JP5419475B2 - Security management apparatus and program - Google Patents

Description

  The present invention relates to an apparatus for managing the implementation status of security measures, and more specifically to an apparatus for managing the implementation status of information security measures implemented in a certain organization.

  There is an information security measure benchmark provided by IPA (Information Processing Promotion Organization) as a measure of the overall management status of information security measures not limited to IT (Information Technology) in organizations such as companies (Reference URL) : Http://www.ipa.go.jp/security/benchmark/benchmark-gaiyou.html).

The primary purpose of this is to obtain an overview of the implementation status of information security measures by answering 25 questions regarding information security measures implemented by the organization.
Also, in this information security measure benchmark, by evaluating the level of information security desired for the organization from responses concerning the company profile of 15 items, or by comparing with other organizations such as other companies in the same industry or companies in the group, The second purpose is to evaluate the information security management situation of the organization viewed from outside the organization, which is a major feature.

In addition, for example, an apparatus has been proposed that is intended to ensure that the system setting according to the information security policy in the organization is performed by the client (Patent Document 1).
This is a mechanism for performing optimum and specific system settings derived from the information security policy of the organization for various IT devices connected to the LAN (Local Area Network) in the organization.
In this system, variations of setting information to be set for IT devices connected to the in-house system are prepared in advance, and specific information and installed information of each IT device represented by a PC (Personal Computer) are prepared. S / W (Soft Wear) information and the like are acquired, and an appropriate system setting is selected from the pre-registered settings in the PC and set.

JP 2006-184936 A

As described above, in the above information security countermeasure benchmark, the purpose of the organization's information security management overview is to make it visible as compared to other organizations. There is a problem that it is difficult to manage details of management measures.
In other words, organizations often change or strengthen some security measures depending on the business characteristics of the sub-organizations that make up the organization and restrictions on the location of the sub-organization offices. There is a point that does not appear in "Overview".

On the other hand, in the system described in Patent Document 1, the target is IT including in-house network settings.
In information security, aspects other than IT, such as how the emergency response represented when an incident occurs is thoroughly implemented by all members of the organization, and whether the members of the organization handle information appropriately in the performance of a certain task. Many of them are complementary to each other.
Therefore, in this system, there is a problem that it is impossible to grasp the overall information security measure status not limited to IT.

  One of the main purposes of this invention is to solve the above-mentioned problems, and the implementation status of a wide range of information security measures adopted by the organization is evaluated in detail against the existing evaluation criteria. The main purpose is to realize a mechanism that can do this.

The security management device according to the present invention is:
An information association unit for associating survey item information indicating a survey item for investigating the implementation status of security measures with security management standard information indicating an evaluation criteria for evaluating the implementation status of security measures;
An information storage unit for storing survey item information and security management information;
Survey results for the survey items indicated in the survey item information are acquired, the acquired survey results are associated with the survey item information, and the survey items in the survey item information are associated with the survey results and the evaluation criteria in the security management standard information. And a result acquisition unit.

  According to the present invention, it is possible to associate a survey item for investigating the implementation status of security measures, a survey result for the survey item, and an evaluation standard for evaluating the implementation status of security measures. The situation can be evaluated in detail against the evaluation criteria.

1 is a diagram illustrating a configuration example of an information security management device according to Embodiment 1. FIG. FIG. 4 is a diagram illustrating a configuration example of an information security management device according to a second embodiment. FIG. 10 is a diagram illustrating a configuration example of an information security management device according to a third embodiment. FIG. 10 is a diagram illustrating a configuration example of an information security management device according to a fourth embodiment. FIG. 10 is a diagram illustrating a configuration example of an information security management device according to a fifth embodiment. FIG. 10 is a diagram illustrating a configuration example of an information security management device according to a fifth embodiment. FIG. 4 is a diagram showing an example of a table for process control according to the first embodiment. FIG. 6 is a diagram showing an example of user attribute information according to the first embodiment. FIG. 5 is a diagram showing an example of confirmation item information according to the first embodiment. FIG. 5 is a diagram showing an example of confirmation item information according to the first embodiment. FIG. 6 is a diagram showing an example of inter-list relationship information according to Embodiment 1. FIG. 6 is a diagram illustrating an example of confirmation item evaluation result information according to the first embodiment. FIG. 6 is a diagram illustrating an example of confirmation item evaluation result information according to the first embodiment. The figure which shows the example of the confirmation item-result relationship information which concerns on Embodiment 1. FIG. FIG. 5 shows an example of analysis information according to the first embodiment. FIG. 10 is a diagram illustrating an example of guide item information according to the second embodiment. FIG. 10 is a diagram illustrating an example of guide item information according to the second embodiment. The figure explaining the keyword extraction and keyword collation operation | movement which concern on Embodiment 3. FIG. FIG. 10 is a diagram for explaining an operation for subdividing confirmation items according to the fourth embodiment. The figure which shows the relationship between the information security measure group of the organization which concerns on Embodiment 5, and the information security measure group in a sub organization. FIG. 3 is a flowchart showing an example of an operation flow according to the first embodiment. FIG. 3 is a flowchart showing details of an environment setting phase according to the first embodiment. FIG. 4 is a flowchart showing details of confirmation item information generation processing according to Embodiment 1; FIG. 3 is a flowchart showing details of an implementation status confirmation phase according to the first embodiment. FIG. 9 is a flowchart showing details of confirmation item information generation processing according to Embodiment 2; FIG. 9 is a flowchart showing details of a keyword extraction phase according to the third embodiment. FIG. 10 is a flowchart showing details of confirmation item information generation processing according to Embodiment 3; FIG. 9 is a flowchart showing details of confirmation item information generation processing according to Embodiment 4; The figure which shows the hardware structural examples, such as the information security management apparatus concerning Embodiment 1-5.

Embodiment 1 FIG.
FIG. 1 shows a configuration example of an information security management apparatus 1 according to the present embodiment.
In FIG. 1, an information security management apparatus 1 is an apparatus for the purpose of confirming an implementation status of information security measures adopted in an organization.
More specifically, the information security management apparatus 1 confirms (examines) the implementation status of information security measures adopted in the organization, and the existing information security policy implementation status. In this way, the confirmation result (investigation result) for the confirmation item, the confirmation item, and the existing evaluation standard are associated with each other.
The existing evaluation standard is an existing standard such as JIS Q 27002, for example.
The information security management device 1 is an example of a security management device.
In the following, an example of investigating and evaluating the implementation status of information security measures will be described. However, the information security management apparatus 1 according to the present embodiment is not limited to information security in a narrow sense such as measures against unauthorized access and prevention of information leakage. For example, application to the investigation and evaluation of the implementation status of a wide range of security measures such as whether personal authentication is performed by IC card or biometric information when entering the office, or whether a surveillance camera is installed at a predetermined position can do.

The user 2 of the information security management device 1 is classified into an operator and a user. An operator is also called an administrator. A user is also called a general user.
The operator is a system administrator who manages the information system in the organization. The operator uses the information security management device 1 to collect information security measure implementation results, and from the survey results, analyzes the information security measure implementation status, evaluates the implementation status, and the like.
The user is a user who uses an information system in the organization. The user responds to the information security management apparatus 1 regarding the implementation status of the information security measures.
An operator and a user may communicate with the information security management apparatus 1 via a network such as a LAN from a terminal device assigned to each person, for example, or a keyboard connected to the information security management apparatus 1 An input from the information security management apparatus 1 may be obtained by inputting to the information security management apparatus 1 using a mouse, a display device or the like (not shown).
Moreover, the same user may play the role of both an operator and a user.
The operator and user are collectively referred to as user 2.

  Next, an internal configuration example of the information security management apparatus 1 will be described.

  The input / output unit 10 serves as an interface with a keyboard, mouse, display device, communication board, and the like connected to the information security management device 1, and inputs information from the user 2 through the keyboard, mouse, communication board, etc. In addition, information is output to the user 2 via a display device, a communication board, or the like.

The user attribute management unit 11 manages user attribute information such as user identification information, information on the organization to which the user belongs, a role that the user plays in information security, and authentication information for authenticating the user. To do.
An example of user attribute information is shown in FIG.

When the user authentication unit 12 is accessed, the user attribute information is registered from the registered user based on the user attribute information registered in advance through the user attribute management unit 11 and the information actually input by the user. In addition to authenticating whether the access is made or not, if the access is from a registered user, the attribute of the accessed user is determined. The attribute is, for example, the department to which the user belongs, qualification, job title, job function, or the like.
The user authentication unit 12 is an example of an authentication unit.

The execution process control unit 13 controls processes that can be executed by the user based on the attribute of the user and the confirmation status of the implementation status of each information security measure.
Moreover, the execution process control part 13 controls the process which can be performed according to a user's attribute.
As the user attribute for control, for example, the role of whether it is an administrator (operator) or a general user (user) who should grasp the information security implementation status, a department to which the user belongs, or the like may be used. . Moreover, you may utilize a table | surface like FIG. 7 for control.
In FIG. 7, an operation permitted for each user is indicated by “◯”.

The implementation status input unit 14 presents confirmation items (investigation items) for confirming the implementation status of individual information security measures to the user via the input / output unit 10, and the confirmation item evaluation result ( The confirmation item evaluation result information indicating the survey result is acquired from the user via the input / output unit 10, and further, evidence information indicating the implementation status is acquired from the user as a part of the confirmation item evaluation result information.
The confirmation item is shown in the information security measure related information 301 of the confirmation item information 300 shown in FIGS. 9 and 10, for example. A portion indicated by reference numeral 3011 in FIG. 10 is a confirmation item, and the user confirms an item indicated in the confirmation item 3011.
The confirmation item is an item uniquely established by an organization such as a company in order to confirm the implementation status of information security measures.
Details of the confirmation item information 300 will be described later.
12 and 13 show examples of confirmation item evaluation result information that is an answer from the user.
The confirmation item evaluation result information 500 includes an information ID 503, a confirmation item evaluation result 501, and evidence information 502.
The confirmation item evaluation result 501 is a content that the user himself / herself evaluated the implementation status based on the implementation status determination criterion information 303. That is, the level corresponding to the implementation status (any of the levels indicated in the implementation status determination criterion information 303) is indicated.
The evidence information 502 is information that can be objectively confirmed when determining the implementation status.
The evidence information 502 may be entered as necessary. That is, the evidence information 502 can be omitted. If there is other necessary information, it may be added as additional information.
The information ID 503 is set by the implementation status input unit 14 when the implementation status input unit 14 acquires the confirmation item evaluation result information 500.

In addition, the implementation status input unit 14 associates the acquired confirmation item evaluation result, the confirmation item, and an existing standard regarding the implementation status of the information security measure.
The existing standard regarding the implementation status of information security measures is an existing evaluation standard regarding the implementation status of information security measures represented by JIS Q27002, as described above.
The association between the confirmation item evaluation result, the confirmation item, and the existing standard is performed, for example, by generating confirmation item-result relationship information 600 shown in FIG.
14, the confirmation item information ID is the information ID 304 (AA00123) of the confirmation item information 300 shown in FIGS. 9 and 10, and the confirmation item evaluation result information ID is the confirmation item evaluation result information shown in FIGS. 500 information ID 503 (ZZ01456).
As shown in FIG. 10, since the confirmation item information 300 includes relation information 302 with the existing standard indicating the existing standard related to the confirmation item, the confirmation item is obtained from the confirmation item-result relation information 600 of FIG. Evaluation results, confirmation items, and existing standards can be associated.
The implementation status input unit 14 is an example of a survey result acquisition unit.

  The implementation status management unit 15 manages the implementation status input status of the user for items for confirming the implementation status of individual information security measures.

The confirmation list management unit 16 manages the processing status of confirmation item information which is a set of confirmation items for confirming the implementation status of individual information security measures.
More specifically, the confirmation list management unit 16 uses information security measure related information 301 (survey item information) indicating confirmation items and information (JIS Q 27002) indicating existing evaluation criteria regarding the implementation status of information security measures. Etc.) Confirmation item information indicating the association between the information security measure related information 301 and the existing standard is managed while being associated with (security management standard information).
That is, as shown in FIGS. 9 and 10, the confirmation list management unit 16 includes the information security measure related information 301 in which the confirmation item 3011 is included, and the existing list indicating the existing standard related to the confirmation item. The confirmation item information 300 including the relationship information 302 is managed.
Furthermore, the confirmation list management unit 16 sets a user attribute 3014 that is a target of the confirmation item 3011.
The confirmation list management unit 106 is an example of an information association unit and an attribute setting unit.

The inter-list relationship management unit 17 manages the relationship between the existing standards represented by JIS Q 27002 and the confirmation items for confirming the implementation status of individual information security measures.
For example, the inter-list relationship management unit 17 generates the inter-list relationship information 400 illustrated in FIG. 11 and manages the relationship between the existing criteria and the confirmation items.
In the inter-list relationship information 400 of FIG. 11, the information ID 304 (AA00123 in the examples of FIGS. 10 and 11) of the confirmation item information 300 and the existing standard ID (JIS Q 27002 7.2.2 in FIG. 12) correspond. Attached.

Information handled in the information security management device 1 is managed in the next DB (Data Base).
The environment DB 31 stores user attribute information 200 (FIG. 8) such as user identification information, organization information to which the user belongs, a role that the user plays in information security, and authentication information for authenticating the user. Store.
The reply result DB 32 stores confirmation item evaluation result information 500 shown in FIGS. 12 and 13 and confirmation item-result relation information 600 shown in FIG.
The confirmation list DB 33 stores confirmation item information 300 (FIGS. 9 and 10) that is information on information security measures adopted in the organization.
The baseline list DB 34 stores information (JIS Q 27002, etc.) related to existing information security management standards.
The confirmation list DB 33 and the baseline list DB 34 are examples of information storage units.
The inter-list relationship DB 35 stores inter-list relationship information 400 that indicates a correspondence relationship between information on existing information security management standards and information security measures adopted in the organization.

Next, the operation of the information security management apparatus 1 according to the present embodiment will be described using FIG.
The information security management device 1 operates in the order of the environment setting phase (S1), the implementation status confirmation phase (S2), and the analysis phase (S3).

First, the environment setting phase of the information security management apparatus 1 will be described.
FIG. 22 is a flowchart illustrating an operation example of the information security management device 1 in the environment setting phase.

  First, in step S101, the user attribute management unit 11 shows user identification information, information on an organization to which the user belongs, a role that the user plays in information security, authentication information for authenticating the user, and the like. User attribute information 200 (FIG. 8) is input via the input / output unit 10 and registered in the environment DB 31.

  Next, in step S102, the confirmation list management unit 16 inputs existing information security management standard information such as JIS Q27002 and information security countermeasure benchmarks via the input / output unit 10 and stores them in the baseline list DB 34 ( Information storage step). It is desirable that the existing information security management standard information is generally evaluated to some extent.

Next, in step S103, the confirmation list management unit 16 generates confirmation item information indicating an information security measure adopted in the organization based on an instruction from the operator, and the generated confirmation item information is stored in the confirmation list DB 33. Store (information association step) (information storage step).
As shown in FIGS. 9 and 10, the confirmation item information 300 includes an information ID 304, information security measure related information 301, relationship information 302 with existing standards, and implementation status determination reference information 303.

  Details of the confirmation item information 300 will be described with reference to FIG.

The information security measure related information 301 is composed of the following elements.
Information 3012 that represents an overview of information security measures in the organization, a document 3013 that defines details of information security measures in the organization, confirmation items 3011 for confirming the implementation status of information security measures, information 3014 that identifies a person to be implemented It is.
The content (sentence) shown in the confirmation item 3011 is presented to the user, and the user investigates the implementation status of the information security measure according to the content of the confirmation item 3011.
Also, the information 3014 indicates the user attributes of the user who investigates the confirmation item 3011, that is, the user who is the target of the confirmation item 3011. User attributes include, for example, the department to which the user belongs, qualifications, job titles, and job functions.
Information security measure related information 301 is an example of survey item information.

  Further, the relationship information 302 with the existing standard includes identification information 3021 of the existing information security management standard information (JIS Q 27002, information security benchmark, etc.) associated with the information security measure related information 301.

The implementation status determination criterion information 303 includes the following elements.
They are judgment criterion information 3031 for judging the implementation status of the information security measure, and a baseline 3032 indicating a target level as an organization among the levels indicated in the judgment criterion information 3031.
With respect to the determination criterion information 3031, the determination criterion for objectively determining the implementation status with a certain fact is presented at a plurality of levels.
For example, in addition to what is shown in FIG. 10, level 1 if 70% or more of users are implementing, level 2 if 100% of users are implementing, and 100% following the implementation status of unimplemented users If the implementation is achieved, it can be considered as level 3.
In addition, a final decision is made based on the implementation status of a plurality of decision details (for example, if the management status of the notebook computer is all appropriate, such as confirmation of take-out / take-out, password setting, USB port management, etc.) Or the like may be used.

  Next, details of the procedure for generating and storing the confirmation item information (S103) shown in FIG. 22 will be described with reference to FIG.

First, the confirmation list management unit 16 inputs information security measure related information 301 from the operator via the input / output unit 10 (S1031). Note that the confirmation list management unit 16 only needs to acquire at least the confirmation item 3011 and the target user attribute 3014, and information on 3012 and 3013 may be omitted.
Next, the confirmation list management unit 16 inputs the existing standard ID information associated with the information security measure related information input in S1031 from the operator via the input / output unit 10, and based on the input ID information, the existing list ID information is input. The relationship information 302 with the reference is generated (S1032).
Next, the confirmation list management unit 16 inputs the implementation status determination reference information 303 from the operator via the input / output unit 10 (S1033).
Then, the confirmation list management unit 16 combines the information security measure related information 301, the relationship information 302 with the existing standard, and the implementation status determination standard information 303, and sets the information ID 304 to generate the confirmation item information 300 ( S1034).
Further, the confirmation list management unit 16 generates the inter-list relationship information 400 (FIG. 11) from the information ID 304 and the existing standard ID 3021 and passes the generated inter-list relationship information 400 to the inter-list relationship management unit 17 (S1035). .
Next, the confirmation list management unit 16 stores the confirmation item information 300 in the confirmation list DB 33 (S1036), and the inter-list relationship management unit 17 stores the inter-list relationship information 400 in the inter-list relationship DB 35 (S1037).
Note that the generation (S1035) and storage (S1037) of the inter-list relationship information 400 may be omitted.

Note that, for example, the department in charge of managing the information system in an organization is not necessarily the same as the department that manages the compliance status. It may be composed of a plurality of selected people.
Also, when the confirmation item information is confirmed, the operator registers the confirmation in the confirmation list DB 33 via the implementation status management unit 15, and enters the implementation status confirmation phase.

  Next, details of the implementation status confirmation phase will be described with reference to FIG.

First, in S201, the user authentication unit 12 determines whether there is an access from the user via the input / output unit 10, and if there is an access from the user (YES in S201), the user authentication unit 12 Performs user authentication using the user attribute information 200 stored in the environment DB 31, and when an accessed user is authenticated, the user attribute of the user is determined (S202).
Next, the implementation status input unit 14 extracts the confirmation item information in which the user attribute that matches the user attribute determined in S202 is set from the confirmation list DB 33 (S203). More specifically, the confirmation item information 300 whose content matching the user attribute determined in S202 is shown in the column of the user attribute 3014 in FIG. 10 is extracted.
In this way, by checking the user attributes, for example, if it is a confirmation item “I know the organization's information security policy”, it is presented to all users, but “a backup procedure for server machine log information is established. If it is a confirmation item “Yes”, an operation can be performed in which it is presented only to a user who manages the server machine.

Next, the implementation status input unit 14 presents the confirmation item information 300 extracted in S203 to the user via the input / output unit 10 (S204).
The user determines the implementation status while looking at the implementation status determination criterion information 303 with respect to the confirmation item 3011 of the presented confirmation item information 300.

Next, the implementation status input unit 14 acquires confirmation item evaluation result information 500 from the user via the input / output unit 10 as a response to the confirmation item information 300 presented in S204 (S205) (survey result acquisition step). . At this time, the implementation status input unit 14 sets an information ID in the acquired confirmation item evaluation result information 500.
Next, the implementation status input unit 14 stores the confirmation item evaluation result information 500 acquired in S205 in the response result DB 32 in association with the confirmation item information 300 extracted in S203 (S206) (survey result acquisition step). Specifically, the implementation status input unit 14 generates confirmation item-result relationship information 600 illustrated in FIG. 14 and associates the confirmation item evaluation result information 500 with the confirmation item information 300.

  The implementation status management unit 15 has a function of managing the implementation status for each user or for each confirmation item. Therefore, the implementation status management unit 15 confirms whether or not an answer has been obtained from all the users who are subject to the implementation confirmation, and when the reply is received from all the users that are the subject of the implementation confirmation, To move on.

In the analysis phase, the implementation status management unit 15 outputs analysis information from the confirmation item evaluation result information collected from the user. The analysis information is composed of the elements shown in FIG.
That is, the result of comparing the distribution status of the confirmation items with the baseline status when compared with the existing information security management standards.

  Based on the analysis information, the administrator can realize optimization of information security measures by expanding and strengthening information security measures and eliminating duplicate measures.

As described above, according to the present embodiment, since the existing information security management standard is associated with each confirmation item, it is possible to confirm the completeness of measures related to information security in the organization.
In addition, by managing information security measures in association with information related to documents instructing their implementation, it is possible to confirm the presence or absence of duplicate measures and efficiently implement information security measures within the organization. Can be managed.
In addition, even when information security measures are changed or added according to changes in the environment surrounding the organization, the related measures are easy to manage, so that it is possible to avoid duplication of effects due to the information security measures.
In addition, since it is possible to associate evidence that can be objectively confirmed with the user's confirmation result evaluation information, an appropriate evaluation result can be determined depending on whether there is a difference between the actual information security measure implementation status and the confirmation result evaluation information. Can be confirmed.

As described above, in the present embodiment, an information security management apparatus for confirming the implementation status of measures for maintaining information security adopted in an organization, the information security management apparatus having the following means: Explained.
User attribute management unit: Manages user attribute information such as user identification information, information on the organization to which the user belongs, the role that the user plays in information security, and authentication information for authenticating the user. means,
User authentication unit: means for authenticating a user based on user attribute information registered in advance through the user attribute management unit and information actually entered by the user,
Execution process control unit: means for controlling the process executable by the user from the attribute of the user and the confirmation status of the implementation status of each information security measure,
Implementation status input section: A means for users to directly answer the status of items for confirming the implementation status of individual information security measures, or to input evidence information indicating the implementation status,
Implementation status management unit: A means for managing the user's implementation status input status for items for confirming the implementation status of individual information security measures,
Confirmation list management unit: means for managing the processing status of the confirmation list itself, which is a set of items for confirming the implementation status of individual information security measures,
Inter-list relationship management unit: means for managing the relationship between an existing information security management policy collection represented by JIS Q 27002 and items for confirming the implementation status of individual information security measures adopted in the organization.
The relationship management section between lists can verify the comprehensiveness of the organization's information security measures by associating the collection of existing information security management measures with items for checking the implementation status of individual information security measures. explained.

Embodiment 2. FIG.
In the first embodiment described above, the management of the implementation status of information security measures within a certain organization is facilitated. However, the operator instructs the association between existing standards and information security measure related information. It was.
In the present embodiment, an example of supporting the association between information security measure related information and existing standards will be described.

FIG. 2 shows a configuration example of the information security management apparatus 1 according to the present embodiment.
In the configuration example of FIG. 2, a classification reference guiding unit 18 is provided instead of the inter-list relationship management unit 17 having the configuration of FIG. 1.
The classification standard guiding unit 18 presents questions step by step, and the operator answers the questions, thereby associating the existing information security management standard information (existing standard) with the confirmation items in the confirmation list. Navigate.
In other words, the classification standard guiding unit 18 generates a question message for selecting the security management standard information to be associated with the information security measure related information from the plurality of security management standard information, and the generated question message is displayed. Output via the input / output unit 10, input a response to the question message via the input / output unit 10, and select security management standard information to be associated with the information security measure related information based on the question message and the response To do.
In the present embodiment, the input / output unit 10 is an example of a message output unit and a response input unit, and the classification reference guide unit 18 constitutes a part of the information association unit.

The classification reference guide unit 18 generates a question message using the guide item information.
The guide item information is information for explaining the contents and configuration of the existing information security management standard, and a plurality of guide item information is connected.
Administrators who register the check item information using the guide item information such as the applicable field, the major classification within the field, the middle classification that subdivides the major classification, and the minor classification that subdivides the middle classification. However, it is assumed that the target information has a hierarchical structure that gradually focuses on the information.
The guide item information is composed of the following elements.
1) A question message that the information security management apparatus 1 confirms with the administrator in order to associate the information security measure that the administrator wants to register with the information security management item,
2) Options for answering question messages,
3) Information for identifying existing information security management reference information associated with each option, or information for identifying guide item information that the information security management apparatus 1 presents to the administrator next.

The guide item information is information shown in FIGS. 16 and 17, for example.
The guide item information 800 includes, for example, a guide item information number 801, a question message 802, and option information 803 for the question message 802.
The option information 803 includes a plurality of options 8031 and 8032. Further, the options 8031 and 8032 include information on the next item. When an option is answered by the administrator, the question of the guide item information having the number indicated in the column of the next item of the option is displayed. A message is presented to the administrator.
For example, in FIG. 17, the question message 802a of the guide item information 800a “what type of information asset is the target” is presented to the administrator, and “client machine” of option 1 (8031a) as a response option Or “server machine” or the like of option 2 (8032a) is presented to the administrator, and when the administrator selects “client machine”, it corresponds to the number 13 shown as the next item of option 1 (8031a) The guide item information 800b to be selected is next selected.
Then, a question message 802b “in which phase the machine is handled” is presented, and “disposal, reuse after initialization”, “introduction, installation”, etc. are presented to the administrator as options. .

As the order of the guide item information 800, for example, as shown in FIG. 17, first, the type of information asset to be confirmed is selected as a guide item (H of client machine, server machine, network device, measuring device, etc.). / W, mobile devices, paper, media, office devices, electronic data, people, etc.), then set to select which phase in the life cycle of each information asset is related (acquisition / generation, transfer / delivery) , Duplication, deletion / discard, backup, recovery, etc.), and if necessary, select appropriate ones from the detailed phase (if there is no need to take home, etc. as a subdivision of movement / delivery) It is possible to continue.
In addition, the guide item information finally reached is associated with any of the existing information security management standard information.
In addition, this guide item information may be applied to the structure of JIS Q 27002 item-security category-control measures-implementation guide, or may be applied to the classification of information security benchmark measures.

Next, the operation will be described.
In the first embodiment, the administrator who inputs the related information with the existing standard is provided. In the second embodiment, the procedure for creating the related information with the existing standard is supported.
Specifically, the flow shown in FIG. 25 is followed.

In FIG. 25, first, as in the first embodiment, the confirmation list management unit 16 inputs information security measure related information 301 from the operator via the input / output unit 10 (S1031).
Next, the classification reference guide unit 18 presents the question message and options shown in the guide item information to the operator via the input / output unit 10 (S1041).
Moreover, the classification reference | standard guidance part 18 acquires the response from an operator via the input / output part 10 (S1042).
If the existing standard that associates the information security measure related information input in S1031 can be specified by the response acquired in S1042 (YES in S1043), the confirmation list management unit 16 uses the existing standard and the information security measure related information. The relationship information 302 with the existing standard for associating with is generated (S1044).
On the other hand, when the existing technology is not specified (NO in S1043), the classification criterion guiding unit 18 searches for the next guide item information, and repeats the processes after S1041.
Further, the operation after the relation information 302 with the existing reference is generated in step S1044 is the same as S1033 to S1037 in FIG. 23 (S1045).

As described above, according to the present embodiment, when a certain guide item is selected, a more detailed guide item is presented as a result. Therefore, information related to the existing standard is created when the administrator confirms item information registration. In doing so, it is possible to work properly simply by following the guide presented by the information security management device.
In other words, the administrator can appropriately associate the confirmation item with the existing standard simply by answering options to the question presented by the information security management apparatus.
And in order to confirm the completeness of the organization's information security measures against the existing information security management standards, information related to existing standards for associating information security management items with individual information security measures can be easily created. The management load reduction realized in the first embodiment can be further accelerated.

  As described above, in the present embodiment, as a means for managing the relationship between the existing information security management measure collection represented by JIS Q 27002 and the confirmation items for confirming the implementation status of individual information security measures, stepwise We explained the classification standard guidance unit that navigates the association between the existing information security management policy collection and the confirmation items in the confirmation list by presenting the questions to the users and answering the questions.

Embodiment 3 FIG.
In the second embodiment, creation of information for associating existing information security management standards with organizational information security measures is supported.
In the present embodiment, as another type of support method, an example will be described in which terms used in existing information security management standards are searched and information is associated with each other based on the matching rate.

FIG. 3 shows the configuration of the information security management apparatus 1 in such a case.
In addition to the configuration of FIG. 2, a keyword extraction unit 19 and a keyword DB 36 are provided.
The keyword extraction unit 19 extracts a keyword included in the evaluation criterion of the existing information security management criterion information and a keyword included in the confirmation item of the information security measure related information.
The keyword DB 36 stores keywords extracted from the evaluation criteria of the existing information security management criteria information.
In FIG. 3, the classification standard guiding unit 18 is shown, but the classification standard guiding unit 18 can be omitted.
In the present embodiment, the keyword extraction unit 19 constitutes a part of the information association unit.

Next, the outline of the association between the existing information security management standard information and the information security measure related information according to the present embodiment will be described with reference to FIG.
The existing information security management standard information indicates an evaluation standard for the implementation status of information security measures. The keyword extraction unit 19 extracts a keyword from the text of the evaluation standard and registers it in the keyword DB 36 as matching keyword information. Keep it.
Similarly, the keyword extraction unit 19 extracts keywords from the confirmation items of the information security measure related information, and the confirmation list management unit 16 displays the keywords extracted from the confirmation items and the keywords stored in the keyword DB 36. In comparison, an existing standard that is a candidate for association is extracted, the extracted existing standard is listed, presented to the administrator, and the administrator selects the existing standard to be associated from the list.

Next, the operation according to the present embodiment will be described with reference to FIGS.
FIG. 26 is a flowchart showing the operation of the keyword extraction phase, and FIG. 27 is a flowchart showing details of the confirmation item information generation and storage procedure (S103) in this embodiment.

First, the operation of FIG. 26 will be described.
The keyword extraction phase is performed, for example, when the existing information security management reference information is stored in the baseline list DB 34 in S102 of FIG.
26, first, in S401, the keyword extraction unit 19 extracts terms and expressions from the text of the evaluation criteria of the information security management criteria information, associates them with the information security management criteria information of the extraction source, and performs matching. It registers in keyword DB36 as keyword information.
When extracting keywords, noun phrases are automatically extracted. Thereafter, the manager and other information security experts may correct the verification keyword as necessary.
Further, after the keyword extraction is completed from the evaluation criteria of all the information security management criteria information, the keyword extraction unit 19 again inputs the evaluation criteria of each information security management criteria information, and in step S402, The number of appearing keywords and the appearance frequency of each keyword are measured and registered in the baseline list DB 34 as the baseline information keyword appearance rate in association with the information security management reference information of the extraction source.
Note that the operation in step S402 may be omitted.

In step S401, keyword information for collation is extracted from the information security management standard to be registered. However, an information security glossary published on the Internet, books, or the like may be used. In this case, the administrator or the like designates information security management standard information (existing standard) corresponding to the matching keyword information extracted from the information security glossary.
Moreover, when there is a discrepancy between a term included in the keyword information for verification and a term used in the organization, they may be associated with each other and registered in the keyword DB 36.

Next, the operation shown in FIG. 27 will be described.
First, as in the first embodiment, the confirmation list management unit 16 inputs information security measure related information 301 from the operator via the input / output unit 10 (S1031).
Next, the keyword extraction part 19 extracts a keyword from the text of the confirmation item 3011 of the information security measure related information 301 input in S1031 (S1051). For example, a noun phrase included in the sentence of the confirmation item 3011 is extracted.
Next, if step S402 shown in FIG. 26 is performed, the keyword extraction part 19 will perform the number of appearance keywords, the frequency | count of appearance with respect to the keyword contained in the text of the confirmation item 3011 similarly to step S402. As a confirmation item keyword appearance rate (S1052).
Next, the confirmation list management unit 16 compares the keyword extracted from the confirmation item 3011 with the matching keyword stored in the keyword DB 36, and considers the baseline information keyword appearance rate and the confirmation item keyword appearance rate. Then, information security management standard information (existing standard) having a high degree of coincidence between the confirmation item and the keyword is extracted, and a list indicating the extracted information security management standard information is generated (S1053).
Next, the confirmation list management unit 16 presents a list of information security management standard information to the administrator via the input / output unit 10 (S1054).
When the administrator selects information security management reference information to be associated from the list, the confirmation list management unit 16 receives designation from the administrator via the input / output unit 10 (S1055). The relation information 302 between the existing standard specified from the existing standard and the existing standard for associating the confirmation item 3011 is generated (S1056).
Further, the operation after the relationship information 302 with the existing standard is generated in step S1056 is the same as S1033 to S1037 in FIG. 23 (S1057).

  As described above, according to the present embodiment, keywords related to information security can be extracted from each of existing information security management standards and organization information security measures, and the relationship between them can be determined by the matching rate. Thus, the management load realized in the first embodiment can be further reduced.

  As described above, in this embodiment, the keyword extracting unit that extracts the keywords indicating the contents of each countermeasure in the existing information security management policy collection and the keywords of the confirmation items in the confirmation list and associates them with the hit rate is described. did.

Embodiment 4 FIG.
In the above embodiment, management of the implementation status of information security measures within an organization is made easier. Next, related information between information security measures is managed to reduce the burden on the answering side. An embodiment intended to do this will be described.

There are many vague descriptions of information security measures in the organization, and it may not be clear who will do what.
Also, it is often unclear who will check the status of compliance with information security measures.
In information security measures, matters that need to be confirmed may differ depending on the role that the user plays in information security, and such an ambiguous description hinders reliable implementation of the measures.
For example, it is assumed that a measure has been introduced in which a patch program is applied within a specified time when patch information of a specified OS (Operating System) is presented by a vendor. At this time, the user reports whether or not he / she has applied the patch program as the implementation status, but the administrator sees the implementation status and follows up on unapplied users or why he / she cannot apply it. It is assumed that there is a role of judging whether or not it is appropriate.
In the case of this measure, the content to be implemented differs between the user and the administrator for the same information security measure.

  In the present embodiment, it is defined in advance that what is an ambiguous sentence when instructing an information security measure is intended, and a sentence that matches the sentence is registered in information security measure related information. Provide a means to detect when there is, and guide it to clearer instructions and sentences.

FIG. 4 shows the configuration of the information security management apparatus 1 in this case.
In contrast to the information security management apparatus 1 described in the above embodiment, in FIG. 4, an item relationship management unit 20 and an item relationship DB 37 are added.
In FIG. 4, the classification reference guiding unit 18, the keyword extracting unit 19, and the keyword DB 36 are included, but these may be omitted.

The inter-item relationship management unit 20 parses the text of the confirmation item of the information security measure related information, and whether or not it is necessary to generate a new investigation item that refines the confirmation item based on the result of the syntax analysis. When a new survey item needs to be generated, a notification message for notifying that a new survey item needs to be generated is generated, and the notification message is output via the input / output unit 10.
In addition, the item relationship management unit 20 inputs a response from the administrator to the notification message via the input / output unit 10, and based on the input response, a new confirmation item is indicated. Generate information. The inter-item relationship management unit 20 may generate two or more new information security measure related information. New information security measure related information is stored in the confirmation list DB 33.
In addition, the inter-item relationship management unit 20 includes new information security measure related information and information security measure related information (hereinafter referred to as “source information security measure related information”) that is a generation source of the new information security measure related information. Create item relationship information that shows the relationship of
The inter-item relationship management unit 20 is an example of a survey item determination unit and a survey item information generation unit.
The item relationship DB 37 stores the item relationship information generated by the item relationship management unit 20.

Further, in the present embodiment, the confirmation list management unit 16 performs common security management on a plurality of information security measure related information when a plurality of new information security measure related information is generated by the inter-item relationship management unit 20. Associate with standard information (existing standard).
In addition, the confirmation list management unit 16 individually sets target user attributes for each of a plurality of new information security measure related information in accordance with the designation from the administrator. That is, a different user attribute can be set for each new information security measure related information.
Then, as in the first embodiment, the implementation status input unit 14 extracts information security measure related information in which user attributes that match the user attributes determined by the user authentication unit 12 are set, and accesses Confirmation items are presented to the user who was present, but as described above, different user attributes may be set for each new information security measure related information, so a confirmation item is presented for each new information security measure related information. The user to be played may be different.

The outline of the operation of the information security management apparatus 1 according to this embodiment will be described with reference to FIG.
For example, the confirmation item 3011 describes that “a patch program released from a vendor is applied within a specified period after the application is authorized in the company”, and the target user attribute 3014 is all employees. Information security measure related information 301 (item 1) exists.
The contents shown in the confirmation item 3011 are the steps of “confirming that each general user has applied the patch program to his / her own computer” and “all general users based on the confirmation result of the general user”. This is achieved in two steps, i.e., the administrator confirms that the patch program has been applied to the computer.
For this reason, the inter-item relationship management unit 20 determines that the content indicated in the confirmation item 3011 of the information security measure related information 301 (item 1) is ambiguous, and that a new confirmation item needs to be generated. To that effect.
Then, according to instructions from the administrator, for example, new information security measure-related information 301a (item 1-a) for general employees and new information security for department heads / persons in departments The measure related information 301b (item 1-b) is generated.
Further, the inter-item relationship management unit 20 generates inter-item relationship information 371 in accordance with an instruction from the administrator.
In the example of FIG. 19 , as the relation 1, it is shown that item 1 is subdivided into item 1-a and item 1-b. Further, as the relationship 2, if the result of the item 1-a is 100%, the item 1-b is OK.
Further, as relation 3, it is indicated that if the result of item 1-a is less than 100%, item 1-b is NG.
The item relationship information 371 indicating the relationship between the source information security measure related information and the new information security measure related information is stored in the item relationship DB 37.
Then, the implementation status input unit 14 presents the information security measure related information 301a (item 1-a) to general employees, and displays the information security measure related information 301b (item 1-b) as a department head / in-department person in charge. The confirmation item evaluation result information 500 is obtained from each.
The acquired confirmation item evaluation result information 500 is analyzed according to the relationship of the item relationship information 371.

  Next, with reference to FIG. 28, details of the procedure for generating and storing confirmation item information (S103) in the present embodiment will be described.

First, as in the first embodiment, the confirmation list management unit 16 inputs information security measure related information 301 from the operator via the input / output unit 10 (S1031).
Next, the inter-item relationship management unit 20 performs syntax analysis of the text of the confirmation item 3011 of the input information security measure related information 301 (S1061).
Then, the inter-item relationship management unit 20 determines whether or not the text of the confirmation item 3011 is an ambiguous instruction (S1062).
For example, the inter-item relationship management unit 20 determines that the instruction is ambiguous when the text of the confirmation item 3011 meets the following conditions (1) and (2).
(1) People and organizations are not the subject.
(2) Judgment criteria are not quantified.

When the inter-item relationship management unit 20 determines that the text of the confirmation item 3011 is “ambiguous instruction” (YES in S1062), a notification for notifying the “ambiguous instruction” to be “clear instruction” A message is generated and a notification message is output from the input / output unit 10. Further, the notification message notifies that the above conditions (1) and (2) are satisfied, for example.
Next, the inter-item relationship management unit 20 inputs specific details of subdivision from the administrator via the input / output unit 10 (S1064).
When the new information security measure related information 301a and 301b in FIG. 19 are generated, information shown in each of 3011a to 3015a and information shown in each of 3011b to 3015b are input.
In addition, the inter-item relationship management unit 20 also inputs the specific contents of the inter-item relationship information 371 from the administrator.
Then, the inter-item relationship management unit 20 subdivides the information security measure related information 301 in accordance with an instruction from the administrator, and generates new information security measure related information 301a and 301b (S1065).
In addition, the inter-item relationship management unit 20 also generates inter-item relationship information 371 according to an instruction from the administrator and stores it in the inter-item relationship DB 37.

Subsequent operations are the same as S1032 to S1037 in FIG. 23 (S1066).
However, in S1032, the confirmation list management unit 16 generates the relationship information with the existing standard, but in the present embodiment, the existing information common to each of the source information security measure related information and the new information security measure related information is used. Associate criteria.

As described above, the implementation status confirmation phase after the confirmation items are subdivided and the confirmation item information is created follows the procedure shown in FIG.
For example, it is assumed that the user α is a general user and is not assigned a role for information security management. When this user α accesses the information security management device 1, in S203 and S204 in FIG. 24, the implementation status input unit 14 displays information security measure related information that matches the attribute of the accessed user α as shown in FIG. The information security measure related information 301a (item 1-a) shown in FIG. And the user (alpha) inputs the implementation condition with respect to the information security measure relevant information 301a (item 1-a).

  When there is another user who has to reply to the new information security measure related information 301a (item 1-a), the information security management apparatus 1 can recognize it from the implementation status management unit 15, so that it relates to information security. When the user β having the administrator role accesses the information security management apparatus 1, the implementation status input unit 14 does not yet present the information security measure related information 301b (item 1-b).

And if all the general users input the implementation status with respect to the information security measure related information 301a (item 1-a), the implementation status management unit 15 detects it.
When a user β having the role of an administrator related to information security accesses the information security management apparatus 1, the implementation status input unit 14 sends information security measure related information 301b (item 1-b) to the user β together with information security. The result of the measure related information 301a (item 1-a) is presented.
From this result, the administrator inputs the implementation status of the information security measure related information 301b (item 1-b).
At this time, the administrator supplements the implementation status of the information security measure related information 301b (item 1-b) with the response result of the information security measure related information 301a (item 1-a), the information security measure related information 301a. Evidence (for example, an access log to the information security policy of each user) indicating the answer result of (Item 1-a) may be attached as evidence information.

In the above description, the presence / absence of a subject and the presence / absence of a numerical criterion are shown as criteria for determining whether or not the instruction is ambiguous. However, the criteria for determination are not limited to these.
In addition, the criterion for determining whether or not it is an “ambiguous instruction” can be added or deleted as necessary.

  As described above, according to the present embodiment, the syntax of the confirmation item text is analyzed, and if the content of the confirmation item is ambiguous, a new confirmation item is generated and the content to be confirmed is further detailed. Therefore, the implementation status of information security measures can be confirmed and evaluated more accurately and efficiently.

  As described above, in the present embodiment, the inter-item relationship management unit that detects the ambiguity of the content of the confirmation item and supports the refinement of the confirmation item has been described.

Embodiment 5 FIG.
In the above embodiment, an example in which the information security management device 1 is operated in a certain organization has been described. Next, by introducing the information security management device 1 in a hierarchical organization, the information security of the entire organization An example will be described in which measures and information security enhancement measures that are additionally performed by some organizations are centrally managed to reduce the management load on the administrator and the implementation status response load on the user.

For example, as shown in FIG. 20, it is assumed that a group of information security measures S common to the organization is deployed in the organization α. In the sub-organization A, which is a subordinate organization within the organization, the information security measure group s is introduced at the request of the customer C. In this case, the measure s is a measure that does not violate the measure S, and is a measure that is additionally added or a measure that strengthens the measure S.
At this time, the sub-organization A needs to confirm the implementation status of the information security measure group of measure S + measure s.

5 and 6 show an information security management apparatus for dealing with such a case.
In FIG. 5, the information security management apparatus shows a higher-level information security management apparatus 1000 that manages an organization-wide information security measure group S. In FIG. 6, the information security measure group in a subordinate organization to which information security measures are added for business purposes. s also includes a lower information security management apparatus 1100 that also manages.

The higher-level information security management apparatus 1000 includes a distribution information extraction unit 101, an inter-device information exchange unit 102, and an answer information acquisition unit 103 in addition to the elements described in the above embodiments.
The distribution information extraction unit 101 extracts necessary information from the DB group in the apparatus and configures it as distribution information in order to distribute information related to the information security measure group implemented in the entire organization to the lower information security management apparatus 1100. .
The inter-device information exchange unit 102 exchanges information between the upper and lower information security management devices.
The response information acquisition unit 103 registers the common response information acquired from the lower information security management apparatus 1100 in the response result DB 32.

The lower information security management device 1100 includes an inter-device information exchange unit 102, a difference information extraction unit 104, and difference database groups 111 to 115 in addition to the elements described in the above embodiments.
Similar to the inter-device information exchanging unit 102 of the higher-level information security management device 1000, the inter-device information exchanging unit 102 exchanges information between the upper and lower information security management devices.
The difference information extraction unit 104 extracts a difference between distribution information distributed from the higher-level information security management apparatus 1000 and information related to the currently registered information security measure.
The difference database groups 111 to 115 store the difference information extracted by the difference information extraction unit 104.
The difference database groups 111 to 115 correspond to the database groups 33 to 37, and each database of the difference database groups 111 to 115 stores the same type of difference information as the information stored in the database with the same name in the database groups 33 to 37. Store.

  In this embodiment, the upper information security management device 1000 and the lower information security management device 1100 are provided in this way, and information security measure related information related to the entire organization and information security measure related to a specific sub organization are provided. Separately store related information, and for information security measure related information related to the entire organization, obtain confirmation results from the entire organization and obtain information security measure related information related to a specific sub-organization. In some cases, confirmation results from specific sub-organizations are obtained.

  Next, the operation will be described.

The registration procedure to the base line list DB 34, the confirmation list DB 33, the keyword DB 36, the inter-list relation DB 35, the inter-item relation DB 37, and the environment DB 31 in the upper information security management apparatus 1000 is as described in the first to fourth embodiments. It is the same.
The registration procedure in the environment DB 31 in the lower information security management apparatus 1100 is the same as the procedure described in the first to fourth embodiments.

  (Step a-1) In the upper information security management apparatus 1000, in addition to the registration processing in the environment DB 31 shown in S101 of FIG. 22, the lower information security management apparatus 1100 that is a partner to which information is distributed from the upper information security management apparatus 1000 Information for identifying the authentication information, authentication information of the lower information security management apparatus 1100, and the like are managed by the environment DB 31.

  (Step a-2) The distribution information extraction unit 101 extracts information related to the lower information security management apparatus 1100 out of all information security management standard information managed by the higher information security management apparatus 1000 and creates it as distribution information To do. Information that is not related to the lower information security management apparatus 1100 is information that is additionally registered in the environment DB 31 in step a-1.

(Step a-3) The distribution information created by the distribution information extraction unit 101 is delivered to the lower information security management device 1100 via the inter-device information exchange unit 102.
At this time, the inter-device information exchanging unit 102 may directly communicate between the information security management devices, or may have a function of inputting / outputting distribution information via a medium or the like. Further, a more reliable authentication function using authentication information may be provided.

(Step a-4) In the lower information security management apparatus 1100, the difference information extraction unit 104 corresponds to each of the DBs 33 to 37 constituting all information security management reference information from the distribution information obtained by the inter-device information exchange unit 102. Expand and register information.
At this time, if the lower information security management apparatus 1100 is in an initial state, all distribution information is registered in each of the DBs 33 to 37 constituting all information security management standard information, but has already been distributed from the upper information security management apparatus 1000. When the information is received and registered in each of the DBs 33 to 37 constituting the entire information security management standard information, the difference information extraction unit 104 extracts the difference between the contents of the existing DBs 33 to 37 and the distribution information, Register in the difference database group 111-115.

(Step a-5) After receiving the distribution information from the higher-level information security management apparatus 1000, the lower-level information security management apparatus 1100 uses the lower-level information security management apparatus 1000 based on the all-information security management standard information. The information security measure group s in the organization may be additionally registered.
The confirmation list manager 16 presents confirmation items constituting the confirmation list registered in step a-4 to the administrator. At this time, if there is an information security measure uniquely adopted in the organization, it is registered as additional information.
Alternatively, if the term is used properly so as to match the business in the subordinate organization, the information used in the subordinate organization may be supplemented to the registered confirmation item.

  (Step a-6) At this time, if there is information registered in Step a-5, the difference information extraction unit 104 registers it in the difference database group.

Next, the process proceeds to the implementation status confirmation phase within the subordinate organization.
The operation in the implementation status confirmation phase in the subordinate organization is the same as in FIG.

  The point of moving to the analysis phase when responses are received from all users who are the targets of the implementation confirmation is the same as that described in the first embodiment.

  Next, in the lower information security management apparatus 1100, a phase in which the information returned by the user of the lower information security management apparatus 1100 is extracted from the distribution information distributed from the upper information security management apparatus 1000 and sent to the upper level. It becomes.

  (Step a-7) The difference information extraction unit 104 of the lower information security management apparatus 1100 extracts the response information for the distribution information distributed from the upper information security management apparatus 1000 as common response information, and the inter-device information exchange unit 102 To the higher-level information security management apparatus 1000.

  (Step a-8) In the higher-level information security management apparatus 1000, the response information acquisition unit 103 registers the common response information acquired by the inter-device information exchange unit 102 as response information in the response result DB 32. The administrator of the higher-level information security management apparatus 1000 analyzes the response result as necessary.

  By doing this, even if the information security measures common to the organization and the information security measures in the subordinate organizations are not the same, and the latter includes the former, the implementation status of the information security measures common to the organization and the subordinate It is possible to manage the information security implementation status unique in the organization separately, and to confirm that the information security measures prescribed by the organization are properly implemented.

As described above, in the present embodiment, the upper information security management apparatus and the lower information security management apparatus for the purpose of hierarchically managing the implementation status of information security measures in the organization have been described.
The upper information security management apparatus has been described as including the following means.
Distribution information extraction unit: In order to distribute information related to the information security measure group implemented in the entire organization to the lower information security management apparatus, necessary information is extracted from the DB group in the apparatus and configured as distribution information.
Inter-device information exchange unit: Exchanges information between the upper and lower information security management devices.
Answer information obtaining unit: registers common answer information obtained from the lower information security management apparatus in the answer result DB.
Further, it has been described that the lower information security management device includes the following means.
Difference information extraction unit: Extracts the difference between the distribution information distributed from the higher-level information security management device and the information on the currently registered information security measure.
Inter-device information exchange unit: Exchanges information between the upper and lower information security management devices.

Finally, the hardware configuration of the information security management apparatus 1, the upper information security management apparatus 1000, and the lower information security management apparatus 1100 (hereinafter collectively referred to as the information security management apparatus 1 etc.) shown in the first to fifth embodiments. An example will be described.
FIG. 29 is a diagram illustrating an example of hardware resources such as the information security management device 1 described in the first to fifth embodiments.
29 is merely an example of the hardware configuration of the information security management device 1 and the like, and the hardware configuration of the information security management device 1 and the like is not limited to the configuration illustrated in FIG. It may be a configuration.

In FIG. 29, the information security management device 1 or the like includes a CPU 911 (also referred to as a central processing unit, a central processing unit, a processing unit, an arithmetic unit, a microprocessor, a microcomputer, and a processor) that executes a program.
The CPU 911 is connected to, for example, a ROM (Read Only Memory) 913, a RAM (Random Access Memory) 914, a communication board 915, a display device 901, a keyboard 902, a mouse 903, and a magnetic disk device 920 via a bus 912. Control hardware devices.
Further, the CPU 911 may be connected to an FDD 904 (Flexible Disk Drive), a compact disk device 905 (CDD), a printer device 906, and a scanner device 907. Further, instead of the magnetic disk device 920, a storage device such as an optical disk device or a memory card (registered trademark) read / write device may be used.
The RAM 914 is an example of a volatile memory. The storage media of the ROM 913, the FDD 904, the CDD 905, and the magnetic disk device 920 are an example of a nonvolatile memory. These are examples of a storage device or a storage unit.
A communication board 915, a keyboard 902, a mouse 903, a scanner device 907, an FDD 904, and the like are examples of an input unit and an input device.
Further, the communication board 915, the display device 901, the printer device 906, and the like are examples of an output unit and an output device.

  For example, the communication board 915 is connected to a LAN (local area network), the Internet, a WAN (wide area network), or the like.

The magnetic disk device 920 stores an operating system 921 (OS), a window system 922, a program group 923, and a file group 924.
The programs in the program group 923 are executed by the CPU 911 using the operating system 921 and the window system 922.

The RAM 914 temporarily stores at least part of the operating system 921 program and application programs to be executed by the CPU 911.
The RAM 914 stores various data necessary for processing by the CPU 911.

The ROM 913 stores a BIOS (Basic Input Output System) program, and the magnetic disk device 920 stores a boot program.
When the information security management device 1 or the like is activated, the BIOS program in the ROM 913 and the boot program in the magnetic disk device 920 are executed, and the operating system 921 is activated by the BIOS program and the boot program.

  The program group 923 stores a program for executing the function described as “˜unit” in the description of the first to fifth embodiments. The program is read and executed by the CPU 911.

In the file group 924, in the description of the first to fifth embodiments, “determination of”, “calculation of”, “comparison of”, “evaluation of”, “registration of”, “setting of” ”,“ Acquisition of ”,“ selection of ”,“ authentication of ”,“ extraction of ”, etc. It is stored as each item of "~ file" and "~ database".
The “˜file” and “˜database” are stored in a recording medium such as a disk or a memory. Information, data, signal values, variable values, and parameters stored in a storage medium such as a disk or memory are read out to the main memory or cache memory by the CPU 911 via a read / write circuit, and extracted, searched, referenced, compared, and calculated. Used for CPU operations such as calculation, processing, editing, output, printing, and display.
Information, data, signal values, variable values, and parameters are stored in the main memory, registers, cache memory, and buffers during the CPU operations of extraction, search, reference, comparison, calculation, processing, editing, output, printing, and display. It is temporarily stored in a memory or the like.
In addition, the arrows in the flowcharts described in the first to fifth embodiments mainly indicate input / output of data and signals. The data and signal values are the RAM 914 memory, the FDD 904 flexible disk, the CDD 905 compact disk, and the magnetic field. Recording is performed on a recording medium such as a magnetic disk of the disk device 920, other optical disks, mini disks, DVDs, and the like. Data and signals are transmitted online via a bus 912, signal lines, cables, or other transmission media.

  In addition, what is described as “˜unit” in the description of the first to fifth embodiments may be “˜circuit”, “˜device”, “˜device”, and “˜step”, It may be “˜procedure” or “˜processing”. That is, what is described as “˜unit” may be realized by firmware stored in the ROM 913. Alternatively, it may be implemented only by software, or only by hardware such as elements, devices, substrates, and wirings, by a combination of software and hardware, or by a combination of firmware. Firmware and software are stored as programs in a recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, and a DVD. The program is read by the CPU 911 and executed by the CPU 911. That is, the program causes the computer to function as “to part” in the first to fifth embodiments. Alternatively, the computer executes the procedure and method of “to part” in the first to fifth embodiments.

  As described above, the information security management device 1 or the like shown in the first to fifth embodiments includes a CPU as a processing device, a memory as a storage device, a magnetic disk, a keyboard as an input device, a mouse, a communication board, and a display device as an output device. The computer includes a communication board and the like, and realizes the functions indicated as “˜unit” as described above using these processing devices, storage devices, input devices, and output devices.

  DESCRIPTION OF SYMBOLS 1 Information security management apparatus, 2 User, 10 Input / output part, 11 User attribute management part, 12 User authentication part, 13 Execution process control part, 14 Implementation status input part, 15 Implementation status management part, 16 Confirmation list management Part, 17 List relation management part, 18 Classification standard guidance part, 19 Keyword extraction part, 20 Item relation management part, 31 Environment DB, 32 Answer result DB, 33 Confirmation list DB, 34 Baseline list DB, 35 Between lists Relationship DB, 36 Keyword DB, 37 Item Relationship DB 101 Distribution Information Extraction Unit, 102 Device Information Exchange Unit, 103 Response Information Acquisition Unit, 104 Difference Information Extraction Unit, 110 Difference Database Group, 111 Confirmation List DB, 112 Baseline List DB, 113 Keyword DB, 114 Inter-list Relationship DB, 115 items Inter-relationship DB, 200 User attribute information, 300 Confirmation item information, 301 Information security measure related information, 302 Relationship information with existing standards, 303 Implementation status criteria information, 304 Information ID, 400 Inter-relationship information, 500 Confirmation items Evaluation result information, 501 confirmation item evaluation result, 502 evidence information, 503 information ID, 600 confirmation item-result relation information, 700 analysis information, 800 guide item information, 1000 upper information security management device, 1100 lower information security management device.

Claims (7)

A survey item information survey items to investigate the implementation of security measures is shown in the text, a specific security management of a plurality of security management standard information criteria for evaluating the implementation of security measures is shown An information association unit associated with the reference information;
A survey item determination unit that parses the survey item text of the survey item information and determines whether it is necessary to generate a new survey item that refines the survey item based on the result of the syntax analysis;
A message output unit that outputs a notification message notifying that generation of a new survey item is necessary when it is determined by the survey item determination unit that generation of a new survey item is necessary;
An attribute setting unit that sets a target user attribute for each of a plurality of survey item information,
Authentication that identifies whether the access is from a registered user when there is an access, and if the access is from a registered user, authenticates the user attributes of the accessed user And
An information storage unit for storing a plurality of pieces of survey item information and a plurality of security management reference information in which user attributes are set by the attribute setting unit ;
The survey item information in which the user attribute that matches the user attribute determined by the authentication unit is extracted from the information storage unit, the extracted survey item information is presented to the accessed user, and the presented survey is presented. Survey results for the survey items indicated in the item information are acquired, the acquired survey results are associated with the survey item information, and the survey items in the survey item information are associated with the survey results and the evaluation criteria for the security management standard information An acquisition unit;
A security management device comprising: The survey item determination unit
As a result of syntactic analysis of the survey item text in the survey item information, at least one of the case where the subject is not shown in the text of the survey item and the case where the quantified standard is not shown in the text of the survey item 2. The security management apparatus according to claim 1, wherein it is determined that a new investigation item needs to be generated . The security management device further includes:
A response input unit for inputting a response to the message output by the message output unit;
A survey item information generating unit that generates new survey item information indicating a new survey item based on the response input by the response input unit;
The information association unit includes:
3. The security according to claim 1 , wherein when a plurality of new survey item information is generated by the survey item information generation unit, the plurality of new survey item information is associated with common security management standard information. Management device. The security management device further includes:
A message output unit for outputting a message;
A response input unit for inputting a response to the message output by the message output unit,
The information association unit includes:
Generating a question message for selecting the security management standard information to be associated with the survey item information from the plurality of security management standard information, and outputting the generated question message via the message output unit; claim 1 of the response to the inquiry message input through the response input section, based on said response and said inquiry message, and selects the security management reference information to be associated with the study item information 4. The security management device according to any one of items 1 to 3 . The information association unit includes:
Analyze the keywords included in the evaluation criteria for each security management standard information, analyze the keywords included in the survey items of the survey item information, and based on the keyword analysis results for the evaluation criteria and the keyword analysis results for the survey items, The security management apparatus according to any one of claims 1 to 4, wherein security management reference information to be associated with survey item information is selected . The security management device includes:
Manages the implementation status of security measures in an organization that includes at least one sub-organization,
The information storage unit
The survey item information related to the entire organization and the survey item information related to a specific sub-organization are distinguished and stored.
The survey result acquisition unit
For survey item information related to the entire organization, obtain survey results from the entire organization, and for survey item information related to a specific sub-organization, obtain survey results from the specific sub-organization. The security management device according to any one of claims 1 to 5. Specific security management among multiple items of security management standard information indicating the evaluation criteria for evaluating the implementation status of security measures. An information association process associated with the reference information;
Survey item determination processing that parses the survey item text of the survey item information and determines whether it is necessary to generate a new survey item that refines the survey item based on the result of the syntax analysis,
A message output process for outputting a notification message notifying that a new survey item needs to be generated when it is determined that a new survey item needs to be generated by the survey item determination process ;
An attribute setting process for setting a target user attribute for each of a plurality of survey item information,
Authentication that identifies whether the access is from a registered user when there is an access, and if the access is from a registered user, authenticates the user attributes of the accessed user Processing,
An information storage process for storing a plurality of investigation item information and a plurality of security management standard information in which user attributes are set by the attribute setting process ;
The survey item information stored by the information storage process, in which the user attribute matching the user attribute determined by the authentication process is set, is extracted, and the extracted survey item information is presented to the accessed user. Obtain the survey results for the survey items indicated in the presented survey item information, associate the acquired survey results with the survey item information, and check the survey item information survey results, the survey results, and the security management standard information evaluation criteria. A survey result acquisition process to associate
A program that causes a computer to execute.

Images