Information system risk assessment method, system and device and storage medium

Abstract

The invention relates to an information system risk assessment method, system and device and a storage medium, and belongs to the technical field of network security, and the method comprises the steps: obtaining basic risk information and associated risk information of a target network asset, the basic risk information being used for reflecting the risk condition of the target network asset, the associated risk information is used for reflecting the influence of the associated network assets on the target network assets; analyzing the basic risk information, and determining a basic risk value; analyzing the associated risk information, and determining an associated risk value; determining an asset risk result corresponding to the basic risk value and the associated risk value; a system risk result corresponding to the asset risk result is determined, the system risk result is used for reflecting the risk condition of an information system where the target network assets are located, and the information system comprises multiple target network assets. The method has the effect of improving the risk assessment accuracy of the information system.

Description

Technical Field

[0001] The present application relates to the technical field of network security, and in particular to an information system risk assessment method, system, device and storage medium. Background Art

[0002] The fundamental and global role of networks and information systems is increasing, and economic and social development is becoming more and more dependent on them. However, due to the defects, vulnerabilities and threats inherent in networks and information systems, there are objective potential risks in the operation of information systems.

[0003] Information system risk assessment is a means to understand the security status of network security. Through risk assessment, we can evaluate the security threats, security vulnerabilities and security risks faced by the assets in the tested object.

[0004] At present, the risk assessment method usually examines the vulnerability, asset value and threat of each asset in the information system, and then calculates the risk quantification value of each asset in the information system by weighted summation; then the risk quantification value of each asset is weighted summed to obtain the risk quantification value of the information system, or according to the "short board theory", the maximum value of the risk quantification value of each asset is taken as the risk quantification value of the information system. The current risk assessment method cannot effectively analyze and process various test results in a unified manner, resulting in incomplete risk assessment conclusions and low accuracy of assessment results. Summary of the invention

[0005] In order to improve the accuracy of information system risk assessment, the present application provides an information system risk assessment method, system, device and storage medium.

[0006] In a first aspect of the present application, a method for risk assessment of an information system is provided. The method comprises:

[0007] Obtaining basic risk information and associated risk information of the target network asset. The basic risk information is used to reflect the risk situation of the target network asset. The associated risk information is used to reflect the impact of the associated network asset on the target network asset. The associated network asset refers to the network asset that has an associated relationship with the target network asset.

[0008] Analyze basic risk information and determine basic risk value;

[0009] Analyze the associated risk information and determine the associated risk value;

[0010] Determine the asset risk results corresponding to the basic risk value and the associated risk value;

[0011] Determine the system risk result corresponding to the asset risk result. The system risk result is used to reflect the risk situation of the information system where the target network asset is located. The information system includes multiple target network assets.

[0012] It can be seen from the above technical scheme that, based on the basic risk information and associated risk information obtained, the risk of each target network asset is determined by comprehensively considering the risk of the target network asset itself and the degree of influence between the target network asset and the associated network assets, and the risk of the target network asset is evaluated more objectively and comprehensively, thereby improving the accuracy of risk assessment of the information system composed of target network assets.

[0013] In a possible implementation, the basic risk information includes the vulnerability status, threat status, protection status and location parameters of the target network asset. The location parameters are used to reflect the impact of the location of the target network asset on the security of the target network asset.

[0014] Analyze basic risk information and determine basic risk value, including:

[0015] Determine the vulnerability score based on the vulnerability scoring table and vulnerability situation. The vulnerability scoring table is used to reflect the impact of different vulnerabilities on target network assets.

[0016] Determine the threat score based on the threat level table and threat situation. The threat level table is used to reflect the impact of different threats on target network assets.

[0017] Determine the protection score based on the protection level table and protection status. The protection level table is used to reflect the protection effect of different protection devices on the target network assets.

[0018] Determine the basic risk value based on the vulnerability score, threat score, protection score and location parameters.

[0019] In one possible implementation, the basic risk value is determined by:

[0020]

[0021] Among them, M single represents the basic risk value, WP represents the vulnerability score, AP represents the threat score, SP represents the protection score, and M location Represents a positional parameter.

[0022] In a possible implementation, the associated risk information includes the access frequency corresponding to the associated network asset and the risk status of the associated network asset;

[0023] Analyze the associated risk information and determine the associated risk value, including:

[0024] Determine an access score corresponding to the access frequency, where the access score is used to reflect the degree of association between the associated network asset and the target network asset;

[0025] Determine the associated risk value based on the access score and the risk situation of the associated network assets.

[0026] In a possible implementation, determining the access score corresponding to the access frequency includes:

[0027] Obtaining a standard access frequency, where the standard access frequency represents a maximum value of the access frequency between the target network asset and the associated network assets during stable operation;

[0028] When the access frequency is greater than the standard access frequency, the maximum value of the access score is used as the access score;

[0029] When the access frequency is less than or equal to the standard access frequency, the access score is determined according to the ratio of the access frequency to the standard access frequency.

[0030] In one possible implementation, determining a system risk result corresponding to an asset risk result includes:

[0031] Get the range of risk results for multiple assets;

[0032] When the range is within the range, the average of multiple asset risk results is used as the system risk result;

[0033] When the range exceeds the range, the system risk result is determined based on the maximum and minimum values ​​in the asset risk results.

[0034] In one possible implementation, determining a system risk result corresponding to an asset risk result includes:

[0035] The maximum or average value of multiple asset risk results is taken as the system risk result.

[0036] In a second aspect of the present application, an information system risk assessment system is provided. The system comprises:

[0037] A data acquisition module is used to acquire basic risk information and associated risk information of target network assets. The basic risk information is used to reflect the risk situation of the target network assets. The associated risk information is used to reflect the impact of associated network assets on the target network assets. Associated network assets refer to network assets that have an associated relationship with the target network assets.

[0038] The basic risk determination module is used to analyze the basic risk information and determine the basic risk value;

[0039] An associated risk determination module is used to analyze associated risk information and determine associated risk values;

[0040] An asset risk determination module is used to determine the asset risk results corresponding to the basic risk value and the associated risk value;

[0041] The system risk determination module is used to determine the system risk result corresponding to the asset risk result. The system risk result is used to reflect the risk situation of the information system where the target network asset is located. The information system includes multiple target network assets.

[0042] In a third aspect of the present application, an electronic device is provided, which includes a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the program, the method described above is implemented.

[0043] In a fourth aspect of the present application, a computer-readable storage medium is provided, on which a computer program is stored, and when the program is executed by a processor, the method according to the first aspect of the present application is implemented.

[0044] In summary, the present application includes at least one beneficial technical effect:

[0045] Based on the basic risk information and associated risk information obtained, the risks of each target network asset are determined by comprehensively considering the risks of the target network asset itself and the degree of impact between the target network asset and the associated network assets. The risks of the target network assets are assessed more objectively and comprehensively, thereby improving the accuracy of risk assessment of the information system composed of target network assets. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is a flowchart of the information system risk assessment method provided by this application.

[0047] Figure 2 It is a structural diagram of the information system risk assessment system provided by this application.

[0048] Figure 3 It is a structural schematic diagram of the electronic device provided by this application.

[0049] In the figure, 201, data acquisition module; 202, basic risk determination module; 203, associated risk determination module; 204, asset risk determination module; 205, system risk determination module; 301, CPU; 302, ROM; 303, RAM; 304, I / O interface; 305, input part; 306, output part; 307, storage part; 308, communication part; 309, drive; 310, removable media. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0051] In addition, the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there can be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article, unless otherwise specified, generally means that the associated objects before and after are in an "or" relationship.

[0052] The embodiments of the present application are further described in detail below in conjunction with the drawings in the specification.

[0053] The present application embodiment provides an information system risk assessment, and the main process of the above method is described as follows.

[0054] like Figure 1 As shown:

[0055] Step S101: Obtain basic risk information and associated risk information of target network assets.

[0056] Specifically, the above-mentioned basic risk information is used to reflect the risk situation of the above-mentioned target network assets, and the above-mentioned associated risk information is used to reflect the impact of the associated network assets on the above-mentioned target network assets. The above-mentioned associated network assets represent network assets that are associated with the above-mentioned target network assets. The above-mentioned basic risk information includes the vulnerability situation, threat situation, protection situation and location parameters of the above-mentioned target network assets. The vulnerability situation of the above-mentioned target network assets includes but is not limited to the number of vulnerabilities, the level of vulnerabilities and the location of vulnerabilities. The above-mentioned threat situation includes but is not limited to the number of dangerous accesses to the target network assets in the recent period, the level of dangerous accesses and the frequency of dangerous accesses. The above-mentioned recent period is set according to the actual use of the target network assets or according to the experience of the user, and there is no limitation on this. The above-mentioned protection situation includes the monitoring, interception and repair of threats by the protection equipment in the target network assets. The above-mentioned location parameters are used to reflect the impact of the location of the above-mentioned target network assets on the security of the above-mentioned target network assets. The above-mentioned associated risk information includes the access frequency corresponding to the above-mentioned associated network assets and the risk situation of the above-mentioned associated network assets. In the example provided in this application, the risk situation of the above-mentioned associated network assets is represented by the basic risk value of the associated network assets. In other embodiments, other data can be used to reflect the risk situation of the associated network assets, and there is no limitation on this.

[0057] Step S102: Analyze basic risk information and determine basic risk value.

[0058] Specifically, the vulnerability score is determined based on the vulnerability scoring table and the above vulnerability situation, and the above vulnerability scoring table is used to reflect the impact of different vulnerabilities on the above target network assets. The threat score is determined based on the threat level table and the above threat situation, and the above threat level table is used to reflect the impact of different threats on the above target network assets. The protection score is determined based on the protection level table and the above protection situation, and the above protection level table is used to reflect the protection effect of different protection devices on the above target network assets. The basic risk value is determined based on the above vulnerability score, the above threat score, the above protection score and the above location parameter.

[0059] The above basic risk value is determined in the following way:

[0060]

[0061] Among them, M single represents the above basic risk value, WP represents the above vulnerability score, AP represents the above threat score, SP represents the above protection score, M location Represents the above positional parameters.

[0062] In a specific example, there are m vulnerabilities on a target network asset, and the vulnerability score corresponding to each vulnerability is w1, w2, w3, ..., w m , we get a one-dimensional vector (w1, w2, w3, ..., w m ), denoted as vector A. Construct another one-dimensional vector (v1, v2, v3, ..., v m ), denoted as vector B, where v i Yes i Corresponding weights. From this, we can get the vulnerability score WP of the target network asset:

[0063]

[0064] Among them, w i represents the vulnerability score of the ith vulnerability, v i represents the weight corresponding to the ith vulnerability. i and v iThe corresponding relationship is that the above vulnerability scoring table can be obtained through one or more of the common vulnerabilities and exposures (CVE), (China national vulnerability database, CNVD), (China national vulnerability database of information security, CNNVD), and can also be set and adjusted according to actual conditions, without limitation. For example, v 外 >v 内 , indicating that the weight of the vulnerability in the intranet is smaller than that in the public network, because the impact of the vulnerability in the public network is greater than that in the intranet. i ∈(0,10), v i ∈(0,1), WP∈(0,10). In other implementations, the range of vulnerability scores and weights can be adjusted according to actual conditions, and there is no limitation on this.

[0065] The threat situation of the target network assets mainly refers to the situation that the network assets are attacked by the network over a period of time. The situation of the network attack is mainly obtained by security monitoring equipment. For example, the threat is divided into 4 levels: severe, high risk, medium risk, and low risk, and different weights are assigned. i , then the threat score AP of the target network asset can be obtained:

[0066]

[0067] Among them, a i is the weight of a threat, a max is the maximum weight of the threat.

[0068] In the examples provided in this application, a i ∈(0,10), AP∈(0,10), the threat registration table includes the threat level and the weight corresponding to the level. The above threat level table can be set by security business experts according to the actual threat situation, for example, a 严重 =10, a 高危 =8,a 中危 =6, a 低危 =4. In other implementations, analysis may be performed based on the historical impact ranges of different threats to obtain a threat registration table, which is not limited to this.

[0069] It is understandable that in order to reduce the attacks or threats to network assets, users will deploy security protection devices on network assets to reduce the security risks of target network assets. The more types of security protection devices there are, the more comprehensive the risks that can be monitored and repaired. According to the classification of security devices by function, the security devices with the same function take the largest safety factor as the safety factor of the function, and the security device score SP can be obtained:

[0070]

[0071] Among them, s ij It represents the weight of a certain type of safety equipment under a function, s ij The larger the value, the more effective the safety protection equipment is. is the maximum weight of similar equipment, is the cumulative multiplication of the scores of the m-type devices. In the example provided in this application, s ij ∈(0,1), SP∈(0,1), the protection level table is set by security business experts based on the actual situation of the equipment and is not limited to this.

[0072] For example, there are security protection devices a, b, and c, among which security protection device a can protect against threats of type a1 and b1, security protection device b can protect against threats of type b1 and c1, and security protection device c can protect against threats of type c1 and d1. According to the function of "protecting against threats of type a1", security protection devices a and b belong to the same category. According to the actual protection of security protection devices a and b against threats of type a1, the weight of security protection device a is set to 0.6, and the weight of security protection device b is set to 0.4. Then the weight corresponding to the function of "protecting against threats of type a1" is 0.6, because 0.6>0.4. Similarly, the weights corresponding to other functions can be determined, which will not be repeated here.

[0073] Step S103: Analyze the associated risk information and determine the associated risk value.

[0074] Specifically, an access score corresponding to the access frequency is determined, and the access score is used to reflect the degree of association between the associated network asset and the target network asset; and an associated risk value is determined according to the access score and the risk situation of the associated network asset.

[0075] It is understood that since most information systems are composed of multiple network assets, network assets are connected to other related network assets. If the related network assets are all at high risk, the risk value of the corresponding target network assets will also increase accordingly. If the risk of the related network assets is higher and the degree of association is closer, the associated risk value of the target network assets will be greater.

[0076] Furthermore, the determining of the access score corresponding to the access frequency includes:

[0077] Obtain a standard access frequency, which represents the maximum value of the access frequency between the target network asset and the associated network asset during stable operation; when the access frequency is greater than the standard access frequency, use the maximum value of the access score as the access score; when the access frequency is less than or equal to the standard access frequency, determine the access score based on the ratio of the access frequency to the standard access frequency. The standard access frequency is determined based on the historical access frequency between the target network asset and the associated network asset, for example, the historical access frequency includes 60 times / minute, 58 times / minute, 63 times / minute, 67 times / minute, 56 times / minute, and 51 times / minute. Select the maximum value of 67 times / minute, and the standard access frequency is 67 times / minute.

[0078] In a specific example,

[0079]

[0080] Among them, p represents the score of the access frequency between the target network asset and the associated network assets, f represents the number of visits between network assets in a unit time, and M i It indicates the risk of the associated network assets, that is, the actual risk value of the associated network assets, and n indicates the number of associated network assets. The number of visits per unit time is the standard access frequency f max The security service experts can set and adjust according to the actual situation, and there is no limitation on this. In the example provided in this application, f max =50, p∈(0,1), M net ∈(0,10), the unit time is 1 minute. In other implementations, it can be adjusted according to actual conditions and is not limited here.

[0081] Step S104: Determine the asset risk result corresponding to the basic risk value and the associated risk value.

[0082] Specifically, when determining the basic risk value M single and the associated risk value M net In the case of N∈(0,10), where N represents the asset risk result. The value range of N corresponds to the value range of the basic risk value and the associated risk value, and can be adjusted according to actual circumstances.

[0083] Step S105: Determine the system risk result corresponding to the asset risk result.

[0084] Specifically, the system risk result is used to reflect the risk situation of the information system where the target network asset is located, and the information system includes a plurality of the target network assets. According to the asset risk result of each target network asset in the information system, the system risk result of the information system is determined.

[0085] In the first implementation, the maximum value of the multiple asset risk results is used as the system risk result, that is, Among them, N system represents the system risk result of the information system, N i Represents the asset risk result of the i-th target network asset in the information system.

[0086] In a second implementation, the average value of the above-mentioned asset risk results is used as the above-mentioned system risk result, that is, Among them, N system represents the system risk result of the information system, N i Represents the asset risk result of the i-th target network asset in the information system.

[0087] In a third embodiment, the range of the multiple asset risk results is obtained; when the range is within the range, the average value of the multiple asset risk results is used as the system risk result; when the range exceeds the range, the system risk result is determined based on the maximum and minimum values ​​of the asset risk results.

[0088] For example, there are 10 target network assets in an information system, and the asset risk values ​​corresponding to the target network assets are 1, 2, 3, 4, 5, 6, 7, 8, 9 and 9. The range is set to 0-4, and the current range is 9-1=8, which is not within the above range. At this time, the position parameter of the target network asset corresponding to the maximum value and the position parameter of the target network asset corresponding to the minimum value are determined. If the position parameter of the target network asset corresponding to the maximum value is greater than the position parameter of the target network asset corresponding to the minimum value, then If the position parameter of the target network asset corresponding to the maximum value is less than or equal to the position parameter of the target network asset corresponding to the minimum value, the average of the asset risk results after removing the maximum and minimum values ​​is used as the system risk result. For another example, the asset risk values ​​corresponding to the 10 target network assets are 6, 4, 5, 4, 5, 7, 7, 8, 7 and 6, then the current range is 8-4=4, which is within the range. So In the example provided in this application, N system ∈(0,10), in other embodiments, N system The value range of corresponds to the value range of the basic risk value and the associated risk value, and can be adjusted according to actual circumstances.

[0089] This application considers the four aspects of vulnerability, threat, protection and location to determine the risk of the target network assets themselves, and then combines the degree of influence between the target network assets and the associated network assets to comprehensively determine the risks of each target network asset, thereby more objectively and comprehensively evaluating the risks of network assets, thereby improving the accuracy of risk assessment of information systems composed of target network assets.

[0090] The present application embodiment provides an information system risk assessment system, referring to Figure 2 , the information system risk assessment system includes:

[0091] The data acquisition module 201 is used to acquire the basic risk information and associated risk information of the target network asset. The basic risk information is used to reflect the risk situation of the target network asset. The associated risk information is used to reflect the impact of the associated network asset on the target network asset. The associated network asset refers to the network asset that has an associated relationship with the target network asset.

[0092] A basic risk determination module 202 is used to analyze basic risk information and determine a basic risk value;

[0093] The associated risk determination module 203 is used to analyze the associated risk information and determine the associated risk value;

[0094] The asset risk determination module 204 is used to determine the asset risk result corresponding to the basic risk value and the associated risk value;

[0095] The system risk determination module 205 is used to determine the system risk result corresponding to the asset risk result. The system risk result is used to reflect the risk situation of the information system where the target network asset is located. The information system includes multiple target network assets.

[0096] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the described module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0097] The present application embodiment discloses an electronic device. Figure 3, the electronic device includes a central processing unit (CPU) 301, which can perform various appropriate actions and processes according to the program stored in the read-only memory (ROM) 302 or the program loaded from the storage part 307 to the random access memory (RAM) 303. In the RAM 303, various programs and data required for system operation are also stored. The CPU 301, ROM 302 and RAM 303 are connected to each other through a bus. The input / output (I / O) interface 304 is also connected to the bus.

[0098] The following components are connected to the I / O interface 304: an input section 305 including a keyboard, a mouse, etc.; an output section 306 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 307 including a hard disk, etc.; and a communication section 308 including a network interface card such as a local area network (LAN) card, a modem, etc. The communication section 308 performs communication processing via a network such as the Internet. A drive 309 is also connected to the I / O interface 304 as needed. A removable medium 310, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 309 as needed so that a computer program read therefrom is installed into the storage section 307 as needed.

[0099] In particular, according to an embodiment of the present application, the above reference flow chart Figure 1 The described process can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a machine-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication part 308, and / or installed from a removable medium 310. When the computer program is executed by a central processing unit (CPU) 301, the above-mentioned functions defined in the device of the present application are executed.

[0100] It should be noted that the computer-readable medium shown in the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, radio frequency (RF), etc., or any suitable combination of the above.

[0101] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of application involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the aforementioned application concept. For example, the above features are replaced with (but not limited to) technical features with similar functions applied in the present application.

Claims

1. A method for risk assessment of an information system, characterized in that: include: Obtaining basic risk information and associated risk information of a target network asset, wherein the basic risk information is used to reflect the risk situation of the target network asset, and the associated risk information is used to reflect the impact of associated network assets on the target network asset, and the associated network assets represent network assets that have an associated relationship with the target network asset; Analyze the basic risk information and determine the basic risk value; Analyzing the associated risk information to determine an associated risk value; Determine the asset risk result corresponding to the basic risk value and the associated risk value; A system risk result corresponding to the asset risk result is determined, wherein the system risk result is used to reflect the risk status of the information system where the target network asset is located, and the information system includes a plurality of the target network assets.

2. The information system risk assessment method according to claim 1, characterized in that: The basic risk information includes the vulnerability status, threat status, protection status and location parameters of the target network asset, and the location parameters are used to reflect the impact of the location of the target network asset on the security of the target network asset; The analyzing the basic risk information to determine the basic risk value includes: Determine a vulnerability score according to the vulnerability scoring table and the vulnerability situation, wherein the vulnerability scoring table is used to reflect the degree of impact of different vulnerabilities on the target network assets; Determining a threat score according to a threat level table and the threat situation, wherein the threat level table is used to reflect the degree of impact of different threats on the target network assets; Determine a protection score according to a protection level table and the protection situation, wherein the protection level table is used to reflect the protection effect of different protection devices on the target network assets; A basic risk value is determined according to the vulnerability score, the threat score, the protection score and the location parameter.

3. The information system risk assessment method according to claim 1, characterized in that: The basic risk value is determined in the following way: Among them, M single represents the basic risk value, WP represents the vulnerability score, AP represents the threat score, SP represents the protection score, M location Represents the positional parameter.

4. The information system risk assessment method according to claim 1, characterized in that: The associated risk information includes the access frequency corresponding to the associated network assets and the risk status of the associated network assets; The analyzing the associated risk information to determine the associated risk value includes: Determine an access score corresponding to the access frequency, wherein the access score is used to reflect the degree of association between the associated network asset and the target network asset; An associated risk value is determined according to the access score and the risk condition of the associated network asset.

5. The information system risk assessment method according to claim 4, characterized in that: The determining of the access score corresponding to the access frequency includes: Acquire a standard access frequency, where the standard access frequency represents a maximum value of an access frequency between the target network asset and the associated network asset during stable operation; When the access frequency is greater than the standard access frequency, taking the maximum value of the access scores as the access score; When the access frequency is less than or equal to the standard access frequency, the access score is determined according to a ratio of the access frequency to the standard access frequency.

6. The information system risk assessment method according to claim 1, characterized in that: The determining of a system risk result corresponding to the asset risk result includes: Obtaining the range among a plurality of the asset risk results; When the range is within the range, the average value of the multiple asset risk results is used as the system risk result; When the range exceeds the range, the system risk result is determined based on the maximum and minimum values ​​in the asset risk results.

7. The information system risk assessment method according to claim 1, characterized in that: The determining of a system risk result corresponding to the asset risk result includes: The maximum value or average value of the multiple asset risk results is used as the system risk result.

8. An information system risk assessment system, characterized in that: include: A data acquisition module, used to acquire basic risk information and associated risk information of a target network asset, wherein the basic risk information is used to reflect the risk situation of the target network asset, and the associated risk information is used to reflect the impact of associated network assets on the target network asset, and the associated network assets represent network assets that have an associated relationship with the target network asset; A basic risk determination module, used to analyze the basic risk information and determine a basic risk value; An associated risk determination module, used to analyze the associated risk information and determine an associated risk value; An asset risk determination module, used to determine an asset risk result corresponding to the basic risk value and the associated risk value; The system risk determination module is used to determine a system risk result corresponding to the asset risk result, wherein the system risk result is used to reflect the risk situation of the information system where the target network asset is located, and the information system includes a plurality of the target network assets.

9. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program that can be loaded by the processor and execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: A computer program is stored which can be loaded by a processor and execute the method as claimed in any one of claims 1 to 7.

Images