Data security assessment method and device, storage medium and computer program product

Abstract

The invention provides a data security assessment method and device, a storage medium and a computer program product. The method comprises the following steps: based on characteristics of an evaluation object, selecting an evaluation question related to an evaluation demand from a preset question library, and generating a questionnaire; wherein the evaluation problem corresponds to at least two options, and each option has a specific score; determining to-be-evaluated data corresponding to the questionnaire according to the reply of the evaluation object to the questionnaire; wherein the to-be-evaluated data comprises a quantitative analysis value and a qualitative analysis value of the evaluation problem; and performing data security assessment on the to-be-assessed data to obtain a data security assessment result of the assessment object. According to the embodiment of the invention, when the data security assessment result is calculated, the weight of the assessment problem does not need to be calculated, and even if the assessment problem in the preset problem library is changed, the weight of each assessment problem does not need to be re-calculated, so that the flexibility is relatively high, the maintenance is convenient, and the assessment efficiency is relatively high.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a data security assessment method, device, storage medium and computer program product. Background Art

[0002] With the development of network technology, data security has become an important part of network security, and data security assessment is very important. After the data is collected, how to quantify and quantify the data is particularly important. The scoring tools currently used usually have fixed factors, fixed processes and fixed calculation formulas. In this way, the scoring process is fixed, and the evaluation factors adopted may not exist for specific enterprises. They cannot be adjusted to meet the needs of enterprises that need extra attention in their own operations. They are not flexible to use and cannot meet the needs of enterprises to score according to their own conditions.

[0003] In order to solve the above problems, the traditional technology obtains all questions and their weights, calculates the scores of all questions according to the score weight rule and the weighted average principle, and finally derives the final score of all questions. However, in this way, all questions and weights need to be determined, and the sum of the weights of all questions must be 100. If the questions in the question bank are changed, the weight of each question in the question bank needs to be recalculated, which loses flexibility, is difficult to maintain, and is inefficient. Summary of the invention

[0004] In view of at least one of the above technical problems existing in the prior art, this application is proposed. According to one aspect of this application, a data security assessment method is provided, the method comprising:

[0005] Based on the characteristics of the evaluation object, select evaluation questions related to the evaluation needs from a preset question library to generate a questionnaire; wherein the evaluation question corresponds to at least two options, each option having a specific score;

[0006] Determining the data to be evaluated corresponding to the questionnaire through the response of the evaluation object to the questionnaire; wherein the data to be evaluated includes the quantitative analysis value and the qualitative analysis value of the evaluation question;

[0007] Performing a data security assessment on the data to be assessed to obtain a data security assessment result of the assessment object.

[0008] In some embodiments, determining the data to be evaluated corresponding to the questionnaire through the response of the evaluation subject to the questionnaire includes:

[0009] Determine the score of each of the evaluation questions according to the selected option made by the evaluation subject for each of the evaluation questions and the corresponding score of the selected option;

[0010] According to the score of each evaluation question, the to-be-evaluated data corresponding to the questionnaire is determined.

[0011] In some embodiments, determining the data to be evaluated corresponding to the questionnaire according to the score of each evaluation question includes:

[0012] The score of the data to be evaluated corresponding to the questionnaire is calculated according to the preset calculation rules and the score of each evaluation question.

[0013] In some embodiments, calculating the score of the data to be evaluated corresponding to the questionnaire according to a preset calculation rule and the score of each evaluation question includes:

[0014] Calculate the maximum, minimum, average and statistics of the scores of all the assessment questions;

[0015] The score of the data to be evaluated corresponding to the questionnaire according to the maximum value, minimum value, average value and statistical number of the scores of all the evaluation questions.

[0016] In some embodiments, calculating the score of each of the evaluation questions according to a preset calculation rule and the corresponding score of the selected option includes:

[0017] Calculating the maximum, minimum, and average scores of all of the assessment questions;

[0018] The score of the data to be evaluated corresponding to the questionnaire according to the maximum value, minimum value and average value of the scores of all the evaluation questions.

[0019] In some embodiments, performing a data security assessment on the data to be assessed to obtain a data security assessment result of the assessment object includes:

[0020] Determine quantitative results for each of said assessment questions;

[0021] Determining a quantitative result for each of the evaluation questions Determining a qualitative result for the evaluation questions;

[0022] Based on the qualitative results, a risk value of each of the assessment questions is determined.

[0023] In some embodiments, when the risk value is in the first range, the data security of the data to be evaluated is rated as basically unqualified;

[0024] When the risk value is in the second range, the data security of the data to be evaluated is rated as basically qualified;

[0025] When the risk value is within the third range, the data security of the data to be evaluated is rated as fully qualified.

[0026] In some embodiments, the method further comprises:

[0027] Verifying the data security assessment results;

[0028] The verification of the data security assessment results includes:

[0029] Calculating the first data to be evaluated of the questionnaire by using a first calculation rule;

[0030] Determine a first data security assessment result according to the first assessment data;

[0031] Verify whether the data security assessment result is correct based on the first data security assessment result.

[0032] In some embodiments, the method further comprises:

[0033] Collecting a first evaluation question, at least two first options corresponding to the first evaluation question, and scores corresponding to the at least two first options;

[0034] The preset question library is constructed according to the first evaluation question, the at least two first options and the scores corresponding to the at least two first options.

[0035] In some embodiments, the method further comprises:

[0036] Perform management operations on the preset question library; the management operations at least include updating, adding and deleting the evaluation questions and the options corresponding to the evaluation questions.

[0037] Another aspect of the present application embodiment provides a data security assessment method and device, the device comprising:

[0038] A memory and a processor, wherein the memory stores a computer program executed by the processor, and when the computer program is executed by the processor, the processor executes the data security assessment method as described above.

[0039] On another aspect, an embodiment of the present application provides a storage medium, on which a computer program is stored. When the computer program is executed by a processor, the processor executes the data security assessment method as described above.

[0040] On the other hand, the embodiments of the present application provide a computer program product, which implements the steps of the above method when the computer program / instructions are executed by a processor.

[0041] The data security assessment method of the embodiment of the present application generates a questionnaire by selecting assessment questions related to the assessment requirements from a preset question library, determines the data to be assessed corresponding to the questionnaire through the responses of the assessment subject to the questionnaire, and performs a data security assessment on the data to be assessed to obtain the data security assessment results of the assessment subject. Since the options corresponding to the assessment questions have specific scores, there is no need to calculate the weights of the assessment questions when calculating the data security assessment results. Even if the assessment questions in the preset question library are changed, there is no need to recalculate the weights of each assessment question. Therefore, it has high flexibility, convenient maintenance, and high assessment efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0043] Figure 1 A schematic flow chart showing a data security assessment method according to an embodiment of the present application;

[0044] Figure 2 A schematic flowchart of step S102 according to an embodiment of the present application is shown;

[0045] Figure 3 A schematic flowchart of step S202 according to an embodiment of the present application is shown;

[0046] Figure 4 A schematic flowchart of step S202 according to another embodiment of the present application is shown;

[0047] Figure 5 A schematic flow chart showing step S202 according to another embodiment of the present application is shown;

[0048] Figure 6 A schematic flowchart of step S103 according to an embodiment of the present application is shown;

[0049] Figure 7 A schematic flowchart of verifying a data security assessment result according to an embodiment of the present application is shown;

[0050] Figure 8 A schematic flowchart of step S601 according to an embodiment of the present application is shown;

[0051] Fig. 9 A schematic flow chart of constructing a preset question library according to an embodiment of the present application is shown;

[0052] Fig.10 A schematic flowchart of managing the preset question library according to an embodiment of the present application is shown;

[0053] Fig.11 A schematic flow chart showing a data security assessment method according to another embodiment of the present application;

[0054] Fig.12 A schematic block diagram of a data security assessment system according to an embodiment of the present application is shown;

[0055] Fig.13 A schematic block diagram of a data security assessment device according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0056] In order to enable those skilled in the art to better understand the technical solutions of the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0057] Based on at least one of the above technical problems, the present application provides a data security assessment method, the method comprising: based on the characteristics of the assessment object, selecting assessment questions related to the assessment requirements from a preset question library, and generating a questionnaire; wherein the assessment question corresponds to at least two options, each of which has a specific score; through the assessment object's reply to the questionnaire, determining the data to be assessed corresponding to the questionnaire; wherein the data to be assessed includes the quantitative analysis value and the qualitative analysis value of the assessment question; performing a data security assessment on the data to be assessed to obtain the data security assessment result of the assessment object. The data security assessment method of the embodiment of the present application, by selecting assessment questions related to the assessment requirements from a preset question library, generating a questionnaire, through the assessment object's reply to the questionnaire, determining the data to be assessed corresponding to the questionnaire, performing a data security assessment on the data to be assessed to obtain the data security assessment result of the assessment object, since the options corresponding to the assessment questions have specific scores, therefore, when calculating the data security assessment result, there is no need to calculate the weight of the assessment question, even if the assessment question in the preset question library changes, there is no need to recalculate the weight of each assessment question, therefore, it has high flexibility, convenient maintenance, and high assessment efficiency.

[0058] Figure 1 A schematic flow chart of a data security assessment method according to an embodiment of the present application is shown; Figure 1As shown, the data security assessment method 100 according to the embodiment of the present application may include the following steps S101, S102 and S103:

[0059] In step S101, based on the characteristics of the evaluation object, evaluation questions related to the evaluation requirements are selected from a preset question library to generate a questionnaire.

[0060] The evaluation question corresponds to at least two options, and each option has a specific score.

[0061] The evaluation object of the embodiment of the present application may include a regulated unit. The characteristics of the evaluation object refer to the basic information about the evaluation object obtained through preliminary investigation, such as the project of the evaluation object, etc. The evaluation requirement refers to whether a basic data security evaluation is performed on the evaluation object, or an in-depth security evaluation is performed on the evaluation object. For example, when conducting a basic data security evaluation, it is necessary to determine whether the evaluation object meets the indicators of policy requirements such as the basic requirements for information security technology network security level protection, the data security law and information security technology key information infrastructure security protection requirements; when conducting an in-depth security evaluation, the requirements for the evaluation object are higher than the above indicators, etc.

[0062] The minimum granularity of the embodiment of the present application is the evaluation problem. As is well known, the smaller the granularity, the more detailed the evaluation of data security and the more accurate the data evaluation.

[0063] For example, the options for assessment question A are "yes" and "no". The options for assessment question B are "a,b,c,d,e".

[0064] In step S102, the data to be evaluated corresponding to the questionnaire is determined through the response of the evaluation object to the questionnaire; wherein the data to be evaluated includes the quantitative analysis value and the qualitative analysis value of the evaluation question.

[0065] In one embodiment of the present application, Figure 2 As shown, step S102 determines the to-be-evaluated data corresponding to the questionnaire through the response of the evaluation object to the questionnaire, including step S201 and step S202:

[0066] In step S201, the score of each evaluation question is determined according to the selected option made by the evaluation subject for each evaluation question and the corresponding score of the selected option;

[0067] In step S202, the to-be-evaluated data corresponding to the questionnaire is determined according to the score of each evaluation question.

[0068] It is worth noting that assessment questions can be single-choice questions or multiple-choice questions. If the assessment question is a multiple-choice question, the options are an array of scores.

[0069] For example: Assessment question A has options of "yes" and "no". Question A is a single-choice question. When the subject selects "yes", the score is 5, and when the subject selects "no", the score is 1. Assessment question B has options of "a, b, c, d, e", which is a multiple-choice question. When the subject selects "a", the score is 1, when the subject selects "b", the score is 2, when the subject selects "c", the score is 3, when the subject selects "d", the score is 4, and when the subject selects "e", the score is 5.

[0070] In one embodiment of the present application, Figure 3 As shown, step S202 determines the to-be-evaluated data corresponding to the questionnaire according to the score of each evaluation question, including step S301:

[0071] In step S301, the score of the to-be-evaluated data corresponding to the questionnaire is calculated according to a preset calculation rule and the score of each evaluation question.

[0072] In one embodiment of the present application, Figure 4 As shown, step S202 calculates the score of the to-be-evaluated data corresponding to the questionnaire according to the preset calculation rules and the score of each of the evaluation questions, including step S401 and step S402:

[0073] In step S401, the maximum value, minimum value, average value and statistical number of the scores of all the evaluation questions are calculated;

[0074] In step S402, the scores of the to-be-evaluated data corresponding to the questionnaire are obtained according to the maximum value, minimum value, average value and statistical number of the scores of all the evaluation questions.

[0075] In the embodiment of the present application, after calculating the score value of the minimum granularity evaluation question, the comprehensive score value of the evaluation question is calculated based on the scores of all evaluation questions.

[0076] Specifically, the maximum, minimum, average and statistical number can be calculated based on the scores of all evaluation questions. For example, for evaluation question A in all questionnaires, the maximum value of the selected options is 1, the minimum value is 1, the average is 1, and the statistical number is 1. For evaluation question B in all questionnaires, the maximum value of the selected options is 4, the minimum value is 2, the average is 3, and the statistical number is 3.

[0077] In another embodiment of the present application, Figure 5As shown, step S202 calculates the score of each evaluation question according to the preset calculation rules and the corresponding score of the selected option, including step S403 and step S404:

[0078] In step S403, the maximum, minimum and average values ​​of the scores of all the evaluation questions are calculated;

[0079] In step S404, the score of the to-be-evaluated data corresponding to the questionnaire is obtained according to the maximum value, the minimum value and the average value of the scores of all the evaluation questions.

[0080] In the embodiment of the present application, the calculation rule can also be customized, and the customized calculation rule can be an average value method, etc. For example, for evaluation question A, the average value is x=1, and for evaluation question B, the average value is x=2.

[0081] In one example, the default calculation rule can be set to the statistical method, and when no calculation rule is set, the average method is used for calculation. The statistical method and the average method can also be set, and the user can choose which method to use for the evaluation object.

[0082] In step S103, a data security assessment is performed on the data to be assessed to obtain a data security assessment result of the assessment object.

[0083] In one embodiment of the present application, Figure 6 As shown, step S103 performs data security assessment on the data to be assessed to obtain the data security assessment result of the assessment object, including step S501, step S502 and step S503:

[0084] In step S501, a quantitative result of each of the evaluation questions is determined;

[0085] In step S502, the quantitative result of each evaluation question is determined to determine the qualitative result of the evaluation question;

[0086] In step S503, the risk value of each assessment question is determined according to the qualitative result.

[0087] In the embodiment of the present application, based on the response results reported by the evaluation subject, the option selected by the evaluation subject for each evaluation question can be known, thereby knowing the score of each evaluation question, thereby determining the quantitative result of each evaluation question.

[0088] Then, the risk value of each assessment question can be determined based on the quantitative results of each assessment question, thereby determining the qualitative results of each assessment question. The risk value of each assessment question can be determined based on the qualitative results of each assessment question.

[0089] In one example, after obtaining the quantitative results of each evaluation question, the risk value of a single evaluation question can be calculated according to the following formula:

[0090] M = 1 - (5 - X) / 4

[0091] Where M represents a floating-point number from 0 to 1, expressed as a percentage; X represents the minimum value of a single evaluation question.

[0092] In an embodiment of the present application, when the risk value is within the first range, the data security of the data to be evaluated is rated as basically unqualified; when the risk value is within the second range, the data security of the data to be evaluated is rated as basically qualified; when the risk value is within the third range, the data security of the data to be evaluated is rated as completely qualified.

[0093] In an embodiment of the present application, according to the custom qualitative range standard, a qualitative evaluation can be performed on a single evaluation item. Then, based on the obtained result judgment, the M value is compared with the custom range to determine the qualitative result of a single evaluation item. For example, the custom qualitative range is that M = 0% is unqualified, 0% < M <= 20% is basically unqualified, 20% < M < 100% is basically qualified, and M = 100% is completely qualified. If the M value is 0, it is unqualified; if the M value is 10%, it is basically unqualified; if the M value is 50%, it is basically qualified; if the M value is 100%, it is completely qualified.

[0094] In an embodiment of the present application, as Figure 7 shown, the method further includes step S601:

[0095] In step S601, verify the data security evaluation result.

[0096] Among them, as Figure 8 shown, verifying the data security evaluation result in step S601 includes step S602, step S603, and step S604:

[0097] Step S602, calculate the first data to be evaluated of the questionnaire using the second calculation rule;

[0098] Step S603, determine the first data security evaluation result according to the first evaluation data;

[0099] Step S604, verify whether the data security evaluation result is correct according to the first data security evaluation result.

[0100] In an embodiment of the present application, as Fig. 9 shown, the method further includes:

[0101] Step S701, collecting a first evaluation question, at least two first options corresponding to the first evaluation question, and scores corresponding to the at least two first options;

[0102] Step S702: construct the preset question library according to the first evaluation question, the at least two first options and the scores corresponding to the at least two first options.

[0103] In one embodiment of the present application, Fig.10 As shown, the method further includes step S801:

[0104] In step S801, management operations are performed on the preset question library.

[0105] The management operation at least includes updating, adding and deleting the evaluation questions and the options corresponding to the evaluation questions.

[0106] For example, as the network develops, new requirements for data security or new evaluation indicators are put forward, and the preset question library needs to be updated. At this time, it is necessary to add evaluation questions in the preset question library or delete old evaluation questions. However, it is not necessary to modify the weight of the evaluation question, but only to configure the corresponding score for the option of the evaluation question.

[0107] In traditional technology, it is necessary to determine all questions and weights, and ensure that the sum of the weights of all questions is 100. If the questions in the question bank change, the weight of each question in the question bank needs to be recalculated. It can be seen that the data security assessment method of traditional technology has low flexibility, is difficult to maintain, and has low assessment efficiency. Compared with traditional technology, the data security assessment method of the embodiment of the present application does not need to calculate the weights of the assessment questions. Even if the assessment questions in the preset question bank change, it is not necessary to calculate the weights of each assessment question. Therefore, it has high flexibility, convenient maintenance, and high assessment efficiency.

[0108] like Fig.11 , which is a schematic flow chart of a data security assessment method according to another embodiment of the present application. The data security assessment method 1100 according to the embodiment of the present application may include the following steps S1101, S1102, S1103, S1104, S1105, S1106, S1107, S1108 and S1109;

[0109] In step S1101, evaluation questions are collected to construct a preset question library, wherein the evaluation questions correspond to at least two options, each of which has a specific score.

[0110] In step S1102, evaluation questions that meet the needs are selected from the preset question library to generate a questionnaire, and the questionnaire is sent to the evaluation object.

[0111] In step S1103, responses to the evaluation questions reported by the evaluation subject are received, wherein the responses include selection options of the evaluation subject to all evaluation questions.

[0112] In step S1104, the score of each evaluation question is calculated according to the pre-configured calculation rules and the selection options of the evaluation object for all evaluation questions.

[0113] In step S1105, the qualitative result of each evaluation question is calculated according to the qualitative scope.

[0114] In step S1106, a final risk value is calculated according to the scores of all evaluation questions to obtain the first qualitative results of all evaluation questions.

[0115] In step S1107, the score of each evaluation question is calculated by manual calculation method according to the selection options of the evaluation object for all evaluation questions.

[0116] In step S1108, all evaluation questions are quantitatively and qualitatively analyzed using manual calculation methods to obtain second qualitative results of all evaluation questions.

[0117] In step S1109, the first qualitative result and the second qualitative result are combined to obtain a final data security assessment result.

[0118] The data security assessment method of the embodiment of the present application generates a questionnaire by selecting assessment questions related to the assessment requirements from a preset question library, determines the data to be assessed corresponding to the questionnaire through the responses of the assessment subject to the questionnaire, and performs a data security assessment on the data to be assessed to obtain the data security assessment results of the assessment subject. Since the options corresponding to the assessment questions have specific scores, there is no need to calculate the weights of the assessment questions when calculating the data security assessment results. Even if the assessment questions in the preset question library are changed, there is no need to recalculate the weights of each assessment question. Therefore, it has high flexibility, convenient maintenance, and high assessment efficiency.

[0119] like Fig.12 , which is a schematic block diagram of a data security assessment system according to an embodiment of the present application. The data security assessment system 1200 according to an embodiment of the present application may include a questionnaire generation module 1201 , a processing module 1202 , and a result generation module 1203 .

[0120] The questionnaire generation module 1201 is used to select evaluation questions related to the evaluation requirements from a preset question library based on the characteristics of the evaluation object, and generate a questionnaire; wherein the evaluation question corresponds to at least two options, and each option has a specific score;

[0121] Processing module 1202, for determining the data to be evaluated corresponding to the questionnaire through the response of the evaluation object to the questionnaire; wherein the data to be evaluated includes the quantitative analysis value and the qualitative analysis value of the evaluation question;

[0122] The result generation module 1203 is used to perform data security assessment on the data to be assessed to obtain the data security assessment result of the assessment object.

[0123] Combine the following Fig.13 The data security assessment device of the present application is described, wherein: Fig.13 A schematic block diagram of a data security assessment device according to an embodiment of the present application is shown.

[0124] like Fig.13 As shown, the data security assessment device 1300 includes: one or more memories 1301 and one or more processors 1302, and the memory 1301 stores a computer program executed by the processor 1302. When the computer program is executed by the processor 1302, the processor 1302 executes the data security assessment method described above.

[0125] The data security assessment device 1300 may be part or all of a computer device that can implement a data security assessment method through software, hardware, or a combination of software and hardware.

[0126] like Fig.13 As shown, the data security assessment device 1300 includes one or more memories 1301, one or more processors 1302, a display (not shown), and a communication interface, etc. These components are interconnected through a bus system and / or other forms of connection mechanisms (not shown). It should be noted that Fig.13 The components and structures of the data security assessment device 1300 shown are merely exemplary and non-limiting. The data security assessment device 1300 may also have other components and structures as required.

[0127] The memory 1301 is used to store various data and executable program instructions generated during the operation of the related method, such as for storing various application programs or algorithms for implementing various specific functions. It can include one or more computer program products, and the computer program product can include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory can include, for example, random access memory (RAM) and / or cache memory (cache), etc. The non-volatile memory can include, for example, read-only memory (ROM), hard disk, flash memory, etc.

[0128] The processor 1302 may be a central processing unit (CPU), a graphics processing unit (GPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other forms of processing units having data processing capabilities and / or instruction execution capabilities, and may be other components in the data security assessment device 1300 to perform desired functions.

[0129] In one example, the data security assessment device 1300 further includes an output device that can output various information (eg, images or sounds) to the outside (eg, a user), and can include one or more of a display device, a speaker, and the like.

[0130] The communication interface can be an interface of any currently known communication protocol, such as a wired interface or a wireless interface, wherein the communication interface may include one or more serial ports, USB interfaces, Ethernet ports, WiFi, wired networks, DVI interfaces, device integrated interconnect modules or other suitable ports, interfaces, or connections.

[0131] In addition, according to an embodiment of the present application, a storage medium is also provided, on which program instructions are stored, and when the program instructions are executed by a computer or a processor, the corresponding steps of the data security assessment method of the embodiment of the present application are executed. The storage medium may include, for example, a memory card of a smart phone, a storage component of a tablet computer, a hard disk of a personal computer, a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a portable compact disk read-only memory (CD-ROM), a USB memory, or any combination of the above storage media.

[0132] In addition, according to an embodiment of the present application, a computer program product is also provided. When the computer program / instructions are executed by a processor, the steps of the data security assessment method described above are implemented.

[0133] The data security assessment system, data security assessment device, storage medium and computer program product of the embodiments of the present application have the same advantages as the aforementioned data security assessment method because they can implement the aforementioned data security assessment method.

[0134] Although example embodiments have been described herein with reference to the accompanying drawings, it should be understood that the above example embodiments are merely exemplary and are not intended to limit the scope of the present application to this. Those of ordinary skill in the art may make various changes and modifications therein without departing from the scope and spirit of the present application. All these changes and modifications are intended to be included within the scope of the present application as required by the appended claims.

[0135] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0136] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed.

[0137] In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

[0138] Similarly, it should be understood that in order to streamline the present application and help understand one or more of the various inventive aspects, in the description of the exemplary embodiments of the present application, the various features of the present application are sometimes grouped together into a single embodiment, figure, or description thereof. However, the method of the present application should not be interpreted as reflecting the following intention: the claimed application requires more features than the features clearly stated in each claim. More specifically, as reflected in the corresponding claims, the inventive point is that the corresponding technical problem can be solved with features less than all the features of a single disclosed embodiment. Therefore, the claims following the specific embodiment are hereby explicitly incorporated into the specific embodiment, wherein each claim itself serves as a separate embodiment of the present application.

[0139] It will be understood by those skilled in the art that, except for mutually exclusive features, all features disclosed in this specification (including the accompanying claims, abstracts and drawings) and all processes or units of any method or device disclosed in this specification may be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstracts and drawings) may be replaced by an alternative feature that provides the same, equivalent or similar purpose.

[0140] In addition, those skilled in the art will appreciate that, although some embodiments described herein include certain features included in other embodiments but not other features, the combination of features of different embodiments is meant to be within the scope of the present application and form different embodiments. For example, in the claims, any one of the claimed embodiments can be used in any combination.

[0141] The various component embodiments of the present application can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all functions of some modules according to the embodiments of the present application. The application can also be implemented as a device program (e.g., computer program and computer program product) for executing a part or all of the methods described herein. Such a program implementing the present application can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0142] It should be noted that the above embodiments illustrate the present application rather than limit the present application, and that those skilled in the art may design alternative embodiments without departing from the scope of the appended claims. In the claims, any reference symbol between brackets should not be constructed as a limitation to the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "one" or "an" preceding an element does not exclude the presence of multiple such elements. The present application may be implemented by means of hardware including several different elements and by means of a suitably programmed computer. In a unit claim that lists several devices, several of these devices may be embodied by the same hardware item. The use of the words first, second, and third, etc. does not indicate any order. These words may be interpreted as names.

[0143] The above is only a specific implementation or description of a specific implementation of the present application, and the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. The protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A data security assessment method, characterized in that: The method comprises: Based on the characteristics of the evaluation object, select evaluation questions related to the evaluation needs from a preset question library to generate a questionnaire; wherein the evaluation question corresponds to at least two options, each option having a specific score; Determining the data to be evaluated corresponding to the questionnaire through the response of the evaluation object to the questionnaire; wherein the data to be evaluated includes the quantitative analysis value and the qualitative analysis value of the evaluation question; Performing a data security assessment on the data to be assessed to obtain a data security assessment result of the assessment object.

2. The method according to claim 1, characterized in that Determining the data to be evaluated corresponding to the questionnaire through the response of the evaluation object to the questionnaire includes: Determine the score of each of the evaluation questions according to the selected option made by the evaluation subject for each of the evaluation questions and the corresponding score of the selected option; According to the score of each evaluation question, the to-be-evaluated data corresponding to the questionnaire is determined.

3. The method according to claim 2, characterized in that According to the score of each evaluation question, the data to be evaluated corresponding to the questionnaire is determined, including: The score of the data to be evaluated corresponding to the questionnaire is calculated according to the preset calculation rules and the score of each evaluation question.

4. The method according to claim 3, characterized in that Calculating the score of the data to be evaluated corresponding to the questionnaire according to the preset calculation rules and the score of each evaluation question, including: Calculate the maximum, minimum, average and statistics of the scores of all the assessment questions; The score of the data to be evaluated corresponding to the questionnaire according to the maximum value, minimum value, average value and statistical number of the scores of all the evaluation questions.

5. The method according to claim 3, characterized in that: Calculating the score of each of the evaluation questions according to the preset calculation rules and the corresponding scores of the selected options includes: Calculating the maximum, minimum, and average scores of all of the assessment questions; The score of the data to be evaluated corresponding to the questionnaire according to the maximum value, minimum value and average value of the scores of all the evaluation questions.

6. The method according to claim 3, characterized in that: Performing a data security assessment on the data to be assessed to obtain a data security assessment result of the assessment object includes: Determine quantitative results for each of said assessment questions; Determining the quantitative results of each of the evaluation questions Determining the qualitative results of the evaluation questions; Based on the qualitative results, a risk value of each of the assessment questions is determined.

7. The method according to claim 6, characterized in that When the risk value is in the first range, the data security of the data to be evaluated is evaluated as basically unqualified; When the risk value is in the second range, the data security of the data to be evaluated is rated as basically qualified; When the risk value is within the third range, the data security of the data to be evaluated is rated as fully qualified.

8. The method according to claim 1, characterized in that The method further comprises: Verifying the data security assessment results; The verification of the data security assessment results includes: Calculating the first data to be evaluated of the questionnaire by using a first calculation rule; Determine a first data security assessment result according to the first assessment data; Verify whether the data security assessment result is correct based on the first data security assessment result.

9. The method according to claim 1, characterized in that: The method further comprises: Collecting a first evaluation question, at least two first options corresponding to the first evaluation question, and scores corresponding to the at least two first options; The preset question library is constructed according to the first evaluation question, the at least two first options and the scores corresponding to the at least two first options.

10. The method according to claim 9, characterized in that The method further comprises: Perform management operations on the preset question library; the management operations at least include updating, adding and deleting the evaluation questions and the options corresponding to the evaluation questions.

11. A data security assessment device, characterized in that: The device comprises: A memory and a processor, wherein the memory stores a computer program executed by the processor, and when the computer program is executed by the processor, the processor executes the data security assessment method according to any one of claims 1 to 10.

12. A storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, enables the processor to execute the data security assessment method according to any one of claims 1 to 10.

13. A computer program product, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images