Walk-through test technique based information security audit implementation method and system

Abstract

The invention relates to the technical field of information monitoring, in particular to a walk-through test technique based information security audit implementation method and system. The method includes: recognizing business sensitive information waiting for audit and access right of the business sensitive information; tracking flow paths of the business sensitive information in one or more information systems based on the access right; performing audit analysis on risk vulnerabilities existing in the process that the systems with access right process the business sensitive information according to tracking results; based on audit analysis results of the risk vulnerabilities, acquiring a risk value of the business sensitive information. By the method and system, risks existing in the process that the sensitive information flows in full life circles of the multiple information systems can be monitored.

Description

technical field [0001] The invention relates to the technical field of information monitoring, in particular to a method and system for realizing information security auditing based on walk-through testing technology. Background technique [0002] At present, information security audit adopts information security risk assessment method in terms of information asset protection, and the implementation steps include: (1) Identify information assets (such as information systems, equipment, etc.) and list assets; Identify the vulnerabilities and configuration vulnerabilities of information system software and information equipment by means of scanning and security inspection; (3) identify the security threats faced by information systems, information networks and information equipment; (4) comprehensively analyze according to the vulnerability level and security threat level Information Security Risk. [0003] Under the existing information security risk assessment method, the c...

AI Technical Summary

Problems solved by technology

[0003] Under the existing information security risk assessment method, the core information assets of the enterprise, that is, the core (sensitive) business data of the enterprise, exist as part of the information system. When conducting information security risk assessment, business data is used as a system function Or a part of information equipment, only evaluates the vulnerability of a single system software and information equipment, and cannot assess the potential risks caused by system design or implementation defects during the flow of business-sensitive information between multiple systems

Images