JP4764446B2 - Information processing apparatus and information processing program - Google Patents

Description

  The present invention relates to an information processing apparatus and an information processing program that are used when security is enhanced for a plurality of tasks.

  Conventionally, many businesses have a plurality of businesses, and each business handles various information assets. Information assets include project documents, personal information, design books, etc. in the form of paper or electronic files. Each information asset has security characteristics such as confidentiality, integrity, and availability that should be emphasized, that is, the information asset is rated. For this reason, the execution of business involves security risks such as information leakage and falsification of these information assets, that is, business risks.

  On the other hand, there are risk factors affecting business risk, that is, business risk factors. Business risk factors include the number of people involved in business and the amount of e-mails handled. For example, if the number of people involved in business is large, the risk of occurrence of information leakage or falsification increases. In addition, the greater the amount of email handled, the higher the risk of information leakage.

  In corporate activities, business reforms and organizational changes may occur, and business units may be reviewed. In this case, security threats to a plurality of businesses and information assets to be handled are assumed, and countermeasures against the assumed security threats are considered. However, the assumption of these security threats, the formulation of countermeasures against the assumed security threats, and the determination of the work to be performed must be judged based on the experience and skills of the analyst, and the analysis work becomes extremely inefficient. It was.

  Under such a background, as disclosed in, for example, Patent Document 1, an analyst inputs information assets to be analyzed and their ratings, pre-registered questions, threat databases, vulnerability databases, and these By calculating the risk value from the association and extracting the qualitative countermeasure guidelines for the vulnerabilities that the analyst determined in consideration of the risk value, the dependency on the analyst's experience and skills is reduced. There is a business risk analysis support device.

Further, as disclosed in, for example, Patent Document 1, an analyst inputs information asset management information to be analyzed, and the threats and vulnerabilities registered in advance from attribute values selected by the analyst for each information asset. There is a business risk analysis support device that extracts together with the risk reduction rate and the analyst selects measures in view of the risk reduction rate, thereby reducing the dependence on the analyst's experience and skills.
JP 2005-135239 A JP 2005-234840 A

  In the example disclosed in Patent Document 1 described above, security threats and vulnerabilities are limited to a pre-registered range, and are only extracted by narrowing down the range. The risk value is calculated for each threat and vulnerability, and is not associated with a business that is a specific activity unit of a company. For this reason, it is necessary to further break down by the analyst, based on the obtained qualitative countermeasure policy, as to what measures should be taken for which work.

  In the example disclosed in Patent Document 2 described above, security threats and vulnerabilities are limited to a pre-registered range, and are only extracted by narrowing down the range. In addition, it is possible to quantitatively grasp the risk reduction effect, but there is no association with a business that is a specific activity unit of a company. For this reason, it is necessary to further break down by the analyst, based on the obtained qualitative countermeasure policy, as to what measures should be taken for which work.

  Accordingly, an object of the present invention is to provide an information processing apparatus capable of calculating a risk value associated with a business without extracting security threats and vulnerabilities from business risk factors and rating information of information assets handled by the business, and It is to provide an information processing program.

That is, the information processing apparatus according to the present invention is an information processing apparatus configured by a computer, and a plurality of types of business risk factors, which are weightings common to a plurality of types of business risk factors, A business risk factor definition storage unit for storing the business risk factor influence degree that is an influence degree of each of the plurality of types of security characteristics for each of the business risk factors, and the plurality of types of business for each of the plurality of types of business. A business risk factor value storage unit that stores business risk factor values that are respective values of risk factors, and the plurality of types of business, the plurality of types of security characteristics, and the plurality of types of business risk factors based on business, security characteristics, and business One risk factor is set at a time, and the multiple types of security characteristics and The reciprocal of a value obtained by multiplying the maximum value of the operational risk factor influence values stored in the operational risk factor definition storage unit for each of the operational risk factors by the number of operational risk factor types. The business risk factor value stored in the business risk factor value storage unit for the set business and the set business risk factor, and the business for the set security characteristic and the set business risk factor The product of the risk factor influence degree and the operational risk factor weight stored in the operational risk factor definition storage unit for the set operational risk factor is the sum of the values calculated for each of the plural types of operational risk factors. By multiplying, the risk level for the security characteristics based on the business risk factor value of each business Simple business risk value calculation means for calculating a simple business risk value for each business and each combination of security characteristics, and information that is a weight for each of the plurality of types of security characteristics for each of a plurality of types of information assets An information asset definition storage unit for storing asset rating information; a business asset association storage unit for storing business asset association information indicating whether each of the plurality of types of information assets is handled for each of the plurality of types of business; One type of business and security characteristics are set for each of a plurality of types of business and the plurality of types of security characteristics, and the set business is handled in the business asset association information stored in the business asset association storage unit. Information assets related to information assets The value of the business request policy that is the weight for the set security characteristic required for the set work, the maximum value among the weights for the set security characteristic in the information asset rating information stored in the product definition storage unit The business request policy calculation means for calculating the business request policy for each combination of the business and the security characteristics, and the business and security characteristics from the multiple types of business and the multiple types of security characteristics. Set one by one, and the reciprocal of the maximum value among the values of the business request policy for each of the business and security characteristics, the business request policy for the set business and the set security characteristics, and The set work and By multiplying the simple business risk value for the set security characteristic, the risk magnitude for each of the plurality of types of security characteristics reflecting the deviation of each of the plurality of types of business from the business request policy A business risk value calculation means for calculating a business risk value for each combination of the business and the security characteristics, and classifying the calculated business risk value according to the priority of the business to be improved and the security characteristics. And a business risk value output means for outputting the output .

  According to the present invention, a risk value associated with a business can be calculated without extracting security threats and vulnerabilities from business risk factors and rating information of information assets handled by the business.

Embodiments of the present invention will be described below with reference to the drawings.
(First embodiment)
First, a first embodiment of the present invention will be described.
FIG. 1 is a block diagram illustrating an example of a functional configuration of the information processing apparatus according to the first embodiment of the present invention.
As shown in FIG. 1, the information processing apparatus according to the embodiment of the present invention is a business risk analysis support device, and includes a business risk factor definition storage unit 1, an information asset definition storage unit 2, a business asset association storage unit 3, a business risk. Factor value storage unit 4, simple business risk value calculation unit 5, business request policy calculation unit 6, simple business risk value storage unit 7, business request policy storage unit 8, business risk value calculation unit 9, business risk value storage unit 10, Business risk value display unit 11, business risk value instruction unit 12, business risk value breakdown calculation unit 13, business risk analysis value storage unit 14, business risk factor improvement value calculation unit 15, business risk analysis result display unit 16, business risk target A value input unit 17 is provided.

FIG. 2 is a block diagram illustrating an example of a hardware configuration of the information processing apparatus according to the first embodiment of the present invention.
The hardware configuration illustrated in FIG. 2 is a configuration that embodies the functions of the respective units of the information processing apparatus illustrated in FIG. 1. As a hardware configuration of the information processing device, a storage device 22 that is a nonvolatile memory, a CPU 21 that controls each unit of the device according to a program in the storage device 22, and a display unit 25 such as a display device that displays processing results and the like. And a communication interface 23 and an input device 24 used by the user for input operations, each of which is connected by a bus 26. The information processing apparatus shown in FIG. 1 can be applied to a computer having these configurations.

  The storage device 22 includes a simple business risk value calculation unit 5, a business request policy calculation unit 6, a business risk value calculation unit 9, a business risk value display unit 11, a business risk value instruction unit 12, a business risk value breakdown calculation unit 13, and a business In addition to programs corresponding to the risk factor improvement value calculation unit 15 and the business risk analysis result display unit 16, the business risk factor definition storage unit 1, the information asset definition storage unit 2, the business asset association storage unit 3, and the business risk factor value storage unit 4. Various data stored in the simple business risk value storage unit 7, the business request policy storage unit 8, the business risk value storage unit 10, and the business risk analysis value storage unit 14 are stored.

  The input device 24 is a device for realizing the business risk target value input unit 17. The display unit 25 displays the display result generated by the business risk value display unit 11 and the business risk analysis result display unit 16.

FIG. 3 is a diagram illustrating an example of a business risk factor weight table stored in the business risk factor definition storage unit of the information processing apparatus according to the first embodiment of the present invention.
FIG. 4 is a diagram illustrating an example of a business risk factor influence degree table stored in the business risk factor definition storage unit of the information processing apparatus according to the first embodiment of the present invention.
The business risk factor definition storage unit 1 stores a business risk factor weight table in the format shown in FIG. 3 and a business risk factor impact table in the format shown in FIG.

The business risk factor weight table is managed in association with a plurality of types of business risk factors and the weights of the factors. The operational risk factors on the operational risk factor weight table are operational risk factors common to various operations.

An analyst or a higher-order person stores a business risk factor weight table and a business risk factor influence degree table common to the business in the business risk factor definition storage unit 1 in advance.
The value of the business risk factor weight is defined by a value of 0 to 1.00 for the business risk factor item and the weight of each business risk factor . In this embodiment, there are four types of business risk factors: “number of members”, “number of related tasks”, “e-mail handling amount”, and “document discard amount”. In the example shown in FIG. The weight in the “e-mail handling amount” is “1.00” which is the maximum weight, and the weight in the work risk factor “number of employees” is “0.5” which is half of the weight in the “e-mail handling amount”.

The business risk factor influence degree table defines the strength of influence on security characteristics for each business risk factor item on the business risk factor weight table. In this embodiment, there are three types of security characteristics: “confidentiality”, “completeness”, and “availability”. In the example shown in FIG. The impact is “1”, the impact on “completeness” is “1”, and the impact on availability is “0”.

FIG. 5 is a schematic diagram illustrating an example of a relationship between business groups to be analyzed by the information processing apparatus according to the first embodiment of the present invention.
As shown in Fig. 5, the analyst interviewed, etc., information on the number of members belonging to multiple types of work, the number of related work, the number of e-mails handled per month, the amount of documents discarded per month, and the type of information asset , and it collects influence of the foregoing various security characteristics of various types of information assets.

In the present embodiment, there are four types of operations, “Staff Operations”, “Sales Operations”, “Development Operations”, and “Research Operations”. In the example shown in FIG. The number of affiliations is 20, the number of related tasks is 3, e-mail handling volume is 100 cases / month, document disposal amount is 6kg / month, and the information assets handled are planning information and design information.
As described above, the analyst stores the information asset rating table in the information asset definition storage unit 2 by operating the input device 24 based on the information obtained by the interview or the like.

FIG. 6 is a diagram illustrating an example of an information asset rating table stored in the information asset definition storage unit of the information processing apparatus according to the first embodiment of this invention.
Information Assets rating table manages the weight of the security characteristics of the information assets. The weights on the information asset rating table are set in the same way as defined by activities such as ISMS. In the present embodiment, information assets are three types of "planning information", "Design Information", "customer information", the impact on the confidentiality in the example shown in FIG. 6, information assets "Planning Information" The weight shown is “2”, the weight indicating the impact on integrity is “1”, and the weight indicating the impact on availability is “0”.

  In addition, the analyst stores the business asset association table in the business asset association storage unit 3 by performing an operation on the input device 24 based on the information obtained through the interview as described above.

FIG. 7 is a diagram illustrating an example of the business asset association table stored in the business asset association storage unit of the information processing apparatus according to the first embodiment of this invention.
The business asset association table manages the presence or absence of information assets handled in various business operations. In the example shown in FIG. 7, since it can be understood from the information shown in FIG. 5 that the staff information handles the planning information and the design information, the portion where the staff task and the planning information intersect, and the portion where the staff task and the design information intersect. The relationship is indicated by setting “o” mark to.

  In addition, the analyst stores the business risk factor value table in the business risk factor value storage unit 4 by performing an operation on the input device 24 based on the information obtained through the interview as described above.

FIG. 8 is a diagram illustrating an example of a business risk factor value table stored in the business risk factor value storage unit of the information processing apparatus according to the first embodiment of this invention.
The business risk factor value table manages values obtained by normalizing the business risk factor values measured for each business within the range of 0 to 1.00 for each business risk factor. In the example shown in FIG. 8 , the work risk factor value corresponding to the number of staff members belonging to the staff work is 20 which is a measured value of the number of staff work staffs, that is, the maximum number of staff members of the entire target work, that is, the R & D work It is 0.20 which is a value obtained by dividing by 100 which is a measurement value of the number of members.

  Similarly, the business risk factor value corresponding to the number of related operations of the staff operation is 1 which is a value obtained by dividing 3 which is a measured value of the number of related operations of the staff operation by 3 of the maximum number of related operations of the entire target operation. .00.

Next, the operation of the apparatus having the configuration shown in FIG. 1 will be described. FIG. 9 is a flowchart illustrating an example of a processing operation performed by the information processing apparatus according to the first embodiment of the present invention.
First, the simple business risk value calculation unit 5 includes a business risk factor weight table stored in the business risk factor definition storage unit 1, a business risk factor impact table, and a business risk factor value stored in the business risk factor value storage unit 4. Based on the table, the risk magnitude for each security characteristic based on the business risk factor value of each business is calculated as a simple business risk value and stored in the simple business risk value storage unit 7 (step S1).

Details of the simple business risk value calculation processing by the simple business risk value calculation unit 5 will be described. FIG. 10 is a flowchart illustrating an example of a simple business risk value calculation process of the information processing apparatus according to the first embodiment of this invention.
First, the simple business risk value calculation unit 5 reads the business risk factor value table stored in the business risk factor value storage unit 4 (step S11), and the business risk factor weight table stored in the business risk factor definition storage unit 1 The business risk factor influence degree table is read (steps S12 and S13).

  The simple business risk value calculation unit 5 sets the business variable i to 1 (step S14). The business variable i is an integer in which the top business on the business risk factor value table shown in FIG. 8 is set to 1 and the bottom business is the maximum value. When the variable i is set to 1, This indicates that the “staff job” at the top of the job risk factor value table shown in FIG. 8 has been selected.

  The simple business risk value calculation unit 5 sets the security characteristic variable j to 1 (step S15). The variable j of the security characteristic is an integer in which the uppermost security characteristic on the business risk factor influence degree table shown in FIG. 4 is 1, and the lowermost security characteristic is the maximum value, and the variable j is set to 1. Then, it is shown that “confidentiality” at the top of the business risk factor influence degree table shown in FIG. 4 is selected.

The simple business risk value calculation unit 5 calculates the simple business risk value (i, j) according to the following formula (1) (step S16).

  The variable k in equation (1) is an integer with the highest business risk factor on the business risk factor weight table shown in FIG. 3 as the maximum and the lowest business risk factor as the maximum value. Is set to “number of members” at the top of the business risk factor weight table shown in FIG.

  Then, the simple business risk value calculation unit 5 determines whether or not the current setting value of the variable j is less than the total number of security characteristic types on the business risk factor influence degree table shown in FIG. (Step S17).

  When it is determined “YES” in the process of step S17, the simple business risk value calculation unit 5 adds 1 to the current set value of the variable j and updates it (step S18), and returns to the process of step S16.

  If the simple business risk value calculation unit 5 determines “NO” in the process of step S17, the current set value of the variable i indicates the type of business on the business risk factor value table shown in FIG. It is determined whether the total number is less than 4, here (step S19).

  If it is determined “YES” in the process of step S19, the simple business risk value calculation unit 5 adds 1 to the current set value of the variable i and updates it (step S20), and returns to the process of step S15.

  When the simple business risk value calculation unit 5 determines “NO” in the process of step S19, the simple business risk value calculated in the process of step S16 corresponds to each of the various business and various security characteristics. A simple business risk value table is generated by storing in the risk value storage unit 7.

FIG. 11 is a diagram illustrating an example of a simple business risk value table stored in the simple business risk value storage unit of the information processing apparatus according to the first embodiment of the present invention.
Next, the business request policy calculation unit 6 handles each business based on the information asset rating table stored in the information asset definition storage unit 2 and the business asset association table stored in the business asset association storage unit 3. A weight for each security characteristic required for the business from the information asset is calculated as a business request policy and stored in the business request policy storage unit 8 (step S2).

Details of the business request policy calculation processing by the business request policy calculation unit 6 will be described. FIG. 12 is a flowchart illustrating an example of a business request policy calculation process of the information processing apparatus according to the first embodiment of this invention.
First, the business request policy calculation unit 6 reads the information asset rating table stored in the information asset definition storage unit 2 (step S21), and reads the business asset association table stored in the business asset association storage unit 3 (step S22). ).

  The business request policy calculation unit 6 sets the business variable i to 1 (step S23). The business variable i is an integer in which the top business in the business asset association table shown in FIG. 7 is set to 1 and the bottom business is set to the maximum value. 7 indicates that the “staff job” at the top of the business asset association table shown in FIG.

The business request policy calculation unit 6 sets the security characteristic variable j to 1 (step S24). The variable j of the security characteristic is an integer with the security characteristic in the leftmost column on the information asset rating table shown in FIG. 6 as 1, and the security characteristic in the rightmost column as the maximum value. The variable j is 1 Is set to “confidentiality” in the leftmost column on the information asset rating table shown in FIG.

  The business request policy calculation unit 6 sets the value of the business request policy (i, j) corresponding to the currently set variable i and variable j to the initial value 0 (step S25), and further sets the variable k to 1 Set (step S26). In the calculation of the business request policy, the variable k is an integer in which the uppermost information asset on the information asset rating table shown in FIG. When set, it indicates that “planning information” at the top of the information asset rating table shown in FIG. 6 has been selected.

The operational request policy calculating section 6, represented by the business assets associated table shown in FIG. 7, the business asset association corresponding to the variable i and the variable k is currently set (i, k) is "○" The value of the business request policy (i, j) corresponding to the currently set variable i and variable j corresponds to the currently set variable k and variable j indicated in the information asset rating table. If it is smaller than the value of the information asset rating (k, j) to be performed (YES in step S27), the business request policy (j) corresponding to the currently set variable i and variable j (k, j). i, j) is set as the value (step S28).

  If the business request policy calculation unit 6 determines “NO” after the process of step S28 or the process of step S27, the current set value of the variable k is the information asset on the information asset rating table shown in FIG. It is determined whether or not it is less than 3, here (step S29).

  If it is determined “YES” in the process of step S29, the business request policy calculation unit 6 adds 1 to the current set value of the variable k and updates it (step S30), and returns to the process of step S27.

  If it is determined “NO” in the process of step S29, the business request policy calculation unit 6 determines whether or not the current setting value of the variable j is less than the total number of security characteristic types described above (step S29). S31).

  If it is determined “NO” in the process of step S31, the business request policy calculation unit 6 adds 1 to the current setting value of the variable j and updates it (step S32), and returns to the process of step S25.

  If the business request policy calculation unit 6 determines “NO” in the process of step S31, the business request policy calculation unit 6 determines whether or not the current setting value of the variable i is less than the total number of business types described above ( Step S33).

  If it is determined “YES” in the process of step S33, the business request policy calculation unit 6 adds 1 to the current setting value of the variable i and updates it (step S34), and returns to the process of step S24.

  If the business request policy calculation unit 6 determines “NO” in the process in step S33, the business request policy corresponding to each of the various business and various security characteristics obtained in the process in step S28 is stored in the business request policy. The business request policy table is generated by storing in the unit 8.

FIG. 13 is a diagram illustrating an example of a business request policy table stored in the business request policy storage unit of the information processing apparatus according to the first embodiment of this invention.
The simple business risk value calculation unit 5 and the business request policy calculation unit 6 output a start command to the business risk value calculation unit 9 after calculating the simple business risk value and the business request policy.

  When the business risk value calculation unit 9 receives an activation command from the simple business risk value calculation unit 5 and the business request policy calculation unit 6, the simple business risk value table, the business request policy stored in the simple business risk value storage unit 7 Based on the business request policy table stored in the storage unit 8, the risk level for each security characteristic that reflects the deviation from the business request policy of each business is calculated, and the calculated risk is used as the business risk value. The value is stored in the value storage unit 10 (step S3).

Details of the business risk value calculation process by the business risk value calculation unit 9 will be described. FIG. 14 is a flowchart illustrating an example of a business risk value calculation process of the information processing apparatus according to the first embodiment of this invention.
First, the business risk value calculation unit 9 reads the simple business risk value table stored in the simple business risk value storage unit 7 (step S41) and reads the business request policy table stored in the business request policy storage unit 8 (step S41). Step S42).
The business risk value calculation unit 9 sets the business variable i to 1 (step S43), and sets the security characteristic variable j to 1 (step S44).

The business risk value calculation unit 9 calculates a business risk value (i, j) according to the following equation (2) (step S45).

  Then, the business risk value calculation unit 9 determines whether or not the current set value of the variable j is less than the total number of security characteristic types described above (step S46).

  When it is determined “YES” in the process of step S46, the business risk value calculation unit 9 adds 1 to the current setting value of the variable j and updates it (step S47), and returns to the process of step S45.

  Further, if the business risk value calculation unit 9 determines “NO” in the process of step S46, the business risk value calculation unit 9 determines whether or not the current set value of the variable i is less than the total number of business types described above ( Step S48).

  When it is determined “YES” in the process of step S48, the business risk value calculation unit 9 adds 1 to the current set value of the variable i and updates it (step S49), and returns to the process of step S44.

  When it is determined “NO” in the process of step S48, the business risk value calculation unit 9 stores the business risk value corresponding to each of the various business and various security characteristics calculated in the process of step S45. The business risk value table is generated by storing in the unit 10.

FIG. 15 is a diagram illustrating an example of a business risk value table stored in the business risk value storage unit of the information processing apparatus according to the first embodiment of this invention.
The business risk value calculation unit 9 outputs a start command to the business risk value display unit 11 after calculating the business risk value.

  Upon receiving an activation command from the business risk value calculation unit 9, the business risk value display unit 11 displays a list of the business risk values shown in the business risk value table for each type of business and security characteristics. The size is classified into levels, that is, classified according to the business to be improved and the priority of security characteristics and displayed (step S4).

Details of the business risk value display processing by the business risk value display unit 11 will be described. FIG. 16 is a flowchart illustrating an example of the business risk value display process of the information processing apparatus according to the first embodiment of this invention.
First, the business risk value display unit 11 reads a business risk value table stored in the business risk value storage unit 10 (step S51), and sets a security characteristic variable j to 1 (step S52).

  The business risk value display unit 11 calculates an average value ave (j) and a distributed value sd (j) of business risk values for each security characteristic on the business risk value table (step S53).

Then, the business risk value display unit 11 determines whether or not the current set value of the variable j is less than the total number of security characteristic types described above (step S54).
When it is determined “YES” in the process of step S54, the business risk value display unit 11 adds 1 to the current setting value of the variable j and updates it (step S55), and returns to the process of step S53.

  If the business risk value display unit 11 determines “NO” in the process of step S54, the business variable i is set to 1 (step S56), and the security characteristic variable j is set to 1 again. (Step S57).

  The business risk value display unit 11 displays the business risk value (i, j) corresponding to the currently set variable i and variable j on the business risk value table, corresponding to the currently set variable j. It is determined whether or not the sum of the average value ave (j) of values and the square root Sqr (sd (j)) of the variance values of the business risk values corresponding to the currently set variable j is exceeded (step S58).

  When it is determined “YES” in the process of step S58, the business risk value display unit 11 sets the background color of the business risk value (i, j) to be determined in the process to red (step S59). .

  If the business risk value display unit 11 determines “NO” in the process of step S58, the business risk value (i, j) described above is the average value of the business risk values corresponding to the currently set variable j. It is determined whether or not ave (j) is exceeded (step S60).

  When it is determined “YES” in the process of step S60, the business risk value display unit 11 sets the background color of the business risk value (i, j) to be determined in the process to yellow (step S59). .

  If the business risk value display unit 11 determines “NO” in the process of step S60, the business risk value (i, j) as a determination target in the process sets the background color to blue (step S62). .

  The business risk value display unit 11 determines whether or not the current set value of the variable j is less than the total number of security characteristic types described above after the processing of step S59, S61, or S62 (step S63).

  If it is determined “YES” in the process of step S63, the business risk value display unit 11 adds 1 to the current setting value of the variable j and updates it (step S64), and returns to the process of step S58.

  Further, when it is determined “NO” in the process of step S63, the business risk value display unit 11 determines whether or not the current set value of the variable i is less than the total number of business types described above ( Step S65).

  If it is determined “YES” in the process of step S65, the business risk value display unit 11 adds 1 to the current set value of the variable i and updates it (step S66), and returns to the process of step S57.

  If the business risk value display unit 11 determines “NO” in the process of step S65, the business risk value background corresponding to each of the various business and various security characteristics set in the process of step S59, S61, or S62. Display a colored table on the screen.

FIG. 17 is a diagram illustrating an example of a business risk value display result by the business risk value display unit of the information processing apparatus according to the first embodiment of the present invention.
“(R)”, “(Y)”, and “(B)” shown in FIG. 17 indicate that the background color of the corresponding business risk value column is red, yellow, and blue, respectively.

In the example shown in FIG. 17, the level classification of the business risk value is expressed by the difference between the red, yellow, and blue background colors, and represents the security characteristics of the business that should be improved with priority in this order. ing.
By performing such display, the analyst can visually grasp which security characteristic of which business should be improved.

  In addition, here, when there is a deviation greater than 1σ from the average value, it is determined to be red, yellow when it is greater than the average value, and blue in other cases, but the classification method by color and the threshold of determination are as follows: Other forms may be used.

  When the business risk value list is displayed by the business risk value display unit 11 and the analyst instructs the business risk value specified by the business type and the security characteristic type by the business risk value instruction unit 12, An activation command is output to the risk value breakdown calculation unit 13.

When the business risk value breakdown calculation unit 13 receives an activation command from the business risk value instruction unit 12, the business risk value instructed by the business risk value instruction unit 12 is stored in the business risk factor definition storage unit 1. and risk factors severity table, and operational risk factors value table stored in the business risk factor value storage section 4, based on the work request policy table stored in the business request policy storage unit 8, operational risk factors per A breakdown is calculated, and the calculation result is stored in the business risk analysis value storage unit 14 as a business risk value breakdown (step S5).

Details of the business risk value breakdown calculation processing by the business risk value breakdown calculation unit 13 will be described. FIG. 18 is a flowchart illustrating an example of a business risk value breakdown calculation process of the information processing apparatus according to the first embodiment of this invention.
First, the business risk value breakdown calculation unit 13 reads the business risk factor value table stored in the business risk factor value storage unit 4 (step S71), and stores the business risk factor weight table stored in the business risk factor definition storage unit 1 The business risk factor influence degree table is read (steps S72 and S73). Further, the business risk value breakdown calculation unit 13 reads the business request policy table stored in the business request policy storage unit 8 (step S74).

  The business risk value breakdown calculation unit 13 sets a variable i corresponding to the type of business instructed by the business risk value instruction unit 12 and a variable j corresponding to the type of security characteristic instructed by the business risk value instruction unit 12. (Steps S75 and S76).

The business risk value breakdown calculation unit 13 sets the business risk factor variable k to 1 (step S77), and calculates the business risk value breakdown (i, j, k) according to the following equation (3) (step S78). ).

  Then, the business risk value breakdown calculation unit 13 determines whether or not the current set value of the variable k is less than the total number of business risk factors on the business risk factor weight table shown in FIG. Step S79).

  If it is determined “YES” in the process of step S79, the business risk value breakdown calculation unit 13 adds 1 to the current set value of the variable k and updates it (step S80), and returns to the process of step S78.

  When the business risk value breakdown calculation unit 13 determines “NO” in the process of step S19, the business risk value breakdown calculation unit 13 responds to each of the business risk factors in the specified business and the specified security characteristics calculated in the process of step S78. The breakdown of the business risk value to be stored is stored in the business risk analysis value storage unit 14.

After the calculation of the business risk value breakdown is completed, the business risk value breakdown calculation unit 13 stores the same value as the business risk value target value in the business risk analysis value storage unit 14 and then starts the business risk factor improvement value calculation unit 15 Outputs a command.

Upon receiving the activation command from the business risk value breakdown calculation unit 13, the business risk factor improvement value calculation unit 15 stores the business risk value target value stored in the business risk analysis value storage unit 14 and the business request policy storage unit 8 . Based on the stored business request policy table, the business risk factor weight table and the business risk factor impact table stored in the business risk factor definition storage unit 1, the improvement target value of the business risk factor value is calculated, The calculation result is stored in the business risk analysis value storage unit 14 as a business risk factor improvement value (step S6).

Details of the business risk factor improvement value calculation process by the business risk factor improvement value calculation unit 15 will be described. FIG. 19 is a flowchart illustrating an example of a business risk factor improvement value calculation process of the information processing apparatus according to the first embodiment of this invention.
The business risk factor improvement value calculation unit 15 reads the business risk value target value stored in the business risk analysis value storage unit 14 (step S81), and performs the processing from step S72 to S77 described above (steps S82 to S87). Then, the business risk factor improvement value (i, j, k) is calculated according to the following equation (4) (step S88).

Then, the business risk factor improvement value calculation unit 15 determines whether or not the current set value of the variable k is less than the total number of business risk factors described above (step S89).
When it is determined “YES” in the process of step S89, the business risk factor improvement value calculation unit 15 adds 1 to the current set value of the variable k and updates it (step S90), and returns to the process of step S88. .

  If the business risk factor improvement value calculation unit 15 determines “NO” in the process of step S90, the business risk factor improvement value calculation unit 15 determines each of the business risk factors in the specified business and the specified security characteristics calculated in the process of step S88. The corresponding business risk factor improvement value is stored in the business risk analysis value storage unit 14.

FIG. 20 is a diagram illustrating an example of a business risk analysis value table stored in the business risk analysis value storage unit of the information processing apparatus according to the first embodiment of the present invention.
As shown in FIG. 20, in the business risk analysis value table, the business risk value breakdown of various business risk factors, the business risk value target value, and the business risk factor improvement value in the business and security characteristics specified by the business risk value instruction unit 12 Is managed.

The business risk factor improvement value calculation unit 15 outputs a start command to the business risk analysis result display unit 16 after storing the business risk factor improvement value.
Upon receiving a start command from the business risk factor improvement value calculation unit 15, the business risk analysis result display unit 16 breaks down the business risk values in the business risk analysis value table stored in the business risk analysis value storage unit 14 and the business risk factors The improvement values are classified and displayed on the screen in descending order of the business risk value breakdown (step S7).

Display and operational risk analysis display results in Figure 21, various operations in the specified the business "Development Services" and security characteristics "Integrity" by operational risk value instruction unit 12 in accordance with the display results of operational risk value display section 11 This is a list of business risk value breakdown of risk factors, business risk value target values, and business risk factor improvement values. “(Y)” shown in FIG. 21 indicates that the background color of the corresponding business risk value target value column is yellow.
By performing such display, the analyst can grasp which business risk factors should be improved with priority.

As described above, when the content stored in the business risk analysis value storage unit 14 is displayed by the business risk analysis result display unit 16, the analyst lowers the specific business risk value target value having a high response priority. Then, by operating the business risk target value input unit 17, the business risk value target value shown in yellow in the display result shown in FIG. 21 is corrected.
In this case, the business risk factor improvement value calculation unit 15 is activated again, and the processes in steps S6 and S7 are performed again.

For this reason, in order to lower the business risk value target value, the analyst can immediately grasp the business risk factor improvement value to be used as the business risk factor value by the business risk analysis result display unit 16.

  The analyst repeatedly instructs the business risk value instruction unit 12 to instruct high-priority business and security characteristics for business risk reduction and grasps the improvement value of the business risk factor necessary for that purpose. It is possible to reduce the operational risk value for the completed business.

  As described above, the information processing apparatus according to the first embodiment of the present invention is associated with a business without extracting security threats and vulnerabilities from business risk factors and rating information of information assets handled by the business. In addition to being able to calculate risk values, deploy risk values for each operational risk factor and quantitatively determine how much operational risk factor value should be improved against the target risk value reduction amount. Can be calculated.

  Therefore, it is possible to obtain a quantitative improvement target value as to which business risk factor of which business should be improved without depending on the registered contents of the security threat and vulnerability database registered in advance. Since it becomes obvious at a glance how much risk factor value of which business should be improved in a certain business, it is possible to greatly improve the efficiency of analysis work.

(Second Embodiment)
Next, a second embodiment of the present invention will be described. In addition, description of the same part as what was shown in FIG. 1 among the structures of the information processing apparatus which concerns on this embodiment is abbreviate | omitted.
FIG. 22 is a block diagram illustrating an example of a functional configuration of the information processing apparatus according to the second embodiment of the present invention.
This embodiment realizes business risk analysis support including normalization processing. As compared with the first embodiment, the information processing apparatus according to the second embodiment of the present invention includes a business risk factor measurement value storage unit 31, a business risk factor value calculation unit 32, and a business risk factor value maximum value storage unit 33. Further prepare.

FIG. 23 is a diagram illustrating an example of a business risk factor measurement value table stored in the business risk factor measurement value storage unit of the information processing apparatus according to the second embodiment of the present invention.
As shown in FIG. 23, the business risk factor measurement value storage unit 31 stores a business risk factor measurement value table. The business risk factor measurement value table manages the business risk factor values measured for each business.

  That is, in the second embodiment, unlike the first embodiment, the analyst does not perform the normalization process on the business risk factor value indicated by the information obtained through the interview as described above, and the business risk factor The measured value storage unit 31 stores it as it is.

FIG. 24 is a flowchart illustrating an example of a processing operation performed by the information processing apparatus according to the second embodiment of the present invention.
In the second embodiment, the business risk factor value calculation unit 32 performs the processing before the processing by the simple business risk value calculation unit 5 is performed.

  The business risk factor value calculation unit 32 stores the maximum value of each business risk factor value on the business risk factor measurement value table between the tasks in the business risk factor value maximum value storage unit 33 for each business risk factor, and also normalizes it. The processed business risk factor value is stored in the business risk factor value storage unit 4 (step S8).

  The business risk factor maximum value is not the business risk value specified by the business risk value instruction unit 12 when the business risk factor value to be improved is the maximum value in the security characteristics, but other business risks with the same security characteristics. This is to avoid lowering the value by normalization.

Details of the business risk factor value calculation processing by the business risk factor value calculation unit 32 will be described. FIG. 25 is a flowchart illustrating an example of a business risk factor value calculation process of the information processing apparatus according to the second embodiment of this invention.
First, the business risk factor value calculation unit 32 reads the business risk factor measurement value table stored in the business risk factor measurement value storage unit 31 (step S91).

  The business risk factor value calculation unit 32 sets the business risk factor variable k to 1 (step S92), sets the business risk factor maximum value (k) to 0 (step S93), and sets the business variable i to 1 Setting is made (step S94).

The business risk factor value calculation unit 32 determines that the business risk factor maximum value (k) that has been set corresponds to the currently set variable i and variable k in the business risk factor measurement value table (i, k) It is determined whether it is less than (step S95).
If the business risk factor value calculation unit 32 determines “YES” in the process of step S95, the business risk factor measurement value (i, k) to be determined in the process is determined as the business risk factor maximum value (k). ) (Step S96).

  The business risk factor value calculation unit 32 determines whether or not the current set value of the variable i is less than the total number of business types described above when it is determined “NO” in the process of step S95 or after the process of step S96. A determination is made (step S97).

If it is determined “YES” in the process of step S97, the business risk factor value calculation unit 32 adds 1 to the current set value of the variable i and updates it (step S98), and returns to the process of step S95.
When it is determined “NO” in the process of step S97, the business risk factor value calculation unit 32 sets the business variable i to 1 again (step S99).

  The business risk factor value calculation unit 32 divides the business risk factor measurement values (i, k) corresponding to the currently set variable i and variable k by the business risk factor maximum value (k) set in step S96. The measured value is set as the business risk factor measurement value (i, k) (step S100).

The business risk factor value calculation unit 32 determines whether or not the current set value of the variable i is less than the total number of business types described above (step S101).
If it is determined “YES” in the process of step S101, the business risk factor value calculation unit 32 adds 1 to the current setting value of the variable i and updates it (step S102), and returns to the process of step S100.

  When it is determined “NO” in the process of step S103, the business risk factor value calculation unit 32 determines whether or not the current set value of the variable k is less than the total number of business risk factors described above ( Step S103).

  When it is determined “YES” in the process of step S103, the business request policy calculation unit 6 adds 1 to the current set value of the variable k and updates it (step S104), and returns to the process of step S93.

If the business request policy calculation unit 6 determines “NO” in the process of step S103, the business risk factor value for each business and each business risk factor calculated in the process of step S100 is obtained. By storing in the storage unit 4, a business risk factor value is generated.
The business risk factor value calculation unit 32 activates the simple business risk value calculation unit 5 after the storage process in the business risk factor value storage unit 4.

  Further, instead of the process of step S6 described in the first embodiment, the business risk factor improvement value calculation unit 15 stores the business risk value target value stored in the business risk analysis value storage unit 14 and the business request policy storage. The business request policy table stored in the section 8, the business risk factor weight table and the business risk factor influence degree table stored in the business risk factor definition storage section 1, and the business risk factor value maximum value storage section 33 Based on the business risk factor maximum value, an improvement target value of the business risk factor value is calculated, and the calculation result is stored in the business risk analysis value storage unit 14 as a business risk factor improvement value (step S9).

Details of the business risk factor improvement value calculation process by the business risk factor improvement value calculation unit 15 will be described. FIG. 26 is a flowchart illustrating an example of a business risk factor improvement value calculation process of the information processing apparatus according to the second embodiment of this invention.
The business risk factor improvement value calculation unit 15 performs the processing from step S81 to S84 described above (steps S111 to S114), and the business risk factor maximum for each business risk factor stored in the business risk factor value maximum value storage unit 33. A value is read (step S115).

Then, the business risk factor improvement value calculation unit 15 performs the processing from step S85 to S87 described above (steps S116 to S118), and the business risk factor improvement value (i, j, k) according to the following equation (5). Is calculated (step S119).

Then, the business risk factor improvement value calculation unit 15 determines whether or not the current set value of the variable k is less than the total number of business risk factors described above (step S120).
When it is determined “YES” in the process of step S120, the business risk factor improvement value calculation unit 15 adds 1 to the current set value of the variable k and updates it (step S121), and returns to the process of step S119. .

  If the business risk factor improvement value calculation unit 15 determines “NO” in the process of step S121, the business risk factor improvement value calculation unit 15 determines each of the business risk factors in the specified business and the specified security characteristics calculated in the process of step S121. The corresponding business risk factor improvement value is stored in the business risk analysis value storage unit 14.

FIG. 27 is a diagram illustrating an example of the display result of the business risk analysis result by the business risk analysis result display unit of the information processing apparatus according to the second embodiment of the present invention.
As shown in FIG. 27, in the display result of the business risk analysis result in the second embodiment, since the business risk factor improvement value is displayed in the same unit as the business risk factor measurement value, more specific business risk factor It is possible to obtain an improvement target value.

  The present invention is not limited to the above-described embodiment as it is, and can be embodied by modifying the constituent elements without departing from the scope of the invention in the implementation stage. Various inventions can be formed by appropriately combining a plurality of constituent elements disclosed in the embodiment. For example, some components may be omitted from all the components shown in the embodiment. Furthermore, you may combine suitably the component covering different embodiment.

FIG. 2 is a block diagram showing an example of a functional configuration of the information processing apparatus according to the first embodiment of the present invention. The block diagram which shows an example of the hardware constitutions of the information processing apparatus in the 1st Embodiment of this invention. The figure which shows an example of the business risk factor weight table stored in the business risk factor definition storage part of the information processing apparatus in the 1st Embodiment of this invention. The figure which shows an example of the business risk factor influence degree table stored in the business risk factor definition storage part of the information processing apparatus in the 1st Embodiment of this invention. The schematic diagram which showed an example of the relationship of the business group of the analysis object by the information processing apparatus in the 1st Embodiment of this invention. The figure which shows an example of the information asset rating table stored in the information asset definition storage part of the information processing apparatus in the 1st Embodiment of this invention. The figure which shows an example of the business asset correlation table stored in the business asset correlation storage part of the information processing apparatus in the 1st Embodiment of this invention. The figure which shows an example of the business risk factor value table stored in the business risk factor value storage part of the information processing apparatus in the 1st Embodiment of this invention. 5 is a flowchart illustrating an example of a processing operation performed by the information processing apparatus according to the first embodiment of the present invention. The flowchart which shows an example of the simple business risk value calculation process of the information processing apparatus in the 1st Embodiment of this invention. The figure which shows an example of the simple business risk value table stored in the simple business risk value storage part of the information processing apparatus in the 1st Embodiment of this invention. 5 is a flowchart illustrating an example of a business request policy calculation process of the information processing apparatus according to the first embodiment of the present invention. The figure which shows an example of the business request policy table stored in the business request policy storage part of the information processing apparatus in the 1st Embodiment of this invention. The flowchart which shows an example of the business risk value calculation process of the information processing apparatus in the 1st Embodiment of this invention. The figure which shows an example of the business risk value table stored in the business risk value storage part of the information processing apparatus in the 1st Embodiment of this invention. The flowchart which shows an example of the business risk value display process of the information processing apparatus in the 1st Embodiment of this invention. The figure which shows an example of the display result of the business risk value by the business risk value display part of the information processing apparatus in the 1st Embodiment of this invention. The flowchart which shows an example of the business risk value breakdown calculation process of the information processing apparatus in the 1st Embodiment of this invention. The flowchart which shows an example of the business risk factor improvement value calculation process of the information processing apparatus in the 1st Embodiment of this invention. The figure which shows an example of the business risk analysis value table stored in the business risk analysis value storage part of the information processing apparatus in the 1st Embodiment of this invention. The figure which shows an example of the display result of the business risk analysis result by the business risk analysis result display part of the information processing apparatus in the 1st Embodiment of this invention. The block diagram which shows an example of a function structure of the information processing apparatus in the 2nd Embodiment of this invention. The figure which shows an example of the business risk factor measured value table stored in the business risk factor measured value storage part of the information processing apparatus in the 2nd Embodiment of this invention. 10 is a flowchart illustrating an example of a processing operation performed by the information processing apparatus according to the second embodiment of the present invention. The flowchart which shows an example of the business risk factor value calculation process of the information processing apparatus in the 2nd Embodiment of this invention. The flowchart which shows an example of the business risk factor improvement value calculation process of the information processing apparatus in the 2nd Embodiment of this invention. The figure which shows an example of the display result of the business risk analysis result by the business risk analysis result display part of the information processing apparatus in the 2nd Embodiment of this invention.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Business risk factor definition storage part, 2 ... Information asset definition storage part, 3 ... Business asset correlation storage part, 4 ... Business risk factor value storage part, 5 ... Simple business risk value calculation part, 6 ... Business request policy calculation part , 7 ... Simple business risk value storage unit, 8 ... Business request policy storage unit, 9 ... Business risk value calculation unit, 10 ... Business risk value storage unit, 11 ... Business risk value display unit, 12 ... Business risk value instruction unit, 13 ... Business risk value breakdown calculation unit, 14 ... Business risk analysis value storage unit, 15 ... Business risk factor improvement value calculation unit, 16 ... Business risk analysis result display unit, 17 ... Business risk target value input unit, 21 ... CPU, DESCRIPTION OF SYMBOLS 22 ... Memory | storage device, 23 ... Communication interface (I / F), 24 ... Input device, 25 ... Display part, 26 ... Bus, 31 ... Business risk factor measured value storage part, 32 ... Business risk factor value calculation part, 33 ... Business Risk factors Maximum storage unit.

Claims (4)

An information processing apparatus constituted by a computer,
Operational risk factor is a degree of influence on each of the multiple types of security characteristics for each of the common operational risk factors weighting is a weighting, and the plurality of types of operational risk factors to a plurality of types of operations with respect to a plurality of types of operational risk factors A business risk factor definition storage for storing the impact ,
And operational risk factor value storage unit for storing the operational risk factor values are the respective values of a plurality of types of operational risk factors for each of the plurality of types of business,
One type of business, security characteristics and business risk factors are set from the plurality of types of business, the plurality of types of security characteristics and the plurality of types of business risk factors, and the plurality of types of security characteristics and the plurality of types of business risk factors are set. For the reciprocal of the value obtained by multiplying the maximum value of the operational risk factor influence values stored in the operational risk factor definition storage unit for each of the operational risk factors by the number of types of operational risk factors, And the business risk factor value stored in the business risk factor value storage unit for the set business risk factor, the set security characteristics and the business risk factor influence degree for the set business risk factor, Before being stored in the business risk factor definition storage for the set business risk factor By multiplying the sum of the calculated values for each of the plurality of types of operational risk factors the product of the operational risk factors weight, simple operational risks is the magnitude of the risk to the security properties based on operational risk factors value for each business Simple business risk value calculation means for calculating a value for each combination of each business and each security characteristic ;
An information asset definition storage unit for storing the plurality of types of weighting for each is information assets rating information security characteristics for each of a plurality of types of information assets,
And the plurality of types of each of the plurality of types of information each business asset association storage unit for storing business asset association information indicating whether or not handling of assets for business,
One type of business and security characteristics are set for each of the plurality of types of business and the plurality of types of security characteristics, and the set business is handled in the business asset association information stored in the business asset association storage unit. The maximum value of the weights for the set security characteristics in the information asset rating information stored in the information asset definition storage unit for the information asset is the weight for the set security characteristics required for the set work. and operational by the value of the request policy, the business request policy calculating means for calculating said work request policy for each combination of the respective business and the respective security characteristics is,
One type of business and security characteristics are set from the plurality of types of business and the plurality of types of security characteristics, and the reciprocal of the maximum value among the values of the business request policy for each of the business and security characteristics, By multiplying the business request policy for the set business and the set security characteristic, and the simple business risk value for the set business and the set security characteristic, the business of each of the plurality of types of business. A business risk value calculating means for calculating a business risk value that is a magnitude of a risk for each of the plurality of types of security characteristics reflecting a deviation from a request policy for each of the business and each combination of the security characteristics ;
The information processing apparatus characterized by the calculated operational risk value, and a business risk value output means for outputting the classified according to the priority of the work and the security properties to be improved. And operational risk value designating means for designating the operational risk value on security characteristics of the one type of business and the any kind of operational risk values displayed by the operational risk value output means,
For the business risk value related to the business and security characteristics specified by the business risk specifying means, one type of business risk factor is set from the plurality of types of business risk factors, and the business request for each of the business and security characteristics is set. A maximum value among policy values, and a maximum value among the business risk factor influence values stored in the business risk factor definition storage unit for each security characteristic and each business risk factor; The business request policy for the business specified by the business risk value specifying means and the specified security characteristics, the specified business and the set business risk are multiplied by the reciprocal of the product risk factor type number. The business risk factor value for the factor and the specified security By calculating the product of the value of the operational risk factors impact on utility characteristics and operational risk factors described above sets, the said operational operational risk value breakdown is the breakdown for each type of risk factor of the operational risk value A business risk value breakdown calculation means for calculating each combination of the designated business, the designated security characteristics and each business risk factor ;
From the plurality of types of business, the plurality of types of security characteristics, and the plurality of types of business risk factors, business, security characteristics and business risk factors are set one by one, and the business regarding the set business and the set security characteristics The value of the request policy, the value of the business risk factor weight stored in the business risk factor definition storage unit for the set business risk factor, the business risk for the set security characteristic and the set business risk factor The reciprocal of the factor influence value multiplied by the set work, the set security characteristic and the set work risk factor for the set work risk factor, and the respective work and each security characteristic. Of the business request policy values for A large value, the By multiplying the maximum value among the values of the operational risk factors influence for each of the security features and the business risk factors, and a number of types of the operational risk factors, the operational risk An operational risk factor improvement value calculating means for calculating an operational risk factor improvement value, which is an improvement target value of the factor value, for each combination of the operations, the security characteristics, and the operational risk factors;
The information processing apparatus according to claim 1, further comprising a business risk analysis result display unit configured to display a list of the calculated business risk value breakdown and business risk factor improvement values. A business risk factor measurement value storage means for storing a business risk factor measurement value that is a measurement value of each of the plurality of types of business risk factors for each of the plurality of types of business;
One type of business and business risk factors is set from the plurality of types of business risk factors, and a business risk factor maximum value that is the maximum value between the business risk factor measurement values for the set business risk factors is obtained, The business risk factor relating to the set business risk factor and the set business risk factor is a value normalized by dividing the measured business risk factor measurement value by the calculated maximum business risk factor value for the set business risk factor. by the measurement value, further comprising a business risk factors value calculating means for calculating the operational risk factor values for each combination of the respective business and the respective business risk factors,
The business risk factor improvement value calculation means is:
From the plurality of types of business, the plurality of types of security characteristics, and the plurality of types of business risk factors, business, security characteristics and business risk factors are set one by one, and the business regarding the set business and the set security characteristics The value of the request policy, the value of the business risk factor weight stored in the business risk factor definition storage unit for the set business risk factor, the business risk for the set security characteristic and the set business risk factor The reciprocal of the factor influence value multiplied by the set work, the set security characteristic and the set work risk factor for the set work risk factor, and the respective work and each security characteristic. Of the business request policy values for A large value, a maximum value among the business risk factor impact values for each security characteristic and each business risk factor, the number of types of the business risk factor and the set business risk factor. 3. The information processing apparatus according to claim 2 , wherein a business risk factor improvement value, which is an improvement target value of the business risk factor value, is calculated by multiplying the calculated business risk factor maximum value . Computer
Operational risk factor is a degree of influence on each of the multiple types of security characteristics for each of the common operational risk factors weighting is a weighting, and the plurality of types of operational risk factors to a plurality of types of operations with respect to a plurality of types of operational risk factors Business risk factor definition storage for storing the impact ,
The plurality of types of the operational risk factor value storage unit for storing operational risk factor values are the respective values of a plurality of types of operational risk factors for each business,
One type of business, security characteristics and business risk factors are set from the plurality of types of business, the plurality of types of security characteristics and the plurality of types of business risk factors, and the plurality of types of security characteristics and the plurality of types of business risk factors are set. For the reciprocal of the value obtained by multiplying the maximum value of the operational risk factor influence values stored in the operational risk factor definition storage unit for each of the operational risk factors by the number of types of operational risk factors, And the business risk factor value stored in the business risk factor value storage unit for the set business risk factor, the set security characteristics and the business risk factor influence degree for the set business risk factor, Before being stored in the business risk factor definition storage for the set business risk factor By multiplying the sum of the calculated values for each of the plurality of types of operational risk factors the product of the operational risk factors weight, simple operational risks is the magnitude of the risk to the security properties based on operational risk factors value for each business Simple business risk value calculation means for calculating values for each business and each combination of security characteristics ,
The information asset definition storage unit for storing information assets rating information is a weighting for each of a plurality of types of security characteristics for each of a plurality of types of information assets,
The plurality of types of the storage portion associated with the business assets to store business asset association information indicating whether or not each of the handling of a plurality of kinds of information assets for each business,
One type of business and security characteristics are set for each of the plurality of types of business and the plurality of types of security characteristics, and the set business is handled in the business asset association information stored in the business asset association storage unit. The maximum value of the weights for the set security characteristics in the information asset rating information stored in the information asset definition storage unit for the information asset is the weight for the set security characteristics required for the set work. business by the value of the request policy, the business request policy calculating means for calculating said work request policy for each combination of the respective business and the respective security characteristics is,
One type of business and security characteristics are set from the plurality of types of business and the plurality of types of security characteristics, and the reciprocal of the maximum value among the values of the business request policy for each of the business and security characteristics, By multiplying the business request policy for the set business and the set security characteristic, and the simple business risk value for the set business and the set security characteristic, the business of each of the plurality of types of business. A business risk value calculating means for calculating a business risk value, which is a magnitude of risk for each of the plurality of types of security characteristics reflecting a deviation from a request policy, for each business and each combination of the security characteristics ; and Calculated business risk Value, the operations and the information processing program to be classified according to the priority of the security characteristics to function as an operational risk value output means for outputting to be improved.

Images