Risk assessment method and device, computer system and medium

Abstract

The invention provides a risk assessment method, and relates to the field of information security, and the method comprises the steps: obtaining the monitoring data of a to-be-tested system; matchingthe monitoring data with a threat rule base to determine that the monitoring data hitting the threat rule base is the threat data, wherein the threat rule base is constructed based on a knowledge base; determining a risk level of the threat data; and determining a defense strategy of the to-be-tested system based on the risk level of the threat data. The invention further provides a risk assessment device, a computer system and a medium.

Description

Technical field [0001] The present disclosure relates to the field of information security, and more specifically, to a risk assessment method, device, computer system and medium. Background technique [0002] The risk assessment scheme based on PASTA (The Process for Attack Simulation and Threat Analysis, risk-centric attack simulation and threat analysis process) is mainly composed of seven sub-steps: definition of objectives, definition of technical scope, application decomposition, threat analysis, and vulnerability And vulnerability analysis, attack modeling, risk and impact analysis. But each step is very complicated. At present, the industry's construction of threat models is mainly based on known threat events and scenarios, or construction with sufficient understanding of their own systems, and the application and landing of threat modeling and risk assessment based on PASTA There are still certain difficulties, such as insufficient comprehensive and accurate threat sce...

AI Technical Summary

Problems solved by technology

But each step is very complicated. At present, the construction of threat models in the industry is mainly based on the construction of known threat events and scenarios, or the construction of a sufficient understanding of its own system, and the application and implementation of threat modeling and risk assessment based on PASTA. There are still some difficulties, such as the threat scenarios are not comprehensive and accurate, the requirements for personnel capabilities are too high, and the handling of threat events lacks priority

Moreover, in the process of building and maintaining a threat model, not only personnel with a deep understanding of the system are required, but also a lot of time and energy are required to update the model and strengthen the system, but the results are often not ideal

Images