Security baseline management method and device, equipment and storage medium
Through the Security Baseline Management Center, identifying the type of objects to be maintained and generating maintenance instructions, the existing security baseline management methods are solved, and efficient security baseline management and configuration are achieved.
Patent Information
- Application Number
- CN202411671678.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-21
- Publication Date
- 2025-03-18
AI Technical Summary
The performance of existing security baseline management methods needs to be improved, especially when maintaining multiple types of objects to be maintained, it is inefficient and prone to errors.
The type of object to be maintained is identified through the Security Baseline Management Center, and the maintenance-able baseline items and executable actions are confirmed in the baseline library, maintenance instructions are generated and sent to the object to be maintained for execution.
It simplifies daily safety baseline management, improves efficiency, and can baseline verification and configuration of different types of objects to be maintained at the same time, avoiding excessive construction.
Smart Images
Figure CN119652566A_ABST
Abstract
Description
Technical Field
[0001] The embodiments of the present application relate to the field of network security technology, and in particular to a security baseline management method, apparatus, device and storage medium. Background Art
[0002] With the rapid development of information technology, the requirements for network security are becoming more and more stringent. As an important security strategy, security baseline management has gradually received widespread attention and application. The security baseline is a set of configuration setting requirements. These configuration requirements are designed to ensure that the system meets the most basic security requirements and prevents internal and external malicious attacks. It is the most basic security protection standard. At present, for the convenience of maintenance, most of the settings in the system or equipment do not meet the security requirements. Therefore, it is necessary to manage the security baseline and continuously update and improve the content of the security baseline.
[0003] However, the performance of the current security baseline management method needs to be improved. Summary of the invention
[0004] In view of this, embodiments of the present application provide a security baseline management method, apparatus, device and storage medium to at least partially solve the above-mentioned problems.
[0005] According to a first aspect of an embodiment of the present application, a security baseline management method is provided, including:
[0006] The security baseline management center identifies the type of object to be maintained;
[0007] According to the type of the object to be maintained, confirm in the baseline library the maintainable baseline items of the object to be maintained and the executable actions of the maintainable baseline items; wherein the baseline library includes several different baseline items, and the executable actions of the several different baseline items include: configuration, inspection, restoration and verification;
[0008] Selecting a maintenance baseline item from the maintainable baseline items, and selecting an execution action from the executable actions of the maintenance baseline item, to generate a maintenance instruction including the maintenance baseline item and the execution action;
[0009] The maintenance instruction including the maintenance baseline item and the execution action is sent to the object to be maintained, so that the object to be maintained can execute it.
[0010] In an optional embodiment, before the security baseline management center identifies the type of the object to be maintained, the method further includes:
[0011] Selecting the maintenance baseline item in the baseline library, and selecting the execution action from the executable actions of the maintenance baseline item, to generate the maintenance instruction including the maintenance baseline item and the execution action;
[0012] The maintenance instruction is sent to all types of the objects to be maintained, so that all types of the objects to be maintained are executed.
[0013] In an optional embodiment, the security baseline management center identifies the type of the object to be maintained, including:
[0014] The security baseline management center obtains the asset information of the object to be maintained through a third-party device;
[0015] The security baseline management center obtains the type of the object to be maintained according to the asset information of the object to be maintained; wherein the type of the object to be maintained includes: network equipment, security equipment, database, business system and operating system running on the host.
[0016] In an optional embodiment, when the type of the object to be maintained is a security device, a database, a business system, and an operating system running on a host, sending the maintenance instruction including the maintenance baseline item and the execution action to the object to be maintained includes:
[0017] The maintenance instruction including the maintenance baseline item and the execution action is sent to the plug-in running in the object to be maintained, and the plug-in executes the maintenance instruction; wherein the plug-in is a plug-in of the security baseline management center, and the plug-in runs in the background of the object to be maintained.
[0018] In an optional embodiment, the executing of the maintenance instruction by the plug-in includes:
[0019] The plug-in executes the execution action on the baseline object of the baseline item in the object to be maintained according to the baseline object corresponding to the maintenance baseline item.
[0020] In an optional embodiment, for the object to be maintained including the plug-in, the method further includes:
[0021] After selecting a maintenance baseline item from the maintainable baseline items, setting baseline parameters of the maintenance baseline item and sending the baseline parameters to a plug-in running in the object to be maintained;
[0022] The plug-in performs the execution action on the baseline object of the baseline item in the object to be maintained according to the baseline parameter; wherein the baseline object of the baseline item in the object to be maintained is the same as the baseline object corresponding to the maintenance baseline item.
[0023] In an optional embodiment, it also includes:
[0024] When the execution action in the maintenance instruction is configuration, all or part of the baseline items of the object to be maintained are backed up before the object to be maintained executes the maintenance instruction.
[0025] According to a second aspect of an embodiment of the present application, a security baseline management device is provided, including:
[0026] An identification unit, used to enable the security baseline management center to identify the type of the object to be maintained;
[0027] A selection unit is used to confirm, in a baseline library, a maintainable baseline item of the object to be maintained and executable actions of the maintainable baseline item according to the type of the object to be maintained; wherein the baseline library includes a plurality of different baseline items, and the executable actions of the plurality of different baseline items include: configuration, inspection, restoration and verification;
[0028] An instruction generating unit, configured to select a maintenance baseline item from the maintainable baseline items, select an execution action from the executable actions of the maintenance baseline item, and generate a maintenance instruction including the maintenance baseline item and the execution action;
[0029] The sending unit is used to send the maintenance instruction including the maintenance baseline item and the execution action to the object to be maintained, so that the object to be maintained can execute it.
[0030] According to a third aspect of an embodiment of the present application, an electronic device is provided, comprising a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, a method as described in any one of the first aspects is implemented.
[0031] According to a fourth aspect of an embodiment of the present application, a computer storage medium is provided, which is configured to store computer program instructions, wherein the computer program instructions are used to execute any one of the methods according to the first aspect.
[0032] According to the solution provided in the embodiment of the present application, the security baseline management center batch maintains the objects to be maintained, and after identifying the types of the objects to be maintained, the maintainable baseline items of the objects to be maintained and the executable actions of the maintainable baseline items are confirmed according to the types of the objects to be maintained for selection, and the maintenance baseline items are selected from the maintainable baseline items, and the execution actions are selected from the executable actions of the maintenance baseline items, and a maintenance instruction including the maintenance baseline items and the execution actions is generated, and the maintenance instruction is sent to the objects to be maintained for execution by the objects to be maintained; thereby, daily security baseline management work is simplified, and a set of solutions can simultaneously perform baseline verification and configuration and other tasks on different types of objects to be maintained, avoiding excessive construction. BRIEF DESCRIPTION OF THE DRAWINGS
[0033] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.
[0034] Figure 1 A flowchart of a security baseline management method according to an embodiment of the present application;
[0035] Figure 2 It is an architecture diagram between a security baseline management center and an object to be maintained according to an embodiment of the present application;
[0036] Figure 3 A structural diagram of a security baseline management device according to an embodiment of the present application. DETAILED DESCRIPTION
[0037] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the embodiments of the present application should fall within the scope of protection of the embodiments of the present application.
[0038] Currently, the security baseline is configured by logging in directly or using a bastion host to log in to each network device in turn, and configuring the baseline items for security devices, databases, business systems, and operating systems running on the host. Since the security baseline involves a wide variety of objects and the number of devices to be configured is usually large, manual configuration of the security baseline is inefficient and prone to errors.
[0039] Based on this, an embodiment of the present application provides a security baseline management method. The specific implementation of the embodiment of the present application is further explained below in conjunction with the accompanying drawings of the embodiment of the present application.
[0040] Please see attached Figure 1 , shows a flowchart of the steps of a security baseline management method according to an embodiment of the present application. A security baseline management method of this embodiment includes the following steps:
[0041] Step S102: The security baseline management center identifies the type of the object to be maintained.
[0042] The Security Baseline Management Center is a platform for unified management of the security baselines of all objects to be maintained. It provides unified maintenance for all types of objects to be maintained of different versions or manufacturers. The objects to be maintained are various types of equipment that require security baseline management, such as network equipment, security equipment, databases, business systems, and operating systems running on hosts. Figure 2 , shows an architecture diagram between the security baseline management center and various types of objects to be maintained of different versions or manufacturers, wherein, in one feasible manner, Figure 2 Specifically shown is the architecture diagram between the security baseline management center and the operating systems running on routers, switches, and hosts from different manufacturers, as well as the security baseline management center and different types of databases.
[0043] In one feasible method, the object to be maintained interacts with the security baseline management center through a third-party device; for example, a bastion host, the bastion host directly logs in to the object to be maintained by opening a session, or directly logs in to the object to be maintained through a provided login-free interface for interaction; the asset information of the object to be maintained is maintained in the bastion host, for example, basic information such as device name, device number, and login information such as IP (Internet Protocol), account, and login protocol; the bastion host interacts with the security baseline management center by providing an API (Application Programming Interface) interface, so that the security baseline management center obtains the asset information of the object to be maintained through the API interface provided by the bastion host.
[0044] In one feasible manner, step S102 specifically includes:
[0045] S1021. The security baseline management center obtains the asset information of the object to be maintained through a third-party device; wherein the asset information of the object to be maintained includes a variety of data and information related to the object to be maintained, which is used to manage and maintain the object to be maintained, such as: the equipment number of the object to be maintained.
[0046] S1022. The security baseline management center obtains the type of the object to be maintained based on the asset information of the object to be maintained.
[0047] For example, the device name and device model of the object to be maintained are obtained according to the basic information, thereby confirming that the object to be maintained is a router.
[0048] The types of objects to be maintained include:
[0049] The operating system running on the host, such as Linux, Windows, Kylin, Tongxin, etc.
[0050] Network equipment, such as routers, switches, etc.
[0051] Security equipment, such as firewalls, network gates, etc.;
[0052] Databases, such as oracle, mysql, mariadb, polardb, etc.
[0053] Business systems, such as TDCS (Train Operation Dispatching Command System), CTC (Centralized traffic control), CSM (Centralized Signalling Monitoring system), etc.
[0054] Among them, the business system is a software business system.
[0055] By confirming the asset information of the object to be maintained, such as confirming the equipment number and equipment name of the object to be maintained, the type of the object to be maintained is confirmed. Thus, on the one hand, the objects to be maintained are divided into multiple types so that security baseline management can be performed according to the type of the object to be maintained, thereby improving the efficiency of security baseline management; on the other hand, determining the type of the object to be maintained based on the asset information is simple to implement and has low implementation cost. When determining the type of the object to be maintained based on the asset information, in one method, keywords can be extracted from the asset information first, and then the type of the object to be maintained corresponding to the keyword can be determined based on the relationship between the extracted keywords and the pre-set type of the object to be maintained. In another feasible method, a clustering algorithm can be used to cluster the asset information first, obtain multiple corresponding clustering categories, and then establish the relationship between the clustering category and the type of the object to be maintained. Then, in subsequent use, the clustering category to which the asset information belongs can be determined first, and then the type of the object to be maintained correspondingly can be determined based on this.
[0056] Step S104: According to the type of the object to be maintained, confirm in the baseline library the maintainable baseline items of the object to be maintained and the executable actions of the maintainable baseline items.
[0057] Among them, several different baseline items are stored in the baseline library of the security baseline management center. In one feasible way, when the security baseline management center maintains the baseline library, the baseline library information includes the type, version and manufacturer of the object to be maintained applicable to the baseline item, as well as the executable actions. In one feasible way, the baseline library information can be maintained in the form of a script library. For example, the baseline item, the type or manufacturer of the object to be maintained applicable to the baseline item, and the executable actions corresponding to the baseline item are written in the script, and the custom name of the script and the script content are displayed to modify, add and perform other maintenance actions on the baseline library information. In addition, the script can be written in a script language such as JSON or XML that can be parsed and executed by most objects to be maintained. However, it is not limited to this. In one feasible way, a conversion model can be set in the security baseline management center. In this case, the script can be written in any appropriate language. When it is needed to be applied to a certain object to be maintained, the security baseline management center can first determine the script language that can be used by the object to be maintained, and then determine whether the script language of the existing script matches the script language; if it matches, it can be directly applied to the object to be maintained; if it does not match, the security baseline management center can convert it into a script language that can be used by the object to be maintained through a conversion model, and then apply it to the object to be maintained. Among them, the conversion model can be any appropriate machine learning model, including but not limited to a convolutional model, a language translation model, etc.
[0058] In one possible approach, several different baseline items are targeted at different types of security baselines, for example:
[0059] Operational security baseline: maintain the security settings when the object to be maintained is turned on or off, or disable or close the default services of the object to be maintained; the baseline items of the operational security baseline include: prohibiting automatic login at startup, prohibiting shutdown by non-administrators, prohibiting shutdown without logging in, and non-safe default services of the operational security baseline: closing default sharing and printers, etc.
[0060] Account security baseline: maintain and set up security policies for accounts, passwords, permissions, and logins; baseline items of the account security baseline include: special treatment of existing default users in the system, deletion of redundant and expired users; account permission allocation control: setting up accounts at different levels and permission ranges; password security baseline policy: validity period restrictions, available characters, length restrictions; lock processing for failed logins, etc.; restrict anonymous logins; limit session timeouts for various login types; prohibit default super-privilege users from logging in, etc.
[0061] Network security baseline: Control network communication protocols and ports, and only allow secure channels to communicate; baseline items of the network security baseline include: closing high-risk ports; setting up encrypted remote management, etc.
[0062] The baseline items of the audit baseline include: actions that pose security risks, configuration of sending logs of different levels to the audit center, etc.
[0063] Several different baseline items stored in the baseline library correspond to executable actions, including: configuration, inspection, restoration and verification; in a feasible way, for each baseline item, with the help of big data statistics, the executable actions corresponding to each baseline item are statistically generated; each baseline item corresponds to at least one executable action, and the security baseline management center can perform different executable actions on the maintenance objects according to different baseline items, for example: the executable action is configuration, which is used to configure the password of the operating system account running on the host to contain special characters. In addition, the baseline library also provides an external interface, through which updates for baseline items and their corresponding executable actions can be received regularly or in real time.
[0064] In one feasible method, you can first select the type of object to be maintained, and then select the maintenance baseline item, that is, you need to maintain a certain type of objects to be maintained; you can also first select the maintenance baseline item, and then select the type of object to be maintained, that is, you need to set a certain type of baseline item and apply it to a certain type of objects to be maintained.
[0065] In a feasible manner, the configuration content in the executable action includes: setting all or part of the baseline items for the maintenance object, for example, setting all or part of the baseline items for the maintenance object through an SQL (Structured Query Language) file, or using XML (Extensible Markup Language), command line, program code, etc.; when using, selection is made according to different objects to be maintained and baseline items; in a feasible manner, the relevant SQL file is included in the factory configuration of the security baseline management center, thereby greatly improving the configuration efficiency; the inspection content in the executable action includes: checking whether all or part of the baseline items in the maintenance object meet the requirements; the restoration content in the executable action includes: restoring all or part of the baseline items in the maintenance object to the configuration state of the backup node; the verification content in the executable action includes: verifying the validity and availability of the baseline items configured in the maintenance object, for example, simulating human operations to verify whether the configured baseline items in the maintenance object achieve the preset expected effects.
[0066] Therefore, in the security baseline management center, all maintainable baseline items of the current type of objects to be maintained and executable actions of the maintainable baseline items can be screened for use, thereby improving the efficiency of security baseline management.
[0067] Step S106: Select a maintenance baseline item from the maintainable baseline items, and select an execution action from the executable actions of the maintenance baseline item, to generate a maintenance instruction including the maintenance baseline item and the execution action.
[0068] In the security baseline management center, a maintenance instruction including the maintenance baseline item and the execution action is generated by selecting the maintenance baseline item and the execution action; for example, the security baseline management center automatically generates a program or script that instructs the object to be maintained to execute the selected execution action for the baseline item based on the maintenance baseline item and the execution action. In a feasible manner, the maintenance instruction can be implemented in the form of a script, a program, a software module, a subroutine, an embedded code, and a machine code.
[0069] Step S108: sending a maintenance instruction including the maintenance baseline item and the execution action to the object to be maintained for execution by the object to be maintained.
[0070] In one feasible method, maintenance instructions in the security baseline management center are sent to a third-party device through the API interface provided by a third-party device, such as a bastion host, and then the baseline object login information maintained in the third-party device is used to directly log in to the object to be maintained and the maintenance instructions are executed by the object to be maintained, wherein the maintenance instructions are non-editable encrypted files.
[0071] When the type of the object to be maintained is a security device, a database, a business system, or an operating system running on a host, in one feasible manner, a plug-in is running in the object to be maintained, and further, the plug-in running in the object to be maintained is a plug-in of the security baseline management center. The security baseline management center sends the maintenance instruction to the third-party device through the API interface of the third-party device, and sends the maintenance instruction containing the maintenance baseline item and the execution action from the third-party device to the plug-in running in the object to be maintained through the API of the plug-in running in the object to be maintained, and the plug-in executes the maintenance instruction. In another feasible manner, the security baseline management center directly communicates with the API of the plug-in running in the object to be maintained, sends the maintenance instruction to the plug-in running in the object to be maintained, and the plug-in running in the object to be maintained executes the maintenance instruction. Furthermore, the communication with the API interface adopts an encrypted method to further improve the security of instruction transmission. In one feasible manner, the security baseline management center sends the maintenance instruction to the plug-in running in the object to be maintained, and the plug-in running in the object to be maintained saves it. When the same maintenance instruction needs to be executed again, the maintenance instruction saved in the plug-in is directly executed without the need for the security baseline management center to issue the instruction again. In a feasible manner, the plug-in running in the object to be maintained analyzes the maintenance instruction, obtains the baseline object corresponding to the maintenance baseline item in the maintenance instruction, such as the password complexity requirement, etc., and the plug-in executes the execution action in the maintenance instruction on the baseline object of the baseline item in the object to be maintained, for example, executes the configuration action, so as to set the first letter of the password of the account of the operating system running on the host to be capitalized; wherein the baseline object of the baseline item in the object to be maintained is the same as the baseline object corresponding to the maintenance baseline item. In a feasible manner, the plug-in hides the interface permissions when running, and runs in the background of the object to be maintained as a service, thereby, when the plug-in executes the maintenance instruction, there will be no pop-up window affecting the use of the existing terminal of the object to be maintained. In a feasible manner, the plug-in running in the object to be maintained and a third-party device, such as a bastion host, communicates using the national secret TCP (Transmission Control Protocol), thereby ensuring the secure encrypted transmission of data through encrypted communication, and protecting the data privacy and security of the object to be maintained.
[0072] In one feasible manner, the baseline items and related information in the baseline library, such as corresponding executable actions, are stored in the plug-in. For the object to be maintained that runs the plug-in, a security baseline management method of an embodiment of the present application further includes:
[0073] A maintenance baseline item is selected from maintainable baseline items, baseline parameters of the maintenance baseline item are set, and the baseline parameters are sent to the plug-in. After the plug-in recognizes the parameters, the corresponding execution action is performed on the baseline object of the baseline item in the object to be maintained according to the baseline parameters, wherein the baseline object of the baseline item in the object to be maintained is the same as the baseline object corresponding to the maintenance baseline item. In this way, the security baseline management of the object to be maintained can be performed more quickly and conveniently.
[0074] In one feasible manner, when the execution action in the maintenance instruction is configuration, before the object to be maintained executes the maintenance instruction, a security baseline management method of an embodiment of the present application also includes: backing up all or part of the current baseline items of the object to be maintained. After the backup, the baseline item configuration information of the current backup node is generated. Thus, after the object to be maintained executes the configuration multiple times and executes different baseline items each time, all or part of the baseline items of the object to be maintained can be restored to the initial configuration or the configuration at any backup time point according to the baseline item configuration information of the backup node by performing a restore. When a situation occurs in which the operation of the customer's business system is affected due to the baseline item configuration, the baseline item configuration can be quickly restored with one click to shorten the duration of the fault.
[0075] In one feasible manner, a security baseline management method of an embodiment of the present application further includes:
[0076] S202. For all objects to be maintained, the security baseline management center obtains the asset information of all objects to be maintained through third-party equipment, selects the maintenance baseline item in the baseline library, and selects the execution action from the executable actions of the maintenance baseline item to generate a maintenance instruction including the maintenance baseline item and the execution action;
[0077] S204. Send the maintenance instruction to all types of objects to be maintained, so that all types of objects to be maintained can execute it.
[0078] Therefore, using the baseline item as the screening basis, a unified baseline item maintenance is performed on all types of objects to be maintained, for example: uniformly checking whether all types of objects to be maintained have high-risk ports; uniformly checking whether all types of accounts of objects to be maintained are safe, etc., which improves the availability and convenience of a security baseline management method in an embodiment of the present application.
[0079] In one feasible way, before sending the maintenance instruction to the object to be maintained, the maintenance instruction needs to be reviewed to confirm whether the maintenance instruction complies with the preset specifications. The maintenance instruction can be sent to the object to be maintained only after the review is passed for the object to be maintained to execute, thereby ensuring the security of security baseline management to prevent non-compliant maintenance instructions from causing failures or abnormal operation of the object to be maintained. In one feasible way, when setting all or part of the baseline items for the object to be maintained, the time, baseline object, baseline items, compliance, comparison of content before and after configuration, executors, and reviewers when setting all or part of the baseline items are automatically recorded for subsequent audit review.
[0080] In one feasible embodiment, a security baseline management method of an embodiment of the present application also includes, when the content of the maintenance instruction is to configure a regular password change, setting a reminder in the security baseline management center at a preset time before the password expires; in another feasible embodiment, sending a maintenance instruction to batch change the passwords of objects to be maintained whose passwords will expire after a preset time, to avoid affecting login when logging into the device due to the expiration of the password of the device to be maintained.
[0081] In a feasible manner, a security baseline management method of an embodiment of the present application supports remote login protocols, such as SSH (Secure Shell) protocol, Telnet protocol, RDP (Remote Desktop Protocol) protocol, and VNC (Virtual Network Console) protocol; in a feasible manner, the remote login protocol of a security baseline management method of an embodiment of the present application uses TCP as the transport layer protocol.
[0082] It can be seen that through the solution of the embodiment of the present application, the objects to be maintained are managed in batches through the security baseline management center. It is only necessary to select the assets of the objects to be maintained to identify the types of the objects to be maintained, confirm the maintainable baseline items of the objects to be maintained, and the executable actions of the maintainable baseline items, and then select the baseline items to be maintained and the execution actions. A maintenance instruction containing the maintenance baseline items and the execution actions can be generated and sent to the objects to be maintained for execution by the objects to be maintained. Maintenance personnel do not need professional operating system and network maintenance knowledge; daily security baseline management work is simplified, and a set of solutions can perform baseline verification and configuration and other tasks on different types of objects to be maintained at the same time, avoiding excessive construction.
[0083] See also Figure 3 As shown, the embodiment of the present application also provides a security baseline management device, including:
[0084] An identification unit, used to enable the security baseline management center to identify the type of the object to be maintained;
[0085] The selection unit is used to confirm, in the baseline library, the maintainable baseline items of the object to be maintained and the executable actions of the maintainable baseline items according to the type of the object to be maintained; wherein the baseline library includes a plurality of different baseline items, and the executable actions of the plurality of different baseline items include: configuration, inspection, restoration and verification;
[0086] An instruction generating unit, used to select a maintenance baseline item from maintainable baseline items, and select an execution action from executable actions of the maintenance baseline item, and generate a maintenance instruction including the maintenance baseline item and the execution action;
[0087] The sending unit is used to send the maintenance instruction including the maintenance baseline item and the execution action to the object to be maintained, so that the object to be maintained can execute it.
[0088] The information interaction, execution process, etc. between the units in the above-mentioned device are based on the same concept as the embodiment of the method of the present application. For specific contents, please refer to the description in the embodiment of the method of the present application, and will not be repeated here.
[0089] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, a security baseline management method in any embodiment of the present invention is implemented.
[0090] The present application also provides a computer storage medium configured to store computer program instructions for executing the method described in any of the above method embodiments. The computer storage medium includes, but is not limited to, a compact disc read-only memory (CD-ROM), a random access memory (RAM), a floppy disk, a hard disk, or a magneto-optical disk.
[0091] It should be pointed out that, according to the needs of implementation, the various components / steps described in the embodiments of the present application can be split into more components / steps, or two or more components / steps or partial operations of components / steps can be combined into new components / steps to achieve the purpose of the embodiments of the present application.
[0092] The above-mentioned method according to the embodiment of the present application can be implemented in hardware, firmware, or implemented as software or computer code that can be stored in a recording medium (such as a CD-ROM, RAM, floppy disk, hard disk or magneto-optical disk), or implemented as a computer code originally stored in a remote recording medium or a non-temporary machine-readable medium downloaded through a network and stored in a local recording medium, so that the method described herein can be stored in such software processing on a recording medium using a general-purpose computer, a dedicated processor or programmable or dedicated hardware (such as an application-specific integrated circuit (ASIC) or a field programmable gate array (FPGA)). It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component (e.g., a random access memory (RAM), a read-only memory (ROM), a flash memory, etc.) that can store or receive software or computer code, and when the software or computer code is accessed and executed by a computer, a processor or hardware, the method described herein is implemented. In addition, when a general-purpose computer accesses the code for implementing the method shown here, the execution of the code converts the general-purpose computer into a dedicated computer for executing the method shown here.
[0093] Those of ordinary skill in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for specific applications, but such implementation should not be considered to be beyond the scope of the embodiments of the present application.
[0094] The above implementation methods are only used to illustrate the embodiments of the present application, and are not limitations on the embodiments of the present application. Ordinary technicians in the relevant technical field can make various changes and modifications without departing from the spirit and scope of the embodiments of the present application. Therefore, all equivalent technical solutions also belong to the scope of the embodiments of the present application. The scope of patent protection of the embodiments of the present application should be limited by the claims.
Claims
1. A security baseline management method, characterized in that: include: The security baseline management center identifies the type of object to be maintained; According to the type of the object to be maintained, confirm in the baseline library the maintainable baseline items of the object to be maintained and the executable actions of the maintainable baseline items; wherein the baseline library includes several different baseline items, and the executable actions of the several different baseline items include: configuration, inspection, restoration and verification; Selecting a maintenance baseline item from the maintainable baseline items, and selecting an execution action from the executable actions of the maintenance baseline item, to generate a maintenance instruction including the maintenance baseline item and the execution action; The maintenance instruction including the maintenance baseline item and the execution action is sent to the object to be maintained, so that the object to be maintained can execute it.
2. The method according to claim 1, characterized in that Before the security baseline management center identifies the type of the object to be maintained, the method further includes: Selecting the maintenance baseline item in the baseline library, and selecting the execution action from the executable actions of the maintenance baseline item, to generate the maintenance instruction including the maintenance baseline item and the execution action; The maintenance instruction is sent to all types of the objects to be maintained, so that all types of the objects to be maintained are executed.
3. The method according to claim 1, characterized in that The security baseline management center identifies the type of the object to be maintained, including: The security baseline management center obtains the asset information of the object to be maintained through a third-party device; The security baseline management center obtains the type of the object to be maintained according to the asset information of the object to be maintained; wherein the type of the object to be maintained includes: network equipment, security equipment, database, business system and operating system running on the host.
4. The method according to claim 3, characterized in that When the type of the object to be maintained is a security device, a database, a business system, and an operating system running on a host, sending the maintenance instruction including the maintenance baseline item and the execution action to the object to be maintained includes: The maintenance instruction including the maintenance baseline item and the execution action is sent to the plug-in running in the object to be maintained, and the plug-in executes the maintenance instruction; wherein the plug-in is a plug-in of the security baseline management center, and the plug-in runs in the background of the object to be maintained.
5. The method according to claim 4, characterized in that The executing of the maintenance instruction by the plug-in includes: The plug-in executes the execution action on the baseline object of the baseline item in the object to be maintained according to the baseline object corresponding to the maintenance baseline item.
6. The method according to claim 5, characterized in that For the object to be maintained including the plug-in, the method further includes: After selecting a maintenance baseline item from the maintainable baseline items, setting baseline parameters of the maintenance baseline item and sending the baseline parameters to a plug-in running in the object to be maintained; The plug-in performs the execution action on the baseline object of the baseline item in the object to be maintained according to the baseline parameter; wherein the baseline object of the baseline item in the object to be maintained is the same as the baseline object corresponding to the maintenance baseline item.
7. The method according to claim 1, characterized in that Also includes: When the execution action in the maintenance instruction is configuration, all or part of the baseline items of the object to be maintained are backed up before the object to be maintained executes the maintenance instruction.
8. A security baseline management device, characterized in that: include: An identification unit, used to enable the security baseline management center to identify the type of the object to be maintained; A selection unit is used to confirm, in a baseline library, a maintainable baseline item of the object to be maintained and executable actions of the maintainable baseline item according to the type of the object to be maintained; wherein the baseline library includes a plurality of different baseline items, and the executable actions of the plurality of different baseline items include: configuration, inspection, restoration and verification; An instruction generating unit, configured to select a maintenance baseline item from the maintainable baseline items, select an execution action from the executable actions of the maintenance baseline item, and generate a maintenance instruction including the maintenance baseline item and the execution action; The sending unit is used to send the maintenance instruction including the maintenance baseline item and the execution action to the object to be maintained, so that the object to be maintained can execute it.
9. An electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.
10. A computer storage medium, characterized in that: The device is configured to store computer program instructions for executing the method according to any one of claims 1 to 7.