JP2005063339A - System, method and program for supporting security audit - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a system, method and program which supports security audit and reduces the labor thereof. <P>SOLUTION: An audited person inputs audit evidence information from an audited person terminal 102. An audit implementing means 108 of an audit server 101 arbitrarily extracts an audited person from a personnel management DB212 on the basis of an audit plan A215, and prepares an audit plan B216. An auditor prepares an audit result notice 219 and an audit report 220 by using an audit terminal 103, and an audit department prepares an audit item slip 209, confirms the audit plan and summarizes the audit report 220 by using an audit department terminal 104. A manager confirms the audit result notice 219 by using a manager terminal 105. The audited person collects audit evidence by an audio evidence collection device 106. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a security audit support system, a security audit support method, and a security audit support program, and more particularly to a security audit support system, a security audit support method, and a security audit support program that reduce the security audit effort.

  Conventionally, maintaining and improving information security levels requires repeated implementation of information security management processes such as formulation, introduction, operation, evaluation, and review of information security policies that are unified and written as an organization. Information security standards are required to be maintained and improved throughout the organization, and some violations of the rules lower the level of the entire organization and cause threats. Education is effective in maintaining and improving the security level of the entire organization, but even if the required level of education is reached and the desired level of knowledge is reached, the information security policy is not always observed. . Auditing is effective in confirming the status of compliance with the information security policy, and the target must be the entire organization.

  In order to audit the entire organization, it is necessary to reduce the labor required for the audit. Audit preparation work and summary work have been conventionally automated using tools and the like.

  In addition, a method has been proposed in which an audit is performed without an interview between the auditing side and the auditee side using a network. (For example, Patent Document 1)

JP 2002-373245 A

  The problem with the conventional technology is that the labor required for auditing is not sufficiently reduced, and it is difficult to audit an entire large-scale organization.

  The reason is that it is an indispensable work in the audit, and consideration is not given to the reduction of the labor required for the audit evidence collection and confirmation work, which is one of the work that requires a lot of work.

  The object of the present invention is to use an audit evidence collection device equipped with an image (video, still image) collection function, a GPS (Global Positioning System) function, etc., and collect audit evidence confirmation information while auditing audit evidence. Security that facilitates security audits for the entire large-scale organization by reducing the labor required to collect and confirm audit evidence by collecting information by the individual and checking and displaying multiple audit evidences at the same time. It is to realize an audit support system.

  The first security audit support system of the present invention creates an audit plan based on the audit evidence information input to the auditee, stores it in the database of the storage device, and arbitrarily sets the required items according to the audit plan. And an audit server including the audit execution unit that selects and instructs the auditee to collect audit evidence via the network.

  The second security audit support system of the present invention acquires the audit evidence collection location and audit evidence collection time as audit evidence confirmation information via the network of the storage device by the GPS function of the audit evidence collection device, and stores it in the database device. It has an audit server provided with an audit execution means for storing and an audit evaluation means for displaying confirmation information of the database.

  The third security audit support system of the present invention includes the identification information of the auditee collected by the audit evidence collection device, the image of the audit evidence storage location, the name of the audit evidence, the date information of the audit evidence, and the approval of the audit evidence. An audit execution means for receiving a mark, an execution status of the security management process, or a continuous image of the implementation status of the security management process via a network, and storing the image in a database of the storage device, and identification of an auditee in the database Information, image of audit evidence storage location, audit evidence name, audit evidence date information, audit evidence approval mark, security management process implementation status, or continuous image of security management process implementation status It has an audit server provided with an audit evaluation means.

  A fourth security audit support system according to the present invention includes an audit item slip, a database, an audit preparation means for creating a first audit plan, and a database arbitrarily selected from the database based on the first audit plan. Auditing means for extracting an inspector, creating a second audit plan, sending the second audit plan, and performing an audit evaluation means for extracting the audited organization and extracting the auditee The server, the auditee terminal that receives the second audit plan and inputs the audit evidence information by the auditee's operation, the audit evidence is displayed by the auditor's operation, the audit result notification, the audit report Auditor terminal that creates the audit report, audit item terminal that creates audit item sheets, displays the audit plan, and summarizes the audit report by operating the audit department staff, and audit result notification by the administrator Display An administrator terminal, an audit evidence collection device that collects audit evidence by an operation of the auditee, the audit server, the auditee terminal, the auditor terminal, the audit department terminal, the manager terminal, the audit evidence And a network to which the collection device is connected.

  According to a first security audit support method of the present invention, the audit server creates an audit plan based on the audit evidence information input to the auditee and stores it in the database of the storage device, according to the audit plan. And optionally selecting required items and instructing the auditee to collect audit evidence via the network.

  In the second security audit support method of the present invention, the audit server acquires the audit evidence collection location and the audit evidence collection time as audit evidence confirmation information via the network of the storage device by the GPS function of the audit evidence collection device. And storing in the database device and displaying confirmation information of the database.

  In the third security audit support method of the present invention, the audit server collects the auditee identification information collected by the audit evidence collection device, the image of the audit evidence storage location, the name of the audit evidence, the audit evidence date information, Receiving an approval mark of audit evidence, a security management process implementation status, or a continuous image of the security management process implementation status over a network and storing it in a database of a storage device; Display identification information, audit evidence storage location, audit evidence name, audit evidence date information, audit evidence approval seal, security management process implementation status, or continuous image of security management process implementation status And the step of performing.

  According to a fourth security audit support method of the present invention, the audit server creates an audit item slip, a database, and a first audit plan in a storage device, based on the first audit plan. The auditee is arbitrarily extracted from the database, the second audit plan is created, the second step of transmitting the second audit plan, and the audited organization is extracted, and the auditor is extracted. The third step, the fourth step in which the auditee terminal receives the second audit plan and inputs the audit evidence information by the auditee operation, and the auditor terminal operates by the auditor The audit step displays the audit evidence, the fifth step of creating the audit result notice and audit report, and the audit department terminal creates the audit item sheet, displays the audit plan, and audits by the operation of the audit department personnel The steps to compile the report and Administrator terminal, a step for displaying the audit results notice by the operation of the administrator audit evidence gathering device, characterized in that it comprises a step of collecting audit evidence by the operation of the auditor, the.

  A first security audit support program according to the present invention includes a step of creating an audit plan based on audit evidence information input to an auditee and storing the audit plan in a database of a storage device, and a request item according to the audit plan. A step of arbitrarily selecting and instructing the auditee to collect audit evidence via the network.

  The second security audit support program of the present invention acquires the audit evidence collection location and the audit evidence collection time as audit evidence confirmation information via the network of the storage device by the GPS function of the audit evidence collection device, and stores it in the database device. The step of storing and the step of displaying the confirmation information of the database are executed by a computer.

  The third security audit support program according to the present invention includes the identification information of the auditee collected by the audit evidence collection device, the image of the audit evidence storage location, the name of the audit evidence, the date information of the audit evidence, and the approval of the audit evidence. Receiving a continuous image of the mark, the security management process implementation status, or the security management process implementation status via the network and storing them in the database of the storage device, the auditee identification information in the database, and auditing Displaying a continuous image of evidence storage location, audit evidence name, audit evidence date information, audit evidence approval mark, security management process implementation status, or security management process implementation status; Is executed by a computer.

  A fourth security audit support program according to the present invention includes: a first step of creating an audit item slip, a database, and a first audit plan in a storage device; and optionally from the database based on the first audit plan. A second step of extracting an auditee, creating a second audit plan, transmitting the second audit plan, and a third step of extracting an auditee and extracting an auditor And the fourth step of receiving the second audit plan and inputting audit evidence information by the auditee's operation, displaying the audit evidence by the auditor's operation, the audit result notice, the audit report The fifth step of creating audits, the creation of audit item slips by operation of audit department personnel, the display of audit plans, the summary of audit reports, and the display of audit result notifications by administrator operations Steps to do , Characterized in that to execute the steps of collecting audit evidence by the operation of the auditor, to the computer.

  The first effect is that the labor for collecting audit evidence can be reduced.

  The reason is that the auditee himself / herself collects audit evidence.

  The second effect is that the labor required for checking the audit evidence can be reduced.

  The reason is that multiple audit evidences can be confirmed simultaneously.

  The third effect is that it is possible to prevent forgery of audit evidence and prevent auditees from sharing their mouths.

  The reason is that collection of audit evidence is performed in an arbitrary order instructed by the security audit support system.

  The fourth effect is that audit evidence can be collected and confirmed even when the audit evidence can be confirmed in various dates and places. The reason is based on the day of the week, time zone, and location that the auditee has previously declared, and the security audit support system specifies the date, time, and location of audit evidence collection, and the auditee audits based on the instructions. This is to collect evidence.

  A fifth effect is that auditing of the entire large-scale organization can be easily performed.

  The reason is that it is an indispensable work in the audit, and it is possible to reduce the labor required for collecting and confirming the audit evidence, which is one of the work that requires a lot of work.

  The sixth effect is that the security level of the entire organization can be improved and maintained.

  The reason is that the auditing effect on the whole organization and the auditee collecting the audit evidence by itself can exert the check effect to prevent the action against the internal control.

  Next, the first best mode of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a block diagram showing the configuration of the first best mode of the present invention.

  Referring to FIG. 1, a security audit support system according to the best mode of the present invention includes an audit preparation unit 107, an audit execution unit 108, an audit evaluation unit 109, an audit server 101 including a storage device 300, and an audit target. An auditee terminal 102 on which an auditor inputs audit evidence information, and an auditor terminal 103 on which an auditor confirms audit evidence and creates an audit result notification 219 (described later) and an audit report 220 (described later); The audit department terminal 104 for creating the audit item slip 209 (described later), confirming the audit plan, summarizing the audit report 220 (described later), and the audit result notification sheet 219 (described later) by the administrator. An administrator terminal 105 for confirming the audit, an audit evidence collecting apparatus 106 for the auditee to collect audit evidence, an audit server 101, an auditee terminal 102, an auditor terminal 103, an audit department terminal 04, the administrator terminal 105, and, and a network 110 which connects the audit evidence collection apparatus 106 to each other. Further, a part of the space between the audit evidence collecting apparatus 106 and the network 110 may be a wireless network 111.

  The audit server 101 is a server type computer including a main memory, a central processing unit, a hard disk device, a display device, and an input / output device. The audit server 101 has an OS (Operating System), a WEB server 201 (world wide WEB) having an encryption function, an access / operation history acquisition function, and a personal authentication function, and an encryption function and a communication record acquisition function. And an e-mail server 202. The audit server 101 includes an audit preparation unit 107, an audit execution unit 108, and an audit evaluation unit 109. The audit server 101 manages data used by the audit preparation unit 107, the audit execution unit 108, and the audit evaluation unit 109. It has a function to exclude access other than that permitted.

  The auditee terminal 102 is a personal computer having a main memory, a central processing unit, a hard disk device, a display device, and an input / output device, and an OS and a WEB browser 203 (described later) having an encryption function and a personal authentication function. And an e-mail client 204 (described later) having an encryption function, and can input audit evidence information.

  The inspector terminal 103 is a personal computer having a main memory, a central processing unit, a hard disk device, a display device, and an input / output device, and includes an OS, a WEB browser 203 (described later) having an encryption function and a personal authentication function, It has an e-mail client 204 (described later) having an encryption function, and can confirm audit evidence and create an audit result notification sheet 219 (described later) and an audit report 220 (described later).

  The audit department terminal 104 is a personal computer having a main memory, a central processing unit, a hard disk device, a display device, and an input / output device, and includes an OS, a WEB browser 203 (described later) having an encryption function and a personal authentication function, It has an e-mail client 204 (described later) having an encryption function, and can create an audit item slip 209 (described later), confirm an audit plan, and summarize an audit report 220 (described later).

  The administrator terminal 105 is a personal computer having a main memory, a central processing unit, a hard disk device, a display device, and an input / output device, and includes an OS, a WEB browser 203 (described later) having an encryption function and a personal authentication function, It has an e-mail client 204 (described later) having an encryption function, and can check an audit result notification sheet 219 (described later).

  The audit evidence collection device 106 is a portable (portable) terminal, and has a WEB browser 203 (described later) having an encryption function and a personal authentication function, and an e-mail client 204 (described later) having an encryption function. , A function of collecting audit evidence (moving image), and a function of sending the collected audit evidence to the audit server 101.

  Furthermore, the audit server 101 can acquire the audit evidence collection location and the audit evidence collection time by the GPS function.

  The storage device 300 includes a hardware disk, a memory, and the like, and stores various databases and the like.

  FIG. 2 is a block diagram showing details of the audit server 101, the auditor terminal 103, the audit department terminal 104, the administrator terminal 105, the auditee terminal 102, and the audit evidence collection apparatus 106.

  Referring to FIG. 2, the storage device 300 of the audit server 101 includes an audit item slip 209, an information asset management DB 210 (database; Data Base), an internal auditor management DB 211, a human resource management DB 212, a location management DB 213, an audit record management DB 214, An audit plan A215, an audit plan B216, an audit plan C217, an audit plan D218, an audit result notification 219, and an audit report 220 are stored.

  The auditor terminal 103, the audit department terminal 104, the administrator terminal 105, the auditee terminal 102, and the audit evidence collection device 106 include a WEB browser 203 and an e-mail client 204.

  FIG. 3 is a flowchart showing the operation of the audit preparation unit 107.

  Referring to FIG. 3, a member of the audit department uses an audit preparation means 107 (for example, including a database software function for creating a database based on input data), and an audit item slip 209 (requirements, information Information such as asset attributes and title attributes), information asset management DB 210 (name, information asset attributes, etc.), internal auditor management DB 211 (name, organization name, etc.), human resource management DB 212 (name, organization name, title, management) Use information asset name, authentication information, etc.) and location management DB 213 (address, organization name, building name, floor name, room name) are created (step S01 in FIG. 3).

  The personnel in the audit department may use a database of another system (not shown).

  Next, the audit preparation means 107 is based on information such as the total number of organizations, the number of internal auditors, the number of audit evidence collection devices 106, etc., and the audit plan A215 (the number of concurrent audits performed, the audit record confirmation cycle, etc.) Create The audit preparation means 107 displays a data input screen and creates an audit plan document A215 in a predetermined format based on data input on the screen by the operator. Furthermore, the personnel of the audit department confirms and adjusts the audit plan document A215 displayed by the audit preparation means 107 (step S02).

  Next, the operation of the audit execution unit 108 will be described with reference to the drawings.

  FIG. 4 is a flowchart showing the operation of the audit execution unit 108.

  Referring to FIG. 4, the audit execution means 108 arbitrarily extracts a person to be audited from the human resource management DB 212 based on the audit plan A215, and the audit plan B216 (audit overview, audit period A (execution of steps S12 to S13). Period), audit period B (execution period of steps S14 to S15), audit period C (execution period of steps S16 to S18)), and the audit plan for the auditee terminal 102 of the auditee extracted Document B216 is notified (for example, sent by e-mail) (step S11 in FIG. 4).

  Next, the auditee receives the audit plan B216 and connects to the audit server 101 (accesses to the WEB server 201) from the auditee terminal 102. The audit execution unit 108 extracts the management / use information asset name from the human resource management DB 212 using the name of the auditee as a key, and extracts the information asset attribute from the information asset management DB 210 using the extracted management / use information asset name as a key. . Next, the audit execution means 108 compares the extracted information asset attribute with the information asset attribute of the audit item slip 209, extracts all the requirements of the matching audit item slip 209, and together with the name of the auditee, Stored in the audit record management DB 214 (name, requirement). Further, the audit execution means 108 extracts the title from the personnel management DB 212 using the name of the auditee as a key, compares the extracted title with the title attribute of the audit item slip 209, and requests the matching audit item slip 209. All items are extracted and stored in the audit record management DB 214 (name, organization name, requirements) along with the name and organization name of the auditee. Subsequently, the audit execution means 108 extracts the requirements of the audit record management DB 214 one by one for the auditee using the name of the auditee as a key, and confirms the compliance status of the extracted requirements (for example, Display a confirmation screen).

  The auditee answers (affirms / denies) the compliance status of the requirement (for example, inputs the response on the confirmation screen), and the audit execution means 108 sets the response of the compliance status of the requirement to audit evidence information. Is stored in the audit record management DB 214 (compliance with requirements). Further, the audit execution means 108 provides the auditee with the audit evidence type for the requirements of the audit document management DB 214 (document, electronic file, security management process execution status (image showing a static state), security management. Process implementation status (image showing action)), audit evidence shooting availability, audit evidence shooting days (Monday to Friday, multiple selection possible) / time zone (am, afternoon, night, multiple selection possible), audit evidence Check the shooting location (building name, floor name, room name), and the reason for audit evidence shooting not possible.

  The auditee inputs input information including the type of audit evidence, whether or not audit evidence can be taken, the day / time of the audit evidence can be taken, the location where the audit evidence is taken, and the reason that the audit evidence cannot be taken to the audit execution means 108. .

  The audit execution unit 108 uses the input information as the audit evidence information in the audit record management DB 214 (audit evidence information (type of audit evidence, whether audit evidence can be taken, day and time of audit evidence photography, time zone, audit evidence shooting location, audit evidence (Reason when photographing is not possible))) (step S12).

  FIG. 6 is an explanatory diagram showing a screen displayed in step S12 by the audit execution unit 108. As shown in FIG.

  Referring to FIG. 6, questions and answer options are displayed on the screen.

  Next, the audit execution means 108 extracts all audit evidence shooting locations where audit evidence shooting is possible or not from the audit evidence information in the audit record management DB 214 using the name of the auditee as a key, and a list of audit evidence shooting locations ( An audit plan C217 (audit period B, list of audit evidence shooting locations) is created together with the audit period B of the audit plan A215, and notified to the auditee (sent by e-mail). (Step S13).

  When the number of audit evidence shooting locations exceeds a predetermined number, a predetermined number of audit evidence shooting locations are arbitrarily selected from all the extracted audit evidence shooting locations.

  Next, the auditee receives the notification of the audit plan C217 and connects to the audit server 101 (accesses to the WEB server 201) from the auditee terminal 102. The audit execution means 108 requests the auditee to select the date and time zone where the auditee is located at the audit evidence shooting location indicated by the audit plan C217 during the audit period B indicated by the audit plan C217. (For example, display on the screen).

  The auditee selects the date and time zone in which the auditee is located at the audit evidence shooting location during the audit period B, and the audit execution means 108 audits the selection result together with the audit period C of the audit plan A215. The plan is stored as a plan D218 (list of audit period C, audit evidence shooting location and audit evidence shooting date / time zone group) (step S14).

  The audit execution unit 108 repeats step S14 until the list of audit evidence shooting locations indicated by the audit plan C217 is completed.

  Next, the audit execution means 108 notifies the auditee of the audit plan D218 (sends by e-mail) (step S15). Next, the audit execution unit 108 extracts the organization name from the personnel management DB 212 using the person name of the auditee as a key, and extracts the building name, floor name, and room name from the location management DB 2134 using the extracted organization name as a key. And output as the destination information of the audit evidence collection device 106. The personnel in the audit department sends the audit evidence collection device 106 to the address included in the destination information of the audit evidence collection device 106.

  Next, the audit execution unit 108 notifies the auditee of the start of audit (sent by e-mail) via the audit evidence collection device 106 on the audit evidence shooting date / time indicated by the audit plan D218. The auditee sends the auditee's own authentication information (fingerprint, face image, etc.) to the audit server 101 via the audit evidence collection device 106 (send by e-mail). The audit execution unit 108 compares the authentication information (fingerprint, face image, etc.) of the auditee acquired via the audit evidence collection device 106 with the authentication information of the human resource management DB 212 and performs personal authentication of the auditee. (Step S16).

  Next, the audit execution unit 108 selects one matching request item from the audit record management DB 214 by using the name of the auditee, the audit evidence shooting location indicated by the audit plan D218, and the audit evidence shooting date / time zone as a key. Each of these is extracted, and the auditee is instructed to collect audit evidence of the extracted requirement items (sent by e-mail) (step S17). If the number of matching request items exceeds a predetermined number, a predetermined number of request items are arbitrarily selected from the matching request items. The audit execution means 108 acquires the audit evidence collection location and the audit evidence collection time by the GPS function of the audit evidence collection device 106, and obtains the audit record management DB 214 (audit evidence confirmation information (audit evidence collection location, audit evidence collection location, audit evidence collection). Time)).

  Next, the auditee collects audit evidence of the requested item by the audit evidence collection device 106. Auditee, when audit evidence type is document or electronic media, auditee's identification information (face image, etc.), audit evidence storage location image, audit evidence name, audit evidence date information, Audit evidence approval marks are continuously photographed and transmitted as audit evidence to the audit server 101 (sent by e-mail). When the audit evidence type is the security management process implementation status (image showing a static state) or the security management process implementation status (image showing an action), the auditee's identification information ( The image of the face, etc.), the image of the audit evidence confirmation location, and the image of the implementation status of the security management process are continuously taken and sent as audit evidence to the audit server 101 (sent by e-mail). The audit execution unit 108 stores the received audit evidence in the audit record management DB 214 (audit evidence) (step S18).

  The audit execution unit 108 compares the current date and time with the audit period C indicated in the audit plan D218. If the current date and time does not exceed the audit period C, the audit execution unit 108 repeats step S16 to step S18, and the current date and time is audited. When the audit period C shown in the plan D218 is exceeded, the auditee is notified of the end of audit evidence collection (sent by e-mail). The auditee returns the audit evidence collection device 106 to the audit department. The audit execution unit 108 performs steps S11 to S18 in parallel for the number of concurrent audits performed in the audit plan A215.

  Next, the operation of the audit evaluation unit 109 will be described with reference to the drawings.

  FIG. 5 is a flowchart showing the operation of the audit evaluation unit 109.

  The audit evaluation unit 109 performs the following steps S21 to S27 in FIG. 5 for each audit record confirmation cycle of the audit plan A215.

  The audit evaluation unit 109 extracts all the names from the audit record management DB 214, extracts the organization name from the personnel management DB 212 using the extracted name as a key, calculates the number of audit records collected for each organization unit, Organizations exceeding the number of employees are extracted as audited organizations.

  Further, the audit evaluation unit 109 arbitrarily extracts a plurality of auditors whose audited organizations and belonging organizations do not match from the internal auditor management DB 211, and sets them as auditors of the audited organizations. The audit evaluation unit 109 notifies the auditor of the confirmation request of the audit paper management DB 214 (sent by electronic mail) (step S21 in FIG. 5).

  Next, the auditor receives a confirmation request from the audit paper management DB 214 and connects to the audit server 101 (accesses to the WEB server 201) from the auditor terminal 103. The audit evaluation means 109 uses the organization name of the audited organization that the auditor is in charge of auditing as a key from the audit record management DB 214, the name, organization name, requirements, compliance with requirements, audit evidence information, audit evidence confirmation information The audit evidence is extracted, the names are rearranged using the keys, and are sequentially displayed on the display device of the auditor terminal 103 as an audit record confirmation screen.

  Further, the audit evaluation unit 109 displays the data (each item in the DB) of the audit record management DB 214 of a plurality of persons in the audited organization in parallel on the display device of the auditor terminal 103 in response to a request from the auditor. Further, the audit evaluation unit 109 displays the data of a plurality of audit paper management DBs 214 of the same person in parallel on the display device of the auditor terminal 103 as an audit paper confirmation screen in response to a request from the auditor. Further, the audit evaluation unit 109 changes the reproduction speed of the audit evidence (moving image) in response to a request from the auditor. The auditor confirms the data in the audit document management DB 214 and creates an audit result notification sheet 219 (points to be pointed out and requested items) in a format in which the confirmation result is input to the audit result notification sheet template displayed by the audit evaluation unit 109. . The audit evaluation unit 109 stores the audit result notification 219 in the audit server 101 (step S22).

  FIG. 7 is an explanatory diagram showing an audit paper confirmation screen displayed by the auditor terminal 103 in step 22 in FIG.

  Referring to FIG. 7, an audit paper confirmation screen and an audit result notification document template are displayed on the display device of the auditor terminal 103.

  Next, the audit evaluation unit 109 notifies (sends by e-mail) a confirmation request for the audit result notification 219 to the administrator of the audited organization (hereinafter referred to as an administrator) (step S23).

  Next, the administrator receives a request for confirmation of the audit result notification 219, and connects to the audit server 101 (accesses to the WEB server 201) from the administrator terminal 105. The audit evaluation unit 109 displays an audit result notice 219. The administrator confirms the audit result notification sheet 219 and enters the confirmation result (answer to the pointed item and the requested item) in the confirmation result entry column of the audit result notification sheet 219. The audit evaluation unit 109 stores the audit result notification 219 in which the confirmation result is entered (step S24).

  Next, the audit evaluation unit 109 notifies (sends by e-mail) a request to create the audit report 220 to the auditor (step S25).

  Next, the auditor receives a request to create the audit report 220 and connects to the audit server 101 (accesses to the WEB server 201) from the auditor terminal 103. The audit evaluation unit 109 displays an audit result notification 219 in which the confirmation result is entered. The auditor creates the audit report 220 in a format that is input to the template displayed by the audit evaluation unit 109. The audit evaluation unit 109 stores the audit report 220 in the audit server 101 (step S26).

  Next, the staff of the audit department regularly compiles the audit report 220 using the audit evaluation means 109, and after giving approval within the department, reports to the authorized person (step S27).

  The security audit support system described above can operate by executing a program held in the main memory of the audit server 101. This program is normally stored in a secondary storage such as a hard disk, and can be loaded and executed in each main memory when the security audit support system is operated.

  Next, the second best mode of the present invention will be described in detail with reference to the drawings.

  The second best mode of the present invention is a method including the steps of FIGS.

  Next, the third best mode of the present invention will be described in detail with reference to the drawings.

  The third best mode of the present invention is a program for causing a computer to execute the steps of FIGS.

It is a block diagram which shows the structure of the 1st best form of this invention. It is a block diagram which shows the detail of an audit server, an auditor terminal, an audit department terminal, an administrator terminal, an auditee terminal, and an audit evidence collection device. It is a flowchart which shows operation | movement of an audit preparation means. It is a flowchart which shows operation | movement of an audit implementation means. It is a flowchart which shows operation | movement of an audit evaluation means. It is explanatory drawing which shows the screen displayed by an audit implementation means. It is explanatory drawing which shows the audit paper confirmation screen displayed by the auditor terminal 103. FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 101 Audit server 102 Auditee terminal 103 Auditor terminal 104 Audit department terminal 105 Administrator terminal 106 Audit evidence collection apparatus 107 Audit preparation means 108 Audit execution means 109 Audit evaluation means 110 Network 111 Wireless network 201 WEB server 202 E-mail server 203 WEB browser 204 E-mail client 209 Audit item vote 210 Information asset management DB
211 Internal Auditor Management DB
212 Human Resource Management DB
213 Location Management DB
214 Audit record management DB
215 Audit Plan A
216 Audit Plan B
217 Audit Plan C
218 Audit Plan D
219 Audit Result Notification 220 Audit Report

Claims (12)

Based on the audit evidence information input to the auditee, an audit plan is created, stored in the database of the storage device, the required items are arbitrarily selected according to the audit plan, and the auditee is notified via the network. A security audit support system comprising an audit server comprising the audit execution means for instructing collection of audit evidence. Audit execution means for acquiring the audit evidence collection location and audit evidence collection time as audit evidence confirmation information via the network of the storage device by the GPS function of the audit evidence collection device, and storing it in the database device, and confirmation of the database A security audit support system comprising an audit server comprising audit evaluation means for displaying information. Auditee identification information collected by the audit evidence collection device, audit evidence storage location image, audit evidence name, audit evidence date information, audit evidence approval mark, security management process implementation status, or security Audit execution means for receiving continuous images of the execution status of management processes via a network and storing them in a database of a storage device, and identification information of auditees in the database, images of storage locations of audit evidence, audit evidence And an audit server having an audit evaluation means for displaying a continuous image of the name of the audit evidence, the audit evidence approval mark, the security management process implementation status, or the security management process implementation status Security audit support system. Audit item slips in the storage device, database, audit preparation means for creating a first audit plan, auditees are arbitrarily extracted from the database based on the first audit plan, and a second audit plan An audit execution means for transmitting the second audit plan, and an audit server provided with an audit evaluation means for extracting an auditee and extracting an auditor;
An auditee terminal that receives the second audit plan and inputs audit evidence information by an operation of the auditee;
An auditor terminal that displays audit evidence by the operation of the auditor and creates an audit result notice and audit report;
An audit department terminal that creates audit item slips, displays audit plans, and summarizes audit reports by operating the audit department personnel;
An administrator terminal that displays the audit result notice by the administrator's operation,
An audit evidence collection device for collecting audit evidence by the operation of the auditee;
A network connecting the audit server, the auditee terminal, the auditor terminal, the audit department terminal, the manager terminal, the audit evidence collection device;
A security audit support system characterized by comprising: The audit server creates an audit plan based on the audit evidence information input to the auditee and stores it in the database of the storage device. According to the audit plan, the request server arbitrarily selects the requested items and transmits them via the network. And instructing the auditee to collect audit evidence. The audit server acquires the audit evidence collection location and the audit evidence collection time via the network of the storage device as the audit evidence confirmation information by the GPS function of the audit evidence collection device, and stores it in the database device; A security audit support method comprising: displaying confirmation information. Audit server identification information collected by the audit evidence collector, audit evidence storage location image, audit evidence name, audit evidence date information, audit evidence approval mark, security management process implementation status Or receiving a continuous image of the implementation status of the security management process via the network and storing it in a database of the storage device; identification information of the auditee in the database; an image of a storage location of audit evidence; an audit A security audit characterized in that it includes a step of displaying a name of evidence, audit evidence date information, an audit evidence approval mark, a security management process implementation status, or a continuous image of the security management process implementation status. Support method. An audit server first extracts an audit item slip, a database, and a first audit plan in a storage device, extracts an auditee arbitrarily from the database based on the first audit plan, A second step of creating a second audit plan and transmitting the second audit plan; and a third step of extracting an audited organization and extracting an auditor;
A fourth step in which the auditee terminal receives the second audit plan and inputs audit evidence information by an operation of the auditee;
A fifth step in which the auditor terminal displays the audit evidence by the operation of the auditor, and creates an audit result notice and an audit report;
The audit department terminal creates audit item slips, displays the audit plan, and summarizes the audit report by operating the audit department personnel.
A step in which the administrator terminal displays an audit result notification by an operation of the administrator;
An audit evidence collecting device collecting audit evidence by the operation of the auditee;
A security audit support method comprising: Based on the audit evidence information input to the auditee, a step of creating an audit plan and storing it in the database of the storage device, and arbitrarily selecting required items according to the audit plan, and the auditee via the network A security audit support program that causes a computer to execute a step of instructing a computer to collect audit evidence. The audit evidence collection device's GPS function acquires the audit evidence collection location and audit evidence collection time as audit evidence confirmation information via the storage device network and stores it in the database device, and displays the database confirmation information A security audit support program that causes a computer to execute Auditee identification information collected by the audit evidence collection device, audit evidence storage location image, audit evidence name, audit evidence date information, audit evidence approval mark, security management process implementation status, or security Receiving a continuous image of the implementation status of the management process via the network and storing it in the database of the storage device; identification information of the auditee in the database; an image of the audit evidence storage location; the name of the audit evidence; A security audit characterized by causing a computer to execute audit evidence date information, an audit evidence approval mark, a security management process implementation status, or a step of displaying a continuous image of the security management process implementation status. Support program. A first step of creating an audit item slip, a database, and a first audit plan in the storage device, a person to be audited is arbitrarily extracted from the database based on the first audit plan, and a second audit plan A second step of creating a certificate and transmitting the second audit plan, and a third step of extracting an audited organization and extracting an auditor;
A fourth step of receiving the second audit plan and inputting audit evidence information by an operation of the auditee;
A fifth step of displaying audit evidence by the operation of the auditor, creating an audit result notice and an audit report,
The steps of creating audit item slips, displaying the audit plan, and summarizing the audit report by operating the personnel of the audit department,
The step of displaying the audit result notice by the operation of the administrator;
Collecting audit evidence through auditee operations;
A security audit support program characterized by causing a computer to execute.

Images