Bank industry application safety index system construction method, system and device based on management domain division and storage medium

Abstract

The invention discloses a bank industry application safety index system construction method, system and device based on management domain division and a storage medium, and the method comprises the steps: decomposing application safety related work into a plurality of management domains, designing a multi-layer index system, formulating an index weight through employing an analytic hierarchy process (CRITIC), collecting work data, and carrying out the calculation. And displaying an evaluation result based on a self-developed large screen, and continuously optimizing the model. According to the method, the standard for quantitative measurement of the application security control condition is established based on the indexes, and the application security condition in a certain time period can be intuitively mastered. Index backtracking and data decomposition are carried out, so that security personnel can be assisted to quickly position key index fluctuation reasons, and strategies such as security test resource configuration, component vulnerability repair priority, Internet high-risk asset exposure surface convergence, security assessment access control and the like are adjusted according to the reasons. The safety of an application system is improved, and the working efficiency of application safety is improved.

Description

Technical Field

[0001] The present invention relates to the field of security indicator system construction, and in particular to a method, system, device and storage medium for building a banking application security indicator system based on management domain division. Background Art

[0002] With the deepening of digital transformation in the banking industry, application systems have become an important channel for business development. Application security is the security construction and management work carried out to ensure the safe operation of application systems such as web, app, and mini-programs. Building an application security indicator system can intuitively perceive the operation of management work, provide important reference for dynamically adjusting management strategies and grasping key management areas, which is conducive to continuously improving the security of application systems.

[0003] The current quantitative research on banking application security indicators has the following deficiencies: (1) Most of the current research on network security quantification and indicator system construction starts from attack surface management, builds an indicator system based on the deployment system of network security products, and uses network security product alarm data as the main data collection source, focusing on network security alarms, network security operations, etc. There is less research on indicator design, indicator measurement, and system construction for application security management, and the evaluation dimensions are not comprehensive. (2) The construction process of existing application security indicators is mostly based on expert judgment and prior experience, which lacks objectivity. Summary of the invention

[0004] The purpose of the present invention is to propose a method, system, device and storage medium for building a banking application security indicator system based on management domain division in view of the shortcomings of the existing technology, so as to solve the problems of insufficient objectivity and incomplete evaluation dimensions in the existing quantitative research of application security indicators. The process is to decompose application security related work into multiple management domains, design a multi-layer indicator system, use the hierarchical analysis-CRITIC method to formulate indicator weights, collect work data and perform calculations, display the evaluation results based on large-screen charts, and continuously optimize the model.

[0005] The object of the present invention is achieved through the following technical solutions: In the first aspect, the present invention provides a method for constructing a banking application security indicator system based on management domain division, the method comprising the following steps:

[0006] (1) Divide banking application security management into five management domains based on work relevance and management continuity, namely security testing, asset security, component security, security assessment, and security governance.

[0007] (2) Based on the data feedback or risk points in each management domain, the management domain is further divided until the control content can be reflected in numbers, forming indicator items and constructing a three-level indicator system, including the corresponding target layer management domain, the first-level indicators of the management domain to which it belongs, and the second-level indicators under each first-level indicator;

[0008] (3) Calculate the value of the secondary indicator, summarize it based on the weight of the secondary indicator to obtain the corresponding calculation result of the primary indicator, and further summarize it based on the weight of the primary indicator to obtain the calculation result of the corresponding target layer management domain;

[0009] (4) Display the calculation results in step (3) in a graph, analyze the trend of calculation results of each management domain of application security management, evaluate the application security management and control situation and implement decisions.

[0010] Furthermore, security testing is further subdivided into four subdomains: project security testing, continuous penetration testing, code auditing, and security tool scanning; asset security is further subdivided into four subdomains: the number of abnormal ports, the number of sensitive assets, the number of expiring SSL certificates, and the number of path scanning vulnerabilities as corresponding first-level indicators; component security is further subdivided into two subdomains: the SCA component detection subdomain and the number of high-risk open source components introduced as corresponding first-level indicators; security assessment is further subdivided into four subdomains: the number of high-risk external assessments, the number of high-risk demand security assessments, the number of high-risk architecture design scheme assessments, and the number of high-risk production package scanning assessments as corresponding first-level indicators; security governance is further subdivided into three subdomains: security tool management, the proportion of security testers, and the number of unclosed vulnerability patches as corresponding first-level indicators.

[0011] Furthermore, three secondary indicators are set in each subdomain of security testing, namely defect density, delay rate and repair rate; three secondary indicators are set in each subdomain of component security, namely the proportion of high-risk vulnerabilities, the proportion of high-risk components and the proportion of high-risk licenses; two secondary indicators, namely the deployment coverage rate of gray box scanning tools and the access coverage rate of black box scanning tools, are set in the security tool management subdomain of security governance; no secondary indicators are set for asset security, security assessment and other subdomains of security governance.

[0012] Furthermore, the weights of the first-level indicators in each management domain are calculated based on the Delphi method and the hierarchical analysis method, and the weights of each second-level indicator under the first-level indicator are calculated based on the CRITIC method.

[0013] Furthermore, the corresponding primary indicator weights are corrected based on the weights of each secondary indicator using a parameter multiplication method.

[0014] Furthermore, for each set indicator, the linear regression equation of the indicator is obtained by fitting the historical data points, and the approximate extreme value of the linear regression equation is obtained to set the interval of the indicator and the corresponding calculation rules.

[0015] In a second aspect, the present invention further provides a banking application security indicator system construction system based on management domain division, the system comprising:

[0016] The management domain division module is used to divide the banking application security management according to work relevance and management continuity, and obtain five management domains: security testing, asset security, component security, security assessment and security governance;

[0017] The indicator setting module is used to further divide the management domain according to the data feedback or risk points in each management domain, until the control content can be reflected in numbers, form indicator items, and build a three-level indicator system, including the corresponding target layer management domain, the first-level indicators of the management domain to which it belongs, and the second-level indicators under each first-level indicator;

[0018] The indicator calculation module is used to calculate the secondary indicator value, summarize the secondary indicator weights to obtain the corresponding primary indicator calculation results, and further summarize the primary indicator weights to obtain the calculation results of the corresponding target layer management domain;

[0019] The result display module is used to display the calculation results of the indicator calculation module in charts, analyze the trend of calculation results of each management domain of application security management, evaluate the application security management and control situation and implement decisions.

[0020] In the third aspect, the present invention also provides a device for constructing a banking application security indicator system based on management domain division, comprising a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, it implements the method for constructing a banking application security indicator system based on management domain division.

[0021] In a fourth aspect, the present invention further provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the method for constructing a banking application security indicator system based on management domain division.

[0022] In a fifth aspect, the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the method for constructing a banking application security indicator system based on management domain division.

[0023] The beneficial effects of the present invention are as follows: by establishing a quantitative measurement standard for application security management and control based on indicators, the application security situation within a certain period of time can be intuitively grasped. The implementation of indicator backtracking and data decomposition can assist security personnel in quickly locating the reasons for fluctuations in key indicators, and accordingly adjust strategies such as security test resource allocation, component vulnerability repair priority, Internet high-risk asset exposure convergence, and security assessment access control, so as to improve the security of the application system and improve the work efficiency of application security. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 It is a flow chart of the method for building an application security indicator system provided by the present invention.

[0026] Figure 2 It is a schematic diagram of the indicator system of the application security indicator system construction method provided by the present invention.

[0027] Figure 3 It is a large-screen display process diagram of the application security indicator system construction method provided by the present invention.

[0028] Figure 4 It is a structural diagram of a banking application security indicator system construction device based on management domain division provided by the present invention. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with the accompanying drawings and implementation examples. It should be understood that the specific implementation examples described herein are only used to explain the present invention and are not used to limit the present invention.

[0030] like Figure 1 As shown, the specific steps of the method for building a banking application security indicator system based on management domain division provided by the present invention are as follows:

[0031] S1, indicator design and threshold setting

[0032] The method process of the present invention extracts indicators from the application security management and control process, and formulates reasonable thresholds of the indicators with the help of data mining methods.

[0033] S11 Identify the management domain

[0034] Identifying management domains is the process of identifying multiple sub-management domains for banking application security management.

[0035] The functional division method is based on the main functions in the organization. Functions of the same nature can only be placed in the same department, and the department is responsible for the execution of this function within the organization.

[0036] This embodiment refers to the concept of functional division method and divides application security management work into five management domains: security testing, asset security, component security, security assessment and security governance according to work relevance and management continuity, and carries out indicator design work in each domain.

[0037] S12 Design Index

[0038] The source of the indicator items is the data feedback of key tasks in each management domain or the embodiment of risk points. The management domain is further divided according to the actual situation until the control content can be reflected in numbers to form indicator items. The indicator items are divided into two categories: counting type and proportion type. The counting type can be directly observed, and the proportion type needs to be obtained through further calculation. This forms a three-level indicator system, such as Figure 2 shown.

[0039] The security test management domain is further divided into four subdomains: project security testing, continuous penetration testing, code auditing, and security tool scanning. In each subdomain, three indicators are set: defect density, delay rate, and repair rate. Defining defect density where c i The number of vulnerabilities found for each project or system, where N 1 The number of projects or systems tested cumulatively in this period; define the delay rate Where N d N is the total number of vulnerabilities in the current platform that have exceeded the final repair time. 2 is the total number of vulnerabilities in the platform; defines the repair rate Where N f is the total number of vulnerabilities fixed in the current platform, N 3 is the total number of vulnerabilities in the platform.

[0040] The asset security management domain sets four indicators: the number of abnormal ports, the number of sensitive assets, the number of expiring SSL certificates, and the number of path scanning vulnerabilities, all of which are obtained through statistical counting.

[0041] The component security management domain includes the SCA component detection subdomain and the open source component introduction high-risk quantity indicator. In the subdomain, three indicators are set: high-risk vulnerability ratio, high-risk component ratio, and high-risk license ratio. The number of high-risk open source components introduced is obtained through statistical counting. Define the high-risk vulnerability ratio Where N v N is the number of high-risk and above vulnerabilities found by the current SCA scan. 4is the total number of vulnerabilities; defines the proportion of high-risk components Where N c N is the number of open source components with high risk or above detected by SCA. 5 The total number of open source components in the product library; define the proportion of high-risk licenses Where N k N is the number of high-risk and above licenses detected by the current SCA. 6 The total number of licenses in the artifact library.

[0042] The security assessment management domain includes four indicators: the number of high-risk external assessments, the number of high-risk demand security assessments, the number of high-risk architecture design solution assessments, and the number of high-risk production package scanning assessments, all of which are obtained through statistical counting.

[0043] The security governance management domain is further divided into the security tool management subdomain and two indicators: the proportion of security testers and the number of unclosed loop vulnerability patches. The security tool management subdomain sets two indicators: gray box scanning tool deployment coverage and black box scanning tool access coverage, which reflect the promotion of vulnerability scanning tools. Defining gray box scanning tool deployment coverage Where N i is the number of applications that have deployed gray-box scanning agents, N 7 is the number of all application systems; defines the deployment coverage of black box scanning tools Where N d is the number of applications that have accessed the black box scanning tool API, N 8 It is the number of all application systems. The security tester ratio reflects the turnover of on-site security testers. Once the indicator is low, it is necessary to start recruiting testers. Define the security tester ratio Where N p is the number of on-site safety testers, N 9 is the number of all security testers. The number of unclosed vulnerability patches is obtained through statistical counting.

[0044] S13 Setting indicator thresholds and calculation methods

[0045] Summarize the calculation results of each management domain: where ω i is the weight of each management domain, calculated in step S3; i It is the summary calculation result of the indicators of the management domain. This can not only intuitively judge the overall application security control situation, but also obtain the situation of a certain management domain. If there is a secondary division in the management domain, further weighted calculation is required.

[0046] Determine the reasonable range of indicator values ​​and set the calculation rules for abnormal indicators to prepare for the calculation of the overall evaluation. Count-type indicators can formulate calculation rules based on the number of observations of abnormal indicators. Proportional indicators determine the reasonable range of values ​​through big data analysis and data mining, and set calculation rules. Taking the project security test defect density indicator in the security test management domain as an example, the defect density reflects the development safety quality and security testing level within a certain period of time. The higher the value, the more vulnerabilities the system may produce during this period, which requires special attention. By fitting historical data points, the linear regression equation of the indicator is obtained as y=0.497x-0.0012. At this time, the correlation coefficient R 2 = 0.00182, the approximate extreme value δ of the equation can be obtained. The reasonable threshold interval of the indicator is set in combination with the value of δ, and the expert assigns the value according to which threshold interval the indicator falls in, which is used for subsequent calculations.

[0047] S2, measure and process indicator data

[0048] Application security data is collected from different data sources, using methods such as automatic export, semi-automatic manual statistics and manual query. Some data can be directly used in the next step after collection, and some data needs to be processed and calculated as input data for indicator calculation. For example, the vulnerability management platform can export vulnerability data within a certain period of time according to the different subdomains described in S12, and the indicators can only be obtained after data cleaning and calculation. The number of security vulnerabilities measured in each project is accumulated and divided by the total number of projects to obtain the value of the "defect density" indicator in the project security test. In the asset security management domain, the value of the "abnormal port number" indicator can be obtained by directly querying the value within the statistical time period in the asset monitoring platform.

[0049] S3, implement quantitative evaluation

[0050] This step obtains the quantitative results of the application security management and control situation based on the indicator data obtained in step S2 and the threshold and calculation method in S1.

[0051] First, the weight of each indicator needs to be calculated. Specifically, the first step is to construct an indicator framework and assign codes to multi-level indicators; the second step is to use the Delphi method and the hierarchical analysis method to calculate the subjective weight of each intermediate indicator; the third step is to use the CRITIC method to calculate the objective weight of the bottom-level indicator; the fourth step is to comprehensively calculate the weights of indicators at all levels from the bottom up. Secondly, the obtained weights are combined with the indicators obtained in S13 for calculation. Finally, the overall numerical evaluation is obtained by a bottom-up and hierarchical summary method.

[0052] The Delphi method is a feedback anonymous inquiry method that ultimately reaches a consensus through multiple rounds of anonymous opinion collection, summary statistics, and anonymous feedback results.

[0053] The analytic hierarchy process (AHP) is a value-assigning evaluation method that decomposes decision-related elements into multiple levels, and conducts stereotyped quantitative analysis on this basis, which can set weights for indicators and quantify the selection of schemes.

[0054] The CRITIC method is also a value-assignment evaluation method that comprehensively measures the objective weight of the indicators based on the comparative strength of the evaluation indicators and the conflict between the indicators. Compared with the entropy weight method, the CRITIC method can comprehensively consider the mutual influence between attributes, reduce decision-making bias, and improve the accuracy of decision-making.

[0055] Taking the security test management domain as an example, the weight calculation process is introduced: the subjective weight is calculated using the hierarchical analysis method for the primary indicators, and the objective weight is calculated using the CRITIC weight method for the secondary indicators. Finally, the weight of the target layer is obtained by hierarchical combination. This method is used in the indicator quantification process of other management domains.

[0056] S31, calculate the management domain indicator weight

[0057] The first step is to construct the indicator framework. The indicator framework of the security test management domain is shown in Table 1.

[0058] Table 1 Security test management domain indicator framework

[0059]

[0060] The second step is to use the AHP method to calculate the weight vector of the first-level indicators

[0061] (1) Construct a judgment matrix. Use the Delphi method to construct a judgment matrix A = (a ij ) n×n , where the elements in A satisfy a ij >0, a ii = 1. The scale values ​​in the matrix are shown in Table 2.

[0062] Table 2 Judgment matrix scale meaning table

[0063] Scale meaning 1 Indicates that two elements have the same importance. 3 Indicates that compared with two elements, the former is more important than the latter 5 Indicates that compared with two elements, the former is significantly more important than the latter 7 Indicates that compared with two elements, the former is extremely important than the latter 9 Indicates that compared with two elements, the former is more important than the latter 2,4,6,8 Indicates the middle value of adjacent scale values reciprocal Indicates the importance of comparing the corresponding two factors in the order of swapping

[0064] In this embodiment, the judgment matrix for the primary indicators is shown in Table 3.

[0065] Table 3 First-level indicator judgment matrix

[0066] index C1 C2 C3 C4 C1 1 3 2 4 C2 1 / 3 1 1 / 2 4 C3 1 / 2 2 2 2 C4 1 / 4 1 / 4 1 / 4 1

[0067] (2) Calculate the weight vector. Calculate the nth root of the product of the scale values ​​in each row of Table 2 to obtain an n-dimensional vector in Normalize the vector and get the eigenvector ω=(ω 1 ,ω2 ,…,ω i ,…,ω n ),in

[0068] The security test management domain contains 4 subdomains. In this calculation, n=4 is taken. The calculated feature vector ω′ C =(0.45,0.20,0.24,0.11)

[0069] (3) Calculate the consistency test results. The maximum characteristic root CI = 4.207. According to the RI table, the corresponding RI value is 0.882. Therefore, CR = CI / RI = 0.078 < 0.1. Through a one-time test, the eigenvector of matrix A can be used to calculate the weight vector. Therefore, the subjective weight vector ω′ of the first-level indicator is C =(0.45,0.20,0.24,0.11).

[0070] The third step is to use the CRITIC method to calculate the secondary indicator weight vector

[0071] Assuming there are p indicators and n observation samples, construct the original indicator data matrix

[0072]

[0073] where x ij Represents the value of the jth indicator of the ith sample.

[0074] (1) Dimensionless processing. The lower the defect density and delay rate indicators, the better, and the higher the repair rate indicator, the better. In order to unify the indicator values, the repair rate d is taken as 1-d. The indicator is reversely processed and calculated:

[0075]

[0076] (2) Calculate the standard deviation S j :

[0077]

[0078] Where S j Represents the standard deviation of the j-th indicator.

[0079] (3) Calculate the correlation coefficient R j :

[0080]

[0081] where r ij Represents the correlation coefficient between evaluation indicators i and j.

[0082] (4) Calculate the information coefficient:

[0083]

[0084] (5) Calculate the weight value:

[0085]

[0086] Input the index data collected in S2, and after the above steps, obtain the objective weight vector of the secondary index

[0087] ω D =(0.02, 0.09, 0.09, 0.06, 0.04, 0.17, 0.04, 0.03, 0.08, 0.01, 0.13, 0.24).

[0088] Step 4: Comprehensively calculate weights

[0089] The first-level index is calculated by multiplying the parameters. The weight of the project safety test C1 is ω′ C1 =0.45*(0.02+0.09+0.09)=0.09. Calculate ω′ in sequence C2 ,ω′ C3 ,ω′ C4 They are 0.054, 0.036, and 0.042 respectively. After normalization, the weight vector ω of the first-level index is obtained C =(0.41, 0.24, 0.16, 0.19). Re-marking the indicator framework in the first step can produce Table 4.

[0090] Table 4 Security test management domain weight table

[0091]

[0092]

[0093] S32, calculation index

[0094] The collected data is input into the indicator calculation rules obtained in S13 to obtain the calculation results of the secondary indicators; the weighted summation calculated according to Table 4 is performed to obtain the calculation results of the primary indicators: where ω i is the weight of the first-level indicator, m i It is the calculation result of the second-level indicator under the first-level indicator. Taking the safety test management domain as an example, it is the defect density α 1 , Delay rate α 2 , repair rate α 3 The results are multiplied by the corresponding weights.

[0095] S33, calculate the overall evaluation

[0096] After all management domains are calculated, the weighted sum is used to obtain the quantitative calculation results of application security management and control within the time period. The calculation method is: where ω i is the weight of each management domain, ss i It is the percentage calculation result of each management domain.

[0097] S4, display evaluation results

[0098] The evaluation results are displayed based on large-screen charts. The process is as follows: Figure 3 The large screen elements include but are not limited to: displaying the percentage evaluation results in the center, using line charts to display the numerical trends of application security management and control calculation results and the numerical trends of calculation results of each management domain, using bar charts to decompose and display the calculation results of each management domain, and using tables to display key data.

[0099] S5, continuous improvement model

[0100] 1. According to the calculation results of each index, the fitting equation in step S13 is continuously optimized to make the obtained index threshold more reasonable.

[0101] 2. Carry out the Delphi method in step S31 to construct the judgment matrix every six months to make the indicator weight setting more in line with the actual management and control situation.

[0102] 3. Establish feedback channels, continuously collect feedback on decisions, and dynamically adjust the settings of indicator items.

[0103] Through the above steps, a quantitative indicator system for application security can be constructed to help financial technology personnel comprehensively evaluate their own application security management and control, and implement corresponding decisions based on the calculation results, so as to continuously improve their own application security management and control level.

[0104] Corresponding to the aforementioned embodiment of a method for constructing a banking application security indicator system based on management domain division, the present invention also provides an embodiment of a device for constructing a banking application security indicator system based on management domain division.

[0105] See also Figure 4 An embodiment of the present invention provides a device for constructing a banking application security indicator system based on management domain division, including a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, it is used to implement a method for constructing a banking application security indicator system based on management domain division in the above embodiment.

[0106] An embodiment of a device for constructing a banking application security indicator system based on management domain division provided by the present invention can be applied to any device with data processing capabilities, and the device with data processing capabilities can be a device or apparatus such as a computer. The device embodiment can be implemented through software, or through hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of any device with data processing capabilities in which it is located reading the corresponding computer program instructions in the non-volatile memory into the internal memory for execution. From a hardware perspective, if Figure 4 As shown, it is a hardware structure diagram of any device with data processing capability where a banking application security indicator system construction device based on management domain division provided by the present invention is located, except Figure 4 In addition to the processor, memory, network interface, and non-volatile memory shown, any device with data processing capabilities in which the apparatus in the embodiments is located may also include other hardware, generally based on the actual functions of the device with data processing capabilities, which will not be described in detail.

[0107] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0108] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative work.

[0109] An embodiment of the present invention further provides a computer-readable storage medium having a program stored thereon. When the program is executed by a processor, a method for constructing a banking application security indicator system based on management domain division in the above embodiment is implemented.

[0110] The computer-readable storage medium may be an internal storage unit of any device with data processing capability described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium may also be an external storage device of any device with data processing capability, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit and an external storage device of any device with data processing capability. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capability, and may also be used to temporarily store data that has been output or is to be output.

[0111] The present invention also provides a computer program product, including a computer program. When the computer program is executed by a processor, it implements the method for constructing a banking application security indicator system based on management domain division.

[0112] The above embodiments are used to illustrate the present invention rather than to limit the present invention. Any modification and change made to the present invention within the spirit of the present invention and the protection scope of the claims shall fall within the protection scope of the present invention.

Claims

1. A method for constructing a banking application security indicator system based on management domain division, characterized in that: The method comprises the following steps: (1) Divide banking application security management into five management domains based on work relevance and management continuity, namely security testing, asset security, component security, security assessment, and security governance. (2) Based on the data feedback or risk points in each management domain, the management domain is further divided until the control content can be reflected in numbers, forming indicator items and constructing a three-level indicator system, including the corresponding target layer management domain, the first-level indicators of the management domain to which it belongs, and the second-level indicators under each first-level indicator; (3) Calculate the value of the secondary indicator, summarize it based on the weight of the secondary indicator to obtain the corresponding calculation result of the primary indicator, and further summarize it based on the weight of the primary indicator to obtain the calculation result of the corresponding target layer management domain; (4) Display the calculation results in step (3) in a graph, analyze the trend of calculation results of each management domain of application security management, evaluate the application security management and control situation and implement decisions.

2. According to claim 1, a method for constructing a banking application security indicator system based on management domain division is characterized in that: Security testing is further subdivided into four subdomains: project security testing, continuous penetration testing, code auditing, and security tool scanning; asset security is further subdivided into four subdomains: the number of abnormal ports, the number of sensitive assets, the number of expiring SSL certificates, and the number of path scanning vulnerabilities as the corresponding first-level indicators; component security is further subdivided into two subdomains: the SCA component detection subdomain and the number of high-risk open source components introduced as the corresponding first-level indicators; security assessment is further subdivided into four subdomains: the number of high-risk external assessments, the number of high-risk demand security assessments, the number of high-risk architecture design plan assessments, and the number of high-risk production package scanning assessments as the corresponding first-level indicators; security governance is further subdivided into three subdomains: security tool management, the proportion of security testers, and the number of unclosed vulnerability patches as the corresponding first-level indicators.

3. A method for constructing a banking application security indicator system based on management domain division according to claim 2, characterized in that: Three secondary indicators are set in each subdomain of security testing: defect density, delay rate and repair rate. Three secondary indicators are set in each subdomain of component security: the proportion of high-risk vulnerabilities, the proportion of high-risk components and the proportion of high-risk licenses. Two secondary indicators, namely the deployment coverage rate of gray box scanning tools and the access coverage rate of black box scanning tools, are set in the security tool management subdomain of security governance. No secondary indicators are set for asset security, security assessment and other subdomains of security governance.

4. According to the method for constructing a banking application security indicator system based on management domain division according to claim 1, it is characterized in that: The weights of the first-level indicators in each management domain are calculated based on the Delphi method and the hierarchical analysis method, and the weights of the second-level indicators under the first-level indicators are calculated based on the CRITIC method.

5. A method for constructing a banking application security indicator system based on management domain division according to claim 4, characterized in that: Based on the weights of each secondary indicator, the corresponding primary indicator weights are corrected using the parameter multiplication method.

6. A method for constructing a banking application security indicator system based on management domain division according to claim 1, characterized in that: For each set indicator, the linear regression equation of the indicator is obtained by fitting the historical data points, and the approximate extreme value of the linear regression equation is obtained to set the indicator interval and the corresponding calculation rules.

7. A banking application security indicator system construction system based on management domain division, characterized in that: The system includes: The management domain division module is used to divide the banking application security management according to work relevance and management continuity, and obtain five management domains: security testing, asset security, component security, security assessment and security governance; The indicator setting module is used to further divide the management domain according to the data feedback or risk points in each management domain, until the control content can be reflected in numbers, form indicator items, and build a three-level indicator system, including the corresponding target layer management domain, the first-level indicators of the management domain to which it belongs, and the second-level indicators under each first-level indicator; The indicator calculation module is used to calculate the secondary indicator value, summarize the secondary indicator weights to obtain the corresponding primary indicator calculation results, and further summarize the primary indicator weights to obtain the calculation results of the corresponding target layer management domain; The result display module is used to display the calculation results of the indicator calculation module in charts, analyze the trend of calculation results of each management domain of application security management, evaluate the application security management and control situation and implement decisions.

8. A device for constructing a banking application security indicator system based on management domain division, comprising a memory and one or more processors, wherein the memory stores executable code, characterized in that: When the processor executes the executable code, a method for constructing a banking application security indicator system based on management domain division as described in any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by a processor, a method for constructing a banking application security indicator system based on management domain division as described in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, a method for constructing a banking application security indicator system based on management domain division as described in any one of claims 1 to 6 is implemented.

Images