JP2023045963A - Support device, support system, support method, support program - Google Patents

Abstract

To provide a system comprising multiple devices that meet security standards considering security levels and different security standards that support compliance with guidelines.SOLUTION: A security standard compliant support device includes a standard/level input unit configured to further accept input of a designation of an object system and a designation of one or more sets of security standard and security level for the object system, a system configuration input unit configured to accept input of a device group for grouping one or more devices constituting an object system having the same set of security standard and security level, a search unit configured to search for security requirements and corresponding countermeasures, by referring to a database in which, for each security standard and security level, security requirements, corresponding countermeasures, and devices subject to the security requirements are associated with each other, and a display unit configured to display security requirements and countermeasures searched by the search unit for each device constituting the object system.SELECTED DRAWING: Figure 11

Description

The present invention relates to a support device, a support system, a support method, and a support program.

Various security standards and guidelines have been established for IoT (Internet Of Things) systems, etc., and devices that build systems are required to comply with these standards and guidelines. It must be done properly in accordance with As a technology related to this, a support device and a support system conforming to security standards for an IoT system as shown in Patent Literature 1 are known.

Patent application 2021-006232

However, security standards and guidelines stipulate various security levels, and each device that builds an IoT system complies with different standards and guidelines. Therefore, in making IoT systems compatible with security standards, it is necessary to check the requirements that each device must meet one by one.

Also, if you want to strengthen the security level of some devices that make up the IoT system after satisfying a certain security level for the entire IoT system, as shown in Patent Document 1, the lowest security level among the devices that make up the IoT system Security level If the security level of the entire IoT system is unified, it is difficult to deal with it.

In particular, recent IoT systems often have large-scale configurations, requiring a lot of labor to check the requirements of each component. Furthermore, IoT systems tend to become more complex, and there are cases where devices with high security levels and devices with low security levels coexist.

An embodiment of the present invention has been devised in view of the above points, and aims to support the construction of a system that complies with security standards and guidelines in consideration of security levels.

In order to achieve the above object, a support device according to one embodiment is a device that supports security standard compliance of a target system composed of one or more devices, and comprises: specifying the target system; The input unit for further inputting the designation of the set of security standard and security level, The input unit for inputting the device group to which each device constituting the target system belongs, The security standard and the security level By referring to a database in which security requirements, countermeasures against the security requirements, and devices subject to the security requirements are associated with each other, each of the security standards and security levels that make up the target system A search unit for searching for security requirements and countermeasures against the security requirements for devices, and a display unit for displaying the security requirements and countermeasures searched by the search unit for each device that constitutes the target system. and have

In a system that consists of multiple devices that support different security standards, it is possible to support compliance with security standards and guidelines that consider security levels.

It is a figure which shows an example of the hardware constitutions of the security standard support apparatus which concerns on this embodiment. 1 is a diagram illustrating an example of a functional configuration of a security standard support device according to an embodiment; FIG. 4 is a diagram showing an example of information stored in a device DB; FIG. FIG. 4 is a diagram showing an example of information stored in a requirement/countermeasure DB; 9 is a flowchart showing an example of first security standard compliance support processing according to the present embodiment; It is a figure which shows an example of component apparatus information. It is a figure which shows an example of connection information. 1 is a diagram showing an example of the configuration of a system targeted for security standard compliance support; FIG. FIG. 5 is a diagram showing an example of device configuration information to which device group information is added; 1 is a diagram showing an example of the configuration of a grouped system targeted for security standard compliance support; FIG. FIG. 3 is a diagram showing a display example (part 1) of system configuration, security standards, security levels, security requirements, and countermeasures; FIG. 10 is a diagram showing a display example (part 2) of the system configuration, security standards, security levels, security requirements, and countermeasures; FIG. 10 is a diagram showing a display example (part 3) of the system configuration, security standards, security levels, security requirements, and countermeasures; FIG. 10 is a diagram showing a display example (part 4) of the system configuration, security standards, security levels, security requirements, and countermeasures; 9 is a flow chart showing an example of a second security standard compliance support process according to the present embodiment; It is an example of a communication sequence between the security standard support device 10 and a device. It is an example of the message structure of the device information response command. FIG. 10 is a diagram showing a display example of the system configuration, security standards, security levels, security requirements, and countermeasures when inconsistency occurs in system configuration information;

An embodiment of the present invention will be described below. In this embodiment, a security standard compliance support device 10 that supports compliance with security standards and guidelines in consideration of security levels (hereafter, security standards and guidelines are collectively referred to simply as "security standards") will be described. By using this security standard compliance support device 10, the user can know the requirements to be met by each device at the desired security standard and security level and countermeasures for a system composed of desired devices. becomes.

<Hardware Configuration of Security Standard Support Device 10>
First, the hardware configuration of the security standard support device 10 according to the present embodiment will be described with reference to FIG. FIG. 1 is a diagram showing an example of the hardware configuration of a security standard support device 10 according to this embodiment.

As shown in FIG. 1, the security standard compliance support device 10 according to the present embodiment is realized by the hardware configuration of a general computer or computer system, and communicates with an input device 101, a display device 102, and an external I/F 103. It has an I/F 104 , a processing device 105 and a storage device 106 . Each hardware of these 101 to 106 is connected via a bus line 107 so as to be able to communicate with each other. In this specification, the security standard support device 10 is assumed to be a personal computer, but it may be a smart phone or a tablet PC (Personal Computer), for example.

The input device 101 is, for example, a keyboard, mouse, touch panel, various buttons, and the like. The touch panel may be operated with a finger, or may be operated using a touch pen, stylus pen, or the like.
The display device 102 is, for example, a display. Display materials, liquid crystal panels, organic EL, etc. are assumed, but no particular designation is made.

The external I/F 103 is an interface with the recording medium 108 and the external device 109 . Examples of the recording medium 108 include CDs (Compact Discs) and DVDs (Digital Versatile Discs).
, Blu-ray (registered trademark), SD memory card (Secure Digital memory card)
etc. As the external device 109 , a case in which a display, a keyboard, or the like is connected to the outside of the security standard gymnastics support device 10 can be considered. As the external I/F 103 for connecting the external device 109 and the security standard support device 10, in addition to wired connection methods such as USB (Universal Serial Bus) and RS-232C, Bluetooth (registered trademark), NFC (Near A wireless connection method using a short-range wireless communication technology such as field communication is conceivable.

The communication I/F 104 is an interface for connecting the security standard support device 10 to a communication network, and includes a wireless antenna, an electric circuit, and the like necessary for communication, although not shown in the drawing. The communication network referred to here refers to, for example, Ethernet (registered trademark) or Wi-Fi (IEEE802.11, etc.), and performs wired or wireless communication.

The processing device 105 is, for example, various arithmetic devices such as a CPU (Central Processing Unit).
The storage device 106 is, for example, an SSD (Solid State Drive), RAM (Random Access Memory), ROM (Read Only Memory), flash memory, or the like.

The first security standard support device 10 according to the present invention has the hardware configuration shown in FIG. 1, so that it can implement various processes described later. The hardware configuration shown in FIG. 1 is merely an example, and the security standard support device 10 may have other hardware configurations. For example, the security standard compliance support device 10 may have a plurality of display devices 102, a plurality of external I/Fs 103, a plurality of communication I/Fs 104, a plurality of processing devices 105, and a plurality of storage devices 106, respectively. Further, the security standard compliance support device 10 does not need to incorporate the input device 101 or the display device 102. In this case, for example, an external device connected via the external I/F 103 or the communication I/F 104 can be used as the input device. It can be used as a substitute for 101 and display device 102 . Of course, the input device 101 may be incorporated and an external input device may be used together, or the display device 102 may be incorporated and an external display device may be used.

<Functional Configuration of Security Standard Support Device 10>
Next, the functional configuration of the first security standard support device 10 according to this embodiment will be described with reference to FIG. FIG. 2 is a diagram showing an example of the functional configuration of the security standard support device 10 according to this embodiment.

As shown in FIG. 2, the first security standard support device 10 according to this embodiment includes a system configuration input unit 201, a standard/level input unit 202, a requirement/countermeasure search unit 203, and a display unit 204. and Each of these units is implemented by processing that one or more programs installed in the security standard compliance support device 10 cause the processing device 105 to execute.

The first security standard support device 10 according to this embodiment also has a device DB 205 and a requirements/countermeasures DB 206 . Each of these DBs (databases) can be realized by the storage device 106, for example. However, at least one of these DBs may be realized by an external storage device (for example, a database server, etc.) connected to the security standard support device 10 via a communication network. Alternatively, at least one of the DBs may reside on the recording medium 108 connected via the external I/F 103 .

A system configuration input unit 201 has a function for the user to input designation of the system configuration. Here, the system configuration means the device names and device types of the devices included in the system to be supported in compliance with the security standard, and the connection relationship between the devices. As will be described later, the device DB 205 stores information indicating the type of device and the I/F that can be used by the device. 10), the device type is selected from the device DB 205, the device name is given, and the system configuration is specified by selecting the I/F that connects the devices. can do things

A standard/level input unit 202 inputs designation of a security standard and a security level by a user. As will be described later, the requirement/countermeasure DB 206 stores information indicating security standard names and security levels in the security standards. The security standard and security level can be specified by selecting the security standard name and security level from the requirements/countermeasures DB 206 using the terminal communicably connected to the client.

Note that the security level is the degree of safety with respect to the requirements (security requirements) defined in the security standards. How to indicate the security level differs depending on the security standard, but for example, "low", "medium", "high" or "1", "2", "3", etc. are common. be. For example, if the security level is defined by numbers, whether the numbers are arranged in descending or ascending order depends on the security standard. There may also be a standard for level "1".

The requirements/measures search unit 203 uses the system configuration, security standard, and security level specified by the user to search for each device included in the system to be supported for compliance with the security standard according to the security standard and security level. The requirements and countermeasures DB 206 are searched for requirements that the device should satisfy and countermeasures for the requirements.

The display unit 204 displays the system configuration of the system to be supported for compliance with security standards, the requirements to be met by each device included in this system, and countermeasures against the requirements on the security standard compliance support device 10 (or security standard compliance support device 10). It is displayed on the display device 102 of the terminal communicably connected to the security standard compliance support device 10 or an external display device communicably connected to the security standard compliance support device 10 .

The device DB 205 stores information indicating the types of devices that can be components of the system and the I/Fs that can be used by the devices. Here, an example showing information stored in the device DB 205 will be described with reference to FIG. FIG. 3 is a diagram showing an example of information stored in the device DB 205. As shown in FIG.

The information stored in the device DB 205 shown in FIG. 3 associates device types with usable I/Fs. The device type is the type (or type) of the device, and FIG. 3 illustrates server machines, routers, controllers, sensors, and actuators. Usable I/F is a means for devices of the device type to communicate with devices other than the device. In FIG. can be used. Similarly, it is illustrated that a router can use a wired LAN, a controller can use a wired LAN or serial communication, and a sensor and an actuator can use serial communication.

The requirements/countermeasures DB 206 stores information indicating security standard names, security levels in the security standards, requirements to be met by each device at each security level, countermeasures against the requirements, and the like. Here, an example of information stored in the requirement/countermeasure DB 206 will be described with reference to FIG. FIG. 4 is a diagram showing an example of information stored in the requirement/countermeasure DB 206. As shown in FIG.

The information stored in the requirement/countermeasure DB 206 shown in FIG. 4 associates security standard names, security requirement classifications, security requirement details, security levels, security requirements, countermeasures, and target devices. It has become a thing.
The security standard name is the name of the security standard, and "standard A" and "standard B" are exemplified in FIG. The security requirement classification is a classification of security requirements defined by the security standard, and "user authentication" and "operation record" are exemplified in FIG. The security requirements are requirements for ensuring the security stipulated by the relevant security standard. "to leave" is exemplified. The security level is the degree of safety for the request, and "low", "middle", and "high" are exemplified in FIG.

The security requirements are the requirements required to realize the request at the security level. In Fig. 4, for the combination of the requirement of "standard A", "performing user authentication and identification" and the security level of "low", "The function cannot be accessed without authentication" is exemplified. Similarly, for the combination of the security level "medium" of "user authentication and identification", which is a requirement of "standard A", "identifying and authenticating the user" is the same as the security level "high". For each combination, "setting a strong password" is exemplified.

Countermeasures are concrete countermeasures for satisfying the security requirements. "Implementing an authentication function using an ID/password" is exemplified as a countermeasure against the fact that functions cannot be accessed without authentication. Similarly, even if the same requirement of "Standard A" is "to perform user authentication and identification", the requirement "to identify and authenticate users" with a security level of "Medium" is Authentication by setting an ID/password", but for the requirement "Set a strong password" for the security level "high", "Issuing an ID/password for each user and ensuring that the password length is above a certain level" limited to” are exemplified respectively.

The target device is the type of device that is the target of the requirements and countermeasures. Fig. 4 shows the requirements and countermeasures corresponding to the requirements of "Standard A", "Performing user authentication and identification" and the security level of "low". A server machine and a controller are exemplified as target devices.
Here, among the items of information stored in the requirements/measures DB 206 shown in FIG. It is the same as the content stipulated in the standard ("standard A" and "standard B" in FIG. 4). Note that if a certain standard does not define a part of the provisions, the item of the relevant provisions of the standard will be blank.
On the other hand, the countermeasure and target device items are set by the creator of the requirement/countermeasure DB 206 or the like. This is because the contents of which standards to apply to which devices in the system and what measures to take to meet security requirements differ depending on the user who builds or operates the system.

<Security standard compliance support processing>
Next, the flow of processing (security standard compliance support processing) executed by the security standard compliance support device 10 according to this embodiment will be described with reference to FIG. FIG. 5 is a flow chart showing an example of security standard compliance support processing according to the present embodiment.
Step S101: The system configuration input unit 201 accepts a system configuration designation process by the user. As described above, the user uses the security standard compliance support device 10 (or a terminal communicably connected to the security standard compliance support device 10) to select a device type from the device DB 205 and assign a device name. Above, you can specify the system configuration by selecting the I/F that connects the devices. Any method can be used to designate the system configuration. For example, the display device 102 of the security standard support device 10, the display device of a terminal communicably connected to the security standard support device 10, or the security standard support device The user selects or inputs the device type, device name, and I/F on the GUI (Graphical User Interface) screen displayed on the external display device connected via the external I/F 103 or communication I/F 104. A possible method is to specify the system configuration with

As a result, the device configuration information representing the correspondence between the device name and the device type, and the connection information representing the I/F that connects the devices (between the device name of the connection source device and the device name of the connection destination device) are generated. It is created by the system configuration input unit 201 . In this embodiment, as an example, it is assumed that the configuration device information shown in FIG. 6 and the connection information shown in FIG. 7 are created. The configuration device information shown in FIG. 6 and the connection information shown in FIG. 7 represent the system configuration shown in FIG.
In this embodiment, the system configuration is designated by the user, but the means for carrying out the invention is not limited. For example, data input to the system configuration input unit 201 may be obtained from another device or terminal connected via the external I/F 103 or communication I/F 104 .

Step S102: The system configuration input unit 201 accepts processing by the user for selecting a group of devices to which each device belongs. The user inputs or selects the device group name to which each device belongs to the device configuration information created in step S101. The device group referred to here is a grouping of one or more devices having the same set of security standard and security level. Devices with different security standards or different security levels cannot be included in the same device group. For example, if device 1 and device 2 both support "standard A, security level high", device 1 and device 2 are in the same device group, but device 3 is "standard A, security level high". , if device 4 corresponds to "standard A, low security level", device 3 and device 4 must belong to different device groups. In this embodiment, as an example, FIG. 9 shows an example of device configuration information to which device group information is added, and FIG. 10 shows an example of the configuration of a system targeted for security standard compliance support grouped by device group information. Illustrate.

The device group name to which the device belongs may be freely determined by the user, or may be selected from a list registered in advance in a DB or the like. In this specification, two device group names "group 1" and "group 2" are exemplified, but of course, one system may have three or more device group names. Also, the method of inputting/selecting the device group name can be performed on the GUI screen displayed on the display device 102 or the like of the security standard support device 10 as described above. Also, as described above, data may be acquired from an external device.
Step S103: The standard/level input unit 202 accepts the process of specifying the security standard and security level by the user. As described above, the user selects the security standard name and security level from the device DB 206 using the security standard support device 10 (or a terminal communicably connected to the security standard support device 10). can specify the security standard and security level.

Any method can be used to designate the system configuration. For example, the display device 102 of the security standard support device 10, the display device of a terminal communicably connected to the security standard support device 10, or the security standard support device A user selects or inputs a security standard and a security level on a GUI (Graphical User Interface) screen displayed on an external display device connected via an external I/F 103 or a communication I/F 104 of 10. A method of specifying the security level is conceivable.
Here, the user can arbitrarily specify one or more pairs of security standards and security levels for each system group. Hereinafter, as an example, a case where the following combinations are specified will be described.

Group 1: standard A+level high, standard B+level low Group 2: standard A+level medium Step S104: Next, the requirement/countermeasure search unit 203 searches for each set of security standards and security levels specified in step S103 above. Second, the requirements/countermeasures DB 206 is searched for security requirements to be satisfied by each device included in the system configuration specified in step S101 and countermeasures for the security requirements.
At this time, as shown in FIG. 9, the device group to which each device belongs is specified. Assign requirements and countermeasures to the security requirements according to the equipment group to which each equipment belongs. That is, devices belonging to group 1 are assigned “standard A+level high” and “standard B+level low”, and devices belonging to group 2 are assigned “standard A+level middle”.

First, the requirement/countermeasure search unit 203 searches for security requirements and countermeasures that each device (server machine 1 and router 1) belonging to group 1 should satisfy in standard A. FIG. In this case, the following security requirements and countermeasures can be acquired from the information stored in the requirement/countermeasure DB 206 shown in FIG.
・User authentication security requirements for server machine 1: Set a strong password Countermeasure: Issue an ID/password for each user, and limit the password length to a certain length or more ・Operation record security requirements for server machine 1: All Countermeasures: Leave records of all command executions in logs For router 1, security requirements and countermeasures for which the router is the target device are stored in the requirements/countermeasures DB 206. No security requirements and countermeasures are assigned.

Next, the requirement/countermeasure search unit 203 searches for security requirements and countermeasures that each device (server machine 1 and router 1) belonging to group 1 should satisfy in standard B. FIG. In this case, the following security requirements and countermeasures can be acquired from the information stored in the requirement/countermeasure DB 206 shown in FIG.
・User authentication for server machine 1 Security requirement: Records should be kept when abnormalities occur Countermeasures: All errors and warnings should be recorded in logs Router 1 is listed as a target device in the requirements/countermeasures DB 206 as described above. No assignment of security requirements and countermeasures is made because there is no

Similarly, the requirement/countermeasure search unit 203 searches for security requirements and countermeasures to be satisfied by each device belonging to group 2 (controller 1, controller 2, sensor 1, sensor 2, actuator 1, and actuator 2). In this case, the following security requirements and countermeasures can be acquired from the information stored in the requirement/countermeasure DB 206 shown in FIG.
・User authentication security requirements for controller 1 and controller 2: Identify and authenticate users Sometimes records remain Countermeasures: Security requirements and countermeasures for Sensor 1, Sensor 2, Actuator 1, and Actuator 2, which record system errors in logs, because they are not listed as target devices in the requirements/countermeasures DB 206 No policy assignments are made.

Step S105: Then, the display unit 204 displays the system configuration specified in step S101 above in association with the security requirements and countermeasures for each device searched and assigned in step S104 above. This display result is displayed on the display device 102 of the security standard compliance support device 10, or the display device of a terminal communicably connected to the security standard compliance support device 10, or the external I/F 103 of the security standard compliance support device 10 or It is displayed on an external display device connected via the communication I/F 104 .

FIG. 11 shows a display example of the system configuration, security requirements, and countermeasures on the display unit 204 . In the display example shown in FIG. 11, the security requirements and countermeasures retrieved in step S104 are displayed on the system configuration shown in FIG. 8 in association with corresponding devices in the system. For example, for server machine 1, regarding "user authentication" in the security requirement classification, "set a strong password" which is a security requirement for standard A and high security level, and countermeasure "issue an ID/password for each user". and limit the length of the password to a certain level or more," and the security requirement for Standard B and Security Level Low, "Record should be kept when an abnormality occurs" and the countermeasure "Leave all errors and warnings in the log". is displayed. Similarly, regarding the request classification "operation record" on the server machine 1, "all processing records must remain" and "all command execution records must be logged", which are the security requirements for standard A and security level high. "Leave" is displayed.

In addition, FIG. 11 shows, for controller 1 and controller 2, regarding "user authentication" of the security requirement classification, "to identify and authenticate the user" which is the security requirement in the standard A and the security level, and countermeasures. "Authenticate by setting an ID/password for each user" is displayed.

In this manner, in the display example shown in FIG. 11, it is possible to check the devices included in the system configuration, the security requirements and countermeasures to be met by each device, and the device group to which each device belongs on the same screen. can. In particular, regarding "user authentication", which is the security requirement classification of the server machine 1, it becomes easy to compare different security requirements and countermeasures between Standard A and Standard B.
In addition, in the display example shown in FIG. 11, the display mode may be changed, for example, by changing the color for each security level, rearranging the display in descending order of the security level, and the like. In addition, in FIG. 11, the security requirements and countermeasures for all devices are displayed, but for example, the security requirements and countermeasures are not displayed in normal times, and the security requirements and countermeasures are displayed only for the devices specified by the user. , and so on. FIG. 11 is merely an example, and the display method is not particularly limited as long as it does not depart from the scope of the claims.

12 shows different display examples of the system configuration, security requirements, and countermeasures on the display unit 204. In FIG. As the system becomes larger and the number of devices that make up the system increases to dozens or even hundreds, it becomes difficult to display all the constituent devices and the security requirements and countermeasures to be met by each device on a single screen. . Therefore, in the present invention, as shown in FIG. 12, it is possible to display security requirements and countermeasures to be satisfied by each device in a tabular format.

Also, as shown in FIG. 13, for example, by designating items such as the device name, security requirement classification, and security standard as search targets, it is possible to display only the information of the devices targeted by the specified items. . In Fig. 13, by specifying "user authentication" in the security requirement classification, the security standards, security levels, security requirements, and countermeasures for server machine 1 belonging to group 1 and controller 1 and controller 2 belonging to group 2 are displayed. is displayed.

Here, if different items are searched, the displayed information is also changed according to the search target. For example, if the search target is a security standard, the items for selecting the level of the security standard increase as shown in Fig. 14, and the information displayed on the screen includes the security requirement classification, security level, security requirements, and countermeasures. Become.

According to step S101, the system configuration is input manually by the user. However, as the number of devices that make up the system increases, the user's input burden increases, and the device type and usable I/F may be specified incorrectly. Therefore, the second security standard support device 10 according to the present invention is characterized in that "automatic acquisition of the system configuration" is performed as step S101' instead of step S101 as shown in FIG. The hardware configuration of the second security standard support device 10 according to the present invention is the same as in FIG. 1, and the functional configuration is the same as in FIG.

An example of automatic acquisition of the system configuration is shown using FIGS. 16, 17, and 18. FIG. The security standard support device 10 performs communication according to the communication sequence shown in FIG. /F can be obtained, and device configuration information as shown in FIGS. 6 and 7 is created.

First, the second security standard support device 10 according to the present invention transmits a “device information inquiry” command to the device connected to the communication I/F 104 . The message contents of the "Device Information Inquiry" command are omitted. Each device that has received the "equipment information inquiry" command transmits an "equipment information response" command having a message structure as shown in FIG. At this time, the device ID included in the electronic message is unique information that allows each device to be individually identified. Upon receiving the "device information response" command from each device constituting the system, the security standard support device 10 stores the device type and usable I/F contained in the "device information response" command as configuration information. At this time, the security standard compliance support device 10 can automatically assign a device name used in the system to each device. An example of a device name is a combination of a device type and an arbitrary unique number (for example, server machine 1, controller 1, etc. as shown in FIG. 6). The security standard compliance support device 10 stores a set of the device ID obtained by communication from each device and the device name assigned to each device, so that the same device name is not assigned to devices with different device IDs. do.

The second security standard compliance support device 10 according to the present invention may communicate with devices connected to the communication I/F 104 automatically by the security standard compliance support device 10 at regular intervals. Operation of a switch or the like mounted on the security standard compliance support device 10, screen displayed on the display device 102 built in the security standard compliance support device 10 or an external display device communicably connected to the security standard compliance support device 10 It may be started by a trigger such as an operation from .

The second security standard compliance support device 10 according to the present invention is characterized in that it automatically acquires information about each device that constitutes the system through communication. I don't mind. For example, in the case of a device that does not have a communication I/F, a device that has a communication I/F different from that of the security standard support device 10, or a device that does not support communication telegrams as shown in FIG. Since the device information cannot be obtained, the user creates system configuration information in combination with steps S101 and S101'.

Although the security standard support device 10 communicates with one device in FIG. 16, for example, a plurality of devices may be connected to the same communication line at the same time for communication. At this time, a known technique may be used for communication timing control and the like. Also, the device ID included in FIG. 17 can be used to identify the communicating device.
If security standards and security levels corresponding to each device are set in advance, such information may be added to the message in FIG. When information on security standards and security levels that each device supports is stored in the message received from each device, the security standard compliance support device 10 receives the system configuration shown in FIG. It is possible to refer to such information when displaying countermeasures.

The second security standard support device 10 according to the present invention can also automatically acquire the security standard and the security level as described above. On the other hand, since the user designates the device group to which the device belongs, there is a possibility that the relationship between the automatically obtained security standard and security level and the device group entered by the user will be inconsistent. For example, as shown in FIG. 18, it is possible to call the user's attention by indicating the location where the contradiction occurs. At this time, on the screen shown in FIG. 18, by grouping the devices belonging to the same device group by enclosing them with a frame as shown in FIG. can. For example, even in the case of a tabular format such as that shown in FIG. 12, a display mode is conceivable such as grouping display by changing the background color for each device group or enclosing them in a color-coded frame.

10 security standard support device 101 input device 102 display device 103 external I/F
104 Communication I/F
105 processing device 106 storage device 107 bus line 108 recording medium 109 external device 201 system configuration input unit 202 standard/level input unit 203 requirement/countermeasure search unit 204 display unit 205 device DB
206 Requirement/Countermeasure DB

Claims (18)

A support device for supporting security standard compliance of a target system composed of one or more devices,
inputting a specification of the target system and a specification of one or more security standards and security level sets for the target system;
an input unit for inputting a device group for grouping one or more devices constituting the target system having the same set of the security standard and the security level;
with reference to a database in which security requirements, countermeasures for the security requirements, and devices subject to the security requirements are associated with each security standard and security level, and for each set of the security standard and security level, a search unit for searching security requirements to which each device constituting the target system is subject and countermeasures against the security requirements;
a display unit for displaying security requirements and countermeasures searched by the search unit for each device constituting the target system;
A support device having The input unit
further input the designation of the interface between the devices that make up the target system;
The display unit
further displaying an interface between the devices;
The support device according to claim 1. the security requirements are categorized into predetermined security requirement categories;
The display unit
3. The support device according to claim 1, wherein said security requirements and countermeasures against said security requirements are displayed for each device and for each security requirement classification. The display unit
When a plurality of sets of security standards and security levels are input by the input unit, the security requirements and countermeasures for the security requirements are set for each device and for each security requirement classification. 4. The support device according to claim 3, wherein the levels are displayed in a comparable manner. The display unit
5. The support device according to any one of claims 1 to 4, wherein the security requirements for each device constituting the target system and countermeasures against the security requirements are displayed in a diagram representing the configuration of the target system. . The display unit
6. The support device according to any one of claims 1 to 5, wherein said group name for each device constituting said target system is displayed in a diagram showing the configuration of said target system. A support system for supporting security standard compliance of a target system composed of one or more devices,
the input unit for further inputting a specification of the target system and a specification of one or more security standards and security level pairs for the target system;
the input unit for inputting a device group for grouping one or more devices constituting the target system having the same set of the security standard and the security level;
with reference to a database in which security requirements, countermeasures for the security requirements, and devices subject to the security requirements are associated with each security standard and security level, and for each set of the security standard and security level, a search unit for searching security requirements to which each device constituting the target system is subject and countermeasures against the security requirements;
a display unit for displaying security requirements and countermeasures searched by the search unit for each device constituting the target system;
support system. A support device that supports the security standard compliance of a target system consisting of one or more devices,
an input step of further inputting a specification of the target system and a specification of one or more security standards and security level pairs for the target system;
an input procedure for inputting a device group for grouping one or more devices constituting the target system having the same set of the security standard and the security level;
with reference to a database in which security requirements, countermeasures for the security requirements, and devices subject to the security requirements are associated with each security standard and security level, and for each set of the security standard and security level, a search procedure for searching security requirements to which each device constituting the target system is targeted and countermeasures against the security requirements;
a display procedure for displaying security requirements and countermeasures retrieved by the retrieval unit for each device constituting the target system;
How to help you run. A support device that supports the security standard compliance of a target system consisting of one or more devices,
an input step of further inputting a specification of the target system and a specification of one or more security standards and security level pairs for the target system;
an input procedure for inputting a device group for grouping one or more devices constituting the target system having the same set of the security standard and the security level;
with reference to a database in which security requirements, countermeasures for the security requirements, and devices subject to the security requirements are associated with each security standard and security level, and for each set of the security standard and security level, a search procedure for searching security requirements to which each device constituting the target system is targeted and countermeasures against the security requirements;
a display procedure for displaying security requirements and countermeasures retrieved by the retrieval unit for each device constituting the target system;
program to run. a procedure for obtaining a device type possessed by each device by communicating with each device that constitutes the target system and that are communicably connected to the support device according to a predetermined communication procedure; prepared,
8. A support system according to claim 7. further comprising a procedure for acquiring a set of a security standard supported by the equipment constituting the target system and a corresponding means for the security standard by performing communication according to a predetermined communication procedure,
11. A support system according to claim 10. In the set of the security standard for the same device and the corresponding means for the security standard, there is a first set obtained by the communication means and a second set obtained by manual input, A procedure for calling attention on the display unit of the support device when a contradiction occurs in the contents of the first set and the second set,
12. A support system according to claim 11. A support method for implementing the support system of claim 10 . A support method for implementing the support system of claim 11 . 13. A support method for implementing the support system of claim 12. A program for executing the support system according to claim 10. A program for executing the support system according to claim 11. A program for executing the support system according to claim 12.

Images