of observed threats in a bubble chart. Detailed information (number of threats, total traffic volume, total number of sessions) for each source and destination can be displayed by hovering the mouse over the information. This bubble chart is the same as the bubble chart in the lower right of the cyber attack information

[30] . When displayed in this manner, comparing the distribution of total traffic volume by source and destination with the distribution of threats by source and destination makes it possible to detect an increase in unauthorized communication that is not proportional to the total traffic volume. The cyber attack information

[34] is not limited to the example shown in FIG. 32, as long as it shows the traffic volume of communications between sources and destinations by region in which the communications were conducted.

[0084] In addition, by displaying cyberattack information

[31]

[32]

[33] side by side, the effect of cyberattack information

[30] (the total traffic volume at the international gateway and the number of observed threats within that volume can be understood, and the origin and destination of the threats can be determined) can also be understood, such as whether the threat was detected by the organization’s own detection rules or the standard detection rules.

[0085] The display screen for cyber attack information may be a screen that includes at least two of the above-mentioned cyber attack information

[31] , cyber attack information

[32] , cyber attack information

[33] , and cyber attack information

[34] .

[0086] [Screen 11] Figure 33 is an example of the layout of a display screen for cyber-attack information in the present disclosure. Cyber-attack information

[35] to

[38] is displayed in

[35] to

[38] in Figure 33. Figures 34 to 37 are examples of display screens that display cyber-attack information in the present disclosure.

[0087] The display screen for cyberattack information may be, for example, a screen including two pieces of information from the cyberattack information

[35] to

[38] . The display screen for cyberattack information may be, for example, a screen displaying three pieces of information from the cyberattack information

[35] to

[38] side by side.

[0088] As shown in FIG. 34, the cyber attack information

[35] displays a pie chart on the left side showing the proportion of protocols in the total communication volume. Also, a pie chart on the right side shows the proportion of protocols in the detected threats. The cyber attack information

[35] is not limited to the example shown in FIG. 34, as long as it shows the proportion of protocols in the communication volume of the implemented communication. This makes it possible to notice differences between the trend of protocols in all communication and the trend of protocols used in fraudulent communication. For example, it is possible to identify protocols that are not often used in overall communication but are frequently used in fraudulent communication.

[0089] As shown in FIG. 35, cyber attack information

[36] displays a bar graph on the left side showing the traffic volume by destination for each region (country, region, base, or continent, etc.). The right side displays a bar graph showing the number of observed threats by destination for each region. Cyber ​​attack information

[36] is not limited to the example shown in FIG. 35, as long as it shows the traffic volume at the destination and the number of threats for each region. By comparing the distribution of total traffic volume by source and destination with the distribution of threats by source and destination, it is possible to notice trends in the source / destination of fraudulent communications that are not proportional to the total traffic volume. Furthermore, the bar graph makes it easier to compare numerical values ​​than a bubble chart.

[0090] Cyber ​​attack information

[37] displays a list of the investigation results for all detections (observed threats), as shown in Figure 36. Cyber ​​attack information

[37] may include at least one of the following information about the detected threats: region, protocol, detection rule, detection details, or investigation conducted in response to the detection, and is not limited to the example shown in Figure 36. This allows you to understand detailed information about individual threats and the response status.

[0091] Cyber ​​attack information

[38] displays line graphs of the total number of detections and the number of closed (investigation completed) attacks superimposed on each other, as shown in the example of Figure 37. Cyber ​​attack information

[38] can be any information that shows the cumulative number of detected threats and the cumulative number of countermeasures taken against the threats, and is not limited to the example shown in Figure 37. This allows users to understand the progress of the cumulative number of threats and the countermeasures (investigations) against the threats.

[0092] The display screen for cyber attack information may be a screen that includes at least two of the above-mentioned cyber attack information

[35] , cyber attack information

[36] , cyber attack information

[37] , and cyber attack information

[38] .

[0093] Alternatively, the display screen for the cyber attack information may be a screen including at least two pieces of information from the cyber attack information [1] to the cyber attack information

[38] as described above.

[0094] 38 is a diagram showing an example of the layout of a display screen for NDR (Network Detection and Response) information in the present disclosure. NDR information is information that indicates the status of network monitoring, threat detection, and response to the threat.

[0095] In

[50] of the NDR information, NDR information

[50] as will be described with reference to FIG. 39 is displayed. In

[51] of the NDR information, NDR information

[51] as will be described with reference to FIG. 40 is displayed. The display screen of the NDR information may, for example, display NDR information

[50] and NDR information

[51] side by side in a horizontal direction or a vertical direction. The display screen of the NDR information may include information that displays information about the NDR information side by side, and is not limited to the example shown in FIG. 38. The NDR information may also be information representing a cyber-attack detected by the NDR, or information representing the occurrence status of a cyber-attack.

[0096] The display screen for NDR information may include at least two pieces of information, such as information representing the rules that the organization has for detecting threats, information representing the number of threats detected using those rules, and information representing the status of investigations conducted regarding the threats detected using those rules, as described below.

[0097] As illustrated in Figure 38, by displaying the results of detection performed by the NDR and the status of the investigation conducted against the detected threats side by side, it is possible to globally grasp the status of threats detected by the NDR and the status of the countermeasures taken against the threats.

[0098] 39 and 40 are examples of display screens that display NDR information in the present disclosure.

[0099] In the example shown in Figure 39, the NDR information

[50] includes information about the rules reflected in the NDR and information indicating the results of investigations conducted at each location where the NDR is installed. The rules are rules for detecting threats (hereinafter referred to as "detection rules").

[0100] Information about detection rules reflected in the NDR includes, for example, information indicating the detection rules used by the NDR to detect threats and information indicating the number of rules for each target (e.g., network traffic, files, etc.) detected by the detection rules. The detection rules are, for example, detection rules used uniquely by an organization or detection rules provided as open source. For example, the detection rule "Organization-specific detection rules" is associated with "50" network traffic and "300" files, totaling "350." This indicates that the total number of detection rules "Organization-specific detection rules" is 350, and includes detection rules for 50 network traffic and detection rules for 300 files.

[0101] The investigation status is information indicating the results of investigations conducted for each location where an NDR is installed. The investigation status includes, for example, the installation location indicating the location where the NDR is installed, information indicating the status of the investigation conducted regarding a threat detected at the installation location, the communication volume at the installation location, and the number of sessions in the communication conducted at the installation location. The installation location "International GW (Gateway)" is associated with "Investigation in Progress" (10), "Closed After Basic Investigation" (5), "Closed After Detailed Investigation" (0), the communication volume (120,000 GB), and the number of sessions (1,700 M). This indicates that an NDR is installed at the international GW (Gateway). This further indicates that the NDR installed at the international GW (Gateway) has a communication volume of 120,000 GB (gigabytes) and 1,700 M (megabytes) of sessions established. This further indicates that investigations have been conducted into threats detected in NDRs installed at international gateways, with 10 investigations underway, 5 investigations completed after basic investigations, and 0 investigations completed after detailed investigations.

[0102] The information indicating the investigation status may include an area in which the period for which the investigation results are to be compiled (hereinafter referred to as the "target period") can be specified. The target period is a period for which the investigation results are to be compiled, such as the past month, the past three months, the past six months, the past year, etc. When the past month is set as the target period, the information indicating the investigation status is information indicating the results of the investigations conducted in the past month. The target period is not limited to the above example, and may be, for example, a period from a start timing to an end timing determined by specifying the start timing and the end timing. The information indicating the investigation status may include the number of detections.

[0103] As illustrated in Figure 39, by displaying information about the detection rules reflected in the NDR side by side with information showing the results of investigations conducted at each location where the NDR is installed, it is possible to grasp the status of detection being carried out using the NDR.

[0104] In the example shown in FIG. 40 , the NDR information

[51] includes information indicating the locations where the NDRs are installed and the number of threats detected by the NDRs installed at each location. For example, the NDR information

[51] indicates that the NDRs are installed at Location 1, Location 2, and Location 3 in Japan. For example, the NDR information

[51] indicates that the NDRs are installed at a global gateway (GW) in a communication network connecting Japan, North America, South America, Europe, China, and APAC. The global gateway is also referred to as an international GW (gateway). In the example shown in FIG. 40 , "Detection: 5" is displayed below the NDR installed at the global gateway. This indicates that the number of threats detected by the NDR is five. In this way, the NDR information

[51] may associate the NDR with the number of threats detected by the NDR.

[0105] As illustrated in Figure 40, by displaying the location where the NDR is installed and the number of threats detected by the NDR side by side, it is possible to grasp the situation of threats detected at the installation location.

[0106] [Screen 13] Figure 41 is a diagram showing scores (assessment values) obtained by assessing vulnerabilities of organizations (hereinafter referred to as "organizations in the supply chain") that are involved in transactions with a certain organization in this disclosure. The scores may be information indicating the results of a vulnerability assessment by a third party independent of the certain organization, or may be information indicating the results of a vulnerability assessment by the certain organization. Hereinafter, information indicating these results will be collectively referred to as "assessment information

[52] ." In the following description, for convenience of explanation, "a certain organization" may be referred to as a "first organization," and "an organization involved in transactions with the certain organization" may be referred to as a "second organization."

[0107] In the example shown in Figure 41, the evaluation information

[52] includes information indicating the average score for the supply chain (hereinafter referred to as "rating information") and information indicating the change in score over time (hereinafter referred to as "rating change information").

[0108] The average score for the supply chain is calculated by calculating the average for the entire supply chain with respect to the scores of each organization in the supply chain. The average may be information that represents the evaluation results of the entire supply chain, such as the median or quartile. In the left diagram of FIG. 41, "670" and "-10" are shown as examples. This indicates that the average value for the entire supply chain is "670," which is a decrease of 10 points compared to the average value for the previous period. The average score may be, for example, the average score at the latest point in time in the rating transition information.

[0109] An example of rating transition information is shown in the right diagram of Fig. 41. The horizontal axis of the right diagram of Fig. 41 represents time, with time progressing further to the right. The vertical axis of the right diagram of Fig. 41 represents the results of vulnerability assessment, with higher scores (i.e., fewer vulnerabilities) at the top. The rating transition information includes information representing the vulnerability assessment score for a certain organization and information representing the average score for the entire supply chain.

[0110] Displaying rating information and rating transition information side by side in the evaluation information

[52] as exemplified in Figure 41 has the effect of enabling the user to grasp information that represents the evaluation results regarding vulnerabilities in the supply chain. Furthermore, displaying the vulnerability assessment score for an organization side by side with the score for the entire supply chain has the effect of enabling the user to grasp the position of an organization in the supply chain in terms of vulnerabilities.

[0111] [Screen 14] Figure 42 is a diagram showing the scores obtained by assessing vulnerabilities of each organization involved in transactions with a certain organization in the present disclosure. The horizontal axis on the left side of Figure 42 represents time, with the further to the right, the more time has passed. The vertical axis on the left side of Figure 42 represents the results of vulnerability assessment, with the higher the score (i.e., the fewer vulnerabilities) at the top.

[0112] In the example shown in Figure 42, the rating transition information for each organization, such as Company A, Company B, Company C, and Company D, is included, as well as rating information indicating the latest value in the rating transition. The rating information may further include the number of assets held by each organization in the supply chain. Hereinafter, this information will be collectively referred to as "evaluation information

[53] ."

[0113] The rating transition information includes information representing an evaluation value that evaluates vulnerability to cyber attacks over a certain period of time. For example, in the example shown on the left side of FIG. 42 , Company C's evaluation value fluctuates between 700 and 750 from April of one year to March of the following year. In the example shown on the right side of FIG. 42 , the number of assets held by Company C is 67. Similarly, Company B's evaluation value fluctuates between 500 and 560 from April of one year to March of the following year. In the example shown on the right side of FIG. 42 , the number of assets held by Company B is 31. Comparing Company B and Company D, Company B has a lower vulnerability score than Company D, even though Company B has fewer assets. From this information, it can be seen that Company B needs more vulnerability countermeasures than Company D.

[0114] Displaying the rating information and the rating transition information side by side in the evaluation information

[53] as exemplified in Figure 42 has the effect of enabling the user to grasp information that indicates the evaluation results regarding vulnerabilities in the supply chain. Furthermore, displaying the vulnerability assessment score for an organization side by side with the score for the entire supply chain has the effect of enabling the user to grasp the position of an organization in the supply chain in terms of vulnerabilities.

[0115] [Screen 15] Figure 43 is a diagram of a screen displaying the vulnerability scores of each organization involved in transactions with a certain organization in the present disclosure. The screen illustrated in Figure 43 includes assessment information

[53] grouped by the number of people belonging to the organization (e.g., the number of employees of a company). Specifically, the screen illustrated in Figure 43 includes assessment information

[53] as described above with reference to Figure 42 for organizations with 500 or more employees, and assessment information

[53] as described above with reference to Figure 42 for organizations with 300 to 499 employees.

[0116] However, the criteria for grouping are not limited to the number of people belonging to an organization, and may be any information indicating the size of the organization, such as the organization's capital, sales, or profits.

[0117] As shown in FIG. 43, by displaying the rating information and the rating transition information in order according to the size of the organization, it is possible to grasp the difference in the evaluation results due to the size.

[0118] [Screen 16] Figure 44 is a diagram showing an example of the layout of a display screen for correspondence information in the present disclosure. In

[54] in the correspondence information, correspondence information

[54] as will be described with reference to Figure 45 is displayed. In

[55] in the correspondence information, correspondence information

[55] as will be described with reference to Figure 46 is displayed. In

[56] in the correspondence information, correspondence information

[56] as will be described with reference to Figure 47 is displayed. In

[57] in the correspondence information, correspondence information

[57] as will be described with reference to Figure 48 is displayed. In

[58] in the correspondence information, correspondence information

[58] as will be described with reference to Figure 49 is displayed. In

[59] in the correspondence information, correspondence information

[59] as will be described with reference to Figure 50 is displayed.

[0119] The display screen for correspondence information may, for example, display correspondence information

[54] to correspondence information

[59] side by side in a horizontal direction or a vertical direction. The display screen for correspondence information may display at least two pieces of information from correspondence information

[54] to correspondence information

[59] side by side. The display screen for correspondence information may include information that displays information about the correspondence information side by side, and is not limited to the example shown in FIG. 44. It can also be said that correspondence information is information that represents the status of measures (or responses) implemented against security risks.

[0120] In this way, by displaying at least two pieces of information from response information

[54] to response information

[59] side by side, it is possible to obtain an overview of the response status to security risks.

[0121] 45 to 50 are diagrams showing examples of display screens that display correspondence information in the present disclosure.

[0122] In the example shown in Figure 45, response information

[54] includes information indicating the results of a verbal evaluation of the response status to security risks and information indicating the results of a numerical evaluation of the response status to security risks.

[0123] The left diagram in Figure 45 shows information indicating the results of a verbal evaluation of the response status to security risks. The information may be information indicating the results of an evaluation by a third-party organization different from the organization, or information indicating the results of an evaluation by the organization. The information may be created, for example, using a response to a prompt that inquires of the generation AI about the response status to security risks. The information may include at least one of "analyst comments," "summary of attack diagnosis," "summary of third-party evaluation," and "summary of emergency security risk investigation."

[0124] The right diagram of Fig. 45 shows an example of the time progression of the results of evaluating the response status to security risks. The horizontal axis of the right diagram of Fig. 45 represents time, with the further to the right, the more time has passed. The vertical axis of the right diagram of Fig. 45 represents the results of the evaluation of the response status to security risks, with the higher the score (i.e., the more progress has been made in responding to security risks).

[0125] The right diagram in Fig. 45 includes information showing the evaluation results for the organization ("our company" in Fig. 45) and information showing the evaluation that the organization is aiming for ("KPI" in Fig. 45). By displaying the information showing the evaluation results for the organization and the information showing the evaluation that the organization is aiming for side by side, it is possible to grasp the progress of the response situation toward the desired evaluation.

[0126] In the response information

[54] , by displaying information showing the results of a verbal evaluation of the response status to security risks and information showing the results of a numerical evaluation of the response status to security risks side by side, it is possible to achieve the effect of being able to grasp the response status to security risks.

[0127] In the example shown in Fig. 46, response information

[55] includes information representing the response status to security risks for each fiscal year. Response information

[55] may be information representing the response status to security risks for each month, or may be information representing the response status to security risks for each day. The information representing the response status to security risks is not limited to the example shown in Fig. 46 as long as it is information that lists information representing the response status for at least two time periods.

[0128] In the example shown in FIG. 46 , the response information

[55] is associated with, for example, a "diagnostic category," a "number of issues," "incomplete," and "closed." The diagnostic category is information representing the name of an activity that evaluated a security risk, including a vulnerability. The number of issues is information representing the number of vulnerabilities detected in the diagnostic category and security risks related to operational and policy aspects. "Incomplete" is information representing the number of issues for which countermeasures have not been completed out of the number of issues for which security risks have been identified. "Closed" is information representing the number of issues for which countermeasures have been completed out of the number of issues for which security risks have been identified. The response information

[55] may include a closure rate that indicates the proportion of issues for which countermeasures have been completed out of the number of issues. The closure rate may be the closure rate for a specific diagnostic category, or the closure rate for all diagnostic categories.

[0129] 46, the diagnostic category "attack diagnosis" is associated with the number of findings "3500," "incomplete" "3200," and "closed" "300." This indicates that for "attack diagnosis," which detects vulnerabilities and security risks related to operational and policy aspects, the number of cases in which security risks were identified is 3500, the number of cases in which countermeasures have not been completed is 3200, and the number of cases in which countermeasures have been completed is 300.

[0130] In this way, by displaying information indicating the response status for at least two time periods side by side, it is possible to obtain an overview of the details of the response status to security risks.

[0131] In the example shown in Figure 47, response information

[56] is information about the progress of an investigation into security risks, including vulnerabilities. Response information

[56] includes, for example, information showing the trend in the number of security risk cases for which responses have been completed ("Trend in cumulative number of risk closures"), information showing a breakdown of the time required for responses ("Percentage of days until closure"), and information showing the trend in the time required for responses ("Average number of days until closure"). Response information

[56] does not need to include all of the information described above; it is sufficient if it is information that lists at least two pieces of information.

[0132] The horizontal axis in the top diagram of FIG. 47 represents time, with the further to the right the time progresses. The first axis (vertical axis on the left) in the top diagram of FIG. 47 represents the number of security risk investigations that have been completed. The second axis (vertical axis on the right) in the top diagram of FIG. 47 represents the total number of security risk investigations that have been completed. The number of security risk investigations that have been completed may be the number of investigations completed in each period, or the total number of investigations that have been completed.

[0133] The horizontal axis in the lower left diagram of Figure 47 represents time, with time progressing further to the right. The vertical axis represents the breakdown of the time required to investigate security risks. The vertical axis in the lower left diagram of Figure 47 represents the percentage of cases in which countermeasures were completed within a certain time period, with the number of cases in which countermeasures were completed for each fiscal year set to 100. For example, the lower left diagram of Figure 47 shows that for fiscal year 2021, there were 20 investigations that took three days or less, 15 investigations that took four to seven days, and 65 investigations that took eight days or more. This indicates that in fiscal year 2021, 20% of investigations took three days or less, 15% that took four to seven days, and 65% that took eight days or more.

[0134] The horizontal axis in the lower right diagram of Fig. 47 represents time, with the further to the right the time progresses, and the vertical axis represents the time required to investigate the security risk.

[0135] By referring to the correspondence information

[56] as exemplified in FIG. 47, it is possible to obtain information about the investigations carried out regarding security risks.

[0136] In the example shown in FIG. 48, response information

[57] is information that indicates the results of an investigation conducted regarding security risks.

[0137] Correspondence information

[57] is associated with attack assessment, urgent security risk, third-party rating, and credential leakage. Attack assessment indicates that the investigation conducted on a security risk is an assessment that involves a simulated attack. Urgent security risk indicates that the investigation conducted on a vulnerability is an urgent security risk assessment. Third-party rating indicates that the investigation conducted on a vulnerability is an investigation conducted by a third party different from the organization. Credential leakage indicates that the investigation involved leaked credential information. Correspondence information

[57] includes information indicating the number of cases that represent the results of each investigation. A larger number indicates a higher number of vulnerabilities, and a smaller number indicates a lower number of vulnerabilities.

[0138] The response information

[57] illustrated in Fig. 48 includes information representing the results of investigations conducted on security risks in each of fiscal years 2019, 2020, 2021, and 2022. The period for compiling the investigations does not necessarily have to be annual, but may be a different period such as monthly.

[0139] By referring to the correspondence information

[57] , it is possible to grasp the location where a security risk is occurring.

[0140] The correspondence information

[58] illustrated in FIG. 49 includes information and supplementary information indicating the organization where the security risk investigation was conducted, and information indicating the results of the security risk investigation in language. In the example illustrated in FIG. 49 , for example, the fiscal year "2020," the target organizations "Department A and Department B," and supplementary information for the organizations are associated. This indicates that the organizations investigated in fiscal year 2020 were Department A and Department B, and that the organizations "conducted internal attack diagnosis until Q3 2019." The information indicating the results of the security risk investigation in language has the effect of enabling organizations to understand the security risks, for example, that were investigated in fiscal year 2023.

[0141] The correspondence information

[58] has the effect of making it possible to grasp the organization in which the investigation was conducted and information that indicates the security risks in that organization.

[0142] The response information

[59] shown in Fig. 50 includes ranking information representing organizations in descending order of security risk based on the results of a security risk investigation, and ranking information representing organizations in descending order of the time it took to complete a response (or investigation) to the security risk. The response information

[59] may further include information representing the number of assets held by the organization.

[0143] In the correspondence information

[59] , the ranking "1" is associated with the organization "Department C," the number of risks "3,500," and the number of assets "200." This indicates that, of all the organizations, Department C has the most security risks, with 3,500 security risks, and the number of assets held by Department C is 200. In the correspondence information

[59] , the ranking "2" is associated with the organization "Department X," the average number of days to respond "300," and the number of assets "400." This indicates that, of all the organizations, Department X has the second longest response time, with that time being 300, and the number of assets held by Department X is 400.

[0144] The response information

[59] has the effect of making it possible to understand the attitude of each organization toward taking measures against security risks.

[0145] [Screen 17] FIG. 51 shows an example of email threat information

[60] indicating the status of email threats.

[0146] In the example shown in the upper left of Figure 51, email threat information

[60] includes information indicating the number of emails received and information indicating the number of threats detected among those emails. In the example shown in the upper right of Figure 51, email threat information

[60] includes information indicating the trend in the number of received emails and information indicating the trend in the number of threats detected among those emails. The horizontal axis of the diagram shown in the upper right of Figure 51 represents time, with the further to the right, the more time has passed. The first axis (left vertical axis) of the diagram in the upper right of Figure 51 represents the number of received emails. The second axis (right vertical axis) of the diagram in the upper right of Figure 51 represents the number of detected threats. In the example shown in the bottom of Figure 51, email threat information

[60] includes the number of detected malware emails, the number of detected phishing emails, the number of detected fraudulent emails, and the number of detected targeted emails. The email threat information

[60] only needs to include at least two of the above-mentioned pieces of information, and does not necessarily need to include all of the above-mentioned pieces of information. In other words, the email threat information

[60] only needs to display information indicating the number of emails received and information indicating trends in email-related threats side by side.

[0147] By displaying the email threat information

[60] side by side with information showing the number of emails received and information showing the trends in email-related threats, it is possible to grasp the trends in email-related threats.

[0148] [Screen 18] Figure 52 is a diagram showing an example of the layout of a display screen displaying email threat information showing the status of email threats in the present disclosure. In

[61] in the email threat information, email threat information

[61] as will be described with reference to Figure 53 is displayed. In

[62] in the email threat information, email threat information

[62] as will be described with reference to Figure 54 is displayed. In

[63] in the email threat information, email threat information

[63] as will be described with reference to Figure 55 is displayed. In

[64] in the email threat information, email threat information

[64] as will be described with reference to Figure 56 is displayed.

[0149] The email threat information display screen may, for example, display email threat information

[61] to email threat information

[64] side by side horizontally or vertically. The email threat information display screen may display at least two pieces of information from email threat information

[61] to email threat information

[64] side by side. The email threat information display screen may include information that displays information about email threat information side by side, and is not limited to the example shown in FIG. 52. Email threat information can also be said to be information that represents trends in email-related threats.

[0150] In this way, by displaying at least two pieces of information from email threat information

[61] to email threat information

[64] side by side, it is possible to obtain an overview of trends in email-related threats.

[0151] FIG. 53 shows an example of email threat information

[61] indicating the status of email threats.

[0152] 53, the email threat information

[61] includes information indicating the number of times malware was detected in emails, information indicating the time when the malware was detected, and information indicating the breakdown of the detected malware names. The email threat information

[61] does not necessarily need to include all three pieces of information above, but it is sufficient if it includes at least two of the three pieces of information above.

[0153] The horizontal axis in the center diagram of FIG. 53 represents time, with time passing further to the right. The vertical axis in the center diagram of FIG. 53 represents the number of malware detections. The right diagram of FIG. 53 represents the percentage of malware detection names. In the example shown on the right side of FIG. 53, the area indicated by A accounts for 33% of the pie chart. This indicates that 33% of the malware detection names are A.

[0154] In the email threat information

[61] , by displaying at least two pieces of information side by side among information indicating the number of times malware was detected in emails, information indicating the time period in which malware was detected, and information indicating the breakdown of the names of the detected malware, it is possible to grasp the situation in which emails containing malware were detected.

[0155] FIG. 54 shows an example of email threat information

[62] indicating the status of email threats.

[0156] 54, the email threat information

[62] includes information indicating the number of phishing emails detected, information indicating the time period in which the phishing emails were detected, and information indicating the subject lines used in the phishing emails. The email threat information

[62] does not necessarily need to include all three pieces of information above, but may include at least two of the three pieces of information above.

[0157] The horizontal axis in the center diagram of Figure 54 represents time, with time passing further to the right. The vertical axis in the center diagram of Figure 54 represents the number of phishing emails detected. The right diagram of Figure 54 represents the subject lines used in phishing emails and the number of emails. In the example shown on the right side of Figure 54, the phishing email subject line "Notice" is associated with the number of emails "121." This indicates that 121 phishing emails containing the subject line "Notice" were detected.

[0158] In the email threat information

[62] , by displaying at least two pieces of information side by side among information indicating the number of phishing emails detected, information indicating the time period in which phishing emails were detected, and information indicating the subject lines used in emails containing phishing emails, it is possible to obtain an understanding of the circumstances under which phishing emails were detected.

[0159] FIG. 55 shows an example of email threat information

[63] indicating the status of email threats.

[0160] As shown in the example of Figure 55, email threat information

[63] includes information indicating the number of fraudulent emails detected, information indicating the time period in which the fraudulent emails were detected, and information indicating the breakdown of the organization names mentioned in the fraudulent emails. Email threat information

[63] does not necessarily need to include all three pieces of information above, but it is sufficient if it includes at least two of the three pieces of information above.

[0161] The horizontal axis in the center diagram of Figure 55 represents time, with the further to the right the time progresses. The vertical axis in the center diagram of Figure 53 represents the number of detected fraudulent emails. The right diagram of Figure 55 represents the percentage of organization names mentioned in fraudulent emails. In the example shown on the right side of Figure 55, the area indicated by the number of cases mentioning organization A accounts for 76% of the pie chart. This indicates that in 76% of the detected fraudulent emails, the organization name mentioned in the fraudulent emails is A.

[0162] In the email threat information

[63] , by displaying at least two pieces of information side by side, among information indicating the number of fraudulent emails detected, information indicating the time period in which the fraudulent emails were detected, and information indicating the breakdown of the names of organizations mentioned in the fraudulent emails, it is possible to obtain an understanding of the circumstances under which the fraudulent emails were detected.

[0163] FIG. 56 shows an example of email threat information

[64] indicating the status of email threats.

[0164] As shown in the example of Figure 56, email threat information

[64] includes information showing details of fraudulent emails claiming to be from Organization A, information showing details of fraudulent emails claiming to be from Organization B, and information showing samples of the fraudulent emails. In other words, email threat information

[64] is information showing details of fraudulent emails for each organization claimed in the fraudulent email. Email threat information

[64] does not necessarily have to include all three pieces of information above; it is sufficient if it is information that lists at least two of the three pieces of information above.

[0165] For example, in information showing details of a fraudulent email claiming to be from Organization A, the detection time "2024 / 6 / 17 12:00," the sender display name "A," the email subject "Project A," and the number of recipients "10" are associated. This indicates that the fraudulent email claiming to be from Organization A was detected at 2024 / 6 / 17 12:00, the sender of the email is A, the subject is Project A, and the number of recipients of the fraudulent email is 10.

[0166] Additionally, the information showing a sample of a fraudulent email associates the detection time "2024 / 6 / 18 1:32," the sender display name "President G," the email subject "Merger," the email image, and the email characteristic "Message pretending to be urgent." This indicates that the fraudulent email was detected at 2024 / 6 / 18 1:32, the sender of the email is President G, the subject is "Merger," and the characteristic of the fraudulent email is "Message pretending to be urgent." The email image only needs to contain at least a portion of the content of the email body, and may be in text format or image format.

[0167] In the email threat information

[64] , by displaying information showing details of the fraudulent email and information showing samples of the fraudulent email side by side for each organization that the fraudulent email speaks of, it is possible to obtain details of the fraudulent email.

[0168] [Screen 19] Figure 57 is a diagram showing an example of the layout of a display screen that displays email threat information showing the status of emails reported to the security management department in the present disclosure. In the email threat information

[65] , email threat information

[65] as will be described with reference to Figure 58 is displayed. In the email threat information

[66] , email threat information

[66] as will be described with reference to Figure 59 is displayed.

[0169] The email threat information display screen may display, for example, email threat information

[65] to email threat information

[66] arranged horizontally or vertically. The email threat information display screen is not limited to the example shown in FIG. 57 as long as it includes information that displays information about email threat information arranged side by side.

[0170] According to the email threat information as exemplified in FIG. 57, it is possible to grasp the status of reports to the security management department.

[0171] FIG. 58 shows an example of email threat information

[65] indicating the situation reported to the security management department.

[0172] As shown in the example of Fig. 58, the email threat information

[65] includes information indicating the number of emails reported to the security management department and information indicating the breakdown of the reported emails. The email threat information

[65] may be information in which the above two pieces of information are arranged.

[0173] The horizontal axis in the center of Fig. 58 represents time, with the further to the right the time progresses. The vertical axis in the center of Fig. 58 represents the number of reports to the security management department. Email threat information

[65] includes information indicating the number of reports of emails reported as junk emails, information indicating the number of reports of emails reported as spam emails, information indicating the number of reports of emails reported as phishing emails, and information indicating the total number of these reports.

[0174] The right diagram of Figure 58 shows the percentage of cases reported as junk mail, the percentage of cases reported as spam mail, and the percentage of cases reported as phishing mail out of the total number of cases reported to the security management department. For example, in the example shown on the right diagram of Figure 58, the area indicated by "spam mail" is 16% of the total area of ​​the circle. This means that 16% of the cases reported to the security management department were reported as spam mail.

[0175] In the email threat information

[65] , by displaying information indicating the number of emails reported to the security management department and information indicating the breakdown of the reported emails side by side, it is possible to grasp the status of reports to the security management department.

[0176] FIG. 59 shows an example of email threat information

[66] indicating the status of email threats.

[0177] As shown in the example of FIG. 59, email threat information

[66] is information showing details of an email reported to the security management department. In the example shown in FIG. 59, email threat information

[66] is associated with the date and time "2024 / 6 / 18 1:32," the sender display name "President of Company U," the email subject "Budget Management," the email image, and the characteristic "Message pretending to be urgent." This indicates that the date and time reported to the security management department was 2024 / 6 / 18 1:32, the sender was the president of Company U, the subject was "Budget Management," and the characteristic of the email was "Message pretending to be urgent." The email image only needs to contain at least a portion of the content of the email body and may be in text format or image format.

[0178] In the email threat information

[66] , by displaying information showing details of emails reported to the security management department, it is possible to obtain an effect that the contents of the emails reported to the security management department can be understood.

[0179] Although the present invention has been described above with reference to the embodiments, the present invention is not limited to the above-described embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

[0180] For example, although multiple operations are described in a sequential order in the form of a flowchart, the order of description does not limit the order in which the multiple operations are performed. Therefore, when implementing each embodiment, the order of the multiple operations can be changed within the scope that does not affect the content.

[0181] A part or all of the above-described embodiments can be described as, but not limited to, the following supplementary notes.

[0182] (Supplementary Note 1) A display device comprising: a collection means for collecting, online or offline, at least any of the following cybersecurity information: information indicating the source of a cyberattack; information indicating the destination of a cyberattack; information indicating the method of cyberattack; information indicating the status of defense against cyberattacks; information indicating the occurrence status of cyberattacks; information indicating the results of vulnerability assessments related to cyberattacks; information indicating the status of responses to vulnerabilities; and information regarding detected email threats; a generation means for generating a screen that displays the collected cybersecurity information in a row; and a display means for displaying the generated screen.

[0183] (Supplementary Note 2) The display device according to Supplementary Note 1, wherein the generation means generates the screen including at least two of the following information: information indicating the number of cyber attacks detected by at least one of existing rules for detecting cyber attacks and new rules; information indicating the number of detected cyber attacks aggregated in a predetermined unit; scored information on threats caused by cyber attacks; information indicating the cumulative number of reports related to threats; and information indicating the number of addresses used in attacks by region.

[0184] (Supplementary Note 3) The display device according to Supplementary Note 1 or 2, wherein the generation means generates the screen including at least two of the following information: information indicating at least one of the number of cases in which damage from cyber-attacks was prevented by implementing countermeasures against cyber-attacks and the number of information processing devices on which countermeasures against cyber-attacks were implemented; information indicating the percentage of the number of cases in which damage from cyber-attacks was prevented by implementing countermeasures against cyber-attacks, per region; information indicating the number of times a certain cyber-attack was blocked; information indicating the number of detection rules that detect cyber-attacks, for each source of the detection rule; and information indicating the location of an international gateway and the number of threats observed at the international gateway.

[0185] (Supplementary Note 4) The display device according to any one of Supplementary Notes 1 to 3, wherein the generating means generates the screen including information indicating the number of blocked threats and the number of introduced network terminals for each region.

[0186] (Supplementary Note 5) The display device according to any one of Supplementary Notes 1 to 4, wherein the generating means generates the screen including information indicating, for each region, at least one of the type of file targeted by the threat and the type of operating system targeted by the threat.

[0187] (Supplementary Note 6) The display device according to any one of Supplementary Notes 1 to 5, wherein the generating means generates the screen including at least two of the following information: information indicating the number of damages caused by ransomware for each period; information calculated for each period the difference in the number of damages caused by ransomware; and information indicating the number of reported cases of phishing or the number of mail servers discovered in attacks against a system.

[0188] (Supplementary Note 7) The display device according to any one of Supplementary Notes 1 to 6, wherein the generation means generates the screen including information indicating at least one of the following: the date the cyber-attack was confirmed; the industry of the organization that was cyber-attacked; the name of the organization that was cyber-attacked; the address that was cyber-attacked; the content contained in the phishing email; the capital of the organization that was cyber-attacked; the number of employees of the organization that was cyber-attacked; and information indicating the analysis results of the phishing.

[0189] (Supplementary Note 8) The display device according to any one of Supplementary Notes 1 to 7, wherein the generating means generates the screen including at least two of the following information: information indicating the content of phishing that is different from previously disclosed phishing; information indicating the number of reported phishing cases, the number of URLs used in phishing, and the number of brands that have been victimized by phishing; and information including at least one of information indicating the number of reported phishing cases, emergency information about phishing that requires urgent notification, and reference information about phishing.

[0190] (Supplementary Note 9) The display device according to at least one of Supplementary Notes 1 to 8, wherein the generating means generates the screen including at least two of the following information: information in which the cumulative number of damages caused by ransomware is tallied by period; information showing the cumulative trend in the number of damages caused by ransomware; information showing the number of damages caused by ransomware; information in which the cumulative number of damages caused by ransomware is shown by type of affected industry; information in which information showing the trend in the cumulative number of damages caused by ransomware is shown by type of affected industry; information in which information showing the trend in the number of damages caused by ransomware is shown by type of affected industry; information in which the cumulative number of damages caused by ransomware is shown by region; information in which the cumulative number of damages caused by ransomware is shown by region; and information in which the number of damages caused by ransomware is shown by region.

[0191] (Supplementary Note 10) The display device according to any one of Supplementary Notes 1 to 9, wherein the generating means generates the screen including information in which the number of detection rules is classified by the source of the detection rules, and information indicating threats observed at international gateways by region.

[0192] (Supplementary Note 11) The display device according to any one of Supplementary Notes 1 to 10, wherein the generation means generates the screen including at least two of the following information: information indicating the number of detected threats observed at an international gateway for each region; information indicating at least one of the number of threats observed at an international gateway and the number of countermeasures taken against the threats; information indicating the number of detected threats for each source of the detection rule; and information indicating the traffic volume in communications between a sender and a destination for each region in which the communications were carried out.

[0193] (Supplementary Note 12) The display device according to any one of Supplementary Notes 1 to 11, wherein the generating means generates the screen including at least two of the following information: information indicating the proportion of protocols in the traffic volume of communications carried out; information indicating the traffic volume and number of threats at the communication destination for each region; information including at least one of the region, protocol, detection rule, detection content, and investigation conducted in response to the detection for detected threats; and information indicating the cumulative number of detected threats and the cumulative number of countermeasures conducted in response to the threats.

[0194] (Supplementary Note 13) The display device according to any one of Supplementary Notes 1 to 12, wherein the generation means generates the screen including at least two pieces of information from among information representing rules for detecting vulnerabilities held by an organization, information representing the number of vulnerabilities detected using the rules, and information representing the status of investigations conducted regarding the vulnerabilities detected using the rules.

[0195] (Supplementary Note 14) The display device according to any one of Supplementary Notes 1 to 13, wherein the generating means generates the screen including information representing the results of an assessment of vulnerabilities held by a second organization involved in a transaction with the first organization, and information representing the number of assets held by the second organization.

[0196] (Supplementary Note 15) The display device described in any one of Supplementary Notes 1 to 14, wherein the generation means generates the screen including at least two of the following information: information indicating the results of a verbal evaluation of the response status to security risks; information indicating the results of a numerical evaluation of the response status to security risks; information indicating the response status to security risks; information about the progress of an investigation into security risks; information indicating the results of an investigation conducted into security risks; information indicating organizations in which an investigation into security risks has been conducted; information indicating organizations in order of the number of security risks; and information indicating organizations in order of the longest period of time required to complete responses to security risks.

[0197] (Supplementary Note 16) The display device described in any one of Supplementary Notes 1 to 15, wherein the generation means generates the screen including at least two of the following information: information indicating the number of malware detected from emails; information indicating the time when malware was detected; information indicating a breakdown of the names of the detected malware; information indicating the number of phishing emails detected; information indicating the time period when phishing emails were detected; information indicating the subject lines used in phishing emails; information indicating the number of fraudulent emails detected; information indicating the time period when fraudulent emails were detected; information indicating a breakdown of the names of organizations mentioned in the fraudulent emails; information indicating details of the fraudulent emails for each organization mentioned in the fraudulent emails; and information indicating samples of the fraudulent emails.

[0198] (Supplementary Note 17) The display device according to any one of Supplementary Notes 1 to 16, wherein the generating means generates the screen including information indicating the number of emails reported to the security management department, and information indicating details of the emails reported to the security management department.

[0199] (Appendix 18) A display system comprising: a collection means for collecting, online or offline, at least any of the cybersecurity information including information indicating the source of a cyberattack, information indicating the destination of a cyberattack, information indicating the method of cyberattack, information indicating the status of defense against cyberattacks, information indicating the occurrence status of cyberattacks, information indicating the results of vulnerability assessments related to cyberattacks, information indicating the status of responses to vulnerabilities, and information regarding detected email threats; a generation means for generating a screen that displays the collected cybersecurity information in a row; and a display means for displaying the generated screen.

[0200] (Supplementary Note 19) A display method in which a computer collects, online or offline, at least any of the following cybersecurity information: information indicating the source of a cyberattack; information indicating the destination of a cyberattack; information indicating the method of cyberattack; information indicating the status of defense against cyberattacks; information indicating the occurrence status of cyberattacks; information indicating the results of vulnerability assessments related to cyberattacks; information indicating the status of responses to vulnerabilities; and information regarding detected email threats; generates a screen that displays the collected cybersecurity information in a row; and displays the generated screen.

[0201] (Appendix 20) A recording medium having recorded thereon a program that causes a computer to perform the following operations: collect, online or offline, at least any of the following cybersecurity information: information indicating the source of a cyberattack; information indicating the destination of a cyberattack; information indicating the method of cyberattack; information indicating the status of defense against cyberattacks; information indicating the occurrence status of cyberattacks; information indicating the results of vulnerability assessments related to cyberattacks; information indicating the status of responses to vulnerabilities; and information regarding detected email threats; generate a screen that displays the collected cybersecurity information in a row; and display the generated screen.

[0202] This application claims priority based on Japanese Patent Application No. 2023-150833, filed September 19, 2023, the disclosure of which is incorporated herein by reference in its entirety.

[0203] 100 Display device 101 Collection unit 102 Generation unit 103 Display unit 500 Computer device 501 CPU 502 ROM 503 RAM 504 Program 505 Storage device 506 Recording medium 507 Drive device 508 Communication interface 511 Input / output interface 512 Bus

Claims

1. A display device comprising: a collection means for collecting, online or offline, at least any of the following cybersecurity information: information indicating the source of a cyberattack; information indicating the destination of a cyberattack; information indicating the method of attack; information indicating the status of defense against cyberattacks; information indicating the occurrence status of cyberattacks; information indicating the results of vulnerability assessments related to cyberattacks; information indicating the status of response to vulnerabilities; and information regarding detected email threats; a generation means for generating a screen that displays the collected cybersecurity information in an arranged manner; and a display means for displaying the generated screen.

2. The display device of claim 1, wherein the generation means generates the screen including at least two of the following information: information indicating the number of cyber attacks detected by at least one of existing rules for detecting cyber attacks and new rules; information indicating the number of detected cyber attacks tallied in a predetermined unit; information in which information on threats caused by cyber attacks is scored; information indicating the cumulative number of reports related to threats; and information indicating the number of addresses used in attacks for each region.

3. The display device of claim 1 or 2, wherein the generation means generates the screen including at least two of the following information: information indicating at least one of the number of cases of cyber-attack damage prevented by implementing countermeasures against cyber-attacks and the number of information processing devices on which countermeasures against cyber-attacks have been implemented; information indicating the percentage of the number of cases of cyber-attack damage prevented by implementing countermeasures against cyber-attacks per region; information indicating the number of times a certain cyber-attack was blocked; information indicating the number of detection rules that detect cyber-attacks for each source of the detection rule; and information indicating the locations where international gateways are installed and the number of threats observed at the international gateways.

4. A display device according to any one of claims 1 to 3, wherein the generating means generates the screen including information showing the number of blocked threats and the number of introduced network terminals for each region.

5. A display device according to any one of claims 1 to 4, wherein the generating means generates the screen including information indicating, for each region, at least one of the type of file targeted by the threat and the type of operating system targeted by the threat.

6. A display device as claimed in any one of claims 1 to 5, wherein the generation means generates the screen including at least two of the following information: information indicating the number of damages caused by ransomware for each period; information calculated as the difference in the number of damages caused by ransomware for each period; and information indicating the number of reported cases of phishing or the number of mail servers discovered in attacks carried out against a system.

7. A display device as described in any one of claims 1 to 6, wherein the generation means generates the screen including information indicating at least one of the following: the date the cyber-attack was confirmed, the industry of the organization that was attacked by the cyber-attack, the name of the organization that was attacked by the cyber-attack, the addresses that were attacked by the cyber-attack, the content contained in the phishing email, the capital of the organization that was attacked by the cyber-attack, the number of employees of the organization that was attacked by the cyber-attack, and information indicating the results of the phishing analysis.

8. The display device according to any one of claims 1 to 7, wherein the generation means generates the screen including at least two of the following information: information indicating the content of phishing that is different from previously disclosed phishing; information indicating the number of reported phishing cases, the number of URLs used in phishing, and the number of brands that have been victimized by phishing; and information including at least one of the following: information indicating the number of reported phishing cases, emergency information about phishing that requires urgent notification, and reference information about phishing.

9. The display device according to at least one of claims 1 to 8, wherein the generating means generates the screen including at least two of the following information: information on the cumulative number of damages caused by ransomware tallied by period; information showing the cumulative trend in the number of damages caused by ransomware; information showing the number of damages caused by ransomware; information showing the cumulative number of damages caused by ransomware by type of damaged industry; information showing information showing the trend in the cumulative number of damages caused by ransomware by type of damaged industry; information showing information showing the trend in the number of damages caused by ransomware by type of damaged industry; information showing the cumulative number of damages caused by ransomware by region; information showing the cumulative number of damages caused by ransomware by region; and information showing the number of damages caused by ransomware by region.

10. A display device according to any one of claims 1 to 9, wherein the generation means generates the screen including information in which the number of detection rules is classified by the source of the detection rules, and information indicating threats observed at international gateways by region.

11. A display device as claimed in any one of claims 1 to 10, wherein the generation means generates the screen including at least two of the following information: information indicating the number of threats detected at an international gateway for each region; information indicating the number of threats observed at an international gateway and / or the number of responses to the threats; information indicating the number of detected threats for each source of detection rule; and information indicating the traffic volume in communications between a source and a destination for each region in which the communications were carried out.

12. A display device as described in any one of claims 1 to 11, wherein the generation means generates the screen including at least two of the following information: information indicating the ratio of protocols to the traffic volume of communications carried out; information indicating the traffic volume and number of threats at the destination for each region; information including at least one of the region, protocol, detection rule, detection content, and investigation conducted in response to the detection for detected threats; and information indicating the cumulative number of detected threats and the cumulative number of countermeasures conducted in response to the threats.

13. A display device as described in any one of claims 1 to 12, wherein the generation means generates the screen including at least two of the following information: information representing rules for detecting vulnerabilities held by an organization, information representing the number of vulnerabilities detected using the rules, and information representing the status of investigations conducted regarding the vulnerabilities detected using the rules.

14. A display device according to any one of claims 1 to 13, wherein the generation means generates the screen including information showing the results of an assessment of vulnerabilities held by a second organization involved in a transaction with the first organization, and information showing the number of assets held by the second organization.

15. A display device as described in any one of claims 1 to 14, wherein the generation means generates the screen including at least two of the following information: information indicating the results of a verbal evaluation of the response status to security risks; information indicating the results of a numerical evaluation of the response status to security risks; information indicating the response status to security risks; information about the progress of an investigation into security risks; information indicating the results of an investigation conducted into security risks; information indicating organizations in which an investigation into security risks has been conducted; information indicating organizations in order of the number of security risks; and information indicating organizations in order of the length of time it took them to complete their responses to security risks.

16. A display device as described in any one of claims 1 to 15, wherein the generation means generates the screen including at least two of the following information: information indicating the number of malware detected in emails; information indicating the time when the malware was detected; information indicating a breakdown of the names of the detected malware; information indicating the number of phishing emails detected; information indicating the time period when the phishing emails were detected; information indicating the subject lines used in the phishing emails; information indicating the number of fraudulent emails detected; information indicating the time period when the fraudulent emails were detected; information indicating a breakdown of the names of organizations mentioned in the fraudulent emails; information indicating details of the fraudulent emails for each organization mentioned in the fraudulent emails; and information indicating samples of the fraudulent emails.

17. A display device according to any one of claims 1 to 16, wherein the generation means generates the screen including information indicating the number of emails reported to the security management department, and information indicating details of the emails reported to the security management department.

18. A display system comprising: a collection means for collecting, online or offline, at least any of the following cybersecurity information: information indicating the source of a cyberattack, information indicating the destination of a cyberattack, information indicating the method of attack, information indicating the status of defense against cyberattacks, information indicating the occurrence status of cyberattacks, information indicating the results of vulnerability assessments related to cyberattacks, information indicating the status of response to vulnerabilities, and information regarding detected email threats; a generation means for generating a screen that displays the collected cybersecurity information in an arranged manner; and a display means for displaying the generated screen.

19. A display method in which a computer collects, online or offline, at least any of the following cybersecurity information: information indicating the source of a cyberattack, information indicating the destination of a cyberattack, information indicating the method of attack, information indicating the status of defense against cyberattacks, information indicating the occurrence status of cyberattacks, information indicating the results of an assessment of vulnerabilities related to cyberattacks, information indicating the status of response to vulnerabilities, and information regarding detected email threats; generates a screen that displays the collected cybersecurity information in an arranged manner; and displays the generated screen.

20. A recording medium having recorded thereon a program that causes a computer to perform the following operations: collect, online or offline, at least any of the following cybersecurity information: information indicating the source of a cyberattack; information indicating the destination of a cyberattack; information indicating the method of attack; information indicating the status of defense against cyberattacks; information indicating the occurrence status of cyberattacks; information indicating the results of vulnerability assessments related to cyberattacks; information indicating the status of responses to vulnerabilities; and information regarding detected email threats; generate a screen that displays the collected cybersecurity information in an arranged manner; and display the generated screen.

Images