Security measure invalidation prevention device, security measure invalidation prevention method, and security measure invalidation prevention program

1. A security measure invalidation prevention device, comprising:

an electronic memory; and

a processor coupled to the electronic memory and configured to

acquire invalidated security point information about an invalidated security point among security points each having a measure function performing a security measure on a node connected to a network, the invalidated security point being bypassed in an updated network path as packets are routed from source to destination in order to invalidate a measure function thereof;

determine whether a security event that the measure function of the invalidated security point addresses is present based on the invalidated security point information acquired;

identify a security point to which the measure function of the invalidated security point is able to be shifted when presence of the security event is determined; and

issue an alert in a case that no security point to which the measure function of the invalidated security point is able to be shifted is identified,

wherein when there is no security point to which the measure function of the invalidated security point can be shifted, communication through the invalidated security point continues without bypassing the invalidated security point and without performing the measure function of the invalidated security point and an alarm is outputted.

2. The security measure invalidation prevention device according to claim 1 , wherein the processor is further configured to output, as a shift-destination candidate security point, the security point identified.

3. The security measure invalidation prevention device according to claim 1 , wherein the processor is further configured to shift the security event to be addressed with the measure function of the invalidated security the security point identified.

4. The security measure invalidation prevention device according to claim 1 , wherein the electronic memory stores therein security point information about the security point having the measure function performing the security measure on the node, measure function information about the measure function included in the security point, and event information about the security event the measure function addresses, and

the processor determines whether the security event to be addressed with the measure function of the invalidated security point is present on the basis of the invalidated security point information acquired, the security point information, the measure function information, and the event information that are stored in the electronic memory.

5. The security measure invalidation prevention device according to claim 4 , wherein the electronic memory stores therein, as the security pointing information, information about the security point having the measure function performing the security measure on the node on a network path to which the node is connected, and, as the event information, information about a cyber attack to be addressed with the measure function.

6. The security measure invalidation prevention device according to claim 4 , wherein

the processor determines, for each measure function, whether the security event to be addressed with the measure function of the invalidated security point is present with reference to the event information corresponding to the measure function of the invalidated security point in the event information stored in the electronic memory, and

the processor identifies, for each security event, the security point to which the measure function of the invalidated security point is able to be shifted out of the security points excluding the invalidated security point, when the processor determines that at least one security event is present.

7. The security measure invalidation prevention device according to claim 1 , wherein the processor identifies the security point to which the measure function of the invalidated security point is able to be shifted out of the security points on a network path to which the node is connected.

8. The security measure invalidation prevention device according to claim 1 , wherein the processor identifies a security point closest to an attack source attacking the node out of the security points to which the measure function of the invalidated security point is able to be shifted.

9. The security measure invalidation prevention device according to claim 1 , wherein the security points include:

a fire wall security point that terminates unauthorized communications in at least one of a network layer and a transport layer,

an intrusion prevention security point that terminates communications that correspond to a predetermined pattern, and

a web application firewall that terminates unauthorized communications in an application layer.

10. The security measure invalidation prevention device according to claim 9 , wherein the invalidated security point is the intrusion prevention security point, and the measure function of the intrusion prevention security point is shifted to one of the fire wall and the web application firewall.

11. A security measure invalidation prevention method performed by a security measure invalidation prevention device, the security measure invalidation prevention method comprising:

acquiring invalidated security point information about an invalidated security point among security points each having a measure function performing a security measure on a node connected to a network, the invalidated security point being bypassed by an updated network path as packets are routed from source to destination in order to invalidate a measure function thereof;

determining whether a security event to be addressed with the measure function of the invalidated security point is present based on the invalidated security point information acquired at the acquiring;

identifying a security point to which the measure function of the invalidated security point is able to be shifted when presence of the security event is determined; and

issuing an alert in a case that no security point to which the measure function of the invalidated security point is able to be shifted is identified,

wherein when there is no security point to which the measure function of the invalidated security point can be shifted, communication through the invalidated security point continues without bypassing the invalidated security point and without performing the measure function of the invalidated security point and an alarm is outputted.

12. The security measure invalidation prevention method according to claim 11 , further comprising outputting, as a shift-destination candidate security point, the security point identified.

13. The security measure invalidation prevention method according to claim 11 , further comprising shifting the security event to be addressed with the measure function of the invalidated security point to the security point identified.

14. A non-transitory computer-readable recording medium having stored a security measure invalidation prevention program that, when executed by a processor, causes the processor to perform a method comprising:

acquiring invalidated security point information about an invalidated security point among security points each having a measure function performing a security measure on a node connected to a network, the invalidated security point being bypassed by an updated network path as packets are routed from source to destination in order to invalidate a measure function thereof;

determining whether a security event to be addressed with the measure function of the invalidated security point is present based on the invalidated security point information acquired at the acquiring;

identifying a security point to which the measure function of the invalidated security point is able to be shifted when presence of the security event is determined; and

issuing an alert in a case that no security point to which the measure function of the invalidated security point is able to be shifted is identified,

wherein when there is no security point to which the measure function of the invalidated security point can be shifted, communication through the invalidated security point continues without bypassing the invalidated security point and without performing the measure function of the invalidated security point and an alarm is outputted.

15. The non-transitory computer-readable recording medium according to claim 14 , further comprising outputting, as a shift-destination candidate security point serving, the security point identified.

16. The non-transitory computer-readable recording medium according to claim 14 , further comprising shifting the security event to be addressed with the measure function of the invalidated security point to the security point identified.