Security management method applied to software development data

Abstract

The invention discloses a security management method applied to software development data, and relates to the technical field of data security management, and the method comprises the following steps: determining associated key data assets in a software development process, including source codes, configuration files, databases and user data, and classifying the key data assets according to the sensitivity and value of the data, and determining the security level of each type of data. By establishing a risk assessment framework, risk assessment can be performed on data assets regularly, potential safety problems can be found in time, corresponding risk management measures can be formulated according to the risk assessment result, and meanwhile, various safety events can be quickly responded by setting different early warning levels and formulating emergency response plans for the levels, so that the risk assessment efficiency is improved. In addition, through continuous risk assessment and monitoring, security vulnerabilities can be found and repaired in time, and the defense capability for new security threats is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of data security management, and in particular to a security management method applied to software development data. Background Art

[0002] With the popularization of computer technology and the Internet, various data sources continue to emerge and the amount of data is growing exponentially. These data include not only personal information and commercial information, but also sensitive information such as state secrets. The surge in data volume makes data management and protection particularly important. With the continuous development of computer technology and information security technology, new security algorithms, technologies and tools continue to emerge, providing strong support for the security management of software development data.

[0003] In the security management of software development data, with the continuous development of technology, new security threats and vulnerabilities continue to emerge. The latest security threats may not be detected, which will lead to deviations in security assessment results and difficulty in effective comparison, resulting in misjudgment of security risks. Therefore, how to analyze software development data, classify security risks in the data management process, and trigger corresponding early warning measures is the problem we need to solve. To this end, a security management method applied to software development data is proposed. Summary of the invention

[0004] The present invention aims to provide a security management method for software development data to solve the problems raised in the above background technology.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is: A security management method for software development data includes the following steps: Step 1: Identify the key data assets associated with the software development process, including source code, configuration files, databases, and user data, and classify them according to the sensitivity and value of the data to determine the security level of each type of data; Step 2: According to the classification results of data security levels, formulate corresponding data security policies and control measures, and classify and protect data according to its sensitivity and importance; Step 3: Establish a risk assessment framework, determine risk assessment indicators, conduct risk assessments on each data asset, configure vulnerability scanning tools, measure vulnerability management indicators, and analyze the degree of security interference of vulnerabilities on each data asset; Step 4: Collect system logs and application logs centrally, implement real-time monitoring and data analysis, comprehensively analyze risk assessment results and vulnerability analysis results, perform anomaly detection, and identify abnormal behaviors and potential security threats; Step 5: Based on the monitoring and detection results, classify abnormal behaviors and potential security threats, determine the abnormal warning level, establish an early warning mechanism, and implement emergency response plans for each abnormal warning level.

[0006] A further improvement of the technical solution of the present invention is that in step 1, the process of determining the security level of each type of data is as follows: Step 101, review the software development environment and identify all key data assets, including source code, configuration files, databases, and user data. The source code contains the program code that implements the software logic and functions and is one of the core assets of the software. The configuration file is used to set the software operating environment and parameters and may contain sensitive configuration information, such as database connection strings, API keys, etc. The database stores the core of application data and contains key information such as user information, business data, and transaction records. User data is all information generated or provided by users, such as personal information, account information, transaction records, communication records, etc. The leakage of this data may have a serious impact on user privacy and rights and interests. Create a data asset list, including the type, location, usage method, and person in charge of the data; Step 102: Perform sensitivity and value analysis on each type of data asset to assess the risk level of data leakage or unauthorized access. Source code is highly sensitive because it contains application logic and business rules. Configuration files are of medium sensitivity, containing system settings and sensitive parameters. Databases are of high sensitivity, containing personal information and business data. User data are of high sensitivity, containing personal identification information and private data. Source code is of high value, directly affecting the function and security of the application. Configuration files are of medium value, affecting system configuration and operation status. Databases are of high value, storing key business and user data. User data are of high value, directly related to user privacy and legal compliance. Step 103, classify data assets into different categories according to the sensitivity and value of the data, and record the security level of each type of data asset in the system, namely low security level, medium security level and high security level, to ensure that corresponding protection measures are followed.

[0007] A further improvement of the technical solution of the present invention is that in step 2, the process of classifying and protecting data according to its sensitivity and importance is as follows: Step 201, classify and label data according to the classification results of the security level of each type of data assets, and formulate corresponding data security policies; Step 202, determine the protection requirements for each type of data asset, including encryption, access control, auditing, and backup to ensure the confidentiality, integrity, and availability of data. The policy content should include but is not limited to: Access control: Set different access rights according to the security level of the data. Highly sensitive data should only be accessible to specific authorized personnel, and multi-factor authentication should be implemented; Encryption protection: Encrypted storage and transmission of highly sensitive and medium-sensitive data to ensure that data is not obtained by unauthorized third parties during transmission and storage; Backup and recovery: Back up data regularly and develop a data recovery plan to quickly restore data and reduce losses when data is lost or damaged; Security audit: Record data access and operation behaviors, conduct security audits regularly, and discover potential security threats and vulnerabilities; Compliance requirements: Ensure that data processing activities comply with relevant laws, regulations, and industry standards, such as GDPR, HIPAA, etc.; Step 203, develop and test an emergency response plan to take prompt action when a data breach or other security incident occurs, and implement specific control measures based on the developed data security policy to ensure that the policy is effectively implemented.

[0008] A further improvement of the technical solution of the present invention is that in step 3, the process of conducting risk assessment on each data asset and analyzing the degree of interference of vulnerabilities on the security of each data asset is as follows: Step 301: Based on the collected data asset information, formulate a risk assessment plan, establish a risk assessment framework, and determine risk assessment indicators, including risk identification rate, risk assessment frequency, and risk response time, to identify potential risk sources and risk types, and analyze the impact of each risk on data assets. Among them, risk identification rate: measures the ratio of the number of potential risks identified during the assessment process to the number of actual risks; risk assessment frequency: defines the cycle of risk assessment, such as a comprehensive assessment every quarter, every six months, or every year; risk response time: the time required from the identification of a risk to the adoption of corresponding response measures; Step 302, by conducting risk assessment on each data asset, identifying and analyzing the risks brought by data leakage or unauthorized access, and using quantitative and qualitative methods to assess different risks, determine the probability of occurrence and the degree of impact, set the risk tolerance according to the probability and impact of the risk, and combine them to obtain a risk assessment index; Step 303: Evaluate the sensitivity and value of each type of data asset according to the risk assessment index, classify the security risks into different levels, namely low security risk level, medium security risk level and high security risk level, determine their security risk levels, and perform risk assessment on each type of data asset according to the risk assessment plan to identify and analyze potential security risks; Step 304: configure vulnerability scanning tools (such as Nessus, Qualys, OpenVAS, etc.), cover all key data assets and system components, scan systems and applications regularly, measure vulnerability management indicators, including vulnerability discovery rate, vulnerability repair time, and vulnerability closure rate, ensure timely discovery and repair of vulnerabilities, and generate scanning reports, including vulnerability details and security recommendations, where vulnerability discovery rate: measures the number of vulnerabilities discovered by vulnerability scanning tools within a specific time period; vulnerability repair time: the time required from the discovery of a vulnerability to the completion of repair; vulnerability closure rate: the ratio of the number of repaired vulnerabilities to the total number of discovered vulnerabilities, reflecting the efficiency and quality of vulnerability management; Step 305, based on the measured vulnerability management indicators of vulnerability discovery rate, vulnerability repair time and vulnerability closure rate, calculate the vulnerability security interference index, evaluate the potential security interference of the vulnerability on each data asset, analyze the risks that the vulnerability may cause, and determine the priority and repair order of the vulnerability.

[0009] A further improvement of the technical solution of the present invention is that the calculation formula of the risk assessment index is: ; in, is the risk assessment index, It is The risk identification rate of each risk, the value range , is the number of risks identified, is the maximum risk tolerance, which is a constant representing the maximum risk level theoretically acceptable. , is the frequency of risk assessment, expressed as the inverse of the period expressed as a natural logarithm. For example, if the assessment is conducted once a year, , value range , is the average risk response time, is the standard value of risk response time, which is a constant and represents the ideal response time; The calculation formula of the vulnerability security interference index is: ; in, is the vulnerability security interference index, is the average vulnerability discovery rate, ranging from , Is the longest vulnerability repair time, indicating the maximum value of all vulnerability repair times, and the value range is , is the average vulnerability closure rate, ranging from .

[0010] A further improvement of the technical solution of the present invention is that in step 4, the process of dividing abnormal warning levels for warning is as follows: Step 401, using a log collection tool, centrally collects system event logs, application logs and security logs into a log management server, encrypts the stored log data, and uses an integrity verification mechanism, such as a digital signature, to ensure that the log data has not been tampered with; Step 402: Use a security information and event management (SIEM) tool (such as IBM QRadar, Splunk, etc.) and configure rules to monitor log data in real time, apply machine learning technology to process and analyze log data, perform anomaly detection, identify abnormal login, abnormal access, and abnormal traffic behavior patterns, train models to identify abnormal login, abnormal access, and abnormal traffic behavior, and discover potential security threats; Step 403: Based on the risk assessment index and the vulnerability security interference index, a comprehensive analysis is performed to obtain an abnormality warning coefficient, and combined with the abnormality detection results, the potential threat level of the identified abnormality to the system and data assets is evaluated; Step 404, based on the anomaly warning coefficient and the anomaly detection result, the potential threat of the anomaly to the system and data assets is divided into three anomaly warning levels, namely the first warning level, the second warning level and the third warning level, wherein the warning level increases step by step from the first level to the third level, and a corresponding warning threshold is matched for each warning level.

[0011] A further improvement of the technical solution of the present invention is that the calculation formula of the abnormal warning coefficient is: ; in, is the abnormal warning coefficient, It is risk assessment index, indicating the assessment value of different risk categories, is corresponding to No. Vulnerability security interference index, is the total number of risk categories, It is Anomaly scores are calculated by a machine learning model based on log data. is the total number of anomaly detection points, The value of will increase with the increase of risk index and vulnerability interference index, indicating that the system faces greater security threats. The square root of the sum of squares of anomaly scores is used to emphasize the importance of anomaly detection results, especially when anomalies occur at multiple detection points at the same time.

[0012] A further improvement of the technical solution of the present invention is that the corresponding warning thresholds matched with different abnormal warning levels are: Level 1 warning , triggering a level 1 warning, indicating that the potential threat is low and may require basic monitoring and review, reviewing abnormal events, recording and monitoring, and may require increased monitoring frequency; Level 2 warning , triggering a level 2 warning, indicating that the potential threat is moderate and requires further analysis and possible mitigation measures. In-depth analysis of the cause of the anomaly, preparation of mitigation measures, and possible isolation of affected resources are required; Level 3 warning , triggering a third-level warning, indicating that the potential threat is high and requires immediate attention and emergency response, and immediate action, such as disconnecting the network, restarting the system, and restoring data; in, is the abnormal warning coefficient, is the lower threshold corresponding to the second-level warning level and the upper threshold corresponding to the first-level warning level, It is the lower threshold corresponding to the third warning level and the upper threshold corresponding to the second warning level.

[0013] A further improvement of the technical solution of the present invention is that in step 5, the process of establishing an early warning mechanism and implementing emergency response plans for each abnormal warning level is as follows: Step 501, obtaining detailed information of abnormal behaviors and potential threats from security information and event management tools and machine learning analysis, and determining the abnormal warning level according to the severity and potential impact of the abnormal behaviors; Step 502: Establish an early warning mechanism based on the determined abnormal warning level, implement the corresponding emergency response plan, and issue early warning information to relevant personnel through email, SMS, system notification and other methods according to the warning level. Emergency response plan for level 1 warning: increase monitoring frequency, review the context of abnormal activities, and notify relevant personnel to conduct preliminary investigation; emergency response plan for level 2 warning: conduct in-depth analysis to determine the cause of the abnormality, prepare and possibly implement mitigation measures, such as isolating the system or network, updating log records, and conducting a more in-depth review; emergency response plan for level 3 warning: take immediate action, such as cutting off the network connection of the affected system, initiating disaster recovery and data backup and recovery processes, and conducting a comprehensive security review and system reinforcement; Step 503, conduct a detailed analysis of each exception handling process, summarize the effectiveness of the emergency response, and adjust the monitoring strategy, early warning mechanism and emergency response plan based on the event analysis results.

[0014] Due to the adoption of the above technical solution, the present invention has the following technical advances compared with the prior art: The present invention provides a security management method applied to software development data. By establishing a risk assessment framework, it is possible to regularly conduct risk assessments on data assets, promptly discover potential security issues, and formulate corresponding risk management measures based on the risk assessment results. At the same time, by setting different warning levels and formulating emergency response plans for each level, it is possible to quickly respond to various security incidents and reduce the impact of security incidents on the business. In addition, through continuous risk assessment and monitoring, security vulnerabilities can be discovered and repaired in a timely manner, thereby improving the defense capability against new security threats.

[0015] The present invention provides a security management method applied to software development data. Through the identification and classification of data assets, the composition and distribution of data assets can be clearly understood, providing a basis for subsequent protection measures. Secondly, the introduction of risk assessment index and vulnerability security interference index can quantitatively evaluate the security risks faced by data assets, so as to formulate protection strategies more targetedly. In addition, the calculation of abnormal warning coefficient, combined with real-time monitoring and machine learning technology, further enhances the ability to identify and respond to potential security threats. The implementation of these measures ensures the security of data assets during collection, storage, processing and transmission, and effectively prevents the occurrence of data leakage, abuse and destruction. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present invention. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0017] Figure 1 is a flow chart of the method of the present invention; Figure 2 A flow chart of the present invention for conducting risk assessment on each data asset and analyzing the degree of interference of vulnerabilities on the security of each data asset; Figure 3 A flow chart of the present invention for classifying abnormal warning levels for early warning. DETAILED DESCRIPTION

[0018] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0019] Embodiment 1, as Figure 1 , Figure 2 As shown, the present invention provides a security management method for software development data, comprising the following steps: Step 1: Identify the key data assets associated with the software development process, including source code, configuration files, databases, and user data, and classify them according to the sensitivity and value of the data, determine the security level of each type of data, review the software development environment, and identify all key data assets, including source code, configuration files, databases, and user data. The source code contains the program code that implements the logic and functions of the software and is one of the core assets of the software. The configuration file is used to set the software operating environment and parameters, and may contain sensitive configuration information, such as database connection strings, API keys, etc. The database stores the core of application data and contains key information such as user information, business data, and transaction records. User data is all information generated or provided by users, such as personal information, account information, transaction records, communication records, etc. The leakage of this data may have a serious impact on user privacy and rights. Create a data asset list, including data According to the type, location, usage and person in charge of the data assets, conduct sensitivity and value analysis for each type of data assets, and assess the risk level caused by data leakage or unauthorized access. The source code is highly sensitive because it contains application logic and business rules. The configuration file is of medium sensitivity, containing system settings and sensitive parameters. The database is of high sensitivity, containing personal information and business data. The user data is of high sensitivity, containing personal identification information and privacy data. The source code is of high value and directly affects the function and security of the application. The configuration file is of medium value and affects the system configuration and operation status. The database is of high value and stores key business and user data. The user data is of high value and is directly related to user privacy and legal compliance. According to the sensitivity and value of the data, the data assets are divided into different categories, and the security level of each type of data asset is recorded in the system, which are low security level, medium security level and high security level, respectively, to ensure that the corresponding protection measures are followed; Step 2: According to the classification results of data security levels, formulate corresponding data security policies and control measures, and classify and protect data according to the sensitivity and importance of data. According to the classification results of the security level of each type of data assets, classify and label data, and formulate corresponding data security policies to determine the protection requirements of each type of data assets, including encryption, access control, auditing, and backup to ensure the confidentiality, integrity and availability of data. The policy content should include but is not limited to: Access control: according to the security level of data, set different access rights. Highly sensitive data should only be accessible to specific authorized personnel, and multi-factor authentication should be implemented; Encryption protection: highly sensitive and medium sensitive data should be encrypted; Encrypted storage and transmission to ensure that data is not obtained by unauthorized third parties during transmission and storage; Backup and recovery: Back up data regularly and develop a data recovery plan to quickly restore data and reduce losses when data is lost or damaged; Security audit: Record data access and operation behaviors, conduct regular security audits, and discover potential security threats and vulnerabilities; Compliance requirements: Ensure that data processing activities comply with relevant laws, regulations and industry standards, such as GDPR, HIPAA, etc., develop and test emergency response plans to take prompt action when data leaks or other security incidents occur, and implement specific control measures based on the formulated data security strategy to ensure that the strategy is effectively implemented; Step 3: Establish a risk assessment framework, determine risk assessment indicators, conduct risk assessments on each data asset, configure vulnerability scanning tools, measure vulnerability management indicators, analyze the degree of security interference of vulnerabilities on each data asset, formulate a risk assessment plan based on the collected data asset information, and establish a risk assessment framework to determine risk assessment indicators, including risk identification rate, risk assessment frequency, and risk response time, in order to identify potential sources of risk and risk types, and analyze the impact of each risk on data assets. Among them, risk identification rate: measures the ratio of the number of potential risks identified during the assessment process to the number of actual risks. Risk assessment frequency: defines the cycle of risk assessment, such as a comprehensive assessment every quarter, every six months, or every year. Risk response time: the time required from the identification of a risk to the adoption of corresponding countermeasures. By conducting risk assessments on each data asset, identify and analyze the risks brought about by data leakage or unauthorized access, and use quantitative and qualitative methods to evaluate different risks, determine their probability of occurrence and impact, set risk tolerance based on the probability and impact of the risk, and combine them to obtain a risk assessment index. Evaluate the sensitivity and value of each type of data asset based on the risk assessment index. Values, classify security risks into different levels, namely low security risk level, medium security risk level and high security risk level, determine their security risk levels, and conduct risk assessments on each type of data assets according to the risk assessment plan, identify and analyze potential security risks, configure vulnerability scanning tools (such as Nessus, Qualys, OpenVAS, etc.), cover all key data assets and system components, scan systems and applications regularly, measure vulnerability management indicators, including vulnerability discovery rate, vulnerability repair time and vulnerability closure rate, ensure timely discovery and repair of vulnerabilities, and generate scanning reports, including vulnerability details and security recommendations, among which, vulnerability discovery rate: measures the number of vulnerabilities discovered by vulnerability scanning tools within a specific time period, vulnerability repair time: the time required from the discovery of a vulnerability to the completion of repair, vulnerability closure rate: the ratio of the number of repaired vulnerabilities to the total number of discovered vulnerabilities, reflecting the efficiency and quality of vulnerability management, based on the measured vulnerability discovery rate, vulnerability repair time and vulnerability closure rate vulnerability management indicators, calculate the vulnerability security interference index, evaluate the potential security interference of vulnerabilities on each data asset, analyze the risks that may be caused by vulnerabilities, and determine the priority and repair order of vulnerabilities; Furthermore, the calculation formula of the risk assessment index is: ; in, is the risk assessment index, It is The risk identification rate of each risk, the value range , is the number of risks identified, is the maximum risk tolerance, which is a constant representing the maximum risk level theoretically acceptable. , is the frequency of risk assessment, expressed as the inverse of the period expressed as a natural logarithm. For example, if the assessment is conducted once a year, , value range , is the average risk response time, is the standard value of risk response time, which is a constant and represents the ideal response time. The lower the value, the more deficiencies in risk management and the need to improve risk identification and response capabilities. The higher the value, the more it reflects the efficiency and effectiveness of risk management to a certain extent; The calculation formula of vulnerability security interference index is: ; in, is the vulnerability security interference index, is the average vulnerability discovery rate, ranging from , Is the longest vulnerability repair time, indicating the maximum value of all vulnerability repair times, and the value range is , is the average vulnerability closure rate, ranging from , The lower the value, the better the vulnerability management is, and the higher the efficiency of vulnerability discovery, repair and closure; Step 4: Collect system logs and application logs centrally, implement real-time monitoring and data analysis, comprehensively analyze risk assessment results and vulnerability analysis results, perform anomaly detection, and identify abnormal behaviors and potential security threats; Step 5: Based on the monitoring and detection results, classify abnormal behaviors and potential security threats, determine the abnormal warning level, establish an early warning mechanism, and implement emergency response plans for each abnormal warning level.

[0020] Embodiment 2, as Figure 3 As shown, based on Example 1, the present invention provides a technical solution: Preferably, in step 4, the process of dividing the abnormal warning level for warning is: Use log collection tools to centrally collect system event logs, application logs, and security logs into the log management server, encrypt the stored log data, use integrity verification mechanisms such as digital signatures to ensure that log data has not been tampered with, use security information and event management (SIEM) tools (such as IBM QRadar, Splunk, etc.) and configure rules to monitor log data in real time, apply machine learning technology to process and analyze log data, perform anomaly detection, identify abnormal login, abnormal access, and abnormal traffic behavior patterns, train models to identify abnormal login, abnormal access, and abnormal traffic behaviors, and discover potential security threats. Based on the risk assessment index and vulnerability security interference index, a comprehensive analysis is performed to obtain the anomaly warning coefficient. Combined with the anomaly detection results, the potential threat level of the identified anomalies to the system and data assets is evaluated. Based on the anomaly warning coefficient and the anomaly detection results, the potential threats of anomalies to the system and data assets are divided into three anomaly warning levels, namely, the first warning level, the second warning level, and the third warning level. The warning level increases in threat level from level one to level three, and the corresponding warning threshold is matched for each warning level; Furthermore, the calculation formula of the abnormal warning coefficient is: ; in, is the abnormal warning coefficient, It is risk assessment index, indicating the assessment value of different risk categories, is corresponding to No. Vulnerability security interference index, is the total number of risk categories, It is Anomaly scores are calculated by a machine learning model based on log data. is the total number of anomaly detection points, The value of will increase with the increase of risk index and vulnerability interference index, indicating that the system faces greater security threats. The square root of the sum of squares of anomaly scores is used to emphasize the importance of anomaly detection results, especially when anomalies occur at multiple detection points at the same time; Furthermore, the corresponding warning thresholds matched by different abnormal warning levels are: Level 1 warning , triggering a level 1 warning, indicating that the potential threat is low and may require basic monitoring and review, reviewing abnormal events, recording and monitoring, and may require increased monitoring frequency; Level 2 warning , triggering a level 2 warning, indicating that the potential threat is moderate and requires further analysis and possible mitigation measures. In-depth analysis of the cause of the anomaly, preparation of mitigation measures, and possible isolation of affected resources are required; Level 3 warning , triggering a third-level warning, indicating that the potential threat is high and requires immediate attention and emergency response, and immediate action, such as disconnecting the network, restarting the system, and restoring data; in, is the abnormal warning coefficient, is the lower threshold corresponding to the second-level warning level and the upper threshold corresponding to the first-level warning level, The lower threshold corresponding to the third warning level and the upper threshold corresponding to the second warning level; In step 5, the process of establishing an early warning mechanism and implementing emergency response plans for each abnormal warning level is as follows: Obtain detailed information on abnormal behaviors and potential threats from security information and event management tools and machine learning analysis, determine the abnormal warning level based on the severity and potential impact of the abnormal behavior, establish an early warning mechanism based on the determined abnormal warning level, implement the corresponding emergency response plan, and issue early warning information to relevant personnel through emails, text messages, and system notifications based on the warning level. The first-level warning level emergency response plan: increase the monitoring frequency, review the context of abnormal activities, and notify relevant personnel to conduct a preliminary investigation; the second-level warning level emergency response plan: conduct in-depth analysis to determine the cause of the abnormality, prepare and possibly implement mitigation measures, such as isolating the system or network, updating log records, and conducting a deeper review; the third-level warning level emergency response plan: take immediate action, such as cutting off the network connection of the affected system, initiating disaster recovery and data backup and recovery processes, conducting a comprehensive security review and system reinforcement, conducting a detailed analysis of each abnormal handling process, summarizing the effectiveness of the emergency response, and adjusting the monitoring strategy, early warning mechanism, and emergency response plan based on the results of the event analysis.

[0021] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A security management method for software development data, characterized in that: The following steps are involved: Step 1: Identify the key data assets associated with the software development process, including source code, configuration files, databases, and user data, and classify them according to the sensitivity and value of the data to determine the security level of each type of data; Step 2: According to the classification results of data security levels, formulate corresponding data security policies and control measures, and classify and protect data according to its sensitivity and importance; Step 3: Establish a risk assessment framework, determine risk assessment indicators, conduct risk assessments on each data asset, configure vulnerability scanning tools, measure vulnerability management indicators, and analyze the degree of security interference of vulnerabilities on each data asset; Step 4: Collect system logs and application logs centrally, implement real-time monitoring and data analysis, comprehensively analyze risk assessment results and vulnerability analysis results, perform anomaly detection, and identify abnormal behaviors and potential security threats; Step 5: Based on the monitoring and detection results, classify abnormal behaviors and potential security threats, determine the abnormal warning level, establish an early warning mechanism, and implement emergency response plans for each abnormal warning level.

2. The method for secure management of software development data according to claim 1, characterized in that: In step 1, the process of determining the security level of each type of data is as follows: Step 101, review the software development environment, identify all key data assets, including source code, configuration files, databases, user data, and create a data asset inventory, including the type, location, usage, and owner of the data; Step 102, perform sensitivity and value analysis on each type of data asset to assess the risk level of data leakage or unauthorized access; Step 103, according to the sensitivity and value of the data, the data assets are classified into different categories, and the security level of each type of data assets is recorded in the system, which are low security level, medium security level and high security level.

3. A method for secure management of software development data according to claim 2, characterized in that: In step 2, the process of classifying and protecting data according to its sensitivity and importance is as follows: Step 201, classify and label data according to the classification results of the security level of each type of data assets, and formulate corresponding data security policies; Step 202, determine the protection requirements for each type of data asset, including encryption, access control, auditing, and backup; Step 203, formulate and test an emergency response plan, and implement specific control measures based on the formulated data security policy.

4. The method for security management of software development data according to claim 3, characterized in that: In step 3, the process of conducting risk assessment on each data asset and analyzing the degree of interference of vulnerabilities on the security of each data asset is as follows: Step 301: Based on the collected data asset information, formulate a risk assessment plan, establish a risk assessment framework, and determine risk assessment indicators, including risk identification rate, risk assessment frequency, and risk response time, to identify potential risk sources and risk types, and analyze the impact of each risk on data assets; Step 302, by conducting risk assessment on each data asset, identifying and analyzing the risks brought by data leakage or unauthorized access, and using quantitative and qualitative methods to assess different risks, determine the probability of occurrence and the degree of impact, set the risk tolerance according to the probability and impact of the risk, and combine them to obtain a risk assessment index; Step 303: Evaluate the sensitivity and value of each type of data asset according to the risk assessment index, classify the security risks into different levels, namely low security risk level, medium security risk level and high security risk level, determine their security risk levels, and perform risk assessment on each type of data asset according to the risk assessment plan to identify and analyze potential security risks; Step 304: configure vulnerability scanning tools to cover all key data assets and system components, scan systems and applications regularly, measure vulnerability management indicators, including vulnerability discovery rate, vulnerability repair time, and vulnerability closure rate, ensure that vulnerabilities are discovered and repaired in a timely manner, and generate scanning reports including vulnerability details and security recommendations; Step 305, based on the measured vulnerability management indicators of vulnerability discovery rate, vulnerability repair time and vulnerability closure rate, calculate the vulnerability security interference index, evaluate the potential security interference of the vulnerability on each data asset, analyze the risks that the vulnerability may cause, and determine the priority and repair order of the vulnerability.

5. A method for secure management of software development data according to claim 4, characterized in that: The calculation formula of the risk assessment index is: ； in, is the risk assessment index, It is The risk identification rate of each risk, is the number of risks identified, is the maximum risk tolerance, which is a constant. is the risk assessment frequency, is the average risk response time, is the standard value of risk response time, which is a constant; The calculation formula of the vulnerability security interference index is: ； in, is the vulnerability security interference index, is the average vulnerability discovery rate, is the longest vulnerability repair time, indicating the maximum value of all vulnerability repair times. is the average vulnerability closure rate.

6. A method for secure management of software development data according to claim 5, characterized in that: In step 4, the process of classifying abnormal warning levels and issuing warnings is as follows: Step 401, using a log collection tool, centrally collects system event logs, application logs and security logs into a log management server, and encrypts the stored log data; Step 402: Use security information and event management tools and configure rules to monitor log data in real time, apply machine learning technology to process and analyze log data, perform anomaly detection, identify abnormal login, abnormal access, and abnormal traffic behavior patterns, train models to identify abnormal login, abnormal access, and abnormal traffic behavior, and discover potential security threats; Step 403: Based on the risk assessment index and the vulnerability security interference index, a comprehensive analysis is performed to obtain an abnormality warning coefficient, and combined with the abnormality detection results, the potential threat level of the identified abnormality to the system and data assets is evaluated; Step 404, based on the anomaly warning coefficient and the anomaly detection result, the potential threat of the anomaly to the system and data assets is divided into three anomaly warning levels, namely the first warning level, the second warning level and the third warning level, wherein the warning level increases step by step from the first level to the third level, and a corresponding warning threshold is matched for each warning level.

7. A method for secure management of software development data according to claim 6, characterized in that: The calculation formula of the abnormal warning coefficient is: ； in, is the abnormal warning coefficient, It is A risk assessment index, is corresponding to No. Vulnerability security interference index, is the total number of risk categories, It is Anomaly score, is the total number of anomaly detection points.

8. A method for secure management of software development data according to claim 7, characterized in that: The corresponding warning thresholds matched with different abnormal warning levels are: Level 1 warning ; Level 2 warning ; Level 3 warning ; in, is the abnormal warning coefficient, is the lower threshold corresponding to the second-level warning level and the upper threshold corresponding to the first-level warning level, It is the lower threshold corresponding to the third warning level and the upper threshold corresponding to the second warning level.

9. A method for secure management of software development data according to claim 8, characterized in that: In step 5, the process of establishing an early warning mechanism and implementing emergency response plans for each abnormal warning level is as follows: Step 501, obtaining detailed information of abnormal behaviors and potential threats from security information and event management tools and machine learning analysis, and determining the abnormal warning level according to the severity and potential impact of the abnormal behaviors; Step 502: Establish an early warning mechanism based on the determined abnormal early warning level, implement a corresponding emergency response plan, and issue early warning information to relevant personnel through email, SMS, system notification, etc. according to the early warning level; Step 503, conduct a detailed analysis of each exception handling process, summarize the effectiveness of the emergency response, and adjust the monitoring strategy, early warning mechanism and emergency response plan based on the event analysis results.

Images