JP7474800B2 - Risk assessment system and risk assessment method - Google Patents

Description

The present invention relates to a risk assessment system and a risk assessment method.

In recent years, cyber attacks have been increasing, and risk assessment against cyber attacks has been attracting attention. In risk assessment, a technique has been proposed that utilizes a method (OSINT; Open Source Intelligence) for collecting information from information sources that are publicly available to third parties and analyzing the collected information (for example, Patent Literature 1).

JP 2021-99589 A

Meanwhile, service users, such as individuals, corporations, or organizations, are expected to use various services (e.g., SaaS; Software as a Service) provided by service providers. In such cases, the effort required to obtain risk assessments for various services is extremely cumbersome. It is also important to properly visualize the risk assessments of services.

Therefore, the present invention has been made to solve the above-mentioned problems, and aims to provide a risk assessment system and a risk assessment method that make it possible to appropriately visualize the risk assessment of a service.

One aspect of the disclosure is a risk assessment device that includes a collection unit that collects information about a service provided by a service provider via a network from an information source that is open to third parties based on attribute information about the service, a control unit that calculates a risk assessment of the service based on the information about the service, a storage unit that stores the risk assessment of the service in chronological order together with time information when the risk assessment of the service was calculated, and an output unit that outputs the progress of the risk assessment of the service in chronological order.

One aspect of the disclosure is a risk assessment method including step A of collecting information on a service provided by a service provider via a network from an information source open to a third party based on attribute information on the service, step B of calculating a risk assessment of the service based on the information on the service, step C of storing the risk assessment of the service in chronological order, and step D of outputting the progress of the risk assessment of the service in chronological order.

The present invention provides a risk assessment system and a risk assessment method that enable appropriate visualization of the risk assessment of a service.

FIG. 1 is a diagram showing a risk assessment system 100 according to an embodiment. FIG. 2 is a diagram showing a risk assessment device 10 according to an embodiment. FIG. 3 is a diagram for explaining risk assessment according to the embodiment. FIG. 4 is a diagram showing an example of a display mode according to the embodiment. FIG. 5 is a diagram showing an example of a display mode according to the embodiment. FIG. 6 is a diagram showing a risk assessment method according to an embodiment. FIG. 7 is a diagram showing an example of operation according to the first modification. FIG. 8 is a diagram showing an example of operation according to the first modification.

The following describes the embodiments with reference to the drawings. In the following description of the drawings, the same or similar parts are denoted by the same or similar reference numerals.

However, it should be noted that the drawings are schematic and the ratios of the dimensions may differ from the actual ones. Therefore, the specific dimensions should be determined with reference to the explanation below. Of course, the drawings may also contain parts with different dimensional relationships or ratios.

[Disclosure Summary]
The risk assessment device according to the disclosure outline includes a collection unit that collects information regarding a service from an information source that is publicly available to third parties based on attribute information regarding the service provided by a service provider via a network, a control unit that calculates a risk assessment of the service based on the information regarding the service, a storage unit that stores the risk assessment of the service in chronological order along with time information when the risk assessment of the service was calculated, and an output unit that outputs the progress of the risk assessment of the service in chronological order.

The risk assessment method according to the disclosure outline includes step A of collecting information on a service provided by a service provider via a network from an information source open to a third party based on attribute information on the service, step B of calculating a risk assessment of the service based on the information on the service, step C of storing the risk assessment of the service in chronological order, and step D of outputting the progress of the risk assessment of the service in chronological order.

In the disclosed overview, the risk assessment device stores the risk assessment of the service in chronological order along with the time information when the risk assessment of the service was calculated, and outputs the progress of the risk assessment of the service in chronological order. With such a configuration, it is possible to easily grasp the deterioration/improvement status of the risk assessment of the service, and to appropriately visualize the risk assessment of the service.

[Embodiment]
(Risk Assessment System)
A risk assessment system according to an embodiment will be described below. Fig. 1 is a diagram showing a risk assessment system 100 according to an embodiment.

As shown in FIG. 1, the risk assessment system 100 includes a risk assessment device 10, a collection server 20, a provision server 30, a first terminal 40, and a second terminal 50. The risk assessment device 10, the collection server 20, the provision server 30, the first terminal 40, and the second terminal 50 are connected by a network 200. Although not particularly limited, the network 200 may be configured by the Internet. The network 200 may include a local area network, a mobile communication network, or a VPN (Virtual Private Network).

In an embodiment, network 200 may be used as a term that includes information sources (e.g., websites, etc.) that are publicly available to third parties.

The risk assessment device 10 is a device that calculates the risk assessment of a service provided by a service provider via the network 200.

In an embodiment, the risk assessment device 10 collects information about the service from information sources published by third parties based on attribute information about the service. The risk assessment device 10 may collect information about the service using a collection server 20. The risk assessment device 10 calculates a risk assessment of the service based on the information about the service, and outputs the calculated risk assessment. Details of the risk assessment device 10 will be described later (see FIG. 2).

Here, the attribute information regarding the service may include identification information that identifies the service in the network 200. For example, the identification information may include a login URL (Uniform Resource Locator) for using the service. The information regarding the service may include web-related information, network-related information, email-related information, DNS (Domain Name Server)-related information, TLS (Transport Layer Security)-related information, and the like. Although not particularly limited, TLS may be read as SSL (Secure Socket Layer).

The collection server 20 is a server that has the function of collecting information on the network 200. The collection server 20 may be considered to be a server that can execute (act as) at least a part of the function of the risk assessment device 10, which collects information about services.

The providing server 30 is a server belonging to a service provider that provides services via the network 200. The providing server 30 may provide services related to SaaS (Software as a Service) and the like. The providing server 30 may provide services related to IaaS (Infrastructure as a Service), PaaS (Platform as a Service), and the like. The providing server 30 may provide other cloud services.

The first terminal 40 is a terminal used by a service provider. The first terminal 40 may have a display unit 41. The display unit 41 may be configured with a display such as a liquid crystal panel, an organic EL (Electroluminescence) panel, or an LED (Light Emitting Diode). For example, the first terminal 40 may be a personal computer, a smartphone, or a tablet terminal.

The second terminal 50 is a terminal used by a person other than the service provider. The person other than the service provider may include a service user who uses the service. The second terminal 50 may have a display unit 51. The display unit 51 may be configured with a display such as a liquid crystal panel, an organic EL panel, or an LED. For example, the second terminal 50 may be a personal computer, a smartphone, or a tablet terminal.

(Risk assessment device)
The risk assessment device 10 according to the embodiment will be described below. Fig. 2 is a diagram showing the risk assessment device 10 according to the embodiment.

As shown in FIG. 2, the risk assessment device 10 has a collection unit 11, a storage unit 12, an output unit 13, and a control unit 14.

The collection unit 11 may be configured by a communication module. The communication module may be a wireless communication module conforming to a standard such as IEEE802.11a/b/g/n/ac/ax, LTE, 5G, or 6G, or may be a wired communication module conforming to a standard such as IEEE802.3.

In the embodiment, the collection unit 11 constitutes a collection unit that collects information about the service from an information source published by a third party based on attribute information about the service. The collection unit 11 may collect information about the service using the collection server 20.

The storage unit 12 is composed of storage media such as a solid state drive (SSD) or a hard disk drive (HDD), and stores various information.

In an embodiment, the storage unit 12 constitutes a storage unit that stores the risk assessment of the service in chronological order together with time information when the risk assessment of the service was calculated.

The output unit 13 outputs the risk assessment of the service. For example, the output unit 13 is configured by a communication module, and transmits display data for displaying the risk assessment on the display unit 41 or the display unit 52 to the first terminal 40 or the second terminal 50.

In the embodiment, the output unit 13 constitutes an output unit that outputs the transition of the risk assessment of the service in time series. The output form (hereinafter, display form) of the output unit 13 will be described later.

The control unit 14 may include at least one processor. The at least one processor may be configured with a CPU (Central Processing Unit), an MPU (Micro Processing Unit), a GPU (Graphics Processing Unit), one or more integrated circuits, one or more discrete circuits, or a combination thereof.

In an embodiment, the control unit 14 constitutes a control unit that calculates a risk assessment of a service based on information about the service. Details of the risk assessment will be described later.

(Risk assessment)
The risk assessment according to the embodiment will be described below. Fig. 3 is a diagram for explaining the risk assessment according to the embodiment.

As shown in FIG. 3, risk assessment may be performed for each assessment item by a collection function and an assessment function. The collection function may be performed by the collection unit 11 described above. At least a part of the collection function may be performed using the collection server 20. The assessment function may be performed by the control unit 14 described above. Assessment items are items that define risk assessment. Assessment items may be referred to as categories.

The collection function may have a function of collecting information about the service from information sources published by third parties based on attribute information about the service. For example, the collection function may include one or more functions selected from a web information collection unit, a network information collection unit, a mail information collection unit, a DNS information collection unit, and a TLS information collection unit.

The web information collection unit may access a login page for the service based on a login URL for using the service, and collect web-related information. The web-related information may be information used to evaluate web-related risks. For example, the web information collection unit may collect cookies issued by a server upon access based on the login URL, and may collect HTTP headers added to the response from the server to the access based on the login URL.

The network information collection unit may have a function of identifying the domain of a login URL based on the login URL for using the service, and identifying a subdomain set for the identified domain. The network information collection unit may have a function of identifying an IP address corresponding to the subdomain based on the identified subdomain (IP address reverse lookup function). The network information collection unit may collect network-related information for each IP address. The network-related information may be information used to evaluate network-related risks. For example, the network information collection unit may collect port numbers that IP addresses expose to the network.

The email information collection unit may have a function of inferring the domain used in email (hereinafter, email domain) based on the login URL for using the service. The email information collection unit may collect email-related information based on the inferred email domain. The email-related information may be obtained from DNS. The email-related information may be information used to evaluate email-related risks. For example, the email information collection unit may collect Sender Policy Framework (SPF) records for the email domain.

The DNS information collection unit may have a function for identifying a DNS record based on a login URL for using the service (a reverse lookup function for DNS records). The DNS information collection unit may collect DNS-related information for each DNS record. The DNS-related information may be information used to evaluate DNS-related risks. For example, the DNS information collection unit may collect NS (Name Server) records for the domain of the service, and may collect whether or not name resolution is available for the domain of the service.

The TLS information collection unit may access a login page for the service as a TLS client based on a login URL for using the service, and collect TLS-related information. The TLS-related information may be information used to evaluate TLS-related risks. For example, the TLS information collection unit may collect the SSL/TLS certificate used in the access based on the login URL.

The evaluation function may have a function of calculating a risk assessment of a service based on the information collected by the collection function. Specifically, the evaluation function may identify risk items based on the information collected by the collection function, and calculate a risk assessment based on the identified risk items. The risk assessment may be expressed by the total number of identified risk items and the number of risk items for which measures have been taken. In such a case, the risk assessment may be referred to as the countermeasure coverage rate. The evaluation function may calculate a risk assessment for each evaluation item. For example, the evaluation function may include one or more functions selected from a web information evaluation unit, a network information evaluation unit, an email information evaluation unit, a DNS information evaluation unit, and a TLS information evaluation unit.

The web information evaluation unit may calculate a risk assessment for security headers, cookies, and content security based on web-related information. Security headers, cookies, and content security are examples of evaluation items. The risk assessment for security headers, cookies, and content security may be referred to as an item risk assessment.

The network information evaluation unit may calculate a risk assessment for IP reputation, amplification attack, and unsafe open service based on the network-related information. IP reputation, amplification attack, and unsafe open service are examples of evaluation items. The risk assessment for IP reputation, amplification attack, and unsafe open service may be referred to as an item risk assessment.

The email information evaluation unit may calculate a risk assessment related to transport security and anti-spoofing based on email-related information. Transport security and anti-spoofing are examples of evaluation items. The risk assessment related to transport security and anti-spoofing may be referred to as an item risk assessment.

The DNS information evaluation unit may calculate a risk assessment regarding DNS Security based on the network-related information and the DNS-related information. DNS Security is an example of an evaluation item. The risk assessment regarding DNS Security may be referred to as an item risk assessment.

The TLS information evaluation unit may calculate a risk assessment regarding TLS security based on TLS-related information. TLS security is an example of an evaluation item. The risk assessment regarding TLS security may be referred to as an item risk assessment.

(Display Mode)
The display mode according to the embodiment will be described below. Fig. 4 and Fig. 5 are diagrams showing an example of the display mode according to the embodiment. A service that is the target of the risk assessment calculation by the risk assessment device 10 may be called a target service.

First, the form (first form) of risk assessment displayed to the service provider will be explained with reference to Figure 4.

As shown in FIG. 4, the first aspect includes aspect 41A, aspect 41B, aspect 41C, and aspect 41D.

Aspect 41A is an aspect that includes a time series of the risk assessment of the target service (measure coverage rate for the past 30 days in FIG. 4). For example, aspect 41A may include a time series of the risk assessment of the entire target service. The risk assessment of the entire target service may be calculated based on the risk assessment for each assessment item.

Here, aspect 41A may include a time series of a transition of the risk assessment of the target service as well as a transition of the reference risk assessment of a reference service related to the target service. The reference service may be one or more services that provide the same or similar functions as the target service. The reference service may be one or more services that are pre-specified in the risk assessment device 10. The reference risk assessment may be calculated by the risk assessment device 10 or may be obtained from an external service. The reference risk assessment may be any one value selected from the average, median, maximum, and minimum value of the risk assessments related to one or more reference services.

Aspect 41B is an aspect that includes the latest item risk assessment for each assessment item that defines the risk assessment of the target service. Aspect 41B may be displayed together with aspect 41B.

Here, aspect 41B may include the latest item risk assessment for each assessment item that defines a reference risk assessment for the reference service along with the latest item risk assessment for the target service. The reference service may be one or more services that provide the same or similar functions as the target service. The reference service may be one or more services that are pre-specified in the risk assessment device 10. The assessment items for the reference service may be calculated by the risk assessment device 10 or may be obtained from an external service. The assessment item for the reference service may be any one value selected from the average, median, maximum, and minimum values of the item risk assessments for one or more reference services.

Aspect 41C is an aspect that includes the countermeasure status (countermeasure coverage rate in FIG. 4) for the risks that the target service has. Aspect 41C may include the countermeasure status for each survey item (category in FIG. 4). The countermeasure status may be the countermeasure coverage rate represented by the total number of identified risk items and the risk items for which countermeasures have been taken.

Aspect 41D is an aspect that includes details about a risk assessment (in FIG. 4, a security assessment). Aspect 41D may include an assessment item (e.g., "Content Security Policy"), a risk item related to the assessment item (e.g., "No value set"), a response to the risk item (e.g., "Recommended response"), reference information related to the risk item, etc.

Two or more aspects selected from aspects 41A to 41D may be displayed simultaneously or separately. For example, two or more aspects selected from aspects 41A to 41D may be displayed in one window, or may be displayed in a pop-up format using separate windows.

Secondly, the form (second form) of risk assessment displayed to persons other than the service provider (e.g., the service user) will be described with reference to Figure 5.

As shown in FIG. 5, the second aspect includes aspect 51A, aspect 51B, aspect 51C, aspect 51D, and aspect 51E.

Aspect 51A is an aspect that includes a time series of the risk assessment of the target service (measure coverage rate for the past 30 days in FIG. 5). Aspect 51A may be the same as aspect 41A described above.

Aspect 51B is an aspect that includes the latest item risk assessment for each assessment item that defines the risk assessment of the target service. Aspect 51B may be similar to aspect 41B described above.

Aspect 51C is an aspect that includes the countermeasure status (countermeasure coverage rate in FIG. 5) for the risk of the target service. Aspect 51C may be the same as aspect 41C described above.

Aspect 51D is an aspect that includes an overview of risk assessment (risk content in FIG. 5). It may include assessment items (e.g., "Content Security Policy"), explanations of the content related to the assessment items, etc. Here, aspect 51D may differ from aspect 41D in that it does not include responses to risk items, etc.

Aspect 51E may be an aspect that includes a risk assessment of the entire target service (in FIG. 5, an overall assessment). The overall assessment may be expressed by a score (e.g., a score expressed out of 100 points) determined using the countermeasure coverage rate used in aspects 51A to 51C. The overall assessment may be calculated using a standard different from the countermeasure coverage rate used in aspects 51A to 51C. For example, the overall assessment may be expressed by a score (e.g., a score expressed out of 100 points) that takes into account the importance of each uncountered risk item.

Two or more aspects selected from aspects 51A to 51E may be displayed simultaneously or separately. For example, two or more aspects selected from aspects 51A to 51E may be displayed in one window, or may be displayed in a pop-up format using separate windows.

As described above, the first aspect shown in FIG. 4 may differ from the second aspect shown in FIG. 5. For example, the first aspect may differ from the second aspect in that the content of aspect 41D differs from the content of aspect 51D. The first aspect may differ from the second aspect in that it does not include aspect 51E.

(Risk assessment method)
The risk assessment method according to the embodiment will be described below. Fig. 6 is a diagram showing the risk assessment method according to the embodiment.

As shown in FIG. 6, in step S10, the risk assessment device 10 identifies attribute information related to the service.

For example, the risk assessment device 10 may identify a login URL for using the service. The risk assessment device 10 may identify the domain of the login URL based on the login URL, and identify a subdomain set for the identified domain. The risk assessment device 10 may identify an IP address corresponding to the subdomain. The risk assessment device 10 may infer an email domain based on the login URL for using the service. The risk assessment device 10 may identify a DNS record based on the login URL for using the service. The login URL, the domain of the login URL, the subdomain set for the domain, the IP address, the email domain, and the DNS record may be considered to be examples of attribute information.

In step S11, the risk assessment device 10 sends a collection request to the collection server 20.

In step S12, the collection server 20 collects information about services on the network 200.

In step S13, the risk assessment device 10 receives a collection response from the collection server 20. The collection response includes the information collected in step S12.

Note that if the collection server 20 is not requested to execute some of the collection functions, the processing of steps S11 to S13 may be omitted. The risk assessment device 10 collects information about services on the network 200.

In step S14, the risk assessment device 10 calculates a risk assessment of the service based on the information about the service. The risk assessment device 10 may calculate a risk assessment for each evaluation item.

In step S15, the risk assessment device 10 stores the risk assessment of the service in chronological order together with the time information when the risk assessment of the service was calculated.

In step S20, the risk assessment device 10 receives a request to output a risk assessment from the first terminal 40. Note that if the risk assessment is output autonomously from the risk assessment device 10, the processing of step S20 may be omitted.

In step S21, the risk assessment device 10 transmits a risk assessment. The risk assessment may be output in the first manner described above (see FIG. 4). The first manner may be different from the second manner.

In step S30, the risk assessment device 10 receives a request to output a risk assessment from the second terminal 50. Note that if the risk assessment is output autonomously from the risk assessment device 10, the processing of step S30 may be omitted.

In step S31, the risk assessment device 10 transmits a risk assessment. The risk assessment may be output in the second manner described above (see FIG. 5). The second manner may be different from the first manner.

(Action and Effects)
In the embodiment, the risk assessment device 10 stores the risk assessment of the target service in chronological order together with the time information when the risk assessment of the target service is calculated, and outputs the transition of the risk assessment of the target service in chronological order (see Aspect 41A and Aspect 51A). With such a configuration, the deterioration/improvement status of the risk assessment of the target service can be easily grasped, and the risk assessment of the target service can be appropriately visualized.

In an embodiment, the risk assessment device 10 may output the latest item risk assessment for each assessment item that defines the risk assessment of the target service (see aspect 41B and aspect 51B). With such a configuration, the current state of the risk assessment of the target service can be easily grasped for each assessment item, and the risk assessment for each assessment item related to the target service can be appropriately visualized.

In an embodiment, the risk assessment device 10 may output the transition of the reference risk assessment of the reference service in chronological order along with the transition of the risk assessment of the target service (see embodiment 41A and embodiment 51A). With such a configuration, it is possible to compare the risk assessment of the target service with the reference risk assessment, and the risk assessment of the target service can be appropriately visualized.

In an embodiment, the risk assessment device 10 may output the latest item risk assessment for the reference service along with the latest item risk assessment for the target service (see aspect 41B and aspect 51B). With such a configuration, it is possible to compare the item risk assessment for the target service with the item list assessment for the reference service, and the risk assessment for each assessment item for the target service can be appropriately visualized.

In an embodiment, the first aspect of the risk assessment provided to the service provider may be different from the second aspect of the risk assessment provided to a person other than the service provider. With such a configuration, it is possible to provide necessary information to the service provider without providing information that does not need to be provided to a person other than the service provider.

[Change Example 1]
Modification 1 of the embodiment will be described below. Differences from the embodiment will be mainly described below.

In Modification Example 1, the relationship between the timing at which each collection function completes collection of information about the service (hereinafter, collection completion timing) and the timing at which a risk assessment is calculated (hereinafter, calculation timing) is explained. The following options are possible for the relationship between the collection completion timing and the calculation timing.

In the following, the collection functions are exemplified as a web information collection unit, a network information collection unit, and an email information collection unit, and an example is given of a case in which the calculation timing is a daily timing (e.g., 0:00).

In the first option, a constraint is imposed that the collection completion timing of each collection function is synchronized with the calculation timing. For example, as shown in FIG. 7, the web information collection unit, network information collection unit, and mail information collection unit are configured to complete information collection by each calculation timing.

In such a case, for example, if a collection timeout occurs by the network information collection unit between 9/1 and 9/2, the information that the network information collection unit should collect will be insufficient at the calculation timing of 9/2, and the risk assessment device 10 will put the risk assessment calculation of the service (Srv.B) that lacks information at the calculation timing of 9/2 on hold. Alternatively, if a collection failure occurs by the web information collection unit between 9/2 and 9/3, the information that the web information collection unit should collect will be insufficient at the calculation timing of 9/3, and the risk assessment device 10 will put the risk assessment calculation of the service (Srv.A) that lacks information at the calculation timing of 9/3 on hold.

The first option may be expressed as follows. The risk assessment device 10 is configured to calculate a risk assessment of a service at a predetermined timing (the calculation timing described above). The risk assessment device 10 executes the calculation of the risk assessment if the collection of information is completed by the predetermined timing. The risk assessment device 10 puts the calculation of the risk assessment on hold if the collection of information is not completed by the predetermined timing.

In this way, with the first option, risk assessment for each calculation timing can be calculated under the same conditions. On the other hand, it is necessary to set the calculation timing according to the collection function with the worst performance, which may result in pending calculation of risk assessment.

In the second option, the collection timing of each collection function is allowed to be asynchronous with the calculation timing. For example, as shown in Figure 8, the web information collection unit, network information collection unit, and mail information collection unit are allowed to collect information about services at their own intervals.

In such a case, for example, if the network information collection unit does not complete collection at the calculation timing of 9/1, the information that should be collected by the network information collection unit will be insufficient, but the risk assessment device 10 will calculate the risk assessment of the service (Srv.A) by excluding the information collected by the network information collection unit at the calculation timing of 9/1. Alternatively, if the mail information collection unit fails to collect information between 9/1 and 9/2, the information that should be collected by the mail information collection unit will be insufficient at the calculation timing of 9/2, but the risk assessment device 10 will calculate the risk assessment of the service (Srv.A) by excluding the information that should be collected by the mail information collection unit at the calculation timing of 9/2.

The second option may be expressed as follows: The risk assessment device 10 is configured to calculate a risk assessment of a service at a predetermined timing (the calculation timing described above). The risk assessment device 10 excludes information that has not been completely collected at the predetermined timing, and calculates a risk assessment of a service based on information that has been completely collected at the predetermined timing.

Thus, with the second option, it is not possible to calculate risk assessment for each calculation timing under the same conditions, but there is no need to set the calculation timing to match the collection function with the worst performance, and there is no pending calculation of risk assessment.

[Other embodiments]
Although the present invention has been described by the above-mentioned embodiment, the description and drawings forming a part of this disclosure should not be understood as limiting the present invention. From this disclosure, various alternative embodiments, examples and operating techniques will become apparent to those skilled in the art.

In the above disclosure, a case has been mainly described in which the risk assessment is the coverage rate of measures. However, the above disclosure is not limited to this. The risk assessment may be calculated based on the importance of the risk item, the number of risk items that have not been addressed, the number of risk items that have been addressed, etc.

In the above disclosure, an example was given of a case where the reference service is one or more services that provide the same or similar functions as the target service. However, the above disclosure is not limited to this. The reference service may be the target service itself. For example, in a case where a risk assessment of the target service in a target month is output in chronological order, the reference service may be the target service for the same month of the previous year. The reference risk assessment may be a risk assessment of the target service for the same month of the previous year.

In the above disclosure, at least a portion of the collection function may be performed using the collection server 20. However, the above disclosure is not limited thereto. At least a portion of the evaluation function may be performed using the collection server 20.

Although not specifically mentioned in the above disclosure, the function of collecting and analyzing information on network 200 may be referred to as OSINT (Open Source Intelligence).

Although not specifically mentioned in the disclosure above, information about the service collected by the collection function may include text information such as company or third party announcements or press articles about the service.

Although not specifically mentioned in the above disclosure, output and display may be interpreted as interchangeable. Display may include a display in physical reality, a display in augmented reality such as AR (Artificial Reality), a display in virtual reality such as VR (Virtual Reality), or a display in a virtual space such as the metaverse.

Although not specifically mentioned in the above disclosure, the risk assessment device 10 may have a display unit that displays the risk assessment. The display unit may be configured with a display such as a liquid crystal panel, an organic EL panel, or an LED.

Although not specifically mentioned in the embodiment, a program may be provided that causes a computer to execute each process performed by the risk assessment device 10. The program may also be recorded on a computer-readable medium. Using the computer-readable medium, it is possible to install the program on a computer. Here, the computer-readable medium on which the program is recorded may be a non-transient recording medium. The non-transient recording medium is not particularly limited, but may be, for example, a recording medium such as a CD-ROM or DVD-ROM.

Alternatively, a chip may be provided that is configured with a memory that stores programs for executing each process performed by the risk assessment device 10 and a processor that executes the programs stored in the memory.

Reference Signs List 10: risk assessment device, 11: collection unit, 12: storage unit, 13: output unit, 14: control unit, 20: collection server, 30: provision server, 40: first terminal, 50: second terminal, 100: risk assessment system, 200: network

Claims (10)

a collection unit that collects information on a service provided by a service provider via a network from an information source that is open to a third party based on attribute information on the service;
A control unit that calculates a risk assessment of the service based on information about the service;
A storage unit for storing a risk assessment of the service;
an output unit that outputs a risk assessment of the service;
the output unit outputs the risk assessment of the service to the service provider in a first manner, and outputs the risk assessment of the service to a person other than the service provider in a second manner different from the first manner;
outputting the service provider in the first manner, the service provider being provided with a plurality of manners indicating a risk assessment of the service, the plurality of manners including one or more predetermined manners and other manners other than the one or more predetermined manners;
outputting the information in the second format to a person other than the service provider, the information being the same as the one or more predetermined formats and the information being the other format excluding at least a part of the risk assessment of the service included in the other format;
When outputting to the service provider in the first mode, outputting the information in the other mode including the response of the service provider to the risk content in the item of the risk assessment,
When outputting in the second mode to a person other than the service provider, the output does not include the correspondence of the other mode in the first mode ,
A risk assessment device that outputs the results of the risk assessment in one or more specified forms to both the service provider and persons other than the service provider, and that includes at least one of displaying a radar chart of multiple items regarding the results of the risk assessment, or displaying a graph showing changes in the risk assessment over time . The output unit outputs a reference risk assessment of a reference service related to the service together with the risk assessment of the service;
The risk assessment device of claim 1 , wherein the reference service is one or more services that provide the same or similar functions as the service. The risk assessment device according to claim 2 , wherein the reference risk assessment is any one value selected from the group consisting of an average value, a median value, a maximum value, and a minimum value of risk assessments relating to one or more of the reference services. The risk assessment device according to claim 1, wherein the output unit outputs the latest item risk assessment for each item that defines the risk assessment of the service as the latest item risk assessment for the service. The output unit outputs, together with the latest item risk evaluation for the service, the latest item risk evaluation for each item defining a reference risk evaluation of a reference service related to the service as the latest item risk evaluation for the reference service;
The risk assessment device according to claim 4 , wherein the reference service is one or more services that provide the same or similar functions as the service. The risk assessment device of claim 5, wherein the latest item risk assessment for the reference service is any one value selected from the average, median, maximum and minimum values of the latest item risk assessments for one or more of the reference services. the attribute information includes identification information for identifying the service in the network;
The risk assessment device according to claim 1 , wherein the collection unit identifies a subdomain set for the domain based on the domain identified by the identification information, and collects information regarding the service based on the subdomain. The control unit is configured to calculate a risk assessment of the service at a predetermined timing,
The risk assessment device according to claim 1 , wherein the control unit executes the calculation of the risk assessment when the collection of information is completed by the predetermined time. The control unit is configured to calculate a risk assessment of the service at a predetermined timing,
The risk assessment device according to claim 1 , wherein the control unit calculates a risk assessment of the service based on information that has been collected at the specified time, excluding information that has not been collected at the specified time. A step A in which a risk assessment device collects information on a service provided by a service provider via a network from an information source open to a third party based on attribute information on the service;
A step B in which the risk assessment device calculates a risk assessment of the service based on information about the service;
A step C of the risk assessment device storing a risk assessment of the service;
and a step D of the risk assessment device outputting a risk assessment of the service;
the step D includes a step of outputting a risk assessment of the service to the service provider in a first manner, and a step of outputting the risk assessment of the service to a person other than the service provider in a second manner different from the first manner,
outputting the service provider in the first manner, the service provider being provided with a plurality of manners indicating a risk assessment of the service, the plurality of manners including one or more predetermined manners and other manners other than the one or more predetermined manners;
outputting the information in the second format to a person other than the service provider, the information being the same as the one or more predetermined formats and the information being the other format excluding at least a part of the risk assessment of the service included in the other format;
When outputting to the service provider in the first mode, outputting the information in the other mode including the response of the service provider to the risk content in the item of the risk assessment,
When outputting in the second mode to a person other than the service provider, the output does not include the correspondence of the other mode in the first mode ,
A risk assessment method which outputs the results of the risk assessment to both the service provider and a person other than the service provider in one or more predetermined forms, including at least one of displaying a radar chart of multiple items regarding the results of the risk assessment, or displaying a graph showing changes in the risk assessment over time .