JP7360101B2 - security diagnostic system - Google Patents

Description

The present invention relates to a security diagnosis system for diagnosing security risks in companies (including sole proprietors) and the like.

Companies, regardless of their industry or size, are faced with more or less security risks, and are forced to take countermeasures. There are a wide variety of security issues for companies to manage, and as one of them, a security diagnosis system has been proposed that diagnoses whether there are deficiencies in authority management, which are vulnerabilities in web applications (see Patent Document 1).

International Publication No. 2019/026172

However, in a system that locally diagnoses some security risks, such as the system described in Patent Document 1, it is difficult to comprehensively and comprehensively grasp the security risks inherent in a company. In addition, for companies that are not aware of how and to what extent security measures should be taken, we comprehensively diagnose security risks as a whole, show problems in an easy-to-understand manner, and provide concrete instructions on what needs to be done. It is desired to build a system that digitizes information in an easy-to-understand manner.

An object of the present invention is to provide a security diagnosis system that can comprehensively grasp the security risks of a company.

The security diagnosis system of the present invention uses seven items: personal computer terminals, mobile phone terminals, servers, networks, websites, physical information including business continuity plans, and internal rules, regulations, and education to assess corporate security risks. A security diagnosis system for diagnosing, a plurality of first questions regarding the personal computer terminal, a plurality of first choices set for each of the first questions, and a degree of security evaluation of the personal computer terminal for each of the first choices. a first storage unit that stores first evaluation points set according to the mobile phone terminal; a plurality of second questions regarding the mobile phone terminal; a plurality of second options set for each of the second questions; and a plurality of second options set for each of the second questions; a second storage unit that stores a second evaluation point set according to the degree of security evaluation in the mobile phone terminal; a plurality of third questions regarding the server; and a plurality of third questions set for each of the third questions. a third storage unit that stores three options and a third evaluation point set according to the degree of security evaluation in the server for each third option; a plurality of fourth questions regarding the network; a fourth storage unit that stores a plurality of fourth options set for the website, and a fourth evaluation score set for each of the fourth options according to the degree of security evaluation in the network; a fifth storage unit that stores five questions, a plurality of fifth choices set for each fifth question, and a fifth evaluation score set for each fifth choice according to the degree of security evaluation on the website; and a plurality of sixth questions regarding the physical information, a plurality of sixth choices set for each of the sixth questions, and a plurality of sixth choices set for each of the sixth choices according to the degree of security evaluation of the physical information. a sixth storage unit that stores a sixth evaluation score; a plurality of seventh questions regarding the company rules/regulations/education; a plurality of seventh choices set for each of the seventh questions; a seventh storage unit that stores a seventh evaluation point set according to the degree of security evaluation in internal rules, regulations, and training; and the plurality of first questions and the plurality of questions stored in the first storage unit. a first option, the plurality of second questions and the plurality of second choices stored in the second storage unit, the plurality of third questions and the plurality of third options stored in the third storage unit; options, the plurality of fourth questions and the plurality of fourth options stored in the fourth storage unit, the plurality of fifth questions and the plurality of fifth options stored in the fifth storage unit, Sequentially the plurality of sixth questions and the plurality of sixth choices stored in the sixth storage unit, and the plurality of seventh questions and the plurality of seventh choices stored in the seventh storage unit a display section to display; a first option to be selected by the user from among the plurality of first options for each of the first questions; and a first option for the user to select from among the plurality of second options for each second question; The user inputs a second option to select, inputs a third option to be selected by the user from among the plurality of third options for each third question, and inputs a third option to select from among the plurality of fourth options for each fourth question. inputting a fourth option selected by the user from among the plurality of fifth options for each fifth question; inputting a fifth option selected by the user from among the plurality of fifth options for each sixth question; an input unit for inputting the sixth option selected by the user from among the sixth options, and inputting the seventh option selected by the user from among the plurality of seventh options for each seventh question; and the highest first evaluation score among the first evaluation points set for the plurality of first options for each first question, and the highest first evaluation point set for the first option input from the input section. A first evaluation point is read from the first storage section, and for each second question, the highest second evaluation point among the second evaluation points set for the plurality of second choices is input from the input section. read the second evaluation points set for the second choices that have been asked from the second storage unit, and the highest among the third evaluation points set for the plurality of third choices for each third question. The highest third evaluation point and the third evaluation point set for the third option input from the input section are read from the third storage section, and the third evaluation point is set for the plurality of fourth options for each of the fourth questions. The highest fourth evaluation point among the fourth evaluation points and the fourth evaluation point set for the fourth option input from the input section are read from the fourth storage section, and the fifth question is The highest fifth evaluation point among the fifth evaluation points set for each of the plurality of fifth options and the fifth evaluation point set for the fifth option input from the input section are Loaded from the fifth storage unit, the highest sixth evaluation score among the sixth evaluation points set for the plurality of sixth options for each sixth question and the sixth option input from the input unit The sixth evaluation points set in the above are read from the sixth storage unit, and for each of the seventh questions, the maximum seventh evaluation point is the highest among the seventh evaluation points set in the plurality of seventh options. a reading unit that reads the seventh evaluation point set for the seventh option input from the input unit from the seventh storage unit; and a maximum that is the sum of the highest first evaluation point read by the reading unit. A first security achievement level is calculated as the ratio of the first evaluation point total and the first evaluation point total which is the sum of the first evaluation points, and A second security achievement level is calculated as a ratio between a certain maximum second evaluation point total and a second evaluation point total that is the sum of the second evaluation points, and A third security achievement level, which is a ratio of the total highest third evaluation score and the third total evaluation score, which is the total of the third evaluation points, is calculated, and the highest fourth evaluation is read by the reading unit. A fourth security achievement level, which is the ratio of the highest fourth evaluation point total, which is the total of the points, and the fourth evaluation point total, which is the total of the fourth evaluation points, is calculated, A fifth security achievement level, which is the ratio between the highest total fifth evaluation point, which is the sum of the five evaluation points, and the fifth total evaluation point, which is the total of the fifth evaluation points, is calculated, and the A sixth security achievement level, which is the ratio of the highest total sixth evaluation point, which is the total of the highest six evaluation points, and the sixth total evaluation point, which is the total of the sixth evaluation points, is calculated, and the sixth security achievement level is read by the reading unit. a first calculation unit that calculates a seventh security achievement level that is a ratio of the highest seventh evaluation point total that is the total of the highest seventh evaluation points and the seventh evaluation point total that is the total of the seventh evaluation points; , a second calculation for calculating an overall security achievement level that is a ratio of the sum of the highest first evaluation point total to the highest seventh evaluation point total and the total of the first evaluation point total to the seventh evaluation point total; and an output unit that outputs calculation results calculated by the first calculation unit and the second calculation unit.

Further, the security diagnosis system of the present invention is characterized in that the first to seventh evaluation points include negative points.

Further, in the security diagnosis system of the present invention, the first predetermined question, which is one of the first to seventh questions, is different from the first predetermined question. The first predetermined option, which is the same question as the second predetermined question, which is at least one question among the seven questions, and which is a plurality of options set in the first predetermined question, is The first predetermined evaluation point set for the first predetermined option is the same option as the second predetermined option which is a plurality of options, and the first predetermined evaluation point set for the second predetermined option is different from the second predetermined evaluation point set for the second predetermined option, The reading unit reads the first predetermined evaluation point set to the first predetermined option input to the input unit, and reads the second predetermined evaluation score that is the same as the first predetermined option input to the input unit. The method is characterized in that the second predetermined evaluation points set in the options are read.

Further, the security diagnosis system of the present invention includes a display control unit that causes the display unit to display an input field for inputting supplementary matters for the first to seventh questions, and a display control unit that displays input fields for inputting supplementary matters for the first to seventh questions, and a The first calculation section further includes an extraction section that extracts a preset keyword from the character string of the supplementary information, and the first calculation section is configured to read the keywords that are read by the reading section based on the keywords extracted by the extraction section. The method is characterized in that the first evaluation point to the seventh evaluation point are added or subtracted.

Further, in the security diagnosis system of the present invention, the first storage further stores first advice including advice regarding security evaluation regarding the personal computer terminal set for each first question, and the second storage further stores second advice including advice regarding security evaluation regarding the mobile phone terminal set for each second question, and the third storage unit further stores second advice including advice regarding security evaluation regarding the mobile phone terminal set for each third question; further stores third advice including advice regarding security evaluation; the fourth storage unit further stores fourth advice including advice regarding security evaluation regarding the network set for each fourth question; The fifth storage unit further stores fifth advice including advice regarding security evaluation regarding the website that is set for each fifth question, and the sixth storage unit further stores fifth advice that is set for each fifth question. further storing sixth advice including advice regarding security evaluation regarding the physical information, and the seventh storage unit storing advice regarding security evaluation regarding the internal rules, regulations, and education set for each of the seventh questions; It is characterized in that it further stores a seventh advice including the above, and the output unit outputs the first advice to the seventh advice together with the calculation result.

Further, in the security diagnosis system of the present invention, the first advice includes different advice regarding the security evaluation regarding the personal computer terminal for each of the first options, and the second advice includes different advice regarding the security evaluation of the personal computer terminal for each of the second options. The third advice includes different advice regarding the security evaluation regarding the terminal for each of the third options, and the fourth advice includes different advice regarding the security evaluation regarding the server for each of the fourth options. The fifth advice includes different advice regarding the security evaluation regarding the website for each of the fifth options, and the sixth advice includes different advice regarding the security evaluation regarding the website for each of the fifth options, and the sixth advice includes different advice regarding the security evaluation regarding the website for each of the fifth options. The seventh advice includes different advice regarding the security evaluation regarding the company rules/regulations/education for each of the seventh options, and the reading section is configured to receive information input from the input section. reads the first advice of the first option selected from the first storage unit, reads the second advice of the second option inputted from the input unit from the second storage unit, and reads the second advice inputted from the input unit from the second storage unit. reads the third advice of the third option input from the third storage section, reads the fourth advice of the fourth option input from the input section from the fourth storage section, and reads the fourth advice input from the input section. reads the fifth advice of the fifth option input from the fifth storage unit, reads the sixth advice of the sixth option input from the input unit from the sixth storage unit, and reads the sixth advice input from the input unit. The seventh advice of the seventh option is read from the seventh storage unit, and the output unit outputs the first advice to seventh advice read by the reading unit together with the calculation result. Features.

The security diagnosis system of the present invention further includes a low first evaluation point that is lower among the first evaluation points read by the reading section, a low second evaluation point that is lower among the second evaluation points, and a third low evaluation point that is lower among the second evaluation points. A low 3rd evaluation point that is the lowest among the evaluation points, a low 4th evaluation point that is the lowest among the 4th evaluation points, a low 5th evaluation point that is the lowest among the 5th evaluation points, and a low 5th evaluation point that is the lowest among the 6th evaluation points. Among the low 6th evaluation points, and the low 7th evaluation points among the 7th evaluation points, the low 1st evaluation point to the low 7th evaluation point where the security risk is high based on the industry and size of the company. The method further includes a selection section that selects at least one point, and the output section outputs the selection result selected by the selection section together with the calculation result.

According to the security diagnosis system of the present invention, it is possible to comprehensively understand the security risks of a company.

FIG. 1 is a block diagram showing the configuration of a security diagnosis system according to a first embodiment. FIG. 3 is a diagram for explaining a database of a first storage unit included in the security diagnosis system according to the first embodiment. FIG. 3 is a diagram showing an example of a screen displayed on a display unit included in the security diagnosis system according to the first embodiment. 2 is a flowchart for explaining processing executed when diagnosing security risks of a company in the security diagnosis system according to the first embodiment. 2 is a flowchart for explaining processing executed when calculating a first security achievement level in the security diagnosis system according to the first embodiment. FIG. 2 is a block diagram showing the configuration of a security diagnosis system according to a second embodiment. FIG. 7 is a diagram for explaining a database of a first storage unit included in a security diagnosis system according to a second embodiment. FIG. 7 is a diagram for explaining databases in a first storage unit and a third storage unit included in the security diagnosis system according to the second embodiment.

A security diagnosis system according to a first embodiment of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing the configuration of a security diagnosis system according to a first embodiment. The security diagnosis system 2 according to this embodiment is a system for diagnosing security risks of companies, etc., specifically, a system for diagnosing security risks of companies, etc., specifically, a system for diagnosing security risks of companies, etc. This is a system for comprehensively understanding security, and as shown in FIG. 1, it is equipped with a control section 4 that centrally controls each section of the security diagnosis system 2.

The control section 4 includes a first storage section 6, a second storage section 8, a third storage section 10, a fourth storage section 12, a fifth storage section 14, a sixth storage section 16, a seventh storage section 18, and an output section. 20, an input section 26, and a diagnosis result storage section 28 are connected.

Each of the first storage unit 6, the second storage unit 8, the third storage unit 10, the fourth storage unit 12, the fifth storage unit 14, the sixth storage unit 16, and the seventh storage unit 18 is designed to prevent security risks for companies. The seven items used for diagnosis are (1) security in the operation of PC terminals, (2) security in the use of mobile phone terminals, (3) security in the use of servers and cloud services, and (4) security in the network environment. security, (5) website security, (6) security of physical information including business continuity plans, and (7) company internal rules such as work regulations, company internal rules, and company internal training. Memorize the questions, etc. necessary to understand the rules, regulations, and security related to education.

First, the first storage unit 6 has a database for personal computer terminals, and as shown in FIG. Set for each first question A, B, C... and first question A, B, C... including advice etc. for each of the first questions A, B, C... 1st options A-1, A-2, A-3, N/A (not applicable); 1st options B-1, B- 2, B-3, B-4, N/A (not applicable); 1st option C-1, C-2, C-3, N/A (not applicable)... and set for each 1st option. The first evaluation points 1, 2, 0; the first evaluation points 5, 2, 0, -5, . . . ; the first evaluation points 0, 3, 1 are stored.

An example of the first question A, B... is ``What type of operating system are you using?'' and an example of the first advice A, B... is ``Let's leave it in the... "Let's manage...", etc., etc., etc., etc., etc., etc., etc., etc., etc., etc., etc., etc., etc., etc., etc., etc., etc., etc., etc., etc., etc., etc..

Further, the first evaluation point is set according to the degree of security evaluation at the personal computer terminal. For example, if the first option A-2 is selected as the answer to the first question A, the first option A-2 has a higher security evaluation of the computer terminal than the other first options A-1 and A-3, so As shown in FIG. 2, the first evaluation point of one option A-2 is set higher than the first evaluation points of the other first options A-1 and A-3. In addition, since the answer to the first question B is more important than the answer to the first question A in the security evaluation of the computer terminal, the first evaluation point for the first option B-1, which has the highest security evaluation for the first question B ( 5 points) is set higher than the first evaluation point (2 points) of the first option A-2, which has the highest security evaluation for the first question A.

The second storage unit 8 has a database for mobile phone terminals, and similarly to the first storage unit 6, the second storage unit 8 has a database for a plurality of second questions, which are questions related to security evaluation in the use of mobile phone terminals, and is set for each second question. Second advice that includes the ideal state and advice related to each of the second questions, second options that are answer options to the second questions set for each second question, and second options that are set for each second question. The second evaluation point is stored. The second evaluation point, like the first evaluation point, is set according to the degree of security evaluation of the mobile phone terminal.

The third storage unit 10 has a server database, and similarly to the first storage unit 6, the third storage unit 10 has a plurality of third questions, which are questions regarding security evaluation when using the server and cloud services, and is set for each third question. 3rd advice including the ideal state and advice related to each 3rd question, 3rd option which is an answer option to the 3rd question set for each 3rd question, and 3rd option set for each 3rd option. A third evaluation point, which is an evaluation point, is stored. The third evaluation point, like the first evaluation point, is set according to the degree of security evaluation of the server.

The fourth storage unit 12 has a network database, and similarly to the first storage unit 6, a plurality of fourth questions, which are questions related to security evaluation of the network environment, are set for each fourth question. 4th advice including advice etc. related to each, 4th option which is an answer option to the 4th question set for each 4th question, and 4th evaluation point which is an evaluation point set for each 4th option. I remember. Like the first evaluation point, the fourth evaluation point is set according to the degree of network security evaluation.

The fifth storage unit 14 has a database for websites, and similarly to the first storage unit 6, a plurality of fifth questions, which are questions related to website security evaluation, are set for each fifth question. 5th advice that includes the ideal state and advice related to each of the above, 5th option that is an answer option to the 5th question set for each 5th question, and evaluation points set for each 5th option. I remember a certain fifth evaluation point. Like the first evaluation point, the fifth evaluation point is set according to the degree of security evaluation of the website.

The sixth storage unit 16 has a database for physical information, and similarly to the first storage unit 6, the sixth storage unit 16 has a plurality of sixth questions, which are questions regarding security evaluation of physical information, and the sixth questions are set for each sixth question. 6th advice including advice regarding each of the 6 questions, 6th option which is an answer option to the 6th question set for each 6th question, and 6th option which is an evaluation point set for each 6th option. 6 evaluation points are memorized. Like the first evaluation point, the sixth evaluation point is set according to the degree of security evaluation of physical information.

The seventh storage unit 18 has a database for internal rules, regulations, and education, and similarly to the first storage unit 6, the seventh storage unit 18 includes a plurality of seventh questions and seventh questions related to security evaluation in internal rules, regulations, education, etc. 7th advice that is set for each question and includes the ideal state and advice related to each of the 7th questions, 7th options that are answer options for the 7th questions that are set for each 7th question, and 7th advice A seventh evaluation point, which is an evaluation point set for each option, is stored. Like the first evaluation point, the seventh evaluation point is set according to the degree of security evaluation of internal rules, regulations, and education.

The number of questions from 1st to 7th varies depending on the importance of security for each item (computer terminal, mobile phone terminal, server, network, website, physical information, and company rules/regulations/education). The numbers of the first to seventh choices for the first to seventh questions also vary depending on the content of the first to seventh questions. For items that are more important than other items in security evaluation, the number of questions will be larger. Furthermore, the first to seventh evaluation points vary depending on the first to seventh options, and include not only positive points but also negative points. In addition, “Not applicable” (N/A) is included as the first to seventh options. Details regarding this will be described later.

A display section 22, which is a display device such as a liquid crystal panel, and a printing section 24, such as a printer, are connected to the output section 20. The output unit 20 outputs an input form 22a (see FIG. 3) for security diagnosis according to instructions from the control unit 4, and causes the display unit 22 to display the input form 22a (see FIG. 3). The output unit 20 also outputs a security diagnosis result report related to each item based on the calculation result by the calculation unit 32, and an overall report of the company created using the security diagnosis result of each item and the calculation result by the calculation unit 32. A security diagnosis result report and the like are output, displayed on the display section 22, and printed on the printing section 24. The input unit 26 is an input device such as a keyboard or a mouse, and the input unit 26 is an input device such as a keyboard or a mouse. Option to 7th option). The diagnosis result storage unit 28 stores the security diagnosis results for each company diagnosed by the security diagnosis system 2.

FIG. 3 is a diagram showing an example of an input form 22a displayed on the input screen of the display unit 22 during security diagnosis. As shown in FIG. 3, when starting the security diagnosis, the display unit 22 displays the first storage unit 6, second storage unit 8, third storage unit 10, fourth storage unit 12, All questions (1st question to 7th question) and all choices (1st choice to 7th question) that are answers to all questions stored in the fifth storage unit 14, sixth storage unit 16, and seventh storage unit 7th option) are displayed in sequence. The medical examiner asks a question to the user, and based on the user's answers, selects the appropriate answer from the multiple first options A-1, A-2, A-3, and Not Applicable to the left of the first option. By clicking the option button using an input device such as a mouse or keyboard, the first question is answered (first option A-2 in FIG. 3). Further, when the diagnostician answers the first question, if there is any supplementary information from the diagnostician and/or the user, the diagnostician inputs text into the supplementary information input field 22b using an input device. The diagnostician also displays the next question by operating the scroll bar 22c on the right side of the input form 22a using an input device such as a mouse or a keyboard. The control unit 4 acquires the first to seventh options and supplementary information input by the diagnostician using the input unit 26 based on the answer from the user.

The control section 4 includes a memory 30, a reading section 31, and a calculation section 32, as shown in FIG. The memory 30 includes an arithmetic processing table 34, and temporarily stores points and the like required for the arithmetic processing by the arithmetic unit 32 in the arithmetic processing table 34. The memory 30 also stores an arithmetic processing program 36 for performing arithmetic processing in the arithmetic unit 32.

The reading unit 31 selects the highest score among the evaluation points (first evaluation point to seventh evaluation point) set for the plurality of options (first option to seventh option) for each question (first question to seventh question). The highest evaluation score, which is a high evaluation point, is stored in the first storage section 6, second storage section 8, third storage section 10, fourth storage section 12, fifth storage section 14, sixth storage section 16, and seventh storage section 18. Read from each. That is, the reading unit 31 selects the highest first evaluation point, which is the highest among the first evaluation points, for each first question, the highest second evaluation point, which is the highest among the second evaluation points, for each second question, and the third question. The highest 3rd evaluation point among the 3rd evaluation points for each question, the highest 4th evaluation point among the 4th evaluation points for every 4th question, and the highest among the 5th evaluation points for every 5th question. The highest highest 5th evaluation point, the highest 6th evaluation point among the 6th evaluation points for every 6th question, and the highest 7th evaluation point among the 7th evaluation points for every 7th question are read. For example, the reading unit 32 assigns 2 points as the highest first evaluation score for the first question A, 5 points as the highest first evaluation score for the first question B, and 5 points as the highest first evaluation score for the first question C. Load three points (see Figure 2).

The reading unit 31 also stores the evaluation points (first evaluation point to seventh evaluation point) set for the options (first option to seventh option) input from the input unit 26 in the first storage unit 6 and the second evaluation point. The information is read from each of the storage section 8, the third storage section 10, the fourth storage section 12, the fifth storage section 14, the sixth storage section 16, and the seventh storage section 18. For example, the reading unit 32 receives 2 points as the first evaluation point for the first option A-2 selected by the user in the first question A, and the first evaluation point for the first option B-3 selected by the user in the first question B. 0 point is read as a point (see FIGS. 2 and 3). Note that if the first option input from the input unit 26 is “Not Applicable” (N/A), the reading unit 31 will receive the highest evaluation score (highest 1st evaluation point to highest 7th evaluation point) and evaluation. Both points (1st evaluation point to 7th evaluation point) are read as 0 points.

The calculation unit 32, which functions as a first calculation unit and a second calculation unit, calculates a first security achievement level that is a security achievement level related to a personal computer terminal, a second security achievement level that is a security achievement level related to a mobile phone terminal, and a security achievement level related to a server. The third security achievement level is security achievement level, the fourth security achievement level is network security achievement level, the fifth security achievement level is website security achievement level, and the sixth security achievement level is security achievement level related to physical information. , the 7th security achievement level, which is the security achievement level regarding internal rules, regulations, and education, and the overall security achievement level, which shows the overall security achievement level of the company, using the above 1st security achievement level to 7th security achievement level. calculate.

For example, a case will be explained in which the answer to the first question A is the first option A-2, the answer to the first question B is the first option B-3, the answer to the first question C is the first option C-3, etc. . The calculation unit 32 calculates the first evaluation points of 2 points, 0 points, 1 point, etc. for the first choices A-2, B-3, C-3, etc., which are all the answers input from the input unit 26, that is, the reading unit 31 (hereinafter referred to as the first evaluation point total), and the highest first evaluation points of all the first questions read by the reading section 31: 2 points, 5 points, 3 points. The ratio of the sum of the points (hereinafter referred to as the maximum first evaluation point total), that is, (first evaluation point total/highest first evaluation point total) x 100, is calculated as the first security achievement level.

FIG. 4 is a flowchart for explaining the processing that the control unit 4 executes when diagnosing the security risk of a company.

First, the control unit 4 displays an input form 22a as shown in FIG. 3 on the display unit 22 via the output unit 20 (step S10). Next, after the user answers all the questions (Step S11, Yes), the control unit 4 calculates the first security achievement level and creates a security diagnosis result report regarding the personal computer terminal (Step S12).

FIG. 5 is a flowchart for explaining the process executed by the calculation unit 32 of the control unit 4 when calculating the first security achievement level. First, the calculation unit 32 obtains the answer to the first question A, that is, the first option (A-1, A-2, A-3, or not applicable) input from the input unit 26 (step S30 ). Next, the calculation unit 32 determines whether the first option acquired in step S30 is "not applicable (N/A)" (step S31). If it is determined in step S31 that the first option is not "not applicable (N/A)" (step S31, No), the calculation unit 32 calculates, for example, if the first option obtained in step S30 is A-1, , reads the first evaluation point (1 point in this case, see FIG. 2) of the first option A-1 from the first storage unit 6 (step S32) and temporarily stores it in the arithmetic processing table 34 of the memory 30. let Furthermore, the calculation unit 32 reads the highest first evaluation score of the first question A (in this case, the first evaluation score of the first option A-2, which is two points) from the first storage unit 6 (step S33), It is temporarily stored in the arithmetic processing table 34 of the memory 30.

On the other hand, if it is determined in step S31 that the first option is "not applicable (N/A)" (step S31, Yes), the calculation unit 32 calculates the first evaluation score for the first question A and the highest Both evaluation points are set to 0 (step S34), and are temporarily stored in the arithmetic processing table 34 of the memory 30.

The calculation unit 32 repeats the processes of steps S30 to S34 until it obtains the answers (first choices), first evaluation points, and maximum first evaluation points for all the first questions (step S35). After acquiring all the first evaluation points and the highest first evaluation point (step S35, Yes), the calculation unit 32 sums up all the first evaluation points read in step S32 (step S36), and then calculates the total of all the first evaluation points read in step S32 (step S36). All the highest first evaluation points read in are summed (step S37). The calculation unit 32 calculates the ratio between the first evaluation point total calculated in step S36 and the highest first evaluation point total calculated in step S37, that is, achievement rate=(first evaluation point total/highest first evaluation point total)× 100= is calculated (step S38), and the first security achievement level is calculated as a score out of 100 points.

The control unit 4 sorts all the first questions into first questions that are positive factors for security measures and first questions that are negative factors for security measures. Specifically, when the first evaluation score of the first option selected as an answer is equal to or higher than the reference score, the control unit 4 determines that the first question is the first question that is a security measure plus factor. On the other hand, if the first evaluation score of the first option selected as an answer is less than the reference score, the control unit 4 determines that the first question is a first question that is a negative factor for security measures. The reference point is set in advance and stored in the memory 30 or the like, and can be changed. In this embodiment, the reference point is set to zero. Specifically, the control unit 4 stores all first questions A, B, C..., their answers (first choices), all first advice A, B, C... and all supplementary matters in the first memory. The first question, the first option, the first advice, and the supplementary information read from part 6 and read in step S32 are above the reference point, and the first evaluation point is less than the reference point. A certain first question, first option, first advice, and supplementary matters are classified as negative factors for security measures. Then, the control unit 4 calculates the first security achievement degree which is the calculation result calculated by the calculation unit 32, the first question which is the security positive factor, the first option, the first advice and the list of positive factors such as supplementary matters, and the security A security diagnosis result report regarding the personal computer terminal including a list of negative factors including the first question, first option, first advice, and supplementary items, which are negative factors, is created and stored in the diagnosis result storage unit 28.

Next, the control unit 4 calculates the second security achievement level and creates a security diagnosis result report regarding the mobile phone terminal (step S13). That is, the calculation unit 32 executes the same process as the process in step S12. Specifically, the calculation unit 32 obtains the answer to the second question (the second option input from the input unit 26), and if the second option is not “Not applicable (N/A)”, the calculation unit 32 selects the second option. The second evaluation point and the highest second evaluation point of the second question are read from the second storage unit 8, and if the second option is "Not applicable (N/A)", the second evaluation point and the highest second evaluation point of the second question are read from the second storage unit 8. Both points are set as 0 points. By repeating this for all the answers to the second questions (the second choices input from the input unit 26), the calculation unit 32 acquires all the second evaluation points and the highest second evaluation points, and then calculates all the second evaluation points. The ratio of the total second evaluation points, which is the sum of the second evaluation points, and the highest total second evaluation point, which is the sum of all the highest second evaluation points, that is, the achievement rate = (total second evaluation points / highest second evaluation point) total)×100=, and calculate the second security achievement level as a score out of 100 points.

The control unit 4 reads all the second questions, their answers (second choices), all the second advice, and all the supplementary matters from the second storage unit 8, and selects the second question whose second evaluation score is equal to or higher than the reference score. Questions, second options, second advice, and supplementary matters are classified as positive factors for security measures, and second questions, second choices, second advice, and supplementary matters for which the second evaluation score is less than the standard score are classified as negative factors for security measures. . Then, the control unit 4 calculates the second security achievement degree which is the calculation result calculated by the calculation unit 32, the second question which is the security positive factor, the second option, the second advice, and the list of positive factors such as the supplementary matters, and the security A security diagnosis result report regarding the mobile phone terminal including a list of negative factors such as the second question, second option, second advice, and supplementary items, which are negative factors, is created and stored in the diagnosis result storage unit 28.

Next, the control unit 4 calculates the third security achievement level and creates a security diagnosis result report regarding the server (step S14). That is, the calculation unit 32 executes the same process as the process in step S12. Specifically, the calculation unit 32 obtains the answer to the third question (the third option input from the input unit 26), and if the third option is not “Not applicable (N/A)”, the calculation unit 32 The third evaluation point and the highest third evaluation point of the third question are read from the third storage unit 10, and if the third option is "Not applicable (N/A)", the third evaluation point and the highest third evaluation point of the third question are read from the third storage unit 10. Both points are set as 0 points. By repeating this for all the answers to the third questions (the third choices input from the input unit 26), the calculation unit 32 obtains all the third evaluation points and the highest third evaluation points, and then calculates all the answers to the third questions. The ratio of the total 3rd evaluation points, which is the sum of the 3rd evaluation points, and the maximum 3rd evaluation point, which is the sum of all the highest 3rd evaluation points, that is, the achievement rate = (total 3rd evaluation points / highest 3rd evaluation point) total)×100=, and calculate the third security achievement level as a score out of 100 points.

The control unit 4 reads all the third questions, their answers (third choices), all the third advice, and all the supplementary matters from the third storage unit 10, and reads the third questions whose third evaluation points are equal to or higher than the reference points. Questions, third options, third advice, and supplementary matters are classified as positive factors for security measures, and third questions, third options, third advice, and supplementary matters for which the third evaluation score is less than the standard score are classified as negative factors for security measures. . The control unit 4 then outputs the third security achievement degree which is the calculation result calculated by the calculation unit 32, the third question which is the security plus factor, the third option, the third advice and the list of plus factors such as the supplementary matters, and the security A security diagnosis result report regarding the server including a list of negative factors including the third question, third option, third advice, and supplementary matters, which are negative factors, is created and stored in the diagnosis result storage unit 28.

Next, the control unit 4 calculates the fourth security achievement level and creates a security diagnosis result report regarding the network (step S15). That is, the calculation unit 32 executes the same process as the process in step S12. Specifically, the calculation unit 32 obtains the answer to the fourth question (the fourth option input from the input unit 26), and if the fourth option is not “Not applicable (N/A)”, the calculation unit 32 selects the answer to the fourth question. The fourth evaluation point and the highest fourth evaluation point of the fourth question are read from the fourth storage unit 12, and if the fourth option is "Not applicable (N/A)", the fourth evaluation point and the highest fourth evaluation point of the fourth question are read. Both points are set as 0 points. The calculation unit 32 repeats this for all the answers to the fourth question (the fourth choice input from the input unit 26), and after acquiring all the fourth evaluation points and the highest fourth evaluation point, The ratio of the total 4th evaluation points, which is the sum of the 4th evaluation points, to the maximum 4th evaluation point, which is the sum of all the highest 4th evaluation points, that is, the achievement rate = (4th evaluation point total / highest 4th evaluation point) Total) x 100 = is calculated, and the fourth security achievement level is calculated as the score out of 100 points.

The control unit 4 reads all the fourth questions, their answers (fourth choices), all the fourth advice, and all supplementary matters from the fourth storage unit 12, and selects the fourth question whose fourth evaluation score is equal to or higher than the reference score. The question, 4th option, 4th advice, and supplementary matters are classified as positive factors for security measures, and the 4th question, 4th choice, 4th advice, and supplementary matters for which the 4th evaluation score is less than the standard score are classified as negative factors for security measures. . The control unit 4 then outputs the fourth security achievement level which is the calculation result calculated by the calculation unit 32, the fourth question which is the security plus factor, the fourth option, the fourth advice and the list of plus factors including the supplementary matters, and the security A security diagnosis result report regarding the network including a list of negative factors including the fourth question, fourth option, fourth advice, and supplementary matters, which are negative factors, is created and stored in the diagnosis result storage unit 28.

Next, the control unit 4 calculates the fifth security achievement level and creates a security diagnosis result report regarding the website (step S16). That is, the calculation unit 32 executes the same process as the process in step S12. Specifically, the calculation unit 32 obtains the answer to the fifth question (the fifth option input from the input unit 26), and if the fifth option is not “Not applicable (N/A)”, the calculation unit 32 selects the answer to the fifth question. The fifth evaluation point and the highest fifth evaluation point of the fifth question are read from the fifth storage unit 14, and if the fifth option is "Not applicable (N/A)", the fifth evaluation point and the highest fifth evaluation point of the fifth question are read from the fifth storage unit 14. Both points are set as 0 points. The calculation unit 32 repeats this for all the answers to the fifth question (fifth choices input from the input unit 26), and after acquiring all the fifth evaluation points and the highest fifth evaluation point, The ratio of the total 5th evaluation points, which is the sum of the 5th evaluation points, and the maximum 5th evaluation point total, which is the summation of all the highest 5th evaluation points, that is, the achievement rate = (total 5th evaluation points / maximum 5th evaluation point Total) x 100 = is calculated, and the fifth security achievement level is calculated as the score out of 100 points.

The control unit 4 reads all the fifth questions, their answers (fifth choices), all the fifth advice, and all the supplementary matters from the fifth storage unit 14, and selects the fifth question whose fifth evaluation score is equal to or higher than the reference score. The question, the 5th option, the 5th advice, and the supplementary matters are classified as positive factors for security measures, and the 5th question, 5th option, 5th advice, and supplementary matters for which the 5th evaluation score is less than the standard score are classified as negative factors for security measures. . Then, the control unit 4 calculates the fifth security achievement degree which is the calculation result calculated by the calculation unit 32, the fifth question which is the security positive factor, the fifth option, the fifth advice and the list of positive factors such as supplementary matters, and the security A security diagnosis result report regarding the website including a list of negative factors such as the fifth question, fifth option, fifth advice, and supplementary matters, which are negative factors, is created and stored in the diagnosis result storage unit 28.

Next, the control unit 4 calculates the sixth security achievement level and creates a security diagnosis result report regarding the physical information (step S17). That is, the calculation unit 32 executes the same process as the process in step S12. Specifically, the calculation unit 32 obtains the answer to the sixth question (the sixth option input from the input unit 26), and if the sixth option is not “Not applicable (N/A)”, The sixth evaluation point and the highest sixth evaluation point of the sixth question are read from the sixth storage unit 16, and if the sixth option is "Not applicable (N/A)", the sixth evaluation point and the highest sixth evaluation point of the sixth question are read from the sixth storage section 16. Both points are set as 0 points. By repeating this for all the answers to the sixth question (sixth choices input from the input unit 26), the calculation unit 32 acquires all the sixth evaluation points and the highest sixth evaluation point, and then calculates all the answers to the sixth question. The ratio of the total 6th evaluation points, which is the sum of the 6th evaluation points, and the maximum 6th evaluation point, which is the sum of all the highest 6th evaluation points, that is, the achievement rate = (total 6th evaluation points / highest 6th evaluation point) Total) x 100 = is calculated, and the sixth security achievement level is calculated as the score out of 100 points.

The control unit 4 reads all the sixth questions, their answers (sixth choices), all the sixth advice, and all the supplementary matters from the sixth storage unit 16, and reads the sixth questions whose sixth evaluation points are equal to or higher than the reference points. The question, the 6th option, the 6th advice, and the supplementary matters are classified as security measures positive factors, and the 6th question, 6th option, 6th advice, and supplementary matters whose 6th evaluation score is less than the standard score are classified as security measures negative factors. . Then, the control unit 4 calculates the sixth security achievement degree which is the calculation result calculated by the calculation unit 32, the sixth question which is the security positive factor, the sixth option, the sixth advice and the list of positive factors such as supplementary matters, and the security A security diagnosis result report regarding physical information including a list of negative factors such as the sixth question, sixth option, sixth advice, and supplementary matters, which are negative factors, is created and stored in the diagnosis result storage unit 28.

Next, the control unit 4 calculates the seventh security achievement level and creates a security diagnosis result report regarding internal rules, regulations, and education (step S18). That is, the calculation unit 32 executes the same process as the process in step S12. Specifically, the calculation unit 32 obtains the answer to the seventh question (the seventh option input from the input unit 26), and if the seventh option is not “Not applicable (N/A)”, the calculation unit 32 selects the answer to the seventh question. The seventh evaluation point and the highest seventh evaluation point of the seventh question are read from the seventh storage unit 18, and if the seventh option is "Not applicable (N/A)", the seventh evaluation point and the highest seventh evaluation point of the seventh question are read from the seventh storage unit 18. Both points are set as 0 points. By repeating this for all the answers to the seventh question (seventh choices input from the input unit 26), the calculation unit 32 acquires all the seventh evaluation points and the highest seventh evaluation point, and then calculates all the answers to the seventh question. The ratio of the total of the 7th evaluation points, which is the sum of the 7th evaluation points, and the maximum 7th evaluation point, which is the sum of all the highest 7th evaluation points, that is, the achievement rate = (7th evaluation point total / the highest 7th evaluation point) Total) x 100 = is calculated, and the seventh security achievement level is calculated as the score out of 100 points.

The control unit 4 reads all the seventh questions, their answers (seventh choices), all the seventh advice, and all the supplementary matters from the seventh storage unit 18, and selects the seventh question whose seventh evaluation score is equal to or higher than the reference score. The question, the 7th option, the 7th advice, and the supplementary matter are classified as positive factors for security measures, and the 7th question, the 7th option, the 7th advice, and the supplementary matters for which the 7th evaluation score is less than the standard score are classified as negative factors for security measures. . Then, the control unit 4 calculates the seventh security achievement degree which is the calculation result calculated by the calculation unit 32, the seventh question which is the security positive factor, the seventh option, the seventh advice and the list of positive factors such as supplementary matters, and the security A security diagnosis result report regarding in-house rules, regulations, and education including a list of negative factors such as the seventh question, seventh option, seventh advice, and supplementary matters, which are negative factors, is created and stored in the diagnosis result storage unit 28.

Next, the control unit 4 calculates the overall security achievement degree from the first security achievement degree to the seventh security achievement degree calculated in steps S12 to S18, and creates a security diagnosis result report for the company (step S19). Specifically, the arithmetic unit 32 calculates an overall evaluation point total that is the sum of the first evaluation point total to the seventh evaluation point total, and an overall highest evaluation point that is the total of the highest first evaluation point total to the highest seventh evaluation point total. The ratio to the total, that is, the overall achievement rate=(total of overall evaluation points/total of overall highest evaluation points)×100=is calculated, and the overall security achievement level is calculated as a score out of 100 points. The control unit 4 creates a corporate security diagnosis result report including the first to seventh security achievement levels and the overall security achievement level, and stores it in the diagnosis result storage unit 28. Note that the security diagnosis result report regarding the personal computer terminal created in step S12, the security diagnosis result report regarding the mobile phone terminal created in step S13, the security diagnosis result report regarding the server created in step S14, and the security diagnosis result report regarding the network created in step S15. The result report, the security diagnosis result report regarding the website created in step S16, the security diagnosis result report regarding physical information created in step S17, and the security diagnosis result report regarding internal rules, regulations, and education created in step S18, It may be created together with the corporate security diagnosis result report in S19.

In response to a request from a user or a diagnostician via the input unit 26, the control unit 4 outputs a security diagnosis result report regarding the personal computer terminal, a security diagnosis result report regarding the mobile phone terminal, and a server stored in the diagnosis result storage unit 28, in response to a request from a user or a diagnostician via the input unit 26. Report on security diagnosis results regarding network, report on security diagnosis on website, report on security diagnosis on physical information, report on internal rules, regulations, and training, and report on corporate security diagnosis. The report is output to the output section 20, and the output section 20 displays the report on the display section 22 and/or prints it on the printing section 24 according to instructions from the control section 4.

According to the security diagnosis system according to the first embodiment, the actual state of security risks is classified into seven items and diagnosed, so it is possible to comprehensively understand the security risks inherent in a company. In addition, in order to quantify security risks, such as 1st to 7th evaluation points including negative points, 1st security achievement degree to 7th security achievement degree calculated using these evaluation points, and overall security achievement degree, It is easier for companies to realize security risks. In addition, since Advice 1 to 7 are included in the security diagnosis report, what should actually be done is clearly and concretely shown, making it easy to understand what companies should be working on and aiming for. .

Next, a security diagnosis system according to a second embodiment of the present invention will be described with reference to the drawings. In the security diagnosis system according to the second embodiment, the same components as those of the security diagnosis system 2 shown in FIG. 1 are denoted by the same reference numerals, and illustration and description thereof will be omitted. FIG. 6 is a block diagram for explaining the configuration of a security diagnosis system according to the second embodiment.

As shown in FIG. 6, the security diagnosis system 38 according to the second embodiment has an extraction unit 40 and A selection section 42 is provided.

The first storage unit 6 has a personal computer terminal database as shown in FIG. 7, for example, instead of the personal computer terminal database shown in FIG. In the first embodiment, the first advices A, B, C, etc. are set for each of the first questions A, B, C, etc., as shown in FIG. 2, whereas in the second embodiment, As shown in FIG. 7, the first advice is set for each first option. That is, as shown in FIG. 7, the first storage unit 6 according to the second embodiment stores the first options A-1, A-2, A-3, N/A (not applicable); B-1, B-2, B-3, B-4, N/A (not applicable); 1st option C-1, C-2, C-3, N/A (not applicable)... First advice including ideal situation and advice etc. A-1, A-2, A-3, A-4; B-1, B-2, B-3, B-4, B-5; C-1, C-2, C-3, C-4... are stored. First advice A-1, A-2, A-3, A-4; B-1, B-2, B-3, B-4, B-5; C-1, C-2, C-3 , C-4... are different pieces of advice, and an example of the first advice A-1, A-2... is, similar to the first advice A, B... shown in FIG. ``Let's manage...'', etc., etc., etc., etc., etc., etc., etc.). In addition, the first advice A-4, B-5, and C-4, which are set to the first option N/A (not applicable), are the ideal form and advice for security measures related to the corresponding first question. It is. In this embodiment, the first advice A-4, B-5, and C-4 are set for the first option N/A (not applicable), but the configuration is such that the first advice is not set. Good too.

Further, in the first embodiment, the second advice to the seventh advice were set for each of the second to seventh questions, whereas in the second embodiment, the second advice to the seventh advice were set for each of the second to seventh questions. Second to seventh advice are set for each option. That is, the second storage unit 8 to seventh storage unit 18 according to the second embodiment also provide different advice for each of the second to seventh options, similar to the first storage unit 6 shown in FIG. Second to seventh advice, including the ideal state and advice, etc., are stored for each of the second to seventh options.

The predetermined question (referred to as the first predetermined question) is the same question as the question in the item different from the first predetermined question (referred to as the second predetermined question). Furthermore, the plurality of options for the first predetermined question (referred to as first predetermined options) are the same options as the plurality of options for the second predetermined question (referred to as second predetermined options). However, the evaluation score for the first predetermined option (referred to as a first predetermined evaluation point) is different from the evaluation score for the second predetermined option (second predetermined evaluation point). Note that the advice for the first predetermined option may be the same as or different from the advice for the second predetermined option.

That is, the first predetermined question among the first questions A, B, C... to the seventh question is at least one of the first questions A, B, C... to the seventh question in an item different from the first predetermined question. This question is the same as the second predetermined question, and is linked between the databases. For example, when the first predetermined question is the first question C, the second predetermined question is any one of the second to seventh questions other than the first question. For example, if the first predetermined question is the first question C and the second predetermined question is the third question Q (there may be two or more second predetermined questions), the first question C and the second question Q are the same As shown in FIG. 8, the first question C and the third question Q are linked. That is, the first question C (third question Q) is a question regarding security evaluation in the operation of a personal computer terminal, and is also a question regarding security evaluation when using a server and a cloud service.

When the first predetermined question is the first question C and the second predetermined question is the third question Q, the first predetermined options C-1, C-2, C-3, and N/A are 2 The same options as the predetermined options Q-1, Q-2, Q-3, and N/A, but the first predetermined evaluation points 0, 3, and 1 are different from the second predetermined evaluation points 1, 5, and 3. . Note that the number of second predetermined questions linked to the first predetermined question is not limited to one, and there may be a plurality of second predetermined questions. In Figure 8, the first advice C-1, C-2, C-3, C-4 and the third advice Q-1, Q-2, Q-3, Q-4 may be the same advice. The advice may be different.

The reading unit 31 reads the advice (first advice to seventh advice) of the choices (first option to seventh option) input from the input unit 26 to the first storage unit 6, second storage unit 8, and third storage unit. 10, the fourth storage section 12, the fifth storage section 14, the sixth storage section 16, and the seventh storage section 18, respectively.

The calculation unit 32 reads the first predetermined evaluation point set to the first predetermined option input to the input unit 26, and also reads the first predetermined evaluation point set to the same second predetermined option as the first predetermined option input to the input unit 26. The second predetermined evaluation points are read. That is, for example, when the first predetermined question is the first question C and the second predetermined question is the third question Q, the calculation unit 32 selects the first predetermined options C-1, C-2, C-3, N/A. At the same time as reading the set first predetermined evaluation points 0, 3, 1, the second predetermined evaluation points 1, 3, 2 set in the second predetermined options Q-1, Q-2, Q-3, N/A are read. Load.

When a supplementary matter is input into the supplementary matter input field 22b (see FIG. 3) by the input section 26, the extraction section 40 extracts AI (artificial intelligence), etc. from the character string of the supplementary matter inputted in the supplementary matter input field 22b. In order to extract keywords, a learning model trained in advance and stored in the memory 30 or the like is used to extract keywords. Keywords are words related to questions and options related to supplementary matters and related to the security of question items, and keywords include both keywords that are a positive factor and keywords that are a negative factor in security evaluation.

The calculation unit 32 adds or subtracts the read first to seventh evaluation points based on the keyword extracted by the extraction unit 40. For example, when the user selects the first option A-2 as an answer to the first question A, and the user and/or the diagnostician input supplementary information into the supplementary information input field 22b, the extraction unit 40 extracts the input supplementary information from Extract keywords from the string. If the extracted keyword is a word that has a positive factor in the security evaluation related to the first question A, the calculation unit 32 adds 2 points, which is the first evaluation point of the first option A-2, according to the degree of the positive factor. Add points. On the other hand, if the extracted keyword is a word that causes a negative factor in the security evaluation related to the first question A, the calculation unit 32 changes the degree of the negative factor from 2 points, which is the first evaluation point of the first option A-2. Points will be deducted accordingly. When the extraction unit 40 extracts two or more keywords, the calculation unit 32 adds or subtracts the first evaluation score based on all the extracted keywords. As described above, the keywords are set in advance and stored in the memory 30, etc., and the addition points or subtraction points related to each keyword are also set in advance and stored in the memory 30, etc.

The selection unit 42 selects the first to seventh evaluation points of the first to seventh options selected as answers to the first to seventh questions, and selects the lowest first evaluation among the first evaluation points. (0 points for the first option A-3 in the first question A; referred to as a low first evaluation point), a low second evaluation point that is low among the second evaluation points, and a low low evaluation point that is low among the third evaluation points. 3 evaluation points (for the 3rd question Q, 1 point for the 3rd option Q-1), the lowest of the 4th evaluation points, the lower of the 4th evaluation points, the lower of the 5th evaluation points, the lower of the 5th evaluation points, the lower of the 5th evaluation points; Among the low 6th evaluation point, which is the lowest among the 6 evaluation points, and the low 7th evaluation point, which is the lowest among the 7th evaluation points, the low 1st evaluation point to low At least one (three in the second embodiment) seven evaluation points are selected.

Specifically, for all questions from the first question to the seventh question, the ranking of security importance (priority in security measures) is set in advance by industry and size of the company, and the selection unit 42 selects the first Among all the questions from Question to Seventh Question, the three questions with the highest ranking of security importance and the lowest evaluation points (low 1st evaluation point to low 7th evaluation point) are selected. When the control unit 4 creates a security diagnosis result report for the company, the selection unit 42 selects the security measures as the top priority items to be addressed, along with the first security achievement level to the seventh security achievement level and the overall security achievement level. A company security diagnosis report is created that includes a summary that particularly emphasizes the three questions (1st to 7th questions) asked and the advice for the questions (1st to 7th advice).

According to the security diagnosis system according to the second embodiment, in addition to the effects of the security diagnosis system according to the first embodiment, advice (first advice) is provided for each selected option (first option to seventh option). Advice No. 7 to Advice 7) is set, so what should actually be done is shown more concretely and clearly, and it is easier to understand what companies should be working on and aiming for. Further, since keywords can be extracted from supplementary information input by the user and/or the diagnostician and reflected in the evaluation score, it is possible to more comprehensively understand the security risks inherent in the company. Moreover, since security evaluations regarding a plurality of items can be obtained by answering one question, efficiency and evaluation performance can be improved.

In each of the embodiments described above, advice (first advice to seventh advice) is stored for each question or for each option. The current event information acquired by the acquisition unit may be added to the security diagnosis result report.

Further, each of the above-described embodiments includes a diagnosis result storage section 28 that stores security diagnosis results, so that data of corporate security diagnosis result reports is accumulated. Therefore, we are further equipped with an analysis department that analyzes a large amount of accumulated data according to the industry and size of the company, and provides a report on the results of a corporate security diagnosis that includes the identification of industry standards in security and advice based on the identified industry standards. You may also create one.

2, 38...Security diagnosis system, 4...Control unit, 6...First storage unit, 8...Second storage unit, 10...Third storage unit, 12...Fourth storage unit, 14...Fifth storage unit, 16... 6th storage unit, 18...7th storage unit, 20...output unit, 22...display unit, 24...printing unit, 26...input unit, 28...diagnosis result storage unit, 30...memory, 31...reading unit, 32... Arithmetic unit, 34... Arithmetic processing table, 36... Arithmetic processing program.

Claims (7)

A security diagnosis system that diagnoses corporate security risks using seven items: computer terminals, mobile phone terminals, servers, networks, websites, physical information including business continuity plans, and internal rules, regulations, and education. ,
A plurality of first questions regarding the personal computer terminal, a plurality of first choices set for each of the first questions, and a first evaluation point set for each of the first choices according to the degree of security evaluation on the personal computer terminal. a first storage unit that stores;
A plurality of second questions regarding the mobile phone terminal, a plurality of second choices set for each second question, and a second set according to the degree of security evaluation of the mobile phone terminal for each second choice. a second storage unit that stores evaluation points;
Storing a plurality of third questions regarding the server, a plurality of third options set for each third question, and a third evaluation point set according to the degree of security evaluation on the server for each third option. a third storage unit to
Storing a plurality of fourth questions regarding the network, a plurality of fourth options set for each of the fourth questions, and a fourth evaluation point set for each of the fourth options according to the degree of security evaluation in the network. a fourth storage unit to
A plurality of fifth questions regarding the website, a plurality of fifth choices set for each of the fifth questions, and a fifth evaluation point set for each of the fifth choices according to the degree of security evaluation of the website. a fifth storage unit that stores
A plurality of sixth questions regarding the physical information, a plurality of sixth options set for each of the sixth questions, and a sixth option set for each of the sixth options according to the degree of security evaluation of the physical information. a sixth storage unit that stores evaluation points;
A plurality of seventh questions regarding the company rules, regulations, and education, a plurality of seventh choices set for each of the seventh questions, and a plurality of seventh choices set for each of the seventh choices, and each seventh choice according to the degree of security evaluation in the company rules, regulations, and education. a seventh storage unit that stores a seventh evaluation point set by
The plurality of first questions and the plurality of first options stored in the first storage unit, the plurality of second questions and the plurality of second options stored in the second storage unit, and the plurality of second options stored in the second storage unit. 3. The plurality of third questions and the plurality of third options stored in the third storage section, the plurality of fourth questions and the plurality of fourth options stored in the fourth storage section, and the fifth storage section. the plurality of fifth questions and the plurality of fifth choices stored in the storage section, the plurality of sixth questions and the plurality of sixth choices stored in the sixth storage section, and the seventh storage section. a display unit that sequentially displays the plurality of seventh questions and the plurality of seventh choices stored in the display unit;
The user inputs a first option selected from among the plurality of first options for each of the first questions, and inputs a second option selected by the user from the plurality of second options for each second question. a third option selected by the user from among the plurality of third options for each third question; and a third option selected by the user from among the plurality of fourth options for each fourth question. inputting a fourth option, inputting a fifth option to be selected by the user from among the plurality of fifth options for each fifth question, and inputting a fifth option selected by the user from among the plurality of sixth options for each sixth question; an input unit for inputting the sixth option selected by the user from the list, and inputting the seventh option selected by the user from among the plurality of seventh options for each seventh question;
The highest first evaluation point among the first evaluation points set for the plurality of first options for each first question and the first evaluation point set for the first option input from the input section. The evaluation points are read from the first storage section, and for each of the second questions, the highest second evaluation point among the second evaluation points set for the plurality of second choices and the maximum second evaluation point input from the input section are read. The second evaluation score set for the second option is read from the second storage unit, and for each third question, the highest highest score among the third evaluation points set for the plurality of third options is read. 3 evaluation points and the third evaluation points set for the third choices inputted from the input section are read from the third storage section, and for each of the fourth questions, the third evaluation points set for the plurality of fourth choices input from the input section are read from the third storage section. The highest fourth evaluation point among the fourth evaluation points and the fourth evaluation point set for the fourth option input from the input section are read from the fourth storage section, and for each fifth question. The highest fifth evaluation point among the fifth evaluation points set for the plurality of fifth options and the fifth evaluation point set for the fifth option input from the input section are Read from the storage unit and set to the highest sixth evaluation point among the sixth evaluation points set for the plurality of sixth options for each sixth question and the sixth option input from the input unit. read the sixth evaluation point from the sixth storage unit, and calculate the highest seventh evaluation point among the seventh evaluation points set for the plurality of seventh options for each seventh question and the input. a reading unit that reads the seventh evaluation point set for the seventh option input from the seventh storage unit;
Calculate a first security achievement level that is a ratio between the highest total first evaluation point that is the total of the highest first evaluation points read by the reading unit and the total first evaluation point that is the total of the first evaluation points. and a second security achievement level that is the ratio of the maximum second evaluation point total that is the sum of the maximum second evaluation points read by the reading unit and the second evaluation point total that is the sum of the second evaluation points. and a third security that is the ratio of the maximum third evaluation point total, which is the sum of the maximum third evaluation points read by the reading unit, and the third evaluation point total, which is the sum of the third evaluation points. Achievement level is calculated, and the ratio of the highest fourth evaluation point total, which is the sum of the highest fourth evaluation points read by the reading unit, and the fourth evaluation point total, which is the sum of the fourth evaluation points, is calculated. 4. Calculate the security achievement level, and calculate the ratio between the maximum 5th evaluation point total, which is the sum of the maximum 5th evaluation points read by the reading unit, and the 5th evaluation point total, which is the sum of the 5th evaluation points. A certain 5th security achievement level is calculated, and the maximum 6th evaluation point total which is the sum of the maximum 6th evaluation points read by the reading unit and the 6th evaluation point total which is the sum of the 6th evaluation points are calculated. calculate the sixth security achievement level which is the ratio, and calculate the maximum seventh evaluation point total which is the sum of the maximum seventh evaluation points read by the reading unit and the seventh evaluation point total which is the sum of the seventh evaluation points. a first calculation unit that calculates a seventh security achievement level that is a ratio of
a second calculating unit that calculates an overall security achievement level that is a ratio of the sum of the highest first evaluation point total to the highest seventh evaluation point total and the total of the first evaluation point total to the seventh evaluation point total; and,
an output unit that outputs calculation results calculated by the first calculation unit and the second calculation unit;
A security diagnostic system equipped with The security diagnosis system according to claim 1, wherein the first to seventh evaluation points include negative points. The first predetermined question, which is one of the first question to the seventh question, is at least one question among the first question to the seventh question in the item different from the first predetermined question. It is the same question as a certain second prescribed question,
The first predetermined option, which is a plurality of options set for the first predetermined question, is the same option as the second predetermined option, which is a plurality of options set for the second predetermined question,
The first predetermined evaluation point set for the first predetermined option is different from the second predetermined evaluation point set for the second predetermined option,
The reading unit reads the first predetermined evaluation point set to the first predetermined option input to the input unit, and reads the second predetermined evaluation score that is the same as the first predetermined option input to the input unit. The security diagnosis system according to claim 1 or 2, wherein the second predetermined evaluation point set as an option is read. a display control unit that causes the display unit to display an input field for inputting supplementary information for the first question to the seventh question;
further comprising: an extraction unit that extracts a preset keyword from a character string of the supplementary information input into the input field by the input unit;
Any one of claims 1 to 3, wherein the first calculation unit adds or subtracts the first to seventh evaluation points read by the reading unit based on the keyword extracted by the extraction unit. The security diagnostic system described in item (1) above. The first storage unit further stores first advice including advice about security evaluation regarding the personal computer terminal set for each first question,
The second storage unit further stores second advice including advice regarding security evaluation regarding the mobile phone terminal set for each second question,
The third storage unit further stores third advice including advice regarding security evaluation regarding the server set for each third question,
The fourth storage unit further stores fourth advice including advice about security evaluation regarding the network set for each fourth question,
The fifth storage unit further stores fifth advice including advice regarding security evaluation regarding the website set for each fifth question,
The sixth storage unit further stores sixth advice including advice regarding security evaluation regarding the physical information set for each sixth question,
The seventh storage unit further stores seventh advice including advice about security evaluation regarding the internal rules, regulations, and education set for each seventh question,
The security diagnosis system according to any one of claims 1 to 4, wherein the output unit outputs the first advice to the seventh advice together with the calculation result. The first advice includes different advice regarding security evaluation regarding the personal computer terminal for each of the first options,
The second advice includes different advice regarding security evaluation regarding the mobile phone terminal for each of the second options,
The third advice includes different advice regarding security evaluation regarding the server for each third option,
The fourth advice includes different advice regarding security evaluation regarding the network for each of the fourth options,
The fifth advice includes different advice regarding security evaluation regarding the website for each of the fifth options,
The sixth advice includes different advice regarding security evaluation regarding the physical information for each of the sixth options,
The seventh advice includes different advice regarding security evaluation regarding the internal rules, regulations, and education for each of the seventh options,
The reading unit reads the first advice of the first option input from the input unit from the first storage unit, and reads the second advice of the second option input from the input unit from the second advice. The third advice of the third option input from the input unit is read from the storage unit, and the fourth advice of the fourth option input from the input unit is read from the third storage unit, and the fourth advice of the fourth option input from the input unit is read from the third storage unit. The fifth advice of the fifth option input from the input unit is read from the storage unit, and the sixth advice of the sixth option input from the input unit is read from the sixth advice input from the input unit. reading from a storage unit, reading the seventh advice of the seventh option input from the input unit from the seventh storage unit;
6. The security diagnosis system according to claim 5, wherein the output unit outputs the first advice to the seventh advice read by the reading unit together with the calculation result. A low first evaluation point that is low among the first evaluation points read by the reading unit, a low second evaluation point that is low among the second evaluation points, and a low third evaluation point that is low among the third evaluation points. a low fourth evaluation point that is low among the fourth evaluation points, a low fifth evaluation point that is low among the fifth evaluation points, a low sixth evaluation point that is low among the sixth evaluation points, and a low sixth evaluation point that is low among the sixth evaluation points. A selection unit that selects at least one of the low first evaluation points to the low seventh evaluation points with the high security risk based on the industry and size of the company from among the low seventh evaluation points among the seven evaluation points. Further prepare,
The security diagnosis system according to any one of claims 1 to 6, wherein the output unit outputs the selection result selected by the selection unit together with the calculation result.

Images