JP2004185455A - Method for supporting audit on information security policy and device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To perform a security audit based on an information security policy without highly specialized knowledge, and to realize the improvement of security level based on the audit result. <P>SOLUTION: In this system, a security audit system for the audit on compliance status of the information security policy is provided with a database 134 for storing the information security policy designated on a procedure level; a database 133 for associating the information security policy with a security log generation program necessary for an audit thereon; and a database 137 in which a condition for presenting an improvement plan for measures for security based on the security log and phrases of the improvement plan are described. On the basis of logs collected by regularly starting up the security log generation program on information equipment of audit object, an audit report generation program 140 probes into the measures for security to be improved, and outputs an improvement plan for the measures for security. <P>COPYRIGHT: (C)2004,JPO&NCIPI

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention relates to a technology for grasping the state of compliance with an information security policy applied to an information device connected to a network and supporting improvement of the information security policy.
[0002]
[Prior art]
In recent years, in security measures for corporate information systems, security management has been implemented by implementing operational management of corporate information systems based on information security policies and regularly improving information security policies based on the results of security audits. There is a need to continuously improve the level.
[0003]
As a conventional tool that supports operation management based on the information security policy, a set of security measures designated by the operator and its reference values for Web servers, DNS servers, routers, firewalls, etc. connected to the network, That is, there is a security audit tool that audits the compliance status of an information security policy specified at a procedure level and outputs an audit report including a found violation and a proposal for correcting the violation (for example, see Non-Patent Document 1). .
[0004]
By using such a security audit tool, the security administrator can grasp the status of compliance with the information security policy of the information device to be audited from the audit report output from the tool, and corrective actions included in the audit report By implementing, the operation management based on the information security policy can be realized.
[0005]
[Non-patent document 1]
"Special Feature 1: Protect Yourself from Unauthorized Access", Nikkei Byte, Nikkei BP, May 22, 2000, No. 204, p. 90-95
[0006]
[Problems to be solved by the invention]
As described above, the security audit tool based on the conventional technology has a mechanism for presenting a proposal for correcting a violation of the information security policy, but based on the results of the security audit, the information security policy itself, which serves as a criterion for auditing, is used. There is no mechanism for presenting improvement plans.
[0007]
For this reason, the work of improving the information security policy necessary for the continuous improvement of the security level of corporate information systems can only be performed if there is no security administrator who has advanced expertise in information security policies and security systems. This is not possible, and implementation is time-consuming and costly.
[0008]
[Means for Solving the Problems]
The present invention makes it possible to continuously improve the security level of an enterprise information system without a high level of specialized knowledge.
[0009]
The present invention uses an electronic computer to audit compliance with an information security policy applied to an information device and, based on the result, present an information security policy audit support that presents an improvement plan at the procedure level of the information security policy. Implement a method and apparatus. This method is achieved by using the following means.
[0010]
This system is
(1) a database for storing an information security policy which is a set of security measures designated by an operator and their reference values;
(2) a database that associates security measures with a security log generation program that generates a security log necessary for auditing the compliance status;
(3) A database that describes the conditions for judging that a violation of security measures has occurred based on the security log and the details of the violation to be included in the audit report and the text of the proposed corrections if the violation has occurred. ,
(4) A policy improvement plan that describes the conditions for judging that the standard value of the security measure should be improved based on the security log and the wording of the improvement plan to be included in the audit report when the conditions are satisfied Database and
(5) Start the security log generation program periodically on the information device to be audited, collect the generated security logs,
(6) Based on security logs collected within a certain period of time, discover violations of security measures, present the details of the violations found and suggestions for corrections, and propose improvement measures for security measure standards. I do.
[0011]
According to the above-described means, it is possible to easily perform a security audit based on an information security policy for an information device and an improvement of a standard value of a security measure applied to the information device, that is, an information security policy at a procedure level. .
[0012]
As described above, according to the information security policy audit support method of the present invention, the operator simply specifies the information security policy applied to the audited information device, and Audit compliance with policies. Further, the information security policy is improved at the procedure level by changing the reference value according to the improvement plan of the reference value of the security measure presented by the present system, thereby improving the security level.
[0013]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[0014]
FIG. 3 is a schematic diagram of an information security policy audit support system to which the embodiment of the present invention is applied. In the system, an information security policy audit support device 31 and a web server 32 to be audited are connected via a network 33. When an information security policy is input, the system audits the compliance status and outputs an improvement plan of the information security policy based on the audit result.
[0015]
FIG. 1 is a schematic configuration diagram of the information security policy audit support device 31. The information security policy audit support device 31 includes a CPU 11, a memory 12, an external storage device 13 such as a hard disk device, a communication device 14 connected to a network, an input device 15 such as a keyboard and a mouse, and a display such as a display. It can be constructed on a computer provided with a device 16, a reading device 17 for reading data from a portable storage medium such as an FD, and an interface 18 for controlling data transmission and reception between the above-described components.
[0016]
Here, the external storage device 13 stores an information security policy setting program 139 and an audit report generation program 140 for constructing the information security policy audit support device 31 on a computer.
[0017]
When the CPU 11 executes the information security policy setting program 139 loaded on the memory 12, the audit target selecting unit 121, the information security policy specifying unit 122, the security measure / security log generation program associating unit 123, and the policy standard The value information input / output unit 124 and the input / output control unit 127 are realized as processes.
[0018]
The audit target selection unit 121 extracts and holds the device information of the Web server to be audited for the information security policy specified by the operator in the database 131 storing the component device information of the system.
[0019]
The information security policy designating unit 122 extracts and holds a security measure and information on whether or not the information security measure has been selected by the operator from a database 132 storing various security measures applicable to the Web server. .
[0020]
The security measure / security log generation program associating unit 123, based on the audit target selection unit 121, includes a security measure database 132, a security log generation program database 133 in which security measures and a security log generation program necessary for the audit are described. For all security measures stored in the security measure database 132, extracting a security log generation program used by the audit target Web server to generate a security log necessary for evaluating the compliance status of the security measures. Do.
[0021]
The measure reference value information input / output unit 124 outputs, for all security measures held in the security measure database 132, reference value information designated by the operator and serving as a criterion for determining whether or not the security measure is being followed. It is extracted from the security policy database 134 and held.
[0022]
The input / output control unit 127 controls the input device 15 and the display device 16 to receive instructions from the operator, and outputs from the audit target selection unit 121, the information security policy specification unit 122, and the measure reference value information input / output unit 124. Is displayed.
[0023]
Further, the CPU 11 executes the audit report generation program 140 loaded on the memory 12, thereby realizing the security measure compliance status evaluation unit 125, the audit report generation unit 126, and the input / output control unit 127 as processes. .
[0024]
The security measure compliance status evaluation unit 125 receives the security log storage database 135 that holds the security log of the audit target Web server from the audit target Web server, and stores the security log database 135 in the external storage device 13. Furthermore, based on the security measures and security logs, the conditions for judging that a violation of the security measures had occurred and the details of the violations to be included in the audit report and the text of the proposed corrections were described if a violation occurred. By searching the received security log in accordance with the judgment conditions held in the policy violation correction plan database 136, a violation of the security measure is found, and the security measure having the violation, the content of the violation, and the correction plan are audited. It is stored in the result database 138.
[0025]
Further, the security measure compliance status evaluation unit 125 describes the conditions for judging that the information security policy should be improved based on the security log and the wording of the improvement plan to be included in the audit report when the conditions are satisfied. By searching the received security log in accordance with the conditions held in the described policy improvement plan database 137, a point to be improved in the information security policy is found, and the wording of the corresponding improvement plan is audited in the audit result database 138. To save.
[0026]
The audit report generation unit 126 searches the audit result database 138 and generates an audit report including the contents of the violation of the security measure, the explanation of the correction plan, and the improvement plan of the information security policy itself.
[0027]
The input / output control unit 127 controls the input device 15 and the display device 16 to receive an instruction from an operator and displays an output from the audit report generation unit 126.
[0028]
FIG. 2 is a schematic configuration diagram of the audit target Web server 32. Here, components having the same functions as those of the information security policy audit support device 31 shown in FIG. 1 are denoted by the same reference numerals.
[0029]
The external storage device 13 of the audit target Web server 32 stores a Web server program 144 running on the audit target Web server 32 and a security log generation program 143 that generates a security log of the audit target Web server 32. . The CPU 11 provides a Web server service by executing the Web server program 144 loaded on the memory 12.
[0030]
When the CPU 11 executes the activation control program 142 loaded on the memory 12, the security log generation program activation control unit 128 is realized as a process.
[0031]
The security log generation program activation control unit 128 receives the information security policy database 134 from the information security policy audit support device 31, stores the information security policy database 134 in the external storage device 13, and stores all the security measures stored in the information security policy database 134. , The security log generation program 143 corresponding to the security measure is activated at a designated activation time interval.
[0032]
The security log generation program 143 forces the audit target Web server 32 to generate operation information necessary for evaluating the compliance status of security measures, and based on the operation information generated here, the information security policy database 134 Is determined based on the reference value of the security measure stored in the security log, and the result is generated as a security log and stored in the security log storage database 135.
[0033]
In addition, the data communication control unit 129 is realized as a process by the CPU 11 executing the communication control program 141 loaded on the memory 12.
[0034]
The data communication control unit 129 always waits for a security log transmission request from the information security policy audit support device 31, and stores the information in the information security policy audit support device 31 and the external storage device 13 upon receiving the security log transmission request. The transmitted security log storage database 135 is transmitted.
[0035]
4 to 9 show configuration examples of a database used in the information security policy audit support device.
[0036]
FIG. 4 shows a database 131 in which component information of the system is stored. In a column 41, an identifier (SYSID) for uniquely identifying a component of the system for managing and auditing the information security policy is described. Column 42 describes the device type (for example, router, server, client, firewall, etc.) of the device described in the SYSID column of the same row. The column 43 describes the type of software (for example, OS, Web, mail, etc.) used in the device described in the SYSID column of the same row, and the column 44 describes the name of the software program used in the column 43. The column 45 is an area for describing whether or not the device indicated by the SYSID in the same row can be selected, and stores the result selected by the operator.
[0037]
FIG. 5 shows a database 132 in which security measures are stored. In column 51, an identifier (POLICYID) for uniquely identifying the security measure is described. In the column 52, a policy type (for example, identification and authentication, an access control function, and the like) of the security policy described in the POLICYID column in the same row is described. The column 53 describes a security measure corresponding to the identifier described in the column 51 of the same row (for example, limiting the terminals that can access the network, and periodically changing the password).
[0038]
FIG. 6 shows a security log generation program database 133 in which a security measure and a security log generation program used in the audit target Web server are described. In a column 61, an identifier (POLICYID) for uniquely identifying the security measure is described. You. The column 62 describes a security log generation program for generating a security log required for evaluating the compliance status of the security measure corresponding to the identifier described in the POLICYID column of the same row. The column 62 further includes a column 621 storing a security log generation program name AUDITID, and a column 622 storing a device (SYSID) capable of generating a security log by the security log generation program.
[0039]
FIG. 7 is an information security policy database 134 in which a reference value serving as a criterion for determining whether or not a security measure is complied with is described. In column 71, an identifier (POLICYID) for uniquely identifying the security measure is described. Is done. In column 72, the security log generation program described in the AUDITID column of the same row is necessary when determining based on the operation information of the audit target Web server 32 in order to determine the content of the security log to be generated. This is an area for writing a basic reference value, and stores a value specified by the operator. The column 72 further includes a column 721 for storing an explanatory note related to the reference value, and a column 722 for storing the content of the reference value input by the operator. The column 73 describes the name of a security log generation program that generates a security log required for evaluating the compliance status of the security measure corresponding to the identifier described in the POLICYID column of the same row. In a column 74, a time interval for starting the security log generation program described in the AUDITID column on the same line, which is input by the operator, is described.
[0040]
FIG. 8 shows a security log storage database 135 for storing the security log generated by the security log generation program. A column 81 describes the security log generation program name AUDITID. The column 82 describes a security log generated by the security log generation program described in the AUDITID column of the same row. The column 82 further includes a column 821 storing the date and time when the security log generation program was activated, and a column 822 storing the contents of the security log generated by the security log generation program.
[0041]
Figure 9 shows the conditions for judging that a violation of the security measure has occurred based on the security measure and the security log, and the contents of the violation to be included in the audit report when the violation has occurred and the text of the correction plan. The described policy violation correction plan database 136 is described, and a column 91 describes an identifier (POLICYID) for uniquely identifying a security measure. In a column 92, a security log generation program for generating a security log necessary for evaluating the compliance status of the security measure described in the column of POLICYID in the same row is described. A column 93 describes conditions for the security measure compliance status evaluation unit 125 to determine that a violation of the security measure described in the POLICYID column of the same row has occurred. This condition is applied to the security log generated by the security log generation program described in the AUDITID column on the same line. In a column 94, when it is determined that a violation of the security measure described in the POLICYID column of the same row has occurred, the content of the violation of the security measure to be included in the audit report and the wording of the correction plan are described. Is done.
[0042]
FIG. 10 is a policy improvement plan database in which conditions for determining that the information security policy should be improved based on the security log and the wording of the improvement plan to be included in the audit report when the conditions are satisfied are described. 137, and a column 1001 describes an identifier (POLICYID) for uniquely identifying a security measure. Column 1002 describes a security log generation program that has generated a security log for checking whether the condition described in column 1003 of the same row is satisfied. A column 1003 describes conditions for presenting a proposal for improving the reference value of the security measure described in the POLICYID column in the same row based on the security log. Column 1004 describes the wording of an improvement proposal to be included in the audit report when the conditions described in column 1003 of the same row are satisfied.
[0043]
FIG. 11 is an audit result database 138 in which the evaluation result of the security measure compliance status by the security measure compliance status evaluation unit 125 is described, and a column 1101 describes (POLICYID) that uniquely identifies the security measure. . A column 1102 describes GOOD when it is determined that a violation of the security measure corresponding to the identifier POLICYID in the same row has not occurred. On the other hand, if it is determined that a violation has occurred, BAD is described. In column 1103, only when it is determined that a violation of the security measure corresponding to the identifier POLICYID in the same row has occurred, the content of the violation of the security measure to be included in the audit report and the text of the correction plan are described. You. Column 1104 describes a proposal for improving the reference value of the security measure corresponding to the identifier POLICYID in the same row.
[0044]
Next, the operation of the security policy audit support device having the above configuration will be described.
[0045]
12 to 18 are operation flows for explaining the operation of the information security policy audit support device.
[0046]
FIG. 12 is an operation flow for describing an outline of the overall processing procedure of the information security policy audit support device 31. In FIG. 12, the entire processing procedure of the device first executes step S1201 for specifying device information and an information security policy on the Web server 32 to be audited by the information security policy audit support device 31, and then executes the security log. The generation program activation control unit 128 periodically activates the security log generation program to generate a security log in step S1202, and when the operator instructs to generate an audit report (step S1203), executes step S1202. The step S1204 of evaluating the compliance status of security measures based on the security log generated by the step S1204 and the step S1205 of generating an audit report based on the evaluation result are executed in parallel. Hereinafter, the processing operation of each step will be described.
[0047]
Step S1201 is realized by an operation flow as shown in FIG.
[0048]
First, the audit target selection unit 121 uses the input / output control unit 127 to include, on the display device 16, the contents of the database 131 in which the component device information of the system recorded in the external storage device 13 is stored. A screen for selecting an information security policy audit target as shown in (1) is displayed (step S1301).
[0049]
In FIG. 19, the items “apparatus type” 1901, “software type” 1902, and “program name” 1903 correspond to columns 42 to 44 of the database 131 in which component information of the corresponding system is stored. The operator selects a Web server to be audited, and a button of an item “auditability” 1904 can select whether or not to be audited. When the "policy designation" button 1905 is pressed, the selection result is reflected in the contents of the "selection availability" column of the database 131.
[0050]
When the operator selects a Web server to be audited by the information security policy via a screen as shown in FIG. 19 and then presses a “designate policy” button 1905 (step S1302), security Based on the result selected in steps S1301 to S1302, the measure / security log generation program associating unit 123 reads a security log generation program database 133 in which a security measure and a security log generation program used in the audit target Web server are described. By using an operation flow as shown in FIG. 14, for all security measures stored in the column 61, a security log generation program used in the audit target Web server is extracted. (Step S1303).
[0051]
The extraction flow of the security log generation program used in the audit target Web server as shown in FIG. 14 is performed in the security log generation program database 133 in which the security measures and the security log generation program used in the audit target Web server are described. First, one POLICYID is extracted from the column 61 “POLICYID” (step S1401), and the search of the Web server selected in step S1302 is performed by searching the column 622 “SYSID” of the row having the same identifier as the extracted identifier (POLICYID). This is performed using the presence or absence of the corresponding identifier (SYSID) (step S1402), and the name of the security log generation program described in the AUDITID column 621 of the line where the corresponding SYSID exists is set. In the information security policy database 134, described as the contents of field 73 of AUDITID lines present the same identifier as POLICYID extracted in step S1401 (step S1403). By performing the operations of steps S1401 to S1403 for all the POLICYIDs described in the column 61 “POLICYID” (step S1404), the extraction is performed.
[0052]
When the extraction of the security log generation program to be used in the audit target Web server is completed, the measure standard value information input / output unit 124 displays a screen for inputting the security measure standard value as shown in FIG. (Step S1304).
[0053]
In FIG. 20, items “measure type” 2001 and “security measure” 2002 correspond to columns 52 and 53 of the database 132 in which the corresponding information security policy is stored, and are stored in the security policy database 132. All security measures that are in use are displayed. The operator can select one security measure item using the items “measure type” 2001 and “security measure” 2002. When a security measure item is selected, the measure reference value information input / output unit 124 searches the column 71 “POLICYID” of the information security policy database 134 based on the identifier (POLICYID) corresponding to the selected security measure item. Identify the line in which the same identifier as the identifier corresponding to the selected security measure item is described. Hereinafter, the row specified here is referred to as a row L1. At this time, the content of the column 721 “explanatory text” in the row L1 is displayed in the item “reference value” 2003. The operator inputs a reference value as a criterion for determining whether or not the security measure is complied with in the input field 2004, and further uses the item “audit log generation time interval” 2005 to start the security log generation program. When the interval is selected and the button “OK” 2006 is pressed, the policy reference value information input / output unit 124 saves the content input in the input column 2004 as the content of the column 722 “reference value” in the row L1. Then, the content selected in the item “audit log generation time interval” 2005 is stored as the content of the column 74 “security log generation program activation time interval” in the row L1.
[0054]
Now, when reference values of all security measures stored in the security measure database 132 are inputted by the operator via a screen as shown in FIG. 20 (step S1305), measure reference value information is inputted. The output unit 124 transmits the information security policy database 134 to the audit target Web server 32 via the communication control program 141 (Step S1306).
[0055]
Step S1201 is realized by sequentially executing steps S1301 to S1306.
[0056]
Next, step S1202 is realized by an operation flow as shown in FIG.
[0057]
First, the security log generation program activation control unit 128 receives the information security policy database 134 from the information security policy audit support device 31 and stores it in the external storage device 13 (step S1501).
[0058]
Subsequently, the security log generation program activation control unit 128 searches the information security policy database 134 for the column 71 and extracts one identifier (POLICYID) for uniquely identifying a security measure. Hereinafter, the line in which the extracted identifier POLICYID exists is referred to as a line L2. Next, the security log generation program activation control unit 128 extracts the security log generation program name described in the AUDITID column of the row L2 (step S1502).
[0059]
Further, the security log generation program activation control unit 128 extracts the activation time interval described in the “security log generation program activation time interval” column of the row L2 in the information security policy database 134 (step S1503).
[0060]
Next, if the security log generation program extracted in step S1502 has not been activated for a time equal to or longer than the activation time interval extracted in step S1503, the security log generation program activation control unit 128 executes the security log generation program. It starts (steps S1504 to S1505).
[0061]
The operations in steps S1502 to S1505 are performed for all identifiers recorded in the column 71 of the information security policy database 134 (step S1506).
[0062]
Subsequently, a record indicating which security measure has been taken out is cleared (step S1507).
[0063]
Step S1202 is realized by executing the above steps S1501 to S1507 in order and returning to step S1502 again.
[0064]
FIG. 16 shows an example of the security log generation program, which is necessary for evaluating the compliance status of the measure type “access monitoring” (column 52) and the security measure “implementation of data / program tampering detection” (column 53). 5 is an operation flow of a security log generation program AUDIT_LOG_ # 1 for generating a security log.
[0065]
First, it is checked whether or not the falsification detection program itself is installed and running (step S1601), and then, whether or not the running operation log is stored (step S1602). Furthermore, it is confirmed whether or not the update time interval of the operation operation log is within a period described in the information security policy database 134 as a reference value of the security measure (step S1603). If YES for all items, the audit result is good, and “Executed without a given period” is generated as a security log (step S1604). If not, the audit result is bad, and "Unexecuted for a given period or"
More "is generated (step S1605).
[0066]
Through the operations of steps S1601 to S1605, generation of a security log is realized.
[0067]
Next, in step S1203, it is determined whether an “audit execution” button 1906 has been pressed after the information security policy audit target is selected by the operator on the screen shown in FIG. If the above condition is satisfied, step S1204 is executed.
[0068]
Step S1204 is realized by an operation flow as shown in FIG.
[0069]
First, the security measure compliance status evaluation unit 125 receives the security log storage database 135 from the audit target Web server selected in step S1203, and stores it in the external storage device 13 (step S1701). Subsequently, the security measure compliance status evaluation unit 125 searches the policy improvement plan database 137 for the column 1001, and extracts one identifier (POLICYID) that uniquely identifies the security measure. Hereinafter, the row in which the identifier POLICYID extracted here exists is referred to as row L3. Further, the presentation condition described in the column 1003 of the row L3 is extracted (step S1702). Furthermore, it is determined whether or not the security log generated by the security generation program described in the “AUDITID” column of the row L3 satisfies the presentation condition extracted in step S1702 (step S1703). Step S1704 is executed. If the condition is not satisfied, step S1705 is executed.
[0070]
In step S1704, the policy improvement plan database 137 is searched based on the identifier POLICYID extracted in step S1702, and the policy improvement plan database 137 is described in the “policy improvement plan wording” column on the line where the same identifier as the identifier POLICYID exists. Take out the wording. Further, the wording extracted here is copied to the “policy improvement proposal wording” column of the line in the audit result database 138 where the same identifier as the identifier POLICYID extracted in step S1702 exists.
[0071]
In step S1705, the policy violation correction plan database 136 is searched for the column 91, and a row in which the same identifier as the identifier POLICYID extracted in step S1702 is specified. Hereinafter, the row specified here is referred to as a row L4. Further, the judgment condition described in the column 93 of the row L4 is extracted.
[0072]
Subsequently, for all the security log generation program names described in the AUDITID column of the row L4, the security log storage database 135 is searched based on the security log generation program name, and the security log generation program is generated. The retrieved security log is retrieved, and it is determined whether the retrieved security log matches the determination condition retrieved in step S1705 (step S1706). If the retrieved security log does not meet the determination condition, step S1706 is performed. Step S1707 is executed. On the other hand, if the conditions are met, steps S1708 and S1709 are executed.
[0073]
In step S1707, the column 1101 of the audit result database 138 is searched based on the identifier POLICYID extracted in step S1702, and a line in which the same identifier as the identifier POLICYID is described is specified. Column describes GOOD. On the other hand, in step S1708, based on the identifier POLICYID extracted in step S1702, the column 1101 of the audit result database 138 is searched to identify a row in which the same identifier as the identifier POLICYID is described, and to evaluate the row. Is described as BAD. Further, in step S1709, the line specified in step S1708 is described in the column of "violation content and remediation plan wording", and the policy violation remediation plan database 136 is described in the line L4 of "violation content and remediation plan wording". Copy the wording that is included.
[0074]
The operations in steps S1702 to S1709 are performed for all identifiers recorded in the column 91 of the policy violation correction plan database 136 (step S1710).
[0075]
Step S1204 is realized by executing steps S1701 to S1710 described above.
[0076]
Step S1205 is realized by the operation flow as shown in FIG.
[0077]
First, the audit result database 138 corresponding to the audit target Web server selected in step S1203 is read (step 1801), and one identifier (POLICYID) for uniquely identifying a security measure is extracted (step S1802). Hereinafter, the line in which the extracted identifier POLICYID exists is referred to as a line L5. Subsequently, it is determined whether or not the content of the “evaluation result” column of the row L5 is BAD (step S1803), and if it is BAD, step S1804 is executed. On the other hand, if it is not BAD, step S1805 is executed.
[0078]
In step S1804, the wording described in the column of “wording of violation content and correction plan” in line L5 is added to the audit report.
[0079]
In step S1805, it is determined whether or not the content of the “language of policy improvement proposal” column in row L5 is empty, and if it is empty, step S1806 is executed. On the other hand, if it is not empty, step S1807 is executed.
[0080]
In step S1806, the text described in the column of “text of policy improvement proposal” in row L5 is added to the audit report.
[0081]
The operations in steps S1802 to S1806 are performed on all identifiers recorded in the column 1101 of the audit result database 138 (step S1807).
[0082]
Finally, an audit report is output to the display device 16 (step S1808).
[0083]
21 to 22 show an example of an audit report by the information security policy audit support device 31.
[0084]
FIG. 21 shows an example in which the audit result of the information security policy is displayed using a so-called table in the form of a security measure (column 53) for each measure type (column 52).
[0085]
As a result of the audit, a security measure that has been determined to have violated is displayed as "violated" in the "Compliance Status" column. On the other hand, for a security measure determined not to have violated, “Compliance” is displayed in the “Compliance Status” column. Further, as a result of the audit, a security measure determined to need to improve the reference value is displayed as “Yes” in the “Presence of improvement plan” column. On the other hand, a security measure that is not determined to be improved is displayed as “none” in the “improvement plan existence” column.
[0086]
The operator can select each measure type to be displayed by designating the tag (2101). By selecting the button "detailed information list" 2102, the operator displays a list of detailed information on the compliance status of security measures and improvement plans as shown in FIG.
[0087]
FIG. 22 shows the results of an audit in accordance with the information security policy using a so-called table as a list of security measures that have been determined to have violated and security measures that have been determined to require improved reference values. This shows an example of displaying. In the column of “violation content and correction plan”, the content of column 1103 is displayed. In the column of “policy improvement plan”, the contents of column 1104 are displayed.
[0088]
According to the present embodiment, the following effects can be obtained.
(1) The operator can specify the Web server to be audited and specify the information security policy at the procedure level, and can audit the compliance state of the specified Web server with the information security policy. For this reason, even an administrator who does not have a high level of specialized knowledge can easily perform a security audit based on the information security policy.
(2) The information security policy can be improved by re-establishing the information security policy at the procedure level according to the information obtained as a result of performing the audit. For this reason, even an administrator who does not have a high level of specialized knowledge can easily improve the security level.
[0089]
In the above-described embodiment, the audit target is limited to the Web server. However, other information devices can be audited using the same method.
[0090]
【The invention's effect】
ADVANTAGE OF THE INVENTION According to this invention, it becomes possible to perform a security audit based on an information security policy, or to improve a security level, even without a high level of specialized knowledge.
[Brief description of the drawings]
FIG. 1 is a configuration diagram of an information security policy audit support device.
FIG. 2 is a configuration diagram of a Web server to be audited.
FIG. 3 is a schematic diagram of an information security policy audit support system to which the embodiment is applied;
FIG. 4 is a database structure in which component information of a system is stored.
FIG. 5 is a database structure in which security measures constituting an information security policy are stored.
FIG. 6 is a database structure storing correspondence information between security measures and a security log generation program;
FIG. 7 is a database structure storing a procedure-level information security policy.
FIG. 8 is a database structure in which a security log is stored.
FIG. 9 is a database structure storing policy violation judgment conditions, violation contents, and remediation text.
FIG. 10 is a database structure storing conditions for presenting a policy improvement plan and text of the improvement plan.
FIG. 11 is a database structure for storing audit results.
FIG. 12 is an operation flow of the overall processing procedure of the information security policy audit support device.
FIG. 13 is an operation flow for specifying an audit target and an information security policy.
FIG. 14 is an operation flow of extracting a security log generation program.
FIG. 15 is an operation flow of security log generation.
FIG. 16 shows an example of a security log generation program.
FIG. 17 is an operation flow of security log evaluation.
FIG. 18 is an operation flow of an audit report generation.
FIG. 19 is an information security policy audit target selection screen
FIG. 20 is an input screen for a reference value of a security measure.
FIG. 21 is an information security policy compliance status audit result display screen
FIG. 22 is a screen for displaying an audit result of compliance with the information security policy.
[Explanation of symbols]
11: CPU, 12: memory, 121: audit target selection unit, 122: information security policy designation unit, 123: security measure / security log generation program association unit, 124: measure reference value information input / output unit, 125: security measure compliance Status evaluation unit, 126: audit report generation unit, 127: input / output control unit, 13: external storage device, 131: system component device information database, 132: security measure database, 133: security log generation program database, 134: information Security Policy Database 135: Security Log Storage Database 136: Policy Violation Correction Database 137: Policy Improvement Proposal Database 138: Audit Result Database 138: Information Security Policy setting program 139: audit report generator, 140: a communication control program, 141: communication control program, 14: communication device, 15: input device, 16: display device, 17: reader, 18: interface.

Claims (5)

Storage means for an information security policy, which is a set of security measures and reference values for information devices to be audited connected to the network,
A security log generation program that generates a security log required for auditing the security measure and its compliance status,
Means for storing conditions for determining that the reference value of the security measure should be improved based on the security log,
Means for starting the security log generation program on the information device to be audited,
Means for collecting the generated security log;
Means for finding an improvement in the information security policy based on the security log collected within a certain period of time. The security audit support system according to claim 1, further comprising:
Means for storing conditions for determining that a violation of a security measure has occurred based on the security log;
Means for finding violations of security measures based on the security log. The security audit support system according to claim 1,
Comprising means for storing component device information of the information device to be audited,
Means for searching for and specifying the audit target information device from the component device information storage means, and / or means for searching and specifying a security measure reference value applied to the audit target information device from the information security policy storage means A security audit support system comprising a security audit support device provided with a security audit. The security audit support device according to claim 3,
A security audit support system comprising means for using the security audit support device from a remote location via a network. The security audit support device according to claim 3,
A distributed security audit support system, comprising: means for arranging a security log generation program in the information device to be audited by the security audit support system; and means for collecting the execution result.

Images