IT asset health degree assessment method, system and device, and computer storage medium

Abstract

The invention discloses an IT asset health degree assessment method, system and device and a computer storage medium, and relates to the technical field of asset security, and the method comprises the steps: obtaining asset data of IT assets, and carrying out the standardization processing; respectively calculating a protection attribute weight, a service attribute weight, a compliance loss score, a risk attribute loss score and an attack attribute loss score according to the conditions of the protection index, the service index, the compliance index, the risk index and the attack index; calculating the asset health degree, wherein the calculation formula of asset health degree evaluation is as follows: asset health degree = total score-business attribute weight * protection attribute weight * risk attribute loss score-attack attribute loss score-compliance loss score; and evaluating the health condition of the assets based on the score of the health degree of the assets.

Description

Technical Field

[0001] The present invention belongs to the field of asset security technology, and in particular relates to an IT asset health assessment method, system, device and computer storage medium. Background Art

[0002] IT asset health assessment is to detect and analyze the performance, reliability, security and other aspects of an enterprise's IT assets to determine their operating status and business support capabilities. This activity helps to ensure stable business operations, improve asset utilization efficiency, reduce security risks, and ensure compliance, which is crucial to the enterprise. The current health assessment method is usually limited to factors related to network attacks such as whether there are vulnerabilities and whether they have been invaded. It cannot fully and comprehensively represent the security situation faced by the asset in the current network environment, and it is also impossible to provide accurate and effective feedback for subsequent security strategies, which is easy to cause IT asset security losses.

[0003] The information disclosed in this background technology section is only intended to enhance the understanding of the overall background of the invention and should not be regarded as an acknowledgment or any form of suggestion that the information constitutes the prior art already known to a person skilled in the art. Summary of the invention

[0004] The purpose of the present invention is to solve the problem that it is impossible to fully and comprehensively represent the security situation faced by assets in the current network environment and to provide accurate and effective feedback for subsequent security strategies, and to provide an IT asset health assessment method, system, device and computer storage medium.

[0005] A first aspect of the present invention provides an IT asset health assessment method, comprising: Obtain asset data of IT assets and perform standardization; According to the protection index, business index, compliance index, risk index and attack index, the protection attribute weight, business attribute weight, compliance score loss, risk attribute score loss and attack attribute score loss are calculated respectively; Calculate asset health. The calculation formula for asset health assessment is: The calculation formula for health assessment is: Asset health = total score - business attribute weight * protection attribute weight * risk attribute loss - attack attribute loss - compliance loss Assess asset health based on asset health scores.

[0006] In one embodiment of the present invention, the business indicators include external network exposure, security level and business system importance.

[0007] In one embodiment of the present invention, the protection index includes the implementation status of protection measures and detection measures.

[0008] In one embodiment of the present invention, the compliance indicators include whether to conduct a real-time review and whether to register.

[0009] In one embodiment of the present invention, the risk indicators include whether there are super-power vulnerabilities, whether there are high-risk vulnerabilities, whether there are overdue unpatched vulnerabilities, whether there are POC exploit vulnerabilities, whether there are EXP vulnerabilities, the number of existing vulnerabilities, whether there are weak passwords, and whether there are high-risk ports.

[0010] In one embodiment of the present invention, the attack indicators include whether there is a serious attack warning, whether there is a high-risk attack warning, whether there is an unprocessed attack warning, and whether there are the same attack warnings from different sources.

[0011] A second aspect of the present invention provides an IT asset health assessment system, comprising: An adaptation module for obtaining asset data of IT assets; Data processing module; used for standardizing the asset data; The analysis module is used to calculate the protection attribute weight, business attribute weight, compliance loss score, risk attribute loss score, and attack attribute loss score of the standardized asset data according to the protection index, business index, compliance index, risk index, and attack index; and calculate the asset health and evaluate the asset health status based on the asset health score; The calculation formula for health assessment is: Asset health = total score - business attribute weight * protection attribute weight * risk attribute loss - attack attribute loss - compliance loss.

[0012] A third aspect of the present invention provides an IT asset health assessment device, comprising a processor and a memory communicatively connected to the processor, wherein the memory stores computer instructions executable by the processor, and when the computer instructions are executed, the IT asset health assessment method as described above is implemented.

[0013] A fourth aspect of the present invention provides a computer-readable storage medium storing computer instructions, which implement the IT asset health assessment method as described above when the computer instructions are executed.

[0014] Compared with the prior art, the technical effects achieved by the present invention are as follows: This method is not limited to the attributes of the assets themselves, but also collects different types of asset attributes from external systems, realizes the aggregation of multi-source asset attributes, and more comprehensively evaluates the health of assets. In the above formula, 100 points represents the highest asset security, which includes three deduction factors, namely risk points, attack points, and compliance points. These three items reflect the health of the assets in the future, past, and present respectively, that is, the assessment of asset health refers to the status of the assets in the time dimension. The heatstroke prevention attribute weight and business attribute weight are deviation corrections made to the risk points, that is, the risk also needs to consider the importance of the business and the security protection situation. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 is a flow chart of an IT asset health assessment method according to an embodiment of the present invention; Figure 2 is a block diagram of an IT asset health assessment system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0016] Unless explicitly stated otherwise, throughout the specification and claims, the term “comprise” or variations such as “include” or “comprising”, etc., will be understood to include the stated elements or components but not to exclude other elements or components.

[0017] The technical solution of the present invention is described below by specific embodiments. It should be understood that one or more steps mentioned in the present invention do not exclude the existence of other methods and steps before and after the combination step, or other methods and steps can be inserted between these explicitly mentioned steps. It should also be understood that these examples are only used to illustrate the present invention and are not used to limit the scope of the present invention. Unless otherwise specified, the numbering of each method step is only for the purpose of identifying each method step, and does not limit the order of arrangement of each method or limit the scope of implementation of the present invention. The change or adjustment of the relative relationship thereof can also be regarded as the scope of implementation of the present invention without substantial changes in the technical content.

[0018] The sources of the raw materials and instruments used in the examples are not particularly limited and can be purchased from the market or prepared according to conventional methods known to those skilled in the art.

[0019] like Figure 1 to Figure 2 As shown, the IT asset health assessment method according to the preferred embodiment of the present invention includes: S1. Obtain the asset data of IT assets and standardize them. The standardization method can be determined as needed.

[0020] S2. Calculate the protection attribute weight, business attribute weight, compliance score loss, risk attribute score loss, and attack attribute score loss respectively based on the protection index, business index, compliance index, risk index, and attack index; Business indicators include external network exposure, security level and business system importance. Please refer to Table 1 below for the specific calculation details of business attribute weights.

[0021] Table 1 Business attribute weight calculation details

[0022] For example, for an important security level 5 business system, when exposed to an unknown external network, the calculated score of the business indicator is 1+0+0.6+0.1=1.7.

[0023] The protection index includes the implementation of protection measures and detection measures. The specific calculation details of the protection attribute weights are shown in Table 2 below.

[0024] Table 2 Detailed table of protection attribute weight calculation

[0025] For example, for an IT asset that is known to have RASP and HIDS but no WAF, the calculated score for the protection attribute is 1-0.2-0.1+0.2=0.9.

[0026] Compliance indicators include whether the user is real-name registered and whether the user is registered. Please refer to Table 3 below for the specific calculation details of compliance loss points.

[0027] Table 3 Compliance loss calculation details

[0028] Risk indicators include whether there are super-power vulnerabilities, whether there are high-risk vulnerabilities, whether there are overdue unpatched vulnerabilities, whether there are POC exploit vulnerabilities, whether there are EXP vulnerabilities, the number of existing vulnerabilities, whether there are weak passwords, and whether there are high-risk ports. Please refer to the following Table 4 for the specific calculation details of risk loss points.

[0029] Table 4 Risk loss score calculation details

[0030] For example, if there are only 12 vulnerabilities, including 1 critical vulnerability and 11 high-risk vulnerabilities, the risk loss score is calculated as 5+5+5=15 points.

[0031] Attack indicators include whether there are serious attack warnings, whether there are high-risk attack warnings, whether there are unprocessed attack warnings, and whether there are the same attack warnings from different sources. For the specific calculation details of attack loss points, please refer to Table 5 below.

[0032] Table 5 Attack loss score calculation details

[0033] S3. Calculate asset health. The calculation formula for asset health evaluation is: Asset health = total score - business attribute weight * protection attribute weight * risk attribute loss - attack attribute loss - compliance loss. The total score is 100 points.

[0034] The asset health is assessed based on the asset health score. The specific assessment method for asset health is shown in Table 6 below.

[0035] Table 6 Asset Health Details

[0036] This method is not limited to the attributes of the assets themselves, but also collects different types of asset attributes from external systems to achieve the aggregation of multi-source asset attributes and more comprehensively evaluate the health of assets. In the above formula, 100 points represents the highest asset security, which includes three deduction factors, namely risk loss points, attack loss points and compliance loss points. These three items reflect the health of the assets in the future, past and present respectively, that is, the assessment of asset health refers to the status of the assets in the time dimension. The heatstroke prevention attribute weight and business attribute weight are deviation corrections made to the risk loss points, that is, the risk also needs to consider the importance of the business and the security protection. Low business importance and good security protection mean a low probability of attack and low loss from attack.

[0037] The asset health score should be dynamic and needs to be recalculated after each data update to ensure the timeliness and accuracy of the asset health assessment.

[0038] As an implementation of the above method, the present invention discloses an embodiment of a system for locating the ownerless asset responsible person, which corresponds to the above method embodiment.

[0039] The IT asset health assessment system includes: An adaptation module for obtaining asset data of IT assets; Data processing module; used for standardizing the asset data; The analysis module is used to calculate the protection attribute weight, business attribute weight, compliance loss score, risk attribute loss score, and attack attribute loss score of the standardized asset data according to the protection index, business index, compliance index, risk index, and attack index; and calculate the asset health and evaluate the asset health status based on the asset health score; The calculation formula for health assessment is: Asset health = total score - business attribute weight * protection attribute weight * risk attribute loss - attack attribute loss - compliance loss.

[0040] As an implementation of the above method, the present invention discloses an embodiment of an IT asset health assessment device, which corresponds to the above method embodiment. The IT asset health assessment device includes a processor and a memory connected to the processor in communication, the memory stores computer instructions that can be executed by the processor, and the above IT asset health assessment method is implemented when the computer instructions are executed.

[0041] As an implementation of the above method, the present invention discloses an embodiment of a computer storage medium, which corresponds to the above method embodiment. The computer storage medium stores computer instructions, which implement the above IT asset health assessment method when executed.

[0042] The foregoing description of specific exemplary embodiments of the present invention is for the purpose of illustration and demonstration. These descriptions are not intended to limit the present invention to the precise form disclosed, and it is clear that many changes and variations can be made based on the above teachings. The purpose of selecting and describing the exemplary embodiments is to explain the specific principles of the present invention and its practical application, so that those skilled in the art can realize and utilize various different exemplary embodiments of the present invention and various different selections and changes. The scope of the present invention is intended to be limited by the claims and their equivalents.

Claims

1. A method for evaluating the health of IT assets, characterized in that: include: Obtain asset data of IT assets and perform standardization; According to the protection index, business index, compliance index, risk index and attack index, the protection attribute weight, business attribute weight, compliance score loss, risk attribute score loss and attack attribute score loss are calculated respectively; Calculate asset health. The calculation formula for asset health assessment is: Asset health = total score - business attribute weight * protection attribute weight * risk attribute loss - attack attribute loss - compliance loss; Assess asset health based on asset health scores.

2. The IT asset health assessment method according to claim 1, characterized in that: The business indicators include external network exposure, security level and importance of business systems.

3. The IT asset health assessment method according to claim 1, characterized in that: The protection indicators include the implementation of protection measures and detection measures.

4. The IT asset health assessment method according to claim 1, characterized in that: The compliance indicators include whether the real name is used and whether it is registered.

5. The IT asset health assessment method according to claim 1, characterized in that: The risk indicators include whether there are super-power vulnerabilities, whether there are high-risk vulnerabilities, whether there are overdue unpatched vulnerabilities, whether there are POC exploit vulnerabilities, whether there are EXP vulnerabilities, the number of existing vulnerabilities, whether there are weak passwords, and whether there are high-risk ports.

6. The IT asset health assessment method according to claim 1, characterized in that: The attack indicators include whether there is a serious attack warning, whether there is a high-risk attack warning, whether there is an unprocessed attack warning, and whether there are the same attack warnings from different sources.

7. An IT asset health assessment system, characterized in that: include: An adaptation module for obtaining asset data of IT assets; Data processing module; Used to standardize the asset data; The analysis module is used to calculate the protection attribute weight, business attribute weight, compliance loss score, risk attribute loss score, and attack attribute loss score based on the protection index, business index, compliance index, risk index, and attack index of the standardized asset data; And calculate the asset health and assess the asset health status based on the asset health score; The calculation formula for health assessment is: Asset health = total score - business attribute weight * protection attribute weight * risk attribute loss - attack attribute loss - compliance loss.

8. An IT asset health assessment device, characterized in that: It comprises a processor and a memory in communication with the processor, wherein the memory stores computer instructions executable by the processor, and when the computer instructions are executed, the IT asset health assessment method as described in any one of claims 1 to 6 is implemented.

9. A computer storage medium storing computer instructions, characterized in that: When the computer instructions are executed, the IT asset health assessment method as described in any one of claims 1 to 6 is implemented.

Images