Asset security management method, device, equipment, storage medium and product

Abstract

The present application discloses an asset security management method, device, equipment, storage medium and product, which relates to the field of security technology, and discloses an asset security management method, including: determining the information sensitivity of each asset based on the data attribute information of each asset; determining the vulnerability scanning frequency of each asset based on the information sensitivity of each asset and the formation time of each asset; and performing vulnerability detection on each asset according to the vulnerability scanning frequency of each asset. Through the above method, the vulnerability detection frequency is planned in combination with the formation time and sensitivity of the asset, which realizes the targeted and flexible planning of the vulnerability detection frequency on different assets, which not only avoids the waste of vulnerability detection resources on secondary or unimportant assets, but also improves the timeliness of vulnerability discovery in key assets, thereby greatly reducing the potential risk of asset information leakage, which is conducive to maintaining customers' trust in the enterprise.

Description

Technical Field

[0001] The present application relates to the field of security technology, and in particular to asset security management methods, devices, equipment, storage media and products. Background Art

[0002] Information technology assets are key elements of daily business operations. Since these assets directly support the normal operation of the business, once there are security risks, it will not only affect the normal operation of the business, but also affect the brand reputation of the enterprise. Therefore, it is necessary to manage the security of the information technology assets of the enterprise. In the existing technology, when performing vulnerability detection on information technology assets, most of them use the same vulnerability detection frequency, which wastes vulnerability detection resources on secondary or unimportant assets, and the vulnerabilities of key assets are not discovered in time, which poses a risk of attackers exploiting the vulnerabilities to obtain sensitive information.

[0003] The above contents are only used to assist in understanding the technical solution of the present application and do not constitute an admission that the above contents are prior art. Summary of the invention

[0004] The main purpose of this application is to provide an asset security management method, device, equipment, storage medium and product, aiming to solve the technical problems that the existing technology has poor flexibility and pertinence when detecting vulnerabilities in information technology assets, which wastes resources and greatly increases the risk of asset information leakage.

[0005] To achieve the above objectives, the present application proposes an asset security management method, the method comprising:

[0006] Determine the information sensitivity of each asset based on the data attribute information of each asset;

[0007] Determine the vulnerability scanning frequency of each asset based on the information sensitivity of each asset and the age of each asset;

[0008] Perform vulnerability detection on each asset according to its vulnerability scanning frequency.

[0009] In one embodiment, the step of determining the information sensitivity of each asset according to the data attribute information of each asset includes:

[0010] Determine the classification attributes of the information data existing in each asset according to the data attribute information of each asset;

[0011] Perform data statistics based on the classification attributes of the information data in each asset to determine the data occupancy of each classification attribute under each asset;

[0012] The sensitivity of each asset is determined by calculating the data content of each classified attribute under each asset and the secret factor of each classified attribute.

[0013] In one embodiment, the step of determining the vulnerability scanning frequency of each asset according to the information sensitivity of each asset and the formation time of each asset includes:

[0014] Compare the formation time of each asset with the preset limit time, and determine the formation time type of each asset according to the comparison result;

[0015] When the formation time type of each asset is an emerging asset type, determine the relationship between the information sensitivity of each asset and the preset sensitivity;

[0016] Determining a first calculation method for each asset based on a relationship between the information sensitivity of each asset and a preset sensitivity;

[0017] A frequency calculation is performed according to the first calculation method of each asset, the preset detection frequency, the information sensitivity of each asset and the preset sensitivity to determine the vulnerability scanning frequency of each asset.

[0018] In one embodiment, after the step of comparing the formation time of each asset with the preset limited time and determining the formation time type of each asset according to the comparison result, the step further includes:

[0019] When the formation time type of each asset is a historical asset type, the historical access ratio of each asset is counted in the asset access record, and the relationship between the information sensitivity of each asset and the preset sensitivity is determined;

[0020] Determining a second calculation method for each asset based on a relationship between the information sensitivity of each asset and a preset sensitivity;

[0021] The frequency calculation is performed based on the second calculation method of each asset, the preset detection frequency, the information sensitivity of each asset, the preset sensitivity and the historical access ratio of each asset to determine the vulnerability scanning frequency of each asset.

[0022] In one embodiment, the method comprises:

[0023] When receiving a remote access instruction, extract information from the remote access instruction to determine the asset to be accessed, the identity information of the visitor, and the access network indication;

[0024] Matching the target asset set corresponding to the visitor identity information with the asset to be visited to obtain an access verification result;

[0025] When the access verification result is successful, a leakage assessment is performed on the asset to be accessed according to the vulnerability detection result of the asset to be accessed, and a leakage risk index of the asset to be accessed is determined;

[0026] Performing a risk assessment on the access network according to the access network indication to determine a communication risk index of the access network;

[0027] An access method of the remote access instruction is determined according to the leakage risk index and the communication risk index, and an instruction reply operation is performed according to the access method.

[0028] In one embodiment, the step of performing a command reply operation according to the access mode includes:

[0029] When the access mode is partial access, searching a preset management information base for a valid classification attribute corresponding to the leakage risk index;

[0030] Extracting data from the information data in the asset to be accessed according to the classification attribute of the information data in the asset to be accessed and the valid classification attribute, and determining valid information data in the asset to be accessed;

[0031] An instruction reply operation is executed according to the valid information data.

[0032] In addition, to achieve the above-mentioned purpose, the present application also proposes an asset security management device, the asset security management device comprising: a processing module, used to determine the information sensitivity of each asset according to the data attribute information of each asset;

[0033] The processing module is used to determine the vulnerability scanning frequency of each asset according to the information sensitivity of each asset and the formation time of each asset;

[0034] The detection module is used to perform vulnerability detection on each asset according to the vulnerability scanning frequency of each asset.

[0035] In addition, to achieve the above-mentioned purpose, the present application also proposes an asset security management device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, and the computer program is configured to implement the steps of the asset security management method described above.

[0036] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the asset security management method described above are implemented.

[0037] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the asset security management method described above are implemented.

[0038] The present application provides an asset security management method, which determines the information sensitivity of each asset based on the data attribute information of each asset; determines the vulnerability scanning frequency of each asset based on the information sensitivity of each asset and the formation time of each asset; and performs vulnerability detection on each asset according to the vulnerability scanning frequency of each asset. Through the above method, the vulnerability detection frequency is planned in combination with the formation time and sensitivity of the asset, which realizes the targeted and flexible planning of vulnerability detection frequency on different assets, which not only avoids the waste of vulnerability detection resources on secondary or unimportant assets, but also improves the timeliness of vulnerability discovery in key assets, thereby greatly reducing the potential risk of asset information leakage, which is conducive to maintaining customers' trust in the company. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0040] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0041] Figure 1 A flowchart of the first embodiment of the asset security management method of the present application is provided;

[0042] Figure 2 A schematic diagram of the structure of an asset security management system provided in Example 1 of the present application;

[0043] Figure 3 A flowchart of the second embodiment of the asset security management method of this application is provided;

[0044] Figure 4 A flowchart of the third embodiment of the asset security management method of this application is provided;

[0045] Figure 5 This is a schematic diagram of the module structure of the asset security management device according to an embodiment of the present application;

[0046] Figure 6 This is a schematic diagram of the device structure of the hardware operating environment involved in the asset security management method in the embodiment of the present application.

[0047] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0048] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0049] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0050] The main solutions of the embodiments of the present application are: determining the information sensitivity of each asset based on the data attribute information of each asset; determining the vulnerability scanning frequency of each asset based on the information sensitivity of each asset and the formation time of each asset; and performing vulnerability detection on each asset according to the vulnerability scanning frequency of each asset.

[0051] Information technology assets often need to be connected and exchanged through the network, so the security risks they face mainly include remote access risks and the risk of being vulnerable to attacks from known vulnerabilities due to failure to install security updates and patches in a timely manner. In this case, the security management of information technology assets can be reflected in vulnerability detection management and remote access management. 1. In the existing technology, when performing vulnerability detection management on information technology assets, most assets use the same vulnerability detection frequency, and vulnerability detection resources are wasted on secondary or unimportant assets. Vulnerabilities of key assets are not discovered in time, and there is a risk of attackers exploiting vulnerabilities to obtain sensitive information, and data leakage damages customer privacy and trust. 2. When performing access management on information technology assets, the existing technology only verifies the access permission of access instructions, and there are problems such as access through malicious networks and attackers exploiting system or application vulnerabilities to attack, endangering the security of the accessed assets.

[0052] In addition, the existing technology has the following shortcomings: 1. Information security and sensitivity identification issues: With the development of network technology, the amount of information on the network has increased exponentially, but many network information security issues have also appeared in front of users. A large number of network devices are widely used in daily work. With the increasing number of vulnerability types, some assets of companies or enterprises have become "zombie" assets due to lack of management. Such assets may use lower versions of services and components and become a weak point exposed to hackers, which is easy to be attacked by network hackers, bringing great hidden dangers to the normal operation of the enterprise's business. 2. Lack of risk scanning and risk analysis: Most of the risk scanning devices such as scanners in the existing technology are used as system security inspection tools. There is only the concept of tasks, and they can only analyze the risk of assets in the system with tasks as the center, resulting in poor ease of use of risk scanning devices such as scanners and low user experience. 3. Network risk situation awareness of industrial control networks: It is necessary to deploy corresponding situation awareness devices in the industrial control network of the enterprise to realize the monitoring of industrial control network risks; but the existing situation awareness devices have a long deployment cycle and high budget in the enterprise, and are not conducive to the perception of the network risk situation of enterprises within a certain area. They lack comprehensiveness and are not conducive to the security supervision of the entire area. 4. The existence of unknown and abnormal IT assets leads to incomplete and inaccurate asset management information, which cannot correctly reflect the real information of assets. The establishment of assets or network services without permission and the separation from the management of managed assets will become the shortcoming of overall IT security. Security administrators lack the technical means to verify changes, omissions, false reports and concealment of assets, which makes the enterprise asset security management work face severe security risks.

[0053] This application plans the vulnerability detection frequency based on the formation time and sensitivity of the assets, thereby achieving targeted and flexible planning of vulnerability detection frequency on different assets. It not only avoids the waste of vulnerability detection resources on secondary or unimportant assets, but also improves the timeliness of vulnerability discovery in key assets, thereby greatly reducing the potential risk of asset information leakage, which is conducive to maintaining customer trust in the company.

[0054] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device capable of realizing the above functions, an asset security management device, etc. The following takes the asset security management device as an example to illustrate this embodiment and the following embodiments.

[0055] Based on this, the present application embodiment provides an asset security management method, referring to Figure 1 , Figure 1 This is a flow chart of the first embodiment of the asset security management method of the present application.

[0056] In this embodiment, the asset security management method includes steps S10 to S30:

[0057] Step S10, determining the information sensitivity of each asset according to the data attribute information of each asset.

[0058] It should be noted that the asset security management device of this embodiment builds an asset security management system, such as Figure 2 As shown, it includes an asset inventory module, an asset sensitivity identification module, a vulnerability scanning and detection module, an access permission setting module, a remote access information extraction module, a management information base, a remote access verification module, a risk assessment module and a remote access restriction module.

[0059] In this embodiment, the asset inventory module is used to inventory the existing information technology assets of the enterprise and form an asset ledger. Specifically, the storage location and formation time of each asset are stored in the asset ledger, and each asset is numbered in the order of formation time from the earliest to the latest. The asset sensitivity identification module is connected to the asset inventory module and the management information library respectively, and is used to extract the information data and formation time contained in each asset from the asset ledger, and classify and mark the information data by attributes, thereby identifying the information sensitivity of each asset. The vulnerability scanning detection module is connected to the asset sensitivity identification module and the management information library respectively, and is used to plan the vulnerability detection frequency of each asset according to the information sensitivity and formation time of each asset, and then perform vulnerability detection scanning on each asset according to the planned vulnerability detection frequency. The access permission setting module is connected to the asset sensitivity identification module, and is used to set the access permission of each asset according to the information sensitivity of each asset. The remote access information extraction module is used to receive the remote access instruction and extract the access information indication from it. The remote access verification module is connected to the remote access information extraction module and the access permission setting module respectively, and is used to perform access verification based on the access content indication and the access permission of each asset. The risk assessment module is connected to the vulnerability scanning and detection module, the remote access information extraction module and the remote access verification module respectively, and is used to retrieve the current vulnerability detection results of the assets to be accessed according to the access content indication after the access verification is successful, thereby evaluating the information leakage risk index of the assets to be accessed, and at the same time evaluating the communication environment risk index of the access network according to the access network indication. The remote access restriction module is connected to the risk assessment module, the asset sensitivity identification module and the management information library respectively, and is used to restrict remote access based on the communication environment risk index of the assets to be accessed and the access network.

[0060] It can be understood that each asset refers to the existing information technology assets of the enterprise, and the assets may contain one or more information data. Data attribute information refers to the information data contained in each asset that is formed after the attribute classification and attribute marking are performed. The data attribute information includes but is not limited to the classification attributes of the information data contained in each asset.

[0061] In the specific implementation, the information data and formation time of each asset are extracted from the asset ledger, and the information data is classified and marked by attributes, thereby identifying the information sensitivity of each asset. The information data contained in each asset can be retrieved from the corresponding storage location according to the storage location of each asset in the asset ledger.

[0062] In this embodiment, the classification attributes of assets include but are not limited to public information, internal information, sensitive information, and confidential information. Public information may be an organization's public statements, advertisements, or other publicly visible content, and such information usually does not cause significant losses to the organization. Internal information is information used within the organization and is not disclosed to the outside, but its disclosure may cause minor damage to the organization, including but not limited to internal documents, employee handbooks, etc. Sensitive information includes information that is very important to the organization, and its disclosure may cause significant damage to the organization's reputation, financial situation, or legal status. Sensitive information may include customer data, financial reports, contracts, etc. Confidential information is the most sensitive information in an organization, and its disclosure may cause great damage to the organization, including but not limited to trade secrets, research and development results, strategic plans, etc.

[0063] In a feasible implementation, step S10 may include steps A11 to A13:

[0064] Step A11, determining the classification attributes of the information data existing in each asset according to the data attribute information of each asset.

[0065] It should be noted that for each asset: the data attribute information of the asset is extracted to determine the classification attribute to which the information data existing in each asset belongs.

[0066] Step A12, performing data statistics according to the classification attributes of the information data existing in each asset, and determining the data occupancy of each classification attribute under each asset.

[0067] It should be noted that the following statistics are performed for each asset: data statistics are performed based on the classification attributes of the existing information data to determine the number of classification attributes, the name of each classification attribute, and the data occupancy of each classification attribute.

[0068] Step A13, performing sensitivity calculation based on the data occupancy of each classified attribute under each asset and the secret factor of each classified attribute, to determine the information sensitivity of each asset.

[0069] It should be noted that, in this embodiment, different classification attributes correspond to different secret factors, wherein the secret factor corresponding to public information < the secret factor corresponding to internal information < the secret factor corresponding to sensitive information < the secret factor corresponding to confidential information.

[0070] It can be understood that the sensitivity calculation is performed based on the data possession of each classified attribute under each asset and the secret factor of each classified attribute. The specific calculation formula is as follows: Thus, the information sensitivity SY of each asset is obtained i , where i represents the sequential number of the asset in the asset ledger, i = 1, 2, ..., n, x i j represents the data occupancy corresponding to the jth classification attribute in the information classification of the i-th asset, j represents the category number in the information classification of each asset, j=1,2,......,m,ε j It represents the secret factor corresponding to the j-th classification attribute, where the larger the secret factor corresponding to the classification attribute in each asset, the larger the data volume and the greater the information sensitivity of the asset.

[0071] In the specific implementation, the greater the data occupancy of each classified attribute in each asset, the greater the data proportion of a certain classified attribute, which means that the data cardinality is larger, which means that the proportion of the data volume of the classified attribute in the overall data is higher, which means that the data cardinality of the corresponding classified attribute is larger and the potential risk is also higher. When the value 1 is added to the data proportion value of each classified attribute as an exponent to construct a logarithmic function, it can ensure that the domain of the logarithmic function is a positive number. When the data proportion value of each classified attribute increases greatly, the logarithmic function grows more slowly, avoiding the excessive sensitivity value caused by linear growth. The square root of the privacy factor can prevent the growth rate from being too fast when the privacy factor is large, avoiding excessive sensitivity values. By calculating the information sensitivity by multiplying the logarithmic function constructed based on the data proportion value and the square root of the privacy factor, the influence of the data proportion value and the privacy factor can be comprehensively considered, which can better balance the relationship between the data proportion value and the sensitivity, avoid excessive sensitivity values, and maintain the rationality and smoothness of the calculation results. In addition, in order to limit the numerical range of the calculated information sensitivity, the use The function limits the calculation result to between 0 and 1, standardizes the output, and does not cause excessive calculation in the subsequent vulnerability detection frequency calculation, simplifies the calculation, and is also easy to understand.

[0072] In this embodiment, asset-centric risk scanning and risk analysis are achieved through the above-mentioned method: the problem in the prior art that it is impossible to determine the current risk situation and historical risk change trends of all assets in the system from a macro perspective is solved, and the ease of use of risk scanning products is improved; and this invention is to take into account that when performing sensitivity identification on information technology assets, the information data contained in an asset may contain more than one type of information, and different types of information have different security management and control requirements, so the assets are classified and divided into attributes, and sensitivity identification is performed based on the classification attributes and the data possession corresponding to each classification attribute, so that the sensitivity identification of assets is more comprehensive, which is conducive to improving the accuracy of the sensitivity identification results.

[0073] Step S20, determining the vulnerability scanning frequency of each asset according to the information sensitivity of each asset and the formation time of each asset.

[0074] It should be noted that the formation time of each asset is compared with the current time to obtain the formation time of each asset, where formation time = current time - formation time. The formation time of each asset is bounded by the set limited time to determine the formation time category of each asset. Where T i Indicates the formation time of the i-th asset, T0 indicates the set limited time, for example, T0 can be set to 1 month. In this embodiment, the formation time of each asset should be unified in units, for example, it can be unified as month.

[0075] It can be understood that each asset is classified according to the time of formation to obtain a number of historical assets and a number of emerging assets, and the vulnerability detection frequency of each emerging asset is calculated by combining the information sensitivity of each emerging asset with the vulnerability detection frequency corresponding to the conventional information sensitivity; the historical access proportion of each historical asset is counted from the asset access records, wherein the historical access proportion is calculated by obtaining the historical access frequency of each historical asset, dividing it by the total number of asset access records to obtain the historical access proportion, and combining it with the information sensitivity to calculate the vulnerability detection frequency of each historical asset.

[0076] Step S30: Perform vulnerability detection on each asset according to the vulnerability scanning frequency of each asset.

[0077] This embodiment provides an asset security management method, which determines the information sensitivity of each asset based on the data attribute information of each asset; determines the vulnerability scanning frequency of each asset based on the information sensitivity of each asset and the formation time of each asset; and performs vulnerability detection on each asset according to the vulnerability scanning frequency of each asset. Through the above method, the vulnerability detection frequency is planned in combination with the formation time and sensitivity of the asset, which realizes the targeted and flexible planning of vulnerability detection frequency on different assets, which not only avoids the waste of vulnerability detection resources on secondary or unimportant assets, but also improves the timeliness of vulnerability discovery in key assets, thereby greatly reducing the potential risk of asset information leakage, which is conducive to maintaining customers' trust in the enterprise.

[0078] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can be referred to the above introduction, and will not be repeated in the following. Figure 3 , step S20, the asset security management method further includes steps S21 to S24:

[0079] Step S21, comparing the formation time of each asset with a preset limited time, and determining the formation time type of each asset according to the comparison result.

[0080] It should be noted that the formation time of each asset is compared with the current time to obtain the formation time of each asset, where formation time = current time - formation time. The formation time of each asset is bounded by the set limited time to determine the formation time category of each asset. In this embodiment, the formation time type refers to the formation time category C of each asset. i .

[0081] In a feasible implementation manner, after step S21, steps B11 to B13 may be included:

[0082] Step B11, when the formation time type of each asset is a historical asset type, the historical access ratio of each asset is counted in the asset access record, and the relationship between the information sensitivity of each asset and the preset sensitivity is determined.

[0083] It should be noted that when the formation time type of each asset is a historical asset type, the historical access percentage value of each historical asset is counted from the asset access record, wherein the historical access percentage value is counted by obtaining the historical access frequency of each historical asset, dividing it by the total number of asset access records, and obtaining the historical access percentage value. In this embodiment, one asset access record corresponds to one historical access.

[0084] It is understandable that the information sensitivity of each asset is compared with the preset sensitivity to determine the magnitude relationship between the two. In this embodiment, the preset sensitivity refers to the conventional information sensitivity SY0 existing in the management information base.

[0085] Step B12, determining a second calculation method for each asset according to the relationship between the information sensitivity of each asset and the preset sensitivity.

[0086] It should be noted that for each historical asset: the relationship between the information sensitivity of the asset and the preset sensitivity has a corresponding vulnerability detection frequency planning method. In this embodiment, the second calculation method for each asset refers to the planning method of the vulnerability detection frequency corresponding to each historical asset. k The specific calculation formula is Where SY k represents the information sensitivity of the kth historical asset, k represents the number of the historical asset, k=1,2,......,u,μ k represents the historical access ratio of the k-th historical asset, and e represents a natural constant.

[0087] In this embodiment, since all assets are divided into historical assets and emerging assets, when numbering historical assets and emerging assets, all assets belonging to historical assets are renumbered, and all assets belonging to emerging assets are renumbered, so that the sum of the number of historical assets and emerging assets is the total number of assets, that is, z+u=n. The numbering method is that under each type, each asset is numbered in the order of formation time from the earliest to the latest.

[0088] It can be understood that for each historical asset: when the information sensitivity of each asset is less than the preset sensitivity, the second calculation method is When the information sensitivity of each asset is greater than or equal to the preset sensitivity, the second calculation method is in, Indicates rounding up, F 常规 Expressed as the frequency of vulnerability detections corresponding to general information sensitivity.

[0089] Step B13, performing frequency calculation based on the second calculation method of each asset, the preset detection frequency, the information sensitivity of each asset, the preset sensitivity and the historical access ratio of each asset to determine the vulnerability scanning frequency of each asset.

[0090] It should be noted that the preset detection frequency refers to the vulnerability detection frequency F corresponding to the general information sensitivity. 常规 , the preset detection frequency, the information sensitivity of each asset, the preset sensitivity, and the historical access ratio of each asset are substituted into the second calculation method of each asset, so as to obtain the vulnerability scanning frequency of each historical asset.

[0091] Step S22: when the formation time type of each asset is an emerging asset type, determine the relationship between the information sensitivity of each asset and the preset sensitivity.

[0092] It should be noted that when the formation time type of each asset is an emerging asset type, the information sensitivity of each asset is compared with the preset sensitivity to determine the size relationship between the two.

[0093] Step S23, determining a first calculation method for each asset according to the relationship between the information sensitivity of each asset and the preset sensitivity.

[0094] It should be noted that for each emerging asset, the relationship between the information sensitivity of the asset and the preset sensitivity has a corresponding vulnerability detection frequency planning method. In this embodiment, the first calculation method for each asset refers to the planning method of the vulnerability detection frequency corresponding to each emerging asset. d The specific calculation formula is Where SY0 represents the conventional information sensitivity, SY d represents the information sensitivity of the dth emerging asset, d represents the number of the emerging asset, d = 1, 2, ..., z.

[0095] It is understandable that for each emerging asset: when the information sensitivity of each asset is less than the preset sensitivity, the first calculation method is When the information sensitivity of each asset is greater than or equal to the preset sensitivity, the first calculation method is

[0096] Step S24, performing frequency calculation according to the first calculation method of each asset, the preset detection frequency, the information sensitivity of each asset and the preset sensitivity, to determine the vulnerability scanning frequency of each asset.

[0097] It should be noted that the preset detection frequency, the information sensitivity of each asset, and the preset sensitivity are substituted into the first calculation method of each asset, so as to obtain the vulnerability scanning frequency of each emerging asset.

[0098] It is understandable that the reason for classifying various assets into historical assets and emerging assets according to their formation time and then planning the vulnerability detection frequency is that for emerging assets, due to their short formation time, there are almost no access records, while for historical assets, due to their long formation time, a large amount of access data will be generated, and the historical access data of assets can reflect the availability of assets to a certain extent. The more frequent the historical access, the greater the available value of the asset, and the more frequent the vulnerability detection is needed to ensure its security. It can be seen that emerging assets and historical assets have different requirements for vulnerability detection.

[0099] In this embodiment, the frequency of leak detection can be expressed as several times per month. For example, the frequency of sewage quality detection corresponding to the normal sewage discharge is 3 times per month. The normal information sensitivity is pre-established and can be set to 0.5. When the information sensitivity is less than the normal information sensitivity The value is between 0 and 1. In this case, the vulnerability detection frequency of the asset is less than the vulnerability detection frequency corresponding to the conventional information sensitivity. When the information sensitivity is greater than or equal to the conventional information sensitivity, The value is greater than 1. In this case, the vulnerability detection frequency of the asset is greater than or equal to the vulnerability detection frequency corresponding to the general information sensitivity.

[0100] This embodiment provides an asset security management method, which compares the formation time of each asset with the preset limited time, and determines the formation time type of each asset according to the comparison result; when the formation time type of each asset is an emerging asset type, determines the relationship between the information sensitivity of each asset and the preset sensitivity; determines the first calculation method of each asset according to the relationship between the information sensitivity of each asset and the preset sensitivity; performs frequency calculation according to the first calculation method of each asset, the preset detection frequency, the information sensitivity of each asset, and the preset sensitivity, and determines the vulnerability scanning frequency of each asset. In the above manner, the detection frequency is planned in combination with the formation time and sensitivity of the asset, so as to achieve the pertinence and flexibility of the vulnerability detection frequency on different assets.

[0101] Based on the first embodiment and / or the second embodiment of the present application, in the third embodiment of the present application, the same or similar contents as those of the above-mentioned first and second embodiments can refer to the above introduction, and will not be repeated later. Figure 4 , step S40, the asset security management method further includes steps S01 to S05:

[0102] Step S01: when a remote access instruction is received, information is extracted from the remote access instruction to determine the asset to be accessed, the identity information of the visitor and the access network indication.

[0103] It should be noted that when a remote access instruction is received, an access information indicator is extracted from the remote access instruction, and the access information indicator includes but is not limited to an access content indicator and an access network indicator. The access content indicator includes but is not limited to the visitor's identity information and the asset to be accessed, where the visitor's identity information may be the visitor's user name; the access network indicator includes but is not limited to the access network category and the access network quality parameter, where the access network category is divided into intranet and extranet, and the access network quality parameter includes but is not limited to the delay rate, signal-to-noise ratio, and bit error rate.

[0104] It is understandable that the reason why the delay rate, signal-to-noise ratio and bit error rate are selected as access network quality parameters in this embodiment is that high delay may cause communication delay, and attackers may try to use high delay to perform certain types of attacks to affect the system response time and interfere with normal operation. The signal-to-noise ratio is the ratio of signal to noise, and a high signal-to-noise ratio generally indicates good signal quality. A low signal-to-noise ratio may cause misunderstandings and errors in communication, reducing the reliability of communication. An attacker may try to interfere with communication by means of noise interference or signal injection, so that the signal-to-noise ratio is reduced, thereby affecting the credibility of communication. A high bit error rate means that a bit error occurs during the communication process, which may cause data damage or loss. An attacker may increase the bit error rate by deliberately introducing noise or interference, thereby affecting the integrity of the communication. It can be seen that the delay rate, signal-to-noise ratio and bit error rate are important parameters of communication network performance. By using them as access network quality parameters, the communication security of the access network can be comprehensively reflected to the maximum extent.

[0105] Step S02: Match the target asset set corresponding to the visitor identity information with the assets to be visited to obtain an access verification result.

[0106] It should be noted that in this embodiment, the number of existing employees in the enterprise and the rank of each employee are counted, and a corresponding relationship is established between the information sensitivity of each asset and the rank, so as to obtain the information sensitivity interval corresponding to each rank. The information sensitivity of each asset is compared with the information sensitivity interval corresponding to each rank to form a set of assets that employees of each rank are allowed to access, and identity information is assigned to each employee, where the identity information can be a user name.

[0107] It is understandable that after determining the visitor's identity information, the visitor's job level is determined based on the visitor's identity information, and then the asset set that the visitor's job level is allowed to access is retrieved from the asset set that employees of each job level are allowed to access, thereby obtaining the target asset set corresponding to the visitor's identity information. The assets to be accessed are matched with the target asset set corresponding to the visitor's identity information. If the match is successful, the access verification result is verification success; if the match fails, the access verification result is verification failure.

[0108] Step S03, when the access verification result is successful, a leakage assessment is performed on the asset to be accessed according to the vulnerability detection result of the asset to be accessed, and a leakage risk index of the asset to be accessed is determined.

[0109] It should be noted that when the access verification result is successful, the vulnerability detection result of the asset to be accessed is obtained, and the vulnerability detection result can be obtained after vulnerability detection is performed according to the vulnerability detection frequency of the asset to be accessed. The vulnerability detection results obtained by performing vulnerability detection through vulnerability detection tools include but are not limited to the number of vulnerabilities and the score value of each vulnerability.

[0110] It is understandable that the vulnerability detection results can be used to evaluate the information leakage risk index of the assets to be accessed. The specific process is as follows: The vulnerability detection results of the assets to be accessed are analyzed by the expression Get the information leakage risk index of the asset to be accessed p f represents the fth vulnerability score value in the current vulnerability detection result of the asset to be accessed, p0 represents the vulnerability score threshold, f represents the vulnerability number, and f=1,2,...,r. In this embodiment, the leakage risk index of the asset to be accessed refers to the information leakage risk index of the asset to be accessed. The larger the vulnerability score value, the more serious the vulnerability. For example, the vulnerability score threshold is 100 points.

[0111] Step S04: performing risk assessment on the access network according to the access network indicator to determine a communication risk index of the access network.

[0112] It should be noted that the access network indicator can be used to evaluate the communication environment risk index of the access network. The specific process is as follows: the access network indicator is evaluated by the evaluation expression The communication environment risk index φ of the access network is obtained. DR, SR, and ER represent the delay rate, signal-to-noise ratio, and bit error rate of the access network, respectively. SR 参考 represents a reference signal-to-noise ratio, exemplarily, the reference signal-to-noise ratio can be set to 20 dB, G1 represents that the access network category is an intranet, and G2 represents that the access network category is an extranet. In this embodiment, the communication risk index of the access network refers to the communication environment risk index φ of the access network.

[0113] Step S05: determining an access method of the remote access instruction according to the leakage risk index and the communication risk index, and executing an instruction reply operation according to the access method.

[0114] It should be noted that the information leakage risk index of the asset to be accessed The default leakage risk index is compared with the default one, and the communication environment risk index φ of the access network is compared with the default secure communication environment risk index. Get the access method W of the remote access command, where represents the preset leakage risk index, φ0 represents the preset security communication environment risk index, and ∧ represents and. For example, the leakage risk index can be set to 0.4, and the security communication environment risk index can be set to 0.3. Finally, the command reply operation is performed according to the implementation method of the remote access command.

[0115] In a feasible implementation manner, in step S05: executing the instruction reply operation according to the access mode may include steps C11 to C13:

[0116] Step C11, when the access mode is partial access, searching a preset management information base for a valid classification attribute corresponding to the leakage risk index.

[0117] It should be noted that when the access method is partial access, the information leakage risk index of the asset to be accessed is compared with the classification attributes allowed to be accessed under each information leakage risk index in the preset management information library, and the classification attributes that are consistent with the comparison are recorded as valid classification attributes, thereby obtaining the valid classification attributes corresponding to the leakage risk index of the asset to be accessed.

[0118] Step C12: extracting the information data in the asset to be accessed according to the classification attribute of the information data in the asset to be accessed and the valid classification attribute, and determining the valid information data in the asset to be accessed.

[0119] It should be noted that the classification attribute of the information data in the asset to be accessed is obtained and matched with the valid classification attribute, thereby extracting the information data corresponding to the valid classification attribute in the asset to be accessed as the information data allowed to be accessed by the remote access instruction under partial access. In this embodiment, the information data allowed to be accessed by the remote access instruction under partial access is the valid information data in the asset to be accessed, and the instruction reply operation is performed through the valid information data.

[0120] Step C13, executing a command reply operation according to the valid information data.

[0121] This embodiment provides an asset security management method. This embodiment extracts information from the remote access instruction when receiving the remote access instruction, determines the asset to be accessed, the visitor's identity information, and the access network indication; matches the target asset set corresponding to the visitor's identity information with the asset to be accessed to obtain an access verification result; when the access verification result is a successful verification, performs a leakage assessment on the asset to be accessed according to the vulnerability detection result of the asset to be accessed, and determines the leakage risk index of the asset to be accessed; performs a risk assessment on the access network according to the access network indication, and determines the communication risk index of the access network; determines the access method of the remote access instruction according to the leakage risk index and the communication risk index, and executes the instruction reply operation according to the access method. In the above manner, remote access restrictions are performed according to the information leakage risk index of the asset to be accessed and the communication environment risk index of the access network, so as to achieve a balance between remote access compliance and security, minimize the risk of information leakage of assets during remote access, thereby ensuring the security of the asset to be accessed, and is conducive to improving the remote access management effect of information technology assets.

[0122] Exemplarily, in order to help understand the implementation process of the asset security management method obtained by combining this embodiment with the above-mentioned embodiment one and embodiment two, the technical effects that can be achieved by all the above-mentioned embodiments are specifically explained: 1. Improving the comprehensiveness of enterprise asset information: The asset inventory module is used to inventory the existing information technology assets of the enterprise and form an asset ledger; it replaces the manual recruitment method and comprehensively improves the comprehensiveness of asset entry.

[0123] 2. Improve the authenticity of enterprise asset information: The asset sensitivity identification module is used to extract the information data and formation time contained in each asset from the asset ledger, and classify and mark the information data by attributes, thereby identifying the information sensitivity of each asset; the vulnerability scanning detection module is used to plan the vulnerability detection frequency of each asset according to the information sensitivity and formation time of each asset, and then perform vulnerability detection scans on each asset according to the planned vulnerability detection frequency; due to the large scale of assets, incomplete asset information, and lack of correlation relationships, it is difficult for enterprises to quickly grasp the overall picture of assets and cannot correctly reflect the true information of assets.

[0124] 3. Improve the asset security of the enterprise: Access permission setting module, used to set the access permissions of each asset according to the information sensitivity of each asset; remote access information extraction module, used to receive remote access instructions and extract access information indicators from them, including access content indicators and access network indicators; management information library, used to store secret factors corresponding to each classification attribute in information technology assets, store vulnerability detection frequencies corresponding to general information sensitivity, and store classification attributes allowed to be accessed under each information leakage risk index; remote access verification module, used to perform access verification based on access content indicators and access permissions of each asset.

[0125] 4. Improve the enterprise's asset risk assessment: The risk assessment module is used to retrieve the current vulnerability detection results of the assets to be accessed based on the access content indication after the access verification is successful, thereby evaluating the information leakage risk index of the assets to be accessed, and at the same time evaluating the communication environment risk index of the access network based on the access network indication; the remote access restriction module is used to restrict remote access based on the information leakage risk index of the assets to be accessed and the communication environment risk index of the access network.

[0126] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the asset security management method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0127] This application also provides an asset security management device, please refer to Figure 5 , the asset security management device comprises:

[0128] The processing module 10 is used to determine the information sensitivity of each asset according to the data attribute information of each asset.

[0129] The processing module 10 is used to determine the vulnerability scanning frequency of each asset according to the information sensitivity of each asset and the formation time of each asset.

[0130] The detection module 20 is used to perform vulnerability detection on each asset according to the vulnerability scanning frequency of each asset.

[0131] Optionally, the processing module 10 is further used for:

[0132] Determine the classification attributes of the information data in each asset based on the data attribute information of each asset; perform data statistics based on the classification attributes of the information data in each asset to determine the data possession of each classification attribute under each asset; perform sensitivity calculation based on the data possession of each classification attribute under each asset and the secret factor of each classification attribute to determine the information sensitivity of each asset.

[0133] Optionally, the processing module 10 is further used for:

[0134] Compare the formation time of each asset with the preset limited time, and determine the formation time type of each asset based on the comparison result; when the formation time type of each asset is an emerging asset type, determine the relationship between the information sensitivity of each asset and the preset sensitivity; determine the first calculation method of each asset based on the relationship between the information sensitivity of each asset and the preset sensitivity; perform frequency calculation based on the first calculation method of each asset, the preset detection frequency, the information sensitivity of each asset and the preset sensitivity, and determine the vulnerability scanning frequency of each asset.

[0135] Optionally, the processing module 10 is further used for:

[0136] When the formation time type of each asset is a historical asset type, the historical access ratio of each asset is counted in the asset access record, and the relationship between the information sensitivity of each asset and the preset sensitivity is determined; the second calculation method of each asset is determined according to the relationship between the information sensitivity of each asset and the preset sensitivity; the frequency calculation is performed according to the second calculation method of each asset, the preset detection frequency, the information sensitivity of each asset, the preset sensitivity and the historical access ratio of each asset to determine the vulnerability scanning frequency of each asset.

[0137] Optionally, the detection module 20 is further used for:

[0138] When a remote access instruction is received, information is extracted from the remote access instruction to determine the asset to be accessed, the visitor's identity information, and the access network indication; the target asset set corresponding to the visitor's identity information is matched with the asset to be accessed to obtain an access verification result; when the access verification result is successful, a leakage assessment is performed on the asset to be accessed based on the vulnerability detection result of the asset to be accessed to determine the leakage risk index of the asset to be accessed; a risk assessment is performed on the access network based on the access network indication to determine the communication risk index of the access network; an access method of the remote access instruction is determined based on the leakage risk index and the communication risk index, and an instruction reply operation is performed according to the access method.

[0139] Optionally, the detection module 20 is further used for:

[0140] When the access mode is partial access, the valid classification attribute corresponding to the leakage risk index is searched in the preset management information library; data extraction is performed on the information data existing in the asset to be accessed according to the classification attribute of the information data existing in the asset to be accessed and the valid classification attribute, and the valid information data in the asset to be accessed is determined; and the instruction reply operation is executed according to the valid information data.

[0141] The asset security management device provided by the present application adopts the asset security management method in the above embodiment, which can solve the technical problem that when performing vulnerability detection on information technology assets, the flexibility and pertinence are poor, and while wasting resources, the risk of asset information leakage is greatly increased. Compared with the prior art, the beneficial effects of the asset security management device provided by the present application are the same as the beneficial effects of the asset security management method provided by the above embodiment, and the other technical features in the asset security management device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0142] The present application provides an asset security management device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the asset security management method in the above-mentioned embodiment one.

[0143] Reference below Figure 6 , which shows a schematic diagram of the structure of an asset security management device suitable for implementing the embodiment of the present application. The asset security management device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 6 The asset security management device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0144] like Figure 6As shown, the asset security management device may include a processing device 1001 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the asset security management device are also stored. The processing device 1001, ROM1002, and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the asset security management device to communicate with other devices wirelessly or by wire to exchange data. Although the figure shows an asset security management device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or have alternatively.

[0145] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0146] The asset security management device provided by the present application adopts the asset security management method in the above embodiment, which can solve the technical problem that when performing vulnerability detection on information technology assets, the flexibility and pertinence are poor, and while wasting resources, the risk of asset information leakage is greatly increased. Compared with the prior art, the beneficial effects of the asset security management device provided by the present application are the same as the beneficial effects of the asset security management method provided by the above embodiment, and the other technical features in the asset security management device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0147] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0148] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0149] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, and the computer-readable program instructions are used to execute the asset security management method in the above-mentioned embodiment.

[0150] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0151] The computer-readable storage medium may be included in the asset security management device; or may exist independently without being assembled into the asset security management device.

[0152] The above-mentioned computer-readable storage medium carries one or more programs. When the above-mentioned one or more programs are executed by the asset security management device, the asset security management device: determines the information sensitivity of each asset based on the data attribute information of each asset; determines the vulnerability scanning frequency of each asset based on the information sensitivity of each asset and the formation time of each asset; and performs vulnerability detection on each asset according to the vulnerability scanning frequency of each asset.

[0153] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0154] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0155] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0156] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned asset security management method, and can solve the technical problem that when performing vulnerability detection on information technology assets, the flexibility and pertinence are poor, and while wasting resources, the risk of asset information leakage is greatly increased. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the asset security management method provided by the above-mentioned embodiment, and will not be repeated here.

[0157] The present application also provides a computer program product, including a computer program, which implements the steps of the above-mentioned asset security management method when executed by a processor.

[0158] The computer program product provided by the present application can solve the technical problem that when performing vulnerability detection on information technology assets, the flexibility and pertinence are poor, and while resources are wasted, the risk of asset information leakage is greatly increased. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as the beneficial effects of the asset security management method provided by the above embodiment, and will not be repeated here.

[0159] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. An asset security management method, characterized in that: The asset security management method comprises: Determine the information sensitivity of each asset based on the data attribute information of each asset; Determine the vulnerability scanning frequency of each asset based on the information sensitivity of each asset and the age of each asset; Perform vulnerability detection on each asset according to its vulnerability scanning frequency.

2. The method according to claim 1, characterized in that The step of determining the information sensitivity of each asset according to the data attribute information of each asset comprises: Determine the classification attributes of the information data existing in each asset according to the data attribute information of each asset; Perform data statistics based on the classification attributes of the information data in each asset to determine the data occupancy of each classification attribute under each asset; The sensitivity of each asset is determined by calculating the data content of each classified attribute under each asset and the secret factor of each classified attribute.

3. The method according to claim 1, characterized in that The step of determining the vulnerability scanning frequency of each asset according to the information sensitivity of each asset and the formation time of each asset includes: Compare the formation time of each asset with the preset limit time, and determine the formation time type of each asset according to the comparison result; When the formation time type of each asset is an emerging asset type, determine the relationship between the information sensitivity of each asset and the preset sensitivity; Determining a first calculation method for each asset based on a relationship between the information sensitivity of each asset and a preset sensitivity; A frequency calculation is performed according to the first calculation method of each asset, the preset detection frequency, the information sensitivity of each asset and the preset sensitivity to determine the vulnerability scanning frequency of each asset.

4. The method according to claim 3, characterized in that After the step of comparing the formation time of each asset with the preset limited time and determining the formation time type of each asset according to the comparison result, the method further includes: When the formation time type of each asset is a historical asset type, the historical access ratio of each asset is counted in the asset access record, and the relationship between the information sensitivity of each asset and the preset sensitivity is determined; Determining a second calculation method for each asset based on a relationship between the information sensitivity of each asset and a preset sensitivity; The frequency calculation is performed based on the second calculation method of each asset, the preset detection frequency, the information sensitivity of each asset, the preset sensitivity and the historical access ratio of each asset to determine the vulnerability scanning frequency of each asset.

5. The method according to claim 1, characterized in that The method comprises: When receiving a remote access instruction, extract information from the remote access instruction to determine the asset to be accessed, the identity information of the visitor, and the access network indication; Matching the target asset set corresponding to the visitor identity information with the asset to be visited to obtain an access verification result; When the access verification result is successful, a leakage assessment is performed on the asset to be accessed according to the vulnerability detection result of the asset to be accessed, and a leakage risk index of the asset to be accessed is determined; Performing a risk assessment on the access network according to the access network indication to determine a communication risk index of the access network; An access method of the remote access instruction is determined according to the leakage risk index and the communication risk index, and an instruction reply operation is performed according to the access method.

6. The method according to claim 5, characterized in that The step of executing the instruction reply operation according to the access mode comprises: When the access mode is partial access, searching a preset management information base for a valid classification attribute corresponding to the leakage risk index; Extracting data from the information data in the asset to be accessed according to the classification attribute of the information data in the asset to be accessed and the valid classification attribute, and determining valid information data in the asset to be accessed; An instruction reply operation is executed according to the valid information data.

7. An asset security management device, characterized in that: The asset security management device comprises: A processing module, used to determine the information sensitivity of each asset based on the data attribute information of each asset; The processing module is used to determine the vulnerability scanning frequency of each asset according to the information sensitivity of each asset and the formation time of each asset; The detection module is used to perform vulnerability detection on each asset according to the vulnerability scanning frequency of each asset.

8. An asset security management device, characterized in that: The device comprises: a memory, a processor, and an asset security management program stored in the memory and executable on the processor, wherein the asset security management program is configured to implement the steps of the asset security management method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium stores an asset security management program, and when the asset security management program is executed by the processor, the steps of the asset security management method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises an asset security management program, and when the asset security management program is executed by a processor, the steps of the asset security management method according to any one of claims 1 to 6 are implemented.

Images