JPWO2018168822A1 - Security risk management device, security risk management method, and security risk management program - Google Patents

Abstract

The security risk management device 20 is an instruction unit 21 that instructs a management target terminal having a security risk to collect operation information that is information indicating an operation status of the management target terminal, and a countermeasure against the security risk. A determination unit 22 that determines whether or not a service provided by a managed terminal when a risk countermeasure is applied is interrupted by using the collected operation information and a determination formula corresponding to the collected operation information; And an assigning unit 23 that assigns risk countermeasures determined not to cause trouble to managed terminals.

Description

  The present invention relates to a security risk management device, a security risk management method, and a security risk management program, and more particularly to a security risk management device, a security risk management method, and a security risk management program that support selection of countermeasures against security risks.

  When security risks such as vulnerabilities and threats are discovered in IT (Information Technology) assets held by organizations, security managers are required to remove the security risks discovered by taking some measures immediately. .

  However, the security administrator is required to consider so that the situation where the work is stopped due to the application of countermeasures will not occur. That is, the security administrator is required to select measures that do not affect the business.

  However, whether or not an effect is generated by applying a countermeasure depends on the usage status of each terminal. Therefore, the security administrator is required to select a countermeasure after confirming the usage status of each terminal in order to select an appropriate countermeasure for each terminal.

  In order to select an appropriate measure for each terminal, the security administrator uses, for example, a security risk management device. The security risk management device is a device that collects terminal configuration information and detects security risks such as vulnerabilities and threats existing in the terminal based on the collected configuration information. Further, the security risk management device presents a countermeasure for removing the detected security risk.

  Patent Documents 1 to 2 describe examples of security risk management devices. Patent Document 1 describes a security risk management system that selects and presents appropriate measures by evaluating risks that may be caused by vulnerabilities and threats, and the impact on availability of measures applied. .

  Patent Document 2 describes a malicious program countermeasure system that efficiently generates a removal program capable of appropriately dealing with a malicious program and avoiding adverse effects on business processing when applied to a target system.

Japanese Patent No. 5125069 JP 2006-099857 A

  Each of the above examples of the security risk management apparatus has the following problems.

  Patent Document 1 does not describe a specific method for setting the degree of influence on availability. That is, the security risk management device described in Patent Literature 1 does not always appropriately evaluate the degree of influence on availability due to application of countermeasures.

Further, in the malicious program countermeasure system described in Patent Document 2, it is not assumed that the operation information of the target system is acquired in efficiently generating the removal program.
That is, there is a possibility that the operation status of the target system is not reflected in the removal program generated by the anti-malware countermeasure system described in Patent Document 2.

  When the operation information of the target terminal is not automatically acquired, the security administrator is required to manually select a countermeasure after confirming the operation status of each terminal. When there are many management terminals, there is a problem that when a security administrator manually selects a countermeasure, a long time is required for selection.

  In addition, the security risk management apparatus may present a plurality of countermeasures against vulnerabilities and threats. When multiple countermeasures are presented, the security administrator is required to select the most appropriate countermeasure from the presented countermeasures. However, when the selection is difficult, there is a problem that it takes a long time for the security administrator to select the most appropriate countermeasure.

[Object of invention]
Therefore, the present invention aims to provide a security risk management apparatus, a security risk management method, and a security risk management program that can quickly select a security risk countermeasure that takes into account the availability of a managed system and solves the above-described problems. And

  The security risk management device according to the present invention includes an instruction unit for instructing a management target terminal having a security risk to collect operation information that is information indicating an operation status of the management target terminal, and a countermeasure against the security risk. A determination unit that determines whether the service provided by the managed terminal is affected when a certain risk countermeasure is applied, using the collected operation information and a determination formula corresponding to the collected operation information, and a service And an allocating unit that allocates risk measures determined to be unaffected to managed terminals.

  The security risk management method according to the present invention instructs a managed terminal having a security risk to collect operation information, which is information indicating the operation status of the managed terminal, and is a risk countermeasure that is a countermeasure against the security risk. Determine whether the service provided by the managed terminal will be disrupted using the collected operation information and the judgment formula corresponding to the collected operation information, and determine that the service will not interfere The assigned risk countermeasures are assigned to managed terminals.

  The security risk management program according to the present invention is directed to a computer that instructs a management target terminal having a security risk to collect operation information that is information indicating an operation status of the management target terminal. A determination process for determining whether or not a service provided by a managed terminal is impaired when a risk countermeasure, which is a countermeasure, is applied, using a collected operation information and a determination formula corresponding to the collected operation information; and An allocation process for allocating risk countermeasures determined to have no trouble in service to managed terminals is executed.

  ADVANTAGE OF THE INVENTION According to this invention, the security risk countermeasure which considered the availability of the management object system can be selected rapidly.

It is a block diagram which shows the structural example of 1st Embodiment of the security risk management apparatus by this invention. It is a flowchart which shows the operation | movement of the allocation process by the security risk management apparatus 20 of 1st Embodiment. It is a block diagram which shows the structural example of 2nd Embodiment of the security risk management system by this invention. It is explanatory drawing which shows the example of security intelligence. It is explanatory drawing which shows the example of a work influence determination screen. It is a flowchart which shows the whole operation | movement of the security risk countermeasure application process by the security risk management system 10 of 2nd Embodiment. It is a flowchart which shows the operation | movement of the security risk determination process by the security risk management apparatus 100 of 2nd Embodiment. It is a flowchart which shows the operation | movement of the security risk countermeasure allocation process by the security risk management apparatus 100 of 2nd Embodiment. It is explanatory drawing which shows the example of a work influence determination result screen. It is a flowchart which shows the operation | movement of the security risk countermeasure application process by the security risk management system 10 of 2nd Embodiment.

Embodiment 1. FIG.
Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing a configuration example of a first embodiment of a security risk management apparatus according to the present invention. The security risk management apparatus 20 according to the present invention instructs the management target terminal having the security risk to instruct to collect the operation information that is the information indicating the operation status of the management target terminal (for example, business impact determination). Part 105) and whether the service provided by the managed terminal is affected when a risk countermeasure that is a countermeasure against the security risk is applied, the collected operation information and the judgment formula corresponding to the collected operation information A determination unit 22 (for example, a business effect determination unit 105) that is determined using a client, and an allocation unit 23 (for example, a business effect determination unit 105) that assigns a risk countermeasure that has been determined not to cause a problem to a service to a managed terminal. Is provided.

  Hereinafter, the allocation process by the security risk management apparatus 20 will be described. FIG. 2 is a flowchart showing the operation of assignment processing by the security risk management apparatus 20 of the first embodiment.

  First, the instruction unit 21 instructs a management target terminal having a security risk to collect operation information that is information indicating an operation status of the management target terminal (step S11).

  Next, the instruction unit 21 acquires the collected operation information (step S12). The instruction unit 21 inputs the acquired operation information to the determination unit 22.

  Next, the determination unit 22 corresponds to the collected operation information and the collected operation information whether or not the service provided by the management target terminal is hindered when a risk countermeasure that is a countermeasure against the security risk is applied. A determination is made using a determination formula (step S13).

  Next, the assigning unit 23 assigns the risk countermeasures determined not to interfere with the service to the management target terminal (step S14). After the assignment, the security risk management apparatus 20 ends the assignment process.

  With such a configuration, the security risk management apparatus can quickly select a security risk countermeasure in consideration of the availability of the managed system.

  Further, the security risk management device 20 may include a security risk determination unit (for example, the security risk determination unit 102) that determines whether or not a security risk exists in the management target terminal.

  With such a configuration, the security risk management apparatus can determine whether a security risk exists in the management target terminal.

  In addition, the instruction unit 21 may instruct the management target terminal to apply the assigned risk countermeasure.

  With such a configuration, the security risk management apparatus can apply the security risk countermeasure assigned to the management target terminal.

  Further, the security risk management apparatus 20 may include a generation unit (for example, the screen data generation unit 104) that generates an input unit for inputting parameters used in the determination formula.

  With such a configuration, the security risk management apparatus can reflect the security administrator's request in the determination formula.

  The generation unit may generate display means for displaying the management target terminal and the risk countermeasures assigned to the management target terminal together.

  With such a configuration, the security risk management apparatus can display the application result of the security risk countermeasure to the security manager.

  Further, the security risk management apparatus 20 may include a storage unit (for example, the security intelligence storage unit 107) that stores security risk management information including a determination formula.

  With such a configuration, the security risk management apparatus can assign various security risk countermeasures to the management target terminal.

Embodiment 2. FIG.
[Description of configuration]
Next, a second embodiment of the present invention will be described with reference to the drawings. FIG. 3 is a block diagram showing a configuration example of the second embodiment of the security risk management system according to the present invention.

  The security risk management system according to the present embodiment collectively determines whether or not security risk countermeasures have an impact on business operations after setting parameters in an influence determination conditional expression in advance. After the determination, the security risk management system assigns to each terminal a security risk countermeasure that does not affect the business.

  As shown in FIG. 3, the security risk management system 10 includes a security risk management device 100, a management target terminal 200, and a security administrator operation terminal 300. The security risk management apparatus 100 plays a role as a server.

  As shown in FIG. 3, a security risk management unit 210 is installed in the management target terminal 200. The security risk management unit 210 plays a role as an agent.

  The security risk management device 100 is a device that detects a security risk existing in the management target terminal 200 and removes the detected security risk. As shown in FIG. 3, the security risk management apparatus 100 includes a server transmission / reception unit 101, a security risk determination unit 102, a countermeasure instruction unit 103, a screen data generation unit 104, a work impact determination unit 105, and an impact determination parameter. It has a receiving unit 106 and a security intelligence storage unit 107.

  The server transmission / reception unit 101 has a function of transmitting / receiving information to / from apparatuses other than the security risk management apparatus 100.

  The security risk determination unit 102 has a function of determining whether a security risk exists in the management target terminal 200.

  The countermeasure instruction unit 103 has a function of instructing the management target terminal 200 to execute the selected security risk countermeasure.

  The screen data generation unit 104 has a function of generating a screen input to the security administrator operation terminal 300.

  The business impact determination unit 105 has a function of performing business impact determination to determine whether or not the business is affected when security risk countermeasures are applied. The case where the business is affected is, for example, a case where trouble occurs in the service provided by the management target terminal 200.

  The influence determination parameter receiving unit 106 has a function of receiving, from the security administrator, parameters necessary for determining whether the business influence determination unit 105 affects the business.

  The security intelligence storage unit 107 has a function of storing a plurality of security intelligences. As shown in FIG. 3, the security intelligence is composed of a risk investigation method, a risk countermeasure, an influence determination conditional expression, and an operation information acquisition method.

  The risk investigation method indicates a method of investigating whether or not a security risk exists. Risk countermeasures indicate countermeasures against security risks.

  The influence determination conditional expression is a conditional expression used for determining whether or not a countermeasure against a security risk affects a business. In addition, the operation information acquisition method indicates a method of acquiring operation information used for determining whether or not a countermeasure against a security risk affects business.

  FIG. 4 is an explanatory diagram showing an example of security intelligence. The security intelligence shown in FIG. 4 corresponds to one risk investigation method.

  The risk investigation method shown in FIG. 4 is a method for confirming whether or not the patch A for vulnerability is applied by referring to the patch application history. In addition, as shown in FIG. 4, as countermeasures against vulnerabilities when the patch A is not applied, “patch and restart”, “close port xxx”, “stop process yyy”, There are four types of countermeasures: “Stop app zzz”.

  The risk countermeasures shown in FIG. 4 are arranged in the order of effectively reducing the security risk. The risk countermeasures may be arranged according to a rule other than the rule in the example shown in FIG.

  Moreover, as shown in FIG. 4, an influence determination conditional expression is prepared for each risk countermeasure. For example, an influence determination conditional expression for “restart by applying a patch” is “average continuous operation time <x1 (time)”. Note that x1, x2, x3, and x4 shown in FIG. 4 are parameters set by the security administrator in consideration of the influence on business.

  As shown in FIG. 4, the operation information collection method describes a method for acquiring operation information used in the evaluation based on the influence determination conditional expression. For example, the operation information collection method for “average continuous operation time <x1 (hour)” is “obtain startup and shutdown history from log AAA and calculate average continuous operation time”.

  Note that the contents of the risk investigation method, risk countermeasures, impact determination conditional expression, and operation information collection method may be other than the contents of the risk investigation method, risk countermeasure, impact determination conditional expression, and operation information collection method shown in FIG. Good.

  The management target terminal 200 is a terminal subject to security risk management. As shown in FIG. 3, a security risk management unit 210 is installed in the management target terminal 200. The security risk management unit 210 receives an instruction from the security risk management apparatus 100 and takes measures against the security risk.

  As illustrated in FIG. 3, the security risk management unit 210 includes a risk information collection unit 211, an operation information collection unit 212, a countermeasure execution unit 213, and an agent transmission / reception unit 214.

  The risk information collection unit 211 has a function of collecting configuration information of the management target terminal 200 used for determining whether or not a security risk exists.

  The operation information collection unit 212 has a function of collecting operation information of the management target terminal 200 that is used to determine whether or not business is affected.

  The countermeasure execution unit 213 has a function of executing a risk countermeasure assigned by the security risk management apparatus 100.

  The agent transmission / reception unit 214 has a function of transmitting / receiving information to / from the security risk management apparatus 100.

  The security administrator operation terminal 300 is a terminal used by the security administrator to operate the security risk management apparatus 100. Further, the security administrator operation terminal 300 displays a business effect determination screen for the security administrator.

  FIG. 5 is an explanatory diagram illustrating an example of a business effect determination screen. The business effect determination screen shown in FIG. 5 corresponds to the security intelligence shown in FIG.

  In the business impact determination screen shown in FIG. 5, risk countermeasures and impact determination conditional expressions related to each risk countermeasure are displayed. The parameter portion of each influence determination conditional expression shown in FIG. 5 is an input field.

  The security risk management apparatus 100 according to the present embodiment applies security risk countermeasures to a plurality of managed terminals using an impact determination conditional expression that determines whether or not business operations are affected by application of security risk countermeasures. Assign all at once. Therefore, the security risk management apparatus 100 can collectively assign security risk countermeasures considering availability to a plurality of management target terminals.

[Description of operation]
Hereinafter, the operation of the security risk management system 10 of this embodiment will be described with reference to FIGS.

  First, the overall operation of the security risk management system 10 of this embodiment will be described with reference to FIG. FIG. 6 is a flowchart showing the overall operation of the security risk countermeasure application processing by the security risk management system 10 of the second embodiment.

  First, the security risk management apparatus 100 determines whether there is a security risk in the management target terminal 200 (step S110). When it is determined that there is no security risk (No in step S120), the security risk management system 10 ends the security risk countermeasure application process.

  When it is determined that there is a security risk (Yes in step S120), the security risk management apparatus 100 assigns an appropriate risk countermeasure to the management target terminal 200 (step S130).

  Next, the security risk management unit 210 applies the assigned risk countermeasure to the management target terminal 200 (step S140). After the application, the security risk management system 10 ends the security risk countermeasure application process.

  Next, the operation of determining whether or not there is a security risk in step S110 will be described with reference to FIG. FIG. 7 is a flowchart illustrating an operation of security risk determination processing by the security risk management apparatus 100 according to the second embodiment.

  The security risk determination unit 102 of the security risk management apparatus 100 acquires a risk investigation method included in the security intelligence stored in the security intelligence storage unit 107 (step S111). The security risk determination unit 102 inputs the acquired risk investigation method to the server transmission / reception unit 101.

  Next, the server transmission / reception unit 101 transmits the input risk investigation method to the agent transmission / reception unit 214 of the security risk management unit 210 (step S112).

  Next, the agent transmitting / receiving unit 214 receives the transmitted risk investigation method. The agent transmission / reception unit 214 inputs the received risk investigation method to the risk information collection unit 211.

  Next, the risk information collection unit 211 collects the configuration information of the management target terminal 200 using the input risk investigation method (step S113). Next, the risk information collection unit 211 inputs the collected configuration information to the agent transmission / reception unit 214.

  Next, the agent transmission / reception unit 214 transmits the input configuration information to the server transmission / reception unit 101 (step S114). Next, the server transmission / reception unit 101 receives the transmitted configuration information. The server transmission / reception unit 101 inputs the received configuration information to the security risk determination unit 102.

  Next, the security risk determination unit 102 determines whether there is a security risk in the managed terminal 200 based on the input configuration information and the transmitted risk investigation method (step S115). After the determination, the security risk management apparatus 100 ends the security risk determination process.

  As described above, in the security risk determination process, the business effect determination unit 105 performs the security risk countermeasure allocation process in the next step S130 for the management target terminal 200 determined to have a security risk. Further, the security risk management system 10 ends the security risk countermeasure application process for the management target terminal 200 determined to have no security risk.

  Next, the operation of assigning risk countermeasures in step S130 will be described with reference to FIG. FIG. 8 is a flowchart illustrating the operation of security risk countermeasure allocation processing by the security risk management apparatus 100 according to the second embodiment.

  First, the business influence determination unit 105 acquires the security intelligence stored in the security intelligence storage unit 107 (step S131). The business influence determination unit 105 inputs the acquired security intelligence to the screen data generation unit 104.

  Next, the screen data generation unit 104 generates a business impact determination screen that displays the content of the business impact determination performed on the management target terminal 200 based on the input security intelligence. Next, the screen data generation unit 104 inputs the generated business effect determination screen to the server transmission / reception unit 101.

  Next, the server transmission / reception unit 101 transmits the input business effect determination screen to the security administrator operation terminal 300 (step S132). The security administrator operation terminal 300 receives the transmitted business effect determination screen.

  Next, the security administrator operation terminal 300 displays the received job influence determination screen for the security administrator. The security administrator operation terminal 300 displays a business effect determination screen as shown in FIG. 5, for example.

  Next, the security administrator operating terminal 300 displays a message for prompting the security administrator to input parameters on the business impact determination screen. The security administrator inputs parameters to the security administrator operation terminal 300 via the business effect determination screen (step S133).

  After the security administrator inputs the parameters, the security administrator operation terminal 300 transmits the input parameters to the server transmission / reception unit 101. The server transmission / reception unit 101 receives the transmitted parameter.

  Next, the server transmitting / receiving unit 101 inputs the received parameter to the influence determination parameter receiving unit 106. The influence determination parameter receiving unit 106 inputs the input parameters to the work influence determination unit 105.

  Next, the business influence determination unit 105 acquires the operation information collection method included in the security intelligence. The business influence determination unit 105 inputs the acquired operation information collection method to the server transmission / reception unit 101.

  Next, the server transmission / reception unit 101 transmits the input operation information collection method to the agent transmission / reception unit 214. The agent transmission / reception unit 214 receives the transmitted operation information collection method. Next, the agent transmission / reception unit 214 inputs the received operation information collection method to the operation information collection unit 212.

  Next, the operation information collection unit 212 collects operation information of the management target terminal 200 using the input operation information collection method (step S134). Next, the operation information collection unit 212 inputs the collected operation information to the agent transmission / reception unit 214.

  Next, the agent transmission / reception unit 214 transmits the input operation information to the server transmission / reception unit 101. The server transmission / reception unit 101 receives the transmitted operation information. Next, the server transmission / reception unit 101 inputs the received operation information to the business effect determination unit 105.

  Next, the business impact determination unit 105 determines whether the business is affected based on the impact determination conditional expression, the parameter acquired in step S133, and the operation information collected in step S134. Is performed (step S135).

  Next, the business influence determination unit 105 assigns a risk countermeasure that has been determined not to affect the business to each management target terminal (step S136).

  Next, the business impact determination unit 105 determines the security intelligence acquired in step S131, the parameters acquired in step S133, the number of terminals that affect the business in each risk countermeasure, and the number of terminals that do not affect the business. Are input to the screen data generation unit 104.

  Next, the screen data generation unit 104 generates a business effect determination result screen based on the input information. The screen data generation unit 104 inputs the generated business effect determination result screen to the server transmission / reception unit 101.

  Next, the server transmission / reception unit 101 transmits the input business effect determination result screen to the security administrator operation terminal 300 (step S137). The security administrator operation terminal 300 receives the transmitted business effect determination result screen.

  Next, the security administrator operation terminal 300 displays the received business effect determination result screen for the security administrator. After the display, the security risk management apparatus 100 ends the security risk countermeasure allocation process.

  FIG. 9 shows an example of the business impact determination result screen displayed when the business impact determination is performed on 100 managed terminals with security risks. FIG. 9 is an explanatory diagram illustrating an example of a business effect determination result screen.

  In the example illustrated in FIG. 9, the security administrator determines that the parameter of the first risk countermeasure influence determination conditional expression is “the terminal that is restarted every 24 hours is not affected by the restart”. It is set to “24” above.

  In the example illustrated in FIG. 9, the business effect determination unit 105 has the risk countermeasure of “restart by applying a patch” affecting the business for 60 terminals whose average continuous operation time is less than 24 hours. Judge that there is no. In addition, for the remaining 40 terminals whose average continuous operation time is 24 hours or more, the business effect determination unit 105 determines that the risk countermeasure of “restart by applying a patch” affects the business. ing.

  For the 40 terminals that are determined to have an impact on the business in the first risk countermeasure business impact assessment, the business impact assessment unit 105 performs the business impact on “close port xxx” that is the next risk countermeasure. Make a decision. Hereinafter, the business impact determination unit 105 repeatedly performs the business impact determination regarding each risk countermeasure until a risk countermeasure that is determined not to affect the business for all terminals is selected.

  In the example illustrated in FIG. 9, risk countermeasures are assigned to all terminals at once. However, the terminals may be classified into predetermined categories, and risk countermeasures may be assigned for each predetermined category. For example, when a terminal is classified into a server and a PC, more appropriate risk countermeasures are assigned by changing parameters between the server and the PC.

  In this embodiment, all risk countermeasures and influence determination conditional expressions are prepared in advance as security intelligence, and the security administrator determines only the parameters of the influence determination conditional expressions. However, a method in which the security administrator determines risk countermeasures, influence determination conditional expressions, and the like may also be used.

  Next, the operation for applying the risk countermeasure in step S140 will be described with reference to FIG. FIG. 10 is a flowchart illustrating the operation of security risk countermeasure application processing by the security risk management system 10 according to the second embodiment.

  First, the countermeasure instruction unit 103 inputs a risk countermeasure assigned to each management target terminal to the server transmission / reception unit 101. The server transmission / reception unit 101 transmits the input risk countermeasure to the agent transmission / reception unit 214 (step S141).

  The agent transmission / reception unit 214 receives the transmitted risk countermeasure. Next, the agent transmission / reception unit 214 inputs the received risk countermeasures to the countermeasure execution unit 213.

  Next, the countermeasure execution unit 213 applies the input risk countermeasure to the management target terminal 200 (step S142). After the application, the security risk management system 10 ends the security risk countermeasure application process.

[Description of effects]
If the security risk management device of this embodiment detects a security risk that exists in a managed terminal and there are multiple countermeasures for the detected security risk, will the business be affected by applying each countermeasure? Determine whether or not.

  After the determination, the security risk management apparatus assigns measures that do not affect the business to the management target terminal. Therefore, a security administrator who uses the security risk management apparatus according to the present embodiment can collectively assign risk countermeasures that do not affect business operations to a plurality of terminals.

  The security risk management apparatus according to the present embodiment provides, as security intelligence, a risk investigation method and a risk countermeasure, as well as an influence determination conditional expression that is used to determine whether the work is affected when the countermeasure is applied. The business impact determination unit 105 of the security risk management apparatus 100 assigns risk countermeasures to each terminal in accordance with the impact determination conditional expression.

  Since the determination is made using the influence determination conditional expression, the business effect determination unit 105 can determine whether the business is affected without much time. In other words, the security administrator can quickly assign a risk countermeasure that does not affect the business to a large number of managed terminals simply by setting the parameters of the influence determination conditional expression.

  The security risk management system of this embodiment is expected to be suitably used in the field of vulnerability management, the field of threat management, the field of cyber security measures, the field of security incident response, and the like.

  The security risk management device 20, the security risk management device 100, and the management target terminal 200 of each embodiment are, for example, a CPU (Central Processing Unit) that executes processing according to a program stored in a non-temporary storage medium. It may be realized by. That is, the instruction unit 21, the determination unit 22, the allocation unit 23, the server transmission / reception unit 101, the security risk determination unit 102, the countermeasure instruction unit 103, the screen data generation unit 104, the work influence determination unit 105, the influence determination parameter reception unit 106, the risk The information collection unit 211, the operation information collection unit 212, the countermeasure execution unit 213, and the agent transmission / reception unit 214 may be realized by a CPU that executes processing according to program control, for example.

  The security intelligence storage unit 107 may be realized by, for example, a RAM (Random Access Memory).

  In addition, each unit in the security risk management device 20, the security risk management device 100, and the management target terminal 200 of each embodiment may be realized by a hardware circuit. As an example, the instruction unit 21, the determination unit 22, the allocation unit 23, the server transmission / reception unit 101, the security risk determination unit 102, the countermeasure instruction unit 103, the screen data generation unit 104, the work influence determination unit 105, the influence determination parameter reception unit 106, The risk information collection unit 211, the operation information collection unit 212, the countermeasure execution unit 213, and the agent transmission / reception unit 214 are each realized by an LSI (Large Scale Integration). Further, they may be realized by one LSI.

  While the present invention has been described with reference to the embodiments and examples, the present invention is not limited to the above embodiments and examples. Various changes that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention.

  This application claims the priority on the basis of the JP Patent application 2017-053154 for which it applied on March 17, 2017, and takes in those the indications of all here.

DESCRIPTION OF SYMBOLS 10 Security risk management system 20, 100 Security risk management apparatus 21 Instruction part 22 Determination part 23 Allocation part 101 Server transmission / reception part 102 Security risk determination part 103 Countermeasure instruction part 104 Screen data generation part 105 Work influence determination part 106 Influence determination parameter reception part 107 Security Intelligence Storage Unit 200 Management Target Terminal 210 Security Risk Management Unit 211 Risk Information Collection Unit 212 Operation Information Collection Unit 213 Countermeasure Execution Unit 214 Agent Transmission / Reception Unit 300 Security Administrator Operation Terminal

Claims (10)

An instruction unit for instructing a management target terminal having a security risk to collect operation information that is information indicating an operation status of the management target terminal;
Whether or not the service provided by the managed terminal is hindered when a risk countermeasure, which is a countermeasure against the security risk, is applied, and the collected operation information and a judgment formula corresponding to the collected operation information are used. A determination unit for determining
A security risk management apparatus comprising: an allocation unit that allocates a risk countermeasure that is determined not to interfere with the service to the managed terminal. The security risk management apparatus according to claim 1, further comprising a security risk determination unit that determines whether or not a security risk exists in the management target terminal. The security risk management device according to claim 1, wherein the instruction unit instructs the management target terminal to apply the assigned risk countermeasure. The security risk management apparatus according to any one of claims 1 to 3, further comprising: a generation unit that generates an input unit that inputs a parameter used in the determination formula. The security risk management apparatus according to claim 4, wherein the generation unit generates display means for displaying the management target terminal and the risk countermeasures assigned to the management target terminal together. The security risk management apparatus according to claim 1, further comprising a storage unit that stores security risk management information including a determination formula. Instructing a managed terminal having a security risk to collect operation information, which is information indicating an operation status of the managed terminal,
Whether or not the service provided by the managed terminal is hindered when a risk countermeasure, which is a countermeasure against the security risk, is applied, and the collected operation information and a judgment formula corresponding to the collected operation information are used. Judgment
A security risk management method characterized by allocating a risk measure determined not to interfere with the service to the managed terminal. The security risk management method according to claim 7, wherein it is determined whether or not a security risk exists in the managed terminal. On the computer,
An instruction process for instructing a management target terminal having a security risk to collect operation information which is information indicating an operation status of the management target terminal;
Whether or not the service provided by the managed terminal is hindered when a risk countermeasure, which is a countermeasure against the security risk, is applied, and the collected operation information and a judgment formula corresponding to the collected operation information are used. And a security risk management program for executing an allocation process for allocating a risk countermeasure determined to not cause trouble in the service to the managed terminal. On the computer,
The security risk management program according to claim 9, wherein determination processing for determining whether or not a security risk exists in a managed terminal is executed.

Images