JP2005234840A - Method for evaluating risk and method for support selection of security management measures and program - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a risk evaluation method for easily associating information property with threat/fragility at the time of grasping threat/fragility and a security management measure selection support method for reducing a time required for the embodiment of security management measures, and for accurately evaluating risk reduction effects by the security management measures. <P>SOLUTION: This risk evaluating method is provided to store information property management information inputted by an operator through an input device 121 or a reading device 123 in an external storage device 127. Then, attribute information relevant to preliminarily stored information property is outputted through an output device 122, and selection by an operator is accepted through an input device 121. Then, information associated with the attribute information selected by the operator is selected from a plurality of preliminarily stored threat/fragility information, and a risk value corresponding to the information property is calculated based on the selected threat/fragility information and the information property management information. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a method and program for performing risk assessment of information assets or supporting selection of security management measures for information assets.

  In today's increasingly information-oriented society, the importance of information assets such as customer information, product / service information, and corporate know-how that organizations have has increased. Retention is essential for maintaining and developing the organization.

  These information assets are always exposed to “threats” and have various “vulnerabilities”. Here, the threat is a factor that violates security, such as loss due to a disaster, crash of an information system, falsification / outflow / loss due to unauthorized access from outside, intentional outside leakage, and the like. Vulnerabilities, on the other hand, are weaknesses that have the potential to generate threats. For example, there are inadequate fire prevention measures, lack of information system maintenance, ease of access from the Internet, inadequate information access management, etc. It corresponds to this.

  Measures that reduce the above-mentioned threats that cause threats and ensure the confidentiality, integrity, and availability of information assets are information security measures. In recent years, information security measures have been changed to information security management systems (ISMS). ) The movement to implement from the viewpoint of) is spreading internationally. The purpose of ISMS is to establish a system that protects information assets from these threats and continuously secures and maintains the confidentiality, integrity, and availability of information.

  The international standard for the information security management system is the BS7799 standard created by BSI (British Standards Institution). This standard consists of two parts. The first part is a guideline that lists basic management measures that should be recommended. The second part specifies specific requirements for the information security management system, conformance standards for authentication purposes, and lists specific management objectives and management measures.

  In Japan, the Japan Information Processing Development Corporation (JIPDEC) has established ISMS certification standards consistent with the BS7799 standard, and JIPDEC-certified certification / registration organizations have reviewed the organization based on ISMS certification standards.・ Authentication is performed.

The general flow up to the establishment of ISMS is as follows.
(Step 1) Understanding information assets subject to ISMS (Step 2) Understanding threats and vulnerabilities to information assets (Step 3) Risk assessment for individual information assets (Step 4) Selecting security management measures to reduce risks (Step 5) Evaluation and acceptance of residual risk after application of selected security control measures (Step 6) Implementation and introduction of selected security control measures

  In step 1, the information assets that the organization should own for ISMS are ascertained. In step 2, threats and vulnerabilities assumed for the information assets grasped in step 1 are extracted, and the relationship between threats and vulnerabilities is further grasped. Step 3 assumes the amount of damage when the security breach occurs due to threats and vulnerabilities identified in Step 2 and the frequency of threats depending on the degree of vulnerability. The risk is estimated by the risk assessment method. In step 4, security management measures are selected to reduce risk. The management policy selected here is often selected from security management policies defined in the BS7799 standard or ISMS authentication standard, and is not so specific as to be actually implemented and installed in the system. Step 5 evaluates whether the residual risk minus the risk reduction due to the implementation of the selected security controls is acceptable. In Step 6, in order to introduce the security management policy selected by performing Step 1 to Step 5 into an actual system, it is necessary to perform a work of selecting a specific method and implementing / introducing it.

  Even after ISMS is established and implemented by the method described above, continuous risk assessment, selection of control measures, and management measures are selected to respond to changes in system configuration and changes / increases in threat types. Review of ISMS by introduction is required.

A technique for performing risk assessment using a computer based on the security policy and the configuration of the current information system has been proposed (see Patent Document 1). The security policy, current status system and information asset data are converted into a data format for risk assessment. The risk assessment program performs risk assessment based on the security policy and the current system. As a result, risk assessment can be automatically executed. Moreover, patent document 1 discloses performing the simulation regarding security, when the management policy of an information system is changed after risk evaluation.
JP 2003-150748 A

  The flow up to the establishment of ISMS described above has the following problems.

  In step 2, it is necessary to extract the threats and vulnerabilities assumed for the information assets grasped in step 1, and to grasp the relationship between the threats and the vulnerabilities. However, the number of information assets grasped in Step 1 is often enormous, and the threats and vulnerabilities associated with these enormous numbers of information assets and the attribute information associated with those information assets There is a problem that it is difficult to extract and perform matching without omission.

  From Step 4 to Step 6, the process from the selection of security control measures to the introduction of security control measures for the actual system is performed. As described above, the control measures selected in Step 4 are actually implemented in the system and introduced. It is not as specific as possible. For example, the content may be “It is desirable to use encryption in order to protect confidentiality of sensitive information that requires careful handling” (quoted from BS7799). In implementing a security management measure of “encrypting”, it is necessary to consider the encryption protocol to be used, the encryption algorithm used in the encryption protocol, the key length used for encryption, the key storage method, and the like. For this reason, in the introduction stage of the security management measure in Step 6, there is a problem that further selection work is required and this selection work takes time.

  Even if a security control measure is selected based on a certain risk reduction level in Step 4, depending on the specific measures determined in Step 6, the risk reduction level assumed in Step 4 may differ, and an accurate risk assessment can be performed. There is no problem.

  Further, Patent Document 1 discloses performing a certain automation for risk evaluation, or performing a security-related simulation when an information system management policy is changed after risk evaluation, but solves the above problem. The method is not disclosed.

  The present invention has been made against the background of the above circumstances, and one object of the present invention is to easily associate information assets with threats / vulnerabilities when grasping threats / vulnerabilities. It is to provide a risk assessment method that can be used. Another object of the present invention is to provide a security management policy selection support method capable of reducing the time required for the implementation of the security management policy and accurately evaluating the risk reduction effect of the security management policy.

  A risk evaluation method according to the present invention is a risk evaluation method for evaluating a risk caused by a threat / vulnerability related to an information asset using an electronic computer, and is a management method for information assets input by an operator via an input means. A first step of storing information asset management information in the information storage means, and a second step of outputting attribute information specifying the attributes of the information asset management information stored in advance via the output means And a third step of accepting selection by the operator from the output attribute information via the input means, and selecting from the plurality of threat / vulnerability information stored in advance in the third step A fourth step of selecting threat / vulnerability information associated with the attribute information, the threat / vulnerability information selected in the fourth step, and the input Based on the information asset management information, and has a fifth step of calculating the risk value for the information assets.

  As a result, when grasping threats / vulnerabilities for information assets, threats / vulnerability items corresponding to the attributes of the input information assets are automatically extracted, and the extraction results are displayed on the output means. Information can be easily associated with threats and vulnerabilities.

  In the above risk evaluation method, the information asset management information includes information asset management information for a plurality of management items of the information asset, and the second step specifies an attribute of the information asset management information for the management item. A plurality of attribute information may be output, and the third step may receive a selection from the output plurality of attribute information.

  In the fifth step, it is preferable to calculate a risk value for the information asset based on the selected threat / vulnerability information and asset value information of the input information asset management information.

  Further, the information asset management information has an asset value that is a sum of values obtained by quantifying relative evaluation assuming the importance of confidentiality, integrity, and availability in the information asset, and the threat / vulnerability information includes: It is preferable that an occurrence frequency prediction value for predicting the occurrence frequency of a threat is included, and in the fifth step, a product of the asset value and the occurrence frequency prediction value is calculated as a risk value. As a result, the risk value can be calculated from the numerical value of the asset value evaluated by the qualitative evaluation method and the numerical value of the occurrence frequency of the threat evaluated by the quantitative evaluation method. The risk value, which is a criterion for judging threats to be attacked, the importance of vulnerabilities, and the effectiveness of security management measures, can be clarified.

  On the other hand, a security management policy selection support method according to the present invention is a security management policy selection support method that supports the determination of a security management policy necessary for information security management using an electronic computer, and is related to information asset management. A first step of storing asset management information and threat / vulnerability information of the information asset in association with each other, and security management related to a security control measure associated with the threat / vulnerability information stored in the first step A second step of selecting measure information from a plurality of pre-stored security control information, and the security control information selected in the second step includes higher security control information and higher security management information. Including a plurality of specific security control information of the policy information, A third step of outputting the security control information via the output means; and a fourth step of accepting an operator's selection via the input means from the plurality of output specific security control information. Is. As a result, since it is possible to select a security management measure that has been embodied to the implementation level, it is possible to reduce the time required for the implementation of the security management measure.

  In the security management policy selection support method described above, a fifth risk value for calculating a reduced risk value for the information asset is calculated based on the risk reduction information included in the specific security management policy information selected in the fourth step. It is desirable to further include steps. As a result, it is possible to evaluate the risk reduction effect and select the management policy using the security management measures that have been implemented up to the implementation level, so that the risk reduction effect by the selected security management measures can be accurately evaluated.

  The fifth step includes calculating a reduced risk value for the information asset by using a risk reduction rate included in the selected specific security control information, and the security control selection support method. Then, the calculated reduced risk value is presented to the operator via the output means as the application effect of the selected specific security control measure, and the acceptance of acceptability of the reduced risk value is accepted via the input means. If the reduced risk value is acceptable in the sixth step and the specific security control selected in the second step is determined as a control measure, and the reduced risk value is not acceptable May further include a seventh step of accepting selection of specific security control information. As a result, it is possible to simultaneously evaluate risk reduction effects and select management measures using security management measures that have been implemented to the implementation level. Implementation is possible.

  Further, in the above-described security management measure selection support method, the information asset management information related to the management of information assets input by the operator via the input means is stored in the information storage means before the first step. A step of outputting attribute information for specifying an attribute of the information asset management information stored in advance through a previous output unit; and a selection by the operator of the output attribute information. A step of accepting via the step, selecting a threat / vulnerability information associated with the selected attribute information from a plurality of threat / vulnerability information stored in advance, and the threat / vulnerability information; And calculating a risk value for the information asset based on the input information asset management information.

  The risk evaluation program according to the present invention includes a first step of storing information asset management information related to management of information assets input by an operator in an information storage means, and an attribute of the information asset management information stored in advance. A second step of outputting attribute information for identifying the output, a third step of accepting selection by the operator of the output attribute information, and a third step from a plurality of threat / vulnerability information stored in advance. A fourth step of selecting the threat / vulnerability information associated with the attribute information selected in the step of step 4, the threat / vulnerability information selected in the fourth step, and the input information asset management information Based on the threat / vulnerability related to the information asset, the computer executes the process of the fifth step of calculating the risk value for the information asset based on the information asset. Risks arising Te is a program to evaluate the.

  The security management measure selection support program according to the present invention stores the information asset management information related to information asset management and the threat / vulnerability information of the information asset in association with each other, and stores the information asset management information in the first step. A second step of selecting the security control information associated with the threat / vulnerability information thus selected from a plurality of pre-stored security control information, and the security control information selected in the second step And a third step of outputting a plurality of specific security control information of the higher security control information and an operation from the output of the plurality of specific security control information A fourth step of accepting a selection by the user, and the specific sec- tion selected in the fourth step. This is a program that supports the selection of a security control necessary for information security management by causing a computer to execute the process of the fifth step of calculating a reduced risk value for the information asset based on the security control information. .

  The present invention can provide a risk evaluation method capable of easily associating information assets with threats / vulnerabilities when grasping threats / vulnerabilities. Furthermore, according to the present invention, it is possible to provide a security management policy selection support method and apparatus capable of reducing the time required for the implementation of the security management policy and accurately evaluating the risk reduction effect of the security management policy.

Embodiment 1 of the Invention
FIG. 1 is a configuration diagram of a risk assessment and security management measure selection support device according to the first exemplary embodiment of the present invention. A typical computer system can be used for the risk assessment and security management policy selection support apparatus 100 according to the present embodiment. As shown in the figure, the security management policy selection support apparatus 100 has inputs such as a keyboard and a mouse. A device 121, an output device 122 such as a monitor and a printer, a reading device 123 such as a CD-ROM drive, and an input / output interface 124 for controlling input / output of these devices are provided. Further, the security management policy selection support device 100 includes a CPU 125 that executes arithmetic processing, and an internal memory 126 and an external storage device 127 that are examples of information storage means. As the external storage device 127, for example, a hard disk device or the like can be used.

  The external storage device 127 includes an information asset management table 140, a management information attribute table 141, a threat / vulnerability table 142, a security management table 143, an asset-specific risk information table 144, a risk assessment and security management policy. A selection support program 145 is stored.

  Here, the information asset management table 140 stores information asset management information that is information related to management of each information asset. The information asset management information includes information on several management items for each information asset. Specifically, for each information asset, each management item such as information asset name, asset type, installation location, network information to which the information asset belongs, information asset management department, user, applicable business process, asset value, etc. Is stored. The information asset management information is input by an operator (not shown) via the input device 121 or the reading device 123 and stored in the memory 126 or the external storage device 127 via the input / output interface 124.

  The management information attribute table 141 stores management information attribute information for specifying attributes of information asset management information of each management item, and threat / vulnerability information. The management information attribute information and the threat / vulnerability information are stored in association with each other. As an example of the management information attribute information, for example, the management information attribute information that can be related to the management item of the installation location includes “location with many power outages”, “location with many earthquakes”, “room with openable window”, etc. . The management information attribute table 141 is registered and saved in the external storage device 127 in advance.

  The threat / vulnerability information table 142 stores threat information and vulnerability information in association with each other. It also stores the characteristics of each threat. Specifically, the name of the threat, the name of the vulnerability related to the threat, the occurrence frequency of the threat, and the like are stored in association with each threat. The threat / vulnerability information table 142 is registered and stored in the external storage device 127 in advance.

  The security management information table 143 stores vulnerabilities and security management policies in association with each other. Specifically, the name of the vulnerability and the information of the security control that compensates for the vulnerability are stored in association with the name of the vulnerability. Further, the security control information includes upper security control information and specific lower security control information included therein. Specifically, the security control information includes the name of the upper security control, the name of the specific security control that has been specified to a level where the higher security control can be implemented, and the risk reduction rate by the specific security control. , And related information, etc., and each information is stored in association with each other. The security control information table 143 is registered and saved in the external storage device 127 in advance.

  FIG. 3 shows an example of the security management information in the security management information table 143. Here, as an example, a security management measure for the vulnerability 301 of “non-encryption” is shown. The upper security control policy 302 is information at a level indicated by a standard guideline such as BS7799 which is also shown in the prior art, and is “encrypted” in FIG. In the security management information in the present embodiment, a higher security management policy is associated with a specific security management policy 303 that is a specific implementation of the content of this higher security management policy. In the example of FIG. 3, a plurality of specific security management policies with different encryption methods and encryption key lengths such as DES and TripleDES are defined for one upper security management policy. Further, since the risk reduction rate differs depending on the specific measure to be selected, a risk reduction rate 304 for each specific measure is defined. The related information 305 is supplementary information on the details of the security management measures, for example, information such as names of commercial products, manufacturer names, and investment amounts for realizing the specific security management measures. It will serve as reference information when making decisions.

  Returning to FIG. 1, the risk information table 144 by asset includes information on the information asset, threat / vulnerability information associated with the information asset, risk value due to the threat / vulnerability, and specific security management selected. The policy information is memorized. The asset-specific risk information table 144 is stored in the external storage device 127 as a result of executing risk assessment and security management measure selection support according to the present invention.

  The risk evaluation and security management measure selection support program 145 is a program for causing the risk evaluation and security control measure selection support method according to the present invention to be executed on the electronic computer. The program is read on the memory 126 and executed on the CPU 125. As a result, the following processes are executed: attribute selection reception, threat / vulnerability information selection, risk value calculation, security management policy selection, security management policy selection reception, and reduction risk value calculation. As the CPU 125 operates in accordance with the program, the computer can operate as the security management policy selection support apparatus 100 of the present embodiment.

  The flow of risk evaluation and security management policy selection according to this embodiment will be described with reference to FIG. The following flow is executed by the CPU 125 operating in cooperation with other hardware configurations in accordance with the risk assessment and security management policy selection support program 145.

  In step S201, the information assets constituting the target system are grasped. First, the operator inputs information asset management information for each management item (information asset name, asset type, location, network information to which it belongs, management department, user, applicable business process, asset value, etc.) . Information input is performed via the input device 121 or the reading device 123. As a result, the input information is registered in the information asset management table 140 stored in the external storage device 127. Thereafter, input of management information attribute information is received for the management item of the information asset management information. Management information attribute information registered in the management information attribute table 141 is displayed on the output device 122 such as a monitor. The operator uses the input device 121 such as a mouse to select and input management information attribute information for management items of information asset management information.

  Here, according to the above example, for example, when the content of the management item called the installation location of the information asset management information is “server room”, the attribute related to this “server room” is “location with many power outages”, “ Management information attribute information such as “a place with a lot of earthquakes”, “a room with openable windows”, “presence / absence of room name display”, and the like are selected.

  Previously, it was necessary to identify and input hundreds to thousands of information assets that are subject to risk assessment. However, in order to input information asset management information for existing hardware and software from the outside in general. It is possible to efficiently grasp information assets.

  In step S202, a threat / vulnerability is associated with each information asset. Specifically, the management information attribute table 141 is searched using the management information attribute information selected in step S201. The management information attribute table 141 stores management information attribute information and threats / vulnerabilities in association with each other. From the management information attribute table 141, threat and vulnerability information related to the selected attribute are automatically extracted. The extracted threat / vulnerability information is stored in the asset-specific risk information table 144 in association with the asset information of the information asset.

  Conventionally, since the threats and vulnerabilities for each information asset were examined and related, the related threats and vulnerabilities were extracted without exception from a huge number of information assets and attribute information attached to those information assets. However, in the embodiment of the present invention, it is possible to reduce operations necessary for associating threats to the respective information assets. For example, in a medium-sized organization, assuming that the number of information assets is 1000 and the attribute information is 50, if the conventional method is used, 1000 operations are required to associate threats and vulnerabilities with each information asset. In the embodiment of the present invention, the threat / vulnerability may be assigned to the attribute information, and the assignment of the threat / vulnerability can be realized by 50 operations on the attribute information.

  In step S203, risk assessment for each information asset is performed. Specifically, the risk value is calculated as the product of the asset value stored in the information asset management table 140 and the occurrence frequency of the threat stored in the threat / vulnerability table 142. The obtained risk value is stored in the asset-specific risk information table 144 for each information asset.

  Here, the asset value is based on the sum of the values obtained by quantifying the relative evaluation, assuming the importance of confidentiality, integrity, and availability for each information asset, taking advantage of the qualitative risk assessment method of the prior art. It is desirable to calculate. For the occurrence frequency of threats, it is desirable to use a value that statistically predicts how many times each threat may occur, for example, based on past data, cases, and experiences.

  It is difficult to calculate the amount of damage by the conventional quantitative risk assessment method, and it is difficult to apply it when there are many information assets to be handled. In addition, the conventional qualitative risk assessment method that is generally used has a drawback that it is difficult to clarify the effectiveness of the security control measures, and the qualitative judgment of the operator who performs the risk assessment is involved. Furthermore, as new information assets are added, new threats occur and changes in the effectiveness of security management measures are accompanied by technological progress, the risk assessment needs to be reviewed over and over again. In the past, it was necessary to redo qualitative judgment when re-performing this risk assessment, and judgment had to be made for all information assets. In this embodiment, the asset value calculation of the qualitative risk method is used, and the effect of each security control measure can be treated quantitatively as the reduction rate of the occurrence frequency of threats. Can be Furthermore, when risk assessment is re-executed, there is an advantage that risk assessment can be re-executed only by correcting the minimum value of only the changed part.

  In step S204, a security management measure for each information asset is selected in order to reduce to a predetermined acceptable risk value. In the present embodiment, the process is carried out until a specific security control measure is selected in step S204. The selected specific security management measure is stored in the asset-specific risk information table 144 in association with each information asset. A security control is selected from the security control information table 143 using vulnerability information. The security management information table 143 stores vulnerabilities and security management policies in association with each other. Using the vulnerability determined in S202, the corresponding security management information is searched in the security management information table 143 and output to the output device 122 such as a monitor. The output security control information includes the name of the upper security control measure and the name of a specific security control measure that is embodied to a level at which the upper security control measure can be implemented. The operator selects the output specific security control by the input device 121 such as a mouse. The selected upper security management policy and lower specific security management policy are stored in the asset-specific risk information table 144 in association with the information asset.

  Conventionally, after only re-assessment of risk management based on the risk reduction effect by selecting only the higher-level security management measures, the security management measures are embodied. On the other hand, in this embodiment, after selecting up to a specific security control measure, the risk is re-evaluated in the next step S205, so the numerical value based on the specific security control measure that actually implements the risk reduction effect. The amount of work and time required to implement security management measures can be greatly reduced.

  In step S205, the risk reduction rate by the specific security management measure selected for each information asset is acquired from the security management measure information 143, and re-risk evaluation is performed using the risk reduction rate. It is determined whether or not the risk value after this re-evaluation has been reduced to a predetermined acceptable risk value. If not, the process returns to step S204 to select an additional security control measure. Become. If the risk value is reduced to a predetermined acceptable risk value, the risk value after re-evaluation is stored in the asset-specific risk information table 144 as a risk value reflecting the effect of the security control measure. Here, the risk value of the re-risk evaluation in the present embodiment is a value obtained as the product of the risk value calculated in step S203 and the value calculated from the risk reduction rate of the selected security measure. Expressed as a formula, it is asset value x threat occurrence frequency x (1-reduction rate of selected security control measures).

  Step S206 is a stage in which the security management measures obtained up to step S205 are implemented. Conventionally, at this step, it was necessary to select a security management measure that has been materialized to the implementation level. However, in this embodiment, since the security management measure that has been materialized at step S205 is selected, The actualization work that has been done is no longer necessary, and only substantial product selection and system security settings need to be made. This makes it possible to implement not only work efficiency but also early security measures.

  In the present embodiment, the example in which the risk assessment and security management measure selection support program is stored in the external storage device 127 such as a hard disk is shown. However, the program can be stored in various types of storage media. And can be transmitted via a communication medium. Here, the storage medium includes, for example, a flexible disk, a hard disk, a magnetic disk, a magneto-optical disk, a CD-ROM, a DVD, a ROM cartridge, a battery-backed RAM memory cartridge, a flash memory cartridge, and a nonvolatile RAM cartridge. The communication medium includes a wired communication medium such as a telephone line, a wireless communication medium such as a microwave line, and the Internet.

Embodiment 2 of the Invention
In the present embodiment, a risk evaluation and security management measure selection support apparatus when selecting a plurality of security management measures for one threat is shown.

  Some information assets may involve multiple threats when considering risks. In addition, there may be a plurality of vulnerabilities for individual threats, and a plurality of security controls may be related to individual vulnerabilities. The calculation of the risk value when associated with these plural elements will be described with reference to FIGS. 4, 5, and 6.

  FIG. 4 is an example of the relationship between threats, vulnerabilities, and security management measures. In FIG. 4, “1) impersonation” is shown as the threat 401, and two related vulnerabilities 402 are “A) User ID is not appropriate” and “B) Easy password is set”. It is shown. In addition, the security management measure 403 includes a) periodic review of UID setting, b) systematization of UID registration, and c) administrator authority for “A) User ID is not appropriate” for the related vulnerability 402. D) Four security controls for security education are shown. Also, two security management measures are shown for d) security education and e) periodic password inspection for “B) easy password is set”. The column of selection 404 indicates that four items a), b), c), and e) of the security management measure 403 are selected.

  Normally, the parts whose vulnerabilities are compensated for by each security measure are not disjoint but overlap each other. FIG. 5 logically shows the relationship of each security control measure to the vulnerability “A) User ID is not appropriate”. In this case, the implementation of management measures a), b), c), and d) completely compensates for the vulnerability “A) User ID is not appropriate”. It shows that there is an overlap. When only the control measures a), b) and c) are selected, it is necessary to evaluate the risk reduction effect in the shaded area in FIG. Therefore, the risk reduction effect when selecting a plurality of security management measures cannot be obtained simply from the sum of the risk reduction rates of each security measure.

In the present embodiment, the formula for calculating the risk value after re-evaluation in the re-risk evaluation (step S205) of the first embodiment of the invention is as follows:
Asset value x Threat frequency x (1-OR of reduction rates of selected security management measures)
By replacing with, it becomes possible to accurately evaluate the risk reduction effect when a plurality of security management measures are implemented.

  Next, a case where there are a plurality of vulnerabilities to one threat will be described. FIG. 6 logically shows the relationship between threats and vulnerabilities in the example shown in FIG. The possibility of risk occurrence in this case is the logical sum of the related vulnerabilities A) and B), and there is the possibility of the occurrence of the hatched portion of FIG. 6 corresponding to the logical product of this logical sum and threat 1). Part.

In this case, the risk value is calculated by using a formula for calculating the risk value after re-evaluation in the re-risk evaluation (step S205) of the first embodiment of the invention.
Asset value x threat occurrence frequency ∧ (1-(control ratio a reduction rate) ∨ (control measure b reduction rate) ∨ (control measure c reduction rate)) ∨ (1-control measure e reduction rate))
By substituting, it becomes possible to accurately evaluate the risk reduction effect. Here, ∧ is a logical product, and ∨ is a symbol representing a logical sum.

Other embodiments.
In the risk evaluation (steps S203 and S205) in the first embodiment of the invention or the second embodiment of the invention, the asset value of the information asset may be specified as an amount. As a result, the risk value becomes the assumed damage amount due to the threat, and the risk value reduced by the specific security management measure becomes the reduced damage amount. By comparing the reduction amount of the damage amount with the introduction cost of the selected security control measure, the cost effectiveness of the specific security control measure can be clearly shown.

It is a block diagram of the risk evaluation and security management measure selection support apparatus concerning this invention. It is a flowchart of risk evaluation concerning this invention, and security management policy selection. It is an example of the security management policy information concerning this invention. It is an example of the relationship between threats, vulnerabilities and security management measures. FIG. 5 is a logical diagram of the relationship between the vulnerability A) of FIG. 4 and each security control measure. FIG. 5 is a logical diagram of the relationship between threat 1) in FIG. 4 and each vulnerability.

Explanation of symbols

121 Input device 122 Output device 123 Reading device 127 External storage device 140 Information asset management table 141 Management information attribute table 142 Threat / vulnerability table 143 Security control table 144 Asset-specific risk information table 145 Risk evaluation and management plan selection support program

Claims (10)

A risk assessment method for assessing risks caused by threats and vulnerabilities related to information assets using an electronic computer,
A first step of storing, in the information storage means, information asset management information related to management of information assets input by the operator via the input means;
A second step of outputting attribute information specifying the attribute of the information asset management information stored in advance via an output means;
A third step of accepting selection by the operator from the output attribute information via an input means;
A fourth step of selecting threat / vulnerability information associated with the attribute information selected in the third step from a plurality of threat / vulnerability information stored in advance;
A fifth step of calculating a risk value for the information asset based on the threat / vulnerability information selected in the fourth step and the input information asset management information;
A risk assessment method. The information asset management information includes information asset management information for a plurality of management items of the information asset,
The second step outputs a plurality of attribute information specifying attributes of the information asset management information for the management item,
The third step accepts a selection from the output plurality of attribute information.
The risk evaluation method according to claim 1.   The risk according to claim 1, wherein the fifth step calculates a risk value for the information asset based on the selected threat / vulnerability information and asset value information of the input information asset management information. Evaluation methods. The information asset management information has, as an asset value, a sum of values obtained by quantifying a relative evaluation assuming the importance of confidentiality, integrity, and availability in the information asset.
The threat / vulnerability information has an occurrence frequency prediction value for predicting the occurrence frequency of threats,
In the fifth step, a risk value is a product of the asset value and the occurrence frequency prediction value.
The risk evaluation method according to claim 1. A security management policy selection support method that supports the determination of security control policies necessary for information security management using an electronic computer,
A first step of storing information asset management information related to information asset management and threat / vulnerability information of the information asset in association with each other;
A second step of selecting, from a plurality of pre-stored security control information, security control information related to the security control associated with the threat / vulnerability information stored in the first step;
The security control information selected in the second step includes upper security control information and a plurality of specific security control information of the higher security control information, and the plurality of specific security control information A third step of outputting via the output means;
A fourth step of accepting an operator's selection via the input means from the plurality of specific security control information output;
A security management policy selection support method.   6. The method according to claim 5, further comprising a fifth step of calculating a reduced risk value for the information asset based on the risk reduction information included in the specific security control information selected in the fourth step. Security control selection support method. The fifth step calculates a reduced risk value for the information asset using a risk reduction rate included in the selected specific security control information,
The security control measure selection support method is:
The reduced risk value calculated in the fifth step is presented to the operator through the output means as the application effect of the selected specific security control measure, and whether or not the reduced risk value is accepted through the input means. A sixth step for accepting input;
If the reduced risk value is acceptable, it is determined as a control that implements the specific security control selected in the second step. If the reduced risk value is not acceptable, the specific security control is determined. A seventh step for accepting selection of information;
The security control measure selection support method according to claim 6, further comprising: Prior to the first step, the security management policy selection support method includes:
Storing information asset management information regarding management of information assets input by the operator via the input means in the information storage means;
Outputting pre-stored attribute information for identifying the attribute of the information asset management information via the previous output means;
Receiving a selection by an operator of the output attribute information via an input means;
Selecting threat / vulnerability information associated with the selected attribute information from a plurality of threat / vulnerability information stored in advance;
Calculating a risk value for the information asset based on the threat / vulnerability information and the input information asset management information;
The security control measure selection support method according to claim 6, comprising: A program for causing a computer to execute a process for evaluating a risk caused by a threat / vulnerability related to an information asset, wherein the process includes:
A first step of storing, in the information storage means, information asset management information related to information asset management input by an operator;
A second step of outputting attribute information specifying the attribute of the information asset management information stored in advance;
A third step of accepting selection by the operator of the output attribute information;
A fourth step of selecting threat / vulnerability information associated with the attribute information selected in the third step from a plurality of threat / vulnerability information stored in advance;
A fifth step of calculating a risk value for the information asset based on the threat / vulnerability information selected in the fourth step and the input information asset management information;
A program with A program for causing a computer to execute processing for supporting determination of security control measures necessary for information security management, wherein the processing includes:
A first step of storing information asset management information related to information asset management and threat / vulnerability information of the information asset in association with each other;
A second step of selecting security control information associated with the threat / vulnerability information stored in the first step from a plurality of pre-stored security control information;
A third step of outputting higher security control information included in the security control information selected in the second step and a plurality of specific security control information of the higher security control information;
A fourth step of accepting selection by the operator from the plurality of outputted specific security control information;
A fifth step of calculating a reduced risk value for the information asset based on the specific security control information selected in the fourth step;
A program with

Images