Method and device for evaluating network assets

Abstract

The embodiment of the invention provides a method and a device for evaluating network assets, and the method comprises the steps: calculating a component vulnerability parameter, reflecting a networkasset component level, corresponding to each classification according to the classification of vulnerabilities in the network assets and the vulnerability parameter of each vulnerability; according toall the component vulnerability parameters corresponding to all the classifications, calculating overall vulnerability parameters reflecting the overall level of the network assets; determining the number of high-risk vulnerabilities and the total number of vulnerabilities according to all vulnerability parameters in the network assets; and determining a total evaluation value reflecting the overall vulnerability of the network assets according to the overall vulnerability parameters, the number of the high-risk vulnerabilities and the evaluation values corresponding to the total number of the vulnerabilities, and evaluating the overall vulnerability level of the network assets according to the total evaluation value. The device executes the method. According to the method and the deviceprovided by the embodiment of the invention, the vulnerability of the network assets can be accurately and comprehensively evaluated.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a method and device for evaluating network assets. Background technique [0002] With the rapid development of Internet technology, the information security of network assets has been promoted to a very important position. At present, vulnerability (vulnerability) is an important factor in network security, and the evaluation of vulnerability and its possible impact is involved in various security products (vulnerability scanning, intrusion detection, antivirus, patch management, etc.). However, there is currently no unified evaluation system standard in the industry. The Common Vulnerability Scoring System (CVSS) is developed by NIAC and maintained by FIRST. It is an open standard that can be adopted by product manufacturers for free. Using this standard , the vulnerability can be scored, and the degree of vulnerability can be determined by scoring. [0003] The numbe...

AI Technical Summary

Problems solved by technology

At present, in the assessment of vulnerability risk management, CVSS only conducts risk assessment and vulnerability quantitative management for a single vulnerability, and cannot comprehensively assess the security risk of network assets as a whole.

Images