Method for calculating vulnerability risks

Abstract

The invention discloses a method for calculating vulnerability risks, which comprises the following steps of S1, standardizing vulnerability levels; S2, standardizing the evaluation dimension by combining the hazard level of the vulnerability with a 5W2H method; S3, standardizing the datum line; S4, performing matching analysis on the standardization in S1, S2 and S3 and risk values between systems of the enterprise to obtain a conclusion. According to the method, risk quantification is carried out on each vulnerability in combination with the vulnerability hazard level and the 5W2H method, sothat a more accurate and objective evaluation result is obtained, the risk level of the vulnerability existing in the current system is known more visually, a more feasible rectification scheme is formulated, and a more effective rectification effect is achieved. And each quantification result is recorded in a case, statistics is carried out on various risk occurrence frequencies of each system regularly, weakness of each system during development is understood, development specifications and requirements are perfected in a more targeted manner, and development quality is improved.

Description

Technical field [0001] The invention relates to the field of computer security, in particular to a method for calculating the risk of a vulnerability. Background technique [0002] With the popularization of the Internet, the application of computers has become more and more extensive, and the security of computer systems has gradually become a matter of great concern to people. Due to flaws in the logic design of application software or operating system software, or errors in writing programs, the computer system has system vulnerabilities, causing this flaw or error to be exploited by criminals or computer hackers by planting Trojan horses or viruses Attack or control the entire computer by other means, thereby stealing important data and information in the computer, or even destroying the computer system. [0003] There are many existing vulnerability repair products, all of which can provide the function of repairing vulnerabilities. Users need to regularly start software pro...

AI Technical Summary

Problems solved by technology

At present, under normal circumstances, vulnerability risk assessments are often not comprehensive and in-depth, and the rectification measures are not thorough or targeted due to non-standardized and inconsistent risk assessment standards and insufficient professionalism and experience of assessors.

Images