A device security management apparatus comprising: a communication unit that communicates with a device, via a network within a building in which the security management apparatus and the device are installed, the device being used for financial processing; a memory unit that memorizes biometric information for each of a plurality of operators; a biometric information acquisition unit that acquires biometric information from the device via the network; a biometric authentication unit that compares the acquired biometric information with the memorized biometric information, to identify an operator corresponding to the acquired biometric information; and a device control unit that notifies the device of first control information for bringing the device into an operable state via the network in a case where the biometric authentication unit has identified the operator corresponding to the acquired biometric information, the device control unit notifying the device of second control information for bringing the device into an inoperable state via the network in a case where the biometric authentication unit has not identified the operator corresponding to the acquired biometric information; wherein the memory unit further memorizes authority information indicating whether authority to operate the device is given for each of the operators, the device control unit determines whether the operator corresponding to the acquired biometric information is authorized to operate the device based on the memorized authority information, in a case where the biometric authentication unit has identified the operator corresponding to the acquired biometric information, the device control unit notifies the device of the first control information, in a case where the device control unit has determined that the operator corresponding to the acquired biometric information is authorized to operate the device, and the device control unit notifies the device of the second control information, in a case where the device control unit has determined that the operator corresponding to the acquired biometric information is not authorized to operate the device the memory unit further memorizes an operation ranking indicating which operation on the device is authorized for an operator who is authorized to operate the device, and the device control unit notifies the device of the first control information including the memorized operation ranking, in a case where the device control unit has determined that the operator corresponding to the acquired biometric information is authorized to operate the device. a communication unit that communicates with a device, via a network within a building in which the security management apparatus and the device are installed, the device being used for financial processing; a memory unit that memorizes biometric information for each of a plurality of operators; a biometric information acquisition unit that acquires biometric information from the device via the network; a biometric authentication unit that compares the acquired biometric information with the memorized biometric information, to identify an operator corresponding to the acquired biometric information; and a device control unit that notifies the device of first control information for bringing the device into an operable state via the network in a case where the biometric authentication unit has identified the operator corresponding to the acquired biometric information, the device control unit notifying the device of second control information for bringing the device into an inoperable state via the network in a case where the biometric authentication unit has not identified the operator corresponding to the acquired biometric information; wherein the memory unit further memorizes authority information indicating whether authority to operate the device is given for each of the operators, the device control unit determines whether the operator corresponding to the acquired biometric information is authorized to operate the device based on the memorized authority information, in a case where the biometric authentication unit has identified the operator corresponding to the acquired biometric information, the device control unit notifies the device of the first control information, in a case where the device control unit has determined that the operator corresponding to the acquired biometric information is authorized to operate the device, and the device control unit notifies the device of the second control information, in a case where the device control unit has determined that the operator corresponding to the acquired biometric information is not authorized to operate the device the memory unit further memorizes an operation ranking indicating which operation on the device is authorized for an operator who is authorized to operate the device, and the device control unit notifies the device of the first control information including the memorized operation ranking, in a case where the device control unit has determined that the operator corresponding to the acquired biometric information is authorized to operate the device.