Network security assessment methods, devices, equipment, storage media and program products

Abstract

The present application relates to a network security assessment method, device, computer equipment, computer-readable storage medium and computer program product. The method comprises: obtaining first object information and assessment standard information of a first assessment object; querying target operation instruction template data corresponding to the first object information; generating target implementation record data based on the first object information, the target operation instruction template data and a preset first implementation record form template; and performing network security assessment on the first assessment object according to the target implementation record data and the assessment standard information. The use of this method can improve the accuracy of network security assessment results.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a network security assessment method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] With the rapid development of information technology, enterprises and institutions are increasingly dependent on information technology. Network security assessment is a necessary means to ensure the security, compliance and efficient operation of the information systems of enterprises and institutions.

[0003] In traditional technology, network security assessment is manually implemented by assessors based on various network security assessment standards.

[0004] However, with the official implementation of the new standard of the Cybersecurity Level Protection System 2.0, the scope of protection objects has gradually expanded. At the same time, the information level of various enterprises and institutions has become increasingly higher, and the first assessment objects have become increasingly complex. The number of systems, platforms, and networks involved in the assessment work has continued to increase, and the workload of on-site implementation by assessors has also continued to increase. The "manual work" method is prone to omissions and errors, resulting in low accuracy of network security assessment results. Summary of the invention

[0005] Based on this, it is necessary to provide a network security assessment method, device, computer equipment, computer-readable storage medium and computer program product that can improve the accuracy of network security assessment results in response to the above technical problems.

[0006] In a first aspect, the present application provides a network security assessment method, comprising:

[0007] Obtaining first object information and evaluation standard information of a first evaluation object;

[0008] Query target work instruction template data corresponding to the first object information;

[0009] Generate target implementation record data based on the first object information, the target work instruction template data and the preset first implementation record form template;

[0010] Conduct a network security assessment on the first assessment object based on the target implementation record data and assessment standard information.

[0011] In one embodiment, querying the target work instruction template data corresponding to the first object information includes:

[0012] Querying a preset object management data table to determine the target work instruction template identification information corresponding to the first object information;

[0013] Obtain the target work instruction book template data corresponding to the target work instruction book template identification information.

[0014] In one embodiment, before searching the preset object management data table to determine the target work instruction template identification information corresponding to the first object information, the method further includes:

[0015] Obtaining the object type and security level of the first evaluation object;

[0016] Querying at least one initial work instruction template identification information matching both the object type and the security level;

[0017] Display the identification information of each initial work instruction template;

[0018] In response to the operation of selecting a work instruction template, obtaining identification information of a selected target work instruction template, where the identification information of the target work instruction template is one of the identification information of each initial work instruction template;

[0019] An object management data table is generated, and an association relationship between the target work instruction template identification information and the first object information is constructed in the object management data table.

[0020] In one embodiment, based on the first object information, the target work instruction template data and the preset first implementation record form template, the target implementation record data is generated, including:

[0021] Generate an evaluation implementation record form based on the first object information, the target work instruction template data and the preset first implementation record form template, and display the evaluation implementation record form, wherein the evaluation implementation record form includes initial implementation record data;

[0022] In response to an editing operation on the initial implementation record data, edited target implementation record data is acquired.

[0023] In one embodiment, after performing a network security assessment on a first assessment object according to the target implementation record data and the assessment standard information, the method further includes:

[0024] Extracting compliance information of at least one evaluation indicator corresponding to the first evaluation object from the target implementation record data, and extracting weight information of at least one evaluation indicator corresponding to the first evaluation object from the evaluation standard information;

[0025] According to the compliance information and weight information, detect the deduction score of each evaluation indicator;

[0026] In the case where a deduction evaluation indicator is detected based on the deduction score, a target rectification suggestion corresponding to the deduction evaluation indicator is extracted from the implementation target implementation record data, where the deduction evaluation indicator is at least one of the evaluation indicators;

[0027] Based on the target rectification suggestions and deduction scores, a rectification suggestion record corresponding to the first evaluation object is generated.

[0028] In one embodiment, after performing a network security assessment on a first assessment object according to the target implementation record data and the assessment standard information, the method further includes:

[0029] Generate a first network security assessment record for a first assessment object;

[0030] In response to the multiplexing operation of the evaluation records for the first evaluation object and at least one second evaluation object, obtaining second object information of each second evaluation object;

[0031] Mapping the second object information to the preset second implementation record table template to generate a target implementation record table template corresponding to each second evaluation object;

[0032] The first network security assessment record is mapped to the to-be-filled items in each target implementation record form template to generate a second network security assessment record for each second assessment object.

[0033] In a second aspect, the present application also provides a network security assessment device, including:

[0034] An acquisition module, used to acquire first object information and evaluation standard information of a first evaluation object;

[0035] A query module, used to query target work instruction template data corresponding to the first object information;

[0036] A generating module, used for generating target implementation record data based on the first object information, the target work instruction template data and the preset first implementation record form template;

[0037] The evaluation module is used to perform a network security evaluation on the first evaluation object according to the target implementation record data and evaluation standard information.

[0038] In a third aspect, the present application further provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0039] Obtaining first object information and evaluation standard information of a first evaluation object;

[0040] Query target work instruction template data corresponding to the first object information;

[0041] Generate target implementation record data based on the first object information, the target work instruction template data and the preset first implementation record form template;

[0042] Conduct a network security assessment on the first assessment object based on the target implementation record data and assessment standard information.

[0043] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the following steps are implemented:

[0044] Obtaining first object information and evaluation standard information of a first evaluation object;

[0045] Query target work instruction template data corresponding to the first object information;

[0046] Generate target implementation record data based on the first object information, the target work instruction template data and the preset first implementation record form template;

[0047] Conduct a network security assessment on the first assessment object based on the target implementation record data and assessment standard information.

[0048] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0049] Obtaining first object information and evaluation standard information of a first evaluation object;

[0050] Query target work instruction template data corresponding to the first object information;

[0051] Generate target implementation record data based on the first object information, the target work instruction template data and the preset first implementation record form template;

[0052] Conduct a network security assessment on the first assessment object based on the target implementation record data and assessment standard information.

[0053] The network security evaluation method, device, computer equipment, computer-readable storage medium and computer program product first obtain the first object information and evaluation standard information of the first evaluation object, query the target operation instruction template data corresponding to the first object information, and then generate the target implementation record data based on the first object information, the target operation instruction template data and the preset first implementation record form template, and then perform network security evaluation on the first evaluation object according to the target implementation record data and the evaluation standard information, thereby realizing the automated execution of network security evaluation. By pre-setting the first implementation record form template, the situation of missed detection can be avoided, and then the target implementation record data is automatically generated in combination with the target operation instruction template data, which can effectively avoid the situation of manual operation of word processing tools to fill in the implementation record data, possible indicator corresponding errors, text editing errors, etc., and then by automatically matching the target implementation record data and the evaluation standard information to perform network security evaluation, it can avoid omissions, miscalculations, etc., thereby comprehensively improving the accuracy of network security evaluation results. On the other hand, compared with the "manual operation" method, automated network security evaluation is more efficient, and the required time cost and labor cost are greatly reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0055] Figure 1 A schematic diagram of a process flow of a network security assessment method in one embodiment;

[0056] Figure 2 A schematic diagram of a flow chart of the steps of querying template data of a template work instruction book in an embodiment;

[0057] Figure 3 A flowchart of steps for generating a rectification suggestion record in one embodiment;

[0058] Figure 4 A schematic diagram of a process for reusing network security assessment records in one embodiment;

[0059] Figure 5 A structural block diagram of a network security evaluation device in one embodiment;

[0060] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0061] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0062] In traditional technology, network security assessment is manually implemented by assessors based on various standards for network security assessment. In the series of processes of conducting on-site network security assessment activities, assessors first use office software such as Office to prepare assessment work instructions for each first assessment object based on various standards related to network security assessment, and then use office software such as Office to prepare assessment record sheets based on the assessment work instructions. Finally, after implementing the on-site assessment, assessors record the assessment results in the assessment record sheet and calculate the assessment record score. Finally, they use the computer's built-in file management system to manage various assessment indicators.

[0063] With the official implementation of the new standard of the Cybersecurity Level Protection System 2.0, information security technology and cybersecurity protection have entered the 2.0 era. Compared with the Cybersecurity Level Protection System 1.0, which only classified information systems, the Cybersecurity Level Protection System 2.0 has expanded the scope of protection objects to include information systems, basic information networks, cloud computing platforms, big data platforms, Internet of Things systems, industrial control systems, and networks using mobile Internet technology. At the same time, the level of informatization of various enterprises and institutions is getting higher and higher, the first evaluation objects are becoming more and more complex, the number of systems, platforms, and networks involved in the evaluation work is increasing, and the workload of the evaluators in the field is also increasing. Considering that there are hundreds of first evaluation objects in the evaluated system, this means that dozens or hundreds of evaluation work instructions need to be developed and hundreds of evaluation record sheets need to be established, which will be a huge workload for the "manual work" evaluators. At the same time, as the number increases, the management of evaluation records will also become complicated. It is found that the "manual work" method can no longer meet the needs of the growth of the evaluation business.

[0064] In an exemplary embodiment, Figure 1As shown, a network security assessment method is provided. This embodiment uses the method applied to a terminal as an example, wherein the terminal may be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices may be smart speakers, smart TVs, smart air conditioners, smart car devices, projection devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. The head-mounted devices may be virtual reality (VR) devices, augmented reality (AR) devices, smart glasses, etc. It is understandable that the method may also be applied to servers, and may also be applied to systems including terminals and servers, and may be implemented through the interaction between the terminals and servers. In this embodiment, the method includes the following steps S10-S30. Among them:

[0065] Step S10, obtaining first object information and evaluation standard information of a first evaluation object.

[0066] Among them, network security assessment is a method for evaluating the security of information systems, the purpose of which is to identify potential security vulnerabilities, assess risks, and provide suggestions for improvement measures, thereby helping enterprises and institutions improve their overall information security level. An information system usually contains multiple assessment objects, including at least one of a physical computer room, network equipment, security equipment, servers, terminal equipment, other systems or equipment, system management software / platform, business application system / platform, data resources, security-related personnel, and security management documents. For each assessment object in the information system, the network security assessment method provided in this embodiment can be used to perform network security assessment.

[0067] As an example, for each evaluation object, a network security evaluation can be conducted for one or more evaluation indicators. For example, starting from the security protection level of the graded object, according to its business information security protection level and system service security protection level, three types of security requirements S / A / G (Security / Assurance / Governance) of the corresponding security protection level and level can be selected from the Basic Requirements to form a set of alternative evaluation indicators.

[0068] Evaluation standard information refers to relevant information of the implementation standards related to network security evaluation, including at least one of evaluation standard identification information, evaluation standard content information, etc. As an example, the network security evaluation in this embodiment can be carried out based on the national standard "Information Security Technology-Basic Requirements for Network Security Level Protection". Considering that the life of national standards is generally 5 years, the national standards will be revised or re-formulated after the life. Therefore, the evaluation standard identification information can be stored by maintaining the evaluation standard library data table. The evaluation standard library data table is used to dynamically record different implementation standards. The main field parameters of the evaluation standard library data table include at least one of the primary key ID (Identity document, identification number), standard number, standard name and remarks. The evaluation standard library content data table can be maintained, and the main field parameters of the evaluation standard library content data table include at least one of security level, control class, control point, requirement item, S / A / G type, type, weight, high risk-class 1 and high risk-class 2. In various data storage systems, databases and tables can be built according to the table field structure described in this embodiment, and management operations such as adding, deleting, modifying, and querying data can be performed with the help of database connection interfaces and any supported programming language. In order to facilitate data management for ordinary users, client application editing interfaces with user graphical interfaces such as Web applications (an application program accessed through an Internet browser), Windows desktop applications (application programs designed for Microsoft Windows operating systems), and iOS applications (application programs designed for iOS operating systems) can also be provided to support users to edit evaluation standard information in client applications, and editing operations include at least one of adding, importing, exporting, modifying, deleting, and querying.

[0069] Exemplarily, after determining the network security assessment task of the target system, any assessment object corresponding to the network security assessment task can be selected from the target system as the first assessment object; then, the assessment standard identification information corresponding to the first assessment object is queried from the preset assessment standard library data table, the assessment standard library content data table corresponding to the assessment standard identification information is determined, and the assessment standard content information corresponding to the first assessment object is queried from the assessment standard library content data table corresponding to the assessment standard identification information.

[0070] As an example, after obtaining the first object information of the first evaluation object, you can also first query the target historical evaluation implementation record table corresponding to the first object information from the pre-generated and stored historical evaluation implementation record table; if the target historical evaluation implementation record table corresponding to the first object information is queried, then extract the target implementation record data from the target historical evaluation implementation record table, and execute the steps of performing a network security evaluation on the first evaluation object according to the target implementation record data and the evaluation standard information, without repeatedly generating the target implementation record data; if the target historical evaluation implementation record table corresponding to the first object information is not queried, execute the steps of obtaining the evaluation standard information to generate the target implementation record data.

[0071] Step S20, querying the target operation instruction template data corresponding to the first object information.

[0072] Among them, the work instruction refers to the operation manual of the network security assessment, which is used to guide the assessment team on how to conduct the network security assessment. The work instruction includes at least one of the specific steps, methods, tools, and techniques of the network security assessment, as well as the key points that need to be paid attention to during the assessment process. The corresponding work instruction template data can be set in advance for common assessment object types, and then, in the actual process of conducting the network security assessment, it is only necessary to query and select the corresponding target work instruction template data according to the first object information of the first assessment object.

[0073] As an example, the method of setting corresponding work instruction template data for common evaluation object types includes: one or more template objects to be built can be constructed in advance according to common evaluation object types and preset security levels, and corresponding work instruction template data is constructed for each template object to be built. The method of constructing the corresponding work instruction template data includes: obtaining the evaluation object type and security level of the template object to be built, referring to "GB / T28448-2019 Information Security Technology Network Security Level Protection Evaluation Requirements", mapping the evaluation indicators, evaluation implementation and unit judgment to the evaluation object type, and combining the characteristics of the evaluation object type, selecting the evaluation method to be adopted and determining the evaluation steps and expected results, and forming a specific evaluation guide for the template object to be built.

[0074] As an example, the work instruction template data can be stored by maintaining the work instruction template data table and the work instruction template content data table. The work instruction template data is stored in the work instruction template content data table, including at least one of control class data, control point data, requirement item data, assessment requirement data, high-risk determination guide data, assessment step data, expected result data, result record data, compliance data, rectification suggestion data and remarks information. The main field parameters of the work instruction template data table include at least one of the primary key ID, work instruction name, security level, control class, type and remarks. The main field parameters of the work instruction template content data table include at least one of the control class, control point, requirement item, assessment requirement, high-risk determination guide, assessment step, expected result, result record, compliance, rectification suggestion and remarks. In various data storage systems, databases and tables can be built according to the table field structure described in this embodiment, and management operations such as adding, deleting, modifying and checking data can be performed with the help of a database connection interface and any supported programming language. In order to enable ordinary users to manage data conveniently, client application editing interfaces with user graphical interfaces such as Web applications (an application accessed through an Internet browser), Windows desktop applications (applications designed for the Microsoft Windows operating system), and iOS applications (applications designed for the iOS operating system) can also be provided to support users in editing work instruction template data in client applications. Editing operations include at least one of adding, importing, exporting, modifying, deleting, and querying.

[0075] Exemplarily, after obtaining the first object information of the first assessment object, the operation instruction name or operation instruction identification information corresponding to the first object information can be queried from the preset operation instruction template data table, and then based on the operation instruction name or operation instruction identification information, the operation instruction template data corresponding to the operation instruction name or operation instruction identification information can be queried from the preset operation instruction template content data table as the target operation instruction template data corresponding to the first object information.

[0076] Step S30, generating target implementation record data based on the first object information, the target work instruction template data and the preset first implementation record form template.

[0077] Among them, the implementation record form is a document used to record the specific details and results of various activities in the assessment process. The implementation record form usually includes the date, time, participants, tools and techniques used, problems found, evaluation results and subsequent action plans of the assessment activities waiting to be filled in. By abstracting the commonalities of the implementation record forms of different assessment objects, the first implementation record form template can be compiled. The target implementation record data refers to the data filled in the first implementation record form template, including at least one of the task identification information, the name of the assessment object, the type of level, the control point number, the corresponding security level, the requirement item number, the requirement item type, the assessment results, the compliance result record, the non-compliance result record, the degree of compliance and remarks.

[0078] Exemplarily, after the target work instruction template data is queried, according to the content prompt information corresponding to each to-be-filled item in the preset first implementation record form template, the to-be-filled data that matches the content prompt information is matched from the first object information and the target work instruction template data, and the to-be-filled data is filled in the to-be-filled item corresponding to the content prompt information; after all the to-be-filled items in the first implementation record form template are filled in with data, an assessment implementation record form corresponding to the first assessment object is obtained, and the data in the assessment implementation record form is the target implementation record data.

[0079] As an example, the target operation instruction template data includes the expected result data corresponding to each evaluation indicator, and the items to be filled in the first implementation record form template include the evaluation result items of each evaluation indicator; based on the evaluation indicator, the expected result data corresponding to each evaluation indicator can be mapped to the evaluation result item corresponding to the evaluation indicator.

[0080] As an example, after all the items to be filled in the first implementation record form template are filled with data and the evaluation implementation record form corresponding to the first evaluation object is obtained, the data in the evaluation implementation record form can be first determined as the initial implementation record data, and the evaluation implementation record form and the initial implementation record data therein are displayed; if an editing operation on the initial implementation record data is detected, the edited target implementation record data is obtained; if no editing operation on the initial implementation record data is detected, the initial implementation record data is determined as the target implementation record data.

[0081] Step S40: Conducting a network security assessment on the first assessment object according to the target implementation record data and assessment standard information.

[0082] It should be noted that in traditional technologies, after filling out the assessment implementation record form, the assessor needs to manually calculate the management level score, technical score, and overall score based on the network security assessment scoring algorithm. If some assessment implementation record data has changed, it may have to be recalculated, and the whole process is relatively cumbersome.

[0083] Exemplarily, after determining the target implementation record data and evaluation standard information corresponding to the first evaluation object, the information required for scoring can be extracted from the target implementation record data and the evaluation standard information based on a preset network security evaluation scoring algorithm, and the information required for scoring can be substituted into the network security evaluation scoring algorithm to automatically calculate the network security score of the first evaluation object.

[0084] The network security assessment score algorithm can be determined based on the "Network Security Level Protection Assessment Report Template (2021 Edition)" and other documents. As an example, the network security assessment score M = V t +V m , where V t For technical scores, V m For the management score, V t and V m The following formula can be used for calculation:

[0085]

[0086]

[0087] Among them, x k =(0,0.5,1), S=100 / n,

[0088] Where y is the attention coefficient, which ranges from 0 to 1 and is given by the level protection management department. The default value is 0.5; n is the total number of evaluation indicators involved in the measured object (excluding inapplicable items), n=t+m; t is the total number of evaluation indicators corresponding to the technical aspects (excluding inapplicable items); V t is the score of the technical aspect; m is the total number of evaluation indicators corresponding to the management aspect (excluding inapplicable items); V m is the score for management; k is the importance of the evaluation indicator k, which is divided into general, important and critical; x k is the score of evaluation indicator k; if evaluation indicator k involves multiple evaluation objects, then x k The value is the arithmetic mean of the scores of multiple evaluation objects. When conducting on-site grade evaluation, the total number of evaluation indicators has actually been determined, that is, n is a fixed value. In order to unify the contribution rate of each indicator item to the comprehensive score, a uniform processing coefficient S is introduced, S=100 / n; each evaluation indicator obtains a compliance information based on the evidence obtained during the on-site evaluation. According to the evaluation indicator set {compliant, partially compliant, basically compliant, not applicable}, the compliance of each evaluation indicator is determined and assigned a value, which is counted as x k, using a scoring system of (0, 0.5, 1), that is, 1 point for compliance, 0.5 points for partial compliance, and 0 points for non-compliance; the above network security evaluation scoring algorithm deducts points for non-compliant indicators and partially compliant indicators based on the baseline score (or), and no more points will be deducted when the deduction is less than 0 points. The basic score of each evaluation indicator is 100 / n. When there are non-compliant indicators and partially compliant indicators, the importance of the evaluation indicator w needs to be considered. k , that is, weight, to deduct points, the deduction degree coefficient f(w k ), f(w k ) value will result in more points being deducted for non-compliant indicators whose importance is critical.

[0089] As an example, performing a network security assessment on a first assessment object according to target implementation record data and assessment standard information includes: based on the assessment task identification information in the first object information, jointly querying the target implementation record data and the assessment standard information, using the assessment task identification information being consistent with the input parameter value, and the level type belonging to secure physical environment, secure communication network, secure area boundary, network equipment, security equipment, business application system / platform, server / storage device, terminal equipment, other system or equipment, data resource, system management software / platform and security management center as query conditions, querying to obtain technical aspect assessment score records V t List; the task identification information of the assessment is consistent with the input parameter value, and the level type belongs to safety management system, safety management organization, safety management personnel, safety construction management, and safety operation and maintenance management as the query condition, and the management assessment score record V is obtained. m List; Score V for initialization techniques t =50 points for management V m =50, obtain the total number of evaluation indicators involved in the first evaluation object according to the queried records n = V t List.size() + V m List.size(), coefficient s = 100 / n. Calculate the technical score V t :Traverse the technical aspect assessment score records; considering the case of multiple objects, it is necessary to calculate the arithmetic mean of the scores of each technical aspect assessment score record, that is, take all the technical aspect assessment score records of the current task with the same indicators as the current technical aspect assessment score record, convert the compliance of the technical aspect assessment score record into a score (1 point for compliance, 0.5 points for partial compliance, and 0 points for non-compliance), and add up the scores of the technical aspect assessment score records with the same indicators and divide them by the number of technical aspect assessment score records with the same indicators to get the arithmetic mean of the technical aspect assessment score records with the same indicators; V is updated once each record is traversedt Value, V t =V t ’ - The current technical evaluation score record corresponding to f(w k )*(1-arithmetic mean)*s,V t ’ V calculated after the last traversal t Calculate the management score V m :Traverse the management aspect assessment score records; considering the multi-object situation, it is necessary to calculate the arithmetic mean of the scores of each management aspect assessment score record, that is, take all the management aspect assessment score records of the current task that have the same indicators as the current management aspect assessment score record, convert the compliance of the management aspect assessment score record into a score (1 point for compliance, 0.5 points for partial compliance, and 0 points for non-compliance), and add up the scores of the management aspect assessment score records with the same indicators and divide them by the number of management aspect assessment score records with the same indicators, so as to obtain the arithmetic mean of the management aspect assessment score records with the same indicators; V is updated once each record is traversed m Value, V m =V m ’ - The f(w) corresponding to the current management evaluation score record k )*(1-arithmetic mean)*s,V m ’ V calculated after the last traversal m After all the traversals are completed, V t and V m Sum the values ​​and get the total score of the assessment task M=vt+vm, and return M.

[0090] In the above network security assessment method, firstly, the first object information and assessment standard information of the first assessment object are obtained, the target operation instruction book template data corresponding to the first object information is queried, and then the target implementation record data is generated based on the first object information, the target operation instruction book template data and the preset first implementation record form template, and then the network security assessment is performed on the first assessment object according to the target implementation record data and the assessment standard information, thereby realizing the automated execution of the network security assessment. By pre-setting the first implementation record form template, the situation of missed detection can be avoided, and then the target implementation record data is automatically generated in combination with the target operation instruction book template data, which can effectively avoid the situation of manual operation of the word processing tool to fill in the implementation record data, the possible indicator corresponding errors, the text editing errors, etc., and then the network security assessment is performed by automatically matching the target implementation record data and the assessment standard information, which can avoid the situation of missed calculation, wrong calculation, etc., thereby comprehensively improving the accuracy of the network security assessment results. On the other hand, compared with the "manual operation" method, the efficiency of automated network security assessment is higher, and the required time cost and labor cost are greatly reduced.

[0091] In an exemplary embodiment, Figure 2 As shown, querying the target work instruction template data corresponding to the first object information includes steps S21 to S22. Among them:

[0092] Step S21, querying a preset object management data table to determine the target work instruction template identification information corresponding to the first object information.

[0093] Among them, the object management data table is a data table used to maintain the object information of the evaluation object. The main field parameters of the object management data table include at least one of the evaluation object identification information, the task identification information, the evaluation object name, the work instruction template identification information, and whether it is an evaluation object. According to the actual situation, you can create a table for each type of evaluation object, or you can create a general table to distinguish various types of first evaluation objects by adding an "evaluation object type" field. In various data storage systems, you can build libraries and tables according to the table field structure described in this embodiment, and use the database connection interface and any supported programming language to perform management operations such as adding, deleting, modifying, and checking data. In order for ordinary users to manage data conveniently, client application editing interfaces with user graphical interfaces such as Web applications, Windows desktop applications, and iOS applications can also be provided to support users to edit the object information of evaluation objects in client applications. The editing operations include at least one of adding, importing, exporting, modifying, deleting, and querying.

[0094] Exemplarily, after obtaining the first object information of the first assessment object, the target work instruction template identification information corresponding to the first object information may be queried from a preset object management data table.

[0095] Step S22, obtaining target work instruction template data corresponding to the target work instruction template identification information.

[0096] Exemplarily, after determining the target work instruction template identification information, the work instruction name or the work instruction template content data table identification information corresponding to the target work instruction template identification information can be queried from a preset work instruction template data table, and then based on the work instruction name or the work instruction template content data table identification information, the work instruction template data corresponding to the work instruction name or the work instruction template content data table identification information can be queried from multiple preset work instruction template content data tables as the target work instruction template data corresponding to the first object information.

[0097] As an example, the main field parameters of the object management data table include evaluation object identification information, task identification information and work instruction template identification information. The first object information includes the evaluation object identification information and the task identification information. The evaluation object identification information in the first object information is compared with the data under the evaluation object identification information parameter in the object management data table, and the task identification information in the first object information is compared with the data under the task identification information parameter in the object management data table. The target data whose evaluation object identification information and task identification information are consistent are found, and the work instruction template identification information corresponding to the target data is determined as the target work instruction template data corresponding to the first object information.

[0098] In this embodiment, for a system that contains a large number of first evaluation objects and for each first evaluation object, multiple evaluation indicators need to be evaluated, the first evaluation objects in the system and related information such as the evaluation indicators of each first evaluation object can be managed in an orderly manner through the object management data table. Combined with the visual interface, the convenience and accuracy of users in managing the first object information of the first evaluation objects can be improved.

[0099] In an exemplary embodiment, before querying the preset object management data table to determine the target work instruction template identification information corresponding to the first object information, steps S201 to S205 are included. Among them:

[0100] Step S201, obtaining the object type and security level of the first evaluation object.

[0101] Step S202: query at least one initial work instruction template identification information that matches both the object type and the security level.

[0102] Among them, the object type refers to the type of the first evaluation object, including at least one of a secure physical environment, a secure communication network, a secure area boundary, a network device, a security device, a business application system / platform, a server / storage device, a terminal device, other systems or devices, data resources, system management software / platform, a security management center, a security management system, a security management organization, security management personnel, security construction management, and security operation and maintenance management. The security level refers to the security level of the evaluation task to which the first evaluation object belongs, which can be determined in advance based on the actual needs of the evaluation task.

[0103] Exemplarily, before conducting a network security assessment, an object management data table can be constructed for the first assessment object in the system that requires a network security assessment. In the process of constructing the object management data table, assessment object identification information, task identification information, assessment object name and other information can be directly imported from the acquired first object information, and the work instruction template identification information can be matched and imported based on preset matching rules, and can also be input and edited by the user; before the user inputs and edits, the initial work instruction template data can be pre-matched and imported for the user to determine whether modification is required, and edit according to actual needs, which can provide a reference for the user and has a certain probability that no modification is required, thereby simplifying user operations; the initial work instruction template data can be matched and imported based on the object type and security level of the first assessment object, so the object type and security level of the first assessment object can be obtained first; then, the work instruction template identification information that matches both the object type and security level is queried from the preset work instruction template data table as the initial work instruction template identification information.

[0104] Step S203: display identification information of each initial operation instruction template.

[0105] Exemplarily, after the initial work instruction template identification information is determined, the initial work instruction template identification information is displayed through the display interface of the user terminal, so that the user can select the target work instruction template identification information that meets the actual needs.

[0106] Step S204, in response to the operation of selecting a work instruction template, obtaining identification information of a selected target work instruction template, where the identification information of the target work instruction template is one of the identification information of each initial work instruction template.

[0107] Exemplarily, when a user's selection operation on any initial work instruction template identification information is detected, the selected initial work instruction template identification information is used as the target work instruction template identification information.

[0108] Step S205: Generate an object management data table, and construct an association relationship between the target work instruction template identification information and the first object information in the object management data table.

[0109] Exemplarily, after the user selects the initial work instruction template identification information that needs to be modified, the user can confirm that the work instruction template selection operation is completed by clicking a confirmation button or clicking to generate an object management data table. After detecting that the user has completed the work instruction template selection operation, the object management data table can be generated based on the edited work instruction template identification information and other first object information that needs to be entered into the object management data table. In the newly generated object management data table, there is a one-to-one correspondence between the target work instruction template identification information and the first object information.

[0110] In this embodiment, before the user inputs and edits, the initial work instruction template data can be pre-matched and imported so that the user can determine whether modification is needed and edit according to actual needs. This can provide a reference for the user and there is a certain probability that no modification is required, thereby simplifying user operations. At the same time, the user is provided with a work instruction template selection function so that the user can re-select more appropriate target work instruction template identification information for each first assessment object according to actual needs.

[0111] In an exemplary embodiment, based on the first object information, the target work instruction template data and the preset first implementation record form template, the target implementation record data is generated, including steps S31 to S32. Among them:

[0112] Step S31, generating an assessment implementation record sheet based on the first object information, the target work instruction template data and the preset first implementation record sheet template, and displaying the assessment implementation record sheet, wherein the assessment implementation record sheet includes initial implementation record data.

[0113] Exemplarily, after the target work instruction template data is queried, according to the content prompt information corresponding to each to-be-filled item in the preset first implementation record form template, the to-be-filled data matching the content prompt information is matched from the first object information and the target work instruction template data, and the to-be-filled data is filled into the to-be-filled item corresponding to the content prompt information; after all the to-be-filled items in the first implementation record form template are filled with data, an evaluation implementation record form corresponding to the first evaluation object is obtained, and the data in the evaluation implementation record form is first determined as initial implementation record data, and the evaluation implementation record form and the initial implementation record data are displayed to the user through the user terminal.

[0114] Step S32, in response to the editing operation on the initial implementation record data, obtaining the edited target implementation record data.

[0115] Exemplarily, the user can confirm whether it is necessary to edit the initial implementation record data in the assessment implementation record table through the assessment implementation record table and the initial implementation record data displayed on the user terminal; if an editing operation on any one or more of the initial implementation record data is detected, the implementation record data in the edited assessment implementation record table will be determined as the target implementation record data for the first assessment object.

[0116] In this embodiment, by matching an initial value for each item to be filled in, when the initial value is consistent with the actual situation, the operation of the user filling in the assessment implementation record form can be effectively simplified. When the initial value is inconsistent with the actual situation, an example of filling in the assessment implementation record form can also be provided to the user. At the same time, by opening the editing function of the implementation record data, the user is allowed to modify the implementation record data according to the actual situation, making the implementation record data more standardized, thereby avoiding the situation where the evaluation personnel's evaluation record expression style is large, resulting in insufficient standardization of the implementation record data and low accuracy, and novices do not know how to write assessment records. The standardization and convenience of network security assessment can be effectively improved.

[0117] In an exemplary embodiment, Figure 3 As shown, after performing network security assessment on the first assessment object according to the target implementation record data and assessment standard information, it also includes steps S511 to S514. Among them:

[0118] Step S511, extracting compliance information of at least one evaluation indicator corresponding to the first evaluation object from the target implementation record data, and extracting weight information of at least one evaluation indicator corresponding to the first evaluation object from the evaluation standard information.

[0119] It should be noted that after completing the network security assessment, the assessors are also required to prepare a rectification proposal based on the network security assessment records of each assessment object. Since each assessment object corresponds to at least one table of network security assessment records and each table has dozens of records, the process of manually extracting records with compliance information as "non-compliant" and "partially compliant" is relatively complicated and time-consuming.

[0120] Among them, the compliance information is used to characterize whether the evaluation object meets the preset requirements of the evaluation indicators. For example, the compliance information corresponding to each evaluation indicator of each evaluation object can be one of compliance, non-compliance and partial compliance. The evaluator can modify the compliance information in the target implementation record data, that is, the compliance information in the target implementation record data can be the preset value in the target operation instruction template data, or it can be the actual value input by the evaluator based on the actual situation. For example, the compliance information of evaluation indicator A, the preset value in the target operation instruction template data corresponding to it is compliance, and the evaluator finds that it is actually partially compliant during the evaluation, then the compliance information of evaluation indicator A can be modified from compliance to partial compliance. Weight information is used to characterize the importance of each evaluation indicator. Generally speaking, the higher the importance, the higher the weight. The weight information is determined by the evaluation standard information and cannot be modified by the evaluator. That is, when the standard is formulated, the importance of each evaluation indicator will be determined, and its corresponding weight information will be determined.

[0121] Exemplarily, after completing the implementation record of the first evaluation object, for each evaluation indicator of the first evaluation object, the compliance information corresponding to each evaluation indicator can be extracted from the target implementation record data, and the weight information corresponding to each evaluation indicator can be extracted from the evaluation standard information.

[0122] Step S512, detecting the deduction score for each evaluation indicator according to the compliance information and weight information.

[0123] Exemplarily, after obtaining the compliance information and weight information of each evaluation indicator, the compliance information is first converted into a compliance score, and the compliance score is positively correlated with the degree of compliance, that is, the compliance score when the compliance information is compliant is the highest, and the compliance score when the compliance information is non-compliant is the lowest; the weight information is converted into a deduction degree coefficient, and the deduction degree coefficient is positively correlated with the weight, that is, the higher the weight represented by the weight information, the higher the deduction degree coefficient; then, based on the compliance score and the deduction degree coefficient of each evaluation indicator, the deduction score of each evaluation indicator is calculated, and the deduction score is negatively correlated with the compliance score, and positively correlated with the deduction degree coefficient.

[0124] As an example, the deduction score lost can be calculated using the following formula:

[0125] Lost=deduction coefficient*(1-compliance score)*S; where S is the homogenization coefficient, S=100 / n, and n is the total number of evaluation indicators.

[0126] Step S513, when a deduction evaluation indicator is detected based on the deduction score, a target rectification suggestion corresponding to the implementation deduction evaluation indicator is extracted from the implementation target implementation record data, and the deduction evaluation indicator is at least one of the evaluation indicators.

[0127] Among them, if the deduction score of the evaluation indicator is greater than the preset deduction threshold, it means that there is a deduction situation for the evaluation indicator, and the evaluation indicator is determined as a deduction evaluation indicator. Usually, rectification suggestions are required for the deduction evaluation indicators. The manual preparation of rectification suggestions has poor standardization, and there may be omissions and wrong selection of records when archiving data. In addition, the preparation process is relatively cumbersome and time-consuming.

[0128] Corrective suggestions can be compiled in advance in the work instruction template data and can be directly obtained and used during the network security assessment process.

[0129] Exemplarily, when an evaluation indicator with a deduction score higher than a preset deduction threshold is detected, the evaluation indicator with a deduction score higher than the preset deduction threshold is determined as a deduction evaluation indicator, and the target rectification suggestion corresponding to the deduction evaluation indicator is extracted from the target implementation record data.

[0130] Step S514: Generate a rectification suggestion record corresponding to the first evaluation object based on the target rectification suggestion and the deduction score.

[0131] Among them, the rectification suggestion record is used to record the rectification suggestions for the deduction evaluation indicators, including at least the rectification suggestions and deduction scores of the deduction evaluation indicators, and may also include at least one of the evaluation object name, control point, deduction evaluation indicator name, problem description, risk level and rectification difficulty. The evaluation object name, control point, deduction evaluation indicator name, problem description, risk level and rectification difficulty can all be queried and obtained from the target implementation record data or evaluation standard information.

[0132] Exemplarily, after obtaining the target rectification suggestions, the target rectification suggestions and the deduction scores can be integrated to form a rectification suggestion record corresponding to the first evaluation object. At least one of the evaluation object name, control point, deduction evaluation indicator name, problem description, risk level and rectification difficulty can also be integrated into the rectification suggestion record.

[0133] In this embodiment, by automatically generating rectification suggestions, the preparation time can be shortened, and the labor cost and time cost can be saved.

[0134] In an exemplary embodiment, Figure 4 As shown, after performing a network security assessment on the first assessment object according to the target implementation record data and the assessment standard information, it also includes steps S521 to S524. Among them:

[0135] Step S521: Generate a first network security assessment record for a first assessment object.

[0136] It should be noted that in actual evaluation work, it is often found that "the owner has built multiple evaluation objects of the same type". For example, a system uses 10 MySQL database servers with the same configuration, or after evaluation, it is found that a system with the same mode and configuration has been tested before. The network security evaluation results of these evaluation objects of the same type are often the same or have only slight differences. Even if the method of repeatedly generating target implementation record data is adopted, when the implementation record data needs to be edited to meet actual needs, the same editing operation still needs to be repeated.

[0137] Exemplarily, after performing a network security assessment on the first assessment object, relevant information of the network security assessment may be integrated to form a first network security assessment record, and the first network security assessment record may be stored as a reusable assessment record.

[0138] Step S522: in response to the multiplexing operation of the evaluation records for the first evaluation object and at least one second evaluation object, obtaining the second object information of each second evaluation object.

[0139] Exemplarily, after conducting a network security assessment on a first assessment object, when the user conducts a network security assessment on other assessment objects, if it is found that one or more second assessment objects are similar to the first assessment object, the first network security assessment record of the first assessment object can be reused; if an operation of reusing the first network security assessment record of the first assessment object to the assessment record of the second assessment object is detected, the second object information of the second assessment object can be obtained first.

[0140] Step S523, mapping the second object information to the preset second implementation record table template, and generating a target implementation record table template corresponding to each second evaluation object.

[0141] Exemplarily, based on the information characteristics of the second object information, the second object information is mapped to the corresponding items to be filled in the preset second implementation record form template, and a target implementation record form template carrying the second object information of each second evaluation object is generated. For example, the second implementation record form template includes items to be filled in with object identification information, and the second object information contains object identification information. Then, the object identification information in the second object information can be filled in the items to be filled in with the object identification information in the second implementation record form template.

[0142] Step S524: Map the first network security assessment record to the items to be filled in each target implementation record form template to generate a second network security assessment record for each second assessment object.

[0143] Exemplarily, the items to be filled in the target implementation record form template that match the information of the second object have been filled in with data, and some items to be filled in have not been filled in with data. Based on the content prompt information of these items to be filled in, the corresponding data can be queried from the first network security assessment record, and the queried data can be mapped to the corresponding items to be filled in the target implementation record form template. After all the items to be filled in the target implementation record form template are filled in with data, the second network security assessment record of the second assessment object is obtained.

[0144] In this embodiment, by reusing previously generated network security assessment records, it is possible to further reduce repeated operations in the network security assessment process and simplify the network security assessment process.

[0145] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0146] Based on the same inventive concept, the embodiment of the present application also provides a network security assessment device for implementing the network security assessment method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more network security assessment device embodiments provided below can refer to the limitations of the network security assessment method above, and will not be repeated here.

[0147] In an exemplary embodiment, Figure 5 As shown, a network security evaluation device is provided, including: an acquisition module 502, a query module 504, a generation module 506 and an evaluation module 508, wherein:

[0148] An acquisition module 502 is used to acquire first object information and evaluation standard information of a first evaluation object;

[0149] A query module 504 is used to query the target work instruction template data corresponding to the first object information;

[0150] A generating module 506, configured to generate target implementation record data based on the first object information, the target work instruction template data and the preset first implementation record form template;

[0151] The evaluation module 508 is used to perform a network security evaluation on the first evaluation object according to the target implementation record data and the evaluation standard information.

[0152] In an exemplary embodiment, the query module 504 is further configured to:

[0153] Querying a preset object management data table to determine the target work instruction template identification information corresponding to the first object information;

[0154] Obtain the target work instruction book template data corresponding to the target work instruction book template identification information.

[0155] In an exemplary embodiment, the query module 504 is further configured to:

[0156] Obtaining the object type and security level of the first evaluation object;

[0157] Querying at least one initial work instruction template identification information matching both the object type and the security level;

[0158] Display the identification information of each initial work instruction template;

[0159] In response to the operation of selecting a work instruction template, obtaining identification information of a selected target work instruction template, where the identification information of the target work instruction template is one of the identification information of each initial work instruction template;

[0160] An object management data table is generated, and an association relationship between the target work instruction template identification information and the first object information is constructed in the object management data table.

[0161] In an exemplary embodiment, the generating module 506 is further configured to:

[0162] Generate an evaluation implementation record form based on the first object information, the target work instruction template data and the preset first implementation record form template, and display the evaluation implementation record form, wherein the evaluation implementation record form includes initial implementation record data;

[0163] In response to an editing operation on the initial implementation record data, edited target implementation record data is acquired.

[0164] In an exemplary embodiment, the network security evaluation device further includes a rectification suggestion recording module. After performing a network security evaluation on the first evaluation object according to the target implementation record data and the evaluation standard information, the rectification suggestion recording module is further used to:

[0165] Extracting compliance information of at least one evaluation indicator corresponding to the first evaluation object from the target implementation record data, and extracting weight information of at least one evaluation indicator corresponding to the first evaluation object from the evaluation standard information;

[0166] According to the compliance information and weight information, detect the deduction score of each evaluation indicator;

[0167] In the case where a deduction evaluation indicator is detected based on the deduction score, a target rectification suggestion corresponding to the deduction evaluation indicator is extracted from the implementation target implementation record data, where the deduction evaluation indicator is at least one of the evaluation indicators;

[0168] Based on the target rectification suggestions and deduction scores, a rectification suggestion record corresponding to the first evaluation object is generated.

[0169] In an exemplary embodiment, the network security evaluation device further includes a reuse module, and after performing network security evaluation on the first evaluation object according to the target implementation record data and evaluation standard information, the reuse module is further used to:

[0170] Generate a first network security assessment record for a first assessment object;

[0171] In response to the multiplexing operation of the evaluation records for the first evaluation object and at least one second evaluation object, obtaining second object information of each second evaluation object;

[0172] Mapping the second object information to the preset second implementation record table template to generate a target implementation record table template corresponding to each second evaluation object;

[0173] The first network security assessment record is mapped to the to-be-filled items in each target implementation record form template to generate a second network security assessment record for each second assessment object.

[0174] Each module in the above network security assessment device can be implemented in whole or in part by software, hardware, or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute the operations corresponding to each module above.

[0175] In an exemplary embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as shown in FIG. Figure 6As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and the external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, near field communication (Near Field Communication, NFC) or other technologies. When the computer program is executed by the processor, a network security assessment method is implemented. The display unit of the computer device is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a button, trackball or touchpad set on the computer device shell, or an external keyboard, touchpad or mouse.

[0176] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0177] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0178] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0179] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0180] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0181] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0182] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0183] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A network security evaluation method, characterized in that: The method comprises: Obtaining first object information and evaluation standard information of a first evaluation object; Querying the target work instruction book template data corresponding to the first object information from the preset work instruction book template content data table; Generate target implementation record data based on the first object information, the target work instruction template data and a preset first implementation record form template; Conducting a network security assessment on the first assessment object according to the target implementation record data and the assessment standard information; The target implementation record data refers to the data filled in the preset first implementation record form template; the target implementation record data is generated based on the first object information, the target operation instruction template data and the preset first implementation record form template, including: According to the content prompt information corresponding to each to-be-filled item in the preset first implementation record form template, matching the to-be-filled data matching the content prompt information from the first object information and the target work instruction template data; Fill the data to be filled into the to-be-filled item corresponding to the content prompt information; After all the items to be filled in the first implementation record form template are filled with data, the evaluation implementation record form and target implementation record data corresponding to the first evaluation object are obtained.

2. The method according to claim 1, characterized in that The querying of the target work instruction template data corresponding to the first object information includes: Querying a preset object management data table to determine the target work instruction template identification information corresponding to the first object information; Obtain target operation instruction book template data corresponding to the target operation instruction book template identification information.

3. The method according to claim 2, characterized in that Before querying the preset object management data table to determine the target work instruction template identification information corresponding to the first object information, the method further includes: Obtaining the object type and security level of the first evaluation object; Querying at least one initial work instruction template identification information that matches both the object type and the security level; Displaying the identification information of each initial work instruction template; In response to the operation of selecting a work instruction template, obtaining identification information of a selected target work instruction template, wherein the identification information of the target work instruction template is one of the identification information of each of the initial work instruction templates; An object management data table is generated, and an association relationship between the target work instruction template identification information and the first object information is constructed in the object management data table.

4. The method according to claim 1, characterized in that: The generating target implementation record data based on the first object information, the target work instruction template data and the preset first implementation record form template includes: Generate an assessment implementation record form based on the first object information, the target work instruction template data and a preset first implementation record form template, and display the assessment implementation record form, wherein the assessment implementation record form includes initial implementation record data; In response to an editing operation on the initial implementation record data, edited target implementation record data is acquired.

5. The method according to any one of claims 1 to 4, characterized in that: After performing network security evaluation on the first evaluation object according to the target implementation record data and the evaluation standard information, the method further includes: Extracting compliance information of at least one evaluation indicator corresponding to the first evaluation object from the target implementation record data, and extracting weight information of at least one evaluation indicator corresponding to the first evaluation object from the evaluation standard information; Detecting the deduction score of each evaluation indicator according to the compliance information and the weight information; In the case where a deduction evaluation indicator is detected based on the deduction score, a target rectification suggestion corresponding to the deduction evaluation indicator is extracted from the implementation target implementation record data, wherein the deduction evaluation indicator is at least one of the evaluation indicators; Based on the target rectification suggestion and the deduction score, a rectification suggestion record corresponding to the first evaluation object is generated.

6. The method according to any one of claims 1 to 4, characterized in that: After performing network security evaluation on the first evaluation object according to the target implementation record data and the evaluation standard information, the method further includes: Generate a first network security assessment record for the first assessment object; In response to the multiplexing operation of the evaluation records for the first evaluation object and at least one second evaluation object, obtaining second object information of each of the second evaluation objects; Mapping the second object information to a preset second implementation record table template to generate a target implementation record table template corresponding to each of the second evaluation objects; The first network security assessment record is mapped to the to-be-filled items in each target implementation record form template to generate a second network security assessment record for each of the second assessment objects.

7. A network security evaluation device, characterized in that: The device comprises: An acquisition module, used to acquire first object information and evaluation standard information of a first evaluation object; A query module, used to query the target work instruction template data corresponding to the first object information from a preset work instruction template content data table; A generating module, configured to generate target implementation record data based on the first object information, the target work instruction template data and a preset first implementation record form template; An evaluation module, configured to perform a network security evaluation on the first evaluation object according to the target implementation record data and the evaluation standard information; Wherein, the generating module is also used for: According to the content prompt information corresponding to each to-be-filled item in the preset first implementation record form template, matching the to-be-filled data matching the content prompt information from the first object information and the target work instruction template data; Fill the data to be filled into the to-be-filled item corresponding to the content prompt information; After all the items to be filled in the first implementation record form template are filled with data, the evaluation implementation record form and target implementation record data corresponding to the first evaluation object are obtained.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images