JP2010237836A - Security audit period derivation device, security audit period derivation program, and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To change the frequency of the acquisition of security setting information from an audit object terminal as the object of security audit according to the risk of the audit object terminal. <P>SOLUTION: An audit object terminal as a security audit period derivation device is provided with: a terminal side risk determination rule storage part 203 for storing a risk determination rule as a rule in which a derivation procedure for deriving the next audit period is defined from the audit result of the security audit of the audit object device as the object of security audit; and a terminal side risk determination part for deriving the audit period of the next security audit to the audit object terminal from the audit result of a client audit result storage part 202 in which the audit result of the security audit of the audit object terminal is stored and the risk determination rule stored in the terminal side risk determination rule storage part 203. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to an audit time deriving device for deriving an execution time for executing a security policy audit.

  A conventional security operation management system stores an information security policy and collects security information of the monitored system to perform a security policy audit of the security status of the monitored system (for example, Patent Document 1). . Further, these security policy audits are performed at a predetermined fixed interval (for example, Patent Document 2).

Japanese Patent Laid-Open No. 2002-247033, FIG. Japanese Patent Laid-Open No. 2001-273388, FIG.

  A conventional security policy auditing system collects security setting information from audit target terminals in security policy auditing at a predetermined time frequency. In such a configuration, the risk of security leakage accidents is reduced by performing as frequently as possible, but the load on the terminal increases or the number of auditable units on one server decreases due to increased server load. There is a problem that setting information cannot be collected at a high frequency.

  An object of the present invention is to reduce the load and improve the security level of both the terminal and the server by changing the frequency of acquiring the security setting information from the terminal according to the risk.

The security audit time derivation device of this invention is
A risk judgment rule storage unit for storing a risk judgment rule that is a rule in which a derivation procedure for deriving a next audit time from a security audit result of an audit target device to be a security audit target is defined;
From the audit result of the audit result storage device in which the audit result of the security audit of the audit target device is stored, and the risk determination rule stored in the risk determination rule storage unit, the next security for the audit target device An audit time deriving section for deriving the audit time of the audit is provided.

  According to the present invention, the audit frequency can be changed according to the risk to be audited.

1 is a system configuration diagram of a security policy audit system 1010 according to Embodiment 1. FIG. 5 is a flow showing the operation of the audit execution unit 212 in the first embodiment. The operation | movement flow of the terminal side risk determination part 214 in Embodiment 1. FIG. The risk determination rule in Embodiment 1. FIG. FIG. 10 is a system configuration diagram of a security policy audit system 1020 according to the second embodiment. FIG. 10 is a configuration diagram of a security policy audit system 1030 in the third embodiment. The operation | movement flow of the terminal side risk determination part 214 in Embodiment 3. FIG. FIG. 18 is a system configuration diagram of a security policy audit system 1040 according to the fourth embodiment. The operation | movement flow of the server side risk determination part 1401 in Embodiment 4. FIG. FIG. 16 is a system configuration diagram of a security policy audit system 1050 according to the fifth embodiment. The operation | movement flow of the risk inquiry part 2401 in Embodiment 5. FIG. The operation | movement flow of the server side risk determination part 1401 in Embodiment 5. FIG. An example of the risk determination rule in Embodiment 5. FIG. 18 is a system configuration diagram of a security policy audit system 1060 according to the sixth embodiment. The operation | movement flow of the risk determination part 1401 in Embodiment 6. FIG. An example of the risk determination rule in Embodiment 6. The appearance of the audit target terminal in the seventh embodiment. 18 shows an example of a hardware configuration of an audit target terminal according to the seventh embodiment.

  In the following first to seventh embodiments, an audit time deriving device for deriving an audit time of a security audit will be described. The main component of the audit time deriving device is a risk determination unit described later. In the first to third embodiments, the audit target terminal itself corresponds to the audit time deriving device (the risk judging unit exists in the audit target terminal), and in the fourth to sixth embodiments, the audit server corresponds to the audit time deriving device. (A risk determination unit exists in the audit server). In the seventh embodiment, the hardware configuration of the audit time deriving device will be described.

Embodiment 1 FIG.
The first embodiment will be described with reference to FIGS. In the first embodiment, the security audit agent 210 (terminal-side risk determination unit 214), which is software incorporated in the audit target terminal device 200 (hereinafter referred to as the audit target terminal), derives the next audit time. It is.

  FIG. 1 is a system configuration diagram of a security policy audit system 1010 according to the first embodiment. The security policy audit system 1010 includes a plurality of audit target terminals 200 and a security audit server device 100 (hereinafter referred to as a security audit server). The audit target terminal 200 and the security audit server 100 are connected to a network (LAN 300) and can communicate with each other. The LAN 300 is a local area network (LAN) to which the security audit server 100 and the audit target terminal 200 are connected.

(Security audit server 100)
The security audit server 100 is a server that performs a security audit of the audit target terminal 200. The security audit server 100 includes an audit result information collection unit 101, an audit result storage unit 102, and an audit result information display unit 103.
(1) The audit result information collection unit 101 collects the audit results notified from the security audit agent 210 of each audit target terminal 200, and stores the collected audit results in the audit result storage unit 102.
(2) The audit result storage unit 102 is a database in which audit results notified from the security audit agent 210 of each audit target terminal 200 are stored.
(3) The audit result information display unit 103 displays the audit result to a person using the security policy audit system such as a security auditor.

(Audit target terminal 200)
The audit target terminal 200 is a device such as a PC (Personal Computer), a server, a portable terminal device, and a measuring instrument to be audited. The audit target terminal 200 includes a security audit agent 210 and a terminal security setting information storage unit 220.

(Security audit agent 210)
The security audit agent 210 is agent software that operates on the audit target terminal and performs security audit. The security audit agent 210 includes an audit result notification unit 211, an audit execution unit 212, a security setting information acquisition unit 213, a terminal-side risk determination unit 214, a security policy storage unit 201, a client audit result storage unit 202 (audit result storage device), A terminal-side risk determination rule storage unit 203 is provided.

(1) The audit result notification unit 211 transmits the audit results collected by the security audit agent 210 (audit execution unit 212) to the security audit server 100.
(2) The audit execution unit 212 performs an audit execution process.
(3) The security setting information acquisition unit 213 acquires terminal security information from the terminal security setting information storage unit 220 in accordance with an instruction from the audit execution unit 212.
(4) The terminal-side risk determination unit 214 determines the security risk of the audit target terminal 200. A security risk is the degree of danger related to security.
(5) The security policy storage unit 201 stores a security policy. The security policy is policy information serving as a reference when the security audit agent 210 executes a security audit.
(6) The client audit result storage unit 202 stores the client audit result. The client audit result is information indicating the audit result of the security audit agent 210 auditing the audit target terminal 200.
(7) The terminal-side risk determination rule storage unit 203 stores risk determination rules. The risk determination rule is rule information used by the terminal-side risk determination unit 214 in risk determination. In the risk determination rule, as shown in FIG. 4 described later, a derivation procedure for deriving the next audit time of the audit target terminal from the audit result of the security audit of the audit target terminal that is the target of the security audit is defined.

(Terminal security setting information storage unit 220)
The terminal security setting information storage unit 220 stores terminal security setting information. The terminal security setting information is information related to the security audit such as information related to the security setting of the audit target terminal 200 and inventory information.

  Next, the operation of the security policy audit system 1010 will be described.

  First, the security audit agent 210 operating on the audit target terminal 200 operates the audit execution unit 212 at the time of activation. It is assumed that the security policy in the security policy storage unit 201 and the risk determination rule in the terminal-side risk determination rule storage unit 203 are determined in advance in, for example, a setting file of the security audit agent 210.

  FIG. 2 is a flowchart showing the operation of the audit execution unit 212.

  In S11, the audit execution unit 212 first acquires a security policy from the security policy storage unit 201, and confirms an audit target item. The items to be audited are described in the security policy.

  In S12, the audit execution unit 212 instructs the security setting information acquisition unit 213 to acquire the terminal security setting information from the terminal security setting information storage unit 220 according to the audit target item.

  In S13, the audit execution unit 212 compares the acquired terminal security setting information with the security policy in the security policy storage unit 201, and displays a “client audit result” indicating whether the terminal security setting information conforms to the security policy. create.

  In S <b> 14, the audit execution unit 212 stores the created client audit result in the client audit result storage unit 202 and simultaneously notifies the security audit server 100 through the audit result notification unit 211.

  In S15, thereafter, the audit execution unit 212 inquires of the terminal-side risk determination unit 214 about the next audit execution start time.

(Terminal risk determination unit 214)
FIG. 3 is a flowchart showing the operation of the terminal-side risk determination unit 214. FIG. 4 is a diagram illustrating an example of the risk determination rule. In S21, the terminal-side risk determination unit 214 acquires the client audit result stored in S14 and the risk determination rule, compares them, and determines the risk status of the audit target terminal 200. In S 22, the next audit execution time (audit time) is derived from the setting information of the next audit time interval of the risk determination rule that matches the determined result, and is notified to the audit execution unit 212.

(Audit execution unit 212)
In S16 of FIG. 2, when the next audit execution time is acquired, the audit execution unit 212 compares the current time with the next audit execution start time, and if the current time has passed, acquires the security setting information again, Repeat the operation. If the current time has not passed, sleep for a fixed time is repeated until the current time passes the next audit start time.

  The client audit result acquired by the security audit agent 210 (audit execution unit 212) is acquired by the audit result information collection unit 101 of the security audit server 100 via the audit result notification unit 211, and a plurality of audit results are stored in the audit result storage unit 102. The audit result of the audit target terminal is stored. The security administrator can refer to the audit result in the audit result storage unit 102 by accessing the audit result information display unit 103.

  As described above, the terminal-side risk determination unit 214 changes the security audit interval according to the previous audit result (determines the next audit time), so that the security level is not lowered and security is not reduced. The load on the audit server can be reduced.

  For example, in the environment where the number of terminals that can be audited by one security audit server is 100 when security audits must be performed once an hour, the risk judgment function can reduce the risk of all audited terminals. If it is determined that a security audit once a day is sufficient, a security audit of 2400 terminals can be realized by one security audit server. In the above example, it was assumed that the risk of all audited terminals was low, but the security audit system found many terminals that violated the security policy at the initial introduction, but the PC with a high risk of violating the security policy during long-term operation. Are almost nonexistent, and in many cases, the above assumption can be applied.

Embodiment 2. FIG.
Next, Embodiment 2 will be described with reference to FIG. In the first embodiment described above, the risk determination rule is stored in advance in the security audit agent 210 and cannot be dynamically changed. However, in the security policy audit system 1020 of the second embodiment, the security audit server 100 The risk judgment rule can be dynamically changed by notification from.

  FIG. 5 is a configuration diagram of the security policy audit system 1020. In FIG. 5, a risk determination rule setting unit 1201 operates on the security audit server 100 and provides a user interface for setting / changing a risk determination rule. The risk judgment rule storage unit 2201 (risk judgment rule input unit) operates on the security audit agent 210 and acquires / changes the security judgment rule.

  Next, the operation will be described.

(Operation of the risk judgment rule setting unit 1201 etc.)
First, the risk determination rule setting unit 1201 sets and changes the risk determination rule in accordance with the operation of the security auditor. The risk determination rule set by the risk determination rule setting unit 1201 is notified to the risk determination rule storage unit 2201.

  The risk determination rule storage unit 2201 receives an input for setting or changing the risk determination rule from the risk determination rule setting unit 1201 and stores the risk determination rule in the terminal-side risk determination rule storage unit 203. That is, the risk determination rule storage unit 2201 reflects the setting or change of the risk determination rule received from the risk determination rule setting unit 1201 in the risk determination rule of the terminal-side risk determination rule storage unit 203.

  Since the terminal-side risk determination unit 214 executes the risk determination process based on the risk determination rule at the time of operation, as shown in the flowchart of FIG. 3, the risk determination rule at the time of execution (if there is a change before the execution) The changed rule is reflected).

  As described above, by adopting a configuration that allows the risk judgment rules to be changed dynamically, the security auditor can dynamically change the risk judgment rules depending on the status of the audit results, further improving the security level.・ Reduces load.

Embodiment 3 FIG.
Next, Embodiment 3 will be described with reference to FIGS. In the first and second embodiments described above, the risk determination rule is held on the agent side (the audit target terminal side). However, the security policy audit system 1030 according to the third embodiment stores the risk determination rule in the security audit server 100. The security audit agent 210 acquires a risk determination rule from the security audit server 100 each time a risk is determined.

  FIG. 6 is a configuration diagram of the security policy audit system 1030 according to the third embodiment. As illustrated in FIG. 6, the risk determination rule is stored in the server-side risk determination rule storage unit 1301. The risk determination rule in the server-side risk determination rule storage unit 1301 is database information for each security inspection agent 210. Further, the risk notification unit 1302 operates on the security audit server 100 and notifies the risk audit rule to the security audit agent 210 of each audit target terminal 200.

  Next, the operation will be described. First, the security audit agent 210 operating on the audit target terminal 200 operates the audit execution unit 212 at the time of activation.

  The operation of the audit execution unit 212 is the same as that in FIG.

  FIG. 7 is a flowchart showing the operation of the terminal-side risk determination unit 214. In FIG. 7, S32 is added to FIG.

  7, when an inquiry is received from the audit execution unit 212 in S32 (S15), the terminal-side risk determination unit 214 obtains a risk determination rule from the risk notification unit 1302 by making a request to the risk notification unit 1302 Then, the obtained risk determination rule is compared with the client audit result of the client audit result storage unit 202 (audit result storage device), and the risk status of the audit target terminal 200 is determined. As a result of the determination, the next audit execution time is derived from the setting information of the next audit time interval of the matching risk determination rule, and is notified to the audit execution unit 212 (S33).

  As in the case of FIG. 3, the audit execution unit 212 that has acquired the next audit execution time compares the current time with the next audit execution start time, and if the current time has passed, acquires the security setting information again, The above operation is repeated. If the current time has not passed, sleep for a fixed time is repeated until the current time passes the next audit start time.

  The client audit result acquired by the security audit agent is acquired by the audit result information collecting unit 101 of the security audit server 100, and the audit results of a plurality of audit target terminals are stored in the audit result storage unit 102. The security administrator can refer to the audit result in the audit result storage unit 102 by accessing the audit result information display unit 103.

  As described above, it is possible to apply one risk determination rule to a plurality of audit target terminals simultaneously by centrally managing the risk determination rule with the security audit server. In addition, it is possible to reflect the risk judgment in real time by making an inquiry to the server.

Embodiment 4 FIG.
Next, the fourth embodiment will be described with reference to FIGS. In the first to third embodiments described above, the risk determination is performed on the agent side (the audit target terminal side). However, in the security policy audit system 1040 according to the fourth embodiment, the risk determination rule and the risk determination function are secured. The security server 100 executes the risk determination of the audit target terminal on the security audit server 100 side.

  FIG. 8 is a configuration diagram of the security policy audit system 1040. In FIG. 8, the risk inquiry unit 2401 operates on the security audit agent 210 and inquires the security audit server about the risk. The server-side risk determination unit 1401 operates on the security audit server 100 and performs risk determination.

  Next, the operation will be described. First, the security audit agent 210 operating on the audit target terminal 200 operates the audit execution unit 212 at the time of activation. It is assumed that the security policy in the security policy storage unit 201 is determined in advance by, for example, a setting file of the security audit agent.

  The operation of the audit execution unit 212 is almost the same as that in FIG. 2 of the first embodiment, but in S15 of FIG. 2, in this fourth embodiment, the audit execution unit 212 performs security through the risk inquiry unit 2401. The difference is that the server side risk determination unit 1401 of the audit server 100 is inquired about the next audit time. In this way, the audit execution unit 212 inquires of the risk inquiry unit 2401 about the next audit execution start time. Upon receiving an inquiry from the audit execution unit 212, the risk inquiry unit 2401 inquires of the server-side risk determination unit 1401 about the risk.

(Server-side risk determination unit 1401)
FIG. 9 is a flowchart showing the operation of the server-side risk determination unit 1401. As shown in the flowchart of FIG. 9, the server-side risk determination unit 1401 stores the risk determination rule in the server-side risk determination rule storage unit 1301 and the audit result storage unit 102 (audit result storage device) for each client (audit terminal). The risk status of the audit target terminal 200 is determined by comparing the corresponding audit result among the stored audit results. The next audit execution time is derived from the setting information of the next audit time interval of the risk determination rule that matches the determined result, and is notified to the audit execution unit 212 via the risk inquiry unit 2401.

(Audit execution unit 212)
As in the first embodiment shown in FIG. 2, the audit execution unit 212 that has acquired the next audit execution time compares the current time with the next audit execution start time. If the current time has passed, the security setting is again set. Information is acquired and the above operations are repeated. If the current time has not passed, sleep for a fixed time is repeated until the current time passes the next audit start time.

  As described above, the risk determination rule and the audit result are centrally managed by the security audit server, thereby making it possible to perform risk determination by combining the results of a plurality of audit target terminals. For example, it is possible to determine the security risk status of a certain organizational unit (department, section), and to conduct audits at a higher frequency for a high-risk organization.

Embodiment 5 FIG.
Next, a fifth embodiment will be described with reference to FIGS. In the fourth embodiment described above, the security audit frequency is changed according to the risk (audit time is determined). Next, an embodiment in which the security setting information acquired according to the risk is changed will be described.

  FIG. 10 is a configuration diagram of the security policy audit system 1050 according to the fifth embodiment.

  The operation of the audit execution unit 212 is almost the same as that in the fourth embodiment. First, the security audit agent 210 operating on the audit target terminal 200 operates the audit execution unit 212 at the time of activation.

(S15: Risk inquiry unit 2401)
FIG. 11 is a flowchart showing the operation of the risk inquiry unit 2401. In S51, the risk inquiry unit 2401 inquires of the server-side risk determination unit 1401 of the security audit server 100 about the risk (step S15 in FIG. 2).

(Server-side risk determination unit 1401)
FIG. 12 is a flowchart showing the operation of the server-side risk determination unit 1401. Upon receiving an inquiry from the risk inquiry unit 2401, the server-side risk determination unit 1401 compares the risk determination rule stored in the server-side risk determination rule storage unit 130 with the client audit result stored in the audit result storage unit 102. The risk status of the audit target terminal 200 is determined.

  Up to this point, the process is the same as in the fourth embodiment.

  FIG. 13 is a diagram illustrating risk determination rules stored in the server-side risk determination rule storage unit 1301. As shown in FIG. 13, the risk judgment rule in the server-side risk judgment rule storage unit 1301 describes not only the next audit time interval but also the audit items in the next audit. As described above, the risk determination rule further defines a procedure for deriving an audit item in the next security audit from the audit result of the security audit of the audit target terminal. The server-side risk determination unit 1401 derives the next audit execution time and the next audit item from the risk determination rule and the audit result, and notifies the risk inquiry unit 2401 of it.

(Risk inquiry section 2401)
The risk inquiry unit 2401 notifies the audit execution unit 212 of the next audit execution time acquired from the server-side risk determination unit 1401 and sets the next audit item in the security policy of the security policy storage unit 201.

(Audit execution unit 212)
The audit execution unit 212 that has acquired the next audit execution time compares the current time with the next audit execution start time. If the current time has passed, the audit execution unit 212 follows the security policy newly set by the risk inquiry unit 2401 (this point). Is different from the fourth embodiment), the security setting information is acquired, and the above operation is repeated. If the current time has not passed, sleep for a fixed time is repeated until the current time passes the next audit start time.

  As described above, by adding not only the next audit execution time but also an item to be audited to the risk determination rule, the audit items can be changed according to the risk. By changing the audit items, it is possible to reduce the load or improve the security level by performing a high-load audit only on a terminal with a high risk.

Embodiment 6 FIG.
Next, Embodiment 6 will be described with reference to FIGS. In the above-described fifth embodiment, the risk is determined only by the audit result of the security audit by the agent. Next, an embodiment in which the entrance / exit management information is used for risk determination will be described.

  FIG. 14 is a configuration diagram of the security policy audit system 1060 according to the sixth embodiment. In FIG. 14, an entrance / exit management system 600 is an entrance / exit management system for managing entrance / exit of a person into a predetermined room, a predetermined area, a predetermined area, and the like. The entrance / exit management system 600 generates an entrance / exit log (entrance / exit management information) indicating the entrance / exit status of a person entering a predetermined room. The entrance / exit management system 600 includes an entrance / exit management device 610 and an entrance / exit log 620. The entrance / exit management device 610 performs card readers and their management. The entrance / exit log 620 is log information related to entrance / exit.

  The entrance / exit information acquisition unit 1601 acquires entrance / exit management information.

  Next, the operation will be described. First, the entrance / exit management device 610 of the entrance / exit management system 600 controls entry / exit of a user, and always performs an operation of storing user entry / exit information as a log in the entrance / exit log 620.

  The operation of the security audit agent 210 is the same as that of the fifth embodiment. As in the fifth embodiment, the risk inquiry unit 2401 inquires of the risk judgment unit 1405 of the security audit server 100 about the risk (S51). In the process of S71 of FIG. 15, the risk determination unit 1405 instructs the entrance / exit information acquisition unit 1601 to acquire entrance / exit management information from the entrance / exit log 620.

  In S72, the server-side risk determination unit 1401 compares the entry / exit log (entrance / exit management information) with the risk determination rule of the server-side risk determination rule storage unit 1301 and the audit result of the audit result storage unit 102, and performs an audit. The risk status of the target terminal 200 is determined.

  FIG. 16 shows the risk determination rules stored in the server-side risk determination rule storage unit 1301. As shown in FIG. 16, the risk determination rule is defined so that not only the audit result but also the entrance / exit management information acquired from the entrance / exit management system is referred to as the judgment formula as the risk judgment formula. As described above, the risk determination rule defines a derivation procedure for deriving the next security audit audit time and the next audit item from the entrance / exit management information and the security audit result.

  The server-side risk determination unit 1401 derives the next audit execution time and the next audit item based on the audit result, the entrance / exit management information, and the risk determination rule, and the derived next audit execution time and the next audit are derived. The item is notified to the risk inquiry unit 2401.

  The following operations are the same as those in the fifth embodiment. That is, the risk inquiry unit 2401 notifies the audit execution unit 212 of the acquired next audit execution time, and reflects the next audit item in the security policy. The audit execution unit 212 that has acquired the next audit execution time compares the current time with the next audit execution start time, and if the current time has passed, acquires the security setting information again and repeats the above operation. If the current time has not passed, sleep for a fixed time is repeated until the current time passes the next audit start time.

  As described above, by adding not only the security audit result but also the information on the entrance / exit management system to the risk judgment rule, for example, when an outside person enters the room, the security level is frequently checked by performing security checks. Can be improved. In addition, when no one is in the room, it is possible to reduce the load by reducing the frequency of security checks and implementing a security audit item with a high load.

Embodiment 7 FIG.
The seventh embodiment will be described with reference to FIGS.

  Embodiment 7 shows a specific embodiment in which the audit target terminal 200 or the security audit server 100 which is a security audit time deriving device is realized by a computer. Description will be made assuming that the security audit time deriving device is the audit target terminal 200.

  FIG. 17 is a diagram illustrating an example of the appearance of the audit target terminal 200. In FIG. 17, the audit target terminal 200 includes a system unit 830, a display device 813 having a CRT (Cathode / Ray / Tube) or LCD (liquid crystal) display screen, a keyboard 814 (Key / Board: K / B), and a mouse 815. , FDD 817 (Flexible Disk Drive), compact disk device 818 (CDD: Compact Disk Drive), printer device 819, and other hardware resources, which are connected by cables and signal lines.

  FIG. 18 is a diagram illustrating an example of hardware resources of the audit target terminal 200. In FIG. 18, the audit target terminal 200 includes a CPU 810 (Central Processing Unit) that executes a program. The CPU 810 includes a ROM (Read Only Memory) 811, a RAM (Random Access Memory) 812, a display device 813, a keyboard 814, a mouse 815, a communication board 816, an FDD 817, a CDD 818, a printer device 819, and a magnetic disk device 820 via a bus 825. And control these hardware devices. Instead of the magnetic disk device 820, a storage device such as an optical disk device or a flash memory may be used.

  The RAM 812 is an example of a volatile memory. Storage media such as the ROM 811, the FDD 817, the CDD 818, and the magnetic disk device 820 are examples of nonvolatile memories. These are examples of a storage device or a storage unit, a storage unit, and a buffer. The communication board 816, the keyboard 814, the FDD 817, and the like are examples of an input unit and an input device. The communication board 816, the display device 813, the printer device 819, and the like are examples of an output unit and an output device.

  The communication board 816 is connected to a network (such as a LAN). The communication board 816 may be connected not only to the LAN but also to a WAN (wide area network) such as the Internet or ISDN. The communication board 816 can communicate with the security audit server 100 and other devices via a network.

  The magnetic disk device 820 stores an operating system 821 (OS), a window system 822, a program group 823, and a file group 824. The programs in the program group 823 are executed by the CPU 810, the operating system 821, and the window system 822.

  The program group 823 stores programs that execute the functions described as “˜units” in the description of the above embodiments. The program is read and executed by the CPU 810.

  The file group 824 includes data described as “risk determination rule”, “security policy”, “client audit result”, and “terminal security setting information” in the description of the above embodiment, and “determination result of”. The information described as “calculation result”, “extraction result”, “generation result”, “processing result”, data, signal value, variable value, parameter, etc. And “˜Database” are stored as each item. The “˜file” and “˜database” are stored in a recording medium such as a disk or a memory. Information, data, signal values, variable values, and parameters stored in a storage medium such as a disk or memory are read out to the main memory or cache memory by the CPU 810 via a read / write circuit, and extracted, searched, referenced, compared, and calculated. Used for CPU operations such as calculation, processing, output, printing, and display. Information, data, signal values, variable values, and parameters are temporarily stored in the main memory, cache memory, and buffer memory during the CPU operations of extraction, search, reference, comparison, operation, calculation, processing, output, printing, and display. Is remembered.

  In the description of the embodiment described above, data and signal values are stored in the memory of the RAM 812, the flexible disk of the FDD 817, the compact disk of the CDD 818, the magnetic disk of the magnetic disk device 820, other optical disks, mini disks, DVDs (Digital). -It records on recording media, such as Versatile and Disk. Data and signals are transmitted on-line via the bus 825, signal lines, cables, and other transmission media.

  In the above description of the embodiment, what has been described as “to part” may be “to means”, “to circuit”, and “to device”, and “to step” and “to”. “Procedure” and “˜Process” may be used. That is, what has been described as “˜unit” may be realized by firmware stored in the ROM 811. Alternatively, it may be implemented only by software, or only by hardware such as elements, devices, substrates, and wirings, by a combination of software and hardware, or by a combination of firmware. Firmware and software are stored as programs in a recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, and a DVD. The program is read by the CPU 810 and executed by the CPU 810. That is, the program causes the computer to function as the “˜unit” described above. Alternatively, the computer executes the procedure and method of “to part” described above.

  It is also possible to grasp the operation of the security audit time deriving device described in the above embodiment as a security audit time deriving program to be executed by a computer. Alternatively, it can be grasped as a computer-readable recording medium in which the security audit time derivation program is recorded. Further, the operation of the security audit time deriving device can be grasped as a security audit time deriving method performed by the security audit time deriving device.

  DESCRIPTION OF SYMBOLS 100 Security audit server, 101 Audit result information collection part, 102 Audit result storage part, 103 Audit result information display part, 200 Audit object terminal, 210 Security audit agent, 201 Security policy storage part, 202 Client audit result storage part, 203 terminal Side risk determination rule storage unit, 211 audit result notification unit, 212 audit execution unit, 213 security setting information acquisition unit, 214 terminal side risk determination unit, 220 terminal security setting information storage unit, 300 LAN, 1201 risk determination rule setting unit, 1301 Server-side risk determination rule storage unit, 1302 Risk notification unit, 1401 Server-side risk determination unit, 2201 Risk determination rule storage unit, 2401 Risk inquiry unit.

Claims (8)

A risk judgment rule storage unit for storing a risk judgment rule that is a rule in which a derivation procedure for deriving a next audit time from a security audit result of an audit target device to be a security audit target is defined;
From the audit result of the audit result storage device in which the audit result of the security audit of the audit target device is stored, and the risk determination rule stored in the risk determination rule storage unit, the next security for the audit target device A security audit timing deriving device comprising an audit timing deriving section for deriving an audit timing of an audit. The security audit time deriving device further includes:
The security audit time deriving device according to claim 1, further comprising a risk determination rule input unit that receives an input of the risk determination rule and stores the received risk determination rule in the risk determination rule storage unit. The audit time deriving section
3. An inquiry about the next audit time is received from the audit target device, and when the query is received, the derivation process is started, and the derived audit time is notified to the audit target device. The security audit time deriving device according to any one of the above. The risk determination rule stored in the risk determination rule storage unit is:
Furthermore, a procedure for deriving an audit item in the next security audit from the audit result of the security audit of the audit target device is defined,
The audit time deriving section
From the audit result of the audit result storage device in which the audit result of the security audit of the audit target device is stored, and the risk determination rule stored in the risk determination rule storage unit, the next security for the audit target device The security audit time deriving device according to claim 1, wherein an audit item for the audit is derived. The risk determination rule stored in the risk determination rule storage unit is:
From the entrance / exit management information indicating the entrance / exit status of the person entering / exiting the predetermined room generated by the entrance / exit management system for managing the entrance / exit of the person to / from the predetermined room and the audit result of the security audit of the audit target device The derivation procedure for deriving the audit time of the next security audit is defined,
The security audit time deriving device further includes:
An entrance / exit management information acquisition unit for acquiring the entrance / exit management information from the entrance / exit management system,
The audit time deriving section
The entrance / exit management information acquired by the entrance / exit management information acquisition unit, the audit result of the audit result storage device in which the audit result of the security audit of the audit target device is stored, and stored in the risk determination rule storage unit The security audit time deriving device according to claim 1, wherein an audit time of a next security audit for the audit target device is derived from the risk determination rule that has been determined. The risk determination rule is acquired from a server device that stores a risk determination rule that is a rule in which a procedure for deriving a next audit time is defined from a security audit audit result of an audit target device to be a security audit target, and the audit The audit time of the next security audit for the audit target device is determined from the audit result of the audit result storage device storing the audit result of the security audit of the target device and the risk determination rule acquired from the server device. A security audit time deriving device comprising a deriving audit time deriving unit. Computer
A risk judgment rule storage unit for storing a risk judgment rule that is a rule in which a derivation procedure for deriving a next audit time from a security audit audit result of a security audit target device is defined;
From the audit result of the audit result storage device in which the audit result of the security audit of the audit target device is stored, and the risk determination rule stored in the risk determination rule storage unit, the next security for the audit target device An audit time deriving section for deriving the audit time of the audit,
Security audit time derivation program to function as.   A computer-readable recording medium on which the security audit time deriving program according to claim 7 is recorded.

Images