Risk assessment method and system

Abstract

The invention discloses a risk assessment method and a risk assessment system, wherein the method comprises: responding to a timing task that includes a task startup time and at least one target infrastructure; acquiring a preset security baseline policy corresponding to the target infrastructure, wherein the security baseline policy includes at least one security baseline; invoking and enforcingthe security baseline policy to obtain a security baseline value for each security baseline in the target infrastructure; calculating a security health value for the target infrastructure based on thesecurity baseline value; and performing a risk assessment on the target infrastructure based on the security health value. By quantifying a security health value through the security status of the target infrastructure, the invention implements real-time monitoring of the operational status of the target infrastructure, and is capable of quickly locating security threat points in the infrastructure when security events occur in the network.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to a risk assessment method and system. Background technique [0002] With the continuous development of information technology, information security incidents are showing an increasing trend, such as using Trojan horse virus to steal user sensitive information, using phishing to conduct network fraud, etc., which bring more and more losses to people, so information security has become an important aspect of enterprise information The focus of cultural construction. [0003] In this process, security operation and maintenance personnel generally formulate security specifications and conduct security checks on the entire network equipment in order to block security incidents before they occur. The security baseline is a product that checks the compliance of the entire network equipment, and specifies the most basic security requirements that an information syste...

AI Technical Summary

Problems solved by technology

However, when a network intrusion event occurs, there is currently no good solution for

Images