WO2015177832A1

WO2015177832A1 - Security measure determination assistance device and security measure determination assistance method

Info

Publication number: WO2015177832A1
Application number: PCT/JP2014/063158
Authority: WO
Inventors: 佑生子松原; 甲斐　賢; 千秋太田原
Original assignee: 株式会社日立製作所
Priority date: 2014-05-19
Filing date: 2014-05-19
Publication date: 2015-11-26

Abstract

The present invention enables one to propose security measures taking into account the availability of the subject to which these measures are applied. A security measure determination assistance device (100) is provided with a calculation device (104) which: compares a graphic region corresponding to security requirement information with a graphic region corresponding to measure information, wherein the graphic region corresponding to the security requirement information has side lengths, each corresponding to a security level, or the amount of time for which the security level should be maintained, indicated by the security requirement information, and wherein the graphic region corresponding to the measure information has side lengths, each corresponding to either a security level estimated to be attained by application of a security measure candidate indicated by security measure candidate information included in the measure information, or the amount of time for which the attained security level is maintained; determines the state in which the graphic region corresponding to the security requirement information is covered by the graphic region corresponding to the measure information; and generates evaluation results of the security measure candidate according to the determined coverage state and outputs the evaluation results to an output device.

Description

Security measure determination support apparatus and security measure determination support method

The present invention relates to a security measure determination support apparatus and a security measure determination support method.

While widespread use of network environments and progress in computer technology are rapidly progressing, various information security threats such as so-called spoofing, information leakage, and information falsification and the risks associated therewith are also increasing. Therefore, it is important to recognize such threats and risks and take appropriate security measures.

The following technologies have been proposed as support technologies for such information security measures. In other words, the state from the initial state to the time of occurrence of damage for the purpose of exhaustively analyzing information security risks and presenting countermeasures without requiring specialized knowledge of information security and IT systems A storage means is provided for storing a correspondence table of threats and assets indicating correspondence between threats that cause changes and asset attributes, and a correspondence table of threats and countermeasures indicating possible measures corresponding to each threat. A device that extracts threats corresponding to attribute information from attribute information such as types of components, operations, etc. in a diagnosis target system and a correspondence table of threats and assets, and outputs a countermeasure corresponding to the threat (Patent Literature) 1) is proposed.

JP 2009-110177 A

In the conventional assistive technology related to security measures, mainly the security measures are evaluated based on the minimization of the costs related to the introduction and operation of security measures and the suppression of residual risks and derivative risks associated with the implementation of security measures. It is intended to make a proposal.

However, there is a lack of philosophy to evaluate focusing on the availability of computer systems and their functions that are subject to security measures, and long recovery from easy outages and outages, as in systems such as medical, financial, and government agencies It is difficult to propose an appropriate security measure for a countermeasure object whose time is not acceptable.

Therefore, an object of the present invention is to provide a technology that makes it possible to propose a security measure in consideration of the availability of a countermeasure target.

In order to solve the above problems, for example, the configuration described in the claims is adopted. The present application includes a plurality of means for solving the above-described problems. To give an example, in the security countermeasure support apparatus, each of the threats that affect the security countermeasure target and the security countermeasure candidates that are assumed to be applied to the threat. A storage device for storing countermeasure information including information, and safety request information including each information related to a safety level on information security required for the security countermeasure target and a maintenance time of the corresponding safety level, and A figure area corresponding to each side length corresponding to each size of the safety level and the maintenance time of the corresponding safety level indicated by the safety requirement information, and the corresponding security countermeasure candidate indicated by the information of the security countermeasure candidate in the countermeasure information The length of each side in each size of the safety level assumed for the application and the maintenance time of the applicable safety level The corresponding graphic area is collated to determine the cover state of the graphic area corresponding to the safety requirement information by the graphic area corresponding to the countermeasure information, and the evaluation result of the corresponding security countermeasure candidate is determined according to the cover state. A computing device that generates and outputs to the output device;
It is characterized by providing.

In addition, the security measure determination support method of the present invention is required for the measure information including each information related to the threat that affects the security measure target and the potential security measure candidate to be applied to the threat, and the security measure target. A computer having a storage device for storing safety requirement information including information related to a safety level for information security and a maintenance time of the safety level, and the safety level and the safety indicated by the safety requirement information. The reachable safety level assumed for application of the corresponding security countermeasure candidate and the corresponding reached safety indicated by the graphic area in which each side length corresponds to each magnitude of the maintenance time of the level and the information of the security countermeasure candidate in the countermeasure information The graphic area corresponding to each side length corresponding to each level maintenance time is collated, Determining the cover state of the graphic area corresponding to the safety requirement information by the graphic area corresponding to the information, generating an evaluation result of the corresponding security countermeasure candidate according to the cover state, and executing a process to output to the output device; It is characterized by that.

According to the present invention, it is possible to propose a security measure in consideration of the availability of the countermeasure target.

It is a figure which shows the example of a network structure containing the security countermeasure determination assistance apparatus of this embodiment. It is a figure which shows the hardware structural example of the security countermeasure determination assistance apparatus in this embodiment. It is a figure which shows the example of the main flow of the security countermeasure determination support method in this embodiment. It is a figure which shows the example of the risk reference value table | surface of DFD in this embodiment. It is a figure which shows the example of the R_SL determination table in this embodiment. It is a figure which shows the example of the A_SL determination table in this embodiment. It is a figure which shows the example of the R_TP and A_TP determination table in this embodiment. It is a figure which shows the example of the R_TO and A_TO determination table in this embodiment. It is a figure which shows the example of the risk analysis table | surface in this embodiment. It is a figure which shows in the example of the countermeasure list | wrist in this embodiment. It is a figure which shows the detailed flow example 1 of the security countermeasure determination support method in this embodiment. It is a figure which shows the example of the countermeasure type table | surface in this embodiment. It is a figure which shows the example of the countermeasure list detailed table | surface in this embodiment. It is a figure which shows the example of the countermeasure group creation rule input screen in this embodiment. It is a figure which shows the detailed flow example 2 of the security countermeasure determination support method in this embodiment. It is a figure which shows the example of the countermeasure implementation type table | surface in this embodiment. It is a figure which shows the example of the countermeasure group evaluation table | surface in this embodiment. It is a figure which shows Example 1 of the DS diagram in this embodiment. It is a figure which shows Example 2 of the DS diagram in this embodiment. It is a figure which shows Example 3 of the DS figure in this embodiment. It is Example 4 of the DS figure in this embodiment. It is a figure which shows the example of the integrated DS diagram in this embodiment. It is a figure which shows Example 1 of the MS figure in this embodiment. It is a figure which shows Example 2 of the MS figure in this embodiment. It is a figure which shows Example 3 of the MS figure in this embodiment. It is a figure which shows Example 4 of the MS figure in this embodiment. It is a figure which shows Example 5 of the MS figure in this embodiment. It is a figure which shows Example 1 of the DMS figure in this embodiment. It is a figure which shows Example 2 of the DMS figure in this embodiment. It is a figure which shows Example 1 of MO area in this embodiment. It is a figure which shows Example 2 of the MO area in this embodiment. It is a figure which shows Example 1 of the EA area in this embodiment. It is a figure which shows Example 2 of the EA area in this embodiment. It is a figure which shows Example 1 of the countermeasure model proposal table creation rule input screen in this embodiment. It is a figure which shows Example 2 of the countermeasure model proposal table creation rule input screen in this embodiment. It is a figure which shows the detailed flow example 3 of the security countermeasure determination support method in this embodiment. It is a figure which shows the example of the countermeasure model proposal table | surface in this embodiment. It is a figure which shows the example of an output of the specification document in this embodiment.

--- Example of hardware configuration of security measure decision support device ---
Embodiments of the present invention will be described below in detail with reference to the drawings. FIG. 1 is a diagram illustrating an example of a network configuration including a security measure determination support apparatus 100 according to the present embodiment. A security countermeasure determination support apparatus 100 shown in FIG. 1 is a computer that enables a security countermeasure proposal considering availability in a security countermeasure target system. As illustrated in FIG. 1, the security measure determination support apparatus 100 according to the present embodiment includes a user terminal 200 used by a designer of a security measure target system and a user terminal 250 used by a security expert via a network 20. It is tied so that it can communicate. These security countermeasure determination support device 100 and

user terminals

200 and 250 can be defined as the security countermeasure determination support system 10.

In the present embodiment, as a security countermeasure target system, for example, a complicated and large-scale power supply system including a plurality of servers including information management servers, subsystems, meters, terminals, and the like is assumed. In the development of this power supply system, a security expert who received a request from the system designer described above performs risk analysis of the target system based on the DFD (data flow diagram, hereinafter referred to as DFD) in the target system, and security. A situation is assumed in which the security measure determination support device 100 of the present embodiment is used via the user terminal 250 as a support means for planning measures. Security specialists are not only requirements for system development, but also security for emergency measures prepared in advance to resume normal execution of business flow and system recovery immediately when a risk occurs during system operation. It is necessary to plan measures.

Further, a countermeasure group is defined as a combination of a plurality of security measures planned by the security expert using the security measure determination support apparatus 100 of the present embodiment on a predetermined scale based on a certain rule. In the present embodiment, this countermeasure group is evaluated, and a countermeasure model is obtained by combining the countermeasure groups on a larger scale (the entire system) based on the evaluation result.

In addition, the hardware configuration of the security measure determination support apparatus 100 described above is as follows. FIG. 2 is a diagram illustrating a hardware configuration example of the security measure determination support apparatus 100 according to the present embodiment. The security measure decision support device 100 is stored in the storage device 101, a storage device 101 composed of an appropriate non-volatile storage element such as an SSD (Solid State や Drive) or a hard disk drive, a memory 103 composed of a volatile storage element such as a RAM, and the storage device 101. The CPU 102 (arithmetic unit) that performs various determinations, computations, and control processes, and performs communication and control with the

user terminals

200 and 250 is performed by reading the program 102 to the memory 103 and executing the program 102 A communication device 107 that performs processing is provided. In addition to the above-described configuration, the security measure determination support device 100 may include an input device 105 such as a keyboard and a mouse that receives input from the user, and an output device 106 such as a display and a speaker that outputs processing results.

Note that the storage device 101 stores data 110 to 127 necessary for various processes in addition to the program 102 for implementing functions necessary for the security measure determination support device 100 of the present embodiment. Details of the data 110 to 127 will be described later.

Although not particularly illustrated, the

user terminals

200 and 250 have the same hardware configuration as a general computer and function as computer terminals.
--- Functional example of security measure decision support device ---
Next, functions provided in the security measure determination support device 100 of this embodiment will be described. As described above, the functions described below can be said to be implemented by executing the program 102 provided in the security measure determination support apparatus 100, for example.

As shown in the memory 103 in FIG. 2, the security measure determination support apparatus 100 includes a communication unit 171, a registration unit 172, a measure list creation unit 173, an input unit 174, a measure evaluation unit 175, a measure model creation unit 176, and specifications. Each function of the entry unit 177 is provided.

Among these, the communication unit 171 is a function of controlling the communication device 107 to access the network 20 and performing communication processing with external devices such as the

user terminals

200 and 250 according to the protocol of the network 20.

In addition, the registration unit 172 has a function of performing processing for registering data such as various tables and specifications acquired via the input device 105 or the communication device 107 in the storage area of the storage device 101. The countermeasure list creation unit 173 is a function that performs security countermeasure planning processing based on the risk analysis result regarding the countermeasure target system obtained from the user terminal 250 of the security expert, for example.

Further, the input unit 174 receives input of the above-described countermeasure group and countermeasure model creation rules from the input device 105 or the user terminal 250 via the communication device 107, and the accepted creation rules are stored in the memory 103 or the storage device. This is a function stored in 101.

Further, the measure evaluation unit 175 is a function for evaluating the security measures planned by the measure list creation unit 173. The measure evaluation unit 175 includes a graphic area in which each side length corresponds to each safety level and each maintenance time level of the safety level indicated by a DFD risk reference value table 111 (safety requirement information) described later, The safe level assumed for application of the corresponding security countermeasure candidate and the maintenance time of the corresponding reached safety level indicated by the information of the security countermeasure candidate for the corresponding DFD in the countermeasure list 115 and the countermeasure list detail table 116 (both countermeasure information) described later The figure area corresponding to each size of each side is compared with the figure area corresponding to each side length to determine the cover state of the figure area corresponding to the corresponding DFD by the figure area corresponding to the corresponding security countermeasure candidate. An evaluation result of the corresponding security countermeasure candidate is generated according to the state and output to the output device 106 or the user terminal 250. It has a function of.

Note that the measure evaluation unit 175 selects the side corresponding to the safety level maintenance time among the above-described graphic regions corresponding to the corresponding DFD, and the reached safety level among the above-described graphic regions corresponding to the security measure candidates for the corresponding DFD. A side corresponding to the maintenance time is arranged on a predetermined time axis, and the time zone covered by the graphic region corresponding to the corresponding security countermeasure candidate among the graphic regions corresponding to the above-mentioned DFD, and arrival in the time zone Information on the area defined by the safety level may be specified as the cover state.

In addition, the countermeasure evaluation unit 175 has an edge corresponding to the maintenance time of the safety level in the graphic area corresponding to the DFD described above, and an edge corresponding to the maintenance time of the reached safety level in the graphic area corresponding to the security countermeasure candidate for the DFD. On the predetermined time axis, and the above-described cover state is specified by placing the start point at the time when an allowable recovery time has elapsed since the operation stop of the security countermeasure target indicated by the risk reference value table 111 of the corresponding DFD It is good.

In addition, the countermeasure evaluation unit 175 has a side corresponding to the safety level maintenance time among the graphic areas corresponding to the DFD described above, and a reaching safety level among the plurality of graphic areas corresponding to the security countermeasure candidates for the DFD. An edge corresponding to the maintenance time is arranged on a predetermined time axis, and among the graphic areas corresponding to the DFD described above, a time zone covered by a plurality of graphic areas corresponding to security countermeasure candidates for the DFD, and Information on an area defined by the overlap of reachable safety levels indicated by the plurality of graphic areas in the time zone may be specified as the cover state.

Further, in the storage device 101, information on security countermeasure candidates for the above-mentioned DFD is applied when development of a system that is a security countermeasure target and is constantly operated, and when a risk occurs during system operation. In the case of storing each information of emergency measures for the purpose of function recovery, the above-mentioned countermeasure evaluation unit 175 has a side corresponding to the maintenance time of the safety level in the graphic area corresponding to the above-mentioned DFD. And, the side corresponding to the maintenance time of the arrival safety level is arranged on a predetermined time axis among the graphic areas corresponding to the countermeasure information of at least one of the countermeasure for development and the countermeasure for first aid described above, Of the graphic area corresponding to DFD, the time covered by the graphic area corresponding to the countermeasure information of at least one of the countermeasures for development and first aid When, it may identify the information of the area defined by the reach safe level in the time zone as a cover state.

The countermeasure model creation unit 176 is a function for creating a countermeasure model based on the evaluation result of the security countermeasures by the countermeasure evaluation unit 175. The countermeasure model creation unit 176 functions as a security countermeasure from the input terminal 106 or from the user terminal 250 via the network 20. The above-mentioned security countermeasure candidates are identified as the evaluation results corresponding to the conditions indicated by the user request, the countermeasure model is generated from the identified security countermeasure candidates, and the countermeasure model is output This is a function for outputting to the user terminal 250 via the device 106 or the network 20.

Note that the above-described countermeasure model creation unit 176 identifies security countermeasure candidates in order of the degree of correspondence of the evaluation results to the conditions indicated by the above-described user request, and uses the security countermeasure models in order of the degree of correspondence to the conditions of the user request. May be sequentially generated, and each countermeasure model may be output to the output terminal 106 or the user terminal 250 via the network 20.

In addition, the specification entry unit 177 automatically inserts the requirement definition of the countermeasure list, which is designated to be adopted from the input device 105 or the user terminal 250, into the corresponding portion of the specification file 127 stored in the storage device 101 in advance. This is a function to generate a document.

The security measure determination support apparatus 100 having these functions 171 to 177 evaluates security measures based on information received from the system designer and security specialist, formulates and presents a measure model, and adopts a measure model to be adopted. A device that automatically inserts requirement definitions into specifications and outputs them.
--- Main flow example ---
Hereinafter, the actual procedure of the security measure determination support method in the present embodiment will be described with reference to the drawings. Various operations corresponding to the security countermeasure determination support method described below are realized by a program 102 that the security countermeasure determination support apparatus 100 reads into the memory 103 and executes. And this program 102 is comprised from the code | cord | chord for performing the various operation | movement demonstrated below.

FIG. 3 is a diagram showing an example of the main flow of the security measure determination support method in the present embodiment. In this flow, not only the processing of the security countermeasure determination support apparatus 100 but also the processing in the

user terminals

200 and 250 that give information to the security countermeasure determination support apparatus 100 is also shown.

In this case, first, the user terminal 200 of the system designer has the DFD 110, the R_SL determination table 119, the R_TP, A_TP determination table 121, the R_TO, A_TO determination table 122, the DFD risk reference value table 111, the system cooperation WBS 123, the application development WBS 124, Are transmitted and registered to the security measure decision support apparatus 100 in accordance with an instruction from the system designer (S3401).

On the other hand, the communication unit 171 of the security measure determination support device 100 receives each of the above-mentioned data transmitted from the above-described user terminal 200, passes it to the registration unit 172, and the registration unit 172 stores it in the storage device 101 ( S3402).

Here, the terms used in this embodiment and the evaluation policy for security measures will be described. In this embodiment, a security measure is evaluated by defining the concept (numerical index) of “measure strength”. This countermeasure strength is expressed by the following two values.

MO: The strength of the ability to maintain system operation (execution of business flow) in a certain security measure.

EA: The strength of a security measure that can withstand external attacks and execute business flows normally.

In addition, the following values are used for the above-mentioned MO and EA calculations.

R_SL: A safety level that a business flow corresponding to a certain DFD should satisfy during normal operation.

R_TP: Time allowed for temporary suspension of the business flow corresponding to a certain DFD.

R_TO: Minimum operating time required for the business flow corresponding to a certain DFD.

A_SL: A safety level at which a business flow can be reached by implementing certain security measures.

A_TP: Time required to prepare for implementation of a certain security measure.

A_TO: The duration of the effect of a certain security measure.

The above-mentioned R_SL, R_TP, and R_TO are values that are determined by reflecting the intention of the system designer, and A_SL, A_TP, and A_TO are assigned by security experts from an objective standpoint with respect to the security measures that they have planned. It is the value to hit. In this embodiment, R_SL and A_SL are represented by integer values from “0” to “7”, and R_TP, R_TO, A_TP, and A_TO are represented by integer values from “1” to “10”. Hereinafter, R_SL, R_TP, and R_TO are referred to as risk reference values, and A_SL, A_TP, and A_TO are referred to as countermeasure reference values. The risk reference value is a value given to the information of the DFD 110 registered in the security measure determination support apparatus 100 by the system designer.

Also, the system cooperation WBS and application development WBS are created in the process of system security design, and are the predecessor of the overall development WBS and development policy definition document included in the final system design requirement definition group.

Further, as illustrated in FIG. 4, the risk reference value R_SL, R_TP, and R_TO values associated with the ID (DFD_ID) of the corresponding DFD 110 are associated with the DFD risk reference value table 111 described above. It is a collection of records. Each risk reference value stored in the risk reference value table 111 is determined by the system designer's user terminal 200 using the determination tables shown in FIGS. 5, 7, and 8.

FIG. 5 is a diagram illustrating a configuration example of the R_SL determination table 119 in the present embodiment. The value of R_SL in the present embodiment is determined by the user terminal 200 with reference to this R_SL determination table 119. The R_SL determination table 119 is created mainly by the system designer, but may be created by a security expert or other related parties in consultation with the system designer. The user terminal 200 determines the value of R_SL as R_SL based on the result of prediction of the impact when the business flow corresponding to the DFD 100 is stopped or abnormally operated (specified by the system designer), for example, “injuring human life / body”. Table 119 is collated, and the corresponding R_SL value “7” is determined. Of course, the system designer may input the value of R_SL with the input device of the user terminal 200.

FIG. 6 is an example of the A_SL determination table 120 in the present embodiment. In the present embodiment, the security expert user terminal 250 refers to the A_SL determination table 120 to determine the value of A_SL. The A_SL determination table 120 is created mainly by a security expert, but may be created in consultation with a system designer or other related parties.

The user terminal 250 determines the above-described value of A_SL by dividing it into levels according to the degree of recovery of the normal state after implementation of security measures, for example. For example, for the risk that the encryption parameters of encrypted communication will be leaked, if the communication can be resumed as before by tracking and reinforcing the leaked route and changing the encryption parameters, the degree of recovery is 100%, In addition, when using a password encryption means different from the conventional algorithm and taking a temporary measure such as sending the password by another route immediately after message transmission, the degree of recovery is 50%. In some cases, it is necessary to form consensus between the parties regarding the definition of the degree of recovery. The user terminal 250 receives a designation of the degree of recovery after the implementation of the corresponding security measure from the system designer, collates this degree of recovery with the A_SL determination table 120, and determines the value of the corresponding A_SL.

FIG. 7 is a diagram illustrating a configuration example of the R_TP and A_TP determination table 121 in the present embodiment. In this embodiment, each value of R_TP and A_TP is determined by the system designer's user terminal 200 with reference to the R_TP and A_TP determination table 121. The R_TP and A_TP determination table 121 is created mainly by the system designer, but may be created by a security specialist or other related parties in consultation with the system designer. The user terminal 200 collates the R_TP, A_TP determination table 121 with information on the time specified by the system designer, for example, the time allowed for temporary suspension of the business flow or the time required for preparation of countermeasures, and the corresponding R_TP, Determine the value of A_TP.

FIG. 8 is a diagram illustrating a configuration example of the R_TO and A_TO determination table 122 in the present embodiment. In the present embodiment, the values of R_TO and A_TO are determined by the system designer's user terminal 200 with reference to the R_TO and A_TO determination table 122. The R_TO and A_TO decision table 122 is created mainly by the system designer, but may be created by a security expert or other related parties in consultation with the system designer. The user terminal 200 collates, for example, the minimum operating time required for the business flow or the effective duration of the countermeasure specified by the system designer against the R_TO, A_TO determination table 122, and sets the corresponding R_TO, A_TO values. decide.

In addition, the setting of A_TP and A_TO shall depend on the technical difficulty of countermeasures, the number of approved / known people, environmental facilities, etc.

Returning to the explanation of the main flow in FIG. Subsequent to step S3402, the communication unit 171 of the security measure determination support apparatus 100 relates to the above-described data acquired in step S3401 and stored in the storage device 101 in step S3402 for the security expert user terminal 250. An arrival notification is transmitted (S3403). The security countermeasure determination support apparatus 100, in response to the transmission of the arrival notification, causes the user terminals for the DFD 110, the R_SL determination table 119, the R_TP, A_TP determination table 121, the R_TO, A_TO determination table 122, and the DFD risk reference value table 111. Browsing from 250 is possible. For example, the security measure determination support device 100 notifies the user terminal 250 of a URL indicating the storage location of the corresponding data in the storage device 101. Alternatively, the user terminal 250 is notified of a password for accessing the data storage location.

On the other hand, the security expert operates the user terminal 250 to provide the above-described information presented by the security countermeasure determination support apparatus 100, that is, the DFD 110, the R_SL determination table 119, the R_TP, A_TP determination table 121, the R_TO, A_TO determination table 122, Each information in the DFD risk reference value table 111 is browsed, and risk analysis work is performed based on the information. The user terminal 250 provides such a general function for risk analysis to the security expert, and generates the risk analysis table 114 (S3404). Thereafter, the security expert described above uses the countermeasure list table 115 in the user terminal 250. A countermeasure reference value determination work is executed together with the creation work. The user terminal 250 acquires the countermeasure list table 115 thus created and the countermeasure reference value information (S3405).

Further, the user terminal 250 transmits the above-described risk analysis table 114, countermeasure list table 115, A_SL determination table 120 (previously held by the user terminal 250), and countermeasure reference values to the security countermeasure determination support apparatus 100 for registration (S3406). ).

On the other hand, the communication unit 171 of the security measure determination support apparatus 100 receives the risk analysis table 114, the measure list table 115, the A_SL determination table 120, and the measure reference value transmitted from the user 250, and stores them in the registration unit 172. Then, the registration unit 172 stores the information in the storage device 101 (S3407).

As illustrated in FIG. 9, the risk analysis table 114 described above includes a DFD (hereinafter, referred to as “risk” extracted at the time of risk analysis, a risk content and a required response level, and a business flow causing the risk occurrence). It is a table including at least each data of information of target DFD, information asset (protection target asset) that causes risk in target DFD, threat analysis, vulnerability analysis, and risk evaluation result.

The above-mentioned required response level is a priority for preventing risk occurrence, and is a value determined by a security expert while consulting with the requester (system designer, etc.) as necessary. In the column of threat analysis, analysis results are compiled for each type of threat and the location (device, area, etc.) where the threat occurred, and information on information assets targeted by the threat is always included.

Note that the target information asset (threat) is extracted from the protection target assets in the target DFD information column. In the vulnerability analysis column, the results are summarized for each location where the vulnerability exists. In the risk evaluation column, the results are summarized for each location where the risk exists, and each information of the risk level and the risk case ID is always included.

The risk cases described above are, for example, “risk generation agents and abusers such as“ an outsider who has entered the information management center exploits the vulnerability of administrator authority settings and alters the device ID ”. This is a risk occurrence situation that clarifies vulnerabilities, occurrence locations, threats, etc. Risk assessment is performed for each risk case. The risk level is the degree of influence of the risk case determined based on the results of threat analysis and vulnerability analysis.

Further, as illustrated in FIG. 10, the above-described countermeasure list 115 is a list in which risk cases extracted in risk analysis are grouped for each risk occurrence location and threat, each countermeasure is listed, and an ID (measure ID) is given. It is. In the countermeasure list 115, a plurality of countermeasures may be listed for each risk case. In addition, if the location or threat of the risk is different, it is possible to repeatedly describe the countermeasures already mentioned. However, in this case, the same countermeasure ID is assigned. In the example of FIG. 10, the security countermeasure with the ID “S003” is repeatedly described in two categories where the risk occurrence location is “information management server” and the threat is “spoofing” and “tampering”.

In addition, “information assets subject to threat” and “target DFD” in the risk column in the countermeasure list 115 are “target information assets (multiple)” → “protection” in the risk analysis table 114 (FIG. 9), respectively. It can be created by following “target asset” → “DFD_ID”. For the listed measures, the contents and types of measures are also described. The types of countermeasures are categorized according to whether they belong to functional countermeasures, operational countermeasures, or physical environmental countermeasures, and fall into risk prevention, risk detection, risk reduction, and business recovery. Is described. In addition, in the item of type, in addition to functions, operations, physical environmental measures, for example, administrative measures, facility measures, and the like may be used. In addition to prevention, detection, reduction, and recovery, the subordinate items may be, for example, risk avoidance, separation, concentration (combination), and transfer.

Returning to the explanation of the main flow in FIG. Subsequent to step S3407 described above, the countermeasure list creation unit 173 of the security countermeasure determination support apparatus 100 performs the risk analysis table 114, the countermeasure list table 115, the A_SL determination table 120, the countermeasure reference value, and the original information obtained from the user terminal 250. By referring to the countermeasure type table 112 stored in its own storage device 101, the countermeasure list detail table 116 is created and stored in the storage device 101 (S3408).

Hereinafter, the creation processing of the above-described countermeasure list detail table 116, that is, details of step S3408 will be described. FIG. 11 is a diagram showing a detailed flow example 1 of the security measure determination support method in the present embodiment.

In this case, the countermeasure list creation unit 173 of the security countermeasure determination support apparatus 100 refers to the risk reference value table 111 of the DFD, and sets the risk reference value of the target DFD that is described for each threat at the risk occurrence location in the countermeasure list 115. Among them, the maximum R_SL, the minimum R_TP, and the maximum R_TO are set in the countermeasure list detail table 116 as risk reference values of the integrated DS diagram (S3501). Although details will be described later, this integrated DS diagram is created by adopting the maximum R_SL, minimum R_TP, and maximum R_TO of each business flow when there are multiple business flows that are subject to security measures. FIG. In addition, the DS diagram shows the dangerous state when security measures are not implemented for the business flow that is subject to certain security measures, the vertical axis indicates the safety level (SL) of the target system, and the horizontal axis indicates It is the figure represented by the rectangular area | region of R_SLx (R_TP + R_TO) as time.

Next, the countermeasure list creation unit 173 of the security countermeasure determination support apparatus 100 refers to the corresponding threat R_SL (determined in S3501) for each countermeasure ID in the countermeasure list 115, and sets the value of this R_SL in the countermeasure reference value column. Is applied to the A_SL calculation formula (R_SL × 1.0 in the example of FIG. 13), and the A_SL value of each countermeasure ID in the target reference value column of the countermeasure list detail table 116 is calculated (S3502).

Subsequently, as described above, the countermeasure list creation unit 173 of the security countermeasure determination support apparatus 100, for each countermeasure ID in the target reference value column of the countermeasure list detail table 116, the A_SL obtained in step S3502, and the storage device 101. Each value of A_TP and A_TO quoted from the countermeasure reference values (acquired from the user terminal 250) stored in is set (S3503).

Further, the countermeasure list creation unit 173 of the security countermeasure determination support apparatus 100 refers to the countermeasure type table 112 for each of the countermeasure IDs described above, compares the risk reference value and the countermeasure reference value of the integrated DS diagram, and measures the countermeasure type. This countermeasure type and use are set in the corresponding column in the countermeasure column of the countermeasure list detail table 116 (S3504).

Note that, as illustrated in FIG. 12, the above-described countermeasure type table 112 shows the security countermeasures shown in the countermeasure list 115 (FIG. 10) as predetermined types (from the viewpoint of safety, implementation speed, and sustainability). In the example of FIG. 12, the table is classified into 8 types (M1 to M8). In the countermeasure type table 112, “development” and “emergency” are also designated as security countermeasure applications for each of the types described above.

Returning to the explanation of the main flow in FIG. Subsequent to step S3408 described above, the communication unit 171 of the security measure determination support apparatus 100 transmits a notification of completion of creation of the measure list detail table 116 to the user terminal 200 of the system designer, and the measure list is transmitted from the user terminal 200. The detailed table 116 can be browsed (S3409). This technique for enabling browsing is the same as that performed in accordance with the execution of step S3403 described above.

FIG. 13 shows an example of the countermeasure list detail table 116 created by the security countermeasure determination support apparatus 100 and made available for browsing by the user terminal 200. The countermeasure list detail table 116 according to the present embodiment includes a risk reference value (a maximum value of R_SL, a minimum value of R_TP, a minimum value of R_TO in the target DFD) of an integrated DS diagram corresponding to a risk occurrence location and a threat classification. It is a maximum value, and is a table including each value of the countermeasure reference value for each countermeasure ID, the type, and the usage, obtained from the DFD risk reference value table 111 (FIG. 4). The countermeasure type determination method will be described later in the description of FIG.

On the other hand, the system designer operates the user terminal 200, browses the above-described countermeasure list detail table 116, determines a countermeasure group creation rule, and performs an input operation with the input device. In this case, the user terminal 200 accepts the input of the countermeasure group creation rule by the system designer described above via the countermeasure group creation rule input screen 1000 provided from the input unit 174 of the security countermeasure determination support apparatus 100. This is transmitted to the security measure decision support apparatus 100 (S3410).

FIG. 14 shows an example of the countermeasure group creation rule input screen 100 in this embodiment. In the present embodiment, a plurality of countermeasures in the countermeasure list 115 (FIG. 10) are combined based on a certain rule to form a countermeasure group. This rule is specified by the operator of the security measure decision support apparatus 100 (for example, a system designer or a security expert who accesses via the user terminal) from the measure group creation rule input screen 1000.

In the present embodiment, on the screen 1000, as rule items for creating a countermeasure group, the number of basic elements serving as a basic value of the number of countermeasure combinations, the minimum unit of countermeasure group application target categories (range for selecting individual countermeasures to be combined) Each setting of the selection condition of the countermeasure type and the presence / absence of the countermeasure selection (duplicate selection) from the same range is accepted. In addition to the above, the rule item may be variously set depending on the case, for example, only measures against a specific risk ID are targeted.

On the other hand, the measure evaluation unit 175 of the security measure decision support device 100 that has received the input of the measure group creation rule via the measure group creation rule input screen 100 described above saves it in the measure list detail table 116 and its own storage device 101. Referring to the countermeasure implementation type table 113, the countermeasure group evaluation table 117 (FIG. 17) is created and stored in the storage device 101 (S3411).

Details of the processing for creating the countermeasure group evaluation table 117 will be described below. FIG. 15 is a diagram illustrating a detailed flow example 2 of the security measure determination support method according to the present embodiment. In this case, the countermeasure evaluation unit 175 of the security countermeasure determination support apparatus 100 creates a plurality of countermeasure groups and countermeasure group IDs for each risk occurrence location and threat category according to the above-described countermeasure group creation rules, that is, under the corresponding rules. All possible combinations of countermeasures are listed and set in the countermeasure group evaluation table 117 (FIG. 17) together with the implementation type and use of each countermeasure (S3601).

The above-described implementation type is specified based on the countermeasure implementation type table 113 illustrated in FIG. The measure implementation type table 113 in the present embodiment defines these embodiments for measures classified as the measure type table 112 (FIG. 12). In the countermeasure implementation type table 113 illustrated in FIG. 16, in addition to the eight countermeasure types shown in the countermeasure type table 112 (FIG. 12) as they are in the embodiment, the validity period of M2, M4, M6, and M8 is limited. By adopting an iterative embodiment in which the same countermeasure is implemented once again after it has expired, a total of 11 implementation types are described in a configuration that newly defines three types with “○” as the determination of sustainability. Yes. Regarding the three types of newly defined applications. From the viewpoint that it is unlikely that repeated use of countermeasures within the R_TO deadline will be assumed at the time of development, only “emergency use” is set.

Further, the countermeasure evaluation unit 175 of the security countermeasure determination support apparatus 100 calculates the MO value for each countermeasure group and sets it as the value in the MO column in the evaluation column of the countermeasure group evaluation table 117 (S3602). Further, the countermeasure evaluation unit 175 of the security countermeasure determination support device 100 obtains the standard deviation of the MO value corresponding to the countermeasure group ID in the category for each threat at the risk occurrence location, and evaluates the countermeasure group evaluation table 117. It is set as the standard deviation value of the MO column in the column (S3603).

Further, the countermeasure evaluation unit 175 of the security countermeasure determination support apparatus 100 calculates an EA value for each countermeasure group and sets it as the value of the EA column in the evaluation column of the countermeasure group evaluation table 117 (S3604). Further, the countermeasure evaluation unit 175 of the security countermeasure determination support apparatus 100 obtains the standard deviation of the EA value corresponding to the ID of the countermeasure group in the category for each threat at the risk occurrence location, and evaluates the countermeasure group evaluation table 117. This is set as the standard deviation value of the EA column in the column (S3605).

Here, the calculation policy of the MO value and the EA value using the risk reference value and the countermeasure reference value will be specifically described. In the present embodiment, for a business flow that is subject to implementation of a certain security measure, a dangerous state when the measure is not taken is represented by R_SL × (R_TP + R_TO), where the vertical axis represents the system safety level (SL) and the horizontal axis represents time. ) And is referred to as a DS diagram. FIG. 18 is an example of a DS diagram 1800 of a business flow in which R_SL = 6, R_TP = 3, and R_TO = 8. In the present embodiment, the DFD information obtained from the system designer's user terminal 200 includes the values of R_SL, R_TP, and R_TO of the business flow supported by each DFD.

Therefore, the security measure determination support apparatus 100 determines that the R_TP time has elapsed from the origin on the time axis based on the above R_SL, R_TP, and R_TO values obtained from the user terminal 200 (in FIG. 18, “3” time The position of R_TO is set as the start point of R_TO, and the R_SL level (in FIG. 18, in the duration of this R_TO (in FIG. 18, the time period of 8 hours extending from “3” time to “11” time) A rectangular area 500 associated with level “6”) is generated.

The above-described rectangular area 500 can be specified by the coordinates of the position of each vertex 505 of the rectangular area 500 on the coordinate space 503 defined by the time axis 501 and the safety level axis 502. In the example of the rectangular area 500 in FIG. 18, when the vertex corresponding to the safety level “0” is viewed clockwise from the end point of R_TP (“3” time), the coordinates of the position of each vertex (time , Safety level), (3, 0), (3, 6), (11, 6), and (11, 0) are obtained. Therefore, the security measure decision support apparatus 100 stores the above-described set of values of the position coordinates of each vertex 505 in the memory 103 or the storage device 101 as information indicating the rectangular area 500 (graphic area) corresponding to each DS diagram. It shall be.

If there are multiple business flows to be subjected to security measures, the DS diagram is created by adopting the maximum R_SL, the minimum R_TP, and the maximum R_TO of each business flow. This is also referred to as an integrated DS diagram 2200. 19 is an example of a DS diagram 1900 of a business flow with R_SL = 2, R_TP = 4, and R_TO = 8. FIG. 20 is an example of a DS diagram 2000 of a business flow with R_SL = 3, R_TP = 3, and R_TO = 7. FIG. 21 shows an example of a DS diagram 2100 of a business flow in which R_SL = 5, R_TP = 5, and R_TO = 6, and FIG. 22 shows an example of an integrated DS diagram 2200 of these business flows. In the integrated DS diagram 2200 of FIG. 22, R_SL = 5, R_TP = 3, and R_TO = 8.

In this embodiment, the degree of safety when security measures are implemented in the business flow to be taken as a countermeasure, the time is 0 (system stop time), with the vertical axis representing the system safety level (SL) and the horizontal axis representing time. This is represented by a rectangular area 600 of A_SL × T_TO starting from the time point when A_TP has elapsed from the time point, and this is called an MS diagram. FIG. 23 is an example of MS diagram 2300 for countermeasures in which A_SL = 7, A_TP = 2, and A_TO = 10. In this embodiment, when a security expert plans measures after risk analysis, the calculation formula of A_SL and the values of A_TP and A_TO are simultaneously given. The security measure determination support apparatus 100 creates an MS diagram based on the calculation formula of A_SL and the values of A_TP and A_TO given from the user terminal 250. Note that the value of A_SL depends on the value of R_SL of the business flow to be subjected to security countermeasures (described in the description of FIG. 13).

The security measure determination support apparatus 100 calculates the value of A_SL by applying the value of R_SL of the business flow to the above-described calculation formula of A_SL obtained from the user terminal 250, and each value of the A_SL, A_TP, and A_TO Based on the time point 601 on the time axis 601 and the time point A_TP time has passed (the position of time “2” in FIG. 23) is set as the start time point of A_TO, and the duration of A_TO (in FIG. 23, “2 A rectangular area 600 in which the level of A_SL (level “7” in FIG. 23) is associated with “10 hours from“ time ”to“ 12 ”hours) is generated.

The above-described rectangular area 600 can be specified by the coordinates of the position of each vertex 605 of the rectangular area 600 on the coordinate space 603 defined by the time axis 601 and the safety level axis 602. In the example of the rectangular region 600 in FIG. 23, when the vertex corresponding to the safety level “0” is viewed clockwise from the end point of A_TP (“2” time), the coordinates of the position of each vertex (time , Safety level), (2, 0), (2, 7), (12, 7), and (12, 0) are obtained.

Therefore, the security measure determination support apparatus 100 stores the set of the coordinates of the position of each vertex 605 described above in the memory 103 or the storage apparatus 101 as information indicating the rectangular area 600 (graphic area) corresponding to each MS diagram. It shall be.

FIG. 24 shows an example of an MS diagram 2400 for countermeasures for A_SL = 1, A_TP = 1, and A_TO = 11. FIG. 25 shows an example of an MS diagram 2500 for countermeasures for A_SL = 3, A_TP = 2, and A_TO = 7. FIG. 26 shows an example of a countermeasure MS in which A_SL = 5, A_TP = 5, and A_TO = 5, and FIG. 27 shows an example of a countermeasure MS in FIG. 2700 in which A_SL = 5, A_TP = 3, and A_TO = 9. In both cases, the value of A_SL is the case where a countermeasure is applied to the business flow that is the creation source of the integrated DS diagram 2200 of FIG.

Here, the concept of development and emergency security measures in this embodiment will be described. In this embodiment, the safety and sustainability expected after implementing security measures exceed the safety level to be met during normal operation of the business flow to which the security measures are applied and the required minimum operating time. The security measures for development are used. That is, in the superimposition of the integrated DS diagram 2200 of business flows to which security measures are applied and the MS diagram, security measures satisfying A_SL ≧ R-SL and A_TO ≧ R-TO are set as security measures for development. In addition, security measures that do not satisfy this requirement are used as emergency security measures. However, security measures for development can also be used for emergency use. When the integrated DS diagram 2200 of the work flow to which the security measures are applied is shown in FIG. 22, the security measures shown in the MS diagrams 2400, 2500, and 2600 in FIGS. 24, 25, and 26 are emergency, and FIG. The security measure shown in the MS diagram 2700 is for development.

In this embodiment, an evaluation is made on a countermeasure group in which a plurality of security countermeasures are arbitrarily combined. In this case, the security countermeasure determination support apparatus 100 includes an MS diagram of each countermeasure that is an element of the countermeasure group. , A diagram obtained by superimposing a DS diagram or an integrated DS diagram of a target business flow is used. This figure is called a DMS diagram.

When creating this DMS diagram, the security measure decision support apparatus 100, when all the elements of the measure group are emergency measures, displays the MS diagram of each measure and the DS diagram or the integrated DS diagram of the business flow to be applied. Overlay as it is. In this superposition process, the values of the coordinates of the positions of the vertices held for the MS diagram, DS diagram, or integrated DS diagram are read from the memory 103 or the storage device 101, and the rectangular region 500 of the DS diagram or integrated DS diagram is read. Then, a rectangular area 600 of the MS diagram is generated, and processing for superimposing the

rectangular areas

500 and 600 on the time axis 701 is performed. The generation and superimposition processing of the

rectangular areas

500 and 600 may be performed using an existing drawing program. The result of the drawing process may be displayed on the output device 106, the

user terminals

200, 250, and the like.

On the other hand, when one or more countermeasures for development are included in the elements of the countermeasure group, the security countermeasure determination support apparatus 100 uses the time axis 701 for the MS diagram of each countermeasure and the DS diagram or the integrated DS diagram of the business flow to be applied. The above overlay process is performed in a state where the start times of R_TO and A_TO are combined.

FIG. 28 is an example of the DMS diagram 2800 in the case where a countermeasure is applied to the business flow from which the countermeasure group having elements of FIG. 24, FIG. 25, and FIG. FIG. 29 is an example of the DMS diagram 2900 in the case where a countermeasure is applied to the business flow from which the countermeasure group having elements of FIG. 24, FIG. 25, and FIG. .

On the other hand, when calculating the MO value, the security measure determination support apparatus 100 calculates the area occupied by the A_SL × A_TO portion of the applied MS diagram within the range of R_SL × R_TO of the applied DS diagram in the above DMS diagram. Hereinafter, this is referred to as an MO area. In calculating the MO area, within the coordinate range of the rectangular region 500 (DS diagram) (the coordinate range of the area closed by the four vertices 505), the coordinate range of each of one or more rectangular regions 600 (DS diagram) (each A location where the coordinate range of the area closed by the vertex 605 matches is specified, and the area of the region connecting the vertex coordinates of the corresponding location is calculated. An existing algorithm may be adopted as the method for calculating the area of the polygon closed at the vertex.

FIG. 30 is an example of a diagram showing a corresponding portion 700 of the MO area in the DMS diagram 2800 of FIG. FIG. 31 is an example of a diagram showing a corresponding portion 700 of the MO area in the DMS diagram 2900 of FIG. The MO value is calculated based on this MO area.

On the other hand, when calculating the EA value, the security measure determination support apparatus 100, when all the elements of the measure group are emergency measures, within the range of R_SL × (R_TP × R_TO) of the applied DS diagram in the above DMS diagram. To calculate the total area occupied by the A_SL × (A_TP × A_TO) portion of each applicable MS diagram. Alternatively, when one or more countermeasures for development are included in the elements of the countermeasure group, the security countermeasure determination support apparatus 100 uses the A_SL × of each applied MS diagram within the range of R_SL × R_TO of the applied DS diagram in the above DMS diagram. Calculate the total area occupied by the A_TO part. Hereinafter, this is called an EA area.

FIG. 32 is an example of a diagram showing a corresponding portion 800 of the EA area in the DMS diagram 2800 of FIG. FIG. 33 is an example of a diagram showing a corresponding portion 800 of the EA area in the DMS diagram 2900 of FIG. The EA value is calculated based on this EA area.

For example, the countermeasure group elements whose countermeasure group ID is “MSx” in the countermeasure group evaluation table 117 of FIG. 17 are the MS diagrams of FIGS. 26, 25 and 24, the MO area of FIG. 30, and the EA area of FIG. Similarly, MO is “32” and EA is “10 + 21 + 25” = 56. Further, the countermeasure group element having the countermeasure group ID “MSy” is shown in the MS diagrams in FIGS. 27, 25 and 24, the MO area is the same as FIG. 31, the EA area is the same as FIG. 33, and the MO is “40”. EA is “48 + 21 + 40” = 69. However, since the countermeasure group element “MSy” is a security measure for development and the EA value is known to be the same value as R_SL × R_TO in the integrated DS diagram of the applied business flow, the countermeasure group evaluation table 117 includes Not set.

Here, in the DMS diagram, the function of the safety level of the applied DS diagram within the R_TP time and the function of the safety level of the applied MS diagram outside the R_TP time are f (x), and the function of the safety level of the applied MS diagram is g (x). (Where x is time)
The formula for calculating the EA value for development is

The formula for calculating the MO value for emergency use is

The formula for calculating the MO value for development is

Can be expressed.

Calculating the EA value has the effect of quantifying the degree of risk coverage that can be realized by the implementation of the countermeasure group, and obtaining the MO value has the effect of quantifying the robustness of the countermeasure of the countermeasure group. In addition, obtaining each standard deviation has an effect that it is possible to give the countermeasure group superiority by the magnitude of the EA value and the MO value.

Returning to the explanation of the main flow in FIG. Subsequent to step S3411 described above, the communication unit 171 of the security measure determination support apparatus 100 transmits a measure evaluation completion notification to the user terminal 200 of the system designer, and the risk analysis table 114, the measure list 115, and the measure list details. The table 116 can be browsed (S3412). This technique for enabling browsing is the same as that performed in accordance with the execution of steps S3403 and S3409 described above.

FIG. 17 shows an example of the countermeasure group evaluation table 117 that can be viewed on the user terminal 200 in this way. The countermeasure group evaluation table 117 according to the present embodiment includes a plurality of countermeasure groups created for each risk occurrence location and threat category according to the rules input from the countermeasure group creation rule input screen 1000 (FIG. 14), and the evaluation groups. Each column is provided. Each countermeasure group is associated with the countermeasure ID of the combined countermeasure, the implementation type, the usage, the MO value and the EA value, and each standard deviation value within the category using the countermeasure group ID as a key.

On the other hand, the system designer determines the countermeasure model proposal table creation rule from the design policy or the like, and inputs it with the input device of the user terminal 250. In this case, the user terminal 250 receives the input of the above-described countermeasure model proposal table creation rule via the countermeasure model proposal table creation rule input screen 1100 obtained from the input unit 174 of the security countermeasure decision support device 100, It transmits to the countermeasure determination support apparatus 100 (S3413).

34 and 35 show specific examples of the countermeasure model proposal table creation rule input screen 1100. FIG. FIG. 34 shows an example of an input screen 1100 for proposing a countermeasure model for development, and FIG. 35 shows an example of an input screen 1100 for proposing an emergency countermeasure model. In the present embodiment, a plurality of countermeasure groups described in the countermeasure group evaluation table 117 (FIG. 17) are combined based on a certain rule to form a countermeasure model. This rule input is accepted, but the input screen is the countermeasure model proposal table creation rule input screen 1100.

In the countermeasure model proposal table creation rule input screen 1100 in the present embodiment illustrated in FIGS. 34 and 35, the “use” column for designating the countermeasure model as a rule item for development or emergency, MO area or EA Each field includes “priority measures to be prioritized” and “suggested options” for selecting which area to focus on. Among these, the “proposed option” column is a column for setting additional conditions such as “there is little risk that cannot be covered” and “the time until R_SL is achieved”. Note that such rule items are not limited to the above-described example, and may be variously set according to the case, for example, the number of elements of the countermeasure model is small.

Following the above-described step S3413 in the flow of FIG. 3, the countermeasure model creation unit 176 of the security countermeasure determination support apparatus 100 follows the countermeasure model proposal table creation rule (obtained in the above-described step S3413) and measures group evaluation table The countermeasure model proposal table 118 is created by determining the priority order of the risk occurrence locations and threat categories in 117 in descending order of the standard deviation of the EA value and the MO value (S3414).

The procedure for creating the countermeasure model proposal table 118 will be described more specifically. FIG. 36 is a diagram illustrating a detailed flow example 3 of the security measure determination support method according to the present embodiment. In this case, the countermeasure model creation unit 176 of the security countermeasure determination support apparatus 100 sets the MO value in the classification for each countermeasure group ID for each classification of the threat at the risk occurrence location in the countermeasure group evaluation table 117 (FIG. 17). Numbering is performed in order of increasing standard deviation as 1, 2,... (S3701).

Subsequently, the countermeasure model creation unit 176 of the security countermeasure determination support apparatus 100 determines, for each countermeasure group ID, the standard deviation of the EA value in each section of the threat at the risk occurrence location in the countermeasure group evaluation table 117. Numbering is performed in the order of 1, 2, ... (S3702).

Next, the countermeasure model creation unit 176 of the security countermeasure determination support apparatus 100 refers to the countermeasure list 115 for each category of the risk occurrence location in the countermeasure group evaluation table 117, and for each countermeasure group ID, in the countermeasure group. The risk cases that cannot be covered are listed (S3703).

Subsequently, the countermeasure model creation unit 176 of the security countermeasure determination support apparatus 100 follows the countermeasure model proposal table creation rule and the standard deviation number of the EA value and the MO value for each threat at the risk occurrence location in the countermeasure group evaluation table 117. Numbers in ascending order. The countermeasure model proposal table 118 is compiled for each countermeasure group ID having the same number. (S3704).

FIG. 37 is a diagram showing an example of the countermeasure model proposal table 118 in the present embodiment. In the present embodiment, according to the rules input on the countermeasure model proposal table creation rule input screen 1100 (FIG. 34 or FIG. 35), a plurality of countermeasure groups are combined for each location where a risk occurs, that is, where countermeasures are implemented. Create a countermeasure model for the entire system. In addition, a plurality of countermeasure models themselves are created, given item numbers, and presented to the requester (system designer, etc.).

In the countermeasure model proposal table 118 in this embodiment, the location of security countermeasures, a summary of IDs of security countermeasures to be adopted, the risk number and threat to be subjected to security countermeasures, the countermeasure group ID to which the security countermeasures to be adopted belong, The configuration includes each value of the countermeasure ID (new and existing) and risk cases that cannot be covered.

Thereafter, the communication unit 171 of the security measure determination support device 100 transmits a measure model proposal table creation completion notification to the user terminal 200 of the system designer, and enables the user terminal 200 to view the measure model proposal table 118 ( S3415). The technique for enabling browsing is the same as that performed in accordance with the execution of steps S3403, S3409, and S3412 described above.

On the other hand, the user terminal 200 of the system designer receives the above-described countermeasure model proposal table 118, displays it on the output device, and provides it for viewing by the system designer. The system designer who has viewed the countermeasure model proposal table 118 determines a countermeasure model to be adopted after conducting various examinations such as implementation costs, and performs an input operation on the input device of the user terminal 200 for the number of the corresponding countermeasure model. Will do.

In this case, the user terminal 200 receives the number of the countermeasure model designated by the system designer by the input device, and transmits it to the security countermeasure determination support device 100 (S3416). The input unit 174 of the security countermeasure determination support apparatus 100 receives the above-described countermeasure model number from the user terminal 200 and stores it in the memory 103 or the storage device 101 (S3417).

Subsequently, the specification entry unit 177 of the security measure determination support device 100 calls the system cooperation WBS 123 and the application development WBS 124 from the storage device 101, and details the requirement definition and design related to the measure model corresponding to the number received from the user terminal 200. The specifications 127 are generated by inserting the corresponding documents in the two documents (system cooperation WBS 123 and application development WBS 124) (S3418). In the example of the specification 127 shown in FIG. 38, the countermeasure model information 1800 corresponding to the underlined portion in the column “1.4. Security countermeasure mechanism” is inserted into the insertion location 1801.

The communication unit 171 of the security measure determination support device 100 transmits a specification entry completion notification to the system designer's user terminal 200, and also includes the completed specification 127, that is, the completed system cooperation WBS 123 and the application development WBS 124. Can be viewed on the user terminal 200 (S3419), and the process ends. The technique for enabling browsing is the same as that performed in accordance with the execution of steps S3403, S3409, S3412, and S3415 described above.

Note that each of the above-described configurations, functions, processing units, processing means, and the like may be realized by hardware by designing a part or all of them, for example, with an integrated circuit. Each of the above-described configurations, functions, and the like may be realized by software by the CPU 104 interpreting and executing a program that realizes each function. Information such as programs, tables, and files for realizing each function can be stored in a recording device such as a memory, a hard disk, an SSD (Solid State Drive), or a recording medium such as an IC card, an SD card, or a DVD.

Also, the control lines and information lines indicate what is considered necessary for the explanation, and not all the control lines and information lines on the product are necessarily shown. Actually, it may be considered that almost all the components are connected to each other.

The best mode for carrying out the present invention has been specifically described above. However, the present invention is not limited to this, and various modifications can be made without departing from the scope of the present invention.

According to this embodiment, it is possible to propose a security measure considering the availability of the countermeasure target.

記載 At least the following will be made clear by the description in this specification. That is, in the security measure determination support device of the present embodiment, the arithmetic device corresponds to the safety requirement information in the determination of the cover state of the graphic region corresponding to the safety requirement information by the graphic region corresponding to the countermeasure information. The side corresponding to the maintenance time of the safety level in the graphic area and the side corresponding to the maintenance time of the reached safety level among the graphic area corresponding to the countermeasure information are arranged on a predetermined time axis, Among the graphic areas corresponding to the safety requirement information, information on the area defined by the time zone covered by the graphic area corresponding to the countermeasure information and the reachable safety level in the time zone is specified as the cover state. It may be a thing.

According to this, for example, the area of the overlapping area between the graphic areas corresponding to the safety requirement information and the countermeasure information is calculated, and the information of the calculated value, that is, the cover state is presented to the user as reference information for determining the security countermeasure. It is possible to perform processing such as The information of the calculated value presented here corresponds to the time during which the security countermeasure target system is restored by performing security countermeasures and the operation is maintained at a predetermined safety level, that is, availability. Therefore, the user can easily perform the work of comparing the above-mentioned calculated values between the security countermeasure candidates and preferentially determining a security measure with high availability, that is, a large calculated value.

Further, in the above-described security measure determination support device, the arithmetic unit may determine the graphic corresponding to the safety requirement information in the determination of the cover state of the graphic region corresponding to the safety requirement information by the graphic region corresponding to the countermeasure information. The safety request information indicates, on the predetermined time axis, an edge corresponding to the maintenance time of the safety level in the area and an edge corresponding to the maintenance time of the reached safety level in the graphic area corresponding to the countermeasure information. It is characterized in that the cover state is specified by arranging a point in time when an allowable recovery time has passed since the operation stop of the security countermeasure target as a starting point.

According to this, when assuming a system that is under development or not in operation after completion of development as a security measure target, the security measure is determined as the cover state under the situation where the security measure is applied according to the start of operation of the corresponding system. Can be presented to the user as reference information. For example, the area of the overlapping area between the graphic areas corresponding to the safety requirement information and the countermeasure information is calculated as the cover state information and presented to the user as reference information for determining the security countermeasure.

Further, in the above-described security measure determination support device, the arithmetic unit may determine the graphic corresponding to the safety requirement information in the determination of the cover state of the graphic region corresponding to the safety requirement information by the graphic region corresponding to the countermeasure information. An edge corresponding to the maintenance time of the safety level and an edge corresponding to the maintenance time of the reachable safety level among the plurality of graphic areas corresponding to the countermeasure information are arranged on a predetermined time axis. The time zone covered by a plurality of graphic regions corresponding to the countermeasure information among the graphic regions corresponding to the safety requirement information and the overlap of the reachable safety level indicated by the plurality of graphic regions in the time zone It is good also as what specifies the information of the area | region used as said cover state.

According to this, among the graphic areas defined by the maintenance time and safety level indicated by the safety requirement information, an area that covers a plurality of graphic areas defined by the maintenance time indicated by the countermeasure information and the reached safety level, That is, it is possible to perform processing for presenting information about a time zone in which a plurality of security measures are applied at the same time and the safety level thereof to the user as reference information for determining the security measures. For example, the area of the overlapping area between the plurality of graphic areas is calculated as cover state information and presented to the user as reference information for determining security measures.

Further, in the above-described security measure determination support device, the storage device is applied as a security measure candidate information in the measure information, and is a development measure that is constantly applied and applied during development of the system that is the security measure target. And a measure for emergency measures that are applied at the time of risk occurrence during system operation and aiming at functional recovery, and the calculation device is based on a graphic area corresponding to the measure information, In the determination of the cover state of the graphic area corresponding to the safety requirement information, the edge corresponding to the maintenance time of the safety level in the graphic area corresponding to the safety requirement information, and the measures for development and the measures for emergency measures Of the graphic area corresponding to at least one of the countermeasure information of A time zone covered by a graphic area corresponding to the countermeasure information of at least one of the countermeasures for development and the countermeasures for first aid, among the graphic areas corresponding to the safety requirement information, arranged on the axis, and It is good also as specifying the information of the area | region prescribed | regulated with the reach | attainment safe level in a time slot | zone as the said cover state.

According to this, there is an emergency phase in which the security target system can be recovered from a stopped state in the shortest possible time even if the safety level indicated by the safety requirement information is not completely satisfied, and the safety level indicated by the safety requirement information is completely satisfied. Assuming two phases, the normal phase that is normally operated, the emergency measures are set for the emergency phase in the time zone within the predetermined time from the stop state, and the normal phase is Can set a countermeasure for development and specify the above-described cover state.

Further, in the above-described security measure determination support device, the arithmetic device accepts a user request related to a security measure at an input device, and among the security measure candidates, is an evaluation result corresponding to a condition indicated by the user request. A process of generating a security countermeasure model from the identified security countermeasure candidates and outputting the countermeasure model to an output device may be further executed.

According to this, for example, the use of security measures (eg, emergency measures or development measures), the priority of security measures to be prioritized (eg, corresponding to measure information in the graphic area corresponding to safety requirement information) Either the area covered by the graphic area, or the area of the graphic area corresponding to the safety requirement information, and the area covered by multiple graphic areas corresponding to the countermeasure information) Based on a user request regarding a condition such as a magnitude, it is possible to identify a security countermeasure candidate having an evaluation result corresponding to the condition indicated by the user request, and present a security countermeasure model including this to the user.

Further, in the above-described security measure determination support device, the computing device specifies the security measure candidates in order of the degree of correspondence of the evaluation result to the condition indicated by the user request when generating and outputting the security measure model, The security countermeasure models may be sequentially generated using the security countermeasure models in order of the degree of correspondence to the user request conditions, and each security countermeasure model may be output to an output device.

According to this, it is possible to present to the user a security countermeasure model having a different recommendation level depending on the degree of matching with the condition indicated by the user request.

Further, in the above-described security measure determination support device, the storage device further stores specification data of a system that is a security measure target, and the arithmetic device is employed in accordance with output processing of the security measure model. A process for generating a specification by receiving a user specification of a security measure by an input device and inserting the information of the security measure that has received the user specification into a corresponding portion of the specification data of the system. There may be.

According to this, it becomes possible to set the information of the security countermeasure model in the specification of the corresponding system and automatically generate the specification corresponding to the situation where the system under development is the target of the security countermeasure.

DESCRIPTION OF SYMBOLS 10 Security countermeasure determination support system 20 Network 100 Security countermeasure determination support apparatus 101 Storage apparatus 102 Program 103 Memory 104 CPU (arithmetic unit)
105 Input Device 106 Output Device 107 Communication Device 108 Internal Bus 110 DFD
111 DFD risk reference value table (safety requirement information)
112 Countermeasure Type Table 113 Countermeasure Implementation Type Table 114 Risk Analysis Table 115 Countermeasure List (Countermeasure Information)
116 Countermeasure list details table (Countermeasure information)
117 Countermeasure group evaluation table 118 Countermeasure model proposal table 119 R_SL determination table 120 A_SL determination table 121 R_TP, A_TP determination table 122 R_TO, A_TO determination table 123 System cooperation WBS
124 Application Development WBS
125 Completed system linkage WBS
126 Completed application development WBS
127 Specification 171 Communication unit 172 Registration unit 173 Countermeasure list creation unit 174 Input unit 175 Countermeasure evaluation unit 176 Countermeasure model creation unit 177

Specification entry unit

200, 250 User terminal

Claims

Countermeasure information including information regarding threats affecting security countermeasure targets and potential security countermeasure candidates that are assumed to be applied to the threats, information security safety levels required for the security countermeasure targets, and corresponding safety levels A storage device for storing safety request information including information on the maintenance time of
Corresponding security countermeasure candidate indicated by the graphic area in which each side length corresponds to each size of the safety level and the maintenance time of the corresponding safety level indicated by the safety requirement information, and information of the security countermeasure candidate in the countermeasure information The safety requirement information based on the figure area corresponding to the countermeasure information by comparing the figure area corresponding to each side length with each of the reachable safety level assumed in the application and the maintenance time of the corresponding arrival safety level. An arithmetic unit that determines the cover state of the graphic area corresponding to the, and generates an evaluation result of the corresponding security countermeasure candidate according to the cover state and outputs it to the output device;
A security measure decision support device characterized by comprising:
The arithmetic unit is:
In determining the cover state of the graphic area corresponding to the safety requirement information by the graphic area corresponding to the countermeasure information,
A side corresponding to the maintenance time of the safety level in the graphic area corresponding to the safety requirement information and a side corresponding to the maintenance time of the reached safety level in the graphic area corresponding to the countermeasure information are set on a predetermined time axis. The information of the area defined by the time zone covered by the graphic area corresponding to the countermeasure information and the reachable safety level in the time period among the graphic areas corresponding to the safety requirement information It is specified as the cover state,
The security measure determination support apparatus according to claim 1, wherein
The arithmetic unit is:
In determining the cover state of the graphic area corresponding to the safety requirement information by the graphic area corresponding to the countermeasure information,
An edge corresponding to the maintenance time of the safety level in the graphic area corresponding to the safety requirement information and an edge corresponding to the maintenance time of the reached safety level in the graphic area corresponding to the countermeasure information are on the predetermined time axis. The safety requirement information indicates that the cover state is specified by placing a point in time when an acceptable recovery time has elapsed since the operation stop of the security countermeasure target,
The security measure determination support apparatus according to claim 2, wherein
The arithmetic unit is:
In determining the cover state of the graphic area corresponding to the safety requirement information by the graphic area corresponding to the countermeasure information,
The side corresponding to the maintenance time of the safety level among the graphic areas corresponding to the safety requirement information, and the side corresponding to the maintenance time of the reached safety level among the plurality of graphic areas corresponding to the countermeasure information, A time zone covered by a plurality of graphic regions corresponding to the countermeasure information, among the graphic regions corresponding to the safety requirement information, arranged on a predetermined time axis, and the plurality of graphic regions in the time zone indicate The area information defined by the overlap of the reachable safety level is specified as the cover state.
The security measure determination support apparatus according to claim 2, wherein
The storage device
As information on the security countermeasure candidates in the countermeasure information, development countermeasures that are applied constantly during development of the system that is the subject of the security countermeasures, and function recovery that is applied when a risk occurs during system operation And the information for first aid measures and
The arithmetic unit is:
In determining the cover state of the graphic area corresponding to the safety requirement information by the graphic area corresponding to the countermeasure information,
Of the graphic area corresponding to the safety requirement information, the side corresponding to the maintenance time of the safety level, and the arrival of the graphic area corresponding to at least one of the countermeasure information for the development measure and the emergency measure measure An edge corresponding to the maintenance time of the safety level is arranged on a predetermined time axis, and the countermeasure information for at least one of the countermeasure for development and the countermeasure for emergency treatment is included in the graphic area corresponding to the safety requirement information. The information of the area defined by the time zone covered by the corresponding graphic area and the reachable safety level in the time zone is specified as the cover state.
The security measure determination support apparatus according to claim 2, wherein
The arithmetic unit is:
The input device accepts a user request related to a security measure, identifies the security measure candidate that is an evaluation result corresponding to the condition indicated by the user request, and generates a security measure model from the identified security measure candidate , To further execute the process of outputting the countermeasure model to the output device,
The security measure determination support apparatus according to claim 1, wherein
The arithmetic unit is:
When generating and outputting the security countermeasure model, the security countermeasure candidates are identified in order of the degree of correspondence of the evaluation results to the conditions indicated by the user request, and the security countermeasure model is ordered in the degree of correspondence to the condition of the user request. The security countermeasure models are sequentially generated using each security countermeasure model and output to the output device.
The security measure decision support apparatus according to claim 6.
The storage device
It further stores the specification data of the system that is the target of security measures.
The arithmetic unit is:
Along with the output process of the security countermeasure model, the user device accepts the user specification of the adopted security countermeasure, and the security countermeasure information received by the user is inserted into the corresponding part of the specification data of the system. The security measure determination support apparatus according to claim 6, further comprising a process of generating a document.
Countermeasure information including information regarding threats affecting security countermeasure targets and potential security countermeasure candidates that are assumed to be applied to the threats, information security safety levels required for the security countermeasure targets, and corresponding safety levels A computer having a storage device for storing safety request information including information on the maintenance time of
Corresponding security countermeasure candidate indicated by the graphic area in which each side length corresponds to each size of the safety level and the maintenance time of the corresponding safety level indicated by the safety requirement information, and information of the security countermeasure candidate in the countermeasure information The safety requirement information based on the figure area corresponding to the countermeasure information by comparing the figure area corresponding to each side length with each of the reachable safety level assumed in the application and the maintenance time of the corresponding arrival safety level. Determining the cover state of the graphic area corresponding to the, and executing a process of generating an evaluation result of the corresponding security countermeasure candidate according to the cover state and outputting it to the output device,
A security measure decision support method characterized by the above.