Enterprise security capability assessment method and device, electronic equipment and storage medium

Abstract

The invention relates to an enterprise security capability assessment method and device, electronic equipment and a storage medium. The enterprise safety capability assessment method comprises the following steps: S1, adapting a capability maturity model to an informatization environment of a to-be-assessed object enterprise; selecting an evaluation domain and a capability component matched with the evaluation object in the model; s2, extracting structured data required by the model from a unit current situation result of the evaluated enterprise, wherein the structured data comprises management factor data and technical factor data; and S3, performing network security capability maturity evaluation, assigning scores to the technical capability and the management capability of the evaluated enterprise unit according to gradients, comparing the scores with a capability component, calculating a maturity score of an evaluation domain, and outputting a security capability maturity level to which the evaluated enterprise belongs. According to the method for evaluating the safety capability of the enterprise, the level of the safety capability of the enterprise can be quantitatively defined, and a basis is provided for the direction of safety capability construction.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a method, device, electronic device and storage medium for assessing the security capability of an enterprise based on a maturity model. Background Art

[0002] The enterprise's safety capability assessment is of great significance in preventing accidents, ensuring employee safety, complying with legal and regulatory requirements, improving enterprise management level, and enhancing information security.

[0003] At present, there is no quantifiable system for the quantitative assessment of enterprise security capabilities, which cannot objectively reflect the level and future direction of enterprise security capability construction.

[0004] With the development of technology, relatively complete capability maturity models such as C2M2, SSE-CMM, and NICE have emerged internationally, and relevant policy bases and evaluation rules for data security capabilities, software supply chain evaluation, and level protection evaluation have also emerged in China. At present, there are many mainstream capability maturity models, but they all have their own fields of use. Based on some common capability maturity models, data maturity, software maturity and other models have evolved, but there is currently no corresponding model system for the maturity assessment of enterprise security capabilities.

[0005] Therefore, it is urgent to develop a scenario that can apply maturity models to enterprise security capability assessment. After in-depth research on the uses and indicator domains of various current models, the relevant concepts of the System Security Engineering Maturity Model SSE-CMM (Systems Security Engineering Capability Maturity Model) that provides a unified standard for evaluating the security engineering capabilities of organizations are selected to build a security maturity model evaluation system to quantify enterprise security capabilities and provide a basis for the direction of enterprise security capability construction. Summary of the invention

[0006] The technical problem to be solved by the present invention is that there is no quantifiable system for the quantitative evaluation of enterprise security capabilities, and in the construction of enterprise security capabilities, it cannot objectively reflect the level and future direction of enterprise security capability construction.

[0007] In order to solve the above technical problems, according to one aspect of the present invention, a method for evaluating the security capability of an enterprise is provided, which includes the following steps: S1, adapting the capability maturity model to the information environment of the target enterprise to be evaluated, determining the information environment contained in the evaluated enterprise unit, the information environment including the network architecture and system composition of the evaluated unit; analyzing the network security threats and risk points faced by the evaluated unit; selecting the evaluation domain and capability components in the model that are adapted to the evaluation object; adjusting the evaluation dimensions, refining the evaluation indicators, and setting appropriate weights; S2, extracting the structured data required by the model from the unit status results of the evaluated enterprise, the structured data including management factor data and technical factor data, the management factor data is used to reflect the management capability of the evaluated enterprise unit, and the technical factor data is used to reflect the technical capability of the evaluated enterprise unit, wherein the management capability includes the status of personnel organization, management system, and management process, wherein the personnel configuration is evaluated to see whether it meets the network security needs, whether it has an effective network security organizational structure, and whether the organization has an effective network security organizational structure. Whether an effective division of responsibilities and responsibility matrix have been established, and the personnel organization of the assessed unit is analyzed; by evaluating whether the management system is complete and whether it covers all aspects of network security, check the implementation of management systems including operation and maintenance security management systems, operation security management systems, and personnel security management systems, and check the management system of the assessed unit; comprehensively sort out the business processes, identify key business links and potential security risk points, and sort out the business processes of the assessed unit; among them, technical capabilities include the current status of the operation and maintenance side and the operation side, and the methods for obtaining technical factor data include on-site acquisition, performing penetration tests, vulnerability scanning, and verifying the effectiveness of security protection; S3, conduct a network security capability maturity assessment, first define multiple enterprise capability maturity levels, obtain structured data on the current status of the assessed enterprise according to the method of step S2, assign points to the technical capabilities and management capabilities of the assessed enterprise units according to the gradient, and then compare the structured data with the capability components, calculate the maturity score of the assessment domain, and output the security capability maturity level of the assessed enterprise.

[0008] According to an embodiment of the present invention, step S3 may include the following steps: S31, based on the SSE-CMM capability maturity model, define the security maturity of the enterprise into multiple levels; S32, assign points to the technical capabilities and management capabilities of the assessed enterprise unit according to the gradient; S33, compare the structured data with the capability components, check the maturity level of the capability components according to the degree of satisfaction, and calculate the maturity score of the assessment domain; S34, formulate capability grading principles, wherein, when the management capabilities and technical capabilities reach the same level, such as any level from level one to level five, the overall network security maturity of the enterprise will be recognized as this level; when the gap between the technical capabilities and management capabilities is large, the management capabilities are given priority for overall capability grading, reflecting the importance of management capabilities in network security; S35, determine the network security maturity level of the assessed unit based on the capability grading principles and the maturity scores of each assessment domain.

[0009] According to an embodiment of the present invention, in step S32, management capability can be scored 50 points, with a gradient of 10 points for each level; management capability is divided into 3 secondary indicators, among which personnel organization is scored 15 points, management system is scored 15 points, and management process is scored 20 points; personnel organization, management system, and management process are divided into 10 evaluation domains, and the evaluation content includes the clarity of organizational structure, job responsibilities, and control processes; the standardization of the formulation, release, and revision of relevant process systems; the effectiveness of organizational structure operation, communication and coordination, requirements, and process implementation; technical capability is scored 150 points, with a gradient of 30 points for each level; technical capability is divided into 2 secondary indicators, among which the operation and maintenance side is scored 115 points, and the operation side is scored 35 points; the operation and maintenance side and the operation side are divided into 11 tertiary indicator items and 32 evaluation domains, and the evaluation content includes the use of technical means and product tools to solidify the execution of security capability requirements and system processes; the automation and continuous support capabilities for network and information security work; and the prevention and response capabilities for network and information security risks.

[0010] According to an embodiment of the present invention, in step S32, the weights of the evaluation items under the three-level indicators are determined. The weights of the evaluation items can be determined by using the Analytic Hierarchy Process (AHP). Experts are invited to compare the importance of the evaluation items under the same three-level indicators in pairs to form a judgment matrix, where a ij is the result of comparing the importance of element i and element j. The judgment matrix satisfies The nature of; among them, when factor i is equally important than factor j, a ij The value of is 1; factor i is slightly more important than factor j if a ij The value of is 3; when factor i is significantly more important than factor j, a ij The value of is 5; when factor i is more important than factor j, a ijThe value of is 7; when factor i is more important than factor j, a ij The value of is 9; among them, the intermediate values ​​of the adjacent judgments of factor i and factor j include 2, 4, 6, and 8; the judgment matrix must undergo a consistency test. If CI A <0.1, CR A <0.1, it indicates that the judgment matrix passes the consistency test. If the calculation result does not meet the requirements, the judgment matrix needs to be rebuilt. The calculation method of CI is as follows: λ is the maximum characteristic root of the judgment matrix, and n is the order of the judgment matrix.

[0011]

[0012] The matrix that passes the consistency test can be used to calculate the weight value of each evaluation item; the judgment matrix is ​​normalized by column, and then the average value of each row after normalization is obtained to obtain the weight value of each evaluation item under the three-level indicator.

[0013] According to an embodiment of the present invention, in step S31, the multiple levels of security maturity can be 5 levels, including: basic protection level, standard construction level, risk management level, intelligent defense level, and continuous optimization level.

[0014] According to an embodiment of the present invention, in step S34, each evaluation item may be provided with a five-level scoring standard, with a total score of five points; during the evaluation process, the score is given according to the actual performance of the evaluated unit in the evaluation item; if the evaluated unit fails to meet the set requirements on a certain evaluation item, a corresponding point will be deducted from the total score, and finally the level corresponding to the evaluation item will be determined based on the score.

[0015] According to an embodiment of the present invention, the capability maturity model adopted in step S1 may be the SSE-CMM capability maturity model; wherein, in step S2, on-site acquisition may be carried out, and interview materials and questionnaires may be customized according to the actual situation of the assessed unit, and the network security status results of the assessed unit may be obtained by reviewing materials, interviews, on-site surveys, and questionnaires, and the structured data required for model evaluation may be obtained; wherein, the execution of penetration testing may be carried out by professional scanning work and manual detection confirmation methods to perform network security white box and black box penetration testing evaluation work under the authorization and supervision of the assessed customer; wherein, the evaluation process of white box penetration testing includes: source code audit evaluation, baseline configuration verification evaluation, and vulnerability evaluation; black box penetration testing The assessment process is: through various professional scanning tools, the routing paths, open services and ports, file storage directories and other information of system-related equipment are mined, and the security vulnerabilities in the application code are detected; wherein, the vulnerability scanning can use the vulnerability scanner to perform automated vulnerability scanning on the application system of the assessed unit to quickly identify common security vulnerabilities and configuration errors; the scanning results are compared and verified with the vulnerabilities found in the penetration test; wherein, verifying the effectiveness of security protection can be used to evaluate the security protection measures deployed by the assessed unit, including firewalls, intrusion detection systems, and anti-virus software, and their actual effects; by trying to bypass these protection measures or using their known vulnerabilities for attack testing, verify whether they can effectively resist external threats.

[0016] According to a second aspect of the present invention, there is provided a device for evaluating the security capability of an enterprise, which comprises: a capability maturity model adaptation module, which is used to adapt the capability maturity model to the information environment of the object enterprise to be evaluated, determine the information environment contained in the evaluated enterprise unit, and the information environment includes the network architecture and system composition of the evaluated unit; analyze the network security threats and risk points faced by the evaluated unit; select the evaluation domain and capability components in the model that are adapted to the evaluation object; adjust the evaluation dimension, refine the evaluation index, and set appropriate weights; obtain structured data module, which is used to extract the structured data required by the model from the unit status results of the evaluated enterprise, and the structured data includes management factor data and technical factor data, and the management factor data is used to reflect the management capability of the evaluated enterprise unit, and the technical factor data is used to reflect the technical capability of the evaluated enterprise unit, wherein the management capability includes the status of personnel organization, management system, and management process, wherein the personnel organization of the evaluated unit is analyzed by evaluating whether the personnel configuration meets the network security requirements, whether it has an effective network security organizational structure, and whether the organization has established an effective division of responsibilities and responsibility matrix; by evaluating whether the management system is perfect and whether it covers all aspects of network security, check whether the operation and maintenance security management system is complete, ... The implementation of the management systems of the system, operation safety management system, and personnel safety management system, and the management system of the assessed unit shall be checked; the business process shall be comprehensively sorted out, key business links and potential security risk points shall be identified, and the business process of the assessed unit shall be sorted out; among them, the technical capabilities include the current status of the operation and maintenance side and the operation side, and the methods for obtaining technical factor data include on-site acquisition, penetration testing, vulnerability scanning, and verification of the effectiveness of security protection; the capability maturity assessment module is used to evaluate the network security capability maturity of enterprise units. First, multiple enterprise capability maturity levels are defined, and the unit of the assessed enterprise is obtained according to the method in step S2. The current structured data will be used to assign points to the technical and management capabilities of the assessed enterprise units according to a gradient. The structured data will then be compared with the capability components to calculate the maturity score of the assessment domain and output the security capability maturity level of the assessed enterprise. The technical and management capabilities of the assessed enterprise units will be assigned points according to a gradient, including management capability scoring and technical capability scoring. The management capability scoring includes the secondary indicators of personnel organization scoring, management system scoring, and management process scoring. The technical capability scoring includes the secondary indicators of operation and maintenance side scoring and operation side scoring. The operation and maintenance side and the operation side have three-level scoring indicator items.

[0017] According to a third aspect of the present invention, there is provided an electronic device comprising: a memory, a processor, and an enterprise security capability assessment program stored in the memory and executable on the processor, wherein the enterprise security capability assessment program implements the steps of the above-mentioned enterprise security capability assessment method when executed by the processor.

[0018] According to a fourth aspect of the present invention, there is provided a computer storage medium, wherein a security capability assessment program for an enterprise is stored on the computer storage medium, and when the security capability assessment program for the enterprise is executed by a processor, the steps of the above-mentioned enterprise security capability assessment method are implemented.

[0019] Compared with the prior art, the technical solution provided by the embodiments of the present invention can at least achieve the following beneficial effects:

[0020] The enterprise security capability assessment method based on the maturity model of the present invention, on the basis of the capability maturity conceptual model, combined with the risk factors faced by the enterprise, constructs a security capability assessment method to form a three-level indicator framework, wherein management and technology are two first-level indicators, wherein the management first-level indicator management system has three second-level indicators of management system, personnel organization, and management process; the technology first-level indicator system has two second-level indicators of operation side and operation and maintenance side; and further, 11 third-level indicators are divided in detail. The use of on-site assessment can realize the quantitative assessment of the enterprise's security capability, give a quantitative maturity level, and point out the direction for improving the enterprise's security capability level.

[0021] Through the method for enterprise security capability assessment of the present invention, it is possible to quantitatively define the level of enterprise security capabilities. Based on this method, the maturity level of the enterprise security capabilities can be quantified, and detailed assessment methods and steps can be given, so that the enterprise's security capability level can be more intuitively seen, and a basis can be provided for the direction of security capability construction. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings of the embodiments will be briefly introduced below. Obviously, the drawings in the following description only relate to some embodiments of the present invention, but are not intended to limit the present invention.

[0023] Figure 1 is a flow chart showing a method for assessing the security capability of an enterprise according to an embodiment of the present invention;

[0024] Figure 2 is a schematic diagram showing the definition of security maturity levels for security capability assessment of an enterprise according to an embodiment of the present invention;

[0025] Figure 3 is a schematic diagram showing a three-level indicator architecture for an enterprise for security capability assessment according to an embodiment of the present invention;

[0026] Figures 4 to 19 It is a block diagram schematically showing the further division of the third-level enterprise indicators for security capability assessment according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to make the purpose, technical solution and advantages of the embodiment of the present invention clearer, the technical solution of the embodiment of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiment of the present invention. Obviously, the described embodiment is a part of the embodiment of the present invention, not all of the embodiments. Based on the described embodiment of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0028] Unless otherwise defined, the technical or scientific terms used herein shall have the common meanings understood by persons with ordinary skills in the field to which the present invention belongs. The words "first", "second" and similar words used in the patent application specification and claims of the present invention do not indicate any order, quantity or importance, but are only used to distinguish different components. Similarly, words such as "one" or "a" do not indicate a quantity limitation, but indicate the existence of at least one.

[0029] Figure 1 is a flow chart illustrating a method for evaluating the security capability of an enterprise according to an embodiment of the present invention.

[0030] After analysis, enterprises mainly face the following four types of security risks: host risk, network risk, data risk and platform risk.

[0031] Among them, host risks, that is, the risks currently faced by host security, include the following aspects:

[0032] 1. The management of high-risk vulnerabilities and high-risk ports needs to be strengthened. High-risk vulnerabilities are important channels for attackers to invade corporate networks. Once there are high-risk vulnerabilities in the system that are not discovered and repaired in time, attackers can use these vulnerabilities to carry out various malicious behaviors, such as data theft and system destruction. At the same time, the opening of high-risk ports also provides opportunities for attackers. Many devices and services in corporate networks communicate through specific ports. If these ports are not properly managed, they can be easily used by attackers to carry out remote attacks.

[0033] 2. Lack of security protection. With a large-scale network environment, there is the possibility of interconnection between devices. Many APT attacks start with a host in the network as a breakthrough point, and gradually invade other devices through lateral movement to carry out greater damage. If there is a lack of security protection, the host may become a springboard or breakthrough point for the attacker.

[0034] 3. Account authority management is chaotic, and weak passwords or default passwords are often used. If the password is cracked by an attacker, the system will be directly controlled by the attacker. The attacker can exploit this vulnerability to further maliciously operate the system or even steal data, which may lead to the leakage of sensitive data and confidential information in the system, thus causing irreparable losses to the enterprise and users.

[0035] Cyber ​​risks, that is, the risks faced in network security, include the following aspects:

[0036] 1. Failure to strictly define the network boundary. If the network does not have a strict and clear network boundary, the correct implementation of necessary information security control measures cannot be guaranteed, which will lead to illegal access to system data.

[0037] 2. Insufficient network traffic monitoring and analysis. There is usually a large amount of data traffic in the network, but there are not enough monitoring and analysis tools to detect abnormal activities. The interconnection between systems may increase security risks and give attackers more paths to choose from. Once attackers invade a subsystem, they can use this entry to infiltrate the entire network, causing huge losses.

[0038] Data risks, that is, the risks faced in data security, include the following aspects:

[0039] 1. The openness of data leads to increased data security risks. With the development of the industrial Internet, more and more devices and systems are connected to the Internet. Data is not only circulated internally, but has become more open, which has increased the security risks of data.

[0040] 2. The direction and path of data flow are complex, making data security protection more difficult. The direction and path of data flow are usually diverse and complex, which makes data security protection more difficult. Attackers can use these complex paths to bypass security measures.

[0041] 3. Data transmission is usually transmitted in plain text without encryption protection, which can be easily intercepted, viewed, stolen or tampered by attackers. This situation seriously threatens the privacy and integrity of data, especially for data containing sensitive information, which may lead to very serious consequences.

[0042] Platform risks, that is, the risks faced by the platform in terms of security, include the following aspects:

[0043] 1. It is difficult to identify the responsible party. The network involves multiple different participants, including equipment manufacturers, system integrators, etc. It becomes complicated to determine the exact responsible party, which brings great challenges to security management and maintenance.

[0044] 2. Security threats are complex and diverse. The platform faces a variety of security threats, such as malware, phishing, denial of service attacks, etc. The types and numbers of these threats are diverse, and the means of attack are becoming more and more complex, which poses a huge challenge to platform security.

[0045] 3. The platform lacks a security framework. The security framework of some units is relatively weak, lacking a complete security mechanism and measures. This results in the platform lacking sufficient protection capabilities when dealing with various security threats.

[0046] Therefore, a method for assessing the security capabilities of an enterprise is proposed, such as Figure 1 As shown, the following steps are included:

[0047] S1. Adapt the capability maturity model to the information environment of the enterprise to be evaluated, determine the information environment of the enterprise to be evaluated, including the network architecture and system structure of the enterprise to be evaluated; analyze the network security threats and risk points faced by the enterprise to be evaluated; select the evaluation domain and capability components in the model that are adapted to the evaluation object; adjust the evaluation dimensions, refine the evaluation indicators, and set appropriate weights. The capability maturity model used is the SSE-CMM capability maturity model.

[0048] S2. Extract the structured data required by the model from the unit status results of the assessed enterprise, wherein the structured data includes management factor data and technical factor data. The management factor data is used to reflect the management capability of the assessed enterprise unit, and the technical factor data is used to reflect the technical capability of the assessed enterprise unit.

[0049] Among them, management capabilities include the current status of personnel organization, management system, and management process. Among them, by evaluating whether the personnel configuration meets the network security needs, whether it has an effective network security organizational structure, and whether the organization has established an effective division of responsibilities and responsibility matrix, the personnel organization of the assessed unit is analyzed; by evaluating whether the management system is complete and whether it covers all aspects of network security, the implementation of management systems including operation and maintenance safety management systems, operation safety management systems, and personnel safety management systems is checked, and the management system of the assessed unit is checked; the business processes are comprehensively sorted out, key business links and potential security risk points are identified, and the business processes of the assessed unit are sorted out.

[0050] Among them, technical capabilities include the current status of the operation and maintenance side and the operation side. Methods for obtaining technical factor data include on-site acquisition, performing penetration tests, vulnerability scanning, and verifying the effectiveness of security protection.

[0051] Among them, the on-site acquisition is to customize interview materials and questionnaires according to the actual situation of the assessed unit, obtain the network security status of the assessed unit through reviewing materials, interviews, on-site investigations, and questionnaires, and obtain the structured data required for model evaluation; the execution of penetration testing is to conduct network security white-box and black-box penetration testing assessments through professional scanning work and manual detection confirmation methods under the authorization and supervision of the assessed customer; the assessment process of white-box penetration testing includes: source code audit assessment, baseline configuration verification assessment, and vulnerability assessment; the assessment process of black-box penetration testing is: through various scanning professional tools to mine the routing paths, open services and ports, file storage directories and other information of system-related devices, and detect security vulnerabilities in application coding; the vulnerability scanning is to use a vulnerability scanner to perform automated vulnerability scanning on the application system of the assessed unit to quickly identify common security vulnerabilities and configuration errors; compare and verify the scanning results with the vulnerabilities found in the penetration test; verify the effectiveness of security protection, which is used to evaluate the security protection measures deployed by the assessed unit, including firewalls, intrusion detection systems, and anti-virus software, and their actual effects; by trying to bypass these protection measures or using their known vulnerabilities for attack testing, verify whether they can effectively resist external threats.

[0052] S3. Conduct a network security capability maturity assessment. First, define multiple enterprise capability maturity levels. According to the method in step S2, obtain the structured data of the current status of the enterprise being assessed. Then, assign points to the technical capabilities and management capabilities of the enterprise being assessed according to the gradient. Then, compare the structured data with the capability components, calculate the maturity score of the assessment domain, and output the security capability maturity level of the enterprise being assessed.

[0053] Through the method for enterprise security capability assessment of the present invention, it is possible to quantitatively define the level of enterprise security capabilities. Based on this method, the maturity level of the enterprise security capabilities can be quantified, and detailed assessment methods and steps can be given, so that the enterprise's security capability level can be more intuitively seen, and a basis can be provided for the direction of security capability construction.

[0054] Figure 2 It is a schematic diagram showing the definition of security maturity levels for security capability assessment of an enterprise according to an embodiment of the present invention.

[0055] like Figure 2 As shown, in step S34, each evaluation item is provided with a five-level scoring standard, with a total score of five points; during the evaluation process, the score is given according to the actual performance of the evaluated unit in the evaluation item; if the evaluated unit fails to meet the set requirements on a certain evaluation item, a corresponding point will be deducted from the total score, and finally the level corresponding to the evaluation item will be determined based on the score.

[0056] According to one or some embodiments of the present invention, step S3 includes the following steps:

[0057] S31. Based on the SSE-CMM capability maturity model, the security maturity of an enterprise is defined into multiple levels.

[0058] S32. The technical and management capabilities of the assessed enterprise units shall be graded according to the gradient;

[0059] S33. Compare the structured data with the capability components, check the maturity level of the capability components according to the degree of satisfaction, and calculate the maturity score of the assessment domain;

[0060] S34. Formulate capability grading principles, where when management capabilities and technical capabilities reach the same level, including any level from level 1 to level 5, the overall cybersecurity maturity of the enterprise will be determined as that level; when there is a large gap between the levels of technical capabilities and management capabilities, management capabilities will be given priority for overall capability grading, reflecting the importance of management capabilities in cybersecurity;

[0061] S35. Determine the cybersecurity maturity level of the assessed unit based on the capability grading principles and the maturity scores of each assessment domain.

[0062] Figure 3 is a schematic diagram showing a three-level indicator architecture for an enterprise for security capability assessment according to an embodiment of the present invention; Figures 4 to 19 It is a block diagram schematically showing the further division of the third-level enterprise indicators for security capability assessment according to an embodiment of the present invention.

[0063] According to one or some embodiments of the present invention, in step S32, management capability is scored 50 points, with a gradient of 10 points for each level; management capability is divided into 3 secondary indicators, of which personnel organization is scored 15 points, management system is scored 15 points, and management process is scored 20 points; personnel organization, management system, and management process are divided into 10 evaluation domains, and the evaluation content includes the clarity of organizational structure, job responsibilities, and control processes; the standardization of the formulation, release, and revision of relevant process systems; the effectiveness of organizational structure operation, communication and coordination, requirements, and process implementation; technical capability is scored 150 points, with a gradient of 30 points for each level; technical capability is divided into 2 secondary indicators, of which the operation and maintenance side is scored 115 points, and the operation side is scored 35 points; Figures 3 to 19 As shown, there are 11 third-level indicator items and 32 evaluation domains under the operation and maintenance side. The evaluation content includes the ability to solidify and execute security capability requirements and institutional processes using technical means and product tools; the ability to automate and continuously support network and information security work; and the ability to prevent and respond to network and information security risks.

[0064] According to one or some embodiments of the present invention, in step S32, the weight of each evaluation item under the three-level index is determined, and the weight of each evaluation item is determined by using the Analytic Hierarchy Process (AHP), and experts are invited to compare the importance of the evaluation items under the same three-level index in pairs to form a judgment matrix, where a ij is the result of comparing the importance of element i and element j. The judgment matrix satisfies the nature of;

[0065] Among them, when factor i is equally important than factor j, a ij The value of is 1; factor i is slightly more important than factor j if a ij The value of is 3; when factor i is significantly more important than factor j, a ij The value of is 5; when factor i is more important than factor j, a ij The value of is 7; when factor i is more important than factor j, a ij The value of is 9; among them, the intermediate values ​​of the adjacent judgments of factor i to factor j include 2, 4, 6, and 8;

[0066] Judgment matrix element a ij The method is as follows:

[0067] Factor i is better than factor j Quantization value Equally important 1 Slightly important 3 Obviously important 5 Extremely important 7 Strongly important 9 The middle value of adjacent judgments 2，4，6，8

[0068] For example, the third-level indicator cloud security has four evaluation items, namely: authentication and access control, security antivirus, anti-saturation attack DDOS, cloud activity log and monitoring. Experts compare the importance of the four evaluation items in pairs to form a judgment matrix.

[0069]

[0070] For example, the third-level indicator physical security includes: infrastructure and environment management, door access and access management, training and emergency response, monitoring and inspection, equipment maintenance assessment items; terminal desktop security includes: terminal equipment access control, anti-virus and malware protection (EDR), permission control, abnormal behavior analysis, data leakage prevention assessment items; network security includes: security equipment construction and operation and maintenance, network zoning and domain, data leakage, abnormal behavior analysis, security product linkage assessment items; situational awareness includes: full time detection, network traffic monitoring and analysis, threat analysis and assessment, security time reporting and notification assessment items; network continuity includes: equipment backup and recovery strategy, availability and redundant equipment configuration, equipment recovery test plan; application security includes: risk prevention and control including anti-virus, permission management, anti-tampering, and anti-virus and permission management. Interface security assessment items; supply chain security includes: assessment items for supplier assessment; development security includes: assessment items for secure development lifecycle; data security includes: assessment items for data classification and grading, data migration, data storage, data use, and data extinction; security compliance includes: assessment items for audit and compliance checks; authority management includes: assessment items for authentication and verification, and authorization management; business continuity includes: assessment items for disaster recovery plans and business continuity testing; personnel organization includes: assessment items for personnel roles, personnel organization, and division of responsibilities; management system includes: assessment items for operation and maintenance safety management system, operation safety management system, and personnel safety management; business processes include: assessment items for examination and training processes, risk assessment and supervision operation processes, asset processes, R&D IPD processes, and security incident monitoring, intervention, and statistics processes.

[0071] The judgment matrix must undergo a consistency test. If CI A <0.1, CR A <0.1, it indicates that the judgment matrix passes the consistency test. If the calculation result does not meet the requirements, the judgment matrix needs to be rebuilt. The calculation method of CI is as follows: λ is the maximum characteristic root of the judgment matrix, and n is the order of the judgment matrix.

[0072]

[0073] The matrix that passes the consistency test can be used to calculate the weight value of each evaluation item; the judgment matrix is ​​normalized by column, and then the average value of each row after normalization is obtained to obtain the weight value of each evaluation item under the three-level indicator.

[0074] According to a second aspect of the present invention, there is provided a device for evaluating the security capability of an enterprise, comprising:

[0075] The capability maturity model adaptation module is used to adapt the capability maturity model to the information environment of the target enterprise to be evaluated, determine the information environment contained in the enterprise unit to be evaluated, and the information environment includes the network architecture and system composition of the unit to be evaluated; analyze the network security threats and risk points faced by the unit to be evaluated; select the evaluation domain and capability components in the model that are adapted to the evaluation object; adjust the evaluation dimensions, refine the evaluation indicators, and set appropriate weights;

[0076] The module for obtaining structured data is used to extract the structured data required by the model from the unit status results of the evaluated enterprise. The structured data includes management factor data and technical factor data. The management factor data is used to reflect the management capability of the enterprise unit being evaluated, and the technical factor data is used to reflect the technical capability of the enterprise unit being evaluated.

[0077] Management capabilities include the status of personnel organization, management system, and management process. By evaluating whether the personnel configuration meets the network security needs, whether there is an effective network security organizational structure, and whether the organization has established an effective division of responsibilities and responsibility matrix, the personnel organization of the assessed unit is analyzed; by evaluating whether the management system is complete and covers all aspects of network security, the implementation of management systems including operation and maintenance safety management system, operation safety management system, and personnel safety management system is checked, and the management system of the assessed unit is checked; the business process is comprehensively sorted out, key business links and potential security risk points are identified, and the business process of the assessed unit is sorted out;

[0078] Among them, technical capabilities include the current status of the operation and maintenance side and the operation side. The methods for obtaining technical factor data include on-site acquisition, performing penetration testing, vulnerability scanning, and verifying the effectiveness of security protection;

[0079] The capability maturity assessment module is used to assess the network security capability maturity of enterprise units. First, multiple enterprise capability maturity levels are defined. According to the method in step S2, the structured data of the unit status of the assessed enterprise is obtained. The technical capability and management capability of the assessed enterprise unit are graded according to the gradient. Then, the structured data is compared with the capability components, the maturity score of the assessment domain is calculated, and the security capability maturity level of the assessed enterprise is output.

[0080] Among them, the technical capabilities and management capabilities of the assessed enterprise units will be scored according to a gradient, including management capability scoring and technical capability scoring. Among them, the management capability scoring includes the secondary indicators of personnel organization scoring, management system scoring, and management process scoring. The technical capability scoring includes the secondary indicators of operation and maintenance side scoring and operation side scoring. The operation and maintenance side and the operation side have three-level scoring indicator items.

[0081] When used, technical capability is scored 150 points, with a gradient of 30 points for each level. There are 2 secondary indicators, of which the operation and maintenance side is scored 115 points and the operation side is scored 35 points. There are 11 tertiary indicators and 32 evaluation domains. The evaluation content includes the ability to solidify and execute security capability requirements and institutional processes using technical means and product tools; the ability to automate and continuously support network and information security work; and the ability to prevent and respond to network and information security risks.

[0082] The principles for ability grading are as follows:

[0083] When both management capabilities and technical capabilities reach the same level (any level from level 1 to level 5), the enterprise's overall cybersecurity maturity will be recognized as that level.

[0084] When there is a large gap between the levels of technical capabilities and management capabilities, management capabilities are given priority for overall capability grading, reflecting the importance of management capabilities in network security.

[0085] Each evaluation item has five levels of scoring criteria, with a total score of five points. During the evaluation process, we will score the company based on its actual performance in the evaluation item. If the company fails to meet the set requirements in a certain evaluation item, one point will be deducted from the total score, and the corresponding level of the evaluation item will be determined based on the score.

[0086] The specific evaluation levels are shown in the following table.

[0087]

[0088]

[0089] The enterprise security capability assessment method or device based on the maturity model of the present invention, on the basis of the capability maturity conceptual model, combined with the risk factors faced by the enterprise, constructs a security capability assessment method to form a three-level indicator framework, wherein management and technology are two first-level indicators, wherein the management first-level indicator management system has three second-level indicators of management system, personnel organization, and management process; the technology first-level indicator system has two second-level indicators of operation side and operation and maintenance side; and further, 11 third-level indicators are divided in detail. The use of on-site assessment can realize the quantitative assessment of the enterprise's security capability, give a quantitative maturity level, and point out the direction for improving the enterprise's security capability level.

[0090] According to another aspect of the present invention, there is provided a device for assessing the security capabilities of an enterprise, comprising: a memory, a processor, and a security capability assessment program for the enterprise stored in the memory and executable on the processor, wherein the steps of the above-mentioned method for assessing the security capabilities of the enterprise are implemented when the security capability assessment program for the enterprise is executed by the processor.

[0091] According to the present invention, a computer storage medium is also provided.

[0092] The computer storage medium stores an enterprise security capability assessment program, which implements the steps of the above-mentioned enterprise security capability assessment method when executed by the processor.

[0093] Among them, the method implemented when the enterprise security capability assessment program running on the processor is executed can refer to the various embodiments of the enterprise security capability assessment method of the present invention, and will not be repeated here.

[0094] The present invention also provides a computer program product.

[0095] The computer program product of the present invention includes a security capability assessment program for an enterprise, and when the security capability assessment program for an enterprise is executed by a processor, the steps of the security capability assessment method for an enterprise as described above are implemented.

[0096] Among them, the method implemented when the enterprise security capability assessment program running on the processor is executed can refer to the various embodiments of the enterprise security capability assessment method of the present invention, and will not be repeated here.

[0097] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0098] The above description is merely an exemplary embodiment of the present invention and is not intended to limit the protection scope of the present invention. The protection scope of the present invention is determined by the appended claims.

Claims

1. A method for evaluating the security capability of an enterprise, comprising the following steps: S1. Adapt the capability maturity model to the information environment of the enterprise to be evaluated, determine the information environment of the enterprise to be evaluated, and the information environment includes the network architecture and system composition of the enterprise to be evaluated; analyze the network security threats and risk points faced by the enterprise to be evaluated; select the evaluation domain and capability components in the model that are adapted to the evaluation object; adjust the evaluation dimensions, refine the evaluation indicators, and set appropriate weights; S2. extracting structured data required by the model from the unit status results of the assessed enterprise, wherein the structured data includes management factor data and technical factor data, wherein the management factor data is used to reflect the management capability of the assessed enterprise unit, and the technical factor data is used to reflect the technical capability of the assessed enterprise unit. in, Management capabilities include the current status of personnel organization, management system, and management process. Specifically, the personnel organization of the assessed unit is analyzed by evaluating whether the personnel configuration meets the network security needs, whether there is an effective network security organizational structure, and whether the organization has established an effective division of responsibilities and responsibility matrix; by evaluating whether the management system is complete and covers all aspects of network security, the implementation of management systems including operation and maintenance safety management system, operation safety management system, and personnel safety management system is checked, and the management system of the assessed unit is checked; the business process is comprehensively sorted out, key business links and potential security risk points are identified, and the business process of the assessed unit is sorted out; Among them, technical capabilities include the current status of the operation and maintenance side and the operation side. The methods for obtaining technical factor data include on-site acquisition, performing penetration testing, vulnerability scanning, and verifying the effectiveness of security protection; S3. Conduct a network security capability maturity assessment. First, define multiple enterprise capability maturity levels. According to the method in step S2, obtain the structured data of the current status of the enterprise being assessed. Then, assign points to the technical capabilities and management capabilities of the enterprise being assessed according to the gradient. Then, compare the structured data with the capability components, calculate the maturity score of the assessment domain, and output the security capability maturity level of the enterprise being assessed.

2. The method for evaluating the security capability of an enterprise according to claim 1, wherein: Step S3 includes the following steps: S31. Based on the SSE-CMM capability maturity model, the security maturity of an enterprise is defined into multiple levels; S32. The technical and management capabilities of the assessed enterprise units shall be graded; S33. Compare the structured data with the capability components, check the maturity level of the capability components according to the degree of satisfaction, and calculate the maturity score of the assessment domain; S34. Formulate capability grading principles, where when management capabilities and technical capabilities reach the same level, the overall cybersecurity maturity of the enterprise will be determined as that level; when there is a large gap between the levels of technical capabilities and management capabilities, management capabilities will be given priority for overall capability grading, reflecting the importance of management capabilities in cybersecurity; S35. Determine the cybersecurity maturity level of the assessed unit based on the capability grading principles and the maturity scores of each assessment domain.

3. The method for evaluating the security capability of an enterprise as claimed in claim 2, wherein: In step S32, management ability is assigned 50 points, with a gradient of 10 points per level; There are three second-level indicators under management capability, among which personnel organization is awarded 15 points, management system is awarded 15 points, and management process is awarded 20 points; technical capability is awarded 150 points, with a gradient of 30 points for each level; there are two second-level indicators under technical capability, among which the operation and maintenance side is awarded 115 points, and the operation side is awarded 35 points; there are 11 third-level indicators under the operation and maintenance side and the operation side.

4. The method for evaluating the security capability of an enterprise according to claim 3, wherein: In step S32, the weight of each evaluation item under the three-level index is determined, and the weight of each evaluation item is determined by using the Analytic Hierarchy Process (AHP). Experts are invited to compare the importance of the evaluation items under the same three-level index in pairs to form a judgment matrix, where a ij is the result of comparing the importance of element i and element j. The judgment matrix satisfies the nature of; Among them, when factor i is equally important than factor j, a ij The value of is 1; factor i is slightly more important than factor j if a ij The value of is 3; when factor i is significantly more important than factor j, a ij The value of is 5; when factor i is more important than factor j, a ij The value of is 7; when factor i is more important than factor j, a ij The value of is 9; among them, the intermediate values ​​of the adjacent judgments of factor i to factor j include 2, 4, 6, and 8; The judgment matrix must undergo a consistency test. If CI A <0.1, CR A <0.1, it indicates that the judgment matrix passes the consistency test. If the calculation result does not meet the requirements, the judgment matrix needs to be rebuilt. The calculation method of CI is as follows: λ is the maximum characteristic root of the judgment matrix, and n is the order of the judgment matrix. The matrix that passes the consistency test can be used to calculate the weight value of each evaluation item; the judgment matrix is ​​normalized by column, and then the average value of each row after normalization is obtained to obtain the weight value of each evaluation item under the three-level indicator.

5. The method for evaluating the security capability of an enterprise according to claim 2, wherein: In step S31, the multiple levels of security maturity are 5 levels, including: basic protection level, standard construction level, risk management level, intelligent defense level, and continuous optimization level.

6. The method for evaluating the security capability of an enterprise according to claim 2, wherein: In step S34, each evaluation item is set with a five-level scoring standard, with a total score of five points; during the evaluation process, the score is given according to the actual performance of the evaluated unit in the evaluation item; if the evaluated unit fails to meet the set requirements on a certain evaluation item, the corresponding point will be deducted from the total score, and finally the level corresponding to the evaluation item will be determined based on the score.

7. The method for assessing the security capability of an enterprise as claimed in claim 1, wherein: The capability maturity model used in step S1 is the SSE-CMM capability maturity model; Among them, in step S2, the on-site acquisition is to customize interview materials and questionnaires according to the actual situation of the assessed unit, obtain the network security status results of the assessed unit through reviewing materials, interviews, on-site surveys, and questionnaires, and obtain the structured data required for model evaluation; The penetration test is performed by conducting network security white-box and black-box penetration test assessments under the authorization and supervision of the client being assessed, through professional scanning and manual detection confirmation methods; the assessment process of white-box penetration test includes: source code audit assessment, baseline configuration verification assessment and vulnerability assessment; the assessment process of black-box penetration test is: using various scanning professional tools to mine the routing paths, open services and ports, file storage directories and other information of system-related devices, and detect security vulnerabilities in application coding; The vulnerability scanning uses a vulnerability scanner to automatically scan the application system of the assessed unit to quickly identify common security vulnerabilities and configuration errors; the scanning results are compared and verified with the vulnerabilities found in the penetration test; Among them, verifying the effectiveness of security protection is used to evaluate the security protection measures deployed by the assessed unit, including firewalls, intrusion detection systems, and anti-virus software, and their actual effects; by attempting to bypass these protection measures or exploiting their known vulnerabilities for attack tests, verify whether they can effectively resist external threats.

8. A device for evaluating the security capability of an enterprise, comprising: The capability maturity model adaptation module is used to adapt the capability maturity model to the information environment of the target enterprise to be evaluated, determine the information environment contained in the enterprise unit to be evaluated, and the information environment includes the network architecture and system composition of the unit to be evaluated; analyze the network security threats and risk points faced by the unit to be evaluated; select the evaluation domain and capability components in the model that are adapted to the evaluation object; adjust the evaluation dimensions, refine the evaluation indicators, and set appropriate weights; The module for obtaining structured data is used to extract the structured data required by the model from the unit status results of the evaluated enterprise. The structured data includes management factor data and technical factor data. The management factor data is used to reflect the management capability of the enterprise unit being evaluated, and the technical factor data is used to reflect the technical capability of the enterprise unit being evaluated. Management capabilities include the status of personnel organization, management system, and management process. By evaluating whether the personnel configuration meets the network security needs, whether there is an effective network security organizational structure, and whether the organization has established an effective division of responsibilities and responsibility matrix, the personnel organization of the assessed unit is analyzed; by evaluating whether the management system is complete and covers all aspects of network security, the implementation of management systems including operation and maintenance safety management system, operation safety management system, and personnel safety management system is checked, and the management system of the assessed unit is checked; the business process is comprehensively sorted out, key business links and potential security risk points are identified, and the business process of the assessed unit is sorted out; Among them, technical capabilities include the current status of the operation and maintenance side and the operation side. The methods for obtaining technical factor data include on-site acquisition, performing penetration testing, vulnerability scanning, and verifying the effectiveness of security protection; The capability maturity assessment module is used to assess the network security capability maturity of enterprise units. First, multiple enterprise capability maturity levels are defined. According to the method in step S2, the structured data of the unit status of the assessed enterprise is obtained. The technical capability and management capability of the assessed enterprise unit are graded according to the gradient. Then, the structured data is compared with the capability components, the maturity score of the assessment domain is calculated, and the security capability maturity level of the assessed enterprise is output. Among them, the technical capabilities and management capabilities of the assessed enterprise units will be scored according to a gradient, including management capability scoring and technical capability scoring. Among them, the management capability scoring includes the secondary indicators of personnel organization scoring, management system scoring, and management process scoring. The technical capability scoring includes the secondary indicators of operation and maintenance side scoring and operation side scoring. The operation and maintenance side and the operation side have three-level scoring indicator items.

9. An electronic device, comprising: A memory, a processor, and an enterprise security capability assessment program stored in the memory and executable on the processor, wherein the enterprise security capability assessment program, when executed by the processor, implements the steps of the enterprise security capability assessment method as described in any one of claims 1 to 7.

10. A computer storage medium, wherein: The computer storage medium stores a security capability assessment program for an enterprise, and when the security capability assessment program for an enterprise is executed by a processor, the steps of the security capability assessment method for an enterprise as described in any one of claims 1 to 7 are implemented.

Images