Information system risk assessment method, device and computer readable storage medium

Abstract

The present disclosure relates to a method for information system risk assessment, comprising the steps of: determining each asset object in the information system; calculating the importance value, vulnerability value and threat value of each asset object; calculating the static risk value sum of each asset object to obtain the static risk value of the information system; obtaining the asset risk transmission direction and data, and calculating the risk transmission direction coefficient; calculating the transmission risk sum of each asset of the information system to other related assets to obtain the dynamic risk value of the information system; and calculating the overall risk value of the information system according to the static risk value of the information system and the dynamic risk value of the information system.

Description

Technical Field

[0001] This invention relates to the field of network technology and security. Background Technology

[0002] Existing asset risk assessment methods are mainly divided into two categories: knowledge assessment and detection assessment. Knowledge assessment uses expert systems, historical statistics, and relevant system vulnerabilities to evaluate risk value and probability of occurrence. Detection assessment utilizes external tools such as security baseline checks, intrusion detection, and vulnerability checks, or combines external dynamic information such as third-party intelligence to assess risk.

[0003] The existing methods have some shortcomings. 1) The essence of risk is the possibility and impact of exploiting an entity's vulnerability. As the entity moves, the risk also moves. Risk assessment only considers the risk at the current point in time, without taking into account its diffusion and variability. 2) Asset risk assessment often overlooks the combined effect of multiple detection and assessment methods and easily neglects the risk mitigation effect of security reinforcement measures. Summary of the Invention

[0004] A brief overview of this disclosure is given below to provide a basic understanding of some aspects of it. However, it should be understood that this overview is not an exhaustive summary of this disclosure. It is not intended to identify key or essential parts of this disclosure, nor is it intended to limit the scope of this disclosure. Its purpose is merely to present certain concepts of this disclosure in a simplified form as a prelude to the more detailed description that follows.

[0005] This disclosure provides a method for information system risk assessment, including the following steps:

[0006] Identify the various asset objects in the information system;

[0007] Calculate the importance, vulnerability, and threat values ​​for each asset.

[0008] Calculate the sum of the static risk values ​​of each asset to obtain the static risk value of the information system;

[0009] Obtain the direction and data of asset risk transmission, and calculate the risk transmission direction coefficient;

[0010] The sum of the transmission risks from each asset of the information system to other related assets is calculated to obtain the dynamic risk value of the information system; and

[0011] Calculate the overall risk value of the information system based on its static and dynamic risk values.

[0012] Other features and advantages of the present invention will become clear from the following detailed description of preferred embodiments. Attached Figure Description

[0013] The accompanying drawings, which form part of this specification, illustrate embodiments of this disclosure and, together with the specification, serve to explain the principles of this disclosure.

[0014] This disclosure will be more clearly understood with reference to the accompanying drawings and the following detailed description, wherein:

[0015] Figure 1 A flowchart of the information system risk assessment method according to this disclosure is shown.

[0016] Figure 2 An exemplary configuration of a computing device capable of implementing embodiments of the present disclosure is shown. Detailed Implementation

[0017] The following detailed description is based on the accompanying drawings and provides various exemplary embodiments of the present disclosure to aid in a comprehensive understanding. Various details are included in the following description to aid understanding; however, these details are considered exemplary only and not intended to limit the present disclosure, which is defined by the appended claims and their equivalents. The words and phrases used in the following description are intended only to provide a clear and consistent understanding of the present disclosure. Additionally, descriptions of well-known structures, functions, and configurations may have been omitted for clarity and brevity. Those skilled in the art will recognize that various changes and modifications can be made to the examples described herein without departing from the spirit and scope of the present disclosure.

[0018] Figure 1 A flowchart of the information system risk assessment method according to this disclosure is shown.

[0019] The following combination Figure 1 The process of the information system risk assessment method disclosed herein is described in detail.

[0020] The following is an exemplary detailed process and formula for the information system risk assessment method disclosed herein.

[0021] Step 1: Identify the information system to be evaluated and the various asset objects within that information system.

[0022] In some embodiments, the information system A to be evaluated is determined. i And retrieve the asset objects m1, m2, ... within it. For example, information system A i The number of asset objects in the data is M. i .

[0023] Step 2: Calculate the importance value, vulnerability value, and threat value of each asset.

[0024] In some embodiments, the evaluation information system Ai The importance, threats, and vulnerabilities of asset m are determined, and the importance value, threat value, and vulnerability value of the asset are calculated.

[0025] In some embodiments, the importance value V(m) of asset m is calculated based on three security attributes: confidentiality, integrity, and availability.

[0026] V(m) = log2(w) c (m)·2 conf(m) +w i (m)·2 int(m) +w a (m)·2 avail(m) )

[0027] In the above formula, conf(m) represents the confidentiality level of asset m, int(m) represents the integrity level of asset m, avail(m) represents the availability level of asset m, and w c (m) represents the weight of confidentiality in the asset value, w i (m) represents the weight of integrity, w a (m) represents the weight of availability.

[0028] The threat value Th(m) of asset m is calculated based on external intelligence, expert systems, and historical statistical scores.

[0029] Th(m)=log2(w b (m)·2 inf(m) +w e (m)·2 exp(m) +w h (m)·2 his(m) )

[0030] In the above formula, inf(m) represents the external intelligence threat score, exp(m) represents the expert system threat score, his(m) represents the historical statistical threat score, and w b (m) represents the weight of the external intelligence threat score in the threat value, w e (m) represents the weight of the expert system score in the threat value, w h (m) represents the weight of the historical threat statistics score in the threat value.

[0031] The vulnerability value Vul(m) of asset m is calculated based on vulnerability detection, intrusion detection, and security mitigation.

[0032] Vul(m) = log2(2 Bug(m)+Ids(m)-Fix(m) )

[0033] In the above formula, Bug(m) represents the vulnerability detection score, Ids(m) represents the intrusion detection score, and Fix(m) represents the security remediation score.

[0034] Although the specific method for calculating the importance, vulnerability, and threat values ​​of each asset object for asset m has been illustrated with examples, those skilled in the art will understand that the importance, vulnerability, and threat values ​​of other asset objects can be calculated in the same manner.

[0035] Step 3: Calculate the static risk value of the information system.

[0036] Information System A i The intrinsic risk value R of the internal asset m itself i (AC m The calculation formula for ) is as follows:

[0037] R i (AC m )=V(m)·Th(m)·Vul(m)

[0038] Information System A i static risk value R st (A i The calculation formula is as follows:

[0039]

[0040] In the above formula, M i For information system A i The amount of internal assets.

[0041] Step 4: Obtain the direction and data of asset risk transmission, and calculate the risk transmission direction coefficient and risk transmission system.

[0042] By using a traffic detection system to determine the direction of data transmission, the direction of asset risk transmission can be obtained, and a risk transmission direction coefficient outside the information system can be constructed to calculate the risk transmission coefficient.

[0043] Information System A i Internal assets m are transmitted to information system A j The risk value R(m) of asset n i →n j The calculation formula for ) is as follows:

[0044] R(m i →n j )=ρ(m,n)·θ(m i n j )·R i (AC n )

[0045] In the above formula, θ(m)i n j ) represents information system A i Internal assets m to information system A j Risk transmission direction coefficient of internal asset n.

[0046] Furthermore, in the above formula, R i (AC n R represents the risk value of asset n itself. R is calculated for asset n in the same manner as for asset m. i (AC n ).

[0047] R i (AC n ) = V(n)·Th(n)·Vul(n)

[0048] V(n) = log2(w) c (n)·2 conf(n) +w i (n)·2 int(n) +w a (n)·2 avail(n) )

[0049] Th(n) = log2(w) b (n)·2 inf(n) +w e (n)·2 exp(n) +w h (n)·2 his(n) )

[0050] Vul(n) = log2(2 Bug(n)+Ids(n)-Fix(n) ).

[0051] Information system A i Assets m and Information System A j The data of asset n is vectorized, with each row of data's fields as one dimension and field values ​​as dimension values, resulting in two vectors m and n. Considering the high probability of missing dimensions between them, and referring to the calculation method of the Pearson correlation coefficient, the formula for calculating the risk transmission coefficient ρ(m, n) is as follows:

[0052]

[0053] In the formula, cov(m, n) is the covariance between m and n, σ m Let σ be the standard deviation of m. n Let n be the standard deviation of n.

[0054] Step 5: Calculate the dynamic risk value of the information system.

[0055] The sum of the risk of each asset in the information system transmitted to other related assets is the dynamic risk value of the information system.

[0056] Information System A i Dynamic risk value R dy (A i Information system A i Asset m in the middle is transmitted to information system A j The risk value transmitted plus the cumulative risk of asset m being transmitted to other information systems.

[0057]

[0058] In the above formula, M i For information system A i The number of assets in M j For information system A i The total number of all external assets, R(m) i →n j Information system A i Internal assets m are transmitted to information system A j The risk value of internal asset n.

[0059] Step Six: Calculate the overall risk value of the information system.

[0060] The overall risk value is calculated based on the static risk value and the dynamic risk value.

[0061] Information System A to be evaluated i Overall risk value R(A) i The sum of the static risk value and the dynamic risk value is calculated using the following formula:

[0062]

[0063] In the information system risk assessment method described above, the calculation of static risk value and dynamic risk value can be performed in parallel, without being limited to the step numbers specifically illustrated above.

[0064] As a specific example, the following describes in detail an exemplary embodiment according to this disclosure.

[0065] This exemplary embodiment is intended to evaluate information system A i The overall risk value includes the following steps.

[0066] 1. Identify the information system A to be evaluated. i To obtain the asset objects within it

[0067] 2. Computational Information System A iThe importance value V(m) of asset m, the threat value Th(m) of threat, and the vulnerability value Vul(m) of vulnerability.

[0068] V(m) = log2(w) c (m)·2 conf(m) +w i (m)·2 int(m) +w a (m)·2 avail(m) )

[0069] In the above formula, conf(m) represents the confidentiality level of asset m, int(m) represents the integrity level of asset m, avail(m) represents the availability level of asset m, and w c (m) represents the weight of confidentiality in the asset value, w i (m) represents the weight of integrity, w a (m) represents the weight of availability.

[0070] Th(m)=log2(w b (m)·2 inf(m) +w e (m)·2 exp(m) +w h (m)·2 his(m) )

[0071] In the above formula, inf(m) represents the external intelligence threat score, exp(m) represents the expert system threat score, his(m) represents the historical statistical threat score, and w b (m) represents the weight of the external intelligence threat score in the threat value, w e (m) represents the weight of the expert system score in the threat value, w h (m) represents the weight of the historical threat statistics score in the threat value.

[0072] Vul(m) = log2(2 Bug(m)+Ids(m)-Fix(m) )

[0073] In the above formula, Bug(m) represents the vulnerability detection score, Ids(m) represents the intrusion detection score, and Fix(m) represents the security remediation score.

[0074] Vulnerability detection and intrusion detection scores can be obtained from a vulnerability detection scoring system. They are divided into 5 levels according to severity, with corresponding scores of 10, 8, 6, 4, and 2 from strongest to weakest. A score of 0 indicates no vulnerability detection.

[0075] Security remediation measures are scored based on the difference between the scores from subsequent vulnerability detections. If the difference is 0, the vulnerability is 0. If technical circumvention is used to fix the vulnerability, the vulnerability value is set to 0.8 * Bug(m). The same applies to intrusion detection.

[0076] 3. Calculate the static risk value of the information system.

[0077] Information System A i The intrinsic risk value R of the internal asset m itself i (AC m The calculation formula for ) is as follows:

[0078] R i (AC m )=V(m)·Th(m)·Vul(m)

[0079] Information System A i M i The cumulative risk value of each asset is information system A. i static risk value R st (A i The calculation formula is as follows:

[0080]

[0081] In the above formula, M i For information system A i The amount of internal assets.

[0082] 4. Obtain the direction and data of asset risk transmission, and calculate the risk transmission direction coefficient and risk transmission system.

[0083] When the traffic detection system can obtain data whose source address is the address pointed to by asset m and whose destination address is the address pointed to by asset n, it is known that asset m is in information system A. i Within information system A, asset n... j If the transmission direction is determined to be m→n, then the risk transmission direction coefficient θ(m) is... i n j If the value is 1, then the value is 0; otherwise, the value is 0.

[0084] Information system A i Assets m and Information System A j The data of asset n is vectorized, with each row of data having a field as a dimension and the field value as the dimension value, resulting in two vectors m and n. The risk transmission coefficient ρ(m, n) between the two vectors is calculated using the following formula:

[0085]

[0086] In the formula, cov(m, n) is the covariance between m and n, σ mLet σ be the standard deviation of m. n Let m be the standard deviation of n, and T be the maximum dimension between m and n.

[0087] Information System A i Internal assets m are transmitted to information system A j The risk value R(m) of asset n i →n j Information system A i The intrinsic risk value R of the internal asset m itself i (AC m ) and downstream information system A j Risk transmission direction coefficient θ(m) of internal asset n i n j The product of the risk transmission coefficient ρ(m,n) and the risk transmission coefficient ρ(m,n) is calculated using the following formula:

[0088] R(m i →n j )=ρ(m,n)·θ(m i n j )·R i (AC n )

[0089] Among them, the risk transmission direction coefficient θ(m) i n j The calculation methods for risk transmission coefficient ρ(m,n) have been explained above.

[0090] As mentioned above, the risk value R of asset n can be calculated for asset n in the same manner as for asset m. i (AC n ):

[0091] R i (AC n ) = V(n)·Th(n)·Vul(n)

[0092] V(n) = log2(w) c (n)·2 conf(n) +w i (n)·2 int(n) +w a (n)·2 avail(n) )

[0093] Th(n) = log2(w) b (n)·2 inf(n) +w e (n)·2 exp(n) +w h (n)·2 his(n) )

[0094] Vul(n) = log2(2 Bug(n)+Ids(n)-Fix(n) ).

[0095] 5. Calculate the dynamic risk value of the information system.

[0096] The sum of the risk of each asset in the information system transmitted to other related assets is the dynamic risk value of the information system.

[0097] Information System A i Dynamic risk value R dy (A i Information system A i Asset m in the middle is transmitted to information system A j The risk value transmitted plus the cumulative risk of asset m being transmitted to other information systems.

[0098]

[0099] In the above formula, M i For information system A i The number of assets in M j For information system A i The total number of all external assets, R(m) i →n j Information system A i Internal assets m are transmitted to information system A j The risk value of asset n.

[0100] 6. Calculate the overall risk value of the information system.

[0101] The overall risk value is calculated by adding the static risk value and the dynamic risk value together.

[0102] Information System A to be evaluated i Overall risk value R(A) i The sum of the static risk value and the dynamic risk value is calculated using the following formula:

[0103]

[0104] In this disclosed scheme, a method for calculating the threat value Th(m) of asset m is proposed, taking into account various security threat factors including external intelligence threat score, expert system threat score and historical statistical threat score, as well as different weights of these factors.

[0105] Furthermore, the scheme disclosed herein considers various security detection and assessment factors, including vulnerability detection, intrusion detection, and security mitigation, and proposes a method for calculating the vulnerability value Vul(m) of asset m.

[0106] Furthermore, in the scheme disclosed herein, a data flow detection system is used to detect the source and destination of data, thereby determining the upstream and downstream relationship of data, and using this method to determine the direction of risk transmission and the risk transmission direction coefficient θ.

[0107] Furthermore, in this disclosed solution, a method for calculating the risk transmission coefficient ρ is proposed using upstream and downstream asset data, which quantifies the risk transmission of assets and allows for the calculation of a time-sensitive risk value using continuously updated asset data.

[0108] Compared with the prior art, this disclosure has at least the following advantages and beneficial effects.

[0109] This disclosure optimizes the calculation of threat and vulnerability values ​​for assets, taking into account multiple security threat factors in calculating threat values, and considering multiple security detection and assessment methods and security compensation factors in calculating vulnerability values.

[0110] This disclosure utilizes a data flow detection system to detect the source and destination of data, thereby determining the direction of transmission. It objectively reflects the directionality of risk transmission and has advantages such as automation, accuracy, and timeliness.

[0111] This disclosure can calculate the similarity between assets using an asset similarity algorithm based on upstream and downstream asset data, quantifying the risk transmission of assets, and can use continuously updated asset data to calculate the risk transmission coefficient ρ(m,n) to obtain a time-sensitive risk value.

[0112] This disclosure can more accurately assess high-risk information systems and vulnerable nodes, thereby obtaining more reliable and timely information system risk assessment results.

[0113] Figure 2 An exemplary configuration of a computing device 200 capable of implementing embodiments of the present disclosure is shown.

[0114] Computing device 200 is an example of a hardware device capable of applying the foregoing aspects of this disclosure. Computing device 200 can be any machine configured to perform processing and / or computation. Computing device 200 can be, but is not limited to, a workstation, server, desktop computer, laptop computer, tablet computer, personal data assistant (PDA), smartphone, in-vehicle computer, or a combination thereof.

[0115] like Figure 2As shown, computing device 200 may include one or more components that can be connected to or communicate with bus 202 via one or more interfaces. Bus 202 may include, but is not limited to, Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus. Computing device 200 may include, for example, one or more processors 204, one or more input devices 206, and one or more output devices 208. The one or more processors 204 may be any type of processor and may include, but is not limited to, one or more general-purpose processors or special-purpose processors (such as dedicated processing chips). Processor 204 may, for example, be configured to perform the methods of this disclosure. Input device 206 may be any type of input device capable of inputting information to the computing device and may include, but is not limited to, a mouse, keyboard, touch screen, microphone, and / or remote controller. Output device 208 may be any type of device capable of presenting information and may include, but is not limited to, a monitor, speaker, video / audio output terminal, vibrator, and / or printer.

[0116] The computing device 200 may also include or be connected to a non-transitory storage device 214, which may be any non-transitory storage device capable of storing data, and may include, but is not limited to, disk drives, optical storage devices, solid-state storage, floppy disks, flexible disks, hard disks, magnetic tapes or any other magnetic media, compressed disks or any other optical media, cache memory and / or any other storage chip or module, and / or any other medium from which a computer may read data, instructions and / or code. The computing device 200 may also include random access memory (RAM) 210 and read-only memory (ROM) 212. ROM 212 may store executable programs, utilities, or processes in a non-volatile manner. RAM 210 provides volatile data storage and stores instructions related to the operation of the computing device 200. The computing device 200 may also include a network / bus interface 216 coupled to a data link 218. The network / bus interface 216 can be any kind of device or system capable of enabling communication with external devices and / or networks, and may include, but is not limited to, modems, network cards, infrared communication devices, wireless communication devices and / or chipsets (such as Bluetooth™ devices, 802.11 devices, WiFi devices, WiMax devices, cellular communication facilities, etc.).

[0117] This disclosure can be implemented as any combination of apparatus, system, integrated circuit, and computer program on a non-transitory computer-readable medium. One or more processors can be implemented as integrated circuits (ICs), application-specific integrated circuits (ASICs), or large-scale integrated circuits (LSIs), system LSIs, super LSIs, or ultra LSI components that perform some or all of the functions described in this disclosure.

[0118] This disclosure includes the use of software, application programs, computer programs, or algorithms. Software, application programs, computer programs, or algorithms may be stored on a non-transitory computer-readable medium to cause a computer, such as one or more processors, to perform the steps described above and in the accompanying drawings. For example, one or more memories may store the software or algorithm in executable instructions, and one or more processors may be associated with executing a set of instructions of the software or algorithm to provide various functionalities according to embodiments described in this disclosure.

[0119] Software and computer programs (also referred to as programs, software applications, applications, components, or code) include machine instructions for programmable processors and can be implemented in high-level procedural languages, object-oriented programming languages, functional programming languages, logic programming languages, assembly languages, or machine languages. The term "computer-readable medium" means any computer program product, apparatus, or device used to provide machine instructions or data to a programmable data processor, such as magnetic disks, optical disks, solid-state storage devices, memories, and programmable logic devices (PLDs), including computer-readable media that receive machine instructions as computer-readable signals.

[0120] For example, computer-readable media may include dynamic random access memory (DRAM), random access memory (RAM), read-only memory (ROM), electrically erasable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage devices, magnetic disk storage devices or other magnetic storage devices, or any other medium that can be used to carry or store required computer-readable program code in the form of instructions or data structures, and that can be accessed by a general-purpose or special-purpose computer or a general-purpose or special-purpose processor. As used herein, a disk or disc includes compact discs (CD), laser discs, optical discs, digital versatile discs (DVD), floppy disks, and Blu-ray discs, wherein a disk typically copies data magnetically, while a disc copies data optically using a laser. Combinations of the above are also included within the scope of computer-readable media.

[0121] The subject matter of this disclosure is provided as examples of apparatus, systems, methods, and programs for performing the features described herein. However, other features or variations are contemplated in addition to those described above. It is anticipated that the components and functions of this disclosure can be implemented using any emerging techniques that may replace any of the above-described implementations.

[0122] Furthermore, the above description provides examples and does not limit the scope, applicability, or configuration set forth in the claims. Changes may be made to the function and arrangement of the elements discussed without departing from the spirit and scope of this disclosure. Various processes or components may be appropriately omitted, substituted, or added in various embodiments. For example, features described with respect to certain embodiments may be combined in other embodiments.

[0123] Similarly, although the operations are depicted in a specific order in the accompanying drawings, this should not be construed as requiring the operations to be performed in the specific order shown or in sequential order, or requiring the execution of all illustrated operations to achieve the desired result. In some cases, multitasking and parallel processing can be advantageous.

Claims

1. An information system risk assessment method, comprising the following steps: Identify the various asset objects in the information system; Calculate the importance, vulnerability, and threat values ​​for each asset. Calculate the sum of the static risk values ​​of each asset to obtain the static risk value of the information system; Obtain the direction and data of asset risk transmission, and calculate the risk transmission direction coefficient; The total risk of each asset in the information system being transmitted to other related assets is calculated to obtain the dynamic risk value of the information system. as well as Calculate the overall risk value of the information system based on its static and dynamic risk values. The threat value of the asset is calculated as follows: ， Indicates the external intelligence threat score. This indicates the threat score of the expert system. This indicates a historical statistical threat score. This indicates the weight of the external intelligence threat score in the overall threat score. This indicates the weight of the expert system score in the threat value. This indicates the weight of the historical threat statistics score in the threat value; as well as, The vulnerability value of the asset is calculated as follows: ， This indicates the vulnerability detection score. Indicates the intrusion detection score. Indicates the safety compensation score, The static risk value of the asset is calculated as follows: And, calculate the static risk value of the information system as follows: For information systems The amount of internal assets, The following computing information system Domestic assets Transmitted to information system Domestic assets risk value : ， Risk transmission coefficient The calculation formula is: Covariance between for standard deviation for The standard deviation of m and n, where T is the maximum dimension between m and n. Information system Domestic assets Information systems Domestic assets The risk transmission direction coefficient, if the source address of the data is the system Domestic assets The address pointed to and the destination address of the data is the system. Domestic assets The address it points to, then the risk propagation direction coefficient =1, otherwise =1 =0, and Assets Its own risk value, in relation to the target asset The same approach applies to assets calculate : 。 2. The method according to claim 1, wherein, The importance value of the asset object is calculated as follows: ， Assets The level of confidentiality, Assets Integrity level, Assets Availability level, This indicates the weight of confidentiality in the asset's value. This indicates the weight given to completeness. This indicates the weight given to availability.

3. The method according to claim 1, wherein, The following computing information system dynamic risk value : For information systems The total number of all external assets, For information systems Domestic assets Transmitted to information system Domestic assets The risk value.

4. The method according to claim 2, wherein, The overall risk value of the information system is calculated as follows: This indicates the overall risk value of the information system.

5. An apparatus for information system risk assessment, comprising: A memory that stores instructions; as well as The processor is configured to execute instructions stored in the memory to perform the method according to any one of claims 1 to 4.

6. A computer-readable storage medium comprising computer-executable instructions, which, when executed by one or more processors, cause the one or more processors to perform the method according to any one of claims 1 to 4.

Images