Network security configuration checking reinforcement method and system based on agency-free architecture

Abstract

The invention relates to a network security configuration checking and reinforcing method and system based on an agent-free architecture, and the method employs the agent-free architecture, directly carries out the communication and operation with a target host system through a preset network protocol, and does not need to install any agent program or client software in the target host system. According to the method, the complexity of system deployment and maintenance is remarkably reduced, the security vulnerability risk of the agent software is avoided, the influence of the agent software on the system performance of the target host is also eliminated, and security configuration checking and reinforcement with lightweight, high security and low performance loss are realized.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a network security configuration verification and reinforcement method and system based on an agentless architecture. Background Art

[0003] Security configuration verification refers to the systematic inspection and verification of various configuration information of network systems, devices or applications to ensure that they comply with industry security standards, best practices and relevant laws and regulations. Security hardening is to further enhance its security, stability and performance by modifying and optimizing system configurations on the basis of security configuration verification, such as shutting down unnecessary services, restricting user permissions, deploying security patches, etc. Security configuration verification and hardening can effectively reduce the security risks and configuration defects in the system, reduce the possibility of network attacks and data leaks, and is an important part of building a deep defense system.

[0004] However, traditional security configuration verification and reinforcement technologies face many challenges in practical applications: First, traditional security configuration verification tools usually rely on agent programs and predefined configuration dictionaries. This approach requires the installation of additional agent software on the target host system, which not only consumes system resources and increases system load, but may also reduce system stability and even introduce incompatible or incorrect configurations, bringing new security risks; secondly, the implementation process of traditional security reinforcement technology is relatively complicated and requires high technical capabilities of operation and maintenance personnel, that is, operation and maintenance personnel need to have an in-depth understanding of various security policies and configuration parameters to effectively use these tools, which undoubtedly increases the difficulty of operation and the possibility of errors; in addition, traditional security configuration verification tools rely on preset configuration dictionaries, which are difficult to update and maintain. That is, with the continuous evolution of network security threats and compliance requirements, preset dictionaries are difficult to update in a timely manner and cannot effectively respond to emerging new security threats, resulting in lagging security protection capabilities.

[0005] In summary, traditional security configuration verification and reinforcement technologies have many shortcomings, such as complex deployment, high security risks, difficult operation and maintenance, and difficult update and maintenance, which are difficult to meet the growing network security needs. Therefore, there is an urgent need for a more efficient, secure, and flexible network security configuration verification and reinforcement solution to cope with the increasingly severe network security challenges and build a more reliable security protection system. Summary of the invention

[0006] In order to solve the above problems, the present invention provides a network security configuration verification and reinforcement method and system based on an agentless architecture, which can efficiently, safely and flexibly improve the security protection capabilities of servers and application systems, while taking into account system stability, performance optimization and convenient operation and maintenance management.

[0007] In order to achieve the above objectives, in a first aspect, an embodiment of the present application provides a network security configuration verification and reinforcement method based on an agentless architecture, comprising the following steps: S1. Obtain preset and user-defined verification baselines, security risk assessment baselines, and reinforcement baselines; S2. Establish a remote connection with the target host system through the agentless architecture using the preset network protocol, and remotely obtain the configuration information and operating environment information of the target host system; S3. Analyze the remotely acquired configuration information according to the verification baseline, identify security risks and configuration defects in the target host system, and generate a configuration verification report; S4. Based on the collected configuration information and operating environment information, as well as the security risk assessment baseline, determine the security risk factor of the reinforcement operation and generate a security risk assessment report; S5. According to the security risk assessment report, you can selectively adjust the target reinforcement items and the corresponding reinforcement scope; S6. Combined with the preset or user-defined reinforcement test strategy, select some target reinforcement items and corresponding reinforcement ranges for reinforcement testing, and generate a reinforcement test report; S7. According to the reinforcement test report, the target reinforcement items and the corresponding reinforcement range can be selectively adjusted; S8. Determine the final target reinforcement items and the corresponding reinforcement scope, and remotely perform reinforcement operations in batches; during the reinforcement operation, dynamically calculate the reinforcement risk value according to the preset risk strategy; S9. If the reinforcement risk value reaches the preset risk threshold, the reinforcement operation is interrupted and the reinforcement is judged as failed; wherein, when the reinforcement fails, the state is automatically rolled back to the state before reinforcement, and after the reinforcement fails, the target reinforcement items and the corresponding reinforcement range are readjusted and the reinforcement operation is continued in batches until all target reinforcement items have completed the reinforcement operation; S10. Collect reinforcement result data and generate a reinforcement report.

[0008] Optionally, the verification baseline includes but is not limited to access control policy, password policy, data encryption policy, and log audit policy.

[0009] Optionally, the agentless architecture means that no agent program or client software needs to be installed in the target host system, but the target host system is communicated directly through a network protocol.

[0010] Optionally, the network protocol includes but is not limited to SSH, SFTP, and WMI.

[0011] Optionally, the configuration information of the target host system includes at least the operating system version and patch level, network configuration, database configuration, and middleware configuration; the operating environment information of the target host system includes at least running processes and services, open network ports, system resource usage, and security logs.

[0012] Optionally, the security risk assessment baseline includes: a) Asset value: Determine the asset value of the target host system based on the configuration information and operating environment information of the target host system. The asset value assessment parameters include operating system version and patch level, network configuration, database configuration, middleware configuration, running processes and services, open network ports, system resource usage, and security logs; b) Hardening dependency: Identify the software associated with the hardening item and the target host system configuration information and operating environment information, and analyze the degree of association; c) Assessment criteria: Based on asset value and reinforcement dependency, use quantitative or qualitative risk assessment methods to conduct risk assessment of reinforcement operations.

[0013] Optionally, the reinforcement operation includes at least modifying the system configuration, installing security patches, disabling unnecessary services and ports, enabling security features, limiting user permissions, data encryption, and security logging; and before performing each reinforcement operation, the target host system or related data is backed up.

[0014] Optionally, in step S6, the reinforcement test strategy includes: a) Determine whether the number of hosts that need to be reinforced has reached the preset minimum number threshold; b) If the number of hosts that need to be reinforced is lower than the minimum number threshold, the reinforcement test is skipped and the remote batch reinforcement operation in step S8 is directly performed; c) If the number of hosts that need to be reinforced reaches or exceeds the minimum number threshold, a reinforcement test is performed according to a preset or user-defined strategy, which includes at least one of the following: selecting the scope of the test reinforcement items, specifying the hosts that must be tested, specifying the hosts that do not need to be tested, and specifying the number of hosts that need to be tested.

[0015] Optionally, in step S8, the risk strategy includes: a) During the reinforcement operation, collect the reinforcement results of each reinforcement item; b) grouping and sorting the reinforcement results based on unit time; c) Calculate the reinforcement failure rate of each reinforcement item in each unit time group to determine the reinforcement risk value corresponding to each reinforcement item.

[0016] d) According to the reinforcement risk value, the reinforcement work is intervened, the high-risk reinforcement task is interrupted, and the work on the reinforcement item is no longer executed, but it will not affect the work of other reinforcement items: e) Confirm whether the failed items need to be rolled back based on the reinforcement work records and logs.

[0017] In a second aspect, an embodiment of the present application provides a network security configuration verification and reinforcement system based on an agentless architecture, which is applicable to a network security configuration verification and reinforcement method based on an agentless architecture described in any embodiment of the first aspect, including: Baseline module, used to store preset and user-defined verification baselines, security risk assessment baselines, and hardening baselines; A remote execution module is used to establish a remote connection with the target host system through a preset network protocol and collect system configuration and operation status information; Configuration verification module, used to analyze configuration information according to the verification baseline, identify security risks and configuration defects, and generate configuration verification reports; The security risk assessment module is used to determine the risk of the reinforcement operation and generate a security risk assessment report based on the security risk assessment baseline and the system configuration and operation status information of the target host system; The reinforcement test module is used to select some targets for reinforcement testing according to the reinforcement test strategy and generate a reinforcement test report; Automatic reinforcement module, used to perform reinforcement operations according to the reinforcement baseline, including data backup, reinforcement execution, failure rollback and interruption functions; The control center is used to centrally dispatch the above modules.

[0018] The network security configuration verification and reinforcement method and system based on agentless architecture designed by the present invention adopt an agentless architecture and directly communicate and operate with the target host system through a preset network protocol. There is no need to install any agent program or client software on the target host system, which significantly reduces the complexity of system deployment and maintenance, avoids the security vulnerability risk of the agent software itself, and eliminates the impact of the agent software on the performance of the target host system, thereby realizing lightweight, high-security, and low-performance loss security configuration verification and reinforcement. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a flow chart of a network security configuration verification and reinforcement method based on an agentless architecture provided in an embodiment of the present application. DETAILED DESCRIPTION

[0020] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0021] Example 1 like Figure 1 As shown, in the first aspect, the embodiment of the present application provides a network security configuration verification and reinforcement method based on an agentless architecture, which aims to automatically set, check and verify various configuration information of the system, device or application to ensure that it complies with the preset security policies, performance standards and business requirements, thereby ensuring the normal operation and security of the system. At the same time, the method enhances the security, stability and performance of the system by modifying and optimizing the system configuration, reduces potential security vulnerabilities and attack surfaces, and improves the overall protection capability of the system.

[0022] The method specifically comprises the following steps: S1. Obtain preset and user-defined verification baselines, security risk assessment baselines, and hardening baselines.

[0023] Optionally, in an implementation of an embodiment of the present invention, the verification baseline includes but is not limited to access control policy, password policy, data encryption policy, and log audit policy.

[0024] Specifically, the verification baseline is a set of predefined security rules and standards used to check whether the security configuration of the target host system meets the security requirements. It can cover various security aspects, such as: operating system security configuration (such as account management, password policy, file permissions), network security configuration (such as firewall rules, access control lists), application security configuration (such as database security configuration, server security configuration), compliance requirements (such as PCI DSS, GDPR). The security risk assessment baseline is used to assess the security risks in the target host system. It can include: known security vulnerability information, common attack methods and methods, industry best practices and security standards. The reinforcement baseline is a set of predefined security reinforcement measures used to improve the security of the target host system. It can include: modifying configuration files, installing security patches, disabling unnecessary services, and enabling security audit functions.

[0025] In addition to the preset baselines, the system also allows users to customize baselines, that is, users can add, modify or delete baseline items according to their actual needs and security policies. For example, users can add additional security rules for specific applications or services, or users can choose different security reinforcement measures based on their own operation and maintenance experience.

[0026] In this way, the method steps provide necessary security rules and standards for subsequent steps by obtaining preset baselines and user-defined baselines, and enhance the automation and flexibility of the system.

[0027] S2. Through the agentless architecture, a preset network protocol is used to establish a remote connection with the target host system, and the configuration information and operating environment information of the target host system are remotely obtained.

[0028] The agentless architecture means that there is no need to install any agent program or client software in the target host system, but to communicate with the target host system directly through a network protocol. In this embodiment, the network protocol includes but is not limited to SSH (Secure Shell), SFTP (Secure File Transfer Protocol), and WMI (Windows Management Instrumentation); for example, assuming that the target host system is a server running a Linux operating system, the SSH protocol can be used to establish a remote connection with it.

[0029] Specifically, through the established remote connection, the system can execute specific commands or scripts to obtain the configuration information and operating environment information of the target host system. In this embodiment, the configuration information of the target host system includes at least the operating system version and patch level, network configuration (such as IP address, subnet mask, gateway), database configuration, middleware configuration (such as firewall rules, password policy); the operating environment information of the target host system includes at least running processes and services, open network ports, system resource usage (such as CPU usage, memory usage), and security logs.

[0030] In this way, the method steps utilize the agentless architecture and preset network protocols to achieve remote access and information collection of the target host system, laying the foundation for subsequent analysis and reinforcement operations, while also avoiding the deployment complexity, security risks and performance impacts brought by agent software, thereby improving efficiency and security.

[0031] S3. According to the verification baseline, the remotely acquired configuration information is analyzed to identify the security risks and configuration defects in the target host system, and a configuration verification report is generated.

[0032] Specifically, by comparing the obtained configuration information with the verification baseline, the security risks and configuration defects in the target host system can be identified. For example, if the verification baseline requires the password length to be at least 8 characters, and the target host system password length is set to 6 characters, the system will identify that the configuration item does not meet the requirements; or if the verification baseline requires the firewall to be enabled, and the target host system does not have the firewall enabled, the system will identify that the security configuration is missing; or if the verification baseline requires the disabling of unnecessary services, and the target host system has enabled unnecessary services, the system will identify that the configuration has security risks.

[0033] In this way, after accurately identifying the security risks and configuration defects in the target host system, the analysis results are summarized into a configuration verification report for user reference, and the user is guided to perform subsequent reinforcement operations. In this embodiment, the report generally includes the following: basic information of the target host system (such as operating system version, IP address, host name), verification baseline information (such as verification baseline name, version, description), security risk list (such as risk description, risk level, affected system components, repair suggestions), configuration defect list (such as defect description, defect level, affected configuration items, repair suggestions).

[0034] S4. Based on the collected configuration information and operating environment information, as well as the security risk assessment baseline, determine the security risk factor of the reinforcement operation and generate a security risk assessment report.

[0035] Optionally, the security risk assessment baseline includes: a) Asset value: Determine the asset value of the target host system based on the configuration information and operating environment information of the target host system. The asset value assessment parameters include operating system version and patch level, network configuration, database configuration, middleware configuration, running processes and services, open network ports, system resource usage, and security logs; b) Hardening dependency: Identify the software associated with the hardening item and the target host system configuration information and operating environment information, and analyze the degree of association; c) Assessment criteria: Based on asset value and reinforcement dependency, use quantitative or qualitative risk assessment methods to conduct risk assessment of reinforcement operations.

[0036] Specifically, by performing risk assessment on each reinforcement operation, users can better understand and manage the risks of reinforcement operations, thereby improving the security of reinforcement operations. For example: Assuming that step S3 identifies that the target server has the security risk of "limiting the number of account authentication failures", a risk assessment is performed on the "enabling the limit on the number of account authentication failures" reinforcement operation in step S4: First, the system will analyze the possible impact of the "enable account authentication failure limit" operation on the server. For example, this operation may require modifying the server's configuration files, and these changes may cause potential risks, such as configuration errors, service interruptions, and failure to authenticate accounts.

[0037] Next, the system will determine the risk level of the "enable account authentication failure limit" operation based on the security risk assessment baseline and the actual situation of the target server. For example, since the "enable account authentication failure limit" operation requires modifying the system configuration, there is a certain probability of causing configuration errors or service interruptions, so the system can determine it as medium risk.

[0038] Finally, the system will generate a security risk assessment report, which will list the risk level of the "enable account authentication failure limit" operation and a detailed risk description. In other embodiments, in order to help users better understand and deal with risks, the report can also provide some risk mitigation suggestions. For example, before performing the reinforcement operation, it is recommended to back up the server's configuration files and data so that they can be restored in time when problems occur, or it is recommended to refer to official documents or seek professional technical support to ensure that the "account authentication failure limit is enabled" is correctly enabled to avoid configuration errors.

[0039] S5. Based on the security risk assessment report, you can selectively adjust the target reinforcement items and the corresponding reinforcement scope.

[0040] Specifically, after completing the security risk assessment and generating a report in step S4, the target reinforcement items and the corresponding reinforcement scope can be selectively adjusted according to the content of the security risk assessment report. For example, for high-risk reinforcement operations, users can choose not to perform the operation, or take additional risk mitigation measures, such as performing a more comprehensive data backup before performing the operation, or seeking professional technical support; for medium and low-risk reinforcement operations, users can choose to perform the operation, but need to carefully read the risk description and risk mitigation suggestions.

[0041] S6. Combined with the preset or user-defined reinforcement test strategy, select some target reinforcement items and corresponding reinforcement ranges for reinforcement testing, and generate a reinforcement test report.

[0042] Optionally, the reinforcement test strategy includes: a) Determine whether the number of hosts that need to be reinforced reaches the preset minimum number threshold; for example, the system default minimum number threshold is 5.

[0043] b) If the number of hosts to be reinforced is lower than the minimum number threshold, the reinforcement test is skipped and the remote batch reinforcement operation in step S8 is directly performed. For example, if only 3 hosts are selected for reinforcement, since it is lower than the threshold of 5, the system will directly perform the reinforcement operation on these 3 hosts without the need for reinforcement testing.

[0044] c) If the number of hosts that need to be reinforced reaches or exceeds the minimum number threshold, a reinforcement test is performed according to a preset or user-defined strategy, which includes at least one of the following: selecting the scope of the test reinforcement items (for example, testing the reinforcement items determined by the security risk assessment module as medium risk or high risk, or testing all selected reinforcement items), specifying the hosts that must be tested (for example, hosts running critical business applications), specifying the hosts that do not need to be tested (for example, hosts in the test environment), and specifying the number of hosts that need to be tested.

[0045] S7. According to the reinforcement test report, you can selectively adjust the target reinforcement items and the corresponding reinforcement scope. In this way, if the reinforcement test report shows that a reinforcement operation fails to execute or has a negative impact on system performance or function, you can choose to abandon the reinforcement operation. For some reinforcement operations with higher risks or greater impacts, you can choose other reinforcement solutions with lower risks or less impacts. For example, if the "disable default account" operation is considered too risky, you can choose to modify the password of the default account and strengthen account permission management instead of directly disabling the account.

[0046] S8. Determine the final target reinforcement items and the corresponding reinforcement scope, and remotely perform reinforcement operations in batches; during the reinforcement operation, dynamically calculate the reinforcement risk value based on the preset risk strategy.

[0047] Optionally, the reinforcement operation includes at least modifying the system configuration, installing security patches, disabling unnecessary services and ports, enabling security features, limiting user permissions, data encryption, and security logging; and before performing each reinforcement operation, the target host system or related data is backed up.

[0048] Specifically, through the remote connection established in step S2, the reinforcement operation is performed remotely without manual intervention. At the same time, in order to reduce the risk, the target reinforcement items and the corresponding reinforcement ranges are divided into multiple batches, and the reinforcement operation is performed batch by batch, so as to avoid large-scale failures that may be caused by operating all target host systems at one time. In addition, during the execution of the reinforcement operation, the risk value of each reinforcement operation can be dynamically calculated according to the preset risk strategy.

[0049] Optionally, the risk strategy includes: a) During the execution of the reinforcement operation, the reinforcement results of each reinforcement item are collected; that is, during the execution of the reinforcement operation, the execution results of each reinforcement item on each target host are collected in real time, including status information such as success, failure, and partial success.

[0050] b) Grouping and sorting the reinforcement results based on unit time; Grouping the reinforcement results according to unit time, for example, the reinforcement operations completed within 20 seconds can be grouped together, which can more accurately reflect the execution status of the reinforcement items in different time periods and avoid inaccurate risk assessment due to abnormal conditions in certain specific time periods.

[0051] c) Calculate the failure rate of each reinforcement item in each time group to determine the corresponding reinforcement risk value of each reinforcement item. For example, if the "disable unnecessary services" reinforcement item is executed on 10 servers within 20 seconds, and 2 servers fail to execute, then the failure rate (risk value) of the "disable unnecessary services" reinforcement item in this time group is 20%.

[0052] S9. If the reinforcement risk value reaches the preset risk threshold, the reinforcement operation is interrupted and determined to be a reinforcement failure; wherein, when the reinforcement fails, it automatically rolls back to the state before reinforcement, and after the reinforcement fails, the target reinforcement items and the corresponding reinforcement range are readjusted and the reinforcement operation is continued in batches until all target reinforcement items complete the reinforcement operation.

[0053] Specifically, before performing each reinforcement operation, the target host system or related data is backed up. If the risk value reaches the preset risk threshold, the system will immediately interrupt the reinforcement operation and determine that the reinforcement has failed. It will also start the automatic rollback mechanism to restore the target host system to the state before the reinforcement operation was performed. Subsequently, based on the cause of the failure, the reinforcement plan can be adjusted again until all target reinforcement items have been completed.

[0054] In this embodiment, the preset risk threshold is a security boundary set based on experience and security policies, that is, when the dynamically calculated reinforcement risk value reaches or exceeds the threshold, the system will consider that the reinforcement operation has a high risk and may cause serious impact on the target host system. At this time, the system will immediately interrupt the current reinforcement operation and determine that the reinforcement has failed to avoid further expansion of the risk. For example, it can be set that when the number of hosts that have completed reinforcement reaches 10% of the total number of hosts, a risk determination is made, or by judging whether the risk value of the reinforcement item reaches or exceeds the preset threshold: for example, the risk threshold can be set to 10% (assuming that the risk value range is 0-100%), that is, if the risk value of a reinforcement item reaches or exceeds 10%, a risk interruption is triggered.

[0055] S10. Collect reinforcement result data and generate a reinforcement report. In specific implementation, the reinforcement result data is summarized into a detailed reinforcement report for users to view and analyze. In this embodiment, the reinforcement report usually includes the following contents: the execution time range of the reinforcement operation, the number of target hosts, the number of successfully reinforced hosts, the number of hosts that failed to be reinforced, etc.; the execution status statistics, average risk value, common error information, etc. of each reinforcement operation; the execution status, execution time, risk value, error information, rollback status, etc. of each operation.

[0056] In a second aspect, an embodiment of the present application provides a network security configuration verification and reinforcement system based on an agentless architecture, which is applicable to a network security configuration verification and reinforcement method based on an agentless architecture described in any embodiment of the first aspect, including: Baseline module, used to store preset and user-defined verification baselines, security risk assessment baselines, and hardening baselines; A remote execution module is used to establish a remote connection with the target host system through a preset network protocol and collect system configuration and operation status information; Configuration verification module, used to analyze configuration information according to the verification baseline, identify security risks and configuration defects, and generate configuration verification reports; The security risk assessment module is used to determine the risk of the reinforcement operation and generate a security risk assessment report based on the security risk assessment baseline and the system configuration and operation status information of the target host system; The reinforcement test module is used to select some targets for reinforcement testing according to the reinforcement test strategy and generate a reinforcement test report; Automatic reinforcement module, used to perform reinforcement operations according to the reinforcement baseline, including data backup, reinforcement execution, failure rollback and interruption functions; The control center is used to centrally dispatch the above modules.

[0057] Technical personnel in the relevant field can clearly understand that, for the convenience and conciseness of description, the specific working process of the system described above can refer to the corresponding process in the aforementioned embodiment of the network security configuration verification and reinforcement method based on the agentless architecture, and will not be repeated here.

[0058] The network security configuration verification and reinforcement method and system based on the agentless architecture provided in this embodiment adopts an agentless architecture and directly communicates and operates with the target host system through a preset network protocol. There is no need to install any agent program or client software on the target host system, which significantly reduces the complexity of system deployment and maintenance, avoids the security vulnerability risk of the agent software itself, and eliminates the impact of the agent software on the performance of the target host system, thereby achieving lightweight, high-security, and low-performance loss security configuration verification and reinforcement.

[0059] In the description of the present invention, it should be noted that the terms "vertical", "up", "down", "horizontal", etc. indicate orientations or positional relationships based on the orientations or positional relationships shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

[0060] In the description of the present invention, it is also necessary to explain that, unless otherwise clearly specified and limited, the terms "set", "install", "connect", and "connect" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two elements. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0061] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art can still modify the technical solutions described in the aforementioned embodiments or replace some of the technical features therein by equivalents. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A network security configuration verification and reinforcement method based on an agentless architecture, characterized in that: The following steps are involved: S1. Obtain preset and user-defined verification baselines, security risk assessment baselines, and reinforcement baselines; S2. Establish a remote connection with the target host system through the agentless architecture using the preset network protocol, and remotely obtain the configuration information and operating environment information of the target host system; S3. Analyze the remotely acquired configuration information according to the verification baseline, identify security risks and configuration defects in the target host system, and generate a configuration verification report; S4. Based on the collected configuration information and operating environment information, as well as the security risk assessment baseline, determine the security risk factor of the reinforcement operation and generate a security risk assessment report; S5. According to the security risk assessment report, you can selectively adjust the target reinforcement items and the corresponding reinforcement scope; S6. Combined with the preset or user-defined reinforcement test strategy, select some target reinforcement items and corresponding reinforcement ranges for reinforcement testing, and generate a reinforcement test report; S7. According to the reinforcement test report, the target reinforcement items and the corresponding reinforcement range can be selectively adjusted; S8. Determine the final target reinforcement items and the corresponding reinforcement range, and remotely perform reinforcement operations in batches; During the reinforcement operation, the reinforcement risk value is dynamically calculated according to the preset risk strategy; S9. If the reinforcement risk value reaches the preset risk threshold, the reinforcement operation is interrupted and the reinforcement is judged as failed; wherein, when the reinforcement fails, the state is automatically rolled back to the state before reinforcement, and after the reinforcement fails, the target reinforcement items and the corresponding reinforcement range are readjusted and the reinforcement operation is continued in batches until all target reinforcement items have completed the reinforcement operation; S10. Collect reinforcement result data and generate a reinforcement report.

2. According to claim 1, the network security configuration verification and reinforcement method based on agentless architecture is characterized in that: The verification baseline includes but is not limited to access control policy, password policy, data encryption policy, and log audit policy.

3. According to claim 1, the network security configuration verification and reinforcement method based on agentless architecture is characterized in that: The agentless architecture means that there is no need to install any agent program or client software in the target host system, but to communicate with the target host system directly through the network protocol.

4. The network security configuration verification and reinforcement method based on agentless architecture according to claim 1 or 3 is characterized in that: The network protocols include but are not limited to SSH, SFTP, and WMI.

5. According to claim 1, the network security configuration verification and reinforcement method based on agentless architecture is characterized in that: The configuration information of the target host system includes at least the operating system version and patch level, network configuration, database configuration, and middleware configuration; the operating environment information of the target host system includes at least running processes and services, open network ports, system resource usage, and security logs.

6. The network security configuration verification and reinforcement method based on agentless architecture according to claim 1 or 5 is characterized in that: The security risk assessment baseline includes: a) Asset value: Determine the asset value of the target host system based on the configuration information and operating environment information of the target host system. The asset value assessment parameters include operating system version and patch level, network configuration, database configuration, middleware configuration, running processes and services, open network ports, system resource usage, and security logs; b) Hardening dependency: Identify the software associated with the hardening item and the target host system configuration information and operating environment information, and analyze the degree of association; c) Assessment criteria: Based on asset value and reinforcement dependency, use quantitative or qualitative risk assessment methods to conduct risk assessment of reinforcement operations.

7. The network security configuration verification and reinforcement method based on agentless architecture according to claim 6 is characterized in that: The reinforcement operations at least include modifying system configuration, installing security patches, disabling unnecessary services and ports, enabling security features, limiting user permissions, data encryption, and security logging; and before performing each reinforcement operation, the target host system or related data shall be backed up.

8. The network security configuration verification and reinforcement method based on agentless architecture according to claim 1 is characterized in that: In step S6, the reinforcement test strategy includes: a) Determine whether the number of hosts that need to be reinforced has reached the preset minimum number threshold; b) If the number of hosts that need to be reinforced is lower than the minimum number threshold, the reinforcement test is skipped and the remote batch reinforcement operation in step S8 is directly performed; c) If the number of hosts that need to be reinforced reaches or exceeds the minimum number threshold, a reinforcement test is performed according to a preset or user-defined strategy, which includes at least one of the following: selecting the scope of the test reinforcement items, specifying the hosts that must be tested, specifying the hosts that do not need to be tested, and specifying the number of hosts that need to be tested.

9. The network security configuration verification and reinforcement method based on agentless architecture according to claim 1 or 8, characterized in that: In step S8, the risk strategy includes: a) During the reinforcement operation, collect the reinforcement results of each reinforcement item; b) grouping and sorting the reinforcement results based on unit time; c) Calculate the reinforcement failure rate of each reinforcement item in each unit time group to determine the reinforcement risk value corresponding to each reinforcement item.

10. A network security configuration verification and reinforcement system based on an agentless architecture, applicable to a network security configuration verification and reinforcement method based on an agentless architecture according to any one of claims 1 to 9, characterized in that: include: Baseline module, used to store preset and user-defined verification baselines, security risk assessment baselines, and hardening baselines; A remote execution module is used to establish a remote connection with the target host system through a preset network protocol and collect system configuration and operation status information; Configuration verification module, used to analyze configuration information according to the verification baseline, identify security risks and configuration defects, and generate configuration verification reports; The security risk assessment module is used to determine the risk of the reinforcement operation and generate a security risk assessment report based on the security risk assessment baseline and the system configuration and operation status information of the target host system; The reinforcement test module is used to select some targets for reinforcement testing according to the reinforcement test strategy and generate a reinforcement test report; Automatic reinforcement module, used to perform reinforcement operations according to the reinforcement baseline, including data backup, reinforcement execution, failure rollback and interruption functions; The control center is used to centrally dispatch the above modules.

Images