JP2010250677A - Security-evaluating device, security-evaluating method for security-evaluating device, and security-evaluating program for security-evaluating device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To check whether a user correctly identifies (recognizes) a security measure, and understands and conducts the security measure to adequately evaluate the degree of infiltration into the user of the security measure. <P>SOLUTION: A security determination data storage part 141 stores, in a storage device, evaluation determination data for evaluating the degrees of recognition, understanding and execution. A computation part 131 inputs the evaluation determination data and computes, through a processing device, a value of the degree of the recognition which indicates at what degree the user recognizes the security measure, a value of the degree of the understanding which indicates at what degree the user understands the security measure, and a value of the degree of the execution which indicates at what degree the user executes the security measure. An operational state-evaluating part 132 evaluates, through the processing device, a security measure-operated state by using an operational state evaluation reference which is preliminarily stored in the storage device on the basis of the value of the degree of the recognition, the value of the degree of the understanding and the value of the degree of the execution, which are all computed by the computation part 131, to store the security measure-operated state, as a result of an operational state evaluation, in an evaluation result storage part 137. <P>COPYRIGHT: (C)2011,JPO&INPIT

Description

  The present invention relates to a security evaluation device, a security evaluation method, and a security evaluation program for evaluating the operational status of security measures of an organization.

  As a conventional technology that supports the operation management of information security in an organization, the difference between the current security policy of the organization and the actual security operation status of the organization is analyzed, and the security policy of the organization is adjusted by adjusting the security operation rules in the organization. There is a method of improving (Patent Document 1). As another conventional technique, there is a technical method in which a security audit on an information device connected to a network is automatically performed by periodically collecting log information and the like and a security measure to be improved is identified ( Patent Document 2).

JP 2002-056176 A JP 2004-185455 A

  In the conventional technology, when managing information security operations, end users are implemented measures that are instructed within the organization by interviews and questionnaires, and by acquiring data such as PC settings from network-connected devices. I was checking whether or not. However, such a method has the following problems.

  First, there is a problem that it is impossible to detect potential risks that cannot be understood unless an accident occurs only by collecting the implementation status. For example, in recent years, many cases of information leakage incidents due to theft of PCs taken outside the office have been reported. As a normal business condition, end users who take out PCs can check the implementation status of taking out PCs, but they do not have to take out PCs for business purposes. For end users who have never been there, the implementation status cannot be confirmed because it has never been done. When such an end user is not aware of the measures for taking out the PC, there is a high risk of an information leakage accident when taking out the PC. This risk is only recognized when an accident occurs.

  Second, there is a problem that even if the implementation status of security measures is acquired on the IT system, the root cause when a security accident occurs is not known. For example, if it is confirmed that a certain end user has not implemented the specified security measures, whether the security measures have been temporarily implemented for the convenience of work or the specified security It is not possible to determine whether it was not implemented because it did not recognize that it was a policy item. In the former case, the end user should be thoroughly instructed to implement the relevant security measures at the timing when the work that causes them ends. In the latter case, the end users need to be retrained about the relevant security measures. become. If there are many end users such as the latter in the organization, it may be necessary to review the security policy instruction method. Thus, when a certain security measure has not been implemented, different measures must be taken depending on the cause.

  The present invention has been made to solve the above-described problems, and by confirming whether the end user correctly identifies (recognizes), understands and implements the security measure, the security measure for the end user is confirmed. Provided is a system capable of appropriately measuring the degree of penetration and presenting an appropriate countermeasure based on the confirmed result.

The security evaluation device in the present invention is:
In a security evaluation device that evaluates the operational status of security measures in an organization,
A security determination data storage unit that stores recognition determination data for determining a recognition status of the security measure in the organization and an execution determination data for determining an implementation status of the security measure in the organization in a storage device;
The degree to which the user recognizes the security measure based on the input recognition determination data and the execution determination data by inputting the recognition determination data and the execution determination data from the security determination data storage unit And a calculation unit that calculates a value of the degree of recognition indicating the degree of implementation and the degree of implementation indicating the degree of implementation of the security measure by the user,
Based on the recognition level value and the implementation level value calculated by the calculation unit, the operation status of the security measure is evaluated by a processing device using an operation status evaluation criterion stored in advance in a storage device. And an operation status evaluation unit that stores the operation status evaluation result in a storage device.

  The security evaluation device according to the present invention is a security evaluation device that evaluates the operational status of a security measure in an organization, wherein the security judgment data storage unit recognizes the recognition status of the security measure in the organization, Implementation determination data for determining the implementation status of the security measure in the organization is stored in a storage device, the calculation unit inputs the recognition determination data and the implementation determination data from the security determination data storage unit, Based on the input recognition determination data and the execution determination data, the degree of recognition indicating the degree of recognition of the security measure by the user and the degree of implementation of the security measure by the user are indicated. The implementation level value is calculated by the processing device, and the operation status evaluation unit Based on the recognition level value and the implementation level value calculated by the calculation unit, the operation status of the security measure is evaluated by a processing device using an operation status evaluation criterion stored in advance in a storage device. As the operation status evaluation result is stored in the storage device, it is possible to check whether the end user is correctly recognizing (identifying and understanding) the security measure and confirming the penetration of the security measure to the end user. It is possible to provide a security management device that can be more appropriately evaluated.

2 is a functional block diagram of the information security management apparatus 100 according to Embodiment 1. FIG. It is a figure which shows an example of the external appearance of the security management apparatus 100 which concerns on embodiment. It is a figure which shows an example of the hardware resource of the security management apparatus 100 which concerns on embodiment. 6 is a flowchart of evaluation information design processing and evaluation information storage processing by the design unit 110 according to Embodiment 1. FIG. It is a figure which shows an example of the evaluation determination data information storage part 121 which the evaluation determination data information design part 111 in Embodiment 1 memorize | stores. 6 is a diagram illustrating an example of a risk improvement measure information storage unit 123 stored by a risk improvement measure design unit 113 according to Embodiment 1. FIG. 6 is a diagram illustrating an example of an evaluation formula information storage unit 122 stored by an evaluation formula design unit 112 according to Embodiment 1. FIG. It is a flowchart which shows the evaluation determination data acquisition process and operation condition evaluation process which concern on Embodiment 1. 6 is a flowchart showing risk inquiry processing according to Embodiment 1. FIG. 6 is a functional block configuration diagram of a security management device 100 according to Embodiment 2. FIG. FIG. 10 is a flowchart showing a flow of an evaluation result three-dimensional graph display process of an evaluation result three-dimensional display unit 138 according to Embodiment 2. 10 is a diagram illustrating an example of an evaluation result three-dimensional graph displayed on a display device in Embodiment 2. FIG. FIG. 10 is a diagram illustrating a functional block configuration diagram of a security management device 100 according to a third embodiment. FIG. 10 is a flowchart showing a flow of correlation analysis processing of a correlation analysis unit 139 according to Embodiment 3.

  Embodiments of the present invention will be described below with reference to the drawings.

Embodiment 1 FIG.
In this embodiment, the operational status of security measures within an organization (hereinafter also referred to as a user) such as a company, office, or government office is evaluated, and an evaluation result (evaluation level) is output. The security management apparatus 100 that can present a risk improvement measure and the like to the user will be described. The security management device 100 is an example of a security evaluation device. That is, the security management apparatus 100 according to the first embodiment is a security management apparatus 100 for the purpose of confirming whether or not the security measure in the organization is being implemented by the end user.

  The security measure in the organization (user) means an individual measure for enhancing the security in the organization. For example, various security measures, such as “Periodic Check Execution Measures by Security Program”, “Prohibition to Take Outside PCs”, “Obligation to Obtain Access Rights to Secret Files”, and “Security Software Execution Measures” There is. In the following, a user means an organization such as a company that implements security measures or individual users in the organization, and the security management apparatus 100 is actually used by an administrator 400 (security administrator) within the user. ). Hereinafter, the administrator 400 who is a member of the user may be referred to as a “user”. In addition, an individual who actually implements security measures by a user (organization) may be called an end user.

  FIG. 1 is a functional block diagram of an information security management apparatus 100 according to the first embodiment. The function of each functional block of the security management device 100 will be described with reference to FIG.

  The security management apparatus 100 according to the present embodiment uses the degree of recognition, the degree of understanding, and the degree of implementation as an evaluation scale for evaluating the operational status of security measures in the organization. The degree of recognition is a value indicating how much the end user recognizes the security measure in the user (organization). The degree of understanding is a value indicating how much the end user understands the security measure in the user. The implementation level is a value indicating the degree of security measures implemented by the end user within the user. That is, the values of recognition level, understanding level, and implementation level can be expressed as percentages. In the security management device 100, determining the degree of recognition, the degree of understanding, and the degree of implementation means, for example, that the values of the degree of recognition, the degree of understanding, and the degree of implementation are expressed as percentages.

  The security management apparatus 100 includes a design unit 110, an evaluation information storage unit 120, an evaluation unit 130, an evaluation determination data acquisition unit 140, a security determination data storage unit 141, a root risk identification unit 150, and a risk countermeasure presentation unit 160.

  The design unit 110 and the evaluation information storage unit 120 correspond to an administrator 400 (user) who wants to evaluate the operational status of security measures in the organization using the security management apparatus 100 for each of the plurality of security measures in the organization. A function (interface, etc.) for setting evaluation information and the like necessary for evaluating a security measure using an input device is provided. In addition, the design unit 110 and the evaluation information storage unit 120 implement security measures based on data input from the administrator 400 via an input device or data acquired from an information system database in the user (organization). Evaluation information necessary for evaluation is stored in a storage device.

  The design unit 110 includes an evaluation determination data information design unit 111, an evaluation formula design unit 112, a risk improvement measure design unit 113, and a question generation unit 114. The evaluation information storage unit 120 includes an evaluation determination data information storage unit 121, an evaluation formula information storage unit 122, and a risk improvement measure information storage unit 123.

  The evaluation judgment data information design unit 111 evaluates the degree of penetration of the security measure to the end user in the organization for each evaluation scale (recognition degree, understanding degree and implementation degree). Evaluation determination data information is set for each implementation degree), and the set evaluation determination data information is stored in the evaluation determination data information storage unit 121. For example, the evaluation determination data information design unit 111 sets evaluation determination data information for each evaluation scale (recognition degree, understanding degree, and implementation degree) based on an input from a user (such as the administrator 400) via an input device. To do. The evaluation determination data information indicates evaluation determination data to be acquired in order to determine the evaluation scale (recognition level, understanding level, and implementation level) of the corresponding security measure. For example, the evaluation determination data information for determining the degree of recognition of the security measure A “regular execution of the security program A” is “whether or not there is access to a specified URL in which the execution procedure of the security program A is written”. Or “specified URL access time”.

  In order to determine the degree of penetration of security measures within the organization for each evaluation scale (recognition, comprehension and implementation), the organization conducts questionnaires and interviews with end users. The question generation unit 114 generates a question for a questionnaire or interview with the end user. For example, the question generation unit 114 generates a question for each evaluation scale based on an input from a user (such as the administrator 400) via the input device. Further, the question generation unit 114 generates aggregate sample information of end user answer data for the generated questions for each evaluation scale. The question generation unit 114 outputs the total information of the answer data to the evaluation determination data information design unit 111 as evaluation determination data information for each evaluation scale. The evaluation determination data information design unit 111 may set the total sample information of the totaled answer data as evaluation determination data information for each evaluation scale.

  Further, the evaluation determination data information design unit 111 sets an evaluation criterion for each data that is a criterion for evaluating the specified evaluation determination data information. For example, the evaluation determination data information design unit 111 sets an evaluation criterion for each data corresponding to the evaluation determination data information based on an input from a user (such as the administrator 400) via the input device. Alternatively, for example, an evaluation satisfaction condition such as “OK when access time is 5 minutes or more” is set as an evaluation criterion for each data with respect to the evaluation determination data information “access time to specified URL”. Here, a plurality of pieces of evaluation determination data information may be specified for each evaluation scale (recognition level, understanding level, and implementation level). The evaluation determination data information design unit 111 sets a corresponding evaluation criterion for each piece of evaluation determination data information specified for each evaluation scale (recognition level, understanding level, and implementation level). And stored in the evaluation determination data information storage unit 121. Here, there may be a plurality of evaluation criteria for each data corresponding to one piece of evaluation determination data information. Details of the evaluation determination data information storage unit 121 will be described later.

  The risk improvement measure design unit 113 sets a risk improvement measure corresponding to the evaluation determination data information for each evaluation scale (recognition level, understanding level, and implementation level). The risk improvement measure design unit 113, for example, evaluation determination data information set for each evaluation scale (recognition degree, understanding degree, and implementation degree) based on an input from a user (such as the administrator 400) via an input device. Corresponding risk improvement measures. The corresponding risk improvement measure is when the corresponding evaluation judgment data information does not satisfy the evaluation criteria for each data (for example, the data of the evaluation judgment data information “presence of access to specified URL” is less than 5 minutes) The risk improvement measures that the user should take. The risk improvement measure design unit 113 sets a corresponding risk improvement measure for the evaluation determination data information and stores it in the risk improvement measure information storage unit 123.

  The evaluation formula design unit 112 sets a plurality of evaluation levels that represent the rating of the evaluation of the operational status of the security measure, and for each evaluation level of the set plurality of evaluation levels, the corresponding understanding level and recognition level And a combination of the value of the implementation level and the operation condition evaluation criteria (hereinafter, also referred to as an evaluation expression) are stored in the evaluation expression information storage unit 122 which is a storage device. The evaluation formula design unit 112 is an example of an evaluation standard setting unit.

  The evaluation formula design unit 112 sets an evaluation formula (operation status evaluation standard) for determining the evaluation level and stores it in the evaluation formula information storage unit 122. The evaluation formula design unit 112 sets an evaluation formula based on an input from a user (such as the administrator 400) via the input device, for example. For example, with respect to security A, “evaluation level 1 (if risk measures are not required)” for security A is 90% or more, and “evaluation level 2 if implementation is 90%” (Immediate action is not required).

  The above description is a functional block for the design unit 110 to perform processing for setting the evaluation information storage unit 120. Next, functional blocks in which the security management apparatus 100 inputs a security measure evaluation request from the administrator 400 or the like and performs an evaluation process for the corresponding security measure will be described.

  The evaluation unit 130 includes a calculation unit 131 and an operation status evaluation unit 132. The calculation unit 131 includes a measure recognition level analysis unit 133, a measure understanding level analysis unit 134, and a measure implementation level analysis unit 135. The operation status evaluation unit 132 includes an evaluation zone calculation unit 136 and an evaluation result storage unit 137.

  The evaluation unit 130 inputs a security measure evaluation request (including a security measure to be evaluated and a user ID (organization ID)) from the administrator 400 via an input device, and performs an evaluation process on the corresponding security measure for the corresponding user. Execute.

  The evaluation unit 130 uses the evaluation determination data in the evaluation information storage unit 120 as a list of evaluation determination data information for evaluating the end user correctly identifying (recognizing), understanding, and implementing security measures. Obtained from the information storage unit 121. The evaluation unit 130 outputs an evaluation determination data acquisition request to the evaluation determination data acquisition unit 140 based on the acquired list of evaluation determination data information.

  In accordance with the evaluation determination data acquisition request input from the evaluation unit 130, the evaluation determination data acquisition unit 140 receives information stored in an information system database (storage device) or the like within the organization, or input from an end user (answer data) The necessary evaluation determination data is acquired from the information etc.) and stored in the storage device. That is, the evaluation determination data acquisition unit 140 includes recognition determination data for determining the recognition status of the security measure for the user, understanding determination data for determining the understanding status of the security measure for the user, and implementation of the security measure for the user. Implementation determination data for determining the situation is stored as evaluation determination data in the security determination data storage unit 141 serving as a storage device.

  The calculation unit 131 calculates values for the evaluation scale (recognition level, understanding level, implementation level), that is, a recognition level value, an understanding level value, and an implementation level value. That is, the measure recognition degree analysis unit 133 inputs the recognition determination data from the security determination data storage unit 141, and based on the input recognition determination data, the recognition indicating the degree of recognition of the corresponding security measure by the corresponding user The degree value is calculated by the processing device. The measure understanding degree analysis unit 134 inputs the understanding determination data from the security determination data storage unit 141 and, based on the input understanding determination data, the degree of understanding indicating the degree that the corresponding user understands the corresponding security measure. The value is calculated by the processing device. The measure implementation degree analysis unit 135 inputs the execution determination data from the security determination data storage unit 141 and, based on the input execution determination data, the execution degree indicating the degree that the corresponding user implements the corresponding security measure. The value is calculated by the processing device.

  The operation status evaluation unit 132 stores the operation status of the security measure based on the recognition value, the understanding value, and the implementation value calculated by the calculation unit 131 in advance using the storage device as an evaluation formula information storage. The evaluation formula (operation status evaluation criteria) stored in the unit 122 is used for evaluation by the processing device, and the operation status evaluation result is stored in the evaluation result storage unit 137 as a storage device.

  The evaluation zone calculation unit 136 is a recognition value calculated by the calculation unit 131 from among a plurality of evaluation levels set in the evaluation formula (operational condition evaluation standard) stored in the evaluation formula information storage unit 122. And the evaluation level corresponding to the combination of the understanding value and the implementation value is acquired by the processing device. The evaluation zone calculation unit 136 stores information including the acquired evaluation level in the evaluation result storage unit 137 that is a storage device as an operation status evaluation result.

  The evaluation zone calculation unit 136 includes an evaluation target user ID, an evaluation target security measure, an evaluation scale value calculated for the evaluation target (a recognition value, an understanding value, and an implementation value), and an evaluation scale. The evaluation level acquired from the value is stored in the evaluation result storage unit 137 for each evaluation target as the operation status evaluation result. Further, the evaluation zone calculation unit 136 further associates the evaluation determination data corresponding to each evaluation scale (recognition level, understanding level, implementation level) of the evaluation target and the determination result based on the evaluation criteria for each data of the evaluation determination data. The determined information is also stored in the evaluation result storage unit 137 as the operation status evaluation result. Here, the evaluation target assumes each user ID (organization ID) and each security measure ID. However, the evaluation target may be for each end user and each security measure ID, and the operation status evaluation result may be stored in the evaluation result storage unit 137 for each end user and for each security measure ID.

  The evaluation unit 130 displays the operation status evaluation result stored in the evaluation result storage unit 137 on a display device or the like and presents it to the administrator 400. For example, the evaluation unit 130 associates the evaluation target user ID and the evaluation target security measure with the evaluation scale value (recognition value, understanding value, and implementation value) calculated for the evaluation target, The evaluation level obtained from the value of the evaluation scale, evaluation judgment data corresponding to each evaluation scale (recognition level, understanding level, implementation level), judgment results based on the evaluation criteria for each data of the evaluation judgment data, etc. are displayed together on the display device. May be.

  As described above, the security management apparatus 100 inputs a security measure evaluation request from the administrator 400 or the like, and performs an evaluation process of the corresponding security measure for the corresponding user. Next, a functional block of processing in which the security management device 100 inputs a risk inquiry request from the administrator 400 or the like via the input device and presents a risk improvement measure of the corresponding security measure for the corresponding user will be described.

  The root risk specifying unit 150 inputs a risk inquiry request (including a target security measure and a user ID (organization ID)) from the administrator 400 via the input device. The root risk identification unit 150 determines, from the operation status evaluation result stored in the evaluation result storage unit 137, evaluation determination data corresponding to each evaluation measure (recognition level, understanding level, implementation level) of the corresponding security measure of the corresponding user. The result (OK / NG) (whether or not the evaluation criteria for each data has been reached) is extracted. If there is evaluation judgment data that is NG, the risk information corresponding to the evaluation judgment data and the risk improvement measures are acquired and notified to the risk countermeasure presentation unit 160. In the case of evaluation determination data that is OK, there is no need to notify in particular, but the evaluation determination data that is OK may be displayed on the display device to call attention to maintain security in the future.

  After confirming the achievement status of the evaluation determination data for all evaluation measures, the root risk identification unit 150 determines that no additional measures are required and notifies the risk measure presentation unit 160 if no corresponding risk information is extracted. You don't have to. Finally, the risk countermeasure presentation unit 160 outputs (displays) the result notified from the root risk identification unit 150 to the display device.

  As described above, the security management system by the security management apparatus 100 is roughly divided into the following procedures. (1) Create evaluation information (evaluation judgment data information, evaluation formula) for evaluating the penetration of security measures to end users (evaluation information design phase), and (2) obtain implementation data required for evaluation Analyze and evaluate (operation status evaluation phase), and (3) present any necessary countermeasures if there is a problem (risk inquiry phase).

  FIG. 2 is a diagram illustrating an example of an appearance of the security management device 100 according to the following embodiment. In FIG. 2, the security management apparatus 100 includes a system unit 910, a display device 901 having a CRT (Cathode / Ray / Tube) or LCD (liquid crystal) display screen, a keyboard 902 (Key / Board: K / B), and a mouse 903. , FDD904 (Flexible Disk Drive), compact disk device 905 (CDD), printer device 906, scanner device 907, touch panel 908, and the like, which are connected by cables and signal lines. The system unit 910 is a computer, and is connected to the facsimile machine 932 and the telephone 931 via a cable, and is connected to the Internet 940 via a local area network 942 (LAN) and a gateway 941.

  FIG. 3 is a diagram illustrating an example of hardware resources of the security management device 100 according to the embodiment. In FIG. 3, the security management apparatus 100 includes a CPU 911 (also referred to as a central processing unit, a central processing unit, a processing unit, an arithmetic unit, a microprocessor, a microcomputer, or a processor) that executes a program. The CPU 911 is connected to the ROM 913, the RAM 914, the communication board 915, the display device 901, the keyboard 902, the mouse 903, the FDD 904, the CDD 905, the printer device 906, the scanner device 907, the touch panel 908, and the magnetic disk device 920 via the bus 912. Control hardware devices. Instead of the magnetic disk device 920, a storage device such as an optical disk device or a memory card read / write device may be used.

  The RAM 914 is an example of a volatile memory. The storage media of the ROM 913, the FDD 904, the CDD 905, and the magnetic disk device 920 are an example of a nonvolatile memory. These are examples of a storage device or a storage unit.

  The communication board 915, the keyboard 902, the scanner device 907, the FDD 904, the display device 901 (display screen 801), the touch panel 908, and the like are examples of an input unit and an input device. Further, the communication board 915, the display device 901, the printer device 906, and the like are examples of an output unit and an output device.

  The communication board 915 is connected to the facsimile machine 932, the telephone 931, the LAN 942, and the like. The communication board 915 is not limited to the LAN 942 and may be connected to the Internet 940, a WAN (wide area network) such as ISDN, or the like. When connected to a WAN such as the Internet 940 or ISDN, the gateway 941 is unnecessary.

  The magnetic disk device 920 stores an operating system 921 (OS), a window system 922, a program group 923, and a file group 924. The programs in the program group 923 are executed by the CPU 911, the operating system 921, and the window system 922.

  The program group 923 stores programs for executing functions described as “˜unit” and “˜means” in the description of the embodiments described below. The program is read and executed by the CPU 911. The file group 924 includes information, data, signal values, variable values, and parameters that are described as “determination results of”, “calculation results of”, and “processing results of” in the description of the embodiments described below. Are stored as items “˜file”, “˜database”, and “˜data”. “˜file”, “˜database”, and “˜data” are stored in a recording medium such as a disk or a memory. Information, data, signal values, variable values, and parameters stored in a storage medium such as a disk or memory are read out to the main memory or cache memory by the CPU 911 via a read / write circuit, and extracted, searched, referenced, compared, Used for CPU operations such as calculation, calculation, processing, output, printing, and display. Information, data, signal values, variable values, and parameters are temporarily stored in the main memory, cache memory, and buffer memory during the CPU operations of extraction, search, reference, comparison, operation, calculation, processing, output, printing, and display. Is remembered.

  In addition, the arrows in the flowcharts described in the following description of the embodiments mainly indicate input / output of data and signals. The data and signal values are the RAM 914 memory, the FDD 904 flexible disk, the CDD 905 compact disk, and the magnetic field. The data is recorded on a recording medium such as a magnetic disk of the disk device 920, another optical disk, a mini disk, and a DVD (Digital Versatile Disk). Data and signals are transmitted online via a bus 912, signal lines, cables, or other transmission media.

  In addition, what is described as “to part” in the description of the embodiment described below may be “to circuit”, “to device”, “to device”, “means”, and “to step”. ”,“ ˜procedure ”, or“ ˜processing ”. That is, what is described as “˜unit” may be realized by firmware stored in the ROM 913. Alternatively, it may be implemented only by software, or only by hardware such as elements, devices, substrates, and wirings, by a combination of software and hardware, or by a combination of firmware. Firmware and software are stored as programs in a recording medium such as a magnetic disk, a flexible disk, an optical disk, a compact disk, a mini disk, and a DVD. The program is read by the CPU 911 and executed by the CPU 911. That is, the program causes the computer to function as “to part” described below. Alternatively, the procedure or method of “to part” described below is executed by a computer.

  FIG. 4 is a flowchart of the evaluation information design process and the evaluation information storage process by the design unit according to the first embodiment. The flow of the evaluation information design process and the evaluation information storage process by the design unit 110 will be described with reference to FIG.

  In S201, the design unit 110 inputs information (for example, security measure ID) for identifying the security measure to be evaluated from the administrator 400 via the input device.

  In S202, the design unit 110 performs the following processing for each evaluation measure (recognition, understanding, implementation) of the security measure to be evaluated (the security measure A indicated by the security measure ID input in S201). It is an iterative process.

  In the following description of S203 to S206, a design process for evaluation determination data information and a process for designing a risk improvement measure for evaluating the “recognition level” of the security measure A will be described. Since the design unit 110 performs the same processing for the understanding level and the implementation level, the description thereof is omitted here.

  In S203, the evaluation determination data information design unit 111 uses the processing device to obtain evaluation determination data information to be acquired in order to determine the degree of recognition based on, for example, an input from the user (administrator 400) via the input device. Identify. The evaluation determination data information indicates evaluation determination data to be acquired in order to determine the recognition degree of the security measure to be evaluated. For example, the evaluation determination data information for determining the degree of recognition of “security measure A: periodic execution of security program A” is “whether or not access to the designated URL” is for downloading security program A, etc. Or “access time to specified URL”.

  In S204, the evaluation determination data information design unit 111 sets an evaluation criterion for each data, which is a criterion for evaluating the specified evaluation determination data information. For example, the evaluation determination data information design unit 111 sets the evaluation criterion for each data corresponding to the evaluation determination data information by the processing device based on the input from the administrator 400 via the input device. As the evaluation criteria for each data corresponding to the evaluation determination data information, for example, binary determination such as “access time to specified URL is 10 minutes or more” with respect to evaluation determination data information “access time to specified URL” is used. It is done. Alternatively, security level classification (for example, “security level 3 if 10 minutes or more”) according to the access time to the specified URL may be defined. The evaluation determination data information design unit 111 may set a plurality of evaluation determination data information for the degree of recognition. The evaluation determination data information design unit 111 sets a corresponding evaluation criterion for each data for the evaluation determination data information using the processing device as described above, and stores it in the evaluation determination data information storage unit 121.

  FIG. 5 is a diagram illustrating an example of the evaluation determination data information storage unit 121 stored in the storage device by the evaluation determination data information design unit 111 according to the first embodiment. In the evaluation determination data information storage unit 121, for the evaluation scale “recognition”, “specified URL access presence / absence”, “specified URL access time”, “specified file access presence / absence”, “specified file access” are set as evaluation determination data information. "Time" is set. In addition, as an evaluation criterion (satisfaction condition) for each data of the evaluation determination data information “specified URL access presence / absence”, a condition “one time is 5 minutes or more” is set. Here, as shown in FIG. 5, the configuration of the evaluation determination data information storage unit 121 sets evaluation items (URL access, file access) for the evaluation scale (recognition), and evaluates each evaluation item. The determination data information is set, but there is no need for an evaluation item. In addition, in FIG. 5, risk information related to risk when each evaluation determination data information (data of evaluation determination data information) does not satisfy the evaluation criteria for each data (satisfaction condition) is added to the configuration of the evaluation determination data information storage unit 121. It has been.

  For example, the design unit 110 is activated as follows. When the security management device 100 is activated, an initial screen of the security management system is displayed on the display device 901. When the administrator 400 selects “evaluation information design phase” on the initial screen, the design unit 110 uses the processing device. It is read from the storage device and activated by the processing device. When started, the design unit 110 displays an evaluation information design input screen (not shown) on the display device 901. The design unit 110 (evaluation determination data information design unit 111) inputs input information (evaluation determination data, evaluation criteria for each data, risk information, etc.) from the administrator 400 via the evaluation information design input screen of the display device 901. And stored in the evaluation determination data information storage unit 121.

  In the security management device 100, a list of obtainable evaluation determination data information, a list of evaluation criteria for each data, and a list of risk information may be stored in the storage device in advance. The design unit 110 (evaluation determination data information design unit 111) uses an interface that allows the administrator 400 to select a list by using a pull-down menu or the like on the evaluation information design input screen using these lists stored in advance in the storage device. May be.

  Alternatively, in the security management device 100, a database (evaluation determination data information DB) configured as shown in the evaluation determination data information storage unit 121 in FIG. 5 is generated in advance at the time of system design or the like and stored in the storage device. It is good. The evaluation determination data information design unit 111 may use an evaluation determination data information DB stored in advance in a storage device when specifying data. The evaluation determination data information DB may be updated by the administrator 400 or the like.

  In S205, the risk improvement measure design unit 113 sets a risk improvement measure corresponding to the evaluation determination data for each evaluation scale (recognition level, understanding level, and implementation level). Alternatively, the risk improvement measure design unit 113 sets a risk improvement measure corresponding to an evaluation item for each evaluation scale (recognition level, understanding level, and implementation level). The risk improvement measure design unit 113, for example, information input from the administrator 400 using the interface of the evaluation information design input screen displayed on the display device 901, information stored in the evaluation determination data information storage unit 121, and Based on the above, risk information and risk improvement measures corresponding to the evaluation evaluation data information (evaluation items) of the degree of recognition are set and stored in the risk improvement measure information storage unit 123.

  FIG. 6 is a diagram illustrating an example of the risk improvement measure information storage unit 123 stored by the risk improvement measure design unit 113 according to the first embodiment. As shown in FIG. 6, in the risk improvement measure information storage unit 123, for example, risk information “measure (regulation) is difficult to find” corresponding to evaluation determination data information “presence / absence of specified URL access” for determining the degree of recognition On the other hand, risk improvement measures “post rules on the web”, “improvement of search algorithms on the web”, and “review of the hierarchical structure of the rules” are set as the improvement measures. The risk improvement measure may be set for each evaluation scale, may be set for each evaluation item, or may be set for each evaluation determination data.

  In S <b> 206, the design unit 110 uses the processing device to calculate evaluation determination data information, evaluation criteria for each data, and risk improvement measures for all evaluation measures (recognition level, understanding level, implementation level). 121, it is determined whether or not the risk improvement measure information storage unit 123 has been stored. When the design unit 110 determines that the storage processing in the evaluation determination data information storage unit 121 and the risk improvement measure information storage unit 123 has been completed for all evaluation scales (recognition level, understanding level, implementation level) (YES in S206). The process proceeds to S207. If the design unit 110 determines that the storage process has not been completed for all evaluation scales (recognition level, understanding level, implementation level) (NO in S206), the design unit 110 returns the process to S202.

  In S207, the evaluation formula design unit 112 sets a plurality of evaluation levels representing the rating of the evaluation of the operational status of the security measure, and sets the “understanding value and the value corresponding to each evaluation level of the set plurality of evaluation levels”. Each combination of the value of the degree of recognition and the value of the degree of implementation is set and stored in the evaluation formula information storage unit 122. The evaluation formula design unit 112 sets an evaluation formula for determining the evaluation level (an example of an operational status evaluation standard) and stores it in the evaluation formula information storage unit 122. For example, the evaluation formula design unit 112 sets an evaluation formula based on input information from the administrator 400 input via the evaluation information design input screen interface displayed on the display device 901, and sets an evaluation formula information storage unit. 122.

  FIG. 7 is a diagram illustrating an example of the evaluation formula information storage unit 122 stored by the evaluation formula design unit 112 in the first embodiment. As shown in FIG. 7, the evaluation formula is that when the security measure A is “recognition value 90% or higher, understanding level 90% or higher, implementation level 90% or higher”, the evaluation level “1: (Risk handling unnecessary) ”,“ recognition value of 90% or higher, understanding level of 90% to 50%, implementation level of 90% or higher ”, evaluation level“ 2: (immediate risk handling unnecessary) ”, In the case of “recognition value 90% to 50%, understanding value 50% to 30%, implementation level value 90% or more”, the conditional expression such as evaluation level “3: (risk correspondence retraining required)” is there.

  This is the end of the description of the evaluation information design process and the evaluation information storage process by the design unit 110 according to the first embodiment.

  FIG. 8 is a flowchart showing evaluation determination data acquisition processing and operation status evaluation processing according to the first embodiment. The evaluation determination data acquisition process performed by the evaluation determination data acquisition unit 140 and the operation status evaluation process performed by the evaluation unit 130 will be described with reference to FIG.

  The evaluation unit 130 is activated as follows, for example. When the security management device 100 is activated, an initial screen of the security management system is displayed on the display device 901. When the administrator 400 selects “operation status evaluation phase” on the initial screen, the evaluation unit 130 stores it in the processing device. It is read from the device and activated by the processing device. When activated, the evaluation unit 130 displays an evaluation target input screen (not shown) on the display device 901 by the processing device.

  In S <b> 301, the evaluation unit 130 (calculation unit 131) inputs a security measure evaluation request from the administrator 400 via the evaluation target input screen displayed on the display device 901. The evaluation unit 130 (calculation unit 131) extracts the user ID and the security measure ID included in the input security measure evaluation request by the processing device and stores them in the storage device.

  In S302, the calculation unit 131 searches the evaluation formula information storage unit 122 based on the input security measure ID (here, it is assumed that the security measure A is designated) by the processing device, and performs the security measure. Evaluation formula information (information in FIG. 7) corresponding to A is extracted.

  S303 is an iterative process in which the calculation unit 131 performs the subsequent processing on the recognition level / understanding level / implementation level for each evaluation scale (recognition level, understanding level, implementation level) of the security measure A to be evaluated.

  In the following description of S304 to S306, the measure recognition data acquisition process in which the measure recognition degree analysis unit 133 obtains the evaluation decision data for calculating the “recognition value” for the security measure A to be evaluated, and the measure recognition The measure recognition degree calculation process for calculating the “recognition value” using the evaluation determination data (recognition determination data) acquired by the degree analysis unit 133 will be described. The calculation unit 131 (the measure recognition level analysis unit 133, the measure understanding level analysis unit 134, and the measure implementation level analysis unit 135) performs the same processing as the recognition level processing on the understanding level and the implementation level. A description of the degree is omitted.

  In S304, the measure recognition degree analysis unit 133 should search the evaluation determination data information storage unit 121 based on the input user ID and the security measure ID by the processing device, and acquire the recognition degree determination. Evaluation evaluation data information is extracted. The measure recognition degree analysis unit 133 outputs an evaluation determination data acquisition request for acquiring evaluation determination data corresponding to the extracted evaluation determination data information to the evaluation determination data acquisition unit 140 by the processing device.

  In S305, the evaluation determination data acquisition unit 140 acquires evaluation determination data corresponding to the evaluation determination data information designated by the evaluation determination data acquisition request by the processing device. For example, the evaluation determination data acquisition unit 140 acquires evaluation determination data from log information accumulated in the user (organization) information system. Alternatively, the evaluation determination data acquisition unit 140 aggregates the answer data that accumulates the answers of the end users in the user (organization) (answers to the questions generated by the question generation unit 114 described above) by the processing device, and evaluates them. Obtained as judgment data. The evaluation determination data acquisition unit 140 stores the acquired evaluation determination data in the security determination data storage unit 141 as recognition determination data.

  In S306, the measure recognition degree analysis unit 133 reads the recognition determination data stored in the security determination data storage unit 141 by the processing device, and calculates the value of the recognition degree based on the read recognition determination data. For example, when the evaluation determination data information is “specified URL access time” and the evaluation criterion for each data “total access time is 30 minutes or more”, the measure recognition degree analysis unit 133 determines that “all end users evaluate by data”. The degree of “access time in actual situation obtained from acquired recognition determination data (evaluation determination data for evaluating recognition degree)” with respect to “access time satisfying determination criterion” is calculated by the processing device. The measure recognition degree analysis unit 133 calculates the degree of all the evaluation determination data information as described above, and calculates the average value as the recognition degree value.

  In S307, the calculation unit 131 has calculated the recognition value, the understanding value, and the enforcement value for the security measure A with respect to all the evaluation scales (recognition degree, understanding degree, and implementation degree) by the processing device. Determine whether or not. If the calculation unit 131 determines that all the evaluation scales (recognition level, understanding level, implementation level) have been calculated (YES in S307), the process proceeds to S308. When the calculation unit 131 determines that all the evaluation scales (recognition level, understanding level, implementation level) have not been calculated (NO in S307), the process returns to S303.

  In S308, the operation status evaluation unit 132 (evaluation zone calculation unit 136) causes the processing device to calculate the “combination of recognition value, understanding value, and implementation value” calculated by the calculation unit 131, and S302. Is compared with the evaluation formula information of the security measure A acquired in step 1, and the evaluation level of the security measure A to be evaluated is determined based on the comparison result. The operation status evaluation unit 132 (evaluation zone calculation unit 136) stores the evaluation level determined by the processing device in the evaluation result storage unit 137 as an operation status evaluation result. In addition, the operation status evaluation unit 132 (evaluation zone calculation unit 136), as the operation status evaluation result of the security measure A in the user ID, together with the evaluation level, values of each evaluation scale (recognition value, understanding value, implementation Degree value), evaluation determination data acquired for each evaluation scale (recognition level, understanding level, implementation level) and the determination result of the evaluation criterion for each data are stored in the evaluation result storage unit 137.

  This is the end of the description of the evaluation determination data acquisition process and the operation status evaluation process according to the first embodiment.

  FIG. 9 is a flowchart showing risk inquiry processing according to the first embodiment. The risk inquiry process will be described with reference to FIG.

  The root risk identification unit 150 is activated as follows, for example. When the security management device 100 is activated, an initial screen of the security management system is displayed on the display device 901. When the administrator 400 selects “risk inquiry phase” on the initial screen, the root risk identification unit 150 is executed by the processing device. It is read from the storage device and activated by the processing device. When activated, the root risk identification unit 150 displays a risk inquiry input screen (not shown) on the display device 901.

  In S401, the root risk identification unit 150 inputs a risk inquiry request from the administrator 400 via the risk inquiry input screen displayed on the display device 901 by the processing device. The root risk identification unit 150 extracts the user ID and the security measure ID included in the input risk inquiry request by the processing device.

  S402 is an iterative process in which the source risk identification unit 150 performs the processes of S403 to S406 for all the evaluation scales (recognition degree, understanding degree, implementation degree) for the security measure A for the target user ID. In the following description, the root risk identification unit 150 refers to the evaluation result storage unit 137 based on the target security measure ID of the target user ID, and each evaluation criterion for each of the evaluation determination data corresponding to the degree of recognition. A process for checking whether or not the above is satisfied will be described. Here, the same processing is performed for the degree of understanding and the degree of implementation, and the description thereof is omitted.

  In S403, the source risk identification unit 150 refers to the evaluation result storage unit 137 based on the input target user ID and the target security measure ID by the processing device, and all of the evaluation determination data corresponding to the degree of recognition. Then, it is checked whether or not each data evaluation criterion is satisfied (whether the determination result is OK or NG).

  The root risk identification unit 150 checks all the evaluation determination data of the degree of recognition. If all the evaluation determination data satisfy the evaluation criteria for each data (YES in S403), the process proceeds to S404a.

  In S404a, the root risk identification unit 150 stores, in the storage device, notification information for notifying the risk countermeasure presenting unit that all the evaluation determination data of the degree of recognition has reached the evaluation criteria for each data by the processing device. .

  In S <b> 404, the root risk identification unit 150 determines whether or not processing has been performed for all evaluation scales (recognition level, understanding level, implementation level) by the processing device. If the root risk specifying unit 150 determines that the processing has been performed for all the evaluation scales (YES in S404), the process proceeds to S404b. In S404b, the root risk identification unit 150 uses the notification information stored in the storage device to determine the achievement status of the evaluation criteria for all evaluation measures (that is, for each evaluation determination data for the degree of recognition, understanding, and implementation). Check the evaluation criteria status). As a result of checking the notification information, the root risk identification unit 150 means that if all the evaluation determination data has reached the evaluation criteria for each data for all evaluation scales, it means that the corresponding risk has not been extracted. A notification to the effect that no additional measures are required is stored in the notification information.

  If the source risk identification unit 150 determines in S404 that the process has not been performed for all evaluation measures (NO in S404), the process returns to S402.

  In S403, if all the evaluation determination data of the degree of recognition do not satisfy the standard (NO in S403), the root risk specifying unit 150 advances the process to S405.

  In S <b> 405, the source risk identification unit 150 acquires evaluation determination data that does not satisfy the evaluation criteria for each data by the processing device, and also displays a risk improvement measure corresponding to the acquired evaluation determination data as a risk improvement measure information storage unit 123. And stored in the storage device as risk improvement measure information corresponding to the degree of recognition. In S405, the root risk identification unit 150 uses the processing device to correspond to the notification information in order to notify the risk countermeasure presentation unit 160 of the risk improvement measure information corresponding to the recognition degree stored in the storage device. Store risk improvement information.

  In S <b> 406, the root risk identification unit 150 determines whether or not processing has been performed for all evaluation scales (recognition level, understanding level, implementation level) by the processing device. If the root risk identification unit 150 determines that the process has been performed for all the evaluation scales (YES in S406), the process proceeds to S407. If the root risk specifying unit 150 determines that the processing is not performed for all the evaluation scales (NO in S406), the process returns to S402.

  In S407, the risk countermeasure presentation unit 160 displays risk improvement measure information corresponding to each evaluation scale on the display device 901 according to the notification information stored in the storage device by the root risk identification unit 150 using the processing device. Further, when the notification indicating that “additional measures are not required” is input as the notification information, the risk countermeasure presenting unit 160 displays that fact on the display device 901.

  In the present embodiment, the security management apparatus 100 having the following features has been described.

The security management device 100 according to the first embodiment is a security management device 100 for the purpose of confirming whether an information security measure in an organization is implemented by an end user,
An evaluation unit 130 that evaluates that the end user correctly identifies (recognizes), understands and implements the security measure as a scale (that is, by an evaluation scale (recognition, understanding, implementation));
An evaluation expression design unit 112 that designs an expression to be evaluated by the evaluation unit 130 from a list of information (evaluation determination data information) that can be collected by evaluation purpose (evaluation scale);
An improvement plan design unit (risk improvement plan design unit 113) for designing an improvement plan when the result evaluated according to the evaluation scale (recognition level, understanding level, implementation level) is determined to be inappropriate;
From a result of evaluating the evaluation determination data acquired by the evaluation determination data acquisition unit 140, a source risk specifying unit 150 that specifies a risk as a source,
And a risk countermeasure presenting unit 160 that presents a countermeasure against the underlying risk.

The security management device 100 in the first embodiment
The evaluation unit 130 analyzes a measure recognition degree analysis unit 133 that analyzes that the end user correctly identifies the security measure, and a measure understanding level analysis unit that analyzes that the end user correctly understands the contents of the security measure 134 and a measure implementation level analysis unit 135 for analyzing that the end user is correctly implementing the security measure,
The security management device 100 in the first embodiment further includes:
From the analysis results (for example, the value of recognition, the value of understanding, and the value of implementation) output by the three analysis units of the measure recognition degree analysis unit 133, the measure understanding degree analysis unit 134, and the measure execution degree analysis unit 135, An evaluation zone calculation unit 136 for specifying an evaluation zone (evaluation level) to which the end user belongs is provided.

  As described above, according to the security management apparatus 100 in the first embodiment, when an end user confirms whether or not an information security measure is implemented, the degree of recognition, understanding, and implementation Therefore, when the end user does not implement the security measure, the cause that is the source can be specified.

Embodiment 2. FIG.
In the security management apparatus 100 according to the first embodiment, an evaluation level is determined using an evaluation formula for a user's security measure and output as an operation status evaluation result. In the security management apparatus 100 according to the present embodiment, a case will be described in which an operation status evaluation result is displayed on the display device 901 using a three-dimensional graph as an operation status evaluation result output (display) method.

  FIG. 10 is a diagram illustrating a functional block configuration diagram of the security management device 100 according to the second embodiment. FIG. 10 is a diagram corresponding to FIG. 1, and functional blocks having the same functions as those in FIG. 10 is different from FIG. 1 in that an evaluation result three-dimensional display unit 138 is provided.

  The evaluation result three-dimensional display unit 138 displays the operation status evaluation result stored in the evaluation result storage unit 137 on a three-dimensional space with recognition, understanding, and implementation as axes, and evaluates the result on the display device 901. The result is displayed as a three-dimensional graph. The evaluation result three-dimensional display unit 138 is an example of an evaluation result display unit.

  FIG. 11 is a flowchart showing the flow of the evaluation result three-dimensional graph display process of the evaluation result three-dimensional display unit 138 according to the second embodiment. The flow of the evaluation result three-dimensional graph display process will be described with reference to FIG.

  The evaluation result three-dimensional display unit 138 is activated as follows, for example. When the security management apparatus 100 is activated, an initial screen of the security management system is displayed on the display device 901, and the administrator 400 selects an “evaluation result three-dimensional display” button or the like on the initial screen to display a three-dimensional evaluation result. The unit 138 is read from the storage device by the processing device and activated by the processing device. When the evaluation result three-dimensional display unit 138 is activated, for example, the evaluation result three-dimensional graph request screen is displayed on the display device 901.

  In S901, the evaluation result three-dimensional display unit 138 inputs an evaluation result three-dimensional graph display request from the administrator 400 via the evaluation result three-dimensional graph request screen displayed on the display device 901 by the processing device.

  In step S901, the evaluation result three-dimensional display unit 138 extracts the security measure ID included in the input evaluation result three-dimensional graph display request by the processing device. Here, it is assumed that the security measure A is specified as the target security measure. Moreover, the evaluation result three-dimensional display part 138 shall display the operation condition evaluation result of the security measure A about all the users. That is, the evaluation result three-dimensional display unit 138 repeats the processing from S902 to S904 for all users.

  In S902, the evaluation result three-dimensional display unit 138 first identifies the target user. The evaluation result three-dimensional display unit 138 can determine a target user corresponding to the specified target security measure based on data such as a registered user list provided in advance in the security management apparatus 100, for example.

  In S903, the evaluation result three-dimensional display unit 138 searches the evaluation result storage unit 137 based on the target user ID of the specified target user and the extracted security measure ID, and the security measure A of the target user ID Extract the values of recognition, understanding and implementation. The evaluation result three-dimensional display unit 138 generates a three-dimensional space centered on the degree of recognition, comprehension, and implementation by the processing device, and extracts the security measure A in the target user ID extracted on the generated three-dimensional space. A recognition value, an understanding value, and an implementation value are plotted, and evaluation result three-dimensional graph data is generated.

  In S904, the evaluation result three-dimensional display unit 138 determines whether plotting in the three-dimensional space has been completed for all users by the processing device. If the evaluation result three-dimensional display unit 138 determines that plotting in the three-dimensional space has been completed for all users (YES in S904), the process proceeds to S905. If the evaluation result three-dimensional display unit 138 determines that plotting in the three-dimensional space is not completed for all users (NO in S904), the process returns to S902.

  In S905, the evaluation result three-dimensional display unit 138 causes the processing device to display the evaluation result three-dimensional graph on the display device 901 based on the generated evaluation result three-dimensional graph data.

  FIG. 12 is a diagram illustrating an example of a three-dimensional evaluation result graph displayed on the display device in the second embodiment. In FIG. 12, the recognition level is shown on the X axis, the understanding level is shown on the Y axis, and the implementation level is shown on the Z axis. Further, although the three-dimensional space is divided into a plurality of substantially rectangular parallelepiped blocks 1 to 27, these can correspond to the evaluation levels of the first embodiment.

  In addition, one plot on the three-dimensional space indicates one user, and indicates the type of security measure by the difference in the shape and color of the plot.

  For example, it is assumed that the plot a1 in which many users are plotted in the block 1 indicates the security measure A. Block 1 is a block with low values for recognition, understanding, and implementation. For security measure A, “High risk: not implemented or what has been implemented since it has never been implemented. You can make an evaluation that you don't recognize. It is assumed that the plot a2 in which many users are plotted in the block 19 indicates the security measure B. Block 19 is a block that has a high degree of implementation but a low level of recognition and understanding. For security measure B, “In mid-risk: The degree of implementation is OK, but the measure is clearly identified (recognized) and understood. Therefore, it can be evaluated that there is a high risk that it cannot respond to changes in security measures.

  The security management apparatus 100 according to the second embodiment is a security management apparatus 100 for the purpose of confirming whether or not an information security measure in the organization is being implemented by an end user. Is provided with an evaluation result three-dimensional display unit 138 that performs a process of displaying the evaluation result in a three-dimensional graph.

  As described above, according to the security management apparatus 100 according to the present embodiment, by displaying the evaluation results of each user for a certain information security measure on a three-dimensional graph, it is easy to understand the distribution status of the user evaluation results. Is displayed. In addition, since the evaluation results of each user are not averaged, it becomes easier to determine whether it is necessary to take overall measures or whether additional measures should be taken only for specific users. It becomes possible to take.

Embodiment 3 FIG.
The security management device 100 according to the first embodiment and the second embodiment described above is intended to display an operation status evaluation result on a display device or the like so that the user can adopt an appropriate risk countermeasure. Is. In the present embodiment, an embodiment will be described in which the security management device 100 improves the evaluation formula to be acquired based on the operation status evaluation result.

  FIG. 13 is a functional block configuration diagram of the security management apparatus 100 according to the third embodiment. FIG. 13 is a diagram corresponding to FIG. 1, and functional blocks having the same functions as those in FIG. 1 are denoted by the same reference numerals and description thereof is omitted. 13 is different from FIG. 1 in that a correlation analysis unit 139 is provided.

  The correlation analysis unit 139 has a function of analyzing the correlation of the evaluation results of each evaluation scale and feeding back the analysis results to the evaluation formula information. The correlation analysis unit 139 determines whether or not the recognition level value and the understanding level value are necessary based on the recognition level value, the understanding level value, and the implementation level value stored in the evaluation result storage unit 137. Is stored in the storage device (evaluation formula information storage unit 122) as necessity information. The correlation analysis unit 139 is an example of a necessity information setting unit.

  FIG. 14 is a flowchart showing the flow of correlation analysis processing of the correlation analyzer according to the third embodiment. The flow of the correlation analysis process of the correlation analysis unit 139 will be described with reference to FIG.

  The correlation analysis unit 139 is started after the operation status evaluation process of the evaluation unit 130 is completed, for example. Alternatively, it may be activated by a request for changing the evaluation formula information by the user (administrator 400).

  In S1201, the correlation analysis unit 139 specifies the security measure ID to be evaluated by the processing device. The correlation analysis unit 139 extracts the security measure ID to be evaluated from the evaluation formula information change request input from the user. Alternatively, the correlation analysis unit 139 may acquire the security measure ID that is the target of the operation status evaluation process by the evaluation unit 130 from the storage device, and specify the security measure ID as the evaluation target security measure ID. Here, it is assumed that the security measure ID to be evaluated indicates the security measure A.

  In S <b> 1202, the correlation analysis unit 139 uses the processing device to obtain a recognition value, an understanding value, and an implementation value for the security measure A from the evaluation result storage unit 137.

  In step S1203, the correlation analysis unit 139 determines whether the evaluation result (recognition value, understanding value, implementation value) of the evaluation scale is sufficient by the processing device. For example, the correlation analysis unit 139 compares the evaluation scale threshold value stored in advance in the storage device with the evaluation scale evaluation results (recognition value, understanding value, and implementation value) by the processing device. To determine whether it is sufficient. When the processing unit determines that the evaluation result of the evaluation scale (recognition value, understanding value, implementation value) is sufficient (YES in step S1203), the correlation analysis unit 139 proceeds to step S1204. . If the processing unit determines that the evaluation result of the evaluation scale (recognition value, understanding value, implementation value) is not sufficient (NO in S1203), the correlation analysis unit 139 proceeds to S1205.

  Here, that the evaluation result of the evaluation scale (recognition value, understanding value, implementation value) is sufficient means that the security measure A has matured in the organization. Therefore, the correlation analysis unit 139 uses the processing device to recognize the recognition degree unnecessary flag (an example of necessity information) stored in the storage device that it is not necessary to acquire the data of the degree of recognition or the degree of understanding for the security measure A. ) Is turned ON. It is assumed that the recognition degree understanding degree unnecessary flag is set in the evaluation formula information storage unit 122 corresponding to the security measure A.

  In step S <b> 1205, the correlation analysis unit 139 determines whether “the understanding level value and the implementation level value are sufficient and the recognition level value is insufficient” by the processing device. The correlation analysis unit 139 compares the evaluation scale threshold value stored in advance in the storage device with the evaluation scale evaluation results (recognition value, understanding value, implementation value) by the processing device, It is determined whether or not “the understanding level value and the implementation level value are sufficient and the recognition level value is insufficient”. If the correlation analysis unit 139 determines that “the understanding level value and the implementation level value are sufficient and the recognition level value is insufficient” by the processing device (YES in S1205), the process proceeds to S1206. move on. If the correlation analysis unit 139 determines by the processing device that “the understanding level value and the implementation level value are sufficient and the recognition level value is insufficient” (NO in S1205), the process proceeds to S1207. move on.

  In S1206, the correlation analysis unit 139 performs data acquisition of the degree of implementation and the degree of recognition in the future if the value of the degree of understanding and the value of the degree of implementation are sufficient and the value of the degree of recognition is insufficient. An understanding level unnecessary flag (an example of necessity information), which means that it is not necessary to acquire understanding level data, is set to ON. The understanding level unnecessary flag is set in the evaluation formula information storage unit 122 corresponding to the security measure A.

  In the case of NO in S1205 (that is, when the value of understanding and the value of implementation are sufficient and the value of recognition is not sufficient), whether or not the scale of implementation and recognition is sufficient Check. In S <b> 1207, the correlation analysis unit 139 determines whether or not “the recognition level value and the implementation level value are sufficient and the understanding level value is insufficient” by the processing device. The correlation analysis unit 139 compares the evaluation scale threshold value stored in advance in the storage device with the evaluation scale evaluation results (recognition value, understanding value, implementation value) by the processing device, It is determined whether or not “a recognition value and an implementation value are sufficient and an understanding value is insufficient”. If the correlation analysis unit 139 determines that the “recognition value and the implementation value are sufficient and the understanding value is insufficient” by the processing device (YES in S1207), the process proceeds to S1208. move on. If the correlation analysis unit 139 determines that the “recognition value and the implementation value are sufficient and the understanding value is insufficient” by the processing device (NO in S1207), the process ends. .

  In S1208, the correlation analysis unit 139 performs data acquisition of the implementation level and the understanding level in the future if “the recognition level value and the implementation level value are sufficient and the understanding level value is insufficient”. The recognition degree unnecessary flag (an example of necessity information) that means that recognition degree data is not required is turned ON. The recognition unnecessary flag is set in the evaluation formula information storage unit 122 corresponding to the security measure A.

  If the result of S1207 is also insufficient, the correlation analysis unit 139 means that it is necessary to acquire data for all the scales, and thus ends the processing.

  As described above, based on the evaluation result of the evaluation scale for security measure A, correlation analysis unit 139 sets the flag (recognition degree not required flag) set in evaluation formula information storage unit 122 corresponding to security measure A. , Understanding level unnecessary flag, recognition level unnecessary flag) (an example of necessity information) is turned ON.

  The evaluation formula design unit 112 (an example of an evaluation criteria setting unit), when performing the evaluation formula design process, flag information (necessity information) set in the evaluation formula information storage unit 122 (recognition degree understanding unnecessary flag, Redesign (reset) based on understanding unnecessary flag and recognition unnecessary flag). For example, when performing the evaluation expression design process, the evaluation expression design unit 112 generates an evaluation expression that determines the evaluation level based only on the value of the degree of implementation when the recognition degree unnecessary flag is ON. To do. Alternatively, the evaluation formula design unit 112 determines the evaluation level based only on the value of recognition and the value of implementation when the understanding level unnecessary flag is ON when performing the evaluation formula design process. Generate an evaluation formula. The evaluation formula design unit 112 determines the evaluation level based only on the value of the understanding level and the value of the implementation level when the recognition degree unnecessary flag is ON when performing the evaluation formula design process. Is generated.

  The security management apparatus 100 according to the third embodiment is a security management apparatus 100 for the purpose of confirming whether or not an information security measure in an organization is implemented by an end user, and correlates evaluation results of each evaluation scale. A correlation analysis unit 139 that analyzes the relationship and feeds back the analysis result to the evaluation formula information is provided.

  As described above, according to the security management apparatus 100 of the present embodiment, it is not necessary to determine the maturity level of a certain security measure from the operational condition evaluation result and change (redesign) the evaluation formula according to this maturity level. Therefore, it is possible to reduce the security operation management load that tends to be excessive.

  As mentioned above, although Embodiment 1-3 was demonstrated, you may implement combining 2 or more embodiment among these. Alternatively, one of these embodiments may be partially implemented. Or you may implement combining two or more embodiment among these partially.

  In addition, the functional blocks described in the description of the first to third embodiments may be realized by a single functional block for all functional blocks. Alternatively, these functional blocks may be configured in any combination.

  DESCRIPTION OF SYMBOLS 100 Security management apparatus, 110 Design part, 111 Evaluation judgment data information design part, 112 Evaluation formula design part, 113 Risk improvement measure design part, 120 Evaluation information storage part, 121 Evaluation judgment data information storage part, 122 Evaluation formula information storage part , 123 Risk improvement measure information storage unit, 130 evaluation unit, 131 calculation unit, 132 operation status evaluation unit, 133 measure recognition level analysis unit, 134 measure understanding level analysis unit, 135 measure implementation level analysis unit, 136 evaluation zone calculation unit, 137 Evaluation result storage unit, 138 Evaluation result three-dimensional display unit, 139 Correlation analysis unit, 140 Evaluation determination data acquisition unit, 141 Security determination data storage unit, 150 Root risk identification unit, 160 Risk countermeasure presentation unit, 400 Administrator, 901 Display device, 902 keyboard, 903 mouse, 904 FDD 905 CDD, 906 printer device, 907 scanner device, 908 touch panel, 910 system unit, 911 CPU, 912 bus, 913 ROM, 914 RAM, 915 communication board, 920 magnetic disk device, 921 OS, 922 window system, 923 program group, 924 file group, 931 telephone, 932 facsimile machine, 940 Internet, 941 gateway, 942 LAN.

Claims (10)

In a security evaluation device that evaluates the operational status of security measures in an organization,
A security determination data storage unit that stores recognition determination data for determining a recognition status of the security measure in the organization and an execution determination data for determining an implementation status of the security measure in the organization in a storage device;
The degree to which the user recognizes the security measure based on the input recognition determination data and the execution determination data by inputting the recognition determination data and the execution determination data from the security determination data storage unit And a calculation unit that calculates a value of the degree of recognition indicating the degree of implementation and the degree of implementation indicating the degree of implementation of the security measure by the user,
Based on the recognition level value and the implementation level value calculated by the calculation unit, the operation status of the security measure is evaluated by a processing device using an operation status evaluation criterion stored in advance in a storage device. A security evaluation device comprising an operation status evaluation unit that stores the operation status evaluation result in a storage device. The security judgment data storage unit further includes:
Storing understanding determination data for determining an understanding status of the security measure in the organization in a storage device;
The calculation unit further includes:
The understanding determination data is input from the security determination data storage unit, and based on the input understanding determination data, the processor calculates an understanding level value indicating the degree of understanding of the security measure by the organization. ,
The operation status evaluation unit
Based on the understanding level value, the recognition level value, and the implementation level value calculated by the calculation unit, the operating status of the security measure is evaluated by a processing device using the operating status evaluation criteria. The security evaluation device according to claim 1, wherein the operation status evaluation result is stored in a storage device. The security evaluation device further includes:
A plurality of evaluation levels representing the rating of evaluation of the operational status of the security measure, and a value of understanding, a value of recognition, and a value of implementation set corresponding to each of the plurality of evaluation levels And an evaluation criterion setting unit that stores the combination as a storage device as the operation status evaluation criterion,
The operation status evaluation unit
Among a plurality of evaluation levels included in the operational status evaluation standard set by the evaluation standard setting unit, the understanding level value, the recognition level value, and the implementation level value calculated by the calculation unit, The security evaluation apparatus according to claim 2, wherein an evaluation level corresponding to the combination is acquired by a processing apparatus, and the acquired evaluation level is stored in a storage device as the operation status evaluation result. The evaluation criterion setting unit further includes:
Corresponding to each of the plurality of evaluation levels, each security improvement measure is set as the operational status evaluation standard,
The operational status evaluation unit further includes:
A security improvement measure corresponding to the evaluation level is acquired together with the acquired evaluation level, and the acquired evaluation level and the security improvement measure are stored in the storage device as the operation status evaluation result. Item 4. The security evaluation device according to Item 3. The security evaluation device further includes:
An evaluation result display unit that displays on a display device a three-dimensional space represented by a three-dimensional coordinate composed of an X coordinate indicating recognition, a Y coordinate indicating understanding, and a Z coordinate indicating implementation, wherein the three-dimensional Evaluation result display for displaying the position indicated by the three-dimensional coordinates corresponding to the value of the degree of understanding, the value of the degree of recognition and the value of the degree of implementation calculated by the calculation unit in a space The security evaluation apparatus according to claim 2, further comprising a unit. The security evaluation device further includes:
Based on the understanding level value, the recognition level value, and the implementation level value calculated by the calculation unit, storage device stores necessity information indicating whether the understanding level value and the recognition level value are necessary. The necessity information setting part to be stored in
The evaluation criteria setting unit
The security evaluation apparatus according to claim 3, wherein the operation status evaluation criterion is reset based on the necessity information set by the necessity information setting unit. A security evaluation device that evaluates the operational status of a security measure in an organization, for determining the recognition status of the security measure in the organization, and for determining the implementation status of the security measure in the organization In a security evaluation method of a security evaluation device including a security determination data storage unit that stores execution determination data in a storage device,
The calculation unit inputs the recognition determination data and the execution determination data from the security determination data storage unit, and the user recognizes the security measure based on the input recognition determination data and the execution determination data. A calculation step of calculating, by a processing device, a value of the degree of recognition indicating the degree of being performed and a value of the degree of execution indicating the degree of the user performing the security measure;
The operation status evaluation unit uses the operation status evaluation criteria stored in advance in the storage device for the operation status of the security measure based on the value of the recognition level and the value of the implementation level calculated in the calculation step. A security evaluation method for a security evaluation device, comprising: an operation status evaluation step that evaluates by a processing device and stores the operation status evaluation result in a storage device. The security judgment data storage unit further includes:
Storing understanding determination data for determining an understanding status of the security measure in the organization in a storage device;
The calculating step further includes:
The calculation unit inputs the understanding determination data from the security determination data storage unit, and based on the input understanding determination data, an understanding level value indicating a degree of understanding of the security measure by the organization. Calculated by the processor,
The operation status evaluation step includes:
The operational status evaluation unit determines the operational status of the security measure based on the understanding level value, the recognition level value, and the implementation level value calculated in the calculating step, and the operational status evaluation standard. The security evaluation method for a security evaluation apparatus according to claim 7, wherein the security evaluation apparatus is used for evaluation by a processing apparatus and the operation status evaluation result is stored in a storage device. A security evaluation device that is a computer that evaluates the operational status of security measures in an organization, and that determines recognition status data for determining the recognition status of the security measures in the organization, and determines the implementation status of the security measures in the organization In a security evaluation program for a security evaluation device, which is a computer provided with a security determination data storage unit that stores execution determination data for storage in a storage device,
The calculation unit inputs the recognition determination data and the execution determination data from the security determination data storage unit, and the user recognizes the security measure based on the input recognition determination data and the execution determination data. A calculation process for calculating, by a processing device, a value of the degree of recognition indicating the degree of performing and a value of the degree of implementation indicating the degree of the user performing the security measure;
The operational status evaluation unit uses the operational status evaluation criteria stored in the storage device in advance for the operational status of the security measure based on the recognition value and the implementation value calculated by the calculation process. A security evaluation program for a security evaluation device, which causes a security evaluation device, which is a computer, to execute an operation status evaluation process that is evaluated by a processing device and stored in a storage device as an operation status evaluation result. The security judgment data storage unit further includes:
Storing understanding determination data for determining an understanding status of the security measure in the organization in a storage device;
The calculation process further includes:
The calculation unit inputs the understanding determination data from the security determination data storage unit, and based on the input understanding determination data, an understanding level value indicating a degree of understanding of the security measure by the organization. Calculated by the processor,
The operational status evaluation process is:
The operational status evaluation unit determines the operational status of the security measure based on the understanding level value, the recognition level value, and the implementation level value calculated in the calculating step, and the operational status evaluation standard. 10. The security evaluation program for a security evaluation apparatus according to claim 9, wherein the security evaluation program is used for evaluation by a processing apparatus and stored in the storage device as the operation status evaluation result.

Images