JP3872689B2 - Security policy creation support system and security measure decision support system - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
The present invention relates to a system that supports creation of a security policy for an information system, and more particularly, to a system that supports creation of a security policy based on past case data.
[0002]
[Prior art]
Traditionally, the methods and procedures for formulating information security policies include those recommended and recommended by international standards such as ISO / IEC TR 13335 (GMITS: Guidelines for the management of IT Security) and ISO / IEC 17799 (BS7799). There is a procedure. In this method / procedure, each step of (1) Determining the scope and scope of application, (2) Defining information assets, (3) Extracting threats, (4) Risk assessment, (5) Formulating policies (measures) Are carried out in this order exactly. In addition, there is ISO / IEC 15408 (CC: Common Criteria) as an international standard for the design and evaluation of security functions of information technology products and information systems. The procedures are the same as ISO / IEC TR 13335 and ISO / IEC 17799 described above. Recommended security design. In this method / procedure, first, the uniqueness of the target information system is defined, and the threats specific to the target system are identified based on the definition, whereby the countermeasures specific to the target system can be formulated. In other words, this technique / procedure is effective for formulating a security policy or security measures suitable for the target information system.
[0003]
Further, as a simple policy formulation method, there is a method using a security policy creation example, for example, Japanese Patent Laid-Open No. 2001-101135 “Security evaluation method and device, security measure creation support method and device”. In this prior art document, policy cases for each information device type are stored in a database in advance, and the policy for the entire target system is formulated by combining the policy cases for each component device according to the target system configuration. It is.
[0004]
[Problems to be solved by the invention]
However, in implementing security policy formulation methods and procedures recommended in the aforementioned international standards, in addition to advanced specialized knowledge and technology such as risk analysis, a wealth of knowledge of threats and countermeasures and to which threats Security know-how such as which measures are effective is required. For this reason, there is a problem that it cannot be implemented unless a limited number of specialists spend time and cost.
[0005]
On the other hand, the method of the prior art document described above has a database of know-how for deriving security policies from components, but it is applied to information systems with low uniqueness of each component such as Internet connection systems. The range is limited.
[0006]
SUMMARY OF THE INVENTION Accordingly, an object of the present invention is to provide a system for assisting even a person who does not have know-how to determine security measures suitable for a target information system or to create a security policy. And
[0007]
Another object of the present invention is to provide a system for providing know-how for creating a security policy and charging for the know-how.
[0008]
Another objective is to collect security policy creation case data and efficiently accumulate know-how.
[0009]
[Means for Solving the Problems]
According to the security policy creation support system according to one aspect of the present invention, the first storage means for storing the information asset constituting the information system and the keyword related to the information asset in association with each other, the information asset Second storage means for storing the threat to which the threat is exposed, the keyword related to the threat in association with each other, the third storage for storing the countermeasure for the threat and the keyword related to the countermeasure in association with each other Means, receiving means for accepting an input of a keyword related to an information system for which a security policy is to be created, extracting means for extracting information assets, threats, and countermeasures based on the keyword accepted by the accepting means, and the extracting means Display means for displaying the extraction results of
[0010]
According to a security policy creation support system according to another aspect of the present invention, a storage means for storing a relationship between an information asset constituting the information system, a threat to which the information asset is exposed, a security policy creation target, Asset determination means for determining information assets included in the information system, extraction means for extracting threat candidates for the information assets determined by the asset determination means, and display means for displaying the extraction results by the extraction means Prepare.
[0011]
According to a security measure determination support system according to another aspect of the present invention, a storage unit that stores a relationship between a threat to which an information system is exposed and a measure against the threat, and an information system that is a target for determining a measure related to security A threat determining unit that determines a threat to which the threat is exposed; an extracting unit that extracts a candidate for countermeasures against the threat determined by the threat determining unit; and a display unit that displays an extraction result by the extracting unit.
[0012]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described with reference to the drawings.
[0013]
FIG. 1 is a diagram showing an overall configuration of a security policy creation support system according to the first embodiment to which the present invention is applied. This system includes a security policy creation support device (hereinafter referred to as support device) 11 that supports creation of a security policy, and a know-how management device 12 that manages know-how used when creating the security policy. The know-how management device 12 manages the know-how database 13 holding know-how used when creating a security policy, the case database 15 consisting of a plurality of security policy creation case data, and the user information of the know-how database 13 A user database 16.
[0014]
A detailed configuration of the support device 11 is shown in FIG. The support device 11 can be configured by a general-purpose personal computer or the like. For example, the support device 11 includes a CPU 21, an input / output control unit 22, a bus 23, an external storage device 24, a main storage device (memory) 25, a display 26 and a keyboard connected to the terminal input / output control unit 22. 27 and a network control unit 28 for controlling a network line between other devices.
[0015]
The external storage device 24 stores a security policy creation support program 241 and a communication processing program 242. When the CPU 21 reads and executes the creation support program 241 and the communication processing program 242, the following processing units 2501 to 258 are realized. That is, on the CPU 21, a keyword input processing unit 251 of a target system for creating a security policy, and a data group related to policy creation of information assets, threats, countermeasures, and the like based on the keywords of the target system (hereinafter referred to as case data). ), A template creation processing unit 252 that creates a template, an information asset definition processing unit 253 that supports the definition of information assets, and a threat extraction / support that identifies threats to information assets and supports the determination of threats to be taken. To communicate via the network line with the decision processing unit 254, the risk / cost management processing unit 255 that evaluates risks and costs required for countermeasures, and the measure planning / decision processing unit 256 that supports decision of measures against threats Communication processing unit 258.
[0016]
A detailed configuration of the know-how management apparatus 12 is shown in FIG. The know-how management device 12 can be composed of a general-purpose personal computer or the like. For example, the know-how management device 12 includes a CPU 31, an input / output control unit 32, a bus 33, an external storage device 34, a main storage device (memory) 35, a display 36 connected to the terminal input / output control unit 32, and A keyboard 37 and a network control unit 38 for controlling a network line between other devices are provided.
[0017]
The external storage device 34 includes a database management program 341 for managing a know-how database, a communication control processing program 342 for performing communication via a network line, case data 343 constituting a case database, and a know-how database. Know-how data 344, user data 345 constituting a user management database, a billing processing program 346, and a priority calculation processing program 347 are stored. The CPU 31 reads and executes the database management program 341, the communication processing program 242, the accounting processing program 346, and the priority calculation processing program 347, thereby realizing the following processing units 351 to 356. That is, on the CPU 31, a communication processing unit 351, a database search processing unit 352, a database update processing unit 353, a know-how user identification / authentication processing unit 354, a charging processing unit 355, and a priority calculation processing unit 356. With.
[0018]
Next, data items of the know-how database 13 are shown in FIGS. The know-how database 13 includes element data 131, inter-element link data 132, performance data 133 and 134, and keyword data 135.
[0019]
Element data 131 defines elements necessary for creating a security policy. The element data includes information 41 regarding the type of information asset (hereinafter simply referred to as asset) held by the target system, information 42 regarding the type of threat to which the target system is exposed, and the type of countermeasures against the threat. Information 43, definition information 44 that defines a threat type, and definition information 45 that defines a countermeasure type are included.
[0020]
The asset type information 41 includes an asset ID 411 for identifying the asset, an asset classification item 412, an information asset name 413, an asset location 414, and an asset form 415.
[0021]
The threat-related information 42 includes a threat ID 421 for identifying a threat, a threat type ID 422 for identifying a threat type, an attacker or threat factor 423, an attack method 424, and a reference risk 425. Including. The reference risk 425 indicates the degree of threat (the degree of loss when the threat occurs), and is an index for comparison with other threats. For example, the reference risk 425 can be obtained by multiplying the amount of loss expected when a threat occurs and the probability that the threat will occur. The reference risk 425 can be updated at any time.
[0022]
The information 43 related to the type of countermeasure against the threat includes a countermeasure ID 431 for identifying the countermeasure, a countermeasure type ID 432 for identifying the countermeasure type, a countermeasure content 433, a reference cost 434, and a reference reduction effect 435. Including. The reference cost 434 is a cost required to implement the countermeasure. The reference reduction effect 435 is a reduction effect of the reference risk 425 that can be expected by implementing the countermeasure, and is an index for comparison with other countermeasures. The reference cost 434 and the reference reduction effect 435 can be updated at any time.
[0023]
The definition information 44 that defines the threat type associates the threat type ID 441 with the threat type 442.
[0024]
The definition information 45 that defines the type of countermeasure associates the countermeasure type ID 451 with the countermeasure type 452.
[0025]
Inter-element link data 132 defines an association between elements. Specifically, the inter-element link data 132 includes a threat-asset link 47 that associates an asset with a threat that may occur against the asset, and a countermeasure-threat link 48 that associates a threat with a countermeasure against the threat. including.
[0026]
The threat-asset link 47 associates a threat-asset link ID 471, a threat ID 421, and an asset ID 411 with each other.
[0027]
The countermeasure-threat link 48 associates a countermeasure-threat link ID 481, a countermeasure ID 431, and a threat ID 421, respectively.
[0028]
As the keyword data 135, data that can be used as keywords representing the characteristics of the system to which the security policy is applied is registered. The keywords include, for example, the type of business (for example, finance, securities, government offices, etc.), system type (for example, Internet connection system, remote access system, ATM system, etc.), department type (for example, company-wide, human resources department, development department, etc.). In the keyword data 135, a keyword ID 561, a keyword 562, and an upper keyword 563 are associated with each other. When the keywords have a hierarchical relationship, the ID of the keyword that is higher than the keyword 562 is registered in the upper keyword 563.
[0029]
The actual data 133 and 134 include element data actual data 133 and inter-element link data actual data 134, and indicate the number of times the element data 131 or the inter-element link data 132 has been used to create the security policy. . Furthermore, the element performance data 133 and the inter-element link performance data 134 associate element data or inter-element link data with a keyword.
[0030]
The element data actual data 133 includes asset actual data 51, threat actual data 52, and countermeasure actual data 53. The inter-element link performance data 134 includes threat-asset link performance data 54 and countermeasure-threat link threat performance data 55.
[0031]
The asset performance data 51 includes an asset ID 411, a total number 512 of use of the asset, and an ID 516 of a registrant who registered the asset. Furthermore, the asset performance data 51 includes a plurality of combinations of the keyword 513 associated with the asset ID 411 and the number of times of use 514 of the keyword. The total number used 512 is the total number of assets used when creating the security policy. The usage count 514 for each keyword indicates the number of times the asset has been used based on the keyword.
[0032]
The threat actual data 52, the countermeasure actual data 53, the threat-asset link actual data 54, and the countermeasure-threat link actual data 55 have the same structure.
[0033]
Next, FIG. 6 shows data items that the case database 15 has. The case database 15 is a database in which data related to cases in which the system has created a security policy is accumulated. The case database 15 includes case data 61 of a security policy creation target system, case data 62, 63, and 64 of element data, and case data 65 and 66 of inter-element link data.
[0034]
The case data 61 of the security policy creation target system includes a case ID 601, a keyword 602, and a creator ID 603 of the target case. Here, four keywords 602 can be registered. The creator ID 603 is the ID of the person who created and registered the case.
[0035]
The case data of the element data includes asset case data 62, threat case data 63, and countermeasure case data 64.
[0036]
The asset case data 62 includes an asset case ID 621, a specific asset name 622, an asset ID 411, a classification item 412, an information asset name 413, an existence location 414, and an asset form 415.
[0037]
The threat case data 63 includes a threat case ID 631, a specific threat description 632, a setting risk 633, a threat ID 421, a threat type 422, an attacker / factor 423, and an attack method 424.
[0038]
The countermeasure case data 64 includes a countermeasure case ID 641, a specific countermeasure description 642, a setting cost 643, a risk reduction effect 644, a countermeasure ID 431, a countermeasure type ID 432, and countermeasure contents 433.
[0039]
The case data of the inter-element link data includes case data 65 of the threat-asset link and case data 66 of the countermeasure-threat link.
[0040]
The threat-asset link case data 65 includes a threat-asset case link ID 651, a threat case ID 631, an asset case ID 621, and a threat-asset link ID 471.
[0041]
The countermeasure-threat link example data 66 includes a countermeasure-threat case link ID 661, a countermeasure case ID 641, a threat case ID 631, and a countermeasure-threat link ID 481.
[0042]
Next, data items in the user database 16 are shown in FIG. The user database 16 includes a user ID 711, a password 712 for authenticating the user, detailed user information 713 such as a user name and company name, a total charge 714, a policy case data creation count 715, It includes a policy case data provision count 716 and a total usage count 717 of each policy case data.
[0043]
Next, a processing procedure when creating a new security policy will be described.
[0044]
FIG. 9 is a flowchart showing a standard security policy creation procedure. The security policy is created by the support device 11 and the know-how management device 12, respectively. The security policy application target is determined 911, the information asset is defined to be protected 912, the threat is extracted from the defined information asset 913, Risk evaluation 914 for threats and countermeasure planning 915 are performed in this order.
[0045]
First, an example of a menu screen displayed by the policy creation support program 241 is shown in FIG. Here, when the determination button 1801 to be applied is pressed, processing in steps S922 and S923 described later is executed. When the information asset definition button 1802 is pressed, a process of step S924 described later is executed. When the threat extraction & risk evaluation button 1803 is pressed, steps S925 and S926 described later are executed. When the countermeasure planning button 1804 is pressed, step S927 described later is executed. When the user determines that the creation of the security policy is completed and the completion button 1806 is pressed, processing of step S928 described later is executed. The
[0046]
(Decision 911 of security policy application target)
First, the user logs into the support apparatus 11. For example, the user login may use a login 220 screen including a user ID 2201 for identifying a user and a password input area 2202 as shown in FIG. The support apparatus 11 notifies the know-how management apparatus 12 of the received user ID and password (S921).
[0047]
The know-how user identification / authentication processing unit 354 of the know-how management device 12 determines whether or not the user can use the information by comparing the notified user ID and password with the registered contents of the user database 16. In the case of a registered user, the keyword list registered in the keyword data 135 of the know-how database 13 is transmitted (S931).
[0048]
The keyword input processing unit 251 of the target system of the support apparatus 11 displays the keyword information input screen 100 to which the security policy is applied shown in FIG. 10 and receives input of keywords and the like from the user. The keyword can be selected and input from the new addition 101 or can be selected from the received keyword list 102. After the input is completed, the keyword is transmitted to the know-how management apparatus 12 (S922).
[0049]
The database search / data acquisition processing unit 352 of the know-how management apparatus 12 creates a security policy template based on the received keyword and transmits it to the support apparatus 11 (S932). The detailed processing procedure for creating a template is shown in FIG.
[0050]
That is, the database search / data acquisition processing unit 352 extracts the keywords registered in the keyword data 135 from the received keywords, and creates a keyword list (S1901). Further, the database search / data acquisition processing unit 352 extracts the upper keyword 563 of each keyword included in the keyword list (S1902). Then, 133 is searched to extract assets, threats, countermeasures, and threat-asset links and countermeasure-threat links associated with each keyword in the keyword list (S1903). Finally, the inter-element link data 132 is referred to, and only the associated assets, threats, and countermeasures are left, and a security policy template is created (S1904). In addition, as a specific process of step S1903, you may extract what is used at least once with respect to the related keyword, or it is used more than the preset use number (for example, 10 times). You may extract what is.
[0051]
The policy data template creation processing unit 252 of the support apparatus 11 stores the received template data including information assets, threats, countermeasures, threat-asset links, countermeasure-threat links in the case database 15. However, in the case of template data, the case ID (621, 631, 641, 651, 661) and the specific description (622, 632, 642, 652, 662) are blank, and the setting risk 633 and the setting cost 643 are respectively set. A standard risk 425 and a standard cost 434 are set. The subsequent processing is performed based on this template data.
[0052]
(Definition of assets 912)
The information asset definition processing unit 253 of the support apparatus 11 displays an asset template list as an initial state on the asset definition screen 110 shown in FIG. The user uses this screen 110 to add / edit / delete assets based on the template (S924).
[0053]
The asset definition screen 110 has an extracted asset classification item 1101, a general name 1102, a unique name 1103, a location where the asset is located, and a display area of a form 1104, and further displays the assets included in the template An add / edit button 1105 for adding and editing and a delete button 1106 for deleting are provided. When the add / edit button 1105 is pressed, an add / edit screen 120 shown in FIG. 12 is displayed. On the add / edit screen 120, new assets that are not included in the template can be added. The add / edit screen 120 includes input fields such as a classification item 1201, an asset general name 1202, an asset unique name 1204, and a location / form 1205.
[0054]
The information asset definition processing unit 253 of the support device 11 requests an asset list from the know-how management device 12, and the database search / data acquisition processing unit 352 of the know-how management device 12 receives the information asset list including the actual data. Send to. The information asset definition processing unit 253 displays the received asset list as options in the input area of the classification item 1201, the asset general name 1202, and the location / form 1205. Here, the general name 1202 determines the asset selection priority 1203 based on the number of times the asset name has been used so far, and displays the list in order of priority. For example, the priority 1203 increases as the number of uses increases. Specifically, (a) priorities are assigned in descending order of the total number of uses, (b) assets related to keywords but not adopted as templates are prioritized in order of use, and assets not related to keywords are assigned. There is a method of prioritizing in order of the total number of uses.
[0055]
This system supports asset definition by the user using the screen as described above.
[0056]
(Threat Extraction 913)
When the user finishes defining the asset, the system assists the user in defining the threat. That is, the threat extraction / determination processing unit 254 of the support apparatus 11 presents a threat template list to the user on the threat extraction / risk evaluation screen 130 shown in FIG. Based on the threat template shown here, the user adds, edits, and deletes a threat (S925). The threat extraction / risk evaluation screen 130 is a screen for extracting and determining a threat for each defined asset, and includes a threat type 1301, a threat list 1302 adopted for creating a security policy, and a priority based on the number of uses. 1303, a risk 1304, a list of addition candidates 1305, an add button 1306, a delete button 1307, a new addition button 1308, and a risk evaluation button 1309. When the threat extraction / risk evaluation screen 130 is opened, a threat template is displayed in the adopted threat 1302, and a list of threats acquired from the know-how database 13 is displayed in the additional candidate list 1305. Here, the additional candidate list 1305 is displayed in the order of the threat selection priority 1303. The priority 1303 is calculated based on the number of times the threat has been used so far. For example, the priority 1303 increases as the number of uses increases. Specifically, (a) assign priorities in descending order of the total number of uses, (b) assign priorities in descending order of the total number of uses of the threat-asset link related to the target information asset, (c) first ( Priorities are assigned by the method of b), and those with the same number of uses are further ranked by the method of (a) .If the rankings are still the same by the methods of (d) and (c), it is further related to the keyword. There are methods, such as determining the presence / absence and the number of times of use of a keyword.
[0057]
(Risk assessment 914)
The adopted threat list 1302 lists threats adopted by the user. When the risk evaluation button 1309 is pressed here, the risk / cost management processing unit 255 evaluates the risk (S926). In the risk display area 1304, the value of the risk evaluation result is displayed. Risk assessment methods include known quantitative methods, qualitative methods, etc., and are separately calculated based on one of the methods.
[0058]
(Measure planning 915)
Finally, the countermeasures against threats are identified on the countermeasure determination / cost setting screen 140 shown in FIG. 14, the countermeasure planning / cost setting screen 150 shown in FIG. 15, and the countermeasure selection screen 160 shown in FIG. A cost-effective measure is selected so as to satisfy the above (S927). The measure determination / cost setting screen 140 includes a threat list 1407 to be taken for each asset, a residual risk 1402 for each asset, a required cost 1404 for the measure, an allowable risk input area 1401, and an allowable cost input area 1403. A countermeasure candidate creation button 1405 and a countermeasure selection button 1406.
[0059]
After the user selects a threat from the threat list 1407 and presses a countermeasure candidate creation button 1405, a countermeasure planning / cost setting screen 150 is opened to identify countermeasures against the threat and set required costs for each countermeasure. The countermeasure planning / cost setting screen 150 is a screen for identifying a countermeasure plan for the selected threat and setting the cost of each countermeasure. The countermeasure candidate list 1502, the priority 1503 based on the number of uses, the cost 1504, and the addition A candidate list 1506, an add button 1507, a delete button 1508, and a new add button 1509 are provided. When this screen 150 opens, a countermeasure template is displayed in the countermeasure candidate 1502, and a list of countermeasures acquired from the know-how database 13 is displayed in the additional candidate list 1506. Here, the addition candidate list 1506 is displayed in the order of priority of countermeasures 1503. The priority 1503 is calculated based on the number of times the countermeasure has been used so far. Specifically, (a) Priorities are assigned in descending order of the total number of uses of each countermeasure, (b) Countermeasures related to the target threat-priority is assigned in descending order of the total number of uses of threat links, (c) First, assign priorities using method (b), and rank those with the same number of times of use using method (a) .If methods (d) and (c) still give the same ranking, then further relate to keywords. There are methods such as determining the presence / absence of an item and the number of times the keyword is used.
[0060]
Next, when the user presses a measure selection button 1406, a measure selection screen 160 is opened, and measures that satisfy the allowable risk and the allowable cost for each asset are selected. The countermeasure selection screen 160 is a screen for selecting countermeasures that allow the remaining risk and required cost to fall within the allowable ranges and deal with threats without omissions. The threat list list 1601, the countermeasure list list 1602, and the countermeasure selection area 1603, a display area 1604 for presence / absence of unmeasured threats, and a remaining risk and required cost display area 1606. When the user checks and selects a countermeasure selection area 1603, the remaining risk and required cost display area 1606 and the presence / absence of unmeasured threats are displayed in the display area 1604.
[0061]
This completes the creation of the security policy. Further, in the security policy creation support method and apparatus of this method, the communication processing unit 258 of the support apparatus 11 transmits all or part of the case data to the know-how management apparatus 12 when the policy creation is completed (S928).
[0062]
On the other hand, the database automatic update processing unit 353 of the know-how management apparatus 12 updates the know-how database 13 based on the whole or a part of the received case data.
[0063]
FIG. 21 shows the procedure of update processing performed by the database automatic update processing unit 353. FIG. 8 shows the case database 15 and the know-how database 13 before and after the update. The database automatic update processing unit 353 branches to processing 211 and processing 212 based on the format of the received policy case data. When the entire policy case data (formats 61, 62, 63, 64, 65, 66) is received, the received data is first stored in the policy case data 343 (S3111). Next, the received case data is created based on the existing data registered in the know-how database (there is an identifier in the asset ID 811) or newly created without existing in the know-how database (in the asset ID 812) Whether or not “-” is present is identified (S21122). Next, when the case data is based on existing data, the total use count of the element result data 133 and the inter-element link record data 134 of the know-how database and the use count when the keyword is related are incremented by one. If it is newly created data, it is added to the know-how database and given a new ID (S2113). For example, in the case of FIG. 8, with respect to the case data of the asset ID “024”, the total usage count “156” and the usage count “63” related to the keyword “K001” in the asset usage record recording unit 83 before the update are updated. After that, it increases by “157” and “64” respectively. In addition, for the newly created case data of the asset ID “-”, the new asset 821 is added to the asset definition unit 82 and the asset ID “100” is given. Finally, the assigned new ID is reflected in the case database (S2114).
[0064]
For example, in the case of FIG. 8, the asset ID 812 that was “-” before the update becomes “100” after the update. When the policy case data is received individually (formats 51, 52, 53, 54, and 55), Steps S2112, 2113, and 2114 are performed on the received policy case data.
[0065]
Thereby, it is possible to efficiently improve the reliability of the scale (number of data) of the database and the index (usage record) indicating the data quality.
[0066]
Next, accounting processing for know-how use in this system will be described.
[0067]
FIG. 17 shows the flow of know-how and billing between the know-how providing company 171 using this system and the know-how using company (such as a company providing a security policy creation support service or a customer company requiring a security policy) 172. It is a figure which shows a mechanism.
[0068]
The know-how provider 171 holds case data 1701. The know-how using company 172 creates a security policy by combining the existing case data 1701 provided by the know-how providing company 171 and the newly created new case data 1702. Then, the know-how using company 172 provides the new case data 1702 and the existing case data use record 1703 to the know-how providing company. As a result, the know-how providing company 171 can increase the scale (number of data) of the know-how database, and can update the use record data that can be used as a measure of the usefulness of the case data to increase the reliability of the use frequency data. .
[0069]
In response to these know-how flows, the know-how providing company 171 charges the know-how using company 172 for a know-how usage fee. The know-how using company 172 pays a price according to the usefulness of the provided know-how. On the other hand, when the know-how using company 172 provides new case data, the know-how providing company 171 pays a price corresponding to the usefulness. With this mechanism, the know-how using company 172 can reduce the know-how usage fee by providing more new case data with higher quality. In addition, more know-how providers can acquire more high-quality case data to improve the quality of the know-how database and provide higher-quality know-how.
[0070]
An example of a charging calculation formula in this charging system is as follows.
[0071]
Know-how usage fee (K yen) = existing case data information fee (K yen / time) x number of case data creation ... (1)
Know-how provision fee (K yen) = new matter data information fee (K yen / time) x number of case data creation ... (2)
Provided know-how value-added fee (K yen) = value-added fee (K yen / time) x total number of new case data usage ... (3)
Billing amount (K yen) = Know-how usage fee-Know-how provision fee-Provision know-how value-added fee ... (4)
[0072]
Here, the existing case data information fee, the new case data information fee, and the added value fee are set in advance. The policy case creation count and policy case provision count are recorded in the user management database 16. Further, when recording know-how data in the know-how database 13, the respective data registrant IDs (516, 526, 536, 546, 556) are recorded, and the know-how data usage count (512, 522, The sum of 532, 542, and 552) is used as the total number of new case data usages, whereby the charge amount can be calculated.
[0073]
Thereby, the charge for know-how use can be reduced based on the number of times of providing the policy case data of the creation result to the know-how database, the number of provided data, and the use frequency of the provided data. As a result, provision of case data and creation of a high-quality security policy that is frequently used can be promoted. Furthermore, it is possible to reduce the security policy creation cost of the user (billing payer), and at the same time, the know-how database can be expanded and the quality can be improved.
[0074]
Next, a second embodiment of the present invention will be described. In the second embodiment, the policy creation support apparatus 11 operates independently without accessing the know-how database arranged on the network.
[0075]
FIG. 20 is a diagram showing the configuration of the second embodiment of the security policy creation support system. In addition to the configuration shown in FIG. 2, the support device 11 in the second embodiment includes an external storage medium control unit 201 that controls an external storage medium such as an FDD, a CD-ROM, and a DVD. A policy creation support program 202 with a know-how database management function, know-how data 344, and user management data 345 are stored. The policy creation support program 202, know-how data 344, and user management data 345 are separately read via a network or the external storage medium 203. However, the know-how data 344 and the user management data 345 may be stored on the external storage medium 203 connected to the support apparatus. Further, by executing the program on the disk, each processing unit shown in the figure is realized on the CPU 21.
[0076]
When the support device 11 has the configuration shown in FIG. 20, the entire processing via the network between the policy creation support device and the know-how management device shown in FIG. 9 can be replaced with the processing inside the support device 11 via the internal bus 23. .
[0077]
Also, the know-how database connected to the know-how management device 12 can be updated in the second embodiment by sending the policy case data of the creation result to the know-how management device 12 via the network or the external storage medium 203. The billing mechanism (FIG. 17) associated therewith can also be realized.
[0078]
According to the embodiment described above, by providing correspondence information between each element of assets, threats, and countermeasures, it is possible to always maintain the correspondence between each element. As a result, it is possible to formulate security measures without omissions.
[0079]
In addition, by using usage data for asset, threat, and countermeasure element data, use case data with a high number of usages as more important data used for creating many security policies. Can do. In addition, by providing the usage record data of the links between the elements, it is possible to preferentially use a correspondence relationship having a high usage frequency as an important relationship having a stronger connection.
[0080]
Also, by creating a policy example data template using keywords representing the characteristics of the target system, a security policy can be efficiently formulated based on a template suitable for the target system.
[0081]
The above-described embodiments of the present invention are examples for explaining the present invention, and are not intended to limit the scope of the present invention only to those embodiments. Those skilled in the art can implement the present invention in various other modes without departing from the gist of the present invention.
[0082]
【The invention's effect】
According to the present invention, even a person who does not have know-how can determine security measures suitable for the target information system or create a security policy.
[Brief description of the drawings]
FIG. 1 is a diagram showing an overall configuration of a security policy creation support system according to a first embodiment to which the present invention is applied.
FIG. 2 is a diagram showing a detailed configuration of the support apparatus 11;
FIG. 3 is a diagram showing a detailed configuration of a know-how management apparatus 12;
FIG. 4 is a diagram showing data items that the know-how database 13 has.
FIG. 5 is a diagram showing data items that the know-how database 13 has.
FIG. 6 is a diagram showing data items that the case database 15 has.
FIG. 7 is a diagram showing data items that the user database 16 has.
FIG. 8 is a diagram showing a state before and after updating a case database 15 and a know-how database 13;
FIG. 9 is a flowchart showing a standard security policy creation procedure;
FIG. 10 is a diagram showing a keyword information input screen 100 to which a security policy is applied.
FIG. 11 is a diagram showing an asset definition screen 110;
12 is a diagram showing an add / edit screen 120. FIG.
13 is a diagram showing a threat extraction / risk evaluation screen 130. FIG.
FIG. 14 is a diagram showing a measure determination / cost setting screen.
15 is a diagram showing a countermeasure planning / cost setting screen 150. FIG.
FIG. 16 is a diagram showing a measure selection screen.
FIG. 17 is a diagram illustrating a know-how flow and a billing mechanism in the present embodiment;
FIG. 18 is a diagram illustrating an example of a menu screen.
FIG. 19 is a flowchart showing a detailed processing procedure for creating a template.
FIG. 20 is a diagram showing an overall configuration of a security policy creation support system according to a second embodiment to which the present invention is applied.
FIG. 21 is a flowchart showing a procedure of update processing performed by the database automatic update processing unit 353;
FIG. 22 is a diagram showing a login 220 screen.
[Explanation of symbols]
DESCRIPTION OF SYMBOLS 11 ... Security policy creation assistance apparatus, 12 ... Know-how provision apparatus, 13 ... Know-how database, 15 ... Case database, 16 ... User database, 131 ... Element data, 132 ... Inter-element link data, 133 ... Element performance data, 134 ... Inter-element link record data, 135 ... keyword data.

Claims (18)

First element data comprising asset elements each having an asset ID for identifying the information asset for each information asset;
For each threat to which the information asset is exposed, a threat ID for identifying the threat, an attack method indicating the content of the threat, and a reference risk that specifies a loss amount due to the threat at a rate per unit time, Second element data consisting of threat elements
For each countermeasure against the threat, the countermeasure ID for identifying the countermeasure, the contents of the countermeasure indicating the specific contents of the countermeasure, the standard cost specifying the cost amount required for the countermeasure at a rate per unit time, and , Third element data consisting of countermeasure elements having a standard reduction effect that specifies the reduction amount of the standard risk by the countermeasure at a rate per unit time;
First element result data consisting of asset element results and asset IDs and keyword IDs for identifying keywords related to information assets specified by the asset IDs, for each asset ID;
Second element result data comprising a threat element result having a threat ID and a keyword ID for identifying a keyword related to the threat specified by the threat ID;
Third element result data consisting of countermeasure element results each having a countermeasure ID and a keyword ID for identifying a keyword related to the countermeasure specified by the countermeasure ID;
Keyword data having a keyword and a keyword ID for identifying the keyword for each keyword;
A security policy creation support system comprising a storage unit, a control unit, a display unit, and an input unit,
The controller is
A keyword acceptance process for accepting an input of a keyword via the input unit;
A keyword ID extraction process for extracting a keyword ID corresponding to the keyword received in the keyword reception process from the keyword data;
The asset ID, threat ID, and countermeasure ID related to the keyword ID extracted in the keyword ID extraction process are the first element result data, the second element result data, and the third element result data, respectively. Element extraction processing to extract from,
For each asset ID extracted by the element extraction process, a threat to which the information asset specified by the asset ID is exposed is selected from the threats specified by the threat ID extracted by the element extraction process. A threat identification process that accepts a process identified via
For each threat identified by the threat extraction process, a process for identifying a countermeasure to be adopted for the threat from the countermeasures identified by the countermeasure ID extracted by the element extraction process via the input unit The countermeasure identification process to be accepted,
For each threat identified in the threat identification process, the reference risk is extracted from the second element data and added to calculate a risk total value that is a total value for each asset, and the threat extraction For each asset for which a threat has been extracted by processing, a standard reduction effect corresponding to the measure specified by the measure specifying process is extracted from the third element data, and the reference reduction effect is subtracted from the total risk value, respectively. In the residual risk calculation process for calculating the residual risk amount,
For each asset for which a threat has been extracted by the threat extraction process, a reference cost corresponding to the measure specified by the measure specifying process is extracted from the third element data, and the required cost amount is obtained by adding the reference cost to each asset. The required cost calculation process to calculate
For each asset from which a threat has been extracted by the threat extraction process, a security policy is created that specifies the residual risk amount, the required cost amount, and a measure specified by the measure specifying process, and the security policy is displayed. Display processing to be displayed on the part,
A security policy creation support system characterized by A security policy creation support system according to claim 1,
In the threat identification process, for each asset ID extracted in the element extraction process, at least one information included in the second element data corresponding to the threat ID extracted in the element extraction process is listed. A security policy creation support system which is displayed on a display unit and specified from the list via the input unit. A security policy creation support system according to claim 2,
In the second element result data, for each threat, the number of times specified by the threat specifying process when the security policy is created is counted,
The security policy creation support system, wherein the list is arranged in a higher order in descending order of the number of times. A security policy creation support system according to claim 1,
The countermeasure specifying process displays, as a list, at least one piece of information included in the third element data corresponding to the countermeasure ID extracted in the element extraction process for each threat identified in the threat extraction process A security policy creation support system, characterized in that the security policy creation support system is displayed on the list and specified from the list via the input unit. A security policy creation support system according to claim 4,
In the third element result data, for each measure, the number of times specified in the measure specifying process when the security policy is created is counted,
The security policy creation support system, wherein the list is arranged in a higher order in descending order of the number of times. A security policy creation support system according to claim 4,
The storage unit includes a threat ID for identifying a threat, a countermeasure ID for identifying a countermeasure against the threat, and a countermeasure identified by the countermeasure ID for the threat identified by the threat ID. Link data having a first number specified in the measure specifying process when creating the security policy is further stored,
The security policy creation support system, wherein the list is arranged in a higher order in descending order of the first number. A security policy creation support system according to claim 6,
In the third element result data, for each measure, the second number of times specified in the measure specifying process when the security policy is created is counted,
The list is arranged such that, when the first number of times is the same, the list is arranged in order from the largest second number of times. A security policy creation support system according to claim 7,
The link data includes a keyword ID for identifying a keyword identified by the threat ID or a keyword related to the countermeasure identified by the countermeasure ID, and a keyword identified by the keyword ID creates the security policy. And a third number of times used in
Creation of a security policy characterized in that, when the first number of times and the second number of times are the same, the list is arranged in order from the largest number of the third number of times. Support system. A security policy creation support system according to claim 1,
The controller is
A user ID input process for receiving an input of a user ID via the input unit;
Via the input unit, new asset element results, threat element results, or countermeasure element results are added to the first element result data, the second element result data, or the third element result data, respectively. Update process to add,
A user ID addition process for adding the user ID of the user who added in the update process to the asset element result, the threat element result, or the countermeasure element result;
Multiplying a predetermined amount by the number of times the asset element result, the threat element result, or the countermeasure element result added by the update process is specified by the countermeasure specifying process when the security policy is created. By know-how provision fee calculation processing for calculating a know-how provision fee for each user ID,
Security policy creation support system characterized by further performing A computer comprising input means and display means,
First element data having an asset ID for identifying the information asset for each information asset;
For each threat to which the information asset is exposed, a threat ID for identifying the threat, an attack method indicating the content of the threat, and a reference risk that specifies a loss amount due to the threat at a rate per unit time, Second element data having,
For each countermeasure against the threat, the countermeasure ID for identifying the countermeasure, the contents of the countermeasure indicating the specific contents of the countermeasure, the standard cost specifying the cost amount required for the countermeasure at a rate per unit time, and A third element data having a standard reduction effect that specifies the reduction amount of the standard risk by the measure at a rate per unit time;
First element result data consisting of asset element results and asset IDs and keyword IDs for identifying keywords related to information assets specified by the asset IDs, for each asset ID;
Second element result data comprising a threat element result having a threat ID and a keyword ID for identifying a keyword related to the threat specified by the threat ID;
Third element result data consisting of countermeasure element results each having a countermeasure ID and a keyword ID for identifying a keyword related to the countermeasure specified by the countermeasure ID;
Keyword data having a keyword and a keyword ID for identifying the keyword for each keyword;
Storage means for storing
A keyword receiving process for receiving an input of a keyword via the input means;
A keyword ID extraction process for extracting a keyword ID corresponding to the keyword received in the keyword reception process from the keyword data;
The asset ID, threat ID, and countermeasure ID related to the keyword ID extracted in the keyword ID extraction process are the first element result data, the second element result data, and the third element result data, respectively. Element extraction processing to extract from,
For each asset ID extracted by the element extraction process, a threat to which the information asset specified by the asset ID is exposed is selected from the threats specified by the threat ID extracted by the element extraction process. A threat identification process that accepts a process identified via
For each threat identified by the threat extraction process, a process for identifying a countermeasure to be adopted for the threat from the countermeasures identified by the countermeasure ID extracted by the element extraction process via the input unit The countermeasure identification process to be accepted,
For each threat identified in the threat identification process, the reference risk is extracted from the second element data and added to calculate a risk total value that is a total value for each asset, and the threat extraction For each asset for which a threat has been extracted by processing, a standard reduction effect corresponding to the measure specified by the measure specifying process is extracted from the third element data, and the reference reduction effect is subtracted from the total risk value, respectively. In the residual risk calculation process for calculating the residual risk amount,
For each asset for which a threat has been extracted by the threat extraction process, a reference cost corresponding to the measure specified by the measure specifying process is extracted from the third element data, and the required cost amount is obtained by adding the reference cost to each asset. The required cost calculation process to calculate
For each asset from which a threat has been extracted by the threat extraction process, a security policy is created that specifies the residual risk amount, the required cost amount, and a measure specified by the measure specifying process, and the security policy is displayed. Display processing to be displayed on the means;
Control means for performing,
A program characterized by functioning as The program according to claim 10,
In the threat identification process, for each asset ID extracted in the element extraction process, at least one piece of information included in second element data corresponding to the threat ID extracted in the element extraction process is displayed as a list. A program that is displayed on the means and specified from the list via the input means. The program according to claim 11,
In the second element result data, for each threat, the number of times specified by the threat specifying process when the security policy is created is counted,
The program is characterized in that the list is arranged in a higher order in descending order of the number of times. The program according to claim 10,
In the countermeasure identifying process, for each threat identified in the threat extracting process, the display unit lists at least one information included in the third element data corresponding to the countermeasure ID extracted in the element extracting process. And a program specified in the list via the input means. The program according to claim 13,
In the third element result data, for each measure, the number of times specified in the measure specifying process when the security policy is created is counted,
The program is characterized in that the list is arranged in a higher order in descending order of the number of times. The program according to claim 13,
The storage means includes a threat ID for identifying a threat, a countermeasure ID for identifying a countermeasure against the threat, and a countermeasure identified by the countermeasure ID for the threat identified by the threat ID. Link data having a first number specified in the measure specifying process when creating the security policy is further stored,
The list is arranged such that the list is positioned in order from the one with the highest first number of times. The program according to claim 15,
In the third element result data, for each measure, the second number of times specified in the measure specifying process when the security policy is created is counted,
The list is arranged such that, when the first number of times is the same, the list is arranged in order from the largest second number of times. The program according to claim 16, wherein
The link data includes a keyword ID for identifying a keyword identified by the threat identified by the threat ID or a countermeasure identified by the countermeasure ID, and the keyword A third number of times that the keyword identified by the domain ID was used in creating the security policy,
The list is arranged such that, when the first number of times and the second number of times are the same, the list is arranged in order from the largest third number of times. The program according to claim 10,
In the control means,
A user ID input process for receiving an input of a user ID via the input means;
Via the input means, new asset element results, threat element results, or countermeasure element results are added to the first element result data, the second element result data, or the third element result data, respectively. Update process to add,
A user ID addition process for adding the user ID of the user who added in the update process to the asset element result, the threat element result, or the countermeasure element result;
Multiplying a predetermined amount by the number of times the asset element result, the threat element result, or the countermeasure element result added by the update process is specified by the countermeasure specifying process when the security policy is created. By know-how provision fee calculation processing for calculating a know-how provision fee for each user ID,
A program characterized in that it is further performed.

Images