An optimization apparatus, comprising: a collecting unit that collects cyber attack information that is information related to a cyber attack, and system information that is information related to an entire system including a device that has received the cyber attack; an extracting unit that identifies, based on the cyber attack information and the system information collected by the collecting unit, an attack route of the cyber attack, and extracts, as dealing point candidates, devices that are on the attack route and have an effective dealing function against the cyber attack; and a selecting unit that selects a dealing point from the dealing point candidates extracted by the extracting unit, by using optimization logic that has been set, wherein the collecting unit: collects, as the cyber attack information, attack type information indicating a type of the cyber attack, an attacker identifier that identifies a terminal of an attacker, a victim identifier that identifies a terminal of a victim, and dealing function information indicating the effective dealing function against the cyber attack; and collects, as the system information, network configuration information that is able to indicate a usage route for each service and devices that may become dealing point candidates, dealing function information for each of the dealing points, and resource usage status information indicating resource usages statuses of the dealing points, and wherein the extracting unit associates the attacker identifier, the victim identifier, and the attack type information, which have been collected by the collecting unit, with the network configuration information to identify the attack route of the cyber attack; extracts dealing points on the attack route; collates the dealing function information for each of the dealing points with the effective dealing function against the cyber attack; and extracts devices having the effective dealing function against the cyber attack as the dealing point candidates. a collecting unit that collects cyber attack information that is information related to a cyber attack, and system information that is information related to an entire system including a device that has received the cyber attack; an extracting unit that identifies, based on the cyber attack information and the system information collected by the collecting unit, an attack route of the cyber attack, and extracts, as dealing point candidates, devices that are on the attack route and have an effective dealing function against the cyber attack; and a selecting unit that selects a dealing point from the dealing point candidates extracted by the extracting unit, by using optimization logic that has been set, wherein the collecting unit: collects, as the cyber attack information, attack type information indicating a type of the cyber attack, an attacker identifier that identifies a terminal of an attacker, a victim identifier that identifies a terminal of a victim, and dealing function information indicating the effective dealing function against the cyber attack; and collects, as the system information, network configuration information that is able to indicate a usage route for each service and devices that may become dealing point candidates, dealing function information for each of the dealing points, and resource usage status information indicating resource usages statuses of the dealing points, and wherein the extracting unit associates the attacker identifier, the victim identifier, and the attack type information, which have been collected by the collecting unit, with the network configuration information to identify the attack route of the cyber attack; extracts dealing points on the attack route; collates the dealing function information for each of the dealing points with the effective dealing function against the cyber attack; and extracts devices having the effective dealing function against the cyber attack as the dealing point candidates.