Abstract: There are provided a method of efficiently establishing a security policy and an apparatus for supporting preparation of a security policy. According to a method of establishing a security policy in six steps, a simple security policy draft is first prepared. The security policy draft is adjusted so as to match realities of an organization, as required, thus completing a security policy stepwise. Therefore, a security policy can be established in consideration of a schedule or budget of the organization.

Abstract: A method and an associated apparatus for automatically creating security policies written in specific languages of specific devices based on a security policy written in natural language. A product level policy creating apparatus comprises language conversion means and a plurality of specific device script creating means. The language conversion means converts a product level policy of a first level into an interface language. The specific device script creating means creates product level policies of a second level for the corresponding specific devices. Defining this interface language is synonymous with defining an API (Application Programming Interface). Since the API is defined thus, plug-in modules for functioning as the specific device script creating means can be easily created based on the API.

Abstract: There are provided a method of efficiently establishing a security policy and an apparatus for supporting preparation of a security policy. According to a method of establishing a security policy in six steps, a simple security policy draft is first prepared. The security policy draft is adjusted so as to match realities of an organization, as required, thus completing a security policy stepwise. Therefore, a security policy can be established in consideration of a schedule or budget of the organization.

Abstract: There are provided a method of efficiently establishing a security policy and an apparatus for supporting preparation of a security policy. According to a method of establishing a security policy in six steps, a simple security policy draft is first prepared. The security policy draft is adjusted so as to match realities of an organization, as required, thus completing a security policy stepwise. Therefore, a security policy can be established in consideration of a schedule or budget of the organization.

Abstract: A risk assessment method for executing a risk assessment based on a security policy and the configuration of a current information system. An external API interface converts the security policy, a current system, and information asset data into a data format intended for risk assessment. A risk assessment program executes a risk assessment based on the security policy and the current system. Controls are also selected as appropriate. Depending on the result of the selection, modifications are also made to the security policy etc. The modified data is controls data. This data is used to perform a security simulation. The simulation result reflects the controls adopted by the risk assessment. Consequently, the simulation result obtained takes account of the result of the risk assessment.

Abstract: To provide a method for enabling faster, accurate ascertainment of status of an information system through use of inquiries submitted to members of an organization and an approach other than the inquiries. In step S1-1, inquiries are submitted to members of an organization, and answers to the inquiries are obtained. In step S1-2, the status of the information system is ascertained on the basis of the answers. In step S1-3, the information system is examined through use of an inspection tool through use of a network analyzer, thereby ascertaining the status of the information system. Instep S1-4, the status of the information system ascertained in step S1-2 and the status of the information system ascertained in step S1-3 are merged. In step S1-5, on the basis of the thus-merged status of the information system, a security policy is established. The status of the information system is ascertained by utilization of inquiries and the result of inspection performed by use of the tool.

Abstract: A method and an associated apparatus for automatically creating security policies written in specific languages of specific devices based on a security policy written in natural language. A product level policy creating apparatus comprises language conversion means and a plurality of specific device script creating means. The language conversion means converts a product level policy of a first level into an interface language. The specific device script creating means creates product level policies of a second level for the corresponding specific devices. Defining this interface language is synonymous with defining an API (Application Programming Interface). Since the API is defined thus, plug-in modules for functioning as the specific device script creating means can be easily created based on the API.

Abstract: There are provided a method of efficiently establishing a security policy and an apparatus for supporting preparation of a security policy. According to a method of establishing a security policy in six steps, a simple security policy draft is first prepared. The security policy draft is adjusted so as to match realities of an organization, as required, thus completing a security policy stepwise. Therefore, a security policy can be established in consideration of a schedule or budget of the organization.