Risk management and control platform based on IT asset detection

Abstract

The invention discloses a risk management and control platform based on IT asset detection. Comprising a video asset data checking module, a video asset detection scanning defense admission module, a video data access white list management and control module, a video access risk assessment module, a video access security operation and maintenance management module, a video access security situation analysis module and a video access report generation module. Fingerprint features are generated based on information such as an IP address, an MAC address, a terminal service, a system and the like, and non-perception authentication is performed when the terminal initiates traffic, so that the access authentication problem of the Internet of Things terminal can be effectively solved, asset management and control are performed on equipment accessed to the Internet of Things, security processing and isolation are performed on access data, and potential security risks are detected and defended. A management and control system of pre-troubleshooting prevention, in-event linkage disposal and post-event traceability reinforcement is formed, and the security of company scheduling network operation and information data is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of risk management and control platforms, and in particular to a risk management and control platform based on IT asset detection. Background Art

[0002] Today, computer and mobile phone information security protection has received widespread attention and popularity, but the security protection of surveillance cameras and other equipment is still ignored by the public. A large number of front-end devices and data of video surveillance networks are not protected and are completely exposed to the Internet. The front-end IP access devices are directly connected to the back-end business system. Once an attacker or infected host accesses the network, it is very easy to spread quickly and cause the entire network to be paralyzed. During the ransomware outbreak in May 2017, more than 120,000 network cameras were hacked worldwide. As a springboard for launching virus propagation and attacks, power supply bureaus have built a large number of video surveillance equipment and access points (substation video cameras, etc.) in recent years. However, under the current asset management model, the asset change information on the control platform is distorted and delayed due to human factors during the transmission process, causing the account and the actual to be inconsistent. At present, most of the terminals in the Internet of Things are dumb terminals, and traditional PPPoE, Web and other mature security authentication access methods cannot be used. When using, traditional Internet of Things security products usually study protection methods from the perspective of attack principles. It is difficult for traditional products to predict and protect against unknown attacks. For this reason, we propose a risk control platform based on IT asset detection. Summary of the invention

[0003] The purpose of the present invention is to provide a risk management and control platform based on IT asset detection to solve the problems raised in the above background technology.

[0004] To achieve the above objectives, the present invention provides the following technical solutions: a risk management and control platform based on IT asset detection, comprising:

[0005] The video asset data inventory module completes the comprehensive cleanup of the existing video assets of Baoshan Power Supply Bureau, conducts a comprehensive inventory of the substations, asset types, asset support agreements, etc., and analyzes the existing assets to form an asset ledger inventory report of the power supply bureau;

[0006] The video asset detection and scanning defense access module uses active scanning, real-time detection, and manual settings to collect the IP, type, manufacturer, geographic location and other attribute information of the front-end device, and generate a whitelist of the device asset library, so as to timely discover and identify unknown, illegal, and counterfeit devices that are illegally connected. Active detection and scanning technology collects front-end IoT terminal information to establish a comprehensive defense access control system. By deploying professional equipment at the convergence layer and using active detection, the front-end device is required to actively report and capture device information, including detailed device information such as the device's IP address, MAC address, device type, manufacturer, and deployment location, to establish a large asset database for the power supply bureau, so that each asset matches its own identity ID;

[0007] The video data access whitelist control module establishes an asset identification whitelist through video access control equipment and optimized security policies. Based on the video access technology architecture of the whitelist mechanism, it performs injection authentication and application control on devices accessing the network. Only whitelist devices are allowed to enter the network, and other devices are regarded as blacklist devices and rejected. This improves the network access security and enables the network to perceive applications, so that only trusted terminals are allowed to access, and only video dedicated networks are allowed to carry legal videos, pictures and other data. All other data are blocked to ensure that the monitoring system is safe and controllable.

[0008] The video access risk assessment module conducts video risk assessment work. Combined with the access system data, it audits video equipment assets, conducts application protocol security analysis, vulnerability scanning and verification, vulnerability repair suggestions, and security inspection reports to complete risk assessment and security strategy optimization. Terminal behavior model analysis + terminal abnormal behavior baseline detection prevents illegal access and abnormal behavior problems of IoT terminals. The IoT is different from traditional network devices or PCs. Many protocols and attack behaviors are not available in traditional security devices. Traditional firewalls and intrusion detection and prevention systems (IPS) can only defend against TCP and UDP traffic, and the virus database needs to be updated in real time for virus intrusion. For some new viruses, the effect is often not obvious.

[0009] The video access security operation and maintenance management module conducts security operation and maintenance control on access devices, formulates corresponding operation and maintenance control processes, carries out asset monitoring management, security vulnerability management, video inspection management, compliance inspection management, security risk management and other operation and maintenance management, and improves the level of video security management and operation and maintenance;

[0010] Video access security situation analysis module: for discovered asset risks, the platform provides big data analysis and display in various dimensions, allowing users to quickly understand the overall security status of cyberspace assets from the large display screen, collect log data, and apply big data and situation awareness technology to conduct in-depth experimental applications of intrusion prevention and monitoring;

[0011] The video access report generation module completes various risk management and control summary tasks based on the security analysis of video access, and issues a video access research summary report.

[0012] Preferably, the video asset detection scanning defense access module includes an asset storage location read-write module and a destination read-write module, and the asset storage location read-write module and the destination read-write module are electrically output and connected to the server; the asset storage location read-write module is used to read the electronic tag card, obtain asset information, and send the asset information to the server;

[0013] The destination read / write module is used to read the electronic tag card, obtain asset information, and send the destination read / write module information and asset information to the server;

[0014] The server is used to receive asset information sent by the asset storage location read-write module, and confirm the assets transferred from the asset storage location based on the asset information. It is also used to receive destination read-write module information and asset information sent by the destination read-write module to confirm the asset processing method.

[0015] Preferably, the video data access whitelist control module enables the network to perceive applications, so that only trusted terminals are allowed to access and only video dedicated networks are allowed to carry legal videos, pictures and other data. Other data are blocked to ensure that the monitoring system is safe and controllable. By optimizing intrusion prevention equipment, real-time detection of data application layer protocols and blocking of attack traffic are achieved, and illegal personnel are prevented from intruding and DDoS attacks on system application areas. By optimizing vulnerability scanning equipment, regular vulnerability scanning of IT resources such as network equipment, operating systems, databases, and application systems running in the video transmission network is achieved, and the risk of vulnerabilities being exploited is discovered, handled, and reduced in a timely manner. By optimizing the deployment of WEB application security equipment, platforms based on B / S architecture are deeply protected, and network attacks on core WEB platforms are completely blocked.

[0016] Preferably, the establishment of the terminal behavior model in the video access risk assessment module:

[0017] a. Terminal behavior model analysis

[0018] Based on the single behavior characteristics of IoT terminals, after self-learning and big data analysis, the terminal network behavior model is automatically established, which can effectively prevent abnormal behaviors initiated by the terminal;

[0019] b. Baseline detection of abnormal terminal behavior

[0020] Devices in the video private network cannot access external IP addresses, certain sensitive ports such as 445 and 21 cannot be accessed, and the PC initiates a large number of detection messages in a short period of time. You can customize the abnormal behavior baseline and issue warnings for abnormal network behavior based on the configuration.

[0021] Preferably, the video access security operation and maintenance management module basically adopts IPv4 security access. As the number of access terminals of the Internet of Things increases, IPv4 address resources will inevitably become a limiting factor in the development of the Internet of Things. The video access security operation and maintenance management module supports various Internet of Things security features in the IPv6 environment.

[0022] Preferably, the video access security situation analysis module includes an asset vulnerability detection unit and a boundary integrity detection unit. The asset vulnerability detection unit can detect vulnerabilities in the basic network equipment, servers, and front-end Internet of Things terminals of the ubiquitous power Internet of Things, and comprehensively discover the security risks of assets. The boundary integrity detection unit detects violations that destroy the integrity of the network boundary, such as private connection to the Internet, private connection to routing, portable WiFi, etc., actively monitors the boundary status of the private network, and prevents cross-network information interaction events.

[0023] Compared with the prior art, the present invention has the following beneficial effects:

[0024] The present invention generates fingerprint features based on information such as IP address, MAC address, terminal service, system, etc., and performs non-perceptual authentication when the terminal initiates traffic, which can effectively solve the access authentication problem of the Internet of Things terminal. In the video data access whitelist control module, the network can perceive the application, so that only trusted terminals are allowed to access, and only the video dedicated network is allowed to carry legal videos, pictures and other data. Other data are shielded, ensuring that the monitoring system is safe and controllable. By optimizing the intrusion prevention equipment, the data application layer protocol is detected in real time and the attack traffic is blocked, and the intrusion and DDoS attacks of illegal personnel to the system application area are prevented. By optimizing the vulnerability scanning equipment, the network equipment, operating system, database, application system and other IT resources running in the video transmission network can be detected. Regular vulnerability scanning of the source can timely discover, deal with and reduce the risk of vulnerabilities being exploited. By optimizing the deployment of WEB application security equipment, in-depth protection is provided for platforms based on B / S architecture, and network attacks on core WEB platforms are completely blocked. In this way, only legally authorized IoT traffic is allowed to pass, and all other traffic is blocked, forming a truly clean and secure IoT. It can more effectively prevent illegal scanning, DDoS attacks, and constantly changing unknown attacks. Asset management and control of IoT access devices, secure processing and isolation of access data, and detection and defense of potential security risks are carried out. A management and control system is formed with pre-investigation and prevention, in-process linkage disposal, and post-incident tracing and reinforcement, thereby improving the security of the company's dispatching network operation and information data. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 This is a block diagram of the working principle of the present invention;

[0026] Figure 2 This is a block diagram of the video asset detection scanning defense access module of the present invention;

[0027] Figure 3 This is a block diagram of the video access security situation analysis module of the present invention. DETAILED DESCRIPTION

[0028] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0029] See also Figure 1 The present invention provides a technical solution: a risk management and control platform based on IT asset detection, comprising:

[0030] The video asset data inventory module completes the comprehensive cleanup of the existing video assets of Baoshan Power Supply Bureau, conducts a comprehensive inventory of the substations, asset types, asset support agreements, etc., and analyzes the existing assets to form an asset ledger inventory report of the power supply bureau;

[0031] The video asset detection and scanning defense access module uses active scanning, real-time detection, and manual settings to collect the IP, type, manufacturer, geographic location and other attribute information of the front-end device, and generate a whitelist of the device asset library, so as to timely discover and identify unknown, illegal, and counterfeit devices that are illegally connected. Active detection and scanning technology collects front-end IoT terminal information to establish a comprehensive defense access control system. By deploying professional equipment at the convergence layer and using active detection, the front-end device is required to actively report and capture device information, including detailed device information such as the device's IP address, MAC address, device type, manufacturer, and deployment location, to establish a large asset database for the power supply bureau, so that each asset matches its own identity ID;

[0032] The video data access whitelist control module establishes an asset identification whitelist through video access control equipment and optimized security policies. Based on the video access technology architecture of the whitelist mechanism, it performs injection authentication and application control on devices accessing the network. Only whitelist devices are allowed to enter the network, and other devices are regarded as blacklist devices and rejected. This improves the network access security and enables the network to perceive applications, so that only trusted terminals are allowed to access, and only video dedicated networks are allowed to carry legal videos, pictures and other data. All other data are blocked to ensure that the monitoring system is safe and controllable.

[0033] The video access risk assessment module conducts video risk assessment work. Combined with the access system data, it audits video equipment assets, conducts application protocol security analysis, vulnerability scanning and verification, vulnerability repair suggestions, and security inspection reports to complete risk assessment and security strategy optimization. Terminal behavior model analysis + terminal abnormal behavior baseline detection prevents illegal access and abnormal behavior problems of IoT terminals. The IoT is different from traditional network devices or PCs. Many protocols and attack behaviors are not available in traditional security devices. Traditional firewalls and intrusion detection and prevention systems (IPS) can only defend against TCP and UDP traffic, and the virus database needs to be updated in real time for virus intrusion. For some new viruses, the effect is often not obvious.

[0034] The video access security operation and maintenance management module conducts security operation and maintenance control on access devices, formulates corresponding operation and maintenance control processes, carries out asset monitoring management, security vulnerability management, video inspection management, compliance inspection management, security risk management and other operation and maintenance management, and improves the level of video security management and operation and maintenance;

[0035] Video access security situation analysis module: for discovered asset risks, the platform provides big data analysis and display in various dimensions, allowing users to quickly understand the overall security status of cyberspace assets from the large display screen, collect log data, and apply big data and situation awareness technology to conduct in-depth experimental applications of intrusion prevention and monitoring;

[0036] The video access report generation module completes various risk management and control summary tasks based on the security analysis of video access, and issues a video access research summary report.

[0037] See also Figure 2 The video asset detection scanning defense access module includes an asset storage location read-write module and a destination read-write module, and the asset storage location read-write module and the destination read-write module are electrically connected to the server; the asset storage location read-write module is used to read the electronic tag card, obtain asset information, and send the asset information to the server;

[0038] The destination read / write module is used to read the electronic tag card, obtain asset information, and send the destination read / write module information and asset information to the server;

[0039] The server is used to receive the asset information sent by the asset storage location read-write module, and confirm the assets transferred from the asset storage location according to the asset information, and is also used to receive the destination read-write module information and asset information sent by the destination read-write module to confirm the asset processing method;

[0040] The video data access whitelist control module enables the network to perceive applications, allowing only trusted terminals to access and only allowing video dedicated networks to carry legal videos, pictures and other data. All other data are blocked to ensure that the monitoring system is safe and controllable. By optimizing intrusion prevention equipment, real-time detection of data application layer protocols and blocking of attack traffic are achieved, and illegal personnel are prevented from intruding and attacking the system application area. By optimizing vulnerability scanning equipment, regular vulnerability scanning of IT resources such as network equipment, operating systems, databases, and application systems running in the video transmission network is achieved, and the risk of vulnerabilities being exploited is discovered, handled and reduced in a timely manner. By optimizing the deployment of WEB application security equipment, in-depth protection is provided for platforms based on B / S architecture, and network attacks on core WEB platforms are fully blocked;

[0041] Establishment of the terminal behavior model in the video access risk assessment module:

[0042] a. Terminal behavior model analysis

[0043] Based on the single behavior characteristics of IoT terminals, after self-learning and big data analysis, the terminal network behavior model is automatically established, which can effectively prevent abnormal behaviors initiated by the terminal;

[0044] b. Baseline detection of abnormal terminal behavior

[0045] Devices in the video private network cannot access external network IPs, certain sensitive ports such as 445 and 21 cannot be accessed, and PCs initiate a large number of detection messages in a short period of time. You can customize the abnormal behavior baseline and issue warnings for abnormal network behavior based on the configuration;

[0046] The video access security operation and maintenance management module basically adopts IPv4 security access. As the number of access terminals of the Internet of Things increases, IPv4 address resources will inevitably become a limiting factor in the development of the Internet of Things. The video access security operation and maintenance management module supports various Internet of Things security features in the IPv6 environment.

[0047] See also Figure 3 The video access security situation analysis module includes an asset vulnerability detection unit and a boundary integrity detection unit. The asset vulnerability detection unit can detect the vulnerabilities of the basic network equipment, servers, and front-end Internet of Things terminals of the ubiquitous power Internet of Things, and comprehensively discover the security risks of assets. The boundary integrity detection unit detects violations that destroy the integrity of the network boundary, such as: private connection to the Internet, private connection to routing, portable WiFi, etc., actively monitors the boundary status of the private network, and prevents cross-network information interaction events.

[0048] Working principle: The present invention generates fingerprint features based on IP address, MAC address, terminal service, system and other information, and performs non-perceptual authentication when the terminal initiates traffic, which can effectively solve the access authentication problem of IoT terminals, and the video data access whitelist control module enables the network to perceive the application, so that only trusted terminals are allowed to access, and only the video dedicated network is allowed to carry legal videos, pictures and other data, and other data are shielded, so as to ensure the safety and controllability of the monitoring system. By optimizing the intrusion prevention equipment, the data application layer protocol can be detected in real time and the attack traffic can be blocked, and the intrusion and DDoS attacks of illegal personnel to the system application area can be prevented. By optimizing the vulnerability scanning equipment, the network equipment, operating system, database, application system and other I running in the video transmission network can be realized. Through regular vulnerability scanning of T resources, timely discovery, disposal and reduction of the risk of vulnerability exploitation, and through optimized deployment of WEB application security equipment, in-depth protection of B / S architecture-based platforms is carried out to comprehensively block network attacks on core WEB platforms. In this way, only legally authorized IoT traffic is allowed to pass, and all other traffic is blocked, forming a truly clean and secure IoT. It can more effectively prevent illegal scanning, DDoS attacks, and constantly changing unknown attacks, and carry out asset management of IoT access devices, secure processing and isolation of access data, and detection and defense of potential security risks, forming a management and control system with pre-investigation and prevention, in-process linkage disposal, and post-incident tracing and reinforcement, thus improving the security of the company's dispatching network operation and information data.

[0049] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A risk management and control platform based on IT asset detection, characterized by: include: The video asset data inventory module completes the comprehensive cleanup of the existing video assets of Baoshan Power Supply Bureau, conducts a comprehensive inventory of the substations, asset types, asset support agreements, etc., and analyzes the existing assets to form an asset ledger inventory report of the power supply bureau; The video asset detection and scanning defense access module uses active scanning, real-time detection, and manual settings to collect the IP, type, manufacturer, geographic location and other attribute information of the front-end device, and generate a whitelist of the device asset library, so as to timely discover and identify unknown, illegal, and counterfeit devices that are illegally connected. Active detection and scanning technology collects front-end IoT terminal information to establish a comprehensive defense access control system. By deploying professional equipment at the convergence layer and using active detection, the front-end device is required to actively report and capture device information, including detailed device information such as the device's IP address, MAC address, device type, manufacturer, and deployment location, to establish a large asset database for the power supply bureau, so that each asset matches its own identity ID; The video data access whitelist control module establishes an asset identification whitelist through video access control equipment and optimized security policies. Based on the video access technology architecture of the whitelist mechanism, it performs injection authentication and application control on devices accessing the network. Only whitelist devices are allowed to enter the network, and other devices are regarded as blacklist devices and rejected. This improves the network access security and enables the network to perceive applications, so that only trusted terminals are allowed to access, and only video dedicated networks are allowed to carry legal videos, pictures and other data. All other data are blocked to ensure that the monitoring system is safe and controllable. The video access risk assessment module conducts video risk assessment work. Combined with the access system data, it audits video equipment assets, conducts application protocol security analysis, vulnerability scanning and verification, vulnerability repair suggestions, and security inspection reports to complete risk assessment and security strategy optimization. Terminal behavior model analysis + terminal abnormal behavior baseline detection prevents illegal access and abnormal behavior problems of IoT terminals. The IoT is different from traditional network devices or PCs. Many protocols and attack behaviors are not available in traditional security devices. Traditional firewalls and intrusion detection and prevention systems (IPS) can only defend against TCP and UDP traffic, and the virus database needs to be updated in real time for virus intrusion. For some new viruses, the effect is often not obvious. The video access security operation and maintenance management module conducts security operation and maintenance control on access devices, formulates corresponding operation and maintenance control processes, carries out asset monitoring management, security vulnerability management, video inspection management, compliance inspection management, security risk management and other operation and maintenance management, and improves the level of video security management and operation and maintenance; Video access security situation analysis module: for discovered asset risks, the platform provides big data analysis and display in various dimensions, allowing users to quickly understand the overall security status of cyberspace assets from the large display screen, collect log data, and apply big data and situation awareness technology to conduct in-depth experimental applications of intrusion prevention and monitoring; The video access report generation module completes various risk management and control summary tasks based on the security analysis of video access, and issues a video access research summary report.

2. The risk management and control platform based on IT asset detection according to claim 1, characterized in that: The video asset detection scanning defense access module includes an asset storage location read-write module and a destination read-write module, and the asset storage location read-write module and the destination read-write module are electrically connected to the server; the asset storage location read-write module is used to read the electronic tag card, obtain asset information, and send the asset information to the server; The destination read / write module is used to read the electronic tag card, obtain asset information, and send the destination read / write module information and asset information to the server; The server is used to receive asset information sent by the asset storage location read-write module, and confirm the assets transferred from the asset storage location based on the asset information. It is also used to receive destination read-write module information and asset information sent by the destination read-write module to confirm the asset processing method.

3. The risk management and control platform based on IT asset detection according to claim 1, characterized in that: The video data access whitelist control module enables the network to perceive applications, allowing only trusted terminals to access and only allowing video dedicated networks to carry legal videos, pictures and other data. Other data are blocked to ensure the security and controllability of the monitoring system. By optimizing intrusion prevention equipment, real-time detection of data application layer protocols and blocking of attack traffic are achieved, and illegal personnel are prevented from intruding and DDoS attacks on system application areas. By optimizing vulnerability scanning equipment, regular vulnerability scanning of IT resources such as network equipment, operating systems, databases, application systems, etc. running in the video transmission network is achieved, and the risk of vulnerabilities being exploited is discovered, handled, and reduced in a timely manner. By optimizing the deployment of WEB application security equipment, in-depth protection is provided for platforms based on B / S architecture, and network attacks on core WEB platforms are completely blocked.

4. The risk management and control platform based on IT asset detection according to claim 1, characterized in that: Establishment of the terminal behavior model in the video access risk assessment module: a. Terminal behavior model analysis Based on the single behavior characteristics of IoT terminals, after self-learning and big data analysis, the terminal network behavior model is automatically established, which can effectively prevent abnormal behaviors initiated by the terminal; b. Baseline detection of abnormal terminal behavior Devices in the video private network cannot access external network IPs, certain sensitive ports such as 445 and 21 cannot be accessed, and the PC initiates a large number of detection messages in a short period of time. You can customize the abnormal behavior baseline and issue warnings for abnormal network behavior based on the configuration.

5. The risk management and control platform based on IT asset detection according to claim 1, characterized in that: The video access security operation and maintenance management module basically adopts IPv4 security access. As the number of access terminals of the Internet of Things increases, IPv4 address resources will inevitably become a limiting factor in the development of the Internet of Things. The video access security operation and maintenance management module supports various Internet of Things security features in the IPv6 environment.

6. The risk management and control platform based on IT asset detection according to claim 1, characterized in that: The video access security situation analysis module includes an asset vulnerability detection unit and a boundary integrity detection unit. The asset vulnerability detection unit can detect vulnerabilities in the basic network equipment, servers, and front-end Internet of Things terminals of the ubiquitous power Internet of Things, and comprehensively discover the security risks of assets. The boundary integrity detection unit detects violations that destroy the integrity of the network boundary, such as private connection to the Internet, private connection to routing, portable WiFi, etc., actively monitors the boundary status of the private network, and prevents cross-network information interaction events.

Images