WO2024166288A1

WO2024166288A1 - Information processing device, risk visualization method, and computer readable medium

Info

Publication number: WO2024166288A1
Application number: PCT/JP2023/004353
Authority: WO
Inventors: 諒水島
Original assignee: 日本電気株式会社
Priority date: 2023-02-09
Filing date: 2023-02-09
Publication date: 2024-08-15

Abstract

The present invention enables a system administrator managing a plurality of systems to easily grasp risks across the plurality of systems. An analysis result acquisition unit (11) acquires a plurality of risk analysis results, each of which is a result of risk analysis conducted for each of the plurality of systems. An aggregation unit (12) aggregates the plurality of risk analysis results by a predetermined evaluation indicator. A visualization unit (13) presents information on the risk analysis results aggregated by the aggregation unit (12) to a user.

Description

Information processing device, risk visualization method, and computer-readable medium

The present disclosure relates to an information processing device, a risk visualization method, and a computer-readable medium.

In recent years, the threat of cyber attacks has not been limited to the field of ICT (Information and Communication Technology), with cases of damage also occurring in the fields of control systems and IoT (Internet of Things). In particular, there have been cases of control systems threatening the operation of critical infrastructure, such as the shutdown of power systems and factories. To combat the threat of cyber attacks, it is important to clarify the security risks posed by systems, implement measures, and reduce those risks.

As a related technique, Patent Document 1 discloses a security design support system. In the security design support system described in Patent Document 1, a security officer distributes a security status confirmation checklist to an industrial cluster made up of multiple organizations. Each of the multiple organizations has its own system, such as a design support system, a production planning system, or a manufacturing system. An organization officer is assigned to each of the multiple organizations, and the organization officer of each organization creates a response to the checklist and sends the created response and system configuration information data to the security officer. The response includes the security status of the system of the organization he or she is responsible for.

The security officer receives responses and system configuration information data from each of the multiple organization officers. The security officer inputs the received responses and system configuration information data into the security design support device. The security design support device uses the input responses and system configuration information data to output security-related countermeasure information. The countermeasure information includes cluster-common baseline requirements list data, organization-specific requirements list data, and inter-organizational collaboration requirements list data. The cluster-common baseline requirements list data is data that indicates the security requirements and countermeasures that are common to the cluster of systems of each organization in the industrial cluster. The organization-specific requirements list data is data that indicates the individual security requirements and countermeasures of each organization's system. The inter-organizational collaboration requirements list data is data that indicates the security requirements and countermeasures when the systems of each organization in the industrial cluster collaborate.

JP 2019-021161 A

In recent years, the visualization of risk analysis results has become important, and there is a growing need to visualize the security risks of all factories and departments in a dashboard format. Furthermore, from the perspective of consultants, there is also a growing need to compare analysis results with other industries or with the same industry. However, it is difficult to grasp the security risks of all factories or departments and determine the priority of countermeasures and whether or not to monitor which countermeasures have been implemented. Administrators who manage multiple systems as a whole want to know the overall risks and whether or not countermeasures should be introduced, but find it difficult to understand detailed attack routes and vulnerability information for each system.

In Patent Document 1, an administrator can determine whether each system satisfies the cluster common baseline requirements, organization-specific requirements, and inter-organization collaboration requirements. However, in Patent Document 1, the analysis results are obtained individually for each system. For this reason, in Patent Document 1, for multiple systems, each operator must understand the risks for each individual system that he or she is responsible for, understand the countermeasures, and determine the priority of the countermeasures.

In view of the above circumstances, the present disclosure aims to provide an information processing device, a risk visualization method, and a computer-readable medium that enable a system administrator who manages multiple systems to easily grasp the risks in the multiple systems.

In order to achieve the above object, the present disclosure provides, as a first aspect, an information processing device. The information processing device includes an analysis result acquisition unit that acquires multiple risk analysis results that are the results of risk analysis performed on each of multiple systems, an aggregation unit that aggregates the multiple risk analysis results using a predetermined evaluation index, and a visualization unit that presents information on the aggregated risk analysis results to a user.

In a second aspect, the present disclosure provides a risk visualization method. The risk visualization method includes acquiring multiple risk analysis results that are the results of risk analysis performed on each of multiple systems, aggregating the acquired multiple risk analysis results using a predetermined evaluation index, and presenting information on the aggregated risk analysis results to a user.

As a third aspect, the present disclosure provides a computer-readable medium. The computer-readable medium stores a program for causing a computer to execute a process including acquiring multiple risk analysis results that are the results of risk analysis performed on each of multiple systems, aggregating the acquired multiple risk analysis results using a predetermined evaluation index, and presenting information on the aggregated risk analysis results to a user.

The information processing device, risk visualization method, and computer-readable medium disclosed herein can enable a system administrator who manages multiple systems to easily understand the risks in the multiple systems.

1 is a block diagram showing a schematic configuration of an information processing device according to the present disclosure. FIG. 1 is a block diagram showing an information processing apparatus according to a first embodiment of the present disclosure. 1 is a schematic diagram showing the relationship between a plurality of systems, individual system administrators, and an overall system administrator. FIG. 11 is a diagram showing an example of visualization in the first specific example. FIG. 13 is a diagram showing an example of a notification sent to an individual system administrator. FIG. 13 is a diagram showing an example of visualization in the second specific example. FIG. 13 is a diagram showing an example of visualization in the third specific example. FIG. 13 is a diagram showing an example of a notification sent to an individual system administrator. FIG. 13 is a diagram showing an example of visualization in the fourth specific example. FIG. 13 is a diagram showing an example of visualization in the fifth specific example. FIG. 13 is a diagram showing an example of visualization in the sixth specific example. FIG. 13 is a diagram showing an example of visualization in the seventh specific example. FIG. 23 is a diagram showing an example of visualization in the eighth specific example. 4 is a flowchart showing an operation procedure of the information processing device. FIG. 11 is a block diagram showing an information processing apparatus according to a second embodiment of the present disclosure. FIG. 13 is a diagram showing an example of information stored in a countermeasure cost DB. 1A to 1C are diagrams showing specific examples of visualization in the present embodiment. FIG. 1 is a block diagram showing an example of the configuration of a computer device.

Prior to describing the embodiments of the present disclosure, an overview of the present disclosure will be described. FIG. 1 shows a schematic configuration of an information processing device according to the present disclosure. The information processing device 10 has an analysis result acquisition unit 11, an aggregation unit 12, and a visualization unit 13. The analysis result acquisition unit 11 acquires multiple risk analysis results 20 for each of multiple systems to be analyzed. The aggregation unit 12 aggregates the acquired multiple risk analysis results 20 using a predetermined evaluation index. The visualization unit 13 presents the aggregated risk analysis results to a user, such as a system administrator who manages multiple systems.

In the present disclosure, the aggregation unit 12 aggregates multiple risk analysis results using a predetermined evaluation index. The visualization unit 13 presents the aggregated risk analysis results to the user. In the present disclosure, by looking at the aggregated risk analysis results, the user can understand to some extent the risks in multiple systems without having to examine the individual risk analysis results in detail. Therefore, a system administrator who manages multiple systems can easily understand the risks in multiple systems.

The following describes in detail the embodiments of the present disclosure. Note that the following description and drawings have been omitted or simplified as appropriate for clarity of explanation. In addition, in each drawing, the same elements and similar elements are given the same reference numerals, and duplicate explanations are omitted as necessary.

FIG. 2 shows an information processing device according to the first embodiment of the present disclosure. The information processing device 100 has a collection unit 101, a common information aggregation unit 102, a risk visualization unit 103, an attack information DB (database) 120, a countermeasure compromise DB 130, and an aggregated information DB 140. The information processing device 100 is configured as a device having, for example, one or more processors and one or more memories. At least a part of the function of each unit in the information processing device 100 can be realized by the processor executing instructions read from the memory. The information processing device 100 corresponds to the information processing device 10 shown in FIG. 1. The information processing device 100 may also be called a risk visualization device.

In this embodiment, the attack information DB 120, countermeasure information DB 130, and aggregated information DB 140 only need to be accessible from the information processing device 100, and these DBs do not necessarily need to be part of the information processing device 100. For example, at least one of the attack information DB 120, countermeasure information DB 130, and aggregated information DB 140 may be located on the cloud. In that case, the information processing device 100 may access at least one of the attack information DB 120, countermeasure information DB 130, and aggregated information DB 140 via a network.

The collection unit 101 collects multiple risk analysis results 201 performed on each of multiple systems. The risk analysis results 201 include, for example, a risk value when an attack is carried out on each system, and information on vulnerabilities used in the attack. The risk analysis results 201 may be the result of a business damage-based risk analysis performed on the system being analyzed (hereinafter also referred to as a business damage-based risk analysis result). Business damage-based risk analysis includes, for example, creating a virtual model from configuration information of a system in a real environment, inputting information on the attack scenario to be analyzed, generating an attack route in accordance with the attack scenario, and calculating a risk value for the generated attack route.

The results of the business damage-based risk analysis indicate the results of an assessment of the risk when an attack is carried out along an attack route from an entry point included in the system being analyzed to the target of the attack. The attack route includes one or more attack steps. An attack step is the smallest unit of an attack route, and includes an attack source, an attack destination, and an attack method. The attack method indicates the attack type of the attack step. The attack method is also called an attack pattern. The attack information may include information on vulnerabilities used in the attack pattern. The results of the business damage-based risk analysis include a risk value that evaluates the risk of the attack steps and the entire attack route when an attack is carried out along the attack route. The risk value is assessed on a five-level scale, for example, from A to E.

Alternatively, the risk analysis result 201 may be the result of performing an asset-based risk analysis on the system being analyzed (hereinafter, also referred to as the asset-based risk analysis result). The asset-based risk analysis includes, for example, evaluating the risk of each of the assets constituting the system being analyzed using three evaluation indicators: its importance (value), the likelihood of the occurrence of a predicted threat, and its vulnerability to the threat.

The asset-based risk analysis result indicates the result of risk assessment for the assets that constitute the system being analyzed. The asset-based risk analysis result includes a risk value that evaluates the risk when an attack is carried out against an asset using one or more assumed attack patterns. The risk value is evaluated on a five-level scale, for example, from A to E. The risk analysis result 201 may include a business damage-based risk analysis result and an asset-based risk analysis result for one system. The collection unit 101 corresponds to the analysis result acquisition unit 11 shown in FIG. 1.

Figure 3 shows the relationship between multiple systems to be analyzed, individual system administrators who manage each system, and an overall system administrator who manages the entire system. For example, assume that a system is constructed for each of multiple departments in a company. Systems 200-1 to 200-N shown in Figure 3 are systems for which risk analysis is performed. By performing risk analysis individually on each of systems 200-1 to 200-N, multiple risk analysis results 201 are obtained.

The multiple individual system administrators are each responsible for one of the multiple systems 200-1 to 200-N, and are the administrators who manage the systems they are responsible for. The individual system administrators manage the asset information, vulnerability information, and system risks of the systems they are responsible for. The number of systems an individual system administrator is responsible for is not limited to one, and one individual system administrator may be in charge of multiple systems. The overall system administrator is the administrator who manages the multiple systems 200-1 to 200-N as a whole. The overall system administrator manages the system risks and vulnerabilities of all the systems. In general, the overall system administrator often does not have a full grasp of the asset details of each system.

Returning to FIG. 2, the attack information DB 120 stores the attack steps, attack patterns, vulnerability information used in the attack patterns, and risk values for each attack route. The countermeasure information DB 130 stores vulnerability information and countermeasure information. The collection unit 101 registers various information contained in the collected multiple risk analysis results 201 in the attack information DB 120. The collection unit 101 also collects vulnerability information for each asset against attacks in each of the systems to be analyzed. Specifically, the collection unit 101 collects information such as vulnerability identification information and attack patterns that may be used for vulnerabilities possessed by the assets to be attacked. Here, CVE (Common Vulnerabilities and Exposures) can be used as the vulnerability identification information. The collection unit 101 also acquires information such as the Common Vulnerability Scoring System (CVSS) score, the presence or absence of a PoC (Proof of Concept) code, and the presence or absence of damage cases. The CVSS score, the presence or absence of a PoC code, and the presence or absence of a damage case can be obtained from an external server or the like via a network such as the Internet. The collection unit 101 registers the collected vulnerability information in the vulnerability information DB 130.

The common information aggregation unit 102 aggregates risk analysis results 201 of multiple systems 200-1 to 200-N (see FIG. 3) using a predetermined evaluation index, using information stored in the attack information DB 120 and information stored in the countermeasure information DB 130. The common information aggregation unit 102 aggregates multiple risk analysis results, for example, by counting the number of systems, the number of attack routes, the number of attack patterns, or the number of vulnerabilities according to predetermined conditions. The common information aggregation unit 102 registers the aggregated information in the aggregated information DB 140. The common information aggregation unit 102 corresponds to the aggregation unit 12 shown in FIG. 1.

The risk visualization unit 103 presents the risk analysis results aggregated by the common information aggregation unit 102 to the user. For example, the risk visualization unit 103 uses information stored in the countermeasure information DB 130 and the risk information DB 140 to display information such as what risks the system as a whole contains on the screen of a display device. By looking at the display screen, the overall system administrator can know information such as what risks the system as a whole contains. The risk visualization unit 103 corresponds to the visualization unit 13 shown in FIG. 1.

Below, the operation of the common information aggregation unit 102 and the risk visualization unit 103 will be described using a specific example of aggregation. In a first specific example of visualization, the common information aggregation unit 102 aggregates risk analysis results of multiple systems by counting the number of systems that meet predetermined conditions based on the risk value and the vulnerabilities used in the attack. For example, the common information aggregation unit 102 counts the number of systems that have attack routes related to a certain number of vulnerabilities with high risk levels. The common information aggregation unit 102 may classify the attack routes related to the vulnerabilities by their risk values and count the number of systems for each risk value. In addition, the common information aggregation unit 102 may count the number of systems depending on whether the attack route exploiting the vulnerability has been addressed, is being addressed, or has not been addressed.

FIG. 4 shows an example of visualization in the first specific example. The common information aggregation unit 102, for example, identifies the risk level for each of multiple vulnerabilities exploited in a predetermined number or more systems. The common information aggregation unit 102 selects a predetermined number of vulnerabilities as dangerous vulnerabilities from among the multiple vulnerabilities in order of increasing risk according to the risk level. The common information aggregation unit 102 selects, for example, the top five vulnerabilities exploited in two or more systems and with the highest CVSS scores as dangerous vulnerabilities. The common information aggregation unit 102 counts the number of systems having attack routes related to the vulnerabilities selected as dangerous vulnerabilities for each risk value. In addition, the common information aggregation unit 102 classifies each attack route into whether it has been addressed, is being addressed, or has not been addressed, and counts the number of systems for each classification. The common information aggregation unit 102 registers the number of systems counted for each vulnerability and risk value in the aggregated information DB 140.

The risk visualization unit 103 acquires information from the aggregated information DB 140 and displays the table shown in FIG. 4. In displaying the table shown in FIG. 4, the risk visualization unit 103 may change the color of the vulnerability column according to the risk of the vulnerability. For example, the risk visualization unit 103 may classify the CVSS score of each vulnerability into a plurality of levels and display the vulnerability column in a color according to the classified level. By referring to the table, the overall system administrator can know that for the combination of "CVE-XXX0" with the highest risk level and risk value "A", the number of systems that have been dealt with, i.e., systems for which measures have already been implemented against the attack route, is "0". Furthermore, the overall system administrator can know that for that combination, the number of systems that are being dealt with, i.e., systems for which measures are being taken, is "5", and the number of systems that have not been dealt with is "10". Furthermore, the overall system administrator can know that for the combination of "CVE-XXX0" with the second highest risk level and risk value "B", the number of systems that have not been dealt with is "1".

If multiple risk analysis results are not aggregated in the common information aggregation unit 102, the responsible operator, such as the individual system administrator shown in FIG. 3, will need to address vulnerabilities on a system-by-system basis. Furthermore, if costs are limited, the overall system administrator will need to interview the individual system administrators about the status of each system and consider the priority of the measures. In contrast, in the first specific example, the overall system administrator can plan to implement measures in order, starting with systems that have attack routes related to vulnerabilities that are highly dangerous and have a high risk value if attacked. In this way, by referring to the table shown in FIG. 4, the system administrator can understand the order of measures to be taken for dangerous vulnerabilities when reducing risk to the entire system.

The overall system administrator can select a combination of vulnerability and risk value for which the number of systems is counted in the table displayed in FIG. 4. The risk visualization unit 103 may identify systems related to the selected combination and send a notification to the individual system administrator in charge of the identified system. For example, the risk visualization unit 103 may identify a system corresponding to "Unaddressed" in the table shown in FIG. 4 as a system related to the selected combination. The risk visualization unit 103 sends a notification to the individual system administrator in charge of the identified system. For example, if a combination of "CVE-XXX0" and risk value "A" is selected in the table shown in FIG. 4, the risk visualization unit 103 may send a notification to the individual system administrator in charge of each of the 10 unaddressed systems.

FIG. 5 shows an example of a notification sent to an individual system administrator. The notification shown in FIG. 5 includes vulnerability information, related system information, and countermeasure information. The vulnerability information includes the CVSS score of the vulnerability, the presence or absence of a PoC code, and information on the presence or absence of damage cases. The related system information includes information identifying an asset having a vulnerability in the system managed by the individual system administrator, such as the asset name, and the number of related attack routes. The related system information may differ for each individual system administrator to whom the notification is sent. The countermeasure information is information indicating a general countermeasure against a vulnerability. In the example of FIG. 5, the countermeasure information includes countermeasure A, which is a permanent measure, and countermeasure B, which is a mitigation measure. Instead of or in addition to sending a notification when the overall system administrator selects a combination, the risk visualization unit 103 may periodically send a notification to the individual system administrator for each combination.

Next, a second specific example of visualization will be described. FIG. 6 shows an example of visualization in the second specific example. In the second specific example, the common information aggregation unit 102 selects a predetermined number of vulnerabilities as dangerous vulnerabilities from among the multiple vulnerabilities in order of decreasing risk, as in the first specific example. Furthermore, the common information aggregation unit 102 selects a predetermined number of systems as high-risk systems from among the multiple systems in order of decreasing system risk value based on the system risk value of each system. The system risk value may be, for example, the maximum value of risk values for multiple attack routes or multiple assets in each system. For example, the common information aggregation unit 102 selects five vulnerabilities as dangerous vulnerabilities and five systems as high-risk systems.

The common information aggregation unit 102 counts the number of assets that have the vulnerability for each selected vulnerability and for each selected system. The common information aggregation unit 102 also counts the number of assets that have the selected vulnerability that are used in attacks. The risk visualization unit 103 displays the ratio of assets that are used in attacks to assets that have dangerous vulnerabilities. For example, if the number of assets that have the vulnerability "CVE-XXX0" in system 1 is "10" and the number of assets that are used in attacks is "3," the risk visualization unit 103 displays "3/10" for the combination of vulnerability "CVE-XXX0" and system 1. Instead of displaying the ratio, the risk visualization unit 103 may simply display the number of assets that are used in attacks.

The common information aggregation unit 102 may count the number of attack routes related to the vulnerability for each selected vulnerability and for each selected system. The common information aggregation unit 102 may also count the total number of attack routes for each system. In this case, the risk visualization unit 103 may display the ratio of the number of attack routes using dangerous vulnerabilities to the total number of attack routes for each system. Instead of displaying the ratio, the risk visualization unit 103 may simply display the number of attack routes using dangerous vulnerabilities. The risk visualization unit 103 may display the counted numerical value in a color corresponding to the maximum value of the risk value of the asset having a dangerous vulnerability or the maximum value of the risk value of the attack route using a dangerous vulnerability. The risk visualization unit 103 may also change the color of the vulnerability column in the display of the table shown in FIG. 6 according to the risk level of the vulnerability.

The overall system administrator can select a combination of a vulnerability and a system in the table displayed in FIG. 6. The risk visualization unit 103 may send a notification including information about the selected vulnerability to the individual system administrator in charge of the selected system. The risk visualization unit 103 sends a notification similar to the notification shown in FIG. 5 to the individual system administrator in charge of the selected system. In the second specific example, the related system information in the sent notification may include, for example, the number of attack routes that go through host A and the number of attack routes that go through host A and use the selected vulnerability. In the second specific example, instead of or in addition to sending a notification when the overall system administrator selects a combination, the risk visualization unit 103 may periodically send a notification to the individual system administrator for each combination.

In the second specific example, the overall system administrator can refer to the table shown in FIG. 6 to plan to implement measures in order of systems that have high-risk vulnerabilities and that pose the highest risk. When measures are implemented for a high-risk system, the risk value of the system for which measures have been implemented decreases, and as a result, the ranking of the high-risk systems changes. After the ranking changes, the overall system administrator can again plan to implement measures in order of systems that have high-risk vulnerabilities and that pose the highest risk.

Next, a third specific example of visualization will be described. FIG. 7 shows an example of visualization in the third specific example. In the third specific example, the common information aggregation unit 102 identifies high-risk systems and counts the number of attack routes for each risk value of the attack route and for each high-risk system. The method of identifying high-risk systems may be similar to the method of identifying high-risk systems in the second specific example. For example, the common information aggregation unit 102 counts the number of attack routes with risk value "A", the number of attack routes with risk value "B", the number of attack routes with risk value "C", the number of attack routes with risk value "D", and the number of attack routes with risk value "E" for system 1. The common information aggregation unit 102 also counts the number of attack routes for each risk value for other systems.

The risk visualization unit 103 displays the number of attack routes for each risk value of the attack route and for each high-risk system. The risk visualization unit 103 may display the average number of attack routes in high-risk systems for each risk value of the attack route. Furthermore, when the number of attack routes in each system is equal to or greater than the average number of attack routes, the risk visualization unit 103 may highlight the number of attack routes. For example, the risk visualization unit 103 may display the number of attack routes equal to or greater than the average in a predetermined color such as red, or in a predetermined background color. Instead of using the average value of the risk value, a predetermined threshold value for the risk value may be used.

In the third specific example, the overall system administrator can grasp the number of attack routes in a list for each high-risk system and for each risk value. Therefore, the overall system administrator can easily compare the number of attack routes between systems and for each risk value. Therefore, even if the overall system administrator does not have knowledge about individual systems, he or she can easily grasp which systems among all the systems are at risk and for which countermeasures need to be implemented. Instead of visualization using a table, the risk visualization unit 103 may visualize the number of attack routes counted for each risk value and for each high-risk system using a bar graph or radar chart.

The overall system administrator can select a combination of risk value and system in the table displayed in FIG. 7. The risk visualization unit 103 may send a notification including information regarding the attack route of the selected risk value to the individual system administrator in charge of the selected system. For example, if a combination of risk value "A" and system 1 is selected in the table shown in FIG. 7, the risk visualization unit 103 may send a notification including information regarding the attack route of risk value "A" to the individual system person in charge of system 1.

FIG. 8 shows an example of a notification sent to an individual system administrator. The notification shown in FIG. 8 includes attack route information and information on the vulnerability used. The attack route information includes the asset that is the starting point of the attack, the asset that is the final target of the attack, the assets along the way from the starting point to the final target, and information on the attack pattern used in the attack. The vulnerability information includes the asset having the vulnerability, information identifying the vulnerability, and the number of related attack routes. In the third specific example, the notification sent to the individual system administrator may include countermeasure information, i.e., information indicating a general countermeasure against the vulnerability. In the third specific example, the risk visualization unit 103 may also periodically send notifications to the individual system administrator for each combination, instead of or in addition to sending a notification when the overall system administrator selects a combination.

Next, a fourth specific example of visualization will be described. FIG. 9 shows an example of visualization in the fourth specific example. In the fourth specific example, a bar graph is used to visualize the number of attack routes. As in the third specific example, the common information aggregation unit 102 counts the number of attack routes for each risk value of the attack route and for each high-risk system. Furthermore, in the fourth specific example, the common information aggregation unit 102 checks the countermeasure multiplicity for each attack route. The countermeasure multiplicity indicates the number of countermeasures implemented for one attack route. For each risk value, the common information aggregation unit 102 counts the number of attack routes with a countermeasure multiplicity equal to or greater than a predetermined number, and the number of attack routes with a countermeasure multiplicity less than a predetermined number.

The common information aggregation unit 102, for example, counts the number of attack routes with a countermeasure multiplicity of 3 or more and the number of attack routes with a countermeasure multiplicity of 2 or less for each risk value. In a fourth specific example, the risk visualization unit 103 visualizes the number of attack routes for systems A-C in a bar graph according to the risk value of the attack route and the number of countermeasure multiplicities. In the bar graph shown in FIG. 9, for example, "A3-" represents an attack route with a risk value of "A" and a countermeasure multiplicity of 3 or more. Also, "A-2" represents an attack route with a risk value of "A" and a countermeasure multiplicity of 2 or less.

The risk visualization unit 103 may display the average number of attack routes in a bar graph. In this case, the overall system administrator can recognize a system in which the number of attack routes exceeds the average value as a high-risk system, and can prioritize planning countermeasures for that system. In addition, the risk visualization unit 103 may weight the number of attack routes with a weight according to the risk value, and change the length of each block in the bar graph according to the weight. For example, the higher the risk value, the longer the length of the block per "1" attack route. In this case, the higher the number of attack routes with a high risk value, the higher the height of the bar graph.

A fifth specific example of visualization will be described. FIG. 10 shows an example of visualization in the fifth specific example. In the fifth specific example, a radar chart is used to visualize the number of attack routes. As in the third specific example, the common information aggregation unit 102 counts the number of attack routes for each risk value of the attack route and for each high-risk system. In the fifth specific example, the risk visualization unit 103 visualizes the number of attack routes for systems 1-3 in a radar chart according to the risk value of the attack route.

The risk visualization unit 103 may display the average number of attack routes for each risk value in a radar chart. In this case, the risk visualization unit 103 may highlight the number of attack routes that exceed the average value in red, for example. The overall system administrator can recognize a system in which the number of attack routes exceeds the average value as a high-risk system, and can prioritize planning countermeasures for that system. In the fifth specific example, the risk visualization unit 103 may also weight the number of attack routes with a weight according to the risk value.

A sixth specific example of visualization will be described. FIG. 11 shows an example of visualization in the sixth specific example. The common information aggregation unit 102 extracts the attack patterns used in the attack routes from the risk analysis results of all systems. The common information aggregation unit 102 identifies the vulnerability most used by each of the extracted attack patterns from the risk analysis results. In addition, the common information aggregation unit 102 counts the number of exploits of each attack pattern, i.e., the number of times each attack pattern was used, in the attack routes of all systems. If the risk analysis results include the amount of damage, the common information aggregation unit 102 obtains the maximum amount of damage from the risk analysis results. Instead of or in addition to the amount of damage, the common information aggregation unit 102 may obtain the number of news articles, the number of cases, or the number of PoCs related to the vulnerability.

The risk visualization unit 103 displays the attack patterns used in the attack routes, the vulnerabilities used, the number of exploits in the attack routes, and the amount of damage. In the number of exploits in the attack route field, the number in parentheses indicates the total number of attack patterns. The risk visualization unit 103 may sort the attack patterns, for example, by the number of exploits in the attack route, and display the attack patterns with the most exploits in the attack routes at the top. By referring to the table shown in FIG. 11, the overall system administrator can know which attack patterns should be countered across multiple systems. When countermeasures are implemented for attack patterns with a high number of exploits in the attack routes, countermeasures are implemented for many attack routes. This allows the overall system administrator to plan efficient countermeasures.

The overall system administrator can select an attack pattern in the table displayed in FIG. 11. The risk visualization unit 103 may identify systems in which the selected attack pattern is used in the attack route, and send a notification including information about the attack pattern to the individual system administrator in charge of the identified system. The information about the attack pattern includes, for example, information about vulnerabilities used by the selected attack pattern, and countermeasure information. The vulnerability information may be the same as the vulnerability information included in the notification shown in FIG. 5. The countermeasure information may be the same as the countermeasure information included in the notification shown in FIG. 5.

A seventh specific example of visualization will be described. FIG. 12 shows an example of visualization in the seventh specific example. The common information aggregation unit 102 extracts the attack patterns used in the attack routes from the risk analysis results of all systems. The common information aggregation unit 102 identifies attack routes related to the attack patterns and counts the number of identified attack routes. The common information aggregation unit 102 also obtains risk values for the identified attack routes, and obtains a maximum risk value and an average risk value. The common information aggregation unit 102 also obtains countermeasures against the attack patterns.

The risk visualization unit 103 displays the attack patterns used in the attack routes, the number of associated attack routes, the maximum risk value, the average risk value, and the countermeasures. The risk visualization unit 103 may sort the attack patterns, for example, by the number of attack routes, and display the attack patterns with the largest number of associated attack routes at the top. Alternatively, the risk visualization unit 103 may display a ranking of countermeasures that are effective for the entire system at the top. The risk visualization unit 103 may allow the overall system administrator to select a countermeasure from a pull-down menu, and display information about the attack patterns related to the selected countermeasure.

By referring to the table shown in Figure 12, the overall system administrator can understand attack patterns that have a large number of associated attack routes across multiple systems and will have a large impact if exploited. This allows the overall system administrator to efficiently consider countermeasures for the entire system. In other words, when there are vulnerabilities in various systems, the overall system administrator can efficiently consider what countermeasures should be implemented overall to reduce risk.

The overall system administrator can select an attack pattern in the table displayed in FIG. 12. The risk visualization unit 103 may identify systems in which the selected attack pattern is used in an attack route, and send a notification including information about the attack pattern to the individual system administrator in charge of the identified system. The information about the attack pattern includes, for example, information about the attack route related to the selected attack pattern, information about vulnerabilities used, and countermeasure information. The attack route information may be the same as the attack route information included in the notification shown in FIG. 8. The vulnerability information may be the same as the vulnerability information included in the notification shown in FIG. 8. The countermeasure information may be the same as the countermeasure information included in the notification shown in FIG. 5.

An eighth specific example of visualization will now be described. FIG. 13 shows an example of visualization in the eighth specific example. The common information aggregation unit 102 extracts vulnerabilities that can be exploited in attacks from the risk analysis results of all systems. The common information aggregation unit 102 identifies attack routes in which vulnerabilities appear, i.e., attack routes in which vulnerabilities are exploited, and counts the number of identified attack routes. The common information aggregation unit 102 also obtains the maximum risk value of the identified attack routes. For each of the extracted vulnerabilities, the common information aggregation unit 102 obtains the presence or absence of exploitation cases, the presence or absence of attack code, the presence or absence of verification code, and the CVSS score. These various pieces of information on vulnerabilities may be obtainable from an external server, for example, via the Internet.

The risk visualization unit 103 displays the vulnerability to be exploited, whether or not the vulnerability has been exploited, the maximum risk value in the attack route, whether or not there is attack code, whether or not there is verification code, the CVSS score, and the number of times the vulnerability appears in the attack route. By referring to the table shown in FIG. 13, the overall system administrator can grasp the vulnerabilities that are at high risk of being exploited across multiple systems. This allows the overall system administrator to efficiently consider countermeasures for the entire system.

The overall system administrator can select a vulnerability in the table displayed in FIG. 13. The risk visualization unit 103 may identify a system having an attack route in which the selected vulnerability appears, and send a notification including information about the vulnerability to the individual system administrator in charge of the identified system. The information about the vulnerability includes, for example, information about the related system and countermeasure information. The information about the related system may be the same as the information about the related system shown in FIG. 5. The countermeasure information may be the same as the countermeasure information included in the notification shown in FIG. 5.

Next, the operation procedure will be explained. Figure 14 shows the operation procedure of the information processing device 100. The operation procedure of the information processing device 100 is also called a risk visualization method. The collection unit 101 collects multiple risk analysis results 201 performed on multiple systems 200-1 to 200-N (see Figure 3) (step S1). The collection unit 101 registers information about attacks obtained from the multiple risk analysis results 201 in the attack information DB 120. The collection unit 101 also registers information about countermeasures obtained from the risk analysis results 201 in the countermeasure information DB 130.

The common information aggregation unit 102 aggregates multiple risk analysis results, for example by aggregating information common to multiple systems, based on the information on attacks registered in the attack information DB 120 and the information on countermeasures registered in the countermeasure information DB 130 (step S2). The common information aggregation unit 102 aggregates multiple risk analysis results, for example, from the perspective of systems, attack routes, attack steps, or vulnerabilities. The common information aggregation unit 102 registers the aggregated information in the aggregated information DB 140. The risk visualization unit 103 reads the registered information from the aggregated information DB 140 and visualizes the risks present in the multiple systems based on the read information (step S3). The risk visualization unit 103 visualizes the risks contained in the multiple systems as a whole, for example, using the visualization methods of the first to eighth specific examples described above.

In this embodiment, the common information aggregation unit 102 aggregates multiple risk analysis results from a predetermined perspective, and the risk visualization unit 103 displays the aggregated risk analysis results. For example, the common information aggregation unit 102 aggregates multiple risk analysis results to count the number of systems related to a specific vulnerability, the number of assets related to a specific vulnerability in multiple systems, or the number of attack routes, or the number of attack routes for each risk value. The risk visualization unit 103 provides the information aggregated across multiple systems to the overall system administrator. By using the information provided by the risk visualization unit 103, the overall system administrator can easily grasp the risk of multiple systems as a whole. In addition, the overall system administrator can consider the priority order of countermeasures, etc.

Furthermore, in this embodiment, the risk visualization unit 103 can send a notification related to the selected information to the individual system administrator. The individual system administrator can analyze threats contained in the system for which he is responsible by referring to the information contained in the notification. Furthermore, the individual system administrator can plan countermeasures against threats.

Next, a second embodiment of the present disclosure will be described. FIG. 15 shows an information processing device according to the second embodiment of the present disclosure. The information processing device 100a according to this embodiment has a countermeasure cost DB 150 in addition to the configuration of the information processing device 100 described in the first embodiment shown in FIG. 2. The countermeasure cost DB 150 stores the cost or expense when a countermeasure is introduced for each of a plurality of countermeasures that can be introduced into a plurality of systems. The countermeasure cost DB 150 is also called a countermeasure cost information storage unit.

FIG. 16 shows an example of information stored in countermeasure cost DB 150. In this example, countermeasure cost DB 150 stores countermeasure costs of "10k" and "1M" for countermeasure 0 and countermeasure 1, respectively. The unit of countermeasure cost may be a currency unit, such as Japanese yen. When a volume discount is applied to the introduction of a countermeasure, countermeasure cost DB 150 may further store the discount rate and the number of units to which the discount is reflected. In the example of FIG. 16, countermeasure cost DB 150 stores information indicating that a 10% discount is applied to countermeasure 1 when 20 units are introduced at once.

In this embodiment, the common information aggregation unit 102 aggregates information about multiple systems for each countermeasure that may be introduced based on the risk analysis results for the multiple systems. The risk visualization unit 103 visualizes the aggregated countermeasure information. In visualizing the aggregated countermeasure information, the risk visualization unit 103 obtains the countermeasure cost from the countermeasure cost DB 150 and displays the cost if the countermeasure is introduced. In addition to the countermeasure cost, the risk visualization unit 103 may also display the number to which a volume discount is applied and the discount rate.

FIG. 17 shows a specific example of visualization in this embodiment. The common information aggregation unit 102 aggregates, for example, for each countermeasure that can be introduced, the number of attack patterns that can be countered, the number of systems to which the countermeasure will be introduced, and the number of countermeasure locations. The risk visualization unit 103 displays the number of attack patterns that can be countered, the number of systems to which the countermeasure will be introduced, and the number of countermeasure locations. In addition, the risk visualization unit 103 obtains the countermeasure cost of each countermeasure from the countermeasure cost DB 150, and displays the obtained countermeasure cost of each countermeasure.

In this embodiment, the risk visualization unit 103 provides the overall system administrator with information on the number of attack patterns that can be countered, the number of systems to which the countermeasures will be introduced, the number of countermeasure locations, and the cost of the countermeasures. In this case, the overall system administrator can know information such as how much the countermeasures will cost when countermeasures are introduced, how many attack patterns the countermeasures can be applied to, and how many systems the countermeasures can be applied to. Therefore, the overall system administrator can prioritize highly efficient countermeasures, taking into consideration the countermeasures cost, the number of attack patterns that can be countered, and the number of systems. Also, in this embodiment, if there is a volume discount, the overall system administrator can know the number of items to which the volume discount is applied and the discount rate, and can use such information when planning countermeasures.

Next, the physical configuration of the information processing device 100 will be described. Figure 18 shows an example configuration of a computer device that can be used as the information processing device 100. The computer device 500 has a control unit (CPU: Central Processing Unit) 510, a storage unit 520, a ROM (Read Only Memory) 530, a RAM (Random Access Memory) 540, a communication interface (IF: Interface) 550, and a user interface 560. The control unit 501 is also called a processor.

The communication interface 550 is an interface for connecting the computer device 500 to a communication network via a wired communication means or a wireless communication means. The user interface 560 includes a display unit such as a display. The user interface 560 also includes an input unit such as a keyboard, a mouse, and a touch panel.

The storage unit 520 is an auxiliary storage device that can hold various types of data. The storage unit 520 does not necessarily have to be a part of the computer device 500, and may be an external storage device or cloud storage connected to the computer device 500 via a network. The storage unit 520 may be used, for example, as at least one of the attack information DB 120, countermeasure information DB 130, and aggregated information DB 140 shown in FIG. 2.

ROM 530 is a non-volatile storage device. For example, a semiconductor storage device with a relatively small capacity, such as a flash memory, is used for ROM 530. Programs executed by CPU 510 can be stored in storage unit 520 or ROM 530. Storage unit 520 or ROM 530 stores various programs for implementing the functions of each unit in information processing device 100, for example.

The program includes instructions (or software code) that, when loaded into a computer, causes the computer to perform one or more functions described in the embodiments. The program may be stored on a non-transitory computer-readable medium or a tangible storage medium. By way of example and not limitation, computer-readable media or tangible storage media include RAM, ROM, flash memory, solid-state drive (SSD) or other memory technology, Compact Disc (CD), digital versatile disc (DVD), Blu-ray (registered trademark) disc or other optical disk storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices. The program may be transmitted on a transitory computer-readable medium or a communication medium. By way of example and not limitation, transitory computer-readable media or communication media include electrical, optical, acoustic, or other forms of propagated signals.

RAM 540 is a volatile storage device. Various semiconductor memory devices such as DRAM (Dynamic Random Access Memory) or SRAM (Static Random Access Memory) are used for RAM 540. RAM 540 can be used as an internal buffer for temporarily storing data, etc. CPU 510 deploys a program stored in storage unit 520 or ROM 530 into RAM 540 and executes it. The functions of each part of information processing device 100 can be realized by CPU 510 executing a program. CPU 510 may have an internal buffer in which data, etc. can be temporarily stored.

The above describes the embodiments of the present disclosure in detail, but the present disclosure is not limited to the above-described embodiments, and the present disclosure also includes changes and modifications to the above-described embodiments that do not deviate from the spirit of the present disclosure.

For example, some or all of the above embodiments can be described as follows, but are not limited to the following:

[Appendix 1]
an analysis result acquisition unit that acquires a plurality of risk analysis results that are results of risk analysis performed on each of the plurality of systems;
an aggregation unit that aggregates a plurality of risk analysis results using a predetermined evaluation index;
and a visualization unit that presents the aggregated risk analysis result information to a user.

[Appendix 2]
2. The information processing device according to claim 1, wherein the risk analysis result includes a risk value in the event that an attack is carried out and a vulnerability used in the attack.

[Appendix 3]
the predetermined evaluation index is the number of the systems;
The aggregation unit counts, for each of a predetermined number of vulnerabilities, the number of systems in which the vulnerability is used in an attack;
The information processing device according to claim 2, wherein the visualization unit displays the number of systems counted for each of the predetermined number of vulnerabilities.

[Appendix 4]
The information processing device according to claim 3, wherein the aggregation unit selects the predetermined number of vulnerabilities based on a risk level of the vulnerability.

[Appendix 5]
The risk analysis result includes a risk analysis result that evaluates a risk when an attack is carried out on the assets of the analysis target system using one or more assumed attack patterns,
the predetermined evaluation index is the number of assets included in the system;
The aggregation unit counts, for each of a predetermined number of vulnerabilities and for each of a predetermined number of systems, the number of assets in the systems that are used in attacks by the vulnerabilities;
The information processing device according to claim 2, wherein the visualization unit displays the number of assets counted for each of the predetermined number of vulnerabilities and for each of the predetermined number of systems.

[Appendix 6]
the risk analysis result includes a risk analysis result evaluating a risk in the event that an attack is made against the system along an attack route;
the predetermined evaluation index is the number of attack routes;
The aggregation unit counts the number of attack routes associated with the vulnerabilities for each of a predetermined number of vulnerabilities and for each of a predetermined number of systems;
The information processing device according to claim 2, wherein the visualization unit displays the number of attack routes counted for each of the predetermined number of vulnerabilities and for each of the predetermined number of systems.

[Appendix 7]
the risk analysis result includes a risk analysis result evaluating a risk in the event that an attack is made against the system along an attack route;
the predetermined evaluation index is the number of attack routes;
The aggregation unit counts the number of attack routes for each risk value of the attack route and for each predetermined number of systems;
The information processing device according to claim 2, wherein the visualization unit displays the number of attack routes counted for each risk value of the attack route and for each of a predetermined number of systems.

[Appendix 8]
The information processing device according to claim 7, wherein the visualization unit displays the number of attack routes counted for each risk value of the attack route and for each predetermined number of systems using a table, a bar graph, or a radar chart.

[Appendix 9]
the risk analysis result includes a risk analysis result that evaluates a risk when an attack is made against the system along an attack route that is an attack route from an intrusion point included in the system to be analyzed to a target of attack, the attack route including one or more attack steps including an attack source, an attack destination, and an attack pattern;
the predetermined evaluation index is the number of attack routes;
The aggregation unit identifies vulnerabilities used in each of a plurality of attack patterns, and counts the number of attack routes related to the identified vulnerabilities;
3. The information processing device according to claim 2, wherein the visualization unit displays the identified vulnerabilities and the number of counted attack routes for each of the multiple attack patterns.

[Appendix 10]
the risk analysis result includes a risk analysis result evaluating a risk in the event that an attack is made against the system along an attack route;
the predetermined evaluation index is the number of attack routes;
The aggregation unit counts, for each vulnerability used in an attack on the plurality of systems, a number of attack routes associated with the vulnerability;
The information processing device according to claim 2, wherein the visualization unit displays the number of attack routes counted for each vulnerability.

[Appendix 11]
the risk analysis result includes a risk analysis result that evaluates a risk when an attack is made against the system along an attack route that is an attack route from an intrusion point included in the system to be analyzed to a target of attack, the attack route including one or more attack steps including an attack source, an attack destination, and an attack pattern;
the predetermined evaluation index is the number of attack routes;
The aggregation unit identifies an attack pattern used in the attack route, and counts the number of attack routes related to the identified attack pattern;
3. The information processing device according to claim 1, wherein the visualization unit displays the identified attack pattern and the number of the counted attack routes.

[Appendix 12]
The aggregation unit further aggregates the plurality of risk analysis results for each countermeasure against an attack on the system,
12. The information processing device according to any one of claims 1 to 11, wherein the visualization unit further displays information of risk analysis results aggregated for each of the countermeasures.

[Appendix 13]
The aggregation unit counts the number of systems to which the countermeasures can be introduced and the number of locations to which the countermeasures can be introduced;
13. The information processing device according to claim 12, wherein the visualization unit displays, for each of the countermeasures, the number of systems in which the countermeasure can be introduced and the number of locations where the countermeasure can be introduced.

[Appendix 14]
The information processing device according to claim 12 or 13, wherein the visualization unit acquires the countermeasure costs from a countermeasure cost information storage unit that stores countermeasure costs indicating the cost when the countermeasure is implemented, and displays the countermeasure costs for each of the countermeasures.

[Appendix 15]
The countermeasure cost information storage unit further stores the number of items to be discounted and a discount rate;
The information processing device according to claim 14, wherein the visualization unit further displays, for each of the measures, the number of the discounts to be implemented and a discount rate.

[Appendix 16]
obtaining a plurality of risk analysis results that are results of a risk analysis performed on each of the plurality of systems;
aggregating the acquired multiple risk analysis results using a predetermined evaluation index;
A risk visualization method comprising presenting information of the aggregated risk analysis results to a user.

[Appendix 17]
obtaining a plurality of risk analysis results that are results of a risk analysis performed on each of the plurality of systems;
aggregating the acquired multiple risk analysis results using a predetermined evaluation index;
A non-transitory computer-readable medium storing a program for causing a computer to execute a process including presenting information of the aggregated risk analysis results to a user.

10: Information processing device 11: Analysis result acquisition unit 12: Aggregation unit 13: Visualization unit 20: Risk analysis result 100: Information processing device 101: Collection unit 102: Common information aggregation unit 103: Risk visualization unit 120: Attack information DB
130: Countermeasure information DB
140: Aggregated information DB
200: System 201: Risk analysis result 500: Computer device 510: CPU
520: Storage unit 530: ROM
540: RAM
550: Communication IF
560: User IF

Claims

an analysis result acquisition unit that acquires a plurality of risk analysis results that are results of risk analysis performed on each of the plurality of systems;
an aggregation unit that aggregates a plurality of risk analysis results using a predetermined evaluation index;
and a visualization unit that presents the aggregated risk analysis result information to a user.
The information processing device according to claim 1, wherein the risk analysis result includes a risk value in the event that an attack is carried out and a vulnerability used in the attack.
the predetermined evaluation index is the number of the systems;
The aggregation unit counts, for each of a predetermined number of vulnerabilities, the number of systems in which the vulnerability is used in an attack;
The information processing apparatus according to claim 2 , wherein the visualization unit displays the number of systems counted for each of the predetermined number of vulnerabilities.
The information processing device according to claim 3, wherein the aggregation unit selects the predetermined number of vulnerabilities based on the risk of the vulnerabilities.
The risk analysis result includes a risk analysis result that evaluates a risk when an attack is carried out on the assets of the analysis target system using one or more assumed attack patterns,
the predetermined evaluation index is the number of assets included in the system;
The aggregation unit counts, for each of a predetermined number of vulnerabilities and for each of a predetermined number of systems, the number of assets in the systems that are used in attacks by the vulnerabilities;
The information processing apparatus according to claim 2 , wherein the visualization unit displays the number of assets counted for each of the predetermined number of vulnerabilities and for each of the predetermined number of systems.
the risk analysis result includes a risk analysis result evaluating a risk in the event that an attack is made against the system along an attack route;
the predetermined evaluation index is the number of attack routes;
The aggregation unit counts the number of attack routes associated with the vulnerabilities for each of a predetermined number of vulnerabilities and for each of a predetermined number of systems;
The information processing device according to claim 2 , wherein the visualization unit displays the number of attack routes counted for each of the predetermined number of vulnerabilities and for each of the predetermined number of systems.
the risk analysis result includes a risk analysis result evaluating a risk in the event that an attack is made against the system along an attack route;
the predetermined evaluation index is the number of attack routes;
The aggregation unit counts the number of attack routes for each risk value of the attack route and for each predetermined number of systems;
The information processing device according to claim 2 , wherein the visualization unit displays the number of attack routes counted for each risk value of the attack route and for each of a predetermined number of systems.
The information processing device according to claim 7, wherein the visualization unit uses a table, a bar graph, or a radar chart to display the number of attack routes counted for each risk value of the attack route and for each predetermined number of systems.
the risk analysis result includes a risk analysis result that evaluates a risk when an attack is made against the system along an attack route that is an attack route from an intrusion point included in the system to be analyzed to a target of attack, the attack route including one or more attack steps including an attack source, an attack destination, and an attack pattern;
the predetermined evaluation index is the number of attack routes;
The aggregation unit identifies vulnerabilities used in each of a plurality of attack patterns, and counts the number of attack routes related to the identified vulnerabilities;
The information processing device according to claim 2 , wherein the visualization unit displays the identified vulnerabilities and the number of the counted attack routes for each of the plurality of attack patterns.
the risk analysis result includes a risk analysis result evaluating a risk in the event that an attack is made against the system along an attack route;
the predetermined evaluation index is the number of attack routes;
The aggregation unit counts, for each vulnerability used in an attack on the plurality of systems, a number of attack routes associated with the vulnerability;
The information processing device according to claim 2 , wherein the visualization unit displays the number of attack routes counted for each vulnerability.
the risk analysis result includes a risk analysis result that evaluates a risk when an attack is made against the system along an attack route that is an attack route from an intrusion point included in the system to be analyzed to a target of attack, the attack route including one or more attack steps including an attack source, an attack destination, and an attack pattern;
the predetermined evaluation index is the number of attack routes;
The aggregation unit identifies an attack pattern used in the attack route, and counts the number of attack routes related to the identified attack pattern;
The information processing device according to claim 1 , wherein the visualization unit displays the identified attack pattern and the number of the counted attack routes.
The aggregation unit further aggregates the plurality of risk analysis results for each countermeasure against an attack on the system,
The information processing apparatus according to claim 1 , wherein the visualization unit further displays information on the risk analysis results summarized for each of the countermeasures.
The aggregation unit counts the number of systems to which the countermeasures can be introduced and the number of locations to which the countermeasures can be introduced;
The information processing device according to claim 12 , wherein the visualization unit displays, for each of the countermeasures, the number of systems in which the countermeasure can be introduced and the number of locations to which the countermeasure can be introduced.
The information processing device according to claim 12 or 13, wherein the visualization unit acquires the countermeasure costs from a countermeasure cost information storage unit that stores countermeasure costs indicating the cost when the countermeasure is implemented, and displays the countermeasure costs for each countermeasure.
The countermeasure cost information storage unit further stores the number of items to be discounted and a discount rate;
The information processing device according to claim 14 , wherein the visualization unit further displays, for each of the measures, the number of the discounts to be implemented and a discount rate.
obtaining a plurality of risk analysis results that are results of a risk analysis performed on each of the plurality of systems;
aggregating the acquired multiple risk analysis results using a predetermined evaluation index;
A risk visualization method comprising presenting information of the aggregated risk analysis results to a user.
obtaining a plurality of risk analysis results that are results of a risk analysis performed on each of the plurality of systems;
aggregating the acquired multiple risk analysis results using a predetermined evaluation index;
A non-transitory computer-readable medium storing a program for causing a computer to execute a process including presenting information of the aggregated risk analysis results to a user.