JP2019070912A - Security evaluation system and method for the same - Google Patents

Abstract

The present invention provides a security evaluation system and a security evaluation method that provide relative evaluation of security measures using appropriate answers.
A security evaluation server receives an information input including an answer to a question on security measures of each group, and a judging unit judges an appropriateness of the information input. The relative evaluation is performed by statistically processing the answers determined to be appropriate by the determination unit 12.
[Effect] It is possible to remove an incorrect response or an input from an incorrect user and provide a relative evaluation of security measures using an appropriate response.
[Selected figure] Figure 1

Description

  The present invention relates to a technology for evaluating security measures, and in particular, to a technology effectively applied to a system and a security evaluation method for performing a relative evaluation of security measures.

  In recent years, with the rapid development of IT technology, its importance has increased, but the degree of influence in the event of failure or information leakage has also increased, and it is important to take appropriate information security measures in companies. It has become.

  Under such circumstances, for example, in Patent Document 1, security analysis is performed by inputting an answer to a question of a security assessment item and executing security diagnosis of a system to be diagnosed (diagnosis result log) and the answer in association with each other. It is stated to do.

JP 2005-234756 A

  As described above, accurate security analysis can be performed by correlating the question answer of the security assessment item with the result of execution of the security diagnosis of the system to be diagnosed and performing security analysis.

  However, as in the case of the technology described in Patent Document 1, when focusing only on adapting to the security assessment item set in advance, an over-investment in security measures may occur. For example, if relative evaluations such as indexes compared with the security measures of other companies in the same industry can be obtained, it can be judged whether or not the security measures of the company are sufficient.

  As a method of obtaining such a relative evaluation, it is conceivable to obtain an answer about security countermeasure status from plural companies and statistically process the answer. However, if some answers are not appropriate (for example, when an answer is obtained from an inappropriate user), relative evaluation may be performed including the inappropriate answers, and an accurate evaluation may not be obtained. .

  It is an object of the present invention to provide a relative assessment of security measures using appropriate answers.

  The above and other objects and novel features of the present invention will be apparent from the description of the present specification and the accompanying drawings.

  The outline of typical ones of the inventions disclosed in the present application will be briefly described as follows.

  A security evaluation system according to a representative embodiment of the present invention is a security evaluation system that performs relative evaluation on security measures, and an input reception unit that receives information input including answers to questions on security measures of each group, and an input A determination unit that determines the appropriateness of the information input by the reception unit, and an evaluation unit that statistically processes the responses of a plurality of groups in the information input determined to be appropriate by the determination unit and performs a relative evaluation on security measures in each group; And an output unit that outputs the relative evaluation by the evaluation unit.

  The effects obtained by typical ones of the inventions disclosed in the present application will be briefly described as follows.

  That is, according to a representative embodiment of the present invention, it is possible to provide a relative assessment of security measures using appropriate answers.

BRIEF DESCRIPTION OF THE DRAWINGS It is the figure which showed the outline | summary about the structural example of the security evaluation system which is one embodiment of this invention. It is the figure which showed the outline | summary about the example of the evaluation screen in one embodiment of this invention. It is the figure which showed the outline | summary about the service reception screen example in one embodiment of this invention. It is the figure which showed the outline | summary about the example of the group attribute input screen in one embodiment of this invention. It is the figure which showed the outline | summary about the example of the countermeasure response screen in one embodiment of this invention. It is the figure which showed the outline about the example of the screen for a correction provided by the security evaluation device in one embodiment of the present invention, and the correction result screen provided by a security evaluation device. It is a figure which shows the outline | summary of the data structure of the data which question DB memorize | stored in one embodiment of this invention. It is the figure which showed the outline about the attribute check method in one embodiment of this invention. It is the figure which showed the outline | summary about the example of the logic judged based on the content of the answer in one embodiment of this invention. It is the figure which showed the outline | summary about the method of calculating the score of each question in one embodiment of this invention. It is the figure which showed the outline about the example of the flow of the process which judges the appropriateness of the information input from the terminal in one embodiment of this invention, and provides relative evaluation. It is the figure which showed the outline about the comparative example of the user's self-report and the result of a system trail in one embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described in detail based on the drawings. Note that, in all the drawings for describing the embodiments, the same reference numeral is attached to the same part in principle, and the repetitive description thereof will be omitted. On the other hand, the parts described with reference to the reference numerals in a certain drawing may be referred to by the same reference numeral although not shown again in the description of the other drawings.

  The security evaluation system which is one embodiment of the present invention acquires the response of security measures of each group (for example, company, school, government office etc.), statistically processes this response, and relates to the security measures of each group. It is a system which provides relative evaluation (for example, a deviation value, a score based on the execution situation of other users).

  Since the security assessment system provides a relative assessment of security measures, each user (for example, a company's information security officer) may decide whether the security measures are sufficient compared to other companies. it can.

<System Configuration (Overview)>
FIG. 1 is a diagram showing an outline of a configuration example of a security evaluation system according to an embodiment of the present invention. The security evaluation system 1 is, for example, a personal information held by a user 4 who is a person in charge of corporate information security who can connect to the security evaluation server 10 (security evaluation apparatus) via the security evaluation server 10 and the network 30 such as the Internet. And a terminal 40 such as a computer.

  The security evaluation server 10 is, for example, a server system consisting of a server device and a virtual server built on a cloud computing service, and the information on the security countermeasure status of the group (for example, company, school) to which the user 4 belongs Collect, record and accumulate to provide a relative assessment of security measures for each user.

  The security evaluation server 10 provides an evaluation screen as shown in FIG. 2 and provides information on relative evaluation. FIG. 2 is a diagram schematically showing an example of the evaluation screen. The evaluation screen shown in FIG. 2 is a screen showing a relative evaluation of the security countermeasure status of a certain group (in the example of FIG. 2, company A). In this evaluation screen, as a relative evaluation, the score (815 points) of the security countermeasure status calculated in consideration of the implementation status of the other company and the deviation value (64.5) are output. As described above, by providing the relative evaluation, the user 4 can determine whether or not sufficient security measures are taken as compared with other companies.

  The terminal 40 makes a service request for obtaining the above evaluation to the security evaluation server 10 in response to the input operation by the user 4. Further, the terminal 40 acquires a question from the security evaluation server 10 in response to the service request, and transmits an answer of the question to the security evaluation server 10. In addition, the terminal 40 acquires a relative evaluation based on the above answer, or updates the above answer.

<Screen transition>
Here, the screen transition provided by the security evaluation server 10 in response to a request from the terminal 40 will be described. First, upon receiving a service request from the terminal 40 of each user, the security evaluation server 10 transmits a service acceptance screen to the terminal 40. Here, the service acceptance screen will be described with reference to FIG. FIG. 3 is a diagram showing an outline of an example of the service acceptance screen provided by the output unit 14. As shown in FIG. 3, the service acceptance screen includes a mail address input area 300 which is an area for inputting a mail address, a confirmation mail transmission button 301, and a login request button 302. When the mail address input area 300 is input by the operation of the user 4 and the confirmation mail transmission button 301 is pressed, the terminal 40 transmits the mail address to the security evaluation server 10.

  In response to this, the security evaluation server 10 transmits an email including the URL of the group attribute registration destination to the email address. When the terminal 40 accesses the URL, the security evaluation server 10 transmits a group attribute input screen to the terminal 40.

  Here, the group attribute input screen will be described with reference to FIG. FIG. 4 is a diagram schematically showing an example of the group attribute input screen. As shown in FIG. 4, the group attribute input screen has an area for inputting group attributes such as a company name and a company representative name, and a “go to input confirmation screen” button for proceeding to input registration.

  In the terminal 40, the group attribute is input in the area for inputting the group attribute by the operation of the user 4, the "Go to input confirmation screen" button is pressed and input, and an instruction to confirm the input is input on the input confirmation screen not shown. Then, information indicating the group attribute is transmitted to the security evaluation server 10.

  After acquiring the information indicating the group attribute, the security evaluation server 10 sends an e-mail including the URL to the countermeasure response screen to the e-mail address. When the terminal 40 accesses the URL, the security evaluation server 10 transmits a countermeasure response screen to the terminal 40.

  Here, the countermeasure response screen will be described with reference to FIG. FIG. 5 is a diagram schematically showing an example of the countermeasure response screen. As shown in FIG. 5, the countermeasure response screen includes a question, an input portion of a reply to the question, and a “save current content” button indicating a storage request. As shown in FIG. 5, an example of the question is “specify the information security risk after grasping the business characteristic of the company”. In addition, there is a part to select the answer (“No”, “Yes”, etc.) of the question. In addition, the option of an answer can be set arbitrarily beforehand, for example, as shown in FIG. 7 mentioned later, "implemented / partially implemented / not implemented / not applicable", "not implemented / defined / documented It can be set as / implemented / reviewed / not applicable. The countermeasure response screen shown in FIG. 5 includes questions for each category. In the example of FIG. 5, the question which shows the category of "strategy" is shown.

  The terminal 40 transmits an answer of each question to the security evaluation server 10 when an answer is inputted on the countermeasure answer screen by the input operation by the user 4 and a “save current content” button is selected.

  When the security evaluation server 10 receives the response, the security evaluation server 10 transmits, to the terminal 40, an evaluation screen (FIG. 2) including a relative evaluation result based on the response.

  Further, when the login request button 302 is pressed on the service acceptance screen shown in FIG. 3, the login screen (not shown) is transmitted to the terminal 40, and when the login information is input on the login screen, the terminal 40 The login information is sent to the security evaluation server 10. The security evaluation server 10 transmits a correction screen to the terminal 40 in response to this.

  Here, the correction screen and the correction result screen will be described with reference to FIG. FIG. 6 is a diagram schematically showing an example of the correction screen 310 provided by the security evaluation server 10 and the correction result screen 320 provided by the security evaluation server 10.

  The correction screen 310 includes a score for each category (strategy category: 184 points / 250 points, etc.), a question, a current answer, a check box 311, and a simulation request button 312. When the simulation request button 312 is pressed in a state in which a check is input to the check box 311 corresponding to a question whose answer is “not performed” at present, the terminal 40 displays information indicating the checked question (for example, a question , And transmits an update request to the security evaluation server 10.

  In response to the update request, the security evaluation server 10 provides the correction result screen 320 (correction result screens 320A to 320C) to the terminal 40. The correction result screen 320 includes a current score and a score (correction score) when the correction content is reflected.

<Functional Description of Security Evaluation Server>
Returning to FIG. 1, the function of the security evaluation server 10 will be described. The security evaluation server 10 includes middleware (OS (Operating System), DBMS (DataBase Management System), Web server program, etc.) developed on the memory by a CPU (Central Processing Unit) (not shown), and software operated thereon. By executing the functions, the functions of the respective units described later are realized. In the present embodiment, as illustrated, for example, each unit such as an input reception unit 11 implemented as software, a determination unit 12, an evaluation unit 13, and an output unit 14 is included. Further, each of the company relationship DB 15, the correct answer DB 16 (correct answer information storage unit), the customer DB 17, the question DB 18, the point allocation DB 19, the answer DB 20, the evaluation result DB 21 and the like recorded in a storage device such as HDD (Hard Disk Drive) not shown. It has a data store.

  The input receiving unit 11 is a part that receives an information input including an answer to a question regarding security measures of each user 4. The input receiving unit 11 receives a service request from the terminal 40 of each user 4. When receiving the service request, the input reception unit 11 notifies the output unit 14 of the service request.

  Further, the input receiving unit 11 receives an input of an e-mail address from the terminal 40. The input reception unit 11 stores the e-mail address, sends the e-mail address to the output unit 14, and makes a transmission request of the e-mail including the URL of the group attribute registration destination addressed to the e-mail address. When receiving the access request to the URL included in the mail from the terminal 40, the input receiving unit 11 sends the output request of the group attribute input screen to the output unit 14.

  Further, the input reception unit 11 receives information indicating a group attribute from the terminal 40. The input reception unit 11 sends the information indicating the group attribute and the e-mail address to the determination unit 12, and makes an attribute check request. When the input acceptance unit 11 receives an answer indicating that the attribute is appropriate from the determination unit 12 in response to the attribute check request, the URL of the countermeasure response screen addressed to the stored mail address for the output unit 14 Make a request to send an email containing.

  When the input reception unit 11 receives that the terminal 40 has accessed the URL included in the mail, the input reception unit 11 requests the output unit 14 to transmit the countermeasure response screen.

  The output unit 14 generates a measure response screen with reference to the question DB 18 and transmits the measure response screen. Here, the information stored in the question DB 18 will be described using FIG. 7. FIG. 7 is a diagram showing an outline of a data structure of data stored in the question DB 18. As shown in FIG. 7, it has each item of the question identification number (#), the question, and the answer option. The question identification number is a number for identifying each question. The question is the content of the question. The answer options are the corresponding question options. Examples of options include "Activated (Yes) / Partially implemented / Not implemented (No) / (n / a)" and "Defined / Documented / Implemented / Reviewed / Not applicable". Questions that are defined, documented, etc. are referred to as questions in group A. In addition, questions whose options are implemented, partially implemented, not implemented, etc. are referred to as group B questions. Further, the question DB 18 includes information indicating the category (large category, medium category) of each question, the degree of difficulty of each question, and the relevance of each question.

  The input reception unit 11 receives the response transmitted from the terminal 40 and sends the response to the determination unit 12. Further, the input reception unit 11 also sends the time when the countermeasure response screen was sent to the terminal 40 and the time when the response was received to the determination unit 12.

  When the input receiving unit 11 receives a log-in from a group that has already received a response, the input receiving unit 11 sends out the user ID used for the log-in to the output unit 14 and is a screen for correcting the response. Make a screen transmission request.

  When the input reception unit 11 receives an update request (update input) together with the update location from the terminal 40, the input reception unit 11 sends the update location, the user ID corresponding to the terminal 40, and an update request to the determination unit 12.

  The determination unit 12 is a portion that determines the appropriateness of the information input by the input reception unit 11. Determination unit 12 determines the appropriateness of the content input by input accepting unit 11 based on the result of comparing the information indicating the group attribute accepted by input accepting unit 11 with the correct attribute information stored in advance. Do.

  Specifically, the determination unit 12 refers to the correct solution DB 16 when the input reception unit 11 acquires the group attribute including the mail address. Here, the check of the group attribute will be described with reference to FIG. FIG. 8 is a diagram for explaining the outline of the attribute check method. First, the information stored in the correct answer DB 16 will be described using FIG. 8 (a). FIG. 8A shows an outline of the data structure of data stored in the correct answer DB 16. As shown in FIG. 8A, each item of “company”, “worker”, and “mail domain” is included.

  "Company" is the name of a company. "Worker" is the name of an employee who works for a company. "Email domain" is the domain part of a corporate email address. Whether the mail domain corresponding to the company name of the correct answer DB 16 identical to the registered company name among the attributes acquired by the input reception unit 11 matches the domain portion of the mail address acquired by the input reception unit 11 among the attributes acquired by the input reception unit 11 Decide whether or not. The determination unit 12 determines that the attribute input is appropriate if the person in charge is the first person in the same company who has made a registration request when the determination results in a match.

  On the other hand, when judging that the domain part of the mail address acquired from the input reception unit 11 and the mail domain of the correct answer data DB 12 do not match, the judgment unit 12 judges that the attribute input is not appropriate. In addition, even if the determination unit 12 determines that the domain part of the email address acquired from the input acceptance unit 11 matches the email domain of the correct answer data DB 12, a registration request is made from another person in charge already belonging to the same company. If yes, it is determined that the attribute input is not appropriate.

  An example of determination by the determination unit 12 will be described with reference to FIG. FIG. 8B is an example of the result of using the correct answer data to determine whether the attribute input is appropriate. In this example, the registration order, the analysis pattern (determination result), the registered company name, the e-mail address of the person in charge, and the necessity of confirmation are included. The necessity of confirmation indicates the necessity of outputting an error message.

  In the first case of registration order, the domain of the e-mail address is that of company A, even though it is registered with company B, so the judgment result is "spoofing?". In this case, the determination unit 12 determines that the attribute input is not appropriate. In the second case, the registered company name is company A, the domain of the e-mail address is that of company A, and since company A registers for the first time, it is judged that the attribute input is appropriate. It has become.

  In the third case of registration order, the registered company name is company A, and the domain of the e-mail address is that of company A, but since company A is the second person, the judgment result "the same company name domain second person" It has become. In this case, the determination unit 12 determines that the attribute input is not appropriate. This is because if one group accepts a plurality of answers and if such an answer is used for relative evaluation, an appropriate relative evaluation can not be obtained.

  If the determination unit 12 determines that the appropriate attribute is input, the determination unit 12 replies to the input reception unit 11 that the attribute is appropriate. If the determination unit 12 determines that the appropriate attribute is input, the determination unit 12 registers the input attribute in the customer DB 17. The determination unit 12 generates identification information of the attribute (information necessary for login such as a user ID), and registers the identification information in the customer DB 17 in association with the attribute. Further, the determination unit 12 refers to the company relationship DB 15 which is a database defining the relationship between companies, company group information (information indicating the company group to which the company belongs) corresponding to the company name of the attribute, business type information Acquire (information indicating the type of business of the company). The determination unit 12 registers these pieces of information in the customer DB 17 in association with the above attributes.

  If the determination unit 12 determines that the appropriate attribute is not input, the determination unit 12 replies to the input reception unit 11 that the attribute is not appropriate. In response to this, the input reception unit 11 outputs an attribute error message to the terminal 40 to the output unit 14. Instead of outputting the attribute error message to the terminal 40 used by the user, the information of the user determined not to be appropriate is transmitted to the administrator user of the security evaluation system (not shown) or the terminal used by the operator, etc. For example, the operator may contact the target user individually by means of a telephone, an e-mail, or the like. Further, the process of outputting the attribute error message to the terminal 40 and the process of transmitting the information of the user who is determined not to be appropriate to the administrator user or the terminal used by the operator may be performed simultaneously.

  Further, the determination unit 12 determines the appropriateness of the input by the input receiving unit 11 based on the content of the answer received by the input receiving unit 11. When acquiring the input date and time, the response acquisition date and time, and the content of the response from the input reception unit 11, the determination unit 12 makes a determination (response check) based on the response.

  Here, FIG. 9 illustrates an example of logic that the determination unit 12 makes a determination based on the content of the answer. As described in FIG. 9, the determination unit 12 determines the appropriateness of the input based on the contents of the answer from five viewpoints. The determination unit 12 determines the first viewpoint "select all the answers as the right end / left end". Specifically, the determination unit 12 determines that the input is not appropriate when it refers to the entire answer and determines that only the option at the right end or the option at the left end of the answer portion of the answer screen is selected.

  In addition, the determination unit 12 determines the second point of view “select answers in zigzag”. Specifically, the determination unit 12 refers to the entire answer and determines whether the answer is shifted one by one from the upper question to the lower question. When judging that the answer is selected in a zigzag manner based on this judgment, the judgment unit 12 judges that the input is not appropriate. Thus, based on the first and second viewpoints, the determination unit 12 determines whether the input is appropriate based on whether or not it belongs to the predetermined pattern.

  In addition, the determination unit 12 determines the third point of view, "the time taken to answer is extremely short". Specifically, the determination unit 12 calculates the response time based on the input date and time from the input reception unit 11 and the response acquisition date and time. When the response time is shorter than a predetermined threshold, the determination unit 12 determines that the time taken for the response is extremely short. Thus, the determination unit 12 determines whether the input is appropriate based on the input speed.

  Further, the determination unit 12 makes a determination regarding the fourth viewpoint “the answer is different for similar questions”. Specifically, when the answers of the mutually related questions defined in the question DB 18 do not match, the determination unit 12 determines that the input is not appropriate.

  In addition, the determination unit 12 determines the fifth point of "selecting that a simple countermeasure is not implemented but a sophisticated countermeasure is implemented". Specifically, the judgment unit 12 refers to the degree of difficulty of each question defined in the question DB 18, and when a question whose degree of difficulty is higher than the question which is selected to be unexecuted is selected to be performed, the input is I judge that it is not appropriate. Thus, based on the fourth and fifth viewpoints, the determination unit 12 determines whether the input is appropriate based on whether or not there is a contradiction in the answer.

  When determining that the input is not appropriate for any of the first to fifth viewpoints, the determination unit 12 adds information indicating that the response is not appropriate and registers the response in the response DB 20. If the determination unit 12 determines that the input is not proper, the determination unit 12 responds to the input reception unit 11 that the input is not proper. In response to this, the input reception unit 11 outputs an answer error message to the terminal 40 to the output unit 14.

  Further, if the determination unit 12 does not determine that the input is not appropriate for any of the first to fifth viewpoints, it determines that the input is appropriate and does not add information indicating that the input is not appropriate. , The answer is registered in the answer DB 20, and the user ID and the answer are sent to the evaluation unit 13.

  When registering the response in the response DB 20, the determination unit 12 registers the response in association with the user ID and the information indicating the company to which the user belongs.

  Further, the determination unit 12 determines the appropriateness of the input based on the frequency of the update input (update request) accepted by the input acceptance unit 11. The determination unit 12 acquires the user ID, the update location, and the update (update request).

  The determination unit 12 stores information in which the user ID and the update request time are associated each time it acquires that the update is performed. The determination unit 12 refers to the information and determines that the input is not appropriate when the update frequency (for example, 100 times of update per day) is high within the latest predetermined period.

  Further, the determination unit 12 refers to the response DB 20, acquires a response corresponding to the user ID, and applies the updated portion to the response, with respect to the viewpoints of 1, 2, 4 and 5 in FIG. It may be determined to determine the appropriateness of the input. If the determination unit 12 determines that the input is not appropriate, the determination unit 12 adds information indicating that the input is not appropriate to the response corresponding to the user ID, with respect to the data in the response DB 20. If the determination unit 12 determines that the input is not proper, the determination unit 12 responds to the input reception unit 11 that the input is not proper. In response to this, the input reception unit 11 outputs an answer error message to the terminal 40 to the output unit 14. On the other hand, when the update frequency is not high (that is, when it is determined that the input is appropriate), the determination unit 12 sends the user ID and the update location to the evaluation unit 13.

  The evaluation unit 13 is a part that statistically processes the responses to the information input determined to be appropriate by the determination unit 12 and performs a relative evaluation on the security measures of each company. When the evaluation unit 13 acquires the user ID and the response from the determination unit 12, the evaluation unit 13 starts relative evaluation based on the response.

  The evaluation unit 13 calculates, as a relative evaluation, a score of the response in consideration of the other company's implementation value. The evaluation unit 13 calculates the score of each question by multiplying the point allocation set for each question of the answer, the adjustment coefficient set for each large category, and the value corresponding to the answer contents of each question. is there. The adjustment coefficient and the point allocation are stored in advance in the point allocation DB 19.

  A method of calculating the score of each question will be described with reference to FIG. FIG. 10 is a diagram showing an outline of a method of calculating the score of each question. As a premise, a score of 1000 is given. Divide points into each large category. For example, in the case where the major categories are “strategy”, “people / organization”, “technology”, and “emergency”, the score for each major category is 1000/4 = 250 points. Subsequently, the adjustment factor will be described. The adjustment factor is a value obtained by dividing the score of each large category by the number of elements (questions) belonging to each large category. If there are 10 major category questions, the adjustment factor is 250/10 = 25.

  In addition, values (company results) corresponding to the answer contents of each question are determined based on the answer contents. Specifically, in the case of questions in group A, "not implemented" is 0 points, "defined" is 0.25 points, "documented" is 0.5 points, "implemented" is 0.75 points, "reconsidered" is 1 point. In the case of questions in group B, “Not implemented” indicating no is 0, “partially implemented” is 0.5, and “implemented” is 1. In addition, “Not applicable”, which indicates that the measures do not apply to its own organization in either group A or B, is one point.

Subsequently, the point allocation will be described. First, the “other companies implementation value” described in FIG. 10 will be described. The “other company implementation value” is an average value of each company's result for each question in an answer (valid answer) to which information indicating that the input is not appropriate is not added among the answers stored in the answer DB 20 (S _{i_1} etc.). Also, S _i is the sum of competitor's implementation values of questions belonging to the middle category which is a low category of the large category. As described above, the evaluation unit 13 performs a relative evaluation using the result of statistically processing the contents of the answers of a plurality of companies (other-company implementation values).

The “system weight” is a value set by the security evaluation provider for each question (for example, _{Ti_1} ). Also, T _i is the sum of system weights of questions belonging to the middle category.

The “allocation” is a value based on the other company implementation value and the system weight. Specifically, a third embodiment value _{S i_k} the questions _{C k,} if the system weights the questions _{C k} is _{T i_k,} Scoring of question _{C k is, {s (S i_k / S} i) + t (T i_k / T _i )} * 100. Here, s and t are coefficients, and for example, s is 0.3 and t is 0.7 (the sum of s and t is 1.0).

  The distribution points and the adjustment coefficients are stored in advance in the distribution point DB 19, and the distribution points and the adjustment coefficients stored in the distribution point DB 19 may be automatically updated according to changes in the other company implementation values, etc. It may be possible to update at an arbitrary timing by the administrator of the security evaluation system. The evaluation unit 13 acquires allocation points and adjustment coefficients from the allocation point DB 19 each time the evaluation is performed. In addition, the evaluation unit 13 calculates allocation points by referring to the answers stored in the answer DB 20 (answers to which the information indicating that the information is not appropriate is not attached) every predetermined time (for example, every week). The calculated result is stored in the point allocation DB 19.

The “score” is equivalent to the above “allocation” (for example, the score of the question C _k is U _k ). The evaluation unit 13 multiplies each company result X _k , the score U _k, and the adjustment coefficient as the score of the question C _k . Further, the evaluation unit 13 counts, for each large category, the scores of the questions belonging to the large category. This tabulation result is the score of the large category.

  Further, the evaluation unit 13 refers to the evaluation result DB 21 to acquire the score for each large category of each user, and calculates the deviation value for each large category using these scores. The evaluation unit 13 sends the score for each of the large categories and the deviation value to the output unit 14. Further, the evaluation unit 13 registers, in the evaluation result DB 21, evaluation information including the user ID, the score for each large category, and the deviation value.

  Further, when the evaluation unit 13 acquires an update part (a question to be updated, an updated answer) together with the user ID from the determination unit 12, the evaluation unit 13 acquires an answer corresponding to the user ID from the answer DB 20. Further, the evaluation unit 13 acquires evaluation information from the evaluation result DB 21. Further, the evaluation unit 13 acquires the distribution point and the adjustment coefficient from the distribution point DB 19. The evaluation unit 13 calculates, for each of the large categories, the updated score, using the answer after the update, the point allocation, and the adjustment coefficient, for the question in the updated portion. Moreover, the deviation value for each large category is calculated based on the score after the update.

  The evaluation unit 13 sends the score before update for each large category, the score after update, the deviation value before update, and the deviation value after update to the output unit 14. Further, the evaluation unit 13 updates the response DB 20 based on the updated portion. Further, the evaluation unit 13 updates the evaluation result DB 21 based on the updated score and the deviation value.

  The output unit 14 is a part that outputs information to the terminal 40. When receiving the service request from the input reception unit 11, the output unit 14 outputs a service reception screen to the terminal 40.

  The output unit 14 acquires an e-mail address from the input reception unit 11, and upon receiving a transmission request for an e-mail including the URL of the group attribute registration destination, generates and transmits the e-mail addressed to the e-mail address.

  When the output unit 14 receives an output request for the group attribute input screen from the input reception unit 11, the output unit 14 outputs the group attribute input screen to the terminal 40.

  The output unit 14 acquires an e-mail address from the input reception unit 11, and upon receiving a transmission request for an e-mail including the URL of the countermeasure response screen, generates and transmits the e-mail addressed to the e-mail address.

  When the output unit 14 receives the transmission request for the countermeasure response screen from the input reception unit 11, the output unit 14 transmits the countermeasure response screen to the terminal 40.

  When the output unit 14 receives the user ID of the request source from the input reception unit 11 and receives the transmission request for the correction screen, the output unit 14 refers to the response DB 20 and acquires a response corresponding to the user ID. Further, the output unit 14 outputs the evaluation information corresponding to the user ID with reference to the evaluation result DB 21. The output unit 14 generates an update screen including the response and the evaluation, and outputs the update screen to the terminal 40.

  In addition, when the output unit 14 acquires the score for each large category and the deviation value from the evaluation unit 13, the output unit 14 generates an evaluation screen including the score for each large category and the deviation value, and the terminal displays the evaluation screen Output to 40

  In addition, when the output unit 14 acquires from the evaluation unit 13 the score before update for each large category, the score after update, the deviation value before update, and the deviation value after update, the correction including the above information is performed. A result screen 320 is generated, and the correction result screen 320 is sent to the terminal 40.

<Flow of processing>
FIG. 11 is a diagram showing an outline of an example of a process flow of determining the appropriateness of the information input from the terminal 40 and providing relative evaluation in the present embodiment.

  First, the terminal 40 transmits an attribute (group attribute) such as an e-mail address or a company name to the security evaluation server 10 by the input operation of the user 4 (S01). The security evaluation server 10 compares the input attribute with the correct answer information to check the attribute (S02).

  The security evaluation server 10 transmits a countermeasure response screen to the terminal 40 if the input is correct as a result of the attribute check (S03). The terminal 40 transmits the response input on the countermeasure response screen to the security evaluation server 10 (S04). The security evaluation server 10 checks the response for the response (S05). If the input is appropriate as a result of the response check, the security evaluation server 10 performs a relative evaluation, and transmits an evaluation result screen to the terminal 40 (S06). The terminal 40 displays the evaluation screen and ends the series of processes (S07).

  In the above embodiment, the determination unit 12 described the case of determining whether the input is appropriate or not based on the content of the answer, but further acquires the result of the system trail audit tool, and the result of the system trail audit tool , And the answers may be compared to determine whether the input is appropriate based on the comparison result.

  Here, FIG. 12 shows a comparison example of the user's self-report and the system trail result. Since the question "monitoring of the security log by SOC etc." has already been implemented for both the user's self-report (answer) and the system trail (result of the system trail audit tool), it can be determined that the answer is appropriate. In the question “targeted email training implementation”, the system trail has been implemented even though the user's self-report has not been implemented. This has the possibility of an answer mistake (an answer omission). The question “outsourcee management / audit” is that the user's self-report has been reviewed and the system trail has been implemented. This may be wrong with self-reporting.

  If the number of answers with incorrect answer or self-report as described above is larger than the threshold set in advance, the determination unit 12 may determine that the input is not appropriate. This makes it possible to prevent the security evaluation server 10 from performing a relative evaluation using an unreliable response.

  Moreover, in the above-mentioned embodiment, although judgment part 12 described the case where it was judged whether the time concerning an answer was extremely short by answering time based on an input date and an answer acquisition date, it is a question unit The response time may be acquired, and it may be determined whether the time taken for the response is extremely short based on the response time.

  In addition, a heat map for each question or category in each group may be displayed on the evaluation screen.

  Alternatively, another company implementation value may be calculated for each company group or industry type, and a point allocation having the other company implementation value may be stored in the point allocation database 19 for each company group or industry type. In this case, the evaluation unit 13 can perform relative evaluation on a company group basis or a business sector basis by using this point allocation.

  As described above, the input receiving unit 11 receives an information input including an answer to a question regarding security measures of each group, and the judging unit 12 judges the appropriateness of the information input, and the evaluating unit 13 judges the judging unit 12. Statistically process the responses that are judged to be appropriate by In this way, it is possible to eliminate the fraudulent response or the input content from the fraudulent user and to make a relative evaluation. That is, the security evaluation server 10 can provide a relative evaluation of security measures using an appropriate answer.

  Further, the determination unit 12 determines the appropriateness of the input based on the result of comparing the information (e-mail address, company name, etc.) regarding the group received by the input reception unit 11 with the correct answer attribute information. According to this, since the security evaluation server 10 can not accept the answer of the question from the user whose attribute is not properly input such as the input of impersonation, such an answer is removed and the relative It can be evaluated. That is, the security evaluation server 10 can appropriately perform the relative evaluation of the security measures.

  In addition, since the determination unit 12 determines the appropriateness of the input based on the contents of the answer, it is possible to avoid performing the relative evaluation using the incorrect answer. Specifically, the determination unit 12 determines the appropriateness of the input based on whether or not the answer content belongs to a predetermined pattern (an answer or the like of only the left end). As a result, the security evaluation server 10 can appropriately identify simple pattern answers that have a high probability of fraudulent answers, and can remove such answers and perform relative evaluation.

  Further, the determination unit 12 determines the appropriateness of the input based on whether or not there is a contradiction in the respective answers of the questions related to each other. As a result, the security evaluation server 10 can identify an answer having a high probability of an incorrect answer and an answer that is inconsistent, and can remove such an answer and perform a relative evaluation.

  In addition, since the determination unit 12 determines the appropriateness of the input based on the input speed of the response, it is possible to identify the response that has been loosely answered (a response having a high probability of the fraudulent response).

  In addition, since the determination unit 12 determines the appropriateness of the input based on the frequency of the update input, it is possible to specify an answer from the user who is the object of the logic analysis or the user who is not properly verified. it can. As a result, the security evaluation server 10 can remove the above answers and perform relative evaluation.

  As mentioned above, although the invention made by the present inventor was concretely explained based on an embodiment, the present invention is not limited to the above-mentioned embodiment, and can be variously changed in the range which does not deviate from the summary. It goes without saying. For example, the above embodiments have been described in detail in order to explain the present invention in an easy-to-understand manner, and are not necessarily limited to those having all the described configurations. Moreover, it is possible to add, delete, and replace other configurations with respect to a part of the configurations of the above-described embodiment.

  In addition, each of the configurations, functions, processing units, processing means, etc. described above may be realized by hardware, for example, by designing part or all of them with an integrated circuit. Further, each configuration, function, etc. described above may be realized by software by the processor interpreting and executing a program that realizes each function. Information such as a program, a table, and a file for realizing each function can be placed in a memory, a hard disk, a recording device such as a solid state drive (SSD), or a recording medium such as an IC card, an SD card, or a DVD.

  Further, in each of the above-mentioned drawings, control lines and information lines indicate what is considered to be necessary for explanation, and not all control lines and information lines on mounting are necessarily shown. In practice, almost all configurations may be considered to be mutually connected.

  INDUSTRIAL APPLICABILITY The present invention is applicable to a security evaluation system and a security evaluation method that statistically processes answers of questions concerning security measures of each group by an information processing system.

1 ... Security evaluation system,
DESCRIPTION OF SYMBOLS 10 ... Security evaluation server, 11 ... Input reception part, 12 ... Judgment part, 13 ... Evaluation part, 14 ... Output part, 15 ... Corporate relationship DB, 16 ... Correct answer DB, 17 ... Customer DB, 18 ... Question DB, 19 ... Allocation point DB, 20 ... answer DB, 21 ... evaluation result DB,
30 ... network,
40 ... terminal.

Claims (5)

It is a security evaluation system that performs relative evaluation on security measures.
An input reception unit that receives information input including answers to questions about security measures of each group;
A determination unit that determines the appropriateness of the information input by the input reception unit;
An evaluation unit that statistically processes the responses of a plurality of groups in the information input determined to be appropriate by the determination unit, and performs a relative evaluation on security measures in each group;
An output unit that outputs a relative evaluation by the evaluation unit;
, A security assessment system. In the security evaluation system according to claim 1,
The information processing apparatus further comprises a correct answer information storage unit that stores correct answer information of the attribute regarding the group,
The input receiving unit receives an input of information indicating an attribute related to a group.
The determination unit is configured to input information by the input reception unit based on a result of comparing information indicating the attribute regarding the group received by the input reception unit with the correct attribute information stored by the correct information storage unit. Security evaluation system that determines appropriateness. In the security evaluation system according to claim 1 or 2,
The relevance of the question is pre-defined,
The input receiving unit receives information input of answers of respective questions related to each other,
The security evaluation system, wherein the determination unit determines the appropriateness of the input by the input reception unit, based on whether or not there is a contradiction in each answer of the related questions received by the input reception unit. The security evaluation system according to any one of claims 1 to 3.
The input receiving unit receives an update input of the answer,
The security evaluation system, wherein the determination unit determines the appropriateness of the input by the input reception unit based on the frequency of the update input. A security evaluation method implemented by a security evaluation system that performs a relative evaluation on security measures,
An input receiving step of receiving information input including answers to questions on security measures of each group;
A judgment step of judging the appropriateness of the information input received in the input reception step;
An evaluation step of statistically processing the responses of a plurality of groups in the information input determined to be appropriate in the determination step and performing a relative evaluation on security measures in each group;
An output unit for outputting a relative evaluation by the evaluation step;
Security assessment methods, including:

Images