Source: http://www.google.com/patents/US20010049793?dq=5527183
Timestamp: 2014-03-11 11:20:06
Document Index: 643601204

Matched Legal Cases: ['art 1', 'art 1', 'art 2', 'art 2', 'art 3', 'art 3', 'art 2', 'art 4', 'art 4', 'art 5', 'art 5']

Patent US20010049793 - Method and apparatus for establishing a security policy, and method and ... - Google PatentsSearch Images Maps Play YouTube News Gmail Drive More »Sign inAdvanced Patent SearchPatentsThere are provided a method of efficiently establishing a security policy and an apparatus for supporting preparation of a security policy. According to a method of establishing a security policy in six steps, a simple security policy draft is first prepared. The security policy draft is adjusted so...http://www.google.com/patents/US20010049793?utm_source=gb-gplus-sharePatent US20010049793 - Method and apparatus for establishing a security policy, and method and apparatus for supporting establishment of security policyAdvanced Patent SearchPublication numberUS20010049793 A1Publication typeApplicationApplication numberUS 09/853,708Publication dateDec 6, 2001Filing dateMay 14, 2001Priority dateJun 1, 2000Also published asEP1160645A2, EP1160645A3, US7260830, US7823206, US20070271593Publication number09853708, 853708, US 2001/0049793 A1, US 2001/049793 A1, US 20010049793 A1, US 20010049793A1, US 2001049793 A1, US 2001049793A1, US-A1-20010049793, US-A1-2001049793, US2001/0049793A1, US2001/049793A1, US20010049793 A1, US20010049793A1, US2001049793 A1, US2001049793A1InventorsTakahiro SugimotoOriginal AssigneeAsgent, Inc.Export CitationBiBTeX, EndNote, RefManReferenced by (33), Classifications (9), Legal Events (2) External Links: USPTO, USPTO Assignment, EspacenetMethod and apparatus for establishing a security policy, and method and apparatus for supporting establishment of security policyUS 20010049793 A1Abstract There are provided a method of efficiently establishing a security policy and an apparatus for supporting preparation of a security policy. According to a method of establishing a security policy in six steps, a simple security policy draft is first prepared. The security policy draft is adjusted so as to match realities of an organization, as required, thus completing a security policy stepwise. Therefore, a security policy can be established in consideration of a schedule or budget of the organization. Images(15) Claims(83)
[0651] Establishment of a security policy by use of such a technique enables establishment of a more elaborate security policy. [0652] Overlap between Items [0653] In connection with items which do not appear in global guidelines and appear in only the recommendations and regulations aimed at a specific industry, it goes without saying that a security policy is established on the basis of the recommendations and regulations. [0654] Conversely, in connection with items which appear in only global guidelines and not in the recommendations and regulations aimed at a specific industry, a security policy is established on the basis of global guidelines, as in the case of the first embodiment. [0655] Further, in connection with items which appear in global guidelines and in the recommendations and regulations aimed at a specific industry, establishment of a security policy on the basis of the recommendations and regulations is desirable. [0656] Fourth Embodiment (designation of Global Guidelines by User) [0657] Establishment of a security policy based on global guidelines or recommendations and regulations aimed at a specific industry has been described thus far. [0658] It is considered that a user may desire to establish a security policy on the basis of a certain global guideline. For example, in a certain nation (e.g., the U.S.), a specific global guideline (e.g., COBIT) has already been utilized as a defacto standard global guideline (COBIT will be described later). Against this backdrop, there are many cases where establishment of a security policy on the basis of this specific global guideline (e.g., COBIT) is desirable. [0659] In the fourth embodiment, there is proposed construction of a global guideline to be utilized in establishing a security policy such that a user can designate the global guideline explicitly. [0660]FIG. 10 is a block diagram showing the configuration of a security policy draft preparation apparatus 320 according to the fourth embodiment. As illustrated, information concerning the global guideline designated by the user is supplied to an inquiry preparation means 322 and to a draft preparation means 328. [0661] The inquiry preparation means 322 prepares an inquiry (or inquiries) on the basis of job specifications of a member. In the fourth embodiment, during preparation of inquiries the inquiry preparation means 322 prepares inquiries complying with the global guideline designated by a user. [0662] The draft preparation means 328 prepares a security policy draft on the basis of the global guideline prescribed by the user. [0663] Operation required for preparing a security policy draft according to the fourth embodiment is substantially identical with that shown in FIG. 5 exclusive of the following points of difference. [0664] A first difference lies in that in step S501 an inquiry complying with the global guideline prescribed by the user is prepared. [0665] A second difference lies in that in step S5-4 a security policy draft complying with the global guideline prescribed by the user is prepared. [0666] In the fourth embodiment, a global guideline to be used for establishing a security policy can be selected. Inquiries are prepared in compliance with the global guideline selected by the user, and a security policy draft is prepared on the basis of answers to the inquiries. Consequently, establishment of a security policy complying with the global guideline desired by the user becomes feasible. [0667] For example, if a user has selected BS7799 to be described later, a security policy complying with (or to comply with) BS7788 can be established. [0668] Global Guidelines [0669] Examples of widely known global guidelines are provided below. [0670] (1) BS7799 [0671] BS7799 was established by the BSI (British Standards Institution) in 1995. BS7799 prescribes fundamental management items (control) which summarize best practices in connection with information security. [0672] When information assets must be protected regardless of the scale of an organization, in connection with an administration, an NGO (Non Governmental Organization), or an NPO (Non Profit Organization), to say nothing of an industry, standards of BS7799 are to be used as a code and reference of one type when the range of information security is clarified. [0673] Hence, the standards of BS7799 have the same objective as that of ISO/IEC 13335 �IT security management guidelines (GMITS)� or that of ISO/IEC 15408 �IT security evaluation standards,� which will be mentioned later. BS7799 differs from the global guidelines in the following two points. [0674] First, other regulations specify details of security techniques while IT is taken as an object. In contrast, BS7799 provides comprehensive guides and references pertaining to a management system. Second, the object of BS7799 is not limited to an electronic medium. Various information assets, such as paper mediums, are taken as objectives of security. [0675] Recently, BS7799 has gained international attention. As a matter of course, detailed individual control of information security is important. The reason for this is attributable to the following perception. As can be seen in requirements for system standards laid out in ISO 9000, a perception that a system for creating a management plan (through analysis of risk), monitoring distribution and management of required resources, and objectively reviewing the plan is effective for information security management is said to have become widespread. [0676] BS7799 is constituted of two parts; that is, a first part relating to standards for implementing information security management, and a second part relating to specifications of an information security system. The first part describes best practices and provides guidelines for providing management advice. The second part describes development of a management framework and references for �system audit.� The first part (BS7799-1) is now adopted by ISO as ISO17799. [0677] (2) GASSP (Generally Accepted System Security Principles) is intended for promoting good practice and alleviating risk and influence of risk. GASSP employs an information security policy laid down by OECD in the form of a hierarchical model and extends details of the policy. [0678] A policy which is in the highest hierarchical level and serves as a basic policy is called pervasive principles and posts a target security concept. [0679] The policy of the next hierarchical level is called broad function principles and states specific implementation of the pervasive principles. [0680] The policy of the next lower hierarchical level is called detailed principles and describes detailed security guidelines corresponding to an environment. [0681] The policies describe management of privacy of an individual and that of an organization, as well as guidelines relating to management and products. [0682] (3) GMITS [0683] GMITS (The Guidelines for the Management of IT Security) is prepared by ISO (International Organization for Standardization). The GMITS is intended for setting standards pertaining to operation, management, and planning of the security of information technology. [0684] GMITS consists of five parts: [0685] Part 1: Concepts and models for IT Security [0686] A general description of information security is provided in Part 1. [0687] Part 2: Managing and Planning IT Security [0688] Part 2 describes an operation analogous to a security life cycle. [0689] Part 3: Techniques for the Management of IT Security [0690] Part 3 describes details of the descriptions provided in Part 2. [0691] Part 4: Selection of Safeguard [0692] Part 4 describes the selection of security measures on the basis of the security rules. [0693] Part 5: Management Guidance on Network Security [0694] Part 5 is draft version such as preliminary revision, as far as now. [0695] (4) ISO/IEC 15408 is a �Collection of Requirements� into which are compiled requirements pertaining to a security function which products or a system using information technology is to have (i.e., functional requirements) and requirements for seeking ascertainment of reliable implementation of a security function during the process of proceeding from the design phase to commercialization of a product (guarantee requirements). [0696] (5) COBIT [0697] COBIT (Control Objectives for Information and Related Technology) shows good practices of security suitable for a framework of a process extending over a plurality of fields and provides a manageable logical structure. The good practices are prepared on the basis of the consent of many experts. COBIT is a global guideline designed for serving in resolving a business risk or a gap between the necessity of control and a technical problem. [0698] (6) EU Instructions [0699] Here, EU instructions are officially known as �Instructions issued by the European Parliament and Board with regard to protection of an individual in connection with personal data processing and to free transfer of personal data.� The EU instructions specify general rules concerning the legitimacy of personal data processing. More specifically, the EU instructions specify the principle of data quality, a principle on grounds for legitimacy of data processing, information to be given to a person whose personal data are to be processed, and the right of the person to access his/her own data. [0700] Fifth Embodiment (designation of rigorousness) [0701] In the embodiments which have been described thus far, the rigorousness of a security policy has been adjusted manually, namely by user's operation in step S1-4 shown in FIG. 1. [0702] However, when the rigorousness of a desired security policy has been determined beforehand, it is desirable to reflect the desired rigorousness on a security policy from the phase of preparation of security policy draft in step S1-2. [0703] In step S4-1 shown in FIG. 1, the rigorousness of each rule has been artificially adjusted. However, if a user can define an indicator of rigorousness, specify the rigorousness of a security policy using the indicator, and automatically adjust the rigorousness of each rule on the basis of the thus-prescribed rigorousness, convenience will be afforded to the user. [0704] The fifth embodiment is characterized in that the user can objectively specify the rigorousness of a security policy in steps S1-2 or S1-4 shown in FIG. 1. [0705] In order to implement designation by the user of rigorousness of a security policy, in the sixth embodiment five types of indicators representing the rigorousness of a security policy are defined. The indicators are arranged in descending order of rigorousness. The �highest level� indicator has the highest level of rigorousness, and an �educational institution level� has the lowest level of rigorousness. [0706] (1) Highest Level: representing the level of security rigorousness considered to be required by a government or a military organization; [0707] (2) Financial Level: representing the level of security rigorousness considered to be required by a financial institution; [0708] (3) International Level: representing the level of security rigorousness considered to be required by international enterprises; [0709] (4) General Level: representing the level of security rigorousness considered to be required by domestic enterprises; [0710] (5) Educational Institution Level: representing the level of rigorousness considered to be required by an educational institution. [0711] Here, examples of five levels of security rigorousness are illustrated. As a matter of course, three levels of security rigorousness; namely, a highest level of security rigorousness, a medium level of security rigorousness, and a lowest level of security rigorousness, may be adopted. [0712] 5-A Establishment of Security Policy for which Rigorousness has been designated [0713] Utilization of indicators of rigorousness of a security policy in step S1-2 (FIG. 1) will now be described. When preparing a security policy draft in step S1-2 (FIG. 1), the user selects a desired security rigorousness from the above-described five levels of security rigorousness and instructs the selected level of security rigorousness to the draft preparation apparatus 20. [0714] By means of the indicator of rigorousness, the user extracts from global guidelines a regulation having a desired rigorousness, thereby enabling preparation of a security policy draft of rigorousness desired by the user. Many of the global guidelines include indicators representing the rigorousness of a security policy. Hence, preparation of a security policy draft of desired rigorousness is feasible. [0715] Extraction operation is to incorporate knowledge concerning the rigorousness of each global guideline into knowledge-based information, and to extract an appropriate rule from global guidelines on the basis of an indicator prescribed by the user by utilization of the knowledge-based information. Knowledge about rigorousness of each of global guidelines is knowledge produced by linking the five levels of security rigorousness with regulations corresponding to the indicators of rigorousness. Through use of such knowledge, regulations corresponding to a given indicator of rigorousness can be selected from the global guidelines. [0716]FIG. 11 is a block diagram showing the configuration of a security policy draft preparation apparatus 420 according to a fifth embodiment of the present invention. As illustrated, an indicator of rigorousness prescribed by the user is delivered to draft preparation means 428 in the security policy draft preparation apparatus 420. [0717] On the basis of the indicator of rigorousness prescribed by the user, the draft preparation means 428 prepares a security policy draft. As mentioned above, a preparation operation is effected to use the knowledge-based information knowledge about a policy matching the prescribed indicator of rigorousness, and to extract from global guidelines a policy matching an indicator of rigorousness on the basis of the knowledge-based information. Briefly, this operation corresponds to pre-arrangement of a rule concerning setting of a policy in connection with a certain indicator of rigorousness (in the knowledge-based information). [0718] Operation required for establishing a security policy according to the fifth embodiment is essentially identical with that described in connection with the flowchart shown in FIG. 5, exclusive of the following two points: [0719] First, in step S5-1 the inquiry preparation means 422 prepares inquiries on the basis of the level of rigorousness prescribed by the user. �Level of rigorousness� has a smaller effect on inquiries than do other parameters (i.e., a field of business). In general, as the level of rigorousness is increased, prepared inquiries concern items of greater detail. Further, as the level of rigorousness is decreased, inquiries about detailed items are newly prepared. [0720] It is considered that the rigorousness of a security policy is reset to a higher level after establishment of the security policy. In this case, a higher level of rigorousness prescribed by the user is supplied also to inquiry preparation means 422. Hence, the inquiry preparation means 422 prepares inquiries concerning items of greater detail. Consequently, there may arise a case where inquiries are provided to members (i.e., interrogees) of an organization once again in part. [0721] If the level of rigorousness of a security policy is reset to a lower level, there is usually no chance of generating new inquiries. Consequently, in this case, a new security policy can be established immediately without implementation of inquiries. [0722] Second, in step S5-4 the indicator of rigorousness prescribed by the user is supplied to the draft preparation means 428, and the draft preparation means 428 prepares a security policy draft on the basis of the indicator of rigorousness. [0723] The operation required for establishing a security policy according to the fifth embodiment is essentially identical with that described in connection with the flowchart shown in FIG. 5, exclusive of the above-described two points. [0724] 5-B Adjustment of Security Policy for which Level of Rigorousness has been designated [0725] In the fifth embodiment, adjustment of a security policy is automatically effected in step S1-4 (FIG. 1). FIG. 12 is a block diagram showing the configuration of a security policy rigorousness adjustment apparatus 500 for effecting adjustment of such a security policy. As illustrated, the security policy rigorousness adjustment apparatus 500 comprises rigorousness inspection means 502, rigorousness adjustment means 504, storage means 506, and merging means 508. [0726] The rigorousness inspection means 502 supplies a security policy draft produced by means of the operations up to step S1-3 (FIG. 1) On the basis of an indicator of rigorousness prescribed by the user, the rigorousness inspection means 502 inspects so as to determine whether each of the rules in a security policy draft matches the rigorousness prescribed by the user. If the result of inspection shows that each of the rules matches the prescribed rigorousness, the rules are output in their present forms. If some of the rules fail to match the prescribed rigorousness, the rules are supplied to rigorousness adjustment means 504. On the basis of the indicator of rigorousness prescribed by the user, the rigorousness adjustment means 504 rewrites the thus-supplied rules and outputs rewritten rules. Information pertaining to correlation between global guidelines, respective rules in the global guidelines, and an indicator of rigorousness is stored in the storage means 508. [0727]FIG. 13 shows a flowchart representing the operation of the security policy rigorousness adjustment apparatus 500. [0728] In step S13-1, a security policy draft is supplied to the rigorousness inspection means 502. [0729] In step S13-2, the rigorousness inspection means 502 inspects so as to determine whether each of rules in the supplied security policy draft matches the indicator of rigorousness prescribed by the user. If the rules match the indicator of rigorousness, processing proceeds to step S14-3 to be described later. In contrast, if some of the rules fail to match the indicator of rigorousness, processing proceeds to step S14-4. In step S13-4, the rules which fail to match the indicator of rigorousness are changed so as to match the indicator, by means of the rigorousness adjustment means 504 and by utilization of information pertaining to correlation between the rules provided in the global guidelines and the indicator of rigorousness, which information is stored in the storage means 506. The information pertains to an indicator of rigorousness corresponding to each of the rules provided in the global guidelines. Utilization of the information enables ascertainment of rules matching the indicator of rigorousness prescribed by the user. The thus-ascertained rules are extracted from the global guidelines stored in the storage means 506. Rules which fail to match the indicator of rigorousness are replaced with the thus-extracted rules. [0730] In step S13-3, the merging means 508 merges the rules that have from the beginning matched the indicator of rigorousness with the altered rules, and outputs the thus-merged rules. [0731] Thus, each of the rules provided in the security policy draft can be matched with an indicator of rigorousness prescribed by the user. [0732] The rigorousness inspection means 502, the rigorousness adjustment means 504, and the merging means 508 according to the fifth embodiment are preferably implemented in the form of software which runs on a computer. Further, the storage means 506 is preferably embodied as a storage medium, such as a hard disk drive, CD-ROM, or DVD. [0733] Relationship between Rule and Indicator of Rigorousness [0734] A more detailed explanation is given of a case where in step S13-2 no match has been determined to exist between the rigorousness of rules and the indicator of rigorousness prescribed by the user. [0735] If the rigorousness of the rules is of lower level than the rigorousness indicated by the indicator, the rules are determined to fail to match the indicator of rigorousness. The rules are replaced with rules of higher rigorousness level. [0736] For example, if the rules are of an educational institution level and the rigorousness prescribed by the user is of a financial level, the rules are replaced with rules of a financial level. Moreover, a period of validity of a password is shortened from 120 days to 30 days. Thus, rules are replaced with more rigorous rules. [0737] If rules are higher in level than the indicator of rigorousness, the rules are determined to fail to match the indicator of rigorousness. The rules are replaced with rules of lower rigorousness level. [0738] If rules are at a highest level of rigorousness and the level of rigorousness prescribed by the user is at a general level, the rules are replaced with rules of general level of rigorousness. For example, in the case of rules of highest level of rigorousness, a period of validity of a password is one week. If the level of the rules is too rigorous, the user prescribes a general level of rigorousness. As a result, the period of validity of a password is extended to 100 days, and the rules are replaced with rules of lower level of rigorousness. [0739] Sixth Embodiment (Selection of Range of Establishment) [0740] In the embodiments which have been described thus far, a security policy is prepared for the entirety of an organization. However, it is considered that there are many desires to establish a security policy for only a portion of the system of the organization. [0741] The user prescribes a range within which a security policy is to be established. If an apparatus and method for establishing a security policy are adopted on the basis of the range, the user can establish a security policy within only an area where establishment of a security policy is desired, thus affording convenience to a user. [0742]FIG. 14 is a block diagram showing the configuration of a security policy draft preparation apparatus 520. The thus-illustrated security policy draft preparation apparatus 520 is identical in configuration with the security policy preparation apparatus 320 described by reference to FIG. 10 and with the security policy preparation apparatus 420 described by reference to FIG. 11. [0743] The two following points of difference are present. [0744] A range of establishment of a security policy prescribed by the user is supplied to the draft preparation means 528. [0745] A range of establishment of a security policy prescribed by the user is supplied to the inquiry preparation means 522. [0746] By means of such a configuration, the draft preparation means 528 establishes a security policy within a range prescribed by the user, and hence the user can efficiently establish a security policy within a required range. [0747] Further, the inquiry preparation means 522 prepares only inquiries about the range prescribed by the user, and hence useless inquiries are obviated, thus enabling conduct of efficient inquiries. Here, provision of the range prescribed by the user to the inquiry preparation means 522 is not inevitable. The reason for this is that the number of inquiries does not affect establishment of a security policy. If inquiries are irrelevant to the range prescribed by the user, an interviewer can skip the inquiries at the time of an interview. Consequently, supply of the range prescribed by the user to the inquiry preparation means 522 is not indispensable. [0748] The user can specify the range of establishment of a security policy by means of various methods. [0749] (1) First, the user can specify the range of establishment of a security policy on a product level. For example, if the user desires to establish a security policy concerning only �VPN,� the user can establish a security policy concerning VPN by means of prescribing �VPN.� By means of prescribing specific hardware or software, such as a WEB, an E-mail, or a firewall, or specific functions thereof, the user can specify establishment of a security policy concerning specific hardware or software. [0750] Next, the user prescribes the range of establishment of a security policy according to an object of use of the security policy. For example, the user desires to establish a security policy only an �outside subcontract,� a security policy can be established with regard to an area which is turned over to an outside contractor. The user can specify establishment of a security policy within a range of object of use or purpose, by means of prescribing the object of use of or purpose of electronic trading (E commerce) or a data center. [0751] (3) Further, the user can specify the range of establishment of a security policy from the viewpoint of organizational structure. For example, if the user desires to establish a security policy in connection with only the �home office,� the user can establish a security policy pertaining to the home office, by means of prescribing the �home office.� If the user prescribes branch offices, a security policy pertaining to branch offices can be established. Moreover, the user can establish a security policy pertaining to a network or a security policy pertaining to a host by means of prescribing a network or a host. [0752] Operation required for establishing a security policy according to the seventh embodiment is essentially identical with that shown in FIG. 5, exclusive of the following points of differences. [0753] First, in step S5-4 shown in FIG. 5 a security policy draft is established on the basis of the range prescribed by the user. [0754] Second, in step S5-1 shown in FIG. 5 inquiries pertaining to only the range prescribed by the user are prepared. [0755] The second point of difference is not inevitable. As has been described, even when inquiries fall outside the range prescribed by the user, such inquiries do not directly pose a problem on establishment of a security policy. Further, it is also considered that an interviewer skips such inquiries, as required. Hence, there is no problem even when inquiries are identical with those described in connection with the first embodiment. [0756] The draft preparation means 528 shown in FIG. 14 establishes a security policy draft. To this end, knowledge-based information concerning ranges within which the rules provided in the global guidelines fall is established in the storage means 524. More specifically, in the storage means 524 are stored knowledge-based information concerning whether rules fall within the range of �home office� or the range of �branch offices.� By reference to the knowledge-based information, the draft establishment means 528 establishes a security policy (draft) through use of only the rules falling within the range prescribed by the user. [0757] In this way, in the sixth embodiment, a security policy (draft) can be prepared within the range prescribed by the user. [0758] The sixth embodiment has described an example in which the inquiry preparation means 522 prepares inquiries in accordance with job specifications of a member (or interviewee), as in the case of the first embodiment (FIG. 14). Here, the inquiry preparation means 522 may be arranged so as to provide a member with general inquiries regardless of his job specifications. [0759] Seventh Embodiment (Programs and a Recording Medium) [0760] Preferably, the means which have been described thus far are actually embodied as programs and a processor executing the program. [0761]FIG. 15 shows a computer 602 having a hard disk drive 600 having programs stored therein. [0762] Programs for performing operations of the inquiry preparation means 12, the answer archival storage means 16, and the draft preparation means 18 described in connection with the first through seventh embodiments are stored in the hard disk drive 600. As a result of a processor of the computer 602 executing the programs, the computer 602 enables implementation of operations corresponding to the inquiry preparation means, the answer archival storage means, and the draft preparation means. [0763] Programs for effecting operation of the contradiction inspection means 32, that of the contradiction output means 40, that of the matching means 41, that of the virtual information system establishment means 34, that of the difference output means 38, and that of the real system input means 36, all the means being shown in FIG. 7, are stored in the hard disk drive 600. By means of the processor of the computer 602 executing these programs, the computer 602 can effect operation of the contradiction inspection means 32 and operations of the other means. [0764] Preferably, the storage means 14 described in connection with the embodiments is provided in the hard disk drive 600. [0765] An operator of the computer 602 launches the foregoing programs, thereby generating inquiries and entering, by way of a keyboard 604, answers to the inquiries from members of an organization. As a matter of course, answers may be entered by use of an input device such as a mouse. [0766]FIG. 15 shows an example in which programs run on the computer 602 of so-called standalone type. However, programs may be supplied over a network. [0767] For example, there is preferably adopted an arrangement in which a client computer executes or downloads the foregoing programs stored in a server each time execution of the programs is required. [0768] Security Policy Draft [0769] The first through eighth embodiments have primarily described preparation of a security policy draft. Needless to say, the security policy draft preparation apparatus can be used for establishing a security policy which is not a draft. In other words, the security policy draft preparation apparatus doubles as a security policy establishment apparatus, and the method of preparing a security policy draft doubles as a method of establishing a security policy. The draft preparation means doubles as a security policy establishment means. [0770] As has been described above, according to the present invention, inquiries are submitted to members of an organization, and a security policy is established on the basis of the resultant answers. Accordingly, a security policy can be established easily. [0771] Further, a security policy is established stepwise, and hence flexible establishment of a security policy can be implemented while taking into consideration the organization's desires (e.g., a budget or the like). [0772] According to the present invention, the state of information security of an organization is determined, so that the organization can be come aware of the importance of information security. [0773] Since security measures can be provided together with the priority thereof, planning of measures for future information security becomes easy. Moreover, the organization can discuss a budget on the basis of the plan. [0774] According to the present invention, a security policy can be established in consideration of line of business. [0775] According to the present invention, the user can specify global guidelines to be used for establishing a security policy. [0776] According to the present invention, a security policy is established through use of recommendations and regulations aimed at a specific line of business other than global guidelines. Hence, an elaborate security policy more preferably matching line of business can be established. [0777] According to the present invention, the user can specify the level of rigorousness of security policy through use of an indicator of rigorousness. Further, according to the present invention, the level of rigorousness of a security policy can be adjusted through use of an indicator of rigorousness. [0778] According to the present invention, the range of establishment of a security policy can be explicitly prescribed by the user. As a result, establishment of a security policy for a portion of an organization can be effected. Referenced byCiting PatentFiling datePublication dateApplicantTitleUS7287280 *Feb 12, 2002Oct 23, 2007Goldman Sachs & Co.Automated security managementUS7350204 *Jun 8, 2001Mar 25, 2008Microsoft CorporationPolicies for secure software executionUS7484237 *May 13, 2004Jan 27, 2009Hewlett-Packard Development Company, L.P.Method and apparatus for role-based security policy managementUS7512584Mar 2, 2006Mar 31, 2009Maxsp CorporationComputer hardware and software diagnostic and report systemUS7536456 *Feb 13, 2004May 19, 2009Preventsys, Inc.System and method for applying a machine-processable policy rule to information gathered about a networkUS7624086Mar 2, 2006Nov 24, 2009Maxsp CorporationPre-install compliance systemUS7624422Feb 13, 2004Nov 24, 2009Preventsys, Inc.System and method for security information normalizationUS7627891 *Feb 13, 2004Dec 1, 2009Preventsys, Inc.Network audit and policy assurance systemUS7664834Jul 7, 2005Feb 16, 2010Maxsp CorporationDistributed operating system managementUS7703123 *Aug 9, 2004Apr 20, 2010Hewlett-Packard Development Company, L.P.Method and system for security control in an organizationUS7725325Jan 18, 2006May 25, 2010International Business Machines CorporationSystem, computer program product and method of correlating safety solutions with business climateUS7840514Sep 22, 2006Nov 23, 2010Maxsp CorporationSecure virtual private network utilizing a diagnostics policy and diagnostics engine to establish a secure network connectionUS7844686Dec 21, 2006Nov 30, 2010Maxsp CorporationWarm standby applianceUS7899722Oct 23, 2002Mar 1, 2011Goldman Sachs & Co.Correspondent bank registryUS7908339Jun 2, 2005Mar 15, 2011Maxsp CorporationTransaction based virtual file system optimized for high-latency network connectionsUS7958027Jun 11, 2003Jun 7, 2011Goldman, Sachs & Co.Systems and methods for managing risk associated with a geo-political areaUS8069105Jun 17, 2003Nov 29, 2011Goldman Sachs & Co.Hedge fund risk managementUS8099378Oct 29, 2010Jan 17, 2012Maxsp CorporationSecure virtual private network utilizing a diagnostics policy and diagnostics engine to establish a secure network connectionUS8135830Jun 1, 2009Mar 13, 2012Mcafee, Inc.System and method for network vulnerability detection and reportingUS8140415 *Mar 20, 2001Mar 20, 2012Goldman Sachs & Co.Automated global risk managementUS8175418Oct 26, 2007May 8, 2012Maxsp CorporationMethod of and system for enhanced data storageUS8195820Jan 3, 2012Jun 5, 2012American Express Travel Related Services Company, Inc.System and method for dynamic security provisioning of computing resourcesUS8201256 *Mar 28, 2003Jun 12, 2012Trustwave Holdings, Inc.Methods and systems for assessing and advising on electronic complianceUS8234238May 24, 2006Jul 31, 2012Maxsp CorporationComputer hardware and software diagnostic and report systemUS8266670 *Dec 16, 2004Sep 11, 2012American Express Travel Related Services Company, Inc.System and method for dynamic security provisioning of data resourcesUS8307239Oct 26, 2007Nov 6, 2012Maxsp CorporationDisaster recovery applianceUS8375199Oct 23, 2007Feb 12, 2013Goldman, Sachs & Co.Automated security managementUS8423821Dec 21, 2006Apr 16, 2013Maxsp CorporationVirtual recovery serverUS8499330 *Nov 15, 2005Jul 30, 2013At&T Intellectual Property Ii, L.P.Enterprise desktop security management and compliance verification system and methodUS8606945May 9, 2012Dec 10, 2013American Express Travel Related Services Company, Inc.System and method for dynamic security provisioning of computing resourcesUS20120060163 *Sep 7, 2010Mar 8, 2012Nadeem KhanMethods and apparatus associated with dynamic access control based on a task/trouble ticketWO2004088472A2 *Mar 26, 2004Oct 14, 2004Joseph PatanellaMethods and systems for assessing and advising on electronic complianceWO2008039395A2 *Sep 21, 2007Apr 3, 2008Robert O Keith JrSecure virtual private network* Cited by examinerClassifications U.S. Classification726/1International ClassificationG06Q10/00, G06Q50/00, G06Q10/06, G06F1/00, G06F21/00Cooperative ClassificationH04L63/20, G06F21/6218European ClassificationG06F21/62BLegal EventsDateCodeEventDescriptionFeb 10, 2011FPAYFee paymentYear of fee payment: 4May 14, 2001ASAssignmentOwner name: ASGENT, INC., JAPANFree format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:SUGIMOTO, TAKAHIRO;REEL/FRAME:011815/0636Effective date: 20010507RotateOriginal ImageGoogle Home - Sitemap - USPTO Bulk Downloads - Privacy Policy - Terms of Service - About Google Patents - Send FeedbackData provided by IFI CLAIMS Patent Services©2012 Google