Questionnaire survey-based compliance assessment method and system

Abstract

The invention provides a compliance evaluation method and system based on questionnaire survey, and the method comprises the steps: S1, constructing a network security evaluation model according to a target evaluation standard; s2, generating a questionnaire survey question based on the network security evaluation model, and collecting answers to the questionnaire survey question; and S3, based on the network security evaluation model and the questionnaire survey questions and answers, performing weighted summation, and calculating an evaluation result. According to the method, the evaluation model is constructed by referring to standards such as GB / T22239-2019 information security technology network security level protection basic requirements, the construction speed of the network security evaluation model is increased, the requirement of testers for network security knowledge reserve is reduced, and operability is improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and in particular, relates to a compliance assessment method and system based on questionnaire survey. Background Art

[0002] With the rapid development of network technology, network security issues have become increasingly prominent. Network security is a strategic factor affecting national development and one of the important factors affecting social, economic and political development. In addition, due to the widespread application of emerging technologies such as cloud computing, big data, and the Internet of Things, network security issues have become more complex and diverse.

[0003] In view of the ever-expanding network scale and increasingly complex network structure, attackers are using security vulnerabilities in systems and networks to carry out attacks more frequently and with more and more methods. In order to meet the challenges, network security technology is also constantly innovating and developing, and network security assessment has become a research hotspot in the field of network information security.

[0004] At present, for the network security assessment of the system under test, research organizations and experts have developed some quantitative or qualitative security assessment models and conducted a series of theoretical research and practical application research.

[0005] In large-scale enterprise networks, attackers no longer target a single host or exploit a single vulnerability. More attacks are carried out in multiple steps. First, they attack a host at the edge of the network, and then use the host as a springboard to attack hosts inside the network, thereby gradually penetrating the network. This results in a large number of network security incidents. For these incidents, it is difficult to obtain the overall security status of the network if they are analyzed or managed only from a manual perspective.

[0006] The existing model cannot adapt to large-scale network applications and cannot meet the needs of analyzing network security status from multiple angles and levels. This has a negative impact on the effectiveness of network security assessment, and this problem needs to be solved urgently. Summary of the invention

[0007] In view of the defects in the prior art, the purpose of the present invention is to provide a compliance assessment method and system based on questionnaire survey.

[0008] A compliance assessment method based on questionnaire survey provided by the present invention includes:

[0009] Step S1: Construct a network security assessment model based on the target assessment criteria;

[0010] Step S2: Based on the network security assessment model, generate questionnaire questions and collect answers to the questionnaire questions;

[0011] Step S3: Based on the network security assessment model and the questionnaire questions and answers, a weighted sum is performed to calculate the assessment result.

[0012] Preferably, in step S1:

[0013] Step S1.1: Enter the task name, evaluation criteria, evaluation level, extended requirements and evaluation object; and query the database according to the evaluation criteria, evaluation level and extended requirements to obtain a corresponding candidate list of evaluation indicators;

[0014] Step S1.2: Select the required evaluation items from the candidate list of evaluation indicator items, set the weight of each evaluation item and the veto item label;

[0015] Step S1.3: Generate a network security assessment model and an assessment task based on the assessment item index, the assessment item index weight and the veto item label, and store the assessment task and model data in a MySQL database;

[0016] In the step S1.1, the evaluation standard includes: GB / T 22239-2019; the evaluation level includes 5 levels of GB / T 22239-2019; the extension requirements include: cloud computing extension requirements and mobile Internet extension requirements;

[0017] The weight of the evaluation item, i.e. the index score of the evaluation item, is set as follows: general, weight 1; important, weight 2; critical, weight 3;

[0018] The weight of the veto item label, that is, the index score of the veto item label is set as follows: for non-veto items, the weight is 0; for veto items, the weight is 1;

[0019] The network security assessment model has a total of 5 layers, among which the first layer is network security assessment, the second layer is general security requirements and extended requirements, the third layer is the secure physical environment; the fourth layer is physical location selection, and the fifth layer is assessment item indicators.

[0020] Preferably, in step S2:

[0021] Step S2.1: Select a task name, query the database according to the task information of the task name, and obtain a list of questionnaire questions;

[0022] Step S2.2: Based on the questionnaire list, input questionnaire questions, and save the answer data of the questionnaire questions into a database;

[0023] The database includes: a MySQL database;

[0024] The questionnaire survey questions are obtained by converting the evaluation item indicators;

[0025] In step S2.2, the answer data is saved corresponding to the two questionnaire status values; when the questionnaire status value is set to 1, the answer data is saved; when the questionnaire status value is set to 2, the answer data is submitted and saved; when the questionnaire status value is repeatedly set to 2, it is not submitted.

[0026] Preferably, in step S3:

[0027] Step S3.1: Calculate an evaluation score based on the network security evaluation model and the answer data;

[0028] Step S3.2: Generate an evaluation result through an expert method according to the evaluation score;

[0029] In the step S3.1: determine whether the score of the indicator with the veto item label is 0, if the result is yes, the evaluation score is 0, and the process ends; if the result is no, the indicator scores of each layer of the network security evaluation model are weighted and summed to obtain the evaluation score;

[0030] The evaluation results include: the number of each option in the questionnaire answer and the final evaluation score;

[0031] The options include: compliant, non-compliant, partially compliant, and not involved.

[0032] A compliance assessment system based on questionnaire survey provided by the present invention includes:

[0033] Module M1: Construct a network security assessment model based on the target assessment criteria;

[0034] Module M2: generating questionnaire questions based on the network security assessment model, and collecting answers to the questionnaire questions;

[0035] Module M3: Based on the network security assessment model and the questionnaire questions and answers, a weighted sum is performed to calculate the assessment result.

[0036] Preferably, in the module M1:

[0037] Module M1.1: Enter the task name, evaluation criteria, evaluation level, extended requirements and evaluation object; and query the database according to the evaluation criteria, evaluation level and extended requirements to obtain a corresponding candidate list of evaluation indicators;

[0038] Module M1.2: Select the required evaluation items from the list of evaluation indicator options, set the weight of each evaluation item and the veto item label;

[0039] Module M1.3: Generate a network security assessment model and an assessment task based on the assessment item index, the assessment item index weight and the veto item label, and store the assessment task and model data in a MySQL database;

[0040] In the module M1.1, the evaluation standards include: GB / T 22239-2019; the evaluation levels include the five levels of GB / T 22239-2019; the extended requirements include: cloud computing extended requirements and mobile Internet extended requirements;

[0041] The weight of the evaluation item, i.e. the index score of the evaluation item, is set as follows: general, weight 1; important, weight 2; critical, weight 3;

[0042] The weight of the veto item label, that is, the index score of the veto item label is set as follows: for non-veto items, the weight is 0; for veto items, the weight is 1;

[0043] The network security assessment model has a total of 5 layers, among which the first layer is network security assessment, the second layer is general security requirements and extended requirements, the third layer is the secure physical environment; the fourth layer is physical location selection, and the fifth layer is assessment item indicators.

[0044] Preferably, in the module M2:

[0045] Module M2.1: Select a task name, query the database according to the task information of the task name, and obtain a list of questionnaire questions;

[0046] Module M2.2: Based on the questionnaire list, input questionnaire questions, and save the answer data of the questionnaire questions into a database;

[0047] The database includes: a MySQL database;

[0048] The questionnaire survey questions are obtained by converting the evaluation item indicators;

[0049] In the module M2.2, the saving of the answer data corresponds to the two questionnaire status values; when the questionnaire status value is set to 1, the answer data is saved; when the questionnaire status value is set to 2, the answer data is submitted and saved; when the questionnaire status value is repeatedly set to 2, it is not submitted.

[0050] Preferably, in the module M3:

[0051] Module M3.1: Calculate an assessment score based on the network security assessment model and the answer data;

[0052] Module M3.2: Generate evaluation results through expert method based on the evaluation scores;

[0053] In the module M3.1: determine whether the score of the indicator with the veto item label is 0, if the result is yes, the evaluation score is 0, and the process ends; if the result is no, the indicator scores of each layer of the network security evaluation model are weighted and summed to obtain the evaluation score;

[0054] The evaluation results include: the number of each option in the questionnaire answer and the final evaluation score;

[0055] The options include: compliant, non-compliant, partially compliant, and not involved.

[0056] A computer-readable storage medium storing a computer program, wherein the computer program, when executed by a processor, implements the steps of a compliance assessment method based on a questionnaire survey.

[0057] An electronic device comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the steps of a compliance assessment method based on a questionnaire survey are implemented.

[0058] Compared with the prior art, the present invention has the following beneficial effects:

[0059] 1. The present invention constructs a network security assessment model based on the assessment standards, such as "GB / T 22239-2019 Information Security Technology Network Security Level Protection Basic Requirements", and improves the construction speed of the network security assessment model, reduces the tester's requirements for network security knowledge reserves, and improves operability.

[0060] 2. The present invention provides a network security assessment model that can automatically generate a questionnaire question list, combine the collected questionnaire results with the network security assessment model, and use a weighted summation method to obtain the final compliance assessment result.

[0061] 3. The network security assessment model provided by the present invention can automatically generate vivid questionnaires, assisting testers to quickly collect questionnaire survey results and obtain network security assessment results, thereby improving the efficiency of compliance assessment. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Other features, objects and advantages of the present invention will become more apparent from the detailed description of non-limiting embodiments made with reference to the following drawings:

[0063] Figure 1 A schematic diagram of the evaluation process provided by the present invention;

[0064] Figure 2 Establish a flow chart for the safety assessment model provided by the present invention;

[0065] Figure 3 A schematic diagram of the network security level provided by the present invention;

[0066] Figure 4 This is a flow chart for calculating the evaluation results provided by the present invention. DETAILED DESCRIPTION

[0067] The present invention is described in detail below in conjunction with specific embodiments. The following embodiments will help those skilled in the art to further understand the present invention, but are not intended to limit the present invention in any form. It should be noted that, for those of ordinary skill in the art, several changes and improvements can also be made without departing from the concept of the present invention. These all belong to the protection scope of the present invention.

[0068] Based on standards such as GB / T 22239-2019 Information Security Technology Network Security Level Protection Basic Requirements, this invention constructs a multi-level and multi-angle network security assessment model. Testers automatically and vividly collect questionnaires based on the network security assessment model, quickly collect questionnaire survey results, and obtain network security assessment results, thereby improving the efficiency of compliance assessment.

[0069] In view of the above-mentioned defects in the prior art, the technical problems to be solved by the present invention are embodied in the following points:

[0070] 1. Based on standards such as "GB / T 22239-2019 Information Security Technology Network Security Level Protection Basic Requirements", users can customize and build a multi-level and multi-angle network security assessment model.

[0071] 2. Generate questionnaire questions based on the constructed security assessment model, and combine the questionnaire results and the network security assessment model to obtain the compliance assessment results.

[0072] like Figure 3 As shown in the figure, the evaluation system has multiple layers of indicators, each layer has multiple evaluation indicators, and network security is evaluated from multiple angles. The entire evaluation consists of multiple layers, and each layer has multiple evaluation indicators.

[0073] like Figure 1 As shown, the present invention proposes a compliance assessment method based on questionnaire survey, including:

[0074] Step S100: Based on the standards such as GB / T 22239-2019 Information Security Technology Network Security Level Protection Basic Requirements, a network security assessment model is constructed. The process is as follows: Figure 2 shown.

[0075] Specifically, in step S100:

[0076] Step S101: Enter the task name, select the evaluation criteria, evaluation level, extended requirements and evaluation object, and query the database to obtain a corresponding candidate list of evaluation indicator items based on the selected evaluation criteria, evaluation level and extended requirements.

[0077] Specifically, according to the evaluation standards and evaluation levels, the extended requirements are selected, and the database is queried to obtain the evaluation index items corresponding to the corresponding standards and levels;

[0078] The evaluation standards include: GB / T 22239-2019;

[0079] The evaluation level is 1-5 in GB / T 22239-2019, with a total of 5 levels;

[0080] The selected extension requirements include: extension requirements for cloud computing and extension requirements for mobile Internet;

[0081] For example Figure 3 There are two alternative lists of evaluation indicators under the Safety General Requirements-Safe Physical Environment-Physical Location selection category. Different evaluation standards, evaluation levels and extended requirements have different numbers and contents of alternative lists of evaluation indicators. The final alternative list of evaluation indicators is all the evaluation indicators corresponding to the selected standard, the selected evaluation level and the selected extended requirements.

[0082] Among them, the evaluation standards include: "GB / T 22239-2019 Information Security Technology - Basic Requirements for Network Security Level Protection" and "GB / T 20282-2006 Information Security Technology - Information System Security Engineering Management Requirements".

[0083] Step S102: Select the required evaluation item from the candidate list of evaluation indicator items, and set the weight of each evaluation item and the veto item label.

[0084] The selection criteria for evaluation items are as follows: based on the aspects of concern in this evaluation and in accordance with the categories in the selected criteria, select alternative indicator items of the corresponding categories as evaluation items.

[0085] The weights of the evaluation items are as follows: general, weight 1; important, weight 2; critical, weight 3;

[0086] The weights of the veto item labels are: non-veto items, weight is 0; veto items, weight is 1;

[0087] The weights of the evaluation items and the labels of the rejected items are set by the user.

[0088] Step S103: Generate a network security assessment model and an assessment task based on the selected assessment item indicators, the weights of the assessment items and the veto item labels, and store the assessment task and model data in a MySQL database.

[0089] Construct a network evaluation model based on the selected evaluation item indicators.

[0090] like Figure 3 As shown in the figure, the network security assessment model has 5 layers. The first layer is network security assessment, the second layer is general security requirements and extended requirements, the third layer is the secure physical environment, the fourth layer is the physical location selection, and the fifth layer is the specific assessment item indicators.

[0091] Based on the selected evaluation indicator items, the evaluation indicator items are converted into survey questions, and the survey questions are automatically generated.

[0092] For example, the evaluation indicator item "The computer room should be located in a building that is earthquake-proof, windproof, and rainproof" will be converted into the survey question "The computer room should be located in a building that is earthquake-proof, windproof, and rainproof".

[0093] Among them, the generated security assessment model has multiple layers, and the five-level indicator hierarchy structure of "GB / T 22239-2019 Information Security Technology Network Security Level Protection Basic Requirements", such as Figure 3 As shown, taking this as an example, the generated security assessment model includes five layers, the second layer is the general security requirements and extended requirements, and the fifth layer is the specific indicators.

[0094] Step S200: Generate corresponding questionnaire questions based on the generated network security assessment model, and collect answers to the questionnaire questions on the questionnaire question filling page.

[0095] Step S201: Select a corresponding assessment task, query the database based on the assessment task information, and obtain a list of questionnaire questions.

[0096] Step S202: Enter the questions in the questionnaire survey and save the answer data of the questionnaire survey questions into the MySQL database.

[0097] There are two ways to save questionnaire answer data:

[0098] The first one is to save the answer data of the questionnaire and allow it to be modified again;

[0099] The second method is to submit and save the questionnaire answer data.

[0100] Specifically, the selection of these two saving methods is changed by the status value of the questionnaire survey. When the status value corresponding to the questionnaire survey is set to 1, the answer data of the questionnaire is saved; when the status value corresponding to the questionnaire survey is set to 2, the answer data of the questionnaire is submitted and saved;

[0101] Specifically, if the status value is repeatedly set to 2, submission is not allowed.

[0102] Step S300: Generate compliance assessment results based on the answers to the questionnaire questions and the security assessment model.

[0103] In other words, based on the cybersecurity assessment model and questionnaire answer data, a compliance assessment is conducted through the expert method to obtain the assessment results.

[0104] Specifically, in step S300:

[0105] The evaluation score is calculated based on the cybersecurity evaluation model and the answers collected from the questionnaire, using a weighted summation method.

[0106] The calculation process is as follows Figure 4 As shown, determine whether the score of the indicator with the veto item label is 0. If the result is yes, the evaluation result is 0; if the result is no, the score of the indicator with the veto item label or the indicator with the veto item label is not 0, then the fourth-level indicator score is calculated based on the weight of the fifth-level evaluation indicator item and the corresponding score collected by the questionnaire survey, the third-level indicator score is calculated based on the fourth-level indicator weight and indicator score, the second-level indicator score is calculated based on the third-level indicator weight and indicator score, and the final compliance evaluation score is calculated based on the second-level indicator weight and indicator score. Select the corresponding evaluation task to obtain the corresponding evaluation result.

[0107] The evaluation results include: the number of each option in the questionnaire answer and the final evaluation score.

[0108] The options include: compliant, non-compliant, partially compliant, and not involved.

[0109] The present invention also provides a compliance assessment system based on questionnaire survey, and the compliance assessment system based on questionnaire survey can be realized by executing the process steps of the compliance assessment method based on questionnaire survey, that is, those skilled in the art can understand the compliance assessment method based on questionnaire survey as a preferred implementation mode of the compliance assessment system based on questionnaire survey.

[0110] A compliance assessment system based on questionnaire survey provided by the present invention includes:

[0111] Module M1: Construct a network security assessment model based on the target assessment criteria;

[0112] Module M2: generating questionnaire questions based on the network security assessment model, and collecting answers to the questionnaire questions;

[0113] Module M3: Based on the network security assessment model and the questionnaire questions and answers, a weighted sum is performed to calculate the assessment result.

[0114] Those skilled in the art know that, in addition to realizing the system and its various devices, modules, and units provided by the present invention in a purely computer-readable program code, it is entirely possible to realize the same functions in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system and its various devices, modules, and units provided by the present invention can be considered as a hardware component, and the devices, modules, and units included therein for realizing various functions can also be regarded as structures within the hardware component; the devices, modules, and units for realizing various functions can also be regarded as both software modules for realizing the method and structures within the hardware component.

[0115] The above describes the specific embodiments of the present invention. It should be understood that the present invention is not limited to the above specific embodiments, and those skilled in the art can make various changes or modifications within the scope of the claims, which does not affect the essence of the present invention. In the absence of conflict, the embodiments of the present application and the features in the embodiments can be combined with each other arbitrarily.

Claims

1. A compliance assessment method based on questionnaire survey, characterized in that: include: Step S1: Construct a network security assessment model based on the target assessment criteria; Step S2: Based on the network security assessment model, generate questionnaire questions and collect answers to the questionnaire questions; Step S3: Based on the network security assessment model and the questionnaire questions and answers, a weighted sum is performed to calculate the assessment result.

2. The compliance assessment method based on questionnaire survey according to claim 1 is characterized in that: In step S1: Step S1.1: Enter the task name, evaluation criteria, evaluation level, extended requirements and evaluation object; and query the database according to the evaluation criteria, evaluation level and extended requirements to obtain a corresponding candidate list of evaluation indicators; Step S1.2: Select the required evaluation items from the candidate list of evaluation indicators, set the weight of each evaluation item and the veto item label; Step S1.3: Generate a network security assessment model and an assessment task based on the assessment item index, the assessment item index weight and the veto item label, and store the assessment task and model data in a MySQL database; In the step S1.1, the evaluation standard includes: GB / T 22239-2019; the evaluation level includes 5 levels of GB / T22239-2019; the extension requirements include: cloud computing extension requirements and mobile Internet extension requirements; The weight of the evaluation item, i.e. the index score of the evaluation item, is set as follows: general, weight 1; important, weight 2; critical, weight 3; The weight of the veto item label, that is, the index score of the veto item label is set as follows: for non-veto items, the weight is 0; for veto items, the weight is 1; The network security assessment model has a total of 5 layers, among which the first layer is network security assessment, the second layer is general security requirements and extended requirements, the third layer is the secure physical environment; the fourth layer is physical location selection, and the fifth layer is assessment item indicators.

3. The compliance assessment method based on questionnaire survey according to claim 2 is characterized in that: In step S2: Step S2.1: Select a task name, query the database according to the task information of the task name, and obtain a list of questionnaire questions; Step S2.2: Based on the questionnaire list, input questionnaire questions, and save the answer data of the questionnaire questions into a database; The database includes: a MySQL database; The questionnaire survey questions are obtained by converting the evaluation item indicators; In step S2.2, the answer data is saved corresponding to the two questionnaire status values; when the questionnaire status value is set to 1, the answer data is saved; when the questionnaire status value is set to 2, the answer data is submitted and saved; when the questionnaire status value is repeatedly set to 2, it is not submitted.

4. The compliance assessment method based on questionnaire survey according to claim 3 is characterized in that: In step S3: Step S3.1: Calculate an evaluation score based on the network security evaluation model and the answer data; Step S3.2: Generate an evaluation result through an expert method according to the evaluation score; In the step S3.1: determine whether the score of the indicator with the veto item label is 0, and if the result is yes, the evaluation score is 0, and the process ends; If the answer is no, then weighted sum of the index scores of each layer of the network security assessment model is performed to obtain the assessment score; The evaluation results include: the number of each option in the questionnaire answer and the final evaluation score; The options include: compliant, non-compliant, partially compliant, and not involved.

5. A compliance assessment system based on questionnaire survey, characterized in that: include: Module M1: Construct a network security assessment model based on the target assessment criteria; Module M2: generating questionnaire questions based on the network security assessment model, and collecting answers to the questionnaire questions; Module M3: Based on the network security assessment model and the questionnaire questions and answers, a weighted sum is performed to calculate the assessment result.

6. The compliance assessment system based on questionnaire survey according to claim 5 is characterized in that: In the module M1: Module M1.1: Enter the task name, evaluation criteria, evaluation level, extended requirements and evaluation object; and query the database according to the evaluation criteria, evaluation level and extended requirements to obtain a corresponding candidate list of evaluation indicators; Module M1.2: Select the required evaluation items from the list of evaluation indicator options, set the weight of each evaluation item and the veto item label; Module M1.3: Generate a network security assessment model and an assessment task based on the assessment item index, the assessment item index weight and the veto item label, and store the assessment task and model data in a MySQL database; In the module M1.1, the evaluation standards include: GB / T 22239-2019; the evaluation levels include the five levels of GB / T22239-2019; the extended requirements include: cloud computing extended requirements and mobile Internet extended requirements; The weight of the evaluation item, i.e. the index score of the evaluation item, is set as follows: general, weight 1; important, weight 2; critical, weight 3; The weight of the veto item label, that is, the index score of the veto item label is set as follows: for non-veto items, the weight is 0; for veto items, the weight is 1; The network security assessment model has a total of 5 layers, among which the first layer is network security assessment, the second layer is general security requirements and extended requirements, the third layer is the secure physical environment; the fourth layer is physical location selection, and the fifth layer is assessment item indicators.

7. The compliance assessment system based on questionnaire survey according to claim 6 is characterized in that: In the module M2: Module M2.1: Select a task name, query the database according to the task information of the task name, and obtain a list of questionnaire questions; Module M2.2: Based on the questionnaire list, input questionnaire questions, and save the answer data of the questionnaire questions into a database; The database includes: a MySQL database; The questionnaire survey questions are obtained by converting the evaluation item indicators; In the module M2.2, the saving of the answer data corresponds to the two questionnaire status values; when the questionnaire status value is set to 1, the answer data is saved; when the questionnaire status value is set to 2, the answer data is submitted and saved; when the questionnaire status value is repeatedly set to 2, it is not submitted.

8. The compliance assessment system based on questionnaire survey according to claim 7 is characterized in that: In the module M3: Module M3.1: Calculate an assessment score based on the network security assessment model and the answer data; Module M3.2: Generate evaluation results through expert method based on the evaluation scores; In the module M3.1: determine whether the score of the indicator with the veto item label is 0, and if the result is yes, the evaluation score is 0, and the process ends; If the answer is no, then weighted sum of the index scores of each layer of the network security assessment model is performed to obtain the assessment score; The evaluation results include: the number of each option in the questionnaire answer and the final evaluation score; The options include: compliant, non-compliant, partially compliant, and not involved.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the compliance assessment method based on questionnaire survey described in any one of claims 1 to 4 are implemented.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the computer program is executed by a processor, the steps of the compliance assessment method based on questionnaire survey described in any one of claims 1 to 4 are implemented.

Images