JP2009140362A - Security level evaluation device and security level evaluation program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To improve precision of security level evaluation of a target device. <P>SOLUTION: A basic model selection part 1 displays a basic model selected by an evaluator to a display device 9. An instance input part 3 creates an instance list associating a structural element on the basic model with an instance defined with respect to the structural element. A security countermeasure list generating part 4 generates a security countermeasure list on the basis of the selected basic model and the instance list. A question list generation part 5 generates a question list on the basis of the security countermeasure list and a question template list. An answer collection part 7 generates a level evaluation result table by collating a result of answer to the question list with the security countermeasure list and the question template list. Also, the answer collection part 7 calculates comprehensiveness and the security level of the security on the basis of the level evaluation result table. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a security level evaluation device and a security level evaluation program for evaluating the security level of a device to be evaluated.

  In recent years, information systems have been widely used. At the same time, attacks with vulnerabilities in information systems are spreading, and it is important that appropriate security measures are taken for information systems. In order to take appropriate security measures for an information system, it is necessary for an evaluator to evaluate the security level of the information system and grasp the current state.

  As for security level evaluation, as disclosed in, for example, Patent Document 1, even if the evaluator does not have advanced expertise, the security state of the system is evaluated and the creation of security measures is supported. There is a security evaluation device.

Specifically, when the evaluator specifies the system to be evaluated and its component devices, the security evaluation device displays a list of security measures to be taken for each device, and the evaluator displays the actual security measures for this list. If the presence / absence of the presence / absence is input, the security status evaluation process of the evaluation target system is performed and the result is displayed.
JP 2001-101135 A

  When evaluating the security level, it is necessary to evaluate from the two viewpoints of whether security measures are deployed in an appropriate balance and whether each security measure is properly realized. However, in the conventional technology, only the presence or absence of security measures is evaluated, and it cannot be evaluated to what extent the security measures are functioning effectively.

  Further, in the conventional technology, it is necessary to register in advance the security measures to be taken for each information system to be evaluated for evaluating whether the security measures are deployed in an appropriate balance. Therefore, the security level cannot be evaluated unless the system and device configuration can be correctly extracted.

  Therefore, an object of the present invention is to provide a security level evaluation apparatus and a security level evaluation program that can improve the accuracy of security level evaluation of a security level evaluation target apparatus.

  That is, the security level evaluation apparatus according to the present invention includes an acquisition means for acquiring security measure information in which each evaluation element of the security level evaluation target apparatus and each security countermeasure item to be realized for the evaluation element are associated, and security level evaluation The definition of the contribution level of completeness of the implementation of each security countermeasure item for each evaluation element of the security level evaluation target device and the corresponding security countermeasure item are realized in the template of the questionnaire used for evaluating the security level of the target device. Template storage means for storing the template information in which the definition value of the security contribution level indicating the effectiveness of the security information is associated, and evaluation factors and security countermeasure items associated with the security countermeasure information acquired by the acquisition means are stored. By reflecting the rate information question item model, a question list that is a list of question items used for security level evaluation of the security level evaluation target device is generated, and answers to each question item in the generated question list For the combination of each evaluation element in the security countermeasure information and the security countermeasure items associated with the evaluation element, the template on the template information used to generate the questionnaire that includes the combination in the question list The contribution level to the comprehensiveness of the security countermeasures based on the input value of the definition value of the coverage level, the definition level of the security level contribution level, and the answer to the questionnaire. Security is calculated by calculating the contribution to security. And generating a security level evaluation information level evaluation target apparatus.

  ADVANTAGE OF THE INVENTION According to this invention, the precision of the security level evaluation of the apparatus of security level evaluation object can be improved.

Embodiments of the present invention will be described below with reference to the drawings.
In the embodiment of the present invention, there are a security level evaluation target device and a security level evaluation device operated by an evaluator.
The security level evaluation target device is a device or system that is a security level determination target. The evaluator is a person who operates the security level evaluation apparatus and evaluates the security level of the security level evaluation target apparatus.

FIG. 1 is a block diagram showing an outline of a system configuration of a security level evaluation apparatus according to an embodiment of the present invention.
As shown in FIG. 1, the security level evaluation apparatus includes a basic model selection unit 1, a storage device 2, an instance input unit 3, a security countermeasure list generation unit 4, a question list generation unit 5, an answer input unit 6, and level evaluation information generation. An answer totaling unit 7, which is a means, an input device 8 such as a keyboard and a mouse, and a display device 9 such as a display device are connected to each other via a bus 10.

  The storage device 2 is a storage medium composed of hardware such as a hard disk drive or a nonvolatile memory device, for example, and includes a basic model selection unit 1, a storage device 2, an instance input unit 3, a security countermeasure list generation unit 4, a question list. In addition to storing a control program for operation by the generation unit 5, the answer input unit 6, and the answer counting unit 7, a basic model storage unit 11, an instance list storage unit 12, a security countermeasure list storage unit 13, which are basic model storage means, It has the question template list memory | storage part 14, the question list memory | storage part 15, the answer list memory | storage part 16, the level evaluation result memory | storage part 17, and the security level result memory | storage part 18 which are template memory | storage means.

  The basic model storage unit 11 stores a plurality of types of basic models. The basic model is information that associates a general system configuration that is a model of a security level evaluation target device with a security measure to be performed there. A general system configuration in the basic model is a group of system components in a specific system form or a specific field, and examples thereof include a Web application, a client server system, and a personnel system. Examples of this component include system functions and system hardware.

  The basic model that defines a general system configuration in this way can be applied universally to various systems. The basic model stored in the basic model storage unit 11 is used to generate an instance list and a security countermeasure list that will be described later.

FIG. 2 is a diagram showing an example of a basic model stored in the storage device of the security level evaluation apparatus according to the embodiment of the present invention in a table format.
The basic model shown in FIG. 2 includes a basic model ID for identifying the basic model, a configuration / measure ID for identifying each row of the basic model, the above-described constituent elements, the above-described security measures, the constituent elements, and the security measures. And the degree of importance that defines how much the combination will affect the degree of contribution to be described later.

  In the basic model shown in FIG. 2, the importance value ranges from “0” to “3”. “0” indicates that the security measure is not necessary for the component, and hereinafter, the greater the numerical value, the greater the degree of influence on the contribution.

The basic model selection unit 1 presents a list of basic models used at the time of security level evaluation to the evaluator, and selects the basic model according to an input operation to the input device 8 by the evaluator.
The instance input unit 3 uses the basic model selected by the basic model selection unit 1 and creates an instance list according to an input operation to the input device 8 for instance definition by the evaluator.

  The instance list storage unit 12 stores a created instance list. The instance list is list information obtained by extracting instances depending on the security level evaluation target device from the components presented in the basic model. An instance in the instance list is a component that allows an evaluator to actually confirm the security level evaluation target device when evaluating the security level.

  The evaluator evaluates each instance when evaluating the security level of the security level evaluation target device. The evaluator should determine the components of the basic model in advance and define an instance of the security level evaluation target device from this basic model, so that it should be applied to each component of the security level evaluation target device from the abstract level. The entire security measures can be covered. Therefore, it is possible to prevent the omission of definition of the instance. The instance list stored in the instance list storage unit 12 is used to generate a security countermeasure list.

FIG. 3 is a diagram showing an example of an instance list stored in the storage device of the security level evaluation apparatus according to the embodiment of the present invention in a table format.
The instance list shown in FIG. 3 defines an instance in the security level evaluation target device when the evaluator selects the basic model shown in FIG. As shown in FIG. 3, the security level evaluation target device that the evaluator wants to evaluate has a personal information input screen, a management information input screen, a personal information output screen, a management information output screen, and a personal information change notification function. .
The security countermeasure list generation unit 4 generates a security countermeasure list based on the basic model selected by the basic model selection unit 1 and the instance defined by the instance input unit 3.

  The security countermeasure list storage unit 13 stores a generated security countermeasure list. The security countermeasure list is information that associates an instance of a security level evaluation target device with a security countermeasure that should be implemented for the instance.

  In general, the evaluator created security measures from nothing when evaluating the security level. However, it is difficult for the evaluator to grasp the entire system, so it is difficult to understand the prepared security measures. Leakage was easy to occur. Therefore, the basic model and the instance list are created in advance to prevent omission of security measures. The security countermeasure list stored in the security countermeasure list storage unit 13 is used to generate a question list and a level evaluation result table.

  The question template list storage unit 14 stores a question template list. This question template list is used to generate a question list and a level evaluation result table which will be described later.

  The question list storage unit 15 stores a question list. The question list is information describing questions used when the evaluator evaluates the security level evaluation target device. The evaluator looks at the questions in the question list, determines whether the security level evaluation target device satisfies the question contents, and can input the result using the input device 8 as an answer to the question.

The answer list storage unit 16 stores an answer list that is information obtained by adding an answer to the question list. The answer list stored in the answer list storage unit 16 is used to generate a level evaluation result table.
The level evaluation result storage unit 17 stores a level evaluation result table. This level evaluation result table is used to generate a security level result of the security level evaluation target device.
The security level result storage unit 18 stores the security level result of the security level evaluation target device. Details of the question template list, question list, answer list, level evaluation result table, and security level result will be described later.

Next, the operation of the security level evaluation apparatus configured as shown in FIG. 1 will be described. FIG. 4 is a sequence diagram showing an example of the processing operation of the security level evaluation apparatus according to the embodiment of the present invention.
As a precondition, before evaluating the security level of the security level evaluation target device, a basic model and a question template list serving as a template for the question list are defined in advance, and the basic model storage unit 11 and the question template list storage unit 14 are stored respectively.

  Thereby, it is possible to shorten the work period in which the evaluator performs the security level evaluation of the security level evaluation apparatus. Further, by making the basic model and the question template list general-purpose, it is possible to efficiently evaluate the security level for various systems and device configurations.

First, the evaluator makes a basic model selection request to the basic model selection unit 1 by operating the input device 8 (step S1).
In accordance with the selection request, the basic model selection unit 1 reads a plurality of basic models from the basic model storage unit 11 and displays them on the display device 9 (steps S2 and S3).

The evaluator selects a basic model to be selected from the displayed basic models by operating the input device 8 (step S4).
The basic model selection unit 1 stores the selected basic model in the basic model storage unit 11, and displays the selected basic model on the display device 9 (steps S5 and S6).

  Subsequently, the instance input unit 3 causes the display device 9 to display an instance input request screen for each of the components of the selected basic model. For example, when the selected basic model has the configuration shown in FIG. 2, the components are “input function”, “output function”, and “notification function”, so an instance of “input function”, “output function” The evaluator is required to input an instance of “function” and an instance of “notification function”.

The evaluator defines the requested instance by operating the input device 8 (step S7). There may be a single instance or multiple instances for a single component.
In the example shown in FIG. 3, the instance “personal information input screen” and the “management information input screen” are defined for the components “input function” and “output function”, respectively, and the instance “personal information” for the component “notification function”. "Change notification function" is defined.

  The instance input unit 3 creates an instance list in which the constituent elements on the basic model are associated with the instances defined for the constituent elements, and stores the instance list in the instance list storage unit 12 (step S8).

  Subsequently, when the evaluator requests the security countermeasure list generation unit 4 to generate a security countermeasure list by operating the input device 8 (step S9), the security countermeasure list generation unit 4 is stored in the basic model storage unit 11. The selected basic model and the instance list stored in the instance list storage unit 12 are acquired (steps S10 and S11), and a security countermeasure list is generated based on the selected basic model and the instance list (step S12). ).

Details of the security countermeasure list generation process will be described here. FIG. 5 is a flowchart showing an example of security countermeasure list generation processing by the security level evaluation apparatus according to the embodiment of the present invention.
First, the security countermeasure list generation unit 4 selects the uppermost line among the unselected lines of the selected basic model (step S41), and the configuration / countermeasure ID, component, security countermeasure and The importance level is extracted (step S42).

  If the extracted importance is not “0” (NO in step S43), the security countermeasure list generation unit 4 acquires an instance corresponding to the component of the extracted row from the generated instance list (step S44).

  The security countermeasure list generation unit 4 has acquired a new “security countermeasure ID” for identifying each row of the security countermeasure list and the “component” extracted from the basic model in the process of step S42 from the instance list in the process of step S43. The “instance” replaced with the instance, and additional information including “security measures” and “importance” extracted from the basic model in the process of step S42 are added to the format of the security measure list to be generated (step S45). The initial definition value of the security countermeasure ID is “1”, and is updated by incrementing by 1 each time new additional information is generated.

  Further, if there are a plurality of types of instances already defined in the instance list for the constituent elements of the row taken out from the basic model by the security countermeasure list generation unit 4, the above-described additional information is generated separately for each instance.

  That is, the component selected from the basic model is “input element”, the security measure for this component is “subject authentication”, and the instance defined in the instance list for the component is “personal information input” as shown in FIG. In the case of “screen” and “management information input screen”, additional information including the instance “personal information input screen” and the security measure “subject authentication” is generated, and the security measure ID is one instance later. Additional information including a management information input screen and a security measure “subject authentication” is further generated.

If the next line exists in the selected basic model (YES in step S46), the security countermeasure list generation unit 4 selects this line (step S47) and returns to the process in step S42.
If the next line does not exist in the selected basic model (NO in step S46), the security countermeasure list generation unit 4 ends the generation of the security countermeasure list.

FIG. 6 is a table showing an example of a security countermeasure list generated by the security level evaluation apparatus according to the embodiment of the present invention.
The security countermeasure list shown in FIG. 6 is a list created from the basic model shown in FIG. 2 and the instance list shown in FIG. In the security countermeasure list illustrated in FIG. 6, a security countermeasure ID, an instance, a security countermeasure, and an importance level are associated with each other.

  The security countermeasure list generation unit 4 stores the generated security countermeasure list in the security countermeasure list storage unit 13, and displays the security countermeasure list on the display device 9 (steps S13 and S14).

  When the evaluator who refers to the displayed security countermeasure list operates the input device 8 to request the question list generation section 5 (step S15), the question list generation section 5 displays the security countermeasure list. The security countermeasure list stored in the storage unit 13 and the question template list stored in the question template list storage unit 14 are acquired (steps S16 and S17), and the question list is based on the security countermeasure list and the question template list. Is generated (step S18). That is, the question list generation unit 5 is an acquisition unit that acquires security countermeasure information.

  The question template list is data used as a basis when the question list generation unit 5 generates a question used when the evaluator evaluates the security level. By preparing this question template list in advance, it becomes possible to automatically generate questions according to various systems and functions.

  In the question template list, the relationship between the question and the degree of contribution is defined. The degree of contribution is a value indicating how much the security measure corresponding to the contents of the question contributes to the security level of the security level evaluation target device.

  The degree of contribution can be broadly divided into two evaluation axes, one is comprehensiveness and the other is security. Comprehensiveness is an index that evaluates the degree to which the security measures required for the security level evaluation target device have been realized, and security is how effective the implemented security measures are. It is an index to evaluate.

  There may be multiple evaluation axes for security. Thus, when there are a plurality of evaluation axes, the evaluation results of these evaluation axes are combined to evaluate security. The security level evaluation device uses two evaluation axes of completeness and security, so that security measures are deployed in an appropriate balance and individual security measures are realized appropriately. From the viewpoint, the security level of the security level evaluation target device can be evaluated.

  This security level evaluation device calculates the security level of completeness in order to evaluate whether security measures are deployed in an appropriate balance, and in order to evaluate whether each security measure is properly realized. Calculate the security level.

FIG. 7 is a diagram showing an example of a question template list stored in the storage device of the security level evaluation apparatus according to the embodiment of the present invention in a table format.
The question template list shown in FIG. 7 is information that defines the contribution of coverage and security when the content of the question template that is the basis of the question presented to the evaluator is satisfied.

  The question template list shown in FIG. 7 includes a question template ID that identifies each row of the question template list, a question template that is a sentence used as a basis for generating a question to be provided to the evaluator, and comprehensiveness and security. Each contribution is related.

  In the example shown in FIG. 7, security is evaluated on four evaluation axes. Further, in the example shown in FIG. 7, the contribution is defined so that the total contribution to each evaluation axis becomes 1, and one question is added to the contributions of a plurality of evaluation axes. It has become.

  In addition, [Instance] and [Security Measure], which are the descriptions enclosed in parentheses in the question template shown in FIG. 7, are specific names of instances and security measures defined in the security measure list, respectively, when the question list is generated. Is replaced.

  Next, details of the question list generation process will be described. FIG. 8 is a first flowchart showing an example of a question list generation process by the security level evaluation apparatus according to the embodiment of the present invention. FIG. 9 is a second flowchart showing an example of a question list generation process by the security level evaluation apparatus according to the embodiment of the present invention.

  First, the question list generation unit 5 acquires the number of rows in the generated security countermeasure list (step S51), and starts a loop for selecting a row in the security countermeasure list (step S52).

  Then, the question list generation unit 5 selects the first row of the acquired question template list (step S53), and extracts the question template ID and the question template of the top row among the unselected rows (step S54, S55).

  The question list generation unit 5 is a new “question ID”, “question template ID” acquired from the question template list in the process of step S54, and “question template” extracted from the question template list in the process of step S54. The additional information for “question” is additionally written in the format of the question list to be generated (step S56). The initial definition value of the question ID is “1”, and is updated by incrementing by one each time new information for additional writing is generated.

  If the next line exists in the selected question template list (YES in step S57), the question list generation unit 5 selects this line (step S58) and returns to the process in step S54. In the example shown in FIG. 7, the number of rows in the question template list is 4, so that the processing from step S54 to S56 is performed four times for one row of the security countermeasure list.

  Then, the question list generation unit 5 proceeds to processing of the next line in the acquired security countermeasure list (step S59). The question list generation unit 5 stores, in the storage device 2, information in which additional information is added to the question list format as intermediate data for generating the question list when processing of all rows of the security countermeasure list is completed. To do.

FIG. 10 is a diagram showing an example of intermediate data for generating a question list by the security level evaluation apparatus according to the embodiment of the present invention in a table format.
By performing the processing up to step S59, the intermediate data shown in FIG. 10 is generated, and a question list is generated based on the intermediate data.

  Then, the question list generation unit 5 selects the first row of the acquired security countermeasure list (step S61), and acquires the instance of the selected row and the security countermeasure (steps S62 and S63).

  The question list generation unit 5 selects, from among the above-described rows on the intermediate data, a row that is continuous for the number of rows in the question template list from the top row among the unselected rows, and the “question” of these rows is selected. Of these, [instance] and [security countermeasure] that are enclosed in parentheses are replaced with the instance and security countermeasure obtained from the security countermeasure list (step S64).

  When the security countermeasure list has the configuration shown in FIG. 6, the instance in the first row is “personal information input screen” and the security countermeasure is “subject authentication”. “[Instance]” in the row selected from above is replaced with “personal information input screen”, and “[Security Measure]” in the row selected from the intermediate data is replaced with “subject authentication”.

If the next line exists in the security countermeasure list (YES in step S65), the question list generation unit 5 selects this line (step S66) and returns to the process in step S62.
If the next line does not exist in the security countermeasure list (NO in step S65), the question list generation unit 5 sets the intermediate data as the final question list.

FIG. 11 is a diagram showing an example of a question list generated by the security level evaluation apparatus according to the embodiment of the present invention in a table format.
The question list shown in FIG. 11 is created by combining the security countermeasure list shown in FIG. 6 and the question template list shown in FIG. The question list shown in FIG. 11 has a question ID for identifying each row of the question list, a question template ID for identifying from which question template the question is generated, and a question.

The question list generation unit 5 stores the generated question list in the question list storage unit 15 and displays the question list on the display device 9 (step S19).
Then, when an evaluator who refers to the question list displayed on the display device 9 operates the input device 8 to request input of an answer to the question on the question list (step S20), the answer input unit 6 A question list stored in the list storage unit 15 is acquired (step S21), and answer input information obtained by adding a question answer input column to the list is displayed on the display device 9 (step S22).

The evaluator refers to the question indicated by the answer input information, determines whether or not this question is satisfied, and inputs the answer using the input device 8.
When an answer to the question indicated by the answer input information, that is, an evaluation of the security level evaluation target device is input to the answer input field (step S23), the answer input unit 6 is used for inputting the answer in which the answer is input. Information is stored in the answer list storage unit 16 as an answer list, and this answer list is displayed on the display device 9 (step S24).

The answer list is obtained by adding evaluator's answer information to the above-described question list. FIG. 12 is a diagram showing an example of a reply list generated by the security level evaluation apparatus according to the embodiment of the present invention in a table format.
The answer list shown in FIG. 12 includes a question ID for identifying each row of the answer list, a question template ID for identifying from which question template the question is generated, the question, and the security level evaluation target device satisfy the question content. And an answer that is an input result of whether or not. In the example shown in FIG. 12, “○” is input as an answer when the evaluator determines that the question content is satisfied, and “X” is input as an answer when the evaluator determines that the question content is not satisfied. Has been.

  When the evaluator who inputs the answer operates the input device 8 to request the totaling of the answers (step S26), the answer totaling unit 7 stores the security countermeasure list stored in the security countermeasure list storage unit 13 and the question template list. The question template list stored in the unit 14 and the answer list stored in the answer list storage unit 16 are acquired (steps S27 and S28).

  The response totaling unit 7 compares the response result of the acquired response list, the acquired security countermeasure list instance and security countermeasure, the importance level, and the contribution level defined in the acquired question template list. An evaluation result table is generated (step S29).

  The level evaluation result table is a table in which the security levels of the security level evaluation target devices are summarized in a table format. Specifically, the security measures that should be implemented in each instance of the security level evaluation target device, the importance of the security measures, and the information that quantifies the effectiveness of the security measures by the degree of contribution are related. It is done.

  By analyzing this level evaluation result table, the evaluator can know the security level of the security level evaluation target device, and what should be done to which instance of the security level evaluation target device to improve the security level. Information can be obtained.

Here, details of the generation processing of the level evaluation result table will be described. FIG. 13 is a flowchart showing an example of level evaluation result table generation processing by the security level evaluation apparatus according to the embodiment of the present invention.
First, the answer counting unit 7 selects an unselected top row in the generated security countermeasure list (step S71), and acquires the security countermeasure ID, instance, security countermeasure, and importance of the selected line. (Step S72).

  The answer totaling unit 7 additionally writes additional information including the new ID, instance, security countermeasure, and importance that cites the extracted security countermeasure ID in the format of the generation target level evaluation result table (step S73). The initial definition value of the ID is “1”, and is updated by incrementing by 1 every time new information for additional writing is generated.

  The answer totaling unit 7 extracts, from the questions on the answer list, a question including both the instance of the row selected from the security countermeasure list and the security countermeasure in the process of step S71 together with the question template ID and the answer associated with the answer list ( Step S74).

  When the security countermeasure list is the configuration shown in FIG. 6 and the question template list is the configuration shown in FIG. 7 and the selected row of the security countermeasure list is the top row, among the questions on the answer list, Questions including both the instance “personal information input screen” of the selected row and the security measure “subject authentication”, that is, questions for four rows are extracted from the top row of the answer list.

The answer totaling unit 7 acquires the question template ID of the information whose answer is “◯” among the information extracted from the answer list (step S75).
Then, the answer counting unit 7 totals the contribution definition values corresponding to the acquired question template ID on the question template list for each evaluation axis (step S76), and calculates the total value as the final contribution value. Is added to the corresponding line on the format of the level evaluation result table (step S77).

  When the answer list has the configuration shown in FIG. 12 and the question template list has the configuration shown in FIG. 7, the question template IDs acquired from the answer list are “1”, “2”, “3” for the top four lines. ”,“ 4 ”, and among these IDs, the question template IDs for which the answer is“ ◯ ”are“ 1 ”,“ 3 ”, and“ 4 ”in the first, third, and fourth lines. Therefore, among the evaluation axes related to the contribution, the total contribution of the comprehensiveness is 1, the total contribution of the security property A is 0, the total contribution of the property B is 1, and the property C The sum of contributions of 1 is 1, and the sum of contributions of property D is 0.4.

  If the next line exists in the security countermeasure list (YES in step S78), the answer counting unit 7 selects this line (step S79) and returns to the process in step S72.

  If the next line does not exist in the security countermeasure list (NO in step S78), the answer counting unit 7 ends the generation of the level evaluation result table, and the level evaluation result storage unit 17 To remember.

  FIG. 14 is a table showing an example of a level evaluation result table generated by the security level evaluation apparatus according to the embodiment of the present invention. The level evaluation result table shown in FIG. 14 is generated by combining the security countermeasure list shown in FIG. 6, the question template list shown in FIG. 7, and the answer list shown in FIG.

  In this level evaluation result table, how much each security measure in each instance contributes to completeness and security is defined by the importance defined in the security measure list and the contribution defined in the question template list. It is expressed by the contribution calculated using the value.

Further, the answer counting unit 7 calculates the security level of coverage and security based on the level evaluation result table (steps S30 and S31).
Here, details of the calculation process of the security level of completeness will be described. FIG. 15 is a flowchart illustrating an example of a security level calculation process for completeness by the security level evaluation apparatus according to the embodiment of the present invention.
FIG. 16 is a flowchart illustrating an example of security level calculation processing by the security level evaluation apparatus according to the embodiment of the present invention.
First, the answer totaling unit 7 calculates the maximum contribution of completeness by adding the importance of each row on the level evaluation result table (step S81).

  Then, the answer counting unit 7 calculates the product of the importance value and the coverage contribution value for each row on the level evaluation result table, and sums the calculation results of each row to sum up the coverage contribution. Is obtained (step S82).

  The total contribution is a value obtained by summing up the contribution calculated by the response counting unit 7 based on the result of the evaluator's response for each evaluation axis, for each completeness, or for each security. The maximum contribution is This is a value obtained by summing up the contribution when the contents of the question are satisfied with respect to all the questions for each evaluation axis, for each completeness, or for each security.

  The answer counting unit 7 calculates the security level of the comprehensiveness by calculating the ratio of the total contribution of comprehensiveness to the maximum contribution of comprehensiveness, and stores the obtained result in the security level result storage unit 18 (step S83).

  When the level evaluation result table has the configuration shown in FIG. 14, the maximum contribution level is “31” and the total contribution level is “25”, so the security level of completeness is about 81%.

Next, details of security level calculation processing will be described. FIG. 16 is a flowchart showing an example of security level calculation processing by the security level evaluation apparatus according to the embodiment of the present invention.
First, the answer counting unit 7 starts a loop for selecting an evaluation axis related to security on the level evaluation result table (step S91). Here, “property A” is selected first, and thereafter “property B”, “property C”, and “property D” are selected in order.

The response totaling unit 7 acquires the total contribution degree of the comprehensiveness calculated as described above, and sets the total contribution degree as the maximum contribution degree of each evaluation axis (step S92).
For each row in the level evaluation result table, the response counting unit 7 calculates the product of the definition value of the importance and security contribution of the same row, and sums the results to obtain the security performance of each evaluation axis. Is calculated (step S93), and the processing proceeds to the next evaluation axis (step S934).

  When the level evaluation result table has the configuration shown in 14, the total contribution of “property A” that is the first evaluation axis of the security level is “20”, and “property B” that is the second evaluation axis. The total contribution is “25”, the total contribution of “property C” as the third evaluation axis is “20”, and the total contribution of “property D” as the fourth evaluation axis is “21”. Become.

When the processing of steps S92 and S93 is performed for each evaluation axis, the answer totaling unit 7 totals the maximum contributions of each evaluation axis to obtain the maximum contribution of security (step S95).
Furthermore, the answer totaling unit 7 totals the contributions of each evaluation axis to obtain the security contribution total (step S96).

  Then, the answer totaling unit 7 calculates the ratio of the total security contribution to the maximum security contribution, thereby obtaining the security level of the security and storing the obtained result in the security level result storage unit 18. (Step S97).

  When the level evaluation result table has the configuration shown in 14, the maximum security contribution that is the sum of the maximum contributions of each evaluation axis is “100”, and the sum of the contributions of each evaluation axis is “86”. Therefore, the security level of security is 86%.

FIG. 17 is a diagram showing an example of a security level calculation result of coverage and security by the security level evaluation apparatus according to the embodiment of the present invention in a table format.
In the example shown in FIG. 17, the security level is calculated by calculating the total contribution and the maximum contribution for each of the completeness and security from the information of the level evaluation result table shown in FIG. It is.

  The answer totaling unit 7 presents the generated level evaluation result table and the security level of coverage and security to the evaluator by displaying them on the display device 9 (step S32).

FIG. 18 is a diagram showing an example of a radar chart of completeness generated by the security level evaluation apparatus according to the embodiment of the present invention.
FIG. 19 is a diagram showing an example of a security radar chart generated by the security level evaluation apparatus according to the embodiment of the present invention.
FIG. 18 is a table in which contributions with respect to comprehensiveness are tabulated for each security measure in the level evaluation result table shown in FIG. 16, and a ratio to the maximum contribution with respect to the security measure is represented by a radar chart. FIG. 19 shows the level evaluation result table shown in FIG. 16, in which contributions regarding security are tabulated for each evaluation axis, and the ratio of the evaluation axis to the maximum contribution is represented by a radar chart.
By using a graph such as a radar chart, the evaluator can more intuitively grasp the security level and the portion of the security level evaluation target device that lacks security measures.

  As described above, in the security level evaluation apparatus according to the embodiment of the present invention, the question template list including a template of questions to the evaluator is displayed together with the definition values of the comprehensiveness of security measures and the contribution degree of security for each question. Create a question list based on this question template list and security countermeasure list in advance, and define the contribution value on the answer list, security countermeasure list, and question template list to which the answers of the question list are added. Based on the above, calculate the security level of completeness and security. Therefore, it is possible not only to evaluate whether security measures are deployed in an appropriate balance, but to more accurately evaluate whether individual security measures are properly realized.

  In this security level evaluation apparatus, since a basic model is defined in advance and a security countermeasure list is generated based on the basic model and the instance list, it is easy for the evaluator to generate the security countermeasure list itself. Therefore, the accuracy of security level evaluation for systems and device configurations that are not familiar to the evaluator is improved.

  Examples of the security level evaluation target device include a Web application, a client server system, and an information system in which these are combined. Moreover, it is not restricted to only an information system, For example, it is good also considering an object other than information systems, such as a server room and a corporate organization.

  Further, the evaluator may be one person or a plurality of persons, or may be an agent that behaves like a person in the security level evaluation of the security level evaluation target device. Further, the method of defining the importance in the basic model is not limited in the present embodiment, and may be defined by a numerical value from 0 to 1, for example.

Further, the components of the basic model may be not only functional configurations but also hardware or the like. Further, an instance of the instance list may define not only a screen but also, for example, a device and a function.
Further, the method of defining the contribution in the question template list is not limited in the present embodiment, and for example, numerical values may be designated in 10 levels from 0 to 10.

  In addition, the method for determining whether the evaluator satisfies the question content is not limited in the present embodiment, for example, by actually operating the security level evaluation target device and determining the security level evaluation target device. For example, judging by looking at manuals and specifications.

  As for the expression method of the security level, not only the expression using the percentage as shown in FIG. 17, but also other expression methods such as expression with a five-level evaluation using a threshold value may be used.

  In addition, the information storage method in each storage unit is not limited in the present embodiment, and information other than information specified in each storage unit may be included. For example, by assigning an ID to each list, a plurality of evaluators can use the security level evaluation apparatus at the same time.

  The present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. Various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, some components may be omitted from all the components shown in the embodiment. Furthermore, you may combine suitably the component covering different embodiment.

The block diagram which shows the outline | summary of the system configuration | structure of the security level evaluation apparatus according to embodiment of this invention. The figure which shows an example of the basic model memorize | stored in the memory | storage device of the security level evaluation apparatus according to embodiment of this invention in a table format. The figure which shows an example of the instance list memorize | stored in the memory | storage device of the security level evaluation apparatus according to embodiment of this invention by a table format. The sequence diagram which shows an example of the processing operation of the security level evaluation apparatus according to embodiment of this invention. The flowchart which shows an example of the production | generation process of the security countermeasure list | wrist by the security level evaluation apparatus according to embodiment of this invention. The figure which shows an example of the security countermeasure list | wrist produced | generated by the security level evaluation apparatus according to embodiment of this invention in a table format. The figure which shows an example of the question template list | wrist memorize | stored in the memory | storage device of the security level evaluation apparatus according to embodiment of this invention in a table format. The 1st flowchart which shows an example of the production | generation process of the question list | wrist by the security level evaluation apparatus according to embodiment of this invention. The 2nd flowchart which shows an example of the production | generation process of the question list | wrist by the security level evaluation apparatus according to embodiment of this invention. The figure which shows an example of the intermediate data for the question list production | generation by the security level evaluation apparatus according to embodiment of this invention in a table format. The figure which shows an example of the question list produced | generated by the security level evaluation apparatus according to embodiment of this invention in a table format. The figure which shows an example of the reply list produced | generated by the security level evaluation apparatus according to embodiment of this invention in a table format. The flowchart which shows an example of the production | generation process of the level evaluation result table by the security level evaluation apparatus according to embodiment of this invention. The figure which shows an example of the level evaluation result table produced | generated by the security level evaluation apparatus according to embodiment of this invention in a table format. The flowchart which shows an example of the calculation process of the security level of the comprehensiveness by the security level evaluation apparatus according to embodiment of this invention. The flowchart which shows an example of the security level calculation process of the security property by the security level evaluation apparatus according to embodiment of this invention. The figure which shows an example of the calculation result of the security level of the coverage and security by the security level evaluation apparatus according to embodiment of this invention in a table format. The figure which shows an example of the radar chart of the completeness produced | generated by the security level evaluation apparatus according to embodiment of this invention. The figure which shows an example of the radar chart of the security property produced | generated by the security level evaluation apparatus according to embodiment of this invention.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Basic model selection part, 2 ... Storage device, 3 ... Instance input part, 4 ... Security countermeasure list generation part, 5 ... Question list generation part, 6 ... Answer input part, 7 ... Answer totaling part, 8 ... Input device, DESCRIPTION OF SYMBOLS 9 ... Display apparatus, 10 ... Bus, 11 ... Basic model memory | storage part, 12 ... Instance list memory | storage part, 13 ... Security countermeasure list memory | storage part, 14 ... Question template list memory | storage part, 15 ... Question list memory | storage part, 16 ... Answer list Storage unit, 17 ... level evaluation result storage unit, 18 ... security level result storage unit.

Claims (4)

An acquisition means for acquiring security countermeasure information in which each evaluation element of the security level evaluation target device and each security countermeasure item to be realized for the evaluation element are associated;
A definition value of the degree of contribution of the coverage of the implementation of each security countermeasure item for each evaluation element of the security level evaluation target device and a template of the question items used for the security level evaluation of the security level evaluation target device and the security Template storage means for storing template information associated with definition values of security contributions indicating effectiveness when countermeasures are realized;
A question used for evaluating the security level of the security level evaluation target device by reflecting the evaluation element and the security countermeasure item associated in the security countermeasure information acquired by the acquiring unit in the template of the question item of the template information. A question list generation means for generating a question list which is a list of matters;
An answer input means for accepting an input of an answer to each question item in the question list generated by the question list generating means;
About the combination of each evaluation element in the security countermeasure information and the security countermeasure item associated with the evaluation element, the template on the template information used for generating the question item including the combination in the question list On the other hand, the comprehensiveness of the security countermeasure items of the above combination based on the definition value of the contribution level of comprehensiveness, the defined value of the contribution level of security, and the input result of the answer to the questionnaire, which are associated with the template information. A security level evaluation apparatus comprising level evaluation information generation means for generating security level evaluation information of the security level evaluation target apparatus by calculating a contribution level to the security level and a contribution level to security. Basic model storage means for storing a basic model associating a component of a model of a security level evaluation target device, a security countermeasure matter to be realized for the component,
An evaluation element input means for receiving an input of an evaluation element of the security evaluation target device corresponding to a component of the basic model;
Security countermeasure list generating means for generating the security countermeasure list by replacing components in the basic model with the input evaluation elements;
A definition value of the degree of contribution of the coverage of the implementation of each security countermeasure item for each evaluation element of the security level evaluation target device and a template of the question items used for the security level evaluation of the security level evaluation target device and the security Template storage means for storing template information associated with definition values of security contributions indicating effectiveness when countermeasures are realized;
By reflecting the evaluation elements and the security countermeasure items associated in the security countermeasure information generated by the security countermeasure list generating means in the template of the question items of the template information, it is possible to evaluate the security level of the security level evaluation target device. A question list generating means for generating a question list which is a list of questions to be used;
An answer input means for accepting an input of an answer to each question item in the question list generated by the question list generating means;
About the combination of each evaluation element in the security countermeasure information and the security countermeasure item associated with the evaluation element, the template on the template information used for generating the question item including the combination in the question list Coverage of the security measures for the combination based on the definition value of the contribution level of comprehensiveness, the definition value of the contribution level of security, and the input result of the answer to the question. Security level evaluation apparatus comprising level evaluation information generation means for generating security level evaluation information of the security level evaluation target apparatus by calculating a contribution to security and a contribution to security . The security level evaluation apparatus according to claim 1, wherein the definition value of the security contribution degree in the template information is defined for each of a plurality of properties of the security subordinate concept. In the template of the questions to be used for the security level evaluation of the security level evaluation target device, the definition value of the contribution degree of completeness of the implementation of each security countermeasure item to be realized for each evaluation element of the security level evaluation target device, and A computer comprising template storage means for storing template information that associates definition values of security contributions indicating effectiveness when the security countermeasure items are realized,
Acquisition means for acquiring security measure information in which each evaluation element of the security level evaluation target device and each security measure item for the evaluation element are associated;
A question used for evaluating the security level of the security level evaluation target device by reflecting the evaluation element and the security countermeasure item associated in the security countermeasure information acquired by the acquiring unit in the template of the question item of the template information. A question list generating means for generating a question list which is a list of matters,
Answer input means for accepting input of an answer to each question item in the question list generated by the question list generation means, and each security element in the security countermeasure information and a combination of the security countermeasure items associated with the evaluation element, The definition value of the contribution level of comprehensiveness associated with the template information on the template information used for generating the question items including the combination in the question list, the contribution level of security The security level evaluation target device by calculating the contribution to the comprehensiveness and the contribution to the security of the security countermeasure items of the combination based on the input value of the definition value and the answer to the question The security level evaluation information of A computer-readable security level evaluation program configured to function as level evaluation information generation means.

Images