Risk identification method and system for server assets

Abstract

The invention aims to provide a risk identification method and system for server assets, and the method and system are combined with real-time flow detection, an ACL strategy on a boundary firewall and scanner data to analyze exposed surface risks of offline assets, opening of high-risk ports, no-flow access ports, no-flow access sources and the like of the current server assets. According to the method, assets, especially exposed surface risks of external servers and target drones, are rapidly and comprehensively collected and sorted, the exposed surfaces of the assets are minimized, the difficulty of network attacks is increased, and the information security protection capability of the server assets is effectively improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of asset security monitoring, and in particular relates to a port risk identification method for server assets and a system applying the method. Background Art

[0002] The rapid development of Internet technology and the country's increasing concern for cyberspace security, the implementation of Information Security Protection 2.0 and the implementation of the Cybersecurity Law have put forward higher requirements for asset management and control of some units with high security and confidentiality requirements. With the development of business and technology, the IT environment is becoming more and more complex, the scale of IT facilities is constantly expanding, and business changes are becoming more and more frequent. In particular, the server assets of organizations such as government departments, military units, scientific research institutes, and financial institutions exchange information through the network and the Internet, becoming important information assets in corporate assets. The existence of a large number of assets has brought many challenges to management work. Not only do we need to protect against external security threats, but we must also prevent illegal behaviors such as arbitrary modification, unauthorized access, and information leakage by intranet users.

[0003] Therefore, enhancing the detection of exposed surfaces of server assets and preventing potential threats is an important prerequisite for effective monitoring and management of network assets, and is also the basis for further achieving targeted network threat defense. Summary of the invention

[0004] In view of the above background, the present invention aims to provide a server asset risk identification method and system, which utilizes the preset flow control strategy of the firewall to identify the port risks existing in the server asset. The specific technical solution of the present invention is as follows.

[0005] First, a risk identification method for server assets is proposed, including: Analyze the real-time network traffic based on the firewall ACL policy and its application control logs, determine the consistency between the policy, logs and server asset port status, and determine the possible port risks of server assets based on the judgment results; The ACL strategy includes judging whether the data flow meets the release conditions according to the source, destination address and port number of the data flow; The application control log content includes: time, service / application, protocol, source area, group, source IP / user, source port, destination area, destination IP, destination port, matching policy name, description and action.

[0006] Preferably, for the external network server assets, the asset information exposed on the external network is obtained through a scanner and synchronized to the security platform, and the asset information discovered by the scan is confirmed and entered into the asset list; The asset information exposed to the external network includes the domain name and the corresponding intranet IP; and the firewall is linked to obtain the ACL policy corresponding to the port of the asset and synchronize it to the security platform.

[0007] Furthermore, the asset confirmation of the scanned server assets includes: if the intranet assets are accessed through domain names, the security platform identifies the host field in the http packet from the collected traffic logs to find the asset domain name, and matches it with the external network IP of the corresponding domain name scanned by the scanner to automatically identify the external and internal network IPs.

[0008] Preferably, for an intranet server asset, if the asset has been marked as a core asset on the security platform, it is determined whether the asset has a risk of no traffic access, including the asset being in a released state in the firewall's ACL policy but no actual traffic accessing the asset.

[0009] The scanner distinguishes assets by external domain names, and the security platform distinguishes assets by internal IP addresses. If the monitored asset is a domain name asset, in order to display the scanner data normally, a mapping relationship between the asset's external domain name and the internal IP address is created when configuring the scanner.

[0010] To further improve security, two-way authentication must be performed when the security platform accesses the firewall, including: after the security platform is set up on the firewall, find the corresponding firewall in the access device list of the security platform to edit the device, select to enable two-way authentication, and enter the authentication account and authentication password. The account and password must be consistent with the account and password of the firewall side connecting to the security platform.

[0011] Preferably, the above-mentioned determination of the port risk of assets includes: If the open port of the current firewall ACL policy is consistent with the access port of the actual traffic, it is a normal asset, otherwise it is an abnormal asset; If the firewall ACL policy opens access to high-risk ports of assets, it is a risk of opening high-risk ports; If the firewall ACL policy opens any port, there is a risk of opening any port; If the firewall ACL policy is to allow access, but there is no actual traffic access to the port, it is a no-traffic port risk; If the firewall ACL policy is normal, but there is no traffic access to the asset within the preset time length, there is no access risk.

[0012] In a second aspect, an asset risk identification system is proposed, including a security platform connected to a firewall system, wherein the security platform includes: Configuration module, used to configure data communication between the security platform and the firewall; Scanning module, used to scan the port status of server assets; The risk identification module analyzes the real-time traffic of the network according to the firewall ACL policy and its application control log, determines the consistency of the policy, log and server asset port status, and determines the possible port risks of the server assets based on the judgment results.

[0013] Preferably, the above configuration module: If the monitored asset is a domain name asset, in order to display the scanner data normally, create a mapping relationship between the asset's external domain name and internal IP when configuring the scanner; After setting up the security platform on the firewall, find the corresponding firewall in the access device list of the security platform to edit the device. After selecting to enable two-way authentication, enter the authentication account and authentication password. The account and password should be consistent with the account and password of the firewall side connecting to the security platform.

[0014] Preferably, the above-mentioned risk identification module: If the open port of the current firewall ACL policy is consistent with the access port of the actual traffic, it is a normal asset, otherwise it is an abnormal asset; If the firewall ACL policy opens access to high-risk ports of assets, it is a risk of opening high-risk ports; If the firewall ACL policy opens any port, there is a risk of opening any port; If the firewall ACL policy is to allow access, but there is no actual traffic access to the port, it is a no-traffic port risk; If the firewall ACL policy is normal, but there is no traffic access to the asset within the preset time length, there is no access risk.

[0015] The present invention adopting the above technical solution has at least the following beneficial effects: combining real-time traffic detection, ACL policy on the border firewall, and scanner data to analyze the exposure risks of the current server assets, such as offline assets, open high-risk ports, no traffic access ports, and no traffic access sources. Quickly and comprehensively collect and sort out the exposure risks of assets, especially external servers and target machines, while minimizing the exposure of assets, increasing the difficulty of network attacks, and effectively improving the information security protection capabilities of server assets. DETAILED DESCRIPTION

[0016] In order to make the purpose, technical solution and advantages of the present invention more clear, the technical solution of the present invention will be clearly and completely described below in conjunction with embodiments.

[0017] First, some of the technical terms involved are explained.

[0018] ACL (Access Control List) is a network security policy tool used to control the ingress and egress of network traffic, ensuring that only qualified data packets can pass through network devices (such as routers and switches). ACL policies check the attributes of data packets (such as source IP address, destination IP address, port number, protocol type, etc.) based on a series of rules, and decide whether to allow the data packets to pass based on these rules. ACL can achieve a variety of network management goals, such as security control, traffic shaping, routing policies, etc. ACL policies are often applied to the interfaces of firewalls, and can be used for both inbound traffic (data packets entering the interface) and outbound traffic (data packets leaving the interface).

[0019] The present invention aims to propose a technical solution for identifying the port exposure risk of server assets by combining real-time traffic detection, ACL policy on the border firewall, and scanner data. Example

[0020] A risk identification method for server assets, comprising: Analyze the real-time network traffic based on the firewall ACL policy and its application control logs, determine the consistency between the policy, logs and server asset port status, and determine the possible port risks of server assets based on the judgment results; The ACL strategy includes judging whether the data flow meets the release conditions according to the source, destination address and port number of the data flow; The application control log content includes: time, service / application, protocol, source area, group, source IP / user, source port, destination area, destination IP, destination port, matching policy name, description and action.

[0021] For external server assets, use a scanner to obtain asset information exposed on the external network and synchronize it to the security platform. After confirming the asset information discovered by the scan, enter it into the asset list. The asset information exposed to the external network includes the domain name and the corresponding intranet IP; and the firewall is linked to obtain the ACL policy corresponding to the port of the asset and synchronize it to the security platform.

[0022] The asset confirmation of the scanned server assets includes: if the intranet assets are accessed through the domain name, the security platform identifies the host field in the http packet from the collected traffic logs to find the asset domain name, and matches it with the external network IP of the corresponding domain name scanned by the scanner to automatically identify the external network and internal network IP.

[0023] For intranet server assets, if the asset has been marked as a core asset on the security platform, determine whether the asset has a no-traffic access risk, including when the asset is in a released state in the firewall's ACL policy but no actual traffic accesses the asset.

[0024] The scanner distinguishes assets by external domain names, and the security platform distinguishes assets by internal IP addresses. If the monitored asset is a domain name asset, in order to display the scanner data normally, a mapping relationship between the asset's external domain name and internal IP address is created when configuring the scanner.

[0025] To further improve security, two-way authentication must be performed when the security platform accesses the firewall, including: after the security platform is set up on the firewall, find the corresponding firewall in the access device list of the security platform to edit the device, select to enable two-way authentication, and enter the authentication account and authentication password. The account and password must be consistent with the account and password of the firewall side connecting to the security platform.

[0026] The determination of the port risk of an asset includes: If the open port of the current firewall ACL policy is consistent with the access port of the actual traffic, it is a normal asset, otherwise it is an abnormal asset; If the firewall ACL policy opens access to high-risk ports of assets, it is a risk of opening high-risk ports; If the firewall ACL policy opens any port, there is a risk of opening any port; If the firewall ACL policy is to allow access, but there is no actual traffic access to the port, it is a no-traffic port risk; If the firewall ACL policy is normal, but there is no traffic access to the asset within the preset time length, there is no access risk.

[0027] The server asset risk identification method embodiment described above combines real-time traffic detection, ACL policies on the border firewall, and scanner data to analyze the exposure risks of the current server assets, such as offline assets, open high-risk ports, no traffic access ports, and no traffic access sources. Quickly and comprehensively collect and sort out the exposure risks of assets, especially external servers and target machines, while minimizing the exposure of assets, increasing the difficulty of network attacks, and effectively improving the information security protection capabilities of server assets. Example

[0028] An asset risk identification system includes a security platform connected to a firewall system, the security platform including: Configuration module, used to configure data communication between the security platform and the firewall; Scanning module, used to scan the port status of server assets; The risk identification module analyzes the real-time traffic of the network according to the firewall ACL policy and its application control log, determines the consistency of the policy, log and server asset port status, and determines the possible port risks of the server assets based on the judgment results.

[0029] As a preferred implementation, the configuration module, If the monitored asset is a domain name asset, in order to display the scanner data normally, create a mapping relationship between the asset's external domain name and internal IP when configuring the scanner; After setting up the security platform on the firewall, find the corresponding firewall in the access device list of the security platform to edit the device. After selecting to enable two-way authentication, enter the authentication account and authentication password. The account and password should be consistent with the account and password of the firewall side connecting to the security platform.

[0030] As a preferred implementation, the risk identification module: If the open port of the current firewall ACL policy is consistent with the access port of the actual traffic, it is a normal asset, otherwise it is an abnormal asset; If the firewall ACL policy opens access to high-risk ports of assets, it is a risk of opening high-risk ports; If the firewall ACL policy opens any port, there is a risk of opening any port; If the firewall ACL policy is to allow access, but there is no actual traffic access to the port, it is a no-traffic port risk; If the firewall ACL policy is normal, but there is no traffic access to the asset within the preset time length, there is no access risk.

[0031] The asset risk identification system embodiment described above combines real-time traffic detection, ACL policies on border firewalls, and scanner data to analyze the exposure risks of current server assets, such as offline assets, open high-risk ports, no traffic access ports, and no traffic access sources. It quickly and comprehensively collects and sorts out the exposure risks of assets, especially external servers and target machines, while minimizing the exposure of assets, increasing the difficulty of network attacks, and effectively improving the information security protection capabilities of server assets.

[0032] A person skilled in the art can understand that all or part of the steps in the above-mentioned embodiment method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc.

[0033] The above description of the above disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but will conform to the broadest scope consistent with the principles disclosed herein.

Claims

1. A method for identifying risks of server assets, characterized in that: include: Analyze the real-time network traffic based on the firewall ACL policy and its application control logs, determine the consistency between the policy, logs and server asset port status, and determine the possible port risks of server assets based on the judgment results; The ACL strategy includes judging whether the data flow meets the release conditions according to the source, destination address and port number of the data flow; The application control log content includes: time, service / application, protocol, source area, group, source IP / user, source port, destination area, destination IP, destination port, matching policy name, description and action.

2. The server asset risk identification method according to claim 1, characterized in that: For external server assets, use a scanner to obtain asset information exposed on the external network and synchronize it to the security platform. After confirming the asset information discovered by the scan, enter it into the asset list. The asset information exposed to the external network, including domain names and corresponding internal network IP addresses; The firewall is linked to obtain the ACL policy corresponding to the port of the asset and synchronize it to the security platform.

3. The asset risk identification method according to claim 2, characterized in that: The asset confirmation of the scanned server assets includes: if the intranet assets are accessed through the domain name, the security platform identifies the host field in the http packet from the collected traffic logs to find the asset domain name, and matches it with the external network IP of the corresponding domain name scanned by the scanner to automatically identify the external network and internal network IP.

4. The server asset risk identification method according to claim 1, characterized in that: For intranet server assets, If the asset has been marked as a core asset on the security platform, determine whether the asset has a no-traffic access risk, including the asset being in a released state in the firewall's ACL policy but no actual traffic accessing the asset.

5. The server asset risk identification method according to claim 1, characterized in that: The scanner distinguishes assets by external domain names, and the security platform distinguishes assets by internal IP addresses. If the monitored asset is a domain name asset, in order to display the scanner data normally, a mapping relationship between the asset's external domain name and internal IP address is created when configuring the scanner.

6. The asset risk identification method according to any one of claims 1 to 5, characterized in that: To further improve security, two-way authentication must be performed when the security platform accesses the firewall, including: after the security platform is set up on the firewall, find the corresponding firewall in the access device list of the security platform to edit the device, select to enable two-way authentication, and enter the authentication account and authentication password. The account and password must be consistent with the account and password of the firewall side connecting to the security platform.

7. The server asset risk identification method according to claim 1, characterized in that: The determination of the port risk of an asset includes: If the open port of the current firewall ACL policy is consistent with the access port of the actual traffic, it is a normal asset, otherwise it is an abnormal asset; If the firewall ACL policy opens access to high-risk ports of assets, it is a risk of opening high-risk ports; If the firewall ACL policy opens any port, there is a risk of opening any port; If the firewall ACL policy is to allow access, but there is no actual traffic access to the port, it is a no-traffic port risk; If the firewall ACL policy is normal, but there is no traffic access to the asset within the preset time length, there is no access risk.

8. An asset risk identification system, characterized in that: A security platform for accessing a firewall system is provided, wherein the security platform comprises: Configuration module, used to configure data communication between the security platform and the firewall; Scanning module, used to scan the port status of server assets; The risk identification module analyzes the real-time traffic of the network according to the firewall ACL policy and its application control log, determines the consistency of the policy, log and server asset port status, and determines the possible port risks of the server assets based on the judgment results.

9. The asset risk identification system according to claim 8, characterized in that: The configuration module, If the monitored asset is a domain name asset, in order to display the scanner data normally, create a mapping relationship between the asset's external domain name and internal IP when configuring the scanner; After setting up the security platform on the firewall, find the corresponding firewall in the access device list of the security platform to edit the device. After selecting to enable two-way authentication, enter the authentication account and authentication password. The account and password should be consistent with the account and password of the firewall side connecting to the security platform.

10. The asset risk identification system according to claim 8, characterized in that: The risk identification module: If the open port of the current firewall ACL policy is consistent with the access port of the actual traffic, it is a normal asset, otherwise it is an abnormal asset; If the firewall ACL policy opens access to high-risk ports of assets, it is a risk of opening high-risk ports; If the firewall ACL policy opens any port, there is a risk of opening any port; If the firewall ACL policy is to allow access, but there is no actual traffic access to the port, it is a no-traffic port risk; If the firewall ACL policy is normal, but there is no traffic access to the asset within the preset time length, there is no access risk.