Method and device for assessing data risk

Abstract

The present application discloses a method and device for assessing data risks, which can be used in the field of data code detection technology. In this method, first, the data used for internal access is scanned to obtain visitor information involving sensitive data, and / or the data used for external access is scanned to obtain interface information involving sensitive data; then, based on the visitor information involving sensitive data and / or the interface information involving sensitive data, the scope of the sensitive data code is obtained; finally, compliance risk detection is performed based on the scope of the sensitive data code, and the evaluation result is output. Thus, it is determined whether the data code has risks based on the evaluation result output by the compliance risk detection. In this way, based on the post-online code combined with the sensitive data access and flow situation, the data code can be detected and the data risk can be assessed without the need for investigation by the development team.

Description

Technical Field

[0001] The present application relates to the field of data code detection technology, and in particular to a method and device for assessing data risks. Background Art

[0002] With the development of information technology, people are paying more and more attention to data security. In order to ensure the security of data codes, the current main method is to divide the software life cycle into three stages: "security review in the design stage", "static scanning of white box code in the development stage", and "black box scanning after going online".

[0003] However, the "security review" phase relies heavily on the cooperation of developers, which is time-consuming and labor-intensive. For example, developers must complete checklists on their own. The "white-box code static scanning" phase currently only provides code inspection capabilities for basic security layers (network security and application security), but not for data security. The "post-launch black-box scanning" phase only provides results, not the causes. Only risk warnings are provided, not detailed correction points. Developers are required to independently investigate and deduce the causes based on the risk results, which reduces developer motivation and efficiency, resulting in poor correction results.

[0004] Therefore, how to assess data risks for data security, realize data code scanning, efficient automation, reduce dependence on human factors and interference in locating the scope of sensitive data codes, and perform compliance risk detection based on the scope of the sensitive data codes and output the evaluation results, is a technical problem that technical personnel in this field urgently need to solve. Summary of the Invention

[0005] In view of the above problems, the present application provides a method for assessing data risk, so as to assess data risk. The present application also provides a device for assessing data risk.

[0006] In a first aspect, an embodiment of the present application provides a method for assessing data risk, the method comprising:

[0007] Scanning data used for internal access to obtain visitor information involving sensitive data, and / or scanning data used for external access to obtain interface information involving sensitive data;

[0008] Obtaining a range of codes involving sensitive data according to the visitor information involving sensitive data and / or the interface information involving sensitive data;

[0009] Conduct compliance risk detection based on the scope of the sensitive data code and output the assessment results.

[0010] Optionally, the scope of the sensitive data code obtained according to the visitor information involving sensitive data and / or the interface information involving sensitive data includes:

[0011] When the visitor information involving sensitive data is used as input data, the IP address of the internal access to the sensitive data is located according to the visitor information involving sensitive data, the server host of the IP address is located from the IP address, the application to which the server host belongs is located from the server host, and the code of the application to which the server host belongs is located according to the application to which the server host belongs, and this is used as the scope of the code involving sensitive data;

[0012] When the interface information involving sensitive data is used as input data, the interface for external access to sensitive data is located according to the interface information involving sensitive data, the application to which the interface belongs is located from the interface, the code of the application is located from the application, and the code of the interface is located from the code of the application as the scope of the code involving sensitive data.

[0013] Optionally, the compliance risk detection is performed based on the scope of the sensitive data code, and the evaluation result is output, including:

[0014] Obtain compliance risk detection instructions based on the scope of sensitive data codes;

[0015] Parsing the compliance risk detection instruction to obtain the corresponding judgment mark;

[0016] Determine the corresponding compliance risk detection model based on the judgment identifier, make a judgment, and output the evaluation result.

[0017] Optionally, the compliance risk detection instruction includes:

[0018] One or more of the following risk detection instructions: unauthenticated risk detection instruction, sensitive data plaintext storage risk detection instruction, sensitive data not desensitized on non-client sensitive front-end pages risk detection instruction, non-client sensitive front-end pages not watermarked risk detection instruction, and log connection unified log center risk detection instruction;

[0019] The step of parsing the compliance risk detection instruction and obtaining a corresponding judgment identifier includes:

[0020] When the compliance risk detection instruction includes an unauthenticated risk detection instruction, obtaining an unauthenticated risk detection judgment identifier;

[0021] When the compliance risk detection instruction includes a sensitive data plain text writing storage risk detection instruction, obtaining a sensitive data plain text writing storage risk detection judgment flag;

[0022] When the compliance risk detection instruction includes a non-client-related sensitive front-end page sensitive data not desensitized risk detection instruction, obtaining a non-client-related sensitive front-end page sensitive data not desensitized risk detection judgment flag;

[0023] When the compliance risk detection instruction includes a non-client sensitive front-end page watermark risk detection instruction, obtaining a non-client sensitive front-end page watermark risk detection judgment flag;

[0024] When the compliance risk detection instruction includes a log connection unified log center risk detection instruction, a log connection unified log center risk detection judgment identifier is obtained.

[0025] Optionally, determining a corresponding compliance risk detection model according to the judgment identifier and performing judgment, and outputting an evaluation result, includes:

[0026] When the identifier is an unauthenticated risk detection and judgment identifier, determine whether the scope of the sensitive data code involves sensitive data and access SSO authentication. If not, perform authentication rectification;

[0027] When the identifier is a sensitive data plain text storage risk detection and judgment identifier, determine whether the code in the range of the sensitive data code involves writing into the sensitive data field in the storage system. If so, determine whether it is plain text storage. If so, perform encryption or desensitization rectification;

[0028] When the identifier is a non-client-related front-end page sensitive data unmasking risk detection judgment identifier, determine whether it is a non-client application, if so, determine whether it is a front-end display page, if so, determine whether to call static desensitization or dynamic desensitization library, if not called dynamic desensitization or static desensitization library, perform desensitization rectification before front-end display, if called dynamic desensitization, determine whether the code is associated with identity data and permission data, if not associated with identity data and permission data, perform desensitization rectification before front-end page display;

[0029] When the mark is a non-client sensitive front-end page without adding a watermark risk detection judgment mark, determine whether it is a non-client sensitive front-end page, if so, determine whether to add a watermark, if not, perform front-end watermark rectification and add a watermark;

[0030] When the identifier is a risk detection judgment identifier for log connection to a unified log center, it is determined whether the scope of the sensitive data code is connected to the unified log risk detection center and a risk detection log is generated. If not, the risk detection log is rectified.

[0031] Optionally, the method further includes:

[0032] After the correlation scan, the data is checked for risks and whether risk rectification is required. If risk rectification is required, governance is carried out and the version is iterated.

[0033] In a second aspect, an embodiment of the present application provides a device for assessing data risk, the device comprising:

[0034] A scanning unit, configured to scan data used for internal access to obtain visitor information involving sensitive data, and / or scan data used for external access to obtain interface information involving sensitive data;

[0035] a determination unit, configured to obtain a range of codes involving sensitive data based on the visitor information involving sensitive data and / or the interface information involving sensitive data;

[0036] The detection unit is used to perform compliance risk detection based on the scope of the sensitive data code and output the evaluation result.

[0037] Optionally, the device further includes:

[0038] The update unit is used to perform compliance risk detection based on the scope of the sensitive data code, output the evaluation results, and determine whether risk rectification is required.

[0039] Optionally, the determining unit is specifically configured to:

[0040] When the visitor information involving sensitive data is used as input data, the IP address of the internal access to the sensitive data is located according to the visitor information involving sensitive data, the server host of the IP address is located from the IP address, the application to which the server host belongs is located from the server host, and the code of the application to which the server host belongs is located according to the application to which the server host belongs, and this is used as the scope of the code involving sensitive data;

[0041] When the interface information involving sensitive data is used as input data, the interface for external access to sensitive data is located according to the interface information involving sensitive data, the application to which the interface belongs is located from the interface, the code of the application is located from the application, and the code of the interface is located from the code of the application as the scope of the code involving sensitive data.

[0042] Optionally, the detection unit is specifically used to:

[0043] Obtain compliance risk detection instructions based on the scope of sensitive data codes;

[0044] Parsing the compliance risk detection instruction to obtain the corresponding judgment mark;

[0045] Determine the corresponding compliance risk detection model based on the judgment identifier, make a judgment, and output the evaluation result.

[0046] Compared with the existing technology, this application has the following beneficial effects:

[0047] An embodiment of the present application provides a method for assessing data risks. When executing the method, first, the data used for internal access is scanned to obtain visitor information involving sensitive data, and / or the data used for external access is scanned to obtain interface information involving sensitive data; then, based on the visitor information involving sensitive data and / or the interface information involving sensitive data, the scope of the sensitive data code is obtained; finally, compliance risk detection is performed based on the scope of the sensitive data code, and the evaluation result is output. Thus, it is determined whether the data code has risks based on the evaluation result output by the compliance risk detection. In this way, based on the post-online code combined with the sensitive data access and flow situation, the data code can be detected and the data risk can be assessed without the need for investigation by the development team. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in this embodiment or the prior art, the following briefly introduces the drawings required for use in the embodiment or the prior art description. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0049] Figure 1 A flowchart of a method for assessing data risk provided in an embodiment of the present application;

[0050] Figure 2 A flowchart of the process of obtaining the scope of the sensitive data code in an embodiment of the present application;

[0051] Figure 3 A flowchart of performing compliance risk detection based on the scope of the sensitive data code in an embodiment of the present application and outputting an assessment result;

[0052] Figure 4 A schematic diagram of the structure of a data risk assessment device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] The following will be combined with the accompanying drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments of this application, all other embodiments obtained by ordinary technicians in this field without making any creative work are within the scope of protection of this application.

[0054] It should be noted that the method and device for assessing data risk provided by this application are used in the field of data code detection technology. The above is only an example and does not limit the application field of the method and device provided by this application.

[0055] See also Figure 1 , which is a flow chart of a method for assessing data risk provided by an embodiment of the present application, and the method includes the following steps:

[0056] S101: Scan data used for internal access to obtain visitor information related to sensitive data, and / or scan data used for external access to obtain interface information related to sensitive data.

[0057] In an embodiment of the present application, data used for internal access and data used for external access are scanned separately. In the process of scanning the data used for internal access, the information of which IP accessed the sensitive data and when is recorded as visitor information; in the process of scanning the data used for external access, the information of which external interface accessed the sensitive data and when is recorded as interface information.

[0058] The step of obtaining visitor information includes the following steps:

[0059] Scan access logs stored in database logs and other storages based on the data classification and grading information library to obtain which fields in the data table a certain IP has accessed.

[0060] Further correlation of the data classification and grading identification results determines that the fields accessed by this IP contain sensitive fields and determines that further correlation is required. The data classification and grading information library is the result of the identification of stored sensitive data to indicate which fields are sensitive fields.

[0061] The step of obtaining the interface information includes the following steps:

[0062] a) Scan and locate the outbound interface involving sensitive data in the external Internet egress traffic, and record the interface information. The scanning and locating shall scan and locate the sensitive data accessed from the inside to the outside and / or the sensitive data collected from the outside to the inside.

[0063] S102: Obtain a range of codes involving sensitive data according to the visitor information involving sensitive data and / or the interface information involving sensitive data.

[0064] In the embodiment of the present application, the visitor information and interface information involving sensitive data are further code scanned and located, accurately to the scope of the code involving sensitive data.

[0065] One possible way is as follows:

[0066] When the visitor information involving sensitive data is used as input data, the following steps are included:

[0067] a) Based on the IP address of the internal access sensitive data, the CMDB (asset configuration information base) is associated to find out which server host the IP address is assigned to.

[0068] b) Query the corresponding business application from the CMDB database according to the server host.

[0069] c) Locate the code library ID of the application and the scope of the code involving sensitive data based on the company code library query.

[0070] When the interface information involving sensitive data is used as input data, the following steps are included:

[0071] a) Based on the interface information of the interface for accessing sensitive data involving external parties, the CMDB (asset configuration database) is associated to query the application to which the interface belongs.

[0072] b) Locate the code library ID of the application and the code of related applications based on the company code library query.

[0073] c) Based on the obtained interface name and other relevant information, further locate the code of the interface from the code of the related application, and use this as the scope of the code involving sensitive data.

[0074] S103: Perform compliance risk detection based on the scope of the sensitive data code and output the evaluation result.

[0075] In the process of executing the above steps, first, according to the scope of the sensitive data code, the compliance risk detection instruction is obtained; the compliance risk detection instruction is parsed to obtain the corresponding judgment identifier; then the corresponding compliance risk detection model is determined and judged according to the judgment identifier, and the verification result and the evaluation result are output.

[0076] In an embodiment of the present application, a corresponding compliance risk detection instruction is obtained based on the scope of the sensitive data code; the compliance risk detection instruction is parsed to obtain a corresponding judgment identifier; in the process of obtaining the corresponding judgment identifier, one or more corresponding judgment identifiers may be obtained at the same time, and then the corresponding compliance risk detection model is determined and judged based on the judgment identifier, wherein one or more judgments may be performed at the same time, and finally the evaluation result is output.

[0077] See also Figure 2 as well as Figure 3, is another method flow chart of the data risk assessment method provided in the embodiment of the present application, wherein, Figure 2 This is a flowchart of the process of obtaining the scope of sensitive data codes in an embodiment of the present application. Figure 3 This is a flowchart of performing compliance risk detection based on the scope of the sensitive data code in an embodiment of the present application and outputting an assessment result. The method includes:

[0078] A) Obtaining a range of codes involving sensitive data based on the visitor information involving sensitive data and / or the interface information involving sensitive data:

[0079] A01a: Scan the data used for internal access and obtain visitor information involving sensitive data as input data.

[0080] A01b: Scan the data used for external access and obtain interface information involving sensitive data as input data.

[0081] A02a: Locate the IP address that accesses the sensitive data internally based on the visitor information involving the sensitive data.

[0082] A02b: Locate the interface for external access to sensitive data based on the interface information involving sensitive data.

[0083] A03a: Locate the server host of the IP according to the IP.

[0084] A03b: Locate the application of the interface according to the interface.

[0085] A04a: Locate the application to which the server host belongs according to the server host.

[0086] A04b: Locate the code of the application according to the application.

[0087] A05a: Locate the code of the application as a range of codes involving sensitive data based on the application.

[0088] A05b: The application code is located in the interface code as the scope of the code involving sensitive data.

[0089] A06: Output the range of the sensitive data code.

[0090] See also Figure 3 , which is a flowchart of performing compliance risk detection based on the scope of the sensitive data code and outputting the evaluation results in an embodiment of the present application.

[0091] Conduct compliance risk detection based on the scope of the sensitive data code and output the assessment results:

[0092] B1: Obtain unauthenticated risk detection instructions based on the scope of the code involving sensitive data.

[0093] After executing the above steps, the corresponding judgment identifier can be obtained according to the detection instruction.

[0094] B2: Obtain an unauthorized risk detection judgment identifier according to the unauthorized risk detection instruction.

[0095] After executing the above steps, the judgment process may be entered for judgment according to the type of the judgment identifier.

[0096] B3: Perform unauthenticated judgment.

[0097] B3a: Based on the identification of unauthorized risk detection and judgment, determine whether the scope of the sensitive data code is connected to SSO authentication (login system authentication). If so, mark it as no risk and enter step B4 for judgment. If not, mark it as risk.

[0098] For the scope of codes involving sensitive data, determine whether they are included in the list (or database) of applications (or interfaces) that have been connected to the SSO authentication center, so as to determine whether there is an SSO authentication risk.

[0099] B4: Assess the risk of sensitive data being written to storage in plain text.

[0100] B4a: Determine whether the code in the range of the sensitive data code involves writing to the sensitive data field in the storage system. If not, mark it as no risk. If so, determine whether it is plain text storage. If it is plain text storage, mark it as risk. If not, mark it as no risk. If no sensitive operation is involved or plain text storage is not performed after determining that sensitive operation is involved, proceed to step B5 for judgment.

[0101] The storage system includes a database, a file system, etc. When writing to the storage, the data is not encrypted or desensitized, that is, it is stored in plain text.

[0102] B5: Conduct risk assessment on non-client sensitive front-end pages where sensitive data is not desensitized.

[0103] B5a: Determine whether it is client application code. If so, mark it as not risky. If not, proceed to step B5b for further determination.

[0104] B5b: Determine whether it is the front-end display page code. If not, mark it as no risk. If it is, proceed to step B5c for judgment.

[0105] B5c: Determine whether the static desensitization or dynamic desensitization library is called in the code. If so, proceed to step B5d for judgment. Otherwise, mark it as a risk.

[0106] B5d: Determine whether static desensitization is called. If so, mark it as not risky. Otherwise, proceed to step B5e for judgment.

[0107] B5e: Determine whether dynamic desensitization is called. If so, determine whether identity data and permission data are dynamically associated. If so, mark it as not risky; otherwise, mark it as risky.

[0108] B6: Conduct risk assessment on non-client sensitive front-end pages that do not have watermarks added.

[0109] B6a: Determine whether it is a non-client front-end display page code. If so, proceed to step B6b for determination.

[0110] B6b: Determine whether it is a non-client sensitive display page and whether to add a watermark. If not, mark it as risky.

[0111] B7: Access the unified log risk detection center for judgment.

[0112] B7a: Determine whether the codes in the scope of the sensitive data code are connected to the unified log risk detection center. If not, mark it as risky; if so, mark it as not risky.

[0113] In this embodiment, after performing steps B1-B7, the following steps should also be included:

[0114] B8: Determine whether the mark indicates a risk. If the mark indicates no risk, output the assessment result. If the mark indicates a risk, perform risk rectification on the risk and then output the assessment result.

[0115] The compliance risk detection instructions include:

[0116] One or more of the following risk detection instructions: unauthenticated risk detection instruction, sensitive data written in plain text to storage risk detection instruction, sensitive data not desensitized on non-client sensitive front-end pages risk detection instruction, non-client sensitive front-end pages not adding watermarks risk detection instruction, and log docking unified log center risk detection instruction.

[0117] The step of parsing the compliance risk detection instruction and obtaining a corresponding judgment identifier includes:

[0118] When the compliance risk detection instruction includes an unauthenticated risk detection instruction, an unauthenticated risk detection judgment identifier is obtained.

[0119] When the compliance risk detection instruction includes a sensitive data plain text writing storage risk detection instruction, a sensitive data plain text writing storage risk detection judgment identifier is obtained.

[0120] When the compliance risk detection instruction includes a non-client-related sensitive front-end page sensitive data not desensitized risk detection instruction, a non-client-related sensitive front-end page sensitive data not desensitized risk detection judgment identifier is obtained.

[0121] When the compliance risk detection instruction includes a non-client sensitive front-end page no watermark risk detection instruction, a non-client sensitive front-end page no watermark risk detection judgment flag is obtained.

[0122] When the compliance risk detection instruction includes a log connection unified log center risk detection instruction, a log connection unified log center risk detection judgment identifier is obtained.

[0123] It should be noted that, as an example, in an embodiment of the present application, the scope of the sensitive data code is obtained based on the visitor information involving sensitive data and / or the interface information involving sensitive data, and compliance risk detection is performed based on the scope of the sensitive data code, and the evaluation result is output. This embodiment is just one of the cases, but is not limited to the above-mentioned case. It is also possible to obtain one or more compliance risk detection instructions at the same time based on the scope of the sensitive data code, and then obtain the corresponding judgment identifier based on the compliance risk detection instruction, determine the corresponding compliance risk detection model based on the judgment identifier and perform judgment, and finally output the verification result and the evaluation result.

[0124] See also Figure 4 , this figure is a schematic diagram of the structure of a data risk assessment device provided in an embodiment of the present application, and the device includes: a scanning unit 401, a determination unit 402, and a detection unit 403.

[0125] The scanning unit 401 is used to scan data used for internal access to obtain visitor information related to sensitive data, and / or to scan data used for external access to obtain interface information related to sensitive data.

[0126] In the data risk assessment device provided in the present application, the scanning unit 401 is specifically used to scan internally accessed data and externally accessed data, and respectively obtain visitor information involving sensitive data and interface information involving sensitive data.

[0127] The determining unit 402 is configured to obtain a range of codes involving sensitive data according to the visitor information involving sensitive data and / or the interface information involving sensitive data.

[0128] The data risk assessment device provided in the present application, the determination unit 402 is specifically used to: when the visitor information involving sensitive data is used as input data, locate the IP for internal access to sensitive data according to the visitor information involving sensitive data, locate the server host of the IP from the IP, locate the application to which the server host belongs from the server host, and locate the code of the application according to the application as the scope of the code involving sensitive data; when the interface information involving sensitive data is used as input data, locate the interface for external access to sensitive data according to the interface information involving sensitive data, locate the application to which the interface belongs from the interface, locate the code of the application from the application, and locate the code of the interface from the application as the scope of the code involving sensitive data.

[0129] The detection unit 403 is configured to perform compliance risk detection based on the scope of the sensitive data code and output an assessment result.

[0130] The data risk assessment device provided in this application, the detection unit 403 is specifically used to: obtain compliance risk detection instructions based on the scope of sensitive data codes; parse the compliance risk detection instructions to obtain corresponding judgment identifiers; determine the corresponding compliance risk detection model based on the judgment identifier and make a judgment, and output the assessment results.

[0131] In one possible implementation, the visitor information involving sensitive data obtained by the scanning unit 401 is input into the determination unit 402. The determination unit 402 scans and associates the data accessed by the visitor information involving sensitive data, determines the IP address of the sensitive data, further determines the server host of the visitor information involving sensitive data and the application to which it belongs, and finally determines the scope of the code involving sensitive data.

[0132] The interface information involving sensitive data obtained after scanning by the scanning unit 401 is input into the determination unit, and the determination unit scans and associates the external Internet port traffic data of the interface information involving sensitive data, determines the interface of the sensitive data field, further determines the application to which the interface information involving sensitive data belongs, and finally determines the scope of the sensitive data code.

[0133] In a possible implementation, the detection unit 403 includes the following submodules: an instruction acquisition module, an identification acquisition module, a judgment module, and an evaluation result output module.

[0134] The instruction acquisition module is used to obtain different instructions according to the range of the sensitive data code and execute subsequent different judgment steps.

[0135] The identification acquisition module corresponds to the relevant instructions and is used to correspond to different judgment modules.

[0136] The judgment module performs corresponding compliance risk detection and judgment.

[0137] The evaluation result output module is used to output the evaluation results.

[0138] Each instruction in the instruction acquisition module has a corresponding identifier in the identifier acquisition module, and each identifier in the identifier acquisition module also has a corresponding judgment process in the judgment module. After the judgment process is finally executed, the judgment result is transmitted to the evaluation result output module for output of the evaluation result.

[0139] In addition to the above units, the device also includes:

[0140] The updating unit 404 is used to rectify and update the sensitive data-related codes that are assessed to be at risk.

[0141] The data risk assessment device provided in this application performs scanning based on the access and flow of sensitive data. It does not require manual investigation and can locate the existing data code security risks through scanning of each unit, and finally output the assessment results.

[0142] The "first" and "second" in the names such as "first" and "second" (if any) mentioned in the embodiments of this application are only used as name identifiers and do not represent the first or second in order.

[0143] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and system embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments. The device and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components indicated as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. A person of ordinary skill in the art can understand and implement it without expending creative work.

[0144] Each embodiment in this specification is described in a progressive manner. The same or similar parts between the embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple. For the relevant parts, refer to the partial description of the method embodiment. Some or all of the modules can be selected according to actual needs to achieve the purpose of the embodiment scheme. Ordinary technicians in this field can understand and implement it without making any creative work.

[0145] The above is a detailed introduction to the method and device for assessing data risks provided by this application. This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above examples is only used to help understand the method and core ideas of this application. It should be pointed out that for ordinary technicians in this technical field, without departing from the principles of this application, several improvements and modifications can be made to this application, and these improvements and modifications also fall within the scope of protection of the claims of this application.

Claims

1. A method for assessing data risk, characterized in that: The method comprises: Scanning data used for internal access to obtain visitor information involving sensitive data, and / or scanning data used for external access to obtain interface information involving sensitive data; Obtaining a range of codes involving sensitive data according to the visitor information involving sensitive data and / or the interface information involving sensitive data; Conduct compliance risk detection based on the scope of the sensitive data code and output the assessment results; According to the visitor information involving sensitive data and / or the interface information involving sensitive data, the scope of the sensitive data code obtained includes: When the visitor information involving sensitive data is used as input data, the IP address of the internal access to the sensitive data is located according to the visitor information involving sensitive data, the server host of the IP address is located from the IP address, the application to which the server host belongs is located from the server host, and the code of the application to which the server host belongs is located according to the application to which the server host belongs, and this is used as the scope of the code involving sensitive data; When the interface information involving sensitive data is used as input data, the interface for external access to sensitive data is located according to the interface information involving sensitive data, the application to which the interface belongs is located from the interface, the application code is located from the application, and the code of the interface is located from the application code as the scope of the code involving sensitive data; The compliance risk detection is performed based on the scope of the sensitive data code, and the evaluation results are output, including: Obtain compliance risk detection instructions based on the scope of sensitive data codes; Parsing the compliance risk detection instruction to obtain the corresponding judgment mark; Determine the corresponding compliance risk detection model based on the judgment identifier, make a judgment, and output the evaluation result; The compliance risk detection instructions include: One or more of the following risk detection instructions: unauthenticated risk detection instruction, sensitive data written in plain text to storage risk detection instruction, sensitive data not desensitized on non-client sensitive front-end pages risk detection instruction, non-client sensitive front-end pages not adding watermarks risk detection instruction, and log docking unified log center risk detection instruction.

2. The method according to claim 1, characterized in that The step of parsing the compliance risk detection instruction and obtaining a corresponding judgment identifier includes: When the compliance risk detection instruction includes an unauthenticated risk detection instruction, obtaining an unauthenticated risk detection judgment identifier; When the compliance risk detection instruction includes a sensitive data plain text writing storage risk detection instruction, obtaining a sensitive data plain text writing storage risk detection judgment flag; When the compliance risk detection instruction includes a non-client-related sensitive front-end page sensitive data not desensitized risk detection instruction, obtaining a non-client-related sensitive front-end page sensitive data not desensitized risk detection judgment flag; When the compliance risk detection instruction includes a non-client sensitive front-end page not adding a watermark risk detection instruction, obtaining a non-client sensitive front-end page not adding a watermark risk detection judgment flag; When the compliance risk detection instruction includes a log connection unified log center risk detection instruction, a log connection unified log center risk detection judgment identifier is obtained.

3. The method according to claim 1, characterized in that Determining the corresponding compliance risk detection model according to the judgment identifier and performing judgment, and outputting the evaluation result, includes: When the identifier is an unauthenticated risk detection and judgment identifier, determine whether the scope of the sensitive data code involves sensitive data and access SSO authentication. If not, perform authentication rectification; When the identifier is a sensitive data plain text storage risk detection and judgment identifier, determine whether the code in the range of the sensitive data code involves writing into the sensitive data field in the storage system. If so, determine whether it is plain text storage. If so, perform encryption or desensitization rectification; When the identifier is a non-client-related front-end page sensitive data unmasking risk detection judgment identifier, determine whether it is a non-client application, if so, determine whether it is a front-end display page, if so, determine whether to call static desensitization or dynamic desensitization library, if not called dynamic desensitization or static desensitization library, perform desensitization rectification before front-end display, if called dynamic desensitization, determine whether the code is associated with identity data and permission data, if not associated with identity data and permission data, perform desensitization rectification before front-end page display; When the mark is a non-client sensitive front-end page without adding a watermark risk detection judgment mark, determine whether it is a non-client sensitive front-end page, if so, determine whether to add a watermark, if not, perform front-end watermark rectification and add a watermark; When the identifier is a risk detection judgment identifier for log connection to a unified log center, it is determined whether the scope of the sensitive data code is connected to the unified log risk detection center and a risk detection log is generated. If not, the risk detection log is rectified.

4. The method according to claim 1, wherein The method further includes: After the correlation scan, the data is checked for risks and whether risk rectification is required. If risk rectification is required, governance is carried out and the version is iterated.

5. A device for assessing data risk, characterized in that: The device comprises: A scanning unit, configured to scan data used for internal access to obtain visitor information involving sensitive data, and / or scan data used for external access to obtain interface information involving sensitive data; a determination unit, configured to obtain a range of codes involving sensitive data based on the visitor information involving sensitive data and / or the interface information involving sensitive data; A detection unit, configured to perform compliance risk detection based on the scope of the sensitive data code and output an assessment result; According to the visitor information involving sensitive data and / or the interface information involving sensitive data, the scope of the sensitive data code obtained includes: When the visitor information involving sensitive data is used as input data, the IP address of the internal access to the sensitive data is located according to the visitor information involving sensitive data, the server host of the IP address is located from the IP address, the application to which the server host belongs is located from the server host, and the code of the application to which the server host belongs is located according to the application to which the server host belongs, and this is used as the scope of the code involving sensitive data; When the interface information involving sensitive data is used as input data, the interface for external access to sensitive data is located according to the interface information involving sensitive data, the application to which the interface belongs is located from the interface, the application code is located from the application, and the code of the interface is located from the application code as the scope of the code involving sensitive data; The compliance risk detection is performed based on the scope of the sensitive data code, and the evaluation results are output, including: Obtain compliance risk detection instructions based on the scope of sensitive data codes; Parsing the compliance risk detection instruction to obtain the corresponding judgment mark; Determine the corresponding compliance risk detection model based on the judgment identifier, make a judgment, and output the evaluation result; The compliance risk detection instructions include: One or more of the following risk detection instructions: unauthenticated risk detection instruction, sensitive data written in plain text to storage risk detection instruction, sensitive data not desensitized on non-client sensitive front-end pages risk detection instruction, non-client sensitive front-end pages not adding watermarks risk detection instruction, and log docking unified log center risk detection instruction.

6. The device according to claim 5, characterized in that The device further comprises: The update unit is used to perform compliance risk detection based on the scope of the sensitive data code, output the evaluation results, and determine whether risk rectification is required.

Images