Device safety assessment method, device, device and readable storage medium

Abstract

The present application discloses a device security assessment method, apparatus, equipment and readable storage medium, the method comprising: determining the online rate of each asset component through device inspection, and calculating the device inspection online rate; comparing each security sub-scheme in the device security scheme with the attribute information of the actual device configuration, and determining the policy audit pass rate of the device; monitoring the encrypted tunnel to obtain the ciphertext traffic and plaintext traffic passing through the encrypted tunnel, and calculating the encrypted tunnel pass rate; performing a baseline check on the device server based on the created baseline configuration file to obtain the baseline check pass rate; generating a device security assessment result based on the device inspection online rate, policy audit pass rate, encrypted tunnel pass rate and baseline check pass rate. The present application comprehensively evaluates the device security from multiple dimensions, generates a comprehensive device security assessment result, and provides a more efficient, comprehensive and real-time solution for device security management.

Description

Technical Field

[0001] The present application relates to the field of equipment detection, and more specifically, to an equipment security assessment method, apparatus, device and readable storage medium. Background Art

[0002] In the field of equipment security assessment, traditional methods often rely on manual inspections, log analysis, and rule-based static security scanning. Although these methods can identify security risks of equipment to a certain extent, they have many limitations. For example, manual inspections are inefficient and prone to missing details; log analysis requires professional interpretation and it is difficult to capture all abnormal behaviors in real time; static security scanning may miss new threats due to untimely updates of the rule base. The existing technologies have the following main defects:

[0003] 1. Inefficiency and high cost: Manual inspection and log analysis require a lot of manpower and time, increasing operating costs.

[0004] 2. Poor real-time performance: Traditional methods make it difficult to monitor equipment status in real time and respond quickly.

[0005] 3. Incomplete coverage: Static security scanning is limited by the rule base and may not be able to fully cover all potential security risks.

[0006] 4. Lack of comprehensive assessment: Most methods only evaluate a single dimension and lack a comprehensive safety assessment system.

[0007] 5. Low degree of automation: It relies heavily on manual operations, has a low level of automation, and is difficult to adapt to the safety management needs of large-scale equipment.

[0008] Based on this, the present application proposes a device safety assessment solution, which effectively overcomes the shortcomings of the prior art. Summary of the invention

[0009] In view of this, the present application provides a device security assessment method, apparatus, equipment and readable storage medium, which comprehensively evaluates the device security from multiple dimensions such as equipment inspection online rate, policy audit pass rate, encrypted tunnel pass rate and baseline verification pass rate through automated means, and generates comprehensive device security assessment results, which effectively overcomes the shortcomings of the existing technology and provides a more efficient, comprehensive and real-time solution for device security management.

[0010] A device safety assessment method, comprising:

[0011] Determine the online rate of each asset component through equipment inspection, and calculate the equipment inspection online rate;

[0012] Compare the attribute information of each dimension of the device's actual configuration with the security sub-plans in the pre-retrieved device security plan to determine the device's policy audit pass rate;

[0013] Monitoring the encrypted tunnel to obtain the ciphertext traffic and plaintext traffic passing through the encrypted tunnel, and calculating the encrypted tunnel encryption rate;

[0014] Perform a baseline check on the device server based on the created baseline configuration file to obtain a baseline check pass rate;

[0015] The device security assessment result is generated according to the device inspection online rate, the policy audit pass rate, the encrypted tunnel pass rate and the baseline verification pass rate.

[0016] Optionally, the security sub-solution in the device security solution includes a routing security sub-solution, a NAT security sub-solution, and a policy security sub-solution;

[0017] Compare the attribute information of each dimension of the device's actual configuration with the security sub-plans in the pre-retrieved device security plan to determine the device's policy audit pass rate, including:

[0018] Based on the routing security sub-scheme and routing configuration attribute information, determine the routing policy audit pass rate by evaluating the correctness of routing table entries, the rationality of routing protocol configuration, and the compliance of routing selection policies;

[0019] Based on the NAT security sub-solution and NAT configuration attribute information, determine the NAT policy audit pass rate according to the NAT mapping rules, port forwarding and NAT table usage;

[0020] Based on the configuration attribute information of the policy security sub-scheme and the policy risk points, the security policy audit pass rate is determined by evaluating the coverage of the security policy on the preset security risk points;

[0021] The policy audit pass rate of the device is determined based on the routing policy audit pass rate, the NAT policy audit pass rate and the security policy audit pass rate.

[0022] Optionally, the online rate of each asset component is determined through equipment inspection, and the equipment inspection online rate is calculated, including:

[0023] Obtaining the proportion of online times of each asset component during the inspection process through equipment inspection, and determining the online rate of each asset component based on the proportion of online times;

[0024] Based on the online rates of the asset components, a weighted calculation is performed to obtain the equipment inspection online rate.

[0025] Optionally, the asset components include switches, firewalls, vertical encryption authentication devices, and servers;

[0026] Determine the online rate of each asset component through equipment inspection, and calculate the equipment inspection online rate, including:

[0027] Determine the switch online rate based on the number of online switches obtained from equipment inspection and the total number of managed switches;

[0028] Determine the firewall online rate based on the number of online firewalls obtained from device inspection and the total number of managed firewalls;

[0029] Determine the online rate of the vertical encryption authentication device based on the number of online vertical encryption authentication devices and the number of managed vertical encryption authentication devices obtained from the equipment inspection;

[0030] Determine the server online rate based on the number of online servers and managed servers obtained from equipment inspection;

[0031] The equipment inspection online rate is calculated based on the online rate of the switch, the online rate of the firewall, the online rate of the vertical encryption authentication device and the online rate of the server.

[0032] Optionally, generating a device security assessment result according to the device inspection online rate, the policy audit pass rate, the policy audit pass rate, and the baseline verification pass rate includes:

[0033] A weighted total score is calculated based on the equipment inspection online rate, the policy audit pass rate, the policy audit pass rate and the baseline verification pass rate, as well as the corresponding inspection weight, audit weight, secret communication weight and verification weight;

[0034] The equipment is graded for safety assessment according to the weighted total score to obtain an equipment safety assessment result.

[0035] Optionally, perform a baseline check on the device server based on the created baseline configuration file to obtain the baseline check pass rate, including:

[0036] Verifying the password setting of the device server according to the created password policy rules to obtain a password verification result;

[0037] Verify the login status of the device server according to the created identity authentication measure to obtain a login verification result;

[0038] Verify the SSH management address of the device server according to the created remote management measure to obtain an address verification result;

[0039] Check the high-risk ports of the device server according to the created intrusion prevention measures to obtain port check results;

[0040] Verify the security audit process of the device server according to the created security audit measures to obtain the audit verification result;

[0041] A baseline verification pass rate is determined based on the password verification result, the login verification result, the address verification result, the address verification result and the audit verification result.

[0042] Optionally, also include:

[0043] If the asset components are not detected, the device security assessment is stopped and the abnormal situation is displayed.

[0044] An equipment safety assessment device, comprising:

[0045] The equipment inspection unit is used to determine the online rate of each asset component through equipment inspection and calculate the equipment inspection online rate;

[0046] The policy audit unit is used to compare the security sub-plans in the pre-retrieved device security plan with the attribute information of each dimension of the actual device configuration to determine the policy audit pass rate of the device;

[0047] The encryption tunnel unit is used to monitor the encryption tunnel to obtain the ciphertext flow and the plaintext flow passing through the encryption tunnel, and calculate the encryption tunnel encryption rate;

[0048] A baseline verification unit, used to perform a baseline verification on the device server based on the created baseline configuration file to obtain a baseline verification pass rate;

[0049] The comprehensive evaluation unit is used to generate a device security evaluation result according to the device inspection online rate, the policy audit pass rate, the encrypted tunnel pass rate and the baseline verification pass rate.

[0050] A device security assessment device, comprising a memory and a processor;

[0051] The memory is used to store programs;

[0052] The processor is used to execute the program to implement each step of the device security assessment method as described in any one of the above items.

[0053] A readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, each step of the device security assessment method as described in any one of the above items is implemented.

[0054] It can be seen from the above technical solutions that the device security assessment method, device, equipment and readable storage medium provided by the embodiment of the present application comprehensively evaluate the device security in multiple dimensions, including the online rate of device inspection, policy audit pass rate, encrypted tunnel pass rate and baseline verification pass rate, through automated means, to generate a comprehensive device security assessment result. First, the online rate of each asset component is determined through device inspection, and the online rate of device inspection is calculated. Secondly, the attribute information of each security sub-scheme in the pre-retrieved device security scheme is compared with the attribute information of each dimension of the actual configuration of the device to determine the policy audit pass rate of the device. In addition, the encrypted traffic and plaintext traffic passing through the encrypted tunnel are obtained by monitoring the encrypted tunnel, and the encrypted tunnel pass rate is calculated. Then, the device server is baseline-checked based on the created baseline configuration file to obtain the baseline verification pass rate. Finally, the device security assessment result is generated according to the online rate of device inspection, the policy audit pass rate, the encrypted tunnel pass rate and the baseline verification pass rate.

[0055] Compared with the prior art, this application has the following advantages:

[0056] 1. Efficiency and low cost: This application significantly improves work efficiency and reduces labor costs through automated evaluation processes.

[0057] 2. Real-time and dynamic: This application enhances the dynamic nature of security management by being able to monitor device status in real time, detect and respond to security incidents in a timely manner.

[0058] 3. Comprehensiveness and accuracy: This application conducts an assessment from multiple dimensions, covering all aspects of equipment safety, thus improving the comprehensiveness and accuracy of the assessment.

[0059] 4. High degree of automation: Compared with the existing technology, this application reduces manual intervention, improves the automation level of the evaluation process, and facilitates large-scale deployment and management.

[0060] 5. Easy to expand and maintain: This application uses modular design to make the assessment system easy to expand and maintain according to actual needs, and can adapt to security assessment needs in different scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0062] Figure 1A flow chart of a device safety assessment method disclosed in this application;

[0063] Figure 2 A structural block diagram of a device safety assessment device disclosed in this application;

[0064] Figure 3 This is a hardware structure block diagram of a device security assessment device disclosed in this application. DETAILED DESCRIPTION

[0065] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0066] The present application can be used in many general or special computing device environments or configurations, such as personal computers, server computers, handheld or portable devices, tablet devices, multi-processor devices, distributed computing environments including any of the above devices or equipment, etc.

[0067] An embodiment of the present application provides a device security assessment method, which can be applied to various security assessment software or systems involving network security devices, and can also be applied to various computer terminals or smart terminals. The execution subject can be a processor or server of the computer terminal or smart terminal.

[0068] Next, the present application scheme is introduced. The present application proposes the following technical scheme, please see below for details.

[0069] Figure 1 This is a flow chart of a device security assessment method disclosed in an embodiment of the present application, such as Figure 1 As shown, the method may include:

[0070] Step S1: determine the online rate of each asset component through equipment inspection, and calculate the equipment inspection online rate.

[0071] Specifically, through regular or irregular equipment inspections, the online status of each asset component (such as servers, firewalls, switches, etc.) can be systematically checked and recorded. Inspection personnel or automated inspection systems will check these components one by one to confirm whether they are in a normal connected and running state. For each asset component inspected, its status will be marked according to whether it is online, that is, able to communicate normally or respond to inspection requests. After completing the inspection of all asset components, the equipment inspection online rate can be obtained by calculating the ratio of the number of online components to the total number of components. This indicator is an important parameter for measuring the overall operational stability and availability of the equipment. A high online rate usually means that the equipment is in good health and can provide services stably.

[0072] Step S2: compare the attribute information of each security sub-plan in the pre-retrieved device security plan with the actual configuration of the device in each dimension to determine the policy audit pass rate of the device.

[0073] Specifically, by comparing the device security plan (i.e., preset security policies, configuration specifications, etc.) with the actual configuration of the device, this process involves retrieving and carefully analyzing the various requirements in the device security plan, such as access control, encryption policies, firewall rules, intrusion detection / prevention system configurations, and then comparing and auditing them one by one with the current operating status and configuration details of the device, so as to determine the policy audit pass rate of the device.

[0074] The policy audit pass rate is calculated as follows:

[0075] (Number of policies actually met by the solution / Number of policies required to be met by the solution)*(Number of compliant policies actually configured / Total number of policies actually configured)*100%.

[0076] Step S3: monitor the encrypted tunnel to obtain the ciphertext traffic and plaintext traffic passing through the encrypted tunnel, and calculate the encrypted tunnel encryption rate.

[0077] Specifically, in order to evaluate the security and efficiency of encrypted tunnels, the system usually monitors and obtains all traffic data passing through these encrypted tunnels, including ciphertext traffic and plaintext traffic. By accurately recording and analyzing these traffic data, the system can calculate the encrypted tunnel's pass rate, which directly reflects the degree of protection of the encrypted tunnel for data transmission. Therefore, by continuously monitoring the encrypted tunnel and accurately calculating the pass rate, organizations can timely understand the operating status and security performance of the encrypted tunnel.

[0078] The encrypted tunnel pass rate is calculated as follows: the total number of tunnels in the encrypted pass mode / the total number of all tunnels.

[0079] Step S4: Perform a baseline check on the device server based on the created baseline configuration file to obtain a baseline check pass rate.

[0080] Specifically, the baseline configuration file defines in detail a series of security standards and requirements for server configuration, including but not limited to password policy rules, identity authentication measures, remote management measures, intrusion prevention measures, etc. In order to verify whether the server complies with these baseline requirements, baseline verification is performed regularly. The baseline verification process involves comparing the created baseline configuration file with the current configuration of the device server one by one, and reviewing the various configuration parameters of the server in detail. Through continuous baseline verification and pass rate analysis, organizations can promptly discover and resolve problems in server configuration and improve the overall security protection level.

[0081] Finally, based on the comparison results, the baseline verification pass rate can be calculated. This indicator reflects the degree of compliance of the server configuration with the baseline requirements and is an important reference for evaluating the security status of the server.

[0082] Further, performing a baseline check on the device server based on the created baseline configuration file to obtain a baseline check pass rate may include:

[0083] ① Verify the password setting of the device server according to the created password policy rules to obtain the password verification result;

[0084] ② Verify the login status of the device server according to the established identity authentication measures to obtain the login verification result;

[0085] ③ Verify the SSH management address of the device server according to the remote management measures that have been created to obtain the address verification result;

[0086] ④ According to the established intrusion prevention measures, the high-risk ports of the device server are checked to obtain the port check results;

[0087] ⑤ Verify the security audit process of the device server according to the created security audit measures to obtain the audit verification results;

[0088] ⑥ Based on the password verification result, the login verification result, the address verification result, the address verification result and the audit verification result, determine the baseline verification pass rate.

[0089] Step S5: Generate a device security assessment result according to the device inspection online rate, the policy audit pass rate, the encrypted tunnel pass rate and the baseline verification pass rate.

[0090] Specifically, in the process of comprehensively evaluating device security, a comprehensive device security evaluation result can be generated based on the device inspection online rate, policy audit pass rate, encrypted tunnel pass rate, and baseline verification pass rate.

[0091] Generate a device security assessment result based on the device inspection online rate, the policy audit pass rate, the policy audit pass rate, and the baseline verification pass rate, including:

[0092] ① Calculate the weighted total score based on the equipment inspection online rate, the policy audit pass rate, the policy audit pass rate and the baseline verification pass rate, as well as the corresponding inspection weight, audit weight, secret communication weight and verification weight;

[0093] ② Conduct safety assessment and grading of the equipment according to the weighted total score to obtain equipment safety assessment results.

[0094] This application defines a weight for each indicator to reflect their importance in the overall security assessment. When these indicators are taken into consideration, a comprehensive score or grade can be calculated based on the preset evaluation logic and weight distribution, which serves as the final evaluation result of the device security.

[0095] It can be seen from the above technical solutions that the device security assessment method, device, equipment and readable storage medium provided by the embodiment of the present application comprehensively evaluate the device security in multiple dimensions, including the online rate of device inspection, policy audit pass rate, encrypted tunnel pass rate and baseline verification pass rate, through automated means, to generate a comprehensive device security assessment result. First, the online rate of each asset component is determined through device inspection, and the online rate of device inspection is calculated. Secondly, the attribute information of each security sub-scheme in the pre-retrieved device security scheme is compared with the attribute information of each dimension of the actual configuration of the device to determine the policy audit pass rate of the device. In addition, the encrypted traffic and plaintext traffic passing through the encrypted tunnel are obtained by monitoring the encrypted tunnel, and the encrypted tunnel pass rate is calculated. Then, the device server is baseline-checked based on the created baseline configuration file to obtain the baseline verification pass rate. Finally, the device security assessment result is generated according to the online rate of device inspection, the policy audit pass rate, the encrypted tunnel pass rate and the baseline verification pass rate.

[0096] Compared with the prior art, this application has the following advantages:

[0097] 1. Efficiency and low cost: This application significantly improves work efficiency and reduces labor costs through automated evaluation processes.

[0098] 2. Real-time and dynamic: This application enhances the dynamic nature of security management by being able to monitor device status in real time, detect and respond to security incidents in a timely manner.

[0099] 3. Comprehensiveness and accuracy: This application conducts an assessment from multiple dimensions, covering all aspects of equipment safety, thus improving the comprehensiveness and accuracy of the assessment.

[0100] 4. High degree of automation: Compared with the existing technology, this application reduces manual intervention, improves the automation level of the evaluation process, and facilitates large-scale deployment and management.

[0101] 5. Easy to expand and maintain: This application uses modular design to make the assessment system easy to expand and maintain according to actual needs, and can adapt to security assessment needs in different scenarios.

[0102] In some embodiments of the present application, the security sub-solution in the device security solution includes a routing security sub-solution, a NAT security sub-solution, and a policy security sub-solution.

[0103] On this basis, the process of comparing the security sub-schemes in the pre-retrieved device security scheme with the attribute information of each dimension of the actual device configuration in step S2 to determine the policy audit pass rate of the device is introduced, which may specifically include:

[0104] Step S21: Based on the routing security sub-solution and routing configuration attribute information, determine the routing policy audit pass rate by evaluating the correctness of routing table entries, the rationality of routing protocol configuration, and the compliance of routing selection policies.

[0105] Specifically, the routing policy audit pass rate is determined by evaluating the correctness of routing table entries, the rationality of routing protocol configuration, and the compliance of routing selection policies to ensure the robustness, security, and compliance with business requirements of network routing. The correctness of routing table entries is to check whether the entries in the routing table are accurate, including key information such as the target network, next-hop address, and metric value. The rationality of routing protocol configuration is to check whether the configuration of routing protocols complies with best practices, industry standards, or network design principles, such as whether the necessary authentication mechanism is enabled, whether reasonable routing summarization is configured, etc. Routing selection policy compliance is to confirm whether routing selection strictly follows established policies or business requirements, such as whether load balancing is achieved, whether specific paths are given priority, etc.

[0106] Step S22: Based on the NAT security sub-solution and NAT configuration attribute information, determine the NAT policy audit pass rate according to the NAT mapping rules, port forwarding and NAT table usage.

[0107] Specifically, the NAT policy audit pass rate is determined by in-depth analysis of NAT mapping rules, port forwarding, and NAT table usage. The correct configuration and effective execution of NAT mapping rules are directly related to the correct forwarding and routing of network traffic, while port forwarding affects the accessibility of specific services or applications. At the same time, the usage of the NAT table reflects the performance and stability of the NAT policy in actual operation, which is crucial for timely discovery and handling of potential network bottlenecks or security issues.

[0108] Step S23: Based on the policy security sub-scheme and the configuration attribute information of the policy risk point, the security policy audit pass rate is determined by evaluating the coverage of the security policy to the preset security risk points.

[0109] Specifically, the security policy audit pass rate focuses on evaluating the coverage of the security policy for the preset security risk points, that is, whether the security policy can effectively identify and respond to known and potential security threats. This process involves an in-depth analysis of the security policy to ensure that it can comprehensively and accurately respond to various security challenges.

[0110] Step S24: Determine the policy audit pass rate of the device based on the routing policy audit pass rate, the NAT policy audit pass rate and the security policy audit pass rate.

[0111] Specifically, based on the routing policy audit pass rate, NAT policy audit pass rate and security policy audit pass rate, the policy audit pass rate of the device can be determined. This indicator not only reflects the policy execution effect of the device in the three key areas of routing, NAT and security, but also provides operation and maintenance personnel with an intuitive overview of the overall security policy implementation of the device.

[0112] In some embodiments of the present application, the process of step S1, determining the online rate of each asset component through equipment inspection, and calculating the equipment inspection online rate is introduced, which may specifically include:

[0113] Obtaining the proportion of online times of each asset component during the inspection process through equipment inspection, and determining the online rate of each asset component based on the proportion of online times;

[0114] Based on the online rates of the asset components, a weighted calculation is performed to obtain the equipment inspection online rate.

[0115] Generally, the asset components include switches, firewalls, vertical encryption authentication devices, and servers;

[0116] On this basis, the online rate of each asset component is determined through equipment inspection, and the equipment inspection online rate is calculated, including:

[0117] Determine the switch online rate based on the number of online switches obtained from equipment inspection and the total number of managed switches;

[0118] Determine the firewall online rate based on the number of online firewalls obtained from device inspection and the total number of managed firewalls;

[0119] Determine the online rate of the vertical encryption authentication device based on the number of online vertical encryption authentication devices and the number of managed vertical encryption authentication devices obtained from the equipment inspection;

[0120] Determine the server online rate based on the number of online servers and managed servers obtained from equipment inspection;

[0121] The equipment inspection online rate is calculated based on the online rate of the switch, the online rate of the firewall, the online rate of the vertical encryption authentication device and the online rate of the server.

[0122] Specifically, the equipment inspection will check the key asset components in the network one by one, which usually include switches, firewalls, vertical encryption authentication devices, and servers. During the inspection process, the online status of each asset component will be recorded, that is, whether the component can respond normally or provide services during the inspection period. Based on these records, the proportion of online times of each asset component during the inspection process can be obtained, that is, the ratio of the online times of the component to the total inspection times, so as to determine the online rate of each asset component.

[0123] In order to obtain an overall evaluation result, it is necessary to perform a weighted calculation based on the online rate of each asset component to obtain the equipment inspection online rate. In this step, the weight setting may be based on a comprehensive consideration of factors such as the importance of the asset component, the degree of impact on business continuity, and the historical failure rate.

[0124] Specifically, for key asset components such as switches, firewalls, and vertical encryption authentication devices, their online rates are calculated based on the ratio of the number of online devices obtained from device inspections to the total number of managed devices (i.e., the total number of devices that should be online). For example, by comparing the number of online switches to the total number of managed switches, the online rate of the switches can be obtained.

[0125] Finally, according to the online rate of switches, firewalls, vertical encryption authentication devices, and servers, an appropriate weighting algorithm is used to integrate the online rates of these individual asset components to calculate the equipment inspection online rate. This indicator comprehensively reflects the overall online status and stability of the equipment during the inspection cycle, providing important reference information for operation and maintenance personnel, helping to promptly discover and resolve potential equipment failures or safety risks.

[0126] The following is a description of a device security assessment apparatus provided in an embodiment of the present application. The device security assessment apparatus described below and the device security assessment method described above can be referenced to each other.

[0127] See also Figure 2 , Figure 2 A schematic diagram of a device safety assessment apparatus disclosed in an embodiment of the present application.

[0128] like Figure 2 As shown, the equipment safety assessment device may include:

[0129] The equipment inspection unit 110 is used to determine the online rate of each asset component through equipment inspection, and calculate the equipment inspection online rate;

[0130] The policy audit unit 120 is used to compare the attribute information of each security sub-scheme in the pre-retrieved device security scheme with the actual configuration of the device in each dimension to determine the policy audit pass rate of the device;

[0131] The encryption tunnel unit 130 is used to monitor the encryption tunnel to obtain the ciphertext traffic and plaintext traffic passing through the encryption tunnel, and calculate the encryption tunnel encryption rate;

[0132] A baseline verification unit 140 is used to perform a baseline verification on the device server based on the created baseline configuration file to obtain a baseline verification pass rate;

[0133] The comprehensive evaluation unit 150 is used to generate a device security evaluation result according to the device inspection online rate, the policy audit pass rate, the encrypted tunnel pass rate and the baseline verification pass rate.

[0134] It can be seen from the above technical solutions that the device security assessment method, device, equipment and readable storage medium provided by the embodiment of the present application comprehensively evaluate the device security in multiple dimensions, including the online rate of device inspection, policy audit pass rate, encrypted tunnel pass rate and baseline verification pass rate, through automated means, to generate a comprehensive device security assessment result. First, the online rate of each asset component is determined through device inspection, and the online rate of device inspection is calculated. Secondly, the attribute information of each security sub-scheme in the pre-retrieved device security scheme is compared with the attribute information of each dimension of the actual configuration of the device to determine the policy audit pass rate of the device. In addition, the encrypted traffic and plaintext traffic passing through the encrypted tunnel are obtained by monitoring the encrypted tunnel, and the encrypted tunnel pass rate is calculated. Then, the device server is baseline-checked based on the created baseline configuration file to obtain the baseline verification pass rate. Finally, the device security assessment result is generated according to the online rate of device inspection, the policy audit pass rate, the encrypted tunnel pass rate and the baseline verification pass rate.

[0135] Compared with the prior art, this application has the following advantages:

[0136] 1. Efficiency and low cost: This application significantly improves work efficiency and reduces labor costs through automated evaluation processes.

[0137] 2. Real-time and dynamic: This application enhances the dynamic nature of security management by being able to monitor device status in real time, detect and respond to security incidents in a timely manner.

[0138] 3. Comprehensiveness and accuracy: This application conducts an assessment from multiple dimensions, covering all aspects of equipment safety, thus improving the comprehensiveness and accuracy of the assessment.

[0139] 4. High degree of automation: Compared with the existing technology, this application reduces manual intervention, improves the automation level of the evaluation process, and facilitates large-scale deployment and management.

[0140] 5. Easy to expand and maintain: This application uses modular design to make the assessment system easy to expand and maintain according to actual needs, and can adapt to security assessment needs in different scenarios.

[0141] Optionally, the security sub-solution in the device security solution includes a routing security sub-solution, a NAT security sub-solution, and a policy security sub-solution;

[0142] The process in which the policy audit unit compares each security sub-scheme in the pre-retrieved device security scheme with the attribute information of each dimension of the actual configuration of the device to determine the policy audit pass rate of the device may include:

[0143] Based on the routing security sub-scheme and routing configuration attribute information, determine the routing policy audit pass rate by evaluating the correctness of routing table entries, the rationality of routing protocol configuration, and the compliance of routing selection policies;

[0144] Based on the NAT security sub-solution and NAT configuration attribute information, determine the NAT policy audit pass rate according to the NAT mapping rules, port forwarding and NAT table usage;

[0145] Based on the configuration attribute information of the policy security sub-scheme and the policy risk points, the security policy audit pass rate is determined by evaluating the coverage of the security policy on the preset security risk points;

[0146] The policy audit pass rate of the device is determined based on the routing policy audit pass rate, the NAT policy audit pass rate and the security policy audit pass rate.

[0147] Optionally, the device inspection unit performs a process of determining the online rate of each asset component through device inspection and calculating the device inspection online rate, which may specifically include:

[0148] Obtaining the proportion of online times of each asset component during the inspection process through equipment inspection, and determining the online rate of each asset component based on the proportion of online times;

[0149] Based on the online rates of the asset components, a weighted calculation is performed to obtain the equipment inspection online rate.

[0150] Optionally, the asset components include switches, firewalls, vertical encryption authentication devices, and servers;

[0151] The device inspection unit performs a process of determining the online rate of each asset component through device inspection and calculating the device inspection online rate, which may specifically include:

[0152] Determine the switch online rate based on the number of online switches obtained from equipment inspection and the total number of managed switches;

[0153] Determine the firewall online rate based on the number of online firewalls obtained from device inspection and the total number of managed firewalls;

[0154] Determine the online rate of the vertical encryption authentication device based on the number of online vertical encryption authentication devices and the number of managed vertical encryption authentication devices obtained from the equipment inspection;

[0155] Determine the server online rate based on the number of online servers and managed servers obtained from equipment inspection;

[0156] The equipment inspection online rate is calculated based on the online rate of the switch, the online rate of the firewall, the online rate of the vertical encryption authentication device and the online rate of the server.

[0157] Optionally, the comprehensive evaluation unit generates a device security evaluation result according to the device inspection online rate, the policy audit pass rate, the policy audit pass rate, and the baseline verification pass rate, which may specifically include:

[0158] A weighted total score is calculated based on the equipment inspection online rate, the policy audit pass rate, the policy audit pass rate and the baseline verification pass rate, as well as the corresponding inspection weight, audit weight, secret communication weight and verification weight;

[0159] The equipment is graded for safety assessment according to the weighted total score to obtain an equipment safety assessment result.

[0160] Optionally, the baseline verification unit performs a baseline verification on the device server based on the created baseline configuration file to obtain a baseline verification pass rate, which may specifically include:

[0161] Verifying the password setting of the device server according to the created password policy rules to obtain a password verification result;

[0162] Verify the login status of the device server according to the created identity authentication measure to obtain a login verification result;

[0163] Verify the SSH management address of the device server according to the created remote management measure to obtain an address verification result;

[0164] Check the high-risk ports of the device server according to the created intrusion prevention measures to obtain port check results;

[0165] Verify the security audit process of the device server according to the created security audit measures to obtain the audit verification result;

[0166] A baseline verification pass rate is determined based on the password verification result, the login verification result, the address verification result, the address verification result and the audit verification result.

[0167] Optionally, the equipment safety assessment device may further include an abnormality display unit, which is used to stop the equipment safety assessment and display the abnormal situation when the asset components are not detected.

[0168] The device safety assessment apparatus provided in the embodiment of the present application can be applied to device safety assessment equipment. Figure 3 The hardware structure diagram of the equipment security assessment equipment is shown in FIG. Figure 3 ,The hardware structure of the device security assessment device may include: at least one processor 1, at least one communication interface 2, at least one memory 3 and at least one communication bus 4;

[0169] In the embodiment of the present application, the number of the processor 1, the communication interface 2, the memory 3, and the communication bus 4 is at least one, and the processor 1, the communication interface 2, and the memory 3 communicate with each other through the communication bus 4;

[0170] The processor 1 may be a central processing unit CPU, or an application-specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of the present application, etc.;

[0171] The memory 3 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), etc., such as at least one disk memory;

[0172] The memory stores a program, and the processor can call the program stored in the memory, wherein the program is used to:

[0173] Determine the online rate of each asset component through equipment inspection, and calculate the equipment inspection online rate;

[0174] Compare the attribute information of each dimension of the device's actual configuration with the security sub-plans in the pre-retrieved device security plan to determine the device's policy audit pass rate;

[0175] Monitoring the encrypted tunnel to obtain the ciphertext traffic and plaintext traffic passing through the encrypted tunnel, and calculating the encrypted tunnel encryption rate;

[0176] Perform a baseline check on the device server based on the created baseline configuration file to obtain a baseline check pass rate;

[0177] The device security assessment result is generated according to the device inspection online rate, the policy audit pass rate, the encrypted tunnel pass rate and the baseline verification pass rate.

[0178] Optionally, the detailed functions and extended functions of the program may refer to the above description.

[0179] The embodiment of the present application further provides a readable storage medium, which may store a program suitable for execution by a processor, wherein the program is used to:

[0180] Determine the online rate of each asset component through equipment inspection, and calculate the equipment inspection online rate;

[0181] Compare the attribute information of each dimension of the device's actual configuration with the security sub-plans in the pre-retrieved device security plan to determine the device's policy audit pass rate;

[0182] Monitoring the encrypted tunnel to obtain the ciphertext traffic and plaintext traffic passing through the encrypted tunnel, and calculating the encrypted tunnel encryption rate;

[0183] Perform a baseline check on the device server based on the created baseline configuration file to obtain a baseline check pass rate;

[0184] The device security assessment result is generated according to the device inspection online rate, the policy audit pass rate, the encrypted tunnel pass rate and the baseline verification pass rate.

[0185] Optionally, the detailed functions and extended functions of the program may refer to the above description.

[0186] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0187] The various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the various embodiments can be referenced to each other.

[0188] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A device safety assessment method, characterized in that: include: Determine the online rate of each asset component through equipment inspection, and calculate the equipment inspection online rate; Compare the attribute information of each dimension of the device's actual configuration with each security sub-plan in the pre-retrieved device security plan to determine the device's policy audit pass rate, which is calculated as follows: (Number of policies actually met by the solution / Number of policies required to be met by the solution)*(Number of compliant policies actually configured / Total number of policies actually configured)*100%; Monitoring the encrypted tunnel to obtain the ciphertext traffic and plaintext traffic passing through the encrypted tunnel, and calculating the encrypted tunnel encryption rate; Perform a baseline check on the device server based on the created baseline configuration file to obtain a baseline check pass rate; Generate a device security assessment result according to the device inspection online rate, the policy audit pass rate, the encrypted tunnel pass rate, and the baseline verification pass rate; The security sub-solutions in the device security solution include routing security sub-solutions, NAT security sub-solutions, and policy security sub-solutions; Compare the attribute information of each dimension of the device's actual configuration with the security sub-plans in the pre-retrieved device security plan to determine the device's policy audit pass rate, including: Based on the routing security sub-solution and routing configuration attribute information, determine the routing policy audit pass rate by evaluating the correctness of routing table entries, the rationality of routing protocol configuration, and the compliance of routing selection policies; Based on the NAT security sub-solution and NAT configuration attribute information, determine the NAT policy audit pass rate according to the NAT mapping rules, port forwarding and NAT table usage; Based on the configuration attribute information of the policy security sub-scheme and the policy risk points, the security policy audit pass rate is determined by evaluating the coverage of the security policy on the preset security risk points; The policy audit pass rate of the device is determined based on the routing policy audit pass rate, the NAT policy audit pass rate and the security policy audit pass rate.

2. The method according to claim 1, characterized in that: Determine the online rate of each asset component through equipment inspection, and calculate the equipment inspection online rate, including: Obtaining the proportion of online times of each asset component during the inspection process through equipment inspection, and determining the online rate of each asset component based on the proportion of online times; Based on the online rates of the asset components, a weighted calculation is performed to obtain the equipment inspection online rate.

3. The method according to claim 1, characterized in that The asset components include switches, firewalls, vertical encryption authentication devices and servers; Determine the online rate of each asset component through equipment inspection, and calculate the equipment inspection online rate, including: Determine the switch online rate based on the number of online switches obtained from equipment inspection and the total number of managed switches; Determine the firewall online rate based on the number of online firewalls obtained from device inspection and the total number of managed firewalls; Determine the online rate of the vertical encryption authentication device based on the number of online vertical encryption authentication devices and the number of managed vertical encryption authentication devices obtained from the equipment inspection; Determine the server online rate based on the number of online servers and managed servers obtained from equipment inspection; The equipment inspection online rate is calculated based on the online rate of the switch, the online rate of the firewall, the online rate of the vertical encryption authentication device and the online rate of the server.

4. The method according to claim 1, characterized in that: Generate a device security assessment result based on the device inspection online rate, the policy audit pass rate, the policy audit pass rate, and the baseline verification pass rate, including: A weighted total score is calculated based on the equipment inspection online rate, the policy audit pass rate, the policy audit pass rate and the baseline verification pass rate, as well as the corresponding inspection weight, audit weight, secret communication weight and verification weight; The equipment is graded for safety assessment according to the weighted total score to obtain an equipment safety assessment result.

5. The method according to claim 1, characterized in that Perform a baseline check on the device server based on the created baseline configuration file to obtain the baseline check pass rate, including: Verifying the password setting of the device server according to the created password policy rules to obtain a password verification result; Verify the login status of the device server according to the created identity authentication measure to obtain a login verification result; Verify the SSH management address of the device server according to the created remote management measure to obtain an address verification result; Check the high-risk ports of the device server according to the created intrusion prevention measures to obtain port check results; Verify the security audit process of the device server according to the created security audit measures to obtain the audit verification result; A baseline verification pass rate is determined based on the password verification result, the login verification result, the address verification result, the address verification result and the audit verification result.

6. The method according to claim 1, characterized in that Also includes: If the asset components are not detected, the device security assessment is stopped and the abnormal situation is displayed.

7. An equipment safety assessment device, characterized in that: include: The equipment inspection unit is used to determine the online rate of each asset component through equipment inspection and calculate the equipment inspection online rate; The policy audit unit is used to compare the security sub-plans in the pre-retrieved device security plan with the attribute information of each dimension of the actual device configuration to determine the policy audit pass rate of the device. The policy audit pass rate of the device is calculated as follows: (Number of policies actually met by the solution / Number of policies required to be met by the solution)*(Number of compliant policies actually configured / Total number of policies actually configured)*100%; The encryption tunnel unit is used to monitor the encryption tunnel to obtain the ciphertext flow and the plaintext flow passing through the encryption tunnel, and calculate the encryption tunnel encryption rate; A baseline verification unit, used to perform a baseline verification on the device server based on the created baseline configuration file to obtain a baseline verification pass rate; A comprehensive evaluation unit, configured to generate a device security evaluation result according to the device inspection online rate, the policy audit pass rate, the encrypted tunnel pass rate, and the baseline verification pass rate; The security sub-solutions in the device security solution include routing security sub-solutions, NAT security sub-solutions, and policy security sub-solutions; Compare the attribute information of each dimension of the device's actual configuration with the security sub-plans in the pre-retrieved device security plan to determine the device's policy audit pass rate, including: Based on the routing security sub-solution and routing configuration attribute information, determine the routing policy audit pass rate by evaluating the correctness of routing table entries, the rationality of routing protocol configuration, and the compliance of routing selection policies; Based on the NAT security sub-solution and NAT configuration attribute information, determine the NAT policy audit pass rate according to the NAT mapping rules, port forwarding and NAT table usage; Based on the configuration attribute information of the policy security sub-scheme and the policy risk points, the security policy audit pass rate is determined by evaluating the coverage of the security policy on the preset security risk points; The policy audit pass rate of the device is determined based on the routing policy audit pass rate, the NAT policy audit pass rate and the security policy audit pass rate.

8. A device safety assessment device, characterized in that: including memory and processor; The memory is used to store programs; The processor is used to execute the program to implement each step of the device security assessment method as described in any one of claims 1 to 6.

9. A readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, each step of the device security assessment method according to any one of claims 1 to 6 is implemented.

Images