Information system risk assessment method and device, storage medium and electronic equipment

Abstract

The application discloses an information system risk assessment method and device, a storage medium and electronic equipment, and relates to the technical field of network security. The method comprises the following steps: collecting threat information of an information system to determine an attack surface of the information system; determining initial risk assessment information of the information system according to threat information corresponding to each dimension of the attack surface; performing correlation analysis according to a network attack chain and a preset analysis rule to obtain risk correction information of the information system; and determining target risk assessment information of the information system according to the initial risk assessment information and the risk correction information. The application solves the technical problem that the accuracy of information system risk assessment is low when various risks and attack stages of the information system are analyzed separately in the prior art.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to an information system risk assessment method and device, a storage medium and an electronic device. BACKGROUND

[0002] In recent years, the rapid development of the Internet and computer technology has significantly enhanced its influence in daily life and work. Therefore, it is particularly important to build an effective security risk management system, especially the security risk identification of information systems.

[0003] At present, when performing information system risk assessment in the prior art, the risk assessment is mainly dependent on the threat information that has occurred, and the risk assessment is not comprehensive. This passive risk identification method cannot actively predict and identify potential risks, and the accuracy is low when analyzing various risks and attack stages of the information system alone.

[0004] In view of the above problems, no effective solution has been proposed so far. SUMMARY

[0005] The embodiments of the present application provide an information system risk assessment method and device, a storage medium and an electronic device to at least solve the technical problem of low accuracy of information system risk assessment when analyzing various risks and attack stages of the information system alone in the prior art.

[0006] According to an aspect of an embodiment of the present application, an information system risk assessment method is provided, comprising: collecting threat information of an information system to determine an attack surface of the information system, wherein the threat information is used to describe the security threats existing in the information system; determining initial risk assessment information of the information system according to the threat information corresponding to each dimension of the attack surface; performing correlation analysis according to a network attack chain and a preset analysis rule to obtain risk correction information of the information system, wherein the risk correction information is used to correct the risk deviation of the initial risk assessment information; and determining target risk assessment information of the information system according to the initial risk assessment information and the risk correction information.

[0007] Further, the dimensions of the attack surface include at least one of the following: operating system vulnerabilities, weak passwords, application assets, improper configurations, and threat information of the information system is collected, including: in the case where the dimensions of the attack surface include operating system vulnerabilities, determining a plurality of vulnerabilities corresponding to the operating system according to version information of the operating system in the information system, and determining a vulnerability without installed patches from the plurality of vulnerabilities, taking information of the vulnerability without installed patches as threat information corresponding to the operating system vulnerability dimension; in the case where the dimensions of the attack surface include weak passwords, identifying target assets in the information system, and performing weak password detection on the target assets to obtain assets with weak passwords, taking information of the assets with weak passwords as threat information corresponding to the weak password dimension, wherein the target assets are assets that need to be logged in with a username and a password; in the case where the dimensions of the attack surface include application assets, determining vulnerabilities corresponding to the application assets according to version information of the application assets in the information system, and taking information of the vulnerabilities corresponding to the application assets as threat information corresponding to the application asset dimension; in the case where the dimensions of the attack surface include improper configurations, scanning the operating system according to a configuration scanning tool to obtain improper configuration items, and taking information of the improper configuration items as threat information corresponding to the improper configuration dimension.

[0008] Further, according to the threat information corresponding to each dimension of the attack surface, initial risk assessment information of the information system is determined, including: performing quantitative calculation according to the threat information corresponding to each dimension of the attack surface to obtain a risk score corresponding to each dimension; obtaining a weight coefficient corresponding to each dimension, and calculating an initial risk score of the information system according to the risk score corresponding to each dimension and the weight coefficient corresponding to each dimension; and taking the initial risk score as the initial risk assessment information of the information system.

[0009] Further, the threat information corresponding to each dimension of the attack surface is quantitatively calculated to obtain a risk score corresponding to each dimension, including: in the case that the dimension of the attack surface includes an operating system vulnerability, a risk score corresponding to the operating system vulnerability dimension is calculated according to a CVSS score corresponding to a vulnerability without a patch, a vulnerability heat score, and a vulnerability exploit difficulty score, wherein the vulnerability heat score represents the frequency of vulnerability exploitation, and the vulnerability exploit difficulty score represents the difficulty of vulnerability exploitation; in the case that the dimension of the attack surface includes a weak password, a first score of an asset with a weak password is determined according to an exposure type of the asset with the weak password, and a risk score corresponding to the weak password dimension is calculated according to the first score and a preset score of the asset with the weak password, wherein the exposure type is one of the following: external exposure and non-external exposure; in the case that the dimension of the attack surface includes an application asset, a vulnerability score of a vulnerability corresponding to the application asset is calculated according to a CVSS score, a vulnerability heat score, and a vulnerability exploit difficulty score corresponding to the vulnerability of the application asset, and a risk score corresponding to the application asset dimension is calculated according to the vulnerability score of the vulnerability corresponding to the application asset and a target coefficient of the application asset, wherein the target coefficient is determined based on the business importance and the network location importance of the application asset; in the case that the dimension of the attack surface includes improper configuration, a score corresponding to each improper configuration item is obtained, and the scores corresponding to each improper configuration item are accumulated to calculate a risk score corresponding to the improper configuration dimension.

[0010] Further, the cyber attack chain includes a preset threat framework and a preset attack chain model, and the risk modification information of the information system is obtained by performing correlation analysis and quantification on the attack surface according to the cyber attack chain and the preset analysis rule, including: performing correlation analysis and quantification on the attack behavior corresponding to the attack surface according to the preset threat framework and the preset attack chain model to obtain a first modification score of the information system; performing correlation analysis and quantification on the threat information corresponding to each dimension of the attack surface according to the preset analysis rule to obtain a second modification score of the information system; and performing statistical calculation on the first modification score and the second modification score to obtain a target modification score, and taking the target modification score as the risk modification information of the information system.

[0011] Further, the target risk assessment information of the information system is determined according to the initial risk assessment information and the risk modification information, including: performing summation calculation on the initial risk score corresponding to the initial risk assessment information and the target modification score corresponding to the risk modification information to obtain a target risk score; and taking the target risk score as the target risk assessment information of the information system.

[0012] Further, after the target risk assessment information of the information system is determined according to the initial risk assessment information and the risk modification information, the method further includes: determining a security reinforcement strategy for the information system according to the target risk assessment information of the information system.

[0013] According to another aspect of the embodiments of the present application, there is also provided an information system risk assessment apparatus, comprising: a collection module configured to collect threat information of an information system to determine an attack surface of the information system, wherein the threat information is used to describe a security threat existing in the information system; a first determination module configured to determine initial risk assessment information of the information system according to threat information corresponding to each dimension of the attack surface; an analysis module configured to perform correlation analysis according to a cyber attack chain and a preset analysis rule to obtain risk correction information of the information system, wherein the risk correction information is used to correct risk deviation of the initial risk assessment information; and a second determination module configured to determine target risk assessment information of the information system according to the initial risk assessment information and the risk correction information.

[0014] According to another aspect of the embodiments of the present application, there is also provided a computer program product comprising a computer program, which, when executed by a processor, implements the information system risk assessment method described above.

[0015] According to another aspect of the embodiments of the present application, there is also provided a computer readable storage medium having a computer program stored therein, wherein the computer program is configured to execute the information system risk assessment method described above when running.

[0016] According to another aspect of the embodiments of the present application, there is also provided an electronic device comprising one or more processors; and a memory configured to store one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement a program configured to execute the information system risk assessment method described above when running.

[0017] In the embodiments of the present application, the correlation analysis based on the cyber attack chain is adopted to comprehensively evaluate the potential risk existing in the information system before being attacked. First, the threat information of the information system is collected to determine the attack surface of the information system, wherein the threat information is used to describe the security threat existing in the information system. Then, the initial risk assessment information of the information system is determined according to the threat information corresponding to each dimension of the attack surface. The correlation analysis is performed according to the cyber attack chain and the preset analysis rule to obtain the risk correction information of the information system, wherein the risk correction information is used to correct the risk deviation of the initial risk assessment information. Finally, the target risk assessment information of the information system is determined according to the initial risk assessment information and the risk correction information.

[0018] In the above process, according to the threat information corresponding to each dimension of the attack surface, the initial risk assessment information of the information system is determined, the accurate single-point threat assessment of the information system is realized, then the overall risk of the information system is comprehensively evaluated through the in-depth analysis of the attack surface and the attack association, the comprehensive risk management is realized, the attack surface is identified by combining the defects of improper user configuration, the potential risk of the information system before being attacked is comprehensively evaluated by using the association analysis based on the network attack chain, the security level of the information system is more accurately determined, the basis for formulating more effective security strategies and countermeasures is provided, and thus corresponding preventive measures can be taken before the attack occurs, and the security of the information system is improved.

[0019] Therefore, through the technical scheme of the present application, the overall risk of the information system is comprehensively evaluated through the in-depth analysis of the attack surface and the attack association, the comprehensive risk management is realized, and the technical effect of improving the accuracy of the information system risk assessment is realized, and thus the technical problem of low accuracy of the information system risk assessment in the prior art is solved. BRIEF DESCRIPTION OF DRAWINGS

[0020] The accompanying drawings, which are included to provide a further understanding of the present application and are incorporated in and constitute a part of this application, illustrate embodiments of the present application and serve to explain the present application, and do not constitute improper limitations on the present application. In the drawings:

[0021] Figure 1 is a flowchart of an optional information system risk assessment method according to an embodiment of the present application;

[0022] Figure 2 is a schematic diagram of an optional attack chain according to an embodiment of the present application;

[0023] Figure 3 is a flowchart of an optional rule-based association analysis according to an embodiment of the present application;

[0024] Figure 4 is a flowchart of an optional risk assessment according to an embodiment of the present application;

[0025] Figure 5 is a schematic diagram of an optional information system risk assessment device according to an embodiment of the present application;

[0026] Figure 6 is a schematic diagram of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0027] In the following, the technical solutions in the embodiments of the present application will be described clearly and completely with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all the other embodiments obtained by a person of ordinary skill in the art without creative effort should belong to the scope of the present application.

[0028] It should be noted that the terms "first", "second" and the like in the description and claims of the present application and the above drawings are used to distinguish similar objects, and do not necessarily indicate a specific order or sequence. It should be understood that the data used in this way can be interchanged under appropriate circumstances, so that the embodiments of the application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device including a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but can include other steps or units not clearly listed or inherent to these processes, methods, products or devices.

[0029] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, analyzed data, etc.) involved in the present application are all information and data authorized by the user or authorized by all parties. For example, an interface is provided between the system and the relevant user or institution. Before obtaining the relevant information, the interface needs to send a request to the aforementioned user or institution, and after receiving the consent information feedback from the aforementioned user or institution, the relevant information is obtained.

[0030] Embodiment 1

[0031] According to the embodiments of the present application, an embodiment of an information system risk assessment method is provided. It should be noted that the steps shown in the flowchart of the drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described herein can be executed in a different order.

[0032] Figure 1 is a flowchart of an optional information system risk assessment method according to an embodiment of the present application, as shown in Figure 1 The method comprises the following steps:

[0033] Step S101, collecting threat information of the information system to determine the attack surface of the information system, wherein the threat information is used to describe the security threats existing in the information system.

[0034] In the above steps, the threat information of the information system can be collected by an application system, a processor, or an electronic device, etc.

[0035] Optionally, the dimensions of the attack surface include at least one of the following: operating system vulnerabilities, weak passwords, application assets, improper configurations (or "configuration errors"). The threat information of the information system is collected by the information system risk assessment system, for example, information is collected based on the four dimensions of operating system vulnerabilities, weak passwords, application assets, and improper configurations respectively. According to the collected threat information, it can be determined whether a certain dimension exists, for example, if no information of the improper configuration dimension is collected, it is determined that the attack surface of the information system includes operating system vulnerabilities, weak passwords, and application assets.

[0036] The attack surface refers to a position in a software environment that can be used by an attacker to input or extract data, representing various ways that can be used by an attacker to invade and affect the target network.

[0037] In this embodiment, in order to comprehensively manage and reduce the attack surface, the attack surface can be divided into four dimensions: operating system vulnerabilities, weak passwords, application assets, and improper configurations. The operating system vulnerabilities include all known and potential operating system security vulnerabilities. The weak passwords cover passwords that are easy to guess or can be easily cracked by brute force. The application assets mainly consider third-party applications installed by users, and the security vulnerabilities of these applications can become potential targets for attackers. The improper configurations are used to describe security vulnerabilities that can be caused in the configuration process of the network environment or system or application program, for example, unreasonable or incorrect settings of the network environment or system. These unreasonable or incorrect configurations make the information system more vulnerable to attacks. The improper configurations can be detected by preset rules.

[0038] Step S102, according to the threat information corresponding to each dimension of the attack surface, the initial risk assessment information of the information system is determined.

[0039] For example, according to the threat information corresponding to each dimension of the attack surface, the risk score corresponding to each dimension can be obtained, and the initial risk score of the information system is calculated according to the risk score corresponding to each dimension.

[0040] Step S103, according to the network attack chain and the preset analysis rule, the correlation analysis is performed to obtain the risk correction information of the information system, wherein the risk correction information is used to correct the risk deviation of the initial risk assessment information.

[0041] In some examples, the attack behaviors corresponding to the attack surface of the information system according to the cyber attack chain are associated and quantified to obtain a first correction value, the threat information corresponding to each dimension of the attack surface of the information system is associated and quantified according to the preset analysis rule to obtain a second correction value, and the risk correction information of the information system is obtained based on the first correction value and the second correction value.

[0042] Exemplarily, the attack behaviors corresponding to the attack surface of the information system according to the cyber attack chain are associated and quantified to obtain the first correction value, which can include: mapping each dimension of the attack surface to an attack method point (attack tactic), taking the mapped attack method point as an attack chain node to form an attack chain (attack kill chain), and calculating the first correction value based on the scores corresponding to different attack chain nodes on the attack chain.

[0043] Here, the cyber attack chain can include a preset threat framework and a preset attack chain model; the preset threat framework is, for example, an ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) framework. The preset attack chain model is, for example, a cyber attack chain (also known as a kill chain) model.

[0044] Here, the preset analysis rule can be a preset association analysis rule.

[0045] Exemplarily, the threat information corresponding to each dimension of the attack surface of the information system is associated and quantified according to the preset analysis rule to obtain the second correction value, which can include: using an association analysis engine constructed in the memory, using a preset matching algorithm to load all possible risk association rules in the memory for the threat information corresponding to each dimension of the attack surface, and taking the cumulative value of the preset scores corresponding to all loaded risk association rules as the second correction value.

[0046] Step S104, determining the target risk assessment information of the information system according to the initial risk assessment information and the risk correction information.

[0047] Optionally, after the attack surface threat information collection is completed, the information is then subjected to quantitative risk assessment. First, according to the threat information corresponding to each dimension of the attack surface, the initial risk assessment information of the information system can be determined, for example, the initial risk score corresponding to each dimension is calculated and summed up, and the initial risk score of the information system can be obtained, then according to the network attack chain and the preset analysis rule, the correlation analysis can be carried out, and the risk correction information of the information system can be obtained, for example, the correlation and overall risk of multiple dimensions of the attack surface are quantitatively analyzed, and the correction score can be obtained, then according to the initial risk assessment information and the risk correction information, the target risk assessment information of the information system can be determined, for example, the initial risk score and the correction score are summed up, and the final risk score (i.e. the target risk score) of the information system can be obtained.

[0048] Optionally, the target risk score Risk score of the information system is calculated according to the following formula:

[0049] Risk score =∑ASM score ×α ASM +φ(c)

[0050] Wherein, ASM score represents the risk score corresponding to each dimension of the attack surface, for example, it can include the risk score of the operating system vulnerability dimension Score vul (v), the risk score of the weak password dimension Score weakpassword (α), the risk score of the application asset dimension Score app (α), the risk score of the improper configuration dimension Score configure (p), v represents a vulnerability, α represents an application, and p represents a configuration item. α ASM represents the weight coefficient corresponding to each dimension of the attack surface, which is used for risk normalization according to the importance of each dimension of the attack surface, for example, it can include the weight coefficient of the operating system vulnerability dimension, the weight coefficient of the weak password dimension, the weight coefficient of the application asset dimension, and the weight coefficient of the improper configuration dimension. φ(c) represents the correction score of the initial risk score ∑ASM score ×α ASM .

[0051] Optionally, when calculating ASM score , the attack surface dimension type, the attack stage, whether there is blocking, detection means, and other specific characteristics based on the attack type can be comprehensively evaluated.

[0052] In the actual attack process, it is a complex situation to want to use the attack surface to complete the attack, different attack surface dimensions can form attack chain combinations, and setting security protection or control measures can alleviate the impact of attacks in the presence of attack surfaces. In the conventional system risk assessment algorithm, this part of the content is often missed. Therefore, in the technical solution of the present application, by associating different security events to reveal potential complex attack activities, based on the rule enrichment of correlation analysis, combined with the attack model of the preset threat framework for analysis, the identification and response capability of complex threats can be effectively improved.

[0053] Based on the scheme defined in steps S101 to S104, it can be known that in the embodiment of the present application, the network attack chain based correlation analysis is used to comprehensively evaluate the potential risks of the information system before being attacked. First, the threat information of the information system is collected to determine the attack surface of the information system, wherein the threat information is used to describe the security threats existing in the information system. Then, according to the threat information corresponding to each dimension of the attack surface, the initial risk assessment information of the information system is determined. According to the network attack chain and the preset analysis rule, correlation analysis is performed to obtain the risk correction information of the information system, wherein the risk correction information is used to correct the risk deviation of the initial risk assessment information. According to the initial risk assessment information and the risk correction information, the target risk assessment information of the information system is determined.

[0054] It is easy to note that in the above process, according to the threat information corresponding to each dimension of the attack surface, the initial risk assessment information of the information system is determined to realize accurate single-point threat assessment of the information system. Then, by combining various possible single-point threats, the overall risk of the information system is comprehensively evaluated through in-depth analysis of the attack surface and attack association, and comprehensive risk management is realized. By combining the defects of improper user configuration to identify the attack surface, using network attack chain based correlation analysis, the potential risks of the information system before being attacked are comprehensively evaluated, and the security level of the information system is more accurately determined, which provides a basis for formulating more effective security strategies and response measures, so that corresponding preventive measures can be taken before the attack occurs, and the security of the information system is improved.

[0055] As can be seen, through the technical solution of the present application, the overall risk of the information system is comprehensively evaluated through in-depth analysis of the attack surface and attack association, and comprehensive risk management is realized, thereby realizing the technical effect of improving the accuracy of information system risk assessment, and further solving the technical problem of low accuracy of information system risk assessment in the prior art when analyzing various risks and attack stages of the information system.

[0056] In an optional embodiment, the dimensions of the attack surface include at least one of the following: operating system vulnerabilities, weak passwords, application assets, improper configurations, collecting threat information of the information system, including: in the case where the dimensions of the attack surface include operating system vulnerabilities, determining a plurality of vulnerabilities corresponding to the operating system according to version information of the operating system in the information system, and determining a vulnerability without installed patches from the plurality of vulnerabilities, taking information of the vulnerability without installed patches as threat information corresponding to the operating system vulnerability dimension; in the case where the dimensions of the attack surface include weak passwords, identifying target assets in the information system, and performing weak password detection on the target assets to obtain assets with weak passwords, taking information of the assets with weak passwords as threat information corresponding to the weak password dimension, wherein the target assets are assets that need to be logged in with a username and a password; in the case where the dimensions of the attack surface include application assets, determining a vulnerability corresponding to the application assets according to version information of the application assets in the information system, and taking information of the vulnerability corresponding to the application assets as threat information corresponding to the application asset dimension; in the case where the dimensions of the attack surface include improper configurations, scanning the operating system according to a configuration scanning tool to obtain improper configuration items, and taking information of the improper configuration items as threat information corresponding to the improper configuration dimension.

[0057] Optionally, asset collection and asset attack surface analysis are implemented by collecting threat information of the information system, in the case where the dimensions of the attack surface include operating system vulnerabilities, determining a plurality of vulnerabilities corresponding to the operating system according to version information of the operating system in the information system, and determining a vulnerability without installed patches from the plurality of vulnerabilities, taking information of the vulnerability without installed patches as threat information corresponding to the operating system vulnerability dimension.

[0058] For example, for the operating system vulnerability dimension, first, the operating system version information of each device can be collected by an automated tool, then known vulnerabilities related to the collected system version are determined according to a security database, and installed patches on each device are checked by a patch management tool or a custom query script, and compared with the known vulnerabilities to screen out vulnerabilities that have not been repaired, i.e., to determine a vulnerability without installed patches from the plurality of vulnerabilities.

[0059] Optionally, in the case where the dimensions of the attack surface include weak passwords, target assets in the information system are identified, and weak password detection is performed on the target assets to obtain assets with weak passwords, taking information of the assets with weak passwords as threat information corresponding to the weak password dimension, wherein the target assets are assets that need to be logged in with a username and a password.

[0060] For example, for the weak password dimension, first, all assets that need to be logged in with a username and a password are determined, then weak password detection can be performed on these assets using a rainbow table or a password cracking tool, and information of the assets with weak passwords, such as the number and type of weak passwords, is recorded.

[0061] Optionally, in the case that the dimension of the attack surface includes application assets, the vulnerabilities corresponding to the application assets are determined according to the version information of the application assets in the information system, and the information of the vulnerabilities corresponding to the application assets is taken as the threat information corresponding to the application asset dimension.

[0062] For example, for the application asset dimension, the type, version number, configuration information, and the like of each application software are first acquired, and then the vulnerabilities and vulnerability types corresponding to the application version can be determined according to the vulnerability database, so that the security risk of each application asset can be evaluated according to the severity of the vulnerabilities and the business importance of the application.

[0063] Optionally, in the case that the dimension of the attack surface includes improper configuration, the improper configuration items are obtained by scanning the operating system by a configuration scanning tool, and the information of the improper configuration items is taken as the threat information corresponding to the improper configuration dimension.

[0064] For example, for the improper configuration dimension, the system registry, services, group policies, and port configurations can be scanned by using a configuration scanning tool, the scanning results are analyzed, and the configuration items that can cause security problems are identified, such as unnecessary open ports, default accounts not disabled, excessive permissions of services, and the like.

[0065] It should be noted that the threat information of the information system is collected, which provides a data basis for accurate single-point threat assessment of the information system.

[0066] In an optional embodiment, the initial risk assessment information of the information system is determined according to the threat information corresponding to each dimension of the attack surface, including: quantitatively calculating the threat information corresponding to each dimension of the attack surface to obtain a risk score corresponding to each dimension; obtaining a weight coefficient corresponding to each dimension, and calculating an initial risk score of the information system according to the risk score corresponding to each dimension and the weight coefficient corresponding to each dimension; and taking the initial risk score as the initial risk assessment information of the information system.

[0067] Optionally, the threat information corresponding to each dimension of the attack surface is quantitatively calculated to obtain a risk score corresponding to each dimension, i.e., the risk score Score vul (v) of the operating system vulnerability dimension, the risk score Score weakpassword (α) of the weak password dimension, the risk score Score app (α) of the application asset dimension, and the risk score Score configure (p) of the improper configuration dimension. score Then, the weight coefficient corresponding to each dimension is obtained, and the initial risk score of the information system can be calculated according to the risk score corresponding to each dimension and the weight coefficient corresponding to each dimension, i.e., the aforementioned ∑ASM ASM, as the initial risk assessment information of the information system.

[0068] Optionally, the weight coefficient can be determined according to the use frequency, the caused impact, and the attack difficulty of each dimension, for example, if the full score of the operating system vulnerability dimension is 10 points, the initial weight coefficients of the respective dimensions can be set as follows: operating system vulnerability 1.0, weak password 1.5, application asset 1.2, improper configuration 0.8, and the initial weight coefficients can be adjusted according to different situations and requirements.

[0069] It should be noted that the initial risk assessment information of the information system is determined according to the threat information corresponding to each dimension of the attack surface, and accurate single-point threat assessment of the information system is realized.

[0070] In an optional embodiment, the threat information corresponding to each dimension of the attack surface is quantitatively calculated to obtain a risk score value corresponding to each dimension, including: in the case where the dimension of the attack surface includes an operating system vulnerability, a risk score value corresponding to the operating system vulnerability dimension is calculated according to a CVSS score value corresponding to an uninstalled patch, a vulnerability heat score value, and a vulnerability exploit difficulty score value, wherein the vulnerability heat score value represents the frequency of exploitation of the vulnerability, and the vulnerability exploit difficulty score value represents the difficulty of exploitation of the vulnerability; in the case where the dimension of the attack surface includes a weak password, a first score value of an asset with a weak password is determined according to an exposure type corresponding to the asset with the weak password, and a risk score value corresponding to the weak password dimension is calculated according to the first score value and a preset score value of the asset with the weak password, wherein the exposure type is one of the following: external exposure and non-external exposure; in the case where the dimension of the attack surface includes an application asset, a vulnerability score value of a vulnerability corresponding to the application asset is calculated according to a CVSS score value corresponding to the vulnerability, a vulnerability heat score value, and a vulnerability exploit difficulty score value, and a risk score value corresponding to the application asset dimension is calculated according to the vulnerability score value of the vulnerability corresponding to the application asset and a target coefficient of the application asset, wherein the target coefficient is determined based on the business importance of the application asset and the network location importance; in the case where the dimension of the attack surface includes improper configuration, a score value corresponding to each improper configuration item is obtained, and the score values corresponding to each improper configuration item are added to calculate a risk score value corresponding to the improper configuration dimension.

[0071] Optionally, in the case where the dimension of the attack surface includes an operating system vulnerability, a risk score value corresponding to the operating system vulnerability dimension is calculated according to a CVSS score value corresponding to an uninstalled patch, a vulnerability heat score value, and a vulnerability exploit difficulty score value, wherein the vulnerability heat score value represents the frequency of exploitation of the vulnerability, and the vulnerability exploit difficulty score value represents the difficulty of exploitation of the vulnerability.

[0072] For example, for the operating system vulnerability dimension, the benchmark score is the CVSS score value Score cvss (v), and then the vulnerability popularity and exploit difficulty are combined to comprehensively evaluate. The risk score Score vul (v) of the operating system vulnerability dimension is calculated according to the following formula:

[0073] Score vul (v) = Score cvss (v) * δ(v) * θ(v)

[0074] wherein δ(v) represents the heat of the vulnerability v, for example, determined based on the frequency of the vulnerability being detected to be used in a preset time period (for example, the last 30 days) with the current time as the end time. θ(v) represents the exploit difficulty, for example, the exploit difficulty can be divided into the following levels: there is a complete exploit program, there is a complete exploit code, there is a vulnerability verification code, there is only vulnerability information without other additional information, and different levels correspond to different scores.

[0075] Optionally, in the case where the dimension of the attack surface includes weak passwords, a first score of the asset with the weak password is determined according to the exposure type corresponding to the asset with the weak password, and a risk score corresponding to the weak password dimension is calculated according to the first score and a preset score of the asset with the weak password, wherein the exposure type is one of the following: external exposure and non-external exposure.

[0076] For example, the risk score Score weakpassword (α) of the weak password dimension is calculated according to the following formula:

[0077] Score weakpassword (α) = Score(α) * ζ(α)

[0078] wherein Score(α) reflects the direct risk of the existence of the weak password, in the security assessment, any form of weak password existing in the application is regarded as a serious security vulnerability, therefore, the application with the weak password directly gets full score (for example, set to 10 points), that is, the preset score can be 10 points, ζ(α) represents a score (that is, the first score) corresponding to the network environment role of the application, For the externally exposed application, the risk of the weak password is higher, therefore, the influence factor thereof is A (for example, A is 1), in comparison, the application only used for connection between internal systems has relatively low potential direct threat, therefore, the influence factor thereof is B (wherein B is less than A, for example, B is 0.5).

[0079] Optionally, in the case that the dimension of the attack surface includes application assets, the vulnerability score of the vulnerability corresponding to the application asset is calculated according to the CVSS score value corresponding to the vulnerability corresponding to the application asset, the vulnerability heat score value, and the vulnerability exploit difficulty score value, and the risk score corresponding to the application asset dimension is calculated according to the vulnerability score of the vulnerability corresponding to the application asset and the target coefficient of the application asset, wherein the target coefficient is determined based on the business importance degree of the application asset and the network position importance degree thereof.

[0080] For example, for the application asset dimension, in addition to considering the number of vulnerabilities existing in the application, the importance of the application also needs to be adjusted. In this way, the security risk situation of the application asset can be more comprehensively reflected, because it not only focuses on the vulnerability itself, but also considers the business importance and network position sensitivity of the application. The risk score Score app The calculation formula of (α) is as follows:

[0081] Score app (α) = ∑Score vul (v) * η(α)

[0082] Wherein, v is the vulnerability existing in the application α, in the calculation of the risk score, first, the total number of vulnerabilities existing in the application needs to be counted, and for each application, the total score of the vulnerabilities in the application is accumulated according to the score of each vulnerability in the application, then the total score of the vulnerabilities in the application is multiplied by the importance coefficient η(α) corresponding to the application, to obtain the risk score of the application, and then the risk scores of all applications are accumulated to obtain the risk score of the application asset dimension, wherein the importance coefficient (i.e. the target coefficient) corresponding to the application can be determined according to the application asset role and the network space position of the application asset, that is, ξ(α) and ρ(α) represent the importance degree and the network position respectively, the higher the importance degree and the easier the application is to be attacked by the attacker, the higher the importance coefficient.

[0083] Optionally, in the case that the dimension of the attack surface includes improper configuration, the score value corresponding to each improper configuration item is obtained, and the score values corresponding to each improper configuration item are accumulated to calculate the risk score corresponding to the improper configuration dimension.

[0084] Misconfiguration dimension is an important aspect in information system security management. Common problems include insecure port opening, inappropriate registry settings, incorrect group policy configuration, firewall configuration errors, and failure to properly enable security application protection functions. These configuration errors can provide convenience for attackers and increase the risk of system attacks. Therefore, it is crucial to manage and evaluate these risks. The risk score of the misconfiguration dimension can be obtained by quantifying the risk of each detection item and then accumulating the risk scores of these items. The risk score of each detection item can be set according to its potential impact on system security. For example, a score value is set for each detection item, all configuration items in the information system are checked, and the configuration that does not meet the security standard is identified. The risk score of the misconfiguration dimension is obtained by accumulating the score values of all misconfigured items Score configure (p).

[0085] It should be noted that the threat information corresponding to each dimension of the attack surface is quantitatively calculated to achieve accurate single-point threat assessment of the information system.

[0086] In an optional embodiment, the network attack chain includes a preset threat framework and a preset attack chain model. The correlation analysis is performed according to the network attack chain and the preset analysis rule to obtain the risk correction information of the information system, including: performing correlation analysis and quantification on the attack behavior corresponding to the attack surface according to the preset threat framework and the preset attack chain model to obtain a first correction score of the information system; performing correlation analysis and quantification on the threat information corresponding to each dimension of the attack surface according to the preset analysis rule to obtain a second correction score of the information system; and performing statistical calculation on the first correction score and the second correction score to obtain a target correction score, and taking the target correction score as the risk correction information of the information system.

[0087] Optionally, in order to obtain the target correction score φ(c) that corrects the initial risk score ∑ASM score ×α ASM The first correction score of the information system can be obtained by performing correlation analysis and quantification on the attack behavior corresponding to the attack surface according to the preset threat framework (such as the ATT&CK framework) and the preset attack chain model. The second correction score of the information system can be obtained by performing correlation analysis and quantification on the threat information corresponding to each dimension of the attack surface according to the preset analysis rule. Then, the first correction score and the second correction score are statistically calculated (such as summation calculation or maximum value calculation), and the target correction score can be obtained.

[0088] Figure 2 is a schematic diagram of an optional attack chain according to an embodiment of the present application, such as Figure 2As shown, the attack chain (i.e., a preset attack chain model) usually includes a series of ordered steps, each of which corresponds to a phase in which an attacker advances towards his final goal in a network environment, i.e., the phases of the attack chain mainly include a reconnaissance phase, a weaponization phase, a delivery phase, an exploit phase, an installation phase, a control phase (i.e., C2), and an action phase.

[0089] Exemplarily, using the ATT&CK framework, different attack behaviors can be classified and mapped to specific tactics and techniques, so as to determine the possible attack surface, and then based on the possible attack behaviors (attack kill chain), the attack surface risk is combined. For example, the detected attack surface is mapped to specific tactics and techniques of the ATT&CK matrix, and then summarized by the attack kill chain, so that the damage that may be caused by the exposure of the attack surface can be fully identified, and through the summary based on the kill chain, a first modified score μ(β) is obtained, which is represented as follows:

[0090] μ(β)=∑Score(β)*γ(β)

[0091] Wherein, β describes the attack kill chain, Score(β) describes the score of each attack kill chain node before modification, and γ(β) is a coefficient for describing whether the kill chain node has a protection measure. For example, different coefficients can be configured according to the strength of the protection measure, and the higher the strength of the protection measure of the kill chain node, the larger the configured coefficient, such as blockage=0.1, detection but unable to block=0.7, and no measure=1.

[0092] Optionally, in a real attack, in addition to such a general correlation, there are a small number of attacks that have a combination of prerequisites or exploits before the vulnerabilities, so further analysis can be performed according to preset analysis rules and a correlation analysis engine. For example, using a correlation analysis engine constructed in memory, for each dimension of the attack surface corresponding to the threat information, all possible risk correlation rules are loaded in memory using a preset matching algorithm (for example, an AC tree algorithm, a string matching algorithm for multi-mode matching), and the cumulative value of the preset scores corresponding to all loaded risk correlation rules is taken as a risk modification value of the initial risk assessment value.

[0093] Figure 3 is a flowchart of an optional rule-based correlation analysis according to an embodiment of the application, as shown in Figure 3As shown, the input of the correlation analysis engine is the threat information collected in the aforementioned 4 dimensions (ASM< vulnerability >, ASM< application >, ASM< configuration >, ASM< weak password >), which is put into a single-point event queue after normalization, and the events in the queue are matched based on the multi-single-point event aggregation rules of the conditions, and if a hit is made, it is reported, for example, based on condition 3 to aggregate and match rules for ASM< application > and ASM< weak password >, and the rule matching is successful.

[0094] For example, the correlation rule 1 is: vulnerability A requires the user to open port B, if the scan finds that vulnerability A exists, but the user has closed port B, then the corresponding attack surface score needs to be corrected (i.e. reduced). Through the summary based on the analysis rule, a second correction score τ(λ) can be obtained, which is represented as follows:

[0095] τ(λ) = ∑Score(λ)

[0096] That is, the hit of the correlation analysis rule λ is counted, and the score Score(λ) of the hit rule is counted and accumulated.

[0097] At this point, the target correction score φ(c) can be obtained, which is represented as follows:

[0098] φ(c) = μ(β) + τ(λ)

[0099] It should be noted that by combining various possible single-point threats, through in-depth analysis of attack surface and attack correlation, the overall risk of the information system is comprehensively evaluated, the overall risk management is realized, the attack surface is identified by combining the defects of improper user configuration, the potential risks of the information system before being attacked are comprehensively evaluated by using the correlation analysis based on the ATT&CK attack matrix, and the security level of the information system is more accurately determined, which provides a basis for formulating more effective security policies and response measures, so that corresponding preventive measures can be taken before the attack occurs, and the security of the information system is improved.

[0100] In an optional embodiment, the target risk assessment information of the information system is determined according to the initial risk assessment information and the risk correction information, including: summing the initial risk score corresponding to the initial risk assessment information and the target correction score corresponding to the risk correction information to obtain a target risk score; and taking the target risk score as the target risk assessment information of the information system.

[0101] Optionally, after the initial risk score ∑ASM score ×α ASM and the target correction score φ(c) are calculated respectively, summing calculation can be performed to obtain the target risk score Risk score , that is:

[0102] Riskscore =∑ASM score ×α ASM +φ(c)

[0103] In an alternative embodiment, after determining the target risk assessment information of the information system according to the initial risk assessment information and the risk correction information, a security reinforcement strategy for the information system is determined according to the target risk assessment information of the information system.

[0104] Optionally, the security reinforcement strategy for the information system can be determined according to the target risk assessment information of the information system, for example, a corresponding risk level can be determined according to the target risk score, so that the corresponding security reinforcement strategy can be taken according to the risk level.

[0105] Optionally, the technical solution of the present application can be applied to information system risk assessment in a host or server environment, and the following are several specific application scenarios:

[0106] (1) Sensitive network access evaluation: Before a host or server is connected to a sensitive network, the technical solution of the present application can be used for risk assessment to ensure that the security of the system meets the security requirements of the sensitive network. By evaluating the risk of each dimension of the attack surface, it can be determined whether further security reinforcement or adjustment strategy is needed.

[0107] (2) Host security state monitoring: The technical solution of the present application is used for regular or real-time security risk assessment of the host to monitor the changes of the system security state and timely find new or enhanced attack surface dimensions, providing necessary information for the security team to update the defense.

[0108] (3) Security compliance check: The technical solution of the present application is used in compliance review to verify whether the information system has reached the necessary security standards and provide detailed risk assessment reports.

[0109] (4) Incident response and forensic analysis: After an information security event occurs, the technical solution of the present application is used to analyze the attack surface and attack chain that may be used by the attacker to determine the attack path and affected system components, providing data support for quickly locating the problem and mitigating risks.

[0110] Figure 4 is a flowchart of an alternative risk assessment according to an embodiment of the present application, as Figure 4As shown, information collection is respectively based on four dimensions of operating system vulnerabilities, weak passwords, application assets, and improper configuration, threat information corresponding to each dimension is quantitatively calculated to obtain a risk score corresponding to each dimension, wherein the operating system vulnerability dimension combines the CVSS score, heat, and difficulty of vulnerability to comprehensively evaluate, the weak password dimension considers the application attribute (such as the network environment role of the application), and the application asset dimension considers the asset importance. Then, the initial risk score is obtained by risk normalization through the weight coefficient corresponding to each dimension, the first modified score is obtained based on the kill chain and blocking condition, the second modified score is obtained based on the association rule analysis, the target modified score is obtained by summing the first modified score and the second modified score, and then the initial risk score is modified according to the target modified score to obtain the final risk score of the information system.

[0111] Therefore, by the technical scheme of the present application, the overall risk of the information system is comprehensively evaluated through in-depth analysis of the attack surface and attack association, the purpose of comprehensive risk management is achieved, the technical effect of improving the accuracy of information system risk assessment is achieved, and the technical problem of low accuracy of information system risk assessment in the prior art is solved.

[0112] Embodiment 2

[0113] According to the embodiment of the present application, an embodiment of an information system risk assessment device is provided, wherein Figure 5 is a schematic diagram of an optional information system risk assessment device according to an embodiment of the present application, as Figure 5 shown, the device comprises: an acquisition module 501 for acquiring threat information of an information system to determine an attack surface of the information system, wherein the threat information is used to describe the security threats existing in the information system; a first determination module 502 for determining initial risk assessment information of the information system according to threat information corresponding to each dimension of the attack surface; an analysis module 503 for performing association analysis according to a network attack chain and a preset analysis rule to obtain risk correction information of the information system, wherein the risk correction information is used to correct the risk deviation of the initial risk assessment information; and a second determination module 504 for determining target risk assessment information of the information system according to the initial risk assessment information and the risk correction information.

[0114] It should be noted that the acquisition module 501, the first determination module 502, the analysis module 503, and the second determination module 504 correspond to steps S101 to S104 in the above embodiment, and the four modules have the same examples and application scenarios as the corresponding steps, but are not limited to the content disclosed in the above embodiment 1.

[0115] Optionally, the dimensions of the attack surface comprise at least one of the following: operating system vulnerabilities, weak passwords, application assets, improper configurations.

[0116] Optionally, the collection module comprises: a first determination unit, configured to, in a case where the dimensions of the attack surface comprise operating system vulnerabilities, determine, according to version information of operating systems in the information system, a plurality of vulnerabilities corresponding to the operating systems, and determine, from the plurality of vulnerabilities, a vulnerability for which a patch is not installed, and take information of the vulnerability for which the patch is not installed as threat information corresponding to the dimension of operating system vulnerabilities; a second determination unit, configured to, in a case where the dimensions of the attack surface comprise weak passwords, identify target assets in the information system, and perform weak password detection on the target assets to obtain assets having weak passwords, and take information of the assets having weak passwords as threat information corresponding to the dimension of weak passwords, wherein the target assets are assets that need to be logged in by using a username and a password; a third determination unit, configured to, in a case where the dimensions of the attack surface comprise application assets, determine, according to version information of application assets in the information system, vulnerabilities corresponding to the application assets, and take information of the vulnerabilities corresponding to the application assets as threat information corresponding to the dimension of application assets; and a fourth determination unit, configured to, in a case where the dimensions of the attack surface comprise improper configurations, perform scanning on operating systems by using a configuration scanning tool to obtain improper configuration items, and take information of the improper configuration items as threat information corresponding to the dimension of improper configurations.

[0117] Optionally, the first determination module comprises: a first calculation unit, configured to perform quantitative calculation on the threat information corresponding to each dimension of the attack surface to obtain a risk score corresponding to each dimension; a second calculation unit, configured to obtain a weight coefficient corresponding to each dimension, and calculate, according to the risk score corresponding to each dimension and the weight coefficient corresponding to each dimension, an initial risk score of the information system; and a fifth determination unit, configured to take the initial risk score as initial risk assessment information of the information system.

[0118] Optionally, the first calculation unit comprises: a first calculation submodule, configured to, in a case where the dimension of the attack surface comprises an operating system vulnerability, calculate a risk score corresponding to the operating system vulnerability dimension according to a CVSS score corresponding to the vulnerability without patch, a vulnerability heat score and a vulnerability exploit difficulty score, wherein the vulnerability heat score represents a frequency of exploitation of the vulnerability, and the vulnerability exploit difficulty score represents a degree of difficulty of exploitation of the vulnerability; a second calculation submodule, configured to, in a case where the dimension of the attack surface comprises a weak password, determine a first score of an asset with a weak password according to an exposure type corresponding to the asset with the weak password, and calculate a risk score corresponding to the weak password dimension according to the first score and a preset score of the asset with the weak password, wherein the exposure type is one of the following: external exposure and non-external exposure; a third calculation submodule, configured to, in a case where the dimension of the attack surface comprises an application asset, calculate a vulnerability score of a vulnerability corresponding to the application asset according to a CVSS score corresponding to the vulnerability, a vulnerability heat score and a vulnerability exploit difficulty score, and calculate a risk score corresponding to the application asset dimension according to the vulnerability score of the vulnerability corresponding to the application asset and a target coefficient of the application asset, wherein the target coefficient is determined based on a business importance degree of the application asset and a network location importance degree; and a fourth calculation submodule, configured to, in a case where the dimension of the attack surface comprises improper configuration, obtain a score corresponding to each improper configuration item, and accumulate the score corresponding to each improper configuration item to calculate a risk score corresponding to the improper configuration dimension.

[0119] Optionally, the analysis module comprises: a first analysis unit, configured to perform correlation analysis and quantification on attack behaviors corresponding to the attack surface according to a preset threat framework and a preset attack chain model to obtain a first modified score of the information system; a second analysis unit, configured to perform correlation analysis and quantification on threat information corresponding to each dimension of the attack surface according to a preset analysis rule to obtain a second modified score of the information system; and a third analysis unit, configured to perform statistical calculation on the first modified score and the second modified score to obtain a target modified score, and take the target modified score as the risk modified information of the information system.

[0120] Optionally, the second determination module comprises: a third calculation unit, configured to perform summation calculation on an initial risk score corresponding to the initial risk assessment information and a target modified score corresponding to the risk modified information to obtain a target risk score; and a sixth determination unit, configured to take the target risk score as the target risk assessment information of the information system.

[0121] Optionally, the information system risk assessment apparatus further comprises: a third determination module, configured to, after determining the target risk assessment information of the information system according to the initial risk assessment information and the risk modified information, determine a security reinforcement strategy for the information system according to the target risk assessment information of the information system.

[0122] Embodiment 3

[0123] According to another aspect of the embodiments of the present application, there is also provided a computer program product comprising a computer program which, when executed by a processor, implements the information system risk assessment method described above.

[0124] Embodiment 4

[0125] According to another aspect of the embodiments of the present application, there is also provided a computer-readable storage medium having stored therein a computer program, wherein the computer program is arranged to perform the information system risk assessment method described above when executed.

[0126] Embodiment 5

[0127] According to another aspect of the embodiments of the present application, there is also provided an electronic device, wherein Figure 6 is a schematic diagram of an optional electronic device according to an embodiment of the present application, as Figure 6 shown, the electronic device comprises one or more processors; a memory for storing one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement a program for running, wherein the program is arranged to perform the information system risk assessment method described above when executed. The processor implements the following steps when executing the program: collecting threat information of the information system to determine an attack surface of the information system, wherein the threat information is used to describe security threats existing in the information system; determining initial risk assessment information of the information system according to threat information corresponding to each dimension of the attack surface; performing correlation analysis according to a cyber attack chain and a preset analysis rule to obtain risk correction information of the information system, wherein the risk correction information is used to correct risk deviation of the initial risk assessment information; and determining target risk assessment information of the information system according to the initial risk assessment information and the risk correction information.

[0128] Optionally, the dimensions of the attack surface comprise at least one of the following: operating system vulnerabilities, weak passwords, application assets, improper configurations; the processor further implements the following steps when executing the program: in the case that the dimensions of the attack surface comprise operating system vulnerabilities, determining a plurality of vulnerabilities corresponding to the operating system according to version information of the operating system in the information system, and determining a vulnerability without installed patches from the plurality of vulnerabilities, and taking information of the vulnerability without installed patches as threat information corresponding to the operating system vulnerability dimension; in the case that the dimensions of the attack surface comprise weak passwords, identifying a target asset in the information system, and performing weak password detection on the target asset to obtain an asset with weak passwords, and taking information of the asset with weak passwords as threat information corresponding to the weak password dimension, wherein the target asset is an asset that needs to be logged in with a username and a password; in the case that the dimensions of the attack surface comprise application assets, determining a vulnerability corresponding to the application asset according to version information of the application asset in the information system, and taking information of the vulnerability corresponding to the application asset as threat information corresponding to the application asset dimension; in the case that the dimensions of the attack surface comprise improper configurations, scanning the operating system according to a configuration scanning tool to obtain an improper configuration item, and taking information of the improper configuration item as threat information corresponding to the improper configuration dimension.

[0129] Optionally, the processor further implements the following steps when executing the program: quantitatively calculating threat information corresponding to each dimension of the attack surface to obtain a risk score corresponding to each dimension; obtaining a weight coefficient corresponding to each dimension, and calculating an initial risk score of the information system according to the risk score corresponding to each dimension and the weight coefficient corresponding to each dimension; and taking the initial risk score as initial risk assessment information of the information system.

[0130] Optionally, the processor, when executing the program, further implements the following steps: in the case that the dimension of the attack surface comprises an operating system vulnerability, calculating a risk score value corresponding to the operating system vulnerability dimension according to a CVSS score value corresponding to the vulnerability without installing a patch, a vulnerability heat score value, and a vulnerability exploit difficulty score value, wherein the vulnerability heat score value represents a frequency of exploitation of the vulnerability, and the vulnerability exploit difficulty score value represents a degree of difficulty of exploitation of the vulnerability; in the case that the dimension of the attack surface comprises a weak password, determining a first score value of an asset with a weak password according to an exposure type corresponding to the asset with the weak password, and calculating a risk score value corresponding to the weak password dimension according to the first score value and a preset score value of the asset with the weak password, wherein the exposure type is one of the following: external exposure and non-external exposure; in the case that the dimension of the attack surface comprises an application asset, calculating a vulnerability score value of a vulnerability corresponding to the application asset according to a CVSS score value corresponding to the vulnerability, a vulnerability heat score value, and a vulnerability exploit difficulty score value, and calculating a risk score value corresponding to the application asset dimension according to the vulnerability score value of the vulnerability corresponding to the application asset and a target coefficient of the application asset, wherein the target coefficient is determined based on a business importance degree of the application asset and a network location importance degree; in the case that the dimension of the attack surface comprises improper configuration, obtaining a score value corresponding to each improper configuration item, and accumulating the score value corresponding to each improper configuration item to calculate a risk score value corresponding to the improper configuration dimension.

[0131] Optionally, the processor, when executing the program, further implements the following steps: performing correlation analysis and quantification on attack behaviors corresponding to the attack surface according to a preset threat framework and a preset attack chain model to obtain a first modified score value of the information system; performing correlation analysis and quantification on threat information corresponding to each dimension of the attack surface according to a preset analysis rule to obtain a second modified score value of the information system; and performing statistical calculation on the first modified score value and the second modified score value to obtain a target modified score value, and taking the target modified score value as the risk modified information of the information system.

[0132] Optionally, the processor, when executing the program, further implements the following steps: performing summation calculation on the initial risk score value corresponding to the initial risk assessment information and the target modified score value corresponding to the risk modified information to obtain a target risk score value; and taking the target risk score value as the target risk assessment information of the information system.

[0133] Optionally, the processor, when executing the program, further implements the following steps: after determining the target risk assessment information of the information system according to the initial risk assessment information and the risk modified information, determining a security reinforcement strategy for the information system according to the target risk assessment information of the information system.

[0134] The device herein can be a server, a PC, a PAD, a mobile phone, or the like.

[0135] The above-mentioned embodiment numbers of the present application are only for description, and do not represent the advantages or disadvantages of the embodiments.

[0136] In the above-mentioned embodiments of the present application, the description of each embodiment has its own focus, and the parts not described in detail in a certain embodiment can be referred to the relevant description of other embodiments.

[0137] In several embodiments provided in the present application, it should be understood that the disclosed technical contents can be implemented by other ways. Among them, the above-mentioned device embodiments are only schematic, for example, the division of the units can be a logical function division, and actual implementation can have another division way, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units or modules shown or discussed can be indirect coupling or communication connection through some interfaces, units or modules, which can be electrical or other forms.

[0138] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place or distributed to multiple units. Part or all of the units can be selected to achieve the purpose of the embodiment scheme according to actual needs.

[0139] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be realized in the form of hardware or in the form of software functional unit.

[0140] The integrated unit, if realized in the form of software functional unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application or the whole or part of the technical solutions which essentially contribute to the prior art can be embodied in the form of software product, which is stored in a storage medium and includes a plurality of instructions for making a computer device (which can be a personal computer, a server or a network device, etc.) execute all or part of the steps of the method described in each embodiment of the present application. The above-mentioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and various program code storage media.

[0141] The above merely describes the preferred embodiments of the present application, and it should be pointed out that, for those skilled in the art, several improvements and refinements can be made without departing from the principles of the present application, and these improvements and refinements should also be considered as falling within the protection scope of the present application.

Claims

1. A method of information system risk assessment, characterized by, The method comprises the following steps: collecting threat information of an information system to determine an attack surface of the information system, wherein the threat information is used to describe security threats existing in the information system; determining initial risk assessment information of the information system according to threat information corresponding to each dimension of the attack surface; performing correlation analysis according to a cyber attack chain and a preset analysis rule to obtain risk correction information of the information system, wherein the risk correction information is used to correct risk deviation of the initial risk assessment information; determining target risk assessment information of the information system according to the initial risk assessment information and the risk correction information; wherein the cyber attack chain comprises a preset threat framework and a preset attack chain model, and performing correlation analysis according to the cyber attack chain and the preset analysis rule to obtain the risk correction information of the information system comprises: performing correlation analysis and quantification on attack behaviors corresponding to the attack surface according to the preset threat framework and the preset attack chain model to obtain a first correction score of the information system; performing correlation analysis and quantification on threat information corresponding to each dimension of the attack surface according to the preset analysis rule to obtain a second correction score of the information system; performing statistical calculation on the first correction score and the second correction score to obtain a target correction score, and taking the target correction score as the risk correction information of the information system.

2. The method of claim 1, wherein, The dimensions of the attack surface comprise at least one of the following: operating system vulnerabilities, weak passwords, application assets, improper configurations, and collecting threat information of the information system comprises: in the case that the dimensions of the attack surface comprise the operating system vulnerabilities, determining a plurality of vulnerabilities corresponding to the operating system according to version information of the operating system in the information system, and determining a vulnerability without installed patches from the plurality of vulnerabilities, and taking information of the vulnerability without installed patches as threat information corresponding to the operating system vulnerability dimension; in the case that the dimensions of the attack surface comprise the weak passwords, identifying target assets in the information system, and performing weak password detection on the target assets to obtain assets with weak passwords, and taking information of the assets with weak passwords as threat information corresponding to the weak password dimension, wherein the target assets are assets that need to be logged in with a username and a password; in the case that the dimensions of the attack surface comprise the application assets, determining vulnerabilities corresponding to the application assets according to version information of the application assets in the information system, and taking information of the vulnerabilities corresponding to the application assets as threat information corresponding to the application asset dimension; in the case that the dimensions of the attack surface comprise the improper configurations, scanning the operating system according to a configuration scanning tool to obtain improper configuration items, and taking information of the improper configuration items as threat information corresponding to the improper configuration dimension.

3. The method of claim 1, wherein, Determining the initial risk assessment information of the information system according to the threat information corresponding to each dimension of the attack surface comprises: performing quantification calculation on the threat information corresponding to each dimension of the attack surface to obtain a risk score corresponding to each dimension. obtain a weight coefficient corresponding to each dimension, and calculate an initial risk score of the information system according to the risk score corresponding to each dimension and the weight coefficient corresponding to each dimension; use the initial risk score as the initial risk assessment information of the information system.

4. The method of claim 3, wherein, quantitative calculation is performed on the threat information corresponding to each dimension of the attack surface to obtain a risk score corresponding to each dimension, including: in the case where the dimension of the attack surface includes an operating system vulnerability, a risk score corresponding to the operating system vulnerability dimension is calculated according to a CVSS score value of a vulnerability without installing a patch, a vulnerability heat score and a vulnerability exploitation difficulty score, wherein the vulnerability heat score represents the frequency of vulnerability exploitation, and the vulnerability exploitation difficulty score represents the difficulty of vulnerability exploitation; in the case where the dimension of the attack surface includes a weak password, a first score of an asset with a weak password is determined according to an exposure type of the asset with a weak password, and a risk score corresponding to the weak password dimension is calculated according to the first score and a preset score of the asset with a weak password, wherein the exposure type is one of the following: external exposure, non-external exposure; in the case where the dimension of the attack surface includes an application asset, a vulnerability score of a vulnerability corresponding to the application asset is calculated according to a CVSS score value, a vulnerability heat score and a vulnerability exploitation difficulty score corresponding to the vulnerability of the application asset, and a risk score corresponding to the application asset dimension is calculated according to the vulnerability score of the vulnerability corresponding to the application asset and a target coefficient of the application asset, wherein the target coefficient is determined based on the business importance of the application asset and the network location importance; in the case where the dimension of the attack surface includes improper configuration, a score value corresponding to each improper configuration item is obtained, and the score value corresponding to each improper configuration item is accumulated to calculate a risk score corresponding to the improper configuration dimension.

5. The method of claim 1, wherein, determine target risk assessment information of the information system according to the initial risk assessment information and the risk correction information, including: perform sum calculation on the initial risk score corresponding to the initial risk assessment information and the target correction score corresponding to the risk correction information to obtain a target risk score; use the target risk score as the target risk assessment information of the information system.

6. The method according to any one of claims 1 to 5, characterized in that, after determining the target risk assessment information of the information system according to the initial risk assessment information and the risk correction information, the method further includes: determine a security reinforcement strategy for the information system according to the target risk assessment information of the information system.

7. An information system risk assessment apparatus, characterized by, including: a collection module for collecting threat information of an information system to determine an attack surface of the information system, wherein the threat information is used to describe the security threats existing in the information system; a first determination module for determining initial risk assessment information of the information system according to threat information corresponding to each dimension of the attack surface; An analysis module is configured to perform correlation analysis according to a cyber attack chain and a preset analysis rule, and obtain risk correction information of the information system, wherein the risk correction information is used to correct risk deviation of the initial risk assessment information; A second determination module is configured to determine target risk assessment information of the information system according to the initial risk assessment information and the risk correction information; The cyber attack chain comprises a preset threat framework and a preset attack chain model, and the analysis module comprises: A first analysis unit is configured to perform correlation analysis and quantification on attack behaviors corresponding to the attack surface according to the preset threat framework and the preset attack chain model, and obtain a first correction score of the information system; A second analysis unit is configured to perform correlation analysis and quantification on threat information corresponding to each dimension of the attack surface according to the preset analysis rule, and obtain a second correction score of the information system; A third analysis unit is configured to perform statistical calculation on the first correction score and the second correction score, and obtain a target correction score, and take the target correction score as the risk correction information of the information system.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, wherein the computer program is configured to execute the information system risk assessment method in any one of claims 1 to 6 when running.

9. An electronic device, comprising: The electronic device comprises one or more processors; A memory is configured to store one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors are caused to implement a program for running, wherein the program is configured to execute the information system risk assessment method in any one of claims 1 to 6 when running.

Images