Risk management method and device, electronic equipment and storage medium

Abstract

The invention provides a risk management method and device, electronic equipment and a storage medium, and relates to the technical field of security. According to the method, the first risk stage to which the risk event belongs is determined, and then the risk influence object of the risk event in the second risk stage is obtained according to the risk association relationship, so that the risk influence object of the risk event in each risk stage can be positioned, and bidirectional risk feedback in an application development stage and an application operation stage can be realized; therefore, the risk of the application development stage and the risk of the application operation stage can be subjected to correlation analysis to accurately position the risk influence object of each risk stage, manual troubleshooting is not needed, and then the risk disposal efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of security technology, and in particular to a risk management method, device, electronic device and storage medium. Background Art

[0002] At present, the risk management for the application development stage and the application operation stage is separate. The risk management in the development stage only needs to ensure safety after going online, while the risk management in the operation stage only fixes the risks found during operation. For example, if a problem occurs in the application during the operation stage, it cannot be traced back to the development stage, and the risks that occur in the development stage cannot be located in the application during the operation stage. Manual investigation is still required, resulting in low efficiency in risk management. Summary of the invention

[0003] The purpose of the embodiments of the present application is to provide a risk management method, device, electronic device and storage medium to improve the problem of low risk management efficiency in the prior art.

[0004] In a first aspect, an embodiment of the present application provides a risk management method, the method comprising:

[0005] Acquire a risk event, wherein the risk event includes risk information;

[0006] Determine the first risk stage to which the risk event belongs;

[0007] Obtaining risk impact objects of the risk event in the second risk stage according to the pre-established risk association relationship;

[0008] Among them, the risk stage includes the application development stage and the application operation stage, the first risk stage and the second risk stage refer to one of the risk stages, and the first risk stage and the second risk stage are different, the risk association relationship includes the association relationship between the risk information in the application development stage and the relevant information of the application, and the association relationship between the risk information in the application operation stage and the relevant information of the application, and the relevant information includes the risk impact object.

[0009] In the above implementation process, by determining the first risk stage to which the risk event belongs, and then obtaining the risk impact objects of the risk event in the second risk stage based on the risk association relationship, the risk impact objects of the risk event in each risk stage can be located, and two-way feedback of risks in the application development stage and the application operation stage can be achieved. Therefore, the risks in the application development stage and the application operation stage can be correlated and analyzed to accurately locate the risk impact objects in each risk stage without manual investigation, thereby improving the efficiency of risk disposal.

[0010] Optionally, the association relationship between the risk information in the application development stage and the relevant information of the application in the risk association relationship refers to the association relationship between the risk characteristics of the risk information in the application development stage and the relevant information of the application, and the association relationship between the risk information in the application operation stage and the relevant information of the application in the risk association relationship refers to the association relationship between the risk characteristics of the risk information in the application operation stage and the relevant information of the application.

[0011] In the above implementation process, since the risk association relationship is the association relationship between the risk characteristics of the risk information and the relevant information of the application, the relevant information can be quickly found according to the risk characteristics, thereby realizing the rapid positioning of the risk-affected objects, which is more efficient.

[0012] Optionally, obtaining the risk impact object of the risk event in the second risk stage according to the pre-established risk association relationship and the risk information includes:

[0013] If the risk stage to which the risk event belongs is the application development stage, then obtaining risk characteristics of the risk information in the risk event;

[0014] Searching for risk information of the application running stage with the same risk characteristics according to the risk association relationship;

[0015] Searching for relevant information of the application associated with the risk information in the application running phase according to the risk association relationship, and determining a risk impact object from the relevant information, wherein the risk impact object includes a running risk application;

[0016] or,

[0017] If the risk stage to which the risk event belongs is the application operation stage, then obtaining risk characteristics of the risk information in the risk event;

[0018] Searching for risk information of the application development stage with the same risk characteristics according to the risk association relationship;

[0019] According to the risk association relationship, relevant information of the application associated with the risk information in the application development stage is searched, and a risk impact object is determined from the relevant information, wherein the risk impact object includes development information corresponding to the application.

[0020] In the above implementation process, for risk events in the application development stage, the risk applications running in the application operation stage can be located according to the risk association relationship, so that the risk impact scope in the application operation stage can be quickly determined. For risk events in the application operation stage, the development information of the application in the application development stage can be repeated according to the risk association relationship, so that the risk can be quickly traced back, thereby improving the efficiency of risk handling.

[0021] Optionally, the development information corresponding to the application includes at least one of a code library, an image library, a component, and development project information corresponding to the application. In this way, relevant information of the application development stage can be located, thereby achieving accurate risk tracing.

[0022] Optionally, the risk association relationship is established in the following manner:

[0023] Acquire collected application risk information, wherein the application risk information includes risk information of each application in the application development phase and risk information of each application in the application operation phase;

[0024] The application risk information is associated with the relevant information of the corresponding application according to the established full life cycle asset ledger to establish a risk association relationship, wherein the full life cycle asset ledger includes relevant information of each application in the application development stage and the application operation stage.

[0025] In the above implementation process, the established full life cycle asset ledger can quickly link the risk information of the application development stage and the application operation stage with the relevant information of the application.

[0026] Optionally, the acquiring of collected application risk information includes:

[0027] Obtain different application risk information collected through various risk detection tools, wherein the risk detection tools include at least one of code risk tools, open source risk tools, container risk tools, and application interface risk tools. These risk detection tools can realize efficient collection of risk information in the application development stage and the application operation stage.

[0028] Optionally, the relevant information of each application in the application development stage and the application running stage also includes at least one of the source code, running components, image code, container assets, and interface assets of the application.

[0029] In a second aspect, an embodiment of the present application provides a risk management device, the device comprising:

[0030] An event acquisition module, used to acquire risk events, wherein the risk events include risk information;

[0031] A risk stage determination module, used to determine the first risk stage to which the risk event belongs;

[0032] A risk location module, used for obtaining the risk impact object of the risk event in the second risk stage according to the pre-established risk association relationship and the risk information;

[0033] Among them, the risk stage includes the application development stage and the application operation stage, the first risk stage and the second risk stage refer to one of the risk stages, and the first risk stage and the second risk stage are different, the risk association relationship includes the association relationship between the risk information in the application development stage and the relevant information of the application, and the association relationship between the risk information in the application operation stage and the relevant information of the application, and the relevant information includes the risk impact object.

[0034] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores computer-readable instructions, and when the computer-readable instructions are executed by the processor, the steps in the method provided in the first aspect are performed.

[0035] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps in the method provided in the first aspect are performed.

[0036] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or be understood by practicing the embodiments of the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0038] Figure 1 A flow chart of a risk management method provided in an embodiment of the present application;

[0039] Figure 2 A schematic diagram of a two-way risk feedback in the application development phase and the application operation phase provided in an embodiment of the present application;

[0040] Figure 3 A schematic block diagram of collecting risk information through various risk detection tools provided in an embodiment of the present application;

[0041] Figure 4 A structural block diagram of a risk management device provided in an embodiment of the present application;

[0042] Figure 5A schematic diagram of the structure of an electronic device for executing a risk management method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0043] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present application.

[0044] It should be noted that the terms "system" and "network" in the embodiments of the present invention can be used interchangeably. "Multiple" means two or more. In view of this, in the embodiments of the present invention, "multiple" can also be understood as "at least two". "And / or" describes the association relationship of associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / ", unless otherwise specified, generally indicates that the previously associated objects are in an "or" relationship.

[0045] An embodiment of the present application provides a risk management method, which determines the first risk stage to which the risk event belongs, and then obtains the risk impact objects of the risk event in the second risk stage based on the risk association relationship. In this way, the risk impact objects of the risk event in each risk stage can be located, and two-way feedback of risks in the application development stage and the application operation stage can be achieved, so that the risks in the application development stage and the application operation stage can be correlated and analyzed to accurately locate the risk impact objects in each risk stage without manual investigation, thereby improving the efficiency of risk handling.

[0046] Please refer to Figure 1 , Figure 1 A flow chart of a risk management method provided in an embodiment of the present application, the method comprising the following steps:

[0047] Step S110: Obtain risk events.

[0048] The risk events here can be newly generated risks. Risk events contain risk information, such as threat intelligence, alarm events, etc. The risk information contained in them includes component risks, vulnerability risks, etc. Risk events can be collected from risk detection tools. These risk detection tools can be used to collect various risk events of applications.

[0049] In order to collect risk events in the application development stage and the application operation stage, corresponding risk detection tools can be deployed for the application development stage and the application operation stage respectively. Risk detection tools may include at least one of code risk tools, open source risk tools, container risk tools, and application interface risk tools. For example, code risk tools and open source risk tools can be deployed in the application development stage to detect risk events in the application development stage. Code risk tools can be used to detect code defect information during application development. Open source risk tools can be used to detect SBOM (Software Bill of Materials) component risks, vulnerability risks, image risks, etc. during application development. Container risk detection tools and application interface risk tools can be deployed in the application operation stage to detect risk events in the application operation stage. Container risk detection tools can be used to detect intrusion risks, security vulnerability risks, etc. during application runtime. Application interface risk tools can be used to detect interface attack risks during application runtime, such as APT attacks, etc.

[0050] Step S120: Determine the first risk stage to which the risk event belongs.

[0051] Among them, the risk stage includes the application development stage and the application operation stage. Here, the first risk stage to which the risk event belongs can be determined based on the above-mentioned risk detection tool. The first risk stage refers to one of the application development stage and the application operation stage. For example, if the risk event is obtained from the risk detection tool corresponding to the application development stage, it is determined that the risk event belongs to the application development stage. If the risk event is obtained from the risk detection tool corresponding to the application operation stage, it is determined that the risk event belongs to the application operation stage.

[0052] In some implementations, it can also be judged by the identifier carried by the risk event. For example, after the risk detection tool corresponding to the application development stage detects a risk event, it can add a corresponding identifier to the risk event. The identifier can indicate that the risk event is a risk event belonging to the application development stage. In this way, the risk stage to which the risk event belongs can be directly judged by the identifier.

[0053] In other implementations, the risk event may also be judged based on relevant information of the risk event itself. For example, if the risk event is about code risk, it can be determined that the risk event belongs to the risk of the application development stage. If the risk event is about container risk, it can be determined that the risk event belongs to the risk of the application operation stage.

[0054] Step S130: According to the pre-established risk association relationship and risk information, the risk impact objects of the risk event in the second risk stage are obtained.

[0055] Among them, the second risk stage also refers to one of the application operation stage and the application development stage. The second risk stage and the first risk stage can be different stages. For example, if the first risk stage to which the risk event belongs is the application development stage, then the second risk stage is the application operation stage. If the first risk stage to which the risk event belongs is the application operation stage, then the second risk stage is the application development stage.

[0056] Therefore, the present application scheme can obtain risk events in the application development phase and then obtain the risk impact objects of the risk events in the application operation phase, or obtain risk events in the application operation phase and then trace the risk impact objects of the risk events in the application development phase.

[0057] The risk association relationship here includes the association relationship between the risk information in the application development stage and the relevant information of the application, and the association relationship between the risk information in the application operation stage and the relevant information of the application. The relevant information of the application includes the risk impact object. In this way, the relevant information of the application in the application development stage or the application operation stage can be found according to the risk association relationship, and then the risk impact object can be obtained from the relevant information of the application, so as to accurately locate the risk impact object.

[0058] The risk impact object can be understood as the scope of impact of this risk event. For example, if an application has code risk, the risk impact object may include the application of the code and the R&D personnel who wrote the code, so that the risk can be quickly located.

[0059] In some other implementations, the second risk stage and the first risk stage may also refer to the same stage, such as both are application operation stages, or both are application development stages, etc. Then, the risk events of the application development stage may be obtained, and then the risk impact objects of the risk events in the application development stage may be obtained, or if the risk event is in the application operation stage, the risk impact objects of the risk event in the application operation stage may be obtained. In this way, no matter which risk stage the risk events are in, the risk impact objects of the current risk stage or other risk stages may be quickly located according to the risk association relationship.

[0060] In addition, it should be noted that the present application method can be applied on a cloud-native platform, that is, the development, operation, risk management, etc. of the application can be achieved through the platform.

[0061] In the above implementation process, by determining the first risk stage to which the risk event belongs, and then obtaining the risk impact objects of the risk event in the second risk stage based on the risk association relationship, the risk impact objects of the risk event in each risk stage can be located, and two-way feedback of risks in the application development stage and the application operation stage can be achieved. Therefore, the risks in the application development stage and the application operation stage can be correlated and analyzed to accurately locate the risk impact objects in each risk stage without manual investigation, thereby improving the efficiency of risk disposal.

[0062] Based on the above embodiment, the association relationship between the risk information in the application development stage and the relevant information of the application in the risk association relationship refers to the association relationship between the risk characteristics of the risk information in the application development stage and the relevant information of the application, and the association relationship between the risk information in the application operation stage and the relevant information of the application in the risk association relationship refers to the association relationship between the risk characteristics of the risk information in the application operation stage and the relevant information of the application.

[0063] The risk feature may refer to a risk identifier or other feature information in the risk information. The feature information here may refer to features that characterize each type of risk information. Of course, in practical applications, the risk feature may be flexibly defined and is not specifically limited here. For ease of description, the risk identifier is used as an example in the following embodiments.

[0064] For example, during the application development phase, a vulnerability risk and component risk of application a are generated, and the risk identifier of the vulnerability risk is a1, and the risk identifier of the component risk is b1. Then, the risk identifier a1 of the vulnerability risk and the risk identifier b1 of the component risk are associated with the relevant information of application a. During the application running phase, a component risk and vulnerability risk of application b are generated, and the risk identifier of the vulnerability risk is a1, and the risk identifier of the component risk is b1. Then, the risk identifier a1 of the vulnerability risk and the risk identifier b1 of the component risk are associated with the relevant information of application b.

[0065] That is to say, the risk association relationship is associated with the relevant information of the application through the risk characteristics, so that the relevant information of the application can be directly found according to the risk characteristics, and the same risk information in the application development stage and the application operation stage can be found according to the risk characteristics. Therefore, the relevant information can be quickly found according to the risk characteristics, and the risk-affected objects can be quickly located, which is more efficient.

[0066] Based on the above embodiment, if the first risk stage is the application development stage and the second risk stage is the application operation stage, then the method for obtaining the risk impact object of the risk event in the second risk stage includes: if the first risk stage to which the risk event belongs is the application development stage, then obtaining the risk characteristics of the risk information in the risk event, and then searching for the risk information of the application operation stage with the same risk characteristics based on the risk association relationship, and then searching for relevant information of the application associated with the risk information of the application operation stage based on the risk association relationship, and determining the risk impact object from the relevant information, at this time, the risk impact object includes the running risk application.

[0067] For example, if a risk event is obtained during the application development phase, such as when a new version of an application is developed, and an SBOM component risk is generated during the development of the new version, then a reverse correlation query can be performed based on the pre-established risk association relationship to find applications that use the SBOM component during the application operation phase, and then determine whether these applications are running. The operation here can be understood as being online. For example, some applications are only developed but will not be put online for use. Then, these running applications can be found, and it can be considered that these running applications are risky, thereby achieving rapid determination of risk-affected objects. At this time, the operation and maintenance personnel can be prompted to conduct risk screening on these risky applications, thereby improving the efficiency of risk disposal.

[0068] For example, when searching based on risk identifiers, if the first risk stage to which the risk event belongs is the application development stage, the risk identifier of the corresponding risk information is a1, i.e., vulnerability risk. If the second risk stage is the application operation stage, the risk information with risk identifier a1 in the risk information of the application operation stage can be found based on risk identifier a1, and then the relevant information of the application associated with the risk identifier a1 of the application operation stage can be found. In this way, the risk impact objects in the application operation stage can be obtained from the relevant information.

[0069] In other embodiments, if the first risk stage is the application operation stage and the second risk stage is the application development stage, then the method for obtaining the risk impact object of the risk event in the second risk stage includes: if the risk stage to which the risk event belongs is the application operation stage, then obtaining the risk characteristics of the risk information in the risk event, and then searching for the risk information of the application development stage with the same risk characteristics based on the risk association relationship, and then searching for relevant information of the application associated with the risk information of the application development stage based on the risk association relationship, and determining the risk impact object from the relevant information, at this time the risk impact object may include the development information corresponding to the application.

[0070] If the risk event is obtained during the application operation phase, the development information corresponding to the application may include at least one of the code library, image library, component, and development project information corresponding to the application. If the risk event is a security vulnerability, it can be traced back to the code library, SBOM component, or image that caused the vulnerability during the application development phase based on the pre-established risk association relationship, and can also locate the specific development department, personnel, and time, thereby achieving rapid risk backtracking and improving risk handling efficiency.

[0071] For example, when searching based on the risk identifier, the first risk stage to which the risk event belongs is the application operation stage, and the risk identifier of the corresponding risk information is b1, that is, component risk. If the second risk stage is the application development stage, the risk information with the risk identifier b1 in the risk information of the application development stage can be found based on the risk identifier b1, and then the relevant information of the application associated with the risk identifier b1 of the application development stage can be found. In this way, the risk impact objects in the application development stage can be obtained from the relevant information.

[0072] In the above implementation process, for risk events in the application development stage, the risk applications running in the application operation stage can be located according to the risk association relationship, so that the risk impact scope in the application operation stage can be quickly determined. For risk events in the application operation stage, the development information of the application in the application development stage can be repeated according to the risk association relationship, so that the risk can be quickly traced back, thereby improving the efficiency of risk handling.

[0073] On the basis of the above-mentioned embodiments, when risks occur in the operation stage and the development stage of each application, a risk event (such as an alarm message, etc.) will be generated. At this time, the risk event contains risk features containing risk information. The system will obtain risk events collected by the risk detection tool in real time or regularly to collect risk information in the application development stage and the application operation stage, and then establish a risk association relationship between these risk information and the relevant information of the corresponding application. The risk association relationship will also be updated in real time or regularly later, such as adding new risk information to the risk association relationship, so that the corresponding risk impact object can be directly found based on the risk association relationship. When the risk association relationship is established, the risk association relationship includes risk information in the application development stage and the application operation stage, so that a risk association relationship for the entire life cycle of the application can be established.

[0074] In this way, when tracing risks, you can trace back based on the risk association relationship. For example, if a new SBOM component risk is discovered during the application development phase, since the corresponding relationship between the relevant information of the application and the SBOM component risk information (including the component risk information of the application operation phase and the component risk information of the application development phase) is pre-established in the risk association relationship, you can find out which applications have deployed SBOM components and these applications have been launched in the risk association relationship, and then you can determine whether these applications have risks during the operation phase. For example, a new vulnerability risk is discovered during the application operation phase. Since the corresponding relationship between the relevant information of the application and the vulnerability risk (including the vulnerability risk information of the application operation phase and the vulnerability risk information of the application development phase) is pre-established in the risk association relationship, and the relevant information of the application associated with the vulnerability risk in the application development phase, such as code library, image library, component and other information, you can reversely trace the relevant development information that caused the vulnerability in the application development phase, thereby achieving rapid risk backtracking. The risk feedback process between the application development phase and the application operation phase can be as follows: Figure 2 shown.

[0075] Based on the above embodiment, a risk association relationship can be established in the following manner: acquiring collected application risk information, the application risk information including risk information of each application in the application development phase and risk information of each application in the application operation phase, associating the application risk information with relevant information of the corresponding application according to an established full life cycle asset ledger to establish a risk association relationship, wherein the full life cycle asset ledger includes relevant information of each application in the application development phase and the application operation phase.

[0076] The full life cycle asset ledger here refers to an asset ledger centered on the application. For example, the full life cycle asset ledger can include relevant information of each application in the application development stage and the application operation stage, such as at least one of the application's source code, running components, image code, container assets, and interface assets. It can also include project information during application development, such as developer, time, department, and other information. These can all be used as the asset ledger of the application. Then, this information is associated with the application, including the asset ledgers of the application development stage and the application operation stage, thereby constituting the full life cycle asset ledger of the application.

[0077] Since the asset ledger for the entire life cycle of the application has been established, the risk information collected during the application development and operation phases can be associated with the relevant information of the corresponding application based on the asset ledger. For example, when associating, the corresponding application can be found from the asset ledger for the entire life cycle based on the application metadata in the risk information, and then associated with the relevant information of the application to establish a risk association relationship.

[0078] It is understandable that in the above process, different application risk information can be collected through risk detection tools, and risk detection tools can include at least one of code risk tools, open source risk tools, container risk tools, and application interface risk tools. Through these risk detection tools, efficient collection of risk information in the application development stage and the application operation stage can be achieved.

[0079] In this application implementation scheme, risk information is collected through various risk detection tools, and then a full life cycle asset ledger is established with the application as the center. Figure 3 As shown, Figure 3 The code guard in it is the code risk tool mentioned above, the open source guard is the open source risk tool mentioned above, the container security is the container risk tool mentioned above, and the API security is the application interface risk tool mentioned above.

[0080] In the above implementation process, the established full life cycle asset ledger can quickly link the risk information of the application development stage and the application operation stage with the relevant information of the application.

[0081] Based on the above embodiment, after the risk impact object is obtained, the risk impact object includes the affected risk applications. In order to improve operation and maintenance efficiency, the risk level of these risk applications can also be evaluated according to risk events, and then the application can be processed accordingly according to the risk level.

[0082] For example, risk levels include warning level and high-risk level, which can be determined according to the category and risk stage to which the risk event belongs. For example, if the risk event is a vulnerability and it is a vulnerability in the application development stage, the corresponding risk level may be a warning level. If the risk event is a vulnerability and it is a vulnerability in the application operation stage, the corresponding risk level may be a high-risk level. Therefore, users can pre-define the risk levels corresponding to risk events of various categories and risk stages. The distinction between risk levels is not limited to the above two types, but can also be other more detailed risk levels. Users can flexibly define them according to actual needs.

[0083] In this way, the risk level of the risk event can be directly obtained, and then the affected risk applications can be handled differently according to the risk level. For example, if it is a warning level, an alarm message will be output; if it is a high-risk level, the development or operation of the application can be suspended. This can achieve rapid processing of risky applications and improve operation and maintenance efficiency.

[0084] Please refer to Figure 4 , Figure 4 This is a structural block diagram of a risk management device 200 provided in an embodiment of the present application. The device 200 may be a module, program segment or code on an electronic device. It should be understood that the device 200 is similar to the above Figure 1 The method embodiment corresponds to and can be executed Figure 1 The various steps involved in the method embodiment and the specific functions of the device 200 can be found in the above description. To avoid repetition, the detailed description is appropriately omitted here.

[0085] Optionally, the device comprises:

[0086] An event acquisition module 210 is used to acquire risk events, wherein the risk events include risk information;

[0087] A risk stage determination module 220, configured to determine a first risk stage to which the risk event belongs;

[0088] The risk location module 230 is used to obtain the risk impact object of the risk event in the second risk stage based on a pre-established risk association relationship and risk information, wherein the risk stage includes an application development stage and an application operation stage, the first risk stage and the second risk stage refer to one of the risk stages, and the first risk stage and the second risk stage are different, the risk association relationship includes the association relationship between the risk information in the application development stage and the relevant information of the application, and the association relationship between the risk information in the application operation stage and the relevant information of the application, and the relevant information includes the risk impact object.

[0089] Optionally, the association relationship between the risk information in the application development stage and the relevant information of the application in the risk association relationship refers to the association relationship between the risk characteristics of the risk information in the application development stage and the relevant information of the application, and the association relationship between the risk information in the application operation stage and the relevant information of the application in the risk association relationship refers to the association relationship between the risk characteristics of the risk information in the application operation stage and the relevant information of the application.

[0090] Optionally, the risk location module 230 is used to obtain the risk characteristics of the risk information in the risk event if the risk stage to which the risk event belongs is the application development stage; search for the risk information of the application running stage with the same risk characteristics according to the risk association relationship; search for the relevant information of the application associated with the risk information of the application running stage according to the risk association relationship, and determine the risk impact object from the relevant information, wherein the risk impact object includes the running risk application;

[0091] Alternatively, the risk location module 230 is used to obtain the risk characteristics of the risk information in the risk event if the risk stage to which the risk event belongs is the application running stage; search for the risk information of the application development stage with the same risk characteristics according to the risk association relationship; search for relevant information of the application associated with the risk information of the application development stage according to the risk association relationship, and determine the risk impact object from the relevant information, wherein the risk impact object includes the development information corresponding to the application.

[0092] Optionally, the development information corresponding to the application includes at least one of a code library, an image library, a component, and development project information corresponding to the application.

[0093] Optionally, the device 200 further includes:

[0094] An information collection module is used to obtain collected application risk information, wherein the application risk information includes risk information of each application in the application development stage and risk information of each application in the application operation stage; the application risk information is associated with relevant information of the corresponding application according to the established full life cycle asset ledger to establish a risk association relationship, wherein the full life cycle asset ledger contains relevant information of each application in the application development stage and the application operation stage.

[0095] Optionally, the information collection module is used to obtain different application risk information collected through various risk detection tools, wherein the risk detection tools include at least one of a code risk tool, an open source risk tool, a container risk tool and an application interface risk tool.

[0096] Optionally, the relevant information of each application in the application development stage and the application running stage also includes at least one of the source code, running components, image code, container assets, and interface assets of the application.

[0097] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the device described above can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0098] Please refer to Figure 5 , Figure 5A structural diagram of an electronic device for executing a risk management method provided in an embodiment of the present application, the electronic device may include: at least one processor 310, such as a CPU, at least one communication interface 320, at least one memory 330 and at least one communication bus 340. Among them, the communication bus 340 is used to realize direct connection and communication between these components. Among them, the communication interface 320 of the device in the embodiment of the present application is used to communicate signaling or data with other node devices. The memory 330 can be a high-speed RAM memory or a non-volatile memory (non-volatile memory), such as at least one disk storage. The memory 330 can optionally also be at least one storage device located away from the aforementioned processor. Computer-readable instructions are stored in the memory 330. When the computer-readable instructions are executed by the processor 310, the electronic device executes the above-mentioned Figure 1 The method process is shown.

[0099] Understandably, Figure 5 The structure shown is for illustration only, and the electronic device may also include Figure 5 More or fewer components as shown, or with Figure 5 Different configurations are shown. Figure 5 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0100] The present application embodiment provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the following is performed: Figure 1 The method process in the method embodiment shown is executed by the electronic device.

[0101] This embodiment discloses a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a computer, the computer can perform the methods provided by the above method embodiments, for example, including:

[0102] Acquire a risk event, wherein the risk event includes risk information;

[0103] Determine the first risk stage to which the risk event belongs;

[0104] According to the pre-established risk association relationship and risk information, the risk impact object of the risk event in the second risk stage is obtained;

[0105] Among them, the risk stage includes the application development stage and the application operation stage, the first risk stage and the second risk stage refer to one of the risk stages, and the first risk stage and the second risk stage are different, the risk association relationship includes the association relationship between the risk information in the application development stage and the relevant information of the application, and the association relationship between the risk information in the application operation stage and the relevant information of the application, and the relevant information includes the risk impact object.

[0106] In summary, the embodiments of the present application provide a risk management method, device, electronic device and storage medium. The method determines the first risk stage to which the risk event belongs, and then obtains the risk impact objects of the risk event in the second risk stage based on the risk association relationship. In this way, the risk impact objects of the risk event in each risk stage can be located, and two-way feedback of risks in the application development stage and the application operation stage can be achieved. Therefore, the risks in the application development stage and the application operation stage can be correlated and analyzed to accurately locate the risk impact objects in each risk stage without manual investigation, thereby improving the efficiency of risk handling.

[0107] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0108] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0109] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0110] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0111] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A risk management method, characterized in that: The method comprises: Acquire a risk event, wherein the risk event includes risk information; Determine the first risk stage to which the risk event belongs; According to the pre-established risk association relationship and the risk information, obtaining the risk impact object of the risk event in the second risk stage; Among them, the risk stage includes the application development stage and the application operation stage, the first risk stage and the second risk stage refer to one of the risk stages, and the first risk stage and the second risk stage are different, the risk association relationship includes the association relationship between the risk information in the application development stage and the relevant information of the application, and the association relationship between the risk information in the application operation stage and the relevant information of the application, and the relevant information includes the risk impact object.

2. The method according to claim 1, characterized in that The association relationship between the risk information in the application development stage and the relevant information of the application in the risk association relationship refers to the association relationship between the risk characteristics of the risk information in the application development stage and the relevant information of the application, and the association relationship between the risk information in the application operation stage and the relevant information of the application in the risk association relationship refers to the association relationship between the risk characteristics of the risk information in the application operation stage and the relevant information of the application.

3. The method according to claim 2, characterized in that The obtaining, according to the pre-established risk association relationship and the risk information, the risk impact object of the risk event in the second risk stage comprises: If the risk stage to which the risk event belongs is the application development stage, then obtaining risk characteristics of the risk information in the risk event; Searching for risk information of the application running stage with the same risk characteristics according to the risk association relationship; Searching for relevant information of the application associated with the risk information in the application running phase according to the risk association relationship, and determining a risk impact object from the relevant information, wherein the risk impact object includes a running risk application; or, If the risk stage to which the risk event belongs is the application operation stage, then obtaining risk characteristics of the risk information in the risk event; Searching for risk information of the application development stage with the same risk characteristics according to the risk association relationship; According to the risk association relationship, relevant information of the application associated with the risk information in the application development stage is searched, and a risk impact object is determined from the relevant information, wherein the risk impact object includes development information corresponding to the application.

4. The method according to claim 3, characterized in that The development information corresponding to the application includes at least one of a code library, an image library, a component, and development project information corresponding to the application.

5. The method according to claim 1, characterized in that The risk association relationship is established in the following ways: Acquire collected application risk information, wherein the application risk information includes risk information of each application in the application development phase and risk information of each application in the application operation phase; The application risk information is associated with the relevant information of the corresponding application according to the established full life cycle asset ledger to establish a risk association relationship, wherein the full life cycle asset ledger includes relevant information of each application in the application development stage and the application operation stage.

6. The method according to claim 5, characterized in that The acquisition of collected application risk information includes: Different application risk information collected through various risk detection tools is obtained, wherein the risk detection tools include at least one of a code risk tool, an open source risk tool, a container risk tool, and an application interface risk tool.

7. The method according to claim 5, characterized in that The relevant information of each application in the application development stage and the application running stage also includes at least one of the source code, running components, image code, container assets, and interface assets of the application.

8. A risk management device, characterized in that: The device comprises: An event acquisition module, used to acquire risk events, wherein the risk events include risk information; A risk stage determination module, used to determine the first risk stage to which the risk event belongs; A risk location module, used for obtaining the risk impact object of the risk event in the second risk stage according to the pre-established risk association relationship and the risk information; Among them, the risk stage includes the application development stage and the application operation stage, the first risk stage and the second risk stage refer to one of the risk stages, and the first risk stage and the second risk stage are different, the risk association relationship includes the association relationship between the risk information in the application development stage and the relevant information of the application, and the association relationship between the risk information in the application operation stage and the relevant information of the application, and the relevant information includes the risk impact object.

9. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores computer-readable instructions. When the computer-readable instructions are executed by the processor, the method according to any one of claims 1 to 7 is executed.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is performed.

Images