Full-link data security risk assessment method and system

Abstract

The invention relates to the technical field of data security, in particular to a full-link data security risk assessment method and system, and the method comprises the following steps: S10, setting a data collection mode; s20, adding the task scheduling center into a task queue; s30, the acquisition engine reads the task queue and executes information acquisition; s40, storing an information acquisition result into an acquisition result information base; s50, the management sub-board module performs overall analysis in combination with the knowledge base; s60, forming a data security check result; the method not only meets the requirement of non-invasive inspection, but also can carry out risk assessment and compliance assessment on data transmission and storage links stored in a database, a host and a file server and transmitted in a network; according to the method, data security risks in a network environment can be effectively found, targeted rectification suggestions are given, and a user is helped to continuously improve the data security construction level.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a full-link data security risk assessment method and system. Background Art

[0002] In the prior art, the patent with announcement number CN105528275A and name "Database Security Check Method" describes that Winscp is integrated in the macro tool of the Excel document, and the configuration file in the target host that needs to perform the database security check is read through Winscp, and the shell script of Winscp is uploaded to the target host according to the information in the configuration file; the shell script is executed on the target host, and the operation data of the database is extracted through the shell script, and the operation data is saved as a text file according to the preset format, and the operation data in the text file is screened to obtain the operation and maintenance data reflecting the health status of the database operation, and the parameters required to execute the corresponding functions are screened from the operation and maintenance data according to the functions of the database; the parameters returned by the target host are received through Winscp, and the parameters are imported into the Excel table, and the security performance of the database is checked according to the parameters in the Excel table. The above-mentioned patent application does not involve detection contents such as illegal storage of sensitive information and illegal transmission of data, and cannot meet the data security inspection needs under the current situation.

[0003] Announcement number CN108133148B, patent name "A full-link data security risk assessment method and system" describes that the data security acquisition module calls the adaptation resources in the acquisition terminal to collect data, and performs trusted authentication on the acquisition terminal; when the trusted authentication of the acquisition terminal passes, the collected data is sent to the data preprocessing module; the data preprocessing module normalizes the received data to be checked, and classifies and grades the normalized data for secure storage; the data security inspection module calls the security inspection submodule that matches the preset inspection mode, and performs a security inspection on the data to be inspected according to the called security inspection submodule to obtain the security inspection result.

[0004] The above-mentioned "CN105528275A Database Security Inspection Method" does not involve detection contents such as illegal storage of sensitive information and illegal data transmission, and cannot meet the data security inspection needs under the current situation. "CN108133148B A full-link data security risk assessment method and system" is deployed in the form of SDK for structured data and needs to be embedded in the business system. It cannot be used for temporary inspections of superiors on subordinates or regulatory departments on regulated departments, as it is impossible to embed SDK into the business system in advance.

[0005] The deployment of structured data in the form of SDK needs to be embedded in the business system, which is not applicable to the inspection of subordinates by superiors or the inspection of the regulated departments by regulatory departments. Therefore, how to effectively carry out data security risk assessment and discover existing data security risks in advance has become the key to carrying out data security construction. Summary of the invention

[0006] The purpose of the present invention is to provide a full-link data security risk assessment method and system in view of the defects and shortcomings of the prior art.

[0007] The full-link data security risk assessment method described in the present invention adopts the following steps: S10: Set data collection mode: Collecting information stored in a database and a file server or a terminal to form a list of stored data asset information, collecting through a first active information collection method, a first manual upload method, or one or more collection methods to perform data collection activities; S20: The task scheduling center joins the task queue: Collecting data asset flow information in the network, data collection activities can be performed through a second active information collection, a second passive information collection, a second manual upload method, through one of the collection methods or a combination of the collection methods; also includes a data asset flow list between the application and the database, marked as a database asset flow list; S30: The collection engine reads the task queue and performs information collection; S40: Storing the collected information results in a collection result information database: Aggregate and store data asset information lists, data asset release lists, data asset flow lists, and application asset lists to form a collection result information database; S50: The management sub-board module combines with the knowledge base for overall analysis: the data storage asset information list, data asset release list, data asset flow list, and application asset list data are processed according to the timeline, data feature combing, and data flow direction to form data asset data flow details from client-application request / response, application-database request / response divided by request, and analyzed in combination with the risk knowledge base to form a risk assessment conclusion.

[0008] S60: Forming data security inspection results: Reading data from the collection result information library in step S40 and integrating and analyzing it with the compliance knowledge base to form data security compliance inspection results, summarizing the judgment results of data association analysis and other inspection results entered by the user in the system, forming the final inspection results, and forming an inspection result report.

[0009] A full-link data security risk assessment system includes a task management module, a detection dispatch center module, an information collection module, a collection result information database, a correlation analysis module, a knowledge base module, and a system management module; One end of the detection and dispatch center module is connected to the task management module, the other end of the detection and dispatch center module is connected to the information collection module, the other end of the information collection module is connected to the collection result information database, the other end of the collection result information database is connected to the correlation analysis module, the other end of the correlation analysis module is connected to the knowledge base module, and the other end of the knowledge base module is connected to the system management module; wherein the knowledge base module includes but is not limited to a compliance template library, a vulnerability library, a threat intelligence library, a data classification rule library, a weak password dictionary library, an API risk rule library, and an encryption algorithm identification rule library.

[0010] Furthermore, the first active information collection in step S10 includes but is not limited to network asset detection and storage data information collection, and data asset information is collected by actively sending network data packets and then analyzing the response data.

[0011] Furthermore, the first manual upload method in step S10 refers to uploading existing material information in the form of files, such as documents, systems, and normative materials, and forming a data asset information list through file identification and standardized analysis of file content; the asset information list includes a database asset list and a file asset list.

[0012] Furthermore, the second active information collection in step S20 includes collecting content published on a designated target website to form a data asset publishing list.

[0013] Furthermore, the second passive information collection method in step S20 refers to collecting data by analyzing passively received network traffic, including real-time collection of network traffic and manually uploaded network traffic packets, and analyzing the IP, port, protocol, data and other contents in the network traffic to form a data asset flow list.

[0014] Furthermore, the second manual upload method in step S20 refers to uploading an existing network traffic package in the form of a file, analyzing the IP, port, protocol, data and other contents in the network traffic to form a data asset flow list. The data asset flow list includes data asset flow lists between applications, between applications and clients, and between applications and databases, which are marked as application data asset flow lists.

[0015] Furthermore, the risk assessment conclusion in step S50 is analyzed by the following steps: For the data collection information generated by the uploaded files, the natural language analysis engine forms semantic analysis results according to the semantic analysis rules. The collection result information is collected uniformly through the collection result information database, and the special data association analysis module is combined with the knowledge base for integrated analysis. Among them, the data association analysis module is a module with risk assessment calculation function, which can automatically classify the semantic analysis results and collection result information and combine various basic libraries in the knowledge base to form risk assessment results; Among them, the knowledge base includes but is not limited to a compliance check template library, a vulnerability library, a threat intelligence library, a data classification rule library, a weak password dictionary library, an API risk rule library, and a network channel encryption algorithm identification rule library.

[0016] The integrated analysis includes: (1) matching the data collection results, semantic analysis results and the compliance judgment method in the compliance inspection template library to determine whether a certain inspection item complies; (2) Match the data collection results with the vulnerability features in the vulnerability database to determine whether a certain vulnerability exists; (3) Match the data collection results with the intelligence rules in the threat intelligence library to determine whether the visitor and the file are from a hacker organization or a malicious IP address; (4) Match the data collection results with the data classification rule base to mark the sensitivity level and type of the data; (5) Match the data collection results with the weak password database to determine whether a certain service has a weak password; (6) Match the data collection results with the API risk rule library to determine whether a certain API poses a risk; (7) Match the data collection results with the network channel encryption algorithm identification rule base to determine whether the network channel is an encrypted channel and whether it uses a national encryption algorithm; (8) Record the data asset flow list and organize it by time sequence and type to form a complete record of application access behavior - application response - database access, which serves as the basic data for behavior tracing.

[0017] The beneficial effects of the present invention are as follows: a full-link data security risk assessment method and system described in the present invention adopts a variety of active and passive non-invasive inspection means, and realizes the collection of data and status of multiple nodes of the target system through the scheduling of the task scheduling center; the collected data is combined with the risk knowledge base through the data association analysis module to form a full-link data security risk assessment result, and then integrated and analyzed in combination with the compliance knowledge base to form a security compliance assessment result for the target network environment; it not only meets the needs of non-invasive inspection, but also can perform risk assessment and compliance assessment on data transmission and storage links stored in databases, hosts, file servers and transmitted in the network; it can effectively discover data security risks in the network environment and give targeted rectification suggestions, helping users to continuously improve the level of data security construction. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present application, but do not constitute an improper limitation of the present invention. In the drawings: Figure 1 It is a topological schematic diagram of the data security checking method of the present invention; Figure 2 A schematic diagram of the framework of the data security system of the present invention. DETAILED DESCRIPTION

[0019] The present invention will be described in detail below in conjunction with the accompanying drawings and specific embodiments, wherein the illustrative embodiments and descriptions are only used to explain the present invention but are not intended to limit the present invention.

[0020] like Figure 1 As shown, a full-link data security risk assessment method and system described in this specific implementation manner adopts the following steps: S10: Set data collection mode: Collecting information stored in a database and a file server or a terminal to form a list of stored data asset information, collecting through a first active information collection method, a first manual upload method, or one or more collection methods to perform data collection activities; S20: The task scheduling center joins the task queue: Collecting data asset flow information in the network, data collection activities can be performed through a second active information collection, a second passive information collection, a second manual upload method, through one of the collection methods or a combination of the collection methods; also includes a data asset flow list between the application and the database, marked as a database asset flow list; S30: The collection engine reads the task queue and performs information collection; S40: Storing the collected information results in a collection result information database: Aggregate and store data asset information lists, data asset release lists, data asset flow lists, and application asset lists to form a collection result information database; S50: The management sub-board module combines with the knowledge base for overall analysis: the data of the storage data asset information list, data asset release list, data asset flow list, and application asset list are processed according to the timeline, data feature combing, and data flow direction to form data flow details of data assets from client-application request / response, application-database request / response divided by request, and analyzed in combination with the risk knowledge base to form risk assessment conclusions; S60: Forming data security inspection results: Reading data from the collection result information library in step S40 and integrating and analyzing it with the compliance knowledge base to form data security compliance inspection results, summarizing the judgment results of data association analysis and other inspection results entered by the user in the system, forming the final inspection results, and forming an inspection result report.

[0021] In the present invention, the first active information collection in step S10 includes but is not limited to network asset detection and storage data information collection, and the data asset information is collected by actively sending network data packets and then analyzing the response data.

[0022] In the present invention, the first manual upload method of collection in step S10 refers to uploading existing material information in the form of files, such as documents, systems, and normative materials, and forming a data asset information list through file identification and standardized analysis of file content; the asset information list includes a database asset list and a file asset list.

[0023] In the present invention, the second active information collection includes collecting the content published by the designated target website to form a data asset publication list.

[0024] In the present invention, the second passive information collection method in step S20 refers to collecting data by analyzing passively received network traffic, including real-time collection of network traffic and manually uploaded network traffic packets, and analyzing the IP, port, protocol, data and other contents in the network traffic to form a data asset flow list.

[0025] In the present invention, the second manual upload method in step S20 refers to uploading an existing network traffic package in the form of a file, analyzing the IP, port, protocol, data and other contents in the network traffic to form a data asset flow list. The data asset flow list includes data asset flow lists between applications, between applications and clients, and between applications and databases, which are marked as application data asset flow lists.

[0026] In the present invention, the risk assessment conclusion in step S50 is analyzed by the following steps: In the present invention, for the data collection information formed by the uploaded files, a semantic analysis result is formed according to the semantic analysis rules by the natural language analysis engine, and the information of the collection result is uniformly collected through the collection result information library, and the special data association analysis module is combined with the knowledge base for integrated analysis; Among them, the data association analysis module is a module with risk assessment calculation function, which can automatically classify the semantic analysis results and collection result information and combine various basic libraries in the knowledge base to form risk assessment results; Among them, the knowledge base includes but is not limited to a compliance check template library, a vulnerability library, a threat intelligence library, a data classification rule library, a weak password dictionary library, an API risk rule library, and a network channel encryption algorithm identification rule library.

[0027] The integrated analysis includes: (1) matching the data collection results, semantic analysis results and the compliance judgment method in the compliance inspection template library to determine whether a certain inspection item complies; (2) Match the data collection results with the vulnerability features in the vulnerability database to determine whether a certain vulnerability exists; (3) Match the data collection results with the intelligence rules in the threat intelligence library to determine whether the visitor and the file are from a hacker organization or a malicious IP address; (4) Match the data collection results with the data classification rule base to mark the sensitivity level and type of the data; (5) Match the data collection results with the weak password database to determine whether a certain service has a weak password; (6) Match the data collection results with the API risk rule library to determine whether a certain API poses a risk; (7) Match the data collection results with the network channel encryption algorithm identification rule base to determine whether the network channel is an encrypted channel and whether it uses a national encryption algorithm; (8) Record the data asset flow list and organize it by time sequence and type to form a complete record of application access behavior - application response - database access, which serves as the basic data for behavior tracing.

[0028] like Figure 2 As shown, a full-link data security risk assessment system includes a task management module, a detection scheduling center module, an information collection module, a collection result information database, a correlation analysis module, a knowledge base module, and a system management module; One end of the detection and dispatch center module is connected to the task management module, the other end of the detection and dispatch center module is connected to the information collection module, the other end of the information collection module is connected to the collection result information database, the other end of the collection result information database is connected to the correlation analysis module, the other end of the correlation analysis module is connected to the knowledge base module, and the other end of the knowledge base module is connected to the system management module; wherein the knowledge base module includes but is not limited to a compliance template library, a vulnerability library, a threat intelligence library, a data classification rule library, a weak password dictionary library, an API risk rule library, and an encryption algorithm identification rule library.

[0029] In the present invention, the task management module is a management module for functions such as creation and deletion of inspection tasks, and has the functions of guiding the inspection process and generating a task ID as a unique identifier.

[0030] In the present invention, the information collection module is a technical detection execution module, which includes multiple information collection engines each having a different data collection function and having the function of executing corresponding technical detection operations according to the instructions of the detection scheduling center module.

[0031] In the present invention, the collection result information database is a collection and management module for the information collected by the information collection module, and has the function of classifying and summarizing the collection results of the information collection module.

[0032] In the present invention, the knowledge base module is a module that provides analysis rules for association analysis, and has a compliance check template library, a vulnerability library, a threat intelligence library, a data classification rule library, a weak password dictionary library, an API risk rule library, a network channel encryption algorithm identification rule library, etc.

[0033] In the present invention, the system management module is a basic support module of the system, providing functions such as user management, log management, and system configuration. Its functional design is as follows: the user creates a data security inspection task and task ID and sets the inspection content through the task management module; the inspection content is set to obtain data 1 by collecting basic information of the inspected target unit through a preset value questionnaire, and the task management module automatically generates compliance inspection items according to the content of data 1.

[0034] In the present invention, the detection scheduling center module adds the detection task to the task queue according to the detection content, and the information collection module reads the task information of the task queue and executes the information collection task according to the task content; the information collection task includes active information collection tasks and passive information collection tasks; the information collection module collects information and stores it in the collection result information library; Among them, active information collection tasks include network asset detection, network asset vulnerability detection, and storage data information collection. Among them, passive information collection tasks are network traffic information collection, including IP, port, protocol, and data content.

[0035] In the present invention, the collaboration between the task scheduling center and the information collection module can be flexibly expanded according to the inspection requirements. For example, by connecting multiple information collection modules at the same time through a task scheduling center, multiple information collection modules can be executed in parallel, thereby improving the efficiency of information collection.

[0036] In the present invention, the association analysis module obtains the corresponding data collection results in the collection result information library according to the task ID and integrates and analyzes the rules in the knowledge base module to form the following judgment results: (1) Check whether the item meets the judgment result; (2) Whether a vulnerability exists; (3) Whether the file comes from a malicious IP or hacker organization; (4) Data sensitivity level and data type determination results; (5) Determination result of whether the service has weak passwords; (6) Whether there are any risk assessment results for the API; (7) The judgment result of whether the network channel is encrypted and whether it is a national secret encryption algorithm; (8) Basic database for behavior tracing.

[0037] This system provides behavior tracing query and analysis functions, and can trace specific time, specific IP, specific account, and specific data through IP, time, and data. The above results are summarized to form a data security inspection result report.

[0038] In the present invention, the second active information collection, the second passive information collection, and the second manual upload mode can be flexibly set according to the actual inspection scene requirements. A single collection can adopt one of the information collection modes, or it can be executed simultaneously or in the order of preset values.

[0039] In the present invention, multiple information collection modules are deployed to collect information simultaneously, thereby improving the efficiency of information collection. Figure 2 As shown, there are several information collection modules, engine 1 to engine N.

[0040] In the present invention, the information collection method can be effectively organized to realize various automatic organization methods of information collection, such as obtaining the existing IP asset information in the network through the passive information collection method; after obtaining the IP asset information, the task scheduling center issues the active information collection task for the IP.

[0041] The advantages of the present invention are as follows: (1) A variety of active and passive non-invasive inspection methods are used. In actual application, there is no need to invade the user's business system, that is, the user's business system does not need to be modified to carry out data security inspections. This avoids the impact of invasive inspection methods on system stability and greatly reduces the operational complexity of data security inspections.

[0042] (2) With a built-in rich knowledge base and flexible task scheduling algorithm, the number of information collection modules can be flexibly configured according to on-site inspection requirements, which can effectively improve the execution efficiency of data security inspections. (3) In addition to checking whether there are security vulnerabilities in the database or host, it can also analyze the collected database, table, field and data sampling information or sample files to determine whether there is sensitive information in the database or file, thereby discovering the phenomenon of illegal data storage.

[0043] (4) Provides behavior tracing query and analysis functions, which can trace the specific time, specific IP, specific account, and specific data through IP, time, and data.

[0044] The above description is only a preferred embodiment of the present invention, so all equivalent changes or modifications made according to the features and principles described in the scope of the patent application of the present invention are included in the scope of the patent application of the present invention.

Claims

1. A full-link data security risk assessment method, characterized by: Use the following steps: S10: Set data collection mode: Collecting information stored in a database and a file server or a terminal to form a list of stored data asset information, collecting through a first active information collection method, a first manual upload method, or one or more collection methods to perform data collection activities; S20: The task scheduling center joins the task queue: Collecting data asset flow information in the network, data collection activities can be performed through a second active information collection, a second passive information collection, a second manual upload method, through one of the collection methods or a combination of the collection methods; also includes a data asset flow list between the application and the database, marked as a database asset flow list; S30: The collection engine reads the task queue and performs information collection; S40: Storing the collected information results in a collection result information database: Aggregate and store data asset information lists, data asset release lists, data asset flow lists, and application asset lists to form a collection result information database; S50: Data association analysis module is combined with knowledge base for integrated analysis: Among them, the data association analysis module is a module with risk assessment calculation function, which can automatically classify the semantic analysis results and collection result information and combine various basic libraries in the knowledge base to form risk assessment results; The knowledge base includes, but is not limited to, a compliance check template library, a vulnerability library, a threat intelligence library, a data classification rule library, a weak password dictionary library, an API risk rule library, and a network channel encryption algorithm identification rule library; The integrated analysis includes: (1) matching the data collection results, semantic analysis results and the compliance judgment method in the compliance inspection template library to determine whether a certain inspection item complies; (2) Match the data collection results with the vulnerability features in the vulnerability database to determine whether a certain vulnerability exists; (3) Match the data collection results with the intelligence rules in the threat intelligence library to determine whether the visitor and the file are from a hacker organization or a malicious IP address; (4) Match the data collection results with the data classification rule base to mark the sensitivity level and type of the data; (5) Match the data collection results with the weak password database to determine whether a certain service has a weak password; (6) Match the data collection results with the API risk rule library to determine whether a certain API poses a risk; (7) Match the data collection results with the network channel encryption algorithm identification rule base to determine whether the network channel is an encrypted channel and whether it uses a national encryption algorithm; (8) Record the data asset flow list and sort it by time sequence and type to form a complete record of application access behavior - application response - database access, which serves as the basic data for behavior tracing; S60: Forming data security inspection results: Reading data from the collection result information library in step S40 and integrating and analyzing it with the compliance knowledge base to form data security compliance inspection results, summarizing the judgment results of data association analysis and other inspection results entered by the user in the system, forming the final inspection results, and forming an inspection result report.

2. A full-link data security risk assessment method according to claim 1, characterized in that: The first active information collection in step S10 includes but is not limited to network asset detection and storage data information collection, and the data asset information is collected by actively sending network data packets and then analyzing the response data.

3. A full-link data security risk assessment method according to claim 1, characterized in that: The first manual upload method in step S10 refers to uploading existing material information in the form of files, such as documents, systems, and normative materials, and forming a data asset information list through file identification and standardized analysis of file content; the asset information list includes a database asset list and a file asset list.

4. A full-link data security risk assessment method according to claim 1, characterized in that: The second active information collection in step S20 includes collecting the content published by the designated target website to form a data asset publication list.

5. A full-link data security risk assessment method according to claim 1, characterized in that: The second passive information collection method in step S20 refers to collecting data by analyzing passively received network traffic, including real-time collection of network traffic and manually uploaded network traffic packets, and analyzing the IP, port, protocol, data and other contents in the network traffic to form a data asset flow list.

6. A full-link data security risk assessment method according to claim 1, characterized in that: The second manual upload method in step S20 refers to uploading existing network traffic packages in the form of files, analyzing the IP, port, protocol, data and other contents in the network traffic to form a data asset flow list; the data asset flow list includes data asset flow lists between applications, between applications and clients, and between applications and databases, marked as application data asset flow lists.

7. A full-link data security risk assessment method according to claim 1, characterized in that: Step S50 also provides a behavior tracing query and analysis function, which can trace the specific time, specific IP, specific account, and specific data through IP, time, and data.

8. A full-link data security risk assessment system, characterized by: It includes task management module, detection dispatch center module, information collection module, collection result information database, correlation analysis module, knowledge base module and system management module; One end of the detection and dispatch center module is connected to the task management module, the other end of the detection and dispatch center module is connected to the information collection module, the other end of the information collection module is connected to the collection result information database, the other end of the collection result information database is connected to the correlation analysis module, the other end of the correlation analysis module is connected to the knowledge base module, and the other end of the knowledge base module is connected to the system management module; wherein the knowledge base module includes but is not limited to a compliance template library, a vulnerability library, a threat intelligence library, a data classification rule library, a weak password dictionary library, an API risk rule library, and an encryption algorithm identification rule library.

Images