Patent ID: 6971026

Claim:
A method for evaluating security applied to a system constituted by at least one component, by the use of an electronic computer, the method comprising steps of: a first step of accepting a first specification of a system to be evaluated and a second specification of each of the components constituting the system, from an operator via an input unit connected to the electronic computer; a second step of retrieving data from a database in which constituent components and security countermeasures to be executed to the constituent components are described for each type of system, and of reading out security countermeasures to be executed to the components constituting the system which are specified by the second specification, out of the constituent components of the system type, the system type corresponding to that of the system which is specified by the first specification; a third step of displaying on a display unit connected to the electronic computer, the security countermeasures read out in the second step in correspondence with each of the components constituting the system which are specified by the second specification and of accepting from the operator via the input unit, information as to whether or not each of the security countermeasures being displayed is executed; and a fourth step of evaluating a state of security of the system, based on the information regarding whether the security countermeasures of the components constituting the system are executed or not, the information being accepted in the third step, and of displaying evaluation results on the display unit, wherein the database describes, as to each of the security countermeasures, a security type ensured by executing the security countermeasure concerned, and wherein the fourth step includes steps of: classifying the security countermeasures, which are read out in the second step, into the security types; determining, as to each of the security types, the ratio of the number of security countermeasures accepted as executed in the third step, to the number of security countermeasures classified into the security type concerned; and displaying on the display unit the ratio for each of the security types as the degree of accomplishment of the security countermeasures classified into the security type concerned.