A network information security assessment method, device, electronic equipment and medium

Abstract

The embodiments of the present application provide a network information security risk assessment method, device, electronic device and medium, which belong to the field of computer technology. The method includes: randomly and irregularly sampling the data to be evaluated in the network assets; performing a preliminary risk assessment on the sampled data to be evaluated; wherein the preliminary risk assessment includes at least one of keyword sensitivity assessment, threat assessment and vulnerability assessment on the data to be evaluated; if the preliminary risk assessment result shows that the risk level of the data to be evaluated exceeds a preset threshold, then continue to perform a secondary risk assessment on the data to be evaluated; wherein the secondary risk assessment includes at least one of full field assessment, value assessment, impact assessment and distribution range assessment on the data to be evaluated; determine the risk level of the data to be evaluated according to the preliminary risk assessment result or the secondary risk assessment result. The present application can improve the accuracy of the assessment.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a network information security assessment and processing method, device, electronic device and medium. Background Art

[0002] With the rapid development of the Internet, network information security issues are becoming increasingly prominent. In order to protect the security of network assets, it is necessary to conduct risk assessment on the data in network assets. Information assessment technology is an important means of network security protection. It analyzes and evaluates data to identify possible risks and take corresponding protective measures. However, due to the huge amount of data in network assets and the diversity of data types, traditional information assessment technology is often unable to comprehensively and accurately assess the risks of all data.

[0003] The existing solution is to periodically sample the data in network assets and then conduct risk assessment on the sampled data. Although this method can assess the risk of network assets to a certain extent, due to the periodicity and fixedness of sampling, some sudden risks may not be discovered and handled in time.

[0004] The main problems with existing technologies in this field are as follows: First, existing sampling methods are usually periodic and fixed, which may result in some sudden risks not being discovered and handled in a timely manner. Second, existing risk assessment methods usually only partially evaluate the sampled data, such as keyword sensitivity assessment, threat assessment, etc., which may lead to inaccurate and incomplete assessment results. Finally, when determining the risk level of data, existing technologies are often based only on the results of preliminary risk assessment, which may lead to inaccurate determination of risk levels. Summary of the invention

[0005] The present application provides a network information security risk assessment method, device, electronic device and medium, aiming to improve the above-mentioned problems.

[0006] In a first aspect, the present application provides a network information security risk assessment method, the method comprising: randomly and irregularly sampling the data to be evaluated in the network assets; performing a preliminary risk assessment on the sampled data to be evaluated; wherein the preliminary risk assessment includes performing at least one of keyword sensitivity assessment, threat assessment and vulnerability assessment on the data to be evaluated; if the preliminary risk assessment result shows that the risk level of the data to be evaluated exceeds a preset threshold, then continuing to perform a secondary risk assessment on the data to be evaluated; wherein the secondary risk assessment includes performing at least one of full-field assessment, value assessment, impact assessment and distribution range assessment on the data to be evaluated; and determining the risk level of the data to be evaluated according to the preliminary risk assessment result or the secondary risk assessment result.

[0007] In one embodiment, the step of determining the risk level of the data to be evaluated according to the preliminary risk assessment result or the secondary risk assessment result includes: if the preliminary risk assessment result shows that any two of the indicators characterizing the keyword sensitivity, the indicators characterizing the threat, and the indicators characterizing the weakness do not exceed the corresponding preset standards, then the risk level of the data to be evaluated is determined to be a no-risk level; if the preliminary risk assessment result shows that at least two of the indicators characterizing the keyword sensitivity, the indicators characterizing the threat, and the indicators characterizing the weakness exceed the corresponding preset standards, then the risk level of the data to be evaluated is determined to be a low-risk level.

[0008] In one embodiment, the step of determining the risk level of the data to be evaluated according to the preliminary risk assessment result or the secondary risk assessment result includes: if the secondary risk assessment result shows that any three of the indicators representing the entire field, the indicators representing the value, the indicators representing the impact, and the indicators representing the distribution range do not exceed the corresponding preset standards, then the risk level of the data to be evaluated is determined to be a medium risk level; if the secondary risk assessment result shows that at least three of the indicators representing the entire field, the indicators representing the value, the indicators representing the impact, and the indicators representing the distribution range exceed the corresponding preset standards, then the risk level of the data to be evaluated is determined to be a high risk level.

[0009] In one embodiment, the method further includes: grading and classifying the network assets according to the risk level, and tracing the sensitive data owner according to the grading and classification results.

[0010] In one embodiment, the method further includes: classifying the classified network assets into different sensitivity levels according to the tracing results; and automatically evaluating sensitive data through user-defined rules or built-in rules.

[0011] In one embodiment, the method further includes: attaching a risk assessment mark to the information that has undergone risk assessment.

[0012] In one embodiment, the method further includes: determining whether the data to be evaluated has been risk evaluated according to the risk evaluation identifier; if so, skipping the evaluation of the data to be evaluated.

[0013] In a second aspect, the present application provides a network information security assessment device, the device comprising:

[0014] A sampling unit, used to randomly and irregularly sample the data to be evaluated in the network assets;

[0015] A preliminary risk assessment unit, configured to perform a preliminary risk assessment on the sampled data to be assessed; wherein the preliminary risk assessment includes performing at least one of a keyword sensitivity assessment, a threat assessment, and a vulnerability assessment on the data to be assessed;

[0016] A secondary risk assessment unit, configured to continue to perform a secondary risk assessment on the data to be assessed when the preliminary risk assessment result shows that the risk level of the data to be assessed exceeds a preset threshold; wherein the secondary risk assessment includes at least one of a full field assessment, a value assessment, an impact assessment, and a distribution range assessment on the data to be assessed;

[0017] The risk level determination unit is used to determine the risk level of the data to be evaluated according to the preliminary risk assessment result or the secondary risk assessment result.

[0018] Compared with the existing technology, this technical solution has at least the following beneficial effects: 1. Randomly and irregularly sampling the data to be evaluated in network assets can more timely discover and handle sudden risks compared to the existing periodic and fixed sampling methods, thereby improving the real-time and effectiveness of risk assessment. 2. Performing preliminary risk assessment and secondary risk assessment on the sampled data to be evaluated, including keyword sensitivity assessment, threat assessment, vulnerability assessment, full field assessment, value assessment, impact assessment and distribution range assessment, etc. Compared with the existing risk assessment method that only partially evaluates the sampled data, this technical solution can more comprehensively and accurately evaluate the risk of the data, thereby improving the accuracy of risk assessment. 3. Determining the risk level of the data to be evaluated according to the preliminary risk assessment results or the secondary risk assessment results. Compared with the existing technology that only determines the risk level of the data based on the results of the preliminary risk assessment, this technical solution can more accurately determine the risk level of the data, thereby improving the accuracy of risk assessment. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 A schematic diagram of the structure of an electronic device provided in the first embodiment of the present application;

[0021] Figure 2 A flowchart of a network information security assessment method provided for the second embodiment of the present application;

[0022] Figure 3A schematic diagram of the functional modules of a network information security assessment device provided in the third embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0024] First embodiment: Figure 1 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application, which can be used in the present application Figure 1 The schematic diagram shown is used to describe an electronic device 100 that is an example of an electronic device and a medium for implementing the network information security assessment method, device, electronic device, and medium of an embodiment of the present application.

[0025] like Figure 1 The electronic device 100 includes one or more processors 102, one or more storage devices 104, an input device 106, and an output device 108. These components are interconnected via a bus system and / or other forms of connection mechanisms (not shown). It should be noted that Figure 1 The components and structures of the electronic device 100 shown are only exemplary and not restrictive. The electronic device may have Figure 1 Some of the components shown may also have Figure 1 Other components and structures are not shown.

[0026] The processor 102 may be a central processing unit (CPU) or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may control other components in the electronic device 100 to perform desired functions.

[0027] It should be understood that the processor 102 in the embodiment of the present application may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0028] The storage device 104 may include one or more computer program products, and the computer program product may include various forms of computer-readable storage media.

[0029] It should be understood that the storage device 104 in the embodiment of the present application may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory may be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0030] Among them, one or more computer program instructions can be stored on the computer-readable storage medium, and the processor 102 can execute the program instructions to implement the client functions (implemented by the processor) in the embodiments of the present application described below and / or other desired functions. Various applications and various data, such as various data used and / or generated by the application, can also be stored in the computer-readable storage medium.

[0031] The input device 106 may be a device used by a user to input instructions, and may include one or more of a keyboard, a mouse, a microphone, a touch screen, and the like.

[0032] Second embodiment:

[0033] Reference Figure 2 The flowchart of a network information security assessment method shown in FIG. 1 is applied to financial, accounting, personnel and other systems. The method specifically includes the following steps:

[0034] Step S100, randomly and irregularly sampling the data to be evaluated in the network assets;

[0035] Specifically, by setting certain sampling rules, such as sampling at a certain time interval or data volume, the sampling process is made random and uncertain, thereby improving the timeliness and accuracy of risk assessment. Sampling can be set every hour, and the data volume of each sampling is 100MB. In this way, even in network assets with huge amounts of data, the randomness and uncertainty of sampling can be guaranteed, thereby improving the timeliness and accuracy of risk assessment.

[0036] Step S200, performing a preliminary risk assessment on the sampled data to be assessed; wherein the preliminary risk assessment includes performing at least one of keyword sensitivity assessment, threat assessment and vulnerability assessment on the data to be assessed;

[0037] Specifically, a preliminary risk assessment is performed on the sampled data to be evaluated: at least one of keyword sensitivity assessment, threat assessment and weakness assessment is performed on the sampled data to evaluate the risk level of the data. This evaluation method can comprehensively cover the risk factors of the data and improve the accuracy and coverage of the evaluation. For example, by keyword matching, it is possible to evaluate whether the data contains sensitive words, thereby determining the keyword sensitivity of the data; it is also possible to evaluate the threat level of the data by analyzing the transmission path and destination of the data; it is also possible to evaluate the weaknesses of the data by analyzing the encryption method and key length of the data.

[0038] Step S300: If the preliminary risk assessment result shows that the risk of the data to be assessed exceeds a preset threshold, a secondary risk assessment is continued on the data to be assessed; wherein the secondary risk assessment includes at least one of full field assessment, value assessment, impact assessment and distribution range assessment on the data to be assessed;

[0039] Specifically, if the preliminary risk assessment results show that the risk level of the data to be assessed exceeds the preset threshold, the data to be assessed will continue to be subject to a secondary risk assessment: at least one of full-field assessment, value assessment, impact assessment, and distribution range assessment will be performed on the data to further assess the risk level of the data. This approach can more accurately assess the risk level of the data and improve the effectiveness of risk management. For example, the value of the data can be assessed by analyzing all the fields of the data; the impact of the data can be assessed by analyzing the possible consequences of the data; and the distribution range of the data can be assessed by analyzing the spread of the data.

[0040] Step S400: determining the risk level of the data to be evaluated according to the preliminary risk evaluation result or the secondary risk evaluation result.

[0041] Specifically, according to the results of risk assessment, the risk level of data is divided into different levels, such as no risk, low risk, medium risk and high risk, so as to facilitate targeted risk management. For example, for no risk and low risk data, regular monitoring can be adopted for management; for medium risk data, enhanced protection can be adopted for management; for high risk data, immediate isolation can be adopted for management.

[0042] Furthermore, the step of determining the risk level of the data to be assessed according to the preliminary risk assessment result or the secondary risk assessment result includes:

[0043] If the preliminary risk assessment result shows that any two of the index representing the sensitivity of the keyword, the index representing the threat, and the index representing the weakness do not exceed the corresponding preset standards, then the risk level of the data to be assessed is determined to be a no-risk level;

[0044] If the preliminary risk assessment result shows that at least two of the indicators representing the keyword sensitivity, the indicators representing the threat, and the indicators representing the vulnerability exceed corresponding preset standards, the risk level of the data to be assessed is determined to be a low risk level.

[0045] Specifically, in order to ensure that different evaluations have corresponding indicator values, an evaluation standard library can be established in advance, and each evaluation standard library has corresponding sub-items and their values. Take the standard indicator of 4 that represents the sensitivity of the keyword as an example. If the current keyword is "account", it can be seen from the table that the sensitivity of "account" is 6, which exceeds the standard indicator 4. The same is true for other threat indicators and weakness indicators. If more than two indicators exceed the standard, it can be determined that the risk level of the data to be evaluated is a low risk level. If there is only one or none, it can also be determined that the risk level of the data to be evaluated is a no-risk level.

[0046] In one embodiment, the step of determining the risk level of the data to be assessed according to the preliminary risk assessment result or the secondary risk assessment result includes:

[0047] If the secondary risk assessment result shows that any three of the indicators representing the entire field, the indicators representing the value, the indicators representing the impact, and the indicators representing the distribution range do not exceed the corresponding preset standards, then the risk level of the data to be assessed is determined to be a medium risk level;

[0048] If the secondary risk assessment result shows that at least three of the indicators representing the entire field, the indicators representing the value, the indicators representing the impact, and the indicators representing the distribution range exceed the corresponding preset standards, the risk level of the data to be assessed is determined to be a high risk level.

[0049] Specifically, similar to the previous embodiment, in order to ensure that different evaluations will have corresponding indicator values, an evaluation standard library can be established in advance, and each evaluation standard library has corresponding sub-items and their values. Take the standard indicator 8 that represents the entire field as an example. If the current entire field is "account balance", it can be seen from the table that the sensitivity of "account balance" is 10, which exceeds the standard indicator 8. The same is true for other value indicators, impact indicators, and distribution range indicators. If more than three indicators exceed the standard, it can be determined that the risk level of the data to be evaluated is a high risk level. If any three items do not exceed the corresponding preset standard, the risk level of the data to be evaluated is determined to be a medium risk level.

[0050] In one embodiment, the method further includes: grading and classifying the network assets according to the risk level, and tracing the sensitive data owner according to the grading and classification results.

[0051] This embodiment is a backtracking process, which determines the risk level of the data to be evaluated, and then classifies and labels the data assets related to the data to be evaluated according to the risk level. After labeling is completed, the owner of the sensitive data is traced back according to the labeling results to determine the risk department, personnel and other information.

[0052] In one embodiment, the method further includes: classifying the classified network assets into different sensitivity levels according to the tracing results; and automatically evaluating sensitive data through user-defined rules or built-in rules.

[0053] Specifically, classified data assets can be divided into three or more sensitivity levels according to the traceability results, such as public, internally disclosed, not suitable for disclosure, and disclosed to certain people. Then, some user evaluation rules or built-in rules can be added on this basis to achieve automatic evaluation and capture of sensitive information.

[0054] In one embodiment, the method further includes: attaching a risk assessment mark to the information that has undergone risk assessment.

[0055] Specifically, a certain machine-readable code may be used to attach a risk assessment identifier to information that has undergone risk assessment.

[0056] In one embodiment, the method further includes: determining whether the data to be evaluated has been risk evaluated according to the risk evaluation identifier; if so, skipping the evaluation of the data to be evaluated.

[0057] Through this specific embodiment, waste of resources can be avoided.

[0058] Compared with the existing technology, this technical solution has at least the following beneficial effects: 1. Randomly and irregularly sampling the data to be evaluated in network assets can more timely discover and handle sudden risks compared to the existing periodic and fixed sampling methods, thereby improving the real-time and effectiveness of risk assessment. 2. Performing preliminary risk assessment and secondary risk assessment on the sampled data to be evaluated, including keyword sensitivity assessment, threat assessment, vulnerability assessment, full field assessment, value assessment, impact assessment and distribution range assessment, etc. Compared with the existing risk assessment method that only partially evaluates the sampled data, this technical solution can more comprehensively and accurately evaluate the risk of the data, thereby improving the accuracy of risk assessment. 3. Determining the risk level of the data to be evaluated according to the preliminary risk assessment results or the secondary risk assessment results. Compared with the existing technology that only determines the risk level of the data based on the results of the preliminary risk assessment, this technical solution can more accurately determine the risk level of the data, thereby improving the accuracy of risk assessment.

[0059] Due to the advanced nature of the technical solution, it can be widely used in application fields such as network security protection, information system management, and data asset management. First, the present invention proposes a new network information security assessment method, which can more accurately and comprehensively assess the data risks in network assets, thereby improving network security protection capabilities. Secondly, the method of the present invention can effectively solve the periodicity and fixity problems of the sampling method in the prior art, and can timely discover and deal with sudden risks. In addition, the method of the present invention can also more accurately determine the risk level of the data, thereby providing a more reliable basis for information system management and data asset management. Therefore, the technical application prospects of the present invention are broad and the market demand is huge.

[0060] Third embodiment:

[0061] See also Figure 3 A network information security risk assessment device is shown, the device comprising:

[0062] The sampling unit 10 is used to randomly and irregularly sample the data to be evaluated in the network assets;

[0063] A preliminary risk assessment unit 20, configured to perform a preliminary risk assessment on the sampled data to be assessed; wherein the preliminary risk assessment includes performing at least one of a keyword sensitivity assessment, a threat assessment, and a vulnerability assessment on the data to be assessed;

[0064] The secondary risk assessment unit 30 is used to continue to perform a secondary risk assessment on the data to be assessed when the preliminary risk assessment result shows that the risk level of the data to be assessed exceeds a preset threshold; wherein the secondary risk assessment includes at least one of a full field assessment, a value assessment, an impact assessment, and a distribution range assessment on the data to be assessed;

[0065] The risk level determination unit 40 is used to determine the risk level of the to-be-assessed data according to the preliminary risk assessment result or the secondary risk assessment result.

[0066] Furthermore, this embodiment also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is run by a processing device, the steps of any one of the network information security risk assessment methods provided in the above-mentioned embodiment 2 are executed.

[0067] A computer program product of a network information security risk assessment method, device and system provided in the embodiments of the present application includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods described in the previous method embodiments. The specific implementation can be found in the method embodiments and will not be repeated here.

[0068] It should be noted that the above embodiments can be implemented in whole or in part by software, hardware (such as circuits), firmware or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center by wired (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains one or more available media sets. The available medium can be a magnetic medium (for example, a floppy disk, a hard disk, a tape), an optical medium (for example, a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state hard disk.

[0069] It should be understood that in the various embodiments of the present application, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0070] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0071] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0072] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0073] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the protection scope of the present application. It should be noted that similar numbers and letters represent similar items in the following drawings, so once an item is defined in one drawing, it does not need to be further defined and explained in the subsequent drawings.

Claims

1. A network information security risk assessment method, characterized in that: The method comprises: Randomly and irregularly sample the data to be evaluated in network assets; Performing a preliminary risk assessment on the sampled data to be assessed; wherein the preliminary risk assessment includes performing at least one of a keyword sensitivity assessment, a threat assessment, and a vulnerability assessment on the data to be assessed; If the preliminary risk assessment result shows that the risk level of the data to be assessed exceeds a preset threshold, a secondary risk assessment is continued for the data to be assessed; wherein the secondary risk assessment includes at least one of a full field assessment, a value assessment, an impact assessment, and a distribution range assessment for the data to be assessed; Determine the risk level of the data to be assessed according to the preliminary risk assessment results or the secondary risk assessment results; The step of determining the risk level of the data to be assessed according to the preliminary risk assessment result or the secondary risk assessment result includes: If the secondary risk assessment result shows that any three of the indicators representing the entire field, the indicators representing the value, the indicators representing the impact, and the indicators representing the distribution range do not exceed the corresponding preset standards, then the risk level of the data to be assessed is determined to be a medium risk level; If the secondary risk assessment result shows that at least three of the indicators representing the entire field, the indicators representing the value, the indicators representing the impact, and the indicators representing the distribution range exceed the corresponding preset standards, the risk level of the data to be assessed is determined to be a high risk level.

2. The method according to claim 1, characterized in that The step of determining the risk level of the data to be assessed according to the preliminary risk assessment result or the secondary risk assessment result includes: If the preliminary risk assessment result shows that any two of the index representing the sensitivity of the keyword, the index representing the threat, and the index representing the weakness do not exceed the corresponding preset standards, then the risk level of the data to be assessed is determined to be a no-risk level; If the preliminary risk assessment result shows that at least two of the indicators representing the keyword sensitivity, the indicators representing the threat, and the indicators representing the vulnerability exceed corresponding preset standards, the risk level of the data to be assessed is determined to be a low risk level.

3. The method according to claim 1, characterized in that Also includes: The network assets are graded and classified according to the risk levels, and the sensitive data owners are traced according to the graded and classified results.

4. The method according to claim 3, characterized in that Also includes: Classifying the classified network assets into different sensitivity levels according to the tracing results; Automatically evaluate sensitive data through user-defined rules or built-in rules.

5. The method according to claim 1, characterized in that Also includes: Attach a risk assessment logo to information that has been risk assessed.

6. The method according to claim 5, characterized in that Also includes: Determining whether the data to be evaluated has been risk assessed according to the risk assessment identifier; If so, the evaluation of the data to be evaluated is skipped.

7. A network information security assessment device, characterized in that: The device comprises: A sampling unit, used to randomly and irregularly sample the data to be evaluated in the network assets; A preliminary risk assessment unit, configured to perform a preliminary risk assessment on the sampled data to be assessed; wherein the preliminary risk assessment includes performing at least one of a keyword sensitivity assessment, a threat assessment, and a vulnerability assessment on the data to be assessed; A secondary risk assessment unit, configured to continue to perform a secondary risk assessment on the data to be assessed when the preliminary risk assessment result shows that the risk level of the data to be assessed exceeds a preset threshold; wherein the secondary risk assessment includes at least one of a full field assessment, a value assessment, an impact assessment, and a distribution range assessment on the data to be assessed; A risk level determination unit is used to determine the risk level of the data to be evaluated according to the preliminary risk assessment result or the secondary risk assessment result; the step of determining the risk level of the data to be evaluated according to the preliminary risk assessment result or the secondary risk assessment result includes: If the secondary risk assessment result shows that any three of the indicators representing the entire field, the indicators representing the value, the indicators representing the impact, and the indicators representing the distribution range do not exceed the corresponding preset standards, then the risk level of the data to be assessed is determined to be a medium risk level; If the secondary risk assessment result shows that at least three of the indicators representing the entire field, the indicators representing the value, the indicators representing the impact, and the indicators representing the distribution range exceed the corresponding preset standards, the risk level of the data to be assessed is determined to be a high risk level.

8. An electronic device, characterized in that: include: A memory for storing executable instructions; The processor is used to implement the network information security assessment processing method as described in any one of claims 1 to 6 when executing the executable instructions stored in the memory.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processing device, the steps of the network information security assessment processing method according to any one of claims 1 to 6 are executed.

Images