Abstract: An electronic file copy notification reception unit acquires identification information on a terminal device connected to a first network switch to which a file server is connected, as first identification information, when the terminal device acquires a copy of an electronic file from the file server. A determination instruction unit acquires identification information on a device, as second identification information, when the device is newly connected to a second network switch different from the first network switch. The determination instruction unit matches the first identification information with the second identification information and instructs the second network switch to restrict communication to and from the terminal device via the second network switch in case where the first identification information coincides with the second identification information.

Abstract: A second communication unit (411) of a security management apparatus (201) externally receives dependency information (412) indicating a dependence relation between information assets individually held by a first system and a second system. Then, a selection unit (415) of the security management apparatus (201) selects a security measure to be implemented, from among candidates for a security measure against a threat to an information asset held by the first system, in accordance with a dependence relation indicated by the dependency information (412) received by the second communication unit (411).

Abstract: When detecting a traffic abnormality, an abnormality detection apparatus 131 notifies a malware infected terminal that has caused the traffic abnormality to a terminal whitelist generation apparatus 133, the terminal whitelist generation unit 133 generates a whitelist indicating software allowed to be installed to the malware infected terminal and setting of a reference terminal device 134 managed not to be infected with the malware, and loads a inspection object extraction program into the malware infected terminal, the inspection object extraction program detects software and setting in the malware infected terminal, and inspects whether or not the detected software and setting coincide with the software and the setting in the whitelist, it is highly likely that software or a setting not coinciding with the whitelist is associated with the malware, by analyzing the software or the setting, the malware may be promptly identified.

Abstract: A relay apparatus log analysis apparatus 132 periodically receives log data from a relay apparatus 112, when detecting a traffic abnormality, an abnormality detection apparatus 131 notifies the IP address of a terminal device that has caused the abnormality to the relay apparatus log analysis apparatus 132, the relay apparatus log analysis apparatus 132 analyzes traffic information generated by a router apparatus 121 to identify a time when the traffic abnormality has occurred, the relay apparatus log analysis apparatus 132 analyzes the log data, based on the occurrence time of the traffic abnormality and the IP address of the terminal device that has caused the abnormality, identifies an address accessed by the terminal device, regards the identified address as the destination from the malware, and sets the relay apparatus 112 so as to block a packet to the address.