Data security risk assessment early warning system

Abstract

The invention provides a data security risk assessment early warning system, which relates to the field of data risk assessment, and comprises a data collection module used for collecting security logs, network traffic information and access behavior information of data, a data analysis module connected to the data collection module and used for analyzing the collected data and assessing security risks faced by the data, and an early warning module connected to the data analysis module and used for assessing the security risks faced by the data. And the early warning module is connected to the data analysis module and is used for giving out early warning when the analyzed safety risk exceeds a preset threshold value. According to the application, through the data collection module, security logs, network traffic information and access behavior information of data are comprehensively collected, comprehensiveness and accuracy of risk assessment are ensured, and the data analysis module can accurately assess security risks faced by the data through a risk assessment model construction technology, analyze new data in real time and quickly judge the security risks.

Description

Technical Field

[0001] The present invention relates to the field of data risk assessment, and in particular to a data security risk assessment and early warning system. Background Art

[0002] In the current digital age, data has become a core resource for business operations and decision-making. However, with the rapid increase in data volume and the increasing complexity of data transmission, data security risks are becoming increasingly prominent. Traditional data security measures often rely on static security strategies and passive defense mechanisms, which are difficult to effectively respond to increasingly complex and changing security threats. Traditional systems often only focus on log information from some data sources, ignoring key data such as network traffic and access behavior, resulting in deviations in risk assessment results.

[0003] Therefore, we have made improvements to this and proposed a data security risk assessment and early warning system. Summary of the invention

[0004] The purpose of the present invention is to address the problem that existing traditional systems often only focus on log information of some data sources, ignore key data such as network traffic and access behavior, and cause deviations in risk assessment results.

[0005] In order to achieve the above-mentioned purpose of the invention, the present invention provides a data security risk assessment and early warning system to improve the above-mentioned problem.

[0006] The specific application is as follows:

[0007] Data security risk assessment and early warning system, including the following modules:

[0008] Data collection module, used to collect data security logs, network traffic information and access behavior information;

[0009] The data analysis module is connected to the data collection module and is used to analyze the collected data and assess the security risks faced by the data;

[0010] The early warning module is connected to the data analysis module and is used to issue an early warning when the security risk analyzed exceeds a preset threshold;

[0011] Custom settings module, allowing users to customize risk indicators and corresponding thresholds;

[0012] The protection strategy module provides protection strategies based on the risk assessment results of the data analysis module;

[0013] The real-time monitoring module can monitor the security status of data in real time and trigger an alarm when an anomaly is detected.

[0014] As the preferred technical solution of this application, the data analysis module specifically includes the following steps:

[0015] S1. Data preprocessing: remove duplicate data and normalize and standardize the collected data;

[0016] S2. Feature extraction: Extract key features from security logs, network traffic, and access behavior information, including abnormal login attempts, unusual data transfer volume, and abnormal access patterns;

[0017] S3. Build a risk assessment model: Build a risk assessment model to predict future security risks by learning patterns in historical data.

[0018] As the preferred technical solution of this application, the data analysis module specifically further includes the following steps:

[0019] S4, model training and optimization: Use labeled historical data to train the model and optimize model parameters through cross-validation technology to improve prediction accuracy;

[0020] S5. Real-time data analysis: When the data collection module transmits new data, the data analysis module will analyze the data in real time. By inputting the new data into the trained risk assessment model, the module can quickly determine whether the current data has security risks;

[0021] S6. Risk assessment and early warning: Based on the output of the model, the data analysis module will evaluate the security risk level of the current data.

[0022] S7. Feedback loop and model update: When new data samples and feedback are collected, the data analysis module uses these new data to regularly update and optimize the risk assessment model to maintain the accuracy of its predictions.

[0023] As the preferred technical solution of this application, in S3, a risk assessment model is constructed to predict future security risks by learning patterns in historical data, which specifically includes the following steps:

[0024] S300, forward propagation: For each neuron, its output is calculated by the following formula: and a = σ(z), where z is the weighted input of the neuron and w i is the weight corresponding to the i-th input feature, x i is the value of the ith input feature, b is the bias term, σ is the activation function, and a is the activation output of the neuron.

[0025] As the preferred technical solution of this application, in S3, a risk assessment model is constructed to predict future security risks by learning patterns in historical data, which specifically includes the following steps:

[0026] S301. Training of neural network: During the training process, the weights and biases of the neural network are updated through the back propagation algorithm and optimizer. Back propagation involves calculating the gradient of the loss function with respect to the weights and biases, and updating the parameters using the gradient descent method or other optimization algorithms: as well as Among them, η is the learning rate, which controls the step size of parameter update. and are the partial derivatives of the loss function L with respect to the weight w and bias b, respectively.

[0027] As a preferred technical solution of the present application, the early warning module is connected to the data analysis module. When the analyzed security risk exceeds the preset threshold, the module is used to issue an early warning. The specific setting of the threshold includes the following steps:

[0028] Step 1: Collect historical data: Collect all login attempt data in the past 30 days, including successful logins and failed login attempts;

[0029] Step 2: Data Analysis: Analyze the collected data, pay special attention to the number of failed login attempts, and calculate the following statistics:

[0030] The average number of failed login attempts per day;

[0031] The standard deviation of the number of failed login attempts;

[0032] The maximum, minimum, and median number of failed login attempts;

[0033] Step 3: Preliminary setting of threshold: Set the threshold to the average number of times plus 2 times the standard deviation, threshold = average number of times + 2*standard deviation.

[0034] As a preferred technical solution of this application, the specific setting of the threshold also includes the following steps:

[0035] Step 4: Simulation test: Use historical data to simulate the thresholds that are initially set, and observe how many days in the past 30 days of data trigger warnings. If the number of days that trigger warnings exceeds 15 days, the threshold needs to be adjusted;

[0036] Step 5: Threshold adjustment: According to the results of the simulation test, if the number of days triggering the warning exceeds 15 days, the threshold is increased by five;

[0037] Step 6: Implementation and monitoring: Apply the set thresholds to the actual risk assessment and early warning system, and continuously monitor the operation of the system;

[0038] Step 7: Regular review and update: Review the thresholds every quarter and adjust them based on the latest historical data.

[0039] As the preferred technical solution of this application, the protection strategy module provides a protection strategy based on the risk assessment results of the data analysis module. The protection strategy specifically includes:

[0040] SA, access control policy:

[0041] SA1. Multi-factor authentication: For high-risk operations or data access, introduce multi-factor authentication, including fingerprint, facial recognition, and dynamic tokens, to enhance security;

[0042] SB, data encryption strategy:

[0043] SB1. Data encryption: Encrypted storage and transmission of sensitive data to ensure that even if the data is illegally obtained, it cannot be easily decrypted.

[0044] SB2. Encryption key management: Implement a strict encryption key management system, including quarterly key replacement, hierarchical key storage and access control;

[0045] SC, security audit and monitoring strategy:

[0046] SC1, Logging:

[0047] All user logins, data access, and modification operations must be recorded in an unalterable audit log, which must be kept for at least one year for subsequent audit and analysis;

[0048] SC2, Real-time monitoring:

[0049] Use security information and event management systems for real-time monitoring and set up automatic alerts for unusual login attempts, large data downloads, and unusual data modification behaviors.

[0050] As the preferred technical solution of this application, the protection strategy specifically includes:

[0051] SD, Security Update and Patch Policy:

[0052] SD1, regular updates:

[0053] All systems and applications must be checked for updates at least once a quarter and deployed within one month of testing, and for critical security updates, deployment must be completed within one week of release;

[0054] SD2, Patch Management:

[0055] Establish a dedicated patch management team to track, test and deploy all relevant patches. Patches must be verified in a test environment before deployment to ensure compatibility with existing systems.

[0056] SE, Emergency Response Plan:

[0057] SE1. Incident response process:

[0058] Establish a dedicated security incident response team and clarify its responsibilities and processes. After a security incident is discovered, the emergency response plan must be immediately initiated and the preliminary investigation must be completed within 24 hours.

[0059] SE2, backup and recovery:

[0060] All critical data must be backed up daily and stored in a physically isolated secure environment, and recovery drills must be conducted regularly to ensure that data can be quickly restored when a real incident occurs.

[0061] As the preferred technical solution of this application, the protection strategy specifically includes:

[0062] SF, Network Security Strategy:

[0063] SF1. Use intrusion prevention systems to monitor and block malicious traffic in real time;

[0064] SF2, Intrusion Detection and Prevention:

[0065] Deploy network intrusion detection systems and host intrusion detection systems to identify and defend against network attacks, and review IDS / IPS logs monthly to identify potential security threats.

[0066] Compared with the prior art, the present invention has the following beneficial effects:

[0067] In the scheme of this application:

[0068] 1. Through the data collection module, the security logs, network traffic information and access behavior information of the data are comprehensively collected to ensure the comprehensiveness and accuracy of risk assessment. The data analysis module can accurately assess the security risks faced by the data through the risk assessment model construction technology, and analyze new data in real time to quickly determine security risks;

[0069] 2. The early warning module allows users to customize risk indicators and corresponding thresholds, and through simulation tests and regular review mechanisms, ensures the rationality and accuracy of the early warning thresholds to reduce false alarms and missed alarms. The protection strategy module provides multi-level protection strategies, including access control, data encryption, security auditing and monitoring, security updates and patch management, emergency response plans and network security strategies, etc., which can comprehensively respond to diverse security threats. BRIEF DESCRIPTION OF THE DRAWINGS

[0070] Figure 1 Schematic diagram of the data security risk assessment and early warning system provided for this application; DETAILED DESCRIPTION

[0071] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0072] As described in the background technology, traditional systems often only focus on log information of some data sources, ignoring key data such as network traffic and access behavior, resulting in deviations in risk assessment results.

[0073] In order to solve this technical problem, the present invention provides a data security risk assessment and early warning system, which is applied to the field of data risk assessment.

[0074] Specifically, please refer to Figure 1 The data security risk assessment and early warning system specifically includes the following modules:

[0075] Data collection module, used to collect data security logs, network traffic information and access behavior information;

[0076] The data analysis module is connected to the data collection module and is used to analyze the collected data and assess the security risks faced by the data;

[0077] The early warning module is connected to the data analysis module and is used to issue an early warning when the security risk analyzed exceeds a preset threshold;

[0078] Custom settings module, allowing users to customize risk indicators and corresponding thresholds;

[0079] The protection strategy module provides protection strategies based on the risk assessment results of the data analysis module;

[0080] The real-time monitoring module can monitor the security status of data in real time and trigger an alarm when an anomaly is detected.

[0081] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings.

[0082] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features and technical solutions in the embodiments may be combined with each other.

[0083] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, further definition and explanation thereof is not required in subsequent drawings.

[0084] Embodiment 1, data security risk assessment and early warning system, the data analysis module specifically includes the following steps:

[0085] S1. Data preprocessing: remove duplicate data, normalize and standardize the collected data (this is a well-known technology, so it will not be described in detail), improve the accuracy and efficiency of data analysis, and reduce misjudgments caused by data quality issues;

[0086] S2. Feature extraction: Extract key features from security logs, network traffic, and access behavior information, including abnormal login attempts, unusual data transfer volumes, and abnormal access patterns. By extracting key features, it helps to more accurately identify potential security risks.

[0087] S3. Build a risk assessment model: Build a risk assessment model to predict future security risks by learning patterns in historical data.

[0088] The data analysis module specifically includes the following steps:

[0089] S4. Model training and optimization: Use labeled historical data (i.e. data with known safety or risks) to train the model and optimize model parameters through cross-validation techniques to improve prediction accuracy;

[0090] S5. Real-time data analysis: When the data collection module transmits new data, the data analysis module will analyze the data in real time. By inputting the new data into the trained risk assessment model, the module can quickly determine whether the current data has security risks;

[0091] S6. Risk assessment and early warning: Based on the output of the model, the data analysis module will evaluate the security risk level of the current data.

[0092] S7. Feedback loop and model update: When new data samples and feedback are collected, the data analysis module uses these new data to regularly update and optimize the risk assessment model to maintain the accuracy of its predictions.

[0093] In S3, a risk assessment model is built to predict future security risks by learning patterns in historical data. The specific steps include:

[0094] S300, forward propagation: For each neuron, its output is calculated by the following formula: and a = σ(z), where z is the weighted input of the neuron and w i is the weight corresponding to the i-th input feature, x i is the value of the ith input feature, b is the bias term, σ is the activation function (specifically f(x) = max(0, x)), and a is the activation output of the neuron.

[0095] In S3, a risk assessment model is built to predict future security risks by learning patterns in historical data. The specific steps include:

[0096] S301. Training of neural network: During the training process, the weights and biases of the neural network are updated through the back propagation algorithm and optimizer. Back propagation involves calculating the gradient of the loss function with respect to the weights and biases, and updating the parameters using the gradient descent method or other optimization algorithms: as well as Among them, η is the learning rate, which controls the step size of parameter update. and They are the partial derivatives of the loss function L with respect to the weight w and bias b, respectively. Forward propagation: Use the neural network model to calculate the output of neurons through weighted input, activation function, etc. to build a risk assessment model.

[0097] Model training and optimization: Use labeled historical data to train the model, optimize model parameters through cross-validation technology, and improve prediction accuracy.

[0098] Real-time data analysis: Perform real-time analysis on newly collected data to quickly determine whether there are security risks in the current data.

[0099] Risk assessment and early warning: Assess security risk levels based on model outputs and issue early warnings when risks exceed preset thresholds.

[0100] Feedback loop and model update: Collect new data samples and feedback to regularly update and optimize risk assessment models to maintain prediction accuracy.

[0101] Example 2 further optimizes the data security risk assessment and early warning system provided in Example 1. Specifically, the early warning module is connected to the data analysis module. When the analyzed security risk exceeds the preset threshold, the module is used to issue an early warning. It supports multiple early warning methods such as email, SMS, and push notifications to ensure timely notification of relevant personnel. The triggering reason, time, processing status, and other information of each early warning are recorded in detail to facilitate subsequent auditing and tracking. The specific setting of the threshold includes the following steps:

[0102] Step 1: Collect historical data: Collect all login attempt data in the past 30 days, including successful logins and failed login attempts (this data can be obtained from the server's log files);

[0103] Step 2: Data Analysis: Analyze the collected data, pay special attention to the number of failed login attempts, and calculate the following statistics:

[0104] The average number of failed login attempts per day;

[0105] The standard deviation of the number of failed login attempts;

[0106] The maximum, minimum, and median number of failed login attempts;

[0107] Step 3: Preliminary setting of threshold: Set the threshold to the average number of times plus 2 times the standard deviation, threshold = average number of times + 2*standard deviation.

[0108] The specific setting of the threshold also includes the following steps:

[0109] Step 4: Simulation test: Use historical data to simulate the thresholds that are initially set, and observe how many days in the past 30 days of data trigger warnings. If the number of days that trigger warnings exceeds 15 days, the threshold needs to be adjusted;

[0110] Step 5: Threshold adjustment: According to the results of the simulation test, if the number of days triggering the warning exceeds 15 days, the threshold is increased by five;

[0111] Step 6: Implementation and monitoring: Apply the set thresholds to the actual risk assessment and early warning system, and continuously monitor the operation of the system;

[0112] Step 7: Regular review and update: Review the thresholds every quarter and adjust them based on the latest historical data.

[0113] Embodiment 3 further optimizes the data security risk assessment and early warning system provided in Embodiment 1 or 2. Specifically, the protection strategy module provides a protection strategy based on the risk assessment results of the data analysis module. The protection strategy specifically includes:

[0114] SA, access control policy:

[0115] SA1. Multi-factor authentication: For high-risk operations or data access, introduce multi-factor authentication, including fingerprint, facial recognition, and dynamic tokens, to enhance security;

[0116] SB, data encryption strategy:

[0117] SB1. Data encryption: Encrypted storage and transmission of sensitive data (personal information, financial information) to ensure that even if the data is illegally obtained, it cannot be easily decrypted.

[0118] SB2. Encryption key management: Implement a strict encryption key management system, including quarterly key replacement, hierarchical key storage and access control;

[0119] SC, security audit and monitoring strategy:

[0120] SC1, Logging:

[0121] All user logins, data access, and modification operations must be recorded in an unalterable audit log, which must be kept for at least one year for subsequent audit and analysis;

[0122] SC2, Real-time monitoring:

[0123] Use a security information and event management (SIEM) system for real-time monitoring and set up automatic alerts for unusual login attempts, large data downloads, and unusual data modification behaviors.

[0124] The protection strategy also includes:

[0125] SD, Security Update and Patch Policy:

[0126] SD1, regular updates:

[0127] All systems and applications must be checked for updates at least once a quarter and deployed within one month of testing, and for critical security updates, deployment must be completed within one week of release;

[0128] SD2, Patch Management:

[0129] Establish a dedicated patch management team to track, test and deploy all relevant patches. Patches must be verified in a test environment before deployment to ensure compatibility with existing systems.

[0130] SE, Emergency Response Plan:

[0131] SE1. Incident response process:

[0132] Establish a dedicated security incident response team and clarify its responsibilities and processes. After a security incident is discovered, the emergency response plan must be immediately initiated and the preliminary investigation must be completed within 24 hours.

[0133] SE2, backup and recovery:

[0134] All critical data must be backed up daily and stored in a physically isolated secure environment, and recovery drills must be conducted regularly (quarterly) to ensure that data can be quickly restored in the event of a real incident.

[0135] The protection strategy also includes:

[0136] SF, Network Security Strategy:

[0137] SF1. Use an intrusion prevention system (IPS) to monitor and block malicious traffic in real time.

[0138] SF2, Intrusion Detection and Prevention:

[0139] Deploy Network Intrusion Detection System (NIDS) and Host Intrusion Detection System (HIDS) to identify and defend against network attacks, and review IDS / IPS logs monthly to identify potential security threats.

[0140] In the present invention, unless otherwise clearly specified and limited, the terms "installed", "connected", "connected", "fixed" and the like should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral one; it can be a mechanical connection, an electrical connection, or communication with each other; it can be a direct connection, or an indirect connection through an intermediate medium, it can be the internal connection of two elements or the interaction relationship between two elements, unless otherwise clearly defined. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0141] Obviously, the embodiments described above are only some embodiments of the present invention, rather than all embodiments. The preferred embodiments of the present invention are given in the accompanying drawings, but they do not limit the patent scope of the present invention. The present invention can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present invention more thorough and comprehensive. Although the present invention has been described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific embodiments, or to perform equivalent replacements for some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of the present invention, directly or indirectly used in other related technical fields, is also within the scope of patent protection of the present invention.

Claims

1. Data security risk assessment and early warning system, It is characterized in that Includes the following modules: Data collection module, used to collect data security logs, network traffic information and access behavior information; The data analysis module is connected to the data collection module and is used to analyze the collected data and assess the security risks faced by the data; The early warning module is connected to the data analysis module and is used to issue an early warning when the security risk analyzed exceeds a preset threshold; Custom settings module, allowing users to customize risk indicators and corresponding thresholds; The protection strategy module provides protection strategies based on the risk assessment results of the data analysis module; The real-time monitoring module can monitor the security status of data in real time and trigger an alarm when an anomaly is detected.

2. According to claim 1, the data security risk assessment and early warning system, It is characterized in that The data analysis module specifically includes the following steps: S1. Data preprocessing: remove duplicate data and normalize and standardize the collected data; S2. Feature extraction: Extract key features from security logs, network traffic, and access behavior information, including abnormal login attempts, unusual data transfer volume, and abnormal access patterns; S3. Build a risk assessment model: Build a risk assessment model to predict future security risks by learning patterns in historical data.

3. According to claim 2, the data security risk assessment and early warning system, It is characterized in that The data analysis module specifically includes the following steps: S4, model training and optimization: Use labeled historical data to train the model and optimize model parameters through cross-validation technology to improve prediction accuracy; S5. Real-time data analysis: When the data collection module transmits new data, the data analysis module will analyze the data in real time. By inputting the new data into the trained risk assessment model, the module can quickly determine whether the current data has security risks; S6. Risk assessment and early warning: Based on the output of the model, the data analysis module will evaluate the security risk level of the current data. S7. Feedback loop and model update: When new data samples and feedback are collected, the data analysis module uses these new data to regularly update and optimize the risk assessment model to maintain the accuracy of its predictions.

4. According to claim 3, the data security risk assessment and early warning system, It is characterized in that In S3, a risk assessment model is built to predict future security risks by learning patterns in historical data. The specific steps include: S300, forward propagation: For each neuron, its output is calculated by the following formula: and a = σ(z), where z is the weighted input of the neuron and w i is the weight corresponding to the i-th input feature, x i is the value of the ith input feature, b is the bias term, σ is the activation function, and a is the activation output of the neuron.

5. According to the data security risk assessment and early warning system of claim 4, It is characterized in that In S3, a risk assessment model is built to predict future security risks by learning patterns in historical data. The specific steps include: S301. Training of neural network: During the training process, the weights and biases of the neural network are updated through the back propagation algorithm and optimizer. Back propagation involves calculating the gradient of the loss function with respect to the weights and biases, and updating the parameters using the gradient descent method or other optimization algorithms: as well as Among them, η is the learning rate, which controls the step size of parameter update. and are the partial derivatives of the loss function L with respect to the weight W and bias b, respectively.

6. According to the data security risk assessment and early warning system of claim 5, It is characterized in that The early warning module is connected to the data analysis module. When the security risk analyzed exceeds the preset threshold, the module is used to issue an early warning. The specific setting of the threshold includes the following steps: Step 1: Collect historical data: Collect all login attempt data in the past 30 days, including successful logins and failed login attempts; Step 2: Data Analysis: Analyze the collected data, pay special attention to the number of failed login attempts, and calculate the following statistics: The average number of failed login attempts per day; The standard deviation of the number of failed login attempts; The maximum, minimum, and median number of failed login attempts; Step 3: Preliminary setting of threshold: Set the threshold to the average number of times plus 2 times the standard deviation, threshold = average number of times + 2*standard deviation.

7. The data security risk assessment and early warning system according to claim 6, It is characterized in that The specific setting of the threshold also includes the following steps: Step 4: Simulation test: Use historical data to simulate the thresholds that are initially set, and observe how many days in the past 30 days trigger warnings. If the number of days that trigger warnings exceeds 15 days, the threshold needs to be adjusted. Step 5: Threshold adjustment: According to the results of the simulation test, if the number of days triggering the warning exceeds 15 days, the threshold is increased by five; Step 6: Implementation and monitoring: Apply the set thresholds to the actual risk assessment and early warning system, and continuously monitor the operation of the system; Step 7: Regular review and update: Review the thresholds every quarter and adjust them based on the latest historical data.

8. According to claim 7, the data security risk assessment and early warning system, It is characterized in that The protection strategy module provides protection strategies based on the risk assessment results of the data analysis module. The protection strategies include: SA, access control policy: SA1. Multi-factor authentication: For high-risk operations or data access, introduce multi-factor authentication, including fingerprint, facial recognition, and dynamic tokens, to enhance security; SB, data encryption strategy: SB1. Data encryption: Encrypt sensitive data for storage and transmission. SB2. Encryption key management: Implement a strict encryption key management system, including quarterly key replacement, hierarchical key storage and access control; SC, security audit and monitoring strategy: SC1, Logging: All user logins, data access, and modification operations must be recorded in an unalterable audit log, which must be kept for at least one year for subsequent audit and analysis; SC2, Real-time monitoring: Use security information and event management systems for real-time monitoring and set up automatic alerts for unusual login attempts, large data downloads, and unusual data modification behaviors.

9. The data security risk assessment and early warning system according to claim 8, It is characterized in that The protection strategy also includes: SD, Security Update and Patch Policy: SD1, regular updates: All systems and applications must be checked for updates at least once a quarter and deployed within one month of testing, and for critical security updates, deployment must be completed within one week of release; SD2, Patch Management: Establish a dedicated patch management team to track, test and deploy all relevant patches. Patches must be verified in a test environment before deployment to ensure compatibility with existing systems. SE, Emergency Response Plan: SE1. Incident response process: Establish a dedicated security incident response team and clarify its responsibilities and processes. After a security incident is discovered, the emergency response plan must be immediately initiated and the preliminary investigation must be completed within 24 hours. SE2, backup and recovery: All critical data must be backed up daily and stored in a physically isolated secure environment, and recovery drills must be conducted regularly to ensure that data can be quickly restored when a real incident occurs.

10. The data security risk assessment and early warning system according to claim 9, It is characterized in that The protection strategy also includes: SF, Network Security Strategy: SF1. Use intrusion prevention systems to monitor and block malicious traffic in real time; SF2, Intrusion Detection and Prevention: Deploy network intrusion detection systems and host intrusion detection systems to identify and defend against network attacks, and review IDS / IPS logs monthly to identify potential security threats.

Images