Information processing device, information processing method, and information processing computer program product

An information processing method implemented by a computer, the method comprising:

• acquiring a resilience requirement for a target system including a plurality of nodes in communication via a network;
• generating a plurality of action sets for which at least one of a type of an action and a number of actions for resilience is different, each action set comprising one or more security actions to be performed against cyberattacks on the target system, the one or more security actions being selected from a cyber resilience catalog including one or more of firewall, anti-virus, Security Operations Center (SOC), backup or restore, fallback, and duplication;
• calculating, for each of the plurality of action sets, a resilience indicator of the target system to which an action set is applied, based on resilience parameters representing improvement degrees of resilience items;
• selecting, as resilience design information, the action set satisfying the resilience requirement among the plurality of action sets, based on the resilience indicator;
• generating a code to implement the action set represented by the resilience design information by generating Infrastructure as Code (IaC) for the action set;
• and
• implementing the action set in the target system by applying the generated code to facilitate an optimum resilience design information for the target system,
• wherein
• the resilience items include at least one of an attack success rate, an operation function, or a stop period,
• the resilience indicator is calculated using an integrated value of a function stop rate and the attack success rate within a return time,
• the function stop rate represents a proportion of functions in the target system that are stopped at a given time, and is defined as 1 minus a function operation rate, and
• the function operation rate is defined as a proportion of functions in the target system that are operating at a given time, expressed as a value between 0 and 1, with 1 indicating all functions are operating and 0 indicating all functions are stopped.

An information processing program product having a non-transitory computer readable medium including programmed instructions, wherein the instructions, when executed by a computer, cause the computer to execute:

• acquiring a resilience requirement for a target system including a plurality of nodes in communication via a network;
• generating a plurality of action sets for which at least one of a type of an action and a number of actions for resilience is different, each action set comprising one or more security actions to be performed against cyberattacks on the target system, the one or more security actions being selected from a cyber resilience catalog including one or more of firewall, anti-virus, Security Operations Center (SOC), backup or restore, fallback, and duplication;
• calculate, for each of the plurality of action sets, a resilience indicator of the target system to which an action set is applied, based on resilience parameters representing improvement degrees of resilience items;
• selecting, as resilience design information, the action set satisfying the resilience requirement among the plurality of action sets, based on the resilience indicator;
• generate a code to implement the action set represented by the resilience design information by generating Infrastructure as Code (IaC) for the action set;
• and
• implement the action set in the target system by applying the generated code to facilitate an optimum resilience design information for the target system,
• wherein
• the resilience items include at least one of an attack success rate, an operation function, or a stop period,
• the resilience indicator is calculated using an integrated value of a function stop rate and the attack success rate within a return time,
• the function stop rate represents a proportion of functions in the target system that are stopped at a given time, and is defined as 1 minus a function operation rate, and
• the function operation rate is defined as a proportion of functions in the target system that are operating at a given time, expressed as a value between 0 and 1, with 1 indicating all functions are operating and 0 indicating all functions are stopped.