TW201913440A - Method, system, computer program product and computer-readable recording medium of information security joint defense mechanism - Google Patents

Abstract

A method, system, computer program product and computer-readable recording medium of an information security joint defense mechanism connecting to at least one client server in which a security information collecting program is installed. The system includes at least one joint-defense server, an insurance server and an information security management server. The joint-defense server includes an alert and surveillance server and/or a notification and response server. The information security management server is configured to selectively exchange a piece of security information collected by the security information collecting program with the joint-defense server and the insurance server, in order to offer at least two of the following services to the client servers: the information security alert and surveillance service, information security notification and response service, and information security and privacy insurance service.

Description

Guardian security methods, systems, computer program products and computer readable recording media

The invention relates to information security technology, in particular to a security joint prevention method, a system, a computer program product and a computer readable recording medium.

With the rapid development of Internet technology, more and more information needs to be transmitted through the Internet, so the issue of network security is even more important. In particular, e-commerce systems for banks or businesses that provide services such as electronic transactions and mobile payments, or large enterprises, public agencies, etc., must pass confidential documents. If these organizations are attacked by hackers or infiltrated by people, they may cause Huge losses.

In this regard, at present, large organizations (such as enterprises, public institutions, banks, etc.) will mostly build their own Security Operation Center (SOC) for protection. However, in addition to the high cost, the self-built network security monitoring center is also unsuccessful and it is difficult to provide better protection. For example, it may be difficult to monitor for a long time because of insufficient manpower allocation, and it is difficult to fully cope with a large-scale attack. Moreover, the resource security resources are also relatively closed and slow to update, and it is difficult to cope with the rapidly changing network attack patterns.

In response to the above problems, some companies have developed the "Security Monitoring Instant Messaging System and Its Joint Defense System and Joint Prevention Method" of the Republic of China Invention Patent Disclosure No. 201122895, and the "Distributed Network Intrusion of the Alliance Type" of the Republic of China Invention Patent Publication No. 201141155 The defense system and its methods are mainly to integrate and prevent multiple system members to improve the problem that independent network security monitoring centers cannot assist each other, exchange and share resources. However, these prior cases still only provide general security services and cannot compensate for the losses that have been attacked.

Although there are currently practitioners developing insurance mechanisms for electronic transactions, such as "Insurance method, insurance system, transaction monitoring method, transaction monitoring system, and program", US Patent Publication No. US 20030046115 A1, Japanese Invention Patent Special 2000- 207453 "Electronic Commerce Guide". However, these prior cases only provide claims insurance that is compensated afterwards, and there is not much substantial help in improving the effectiveness of security protection.

Therefore, in order to provide a better security protection mechanism, the present inventors propose a method for joint security prevention, comprising the following steps: an environmental construction step, a joint prevention step, and a service step. The environment construction step is to establish a security control server. The joint defense step: installing a security message collection object on a client server, and the security information collection object is connected to the security control server through a network, and the security control server signal is connected to at least one The joint defense servo end and the insurance servo end, the aforementioned joint defense servo end includes an early warning and monitoring servo end or/and a notification and strain servo end. Providing the service step: causing the security controller to selectively exchange the security message with the security server and the insurance server to obtain a security message to provide a joint defense service to the client server and An insurance service.

Further, a risk assessment step is included: a risk assessment module calculates a security risk model based on the security information, and calculates a security risk value according to the security risk feature model.

Further, the security information includes a log of a security risk profile including a management risk value, a base security risk value, an information management security value, and an external threat value. .

Further, the method further includes a depositing step of converting each of the security information into a block of data, the block data being stored in a private blockchain and a public blockchain, the private zone The block chain is used for interfacing with a digital identification system to read the block data. The public blockchain is used to provide the foregoing block data to the client server and the joint defense server for reading.

The invention is also a method for joint security prevention, comprising the following steps: an environmental construction step, a joint prevention step and a service step. The environment construction step: build a security control server. The joint defense step: installing a security message collection object on a client server, and the security information collection object is connected to the security control server through a network, and the security controller is connected to the server. The servo end, the aforementioned joint defense servo end includes an early warning and monitoring servo end and a notification and strain servo end. Providing the service step: causing the security controller to selectively exchange the security message with the aforementioned anti-server to obtain a security message to provide a joint defense service to the client server, and the defense service includes a Security security and monitoring services and a security notification and response services.

The invention is also a security security defense system, which is used for connecting at least one client server, and the client server installs a security information collection object, the security security system includes: at least one anti-server, one insurance server and one The security control server. The aforementioned joint defense server includes an early warning and monitoring servo terminal or/and a notification and strain servo terminal. The security control server signal is connected to the joint defense server and the insurance server, and the signal is connected to the security information collection object, and the security control server is used for selectively exchanging with the joint defense server and the insurance server. The security information collection object obtains a security information to provide at least two of the following services to the aforementioned client server: a security warning and monitoring service, a security notification and response service, and a security damage insurance service.

Further, the foregoing early warning and monitoring server includes an information sharing and analysis center (ISAC), a security monitoring center (SOC), a security tool providing unit, a telecommunications service center, a security risk assessment unit, and a security Test any or combination of teams.

Further, the aforementioned notification and response server includes a government-funded information sharing and analysis center (G-ISAC), a financial support center (F-ISAC), a funded security investigation and identification unit, and a funded security team. Or a combination.

Further, a risk assessment module is further included, and the signal is connected to the security control server, and the risk assessment module is configured to calculate a security risk feature model according to the security information, and calculate a capital according to the security risk feature model. Security risk value.

Further, the security information includes a log of a security risk profile including a management risk value, a base security risk value, an information management security value, and an external threat value. .

Further, a card storage module is connected to the controller, and the card storage module is configured to convert each of the security messages into a block of data, and the block data is stored in a private block. a chain and a public blockchain, wherein the private blockchain is used for interfacing by a digital identification system to read the block data, and the public blockchain is used to provide the foregoing client data to the client server and the foregoing joint defense The server reads.

The invention can be a computer program product, which stores a program, and when the computer loads the program and executes it, the following method can be completed.

The invention can also be a computer readable recording medium, which stores a program. When the computer loads the program and executes it, the method can be completed as described above.

According to the above technical features, the following effects can be achieved:

1. The security control server can integrate the anti-server, and provide better protection for the client's servo. To improve the independent establishment of network security monitoring centers can not help each other, exchange, and share resources.

2. Providing more than two services, such as security warning and monitoring services for preventive measures, security notifications and response services for incidents, and security damage insurance services for incident losses, to provide a more complete Security protection effect.

3. The security control server is better able to integrate the anti-server with the insurance server, and provide the insurance mechanism for the customer's server to prevent and compensate afterwards, so that the cooperative customers (such as large institutions, public agencies, banks, etc.) ) Get better protection.

4. While providing protection, it can also provide security information to the insurance server, so that it is easy to clarify the liability of damages after the event and reduce the dispute of claim determination.

5. The early warning and monitoring server can be, for example, the Information Sharing and Analysis Center (ISAC), the One Security Monitoring Center (SOC), the One-Aid Security Tool Providing Unit, a Telecommunications Service Center, a Security Risk Assessment Unit, and a Security Center. The inspection team, etc., the notification and response server can be, for example, the government's information security sharing and analysis center (G-ISAC), the one-finance financing center (F-ISAC), the one-investigation investigation and identification unit, the one-on-one security response team, etc. By expanding the members of the joint defense and making full use of the characteristics of different units, the benefits of joint prevention will be further enhanced.

6. The risk assessment module can determine the security risk value of the client's server based on the security risk model to facilitate the identification of reasonable premiums.

7. The security risk feature model can be established based on the security information of the client's server, and can be comprehensively evaluated according to the source of the security information (such as from management, grassroots, information management, external threats, etc.) to facilitate Accurately identify the value of the security risk, which in turn can estimate more reasonable premiums.

8. Use blockchain technology to back up the security information, reduce the possibility of the loss and tampering of the information of the security information, improve the credibility of the backup security information, and avoid disputes arising from the after-the-fact claims.

9. Traditionally, due to the asymmetry of information on the security risks between the insurer and the insured, the insurer has weak confidence in the insurer's ability to protect and risk, and the insurance premium rate is high. However, by providing the third party as the third party, the service provider, such as the security monitoring and protection rules, the security information and the joint defense, will help improve the insurer’s confidence in the security protection of the insured and reduce The insurance premium rate and the accelerated claims process.

In combination with the above technical features, the main functions of the method, system, computer program product and computer readable recording medium of the present invention will be clearly shown in the following embodiments.

Referring to the first figure and the second figure, the security security system (100) of the embodiment of the present invention is disclosed for connecting at least one client server (200) (such as a server of a company, a bank, a public service, etc.). In this case, since the same component symbol is used by the same user, the client server (200) installs a security information collection item (201) (for example, a log collector), and the security joint prevention system (100) includes: multiple joint defense The servo terminal (1), a safety servo terminal (10) and a security control server (2). In the embodiment, the joint defense server (1) includes an early warning and monitoring servo end (11) and a notification and strain servo end (12), but is not limited thereto. For example, there may be only the warning and monitoring server (11), the notification and the strain server (12), and not the insurance server (10); or only the notification and strain server (12) and the insurance The servo terminal (10); or the warning and monitoring servo terminal (11) and the insurance servo terminal (10). The security control server (2) signal connects the security message collection object (201) and the aforementioned joint defense server (1). The security controller (2) is configured to selectively exchange the security information collection object (201) with the security server (1) to obtain a security message to provide a service to the client server (200). Joint defense service and one insurance service, wherein the joint defense service includes a security warning and monitoring service and a security notification and response service, which may include underwriting assessment and/or claims service. However, it should be specially stated that it is not necessary to provide the insurance service, and it can also provide only the security warning and monitoring service, the security notification and the response service.

Please refer to the first figure and the second figure. In detail, the warning and monitoring server (11) can be provided, for example, by the Information Sharing and Analysis Center (ISAC), the SOC, and the security tool. The unit, a telecom service center, a security risk assessment unit, a security inspection team, etc., the notification and response server (12) can be, for example, the government fund information sharing and analysis center (G-ISAC), one gold financing An Center (F-ISAC), a funded security investigation and identification unit, and a funded security team. By expanding the membership of the joint defense, the characteristics of different units can be fully utilized to improve the effectiveness of the joint defense. For example, the Telecommunication Service Centre can be used for better traffic control. The Government Information Security Sharing and Analysis Centre can be used to obtain important information on the security of the information. The use of the IPA tool provider can help overcome the technical problems of the security tool. The insurance server (10) is, for example, a server that can be underwritten or/and underwritten by an insurance institution, an insurance business development center (the security center).

As shown in the second figure, it is preferable to further include a risk assessment module (3), and the signal is connected to the security controller (2). The risk assessment module (3) is configured to calculate a security risk model (31) according to the security information, and calculate a security risk value according to the security risk model (31). In detail, the security information includes a log (log), the security risk model (31) includes a management risk value, a grassroots security risk value, an information management security value, and an external threat value. Any or combination of them. It is possible to conduct a comprehensive evaluation based on the source of the information (such as management, grassroots, information management, external threats, etc.) in order to more accurately determine the value of the security risk, and thus estimate the reasonable premium.

As shown in the second figure, it is preferable to further include a deposit module (4), and the signal is connected to the security controller (2), and the deposit module (4) is used for each asset. The information is converted into a block of data, and the block data is stored in a private blockchain and a public blockchain, and the private blockchain is used for reading a block by a digital identification system. The public blockchain is used to read the foregoing block data to provide the aforementioned client server (200) and the aforementioned joint defense server (1).

For the continuation, please refer to the third figure. In detail, the aforementioned client server (200) is installed with the aforementioned security information collection object (201) and establishes a key infrastructure information asset management information (202), and the security information collection object ( 201) A log (log) for collecting various devices or events is transmitted to the security control server (2), and the critical infrastructure information asset management information (202) is based on customer related information software and hardware devices. Classification, risk assessment and recommended risk are prioritized to save customers' relevant man-hours and improve the timeliness of the response. The key infrastructure information asset management information (202) is transferred to the security management server (2) and stored as a key infrastructure information asset information (20) to establish exclusive information for each customer. Information assets. The security control server (2) includes a security monitoring module (21), an early warning and notification module (22), a security message storage module (23), and an emotional exchange module (24). ) and the aforementioned risk assessment module (3). The security monitoring module (21) can analyze and filter the aforementioned security information through the security threat information rule engine, and issue event information when there is a threat to notify by the early warning and notification module (22). Notify the relevant client server (200). The security information storage module (23) is used for synchronously storing the aforementioned security information, thereby storing digital evidence, and when the security incident occurs, and the damage occurs, the insurance server (10) may be requested to make compensation. At this time, the insurance server (10) can go to the security information storage module (23) to access the deposit information, in order to identify the situation of the security incident, as a reference for claims, and speed up the claims process. The emotional exchange module (24) can be integrated with a number of domestic and international information security and analysis centers (ISAC) to provide their own security, or to receive the security of domestic and international organizations.

Please refer to the fourth figure and the second figure. The method for controlling the security of the embodiment of the present invention is disclosed. The implementation can be constructed as a program and stored in a computer program product or a computer readable recording medium. After the computer is loaded into the program and executed, the aforementioned security joint prevention method can be completed. The foregoing security joint prevention method includes an environment construction step (S01), a joint defense establishment step (S02), and a service providing step (S03). . The environment construction step (S01): the establishment of the aforementioned security control server (2).

Referring to the fourth figure and the second figure, the joint defense step (S02): installing the aforementioned security information collection item (201) on the client server (200), and the security information collection object (201) is transmitted through The network connection is connected to the security control server (2), and the security control server (2) signal is connected to the joint defense server (1) and the aforementioned insurance server (10), and the joint defense server (1) includes The aforementioned warning and monitoring servo terminal (11) and the aforementioned notification and strain servo terminal (12). But it is not limited to this. For example, there may be only the warning and monitoring server (11), the notification and the strain server (12), and not the insurance server (10); or only the notification and strain server (12) and the insurance The servo terminal (10); or the warning and monitoring servo terminal (11) and the insurance servo terminal (10).

Referring to the fourth figure and the second figure, the providing service step (S03): causing the security controller (2) to selectively exchange the same with the aforementioned defense server (1) and the insurance server (10). The Security Information Collection (201) obtained a security information to provide at least two of the following services to the aforementioned client server (200): a security warning and monitoring service, a security notification and response service, and a security Damage insurance services. In this embodiment, the three can be combined, but not limited thereto. For example, only the security warning and monitoring service and the security notification and response service, or only the security notification and response service, The security damage insurance service is also the security warning and monitoring service and the security damage insurance service.

For the continuation, please refer to the fifth figure with the second picture. Preferably, it further includes a security risk assessment step (S04): using a risk assessment module (3) to calculate a security risk model based on the security information ( 31), and calculate the value of a security risk based on the security risk model (31). In detail, the security information includes a log (log), the security risk model (31) includes a management risk value, a grassroots security risk value, an information management security value, and an external threat value. Any or combination of them. It is possible to conduct a comprehensive evaluation based on the source of the information (such as management, grassroots, information management, external threats, etc.) in order to more accurately determine the value of the security risk, and thus estimate the reasonable premium. In detail, the security risk assessment step (S04) includes a sub-step of establishing a security risk characteristic model (S041), an evaluation sub-step of the security risk value (S042), and a sub-step of calculating the security risk value (S043) .

For the continuation, please refer to the fifth figure with the second picture. The sub-step (S041) of establishing the security risk feature model is based on the big data data analysis technology, and the information security asset classification and the information security log are analyzed to establish the aforementioned security risks. Feature model. Specifically, under the security and security system, the industry group resource security data set is first established according to the industry attributes, including an information asset and a log based on the resource security monitoring needs. The information assets are classified according to attributes, such as server hardware, server operating system, system software, database software, application system software, and terminal equipment. The security log: The content analyzed by the general security log can be divided into the actor (Who), the when (When), the action (Do), and the role (Use) (for the analysis example, please refer to the sixth figure). Then, shaping the aforementioned Zi'an risk characteristic model (31), according to the information asset classification and analysis of the security log, the risk characteristics of the aforementioned Zian risk feature model (31) are as follows: Feature 1: Induction may trigger security Risk of employee behavior (used to calculate the aforementioned basic security risk value), such as the amount of logs violated by the office AD Log security policy (eg, password error amount), the number of alarms triggered by company-wide anti-virus software (in per person per month) Average count), the number of Proxy Log employees' Hit blacklists or suspicious websites of the same brand (average monthly for each employee in different companies). Feature 2: System administrator behavior (used to calculate the aforementioned basic security risk value). If the system administrator has the behavior of initiating the security risk, the risk and impact are greater, such as the monthly or annual average of the administrator's computer IP. The number of poisoning alarms, the IP Proxy blacklist blocking amount of the administrator's computer, and so on. Feature 3: Information security management surface (used to count the aforementioned information management security value), summarizing the information of each enterprise entity in the system security management system, such as the amount of violation of the AD Log security policy in the system service area (eg password error) Quantity), database access internal Deny amount, management network segment Firewall Deny number, system service area network segment virus trigger number (average number of viruses triggered per server operating system per year), data leakage (DLP) violation The number of policies, the number of alerts triggered by the office's peer anti-virus software (on an average per person per month). Feature 4: External threats (used to count the aforementioned external threat values), external threats that can be summarized by the security log, such as the number of IPS's Block spam or virus mail, and the amount of Web Access Log.

For the continuation, please refer to the fifth figure with the second picture. The sub-step of evaluating the security risk value (S042) and the sub-step of calculating the security risk value (S043) are based on the aforementioned model of the security risk model established by the industry (31). ), and then enter the asset security data set of the individual enterprise, and generate the risk value of the enterprise's security risk characteristics. Then, different characteristic values (such as the foregoing feature 1 to feature 4) of the aforementioned security risk feature model (31) are assigned different weights. For example, the foregoing feature 1 to feature 4 may each be set to 25% of the total score, or according to actual needs. After adjustment, the risk assessment module (3) finally calculates the value of the security risk. The value of the security risk calculated by the risk assessment module (3), based on the distribution of the risk value of the security, provides the basis for the insurance server (10) to verify the insurance premium rate, which can be based on the enterprise security risk value each year. As a reference for the increase and decrease of insurance premiums, if the risk value of the security is increased by one level, the premium can be reduced. Conversely, the fee should be increased to encourage the enterprise to strengthen the security protection and improve the overall security protection and avoid the threat of security. .

For the continuation, please refer to the seventh figure and the second figure. Preferably, the method further includes a deposit verification step (S05): converting each of the security information into a block data by using a deposit module (4). The block data is stored in a private blockchain and a public blockchain, and the private blockchain is used for interfacing by a digital identification system to read the block data, and the public blockchain is used to block the block. The data is provided for reading by the aforementioned client server (200) and the aforementioned joint defense server (1).

Please refer to the seventh figure and the second figure. In detail, the depositing step (S05) includes a generating block data sub-step (S051), a establishing a private block chain step (S052), and a public block chain. Step (S053). The generating block data sub-step (S051) first transmits the security log data of the client server (200) to the security control server (2) by using the streaming data, and the server is controlled by the security controller (2). The deposit module (4) converts a block of data. The security log is recorded by streaming data, and the content of the certificate can be recorded without relying on the formatted message design. The step of establishing a private blockchain (S052) is applied to the one-to-one or one-to-one message transmission, and provides a multi-participant computing environment, which can be used for multi-enterprise, multi-system, multi-point common under the joint defense system. Participate and construct an environment of flexible participation. Using the characteristics of blockchain, the digital evidence can not be destroyed, simplifying the evidence preservation procedure, and in the future, the non-repudiation of the deposited data can be verified through mathematical operations, and the evidence power is strengthened. The private blockchain can provide a general digital identification system to access and access the log storage information for use as a security investigation. The block data generated by the Zi'an log is stored in the private blockchain and is also placed in the digital identification system. Ensure that all processors get the same order data in a one-to-many application. Digital forensic personnel can access the data through the digital identification system or directly to the private blockchain of the Zi'an log deposit, and the system performs mathematical eigenvalue calculations to ensure the evidence of the data. The public block chain step (S053) is a block feature value calculated by simplifying the block data per day and stored in the public blockchain. The characteristic value of the security log is publicly stored among the participants, and the arbitrability and verifiability of the future are confirmed by the common holding method. Any blockchain system that is publicly disclosed externally uses the characteristics of the blockchain to enhance the evidence of digital data and improve the efficiency of digital forensics.

In view of the foregoing description of the embodiments, the operation and the use of the present invention and the effects of the present invention are fully understood, but the above described embodiments are merely preferred embodiments of the present invention, and the invention may not be limited thereto. Included within the scope of the present invention are the scope of the present invention.

(100) ‧‧‧ Security Security System

(200)‧‧‧Customer server

(201) ‧ ‧ ‧ Security Information Collection Objects

(202) ‧‧‧Key Infrastructure Information Asset Management Information

(1) ‧ ‧ joint defense server

(11) ‧‧‧Warning and monitoring server

(12) ‧‧‧Notification and strain server

(10) ‧‧‧ insurance server

(2) ‧ ‧ ‧ security control server

(20) ‧‧‧Key Infrastructure Information Asset Information

(21) ‧‧‧ Security Monitoring Module

(22) ‧ ‧ Early warning and notification module

(23) ‧‧‧ Security Information Depository Module

(24) ‧‧‧Sex exchange module

(3) ‧ ‧ risk assessment module

(31) ‧ ‧ ‧ security risk characterization model

(4) ‧‧‧Certificate module

(S01) ‧ ‧ Environmental Construction Steps

(S02) ‧ ‧ joint defense implementation steps

(S03)‧‧‧Provide service steps

(S04) ‧‧ ‧ security risk assessment steps

(S041) ‧ ‧ Establish sub-steps of the security risk model

(S042) ‧ ‧ sub-steps for assessing the risk value of security

(S043) ‧‧‧ Sub-steps for calculating the risk value of security

(S05) ‧ ‧ § deposit procedure

(S051) ‧‧‧ Generate block data substeps

(S052) ‧ ‧ Establishing a private blockchain step

(S053) ‧ ‧ public block chain steps

[First figure] is a schematic diagram of a main system architecture of an embodiment of the present invention. [Second figure] is a block diagram of a system according to an embodiment of the present invention. [Third Figure] is a detailed system block diagram of an embodiment of the present invention. [Fourth Diagram] is a schematic flow chart of the main steps of the embodiment of the present invention. [Fifth Diagram] is a schematic flow chart of the steps of the risk assessment of the embodiment of the present invention. [Sixth Graph] is a schematic diagram of the analysis state of the security log in the risk assessment of the embodiment of the present invention. [Seventh figure] is a schematic flow chart of the steps of the present invention.

Claims (15)

A security joint prevention method includes the following steps: an environment construction step: establishing a security control server; a joint defense construction step: installing a security information collection object on a client server, and the security information collection The object connects the security control server through a network, and connects the security control server signal to at least one anti-server and one insurance server. The anti-server includes an early warning and monitoring server or/and a notification. And providing a service step: causing the security controller to selectively exchange the security message with the aforementioned defense server and the insurance server to obtain a security message for the foregoing client server Provide a joint defense service and an insurance service. For example, the above-mentioned early warning and monitoring server includes an information sharing and analysis center (ISAC), a security monitoring center (SOC), and a security tool providing unit. Any one or combination of a telecom service center, a security risk assessment unit, and a security inspection team. For example, in the application for patent security, the above-mentioned notification and response server includes a government fund information sharing and analysis center (G-ISAC) and a financial financing center (F-ISAC). Any one or combination of the one-investigation investigation and identification unit and the one-on-one security response team. For example, the security joint prevention method described in item 1 of the patent application scope includes a risk assessment step: a risk assessment module calculates a security risk model based on the security information, and according to the security risk characteristics The model calculates the value of a security risk. For example, the security security prevention method described in claim 4, wherein the security information includes a log (log), the security risk characteristic model includes a management risk value, a grassroots security risk value, An information management security value, an external threat value, or a combination thereof. For example, the security joint prevention method described in item 1 of the patent application scope includes a deposit verification step: converting each security information into a block data by using a deposit module, the block data being separately stored in a private a blockchain and a public blockchain for reading a block information by a digital identification system for providing the foregoing block data to the client server and The aforementioned joint defense server reads. A security joint prevention method includes the following steps: an environment construction step: establishing a security control server; a joint defense construction step: installing a security information collection object on a client server, and the security information collection The object is connected to the security control server through a network, and the security controller is connected to the plurality of anti-servers, and the anti-server includes an early warning and monitoring servo and a notification and response servo; Step: the security control server selectively exchanges the security information collection object with the aforementioned anti-server to obtain a security message to provide a joint defense service to the client server, and the defense service includes a security warning And monitoring services and a security notification and response services. A security joint defense system for connecting at least one client server, wherein the client server installs a security message collection object, the security prevention system includes: at least one anti-server and one insurance server, and the foregoing anti-server includes An early warning and monitoring servo terminal or/and a notification and strain servo terminal; and a security control server, the signal is connected to the aforementioned joint defense server and the insurance server, and the signal is connected to the security information collection object, the security control The server is configured to selectively exchange the security information with the foregoing anti-server and the insurance server to obtain a security message to provide the following client server with at least any of the following services: a security warning and monitoring Services, one-off security notification and response services, and a security damage insurance service. For example, in the application for the patent security scope item 8, the aforementioned warning and monitoring server includes an information sharing and analysis center (ISAC), a security monitoring center (SOC), and a security equipment providing unit. Any one or combination of a telecom service center, a security risk assessment unit, and a security inspection team. For example, in the application for the patent security scope item 9, the aforementioned notification and response server includes a government fund information sharing and analysis center (G-ISAC) and a financial security center (F-ISAC). Any one or combination of the one-investigation investigation and identification unit and the one-on-one security response team. For example, the security security system described in item 8 of the patent application scope further includes a risk assessment module, and the signal is connected to the security control server, and the risk assessment module is configured to calculate a security risk characteristic according to the security information. The model calculates the risk value of the security based on the security risk model. For example, the security security prevention system described in claim 11 of the patent scope, wherein the security information includes a log (log), the security risk characteristic model includes a management risk value, a grassroots security risk value, An information management security value, an external threat value, or a combination thereof. For example, the security security system described in item 8 of the patent application scope further includes a deposit certificate module, and the signal is connected to the security control server, and the deposit verification module is used to convert each security message into a block. The data of the block is stored in a private blockchain and a public blockchain. The private blockchain is used for interfacing by a digital identification system to read the block data. The public blockchain is used to read the block data. The foregoing block data is provided for reading by the aforementioned client server and the aforementioned joint defense server. A computer program product, in which a program is stored, and when the computer is loaded into the program and executed, the security joint prevention method described in any one of items 1 to 7 of the claim can be completed. A computer readable recording medium storing a program, and when the computer is loaded into the program and executed, the security prevention method described in any one of items 1 to 7 of the claim can be completed.