Vulnerability priority determination method and device and attack surface management system

Abstract

The invention provides a vulnerability priority determination method and device and an attack surface management system, and relates to the technical field of vulnerability processing. According to the method, the vulnerability risk analysis model compatible with the service attribute, the vulnerability attribute and the protection attribute is designed, so that the vulnerability risk score of the system which is low in service value and already executes the security protection strategy is reduced, and the vulnerability repair priority of the system is later; according to the method, enterprises can focus on high-service-value and high-availability vulnerability repair for protecting missing assets, the accuracy of vulnerability risk assessment is improved, and the protection efficiency is improved. Furthermore, for the score of each vulnerability risk assessment index under the protection attribute, the security protection coverage condition is considered, whether a security protection failure point (such as strategy configuration failure) exists or not, namely whether security protection can take effect truly or not, is considered in a more refined manner, the accuracy and reliability of security protection are improved, and the security protection efficiency is improved. And vulnerability protection of the system is more accurate and effective.

Description

Technical Field

[0001] The present invention relates to the technical field of vulnerability processing, and in particular to a vulnerability priority determination method, device and attack surface management system. Background Art

[0002] In the existing technology, the priority of vulnerabilities is generally determined based on the CVSS (Common Vulnerability Scoring System) score, which belongs to the Common Vulnerability Scoring System. CVSS is a set of vulnerability evaluation standard systems created by the Incident Response and Security Team Forum and maintained and updated by the US National Vulnerability Database on a daily basis. Its main purpose is to help the industry measure the severity of vulnerability damage and guide the industry to repair vulnerabilities.

[0003] However, the traditional method of determining the order of vulnerability repairs through CVSS does not take into account the actual business situation and real risks. For example, for the same vulnerability, the repair priorities of test servers and important business servers are completely different, and the repair priorities of systems with RASP protection (Runtime Application Self-Protection) installed and systems without RASP protection installed will also be different. Among them, RASP is a security product that uses plug-in technology during the operation of the application to achieve high-precision detection and defense against external attacks without human intervention and perception. RASP can quickly integrate security defense functions into running applications, and enable applications to have self-protection capabilities like "antibodies", thereby achieving automatic immunity to threats from outside the application.

[0004] Therefore, vulnerability prioritization technology (VPT) came into being to provide security managers with vulnerability repair priority guidance.

[0005] Vulnerability VPT technology is a micro-innovation technology in the field of vulnerability management and is widely used in the field of vulnerability assessment. This is because it is almost impossible to fix all vulnerabilities in security operations. VPT uses certain methods and processes to dynamically prioritize the vulnerabilities that need to be fixed and optimize the process to improve the repair efficiency, so as to achieve the best results in the shortest time.

[0006] The prior art discloses a vulnerability priority determination method and device, which scans a target asset to obtain vulnerability information corresponding to the vulnerability on the target asset; determines a vulnerability score corresponding to the vulnerability based on the vulnerability information; wherein the vulnerability score includes a threat capability factor, an exploitability factor, a frequency factor, and a time factor; and determines the priority of the vulnerability based on the vulnerability score, so that the user can handle the vulnerability with a high priority.

[0007] The defect of this method is that it is based on CVSS technology, and the vulnerability threat capability factor, exploitability factor, frequency factor and time factor it defines are still based on the attributes of the vulnerability itself, without considering the actual situation of asset importance and security operations.

[0008] The prior art also discloses a vulnerability prioritization system and method, the architecture design of which includes an asset collection engine, an asset relationship mapping engine, a threat intelligence aggregation engine, a vulnerability reachability analysis engine, a code relationship mapping engine, a multi-platform vulnerability aggregation engine, and a vulnerability prioritization engine. The system prioritizes product security vulnerabilities through multi-dimensional data analysis, enabling the business team to solve the most critical security issues in the face of tight development tasks and limited security resources. The method achieves a multi-dimensional assessment of vulnerabilities through the collaboration of multiple engines, integrating vulnerabilities, assets, intelligence, reachability, and combining the code to give suggestions on the responsible person for repair.

[0009] The existing technology also provides a computational model for vulnerability priority ranking, which fully identifies, extracts and weights the key information in the vulnerability intelligence to prioritize the vulnerabilities. It mentions the first-level evaluation indicators and second-level evaluation indicators, including the vulnerability hazard level (first-level evaluation indicators), hot vulnerability indicators, security tool detection indicators, and attack method indicators (second-level evaluation indicators).

[0010] The prior art also provides a vulnerability assessment method and device, which adds the asset risk level and port availability as two types of evaluation factors into the VPT calculation model to recalculate the vulnerability risk.

[0011] Although the existing technology can solve the problem of vulnerability repair priority well, it does not take the attributes of security protection into consideration. Security protection capability is an important achievement of enterprise security construction. Security protection systems (such as WAF, RASP, IPS, etc.) can effectively block some vulnerability exploitation attacks. For these vulnerabilities, the repair priority can be lowered as appropriate. At the same time, the existing technology adopts a one-by-one verification method when evaluating attack accessibility (although the vulnerability may exist in a system, it may not be successfully exploited due to the limitations of exploitation conditions. For example, the Spring4shell vulnerability can only be successfully exploited in an environment above JDK 9, which is the vulnerability accessibility.), which increases the time cost to a certain extent. Some asset vulnerabilities may also be unable to be verified, resulting in inaccurate evaluation. Summary of the invention

[0012] The purpose of the present invention is to overcome the above-mentioned technical deficiencies and provide a vulnerability priority determination method, device and attack surface management system to solve the problem that vulnerability risk assessment in related technologies does not take into account the security protection attributes of the system, resulting in inaccurate assessment.

[0013] In order to achieve the above technical objectives, the present invention adopts the following technical solutions: According to a first aspect of the present invention, a vulnerability priority determination method is provided, comprising: Determine a vulnerability risk analysis model, wherein the vulnerability risk analysis model includes at least vulnerability risk assessment indicators in three dimensions: business attributes, vulnerability attributes, and protection attributes, and corresponding weight values; When the vulnerability risk analysis trigger condition is met, the vulnerability risk score of each system is calculated according to the vulnerability risk analysis model; Determine the vulnerability repair priority for each system based on the vulnerability risk score.

[0014] Preferably, the vulnerability risk analysis triggering condition is specifically: Each time the vulnerability data source is updated, if new vulnerabilities are found, a vulnerability risk analysis is performed.

[0015] Preferably, the vulnerability risk score of each system is calculated according to the vulnerability risk analysis model, specifically: Determine the scores of each vulnerability risk assessment indicator under different dimensions; Obtain vulnerability risk assessment scores under different dimensions according to the scores of each vulnerability risk assessment indicator and the first-level weight values ​​preset in the vulnerability risk analysis model; The vulnerability risk score of the current system is obtained according to the vulnerability risk assessment scores under different dimensions and the secondary weight values ​​preset in the vulnerability risk analysis model.

[0016] Preferably, determining the scores of vulnerability risk assessment indicators under different dimensions includes: The score of each vulnerability risk assessment indicator under business attributes is determined according to asset attributes and scoring rules; The score of each vulnerability risk assessment indicator under the vulnerability attribute is determined by directly calling the CVSS score of the vulnerability or by configuring the attribute value; The score of each vulnerability risk assessment indicator under the protection attribute is determined by calling the security effectiveness verification system to verify whether the necessary security protection equipment is deployed on the relevant assets and whether the security protection equipment can currently effectively protect against vulnerabilities.

[0017] Preferably, the method further comprises: When an attribute value is missing or the security effectiveness verification system cannot return results normally, the default score configured in the vulnerability risk analysis model is used for calculation to obtain the vulnerability risk score.

[0018] According to a second aspect of the present invention, there is provided a vulnerability priority determination device, comprising: A determination module is used to determine a vulnerability risk analysis model, wherein the vulnerability risk analysis model includes at least vulnerability risk assessment indicators in three dimensions: business attributes, vulnerability attributes, and protection attributes, and corresponding weight values; A calculation module, used to calculate the vulnerability risk score of each system according to the vulnerability risk analysis model when the vulnerability risk analysis trigger condition is met; The sorting module is used to determine the vulnerability repair priority of each system according to the vulnerability risk score.

[0019] According to a third aspect of the present invention, there is provided a vulnerability VPT engine, comprising: A processor, and a memory connected to the processor; The memory is used to store computer programs; The processor is used to call and execute the computer program in the memory to perform the above method.

[0020] According to a fourth aspect of the present invention, there is provided an attack surface management system, comprising: The aforementioned vulnerable VPT engine.

[0021] Preferably, the attack surface management system further includes: An asset information library, which is in communication with the vulnerability VPT engine and is used to maintain normalized asset information, and changes dynamically as external asset data sources are updated; A vulnerability information library, which is in communication with the vulnerability VPT engine and is used to record processed and integrated multi-source vulnerability data and intelligence, and changes dynamically as external vulnerability data sources are updated; The protection effectiveness verification module is connected to the vulnerability VPT engine for linking with the external intrusion and attack simulation system to initiate effectiveness verification tasks and process verification results.

[0022] According to a fifth aspect of the present invention, there is provided a computer program product, comprising computer program instructions, wherein when the computer program instructions are read and executed by a processor, the above method is executed.

[0023] The technical solution provided by the embodiments of the present invention may have the following beneficial effects: By designing a vulnerability risk analysis model that is compatible with business attributes, vulnerability attributes, and protection attributes, the vulnerability risk scores of systems with low business value and that have implemented security protection strategies are reduced, making vulnerability repairs for these systems a lower priority. Enterprises can focus more on high-availability vulnerability repairs for high-business value and missing protection assets, thereby improving the accuracy of vulnerability risk assessments and enhancing protection efficiency.

[0024] Furthermore, the score of each vulnerability risk assessment indicator under the protection attribute not only takes into account the security protection coverage, but also considers in more detail whether there are security protection failure points (such as policy configuration failure), that is, whether the security protection can really take effect, thereby improving the accuracy and reliability of security protection and making the system's vulnerability protection more accurate and effective.

[0025] Furthermore, in terms of system design, the present invention utilizes attack surface management technology, adds a protection effectiveness verification module to the vulnerability VPT engine, and uses the intrusion and attack simulation system to obtain the current security protection attributes for evaluation. It can fully utilize the value of security protection equipment, thereby reducing a large number of vulnerability repair work that cannot be truly exploited, and helping vulnerability repair personnel focus on vulnerability repair work that can truly be effectively exploited. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 is a flow chart of a vulnerability priority determination method according to an exemplary embodiment; Figure 2 is a schematic diagram of an algorithm framework for calculating the vulnerability risk score of each system according to a vulnerability risk analysis model shown in an exemplary embodiment; Figure 3 is a flow chart of a vulnerability priority determination method according to another exemplary embodiment; Figure 4 is a schematic block diagram of a device for determining vulnerability priority according to an exemplary embodiment; Figure 5 The invention is a schematic block diagram of an attack surface management system according to an exemplary embodiment. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0028] Embodiment 1 Figure 1 is a flowchart of a vulnerability priority determination method according to an exemplary embodiment. Figure 1 , the method comprising: Step S11, determining a vulnerability risk analysis model, wherein the vulnerability risk analysis model includes at least vulnerability risk assessment indicators in three dimensions: business attributes, vulnerability attributes, and protection attributes, and corresponding weight values; Step S12: when the vulnerability risk analysis triggering condition is met, the vulnerability risk score of each system is calculated according to the vulnerability risk analysis model; Step S13: Determine the vulnerability repair priority of each system according to the vulnerability risk score.

[0029] It can be understood that the technical solution provided in this embodiment reduces the vulnerability risk scores of systems with low business value and implemented security protection strategies by designing a vulnerability risk analysis model that is compatible with business attributes, vulnerability attributes, and protection attributes, so that vulnerability repair priorities for these systems are lowered, allowing enterprises to focus more on high-availability vulnerability repair for high business value and missing protection assets, thereby improving the accuracy of vulnerability risk assessment and enhancing protection efficiency.

[0030] In specific practice, the vulnerability risk analysis triggering condition in step S12 may be: When the preset time point is reached, vulnerability risk analysis is performed; or, Perform vulnerability risk analysis at preset intervals; or Each time the vulnerability data source is updated, if new vulnerabilities are found, a vulnerability risk analysis is performed.

[0031] Under the first two vulnerability risk analysis triggering conditions, the vulnerability risk analysis calculation is large and the timeliness is not strong. Therefore, the technical solution provided in this embodiment is preferably: Each time the vulnerability data source is updated, if new vulnerabilities are found, a vulnerability risk analysis is performed.

[0032] See also Figure 2In specific practice, in step S12, the vulnerability risk score of each system is calculated according to the vulnerability risk analysis model, specifically: Determine the scores of each vulnerability risk assessment indicator under different dimensions; Obtain vulnerability risk assessment scores under different dimensions according to the scores of the vulnerability risk assessment indicators and the first-level weight values ​​preset in the vulnerability risk analysis model; The vulnerability risk score of the current system is obtained according to the vulnerability risk assessment scores under different dimensions and the secondary weight values ​​preset in the vulnerability risk analysis model.

[0033] See also Figure 2 , Taking business attributes as an example, the following are the indicator scores corresponding to business attribute A, the indicator scores corresponding to business attribute B, the indicator scores corresponding to business attribute N, .... The first-level weight values ​​corresponding to the indicators of each business attribute are a1, a2, an.... (the values ​​of a1, a2, an.... are preset in the vulnerability risk analysis model); under this business attribute, the weighted sum of each indicator score and each first-level weight value is obtained to obtain the vulnerability risk assessment score under the business attribute.

[0034] Taking the protection attribute as an example, there are corresponding protection coverage scores and protection effectiveness scores. The first-level weight values ​​corresponding to these two indicators are c1 and c2 respectively (the values ​​of c1 and c2 are preset in the vulnerability risk analysis model); under this protection attribute, the scores of each indicator and each first-level weight value are weighted and summed to obtain the vulnerability risk assessment score under the protection attribute.

[0035] Under vulnerability attributes, you can directly take the CVSS score as the vulnerability risk assessment score under vulnerability attributes.

[0036] CVSS is a set of vulnerability assessment standards created by the Incident Response and Security Team Forum and maintained and updated by the U.S. National Vulnerability Database. Its main purpose is to help the industry measure the severity of vulnerability damage and guide the industry to fix vulnerabilities. When using the CVSS scoring mechanism to evaluate the severity of new security vulnerabilities, it is usually evaluated from the basic dimension (Base Metric Group), life cycle dimension (Temporal Metric Group) and environmental dimension (Environmental Metric Group), and a score between 0 and 10 is generated to evaluate the severity of the vulnerability.

[0037] Finally, the vulnerability risk assessment score under the business attribute * the secondary weight value a + the vulnerability risk assessment score under the protection attribute * the secondary weight value c + the vulnerability risk assessment score under the vulnerability attribute * the secondary weight value b = the vulnerability risk score of the current system. a, b, c>0.

[0038] In specific practice, the scores of vulnerability risk assessment indicators under different dimensions are determined, including: The score of each vulnerability risk assessment indicator under business attributes is determined according to asset attributes and scoring rules (for example, refer to asset attributes such as "security level", "important system", "external network exposure", "network area", "component version" and corresponding scoring rules to determine the business attribute score); The score of each vulnerability risk assessment indicator under the vulnerability attribute is determined by directly calling the CVSS score of the vulnerability, or by configuring the attribute value (for example, by calculating the attribute values ​​such as severity, impact range, exploitability, EXP / POC, etc.); The score of each vulnerability risk assessment indicator under the protection attribute is determined by calling the security effectiveness verification system to verify whether the necessary security protection equipment is deployed on the relevant assets, and whether the security protection equipment can currently effectively protect against vulnerabilities (the protection effectiveness verification module in the security effectiveness verification system simulates intrusion and attack on the current system by calling the intrusion and attack simulation system. If the current system has not been successfully invaded or attacked, it proves that the security protection equipment deployed on the current system is effective and can effectively protect against vulnerabilities).

[0039] It should be noted that the above technical terms EXP / POC are explained as follows: 1. POC, Proof of Concept, means "proof of concept" in Chinese. This phrase is used in vulnerability reports. The POC in the vulnerability report is a description or an attack example that allows readers to confirm that the vulnerability is real.

[0040] 2. EXP, Exploit, means "vulnerability exploitation" in Chinese. It means a detailed description of how to exploit a vulnerability or a demonstrated vulnerability attack code, which can enable readers to fully understand the mechanism of the vulnerability and how to exploit it.

[0041] It should be noted that the specific number of vulnerability risk assessment indicators under business attributes and their respective meanings can be configured according to asset attributes, and the specific content and number of indicators are not limited here. However, for ease of understanding, it is assumed that the vulnerability risk assessment indicators under business attributes include: "Security Protection Level", "Is it an Important System", "External Network Exposure", and "Network Area".

[0042] Then the corresponding scoring rules can be as follows: Among them, the scoring rules for "Security Protection Level" are: 20, 25, 30, 35, and 40 points for levels one to five respectively. If there is no classification, the score is 0; the scoring rules for "Is it an important system" are: (Yes: 20 points, No 0 point); the scoring rules for "External network exposure" are: (Yes 20 points; No 0 point); the scoring rules for "Network area" are (Internet area 20 points, DMZ area 15 points; Intranet area 10 points).

[0043] It should be noted that the above examples are not intended to limit the specific number, content, and scoring rules of each vulnerability risk assessment indicator under business attributes, but are only examples for ease of understanding. As long as the scores of each vulnerability risk assessment indicator under business attributes adopt the software concept of this application, they are all within the protection scope of this embodiment.

[0044] It should be noted that there are several specific vulnerability risk assessment indicators under vulnerability attributes, and their respective contents can be configured according to the vulnerability attributes. The specific content and quantity of the indicators are not limited here. However, for the sake of ease of understanding, it is assumed that the vulnerability risk assessment indicators under vulnerability attributes include: "Security Protection Level", "Is it an Important System", "External Network Exposure", and "Network Area".

[0045] In practice, the scoring rules for vulnerability attribute values ​​such as "severity", "scope of impact", "exploitability", and "EXP / POC" can be configured as follows: The scoring rules for "severity" are: (extremely dangerous: 50 points; high risk: 40 points; medium risk: 30 points; low risk: 20 points); the scoring rules for "exploitability" are: (high: 20 points; medium: 15 points; low: 10 points); the scoring rules for "whether there is a POC" are: (presence 20 points; non-presence 10 points); the scoring rules for "scope of impact" are: (within the scope: 10 points; not within the scope: 0 points).

[0046] It should be noted that the above examples are not intended to limit the specific number, specific content, and specific scoring rules of each vulnerability risk assessment indicator under the vulnerability attribute, but are only examples for ease of understanding. As long as the scores of each vulnerability risk assessment indicator under the vulnerability attribute adopt the software concept of this application, they are all within the protection scope of this embodiment.

[0047] Assuming that the scores of each vulnerability risk assessment indicator under business attributes are: A1, A2, ....An, and the corresponding first-level weights are a1, a2, ....an, then the vulnerability risk assessment score under business attributes is A=a1*A1+a2*A2+, ....+an*An; Assuming that the scores of each vulnerability risk assessment indicator under the protection attribute are: B1, B2, .... Bn, and the corresponding first-level weights are b1, b2, .... bn, then the vulnerability risk assessment score under the protection attribute is B = b1*B1+b2*B2+, .... + bn*Bn; Assuming that the scores of each vulnerability risk assessment indicator under vulnerability attributes are: C1, C2, .... Cn, and the corresponding first-level weights are c1, c2, .... cn; then the score of each vulnerability risk assessment indicator under vulnerability attributes is C = c1*C1+c2*C2+, .... + cn*Cn; Assume that the vulnerability risk assessment score under the business attribute is A, and the corresponding weight is a; the score of each vulnerability risk assessment indicator under the protection attribute is B, and the corresponding weight is b; the score of each vulnerability risk assessment indicator under the vulnerability attribute is C, and the corresponding weight is c; then, the vulnerability risk score of the current system is W=a*A+b*B+c*C.

[0048] It can be understood that the technical solution provided in this embodiment not only considers the security protection coverage for the scores of each vulnerability risk assessment indicator under the protection attributes, but also considers in a more refined way whether there are security protection failure points (such as policy configuration failure), that is, whether the security protection can really take effect, thereby improving the accuracy and reliability of security protection and making the system's vulnerability protection more accurate and effective.

[0049] In specific practice, the method further includes: When an attribute value is missing or the security effectiveness verification system cannot return results normally, the default score configured in the vulnerability risk analysis model is used for calculation to obtain the vulnerability risk score.

[0050] For example, the score of a vulnerability risk assessment indicator under the vulnerability attribute does not have a corresponding CVSS score, nor does it have a user-configured attribute value. At this time, the default score configured according to the vulnerability risk analysis model is calculated to finally obtain the vulnerability risk score. This ensures the reliability of the vulnerability priority determination method provided in this embodiment and guarantees user experience.

[0051] For another example, the security effectiveness verification system is called under the protection attribute to verify that the necessary security protection equipment has been deployed on the relevant assets. However, when verifying whether the security protection equipment can currently effectively protect against vulnerabilities, no normal results are returned. In this case, the default score configured according to the vulnerability risk analysis model is used for calculation to finally obtain the vulnerability risk score.

[0052] It can be understood that the technical solution provided in this embodiment provides an alternative solution when the scores of each vulnerability risk assessment indicator cannot be obtained normally under business attributes, vulnerability attributes, and protection attributes, which can ensure the reliability of the vulnerability priority determination method provided in this embodiment and ensure user experience.

[0053] Embodiment 2 Figure 3 is a flowchart of a vulnerability priority determination method according to another exemplary embodiment. Figure 3 , the method comprising: Step S21: Each time the vulnerability data source is updated, if a new vulnerability is found, a vulnerability risk analysis is performed; Step S22: calling a vulnerability risk analysis model, wherein the vulnerability risk analysis model includes at least vulnerability risk assessment indicators in three dimensions: business attributes, vulnerability attributes, and protection attributes, and corresponding weight values; Step S23: Obtain asset attributes and vulnerability attributes of each business system; Step S24: determine whether there are corresponding attribute values ​​for each vulnerability risk assessment indicator under the asset attribute and vulnerability attribute. If so, call the intrusion and attack simulation system to verify the effectiveness of protection and jump to step S25; otherwise, assign a default score to the corresponding vulnerability risk assessment indicator to calculate the vulnerability risk score, then call the intrusion and attack simulation system to verify the effectiveness of protection and jump to step S25; Step S25, determine whether the protection effectiveness is successfully verified. If so, obtain the vulnerability risk assessment score under the protection attribute, and then perform weighted summation on the vulnerability risk assessment scores under the business attribute, vulnerability attribute, and protection attribute to finally obtain the vulnerability risk score; otherwise, assign a default score to the vulnerability risk assessment score under the protection attribute, and then perform weighted summation on the vulnerability risk assessment scores under the business attribute, vulnerability attribute, and protection attribute to finally obtain the vulnerability risk score.

[0054] It is understandable that in real enterprise security construction, security equipment such as WAF and RASP are purchased to effectively prevent many high-risk vulnerabilities from being exploited. These vulnerabilities can be temporarily repaired. Therefore, in the process of vulnerability VPT evaluation, the attributes of security protection need to be considered. At the same time, it cannot be assumed that protection can be achieved as long as it is deployed. Therefore, it is necessary to verify whether the current protection capabilities are truly effective through intrusion and attack simulation systems.

[0055] It can be understood that the technical solution provided in this embodiment reduces the vulnerability risk scores of systems with low business value and implemented security protection strategies by designing a vulnerability risk analysis model that is compatible with business attributes, vulnerability attributes, and protection attributes, so that vulnerability repair priorities for these systems are lowered, allowing enterprises to focus more on high-availability vulnerability repair for high business value and missing protection assets, thereby improving the accuracy of vulnerability risk assessment and enhancing protection efficiency.

[0056] Furthermore, the score of each vulnerability risk assessment indicator under the protection attribute not only takes into account the security protection coverage, but also considers in more detail whether there are security protection failure points (such as policy configuration failure), that is, whether the security protection can really take effect, thereby improving the accuracy and reliability of security protection and making the system's vulnerability protection more accurate and effective.

[0057] Embodiment 3 Figure 4 is a schematic block diagram of a vulnerability priority determination device 100 according to an exemplary embodiment. Figure 4 , the device 100 comprises: Determination module 101, used to determine a vulnerability risk analysis model, wherein the vulnerability risk analysis model includes at least vulnerability risk assessment indicators in three dimensions: business attributes, vulnerability attributes, and protection attributes, and corresponding weight values; A calculation module 102, configured to calculate a vulnerability risk score of each system according to the vulnerability risk analysis model when a vulnerability risk analysis trigger condition is met; The sorting module 103 is used to determine the vulnerability repair priority of each system according to the vulnerability risk score.

[0058] It can be understood that the technical solution provided in this embodiment reduces the vulnerability risk scores of systems with low business value and implemented security protection strategies by designing a vulnerability risk analysis model that is compatible with business attributes, vulnerability attributes, and protection attributes, so that vulnerability repair priorities for these systems are lowered, allowing enterprises to focus more on high-availability vulnerability repair for high business value and missing protection assets, thereby improving the accuracy of vulnerability risk assessment and enhancing protection efficiency.

[0059] Embodiment 4 A vulnerability VPT engine according to an exemplary embodiment includes: A processor, and a memory connected to the processor; The memory is used to store computer programs; The processor is used to call and execute the computer program in the memory to perform the above method.

[0060] It can be understood that the technical solution provided in this embodiment reduces the vulnerability risk scores of systems with low business value and implemented security protection strategies by designing a vulnerability risk analysis model that is compatible with business attributes, vulnerability attributes, and protection attributes, so that vulnerability repair priorities for these systems are lowered, allowing enterprises to focus more on high-availability vulnerability repair for high business value and missing protection assets, thereby improving the accuracy of vulnerability risk assessment and enhancing protection efficiency.

[0061] Furthermore, the score of each vulnerability risk assessment indicator under the protection attribute not only takes into account the security protection coverage, but also considers in more detail whether there are security protection failure points (such as policy configuration failure), that is, whether the security protection can really take effect, thereby improving the accuracy and reliability of security protection and making the system's vulnerability protection more accurate and effective.

[0062] Embodiment 5 Figure 5 is a schematic block diagram of an attack surface management system 200 according to an exemplary embodiment. Figure 5 , the system 200 comprises: The above-mentioned vulnerability VPT engine 201.

[0063] Preferably, the attack surface management system further includes: The asset information library 202 is in communication with the vulnerability VPT engine 201 and is used to maintain normalized asset information, which changes dynamically as the external asset data source is updated; A vulnerability information library 203 is in communication with the vulnerability VPT engine 201 and is used to record processed and integrated multi-source vulnerability data and intelligence, and changes dynamically as external vulnerability data sources are updated; The protection effectiveness verification module 204 is connected to the vulnerability VPT engine 201 for linking with an external intrusion and attack simulation system to initiate effectiveness verification tasks and process verification results.

[0064] It is understandable that in real enterprise security construction, security equipment such as WAF and RASP are purchased to effectively prevent many high-risk vulnerabilities from being exploited. These vulnerabilities can be temporarily repaired. Therefore, in the process of vulnerability VPT evaluation, the attributes of security protection need to be considered. At the same time, it cannot be assumed that protection can be achieved as long as it is deployed. Therefore, it is necessary to verify whether the current protection capabilities are truly effective through intrusion and attack simulation systems.

[0065] The technical solution provided in this embodiment utilizes the attack surface management technology to integrate multi-source asset data and vulnerability data scattered in host security, terminal security, IT asset management system, runtime security protection (RASP), WAF equipment, threat intelligence, vulnerability scanning system, vulnerability management system, etc., to fully obtain asset attributes, vulnerability attributes, and protection attributes, and provide protection effectiveness attributes through the BAS (intrusion and attack simulation) system to calculate the vulnerability repair priority.

[0066] The score of each vulnerability risk assessment indicator under the protection attribute not only takes into account the security protection coverage, but also considers in more detail whether there are security protection failure points (such as policy configuration failure), that is, whether the security protection can really take effect, thereby improving the accuracy and reliability of security protection and making the system's vulnerability protection more accurate and effective.

[0067] Furthermore, in terms of system design, this embodiment utilizes attack surface management technology, adds a protection effectiveness verification module to the vulnerability VPT engine, and uses the intrusion and attack simulation system to obtain the current security protection attributes for evaluation. It can fully utilize the value of security protection equipment, thereby reducing a large number of vulnerability repair work that cannot be truly exploited, and helping vulnerability repair personnel focus on vulnerability repair work that can truly be effectively exploited.

[0068] In addition, the technical solution provided in this embodiment also effectively utilizes the multi-source assets and vulnerability fusion capabilities of the attack surface management system, solving the problem of incomplete VPT business attributes and vulnerability attributes.

[0069] Embodiment 6 A computer program product according to an exemplary embodiment includes computer program instructions, and when the computer program instructions are read and executed by a processor, the above method is executed.

[0070] It can be understood that the technical solution provided in this embodiment reduces the vulnerability risk scores of systems with low business value and implemented security protection strategies by designing a vulnerability risk analysis model that is compatible with business attributes, vulnerability attributes, and protection attributes, so that vulnerability repair priorities for these systems are lowered, allowing enterprises to focus more on high-availability vulnerability repair for high business value and missing protection assets, thereby improving the accuracy of vulnerability risk assessment and enhancing protection efficiency.

[0071] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0072] If the integrated units in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling one or more computer devices (which may be personal computers, servers or network devices, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application.

[0073] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0074] In the several embodiments provided in the present application, it should be understood that the disclosed client can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0075] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0076] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0077] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A vulnerability priority determination method, characterized in that: include: Determine a vulnerability risk analysis model, wherein the vulnerability risk analysis model includes at least vulnerability risk assessment indicators in three dimensions: business attributes, vulnerability attributes, and protection attributes, and corresponding weight values; When the vulnerability risk analysis trigger condition is met, the vulnerability risk score of each system is calculated according to the vulnerability risk analysis model; Determine the vulnerability repair priority for each system based on the vulnerability risk score.

2. The method according to claim 1, characterized in that: The vulnerability risk analysis triggering conditions are specifically: Each time the vulnerability data source is updated, if new vulnerabilities are found, a vulnerability risk analysis is performed.

3. The method according to claim 1, characterized in that The vulnerability risk score of each system is calculated according to the vulnerability risk analysis model, specifically: Determine the scores of each vulnerability risk assessment indicator under different dimensions; Obtain vulnerability risk assessment scores under different dimensions according to the scores of the vulnerability risk assessment indicators and the first-level weight values ​​preset in the vulnerability risk analysis model; The vulnerability risk score of the current system is obtained according to the vulnerability risk assessment scores under different dimensions and the secondary weight values ​​preset in the vulnerability risk analysis model.

4. The method according to claim 3, characterized in that Determining the scores of each vulnerability risk assessment indicator under different dimensions includes: The score of each vulnerability risk assessment indicator under business attributes is determined according to asset attributes and scoring rules; The score of each vulnerability risk assessment indicator under the vulnerability attribute is determined by directly calling the CVSS score of the vulnerability or by configuring the attribute value; The score of each vulnerability risk assessment indicator under the protection attribute is determined by calling the security effectiveness verification system to verify whether the necessary security protection equipment is deployed on the relevant assets and whether the security protection equipment can currently effectively protect against vulnerabilities.

5. The method according to claim 4, characterized in that Also includes: When an attribute value is missing or the security effectiveness verification system cannot return results normally, the default score configured in the vulnerability risk analysis model is used for calculation to obtain the vulnerability risk score.

6. A vulnerability priority determination device, characterized in that: include: A determination module is used to determine a vulnerability risk analysis model, wherein the vulnerability risk analysis model includes at least vulnerability risk assessment indicators in three dimensions: business attributes, vulnerability attributes, and protection attributes, and corresponding weight values; A calculation module, used to calculate the vulnerability risk score of each system according to the vulnerability risk analysis model when the vulnerability risk analysis trigger condition is met; The sorting module is used to determine the vulnerability repair priority of each system according to the vulnerability risk score.

7. A vulnerability VPT engine, characterized in that: include: A processor, and a memory connected to the processor; The memory is used to store computer programs; The processor is used to call and execute the computer program in the memory to perform the method according to any one of claims 1 to 5.

8. An attack surface management system, characterized in that: include: The vulnerability VPT engine described in claim 7.

9. The attack surface management system according to claim 8, characterized in that: Also includes: An asset information library, which is in communication with the vulnerability VPT engine and is used to maintain normalized asset information, and changes dynamically as external asset data sources are updated; A vulnerability information library, which is in communication with the vulnerability VPT engine and is used to record processed and integrated multi-source vulnerability data and intelligence, and changes dynamically as external vulnerability data sources are updated; The protection effectiveness verification module is connected to the vulnerability VPT engine for linking with the external intrusion and attack simulation system to initiate effectiveness verification tasks and process verification results.

10. A computer program product, characterized in that The method comprises computer program instructions, and when the computer program instructions are read and executed by a processor, the method according to any one of claims 1 to 5 is executed.

Images