JP2022057956A - Risk evaluation support system - Google Patents

Abstract

To provide a risk evaluation support system capable of supporting to obtain risk evaluations for subject entities.SOLUTION: A risk evaluation support system comprises: a management unit for managing a correspondence relation between a first user entity and a first subject entity, and associating and managing a risk evaluation pertaining to security measures of the first subject entity with the first subject entity; and a control unit for, when the risk evaluation is updated, providing the updated risk evaluation to the first user entity associated with the first subject entity.SELECTED DRAWING: Figure 2

Description

The present invention relates to a risk assessment support system.

Since cyber attacks have been increasing in recent years, risk assessment for cyber attacks has been attracting attention. For example, a system for deriving a risk assessment regarding security measures based on an answer to a list of questions regarding security measures (hereinafter referred to as a checklist) has been proposed (for example, Patent Document 1).

Japanese Unexamined Patent Publication No. 2019-070912

By the way, an entity such as an individual, a corporation or an organization often has a relationship such as a business relationship or a capital relationship with another entity (hereinafter referred to as a target entity). In such a case, it is preferable that the entity not only obtains its own risk assessment but also obtains the risk assessment of the target entity.

However, in the case where a large number of target entities exist, it is extremely complicated for the entity to acquire the risk assessment of all the target entities by itself. Furthermore, it is extremely complicated to keep updating the risk assessment of the target entity of the latest version.

Therefore, the present invention has been made to solve the above-mentioned problems, and an object of the present invention is to provide a risk assessment support system capable of supporting the acquisition of a risk assessment of a target entity.

The first feature is a risk evaluation support system, which manages the correspondence between the first user entity and the first target entity, and corresponds to the first target entity for risk evaluation regarding security measures of the first target entity. A management unit that is attached and managed, and a control unit that provides the updated risk evaluation to the first user entity associated with the first target entity when the risk evaluation is updated. The gist is to be prepared.

The second feature is that, in the first feature, the control unit provides the updated risk assessment with the permission of the first target entity regarding the update of the risk assessment. ..

The third feature is the first feature or the second feature, the gist of which is that the control unit updates the risk assessment based on the information provided by the first target entity.

The fourth feature is that in any of the first feature to the third feature, the control unit is managed by the management unit when the acquisition of the risk assessment is requested by the second user entity. The gist is to provide the risk assessment to the second user entity.

A fifth feature is that, in the fourth feature, the control unit provides the risk assessment managed by the management unit when the first target entity has permission to provide the risk assessment. The gist is that.

The sixth feature is the gist of the first feature to the fifth feature that the control unit acquires a risk assessment regarding the security measures of the target entity based on the information provided by the target entity. do.

The seventh feature is the gist of the first feature to the fifth feature that the control unit acquires a risk assessment regarding the security measures of the target entity based on the information disclosed about the target entity. do.

According to the present invention, it is possible to provide a risk assessment support system that can support the acquisition of a risk assessment of a target entity.

FIG. 1 is a diagram showing a risk assessment support system 100 according to an embodiment. FIG. 2 is a diagram showing a support server 30 according to an embodiment. FIG. 3 is a diagram showing an example of data stored in the management unit 32 according to the embodiment. FIG. 4 is a diagram showing an example of data stored in the management unit 32 according to the embodiment. FIG. 5 is a diagram showing an example of a check sheet according to an embodiment. FIG. 6 is a diagram showing an example of risk assessment according to an embodiment. FIG. 7 is a diagram showing a risk assessment support method according to an embodiment. FIG. 8 is a diagram showing a risk assessment support method according to an embodiment. FIG. 9 is a diagram showing a risk assessment support method according to an embodiment. FIG. 10 is a diagram showing a risk assessment support method according to the modified example 1. FIG. 11 is a diagram showing an example of a confirmation screen according to the second modification.

Hereinafter, embodiments will be described with reference to the drawings. In the description of the drawings below, the same or similar parts are designated by the same or similar reference numerals.

However, it should be noted that the drawings are schematic and the ratio of each dimension may differ from the actual one. Therefore, the specific dimensions should be determined in consideration of the following explanation. In addition, it goes without saying that there may be a portion where the relations or ratios of the dimensions of the drawings are different from each other.

[Summary of disclosure]
The risk assessment support system related to the outline of disclosure manages the correspondence between the first user entity and the first target entity, and manages the risk assessment related to the security measures of the first target entity in association with the first target entity. A management unit is provided, and a control unit that provides an updated risk assessment to the first user entity associated with the first target entity when the risk assessment is updated.

In the outline of the disclosure, the risk assessment support system is the first target when the risk assessment of the first target entity is updated under the premise that the correspondence between the first user entity and the first target entity is managed. Provides an updated risk assessment for the first user entity associated with the entity. According to such a configuration, the first user entity can easily acquire the latest version of the risk assessment, and the complexity of the user entity associated with the acquisition of the risk assessment can be reduced.

Here, the entity may be considered as a term referring to an individual, a corporation, an organization, or the like. An entity may be considered as a terminal used by an individual, a corporation, an organization, or the like. A user entity is an entity that requests a risk assessment of the target entity. The target entity is the entity that is the target of the risk assessment. For example, the target entity is an entity that has some relationship such as a transaction relationship or a capital relationship with the user entity. The target entity may include an entity that may have some relationship with the user entity in the future. The target entity may include an entity that provides the software or application used by the user entity.

[Embodiment]
(Risk assessment support system)
The risk assessment support system according to the embodiment will be described below. FIG. 1 is a diagram showing a risk assessment support system 100 according to an embodiment.

As shown in FIG. 1, the risk assessment support system 100 includes a first terminal 10, a second terminal 20, and a support server 30. The first terminal 10, the second terminal 20, and the support server 30 are connected by the network 110. Although not particularly limited, the network 110 may be configured by the Internet. The network 110 may include a local area network, a mobile communication network, or a VPN (Virtual Private Network).

The first terminal 10 is a terminal used by the user entity. A user entity is an entity that requests a risk assessment of the target entity. The user entity may be used as a term indicating the first terminal 10. For example, the first terminal 10 may be a personal computer, a smartphone, or a tablet terminal. In FIG. 1, the first terminal 10A and the first terminal 10B are exemplified. The first terminal 10A may be the terminal used by the first user entity. Hereinafter, the first user entity using the first terminal 10A may be referred to as “AAA”. The first terminal 10B may be a terminal used by the second user entity. In the following, the first user entity using the first terminal 10B may be referred to as “BBB”.

The first user entity is a user entity associated with the target entity in the support server 30. The second user entity is a user entity that is not associated with the target entity in the support server 30.

The second terminal 20 is a terminal used by the target entity. The target entity is the entity that is the target of the risk assessment. The target entity may include an entity that provides the software or application used by the user entity. The target entity may be used as a term indicating the second terminal 20. For example, the second terminal 20 may be a personal computer, a smartphone, or a tablet terminal. In FIG. 1, the second terminal 20A to the second terminal 20D are exemplified. The second terminal 20A to the second terminal 20C may be terminals used by the first target entity. In the following, the first target entity using the second terminal 20A to the second terminal 20C may be referred to as “aaa” to “ccc”. The second terminal 20D may be a terminal used by a target entity (may be referred to as a second target entity) other than the first target entity. The second target entity using the second terminal 20D may be referred to as "ddd".

The first target entity is a target entity associated with the target entity in the support server 30. The second target entity is a target entity that is not associated with the target entity in the support server 30.

The support server 30 is a server managed by an operator who supports the provision of risk assessment. The operator may be used as a term indicating the support server 30. The support server 30 is a server that manages a risk assessment regarding security measures of the target entity. The support server 30 provides the risk assessment of the target entity to the user entity. The provision of risk assessment includes a process of transmitting an information element indicating risk assessment to the first terminal 10. The details of the support server 30 will be described later.

(Support server)
Hereinafter, the support server according to the embodiment will be described. FIG. 2 is a diagram showing a support server 30 according to an embodiment. As shown in FIG. 2, the support server 30 has a communication unit 31, a management unit 32, and a control unit 33.

The communication unit 31 is composed of a communication module. The communication module may be a wireless communication module compliant with standards such as IEEE802.11a / b / g / n, ZigBee, Wi-SUN, LTE, and 5G, and a wired communication module compliant with standards such as IEEE802.3. May be.

For example, the communication unit 31 may transmit data managed by the management unit 32 (for example, risk assessment of the target entity) to the first terminal 10. The communication unit 31 may transmit a list of questions regarding security measures (hereinafter referred to as a checklist) to the second terminal 20. The communication unit 31 may receive an answer to the checklist from the second terminal 20.

The management unit 32 is composed of a storage medium such as a non-volatile memory, an HDD (Hard Disk Drive), an SSD (Solid State Drive), and a magnetic tape.

In the embodiment, the management unit 32 manages the correspondence between the first user entity and the first target entity. The management unit 32 manages the risk assessment related to the security measures of the first target entity in association with the first target entity.

For example, a case where the first user entity is "AAA" and the first target entity is "aaa", "bbb" and "ccc" will be illustrated.

First, as shown in FIG. 3, the management unit 32 manages (stores) the target entity and the risk assessment in association with each other. In addition to the target entity and the risk assessment, the management unit 32 is an information element indicating whether or not to permit the provision of the risk assessment to the second user entity different from the first user entity (permission (provided) in FIG. 3). May be managed. The information element for which permission (providing) is OK is an information element meaning that the first target entity regarding the provision of risk assessment has permission. The information element for which the permission (providing) is NG is an information element meaning that there is no permission of the first target entity regarding the provision of the risk assessment. For example, in FIG. 3, “aaa” and “bbb” permit the provision of risk assessment to user entities other than “AAA”, and “ccc” permits risk assessment to user entities other than “AAA”. The case where the provision of is not permitted is illustrated.

In the embodiment, it is premised that the provision of the risk assessment to the first user entity (“AAA”) is permitted. Therefore, in FIG. 3, the permission (providing) provides the risk assessment to the second user entity. It is an information element indicating whether or not to permit. However, the embodiments are not limited to this. The permission (providing) may be any information element that identifies the user entity to which the first target entity permits the provision of the risk assessment. For example, the permission (provision) may be an information element that specifies the user entity to which the first target entity permits the provision of the risk assessment, and the condition of the user entity to which the first target entity permits the provision of the risk assessment. It may be an information element to be specified. Although not particularly limited, the conditions of the user entity may include whether or not a contract is concluded with the operator, the credit risk of the user entity, the size of the user entity, and the like. The contract may include a contract that agrees to the terms of use. The contract may include an NDA (Non-Disclosure Agreement) contract.

Secondly, as shown in FIG. 4, the management unit 32 manages (stores) the correspondence between the user entity and the target entity. The management unit 32 is an information element indicating whether or not to permit the provision of the updated risk assessment to the first user entity in addition to the user entity and the target entity (permission (update) in FIG. 4). May be managed. The information element for which the permission (renewal) is OK is an information element meaning that the first target entity regarding the renewal of the risk assessment has permission. The information element for which the permission (renewal) is NG is an information element meaning that there is no permission of the first target entity regarding the renewal of the risk assessment. For example, in FIG. 4, “aaa” and “bbb” license to provide an updated risk assessment to “AAA” and “ccc” provides an updated risk assessment to “AAA”. The case where is not licensed is illustrated.

The control unit 33 may include at least one processor. At least one processor may be composed of a single integrated circuit or may be composed of a plurality of communicablely connected circuits (such as integrated circuits and / or discrete circuits).

For example, the control unit 33 acquires a risk assessment regarding the security measures of the target entity based on the information provided by the target entity. For example, the control unit 33 may acquire the risk assessment of “aaa” to “ccc” based on the information provided from “aaa” to “ccc”. The information provided by the target entity may be the target entity's response to the checklist.

Further, the control unit 33 may update the risk assessment based on the information provided by the first target entity. The information provided by the first target entity may be the response of the target entity to the checklist.

Here, the checklist contains a plurality of questions regarding security measures. As shown in FIG. 5, the question items may include S: a question item related to strategy, P: a question item related to people / organizations, O: a question item related to operation, and T: a question item related to technology. The checklist may be prepared by the operator.

The risk assessment may be obtained based on the answers to the checklist. As shown in FIG. 6, the name of the target entity and the risk assessment may be included. The risk assessment is a comprehensive risk assessment (“XX” in Fig. 6), a risk assessment related to confidentiality (C) (“PP” in Fig. 6), and a risk assessment related to completeness (I) (“QQ” in Fig. 6). ”) And risk assessment for availability (A) (“RR” in FIG. 6) may be included. “XX” is acquired based on “PP”, “QQ” and “RR”.

“XX”, “PP”, “QQ” and “RR” may be represented numerically. In such a case, "XX" may be the average value of "PP", "QQ" and "RR", and "XX" is the total value of "PP", "QQ" and "RR". May be. “PP”, “QQ” and “RR” may be weighted by different coefficients.

Alternatively, at least one of "XX", "PP", "QQ" and "RR" may be represented by an index such as an abstract level or rank.

Here, the risk assessment may be an absolute assessment acquired independently of the risk assessment of other entities, or a relative assessment acquired in consideration of the relationship with the risk assessment of other entities. There may be.

The risk assessment may be an assessment that conforms to a standard such as the ISO27000 series (for example, ISO27001), or may be an assessment that the operator independently performs.

Under such a background, the control unit 33 provides the first user entity with a risk assessment of the first target entity managed by the management unit 32. When the risk assessment of the first target entity is updated, the control unit 33 provides the updated risk assessment to the first user entity associated with the first target entity. The control unit 33 may provide the updated risk assessment with the permission of the first target entity regarding the update of the risk assessment.

For example, taking the case shown in FIG. 4 as an example, when the risk assessments of “aaa” and “bbb” are updated, the control unit 33 provides the updated risk assessment to “AAA”. On the other hand, when the risk assessment of "ccc" is updated, the control unit 33 does not provide the updated risk assessment to "AAA". In addition, "ccc" may permit the provision of the updated risk assessment to the user entity other than "AAA".

Further, the control unit 33 may provide the second user entity with the risk assessment managed by the management unit 32 when the second user entity requests the acquisition of the risk assessment of the first target entity. The control unit 33 may provide the risk assessment managed by the management unit 32 when the permission of the first target entity regarding the provision of the risk assessment is obtained.

For example, taking the case shown in FIG. 3 as an example, when the risk assessment of “aaa” and “bbb” is requested by “BBB”, the control unit 33 performs the risk assessment of “aaa” and “bbb”. Provide to "BBB". On the other hand, when the risk assessment of "ccc" is requested by "BBB", the control unit 33 does not provide the risk assessment of "ccc" to "BBB".

(Risk assessment support method)
The risk assessment support method according to the embodiment will be described below. 7 to 9 are diagrams showing a risk assessment support method according to an embodiment. Here, the case where the user entity is "AAA" and "BBB" and the target entity is "aaa", "bbb" and "ccc" will be illustrated.

First, a case where the user entity acquires the risk assessment of the target entity will be described with reference to FIG. 7. FIG. 7 is a sequence diagram showing the acquisition of a risk assessment.

In the initial stage of the sequence shown in FIG. 7, “AAA” may be considered to be the second user entity because it is not associated with the target entity in the support server 30. Similarly, “aaa”, “bbb” and “ccc” may be considered as the second target entity because they are not associated with the user entity in the support server 30.

As shown in FIG. 7, in step S10, the support server 30 (operator) concludes a contract with the first terminal 10A (user entity “AAA”). For example, the contract may include a contract that agrees to the terms of use.

In step S20, the first terminal 10A transmits an evaluation request for risk assessment of the target entity to the support server 30. The evaluation request includes at least an information element that specifies the target entity (for example, “aaa” to “ccc”).

In step S21, the support server 30 determines whether or not the risk assessment of the target entity specified by the evaluation request is already managed. Here, the explanation is continued assuming that the risk assessment of the target entity is not managed.

In step S22, the support server 30 (operator) concludes a contract with the second terminal 20 (target entities “aaa” to “ccc”). The target entity may be the target for which risk assessment was requested in step S20. For example, the contract may include a contract that agrees to the terms of use. The contract may include the license (offer) shown in FIG. 3 or the license (renewal) shown in FIG.

In step S30, the support server 30 transmits the checklist to the second terminal 20. As mentioned above, the checklist contains multiple questions regarding security measures (see Figure 5).

In step S31, the support server 30 receives the response to the checklist from the second terminal 20.

In step S32, the support server 30 confirms whether or not the answer to the checklist is incomplete. If the answer to the checklist is incomplete, the support server 30 sends a correction request for the answer to the checklist to the second terminal 20 (step S33), and receives the correction answer to the correction request from the terminal 20 (step). S34). Steps S33 and S34 are executed until the deficiencies in the answers to the checklist are resolved. If the answers to the checklist are correct, the processes of steps S33 and S34 are omitted.

In step S35, the support server 30 transmits a risk assessment to the first terminal 10A. The risk assessment is acquired based on the information (answer to the checklist) received from the second terminal 20.

As a result of the operation shown in FIG. 7, the support server 30 manages the correspondence between “AAA” and “aaa” to “ccc”. In other words, the support server 30 manages the risk assessment of the first target entity (“aaa” to “ccc”), and also manages the first user entity (“AAA”) and the first target entity (“aaa” to “ccc”). Manage the correspondence with "). According to the operation shown in FIG. 7, the support server 30 can acquire the risk assessment of the target entity on behalf of the user entity and then provide the risk assessment of the target entity to the user entity.

Second, a case where the second user entity acquires the risk assessment managed by the support server 30 will be described with reference to FIG.

As an initial stage of the sequence shown in FIG. 8, a case where the correspondence between the first user entity (“AAA”) and the first target entity (“aaa” to “ccc”) is already managed will be described. Further, "BBB" is a second user entity because it is not associated with the target entity in the support server 30.

FIG. 8 describes a case where the support server 30 (operator) has already concluded a contract with the second terminal 20 (target entity) in step S40.

As shown in FIG. 8, in step S51, the support server 30 (operator) concludes a contract with the first terminal 10B (second user entity “BBB”). For example, the contract may include a contract that agrees to the terms of use.

In step S52, the first terminal 10B transmits an evaluation request for risk assessment managed by the support server 30 to the support server 30. Here, the evaluation request includes an information element that specifies the first target entity (for example, “aaa” to “ccc”) managed by the support server 30.

In step S53, the support server 30 determines whether or not the first target entity has permission to provide the risk assessment. When the permission of the first target entity is obtained, the support server 30 transmits the risk assessment managed by the support server 30 to the first terminal 10B (step S54).

For example, taking the case shown in FIG. 3 as an example, when a risk assessment of “aaa” or “bbb” is requested, the support server 30 performs a risk assessment of “aaa” or “bbb” as the first terminal. Send to 10B. On the other hand, when the risk assessment of "ccc" is requested, the support server 30 does not transmit the risk assessment of "ccc" to the first terminal 10B. In such a case, the support server 30 may send a message to the first terminal 10B indicating that the risk assessment cannot be provided.

As a result of the operation shown in FIG. 8, the support server 30 manages the correspondence between “BBB” and “aaa” or “bbb”. In other words, the support server 30 may treat "BBB" as the first user entity in relation to "aaa" or "bbb". However, in relation to "ccc", "BBB" remains the second user entity.

FIG. 8 illustrates a case where the permission (providing) of the first target entity is registered in the support server 30 in advance, but the embodiment is not limited to this. For example, when the support server 30 receives the risk assessment evaluation request from the first terminal 10B (second user entity), the support server 30 inquires whether to allow the second user entity to provide the risk assessment. May be transmitted to the second terminal 20 (first target entity). The support server 30 may determine whether or not the first target entity has permission to provide the risk assessment based on the response message to the inquiry message.

Third, a case where the risk assessment managed by the support server 30 is updated will be described with reference to FIG.

As an initial stage of the sequence shown in FIG. 9, a case where the correspondence between the first user entity (“AAA”) and the first target entity (“aaa” to “ccc”) is already managed will be described. Further, in relation to "aaa" or "bbb", a case where "BBB" is treated as the first target entity will be described.

As shown in FIG. 9, in step S60, the support server 30 receives the update information from the second terminal 20 (for example, the first target entities “aaa” to “ccc”). The update information may be the update information of the response to the above-mentioned checklist. The updated information may include answers to questions that have not yet been answered, or may include new answers to questions that have already been answered.

In step S61, the support server 30 updates the risk assessment based on the update information.

In step S62, the support server 30 determines whether the updated risk assessment can be provided to the first user entity (“AAA” or “BBB”).

For example, the support server 30 may determine that the support server 30 can provide an updated risk assessment for the first user entity associated with the first target entity. The support server 30 may determine that the support server 30 cannot provide the updated risk assessment to the second user entity that is not associated with the first target entity. When the support server 30 determines that the updated risk assessment can be provided, the support server 30 transmits the updated risk assessment to the first terminal 10.

Alternatively, the support server 30 determines whether or not there is permission of the first target entity regarding the update of the risk assessment. If the permission of the first target entity is obtained, the support server 30 transmits the updated risk assessment to the first terminal 10A (step S63A). Similarly, if the permission of the first target entity is obtained, the support server 30 transmits the updated risk assessment to the first terminal 10B (step S63B).

For example, taking the case shown in FIG. 4 as an example, when the risk assessment of “aaa” or “bbb” is updated, the support server 30 performs the risk assessment of “aaa” or “bbb” as the first terminal. Send to 10A. On the other hand, when the risk assessment of "ccc" is updated, the support server 30 does not transmit the risk assessment of "ccc" to the first terminal 10A. In such a case, the support server 30 may send a message to the first terminal 10A indicating that the risk assessment cannot be provided.

Note that FIG. 4 does not illustrate the case where "BBB" is treated as the first user entity in relation to "aaa" or "bbb". If "aaa" or "bbb" grants permission to update the risk assessment to "BBB" as well as "AAA", the support server 30 will give the risk assessment of "aaa" or "bbb" first. It may be transmitted to the terminal 10B. However, since "BBB" remains the second user entity in relation to "ccc", even if the risk assessment of "ccc" is updated, the processing for the first terminal 10B does not have to be executed in particular.

FIG. 9 illustrates a case where the permission (update) of the first target entity is registered in the support server 30 in advance, but the embodiment is not limited to this. For example, the support server 30 may send an inquiry message asking whether or not to allow the first user entity to provide the updated risk assessment to the second terminal 20 (first target entity). The support server 30 may determine whether or not there is permission of the first target entity regarding the update of the risk assessment based on the response message to the inquiry message.

(Action and effect)
In the embodiment, the support server 30 provides the risk assessment of the target entity to the user entity in response to the risk assessment acquisition request. In other words, the support server 30 acts on behalf of acquiring the risk assessment of the target entity. According to such a configuration, it is possible to reduce the complexity of the user entity associated with the acquisition of the risk assessment.

In the embodiment, the support server 30 and the first target entity and the first target entity when the risk assessment of the first target entity is updated under the premise that the correspondence between the first user entity and the first target entity is managed. Provides an updated risk assessment for the associated first user entity. According to such a configuration, the first user entity can easily acquire the latest version of the risk assessment, and the complexity of the user entity associated with the acquisition of the risk assessment can be reduced.

In the embodiment, the support server 30 provides an updated risk assessment for the first user entity associated with the first target entity. Further, the support server 30 may provide the updated risk assessment if there is permission to update the risk assessment. With such a configuration, it is possible to suppress the situation where the updated risk assessment is provided indefinitely, and it is possible to suppress the provision of the risk assessment that the first target entity does not want.

In the embodiment, the support server 30 may provide the second user entity with the risk assessment managed by the management unit 32 when the second user entity requests the acquisition of the risk assessment of the target entity. According to such a configuration, it is possible to reduce the load on the support server 30 (operator) that acquires the risk assessment of the target entity again.

In the embodiment, the support server 30 may provide the risk assessment managed by the management unit 32 when there is permission to provide the risk assessment. With such a configuration, it is possible to suppress the situation where the updated risk assessment is provided indefinitely, and it is possible to suppress the provision of the risk assessment that the first target entity does not want.

In the embodiment, the risk assessment of the target entity may be acquired based on the information provided by the target entity. It should be noted that in such cases, it is extremely important for the target entity to control the situation where the risk assessment of the target entity is provided indefinitely.

[Change example 1]
Hereinafter, modification 1 of the embodiment will be described. In the following, the differences from the embodiments will be mainly described.

In the embodiment, the support server 30 acquires a risk assessment regarding the security measures of the target entity based on the information provided by the target entity (for example, the answer to the checklist). On the other hand, in the change example 1, the support server 30 acquires a risk assessment regarding the security measures of the target entity based on the information disclosed about the target entity. Although not particularly limited, the information disclosed about the target entity may include information acquired by means such as the Internet, or may include information acquired by means such as publications such as magazines and books. good. For example, the information published about the subject entity may be information obtained from the subject entity's website or may include information about the software or application provided by the subject entity. The information disclosed about the target entity may be any information other than the confidential information specified by the target entity to be kept secret.

(Risk assessment support method)
The risk assessment support method according to the change example 1 will be described below. FIG. 10 is a diagram showing a risk assessment support method according to the modified example 1. Here, in the sequence shown in FIG. 7, a case where the target entity rejects the answer to the checklist will be described. In FIG. 10, since the same step numbers are assigned to the same processes as those in FIG. 7, the description of the same processes as in FIG. 7 will be omitted.

As shown in FIG. 10, in step S71, the support server 30 receives a message from the second terminal 20 that refuses to answer the checklist.

In step S72, the support server 30 acquires a risk assessment regarding the security measures of the target entity based on the information disclosed about the target entity.

In step S73, the support server 30 transmits the risk assessment acquired in step S72 to the first terminal 10A.

As in FIG. 7, as a result of the operation shown in FIG. 10, the support server 30 manages the correspondence between “AAA” and “aaa” to “ccc”. In other words, the support server 30 manages the risk assessment of the first target entity (“aaa” to “ccc”), and also manages the first user entity (“AAA”) and the first target entity (“aaa” to “ccc”). Manage the correspondence with "). As a result of the operation shown in FIG. 7, the support server 30 can provide the risk assessment of the target entity to the user entity.

Here, it is considered that the permission of the first target entity regarding the provision and renewal is not required for the risk assessment acquired based on the information disclosed about the target entity. Therefore, the support server 30 may provide the risk assessment of the first target entity to the second user entity without requiring the permission of the first target entity, and provide the updated risk assessment to the first user entity. You may.

[Change example 2]
Hereinafter, modification 2 of the embodiment will be described. In the following, the differences from the embodiments will be mainly described.

In the embodiment, the risk assessment is acquired for each target entity, but in the second modification, when the target entity provides two or more services, the risk assessment is acquired for each service provided by the target entity. Further, in the second modification, a screen (confirmation screen) in which the target entity confirms the response status to the checklist will be described. In such a case, the support server 30 manages the data for displaying the confirmation screen, and may transmit the data for displaying the confirmation screen to the second terminal 20.

Here, the case where the target entity is “aaa” and the service provided by “aaa” is “PPP” to “RRR” is illustrated. The service may include, but is not limited to, software or applications that may be used by the user entity. The service may be provided in the form of a cloud service or SaaS (Service as a Software).

As shown in FIG. 11, the confirmation screen may include a user entity, a service, a progress, a status, and a respondent.

The user entity is an item indicating the entity requesting the acquisition of the risk assessment of “aaa”. As shown in FIG. 11, the same user entity (eg AAA) may request the acquisition of risk assessments for different services.

The service is an item indicating the service provided by "aaa". In FIG. 11, “PPP” to “RRR” are exemplified as services.

The progress status is an item indicating the progress of the response to the checklist. For example, progress may be represented by the ratio of the total number of questions included in the checklist to the number of questions answered.

The status is an item indicating the status of the answer to the checklist. The status may include "answering", "answering confirmation", "answered", "rejected", and the like. “Responding” means that the checklist is being answered in “aaa”. "Checking for answer" means that the support server 30 (operator) is in the process of confirming the answer of "aaa" to the checklist. “Responded” means that both the response of “aaa” to the checklist and the confirmation of the support server 30 have been completed. “Reject” means that “aaa” rejected the answer to the checklist.

Respondent is an item indicating a respondent who creates or inputs an answer to a checklist. The respondent may be one respondent or two or more respondents.

As described above, the target entity responds to the checklist in relation to the user entity and the service. The answer to the checklist is used to acquire the risk assessment on the support server 30. In other words, the target entity can decide whether to provide a risk assessment (whether to respond to the checklist) in relation to the user entity and the service, and can check the response status to the checklist. can.

Under such a background, the confirmation screen viewed by the target entity is generated based on the data managed by the support server 30. Therefore, the support server 30 manages the data for specifying the correspondence relationship shown in FIG. That is, the support server 30 manages the response status to the checklist for the combination of the user entity, the target entity, and the service. Further, the support server 30 may manage the risk assessment of the service for the combination of the user entity, the target entity, and the service. Further, the support server 30 may manage the permission (providing) shown in FIG. 3 or the permission (update) shown in FIG. 4 for the combination of the user entity, the target entity, and the service.

[Other embodiments]
Although the invention has been described by embodiments described above, the statements and drawings that form part of this disclosure should not be understood to limit the invention. This disclosure will reveal to those skilled in the art various alternative embodiments, examples and operational techniques.

In the embodiment, the case where the permission of the target entity regarding the provision of the risk assessment is obtained at the stage of concluding the contract with the target entity is illustrated. However, the embodiments are not limited to this. The support server 30 may inquire of the target entity for permission to provide the risk assessment in response to a predetermined trigger. The predetermined trigger may be requested by the second user entity to provide a risk assessment.

In the embodiment, the case where the permission of the target entity regarding the renewal of the risk assessment is obtained at the stage of concluding the contract with the target entity is illustrated. However, the embodiments are not limited to this. The support server 30 may inquire of the target entity for permission regarding the update of the risk assessment in response to a predetermined trigger. The predetermined trigger may be that the risk assessment of the target entity is updated.

In the embodiment, the case where the user entity "AAA" is treated as the first user entity in relation to the target entities "aaa" to "ccc" has been exemplified. However, the embodiments are not limited to this. The user entity "AAA" may be treated as a second user entity in relation to the target entity "ddd". That is, the terms of the first user entity and the second user entity may be determined depending on whether or not the correspondence between the user entity and the target entity is managed in the support server 30.

Although not particularly mentioned in the embodiment, the support server 30 may autonomously provide the updated risk assessment to the first user entity when the risk assessment of the first target entity is updated. Alternatively, the support server 30 notifies the first user entity that the risk assessment of the first target entity has been updated, and updates the risk assessment when requested by the first user entity. The risk assessment given may be provided to the first user entity.

Although not specifically mentioned in the embodiment, the risk assessment of the target entity may be updated based on the information published about the target entity.

Although not particularly mentioned in the embodiment, the function of the support server 30 may be provided in the form of a cloud service or SaaS (Service as a Software).

In the embodiment, the risk assessment support system 100 illustrates a case including the first terminal 10 and the second terminal 20. However, the embodiments are not limited to this. The risk assessment support system 100 may include the support server 30 without including the first terminal 10 and the second terminal 20.

10 ... 1st terminal, 20 ... 2nd terminal, 30 ... support server, 31 ... communication unit, 32 ... management unit, 33 ... control unit, 100 ... risk assessment support system, 110 ... network

Claims (7)

A management unit that manages the correspondence between the first user entity and the first target entity, and manages the risk assessment related to the security measures of the first target entity in association with the first target entity.
A risk assessment support system comprising a control unit that provides an updated risk assessment to the first user entity associated with the first target entity when the risk assessment is updated. The risk assessment support system according to claim 1, wherein the control unit provides the updated risk assessment when the first target entity has permission to update the risk assessment. The risk assessment support system according to claim 1 or 2, wherein the control unit updates the risk assessment based on the information provided by the first target entity. Claims 1 to 3 that the control unit provides the second user entity with the risk assessment managed by the management unit when the acquisition of the risk assessment is requested by the second user entity. The risk assessment support system described in any one of the above. The risk assessment support system according to claim 4, wherein the control unit provides the risk assessment managed by the management unit when the first target entity has permission to provide the risk assessment. The risk assessment support system according to any one of claims 1 to 5, wherein the control unit acquires a risk assessment regarding security measures of the target entity based on the information provided by the target entity. The risk assessment support system according to any one of claims 1 to 5, wherein the control unit acquires a risk assessment regarding security measures of the target entity based on the information disclosed about the target entity.

Images