Enterprise information security management method and system

Abstract

The invention provides an enterprise information security management method and system, which is applied to the technical field of computers, and comprises the following steps: obtaining anti-virus management data from an anti-virus management platform, acquiring patch repair management data from a patch repair management system, acquiring employee internet-surfing behavior management data from an employee internet-surfing behavior management system, and acquiring leak-proof management data from a data leak-proof system; analyzing the anti-virus management data, the patch repair management data, the employee online behavior management data and the anti-leakage management data to obtain the index value of each assessment index of each institution in the enterprise and the risk point positioning information of each institution; and generating information security management evaluation information of each mechanism. By obtaining the safety management data of the enterprise from multiple dimensions and combining various safety management data analysis, the information safety condition of the enterprise is comprehensively analyzed, and comprehensive information safety management is achieved for the enterprise.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an enterprise information security management method and system. Background Art

[0002] With the deepening of informatization, the number of computer equipment in large and medium-sized enterprises is large and scattered, resulting in high costs and difficulties in the management of office computer information security. Enterprises generally use multiple information security systems to achieve security protection for office computers. These systems mostly provide protection against certain security threats to office computer security, such as anti-virus, vulnerability scanning, data leakage prevention and other systems. The functions of a single system are relatively simple. From the perspective of a single security system, the overall security status of the enterprise's office computers cannot be displayed, and the comprehensive management of enterprise information security cannot be achieved. Summary of the invention

[0003] In view of this, the embodiments of the present application provide an enterprise information security management method and system. The present application integrates the data of different security systems, breaks down the data barriers between different systems, analyzes the information security of the enterprise from multiple dimensions and aspects, manages multiple aspects of the information security of the enterprise, and realizes comprehensive management of the information security of the enterprise.

[0004] To achieve the above objectives, the present application provides the following technical solutions:

[0005] An enterprise information security management method, comprising:

[0006] Obtaining the enterprise's antivirus management data in the antivirus management platform, the enterprise's patch repair management data in the patch repair management system, the enterprise's employee online behavior management data in the employee online behavior management system, and the enterprise's anti-leakage management data in the data anti-leakage system; the enterprise includes multiple organizations, each organization includes multiple terminal devices;

[0007] Analyze the anti-virus management data, the patch repair management data, the employee online behavior management data, and the anti-leakage management data to obtain employee online behavior analysis result data, risk terminal data, terminal security software operation statistics, organization online behavior statistics, and organization sensitive information interception statistics;

[0008] Based on the statistical data of the operation of the terminal security software, the statistical data of the online behavior of the organization, and the statistical data of the interception of sensitive information of the organization, the indicator value of each preset assessment indicator of each organization is determined;

[0009] Analyze the employee online behavior analysis result data and the risk terminal data, locate risk points in the terminal devices of each of the institutions, and obtain risk point location information for each of the institutions;

[0010] Based on the indicator values ​​of each of the institutions and the risk point location information, information security management assessment information of each of the institutions is generated.

[0011] The above method optionally includes analyzing the antivirus management data, the patch repair management data, the employee online behavior management data, and the anti-leakage management data to obtain employee online behavior analysis result data, risk terminal data, terminal security software operation statistics, organization online behavior statistics, and organization sensitive information interception statistics, including:

[0012] Summarize the table of failed antivirus software update devices and the table of terminal devices attacked by viruses in the antivirus management data, the table of failed security update devices and the table of failed patch repair terminal devices in the patch repair management data, and the table of Internet access click times in the employee online behavior management data, and remove duplicates from the summarized data to obtain employee online behavior analysis result data;

[0013] Aggregate the antivirus system basic data table in the antivirus management data, the patch repair management system basic data table in the patch repair management data, the employee online behavior management system basic data table in the employee online behavior management data, and the data leakage prevention system basic data table in the leakage prevention management data, and remove duplicates from the aggregated data to obtain a terminal computer information library table;

[0014] Using the IP address field as an index, searching the antivirus system basic data table and the terminal computer information library table to obtain a terminal device list table for which the antivirus software is not installed;

[0015] Using the IP address field as an index, searching the basic data table of the patch repair management system and the terminal computer information library table to obtain a terminal device list table that does not have the patch repair software installed;

[0016] Generate risk terminal data based on the terminal device list table without antivirus software installed and the terminal device list table without antivirus software installed;

[0017] Processing the risk terminal data, the terminal computer information library table, the security update failure device table in the patch repair management data, the antivirus software update failure device table and the virus-attacked terminal computer data table in the antivirus management data to obtain the terminal security software operation status statistical data;

[0018] Based on the Internet access click count data table in the employee Internet behavior management data, the Internet access count of each organization is counted to obtain the Internet behavior statistics of the organization;

[0019] Based on the data leakage prevention system statistical data table in the leakage prevention management data, the number of sensitive information interception of each organization is counted to obtain the sensitive information interception statistical data of the organization.

[0020] The above method optionally processes the risk terminal data, the terminal computer information library table, the security update failure device table in the patch repair management data, the antivirus software update failure device table in the antivirus management data, and the terminal computer data table attacked by viruses to obtain the terminal security software operation status statistical data, including:

[0021] Based on the terminal equipment list table of the risk terminal data that does not have antivirus software installed, obtain a statistical table of the situation of not having antivirus software installed;

[0022] Based on the terminal equipment list table of the risk terminal data that does not have the patch repair software installed, obtain a statistical table of the situation of the patch repair software not installed;

[0023] Extracting a statistical table of devices for which virus database updates of each institution have failed from the table of devices for which antivirus software updates have failed;

[0024] Extracting a statistical table of devices for which patch repair software updates of various institutions have failed from the table of devices for which security updates have failed;

[0025] Extracting a resource allocation statistics table from the terminal computer information database table, wherein the resource allocation statistics table contains statistical information of the terminal equipment and employees of each organization;

[0026] The statistical table of the situation where the antivirus software is not installed, the statistical table of the situation where the patch repair software is not installed, the statistical table of the devices where the virus database of each institution has failed to update, the statistical table of the devices where the patch repair software of each institution has failed to update, the statistical table of resource allocation and the data table of terminal computers attacked by viruses are summarized and deduplicated to obtain statistical data on the operation of terminal security software.

[0027] The above method may optionally further include:

[0028] The antivirus software update failure device table and the virus-attacked terminal device data table in the antivirus management data, the security update failure device table and the patch repair failure terminal device table in the patch repair management data, and the data leakage prevention system statistical data table in the leakage prevention management data are deduplicated to obtain the employee data leakage prevention analysis result statistical data.

[0029] The above method may optionally further include:

[0030] The information security management assessment information of each of the institutions is used to generate an information security assessment report for the enterprise.

[0031] An enterprise information security management system, comprising:

[0032] The first acquisition unit is used to acquire the antivirus management data of the enterprise in the antivirus management platform, the patch repair management data of the enterprise in the patch repair management system, the employee online behavior management data of the enterprise in the employee online behavior management system, and the anti-leakage management data of the enterprise in the data leakage prevention system; the enterprise includes multiple institutions, each institution includes multiple terminal devices;

[0033] A second acquisition unit is used to analyze the anti-virus management data, the patch repair management data, the employee online behavior management data and the anti-leakage management data to obtain employee online behavior analysis result data, risk terminal data, terminal security software operation statistics, organization online behavior statistics and organization sensitive information interception statistics;

[0034] A confirmation unit, used to determine the indicator value of each of the institutions in each preset assessment indicator based on the statistical data of the terminal security software operation, the statistical data of the institution's online behavior, and the statistical data of the institution's sensitive information interception;

[0035] An analysis unit, used to analyze the employee online behavior analysis result data and the risk terminal data, locate risk points in the terminal devices of each of the institutions, and obtain risk point location information for each of the institutions;

[0036] The first generating unit is used to generate information security management evaluation information of each of the institutions based on the indicator values ​​of each of the institutions and the risk point location information.

[0037] In the above system, optionally, the second acquisition unit performs a process of analyzing the antivirus management data, the patch repair management data, the employee online behavior management data, and the anti-leakage management data to obtain employee online behavior analysis result data, risk terminal data, terminal security software operation statistics, organization online behavior statistics, and organization sensitive information interception statistics, including:

[0038] Summarize the table of failed antivirus software update devices and the table of terminal devices attacked by viruses in the antivirus management data, the table of failed security update devices and the table of failed patch repair terminal devices in the patch repair management data, and the table of Internet access click times in the employee online behavior management data, and remove duplicates from the summarized data to obtain employee online behavior analysis result data;

[0039] Aggregate the antivirus system basic data table in the antivirus management data, the patch repair management system basic data table in the patch repair management data, the employee online behavior management system basic data table in the employee online behavior management data, and the data leakage prevention system basic data table in the leakage prevention management data, and remove duplicates from the aggregated data to obtain a terminal computer information library table;

[0040] Using the IP address field as an index, searching the antivirus system basic data table and the terminal computer information library table to obtain a terminal device list table for which the antivirus software is not installed;

[0041] Using the IP address field as an index, searching the basic data table of the patch repair management system and the terminal computer information library table to obtain a terminal device list table that does not have the patch repair software installed;

[0042] Generate risk terminal data based on the terminal device list table without antivirus software installed and the terminal device list table without antivirus software installed;

[0043] Processing the risk terminal data, the terminal computer information library table, the security update failure device table in the patch repair management data, the antivirus software update failure device table and the virus-attacked terminal computer data table in the antivirus management data to obtain the terminal security software operation status statistical data;

[0044] Based on the Internet access click count data table in the employee Internet behavior management data, the Internet access count of each organization is counted to obtain the Internet behavior statistics of the organization;

[0045] Based on the data leakage prevention system statistical data table in the leakage prevention management data, the number of sensitive information interception of each organization is counted to obtain the sensitive information interception statistical data of the organization.

[0046] In the above system, optionally, the second acquisition unit performs a process of processing the risk terminal data, the terminal computer information library table, the security update failure device table in the patch repair management data, the antivirus software update failure device table in the antivirus management data, and the terminal computer data table attacked by viruses to obtain the terminal security software operation status statistical data, including:

[0047] Based on the terminal equipment list table of the risk terminal data without antivirus software installed, obtaining a statistical table of the situation of not installing antivirus software, wherein the statistical table of not installing antivirus software includes the number of terminal equipment without antivirus software installed in each institution;

[0048] Based on the terminal equipment list table of the risk terminal data that does not have the patch repair software installed, a statistical table of the situation of the patch repair software not installed is obtained, wherein the statistical table of the situation of the patch repair software not installed includes the number of terminal equipment of each institution that does not have the antivirus software installed;

[0049] Extracting a statistical table of devices for which virus database updates of each institution have failed from the table of devices for which antivirus software updates have failed;

[0050] Extracting a statistical table of devices for which patch repair software updates of various institutions have failed from the table of devices for which security updates have failed;

[0051] Extracting a resource allocation statistics table from the terminal computer information database table, wherein the resource allocation statistics table contains statistical information of the terminal equipment and employees of each organization;

[0052] The statistical table of the situation where the antivirus software is not installed, the statistical table of the situation where the patch repair software is not installed, the statistical table of the devices where the virus database of each institution has failed to update, the statistical table of the devices where the patch repair software of each institution has failed to update, the statistical table of resource allocation and the data table of terminal computers attacked by viruses are summarized and deduplicated to obtain statistical data on the operation of terminal security software.

[0053] The above system may optionally further include:

[0054] The summarizing unit is used to summarize the table of antivirus software update failure devices and the table of terminal devices attacked by viruses in the antivirus management data, the table of security update failure devices and the table of terminal devices failed to patch repair in the patch repair management data, and the table of data leakage prevention system statistical data in the leakage prevention management data, and perform deduplication processing to obtain statistical data of employee data leakage prevention analysis results.

[0055] The above system may optionally further include:

[0056] The second generating unit is used to generate an information security assessment report for the enterprise by applying the information security management assessment information of each of the institutions.

[0057] Compared with the prior art, this application has the following advantages:

[0058] The present application provides an enterprise information security management method and system, including: obtaining the enterprise's antivirus management data from an antivirus management platform, obtaining the enterprise's patch repair management data from a patch repair management system, obtaining the enterprise's employee Internet behavior management data from an employee Internet behavior management system, and obtaining the enterprise's anti-leakage management data from a data leakage prevention system, analyzing the antivirus management data, patch repair management data, employee Internet behavior management data, and leakage prevention management data, so as to obtain the indicator values ​​of each preset assessment indicator for each institution in the enterprise, as well as the risk point location information of each institution, and then generating the information security management assessment information of each institution according to the indicator values ​​and risk point location information of each institution. This solution obtains the enterprise's security management data from multiple dimensions, and combines and analyzes the security management data from multiple aspects, so as to comprehensively analyze the enterprise's information security situation and realize comprehensive information security management for the enterprise. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0060] Figure 1 A flowchart of an enterprise information security management method provided in an embodiment of the present application;

[0061] Figure 2 A flowchart for analyzing antivirus management data, patch repair management data, employee Internet behavior management data, and anti-leakage management data provided in an embodiment of the present application;

[0062] Figure 3 A flowchart for obtaining terminal security software operation statistics provided in an embodiment of the present application;

[0063] Figure 4 A schematic diagram of the structure of an enterprise information security management system provided in an embodiment of the present application;

[0064] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0065] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0066] In this application, the terms "comprises", "comprising" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device comprising the element.

[0067] Terminology explanation:

[0068] Antivirus management platform: Computer antivirus software background management system, which can realize centralized management of all computers installed with computer antivirus client software.

[0069] Patch repair management system: software that can patch and repair vulnerabilities in office computer operating systems and application software.

[0070] Employee Internet Behavior Management System: A system that controls employee Internet access permissions, filters employee Internet content, and records employee Internet behavior.

[0071] Data leakage prevention system: A system deployed at the Internet exit to intercept and filter content posted on the Internet to prevent the leakage of sensitive internal information of the enterprise.

[0072] To ensure the security of enterprise terminal computers and information systems, the existing technology mainly protects them by installing terminal security management software such as antivirus and vulnerability repair on terminal computers. Due to the improvement of the degree of informatization of large and medium-sized enterprises, the number of terminal computers has increased rapidly, and the geographical distribution is dispersed, which makes the information security management of terminal computers a difficult problem for enterprise information security management. In recent years, with the increasingly severe information security situation and the rapid development of information security prevention technology, enterprises have deployed multiple sets of information security management systems for different threats in their internal information systems. These systems have well protected the system and information security of enterprises from different angles. However, the functions of each security system are relatively single, and the independence of system functions leads to insufficient data correlation analysis between systems, making it impossible to comprehensively manage the information security of enterprise office computers. How to utilize and integrate data from multiple systems, break through the data barriers between multiple systems, show the current status of enterprise information security management from an overall perspective, start with terminal computer security management, and establish a comprehensive and systematic enterprise information security management system is of great significance to enterprises.

[0073] In order to solve the above problems, the present application provides an enterprise information security management solution, which includes: obtaining the enterprise's antivirus management data from the antivirus management platform, obtaining the enterprise's patch repair management data from the patch repair management system, obtaining the employee's online behavior management data from the employee's online behavior management system, and obtaining the enterprise's anti-leakage management data from the data leakage prevention system, analyzing the antivirus management data, patch repair management data, employee online behavior management data, and leakage prevention management data, so as to obtain the indicator data of each institution of the enterprise in each preset assessment indicator, as well as the risk point positioning information of each institution, and using each indicator data and risk point positioning information of each institution to generate information security management assessment information for each institution. Analyze the information security of the institution from multiple dimensions, and analyze it in combination with data from multiple aspects, so that the information security of the enterprise can be managed comprehensively.

[0074] The present application can be used in many general or special computing device environments or configurations, such as personal computers, server computers, handheld or portable devices, tablet devices, multi-processor devices, distributed computing environments including any of the above devices or equipment, etc.

[0075] Reference Figure 1 , is a flow chart of an enterprise information security management method provided in an embodiment of the present application, and is specifically described as follows:

[0076] S101. Obtain the enterprise's antivirus management data in the antivirus management platform, the enterprise's patch repair management data in the patch repair management system, the enterprise's employee online behavior management data in the employee online behavior management system, and the enterprise's anti-leakage management data in the data anti-leakage system; the enterprise includes multiple institutions, and each institution includes multiple terminal devices.

[0077] It should be noted that the terminal device mentioned in this application can be a computer terminal, such as a desktop computer, an all-in-one computer, an IPAD and other smart terminals.

[0078] The antivirus management data includes relevant data generated when the antivirus management platform performs antivirus management on each organization of the enterprise; the antivirus management data includes basic data of the antivirus management system, update information of antivirus software of each terminal device of each organization, virus information, virus attack information, etc. Preferably, the antivirus management data includes an antivirus system basic data table, an antivirus software update failure device table, a computer virus data table within a first preset time, and a terminal device data table attacked by viruses within a second preset time.

[0079] The first preset time and the second preset time can be set according to actual needs. The set time lengths can be the same or different. The time units of both can be days or hours, and can be set according to actual needs.

[0080] The antivirus system basic data table includes a terminal device name field, an organization field, an IP address field, and a network card MAC address field; thus, the antivirus system basic data table records the basic information of each terminal device managed by the antivirus management platform in the enterprise.

[0081] The antivirus software update failure device table includes a terminal device name field, an organization field, and an antivirus software update abnormal IP address field; thus, the antivirus software update failure device table can record information about terminal devices in the enterprise that failed to update antivirus software.

[0082] The computer virus data table includes a virus name field, a category field and a quantity field; thus, the computer virus data table can record information about various viruses that appear in an enterprise; the quantity field in the table is used to record the number of terminal devices where a certain virus appears.

[0083] The data table of terminal devices attacked by viruses includes a field of terminal device name, a field of affiliated organization, a field of IP address, and a field of number of virus occurrences; thus, the data table of terminal devices attacked by viruses can record information of terminal devices attacked by viruses in an enterprise.

[0084] The patch repair management data includes relevant data generated by the patch repair management system when performing patch repair management for the enterprise.

[0085] The patch repair management data includes the patch repair management system basic data table, the security update failure device table, the unrepaired patch data table, and the patch repair failure terminal device table.

[0086] The basic data table of the patch repair management system includes a terminal device name field, an organization field, an IP address field, and a network card MAC field; thus, the basic data table of the patch repair management system records the basic information of each terminal device managed by the patch repair management system in the enterprise.

[0087] The security update failure device table includes an institution field, a terminal device name field, and a security update failure IP address field; thus, the security update failure device table is used to record information about terminal devices that have failed security updates among the various terminal devices managed by the patch repair management system, and can also be understood as being used to record information about terminal devices that have failed patch repair software updates among the various terminal devices managed by the patch repair management system.

[0088] The unrepaired patch data table includes a patch name field, a severity field, and a quantity field; the unrepaired patch data table is used to record information about unrepaired patches in the enterprise, and the quantity field in the table can be used to record the number of terminal devices that have not repaired a certain patch.

[0089] The patch repair failure terminal device table includes a terminal device name field, an organization field, an IP address field, and a field for the number of unrepaired patches; thus, the patch repair failure terminal device table is used to record information about terminal devices that have not had patches repaired, as well as information about which specific patch has not been repaired. It can also be understood that the table is used to record information about terminal devices that have failed to have patches repaired, and the information includes the content of the patch that failed to be repaired.

[0090] The employee online behavior management data includes data on the online behavior of employees in the enterprise managed by the employee online behavior management system.

[0091] Employee online behavior management data includes the employee online behavior management system basic data table and the Internet access click count data table.

[0092] The basic data table of the employee online behavior management system includes an employee name field, an organization field, and an IP address field; thus, the table records the basic information of each employee in the enterprise managed by the employee online behavior management system.

[0093] The Internet click count data table includes an employee name field, an organization field, an IP address field, and a click count field; thus, the table records the statistical information of each employee's online behavior, and the click count field in the table is used to save the number of clicks when the employee accesses the Internet.

[0094] The leakage prevention management data includes the data generated when the data leakage prevention system manages the data leakage prevention of the enterprise.

[0095] The leakage prevention management data includes a data leakage prevention system basic data table and a data leakage prevention system statistical data table within a third preset time; the relevant description of the third preset time can refer to the description of the first preset time and the second preset time, and will not be repeated here.

[0096] The basic data table of the data leakage prevention system includes an employee name field, an organization field, and an IP address field; thus, the table is used to record the basic information of all employees managed by the data leakage prevention system in the enterprise.

[0097] The statistical data table of the data leakage prevention system includes an employee name field, an organization field, an IP address field and an interception count field; thus, the table is used to record relevant information when the data leakage prevention system intercepts sensitive information, and the relevant information includes the name of the intercepted employee, the organization to which the intercepted employee belongs, the IP address of the intercepted employee and the number of interceptions of the intercepted employee; the interception count field is used to save the number of times the employee is intercepted.

[0098] S102. Analyze the anti-virus management data, patch repair management data, employee Internet behavior management data and anti-leakage management data to obtain employee Internet behavior analysis result data, risk terminal data, terminal security software operation statistics, organization Internet behavior statistics and organization sensitive information interception statistics.

[0099] Reference Figure 2 , which is a flowchart for analyzing antivirus management data, patch repair management data, employee Internet behavior management data and anti-leakage management data provided by an embodiment of the present application, is specifically described as follows:

[0100] S201. Summarize the table of failed antivirus software update devices and the table of terminal devices attacked by viruses in the antivirus management data, the table of failed security update devices and the table of failed patch repair terminal devices in the patch repair management data, and the table of Internet access click times in the employee online behavior management data, and deduplicate the summarized data to obtain employee online behavior analysis result data.

[0101] Exemplarily, the data in the Internet access click count data table are sorted in descending order according to the number of clicks, thereby obtaining a descending Internet access click count data table, an antivirus software update failure device table, a virus-attacked terminal device table, a security update failure device table, and a patch repair failure terminal device table, which are summarized and duplicates are removed to obtain employee Internet behavior analysis result data.

[0102] Preferably, the employee online behavior analysis result data can record relevant data in the form of a table. In other words, the employee online behavior analysis result data can be called an employee online behavior analysis result statistical table, and the employee online behavior analysis result statistical table includes an organization name field, an employee name field, an IP address field, a click count field, and a field for reasons for excessive clicks; preferably, the employee online analysis result statistical table includes analysis data on the online behavior of each employee in the enterprise, such as the number of employee online clicks, the employee's organization, name, the IP address of the device used, and the reason why the employee's online clicks exceed a preset number.

[0103] The Reason for Too High Times field is used to include the reason why the employee's Internet clicks exceed the preset number. The predicted number can be set according to actual needs.

[0104] S202. Aggregate the antivirus system basic data table in the antivirus management data, the patch repair management system basic data table in the patch repair management data, the employee online behavior management system basic data table in the employee online behavior management data, and the data leakage prevention system basic data table in the leakage prevention management data, and deduplicate the aggregated data to obtain a terminal computer information library table.

[0105] The basic data tables of the antivirus system, the patch repair management system, the employee online behavior management system and the data leakage prevention system are aggregated and duplicate items are removed to obtain a terminal computer information library table.

[0106] The terminal computer information library table includes the terminal device name field, the affiliated organization field, the IP address field and the employee name field; this table summarizes the basic data of the anti-virus management platform, patch repair management system, employee Internet behavior management system and data leakage prevention system in managing the enterprise. By aggregating data of different dimensions, breaking through the data barriers between multiple security systems, and establishing a comprehensive computer information library, it is convenient for comprehensive management of the company's computer terminals.

[0107] S203: Using the IP address field as an index, search the antivirus system basic data table and the terminal computer information library table to obtain a terminal device list table for which the antivirus software is not installed.

[0108] The terminal device list table without antivirus software installed includes a terminal device name field, an organization field, an IP address field and an employee name field; the list is used to save the information of the terminal devices without antivirus software installed; the terminal device name field in the table is used to save the name of the terminal device without antivirus software installed, the organization field is used to save the organization to which the terminal device without security antivirus software belongs, the IP address field is used to save the IP address of the terminal device without antivirus software installed, and the employee name field is used to save the name of the employee who uses the terminal device without antivirus software installed.

[0109] S204: Using the IP address field as an index, search the basic data table of the patch repair management system and the terminal computer information library table to obtain a terminal device list table that does not have the patch repair software installed.

[0110] The terminal device list table for which patch repair software is not installed includes a terminal device name field, an organization field, an IP address field, and an employee name field; the terminal device list for which patch repair software is not installed is used to save information on terminal devices for which patch repair software is not installed, including the device name, organization, IP address, and the name of the employee using the device.

[0111] S205: Generate risk terminal data based on the terminal device list table without antivirus software installed and the terminal device list table without patch repair software installed.

[0112] Risk terminal data includes a list of terminal devices that do not have antivirus software installed and a list of terminal devices that do not have patch repair software installed.

[0113] S206. Process the risk terminal data, the terminal computer information library table, the security update failure device table in the patch repair management data, the antivirus software update failure device table in the antivirus management data, and the terminal computer data table attacked by viruses to obtain terminal security software operation statistics.

[0114] Reference Figure 3 , which is a flowchart for obtaining terminal security software operation status statistics provided by an embodiment of the present application, and is specifically described as follows:

[0115] S301. Based on the terminal device list table without antivirus software installed in the risk terminal data, obtain a statistical table of the situation of not installing antivirus software.

[0116] The data in each row of the terminal equipment list table without antivirus software installed is counted by organization, that is, the data belonging to the same organization in the terminal equipment list table without antivirus software installed is aggregated, and then cluster data is obtained, each cluster of data corresponds to a different organization, so as to obtain the total number of terminal equipment without antivirus software installed in each organization in the terminal equipment list table without antivirus software installed, and then obtain a statistical table of the situation of not installing antivirus software. Preferably, the organization in the present application can be a functional department in an enterprise.

[0117] The statistics table for not installing antivirus software includes an organization name field and a field for the number of terminal devices without antivirus software installed; the statistics table for not installing antivirus software is used to save the organizations with terminal devices without antivirus software installed, and the total number of terminal devices without antivirus software installed in the organization.

[0118] S302: Based on the terminal equipment list table of the risk terminal data that does not have the patch repair software installed, obtain a statistical table of the situation of the patch repair software not installed.

[0119] Statistics are performed on each row of data in the terminal equipment list table without patch repair software installed on an institution basis. That is, data belonging to the same institution in the terminal equipment list without patch repair software installed are aggregated to obtain multiple clusters of data, each cluster of data corresponding to a different institution. Thus, the total number of terminal devices without antivirus software installed for each institution in the terminal equipment list table without patch repair software installed is obtained, and then a statistical table of the situation of not installing antivirus software is obtained.

[0120] The statistical table of the situation of not installing the patch repair software includes an organization name field and a field for the number of terminal devices that do not install the patch repair software. The organization name field in the table is used to save various information about the organization that has terminal devices that do not install the patch repair software. The information includes the name of the organization and the number of terminal devices in the organization that do not install the patch repair software.

[0121] S303. Extract a statistical table of devices whose virus databases of each organization have failed to update from the table of devices whose antivirus software has failed to update.

[0122] The data in each row of the antivirus software update failure device table is counted by institution, so as to obtain information such as the number of terminal devices and the number of employees in each institution where the antivirus software update failed in the antivirus software update failure device table, and thus obtain a statistical table of virus database update failure devices in each institution.

[0123] The statistical table of devices where virus database update failed in each institution includes an institution name field, a field for the number of terminal devices where virus database update failed, and a field for the number of employees; the table is used to save various information about institutions where terminal devices where antivirus software update failed exist, and each piece of information includes the name of the institution, the number of terminal devices where antivirus software update failed in the institution, and the number of employees; preferably, the number of employees here should be equal to the number of terminal devices where antivirus software update failed.

[0124] S304. Extract a statistical table of devices whose patch repair software updates have failed for each organization from the table of devices whose security updates have failed.

[0125] The data in each row of the security update failure device table is counted by institution, so as to obtain information such as the number of terminal devices and the number of employees in each institution whose patch repair software update failed in the security update failure device table, and thus obtain a statistical table of patch repair software update failure devices in each institution.

[0126] The statistical table of devices whose patch repair software updates failed in each institution includes a field for the name of the institution, a field for the number of terminal devices whose patch repair software updates failed, and a field for the number of employees; the table is used to save various information about the institutions where terminal devices whose patch repair software updates failed exist, and each piece of information includes the name of the institution, the number of terminal devices whose patch repair software updates failed in the institution, and the number of employees; preferably, the number of employees here should be equal to the number of terminal devices whose patch repair software updates failed.

[0127] S305. Extract a resource allocation statistics table from the terminal computer information database table. The resource allocation statistics table includes the statistical information of the terminal equipment and employees of each organization.

[0128] The resource allocation statistics table can also be called the agency terminal equipment and employee allocation statistics table.

[0129] The terminal computer information base table is counted based on the organization, so as to obtain various information of each organization in the terminal computer information base table, including the name of the organization, the number of terminal devices of the organization and the number of employees of the organization.

[0130] Exemplarily, each row of data in the terminal computer information database table is aggregated based on the organization, thereby obtaining multiple clusters of data, each cluster of data corresponding to a different organization.

[0131] The resource allocation statistics table includes the organization name field, the terminal quantity field and the employee quantity field. The resource allocation statistics table is used to save information such as the number of terminal devices and the number of employees of each organization.

[0132] S306. Summarize the statistics table of the situation where the antivirus software is not installed, the statistics table of the situation where the patch repair software is not installed, the statistics table of the devices where the virus database of each institution has failed to update, the statistics table of the devices where the patch repair software of each institution has failed to update, the statistics table of resource allocation, and the data table of terminal computers attacked by viruses, and perform deduplication processing to obtain statistical data on the operation of terminal security software.

[0133] The statistical table of the situation where the antivirus software is not installed, the statistical table of the situation where the patch repair is not installed, the statistical table of the equipment where the virus database of each institution fails to update, the statistical table of the equipment where the patch repair software of each institution fails to update, the statistical table of resource allocation and the data table of terminal computers attacked by viruses are summarized and duplicate items are removed to generate terminal security software operation status statistical data. Preferably, the data can be expressed in a table, which can be called a terminal security software operation status statistical table.

[0134] The terminal security software operation statistics table includes the organization name field, the terminal device quantity field, the number of antivirus software not installed field, the number of patch repair software not installed field, the antivirus software installation rate field, the patch repair software installation rate field, the virus database update success rate field, the patch repair software update success rate field and the virus occurrence count field.

[0135] The terminal security software operation statistics table is used to save various information of each organization, including the organization name, the number of terminal devices in the organization, the number of terminals in the organization that do not have antivirus software installed, the number of terminals in the organization that do not have patch repair software installed, the organization's antivirus software installation rate, the organization's patch repair software installation rate, the organization's antivirus software update success rate, the organization's patch repair software update success rate and the number of times the organization is attacked by viruses.

[0136] The antivirus software installation rate of an organization = the number of terminal devices in the organization that have antivirus software installed / the total number of terminal devices in the organization; the patch repair software installation rate of an organization = the number of terminal devices in the organization that have patch repair software installed / the total number of terminal devices in the organization; the antivirus software update success rate of an organization = the number of terminal devices in the organization that have successfully updated their antivirus software / the number of terminal devices in the organization that have antivirus software installed; the patch repair software update success rate of an organization = the number of terminal devices in the organization that have successfully updated their patch repair software / the number of terminal devices in the organization that have patch repair software installed; the number of times an organization is attacked by viruses is the sum of the number of times each terminal device in the organization is attacked by viruses.

[0137] S207. Based on the Internet access click count data table in the employee Internet access behavior management data, count the Internet access count of each organization to obtain the organization's Internet access behavior statistics.

[0138] Based on the Internet access click count table, the Internet usage of each organization is counted, which can also be understood as counting the Internet access clicks of each organization, so as to obtain the statistical data of the organization's Internet behavior. The statistical data of the organization's Internet behavior can also be called the organization's Internet behavior statistical table.

[0139] The institution's online behavior statistics table includes the institution name field, the number of employees field, the total number of devices field and the number of clicks field; the institution's online behavior statistics table is used to record the online information of each institution, and the online information includes the institution's name, the number of employees in the institution, the number of terminal devices in the institution, and the total number of Internet access clicks of each terminal device in the institution.

[0140] S208. Based on the data leakage prevention system statistical data table in the leakage prevention management data, the number of sensitive information interception of each organization is counted to obtain the sensitive information interception statistical data of the organization.

[0141] The number of times sensitive information is intercepted by each organization is counted from the data leakage prevention system statistical data table, thereby obtaining the organization's sensitive information interception statistical data, which can also be called the organization's sensitive information interception statistical table.

[0142] The organization sensitive information interception statistics table includes the organization name field, the number of employees field, the total number of devices field and the sensitive information interception times field; the organization sensitive information interception statistics table is used to save various information on sensitive information interception of each organization, including the name of the organization, the number of employees of the organization, the number of terminal devices of the organization, and the number of times sensitive information is intercepted in the organization.

[0143] By aggregating and analyzing various tables and data, data from different systems can be integrated to obtain the data required to manage the enterprise's information security.

[0144] S103. Determine the indicator value of each preset assessment indicator for each institution based on the statistical data of terminal security software operation, the statistical data of the institution's online behavior, and the statistical data of the institution's sensitive information interception.

[0145] Preferably, based on the statistical data of terminal security software operation, the statistical data of the online behavior of the organization and the statistical data of the interception of sensitive information of the organization, the installation rate of the security software (anti-virus software), the virus database update rate, the patch update rate, the number of virus occurrences and the number of sensitive information leakages of the terminal devices of each organization can be calculated. Preferably, the installation rate of the security software, the virus database update rate, the patch update rate, the number of virus occurrences and the number of sensitive information leakages are used as the preset assessment indicators, thereby obtaining the indicator values ​​of each organization under each assessment indicator.

[0146] Preferably, the indicator values ​​of each institution can be used to quantitatively assess and rank the terminal computer information security management work of each institution.

[0147] S104. Analyze the employee online behavior analysis result data and risk terminal data, locate risk points in the terminal devices of each organization, and obtain risk point location information for each organization.

[0148] Preferably, when locating risk points, terminal devices with high risks can be determined as risk points, such as terminal devices that do not have antivirus software and patch repair software installed as risk points; terminal devices whose interception times reach a preset number of times are determined as risk points, where the preset number can be set according to actual needs.

[0149] The risk point location information includes the information of the terminal device determined as the risk point, including the name of the terminal device, the name of the employee using it, the IP address, etc. When the institution has no risk point, the risk point location information of the institution is empty.

[0150] By analyzing the data from the antivirus management platform, the patch repair management system, the employee Internet behavior management system, and the data leakage prevention system, we obtain the employee Internet behavior analysis result data and risk terminal data. By analyzing the data from different systems, we break down the data barriers between different systems and obtain the employee Internet behavior analysis result data and risk terminal data.

[0151] For example, the process of analyzing the employee online behavior analysis result data and risk terminal data and locating risk points in the terminal devices of each organization is as follows:

[0152] For each institution, based on the risk terminal data, terminal devices in the institution that do not have patch repair software installed and terminal devices that do not have antivirus software installed are all determined as first devices;

[0153] For each organization, based on the employee online behavior analysis result data, employees in the organization whose online clicks are greater than the preset online clicks are determined as target employees, and the reason why the target employee's online clicks are too high is determined from the employee online behavior analysis result data. When the reason is an abnormal reason, the terminal device corresponding to the target employee is determined as the second device; the abnormal reason may be that the number of clicks is too high due to malware infection or that the number of clicks is too high due to phishing;

[0154] Each first device and each second device is determined as a risk point, and risk point location information including information of each risk point is generated.

[0155] Therefore, different data can be used to analyze risk points in an organization, determine the organization's information security risks, and facilitate organization personnel to adjust information security management strategies.

[0156] Furthermore, when locating risk points, you can also use the data leakage prevention system statistical data table to determine the risk points in each organization. Specifically, for each organization, the number of interceptions in the data leakage prevention system statistical data table that is higher than the preset interception number is determined as the first value, and the IP address corresponding to the first value belonging to the organization is determined as the target address, and the target address is determined as the risk point of the organization. Thus, the IP addresses that are at risk in the organization can be obtained.

[0157] Preferably, by applying the method provided by the present solution, when determining the risk points of an organization, the risk points of the organization can be analyzed from aspects such as the software security of the terminal equipment, the Internet behavior of the employees using the equipment, and the blocked IP addresses. By analyzing the risk points of the organization from multiple directions and dimensions, the current risk situation of the organization can be comprehensively obtained, so as to facilitate timely adjustment of the security maintenance direction of the organization.

[0158] S105. Generate information security management assessment information for each institution based on the indicator values ​​and risk point location information of each institution.

[0159] Furthermore, for each institution, based on the indicator value of each assessment indicator of the institution, the first score of the institution in each assessment indicator is determined, and based on the weight value and the first score of each assessment indicator of the institution, the assessment score of the institution in each assessment indicator is determined, and the assessment scores of the institution in each assessment indicator are summarized to obtain the information security management score of the institution.

[0160] Based on the indicator value of each assessment indicator of the organization, the process of determining the first score of the organization in each assessment indicator is as follows: for each assessment indicator, the indicator value of the assessment indicator traverses each preset numerical interval, the numerical interval in which the indicator value is located is determined as the target numerical interval, and the score corresponding to the target numerical interval is determined as the first score of the organization in the assessment indicator.

[0161] The process of determining the assessment score of the institution for each assessment indicator based on the weight value and the first score of the institution for each assessment indicator is as follows: for each assessment indicator, determine the weight value of the institution for the assessment indicator, calculate the weight value and the first score, such as multiplying them, and then obtain the assessment score of the institution for the assessment indicator.

[0162] The assessment scores of various assessment indicators can evaluate the organization's information security management in different aspects. The higher the assessment score of the assessment indicator, the better the assessment organization performs in the information security management corresponding to the assessment indicator. Based on the organization's assessment scores of different assessment indicators, we can intuitively understand the organization's information security management work in different aspects, and also evaluate whether the organization has information security risks.

[0163] Furthermore, the weight values ​​of various assessment indicators for different institutions may be the same or different; preferably, a weight value for each assessment indicator may be configured for each institution based on the working scenario of each institution. Because different institutions have different working scenarios, their focus on information security management is also different. By configuring a weight value for each assessment indicator for each institution based on the working scenario of each institution, a more accurate assessment score can be obtained.

[0164] In this application, the information security management score of an organization can comprehensively reflect the overall situation of the organization's information security management. By breaking down the data barriers between different security management systems, a score for the organization's overall information security management can be obtained. This score can be used to directly understand the organization's information security management situation.

[0165] Preferably, the information security management scores of the respective institutions may be used to rank the respective institutions, thereby obtaining the information security management status of the respective institutions in the enterprise.

[0166] The information security management of each institution is assessed and ranked based on the numerical values ​​of each indicator of each institution; the information management risk of the institution is determined based on the risk point positioning information of each institution; and then, based on the assessment ranking and information management risk of each institution, the information security management assessment information of the institution is obtained, and the information security management assessment information includes the assessment ranking and information management risk of the institution.

[0167] By obtaining the information security management assessment information of each organization, we can comprehensively understand the information security management situation of the organization, which is convenient for enterprises to conduct comprehensive management of information security.

[0168] In this application, the antivirus software update failure device table and the virus-attacked terminal device data table in the antivirus management data, the security update failure device table and the patch repair failure terminal device table in the patch repair management data, and the data leakage prevention system statistical data table in the leakage prevention management data are summarized and deduplicated to obtain the statistical data of the employee data leakage prevention analysis results.

[0169] The data rows in the data leakage prevention system statistical data table in the data leakage prevention management data are sorted in descending order according to the number of times they are intercepted to obtain the data leakage prevention system statistical data table in descending order; the data leakage prevention system statistical data table, the antivirus software update failure device table, the virus-attacked terminal device data table, the security update failure device table and the patch repair failure terminal device table are summarized and duplicates are removed to generate employee data leakage prevention analysis result statistical data, which can also be called employee data leakage prevention analysis result statistical table.

[0170] The employee data leakage prevention analysis result statistics table includes the organization name field, employee name field, IP address field, sensitive information interception times field and high number of reasons field; the employee data leakage prevention analysis result statistics table is used to save relevant information about employees' Internet access being intercepted, and the relevant information includes the employee's name, the organization to which the employee belongs, the IP address used by the employee, the number of times the employee was intercepted due to sensitive information, and the reason why the employee was intercepted multiple times.

[0171] In the solution provided in this application, the information security management assessment information of each organization is used to generate an information security assessment report for the enterprise. The information security assessment report contains the information security management assessment information of each structure and may also include the assessment content of the enterprise's information security management. The enterprise's information security management measures can be adjusted based on the content to achieve comprehensive management of the enterprise's information security.

[0172] In the method provided in the embodiment of the present application, the enterprise's antivirus management data is obtained from the antivirus management platform, the enterprise's patch repair management data is obtained from the patch repair management system, the enterprise's employee Internet behavior management data is obtained from the employee Internet behavior management system, and the enterprise's anti-leakage management data is obtained from the data leakage prevention system, and the anti-leakage management data of the enterprise is analyzed. The index values ​​of each preset assessment index of each institution in the enterprise and the risk point location information of each institution are obtained, and then the information security management assessment information of each institution is generated according to the index values ​​and risk point location information of each institution. This solution obtains the security management data of the enterprise from multiple dimensions, and combines and analyzes the security management data of multiple aspects, so as to comprehensively analyze the information security situation of the enterprise and realize comprehensive information security management for the enterprise.

[0173] The comprehensive analysis and management method for information security of office computers of employees in large and medium-sized enterprises of the present invention integrates and utilizes the data of four information security management systems, namely, the anti-virus management platform, the patch repair management system, the employee online behavior management system and the data leakage prevention system, obtains quantitative assessment indicators and accurately locates risk points through data correlation analysis, and realizes efficient and unified management of enterprise information security. Through the application of data analysis results, including the overall information security situation display, assessment and ranking, the efficiency of supervision and inspection is improved.

[0174] Although the present invention depicts operations in a particular order, this should not be understood as requiring that the operations be performed in the particular order shown or in a sequential order.Multitasking and parallel processing may be advantageous under certain circumstances.

[0175] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0176] and Figure 1 Correspondingly, this application provides an enterprise information security management system for supporting Figure 1 For the specific implementation of the method shown, refer to Figure 4 , is a schematic diagram of the structure of an enterprise information security management system provided in an embodiment of the present application, and is specifically described as follows:

[0177] The first acquisition unit 401 is used to acquire the antivirus management data of the enterprise in the antivirus management platform, the patch repair management data of the enterprise in the patch repair management system, the employee online behavior management data of the enterprise in the employee online behavior management system, and the anti-leakage management data of the enterprise in the data leakage prevention system; the enterprise includes multiple institutions, each institution includes multiple terminal devices;

[0178] The second acquisition unit 402 is used to analyze the anti-virus management data, the patch repair management data, the employee online behavior management data and the anti-leakage management data to obtain employee online behavior analysis result data, risk terminal data, terminal security software operation status statistics, organization online behavior statistics and organization sensitive information interception statistics;

[0179] A confirmation unit 403 is used to determine the indicator value of each of the institutions in each preset assessment indicator based on the statistical data of the terminal security software operation, the statistical data of the institution's online behavior, and the statistical data of the institution's sensitive information interception;

[0180] The analysis unit 404 is used to analyze the employee online behavior analysis result data and the risk terminal data, locate the risk point in the terminal device of each of the institutions, and obtain the risk point location information of each of the institutions;

[0181] The first generating unit 405 is used to generate information security management evaluation information of each of the institutions based on the indicator values ​​of each of the institutions and the risk point location information.

[0182] In the system provided by the embodiment of the present application, the enterprise's antivirus management data is obtained from the antivirus management platform, the enterprise's patch repair management data is obtained from the patch repair management system, the enterprise's employee Internet behavior management data is obtained from the employee Internet behavior management system, and the enterprise's anti-leakage management data is obtained from the data leakage prevention system, and the anti-virus management data, patch repair management data, employee Internet behavior management data, and leakage prevention management data are analyzed to obtain the index values ​​of each preset assessment index of each institution in the enterprise, as well as the risk point location information of each institution, and then generate the information security management assessment information of each institution according to the index values ​​and risk point location information of each institution. This solution obtains the security management data of the enterprise from multiple dimensions, and combines and analyzes the security management data of multiple aspects, so as to comprehensively analyze the information security situation of the enterprise and realize comprehensive information security management for the enterprise.

[0183] In another embodiment provided by the present application, the second acquisition unit of the system performs a process of analyzing the antivirus management data, the patch repair management data, the employee online behavior management data, and the anti-leakage management data to obtain employee online behavior analysis result data, risk terminal data, terminal security software operation statistics, organization online behavior statistics, and organization sensitive information interception statistics, including:

[0184] Summarize the table of failed antivirus software update devices and the table of terminal devices attacked by viruses in the antivirus management data, the table of failed security update devices and the table of failed patch repair terminal devices in the patch repair management data, and the table of Internet access click times in the employee online behavior management data, and remove duplicates from the summarized data to obtain employee online behavior analysis result data;

[0185] Aggregate the antivirus system basic data table in the antivirus management data, the patch repair management system basic data table in the patch repair management data, the employee online behavior management system basic data table in the employee online behavior management data, and the data leakage prevention system basic data table in the leakage prevention management data, and remove duplicates from the aggregated data to obtain a terminal computer information library table;

[0186] Using the IP address field as an index, searching the antivirus system basic data table and the terminal computer information library table to obtain a terminal device list table for which the antivirus software is not installed;

[0187] Using the IP address field as an index, searching the basic data table of the patch repair management system and the terminal computer information library table to obtain a terminal device list table that does not have the patch repair software installed;

[0188] Generate risk terminal data based on the terminal device list table without antivirus software installed and the terminal device list table without antivirus software installed;

[0189] Processing the risk terminal data, the terminal computer information library table, the security update failure device table in the patch repair management data, the antivirus software update failure device table and the virus-attacked terminal computer data table in the antivirus management data to obtain the terminal security software operation status statistical data;

[0190] Based on the Internet access click count data table in the employee Internet behavior management data, the Internet access count of each organization is counted to obtain the Internet behavior statistics of the organization;

[0191] Based on the data leakage prevention system statistical data table in the leakage prevention management data, the number of sensitive information interception of each organization is counted to obtain the sensitive information interception statistical data of the organization.

[0192] In another embodiment provided by the present application, the second acquisition unit of the system performs a process of processing the risk terminal data, the terminal computer information library table, the security update failure device table in the patch repair management data, and the antivirus software update failure device table and the virus-attacked terminal computer data table in the antivirus management data to obtain the terminal security software operation status statistical data, including:

[0193] Based on the terminal equipment list table of the risk terminal data without antivirus software installed, obtaining a statistical table of the situation of not installing antivirus software, wherein the statistical table of not installing antivirus software includes the number of terminal equipment without antivirus software installed in each institution;

[0194] Based on the terminal equipment list table of the risk terminal data that does not have the patch repair software installed, a statistical table of the situation of the patch repair software not installed is obtained, wherein the statistical table of the situation of the patch repair software not installed includes the number of terminal equipment of each institution that does not have the antivirus software installed;

[0195] Extracting a statistical table of devices for which virus database updates of each institution have failed from the table of devices for which antivirus software updates have failed;

[0196] Extracting a statistical table of devices for which patch repair software updates of various institutions have failed from the table of devices for which security updates have failed;

[0197] Extracting a resource allocation statistics table from the terminal computer information database table, wherein the resource allocation statistics table contains statistical information of the terminal equipment and employees of each organization;

[0198] The statistical table of the situation where the antivirus software is not installed, the statistical table of the situation where the patch repair software is not installed, the statistical table of the devices where the virus database of each institution has failed to update, the statistical table of the devices where the patch repair software of each institution has failed to update, the statistical table of resource allocation and the data table of terminal computers attacked by viruses are summarized and deduplicated to obtain statistical data on the operation of terminal security software.

[0199] In another embodiment provided by the present application, the system further includes:

[0200] The summarizing unit is used to summarize the table of antivirus software update failure devices and the table of terminal devices attacked by viruses in the antivirus management data, the table of security update failure devices and the table of terminal devices failed to patch repair in the patch repair management data, and the table of data leakage prevention system statistical data in the leakage prevention management data, and perform deduplication processing to obtain statistical data of employee data leakage prevention analysis results.

[0201] In another embodiment provided by the present application, the system further includes:

[0202] The second generating unit is used to generate an information security assessment report for the enterprise by applying the information security management assessment information of each of the institutions.

[0203] An embodiment of the present invention further provides a storage medium, which includes stored instructions, wherein when the instructions are executed, the device where the storage medium is located is controlled to execute the above-mentioned enterprise information security management method.

[0204] The embodiment of the present invention further provides an electronic device, the structural diagram of which is shown in FIG. Figure 5 As shown, it specifically includes a memory 601 and one or more instructions 602, wherein the one or more instructions 602 are stored in the memory 601 and are configured to be executed by one or more processors 603 to perform operations above the one or more instructions 602.

[0205] It should be noted that the information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards in the relevant regions.

[0206] The specific implementation processes and derivative methods of the above-mentioned embodiments are all within the protection scope of the present invention.

[0207] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.

[0208] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention.

[0209] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for enterprise information security management, characterized in that: include: Obtain the enterprise's antivirus management data in the antivirus management platform, the enterprise's patch repair management data in the patch repair management system, the enterprise's employee online behavior management data in the employee online behavior management system, and the enterprise's anti-leakage management data in the data anti-leakage system; The enterprise includes a plurality of organizations, each of which includes a plurality of terminal devices; Analyze the anti-virus management data, the patch repair management data, the employee online behavior management data, and the anti-leakage management data to obtain employee online behavior analysis result data, risk terminal data, terminal security software operation statistics, organization online behavior statistics, and organization sensitive information interception statistics; Based on the statistical data of the operation of the terminal security software, the statistical data of the online behavior of the organization, and the statistical data of the interception of sensitive information of the organization, the indicator value of each preset assessment indicator of each organization is determined; Analyze the employee online behavior analysis result data and the risk terminal data, locate risk points in the terminal devices of each of the institutions, and obtain risk point location information for each of the institutions; Based on the indicator values ​​of each of the institutions and the risk point location information, information security management assessment information of each of the institutions is generated.

2. The method according to claim 1, characterized in that The anti-virus management data, the patch repair management data, the employee online behavior management data and the anti-leakage management data are analyzed to obtain employee online behavior analysis result data, risk terminal data, terminal security software operation statistics, organization online behavior statistics and organization sensitive information interception statistics, including: Summarize the table of failed antivirus software update devices and the table of terminal devices attacked by viruses in the antivirus management data, the table of failed security update devices and the table of failed patch repair terminal devices in the patch repair management data, and the table of Internet access click times in the employee online behavior management data, and remove duplicates from the summarized data to obtain employee online behavior analysis result data; Aggregate the antivirus system basic data table in the antivirus management data, the patch repair management system basic data table in the patch repair management data, the employee online behavior management system basic data table in the employee online behavior management data, and the data leakage prevention system basic data table in the leakage prevention management data, and remove duplicates from the aggregated data to obtain a terminal computer information library table; Using the IP address field as an index, searching the antivirus system basic data table and the terminal computer information library table to obtain a terminal device list table for which the antivirus software is not installed; Using the IP address field as an index, searching the basic data table of the patch repair management system and the terminal computer information library table to obtain a terminal device list table that does not have the patch repair software installed; Generate risk terminal data based on the terminal device list table without antivirus software installed and the terminal device list table without antivirus software installed; Processing the risk terminal data, the terminal computer information library table, the security update failure device table in the patch repair management data, the antivirus software update failure device table and the virus-attacked terminal computer data table in the antivirus management data to obtain the terminal security software operation status statistical data; Based on the Internet access click count data table in the employee Internet behavior management data, the Internet access count of each organization is counted to obtain the Internet behavior statistics of the organization; Based on the data leakage prevention system statistical data table in the leakage prevention management data, the number of sensitive information interception of each organization is counted to obtain the sensitive information interception statistical data of the organization.

3. The method according to claim 2, characterized in that The processing of the risk terminal data, the terminal computer information library table, the security update failure device table in the patch repair management data, the antivirus software update failure device table in the antivirus management data, and the terminal computer data table attacked by viruses to obtain the terminal security software operation status statistical data includes: Based on the terminal equipment list table of the risk terminal data that does not have antivirus software installed, obtain a statistical table of the situation of not having antivirus software installed; Based on the terminal equipment list table of the risk terminal data that does not have the patch repair software installed, obtain a statistical table of the situation of the patch repair software not installed; Extracting a statistical table of devices for which virus database updates of each institution have failed from the table of devices for which antivirus software updates have failed; Extracting a statistical table of devices for which patch repair software updates of various institutions have failed from the table of devices for which security updates have failed; Extracting a resource allocation statistics table from the terminal computer information database table, wherein the resource allocation statistics table contains statistical information of the terminal equipment and employees of each organization; The statistical table of the situation where the antivirus software is not installed, the statistical table of the situation where the patch repair software is not installed, the statistical table of the devices where the virus database of each institution has failed to update, the statistical table of the devices where the patch repair software of each institution has failed to update, the statistical table of resource allocation and the data table of terminal computers attacked by viruses are summarized and deduplicated to obtain statistical data on the operation of terminal security software.

4. The method according to claim 1, characterized in that Also includes: The antivirus software update failure device table and the virus-attacked terminal device data table in the antivirus management data, the security update failure device table and the patch repair failure terminal device table in the patch repair management data, and the data leakage prevention system statistical data table in the leakage prevention management data are deduplicated to obtain the employee data leakage prevention analysis result statistical data.

5. The method according to claim 1, characterized in that Also includes: The information security management assessment information of each of the institutions is used to generate an information security assessment report for the enterprise.

6. An enterprise information security management system, characterized in that: include: The first acquisition unit is used to acquire the antivirus management data of the enterprise in the antivirus management platform, the patch repair management data of the enterprise in the patch repair management system, the employee online behavior management data of the enterprise in the employee online behavior management system, and the anti-leakage management data of the enterprise in the data leakage prevention system; The enterprise includes a plurality of organizations, each of which includes a plurality of terminal devices; A second acquisition unit is used to analyze the anti-virus management data, the patch repair management data, the employee online behavior management data and the anti-leakage management data to obtain employee online behavior analysis result data, risk terminal data, terminal security software operation statistics, organization online behavior statistics and organization sensitive information interception statistics; A confirmation unit, used to determine the indicator value of each of the institutions in each preset assessment indicator based on the statistical data of the terminal security software operation, the statistical data of the institution's online behavior, and the statistical data of the institution's sensitive information interception; An analysis unit, used to analyze the employee online behavior analysis result data and the risk terminal data, locate risk points in the terminal devices of each of the institutions, and obtain risk point location information for each of the institutions; The first generating unit is used to generate information security management evaluation information of each of the institutions based on the indicator values ​​of each of the institutions and the risk point location information.

7. The system according to claim 6, characterized in that The second acquisition unit performs a process of analyzing the anti-virus management data, the patch repair management data, the employee online behavior management data, and the anti-leakage management data to acquire employee online behavior analysis result data, risk terminal data, terminal security software operation statistics, organization online behavior statistics, and organization sensitive information interception statistics, including: Summarize the table of failed antivirus software update devices and the table of terminal devices attacked by viruses in the antivirus management data, the table of failed security update devices and the table of failed patch repair terminal devices in the patch repair management data, and the table of Internet access click times in the employee online behavior management data, and remove duplicates from the summarized data to obtain employee online behavior analysis result data; Aggregate the antivirus system basic data table in the antivirus management data, the patch repair management system basic data table in the patch repair management data, the employee online behavior management system basic data table in the employee online behavior management data, and the data leakage prevention system basic data table in the leakage prevention management data, and remove duplicates from the aggregated data to obtain a terminal computer information library table; Using the IP address field as an index, searching the antivirus system basic data table and the terminal computer information library table to obtain a terminal device list table for which the antivirus software is not installed; Using the IP address field as an index, searching the basic data table of the patch repair management system and the terminal computer information library table to obtain a terminal device list table that does not have the patch repair software installed; Generate risk terminal data based on the terminal device list table without antivirus software installed and the terminal device list table without antivirus software installed; Processing the risk terminal data, the terminal computer information library table, the security update failure device table in the patch repair management data, the antivirus software update failure device table and the virus-attacked terminal computer data table in the antivirus management data to obtain the terminal security software operation status statistical data; Based on the Internet access click count data table in the employee Internet behavior management data, the Internet access count of each organization is counted to obtain the Internet behavior statistics of the organization; Based on the data leakage prevention system statistical data table in the leakage prevention management data, the number of sensitive information interception of each organization is counted to obtain the sensitive information interception statistical data of the organization.

8. The system according to claim 6, characterized in that The second acquisition unit performs processing on the risk terminal data, the terminal computer information library table, the security update failure device table in the patch repair management data, the antivirus software update failure device table in the antivirus management data, and the terminal computer data table attacked by viruses to obtain the terminal security software operation status statistical data, including: Based on the terminal equipment list table of the risk terminal data without antivirus software installed, obtaining a statistical table of the situation of not installing antivirus software, wherein the statistical table of not installing antivirus software includes the number of terminal equipment without antivirus software installed in each institution; Based on the terminal equipment list table of the risk terminal data that does not have the patch repair software installed, a statistical table of the situation of the patch repair software not installed is obtained, wherein the statistical table of the situation of the patch repair software not installed includes the number of terminal equipment of each institution that does not have the antivirus software installed; Extracting a statistical table of devices for which virus database updates of each institution have failed from the table of devices for which antivirus software updates have failed; Extracting a statistical table of devices for which patch repair software updates of various institutions have failed from the table of devices for which security updates have failed; Extracting a resource allocation statistics table from the terminal computer information database table, wherein the resource allocation statistics table contains statistical information of the terminal equipment and employees of each organization; The statistical table of the situation where the antivirus software is not installed, the statistical table of the situation where the patch repair software is not installed, the statistical table of the devices where the virus database of each institution has failed to update, the statistical table of the devices where the patch repair software of each institution has failed to update, the statistical table of resource allocation and the data table of terminal computers attacked by viruses are summarized and deduplicated to obtain statistical data on the operation of terminal security software.

9. The system according to claim 6, characterized in that Also includes: The summarizing unit is used to summarize the table of antivirus software update failure devices and the table of terminal devices attacked by viruses in the antivirus management data, the table of security update failure devices and the table of terminal devices failed to patch repair in the patch repair management data, and the table of data leakage prevention system statistical data in the leakage prevention management data, and perform deduplication processing to obtain statistical data of employee data leakage prevention analysis results.

10. The system according to claim 6, characterized in that Also includes: The second generating unit is used to generate an information security assessment report for the enterprise by applying the information security management assessment information of each of the institutions.

Images