Network security operation method, system, platform and storage medium

Abstract

A network security operation method, system, platform and storage medium are disclosed. The network security operation system includes a red team work order module, a blue team work order module, a yellow team work order module and an equipment manufacturer work order module. The red team work order module is used to generate a vulnerability scanning work order, a penetration test work order or a vulnerability retest work order, and send the work order to the corresponding red team processing personnel or network security equipment. The blue team work order module is used to generate an asset combing work order, a security alarm work order or a security incident work order, and send the work order to the corresponding blue team processing personnel. The yellow team work order module is used to generate a vulnerability repair work order, an incident handling work order or a security reinforcement work order, and send the work order to the corresponding yellow team processing personnel. The above-mentioned operation system can solve the efficiency problem of collaboration between teams and between members within the team, greatly improve the collaboration efficiency, and ensure data security.

Description

Background Art

[0002] At present, in the process of network security operation, multiple technical teams such as the red team, blue team, yellow team and third-party security manufacturers usually collaborate. Among them, the red team is mainly responsible for discovering security problems in the enterprise through attacks from the perspective of network attackers. As the network security defender of the enterprise, the blue team uses security equipment to monitor and filter attack traffic, identify and intercept potential threats, and cooperate with the yellow team to take corresponding measures to isolate or remove security incidents when security incidents occur. The yellow team is composed of network administrators, system administrators, database administrators and other operation and maintenance personnel. They are mainly responsible for the daily operation and maintenance of the company's network, system and other software and hardware assets. In network security operations, they cooperate with the red team to repair discovered vulnerabilities, strengthen the security baseline of the equipment, and cooperate with the blue team to deal with discovered attacks. When third-party equipment and service manufacturers are notified of vulnerabilities in their products, they will deploy original factory resources to repair vulnerabilities, and cooperate to optimize configuration when there are problems with the configuration of security equipment.

[0003] During the collaboration process, each of the above teams can only form a report of the work results of each team in the form of an electronic document, and then send the electronic file to the corresponding collaborating party. The parties cannot integrate, synchronize and aggregate information, resulting in a large amount of collaborative communication and audit costs being wasted in the current security operation process, low collaborative efficiency, and potential security risks such as data tampering and data leakage during file transmission. For example, in a specific implementation scenario, after the red team has scanned a large number of assets through a vulnerability scanner, the result data of a large number of assets in the scanner can only be exported and sorted in the form of electronic files and sent to the yellow team or a third-party security manufacturer for repair. Whether to repair, when to repair, whether to synchronize the closed loop to the red team, whether the red team has conducted a retest, and whether to confirm whether the repair is completed after the retest. When detecting attacks, the blue team does not have a good channel to know or query which vulnerabilities have been newly discovered in the current assets, which vulnerabilities already exist, and when which existing vulnerabilities have been repaired. There are a lot of team collaboration, data synchronization, data aggregation, data auditing, behavior auditing and other actions in the entire security collaboration process, which greatly wastes manpower and material resources. For example, if the blue team finds that a certain attack is not successfully intercepted by security equipment, a third-party security manufacturer needs to repair or optimize the security strategy. When the third-party security manufacturer optimizes, whether the optimization has been completed, whether the red team is notified to retest after optimization, and what the results of the retest are, all require a lot of communication and data collation to know. In addition, enterprise managers cannot better understand and count the work status and workload of each team in the process of network security operations.

[0004] In the above examples, the collaboration within and between teams basically relies on electronic documents to synchronize information and records. It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute prior art known to ordinary technicians in the field. Summary of the invention

[0005] The present disclosure aims to provide a method for overcoming, at least to some extent, one or more problems caused by limitations and disadvantages of the related art.

[0006] According to a first aspect of an embodiment of the present disclosure, a network security operation system is provided, including:

[0007] A red team work order module, which is used to generate a vulnerability scanning work order, a penetration testing work order or a vulnerability retesting work order based on corresponding operations or data interaction with network security devices, and send the work order to the corresponding red team processing personnel or network security devices;

[0008] The blue team work order module is used to generate asset sorting work orders, security alarm work orders or security incident work orders based on corresponding operations or data interactions with network security devices, and send the work orders to the corresponding blue team processing personnel;

[0009] A yellow team work order module, which is used to generate a vulnerability repair work order, an incident handling work order, or a security reinforcement work order based on corresponding operations or data interaction with network security devices, and send the work order to the corresponding yellow team processing personnel; and

[0010] The equipment manufacturer work order module is used to generate equipment upgrade work orders and security policy optimization work orders based on corresponding operations or data interactions with network security devices, and send the work orders to the corresponding equipment manufacturer processing personnel.

[0011] In an exemplary embodiment of the present disclosure, the red team work order module is used to:

[0012] In response to the red team member's scanning task issuance operation, a vulnerability scanning work order is generated, the corresponding asset parameters in the asset module are called according to the vulnerability scanning work order, vulnerability scanning parameters are generated, and the vulnerability scanner is triggered to execute the corresponding vulnerability scanning task based on the vulnerability scanning parameters;

[0013] In response to the penetration test issuing operation of the red team personnel, the corresponding asset parameters are called from the asset module, a penetration test work order is generated, and the penetration test work order is sent to the red team processing personnel;

[0014] In response to the completion of the vulnerability repair task by the yellow team handler, a vulnerability retesting work order is generated and sent to the red team handler.

[0015] In an exemplary embodiment of the present disclosure, the red team work order module further includes:

[0016] Call vulnerability information in the threat intelligence module;

[0017] Matching the vulnerability information with the asset parameters in the asset module to obtain a matching result;

[0018] A penetration test work order is generated based on the matching result, and the vulnerability retest work order is sent to the corresponding red team processing personnel.

[0019] In an exemplary embodiment of the present disclosure, the blue team work order module is used to:

[0020] In response to the asset update operation, an asset combing work order is generated, and the asset combing work order is sent to a blue team processing personnel;

[0021] Call the alarm information in the security alarm module, generate a security alarm work order, and send the security alarm work order to the blue team processing personnel;

[0022] In response to the event triggering action of the security alert module, a security event work ticket is generated and sent to the blue team processing personnel.

[0023] In an exemplary embodiment of the present disclosure, the yellow team work order module is used to:

[0024] In response to the completion of the vulnerability scanner scanning task and / or the completion of the red team handler's penetration testing task, a vulnerability repair work order is generated, and the vulnerability repair work order is sent to the yellow team handler;

[0025] In response to the confirmation of the security incident work order by the blue team processing personnel, an incident handling work order is generated and the incident handling work order is sent to the yellow team processing personnel;

[0026] In response to the confirmation of the security alert work order by the blue team processing personnel, a security reinforcement work order is generated and sent to the yellow team processing personnel.

[0027] In an exemplary embodiment of the present disclosure, the equipment manufacturer work order module is used to:

[0028] In response to the Yellow Team processing personnel's operation of repairing the vulnerability of the software and hardware equipment or the operation of upgrading and converting the security reinforcement work order, generating a device upgrade work order;

[0029] In response to the optimization conversion operation of the yellow team processing personnel on the security reinforcement work order, a security policy optimization work order is generated.

[0030] In an exemplary embodiment of the present disclosure, a vulnerability management module is further included, and the vulnerability management module is used to: update the risk items in the asset module and generate a vulnerability management log after performing any of the following operations: in response to the completion of a vulnerability scanner scanning task, obtain vulnerability scanning results, in response to the completion of a red team processing personnel's penetration testing task, obtain penetration testing results, and in response to the completion of a red team processing personnel's vulnerability retesting task, obtain vulnerability retesting results;

[0031] And / or, it also includes: a performance management module and a task cycle management module, the performance management module is used to obtain the completion status of each work order task, and perform performance statistics for the red team processing personnel, the yellow team processing personnel, the blue team processing personnel or the equipment manufacturer personnel according to the completion status.

[0032] According to a second aspect of an embodiment of the present disclosure, a network security operation platform is provided, comprising: an asset module, a vulnerability scanner, a threat intelligence module, a security alarm module, and a network security operation system as described in any one of the above items, wherein:

[0033] The asset module is used to store asset information;

[0034] The vulnerability scanner is used to repair vulnerabilities based on vulnerability scanning work orders;

[0035] The threat intelligence module is used to provide threat intelligence for network security devices;

[0036] The security alarm module is used to provide security alarm information of network security devices.

[0037] According to a third aspect of an embodiment of the present disclosure, a network security operation method is provided, including:

[0038] In response to the red team processing personnel's scanning task issuance operation, a vulnerability scanning work order is generated, the corresponding asset parameters in the asset module are called according to the vulnerability scanning work order, vulnerability scanning parameters are generated, and the vulnerability scanner is triggered to execute the corresponding vulnerability scanning task based on the vulnerability scanning parameters;

[0039] In response to the penetration test issuing operation of the red team processing personnel, the corresponding asset parameters are called from the asset module, a penetration test work order is generated, and the penetration test work order is sent to the red team processing personnel;

[0040] In response to the completion of the vulnerability repair task by the yellow team processing personnel, a vulnerability retesting work order is generated, and the vulnerability retesting work order is sent to the red team processing personnel;

[0041] In response to the asset update operation, an asset combing work order is generated, and the asset combing work order is sent to a blue team processing personnel;

[0042] Call the alarm information in the security alarm module, generate a security alarm work order, and send the security alarm work order to the blue team processing personnel;

[0043] In response to the event triggering action of the security alarm module, a security incident work order is generated, and the security incident work order is sent to the blue team processing personnel;

[0044] In response to the completion of the vulnerability scanner scanning task and / or the completion of the red team handler's penetration testing task, a vulnerability repair work order is generated, and the vulnerability repair work order is sent to the yellow team handler;

[0045] In response to the confirmation of the security incident work order by the blue team processing personnel, an incident handling work order is generated, and the incident handling work order is sent to the yellow team processing personnel;

[0046] In response to the confirmation of the security warning work order by the blue team processing personnel, a security reinforcement work order is generated, and the security reinforcement work order is sent to the yellow team processing personnel;

[0047] In response to the Yellow Team's processing personnel's operation of repairing the vulnerability of the software and hardware equipment or the upgrade and conversion operation of the security reinforcement work order, a device upgrade work order is generated, and the device upgrade work order is sent to the equipment manufacturer's processing personnel;

[0048] In response to the optimization and conversion operation of the yellow team processing personnel on the security reinforcement work order, a security policy optimization work order is generated, and the security policy optimization is sent to the equipment manufacturer processing personnel.

[0049] According to a fourth aspect of an embodiment of the present disclosure, there is provided a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the network security operation method as described above is implemented.

[0050] The technical effects of the network security operation method, system, platform and storage medium in the embodiments of the present disclosure are:

[0051] The network security operation system provided by the present disclosure generates corresponding security service work orders through the red team work order module, the yellow team work order module, the blue team work order module and the equipment manufacturer module, including vulnerability scanning, penetration testing, asset sorting, security alerts, security incident handling, security reinforcement, etc., and sends the corresponding work orders to the corresponding personnel or network security equipment for processing, so that network operators of various roles can quickly start various network security service tasks. The red team, the yellow team, the blue team and the equipment manufacturer personnel do not need to interact and audit complex electronic files, which greatly improves the collaborative efficiency of security operations, realizes the closed loop of the workflow well, and can effectively avoid data tampering, data leakage and other security risks during file transmission.

[0052] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0054] Figure 1 A block diagram of a network security operation platform in an exemplary embodiment of the present disclosure is schematically shown.

[0055] Figure 2 A block diagram of a network security operation system in an exemplary embodiment of the present disclosure is schematically shown.

[0056] Figure 3 The following schematically shows a flow chart of a network security operation method in an exemplary embodiment of the present disclosure.

[0057] Figure 4 A block diagram schematically shows an electronic device in an exemplary embodiment of the present disclosure.

[0058] Figure 5 A block diagram schematically shows an electronic device in an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0059] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as being limited to the examples set forth herein; on the contrary, these embodiments are provided so that the present disclosure will be more comprehensive and complete, and the concepts of the example embodiments are fully conveyed to those skilled in the art. The described features, structures, or characteristics may be combined in one or more embodiments in any suitable manner. In the following description, many specific details are provided to provide a full understanding of the embodiments of the present disclosure. However, those skilled in the art will appreciate that the technical solutions of the present disclosure may be practiced while omitting one or more of the specific details, or other methods, components, devices, steps, etc. may be adopted. In other cases, known technical solutions are not shown or described in detail to avoid obscuring various aspects of the present disclosure.

[0060] In addition, the accompanying drawings are only schematic diagrams of the present disclosure, and the same reference numerals in the drawings represent the same or similar parts, so their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities, which do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0061] The exemplary embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0062] Figure 1 The block diagram of the network security operation platform of the exemplary embodiment of the present disclosure is schematically shown. Figure 1 A network security operation platform 100 includes: an asset module 110, a vulnerability scanner 120, a threat intelligence module 130, a security alarm module 140, and a network security operation system 150. The network security operation system 150 interacts with the asset module 110, the vulnerability scanner 120, the threat intelligence module 130, and the security alarm module 140 respectively, for example, data interaction with each module can be achieved through an API interface, or data interaction can be performed through IP or port parameters.

[0063] In an exemplary embodiment of the present disclosure, the asset module 110 is used to store various asset information. Asset information may include, for example, asset parameters, risk items, tags, etc. Asset parameters may include: external network open domain name, IP, port, service version, operating system version, etc. The asset module 110 may have a visual display interface so that the operator can promptly obtain information about various asset situations. The vulnerability scanner 120 is used to perform vulnerability scanning based on vulnerability scanning work orders. The vulnerability scanner can scan the open ports, misconfigurations and vulnerabilities of the device. The threat intelligence module 130 is used to provide threat intelligence for network security devices. The threat intelligence module helps to discover information security about companies, employees, IT assets and other credentials or sensitive data that can be exploited by attackers. The security alarm module 140 is used to provide security alarm information for network security devices. When a security device detects an attack attempt from the outside or inside, an alarm is triggered to form a security alarm log.

[0064] It is understandable that the vulnerability scanner 120, the threat intelligence module 130 and the security alert module 140 can all be implemented through existing tools, such as the OpenVAS vulnerability scanner, etc., and the present disclosure will not elaborate on them here.

[0065] Figure 2 The block diagram of the network security operation system 150 of the exemplary embodiment of the present disclosure is schematically shown. Figure 2, a network security operation system 150, comprising:

[0066] The red team work order module 210 is used to generate a vulnerability scanning work order, a penetration testing work order or a vulnerability retesting work order based on corresponding operations or data interaction with network security devices, and send the work order to the corresponding red team processing personnel or network security devices;

[0067] A blue team work order module 220 is used to generate an asset sorting work order, a security alarm work order or a security incident work order based on corresponding operations or data interaction with network security devices, and send the work order to the corresponding blue team processing personnel;

[0068] The yellow team work order module 230 is used to generate a vulnerability repair work order, an incident handling work order or a security reinforcement work order based on corresponding operations or data interaction with network security devices, and send the work order to the corresponding yellow team processing personnel; and

[0069] The equipment manufacturer work order module 240 is used to generate equipment upgrade work orders and security policy optimization work orders based on corresponding operations or data interactions with network security devices, and send the work orders to corresponding equipment manufacturer processing personnel.

[0070] The network security operation system disclosed in the present invention generates corresponding security service work orders through the red team work order module, the yellow team work order module, the blue team work order module and the equipment manufacturer module, including vulnerability scanning, penetration testing, asset sorting, security alerts, security incident processing, security reinforcement, etc., and sends the corresponding work orders to the corresponding personnel or network security equipment for processing, so that network operators of various roles can quickly start various network security service tasks. The red team, the yellow team, the blue team and the equipment manufacturer personnel do not need to interact and audit complex electronic files, which greatly improves the collaborative efficiency of security operations, well realizes the closed loop of the workflow, and can effectively avoid data tampering, data leakage and other security risks during file transmission.

[0071] The network security operation system of the embodiment of the present disclosure is described in detail below.

[0072] In an exemplary embodiment of the present disclosure, the red team work order module 210 is used to generate a vulnerability scanning work order in response to the operation of the red team processing personnel issuing a scanning task, call the corresponding asset parameters in the asset module according to the vulnerability scanning work order to generate vulnerability scanning parameters, and trigger the vulnerability scanner to perform the corresponding vulnerability scanning task based on the vulnerability scanning parameters. Specifically, the red team leader issues a vulnerability scanning task and generates a corresponding vulnerability scanning work order. According to the item name, asset IP, port range and other related parameters of the vulnerability scanning work order, the IP and other parameters in the asset module are called to obtain the vulnerability scanning parameters. The red team work order module 210 is linked to the vulnerability scanner through the API interface, and the vulnerability scanner performs the vulnerability scanning task according to the relevant vulnerability scanning parameters. Further, the vulnerability scanner synchronizes the scanning task status to the vulnerability scanning work order. When the scanning task is completed, the red team work order module 210 obtains the vulnerability scanning result and enters the parameters (risk items) in the scanning result into the corresponding risk items of the relevant IP in the asset module.

[0073] In an exemplary embodiment of the present disclosure, the red team work order module 210 is also used to respond to the operation of the red team processing personnel issuing a penetration test, call the corresponding asset parameters from the asset module, and generate a penetration test work order. Specifically, the red team leader issues a penetration test task and generates a penetration test work order. The red team work order module 210 is associated with the asset module, and calls relevant asset parameters from the asset module, such as external network open domain names, IPs, open service versions, operating system versions, risk items, etc., to generate a penetration test work order. The penetration is sent to the corresponding processing personnel of the red team to perform the penetration test task. After the penetration test is completed, the red team work order module 210 can also obtain the penetration test results and enter the penetration test results into the asset module.

[0074] In an exemplary embodiment of the present disclosure, the red team work order module 210 is used to generate a vulnerability retest work order in response to the completion of the vulnerability repair task of the yellow team handler. Specifically, in a specific application scenario, when the yellow team handler completes the vulnerability repair task, the task is submitted on the corresponding work order module. When the red team work order module 210 obtains the vulnerability repair task submission, it automatically generates a vulnerability retest work order and sends the vulnerability to the corresponding handler of the red team. The red team handler retests the vulnerability, confirms that the vulnerability is repaired, and completes the task flow of the vulnerability, completing the vulnerability repair closed loop.

[0075] In another exemplary embodiment of the present disclosure, the red team work order module 210 is also used to: call the vulnerability information in the threat intelligence module; match the vulnerability information with the asset parameters in the asset module to obtain a matching result; and generate a penetration test work order based on the matching result. Specifically, the red team work order module 210 is connected to the threat intelligence module through the API interface, and the newly discovered software vulnerability name, version number and other related vulnerability information in the threat intelligence are called, and the software name, version number and other information recorded in the asset module are automatically matched according to the preset matching rules to obtain a matching result. According to the matching results, it is confirmed which assets have new vulnerabilities, and based on the assets with new vulnerabilities, a corresponding penetration test work order is generated. And the penetration test work order is sent to the corresponding red team processing personnel for penetration testing. Similarly, when the red team processing personnel complete the penetration test task, the red team work order module 210 obtains the penetration test results and enters the penetration test results into the asset module.

[0076] In an exemplary embodiment of the present disclosure, the blue team work order module 220 is used to generate an asset combing work order in response to an asset update operation. Specifically, when the corresponding personnel of the yellow team perform an asset update, for example, after deploying new assets or new business systems or deleting old assets or business systems, the assets change. After obtaining the asset changes, the blue team work order module 220 generates a corresponding asset combing work order and sends the asset combing work order to the corresponding blue team processing personnel. After receiving the asset combing work order, the blue team processing personnel comb the newly added assets and collect the open ports, related process services, related process versions, etc. of the newly added assets. The blue team work order module 220 can also obtain the asset combing results after the blue team completes the asset combing task, and synchronize the asset combing results to the asset module.

[0077] In an exemplary embodiment of the present disclosure, the blue team work order module 220 is used to call the alarm information in the security alarm module, generate a security alarm work order, and send the security alarm work order to the corresponding blue team processing personnel. Specifically, the blue team work order module 220 interacts with the security alarm module, obtains the security alarm work order by calling the risk items and labels and other alarm information in the security alarm module, and the blue team processing personnel monitor and analyze the network security equipment according to the security alarm work order to confirm whether security reinforcement and other operations are required.

[0078] In an exemplary embodiment of the present disclosure, the blue team work order module 220 is also used to generate a security event work order in response to the event triggering action of the security alarm module, and send the security event work order to the corresponding blue team processing personnel. Specifically, the security alarm module triggers a security event through preset rules, and generates a security time work order after the security event is triggered. For example, the preset rules may be: set the alarm name generated by the matching traffic probe to "SQL injection" and the alarm log generated during abnormal working hours. The alarm log can be judged as not a false alarm, and the web firewall did not successfully intercept the SQL injection. According to the preset rules, a corresponding security event work order is generated. After receiving the work order, the blue team processing personnel analyze and judge the security incident to confirm whether event processing or security reinforcement is required.

[0079] In an exemplary embodiment of the present disclosure, the yellow team work order module 230 is used to generate a vulnerability repair work order in response to the completion of the vulnerability scanner scanning task and / or the completion of the red team handler's penetration test task, and send the vulnerability repair work order to the yellow team handler. Specifically, the yellow team work order module 230 can automatically generate a corresponding vulnerability repair work order when the vulnerability scanner scanning task is completed or when the red team handler completes the penetration test task. It is also possible to generate a vulnerability repair work order when the vulnerability scanner scanning task is completed and the red team handler completes the penetration test task. The yellow team handler performs vulnerability repair according to the vulnerability repair work order. After completing the vulnerability repair, the red team work order module 210 automatically generates a vulnerability retesting work order.

[0080] In an exemplary embodiment of the present disclosure, the yellow team work order module 230 is used to generate an event handling work order in response to the confirmation of the security incident work order by the blue team processing personnel. Specifically, after the blue team processing personnel confirm that the security incident needs to be handled, the yellow team work order module 230 generates a corresponding event handling work order and sends the event handling work order to the corresponding yellow team processing personnel. After the yellow team processing personnel completes the handling of the security incident, they complete the task flow of the security incident and close the loop of the security incident.

[0081] In an exemplary embodiment of the present disclosure, the yellow team work order module 230 is used to generate a security reinforcement work order in response to the confirmation of the blue team processing personnel on the security alarm work order. Specifically, the yellow team work order module 230 generates a security reinforcement work order when the blue team processing personnel confirms that the alarm item needs to be security reinforced. The security reinforcement work order can be attached with the alarm information of the security alarm work order. The yellow team processing personnel perform corresponding security reinforcement according to the alarm type of the alarm information. Or, according to the security reinforcement work order, it is determined whether the equipment manufacturer needs to upgrade the equipment or optimize the security policy to solve the security reinforcement problem. For example, when the alarm information is "SQL injection", the yellow team processing personnel need to detect whether the web firewall is correctly configured with the defense configuration of the SQL injection site. If it is not correctly configured, the yellow team can solve the security reinforcement problem by itself. If the web firewall product itself cannot defend against the "SQL injection" attack, it is a product problem, and the yellow team cannot solve it by itself, so it is necessary to set the web firewall manufacturer to upgrade the equipment to solve it. Similarly, when the alarm information is caused by improper configuration of security policies, Team Huang is unable to optimize it and needs to ask the relevant third-party manufacturers to optimize it in order to solve the security reinforcement problem.

[0082] In an exemplary embodiment of the present disclosure, the equipment manufacturer work order module 240 is used to generate an equipment upgrade work order in response to the Yellow Team handler's vulnerability repair operation on the software and hardware equipment or the upgrade conversion operation on the security reinforcement work order, and send the equipment upgrade work order to the equipment manufacturer handler. Specifically, in a specific application scenario, after the Yellow Team handler repairs the vulnerability of the software and hardware equipment, for some vulnerabilities that cannot be repaired by the repair tool, a corresponding equipment upgrade work order is generated, so that the relevant equipment manufacturers can upgrade the equipment and solve the unrepairable vulnerability problem by means of equipment upgrade. After the equipment upgrade is completed, the task flow of the vulnerability is completed, and the vulnerability repair is closed. In another specific application scenario, the Yellow Team handler determines that the equipment upgrade is required to achieve the purpose of security reinforcement based on the security reinforcement work order, and upgrades the security reinforcement work order to a device upgrade work order. After the relevant equipment manufacturer upgrades the equipment, the task flow of the security reinforcement is completed, and the security reinforcement closed loop is performed.

[0083] In an exemplary embodiment of the present disclosure, the equipment manufacturer work order module 240 is also used to generate a security policy optimization work order in response to the optimization conversion operation of the yellow team processing personnel on the security reinforcement work order. Specifically, when the yellow team processing personnel determine that the equipment needs security reinforcement due to improper security policy configuration based on the security reinforcement work order, the security reinforcement work order is upgraded to a security policy optimization work order. After the relevant equipment manufacturer optimizes the equipment, after the optimization is completed, the task process of the security reinforcement is completed, and the security reinforcement closed loop is performed.

[0084] It should be noted that in an exemplary embodiment of the present disclosure, a mapping table between processing personnel and work order names may be set in the network security operation system, and corresponding work orders may be sent to corresponding personnel for processing according to different work order names.

[0085] In an exemplary embodiment of the present disclosure, the network security operation system may further include a vulnerability management module 250. The vulnerability management module 250 is used to: in response to the completion of the vulnerability scanner scanning task, obtain vulnerability scanning results, update risk items in the asset module according to the vulnerability scanning results, and generate vulnerability management logs.

[0086] The vulnerability management module 250 is further used to: in response to the completion of the penetration test task by the red team handler, obtain the penetration test results, update the risk items in the asset module according to the penetration test results, and generate a vulnerability management log.

[0087] The vulnerability management module 250 is further used to: in response to the completion of the vulnerability repair task by the yellow team processing personnel, obtain the vulnerability retest results, update the risk items in the asset module according to the vulnerability retest, and generate a vulnerability management log.

[0088] When performing vulnerability scanning, penetration testing and vulnerability repair, the risk items of the network security device will change. The vulnerability management module 250 can update the risk items in the asset module in real time to form vulnerability life cycle management. The vulnerability management log can record relevant parameters such as IP, port, service version, vulnerability discovery time, vulnerability repair time, etc. to better manage vulnerabilities.

[0089] In an exemplary embodiment of the present disclosure, the network security operation system may further include a performance management module 260. The performance management module 260 is used to obtain the completion status of each work order task, and to perform performance statistics on the red team processing personnel, the yellow team processing personnel, the blue team processing personnel, or the equipment manufacturer personnel according to the completion status. For example, statistics are performed on the work order sorting, completion hours, completion rate, and work scoring according to the completion status of each processing personnel.

[0090] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0091] Figure 3 A flowchart of a network security operation method is shown as an example. Figure 3 , a cybersecurity operations method, comprising:

[0092] S301, in response to the red team processing personnel's scanning task issuing operation, generating a vulnerability scanning work order, calling the corresponding asset parameters in the asset module according to the vulnerability scanning work order, generating vulnerability scanning parameters, and triggering the vulnerability scanner to execute the corresponding vulnerability scanning task based on the vulnerability scanning parameters;

[0093] S302, in response to the penetration test issuing operation of the red team processing personnel, calling the corresponding asset parameters from the asset module, generating a penetration test work order, and sending the penetration test work order to the red team processing personnel;

[0094] S303, in response to the completion of the vulnerability repair task by the yellow team processing personnel, generating a vulnerability retesting work order, and sending the vulnerability retesting work order to the red team processing personnel;

[0095] S304, in response to the asset update operation, generating an asset sorting work order, and sending the asset sorting work order to the blue team processing personnel;

[0096] S305, calling the alarm information in the security alarm module, generating a security alarm work order, and sending the security alarm work order to the blue team processing personnel;

[0097] S306, in response to the event triggering action of the security alarm module, generating a security event work order, and sending the security event work order to the blue team processing personnel;

[0098] S307, in response to the completion of the vulnerability scanner scanning task and / or the completion of the red team processing personnel's penetration testing task, generating a vulnerability repair work order, and sending the vulnerability repair work order to the yellow team processing personnel;

[0099] S308, in response to the confirmation of the security incident work order by the blue team processing personnel, generating an incident handling work order, and sending the incident handling work order to the yellow team processing personnel;

[0100] S309, in response to the confirmation of the security warning work order by the blue team processing personnel, generating a security reinforcement work order, and sending the security reinforcement work order to the yellow team processing personnel;

[0101] S310, in response to the yellow team processing personnel's operation of repairing the vulnerability of the software and hardware equipment or upgrading and converting the security reinforcement work order, generating a device upgrade work order, and sending the device upgrade work order to the equipment manufacturer processing personnel;

[0102] S311, in response to the optimization conversion operation of the yellow team processing personnel on the security reinforcement work order, a security policy optimization work order is generated, and the security policy optimization is sent to the equipment manufacturer processing personnel.

[0103] The specific process of each step of the above network security operation method has been described in detail in the above network security operation system, and this disclosure will not repeat it here.

[0104] In an exemplary embodiment of the present disclosure, an electronic device capable of implementing the above network security operation method is also provided.

[0105] It will be appreciated by those skilled in the art that various aspects of the present invention may be implemented as a system, method or program product. Therefore, various aspects of the present invention may be specifically implemented in the following forms, namely: a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as a "circuit", "module" or "system".

[0106] Refer to the following Figure 4 An electronic device 400 according to this embodiment of the present invention will be described. Figure 4 The electronic device 400 shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0107] like Figure 4 As shown, the electronic device 400 is in the form of a general computing device. The components of the electronic device 400 may include but are not limited to: at least one processing unit 410, at least one storage unit 420, and a bus 430 connecting different system components (including the storage unit 420 and the processing unit 410).

[0108] The storage unit stores program codes, which can be executed by the processing unit 410, so that the processing unit 410 performs the steps according to various exemplary embodiments of the present invention described in the above “Exemplary Method” section of this specification. For example, the processing unit 410 can perform the following steps: Figure 3 Steps S301~S311 shown in .

[0109] The storage unit 420 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 4201 and / or a cache storage unit 4202 , and may further include a read-only storage unit (ROM) 4203 .

[0110] The storage unit 420 may also include a program / utility 4204 having a set (at least one) of program modules 4205, such program modules 4205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0111] Bus 430 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0112] The electronic device 400 may also communicate with one or more external devices 700 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 400, and / or communicate with any device that enables the electronic device 400 to communicate with one or more other computing devices (e.g., routers, modems, etc.). This communication may be performed through an input / output (I / O) interface 450. In addition, the electronic device 400 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) through a network adapter 460. As shown, the network adapter 460 communicates with other modules of the electronic device 400 through a bus 430. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 400, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0113] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, and includes a number of instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0114] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the above method of the present specification is stored. In some possible implementations, various aspects of the present invention can also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary embodiments of the present invention described in the above "Exemplary Method" section of the present specification.

[0115] refer to Figure 5As shown, a program product 500 for implementing the above method according to an embodiment of the present invention is described, which can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the present invention is not limited thereto. In this document, a readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0116] The program product may be any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (non-exhaustive list) of readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0117] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, in which readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Readable signal media may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0118] The program code embodied on the readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0119] Program code for performing the operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0120] In addition, the above-mentioned figures are only schematic illustrations of the processes included in the method according to an exemplary embodiment of the present invention, and are not intended to be limiting. It is easy to understand that the processes shown in the above-mentioned figures do not indicate or limit the time sequence of these processes. In addition, it is also easy to understand that these processes can be performed synchronously or asynchronously, for example, in multiple modules.

[0121] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The specification and examples are to be considered exemplary only, and the true scope and concept of the present disclosure are indicated by the claims.

Claims

1. A network security operation system, characterized in that: include: The red team work order module is used to generate vulnerability scanning work orders, penetration testing work orders or vulnerability retesting work orders based on corresponding operations or data interactions with network security devices, and send the work orders to corresponding red team processing personnel or trigger network security device operations; The blue team work order module is used to generate asset sorting work orders, security alarm work orders or security incident work orders based on corresponding operations or data interactions with network security devices, and send the work orders to the corresponding blue team processing personnel; The Yellow Team Work Order Module is used to generate vulnerability repair work orders, incident handling work orders or security reinforcement work orders based on corresponding operations or data interactions with network security devices, and send the work orders to the corresponding Yellow Team processing personnel; as well as The equipment manufacturer work order module is used to generate equipment upgrade work orders and security policy optimization work orders based on corresponding operations or data interactions with network security equipment, and send the work orders to the corresponding equipment manufacturer processing personnel; Among them, the red team work order module is used to: generate a vulnerability scanning work order in response to the scanning task issuance operation of the red team personnel, call the corresponding asset parameters in the asset module according to the vulnerability scanning work order, generate vulnerability scanning parameters, and trigger the vulnerability scanner to perform the corresponding vulnerability scanning task based on the vulnerability scanning parameters; in response to the penetration test issuance operation of the red team personnel, call the corresponding asset parameters from the asset module, generate a penetration test work order, and send the penetration test work order to the red team processing personnel; in response to the completion of the vulnerability repair task of the yellow team processing personnel, generate a vulnerability retest work order, and send the vulnerability retest work order to the red team processing personnel; after the red team processing personnel confirms the vulnerability repair, they complete the task process of the vulnerability and perform a vulnerability repair closed loop; call the vulnerability information in the threat intelligence module; match the vulnerability information with the asset parameters in the asset module to obtain a matching result; generate a penetration test work order according to the matching result, and send the vulnerability retest work order to the red team processing personnel; The blue team work order module is used to: generate an asset combing work order in response to an asset update operation, and send the asset combing work order to a blue team processing personnel; call the alarm information in the security alarm module to generate a security alarm work order, and send the security alarm work order to a blue team processing personnel; generate a security event work order in response to an event triggering action of the security alarm module, and send the security event work order to a blue team processing personnel; The yellow team work order module is used to: generate a vulnerability repair work order in response to the completion of the vulnerability scanner scanning task and / or the completion of the red team processing personnel's penetration test task, and send the vulnerability repair work order to the yellow team processing personnel; generate an event handling work order in response to the blue team processing personnel's confirmation of the security incident work order, and send the event handling work order to the yellow team processing personnel; after the yellow team processing personnel completes the handling of the security incident, they complete the task flow of the security incident and close the loop of the security incident; generate a security reinforcement work order in response to the blue team processing personnel's confirmation of the security warning work order, and send the security reinforcement work order to the yellow team processing personnel; The equipment manufacturer work order module is used to: In response to the Yellow Team’s handling personnel repairing the vulnerabilities of the software and hardware equipment, if the vulnerabilities cannot be repaired by the repair tools, a device upgrade work order is generated, and the device upgrade work order is sent to the corresponding equipment manufacturer’s handling personnel; after the relevant equipment manufacturer completes the equipment upgrade, the task flow of the vulnerability is completed, and the vulnerability repair closed loop is performed; or in response to the Yellow Team’s handling personnel determining that the equipment upgrade is required to achieve the purpose of security reinforcement based on the security reinforcement work order, the security reinforcement work order is upgraded to a device upgrade work order; after the relevant equipment manufacturer upgrades the equipment, the task flow of the security reinforcement is completed, and the security reinforcement closed loop is performed; In response to the optimization conversion operation of the yellow team processing personnel on the security reinforcement work order, a security policy optimization work order is generated, and the security policy optimization work order is sent to the corresponding equipment manufacturer processing personnel; Also included is a vulnerability management module, the vulnerability management module is used to: update the risk items in the asset module and generate a vulnerability management log after performing any of the following operations: in response to the completion of a vulnerability scanner scanning task, obtain vulnerability scanning results, in response to the completion of a red team processing personnel's penetration testing task, obtain penetration testing results, and in response to the completion of a red team processing personnel's vulnerability retesting task, obtain vulnerability retesting results; It also includes: a performance management module and a task management module. The performance management module is used to obtain the completion status of each work order task, and to perform performance statistics on the red team processing personnel, the yellow team processing personnel, the blue team processing personnel or the equipment manufacturer personnel according to the completion status.

2. A network security operation platform, characterized in that: include: An asset module, a vulnerability scanner, a threat intelligence module, a security warning module, and a network security operation system as claimed in claim 1, wherein: The asset module is used to store asset information; The vulnerability scanner is used to perform vulnerability scanning; The threat intelligence module is used to obtain threat intelligence information; The security alarm module is used to obtain security alarm information of network security devices.

3. A network security operation method, characterized in that: include: In response to the red team processing personnel's scanning task issuance operation, a vulnerability scanning work order is generated, the corresponding asset parameters in the asset module are called according to the vulnerability scanning work order, vulnerability scanning parameters are generated, and the vulnerability scanner is triggered to execute the corresponding vulnerability scanning task based on the vulnerability scanning parameters; In response to the penetration test issuing operation of the red team processing personnel, the corresponding asset parameters are called from the asset module, a penetration test work order is generated, and the penetration test work order is sent to the red team processing personnel; In response to the completion of the vulnerability repair task by the yellow team processing personnel, a vulnerability retesting work order is generated, and the vulnerability retesting work order is sent to the red team processing personnel; In response to the asset update operation, an asset combing work order is generated, and the asset combing work order is sent to a blue team processing personnel; Call the alarm information in the security alarm module, generate a security alarm work order, and send the security alarm work order to the blue team processing personnel; In response to the event triggering action of the security alarm module, a security incident work order is generated, and the security incident work order is sent to the blue team processing personnel; In response to the completion of the vulnerability scanner scanning task and / or the completion of the red team handler's penetration testing task, a vulnerability repair work order is generated, and the vulnerability repair work order is sent to the yellow team handler; In response to the confirmation of the security incident work order by the blue team processing personnel, an incident handling work order is generated, and the incident handling work order is sent to the yellow team processing personnel; In response to the confirmation of the security warning work order by the blue team processing personnel, a security reinforcement work order is generated, and the security reinforcement work order is sent to the yellow team processing personnel; In response to the Yellow Team's processing personnel's operation of repairing the vulnerability of the software and hardware equipment or the upgrade and conversion operation of the security reinforcement work order, a device upgrade work order is generated, and the device upgrade work order is sent to the equipment manufacturer's processing personnel; In response to the optimization conversion operation of the yellow team processing personnel on the security reinforcement work order, a security policy optimization work order is generated, and the security policy optimization is sent to the equipment manufacturer processing personnel; Obtaining the completion status of each work order task, and performing performance statistics on the red team processing personnel, the yellow team processing personnel, the blue team processing personnel or the equipment manufacturer personnel according to the completion status; and After performing any of the following operations, the risk items in the asset module are updated and a vulnerability management log is generated: in response to the completion of the vulnerability scanner scanning task, the vulnerability scanning results are obtained; in response to the completion of the red team handler's penetration testing task, the penetration testing results are obtained; in response to the completion of the red team handler's vulnerability retesting task, the vulnerability retesting results are obtained.

4. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network security operation method according to claim 3 is implemented.

Images