Security configuration vulnerability monitoring method, device, and computer-readable storage medium

Abstract

The invention discloses a security configuration vulnerability monitoring method. The method includes the following steps: through fingerprint detection, collecting information of network channels ornetwork nodes that accord with preset fingerprint conditions; arranging self-adaptive probes that fit the network channels or the network nodes; obtaining configuration file information of the networkchannels or the network nodes through the self-adaptive probes; and comparing the configuration file information of the network channels or the network nodes with security baseline indexes corresponding to the network channels or the network nodes, and obtaining security configuration vulnerability information of the network channels or the network nodes. The security configuration vulnerabilitymonitoring method can comprehensively detect security configuration vulnerability information of network channels or network nodes in an Internet system to prevent attacks of hackers at the source. The invention also provides a security configuration vulnerability monitoring device configured in the Internet and a computer readable storage medium.

Description

technical field [0001] The present invention relates to the field of security technology, in particular to a security configuration loophole monitoring method, a security configuration loophole monitoring device and a computer-readable storage medium. Background technique [0002] The process of advanced persistent threat attacks by hackers mainly includes: [0003] 1. Collect information on the attack target (collect various configuration information). [0004] 2. The attacker analyzes the collected configuration information and begins to write attack tools. [0005] 3. Start delivery for the target. [0006] 4. The delivery is successful and the attack begins. [0007] 5. Upload the computer shell (shell) for remote control. [0008] 6. Subsequent intranet attacks. [0009] Hackers usually use security configuration vulnerability information on terminals or servers as an entry point to organize attacks. In the attack process of advanced persistent threats, the collect...

AI Technical Summary

Problems solved by technology

[0008] 6. Subsequent intranet attacks

The current status quo is that the network structure is becoming more and more complex, and the number and types of important applications and servers are increasing. Once personnel misuse or ignore a certain configuration detail of a certain system, it may greatly affect the normal operation of the system. run

By adopting a unified security configuration standard to standardize the daily operations of technicians on various systems, the operation and maintenance personnel have a benchmark for checking default risks. Completing compliance system configuration checks and repairs has become a time-consuming and labor-intensive task

Images