Security countermeasure determination device, security countermeasure determination method and security counter determination program

摘要

The risk analysis unit (140) of the security measure determination device (100) generates threat information (111). The threat information (111) is information on a combination of one or more conditions in which each threat occurs and conditions included in a combination of threats with respect to the plurality of threats that affect the system (200) Is information satisfying whether it is satisfied or unsatisfied. The countermeasure selection unit (150) of the security measure determination device (100) refers to the threat information (111) and selects one of a plurality of threats according to the number of unfulfilled conditions included in each combination of threats , Identify threats to be addressed. Then, the countermeasure selection unit (150) selects a security measure that should be implemented, which can change at least one satisfied condition included in the specified combination of threats to an unsatisfied condition .