Risk model correcting system, risk model correcting method, and risk model correcting program

A risk model correcting method comprising;

• storing a correspondence relation of a group of threats of a risk, a parameter indicating a magnitude of each of the threats of the group, a group of measures to the threat, and a parameter indicating an effect of each of the measures of the group, as a risk model;
• collecting the measure adopted for an analysis target system as adoption measure data;
• calculating a magnitude of the risk in said analysis target system as a risk value based on said risk model and said adoption measure data;
• calculating an influence degree of existence or non-existence of the adopted measure on a calculation result of said risk value;
• extracting each of the threats or each of measures, for the parameter to be adjusted, as a parameter adjustment candidate based on the influence degree;
• displaying the extracted parameter adjustment candidate;
• and
• adjusting the parameter related to the threat or the measure.

A risk model correcting program executed by a computer which comprises:

• storing a correspondence relation among a group of threats of a risk, a parameter indicating a magnitude of each of the threats of the group, a group of measures to the threat, and a parameter indicating an effect of each of the measures of the group, as a risk model;
• collecting the measure adopted for an analysis target system as adoption measure data;
• calculating a magnitude of the risk in said analysis target system as a risk value based on said risk model and said adoption measure data;
• calculating an influence degree of existence or non-existence of the adopted measure on a calculation result of said risk value;
• extracting each of the threats or each of measures, for the parameter to be adjusted, as a parameter adjustment candidate based on the influence degree;
• displaying the extracted parameter adjustment candidate;
• and
• adjusting the parameter related to the threat or the measure.