CN116094830A - Risk assessment method, risk assessment device and readable storage medium - Google Patents
Risk assessment method, risk assessment device and readable storage medium Download PDFInfo
- Publication number
- CN116094830A CN116094830A CN202310125599.0A CN202310125599A CN116094830A CN 116094830 A CN116094830 A CN 116094830A CN 202310125599 A CN202310125599 A CN 202310125599A CN 116094830 A CN116094830 A CN 116094830A
- Authority
- CN
- China
- Prior art keywords
- risk
- security
- evaluated
- domain
- factors
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000000034 method Methods 0.000 title claims abstract description 38
- 238000012502 risk assessment Methods 0.000 title claims abstract description 30
- 238000004364 calculation method Methods 0.000 claims description 12
- 238000004590 computer program Methods 0.000 claims description 10
- 238000012545 processing Methods 0.000 claims description 2
- 238000011156 evaluation Methods 0.000 abstract description 11
- 230000000694 effects Effects 0.000 abstract description 3
- 238000007689 inspection Methods 0.000 description 7
- 238000011144 upstream manufacturing Methods 0.000 description 6
- 238000011161 development Methods 0.000 description 4
- 238000007726 management method Methods 0.000 description 4
- 230000008450 motivation Effects 0.000 description 4
- 230000008569 process Effects 0.000 description 4
- 230000006870 function Effects 0.000 description 3
- 238000002347 injection Methods 0.000 description 3
- 239000007924 injection Substances 0.000 description 3
- 238000005516 engineering process Methods 0.000 description 2
- 230000000007 visual effect Effects 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 1
- 238000013475 authorization Methods 0.000 description 1
- 230000005540 biological transmission Effects 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000010276 construction Methods 0.000 description 1
- 230000010485 coping Effects 0.000 description 1
- 230000008030 elimination Effects 0.000 description 1
- 238000003379 elimination reaction Methods 0.000 description 1
- 208000015181 infectious disease Diseases 0.000 description 1
- 230000003993 interaction Effects 0.000 description 1
- 238000013139 quantization Methods 0.000 description 1
- 230000004044 response Effects 0.000 description 1
- 239000000243 solution Substances 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1433—Vulnerability analysis
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F21/577—Assessing vulnerabilities and evaluating computer system security
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
- G06F2221/033—Test or assess software
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
- G06F2221/034—Test or assess a computer or a system
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- Computing Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The application relates to a risk assessment method, a risk assessment device and a readable storage medium. The risk assessment method comprises the following steps: constructing a domain division library, wherein the domain division library is used for dividing an object to be evaluated into at least one security domain according to security identification data of the object to be evaluated, and the security identification data comprises at least one of a security name, a security attribute and positioning; presetting a plurality of risk scenes, wherein the risk scenes are obtained by classifying according to the network security events; presetting a matching relation between risk scenes and security domains, wherein each security domain is matched with at least one risk scene; dividing an object to be evaluated into at least one security domain according to a domain-division library; identifying risk elements of a risk scenario matched by each security domain in the object to be evaluated, wherein the risk elements comprise threat sources, vulnerability and security measure effectiveness; and evaluating the risk of the object to be evaluated according to the risk factors. The method has the effects of intuitively showing security threat and having larger evaluation granularity.
Description
Technical Field
The present application relates to the field of supply chain security technologies, and in particular, to a risk assessment method, apparatus, and readable storage medium.
Background
In the risk assessment process of an information system, a risk assessment object is usually huge in target, a specific implementation object of inspection and assessment cannot be rapidly positioned, and after the inspection and assessment object is subdivided, the problem of huge number of inspection and assessment objects exists. In particular, in information systems of IT industry, the assets involved are huge, and each specific evaluation object cannot well represent the present situation of risk and the possible threats, so that the risk threats which are combed out are far away from the actual possible attack scene. And further, the high risk in the risk report is dispersed into various scenes of specific assets and information systems, so that the risk response cannot be quickly performed. In addition, in the related regulations guidelines such as the prior supply chain safety, the grade protection, the network safety, the data safety and the like, most risk assessment methods are based on the assessment assets taking asset objects as units as assessment units, so that granularity is too fine, and further, the difficulty of combing and assessing asset items and inspection items is extremely high, and the implementation of inspection and assessment is difficult.
Disclosure of Invention
In order to at least solve the above problems, the present application provides a risk assessment method, which uses a risk scene as an assessment object to comb possible security risks in a security domain, so that security risks can be intuitively presented, and the granularity of the risk scene is larger, so that the risk assessment method is better implemented.
In a first aspect, the risk assessment method provided in the present application adopts the following technical scheme: a risk assessment method for assessing the security risk of an object to be assessed, comprising the steps of: constructing a domain division library, wherein the domain division library is used for dividing the object to be evaluated into at least one security domain according to security identification data of the object to be evaluated, and the security identification data comprises at least one of a security name, a security attribute and positioning; presetting a plurality of risk scenes, wherein the risk scenes are obtained by classifying according to the occurred network security events; presetting a matching relation between the risk scenes and the safety domains, wherein each safety domain matches at least one risk scene; dividing the object to be evaluated into at least one security domain according to the domain library; identifying risk elements of a risk scenario matched by each security domain in the object to be evaluated, wherein the risk elements comprise threat sources, vulnerability and security measure effectiveness; and evaluating the risk of the object to be evaluated according to the risk element.
According to the technical scheme, the object to be evaluated can be divided into at least one security domain according to the security identification data of the object to be evaluated, the object to be evaluated is further rapidly divided into different risk scenes according to the matching relation between the risk scenes and the security domain, and then risk elements of the different risk scenes are identified, so that the risk scenes are used as evaluation objects to comb possible security risks in the security domain, and the problems that granularity based on asset objects is too thin, the number is huge and risk countermeasures cannot be implemented specifically in the risk inspection evaluation implementation process are solved.
Optionally, the constructing the domain library includes: extracting security identification data according to the existing security domain; presetting a security domain division standard; and carrying out unified processing on the names of the security domains with the same or similar attributes.
By the technical scheme, the data of the existing mass security domains can be automatically counted and classified, for example, the security identification data is automatically extracted; and quantifying the application range of the security domain, taking the application range of the security domain as the basis of the security domain division and the like, thereby establishing a domain-divided library.
Optionally, the security domain includes multiple levels.
Through the technical scheme, the security domain can be further refined, then the risk scene matched with the refined security domain is identified, and the risk scene is taken as the minimum evaluation object, so that the risk can be evaluated more accurately.
Optionally, the evaluating the risk of the object to be evaluated according to the risk factor includes: analyzing the threat source of each risk scene of the object to be evaluated to obtain threat source attribute factors; analyzing the vulnerability of each risk scene of the object to be evaluated to obtain vulnerability attribute factors; analyzing the negative influence of the threat source attribute factors and the vulnerability attribute factors on the risk scene to obtain negative influence factors; quantifying the threat source attribute factors, the vulnerability attribute factors and the negative influence factors to obtain quantized values of the threat source attribute factors, the vulnerability attribute factors and the negative influence factors; and calculating the occurrence probability and the risk value of the risk scene in the object to be evaluated, namely the risk of the object to be evaluated, according to the quantized value of the threat source attribute factor, the quantized value of the vulnerability attribute factor and the quantized value of the negative influence factor.
Through the technical scheme, the risk of the object to be evaluated can be calculated, so that the evaluation result is more visual.
Optionally, the threat source attribute factors include a capability sub-factor, a motivation sub-factor, an opportunity sub-factor, and a scale sub-factor.
Optionally, the negative impact factors include technical impact and business negative impact.
Optionally, a calculation formula of the occurrence probability of the risk scene is:
Probability＝ThreatorScore*VulnerabilityScore，
wherein Prolikelihood is the Probability of occurrence, theator score is the quantized value of the threat source attribute factor, and Vulneraility score is the quantized value of the vulnerability attribute factor.
Optionally, a calculation formula of the risk value of the risk scene is:
RiskValue＝Probability*ImpactScore，
wherein RiskValue is a risk value and ImpactScore is a quantized value of negative influence factors.
In a second aspect, the present application provides a computer device comprising a memory storing a computer program and a processor implementing the steps of any one of the methods described above when the computer program is executed by the processor.
In a third aspect, the present application provides a computer readable storage medium storing a computer program which, when executed by a processor, performs the steps of the method of any one of the preceding claims.
Compared with the traditional risk assessment method taking the asset item as the minimum risk assessment unit, the risk assessment method takes the risk scene corresponding to the security domain as the assessment object, and effectively solves the problem of great difficulty in combing and assessing the asset item and the examination item; meanwhile, compared with the prior art that the security domain is divided by the physical domain or the system domain, the risk assessment object is subdivided by the risk scene, and the possible security risks under the security domain are clearly combed, so that the security threat can be intuitively displayed, and the risk threat is clear at a glance.
Drawings
FIG. 1 is a flow chart of a risk assessment method according to one embodiment of the present application;
fig. 2 is a flowchart of evaluating risk of the object to be evaluated according to risk factors according to one embodiment of the present application.
Detailed Description
In order to make the objects, technical solutions and advantages of the present application more apparent, the present application will be further described in detail with reference to fig. 1 to 2 and the examples. It should be understood that the specific embodiments described herein are for purposes of illustration only and are not intended to limit the present application.
Referring to fig. 1, the risk assessment method provided in the present application adopts the following technical scheme: a risk assessment method is used for assessing the security risk of an object to be assessed and comprises steps S101-S106. In step S101, a domain library is constructed, where the domain library is configured to divide the object to be evaluated into at least one security domain according to security identification data of the object to be evaluated, where the security identification data includes at least one of a security name, a security attribute, and a location. The above-mentioned domain library table field mainly can include security name, security attribute and location. Examples of security attributes, locations are shown in table 1.
In one embodiment, the foregoing constructing the domain library may further include the steps of: extracting security identification data according to the existing security domain; presetting a safety domain division standard, namely defining a safety domain application range standard as a basis of safety domain division; the names of security domains having the same or similar security attributes are normalized to uniquely named security domains, or the names of security domains having the same or similar locations are normalized to uniquely named security domains, so that the security domains are automatically partitioned by the domain library. The specific process of constructing the domain library according to the information such as the table field, the security domain division standard, the normalized security domain name and the like is the prior art, and is not repeated here. In practical applications, the security domain may comprise multiple levels, and the security domain may be divided directly into multiple levels according to the domain-dividing library. For example, an object to be evaluated named a supply chain security lifecycle, one of the primary security domains of the object to be evaluated is upstream security, which in turn includes two secondary security domains, which are upstream enterprise security issues and software supply chain interrupts, respectively.
At step S102, a plurality of risk scenarios are preset, and the risk scenarios may be categorized according to the massive number of network security events that have occurred. It should be noted that, the method in the embodiment of the present application may acquire a globally occurring network security event, classify the network security event into a corresponding risk scenario according to the globally occurring network security event, where the network security event is defined in a broad sense, and may specifically include a supply chain security event, a data security event, a network information security event, and so on. Risk scenarios may include business breaks, data leakage, and luxury software, among others. Specifically, the operation interruption risk scenes such as "the equipment hardware is faulty, the communication link is interrupted to cause safe and efficient stable operation interruption", "the external malicious attacker initiates DDoS attack to cause network security event of business interruption", etc. can be classified as the operation interruption risk scenes, the data leakage caused by the misoperation of data transmission error or data which should not be transmitted by the internal personnel "," the data leakage caused by the external malicious personnel injecting into the acquired database through the SQL ", and the data security problem caused by the external personnel through the back door reserved by software or by utilizing other special back door software" can be classified as the data leakage risk scenes; network security events such as "staff browsing websites containing malicious code to infect luxury software", and "hackers hacking remote entry intrusion using weak passwords or RDP violence to cause system infection to luxury software" are categorized as luxury software risk scenarios.
At step S103, a matching relationship between the risk scenario and the security domains is preset, and each security domain (whether a primary security domain or a secondary security domain) matches at least one of the risk scenarios. For example, when the security domain is upstream secure in the supply chain security lifecycle, the security domain matching risk scenario may include: internal vulnerabilities, external attacks, and credential data leaks.
At step S104, the object to be evaluated is divided into at least one security domain according to the domain library. For example, the service name of the object to be evaluated is: and (3) a supply chain safety life cycle, namely, a plurality of safety domains (such as upstream safety, open source safety, development safety and delivery use safety) matched with the service name can be found in the domain library according to the service name, and the object to be evaluated is divided into four safety domains, namely, upstream safety, open source safety, development safety and delivery use safety. Further defined matching may also be performed by security attributes, positioning of the security domain. For example, when the security name of the object to be evaluated is the life cycle of the security of the supply chain, the security attribute is the self-development basic function, and the open source code is not used, only 3 corresponding security domains (not including the open source security) in the domain library are provided, so that the security domains are divided into 3 security domains, namely, upstream security, development security and delivery use security.
At step S105, risk elements of the risk scenario matched by each security domain in the object under evaluation are identified, including threat sources, vulnerabilities, and security measures effectiveness. Firstly, according to the matching relationship between the risk scenes and the security domains, each security domain contained in the object to be evaluated is rapidly divided into different risk scenes, for example, the 4 risk scenes matched in the security domain of the open source security contained in the security life cycle of the supply chain are respectively: the open source item maintains robustness, liveness and coping awareness, intellectual property, and license authorization risk. The risk elements of the 4 risk scenes are identified separately, i.e. the threat sources, vulnerabilities and security measures validity of the 4 risk scenes are identified separately. As shown in table 2.
TABLE 2
At step S106, the risk of the object to be evaluated is evaluated according to the risk element. Specifically, step S201 to step S205 may be included. At step S201, threat sources and attack methods of the risk scenario are analyzed, so as to obtain threat source attribute factors. The threat source attribute factor is used to characterize the probability of the threat source successfully launching an attack, and in one application scenario, the threat source attribute factor may include a capability sub-factor, a motivation sub-factor, a chance sub-factor, and a scale sub-factor. The capability sub-factor is used for representing the computer capability required by the threat source to launch the attack; the motor sub-factors are used for representing the expected income size of the threat source for launching the attack; the opportunity sub-factors are used for representing the possibility that the attack can be successfully launched after the threat source decides to launch the attack; the scale sub-factor is used to characterize the threat source population size that initiates a certain type of attack.
At step S202, the vulnerability of each risk scenario of the object to be evaluated is analyzed, resulting in a vulnerability attribute factor. The specific analysis mode can be to judge all the vulnerability which is theoretically utilized when the corresponding risk scene occurs according to the vulnerability list library which is summarized in the risk scene and network security management construction, then analyze the implementation condition of the risk management measures of the object to be evaluated to obtain the vulnerability which is utilized when the object to be evaluated occurs in the risk scene, and obtain the vulnerability attribute factors, wherein the vulnerability attribute factors are used for representing the probability that the vulnerability is successfully utilized. For example, for a network security event: the method comprises the steps that data in a database are acquired by external malicious personnel through SQL injection, so that data leakage is caused, in theory, when a threat source initiates an attack, the vulnerability to be utilized is A, B, C, D, the object to be evaluated takes risk management and control measures, and the vulnerability of A and B is eliminated, if the object to be evaluated generates the network security event, the vulnerability utilized by the threat source can be determined to be C or D, discoverability and availability of C and D are analyzed, and vulnerability attribute factors can be obtained (the corresponding vulnerability can be completely eliminated by the measures assumed to be taken in the embodiment of the application, and the vulnerability elimination proportion can be determined according to actual conditions in actual application). The vulnerability attribute factor may be expressed as:
VulnerabilityScore＝(DiscoveryScore+ExploitScore)/2，
wherein vulnerabilities score is a vulnerability attribute factor, discoveries score is a discoverability score, and explotscore is an availability score.
At step S203, negative impact on the risk scenario is analyzed according to the threat source attribute factor and the vulnerability attribute factor, so as to obtain a negative impact factor. In practical applications, the negative impact factors include technical impact and commercial negative impact. Technical negative effects are used to characterize the impact of threat source exploitation vulnerability on the confidentiality, integrity and availability of affected assets, and business negative effects are used to characterize the impact of network security events on the finance, reputation and user privacy of objects to be assessed. For example, for a network security event: the external malicious personnel acquire data in the database through SQL injection, so that data leakage is caused, an output threat source is the external malicious personnel, such as a hacker, an attack method is SQL injection, and a security event is a data leakage risk scene of data leakage caused by intrusion into the database. And outputting threat sources to successfully attack the object to be evaluated, wherein the utilized vulnerabilities are C and D. And identifying the influence of the threat source on the confidentiality, the integrity and the availability of the affected assets by utilizing the vulnerabilities according to the threat source attribute factors and the vulnerability attribute factors, so as to obtain the negative influence of the total technology and identify the influence of the object to be evaluated on finance, reputation and user privacy.
At step S204, the threat source attribute factor, the vulnerability attribute factor, and the negative impact factor are quantized to obtain quantized values of the threat source attribute factor, the vulnerability attribute factor, and the negative impact factor. Among the threat source attribute factors, the capability sub-factor is represented by AbilityScare, the motivation sub-factor is represented by motionScare, the scale sub-factor is represented by SizeScare, and the capability sub-factor, motivation sub-factor and scale sub-factor are quantized with 0-1 division, with a score interval of 0.1. The opportunity sub-factors are represented by the opportunity score, and five factors, namely, required privilege RP (refer to privilege types that an attacker must have to access code/functions, systems or equipment assets, etc. containing weak points), required privilege layer RPL (refer to that an attacker must use privileges to utilize or attack weak points at a certain operation layer, such AS a network layer, an object infrastructure layer to be evaluated, a system layer), access vector AV (refer to that an attacker must use certain channels to access code/functions, systems or equipment assets, etc. containing weak points), authentication strength AS (refer to identity authentication strength that an attacker needs to pass in order to contact protected weak points), and interaction degree LoIN (refer to actions that an attacker needs to take, such AS clicking on a link on a webpage or previewing e-mail, to cause an attacker to attack successfully), are also adopted 0-1 minute, the score interval is 0.1, and the calculation formula of the opportunity sub-factors is:
OpportunityScore＝75％*(RP+RPL+AV)+5％*AS+20％*LoIN
the calculation formula of the quantized value of the threat source attribute factor is as follows:
ThreatorScore＝(AbilityScore+MotivationScore+OpportunityScore+SizeScore)/4，
the value of the threader score ranges from 0.000 to 1.000.
The calculation formula of the quantized value of the vulnerability attribute factor is as follows:
VulnerabilityScore＝(DiscoveryScore+ExploitScore)/2，
the quantized value Vulnerabilityscore of the vulnerability attribute factor ranges from 0.000 to 1.000.
Negative influencing factors include technical negative influences and business negative influences. Starting from all the vulnerabilities theoretically possessed under the current risk scene, evaluating the influence of each vulnerability on confidentiality, integrity and usability of the object asset to be evaluated after being utilized, wherein the calculation formula of the technical negative influence corresponding to each vulnerability is as follows:
TechImpac＝10.41*(1-(1-ConfImpact)*(1-IntegImpact)*(1-AvailImpact))，
wherein ConfImpact is the value of confidentiality, integImpact is the value of integrity, availImpact is the value of availability. The quantization table of confidentiality, integrity and availability can be represented as shown in table 3.
TABLE 3 Table 3
In combination with the management and control measures adopted by the object to be evaluated for the vulnerability, the effective degree f of the management and control measures is evaluated, and the quantized values are shown in table 4.
TABLE 4 Table 4
| Measure effectiveness f | Score value | Description of the invention |
| Complete and complete | 1 | Corresponding measures completely eliminate the corresponding vulnerability |
| High height | 0.8 | Corresponding measures eliminate the influence of corresponding vulnerability to a large extent |
| In (a) | 0.5 | The corresponding measures moderately eliminate the influence of the corresponding vulnerability |
| Low and low | 0.2 | The corresponding measures eliminate the influence of the corresponding vulnerability to a small extent |
| Part of the | 0 | No corresponding measures are taken |
Thus, the technical formula for the total technical negative impact value is:
wherein, techlmpact i The technical influence value caused by the ith vulnerability is n, which is the number of utilized vulnerabilities in the risk scene, f i The value of the measure of care taken for the subject under evaluation for the ith vulnerability is scored.
The commercial negative influence comprises influence of the object to be evaluated on finance, reputation and user privacy, wherein the influence is respectively 0-10 minutes, the score interval is 1, the score interval is respectively represented by FinImpact, replmpact and Prim pact, and the calculation formula of the commercial negative influence value Commim paccore is as follows:
CommImpactScore＝(FinImpact+RelImpact+PriImpact)/3,
therefore, the calculation formula of the quantized value of the negative influence factor is:
ImpactScore＝TechImpactScore+CommImpactScore。
at step S205, the occurrence probability and the risk value of the risk scene in the object to be evaluated, that is, the risk of the object to be evaluated, are calculated according to the quantized values of the threat source attribute factor, the vulnerability attribute factor, and the negative influence factor. Specifically, the calculation formula of the occurrence probability is:
Probability＝ThreatorScore*VulnerabilityScore，
wherein Procapability is the occurrence Probability, theator score is the quantized value of the threat source attribute factor, and Vulneraility score is the quantized value of the vulnerability attribute factor.
The calculation formula of the risk value is as follows:
RiskValue＝Probability*ImpactScore，
wherein RiskValue is a risk value and ImpactScore is a quantized value of negative influence factors.
The influence of various vulnerabilities on the confidentiality, integrity and availability of the affected assets is utilized for threat sources, so that the total technical negative influence and the influence of the object to be evaluated on finance, reputation and user privacy are obtained. Through the technical scheme, the risk of the object to be evaluated can be calculated, so that the evaluation result is more visual.
According to the embodiment of the application, the risk scene is taken as the minimum evaluation object to comb the possible safety risks in the safety domain, the granularity of the risk scene is large, the number of the risk scenes is small, the risk can be identified conveniently and rapidly, and the problems that the granularity based on the asset object is too thin, the number of the risk scenes is huge and the risk can not be implemented in the implementation process of risk inspection evaluation are solved.
Embodiments of the present application also provide a computer device comprising a memory storing a computer program and a processor implementing the steps of any one of the methods described above when the processor executes the computer program.
Embodiments of the present application also provide a computer-readable storage medium storing a computer program which, when executed by a processor, implements the steps of any of the methods described above.
The foregoing description of the preferred embodiments of the present application is not intended to limit the scope of the application, in which any feature disclosed in this specification (including abstract and drawings) may be replaced by alternative features serving the same, equivalent or similar purpose, unless expressly stated otherwise. That is, each feature is one example only of a generic series of equivalent or similar features, unless expressly stated otherwise.
Claims (10)
1. A risk assessment method for assessing the security risk of an object to be assessed, comprising the steps of:
constructing a domain division library, wherein the domain division library is used for dividing the object to be evaluated into at least one security domain according to security identification data of the object to be evaluated, and the security identification data comprises at least one of a security name, a security attribute and positioning;
presetting a plurality of risk scenes, wherein the risk scenes are obtained by classifying according to the occurred network security events;
presetting a matching relation between the risk scenes and the safety domains, wherein each safety domain matches at least one risk scene;
dividing the object to be evaluated into at least one security domain according to the domain library;
identifying risk elements of a risk scenario matched by each security domain in the object to be evaluated, wherein the risk elements comprise threat sources, vulnerability and security measure effectiveness;
and evaluating the risk of the object to be evaluated according to the risk element.
2. The risk assessment method according to claim 1, wherein the constructing a domain library comprises:
extracting security identification data according to the existing security domain;
presetting a security domain division standard;
and carrying out unified processing on the names of the security domains with the same or similar attributes.
3. The risk assessment method of claim 1, wherein the security domain comprises multiple levels.
4. The risk assessment method according to claim 1 or 2, characterized in that the assessing the risk of the object to be assessed according to risk elements comprises:
analyzing the threat source of each risk scene of the object to be evaluated to obtain threat source attribute factors;
analyzing the vulnerability of each risk scene of the object to be evaluated to obtain vulnerability attribute factors;
analyzing the negative influence of the threat source attribute factors and the vulnerability attribute factors on the risk scene to obtain negative influence factors;
quantifying the threat source attribute factors, the vulnerability attribute factors and the negative influence factors to obtain quantized values of the threat source attribute factors, the vulnerability attribute factors and the negative influence factors;
and calculating the occurrence probability and the risk value of the risk scene in the object to be evaluated, namely the risk of the object to be evaluated, according to the quantized value of the threat source attribute factor, the quantized value of the vulnerability attribute factor and the quantized value of the negative influence factor.
5. The risk assessment method of claim 4, wherein the threat source attribute factors include a capability sub-factor, a motivational sub-factor, an opportunity sub-factor, and a scale sub-factor.
6. The risk assessment method of claim 4, wherein the negative impact factors include technical impact and business negative impact.
7. The risk assessment method according to claim 4, wherein the calculation formula of the occurrence probability of the risk scene is:
Probability＝ThreatorScore*VulnerabilityScore，
wherein Prolikelihood is the Probability of occurrence, theator score is the quantized value of the threat source attribute factor, and Vulneraility score is the quantized value of the vulnerability attribute factor.
8. The risk assessment method according to claim 7, wherein the calculation formula of the risk value of the risk scenario is:
RiskValue＝Probability*ImpactScore，
wherein RiskValue is a risk value and ImpactScore is a quantized value of negative influence factors.
9. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor implements the steps of the method of any one of claims 1 to 8 when the computer program is executed.
10. A computer readable storage medium storing a computer program, characterized in that the computer program when executed by a processor implements the steps of the method of any one of claims 1-8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310125599.0A CN116094830A (en) | 2023-02-16 | 2023-02-16 | Risk assessment method, risk assessment device and readable storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202310125599.0A CN116094830A (en) | 2023-02-16 | 2023-02-16 | Risk assessment method, risk assessment device and readable storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN116094830A true CN116094830A (en) | 2023-05-09 |
Family
ID=86202439
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202310125599.0A Pending CN116094830A (en) | 2023-02-16 | 2023-02-16 | Risk assessment method, risk assessment device and readable storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN116094830A (en) |
-
2023
- 2023-02-16 CN CN202310125599.0A patent/CN116094830A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Ahmed et al. | False data injection attack (FDIA): an overview and new metrics for fair evaluation of its countermeasure | |
| Cheng et al. | Enterprise data breach: causes, challenges, prevention, and future directions | |
| CN107577939B (en) | Data leakage prevention method based on keyword technology | |
| CN111507597A (en) | Network information security risk assessment model and method | |
| US8607353B2 (en) | System and method for performing threat assessments using situational awareness | |
| US9336388B2 (en) | Method and system for thwarting insider attacks through informational network analysis | |
| CN101964730B (en) | Network vulnerability evaluation method | |
| CN108108624B (en) | Product and service-based information security quality assessment method and device | |
| US20170155683A1 (en) | Remedial action for release of threat data | |
| CN116049859A (en) | Data security management method, system, terminal equipment and storage medium | |
| Kotenko et al. | Data analytics for security management of complex heterogeneous systems: event correlation and security assessment tasks | |
| US20230396640A1 (en) | Security event management system and associated method | |
| Angelelli et al. | Cyber-risk perception and prioritization for decision-making and threat intelligence | |
| CN115640581A (en) | Data security risk assessment method, device, medium and electronic equipment | |
| CN116720194A (en) | Method and system for evaluating data security risk | |
| Wang et al. | Privacy impact assessment for online social networks | |
| Lv et al. | Publishing triangle counting histogram in social networks based on differential privacy | |
| Al-Sanjary et al. | Challenges on digital cyber-security and network forensics: a survey | |
| CN116094830A (en) | Risk assessment method, risk assessment device and readable storage medium | |
| CN110750795B (en) | Information security risk processing method and device | |
| Pournouri et al. | Improving cyber situational awareness through data mining and predictive analytic techniques | |
| Galiautdinov | Securing the future of artificial intelligence: a comprehensive overview of AI security measures | |
| Shivakumara et al. | Review Paper on Dynamic Mechanisms of Data Leakage Detection and Prevention | |
| Mead et al. | Security and privacy requirements engineering | |
| Cârstea | Methods of Identifying Vulnerabilities in the Information Security Incident Management Process |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |