A security configuration detection method, device, equipment and medium

Abstract

The present application discloses a security configuration detection method, apparatus, equipment and medium, and relates to the field of security configuration development and detection technology. The method includes: configuring corresponding security requirements for each security configuration item in the target to be detected to generate a security configuration description; building an automation platform according to the security configuration description; the automation platform includes a client and multiple function scripts; wherein the function script is a script developed for each security configuration item in the security configuration description to execute different operation processes; the operation process includes scanning operations, reinforcement operations and rollback operations; the client is used to call the function script to execute the operation process on the security configuration item, and is used to provide an extended function plug-in to add a custom function script; the automation platform is used to perform different functional operations on the security configuration item to detect whether the target to be detected is correctly configured for security. Through the technical solution of the present application, the security configuration can be automatically configured correctly.

Description

Technical Field

[0001] The present invention relates to the field of security configuration development and detection technology, and in particular to a security configuration detection method, device, equipment and medium. Background Art

[0002] Security misconfiguration is a common security issue and one of the vulnerabilities listed in the OWASP (Open Web Application Security Project) Top 10. Security misconfiguration can have multiple consequences, making proper security configuration essential. Currently, the most common approach is to use automated tools for security scanning and then implement security configurations based on identified issues. However, most common automated scanning tools only provide scanning functionality, requiring manual remediation of security misconfigurations. Furthermore, there are no standardized scanning procedures, and therefore, these tools cannot fully meet user needs. Furthermore, manual remediation of security configurations can lead to further security issues and significantly impact work efficiency.

[0003] Therefore, how to provide a solution to the above technical problems is a problem that those skilled in the art need to solve at present. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a security configuration detection method, apparatus, device and medium that can automatically and correctly configure the security configuration. The specific solution is as follows:

[0005] In a first aspect, the present application discloses a security configuration detection method, comprising:

[0006] Determine a target to be detected, and configure corresponding security requirements for each security configuration item in the target to be detected, so as to generate a security configuration description of the target to be detected using the security requirements;

[0007] An automation platform is constructed according to the security configuration instructions; the automation platform includes a client and multiple functional scripts; wherein the functional script is a script developed for executing different operation processes for each security configuration item in the security configuration instructions; the operation process includes a scanning operation, a reinforcement operation, and a rollback operation; the client is used to call the functional script to execute the operation process for the security configuration item, and is used to provide an extended function plug-in to add a custom functional script;

[0008] The automation platform is used to perform different functional operations on the security configuration items to detect whether the security configuration of the target to be detected is correct.

[0009] Optionally, the security requirements are security requirements for basic introductions, operating procedures, or security standards; wherein configuring corresponding security requirements for each security configuration item in the target to be detected includes:

[0010] When the security requirements are security requirements for the basic introduction, corresponding description information, security level, and security type are configured for each security configuration item in the target to be detected; the description information includes identification information, name information, summary information, and object information configured for the security configuration item; the security level is used to perform a security assessment on the security configuration item to indicate the risk of misconfiguration of the security configuration item; the security type is used to indicate the security category to which the security configuration item belongs;

[0011] When the security requirement is a security requirement for the operation process, configuring the operation steps of the scanning operation, the reinforcement operation, and the rollback operation for each security configuration item in the target to be detected, and adding an expected execution result to the operation step;

[0012] When the security requirement is a security requirement for the security standard, a corresponding security standard type is configured for each security configuration item in the target to be detected.

[0013] Optionally, building an automation platform according to the security configuration specification includes:

[0014] Develop a functional script for executing different operation processes for each security configuration item in the security configuration description, and obtain a preset calling interface provided by the functional script, then develop a corresponding client for the preset calling interface, and configure a functional script adaptation layer for calling the preset calling interface and a database for storing the execution process data of the client for the client.

[0015] Optionally, the utilizing the automation platform to perform different functional operations on the security configuration items to detect whether the security configuration of the target to be detected is correct includes:

[0016] Obtaining a current security configuration item, and determining a current operation step in a current operation process executed on the current security configuration item and a current execution expected result corresponding to the current operation step;

[0017] Call the function script to execute the current operation step and obtain the corresponding script implementation result;

[0018] Determine whether the script implementation result is the same as the current execution expected result;

[0019] If the script implementation result is the same as the current expected execution result, it is determined that the current security configuration item is executed successfully;

[0020] If the script implementation result is different from the expected result of the current execution, it is determined that the execution of the current security configuration item has failed, and if the current operation process is the scanning operation, the reinforcement operation is performed on the security configuration item; if the current operation process is the reinforcement operation, the reinforcement operation is rolled back to the state before the reinforcement operation is performed; if the current operation process is the rollback operation, the rollback operation is rolled back to the state before the rollback operation is performed.

[0021] Optionally, the utilizing the automation platform to perform different functional operations on the security configuration item includes:

[0022] Utilizing the automation platform to perform the scanning operation, the reinforcement operation, or the rollback operation on the security configuration item according to the execution command in the target to be detected;

[0023] Alternatively, the configuration file is modified using the automation platform to perform the reinforcement operation or the rollback operation on the security configuration item.

[0024] Optionally, the modifying the configuration file by using the automation platform to perform the reinforcement operation or the rollback operation on the security configuration item includes:

[0025] Build an initialization configuration file library;

[0026] Performing the scanning operation on the security configuration item to obtain an initial state of the security configuration item;

[0027] If the initial state is used to indicate that the security configuration item needs to be repaired, copying the configuration file to be reinforced corresponding to the security configuration item to a target directory in the target to be detected for backing up to obtain a first backup file, and recording data information of the configuration file to be reinforced in the configuration file library;

[0028] Based on the configuration file to be reinforced, using the data information, perform the reinforcement operation on the security configuration item, and determine whether the reinforcement operation is successful; if the reinforcement operation is successful, delete the first backup file and change the status of the security configuration item to repaired; if the reinforcement operation fails, replace the current configuration file to be reinforced with the first backup file;

[0029] If the initial state is used to indicate that the security configuration item has been repaired, copying the configuration file to be rolled back corresponding to the security configuration item to the target directory for backing up to obtain a second backup file;

[0030] Based on the configuration file to be rolled back, the rollback operation is performed on the security configuration item using the data information, and it is determined whether the rollback operation is successful; if the rollback operation is successful, the second backup file is deleted, and the status of the security configuration item is modified to be repaired; if the rollback operation fails, the second backup file is used to replace the current configuration file to be rolled back.

[0031] Optionally, the utilizing the automation platform to perform different functional operations on the security configuration items to detect whether the security configuration of the target to be detected is correct includes:

[0032] Utilizing the automation platform to locally perform different functional operations on the security configuration items to detect whether the security configuration of the target to be detected is correct;

[0033] Alternatively, based on a preset network connection protocol, the automation platform is used to remotely perform different functional operations on the security configuration items to detect whether the security configuration of the target to be detected is correct.

[0034] In a second aspect, the present application discloses a security configuration detection device, comprising:

[0035] A security configuration description building module is used to determine a target to be detected and configure corresponding security requirements for each security configuration item in the target to be detected, so as to generate a security configuration description of the target to be detected using the security requirements;

[0036] An automation platform construction module is used to construct an automation platform based on the security configuration specification; the automation platform includes a client and multiple function scripts; wherein the function script is a script developed for executing different operation processes for each security configuration item in the security configuration specification; the operation process includes a scanning operation, a reinforcement operation, and a rollback operation; the client is used to call the function script to execute the operation process for the security configuration item, and is used to provide an extended function plug-in to add a custom function script;

[0037] The security configuration detection module is used to use the automation platform to perform different functional operations on the security configuration items to detect whether the security configuration of the target to be detected is correct.

[0038] In a third aspect, the present application discloses an electronic device, comprising a processor and a memory; wherein the memory is used to store a computer program, and the computer program is loaded and executed by the processor to implement the security configuration detection method as described above.

[0039] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein the computer program, when executed by a processor, implements the security configuration detection method as described above.

[0040] The present application provides a security configuration detection method, including: determining a target to be detected, and configuring corresponding security requirements for each security configuration item in the target to be detected, so as to generate a security configuration description of the target to be detected by using the security requirements; building an automation platform according to the security configuration description; the automation platform includes a client and multiple functional scripts; wherein the functional script is a script developed for each security configuration item in the security configuration description to execute different operation processes; the operation process includes a scanning operation, a reinforcement operation and a rollback operation; the client is used to call the functional script to execute the operation process on the security configuration item, and is used to provide an extended function plug-in to add a custom function script; and the automation platform is used to perform different functional operations on the security configuration item to detect whether the security configuration of the target to be detected is correct.

[0041] The beneficial technical effects of this application are: configuring unique security requirements for multiple security configuration items contained in the target to be detected, and constructing corresponding security configuration instructions for the target to be detected for the security configuration items; developing corresponding functional scripts based on the security configuration instructions, and implementing an automation platform based on multiple security configuration standards by calling these scripts on the client. Utilizing the automation platform to correctly configure the security configuration of the target to be detected not only improves the security of the target to be detected, but also improves the maintainability of the security configuration and the work efficiency of the staff, reduces the workload of users, and standardizes the configuration of the system.

[0042] In addition, the present application provides a security configuration detection device, equipment, and storage medium, which correspond to the above-mentioned security configuration detection method and have the same effect as above. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0044] Figure 1 A flow chart of a security configuration detection method disclosed in this application;

[0045] Figure 2 This is a schematic diagram of an automation platform framework disclosed in this application;

[0046] Figure 3 A schematic diagram illustrating a security configuration disclosed in this application;

[0047] Figure 4 A schematic diagram of a security reinforcement and rollback process disclosed in this application;

[0048] Figure 5 This is a schematic diagram of utilizing the automation platform function disclosed in this application;

[0049] Figure 6 This is a structural diagram of a security configuration detection device disclosed in this application;

[0050] Figure 7 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0051] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0052] Security misconfiguration can have multiple consequences, such as sensitive information leakage, data tampering or destruction, and compliance risks, which can directly impact system security, data confidentiality, integrity, and availability. Therefore, correct security configuration is essential.

[0053] Currently, the most common approach is to use automated tools to perform security scans and then perform security configurations based on the issues found. However, this approach has the following problems:

[0054] First, common automated scanning tools cannot fully meet user needs:

[0055] 1) Most common automated scanning tools only have scanning capabilities, and incorrect security configurations still require manual repair;

[0056] 2) Common automated scanning tools do not have unified standards when performing scanning, and users can only refer to them but cannot directly apply them.

[0057] Secondly, there are still many problems with manually repairing security configurations:

[0058] 1) Without a good understanding of the system or application, manual repair is not only difficult but also prone to errors, leading to more security issues.

[0059] 2) If the system or application has many security configuration issues or requires frequent scanning and configuration updates, manual processing alone is not only prone to omissions but also labor-intensive and seriously affects work efficiency.

[0060] It can be seen that a security configuration tool that can meet multiple security requirements and automatically implement multiple operation processes is very necessary. To this end, this application provides a security configuration detection solution that can automatically configure the security configuration correctly, improving user work efficiency and system security.

[0061] The embodiment of the present invention discloses a security configuration detection method, see Figure 1 As shown, the method includes:

[0062] Step S11: determining a target to be detected, and configuring corresponding security requirements for each security configuration item in the target to be detected, so as to generate a security configuration description of the target to be detected using the security requirements.

[0063] In the embodiment of the present application, the target to be detected is a system or application that needs to detect whether the security configuration is correctly configured. When the target to be detected that needs to be operated is a system, it can be a local system or a remote host system, which is not specifically limited here.

[0064] Security misconfiguration is a common security issue. This error is often caused by insecure default configurations, incomplete temporary configurations, incorrect HTTP (Hypertext Transfer Protocol) header configurations, and detailed error messages containing sensitive information, which can lead to incorrect or inaccurate security settings for systems or applications. In the embodiments of this application, different security standards are used to determine security configuration items for systems and applications based on different targets to be detected, and security configuration instructions are constructed.

[0065] It should be pointed out that the security configuration description consists of the security requirements of each security configuration item, and each security configuration item has a unique security requirement; each system or application corresponding to the target to be detected contains multiple security configuration items; in addition, the security configuration description can include multiple systems and applications.

[0066] Step S12: Build an automation platform according to the security configuration instructions; the automation platform includes a client and multiple functional scripts; wherein the functional script is a script developed for each security configuration item in the security configuration instructions to execute different operation processes; the operation process includes a scanning operation, a reinforcement operation and a rollback operation; the client is used to call the functional script to execute the operation process for the security configuration item, and is used to provide an extended function plug-in to add a new custom function script.

[0067] In an embodiment of the present application, an automation platform based on function scripts + client is constructed according to the security configuration instructions. In addition, a function script adaptation layer for calling function scripts and a database for storing the execution process data of the client are configured in the client.

[0068] Specifically, a functional script that executes different operation processes is developed for each security configuration item in the security configuration description, and a preset calling interface provided by the functional script is obtained. Then, a corresponding client is developed for the preset calling interface, and a functional script adaptation layer for calling the preset calling interface and a database for storing the execution process data of the client are configured for the client.

[0069] It should be pointed out that the functional script is a script that performs security scanning, reinforcement, and rollback. Security scanning is to perform a security assessment on the security configuration items in the system or application; if there is an unsafe configuration, the process of repairing it is security reinforcement; if the reinforced security configuration affects the user's actual application, the configuration can be rolled back to the original state, thereby realizing the function of security rollback. Each functional script corresponds to a security configuration item in the security configuration description. The functional script provides a unified preset calling interface for the client's functional script adaptation layer to call. Based on the automation platform, users can select one or more security configuration items through the client to perform scanning, reinforcement, and rollback operations.

[0070] like Figure 2 The following shows an example automation platform framework. Users perform different functional operations through the client, which then calls the corresponding functional scripts through the functional script adaptation layer. Meanwhile, user operations, adaptation information, logs, and configuration item security requirements during execution are all stored in the database.

[0071] In addition, in a specific implementation, users can extend the function script and add custom function scripts through the client, providing convenience for users in many aspects. Since the function script provides a unified interface for the client's adaptation layer to call, users only need to write the corresponding script according to the function script writing rules to extend the custom script. The specific process is as follows:

[0072] 1) Write custom function scripts according to the rules;

[0073] 2) Configure security instructions for security configuration items on the platform;

[0074] 3) Upload the custom function script to the platform;

[0075] 4) After the platform parses the custom function script and the corresponding safety instructions, it records the information in the database. At the same time, it can set up a function script library and save the custom function script snapshot in the function script library.

[0076] Step S13: Utilize the automation platform to perform different functional operations on the security configuration items to detect whether the security configuration of the target to be detected is correct.

[0077] Based on the above steps, it can be seen that since the target to be detected can be a local system or a remote host system, the embodiment of the present application can operate not only the local system but also the remote system.

[0078] Specifically, the automation platform is used to locally perform different functional operations on the security configuration items to detect whether the security configuration of the target to be detected is correct; or, based on a preset network connection protocol, the automation platform is used to remotely perform different functional operations on the security configuration items to detect whether the security configuration of the target to be detected is correct.

[0079] In other words, when performing security operations on a local system or application, you can do so directly. When performing security operations on a remote host's system or application, you can connect to the system's IP address via SSH (Secure Shell) by entering the IP address, username, and password. After logging in with the username and password, you can perform operations on the remote system. This provides both local and remote operation modes, offering flexibility and allowing users to choose the method that best suits their needs, enabling a variety of user scenarios.

[0080] The present application provides a security configuration detection method, including: determining a target to be detected, and configuring corresponding security requirements for each security configuration item in the target to be detected, so as to generate a security configuration description of the target to be detected by using the security requirements; building an automation platform according to the security configuration description; the automation platform includes a client and multiple functional scripts; wherein the functional script is a script developed for each security configuration item in the security configuration description to execute different operation processes; the operation process includes a scanning operation, a reinforcement operation and a rollback operation; the client is used to call the functional script to execute the operation process on the security configuration item, and is used to provide an extended function plug-in to add a custom function script; and the automation platform is used to perform different functional operations on the security configuration item to detect whether the security configuration of the target to be detected is correct.

[0081] The beneficial technical effects of this application are: configuring unique security requirements for multiple security configuration items contained in the target to be detected, and constructing corresponding security configuration instructions for the target to be detected for the security configuration items; developing corresponding functional scripts based on the security configuration instructions, and implementing an automation platform based on multiple security configuration standards by calling these scripts on the client. Utilizing the automation platform to correctly configure the security configuration of the target to be detected not only improves the security of the target to be detected, but also improves the maintainability of the security configuration and the work efficiency of the staff, reduces the workload of users, and standardizes the configuration of the system.

[0082] Based on the above embodiment, this embodiment will specifically explain S11 in the above embodiment. The security requirements are security requirements for basic introduction, operation process or security standards; for the construction of security configuration instructions, the process of configuring corresponding security requirements for each security configuration item in the target to be detected may include the following steps:

[0083] When the security requirements are security requirements for the basic introduction, corresponding description information, security level, and security type are configured for each security configuration item in the target to be detected; the description information includes identification information, name information, summary information, and object information configured for the security configuration item; the security level is used to perform a security assessment on the security configuration item to indicate the risk of misconfiguration of the security configuration item; the security type is used to indicate the security category to which the security configuration item belongs;

[0084] When the security requirement is a security requirement for the operation process, configuring the operation steps of the scanning operation, the reinforcement operation, and the rollback operation for each security configuration item in the target to be detected, and adding an expected execution result to the operation step;

[0085] When the security requirement is a security requirement for the security standard, a corresponding security standard type is configured for each security configuration item in the target to be detected.

[0086] In the embodiment of the present application, the security configuration description is composed of the security requirements of each security configuration item, and each security configuration item mainly includes three aspects: basic introduction, operation process, and safety standards.

[0087] 1. Basic Introduction: Provide an overall introduction to security configuration items, which may include:

[0088] (1) Description:

[0089] Identification information: unique. Each security configuration item has a unique identifier.

[0090] Name information: An easy-to-understand summary of the security configuration item;

[0091] Summary information: This section describes the functions of security configuration items, the potential harm caused by incorrect configuration, and the causes of the harm.

[0092] Object information: The target to be detected, that is, the system or application to be operated by the user, including operating systems, containers, databases, other applications, etc. The embodiments of this application provide security operations for various systems and applications, including:

[0093] a. Operating system: including Windows (10 / 11), CentOS (7 / 8), Ubuntu (16 / 18 / 20 / 22), Debian (8 / 9 / 10), Anolis (7 / 8 / 23), Linux;

[0094] b. Containers: including Docker (11 / 12 / 13) and K8S (20 / 23 / 24);

[0095] c. Database: including Mysql, Postgresql, MongoDB;

[0096] d. Other applications: including Apache, Bind, Chrome, Firefox, VMware, Nginx, RabbitMQ, Jenkins, etc.

[0097] Comprehensive applications allow users to perform secure operations on important applications or platforms in the system, thereby minimizing the impact of security configuration errors.

[0098] (2) Security level: This indirectly reflects the severity of the harm caused by a misconfiguration of the security configuration item. In a specific implementation, the CVSS (Common Vulnerability Scoring System) vulnerability assessment method is used to conduct a security assessment on each security configuration item. The security configuration items are then divided into four levels: high, medium, low, and recommended according to the assessment scores. The higher the level, the greater the harm caused by the misconfiguration of the item.

[0099] (3) Security type: The security category to which this security configuration item belongs.

[0100] The embodiments of this application utilize multiple security configuration standards; the algorithm incorporates four standards: MLSP Level 2, MLSP Level 3, CIS (Center for Internet Security), and security practices. Each security configuration item in MLSP Level 2, MLSP Level 3, and CIS standards has a corresponding security type. For security configuration items in security practices, the security type can be set based on the MLSP Level 2, MLSP Level 3, and CIS standards. Common security types include access control, security auditing, and intrusion prevention.

[0101] 2. Operation process: The main operations of the embodiment of the present application include scanning operation, reinforcement operation and rollback operation. Therefore, the operation process includes the operation steps of scanning, reinforcement and rollback, as well as the expected results after executing each operation step.

[0102] 3. Security Standards: The present embodiment provides a variety of security standards to meet the different security needs of users. Users can select the corresponding security configuration standard to perform corresponding security operations based on their own security needs, including:

[0103] (1) Level 2 and Level 3: These are the two most common levels in information security level protection assessment.

[0104] Meeting the requirements of Level 2 and Level 3 of the MSP not only demonstrates compliance with laws and regulations and provides assurance for system security, but also protects against external attacks and threats. This paper studies the requirements of Level 2 and Level 3 of the MSP and identifies corresponding security configuration items for different applications.

[0105] (2) CIS Benchmark: A globally recognized set of consensus-driven best practices published by the Center for Internet Security, designed to help security practitioners implement and manage their network security defenses. This paper converts CIS benchmarks for different applications to obtain corresponding security configuration items.

[0106] (3) Security Practices: These are a series of measures and behaviors designed to prevent and address security threats and information security. Based on different security practices, this paper summarizes common security practice requirements applicable to different applications and organizes corresponding security configuration items based on these requirements.

[0107] In addition, users can build their own security practices based on existing security configuration items. The specific process is as follows: First, execute the "Build a Security Practice" operation and select one or more security configuration items as your own security practice; second, determine the name of the security practice and create an association between the security practice and the security configuration items in the database; finally, when executing the security practice, select the associated security configuration items to perform the operation. In this way, a security practice tailored to the user can be created based on existing functional scripts.

[0108] In summary, if Figure 3 The following is a schematic diagram of an exemplary security configuration description provided in conjunction with the above steps. Each security configuration item has a unique security requirement; each system or application contains multiple security configuration items; and the security configuration description includes multiple systems and applications.

[0109] Based on the above embodiment, this embodiment will specifically explain S13 in the above embodiment. Specifically, with respect to the development of a function script, in order to utilize an automation platform to call a function script through a client to perform a function operation, the process of utilizing the automation platform to perform different function operations on the security configuration item to detect whether the security configuration of the target to be detected is correct may include the following steps:

[0110] Step 1: Obtain a current security configuration item, and determine a current operation step in a current operation process executed on the current security configuration item and a current execution expected result corresponding to the current operation step;

[0111] Step 2: Call the function script to execute the current operation step and obtain the corresponding script implementation result;

[0112] Step 3: Determine whether the script implementation result is the same as the current execution expected result;

[0113] Step 4: If the script implementation result is the same as the current expected execution result, it is determined that the current security configuration item is executed successfully;

[0114] Step 5: If the script implementation result is different from the expected result of the current execution, it is determined that the execution of the current security configuration item has failed, and if the current operation process is the scanning operation, the reinforcement operation is performed on the security configuration item; if the current operation process is the reinforcement operation, the reinforcement operation is rolled back to the state before the reinforcement operation is performed; if the current operation process is the rollback operation, the rollback operation is rolled back to the state before the rollback operation is performed.

[0115] In the embodiment of the present application, each function script corresponds to a security configuration item in the security configuration description, and realizes the operations of scanning, reinforcement and rollback. When developing the function script, the operation steps for each operation type are realized by the script.

[0116] When calling a function script to test the security configuration, first determine the operation steps and corresponding expected results of each operation process in the security configuration item; when executing the function script, if the result implemented by the script is the same as the expected result, the security configuration item is executed successfully; otherwise:

[0117] 1) If it is a scanning operation, it means that the configuration item is unsafe and security reinforcement is required;

[0118] 2) If it is a reinforcement operation, it means that the reinforcement has failed and the reinforcement operation needs to be rolled back to the state before reinforcement;

[0119] 3) If it is a rollback operation, it means that the rollback has failed. In this case, you need to roll back the rollback operation to the state before the rollback.

[0120] Among them, the security scan operation only performs a security assessment on the system or application and does not make any modifications to it, but the security hardening and rollback operations will modify the system.

[0121] Based on the above embodiment, this embodiment will specifically explain S13 in the above embodiment. There are two main ways to execute the operation process according to the operation steps for different security configuration items: directly executing commands and modifying corresponding configuration files. Therefore, the process of using the automation platform to perform different functional operations on the security configuration items may include the following steps:

[0122] Utilizing the automation platform to perform the scanning operation, the reinforcement operation, or the rollback operation on the security configuration item according to the execution command in the target to be detected;

[0123] Alternatively, the configuration file is modified using the automation platform to perform the reinforcement operation or the rollback operation on the security configuration item.

[0124] In the first specific implementation, for the method of directly executing commands to execute the operation process, the corresponding command can be directly executed. Take disabling the SNMP (Simple Network Management Protocol) service in the CentOS 7 system as an example:

[0125] Scan command: sudo service snmpd status;

[0126] Reinforcement command: sudo service snmpd stop;

[0127] Fallback command: sudo service snmpd start;

[0128] When you execute a scan command for a disabled SNMP service configuration item, if the execution result contains Active, it means that the SNMP service is enabled in the system. Execute the hardening command to disable the SNMP service. Similarly, execute the rollback command to re-enable the SNMP service.

[0129] In the second specific implementation, configuration file modification is a common method for security hardening and rollback. It's important to note that with configuration file modification, multiple security configuration items may modify the same configuration file; the execution order of different security configuration items varies, resulting in different configuration file modifications; and security hardening and rollback operations may frequently involve the same configuration file. Consequently, automated rollback operations are prone to exceptions, making automated rollback operations difficult.

[0130] Common solutions include backing up the entire file system using snapshots after each hardening session and backing up each file after each modification. However, both approaches present certain challenges: The first approach may create multiple snapshots, and a rollback requires a full system rollback. This approach not only prevents the rollback of individual security configuration items, but also renders any user modifications made during this time ineffective, severely impacting user experience. The second approach generates numerous file backups and also fails to support the rollback of individual security configuration items.

[0131] Therefore, in order to efficiently and reliably implement the automated reinforcement and rollback functions, the present application proposes a version management-based configuration file management method. The specific process is as follows:

[0132] Build an initialization configuration file library;

[0133] Performing the scanning operation on the security configuration item to obtain an initial state of the security configuration item;

[0134] If the initial state is used to indicate that the security configuration item needs to be repaired, copying the configuration file to be reinforced corresponding to the security configuration item to a target directory in the target to be detected for backing up to obtain a first backup file, and recording data information of the configuration file to be reinforced in the configuration file library;

[0135] Based on the configuration file to be reinforced, using the data information, perform the reinforcement operation on the security configuration item, and determine whether the reinforcement operation is successful; if the reinforcement operation is successful, delete the first backup file and change the status of the security configuration item to repaired; if the reinforcement operation fails, replace the current configuration file to be reinforced with the first backup file;

[0136] If the initial state is used to indicate that the security configuration item has been repaired, copying the configuration file to be rolled back corresponding to the security configuration item to the target directory for backing up to obtain a second backup file;

[0137] Based on the configuration file to be rolled back, the rollback operation is performed on the security configuration item using the data information, and it is determined whether the rollback operation is successful; if the rollback operation is successful, the second backup file is deleted, and the status of the security configuration item is modified to be repaired; if the rollback operation fails, the second backup file is used to replace the current configuration file to be rolled back.

[0138] In this embodiment of the present application, the initialized configuration file library is a configuration file library constructed from an unscanned target. The first time a user operates on a target, they must first perform a scan. Based on the scan results, the initial status of the target's security configuration items is recorded, including safe, pending repair, and repaired.

[0139] Next, we will combine Figure 4 Detailed instructions for security hardening and rollback processes.

[0140] If it is a security configuration item to be repaired, you can perform hardening operations. The execution process is as follows:

[0141] First, back up the configuration files to be hardened. Then, record the initial configuration and hardening information for each security configuration item to be repaired. Specifically, you can add an identifiable marker to the hardened content, such as adding <--security configuration item identifier:ip:date--> to each modified line. Next, perform the hardening operation on the security configuration item, replacing the configuration information in the configuration file with the hardened information. If the hardening fails, replace the current configuration file with the backup one. If the hardening succeeds, delete the backup file and change the security configuration item's status to Repaired.

[0142] If the security configuration item has been repaired, you can perform a rollback operation. The execution process is as follows:

[0143] First, back up the configuration file to be rolled back. Second, perform a rollback on the security configuration item, find the identifier of the corresponding security configuration item, and replace it with the original content. If the rollback fails, replace the current configuration file with the backup configuration file. If the rollback is successful, delete the backup file and change the status of the security configuration item to pending repair.

[0144] It can be seen that according to Figure 4 As can be seen from the content, the algorithm of the present invention records and identifies the original and hardened configuration information of security configuration items. When performing hardening and rollback operations, only the corresponding configuration information needs to be replaced. Furthermore, before performing hardening and rollback operations, the configuration file is first backed up. If the operation fails, the backup file can be directly used for replacement. In addition, the algorithm of the present invention uses a single security configuration item as a unit, so one or more security configuration items can be selected for rollback. During execution, while the configuration is not retained, it does not affect the user's modification of the configuration file.

[0145] Further, such as Figure 5 The figure shows a flowchart for implementing functional operations using the automation platform provided in the aforementioned embodiments. First, new functional scripts are added, supporting the expansion of customized functional scripts, providing user convenience in multiple ways. Second, security practices can be built, creating customized security practices based on existing functional scripts. Both local and remote modes are provided for user access. Users can perform security operations directly locally or remotely on the system or application by entering the IP address, username, and password. Finally, a variety of operations are provided, including scanning, hardening, and rollback, and a database records user operations. When implementing the hardening and rollback functions, the present invention utilizes the principles of file version control, allowing users to complete them based on their specific needs. Furthermore, the functionality is enhanced by providing a one-click restore function. It should be noted that when constructing the initial configuration file library, the configuration files mentioned in the security configuration instructions are copied to a specific directory on the target to be detected for backup. The configuration file names, paths, and other information are also recorded in the database. When the system configuration needs to be restored to its initial state, the configuration files corresponding to the repaired security configuration items are simply distributed from the security configuration library to the corresponding directory according to the path. In summary, users can perform corresponding security operations on security configuration items according to their actual needs, which greatly improves user work efficiency and system security, reduces user workload, enhances system maintainability, and standardizes system configuration.

[0146] Correspondingly, the embodiment of the present application also discloses a security configuration detection device, see Figure 6 As shown, the device includes:

[0147] A security configuration description building module 11 is used to determine a target to be detected and configure corresponding security requirements for each security configuration item in the target to be detected, so as to generate a security configuration description of the target to be detected using the security requirements;

[0148] An automation platform construction module 12 is configured to construct an automation platform based on the security configuration specification; the automation platform includes a client and multiple function scripts; wherein the function scripts are scripts developed for executing different operation processes for each security configuration item in the security configuration specification; the operation processes include scanning operations, reinforcement operations, and rollback operations; the client is configured to call the function scripts to execute the operation processes for the security configuration items, and is configured to provide extended function plug-ins to add custom function scripts;

[0149] The security configuration detection module 13 is used to use the automation platform to perform different functional operations on the security configuration items to detect whether the security configuration of the target to be detected is correct.

[0150] Among them, for more specific working processes of the above modules, please refer to the corresponding contents disclosed in the aforementioned embodiments, which will not be repeated here.

[0151] It can be seen that the above scheme of this embodiment includes: determining the target to be detected, and configuring corresponding security requirements for each security configuration item in the target to be detected, so as to generate the security configuration description of the target to be detected using the security requirements; building an automation platform according to the security configuration description; the automation platform includes a client and multiple functional scripts; wherein the functional script is a script developed for each security configuration item in the security configuration description to execute different operation processes; the operation process includes scanning operation, reinforcement operation and rollback operation; the client is used to call the functional script to execute the operation process on the security configuration item, and to provide an extended function plug-in to add a custom function script; using the automation platform to perform different functional operations on the security configuration item to detect whether the security configuration of the target to be detected is correct.

[0152] The beneficial technical effects of this application are: configuring unique security requirements for multiple security configuration items contained in the target to be detected, and constructing corresponding security configuration instructions for the target to be detected for the security configuration items; developing corresponding functional scripts based on the security configuration instructions, and implementing an automation platform based on multiple security configuration standards by calling these scripts on the client. Utilizing the automation platform to correctly configure the security configuration of the target to be detected not only improves the security of the target to be detected, but also improves the maintainability of the security configuration and the work efficiency of the staff, reduces the workload of users, and standardizes the configuration of the system.

[0153] In a specific embodiment, the security configuration description building module 11 includes:

[0154] A basic introduction configuration module is configured to, when the security requirement is a security requirement for the basic introduction, configure corresponding description information, security level, and security type for each security configuration item in the target to be detected; the description information includes identification information, name information, summary information, and object information configured for the security configuration item; the security level is used to perform a security assessment on the security configuration item to indicate the risk of misconfiguration of the security configuration item; and the security type is used to indicate the security category to which the security configuration item belongs;

[0155] an operation process configuration module, configured to, when the security requirement is a security requirement for the operation process, configure the operation steps of the scanning operation, the reinforcement operation, and the rollback operation for each security configuration item in the target to be detected, and add an expected execution result to the operation step;

[0156] The security requirement configuration module is configured to configure a corresponding security standard type for each security configuration item in the target to be detected when the security requirement is a security requirement for the security standard.

[0157] In a specific embodiment, the automation platform construction module 12 is specifically used to:

[0158] Develop a functional script for executing different operation processes for each security configuration item in the security configuration description, and obtain a preset calling interface provided by the functional script, then develop a corresponding client for the preset calling interface, and configure a functional script adaptation layer for calling the preset calling interface and a database for storing the execution process data of the client for the client.

[0159] In a specific implementation, the security configuration detection module 13 is specifically configured to:

[0160] Obtaining a current security configuration item, and determining a current operation step in a current operation process executed on the current security configuration item and a current execution expected result corresponding to the current operation step;

[0161] Call the function script to execute the current operation step and obtain the corresponding script implementation result;

[0162] Determine whether the script implementation result is the same as the current execution expected result;

[0163] If the script implementation result is the same as the current expected execution result, it is determined that the current security configuration item is executed successfully;

[0164] If the script implementation result is different from the expected result of the current execution, it is determined that the execution of the current security configuration item has failed, and if the current operation process is the scanning operation, the reinforcement operation is performed on the security configuration item; if the current operation process is the reinforcement operation, the reinforcement operation is rolled back to the state before the reinforcement operation is performed; if the current operation process is the rollback operation, the rollback operation is rolled back to the state before the rollback operation is performed.

[0165] In a specific embodiment, the security configuration detection module 13 includes:

[0166] A functional operation execution module is used to use the automation platform to perform the scanning operation, the reinforcement operation or the rollback operation on the security configuration item according to the execution command in the target to be detected; or, use the automation platform to modify the configuration file to perform the reinforcement operation or the rollback operation on the security configuration item.

[0167] In a specific embodiment, the functional operation execution module is specifically used to:

[0168] Build an initialization configuration file library;

[0169] Performing the scanning operation on the security configuration item to obtain an initial state of the security configuration item;

[0170] If the initial state is used to indicate that the security configuration item needs to be repaired, copying the configuration file to be reinforced corresponding to the security configuration item to a target directory in the target to be detected for backing up to obtain a first backup file, and recording data information of the configuration file to be reinforced in the configuration file library;

[0171] Based on the configuration file to be reinforced, using the data information, perform the reinforcement operation on the security configuration item, and determine whether the reinforcement operation is successful; if the reinforcement operation is successful, delete the first backup file and change the status of the security configuration item to repaired; if the reinforcement operation fails, replace the current configuration file to be reinforced with the first backup file;

[0172] If the initial state is used to indicate that the security configuration item has been repaired, copying the configuration file to be rolled back corresponding to the security configuration item to the target directory for backing up to obtain a second backup file;

[0173] Based on the configuration file to be rolled back, the rollback operation is performed on the security configuration item using the data information, and it is determined whether the rollback operation is successful; if the rollback operation is successful, the second backup file is deleted, and the status of the security configuration item is modified to be repaired; if the rollback operation fails, the second backup file is used to replace the current configuration file to be rolled back.

[0174] In a specific embodiment, the security configuration detection module 13 includes:

[0175] A local operation module, configured to utilize the automation platform to locally perform different functional operations on the security configuration items to detect whether the security configuration of the target to be detected is correct;

[0176] The remote operation module is used to remotely perform different functional operations on the security configuration items using the automation platform based on a preset network connection protocol to detect whether the security configuration of the target to be detected is correct.

[0177] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 7 This is a structural diagram of an electronic device 20 according to an exemplary embodiment, and the content in the diagram cannot be considered as any limitation to the scope of use of the present application.

[0178] Figure 7 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the security configuration detection method disclosed in any of the aforementioned embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be a computer.

[0179] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0180] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, a magnetic disk, or an optical disk. The resources stored thereon may include an operating system 221, a computer program 222, and data 223. The data 223 may include various data. The storage method can be temporary storage or permanent storage.

[0181] The operating system 221 is used to manage and control the hardware devices on the electronic device 20 and the computer program 222, and can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of implementing the security configuration detection method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program capable of implementing other specific tasks.

[0182] Furthermore, the embodiments of the present application also disclose a computer-readable storage medium, where the computer-readable storage medium includes a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a magnetic disk, or an optical disk, or any other form of storage medium known in the technical field. When the computer program is executed by a processor, the aforementioned security configuration detection method is implemented. For the specific steps of the method, reference can be made to the corresponding content disclosed in the aforementioned embodiments, and no further description will be given here.

[0183] Furthermore, an embodiment of the present application also provides a computer program product, including a computer program / instruction, which implements any one of the above-mentioned security configuration detection methods when executed by a processor.

[0184] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0185] The steps of the security configuration detection method or algorithm described in conjunction with the embodiments disclosed herein can be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0186] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0187] The above is a detailed introduction to a security configuration detection method, device, equipment and medium provided by the present invention. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core ideas. At the same time, for those skilled in the art, according to the ideas of the present invention, there may be changes in the specific implementation methods and application scopes. In summary, the contents of this specification should not be understood as limiting the present invention.

Claims

1. A security configuration detection method, characterized in that: include: Determine a target to be detected, and configure corresponding security requirements for each security configuration item in the target to be detected, so as to generate a security configuration description of the target to be detected using the security requirements; Building an automation platform according to the security configuration instructions; The automation platform includes a client and multiple function scripts; wherein the function script is a script developed for executing different operation processes for each security configuration item in the security configuration description; the operation process includes a scanning operation, a reinforcement operation, and a rollback operation; the client is used to call the function script to execute the operation process for the security configuration item, and is used to provide an extended function plug-in to add a custom function script; The automation platform is used to perform different functional operations on the security configuration items to detect whether the security configuration of the target to be detected is correct; wherein, the automation platform is used to perform the scanning operation, the reinforcement operation or the rollback operation on the security configuration item according to the execution command in the target to be detected; or, the automation platform is used to modify the configuration file to perform the reinforcement operation or the rollback operation on the security configuration item.

2. The security configuration detection method according to claim 1, characterized in that: The security requirements are security requirements for basic introductions, operating procedures, or security standards; wherein, configuring corresponding security requirements for each security configuration item in the target to be detected includes: When the security requirements are security requirements for the basic introduction, corresponding description information, security level, and security type are configured for each security configuration item in the target to be detected; the description information includes identification information, name information, summary information, and object information configured for the security configuration item; the security level is used to perform a security assessment on the security configuration item to indicate the risk of misconfiguration of the security configuration item; the security type is used to indicate the security category to which the security configuration item belongs; When the security requirement is a security requirement for the operation process, configuring the operation steps of the scanning operation, the reinforcement operation, and the rollback operation for each security configuration item in the target to be detected, and adding an expected execution result to the operation step; When the security requirement is a security requirement for the security standard, a corresponding security standard type is configured for each security configuration item in the target to be detected.

3. The security configuration detection method according to claim 1, characterized in that: The step of constructing an automation platform according to the security configuration instructions includes: Develop a functional script for executing different operation processes for each security configuration item in the security configuration description, and obtain a preset calling interface provided by the functional script, then develop a corresponding client for the preset calling interface, and configure a functional script adaptation layer for calling the preset calling interface and a database for storing the execution process data of the client for the client.

4. The security configuration detection method according to claim 1, characterized in that: The utilizing the automation platform to perform different functional operations on the security configuration items to detect whether the security configuration of the target to be detected is correct includes: Obtaining a current security configuration item, and determining a current operation step in a current operation process executed on the current security configuration item and a current execution expected result corresponding to the current operation step; Call the function script to execute the current operation step and obtain the corresponding script implementation result; Determine whether the script implementation result is the same as the current execution expected result; If the script implementation result is the same as the current expected execution result, it is determined that the current security configuration item is executed successfully; If the script implementation result is different from the expected result of the current execution, it is determined that the execution of the current security configuration item has failed, and if the current operation process is the scanning operation, the reinforcement operation is performed on the security configuration item; if the current operation process is the reinforcement operation, the reinforcement operation is rolled back to the state before the reinforcement operation is performed; if the current operation process is the rollback operation, the rollback operation is rolled back to the state before the rollback operation is performed.

5. The security configuration detection method according to claim 1, characterized in that: The modifying the configuration file by using the automation platform to perform the reinforcement operation or the rollback operation on the security configuration item includes: Build an initialization configuration file library; Performing the scanning operation on the security configuration item to obtain an initial state of the security configuration item; If the initial state is used to indicate that the security configuration item needs to be repaired, copying the configuration file to be reinforced corresponding to the security configuration item to a target directory in the target to be detected for backing up to obtain a first backup file, and recording data information of the configuration file to be reinforced in the configuration file library; Based on the configuration file to be reinforced, using the data information, perform the reinforcement operation on the security configuration item, and determine whether the reinforcement operation is successful; if the reinforcement operation is successful, delete the first backup file and change the status of the security configuration item to repaired; if the reinforcement operation fails, replace the current configuration file to be reinforced with the first backup file; If the initial state is used to indicate that the security configuration item has been repaired, copying the configuration file to be rolled back corresponding to the security configuration item to the target directory for backing up to obtain a second backup file; Based on the configuration file to be rolled back, the rollback operation is performed on the security configuration item using the data information, and it is determined whether the rollback operation is successful; if the rollback operation is successful, the second backup file is deleted, and the status of the security configuration item is modified to be repaired; if the rollback operation fails, the second backup file is used to replace the current configuration file to be rolled back.

6. The security configuration detection method according to any one of claims 1 to 5, characterized in that: The utilizing the automation platform to perform different functional operations on the security configuration items to detect whether the security configuration of the target to be detected is correct includes: Utilizing the automation platform to locally perform different functional operations on the security configuration items to detect whether the security configuration of the target to be detected is correct; Alternatively, based on a preset network connection protocol, the automation platform is used to remotely perform different functional operations on the security configuration items to detect whether the security configuration of the target to be detected is correct.

7. A security configuration detection device, characterized in that: include: A security configuration description building module is used to determine a target to be detected and configure corresponding security requirements for each security configuration item in the target to be detected, so as to generate a security configuration description of the target to be detected using the security requirements; An automation platform construction module, configured to construct an automation platform according to the security configuration instructions; The automation platform includes a client and multiple function scripts; wherein the function script is a script developed for executing different operation processes for each security configuration item in the security configuration description; the operation process includes a scanning operation, a reinforcement operation, and a rollback operation; the client is used to call the function script to execute the operation process for the security configuration item, and is used to provide an extended function plug-in to add a custom function script; A security configuration detection module is used to use the automation platform to perform different functional operations on the security configuration items to detect whether the security configuration of the target to be detected is correct; wherein, the automation platform is used to perform the scanning operation, the reinforcement operation or the rollback operation on the security configuration item according to the execution command in the target to be detected; or, the automation platform is used to modify the configuration file to perform the reinforcement operation or the rollback operation on the security configuration item.

8. An electronic device, characterized in that: The electronic device includes a processor and a memory; wherein the memory is used to store a computer program, and the computer program is loaded and executed by the processor to implement the security configuration detection method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that Used to store a computer program; wherein when the computer program is executed by a processor, the security configuration detection method according to any one of claims 1 to 6 is implemented.

Images