Risk rating method and device for security vulnerabilities of information system, equipment and storage medium

Abstract

The embodiment of the invention discloses a risk rating method and device for security vulnerabilities of an information system, equipment and a storage medium. The risk rating method for the security vulnerabilities of the information system comprises the following steps: determining vulnerability types according to positions of to-be-rated vulnerabilities; determining a corresponding risk rating index and content according to the vulnerability type, wherein the risk rating indexes comprise a vulnerability occurrence probability index, a vulnerability hazard level index and a vulnerability utilization difficulty index; quantifying the content of each risk rating index to obtain a quantized value of each risk rating index; and according to the quantized value of each risk rating index and a preset weight ratio among the vulnerability occurrence probability index, the vulnerability hazard level index and the vulnerability utilization difficulty index, determining the risk level of the to-be-rated vulnerability. Through the method, the security vulnerabilities of the information system can be graded quickly.

Description

technical field [0001] The embodiments of the present invention relate to the technical field of information system security, and in particular, to a risk rating method, device, device and storage medium for information system security vulnerabilities. Background technique [0002] With the rapid development of big data, the Internet of Things, cloud computing, and the rise of new business forms such as Internet financial technology, cyber attacks have become a new challenge to information system security, and key information infrastructure may be threatened by cyber attacks at all times. For various security vulnerability threats, it is particularly important to be able to quickly determine the risk level to distinguish the priority of treatment for better protection of information system security. [0003] At present, the CVSS general vulnerability scoring system is the most used. In specific applications, this model can reflect the possibility of a system being successful...

AI Technical Summary

Problems solved by technology

[0003] At present, the CVSS general vulnerability scoring system is the most used. In specific applications, this model can reflect the possibility of a system being successfully invaded by predicting the vulnerability risk score. However, in actual application, the system model has many index items and needs to be manually Selection is time-consuming and labor-intensive, and its applicability is not strong. For example, it is easy for users who are not familiar with the system to misjudge the impact result, which may affect the priority of dealing with vulnerability threats and cause losses.

Images