Patent ID: 8484729

Claim:
A security operation management system for managing the security of a managed system including during operation of the managed system, the security operation management system comprising: state changing means for determining a state satisfying a state rule, which defines a desired state for the security of diagnostic items of the managed system, as a target state if the state of the managed system does not satisfy the state rule; action determining means for determining a countermeasure, which is for changing the state of the diagnostic items in a state different from the target state to the target state, as a countermeasure that needs to be carried out based on action information defined in advance wherein: the state rule is indicated by a constraint equation related to predetermined state variables allocated to diagnostic items related to the security in the managed system, the state changing means determines the state of the managed system indicated by a combination of states of the diagnostic items satisfying the constraint equation as the target state if the current state of the diagnostic items collected from the managed system does not satisfy the constraint equation as the state rule, and the action determining means determines a process for changing diagnostic items, in which the current state is different from the states of the diagnostic items in the target state, among the diagnostic items collected from the managed system, to the states of the diagnostic items in the target state as a countermeasure that needs to be carried out policy information storing means for storing policy information defining requirements for the managed system; requirement-by-requirement state model storing means for storing a state model defining a state of the managed system when the requirement is satisfied, for each requirement defined by the policy information; and policy converting means for delivering a state rule defining a desired state of the managed system based on the policy information stored in the policy information storing means and the state model stored in the requirement-by-requirement state model storing means, wherein the policy converting means delivers a constraint equation, which limits values that state variables can take in the state of the managed system when the requirements that need to be satisfied are satisfied, and an objective function, which becomes maximum or minimum depending on values of state variables in the state of the managed system when all requirements that need to be satisfied as much as possible are satisfied, as state rules defining the system state that satisfies as many requirements for the managed system as possible, and wherein the policy converting means weights the values of the state variables in the state of the managed system when the requirements in the objective function are satisfied in accordance with the priority order of the requirements for the managed system.