A management device is configured to control reading and writing of data as performed by a processing circuit with respect to a nonvolatile memory. The management device includes circuitry configured to: in response to a request from the processing circuit, perform writing or reading with respect to the nonvolatile memory; in response to writing with respect to the nonvolatile memory, update a table indicating a rewriting count for each area in the nonvolatile memory; detect writing having a high degree of locality representing rewriting operation performed to an extent equal to or greater than a reference value, with respect to the same area in the nonvolatile memory by refer to the table; and identify an area under attack in which the writing having the high degree of locality is performed.