JP4369724B2 - Information security management program, information security management apparatus and management method - Google Patents

Description

  The present invention relates to a data processing technique for supporting information security management work. More specifically, the present invention relates to an information security management apparatus and a computer for performing risk analysis processing or countermeasure planning processing necessary for maintaining information in an organization such as a company or an organization based on a predetermined information security standard. The present invention relates to a program for functioning as a security management device and an information security management method.

  Information security is to protect information considered important in an organization as a kind of asset and protect it from various risks.In other words, it prevents leakage to unauthorized persons, prevents misuse and tampering, and is necessary. Sometimes it means maintaining and managing information so that it can be used safely and reliably. In recent years, with the progress of systemization and networking in organizations, the types and storage forms of information have been diversified, so information security has become increasingly important.

  Various standards and standards for information security management include, for example, BS7799 (Code of Practice for Information Management Management) by the British Standards Institute (BSI), ISO / IEC TR13335 (GMITS: Guideline for Management Management, etc.). There is a standard. BS7799 is a guideline showing basic matters including a universal and comprehensive definition concerning information security management, and GMITS is a guideline showing a basic framework of processes related to information security management and planning similar to BS7799.

  In BS7799, information security is defined as ensuring and maintaining the confidentiality, integrity, and availability of information that should be considered as assets and preserved. Here, confidentiality ensures that only authorized persons can access the information, integrity ensures that the information and how it is processed is accurate and complete, and availability is authorized Is meant to ensure that information and related assets are available to the person when needed.

  In BS7799, as a criterion for determining the level of information security management of an organization, information gaps revealed by the current status analysis are based on the fact that the gap between the best practices of information security in the organization and the current status is a security vulnerability. It shows that risk analysis is performed based on the characteristics and threats, and risk assessment of information is performed. It also shows that risk assessment can be used to formulate countermeasure guidelines for future information security establishment.

  As the information security management model of BS7799, it is desirable to perform the processing of “security policy determination” → “information security management scope determination” → “risk analysis” → “measure guideline determination and management based on risk assessment” .

A method of automatically performing the above risk assessment using a computer is disclosed in, for example, Patent Document 1. The risk evaluation method of Patent Document 1 performs risk evaluation of information assets based on the security policy and the configuration of the current information system in accordance with the guidelines of BS7799.
JP 2003-150748 A

  For example, in information security management defined by BS7799, in the risk analysis of information assets (hereinafter simply referred to as assets), the risk is determined based on a calculation model (calculation formula) of “risk = asset value × vulnerability × threat”. Calculated.

  As described above, risk is determined by three variables: asset value, vulnerability, and threat. Here, the “asset value” is a value indicating the degree of loss given to the organization when the information to be protected is threatened. Asset values are usually defined in terms of information confidentiality, integrity, and availability.

  Confidentiality indicates the degree of loss to the organization if the confidentiality of the information is lost, integrity indicates the degree of loss to the organization if the integrity of the information and how it is processed, Availability indicates the degree of loss to an organization if information availability is lost.

  “Vulnerability” is a value indicating the degree of damage that cannot be prevented by security measures in operation, and is determined based on the gap between the best practice in the security policy and the current situation. The “threat” is a value indicating the degree of possibility that a factor (accident, disaster, human action, etc.) threatening the safety of information will occur.

  Special knowledge is required to accurately grasp and quantify vulnerabilities and threats, and it is very difficult for non-experts. Furthermore, it is necessary to cover the vulnerabilities and threats to be grasped, but it is often difficult in reality to grasp the vulnerabilities and threats comprehensively.

  Therefore, the asset value used for the risk calculation model (calculation formula) in the risk analysis can be specified by referring to a predetermined standard by the person in charge of security of the organization. On the other hand, vulnerabilities and threats are identified by information security management specialists who listen to the current operational status from the security management personnel of the organization and judge the operational status based on specialized knowledge and empirical rules. I was going. Therefore, it has been practically difficult to conduct risk analysis for information security management without the assistance of experts.

  In the risk evaluation process in the system of Patent Document 1, data relating to the current system and information assets is converted into data for risk evaluation process, risk analysis is performed, and a risk evaluation report is output. Patent Document 1 does not mention the input of data on vulnerabilities and threats, but it is necessary to identify vulnerabilities and threats for risk analysis, and this involves an input work by an expert. Therefore, it is considered that the problem of vulnerability and the difficulty of grasping the threat has not been solved.

  The present invention has been made in view of such problems, and in information security management, an information security management device that performs risk calculation without inputting data related to vulnerabilities and threats that are difficult to identify in risk analysis, the information It is an object of the present invention to provide a program for causing a computer to function as a security management device, and an information security management method.

  Further, the present invention relates to an information security management device that outputs a countermeasure guideline corresponding to a risk calculated by the above risk analysis processing in information security management, a program for causing a computer to function as the information security management device, and information An object is to provide a security management method.

  In order to achieve the above object, the present invention provides a current state analysis input processing means for inputting a question asking about a security measure being executed as information security management, and an answer indicating the current state of the security measure against the security measure, Asset input processing means for inputting asset list information including an asset category indicating the asset type and an asset value indicating the information security management value of the asset for each asset which is information subject to information security management Answer option storage means for storing the answer and an answer weight value indicating the degree of achievement of the security measure indicated by the answer, a vulnerability associated with the security measure of the question, and damage caused by the vulnerability Vulnerability information storage for storing a vulnerability weight value that is an index of the degree of vulnerability and an asset category related to the vulnerability And a threat information storage means for storing a threat associated with the vulnerability and a threat weight value that is an index of the threat magnitude, and the achievement degree of the security measure indicated by the answer is a predetermined degree Assets of assets that are classified into the asset category associated with the vulnerability from the asset list information by acquiring the vulnerability and vulnerability weight value associated with the question from the vulnerability information storage means in some cases Vulnerability analysis means for obtaining a value and calculating a vulnerability value that is an index of vulnerability using the vulnerability weight value and the answer weight value for each vulnerability, and the threat information storage means Threat analysis means for acquiring a threat and a threat weight value associated with the vulnerability from the above, and calculating a threat value that is an index of the possibility of occurrence of the threat; the asset value, the vulnerability value, and the threat value Based on, as an information security management system and a risk calculation means for calculating the risk value of each of the vulnerability is a program for causing a computer to function.

  The present invention also provides an information security management apparatus and an information security management method that perform the same processing as described above.

The related invention of the present invention is a status analysis input processing means for inputting information relating to the current status of security measures being executed as information security management, a vulnerability information storage means for storing vulnerabilities associated with the security measures, Vulnerability analysis means for acquiring a vulnerability associated with the security measure from the vulnerability information storage means, threat information storage means for storing a threat associated with the vulnerability, and vulnerability from the threat information storage means This is a program for causing a computer to function as an information security management device including threat analysis means for acquiring a threat associated with sex.

Further, the related invention of the present invention inputs the status analysis input processing means for inputting information on the current status of security measures being executed as information security management, and information on the asset that is the information subject to the information security management. Asset input processing means, vulnerability information storage means for storing vulnerabilities associated with the security measures and assets related to the vulnerabilities, and the present state analysis input processing means by collating the vulnerability information storage means The vulnerability associated with the security measure input in step 1 and the asset associated with the vulnerability are acquired, and the acquired vulnerability and the asset associated with the vulnerability among the input asset are acquired. As an information security management device equipped with vulnerability analysis means for extracting and outputting, a program for causing a computer to function It is a lamb.

  The information security management program of the present invention performs the following processing by being read into a predetermined computer, installed and started.

  The present invention inputs, for example, a question (current question) entered by a user asking about security measures being executed as information security management, and an answer indicating the current status of the question with respect to the security measures. Further, asset list information including an asset category indicating the type of the asset and an asset value indicating the value of the asset in information security management is input for each asset which is information to be information security managed.

  Also, an answer option storage means (answer option table) for storing the answer and an answer weight value indicating the degree of achievement of the security measure indicated by the answer, a vulnerability associated with the security measure of the question, and the vulnerability Vulnerability information storage means (vulnerability database) for storing a vulnerability weight value that is an index of the degree of damage caused by the property, and an asset category related to the vulnerability, and a threat associated with the vulnerability And threat information storage means (threat database) for storing a threat weight value that is an index of the threat size.

  Then, when the degree of achievement of the security measures indicated by the input answer is a predetermined level, the vulnerability and the vulnerability weight value associated with the question are obtained from the vulnerability database, and the asset list information is obtained. The asset value of an asset classified into the asset category associated with the vulnerability is obtained, and the vulnerability weight value and the response weight value are used for each vulnerability, which is an index of vulnerability magnitude Vulnerability value is calculated. Further, a threat associated with the vulnerability and a threat weight value are acquired from the threat database, and a threat value that is an index of the possibility of occurrence of the threat is calculated. Then, a risk value for each vulnerability is calculated based on the asset value, the vulnerability value, and the threat value.

  This makes it possible to calculate risk values without entering vulnerabilities and threats that are difficult to identify in risk analysis, and information security managers can easily obtain risk values in information security management operations. .

  The information security management apparatus having the above-described configuration further includes risk assessment output means for outputting a risk assessment including the vulnerability value, the threat value, and the risk value for the vulnerability. It is a program for making a computer function as a thing.

  Thereby, it becomes possible to automatically output a risk assessment based on the processing result (analysis result) by the above risk analysis, and the information security manager can easily obtain the risk assessment.

  Alternatively, the program is a program for causing a computer to function as an information security management device including value changing means for changing the vulnerability value or the threat value based on a user instruction.

  This makes it possible to change the vulnerability value or threat value according to the individual status of the organization's information security management, and the information security administrator obtains risk values and risk assessments according to the operational status of the organization. can do.

  Alternatively, countermeasure guideline information storage means for storing countermeasure contents that are security countermeasures related to information security management vulnerabilities, and countermeasures corresponding to the vulnerabilities extracted from the countermeasure guideline information storage means by the vulnerability analysis means This is a program for causing a computer to function as an information security management device including countermeasure guideline creation means for extracting contents and creating and outputting a countermeasure guideline based on the answer.

  Thereby, the countermeasure guideline based on said risk assessment can be output automatically, and the information security manager can easily acquire the countermeasure guideline.

  According to the present invention, in risk analysis processing in information security management, when risk calculation is performed based on information value, vulnerability, and threat as in the risk calculation model adopted in BS7799, for example, the present security measure is provided. Risk calculation can be performed simply by inputting data and data on asset values.

  This eliminates the task of identifying vulnerabilities and threats in information security management operations, so that standard risk analysis results can be obtained without using technical terms for vulnerability and threat identification. Can do.

  Further, according to the present invention, it is possible to output a countermeasure guideline based on the result of the risk analysis process. Thereby, since the countermeasure guideline according to the risk analysis result of the organization is automatically output, the countermeasure planning work can be facilitated and made useful.

  In addition, according to the present invention, an information security management system that performs risk analysis processing and countermeasure guideline output processing compliant with BS7799 can be easily realized, so that it is easy to obtain BS7799 certification for companies and organizations. Play.

  FIG. 1 shows a configuration example in the embodiment of the present invention. The information security management device 1 according to the present invention is a system that outputs countermeasure guidelines for risk analysis and countermeasure planning based on the BS7799 standard.

  The information security management device 1 includes a current state analysis input processing unit 11, an asset input processing unit 12, a vulnerability analysis unit 13, a threat analysis unit 14, a risk calculation unit 15, a risk assessment output processing unit 16, a value change unit 17, a countermeasure guideline. The creation unit 18, a current question database 21, an answer option table 22, a vulnerability database 23, a threat database 24, and a countermeasure guideline database 25 are configured. In addition, the information security management device 1 performs input / output processing of information between the input device 31 and the display device 32 via a predetermined input / output processing unit (not shown).

  The current status analysis input processing unit 11 uses the current status question database 21 and the answer option table 22 to create a current status question for acquiring the current status of the security measures operated by the organization, and the security measures in operation and the achievement status thereof It is a means to acquire.

  In FIG. 2, the structural example of the present condition question database 21 is shown. The current question database 21 is a database that stores the question contents displayed on the current question screen. The current question database 21 includes items such as a question ID, a number, and a question content. The question ID is an item in which information for identifying the question content is described, and the question content is an item in which specific content of security measures executed in information security management is described. The number and the question content are displayed as components of the current question screen.

  FIG. 3 shows a configuration example of the answer option table 22. The answer option table 22 is a data table for storing answers that can be selected by the user with respect to the questions displayed on the current question screen. The answer option table 22 includes items such as options, values, and weights. The choice is an item that describes an answer to the question (status of achievement of security measures) displayed on the current question screen, the value is an item indicating a predetermined value that distinguishes the answer prepared as an option, and the weight is security It is an item in which a value indicating the achievement status of the countermeasure is described.

  The current state analysis input processing unit 11 creates a current state question screen by referring to the question content and number stored in the current state question database 21 and displays the current state question screen on the display device 32. When a user such as a person in charge of information security management selects an answer from predetermined answer options for each question content on the current question screen via the input device 31, the current state analysis input processing unit 11 displays the question item on the current question screen. Get the question ID and answer.

  The asset input processing unit 12 is a processing unit that inputs an asset list that stores information such as the asset name, asset category, and asset value of the asset to be maintained.

  The asset category is a predetermined type that identifies the type of asset, and is, for example, a predefined type of information, document, data recording medium, device / equipment, software, service, organization member, or the like. Asset values are classified into about three levels from the viewpoint of confidentiality, integrity, and availability of information. For example, confidentiality = 3 indicates that the information that causes a considerable loss in the organization when the confidentiality of the information is lost, and confidentiality = 1 indicates that the information is lost when the confidentiality of the information is lost. Indicates information that causes a relatively small loss.

  The vulnerability analysis unit 13 refers to the vulnerability database 23, extracts potential vulnerabilities in the current security measures based on the answers to the current state questions input by the current state analysis input processing unit 11, and This is a processing means for calculating a vulnerability value indicating a degree and associating the extracted vulnerability with the asset input by the asset input processing unit 12.

  FIG. 4 shows a configuration example of the vulnerability database 23. The vulnerability database 23 is a database that stores vulnerabilities in information security management. The vulnerability database 23 includes items such as a vulnerability ID, a vulnerability, a question ID, a weight, and an asset category related flag. Vulnerability ID is an item describing information for identifying the vulnerability, vulnerability is an item describing the specific content of the vulnerability of information security management, and question ID is the question ID of the question content associated with the vulnerability Is an item to be described. The weight is an item in which a vulnerability index value is described. The asset category related flag is an item in which flag information for specifying an asset category associated with the vulnerability is described. Asset category information (information), documents (sentences), data recording media (media), equipment (machines), software (So), services (services), organizational members (members), etc. A value of = 1, irrelevant = 0 is set.

  The threat analysis unit 14 is a processing unit that refers to the threat database 24 to extract a threat associated with the vulnerability extracted by the vulnerability analysis unit 13 and calculates a threat value indicating the degree of the extracted threat. .

  FIG. 5 shows a configuration example of the threat database 24. The threat database 24 is a database that stores threats to information security management. The threat database 24 includes items such as a threat ID, a threat, a vulnerability ID, and a weight. The threat ID is an item describing information for identifying a threat, and the threat is an item describing a specific factor of the threat. The vulnerability ID is an item in which the vulnerability ID associated with the threat is described, and the weight is an item in which the threat index value is described.

  The risk calculation unit 15 uses, for example, a risk calculation model (formula) conforming to BS7799, and calculates a risk value for each asset value for each vulnerability based on the asset value, vulnerability value, and threat value. It is.

  The risk assessment output processing unit 16 is a processing unit that creates a risk assessment indicating information necessary for information security management such as a risk value, a vulnerability value, and a threat value calculated by the risk calculation unit 15 and displays the risk assessment on the display device 32. .

  The value changing unit 17 is a processing unit that changes the vulnerability value and the threat value calculated by the vulnerability analyzing unit 13 and the threat analyzing unit 14, respectively. When the user changes the vulnerability value or threat value displayed on the display device 32, the value change unit 17 passes the changed vulnerability value / threat value to the vulnerability analysis unit 13 or the threat analysis unit 14. . The vulnerability analysis unit 13 and the threat analysis unit 14 rewrite each vulnerability value / threat value with the passed change value, and further pass the changed vulnerability value / threat value to the risk calculation unit 15. The risk calculation unit 15 recalculates the risk value based on the changed vulnerability value / threat value.

  The countermeasure guideline creation unit 18 is a processing unit that refers to the countermeasure guideline database 25 to search and extract the countermeasure contents regarding the vulnerability extracted by the vulnerability analysis unit 13 and create a countermeasure guideline.

  FIG. 6 shows a configuration example of the countermeasure guideline database 25. The countermeasure guideline database 25 includes items such as vulnerability ID, vulnerability, and countermeasure contents. The countermeasure content is an item in which the specific content of the security countermeasure to be executed for the vulnerability associated with the vulnerability ID is described.

  The processing flow of the present invention will be described below.

  First, the current state analysis input processing unit 11 of the information security management device 1 creates a current state question screen based on the content of the current state question database 21 and displays it on the display device 32. FIG. 7 shows an example of the current question screen. The current question screen displays a question content and a predetermined answer selection field. When the user selects an answer to the question on the current question screen, the current state analysis input processing unit 11 inputs the question ID and answer of the question item on the current question screen.

  In addition, the asset input processing unit 12 inputs information (asset list) related to assets to be maintained. The asset list includes, for each asset, asset values (confidentiality value, integrity value, availability value) evaluated from the three viewpoints of asset category, confidentiality, integrity, and availability.

  The vulnerability analysis unit 13 acquires the question ID and answer input by the current state analysis input processing unit 11 and the asset list input by the asset input processing unit 12 and performs vulnerability analysis processing. 8 and 9 show the processing flow of the vulnerability analysis processing.

  The vulnerability analysis unit 13 inputs the question ID and answer of the question item on the current question screen (step S10), collates the input answer with the answer option table 22 (step S11), and the answer value is Yes or N / It is determined whether or not A (step S12). If the answer value is not Yes or N / A, the weight of the answer is obtained (step S13), the vulnerability associated with the question ID is extracted from the vulnerability database 23 (step S14), and the extracted vulnerability The sex record is added to the vulnerability list (step S15). The vulnerability list is a data list used by the vulnerability analysis unit 13 for processing, and stores records in the vulnerability database 23 and vulnerability values described later.

Further, for each vulnerability in the vulnerability list, a vulnerability value is calculated based on the vulnerability weight and the response weight (step S16). The vulnerability analysis unit 13 calculates a vulnerability value using the following calculation formula.
"Vulnerability value = ((Maximum vulnerability value * Vulnerability weight * Response weight -1) / 10000) + 1"
For example, the vulnerability value is calculated for the vulnerability identified by vulnerability ID = 125 associated with the question item whose vulnerability is classified in 5 stages of 1 to 5 and whose answer is “partially implemented”. In this case, vulnerability weight = 70 and answer weight = 60, and the vulnerability value is calculated as follows.
"Vulnerability value = ((5 * 70 * 60-1) / 10000) + 1 = 3"
Subsequently, the vulnerability analysis unit 13 extracts one vulnerability in the vulnerability list (step S20), sets the first item of the extracted asset category related flag of the vulnerability as n = 1 (step S21), and sets the asset category. It is determined whether or not the nth value of the related flag is “0” (step S22). If the n-th value is not “0”, all the assets belonging to the asset category are associated with the vulnerability from the asset list (step S23). It is determined whether or not all the asset category related flag items have been processed (step S24). If not processed, n = n + 1 is set (step S25), and the processing of steps S22 and S23 is performed for the next item. repeat.

  Thereafter, it is determined whether or not all the vulnerabilities in the vulnerability list have been processed (step S26). If the vulnerabilities have not been processed, the next vulnerability is extracted (step S27). The process is repeated, and if the process has been completed, the process ends.

  Subsequently, the threat analysis unit 14 performs a threat analysis process. FIG. 10 shows a process flow of the threat analysis process.

  The threat analysis unit 14 acquires the vulnerability ID of the vulnerability in the vulnerability list from the vulnerability analysis unit 13, extracts the threat corresponding to the vulnerability ID from the threat database 24 (step S30), and extracts the extracted threat. A record is added to the threat list (step S31). The threat list is a data list used by the threat analysis unit 14 for processing, and stores records in the threat database 24 and threat values described later.

  FIG. 11 shows the correspondence between vulnerabilities and threats. The vulnerability in the vulnerability database 23 and the threat in the threat database 24 are in a relationship in which one-to-one or one-to-multiple association is made. In the threat database 24, all vulnerability IDs associated with each threat are set.

Further, the threat analysis unit 14 calculates a threat value based on the threat weight (step S32). The threat analysis unit 14 calculates a threat value by the following calculation formula.
“Threat value = ((maximum threat value * threat weight−1) / 100) +1”
For example, when the threat value of threat ID = 678 associated with the vulnerability identified by vulnerability ID = 124 is classified into 7 stages and threat ID = 124, threat weight = 80, and the threat value is as follows: Is calculated as follows.
“Threat value = ((7 * 80−1) / 100) + 1 = 6”
Subsequently, the risk calculation unit 15 performs a risk calculation process. FIG. 12 shows a process flow of the risk calculation process.

The risk calculation unit 15 acquires assets associated with the vulnerabilities in the vulnerability list (step S40). Then, a risk value is calculated based on the vulnerability value and the threat value for the confidentiality, integrity, and availability of each asset (step S41). The risk calculation unit 15 calculates a risk value using the following calculation formula defined by so-called GMITS.
"Risk value = Asset value + Vulnerability value + Threat value -k (k = 2)"
For example, the risk value for confidentiality among the asset values of a certain asset is “1 + 1 + 3−2 = 3” when the confidentiality value = 1, the vulnerability value = 1, and the threat value = 3. As described above, the risk calculation unit 15 calculates a risk value based on the confidentiality value, the integrity value, and the availability value for each asset associated with all the vulnerabilities in the vulnerability list.

  Moreover, the risk calculation part 15 acquires the largest risk value from the risk value calculated for every vulnerability (step S42).

  After the risk calculation process is completed, the risk assessment output processing unit 16 creates a risk assessment based on the vulnerability list, the threat list, and the calculated risk value, and displays the risk assessment on the display device 32.

  FIG. 13 shows an example of the risk assessment display screen. The risk assessment display screen displays vulnerabilities, vulnerability values, assets, threats, threat values, and maximum risk values for each vulnerability.

  When the user selects the button “OK” on the risk assessment display screen, the countermeasure guideline creation unit 18 performs countermeasure guideline creation processing based on the contents of the risk assessment. When the button “Cancel” is selected, the process proceeds to the current state analysis input processing unit 11. The current state analysis input processing unit 11 displays a current state question screen and prompts the user to select an answer.

  When the button “change vulnerability value / threat value” is selected, the process proceeds to the value changing unit 17. The value change unit 17 displays a vulnerability value / threat value change screen for changing the vulnerability value or the threat value. FIG. 14 shows an example of the vulnerability value / threat value change screen.

  On the vulnerability value / threat value change screen, the asset value (confidentiality value, integrity value, availability value) and the risk value for each asset value are displayed for all assets associated with the vulnerability. Furthermore, there is an item configured to allow selection of each value of the vulnerability value and the threat value, and the vulnerability value and the threat value calculated by the vulnerability analysis unit 13 and the threat analysis unit 14 are displayed as initial values. The reason corresponding to the value is displayed.

  The user displays the risk value for each asset value of each asset, and the reason corresponding to the value specified in the selection item is displayed on the screen, so the vulnerability value or threat value while referring to this information Can be changed.

  When the button “OK” on the vulnerability value / threat value change screen is selected, the value change unit 17 inputs the changed vulnerability value or threat value, and the vulnerability analysis unit 13 inputs the input vulnerability value. To the threat analysis unit 14. The vulnerability analysis unit 13 and the threat analysis unit 14 rewrite the vulnerability value / threat value with the passed change value, and pass the changed vulnerability value / threat value to the risk calculation unit 15. The risk calculation unit 15 calculates a risk value based on the changed vulnerability value / threat value.

  When the button “Cancel” on the vulnerability value / threat value change screen is selected, the process moves to the risk assessment output processing unit 16, and the risk assessment is displayed on the display device 32.

  Thereafter, the countermeasure guideline creation unit 18 performs countermeasure guideline creation processing. FIG. 15 shows a processing flow of countermeasure guideline creation processing. The countermeasure guideline creation unit 18 extracts the countermeasure content associated with the vulnerability ID in the vulnerability list from the countermeasure guideline database 25 (step S50), and displays the countermeasure guideline composed of the vulnerability and the extracted countermeasure content. The information is displayed on the device 32 (step S51).

  Thereby, the user can acquire a risk assessment and can acquire a countermeasure guideline by selecting a predetermined answer on the current question screen. Therefore, when the risk analysis process and the countermeasure planning process of the information security management apparatus 1 are based on, for example, BS7799, the information security management based on BS7799 can be easily realized in the organization, so that it is easy to obtain the certification of BS7799. Become.

  As mentioned above, although this invention was demonstrated by the embodiment, it cannot be overemphasized that a various deformation | transformation is possible for this invention in the range of the main point.

  The information security management device 1 may include a device that outputs data by another method, such as a printing device, instead of the display device 32. In addition, the information security management device 1 includes a data transmission / reception processing unit instead of performing information input / output processing on the input device 31 and the display device 32, and performs data transmission / reception processing with other systems or terminals. Good.

  The present invention can also be implemented as a program that is read and executed by a computer. The program for realizing the present invention can be stored in an appropriate recording medium such as a portable medium memory, a semiconductor memory, or a hard disk, which can be read by a computer, provided by being recorded on these recording media, or communication. It is provided by transmission / reception using various communication networks via an interface.

It is a figure which shows the structural example in embodiment of this invention. It is a figure which shows the structural example of a present condition question database. It is a figure which shows the structural example of an answer choice table. It is a figure which shows the structural example of a vulnerability database. It is a figure which shows the structural example of a threat database. It is a figure which shows the structural example of a countermeasure guideline database. It is a figure which shows the example of a present condition question screen. It is a figure which shows the processing flow of a vulnerability analysis process. It is a figure which shows the processing flow of a vulnerability analysis process. It is a figure which shows the processing flow of a threat analysis process. It is a figure which shows the correspondence of a vulnerability and a threat. It is a figure which shows the processing flow of a risk calculation process. It is a figure which shows the example of a risk assessment display screen. It is a figure which shows the example of a vulnerability value / threat value change screen. It is a figure which shows the processing flow of countermeasure guideline preparation processing.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Information security management apparatus 11 Current condition analysis input process part 12 Asset input process part 13 Vulnerability analysis part 14 Threat analysis part 15 Risk calculation part 16 Risk assessment output process part 17 Value change part 18 Countermeasure guideline preparation part 21 Current situation question database 22 Answer Choice table 23 Vulnerability database 24 Threat database 25 Countermeasure guideline database 31 Input device 32 Display device

Claims (7)

A program for causing a computer to function as an information security management device,
Current status analysis input processing means for inputting a question asking about security measures being executed as information security management, and an answer indicating the current status of the security measures for the question,
Asset input processing means for inputting asset list information including an asset category indicating the asset type and an asset value indicating the information security management value of the asset for each asset which is information subject to information security management When,
Answer option storage means for storing the answer and an answer weight value indicating a degree of achievement of the security measure indicated by the answer;
Vulnerability information storage means for storing a vulnerability associated with the security measure of the question, a vulnerability weight value that is an index of the degree of damage caused by the vulnerability, and an asset category related to the vulnerability ,
Threat information storage means for storing a threat associated with the vulnerability and a threat weight value which is an index of the threat size;
When the achievement level of the security countermeasure indicated by the answer is a predetermined level, the vulnerability and the vulnerability weight value associated with the question are acquired from the vulnerability information storage unit, and the asset list information Vulnerability that is an index of vulnerability size by acquiring the asset value of an asset classified into the asset category associated with the vulnerability and using the vulnerability weight value and the response weight value for each vulnerability Vulnerability analysis means for calculating the value;
Threat analysis means for acquiring a threat associated with the vulnerability and a threat weight value from the threat information storage means, and calculating a threat value that is an index of the possibility of occurrence of the threat;
Based on the asset value, the vulnerability value, and the threat value, as an information security management device comprising a risk calculation unit that calculates a risk value for each vulnerability,
An information security management program that allows computers to function. Furthermore, as the information security management device comprising a risk assessment output means for outputting a risk assessment including the vulnerability value, the threat value, and the risk value for the vulnerability,
The information security management program according to claim 1 for causing a computer to function. Furthermore, as an information security management device comprising value changing means for changing the vulnerability value or the threat value based on a user instruction,
The information security management program according to claim 1 for causing a computer to function. Furthermore, countermeasure guideline information storage means for storing countermeasure contents that are security countermeasures related to information security management vulnerabilities,
Information security provided with countermeasure guideline creation means for extracting countermeasure contents corresponding to the vulnerability extracted by the vulnerability analysis means from the countermeasure guideline information storage means, and creating and outputting a countermeasure guideline based on the answer As a management device,
The information security management program according to claim 1 for causing a computer to function. The asset input processing means is an information security management device that performs processing to input asset list information including an index value related to confidentiality of information, an index value related to integrity, and an index value related to availability as the asset value,
The information security management program according to claim 1 for causing a computer to function. Current status analysis input processing means for inputting a question asking about security measures being executed as information security management, and an answer indicating the current status of the security measures for the question,
Asset input processing for inputting asset list information including an asset category indicating the type of the asset and an asset value indicating the information security management value of the asset for each asset which is information subject to information security management Means,
Answer option storage means for storing the answer and an answer weight value indicating a degree of achievement of the security measure indicated by the answer;
Vulnerability information storage means for storing a vulnerability associated with the security measure of the question, a vulnerability weight value that is an index of the degree of damage caused by the vulnerability, and an asset category related to the vulnerability ,
Threat information storage means for storing a threat associated with the vulnerability and a threat weight value which is an index of the threat size;
When the achievement level of the security countermeasure indicated in the answer is a predetermined level, the vulnerability and the vulnerability weight value associated with the question are acquired from the vulnerability information storage unit, and the asset list information Vulnerability that is an index of vulnerability size by acquiring the asset value of an asset classified into the asset category associated with the vulnerability and using the vulnerability weight value and the response weight value for each vulnerability Vulnerability analysis means for calculating the value;
Threat analysis means for acquiring a threat associated with the vulnerability and a threat weight value from the threat information storage means, and calculating a threat value that is an index of the possibility of occurrence of the threat;
An information security management device comprising: a risk calculation unit that calculates a risk value for each vulnerability based on the asset value, the vulnerability value, and the threat value. A process of inputting a question asking about security measures executed as information security management, and an answer indicating the current state of the security measures for the question;
A process of inputting asset list information including an asset category indicating the type of the asset and an asset value indicating the value of information security management of the asset for each asset which is information to be managed by the information security management. ,
A process of accessing an answer option storage means for storing the answer and an answer weight value indicating a degree of achievement of the security measure indicated by the answer;
To vulnerability information storage means for storing a vulnerability associated with the security measure of the question, a vulnerability weight value that is an index of the degree of damage caused by the vulnerability, and an asset category related to the vulnerability The access process ,
A process of accessing threat information storage means for storing a threat associated with the vulnerability and a threat weight value which is an index of the threat size;
When the achievement level of the security countermeasure indicated in the answer is a predetermined level, the vulnerability and the vulnerability weight value associated with the question are acquired from the vulnerability information storage unit, and the asset list information Vulnerability that is an index of vulnerability size by acquiring the asset value of an asset classified into the asset category associated with the vulnerability and using the vulnerability weight value and the response weight value for each vulnerability A process of calculating a value;
A process of obtaining a threat and a threat weight value associated with the vulnerability from the threat information storage unit, and calculating a threat value that is an index of the possibility of occurrence of the threat;
An information security management method comprising: a process for calculating a risk value for each vulnerability based on the asset value, the vulnerability value, and the threat value.

Images