IT asset health assessment method, system, equipment, and computer storage medium

Abstract

The present invention discloses an IT asset health assessment method, system, device and computer storage medium, relating to the field of asset security technology. The method comprises: obtaining asset data of IT assets and performing standardized processing; calculating protection attribute weights, business attribute weights, compliance loss points, risk attribute loss points and attack attribute loss points respectively according to protection indicators, business indicators, compliance indicators, risk indicators and attack indicators; calculating asset health, wherein the calculation formula for asset health assessment is: asset health = total score - business attribute weight * protection attribute weight * risk attribute loss points - attack attribute loss points - compliance loss points; and assessing the asset health status based on the asset health score.

Description

Technical Field

[0001] The present invention belongs to the field of asset security technology, and in particular relates to an IT asset health assessment method, system, device and computer storage medium. Background Art

[0002] IT asset health assessments examine and analyze the performance, reliability, and security of enterprise IT assets to determine their operational status and business support capabilities. This activity is crucial for businesses, helping to ensure stable business operations, improve asset utilization efficiency, reduce security risks, and ensure regulatory compliance. Current health assessment methods are typically limited to factors related to cyberattacks, such as the presence of vulnerabilities and intrusions. These methods fail to fully and comprehensively represent the security situation facing the asset in the current network environment, and therefore cannot provide accurate and effective feedback for subsequent security strategies, which can easily lead to IT asset security losses.

[0003] The information disclosed in this background technology section is only intended to enhance understanding of the overall background of the invention and should not be regarded as an admission or any form of suggestion that the information constitutes the prior art already known to a person skilled in the art. Summary of the Invention

[0004] The purpose of the present invention is to solve the problem of being unable to fully and comprehensively represent the security situation faced by assets in the current network environment and unable to provide accurate and effective feedback for subsequent security strategies, and to provide an IT asset health assessment method, system, device and computer storage medium.

[0005] A first aspect of the present invention provides an IT asset health assessment method, comprising:

[0006] Obtain asset data of IT assets and perform standardization;

[0007] Calculate the protection attribute weight, business attribute weight, compliance loss points, risk attribute loss points, and attack attribute loss points based on the protection indicators, business indicators, compliance indicators, risk indicators, and attack indicators.

[0008] Calculate asset health. The calculation formula for asset health assessment is: The calculation formula for health assessment is:

[0009] Asset health = total score - business attribute weight * protection attribute weight * risk attribute loss - attack attribute loss - compliance loss

[0010] Assess asset health based on asset health scores.

[0011] In one embodiment of the present invention, the business indicators include external network exposure, security level, and business system importance.

[0012] In one embodiment of the present invention, the protection indicators include the implementation status of protection measures and detection measures.

[0013] In one embodiment of the present invention, the compliance indicators include whether to conduct a real-time review and whether to register.

[0014] In one embodiment of the present invention, the risk indicators include whether there are super-power vulnerabilities, whether there are high-risk vulnerabilities, whether there are overdue unpatched vulnerabilities, whether there are POC exploit vulnerabilities, whether there are EXP vulnerabilities, the number of existing vulnerabilities, whether there are weak passwords, and whether there are high-risk ports.

[0015] In one embodiment of the present invention, the attack indicators include whether there is a serious attack warning, whether there is a high-risk attack warning, whether there is an unprocessed attack warning, and whether there are the same attack warnings from different sources.

[0016] A second aspect of the present invention provides an IT asset health assessment system, comprising:

[0017] An adaptation module for obtaining asset data of IT assets;

[0018] Data processing module; used for standardizing the asset data;

[0019] The analysis module is used to calculate the protection attribute weight, business attribute weight, compliance loss score, risk attribute loss score, and attack attribute loss score based on the protection index, business index, compliance index, risk index, and attack index of the standardized asset data; and calculate the asset health and assess the asset health status based on the asset health score;

[0020] The calculation formula for health assessment is:

[0021] Asset health = total score - business attribute weight * protection attribute weight * risk attribute loss - attack attribute loss - compliance loss.

[0022] A third aspect of the present invention provides an IT asset health assessment device, comprising a processor and a memory communicatively connected to the processor, wherein the memory stores computer instructions executable by the processor, and when the computer instructions are executed, the IT asset health assessment method as described above is implemented.

[0023] A fourth aspect of the present invention provides a computer-readable storage medium storing computer instructions, which implement the IT asset health assessment method as described above when the computer instructions are executed.

[0024] Compared with the prior art, the technical effects achieved by the present invention are as follows: This method is not limited to the attributes of the assets themselves, but also collects different types of asset attributes from external systems, realizes the aggregation of multi-source asset attributes, and more comprehensively evaluates the health of assets. In the above formula, 100 points represents the highest asset security, which includes three deduction factors, namely risk loss points, attack loss points, and compliance loss points. These three items reflect the health of the assets in the future, past, and present respectively, that is, the assessment of asset health refers to the status of the assets in the time dimension. The heatstroke prevention attribute weight and business attribute weight are deviation corrections made to the risk loss points, that is, the risk also needs to consider the importance of the business and the security protection situation. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 is a flow chart of an IT asset health assessment method according to an embodiment of the present invention;

[0026] Figure 2 FIG. 4 is a block diagram of an IT asset health assessment system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] Unless expressly stated otherwise, throughout the specification and claims, the term "comprise" or variations such as "include" or "comprising", etc., will be understood to include the stated elements or components but not to exclude other elements or other components.

[0028] The technical solutions of the present invention are described below by means of specific embodiments. It should be understood that one or more steps mentioned in the present invention do not exclude the presence of other methods and steps before and after the combination step, or other methods and steps may be inserted between these explicitly mentioned steps. It should also be understood that these examples are only used to illustrate the present invention and are not used to limit the scope of the present invention. Unless otherwise specified, the numbering of each method step is only for the purpose of identifying each method step, and does not limit the order of arrangement of each method or the scope of implementation of the present invention. Changes or adjustments in their relative relationships can also be regarded as the scope of implementation of the present invention without substantial changes in the technical content.

[0029] The sources of the raw materials and instruments used in the examples are not particularly limited and can be purchased from the market or prepared according to conventional methods known to those skilled in the art.

[0030] like Figures 1 to 2 As shown, the IT asset health assessment method according to the preferred embodiment of the present invention includes:

[0031] S1. Obtain and standardize the asset data of IT assets. The standardization method can be determined based on the needs.

[0032] S2. Calculate the protection attribute weight, business attribute weight, compliance loss score, risk attribute loss score, and attack attribute loss score based on the protection indicators, business indicators, compliance indicators, risk indicators, and attack indicators.

[0033] Business indicators include external network exposure, security level, and business system importance. For detailed calculation details of business attribute weights, please refer to Table 1 below.

[0034] Table 1 Business attribute weight calculation details

[0035]

[0036] For example, for an important Level 5 security protection business system, when exposed to an unknown external network, the calculated business indicator score is 1+0+0.6+0.1=1.7.

[0037] Protection indicators include the implementation of protective measures and detection measures. See Table 2 below for detailed calculations of protection attribute weights.

[0038] Table 2 Detailed calculation table of protection attribute weights

[0039]

[0040] For example, for an IT asset that is known to have RASP and HIDS but no WAF, the calculated score for the protection attribute is 1-0.2-0.1+0.2=0.9.

[0041] Compliance indicators include whether real-name registration is used and whether registration is performed. Please refer to Table 3 below for details on how compliance points are calculated.

[0042] Table 3 Compliance loss calculation details

[0043]

[0044] Risk indicators include the presence of super-power vulnerabilities, high-risk vulnerabilities, overdue unpatched vulnerabilities, POC exploit vulnerabilities, EXP vulnerabilities, the number of vulnerabilities, weak passwords, and high-risk ports. See Table 4 below for detailed calculation of risk points.

[0045] Table 4 Risk loss score calculation details

[0046]

[0047] For example, if there are only 12 vulnerabilities, including 1 critical vulnerability and 11 high-risk vulnerabilities, the risk loss score is calculated as 5+5+5=15 points.

[0048] Attack indicators include the presence of severe attack warnings, high-risk attack warnings, unhandled attack warnings, and identical attack warnings from different sources. See Table 5 below for details on calculating attack penalty points.

[0049] Table 5 Attack loss score calculation details

[0050]

[0051] S3. Calculate asset health. The calculation formula for asset health evaluation is:

[0052] Asset Health = Total Score - Business Attribute Weight * Protection Attribute Weight * Risk Attribute Loss - Attack Attribute Loss - Compliance Loss. The total score is 100.

[0053] The asset health status is assessed based on the asset health score. The specific evaluation method for asset health is shown in Table 6 below.

[0054] Table 6 Asset Health Details

[0055]

[0056] This method is not limited to the attributes of the asset itself, but also collects different types of asset attributes from external systems to achieve the aggregation of multi-source asset attributes and more comprehensive assessment of asset health. In the above formula, 100 points represents the highest asset security, which includes three deduction factors, namely risk loss points, attack loss points and compliance loss points. These three items reflect the health of the asset in the future, past and present respectively, that is, the assessment of asset health refers to the status of the asset in the time dimension. The heatstroke prevention attribute weight and business attribute weight are deviation corrections made to the risk loss point, that is, the risk also needs to consider the importance of the business and the security protection. Low business importance and good security protection mean a low probability of attack and low loss from attack.

[0057] The asset health score should be dynamic and needs to be recalculated after each data update to ensure the timeliness and accuracy of the asset health assessment.

[0058] As an implementation of the above method, the present invention discloses an embodiment of a system for locating the person responsible for unowned assets, which corresponds to the above method embodiment.

[0059] The IT asset health assessment system includes:

[0060] An adaptation module for obtaining asset data of IT assets;

[0061] Data processing module; used for standardizing the asset data;

[0062] The analysis module is used to calculate the protection attribute weight, business attribute weight, compliance loss score, risk attribute loss score, and attack attribute loss score based on the protection index, business index, compliance index, risk index, and attack index of the standardized asset data; and calculate the asset health and assess the asset health status based on the asset health score;

[0063] The calculation formula for health assessment is:

[0064] Asset health = total score - business attribute weight * protection attribute weight * risk attribute loss - attack attribute loss - compliance loss.

[0065] As an implementation of the above-described method, the present invention discloses an embodiment of an IT asset health assessment device, corresponding to the above-described method embodiment. The IT asset health assessment device includes a processor and a memory communicatively coupled to the processor. The memory stores computer instructions executable by the processor. When executed, the computer instructions implement the above-described IT asset health assessment method.

[0066] As an implementation of the above method, the present invention discloses an embodiment of a computer storage medium, which corresponds to the above method embodiment. The computer storage medium stores computer instructions that, when executed, implement the above IT asset health assessment method.

[0067] The foregoing descriptions of specific exemplary embodiments of the present invention are for purposes of illustration and description. These descriptions are not intended to limit the invention to the precise forms disclosed, and it is apparent that many variations and modifications are possible in light of the foregoing teachings. The exemplary embodiments have been selected and described for the purpose of explaining the specific principles of the invention and their practical application, thereby enabling those skilled in the art to realize and utilize a variety of exemplary embodiments of the invention and various options and modifications. The scope of the invention is intended to be defined by the claims and their equivalents.

Claims

1. A method for evaluating the health of IT assets, characterized in that: include: Obtain asset data of IT assets and perform standardization; Calculate the protection attribute weight, business attribute weight, compliance loss points, risk attribute loss points, and attack attribute loss points based on the protection indicators, business indicators, compliance indicators, risk indicators, and attack indicators. Calculate asset health. The calculation formula for asset health assessment is: Asset health = total score - business attribute weight * protection attribute weight * risk attribute loss - attack attribute loss - compliance loss. The risk attribute loss reflects the future health of the asset, the attack attribute loss reflects the past health of the asset, and the compliance loss reflects the current health of the asset. Assess asset health based on asset health scores.

2. The IT asset health assessment method according to claim 1, characterized in that: The business indicators include external network exposure, security level and importance of business systems.

3. The IT asset health assessment method according to claim 1, characterized in that: The protection indicators include the implementation of protection measures and detection measures.

4. The IT asset health assessment method according to claim 1, wherein: The compliance indicators include whether the real name is used and whether the registration is carried out.

5. The IT asset health assessment method according to claim 1, wherein: The risk indicators include whether there are super-power vulnerabilities, whether there are high-risk vulnerabilities, whether there are overdue unpatched vulnerabilities, whether there are POC exploit vulnerabilities, whether there are EXP vulnerabilities, the number of vulnerabilities, whether there are weak passwords, and whether there are high-risk ports.

6. The IT asset health assessment method according to claim 1, wherein: The attack indicators include whether there are serious attack warnings, whether there are high-risk attack warnings, whether there are unprocessed attack warnings, and whether there are the same attack warnings from different sources.

7. An IT asset health assessment system, characterized in that: include: An adaptation module for obtaining asset data of IT assets; Data processing module; Used to standardize the asset data; The analysis module is used to calculate the protection attribute weight, business attribute weight, compliance loss score, risk attribute loss score, and attack attribute loss score based on the protection index, business index, compliance index, risk index, and attack index of the standardized asset data; Calculate asset health and assess asset health based on the asset health score; The calculation formula for health assessment is: Asset health = total score - business attribute weight * protection attribute weight * risk attribute loss - attack attribute loss - compliance loss; the risk attribute loss reflects the future health of the asset, the attack attribute loss reflects the past health of the asset, and the compliance loss reflects the current health of the asset.

8. An IT asset health assessment device, characterized in that: The method comprises a processor and a memory in communication with the processor, wherein the memory stores computer instructions executable by the processor, and when the computer instructions are executed, the IT asset health assessment method according to any one of claims 1 to 6 is implemented.

9. A computer storage medium storing computer instructions, characterized in that: When the computer instructions are executed, the IT asset health assessment method according to any one of claims 1 to 6 is implemented.

Images