WO2017167015A1

WO2017167015A1 - Method and device for server device security management and computer storage medium

Info

Publication number: WO2017167015A1
Application number: PCT/CN2017/076797
Authority: WO
Inventors: 周祥生; 陈俊; 余谦益
Original assignee: 中兴通讯股份有限公司
Priority date: 2016-04-01
Filing date: 2017-03-15
Publication date: 2017-10-05
Also published as: CN107292175A

Abstract

A method and device for server device security management and a computer storage medium. The method comprises: acquiring a security scan report with respect to a server device (S101); analyzing the security scan report and isolating from the security scan report a search keyword of an entry that failed a security check (S102); and, reinforcing the security of the server device on the basis of the keyword of the entry that failed the security check (S103).

Description

Server device security management method, device and computer storage medium

Technical field

The present invention relates to the field of server device security management technologies, and in particular, to a server device security management method, apparatus, and computer storage medium.

Background technique

In recent years, intrusion and attacks involving server devices have occurred frequently, and the security of server devices has been increasingly valued by enterprises and institutions.

Among them, the patch management and configuration of server equipment to form a scale, many commercial companies developing security products can provide professional-grade scanning products, these products can provide security for mainstream LINUX, WINDOWS server equipment and ORACLE, SYBASE database system The detection function prompts the security risks such as the old patch version and the vulnerable security configuration of the system.

However, the current tools mainly complete the security check function, although some products give some simple fixes to the existing security risks after the security check is completed, but for the current server device cloud, virtualization, data center Today, the trend is becoming more and more the trend. The line-by-line reading, analysis and finishing of a large number of equipment safety inspection reports have enabled the equipment operation and maintenance engineers to put a lot of effort into the control of the overall safety status assessment report period from the end of the scan to the output equipment room. At the same time, the error data generated by manual reading and analyzing sorting can not be avoided. In addition, with the scan report, the scan report needs to be analyzed, and the operation and maintenance engineer reinforces the server equipment. At the time of reinforcement, at present, it is still according to physics. In the server mode, system patches are updated and configuration files are modified in a traditional manual manner. This hardening method cannot cope with the current situation of server cloudization, virtualization, and data centering.

Summary of the invention

In order to solve the existing technical problems, the embodiments of the present invention provide a server device security management method, apparatus, and computer storage medium.

A server device security management method according to an embodiment of the present invention includes:

Obtain a security scan report for the server device;

Analyzing the security scan report, separating a search keyword that fails the security check entry from the security scan report;

The server device is security hardened according to the keyword that does not pass the security check entry.

In the foregoing solution, the step of performing security hardening on the server device according to the keyword that does not pass the security check entry includes:

Retrieving the reinforcement program library according to the retrieval keyword that does not pass the security check entry, and generating an executable security reinforcement package for the server device;

Uploading the executable security hardening package to a corresponding server device to perform a security hardening operation on the corresponding server device.

In the above solution, the step of retrieving the hardening program library according to the search key that does not pass the security check entry, and generating an executable security hardening package for the server device includes:

Retrieving an automated hardening library according to the search key that does not pass the security check entry, and obtaining an automated hardening program corresponding to the failed security check entry;

Generate executable scripts for the obtained automated hardening program;

An executable security hardening package is generated for the server device based on an executable script generated by the automated hardening program.

In the above solution, the step of obtaining a security scan report for the server device includes:

Selecting a third-party security scan report platform, and obtaining the identifier and template information of the third-party security scan report platform;

Obtain a security scan report for the server device from the selected third-party security scan report platform;

Obtaining a corresponding report resolution policy from the data storage module according to the identifier and template information of the third-party security scan report platform;

Get the corresponding search keyword.

In the above solution, the method further includes:

Receiving a reinforcement report fed back by the server device after performing a security hardening operation.

The embodiment of the invention further provides a server device security management device, including:

Obtaining a module configured to obtain a security scan report for the server device;

An analysis module configured to analyze the security scan report, and separate a search keyword that fails the security check entry from the security scan report;

The security module is configured to perform security hardening on the server device according to the keyword that does not pass the security check entry.

In the above solution, the reinforcement module includes:

a generating unit, configured to retrieve a hardening library according to the retrieval key that does not pass the security check entry, and generate an executable security hardening package for the server device;

The scheduling unit is configured to upload the executable security hardening package to the corresponding server device to perform a security hardening operation on the corresponding server device.

In the above solution, the generating unit is further configured to: retrieve an automated hardening library according to the search key that does not pass the security check entry, obtain an automated hardening program corresponding to the failed security check entry; and obtain an automated hardening program Generate executable scripts; generate executable security hardening packages for server devices based on executable scripts generated by the automated hardening program.

In the above solution, the acquiring module is configured to select a third-party security scanning reporting platform, obtain the identifier and template information of the third-party security scanning reporting platform, and obtain security for the server device from the selected third-party security scanning reporting platform. Scanning report; obtaining a corresponding report resolution policy from the data storage module according to the identifier and template information of the third-party security scan report platform; and obtaining a corresponding search keyword.

In the above solution, the scheduling unit is further configured to receive a reinforcement report fed back by the server device after performing a security hardening operation.

The embodiment of the invention further provides a computer storage medium, the computer storage medium comprising a set of instructions, when executed, causing at least one processor to execute the server device security management method described above.

A server device security management method, device and computer storage medium according to an embodiment of the present invention obtains a security scan report by analyzing a security scan report of a server device, The search keyword that fails the security check entry is separated in the full scan report; the corresponding server device is security-hardened according to the search keyword that does not pass the security check entry, thereby realizing the server device security assessment, analysis, and security hardening ( Automated processing of server equipment security management, improve the efficiency of evaluation results analysis, reduce manual analysis errors, and improve the automation level of security reinforcement.

DRAWINGS

1 is a schematic structural diagram of a system involved in an embodiment of the present invention;

2 is a schematic flowchart of a first embodiment of a server device security management method according to the present invention;

3 is a schematic diagram of a service flow for initiating a third-party security scan report and automatically analyzing a report by using a scan report analysis module according to an embodiment of the present invention;

4 is a schematic flowchart of a second embodiment of a server device security management method according to the present invention;

FIG. 5 is a schematic diagram of a service process for automatically hardening a device according to an embodiment of the present invention; FIG.

6 is a schematic diagram of a business process of one-click completion report analysis and security hardening in the embodiment of the present invention;

FIG. 7 is a schematic diagram of functional modules of a first embodiment of a server device security management apparatus according to the present invention.

detailed description

In order to make the technical solutions of the present invention clearer and clearer, the following will be further described in detail with reference to the accompanying drawings.

It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

In various embodiments of the embodiments of the present invention, a third-party compliance security scan report import function is provided, and the scan report is analyzed by comparing the configured parsing rules, the solution is automatically generated, and an executable security hardening program is automatically generated, and Provide online, batch, and automated server device reinforcement functions, from device security assessment to evaluation result analysis, to device security hardening process, “one button” and automated security hardening, so as to improve the efficiency of evaluation results. Provide solutions to reduce manual analysis errors and improve the automation level of security hardening.

The solution of the embodiment of the present invention can implement a security scan report on one or more server devices. The intelligent architecture, security hardening and other automated operations, the system architecture can be seen in Figure 1.

As shown in FIG. 1 , the architecture may involve: a server security management device, and a plurality of server devices (ie, the host device shown in FIG. 1 , wherein a corresponding proxy module may be set to communicate with the server security management device) .

The server security management device may include: a basic data management module, a data storage module, a scan report analysis module, an automated reinforcement program library, and an automated hardening scheduling module.

The basic data management module is a human-computer interaction interface. Through this interface, the system administrator can set a third-party security scan report platform (manufacturer) that supports the security scan report, define the format of the scan report of each manufacturer, and analyze the scan report. The logic and strategy (such as compliance entry keywords, scanning device IP information location, etc.), manufacturers and strategies can be dynamically increased or decreased or updated.

The data storage module provides data storage for the basic data. It can use commercial databases such as ORACLE and SYBASE, and can also use open source databases such as MYSQL and POSTGRESQL.

The automated hardening library consists of a series of executable program scripts. One compliance knowledge point corresponds to an executable program. The so-called compliance knowledge point is a specific requirement of security compliance, such as operating system password strength requirements, shutdown non-essential Port or service requirements, critical system file access requirements, use of secure communication protocol requirements, and more.

The scan report analysis module compares the imported third-party manufacturer's compliance scan report with the manufacturer's report format definition and parsing policy preset in the data storage module, and analyzes that the security scan fails the security check entry through the keyword Technical means to retrieve the automated hardening library and generate an executable script for each server device that requires security hardening (with security check entries). The script concatenates the automated hardening program that does not pass the security check entry to ensure these automated hardening procedures. Can be executed sequentially.

The automatic hardening scheduling module is a scheduling execution engine that automates security hardening. The executable scripts generated by the scanning report analysis module and the programs included in the script are uploaded to the corresponding server device, and the security hardening result is returned, and the hardening result is generated and a reinforcement report is generated. Security hardening is performed on the host device, supporting proxy mode and non-proxy mode; the communication protocol between the automated scheduling module and the host device can use Secure Shell Protocol (SSH). The automated scheduling module can be batch-hardened on multiple devices at once and can support virtual machine environments.

In addition, the automatic analysis of the scan report and the automatic execution of the security hardening are performed in the embodiment of the present invention, which Two actions can be performed with one click or separately.

The embodiments of the present invention are described in detail below based on the above system architecture.

Specifically, as shown in FIG. 2, a first embodiment of the present invention provides a server device security management method, including:

Step S101: Obtain a security scan report for the server device.

The server device in this embodiment may also be referred to as a server, a host device, and the like, and is not limited herein.

To implement security check, evaluation, and hardening of server devices, you first need to obtain a security scan report for the server device.

The obtaining of the security scan report may be locally scanned by the server security management device, or may be obtained by the server security management device from the third-party security scan report platform. In this embodiment, the third-party security scan report platform provides a security scan report of each server device. Give an example.

Specifically, the system administrator can set a third-party security scan report platform (manufacturer) that supports the security scan report through the human-computer interaction interface, define the format of each platform scan report, and scan the report analysis logic and policies (such as compliance items). The keyword, the location of the scanning device IP, etc.), the platform and strategy can be dynamically increased or decreased or updated.

The specific implementation process is as follows:

First, the basic data management module selects a third-party security scan report platform according to the operation instruction of the system administrator, and obtains the identifier (name, IP location, etc.) and template information of the third-party security scan report platform.

Specifies that the third-party security scan reporting platform performs a secure scan of the server device and imports the report.

Then, the scan report analysis module obtains a security scan report for the server device from the selected third-party security scan report platform; and obtains a corresponding report resolution policy from the data storage module according to the identifier and template information of the third-party security scan report platform. And get the corresponding search keyword. The data storage module returns a corresponding report resolution policy and corresponding search keywords.

The search keyword may be a number corresponding to various security vulnerabilities, and the number may be different in a report generated by a different third-party security scan report platform. For example, if the report is generated by a form, for the A manufacturer, The number of a certain risk vulnerability is located in the first column of the table. For the B manufacturer, the number of the same type of risk vulnerability may be in the second column of the table.

The selected search keyword can be used to retrieve the corresponding security check entry based on the obtained report resolution policy in the security scan report.

Step S102, analyzing the security scan report, and separating a search keyword that fails the security check entry from the security scan report;

Here, the scan report analysis module separates the search keywords of the failed entry from the report according to the report resolution policy.

Step S103: Perform security hardening on the server device according to the keyword that does not pass the security check entry.

Specifically include:

The hardening library is retrieved according to the retrieval key that does not pass the security check entry, and an executable security hardening package is generated for the server device.

In an embodiment, the method may further include:

Specifically, first, the automated reinforcement program library is retrieved according to the retrieval keyword that does not pass the security check entry, and an automated reinforcement program corresponding to each failed security check entry is obtained;

Generate executable scripts for the obtained automated hardening program;

Then, based on the executable script generated by the automated hardening program, an executable security hardening package is generated for each server device in units of server devices, and an analysis report is formed.

Through the above solution, the embodiment realizes the automatic processing of the server device security assessment analysis, improves the analysis result analysis efficiency, reduces the manual analysis error, and further improves the automation level of the server device security reinforcement.

The following describes the business process of initiating a third-party security scan report and automatically analyzing the report through the scan report analysis module in the embodiment, with reference to FIG. 3, the specific process is as follows:

Step 301: The system administrator specifies a manufacturer, a report template, and a report of the third-party security scan report through the human-computer interaction interface.

Step 302: The scan report analysis module acquires a corresponding search keyword and a report parsing strategy from the data storage module according to the manufacturer information and the template information.

Step 303, the data storage module returns a corresponding report resolution policy and a search keyword;

Step 304: The scan report analysis module separates the search keyword of the failed entry from the report according to the report parsing policy;

Step 305: The scan report analysis module retrieves the solution corresponding to each item and the reinforcement program script from the automated reinforcement program library according to the search keyword;

Step 306, returning a search result;

Step 307: The scan report analysis module further processes the search result, generates an analysis report (reporting a recommended solution for failing the item by device), and generates an executable security hardening package;

Step 308, presenting an analysis report to the system administrator through the human-computer interaction interface, and the security hardening package can be downloaded through the human-computer interaction interface.

Thereby, the automatic processing of the server equipment safety assessment analysis is realized, the analysis result analysis efficiency is improved, the manual analysis error is reduced, and the automation level of the server equipment security reinforcement is improved.

In an actual application, the executable security hardening package may be uploaded to a corresponding server device to perform a security hardening operation on the corresponding server device.

Specifically, the system administrator can select to download an executable security hardening package through the human interface. After the executable security hardening package is obtained, the system administrator can import the executable security hardening package of each server device to the corresponding server device to perform security hardening on each server device.

The above process can be done automatically by the system or by the system administrator.

The solution of the embodiment uses the technologies such as WEB and database to realize the automatic analysis of the security compliance report, and provides the function of automatically generating the security reinforcement program, establishing a security scan, automatic analysis of the scan report, and a series of hardening operations for the security reinforcement. It realizes the automatic evaluation of server equipment security assessment and reinforcement, improves the efficiency of equipment safety assessment results analysis, reduces manual analysis errors, and improves the automation level of server equipment security reinforcement.

As shown in FIG. 4, a second embodiment of the present invention provides a server device security management method. Based on the embodiment shown in FIG. 2 above, the method further includes:

Step S104: Receive a reinforcement report fed back by the server device after performing a security hardening operation.

After the server device performs the security hardening operation, the feedback hardening report is sent to the system administrator.

The business process of automatically hardening the device in this embodiment is described in detail below with reference to FIG.

FIG. 5 is a service flow of the device that is automatically reinforced according to the analysis result of the process shown in FIG. 3, and the process is as follows:

In step 401, the system administrator imports the security hardening package generated by the process of FIG. 3 through the human-computer interaction interface. After the import, the system displays the specific content of the package to the administrator, including the hardening content of each device to be executed. Based on the package, you can select which devices perform the reinforcement of which entries;

Step 402, the automated hardening scheduling module uploads the corresponding reinforcement package to the device A;

Step 403: Perform security hardening on device A.

Step 404, returning the reinforcement report of the device A;

Step 405, the automated hardening scheduling module uploads the corresponding reinforcement package to the device B;

Step 406: Perform security hardening on device B.

Step 407, returning the reinforcement report of device B;

Step 408: After all the devices are hardened, the automated hardening scheduling module sorts the hardening reports of the devices and integrates them into a unified report and presents them to the system administrator.

The solution of the embodiment uses the technologies such as WEB and database to realize the automatic analysis of the security compliance report, and provides the function of automatically generating the security reinforcement program, and establishes the automatic execution of the security scan, the automatic analysis of the scan report, and the security reinforcement of a series of reinforcement operations. The server equipment security assessment analysis and automatic processing of reinforcement, improve the efficiency of equipment safety assessment results analysis, reduce manual analysis errors, and improve the automation level of server equipment security reinforcement.

It should be noted that the scan report analysis and the automatic reinforcement can be regarded as a continuous action, that is, the "one button" completes the report analysis and the security reinforcement.

As shown in FIG. 6, FIG. 6 is a combination of the process shown in FIG. 3 and the process shown in FIG. 5, that is, the scanning report analysis and the automatic reinforcement are regarded as continuous actions, that is, the “one button” completes the report analysis and the security reinforcement, and the process has For example, two devices that need to be hardened are as follows:

Step 501: The system administrator specifies a manufacturer, a report template, and a report of the third-party security scan report through the human-computer interaction interface.

Step 502: The scan report analysis module obtains a corresponding search keyword and a report parsing strategy from the data storage module according to the manufacturer information and the template information.

Step 503: The data storage module returns a corresponding report resolution policy.

Step 504: The scan report analysis module separates the search keyword of the failed entry from the report according to the report parsing policy;

Step 505: The scan report analysis module retrieves the solution corresponding to each item and the reinforcement program script according to the search keyword to the automated reinforcement program library;

Step 506, returning a search result;

Step 507: The scan report analysis module further processes the search result, generates an analysis report (reporting the recommended solution for failing the entry by the device), and generates an executable security hardening package;

Step 508: The scan report analysis module automatically imports the generated security hardening package into the automatic hardening scheduling module.

Step 509, the automated hardening scheduling module uploads the corresponding hardening package to the device A;

Step 510: Perform security hardening on device A.

Step 511, returning the reinforcement report of the device A;

Step 512, the automated hardening scheduling module uploads the corresponding hardening package to the device B;

Step 513, performing security hardening on device B.

Step 514, returning the reinforcement report of the device B;

Step 515: After all the devices are hardened, the automated hardening scheduling module organizes the hardening reports of the devices and integrates them into a unified report, which is presented to the system administrator.

The solution of the embodiment uses the technologies such as WEB and database to realize the automatic analysis of the security compliance report, and provides the function of automatically generating the security reinforcement program, establishing a security scan, automatic analysis of the scan report, and a series of hardening operations for the security reinforcement. Implemented the server device The safety assessment analysis and the automated processing of reinforcement improve the efficiency of equipment safety assessment results analysis, reduce manual analysis errors, and improve the automation level of server equipment security reinforcement.

Correspondingly, an embodiment of the server device security management apparatus of the present invention is proposed.

As shown in FIG. 7, the first embodiment of the present invention provides a server device security management apparatus, including: an obtaining module 201, an analyzing module 202, and a reinforcing module 203, where:

The obtaining module 201 is configured to obtain a security scan report for the server device, and obtain a search keyword and a report parsing policy; the obtaining module 201 corresponds to the basic data management module in the system architecture shown in FIG. 2;

The analyzing module 202 is configured to analyze the security scan report according to the search keyword and the report parsing policy, and separate the search keyword that fails the security check entry from the security scan report;

The hardening module 203 is configured to perform security hardening on the server device according to the keyword that does not pass the security check entry.

The reinforcement module 203 may include: a generating unit and a scheduling unit;

The analysis module 202 and the generation unit correspond to the scan report analysis module in the system architecture shown in FIG. 2.

Specifically, the server device in this embodiment may also be referred to as a server, a host device, and the like, and is not limited herein.

Specifically, the system administrator can set a third-party security scan report platform (manufacturer) that supports the security scan report through the human-computer interaction interface, define the format of each platform scan report, and scan The logic and strategy of the report analysis (such as the compliant entry keyword, the location of the scanning device IP, etc.), the platform and strategy can be dynamically increased or decreased or updated.

The specific implementation process is as follows:

First, the third module security scan report platform is selected by the obtaining module 201 according to the operation instruction of the system administrator, and the identifier (name, IP location, etc.) and template information of the third-party security scan report platform are obtained.

Then, the obtaining module 201 (also corresponding to the scan report analysis module shown in FIG. 2) obtains a security scan report for the server device from the selected third-party security scan report platform; and according to the identifier and template of the third-party security scan report platform The information is obtained from the data storage module, and the corresponding search keyword is obtained. The data storage module returns a corresponding report resolution policy and corresponding search keywords.

Thereafter, the analysis module 202 separates the search keywords that have not passed the entry from the report according to the report resolution policy.

The generating unit in the hardening module 203 retrieves the hardening program library according to the search key that does not pass the security check entry, and generates an executable security hardening package for the server device.

Specifically, first, the automated reinforcement program library is retrieved according to the search keyword that does not pass the security check entry, and an automated reinforcement program corresponding to each failed security check entry is obtained;

Generate executable scripts for the obtained automated hardening program;

Then, based on the executable script generated by the automated hardening program, an executable security hardening package is generated for the server device in units of server devices, and an analysis report is formed.

Through the above solution, the embodiment implements automatic processing of server equipment security assessment analysis, improves analysis result analysis efficiency, reduces manual analysis error, and further improves server equipment. The level of automation for security hardening.

In an embodiment, the scheduling unit in the reinforcement module 203 is configured to upload the executable security hardening package to the corresponding server device to perform a security hardening operation on the corresponding server device.

The scheduling unit corresponds to an automated hardening scheduling module in the system architecture shown in FIG. 2.

Compared with the foregoing embodiment, the embodiment further includes a solution for uploading the executable security hardening package to the corresponding server device to perform a security hardening operation on the corresponding server device.

Further, the scheduling unit is further configured to receive a reinforcement report that is feedback after the server device performs a security hardening operation.

Compared with the prior art, the solution of the embodiment of the present invention provides a third-party compliance security scan report import function, analyzes the scan report by comparing the configured parsing rules, automatically generates a solution, and automatically generates an executable security hardening program, and provides Online, batch, and automated reinforcement of server equipment, from equipment safety assessment, to evaluation results analysis, to the entire process of equipment security hardening, "one-click", automated security hardening, in order to improve the efficiency of evaluation results, Reduce the manual analysis error, improve the automation level of security reinforcement, and provide means and methods.

In an actual application, the obtaining module 201, the analyzing module 202, and the generating unit may be implemented by a processor in the server device security management device; the hardening module 203 may be implemented by a processor in the server device security management device in combination with the communication interface; The scheduling unit can be implemented by a communication interface in the server device security management device.

It is also to be understood that the term "comprises", "comprising", or any other variants thereof is intended to encompass a non-exclusive inclusion, such that a process, method, article, or device that comprises a And includes other elements not explicitly listed, or elements that are inherent to such a process, method, article, or device. An element that is defined by the phrase "comprising a ..." does not exclude the presence of additional equivalent elements in the process, method, item, or device that comprises the element.

The serial numbers of the embodiments of the present invention are merely for the description, and do not represent the advantages and disadvantages of the embodiments.

Through the description of the above embodiments, those skilled in the art can clearly understand that the foregoing embodiment method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be through hardware, but in many cases, the former is better. Implementation. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, may be embodied in the form of a software product stored in a storage medium (such as ROM/RAM, disk, The optical disc includes a number of instructions for causing a terminal device (which may be a cell phone, a computer, a server, or a network device, etc.) to perform the methods described in various embodiments of the present invention.

Based on this, an embodiment of the present invention further provides a computer storage medium, where the computer storage medium includes a set of instructions, when executed, causing at least one processor to perform security management of the server device described in the embodiment of the present invention. method.

The above is only the embodiment of the present invention, and is not intended to limit the scope of the invention, and the equivalent structure or process change made by the specification and the drawings of the present invention may be directly or indirectly applied to other related technical fields. The same is included in the scope of patent protection of the present invention.

Industrial applicability

The solution provided by the embodiment of the present invention obtains a security scan report for the server device. Analysis of the security scan report, separating the search key that fails the security check entry from the security scan report; performing security hardening on the corresponding server device according to the search key that has not passed the security check entry, thereby implementing security assessment of the server device , analysis and security reinforcement (automatic processing, improve the efficiency of evaluation results analysis, reduce manual analysis errors, improve the automation level of security reinforcement.

Claims

A server device security management method includes:

Obtain a security scan report for the server device;

Analyzing the security scan report, separating a search keyword that fails the security check entry from the security scan report;

The server device is security hardened according to the keyword that does not pass the security check entry.
The method according to claim 1, wherein the step of performing security hardening on the server device according to the keyword that does not pass the security check entry comprises:

Retrieving the reinforcement program library according to the retrieval keyword that does not pass the security check entry, and generating an executable security reinforcement package for the server device;

Uploading the executable security hardening package to a corresponding server device to perform a security hardening operation on the corresponding server device.
The method of claim 2, wherein the step of retrieving the hardening library according to the retrieval key that does not pass the security check entry, and generating an executable security hardening package for the server device comprises:

Retrieving an automated hardening library according to the search key that does not pass the security check entry, and obtaining an automated hardening program corresponding to the failed security check entry;

Generate executable scripts for the obtained automated hardening program;

An executable security hardening package is generated for the server device based on an executable script generated by the automated hardening program.
The method of claim 1, 2 or 3, wherein the step of obtaining a security scan report for the server device comprises:

Selecting a third-party security scan report platform, and obtaining the identifier and template information of the third-party security scan report platform;

Obtain a security scan report of the server device from the selected third-party security scan report platform Report

Obtaining a corresponding report resolution policy from the data storage module according to the identifier and template information of the third-party security scan report platform;

Get the corresponding search keyword.
The method of claim 2, wherein the method further comprises:

Receiving a reinforcement report fed back by the server device after performing a security hardening operation.
A server device security management device includes:

Obtaining a module configured to obtain a security scan report for the server device;

An analysis module configured to analyze the security scan report, and separate a search keyword that fails the security check entry from the security scan report;

The security module is configured to perform security hardening on the server device according to the keyword that does not pass the security check entry.
The apparatus of claim 6 wherein said reinforcement module comprises:

a generating unit, configured to retrieve a hardening library according to the retrieval key that does not pass the security check entry, and generate an executable security hardening package for the server device;

The scheduling unit is configured to upload the executable security hardening package to the corresponding server device to perform a security hardening operation on the corresponding server device.
The apparatus according to claim 7, wherein

The generating unit is further configured to: retrieve an automated hardening library according to the search key that does not pass the security check entry, obtain an automated hardening program corresponding to the failed security check entry; generate an executable script for the obtained automated hardening program An executable security hardening package for the server device based on an executable script generated by the automated hardening program.
The device according to claim 6, 7 or 8, wherein

The obtaining module is configured to select a third-party security scan reporting platform, and obtain the identifier and template information of the third-party security scan reporting platform; and select a third-party security scan report. The platform obtains a security scan report for the server device, and obtains a corresponding report resolution policy from the data storage module according to the identifier and template information of the third-party security scan report platform; and obtains a corresponding search keyword.
The apparatus according to claim 7, wherein

The scheduling unit is further configured to receive a reinforcement report fed back by the server device after performing a security hardening operation.
A computer storage medium comprising a set of instructions that, when executed, cause at least one processor to perform the server device security management method of any one of claims 1 to 5.