JP2017182272A - Information processing apparatus, information processing method and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide an information processing apparatus, an information processing method and a program which allow a countermeasure to be taken for components other than components managed by a prescribed manager, on the basis of an instruction from the manager in order to cope with the security risk of the components managed by the manager.SOLUTION: The information processing apparatus includes: a specifying unit which specifies a second component associated with a countermeasure against a security risk for a first component; an accepting unit which accepts instruction information of a countermeasure for the second component from a manager of the first component; and an execution unit which takes the countermeasure on the basis of the instruction information.SELECTED DRAWING: Figure 2

Description

  The present invention relates to an information processing apparatus, an information processing method, and a program.

  Many systems are composed of multiple components. The constituent elements are, for example, a network device configuring a network and a device connected to the network. A device connected to the network is, for example, a printer or a server. A device connected to a network has security problems against vulnerabilities and threats caused by external cyber attacks. Security problems are also called information security risks or simply security risks. In order to operate the system safely, there is a technique for investigating whether a device having a security risk exists on the network and taking necessary measures. In a system including a network device and a device connected to the network, the administrator of the network device and the administrator of the device connected to the network are often different administrators. In an operation where the device administrator and the network administrator are separated, if a security risk exists in a device and it is necessary to change the network settings as a countermeasure against the security risk, for example, enable a firewall. If there is a need to restrict communication, the administrator of the device with a security risk contacts the administrator of the network device, and the administrator of the network device that receives the notification takes the necessary measures. Become.

  Related art includes the following Patent Documents 1 and 2.

  Patent Document 1 discloses a security risk information providing apparatus that presents information on security risks that occur when a plurality of Web services are linked. The security risk information providing apparatus sets a security policy when using a service provided by the Web service providing apparatus. Whether the service usage status of the user conforms to the security policy using the service usage status information indicating the usage status of the service used by the user and the service linkage information indicating the linkage information between services used by the user. Determine.

  Patent Document 2 discloses a management computer that detects a mismatch between a volume management range on a management computer and a volume management range due to storage division within the storage. When a plurality of volumes are designated as user management targets, the management computer acquires the identifiers of the volume groups to which the designated plurality of volumes belong from the storage. Then, the storage management information that stores the correspondence between the identifier of the volume group and the identifier of the user is referred to, and it is determined whether or not the acquired volume group falls within the management range of the same user.

JP 2013-196422 A JP-A-2005-322102

  It may be necessary to take countermeasures as soon as possible for security risks. However, when the managers of a plurality of components constituting the system are divided as described above, it is urgent to work on other components as a countermeasure to the security risk of one component. There was a problem that no measures could be taken.

  Patent Documents 1 and 2 do not disclose means for solving the problem.

  The objective of this invention is providing the information processing apparatus, the information processing method, and program which solve the above-mentioned subject.

  An information processing apparatus according to the present invention includes: a specifying unit that specifies a second component related to the countermeasure against the security risk related to the first component; and a manager of the first component, and the administrator in the second component. A receiving unit that receives instruction information for handling, and an execution unit that executes handling based on the instruction information.

  The information processing method according to the present invention includes a specific step of identifying a second component related to a countermeasure against a security risk related to the first component, and a countermeasure in the second component from the administrator of the first component. A reception step for receiving the instruction information, and an execution step for executing a countermeasure based on the instruction information.

  The program according to the present invention is a program for specifying a second component related to a security risk countermeasure related to the first component in the computer, and from the administrator of the first component to the second component. A reception process for receiving the instruction information for handling and an execution process for executing the handling based on the instruction information are executed.

  According to the present invention, in order to deal with a security risk of a component managed by a predetermined administrator, based on an instruction from the administrator, a measure in a component other than the component managed by the administrator is executed. An information processing apparatus, an information processing method, and a program can be provided.

It is a figure which shows the structure of the system 1000 concerning 1st Embodiment. It is a figure showing composition of information processor 100 concerning a 1st embodiment. 6 is a diagram for explaining the operation of the information processing apparatus 100. FIG. It is a figure which shows the structure of the system 2000 concerning 2nd Embodiment. It is a figure which shows the structure of the information processing apparatus 110 concerning 2nd Embodiment. It is a figure which shows an example of the information which the storage part 112 stores. 2 is a diagram illustrating a hardware configuration of an information processing apparatus 110. FIG. FIG. 11 is a diagram for explaining the operation of the information processing apparatus 110. It is a figure which shows the structure of the information processing apparatus 120 concerning 3rd Embodiment. It is a figure which shows an example of the notification screen to an administrator. 6 is a diagram for explaining the operation of the information processing apparatus 120. FIG. It is a figure which shows the structure of the information processing apparatus 130 concerning 4th Embodiment. It is a figure which shows an example of the information which the storage part 132 stores. FIG. 11 is a diagram for explaining the operation of the information processing apparatus 130.

[First Embodiment]
[Processing configuration]
FIG. 1 is a diagram illustrating a configuration of a system 1000 according to the first embodiment. The system 1000 includes an information processing apparatus 100, a component 200, and a component 300.

  The component 200 and the component 300 are information technology-based components (configuration items; CI). The component 200 and the component 300 are devices such as a computer, a server, and a printer. In addition, the constituent element 200 and the constituent element 300 may be constituent elements other than devices such as services, software, operating systems, and applications. As an example of the operation in which the administrator is separated, there is an operation in which the administrator of the network device and the administrator of the device connected to the network are different administrators. As another example of the operation in which the administrator is separated, there is an operation in which the website administrator and the server administrator are different administrators. In operations where the website administrator and the server administrator are different administrators, for example, the website administrator is not authorized to set directory permissions, but to deal immediately with the security risks of the website. In addition, the website administrator may need to set permissions for the C drive of the server.

  Here, when the security risk is operated with a vulnerability existing in the component 200, a threat caused by an external attack on the component 200, or a non-secure operation setting (a setting weak against the security risk). Including risks. Countermeasures are measures to eliminate, avoid, or reduce security risks.

  FIG. 2 is a diagram illustrating a configuration of the information processing apparatus 100 according to the first embodiment. The information processing apparatus 100 includes a specifying unit 101, a receiving unit 102, and an execution unit 103.

  The identifying unit 101 identifies a component related to the countermeasure against the security risk related to the component 200. An example of a specifying method by the specifying unit 101 will be described. In the operation in which the administrator of the network device is different from the administrator of the device connected to the network, the component 200 is a device connected to the network (first device), and the component Reference numeral 300 denotes a network device (second device). For example, the identifying unit 101 refers to the communication log of the first device, and identifies the second device having a communication history related to the security risk as the device related to the countermeasure. The identifying unit 101 refers to the system topology information and identifies the second device corresponding to the case where the countermeasure regarding the network of the first device is performed. For example, if the countermeasure for the network is “blocking access to a specific port of the first device from the external terminal”, a firewall device that passes when the first device communicates with the external terminal, or a network having a firewall function The device is specified based on the system topology information, and the specified device is set as the second device. The system topology information is information indicating a network connection relationship between devices, a connection relationship between devices and peripheral devices such as disks, a range of a domain in the network, and the like. The system topology information may be configured so that the specifying unit 101 appropriately refers to or obtains information from an external subsystem as necessary. The external subsystem stores, for example, information including at least a part of the physical and logical configuration of the network and the relationship between the device and the peripheral device by user input, or is discovered by the discovery function and retained. be able to. In the operation in which the website administrator and the server administrator are different administrators, the component 200 is an application and the component 300 is a server. When an attack on the website occurs, the specifying unit 101 specifies a server on which an application related to the website is operated as an apparatus related to the countermeasure against the attack.

  The receiving unit 102 receives instruction information for handling in the component 300 from the administrator of the component 200.

  The execution unit 103 executes a countermeasure based on the instruction information received by the reception unit 102.

[Operation]
FIG. 3 is a flowchart for explaining the operation of the information processing apparatus 100.

  The specifying unit 101 specifies the component 300 related to the countermeasure against the security risk related to the component 200 (step S11). The accepting unit 102 accepts instruction information for handling in the component 300 from the administrator of the component 200 (step S13). The executing unit 103 executes a countermeasure based on the instruction information received by the receiving unit 103 in step S13 (step S15).

[effect]
According to the information processing apparatus 100 of the present embodiment, in order to deal with the security risk of a component managed by a predetermined administrator, a component other than the component managed by the administrator based on an instruction from the administrator. Actions on the component can be performed. As a result, even when the administrators of multiple components that make up the system are separated, it is necessary to work on other components as a countermeasure to the security risk of one component Measures can be taken immediately.

[Second Embodiment]
[Processing configuration]
FIG. 4 is a diagram illustrating a configuration of a system 2000 according to the second embodiment. The system 2000 includes an information processing device 110 and a device 210. The information processing apparatus 110 and the apparatus 210 are connected to the network 310. In the present embodiment, the device 210 corresponds to the component 200 in the first embodiment, and the network 310 corresponds to the component 300 in the first embodiment. The network 310 includes a network device.

  FIG. 5 is a diagram illustrating a configuration of the information processing apparatus 110. The information processing apparatus 110 is an apparatus that manages security risks of the apparatus 210. The information processing apparatus 110 includes an acquisition unit 111, a storage unit 112, a reception unit 113, an analysis unit 114, a determination unit 115, and an execution unit 116.

  The acquisition unit 111 acquires the security risk investigation result of the device 210. The security risk survey is a survey conducted on the basis of information indicating security risks and countermeasures provided from each vendor, for example, and is a survey conducted by a survey unit 212 (described later) of the apparatus 210. Hereinafter, information indicating security risks and countermeasures is also referred to as security risk information. The security risk information may include device vulnerability information provided by each vendor or research organization. The security risk may include information related to the non-secure operation setting of the device. The security risk survey result includes information indicating the device 210 having the security risk, the type of the security risk, and the countermeasure. The acquisition unit 111 may acquire the result of the security risk investigation performed by the apparatus 210 in response to the investigation request from the information processing apparatus 110 from the apparatus 210. In addition, the acquisition unit 111 may acquire the result of a security risk investigation performed by the apparatus 210 in response to an investigation request from an apparatus other than the information processing apparatus 110 or independently. Further, a storage device may be provided in the system 2000 separately from the information processing device 110 and the device 210, and the security risk investigation result in the device 210 may be stored in the storage device. In this case, the acquisition unit 111 acquires the result of the security risk investigation from the storage device.

  The information processing apparatus 110 that has acquired the security risk investigation result can notify the administrator of the apparatus of the security risk investigation result. As a notification method, there are a method of displaying on a display unit (not shown) of the apparatus 210 and a method of sending an e-mail to an administrator.

  The storage unit 112 stores the component-specific countermeasure information 10 in which countermeasures applicable to the security risks included in the investigation result acquired by the acquisition unit 111 are associated with each device 210. Referring to FIG. 6, the component-specific countermeasure information 10 is information in which a security risk investigation identifier (survey ID) 11, a device identifier (device ID) 12, and an applicable countermeasure 13 are associated with each other. Applicable countermeasure 13 refers to a countermeasure that eliminates the security risk when the countermeasure is applied to the device 210 having the security risk. The component-specific countermeasure information 10 is generated by investigating the apparatus 210 based on information (security risk information) indicating, for example, the types of security risks and countermeasures provided from each vendor. In addition, the storage unit 112 stores information 20 in which an administrator identifier (administrator ID) 21 that is an identifier of an administrator of the apparatus 210 is associated with the apparatus ID 22. Referring to FIG. 6, for example, the administrator identified by the administrator ID 11 “user01” can perform operations and information regarding the device 210 identified by the device IDs “A” and “B”. The device ID 12 and the device ID 22 are a manufacturing number, a Media Access Control address, an Internet Protocol (IP) address, or a port number provided in the device 210.

  The accepting unit 113 accepts the instruction information related to the network setting change and the administrator ID 11 from the administrator. The instruction information regarding the network setting change is, for example, instruction information having contents such as “blocking communication from the IP address 123.456.7.8 for the device A” and “closing the port BB of the device B”. The reception unit 113 corresponds to the reception unit 102 of the information processing apparatus 100 according to the first embodiment.

  The analysis unit 114 analyzes the instruction information received by the reception unit 113 and refers to the storage unit 112 to determine whether or not the instruction information includes instruction information related to a countermeasure applicable to the device 210 against the security risk. To do. When the instruction information regarding the network setting change received by the receiving unit 113 includes instruction information that is not applicable in order to deal with the security risk, the administrator of the apparatus 210 is unnecessarily granted the authority regarding the network setting change. This is to prevent it from happening. The processing of the analysis unit 114 will be described in detail with reference to FIG. 6. The applicable countermeasure 13 is searched using the device ID 12 included in the instruction information received by the reception unit 113 as a key, and the searched countermeasure 13 and the reception unit Compared with the countermeasure included in the instruction information received by 113.

  The determination unit 115 refers to the storage unit 112 when the instruction information received by the reception unit 113 includes instruction information related to countermeasures applicable to the device 210 against the security risk. It is determined whether or not the correspondence between the device ID 22 included in the ID and the administrator ID 21 received by the receiving unit 113 is correct.

  The analysis unit 114 and the determination unit 115 correspond to the specifying unit 101 in the information processing apparatus 100 according to the first embodiment.

  As a result of the determination by the determination unit 115, the execution unit 116 accepts the reception unit 113 when the correspondence between the device ID 22 included in the instruction information received by the reception unit 113 and the administrator ID 21 received by the reception unit 113 is correct. Take corrective action based on the corrective action information. Examples of setting changes to the network include blocking the communication from a specific IP address by changing the firewall settings and closing a specific port. The execution unit 116 corresponds to the execution unit 103 in the information processing apparatus 100 according to the first embodiment.

  The device 210 is a client personal computer (hereinafter referred to as a personal computer), a server, a printer, or the like. However, the apparatus 210 is not limited to the example given here. The device 210 includes a communication unit 211 and a survey unit 212.

  The communication unit 211 communicates with an external device (for example, the information processing device 110) via the network 310. The communication unit 211 acquires security risk information provided from each vendor.

  The investigation unit 212 compares the operating system (OS) type of the device 210, the OS version, information on various applications installed in the device 210 with the security risk information acquired by the communication unit 211, and the like. Investigate the device 210 at risk.

  Instead of investigating the security risk by the investigation unit 212, an investigation unit may be provided in the information processing apparatus 110 or another device, and the investigation unit may conduct the investigation. When the investigation unit of the information processing device 110 or another device conducts a security risk investigation, the device 210 transmits information necessary for the investigation to the information processing device 110 or the investigation unit of the other device. The information necessary for the investigation is, for example, an OS running on the apparatus 210 or a product version of an application. The form of transmitting information necessary for the investigation may be a push type or a pull type. For example, when the device 210 is a personal computer, transmission of information necessary for the investigation can be realized by agent software installed in the personal computer. In addition, when the device 210 is a printer or a network device, it is possible to transmit information necessary for the investigation by the Simple Network Management Protocol server.

  The network 310 may be a local area network or a public line network such as the Internet, a telephone line network, or satellite communication.

[Hardware configuration]
FIG. 7 is a diagram illustrating a hardware configuration of the information processing apparatus 110. The information processing apparatus 110 includes a processor 110a, a memory 110b, a storage 110c, an input / output interface (input / output I / F) 110d, and a communication interface (communication I / F) 110e. The processor 110a, the memory 110b, the storage 110c, the input / output interface 110d, and the communication interface 110e are connected by a data transmission path 110f for transmitting / receiving data to / from each other.

  The processor 110a is an arithmetic processing device such as a Central Processing Unit or a Graphics Processing Unit. The processor 110a implements the functions of each processing unit by executing each program stored in the storage 110c described later. Here, when executing each program, the processor 110a may execute these programs after reading them onto a memory 110b described later, or may execute them without reading them onto the memory 110b.

  The memory 110b is a memory such as a random access memory (RAM) or a read only memory (ROM).

  The storage 110c is a storage device such as a hard disk drive, a solid state drive, or a memory card. The storage 110c may be a memory such as a RAM or a ROM. The storage 110c stores programs that realize the functions of the processing units.

  The communication interface 110e transmits / receives data to / from an external device or an external network. The communication interface 110e communicates with an external device or an external network via a wired network or a wireless network, for example. Note that the hardware configuration of the information processing apparatus 110 is not limited to the configuration shown in FIG.

[Operation]
The operation of the information processing apparatus 110 will be described with reference to FIG.

  4 and 8, the acquisition unit 111 acquires the security risk investigation result of the device 210 (step S21). The accepting unit 113 accepts the instruction information related to the network setting change and the administrator ID 11 from the administrator (step S23). When the instruction information and the manager ID 11 are not received from the manager (no in step S23), the information processing apparatus 110 ends the operation. When the instruction information and the administrator ID 11 are received from the administrator (yes in step S23), the analysis unit 114 analyzes the instruction information received by the reception unit 113, refers to the storage unit 112, and the instruction information is It is determined whether or not the instruction information regarding the countermeasure applicable to the device 210 for the security risk is included (step S25).

  As a result of the analysis in step S25, when the instruction information received by the receiving unit 113 does not include instruction information related to countermeasures applicable to the device 210 with respect to the security risk (no in step S25), the information processing apparatus 110 ends the operation. To do. When the instruction information received by the reception unit 113 includes instruction information regarding a countermeasure applicable to the device 210 against the security risk (Yes in step S25), the determination unit 115 refers to the storage unit 112 and receives the reception unit 113. It is determined whether or not the correspondence relationship between the device ID 22 included in the instruction information received by the manager ID 21 and the manager ID 21 received by the receiving unit 113 is correct (step S27).

  As a result of the determination in step S27, when the correspondence between the device ID 22 included in the instruction information received by the receiving unit 113 and the administrator ID 21 received by the receiving unit 113 is correct (yes in step S27), the execution unit 116 Based on the instruction information received by the receiving unit 113, a setting change for the network is executed (step S29). If the correspondence between the device ID 22 included in the instruction information received by the receiving unit 113 and the administrator ID 21 received by the receiving unit 113 is not correct (no in step S27), the information processing device 110 ends the operation.

[effect]
According to the information processing apparatus 110 according to the second embodiment, a configuration managed by the administrator based on an instruction from the administrator in order to deal with a security risk of a component managed by a predetermined administrator. Actions on components other than elements can be executed.

[Third Embodiment]
[Processing configuration]
FIG. 9 is a diagram illustrating a configuration of the information processing apparatus 120 according to the third embodiment. The information processing apparatus 120 includes an acquisition unit 121, a storage unit 122, a reception unit 123, an analysis unit 124, a determination unit 125, and an execution unit 126. The configurations that are not particularly described are the same as those of the information processing apparatus 100 and the information processing apparatus 110 according to the first and second embodiments.

  The acquisition unit 121 acquires the operation information of the device 220 in addition to the security risk investigation result. The operation information is at least one of information (operation history information) indicating a history of operations and processes performed by the device 220 and information (operation schedule information) indicating operations and processes scheduled to be performed in the device 220 from now on. It is information to include. The operation information is generated by the apparatus 220 and stored in the storage unit 122 of the apparatus 220 in response to an execution of a predetermined operation or process in the apparatus 220 or an input of a predetermined operation or process execution schedule.

  The determination unit 125 refers to the storage unit 122 when the instruction information received by the reception unit 123 includes instruction information related to a countermeasure applicable to the device 220 with respect to the security risk. It is determined whether or not the correspondence between the device ID 22 included in the ID and the administrator ID 21 received by the receiving unit 123 is correct. Also, the determination unit 125 calculates a recommended execution time (recommended action time) for dealing with a security risk based on the operation information obtained by the obtaining unit 121. When countermeasures such as changing firewall settings or closing ports are necessary as countermeasures against security risks, the apparatus 220 may need to be restarted in accordance with the execution of these countermeasures. For example, in the case of the apparatus 220 that is restarted every Thursday in the operation information acquired by the acquisition unit 121, countermeasures for security risks are executed in accordance with the timing of the periodic restart, and the countermeasures are executed. Rebooting is efficient.

  The execution unit 126 executes applicable measures at the execution time calculated by the determination unit 125.

  There may be a case where priority is given to addressing the security risk as soon as possible rather than minimizing the downtime of the device 220. In this case, the administrator is notified of the execution time determined based on the operating status (FIG. 10), and the user selects whether to execute the countermeasure immediately or at the recommended countermeasure time calculated based on the operating status. You can also

[Operation]
The operation of the information processing apparatus 120 will be described with reference to FIG.

  The acquisition unit 121 acquires the security risk investigation result of the device 220 (step S31). And the acquisition part 121 acquires the operation information of the apparatus 220 (step S33). The accepting unit 123 accepts the instruction information related to the network setting change and the administrator ID 11 from the administrator (step S35). When the instruction information and the manager ID 11 are not received from the manager (no in step S35), the information processing apparatus 120 ends the operation. When the instruction information and the administrator ID 11 are received from the administrator (yes in step S35), the analysis unit 124 analyzes the instruction information received by the reception unit 123, refers to the storage unit 112, and the instruction information is It is determined whether or not the instruction information regarding the countermeasure applicable to the device 220 is included for the security risk (step S37).

  As a result of the analysis in step S37, when the instruction information received by the receiving unit 123 does not include instruction information related to countermeasures applicable to the device 220 with respect to the security risk (no in step S37), the information processing apparatus 120 ends the operation. To do. When the instruction information received by the reception unit 123 includes instruction information related to a countermeasure applicable to the device 220 with respect to the security risk (yes in step S37), the determination unit 125 refers to the storage unit 122 and receives the reception unit 123. It is determined whether or not the correspondence relationship between the device ID 22 included in the instruction information received by the manager ID 21 and the administrator ID 21 received by the receiving unit 123 is correct (step S39).

  As a result of the determination in step S39, when the correspondence between the device ID 22 included in the instruction information received by the reception unit 123 and the administrator ID 21 received by the reception unit 123 is correct (yes in step S39), the determination unit 125 The recommended handling time is calculated based on the operation information acquired by the acquisition unit 121 in step S33 (step S41). If the correspondence between the device ID 22 included in the instruction information received by the receiving unit 113 and the administrator ID 21 received by the receiving unit 123 is not correct (no in step S39), the information processing device 120 ends the operation.

  When the current time is the recommended handling time calculated in step S41 (yes in step S43), the execution unit 126 executes setting change for the network based on the instruction information received by the reception unit 123 (step S45). .

[Function and effect]
According to the information processing apparatus 120 according to the third embodiment, it is possible to effectively execute countermeasures against security risks in accordance with the operation status of the apparatus 220.

[Fourth Embodiment]
[Processing configuration]
FIG. 12 is a diagram illustrating a configuration of the information processing apparatus 130 according to the fourth embodiment. The information processing apparatus 130 includes an acquisition unit 131, a storage unit 132, a reception unit 133, an analysis unit 134, a determination unit 135, and an execution unit 136. The configurations that are not particularly described are the same as those of the information processing device 100, the information processing device 110, and the information processing device 120 according to the first to third embodiments.

  The storage unit 132 stores information corresponding to the component-specific countermeasure information 10 in the second embodiment. The storage unit 132 stores information corresponding to the information 20 in the second embodiment, that is, information in which the administrator ID 21 and the device ID 22 are associated with each other. FIG. 13 is a diagram illustrating an example of information 30 corresponding to the information 20. In the information 30, a flag (handling completion flag) 34 indicating whether or not the execution of the countermeasure by the execution unit 136 is completed is stored in association with the device ID. In FIG. 13, “1” of the countermeasure completion flag 34 indicates that the execution of the countermeasure has been completed, and “0” indicates that the execution of the countermeasure has not been completed. Instead of the countermeasure completion flag 34, information regarding the progress of countermeasures can be stored, and the progress of countermeasures can be presented to the administrator based on the information.

  The determination unit 135 refers to the storage unit 132 when the reception unit 133 receives the instruction information regarding the network setting change and the administrator ID 11 from the administrator, and whether or not the execution of the countermeasure by the execution unit 136 is completed. Determine whether. If the determination unit 135 determines that the execution of the countermeasure by the execution unit 136 has been completed, the determination unit 135 invalidates the instruction information. Specifically, the determination unit 135 discards the instruction information and notifies the administrator that the execution of the countermeasure has already been completed. The notification includes notification by e-mail transmission and notification by display on a display screen of a device managed by the administrator.

[Operation]
The operation of the information processing apparatus 130 will be described with reference to FIG.

  Steps S51 through S55 are the same as steps S21 through S25 in FIG.

  In FIG. 14, when the instruction information received by the reception unit 133 includes instruction information regarding a countermeasure applicable to the device 230 against the security risk (yes in step S55), the determination unit 135 refers to the storage unit 132, It is determined whether or not the execution of the countermeasure by the execution unit 136 has been completed (step S57). As a result of the determination in step S55, when the execution of the countermeasure by the execution unit 136 is completed (yes in step S57), the information processing apparatus 130 ends the operation. When the execution of the countermeasure by the execution unit 136 has not been completed (No in step S57), the process proceeds to step S59. Step S59 and step S61 are the same as step S27 and step S29 of FIG.

[Function and effect]
According to the information processing apparatus 130 according to the fourth embodiment, even when the reception unit 133 receives instruction information having the same content as the countermeasure required as a result of the security risk investigation, the countermeasure has been completed. In this case, the determination unit 135 discards the instruction information. Therefore, it is possible to prevent duplicated execution of countermeasures, and it is possible to prevent the scope of granting authority regarding network setting changes from being unnecessarily expanded.

  As mentioned above, although embodiment of this invention was described, this invention is not limited to the said embodiment, It cannot be overemphasized that another modification and an application example are included unless it deviates from the meaning of this invention.

10 Countermeasure information by component 11, 31, survey ID
12, 22, 32 Device ID
13, 33 Applicable measures 21 Administrator ID
20, 30 Information 34 Countermeasure completion flag 100, 110, 120, 130 Information processing apparatus 101 Identification unit 102, 113, 123, 133 Reception unit 103, 116, 126, 136 Execution unit 110a Processor 110b Memory 110c Storage 110d Input / output interface 110e Communication interface 110f Data transmission path 111, 121, 131 Acquisition unit 112, 122, 132 Storage unit 114, 124, 134 Analysis unit 115, 125, 135 Determination unit 200, 300 Component 210, 220, 230 Device 310, 320, 330 Network 211 Communication unit 212 Survey unit 1000, 2000 System

Claims (10)

A specifying unit for specifying a second component related to the countermeasure against the security risk related to the first component;
A receiving unit that receives, from the administrator of the first component, the instruction information of the countermeasure in the second component;
An execution unit that executes the countermeasure based on the instruction information;
An information processing apparatus comprising:   The information processing apparatus according to claim 1, wherein the specifying unit specifies the second component based on communication history information of the first component. A storage unit that stores countermeasure information for each component that indicates a countermeasure applicable to each of the first components for the security risk, and
The information processing apparatus according to claim 1, wherein the specifying unit specifies the second component element with reference to the component-specific countermeasure information stored in the storage unit. An acquisition unit for acquiring operation information including operation history information and operation schedule information of the first component;
The execution unit calculates an execution time of a countermeasure applicable to the first component against the security risk based on the operation information acquired by the acquisition unit, and calculates the applicable countermeasure The information processing apparatus according to claim 1, wherein the information processing apparatus is executed at the execution time. A specific step of identifying a second component associated with addressing a security risk associated with the first component;
An accepting step of receiving, from the administrator of the first component, the instruction information for handling in the second component;
An information processing method comprising: an execution step of executing the countermeasure based on the instruction information.   The information processing method according to claim 5, wherein in the specifying step, the second component is specified based on communication history information of the first component.   In the specifying step, the second component is specified with reference to component-specific countermeasure information indicating a countermeasure applicable to the security risk for each first component. The information processing method described. Including an acquisition step of acquiring operation information including operation history information and operation schedule information of the first component;
In the execution step, based on the operation information acquired in the acquisition step, the execution time of a countermeasure applicable to the first component against the security risk is calculated, and the applicable countermeasure is The information processing method according to claim 5, wherein the information processing method is executed at the calculated execution time. Specific processing for identifying a second component related to addressing a security risk associated with the first component in a computer;
An accepting process for accepting the handling instruction information in the second component from the administrator of the first component;
A program for executing an execution process for executing the countermeasure based on the instruction information.   The program according to claim 9, wherein in the specifying process, the second component is specified based on communication history information of the first component.

Images