A method and system for cybersecurity assessment based on a multi-level cybersecurity indicator system

Abstract

This application discloses a method for cybersecurity assessment based on a multi-level cybersecurity indicator system, comprising: obtaining multiple objects to be assessed from a group enterprise; determining the cybersecurity indicators included in the lowest indicator level of the objects to be assessed, and the current measurement value corresponding to each cybersecurity indicator; determining the relative activity factor and relative improvement factor corresponding to each cybersecurity indicator included in the lowest indicator level of the objects to be assessed; calculating the dynamic measurement value of the corresponding cybersecurity indicator based on the current measurement value, the relative activity factor, and the relative improvement factor; calculating the total cybersecurity score of each object to be assessed iteratively level by level based on the dynamic measurement value of each cybersecurity indicator of each object to be assessed; and conducting a cybersecurity assessment on each object to be assessed based on the total cybersecurity score.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for network security assessment based on a multi-level network security indicator system. Background Technology

[0002] Against the backdrop of accelerated digital and intelligent evolution, cybersecurity has become a strategic core capability to ensure high-quality enterprise development. Various cybersecurity entities, in the process of continuously advancing information technology construction, industrial intelligent integration, and group-based operations, often face multi-dimensional cybersecurity challenges from compliance policies, business system security, data asset protection, and personnel security awareness. Therefore, objectively assessing the cybersecurity status of these entities is particularly important.

[0003] Within large corporations, scientifically and effectively comparing the cybersecurity construction and operation levels of their subsidiaries is a global challenge. On one hand, subsidiaries have different main businesses, varying levels of IT sophistication, and consequently, different levels of cybersecurity construction and operation. Any simplistic, one-size-fits-all assessment method would be unfair. On the other hand, the ultimate goal of evaluating subsidiaries is to promote the continuous and healthy development of their cybersecurity construction and operation. Therefore, the evaluation method must not only reflect the shortcomings in a subsidiary's cybersecurity construction and operation but also encourage continuous improvement and enhancement.

[0004] Specifically, it mainly includes the following aspects: 1. Fairness: All subsidiaries should be assessed according to the same logical structure to reduce human bias.

[0005] 2. Universality: The weight calculation is based on the group's global data and has the ability to adapt across regions and businesses.

[0006] 3. Maintainability: A unified set of weight tables should be maintained and updated as much as possible, rather than allowing each subsidiary to operate independently.

[0007] 4. Strategic alignment: Subsidiary assessments should be consistent with and fully integrated with the group's unified business structure.

[0008] In existing technologies, cybersecurity assessments are typically conducted using either capability classification or scenario classification. However, capability classification is mechanical and rigid, detached from practical business needs, and its assessment indicators are applied in a one-size-fits-all manner. Scenario classification, on the other hand, is prone to incomplete coverage, creating management gaps. Therefore, neither of the existing assessment methods can meet the actual needs of the business.

[0009] Therefore, there is an urgent need to provide a cybersecurity assessment solution that can address the above-mentioned technical issues. Summary of the Invention

[0010] To address the above technical issues, this invention provides a method and system for network security assessment based on a multi-level network security indicator system. This system can automatically adapt to different scenarios and conduct accurate, comprehensive, and objective network security assessments for group enterprises without requiring frequent adjustments to the multi-level network security indicator system framework.

[0011] On one hand, embodiments of the present invention provide a method for network security assessment based on a multi-level network security indicator system. The method is used in a network security assessment system, which deploys a multi-level network security indicator system. This multi-level network security indicator system includes: multiple indicator levels, each indicator level containing at least one network security indicator, and each higher-level network security indicator consisting of at least one lower-level network security indicator. The method includes: Identify multiple entities within a group of enterprises that require cybersecurity assessment; Determine the network security indicators included in the lowest indicator level of the object to be evaluated, and the current measurement value corresponding to each network security indicator; The relative activity factor and relative improvement factor are determined for each cybersecurity indicator included in the lowest indicator level of the object to be evaluated. The relative activity factor is used to characterize the proportion of the activity level of a certain scenario in all scenarios defined by the multi-level cybersecurity indicator system to the total activity level of all scenarios. The relative improvement factor is used to characterize the contribution of the relative improvement of the score of a certain indicator within a set period to the score of that indicator to the overall score of the indicator. Based on the current measurement value, the relative activity factor, and the relative improvement factor, the dynamic measurement value of the corresponding network security indicator is calculated. Based on the dynamic measurement values ​​of each network security indicator of each object to be evaluated, the total network security score of each object to be evaluated is calculated iteratively step by step. Based on the total cybersecurity score, a cybersecurity assessment is conducted on each object to be evaluated.

[0012] Furthermore, the multi-level cybersecurity indicator system is a three-level cybersecurity indicator system. The cybersecurity indicators, arranged from highest to lowest level, include: Level 1 indicators, Level 2 indicators, and Level 3 indicators. Each Level 1 indicator includes multiple Level 2 indicators, and each Level 2 indicator includes at least one Level 3 indicator. The lowest level of the evaluation object contains Level 3 cybersecurity indicators. Determining the relative activity factor corresponding to each cybersecurity indicator in the lowest level of the evaluation object includes: The relative activity factor corresponding to each tertiary indicator of the object to be evaluated is determined based on the following formula; definition NThe first scenario, the... i Relative activity factor of each scenario for: ; in, For the first i The activity parameters for each scenario are used to characterize the frequency of operations. The activity parameters include one or more of the following: number of visits, number of confirmation updates, and number of confirmation executions. The number of visits is used to characterize the intensity of interaction between the user and the system; the number of confirmation updates is used to characterize the frequency of control measures or actual operations triggered; and the number of confirmation executions is used to characterize the intensity of interaction with data resources. Indicates the first i The weighting factor for activity in each scenario, with the denominator representing the weighted sum of activity across all scenarios, and the sum of activity factors for all scenarios being 1.

[0013] Furthermore, determining the relative improvement factor for each cybersecurity indicator included in the lowest indicator level of the object to be evaluated includes: Assume the first The first subject to be evaluated The current value of the third-level indicator is The historical average value within the evaluation period is Then the percentage deviation of the third-level indicators of the object to be evaluated for: ; Then the first The first subject to be evaluated Relative improvement factor of the third-level indicators for: ; in, The maximum percentage deviation among all tertiary indicators for all objects to be evaluated. The minimum percentage deviation among all tertiary indicators for all objects to be evaluated, 0 ≤ α <1.

[0014] Furthermore, the method also includes: Determine the business weight and dynamic weight corresponding to each tertiary indicator; Based on the dynamic measurement values ​​of each cybersecurity indicator for each of the aforementioned objects to be evaluated, the total cybersecurity score for each object to be evaluated is calculated iteratively at each level, including: Based on the dynamic measurement values ​​of each of the three-level indicators for each of the objects to be evaluated, calculate the cybersecurity score corresponding to each of the three-level indicators. Based on the network security scores corresponding to the three-level indicators, as well as the corresponding business weights and dynamic weights, the network security scores of each secondary indicator are calculated. Based on the cybersecurity scores of each secondary indicator and the corresponding expert weights, the cybersecurity scores of each primary indicator are calculated. Based on the cybersecurity scores of each primary indicator and the corresponding expert weights, the total cybersecurity score for each of the objects to be evaluated is calculated.

[0015] Furthermore, the step of iteratively calculating the total cybersecurity score for each object to be evaluated based on the dynamic measurement values ​​of each cybersecurity indicator of each object to be evaluated includes: The total cybersecurity score for each of the objects to be evaluated is calculated based on the following formula: ; Where S refers to the total cybersecurity score of the object being evaluated, and V... i This refers to the cybersecurity score of the i-th level 3 indicator of the object to be evaluated. This refers to the business weight corresponding to the i-th tertiary indicator. B refers to the dynamic weight of the i-th tertiary indicator. j The j-th secondary indicator of the object to be evaluated. The expert weight of the j-th secondary indicator, A k The k-th primary indicator of the object to be evaluated. The expert weight refers to the k-th primary indicator; the expert weight is used to characterize the relative importance of the corresponding level indicator among the other indicators at the same level.

[0016] Furthermore, the primary indicators include at least two of the following: safety management, safety technology, safety construction, and safety operation; The secondary indicators under the aforementioned safety management include at least two of the following: safety organization, safety system, and personnel management. The secondary indicators under the aforementioned security technology include at least two of the following: data center security, network security, host security, application security, data security, and endpoint security. The secondary indicators under the security construction include: security investment, completion rate of the three synchronizations, and at least two of the following: supply chain security. The secondary indicators under the security operation include at least two of the following: security monitoring and early warning, major event protection, graded protection management, inspection and supervision management, security vulnerability management, security incident management, emergency drill management, asset management, security operation and maintenance, security notification management, security training management, and attack and defense drill management. The three-level indicators under the security organization include: security organization completeness rate, implementation status of separation of duties among the three personnel, and whether a specific organization within the enterprise participates in at least one of the following cybersecurity-related thematic meetings: The three-level indicators under the security system include at least one of the following: the completeness of the network security management system and the timeliness of network security system updates; The three-level indicators under personnel management include at least one of the following: personnel background check coverage rate, job confidentiality agreement signing rate, timely account cancellation rate of departing employees, and privileged account control rate. The three-level indicators for data center security include at least one of the following: the completeness of the data center's physical protection, the frequency of data center inspections, and the status of data center access control. The three-level indicators under network security include at least one of the following: network partitioning and isolation implementation status, network boundary security device deployment rate, and network boundary device policy update timeliness rate. The three-level indicators under host security include at least one of the following: host security protection coverage, host patch update timeliness rate, and number of host security incidents; The three-level indicators under application security include at least one of the following: application system three-person role configuration rate, user identity authentication strategy strength, application system two-factor authentication configuration rate, and middleware component patch update rate. The three-level indicators under data security include at least one of the following: data storage encryption coverage, data backup coverage, external business data encryption transmission coverage, and data classification and grading implementation rate. The three-level indicators under the terminal security include at least one of the following: terminal protection system installation rate, terminal behavior audit execution rate, and terminal access percentage. The three-level indicators under the aforementioned safety investment include: the proportion of safety investment; The three-level indicators under the three-synchronization completion rate include: synchronous planning completion rate, synchronous construction completion rate, and synchronous operation completion rate; The three-level indicators under supply chain security include at least one of the following: supply chain security risk assessment coverage, open source component security inspection rate, and open source component asset inventory rate. The three-level indicators under the security monitoring and early warning system include at least one of the following: network security monitoring and protection capability coverage and threat alarm handling rate; The three-level indicators under the major event protection include at least one of the following: whether a self-inspection was carried out in the early stage of the major event protection, the score completed during the duty period, the timeliness of the event response during the major event, and whether a summary and review was carried out in the later stage of the major event protection. The three-level indicators under the graded protection management include at least one of the following: graded filing completion rate, graded protection assessment completion rate, and graded protection assessment rectification completion rate. The three-level indicators under the inspection and supervision management include at least one of the following: the timely completion rate of inspection and supervision tasks and the timely completion rate of problem rectification. The three-level indicators under the security vulnerability management include at least one of the following: vulnerability scan execution rate, vulnerability remediation timeliness rate, and vulnerability handling false alarm rate. The three-level indicators under the security incident management include at least one of the following: incident response plan completeness rate, security incident handling timeliness rate, and number of security incidents; The three-level indicators under the emergency drill management include at least one of the following: drill plan development status, drill execution rate according to plan, and drill problem rectification completion rate. The three-level indicators under asset management include at least one of the following: asset reporting completeness, asset confirmation timeliness, and asset data accuracy. The three-level indicators under the security operation and maintenance include at least one of the following: security log audit coverage, whether security inspections are carried out, whether security self-inspections are carried out, security device policy optimization score, and security baseline verification coverage. The three-level indicators under the security notification management include at least one of the following: notification response timeliness rate and notification issue closure rate; The three-level indicators under the security training management include at least one of the following: number of self-organized training sessions, security training participation rate, security training assessment pass rate, cybersecurity knowledge assessment participation rate, and cybersecurity knowledge assessment pass rate. The three-level indicators under the attack and defense exercise management include at least one of the following: whether a risk assessment was conducted before the attack and defense exercise, the timeliness of vulnerability rectification during the exercise, the completion rate of vulnerability rectification during the exercise, and whether a summary and review of the attack and defense exercise was conducted.

[0017] Furthermore, the method also includes: Based on the reporting applications sent by each entity to be evaluated, the three-level network security indicator system is adaptively adjusted, and the first-level, second-level, and third-level indicators suitable for each entity to be evaluated are determined. The cybersecurity assessment of each entity to be evaluated, based on the total cybersecurity score, includes: Based on the total cybersecurity score, each object to be evaluated is ranked. Based on the total network security score and the pre-set network security level classification standards, the network security level to which each object to be evaluated belongs is determined.

[0018] On the other hand, embodiments of the present invention provide a network security assessment system, wherein the system deploys a multi-level network security indicator system, the multi-level network security indicator system comprising: multiple indicator levels, each indicator level containing at least one network security indicator, and each higher-level network security indicator consisting of at least one lower-level network security indicator, the system comprising: The acquisition module is used to acquire multiple entities from group enterprises that require cybersecurity assessment. The first determining module is used to determine the network security indicators included in the lowest indicator level of the object to be evaluated, and the current measurement value corresponding to each network security indicator. The second determining module is used to determine the relative activity factor and relative improvement factor corresponding to each network security indicator included in the lowest indicator level of the object to be evaluated. The relative activity factor is used to characterize the proportion of the activity level of a certain scenario in all scenarios defined by the multi-level network security indicator system to the total activity level of all scenarios. The relative improvement factor is used to characterize the contribution of the relative improvement of the score of a certain indicator within a set period to the score of that indicator to the overall score of the indicator. The first calculation module is used to calculate the dynamic measurement value of the corresponding network security indicator based on the current measurement value, the relative activity factor and the relative improvement factor. The second calculation module is used to iteratively calculate the total cybersecurity score of each object to be evaluated based on the dynamic measurement values ​​of each cybersecurity indicator of each object to be evaluated. The assessment module is used to conduct a cybersecurity assessment of each object to be assessed based on the total cybersecurity score.

[0019] Thirdly, embodiments of the present invention provide an electronic device, including: a memory and a processor, wherein the memory and the processor are connected; Memory, used to store computer programs; A processor is used to invoke a computer program stored in memory to perform any of the above methods.

[0020] Fourthly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when run by a computer, performs any of the methods described above.

[0021] This invention provides a method for cybersecurity assessment based on a multi-level cybersecurity indicator system. The method involves: obtaining multiple assessment targets from a group enterprise; determining the cybersecurity indicators included in the lowest indicator level of each assessment target, and the current measurement value corresponding to each cybersecurity indicator; determining the relative activity factor and relative improvement factor corresponding to each cybersecurity indicator in the lowest indicator level of each assessment target, where the relative activity factor represents the proportion of the activity level of a particular scenario in all scenarios defined by the multi-level cybersecurity indicator system to the total activity level of all scenarios; the relative improvement factor representing the contribution of the relative improvement of an indicator's score within a set period to the overall indicator score; calculating the dynamic measurement value of the corresponding cybersecurity indicator based on the current measurement value, the relative activity factor, and the relative improvement factor; iteratively calculating the total cybersecurity score for each assessment target based on the dynamic measurement values ​​of each cybersecurity indicator for each assessment target; and conducting a cybersecurity assessment for each assessment target based on the total cybersecurity score. This method and system can automatically adapt to different scenarios and conduct accurate, comprehensive, and objective cybersecurity assessments for group enterprises without requiring frequent adjustments to the multi-level cybersecurity indicator framework. Attached Figure Description

[0022] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0023] Figure 1 A flowchart illustrating a method for network security assessment based on a multi-level network security indicator system, provided in this application embodiment; Figure 2 This is a block diagram of a network security assessment system provided in an embodiment of this application. Detailed Implementation

[0024] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with specific embodiments and accompanying drawings. It should be particularly noted that the embodiments described in this application are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0025] It should be noted that, unless otherwise defined, the technical or scientific terms used in the embodiments of this application should have the ordinary meaning understood by one of ordinary skill in the art to which this application pertains. The terms "first," "second," and similar terms used in the embodiments of this application do not indicate any order, quantity, or importance, but are merely used to distinguish different components. Terms such as "comprising" or "including" mean that the element or object preceding the word covers the element or object listed after the word and its equivalents, without excluding other elements or objects. Terms such as "connected" or "linked" are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. Terms such as "upper," "lower," "left," and "right" are only used to indicate relative positional relationships; when the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0026] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present application.

[0027] One embodiment of this patent application provides a method for network security assessment based on a multi-level network security indicator system, such as... Figure 1 As shown, the method is used in a network security assessment system. The system deploys a multi-level network security indicator system, which includes multiple indicator levels. Each indicator level contains at least one network security indicator, and each higher-level network security indicator is composed of at least one lower-level network security indicator. The method includes steps 101-106: Step 101: Obtain multiple entities from group companies that require cybersecurity assessment.

[0028] The entities to be evaluated can be some or all of the subsidiaries of a group company.

[0029] Step 102: Determine the network security indicators included in the lowest indicator level of the object to be evaluated, and the current measurement value corresponding to each network security indicator.

[0030] Step 103: Determine the relative activity factor and relative improvement factor corresponding to each network security indicator included in the lowest indicator level of the object to be evaluated. The relative activity factor is used to characterize the proportion of the activity level of a certain scenario in all scenarios defined by the multi-level network security indicator system to the total activity level of all scenarios. The relative improvement factor is used to characterize the contribution of the relative improvement of the score of a certain indicator within a set period to the score of that indicator to the overall score of the indicator.

[0031] Step 104: Based on the current measurement value, the relative activity factor, and the relative improvement factor, calculate the dynamic measurement value of the corresponding network security indicator.

[0032] Within the framework of hierarchical index calculation, in principle, as long as the measurement value matrix is ​​obtained... That is, by measuring each indicator specifically, the overall indicator can be calculated. I However, directly using the original measured values ​​(current measured values) to calculate the overall index will lead to the following problems: 1. It failed to highlight the key tasks recently emphasized by the head office and could not better reflect the progress made by each subsidiary in the company's recent key cybersecurity initiatives.

[0033] 2. It failed to highlight the specific progress made by each subsidiary in any single indicator.

[0034] For example, in the previous assessment cycle, Company A scored 40 points on a certain indicator, while Company B scored 50 points on the same indicator. In the latest assessment, Company A improved to 50 points, while Company B remained at 50 points. From a management perspective, although the two companies currently have the same score, Company A's progress should be encouraged, while Company B's stagnation should be spurred on.

[0035] To address the two issues mentioned above, it is necessary to design a method for calculating dynamic measurements from a scenario-based perspective and define relative activity factors accordingly. and relative improvement factor and fusion factors And there are: .

[0036] If the first The first subsidiary The current measurement value of the evaluation indicator is Then its dynamic measurement value is: .

[0037] Step 105: Based on the dynamic measurement values ​​of each network security indicator of each object to be evaluated, calculate the total network security score of each object to be evaluated iteratively step by step.

[0038] Step 106: Based on the total cybersecurity score, conduct a cybersecurity assessment for each object to be evaluated.

[0039] It should be noted that the design logic of the multi-level network security indicator system combining scenario-based analysis in this application embodiment is as follows: The multi-level cybersecurity indicator system aims to comprehensively support the quantifiable, accountable, and sustainable cybersecurity governance of group enterprises by constructing a scientific, standardized, and executable quantitative evaluation model. The indicator design is based on the group's relevant cybersecurity systems and security construction guidelines, and is guided by the needs of hierarchical and categorized governance, constructing a layered, logically closed-loop indicator system structure. The system adopts a "three-level indicator architecture," progressively aggregating and abstracting indicators from bottom to top: Level 3 indicators are defined as collectable, calculable, and executable safety work units, mainly covering basic tasks such as safety training, system implementation, and incident handling. Secondary indicators are responsible for the aggregation and analysis within the governance module, reflecting the process performance of responsible units or business processes; The primary indicator represents the overall level of cybersecurity capabilities of each subsidiary and is used to support macro-level governance and decision-making.

[0040] To achieve accurate measurement and dynamic adaptation, the system technically integrates business weighting rules and dynamic weighting factors, ensuring the comparability and relevance of indicator scores across different subsidiaries, business modules, and usage scenarios. Furthermore, the indicator system supports deep integration with the group's comprehensive cybersecurity business management platform, enabling full lifecycle management from indicator configuration, data collection, model operation, result evaluation, rectification closure, to continuous optimization. This design logic not only guarantees quantitative feedback on policy implementation but also provides reliable support for the standardization, process-orientation, and intelligent improvement of cybersecurity work.

[0041] Specifically, the multi-level cybersecurity indicator system is a three-level cybersecurity indicator system. The cybersecurity indicators are arranged in descending order of level: Level 1 indicators, Level 2 indicators, and Level 3 indicators. Each Level 1 indicator includes multiple Level 2 indicators, and each Level 2 indicator includes at least one Level 3 indicator. The cybersecurity indicators included in the lowest indicator level of the object to be evaluated are Level 3 indicators. Determining the relative activity factor corresponding to each cybersecurity indicator included in the lowest indicator level of the object to be evaluated includes: determining the relative activity factor corresponding to each Level 3 indicator included in the object to be evaluated based on the following formula.

[0042] Regarding the relative activity factor Act : Considering that scenario categorization allows for the linking of evaluation metrics with specific work content or actions, when the head office organizes its subsidiaries to jointly carry out recent key tasks, one or more specific scenarios will be activated. When the head office uses an online management system to monitor the activities of its subsidiaries, the system can automatically perceive the current key tasks by analyzing the frequency of operations on specific scenario modules, without requiring managers to issue specific instructions.

[0043] Therefore, we can define N The first scenario, the... i Relative activity factor of each scenario for: ; in, For the first i The activity parameter for each scenario is used to characterize the frequency of operations. Applying this factor to the dynamic adjustment of various indicator measurements within that scenario reflects the performance of each subsidiary on key company projects. The larger the relative activity factor of a scenario, the greater the impact of its indicator values ​​on the overall indicators. The activity parameter may include one or more of the following: access count, confirmation update count, and confirmation execution count. The access count characterizes the intensity of interaction between the user and the system; the confirmation update count characterizes the frequency of control measures or actual operations triggered; and the confirmation execution count characterizes the intensity of interaction between the (module) and data resources. Indicates the first i The weighting factor for the activity level of each scene can be adjusted. For example, if a scene is rarely triggered, but does require special attention when it is, then a larger weighting factor can be assigned to that scene. Values, and vice versa. Value, but generally speaking, It can be set to 1 by default. The denominator refers to the weighted sum of activity across all scenarios, and the sum of the activity factors across all scenarios is 1.

[0044] In one embodiment, determining the relative improvement factor for each cybersecurity metric included in the lowest metric level of the object to be evaluated includes: According to the principle of information entropy, the more significant the difference in the numerical distribution of an indicator across different organizations or time periods, the lower its information entropy, indicating lower uncertainty and stronger discriminative power, representing a higher contribution and informational value of the indicator to the overall assessment. Referring to the principle of information entropy, we can use the relative improvement of an indicator's score over a certain period to influence its contribution to the overall score. The specific calculation process is as follows: Assume the first The first subject to be evaluated The current value of the third-level indicator is The historical average value within the evaluation period is Then the percentage deviation of the third-level indicators of the object to be evaluated for: ; For example, suppose Company A's historical scores for a certain indicator over 7 days are: 40, 40, 50, 60, 65, 65, 70, with an average of 55.7 and a current score of 70. The average percentage deviation of Company A for this indicator is DR = |55.7 - 70 / 55.7| ≈ 25.67%.

[0045] Relative improvement factor It is the average offset percentage. The function, whose value range is generally 1. From the perspective of practical application results, it is generally taken as follows: This is quite appropriate. In other words, it's necessary to map the average percentage offset of each specific metric for each subsidiary to... Above the range, and maintain for It is a monotonically increasing function.

[0046] The following uses the simplest linear mapping method to process... The calculation, that is, taking The maximum percentage deviation of all indicators across all subsidiaries, taken as... The minimum percentage offset for all metrics across all subsidiaries. Then the first The first subject to be evaluated (the first) (the first subsidiary) Relative improvement factor of the third-level indicators for: ; in, The maximum percentage deviation among all tertiary indicators for all objects to be evaluated. The minimum percentage deviation among all tertiary indicators for all objects to be evaluated, 0 ≤ α <1.

[0047] In practical applications, if a subsidiary's historical measurement value for a certain indicator has already met the head office's highest requirement for that indicator, it can be considered acceptable even if the indicator has not changed during the statistical period. For example, if the target score is 90, then Company A's historical scores over the past 7 days are 90, 90, 90, 90, 90, 90, 90, and 90 respectively. Regardless of whether the subsidiary has made any new improvements in this indicator, the score will be recorded as 90. .

[0048] Regarding the calculation of the fusion factor: From a physical perspective, the relative activity factor From a global perspective, higher dynamic weights are given to scenarios with higher activity levels. (The relative improvement factor...) The latter approach assigns higher weights to subsidiaries that continuously improve on specific indicators, while penalizing companies that fail to meet the standards for a long time and whose improvement is slow by giving them certain weights on specific indicators.

[0049] Special note: Fusion factor The calculation is based on the reason why... and The main reasons for performing multiplication calculations are as follows: 1. In a multidimensional factor combination model, the multiplicative relationship can reflect the "joint constraint" or "interdependence" between dimensions. That is, the fusion is significant only when both factors are high; if either factor is low, the influence of the indicator will be suppressed.

[0050] 2. If addition or weighted averaging is used, an abnormally high value in one dimension may mask a deficiency in another. Multiplicative fusion, on the other hand, conforms to the "weakest link" principle, is more rigorous and conservative, and is beneficial for evaluation and control in risky scenarios.

[0051] 3. In the field of cybersecurity, evaluation systems often follow a "risk-oriented" principle, tending to suppress the weight of high-risk, volatile items to avoid distorting the scoring results. Multiplicative models can ensure that when a particular aspect of an indicator fluctuates significantly, its overall impact is not overestimated due to structural "importance."

[0052] 4. The multiplication model conforms to the guiding principle of "high sensitivity + high importance = high weight; any weakness = reduced impact".

[0053] 5. The multiplication model is easy to implement mathematically and systematically, and has the characteristics of being simple, having strong linear transformation ability, and having a closed result interval (when both weights are in the interval [0,1], the product is still in the interval [0,1]).

[0054] 6. Facilitates recursive calculation of multi-level weighted structures.

[0055] Normalization of element measurements: To ensure the consistency of the calculation of the entire indicator system, it is necessary to solve the problem of normalization of element measurements.

[0056] The measured value of an element refers to the actual score of a certain capability (also known as the actual measured value or current measured value). In the field of cybersecurity, the measured values ​​of elements mainly fall into two categories: one is data automatically captured by cybersecurity devices or systems (e.g., the number of security incidents), and the other is data manually reported and entered (e.g., the status of cybersecurity organization development). Numerically, there are mainly the following situations: 1. Percentage type, such as 95%, 0.92; 2. Binary type, such as yes / no, true / false; 3. Interval values: Raw statistical values, such as time, frequency, etc.

[0057] For the different natural values ​​of an element, we can use the following table to list the element's score. Normalized to any positive integer between 0 and 100.

[0058] The following are examples of different types of numerical normalization methods:

[0059] In another embodiment, the method further includes: Determine the business weight and dynamic weight corresponding to each tertiary indicator; Based on the dynamic measurement values ​​of each cybersecurity indicator for each of the aforementioned objects to be evaluated, the total cybersecurity score for each object to be evaluated is calculated iteratively at each level, including: Based on the dynamic measurement values ​​of each of the three-level indicators for each of the objects to be evaluated, calculate the cybersecurity score corresponding to each of the three-level indicators. Based on the network security scores corresponding to the three-level indicators, as well as the corresponding business weights and dynamic weights, the network security scores of each secondary indicator are calculated. Based on the cybersecurity scores of each secondary indicator and the corresponding expert weights, the cybersecurity scores of each primary indicator are calculated. Based on the cybersecurity scores of each primary indicator and the corresponding expert weights, the total cybersecurity score for each of the objects to be evaluated is calculated.

[0060] The process of iteratively calculating the total cybersecurity score for each object under evaluation based on the dynamic measurement values ​​of various cybersecurity indicators for each object to be evaluated includes: The total cybersecurity score for each of the objects to be evaluated is calculated based on the following formula: ; Where S refers to the total cybersecurity score of the object being evaluated, and V... i This refers to the cybersecurity score of the i-th level 3 indicator of the object to be evaluated. This refers to the business weight corresponding to the i-th tertiary indicator. B refers to the dynamic weight of the i-th tertiary indicator. j The j-th secondary indicator of the object to be evaluated. The expert weight of the j-th secondary indicator, A k The k-th primary indicator of the object to be evaluated. The expert weight refers to the k-th primary indicator; the expert weight is used to characterize the relative importance of the corresponding level indicator among the other indicators at the same level.

[0061] To ensure the scientific rigor and authority of the multi-level indicator weight aggregation process, this system employs an expert weighting mechanism (i.e., expert weights) in the weighting of secondary indicators and primary dimensions. However, this weighting is not arbitrary but is configured based on the following principles: 1. The weighting mechanism has a clear source and is based on business principles. The weights of each level of indicator are derived from the "business mapping logic" and "indicator goal orientation" in the indicator design phase, and are predicted by the expert group in combination with the platform's responsibility structure.

[0062] The primary dimension mainly reflects the strategic priorities of cybersecurity governance (such as organizational safeguards and security operations), and the weights are set based on standards, industry guidelines, or group strategic plans. The weights for the secondary dimensions and tertiary indicators are as follows: The importance of each indicator in actual management and control; The degree to which it is linked to key tasks / systems; Objective evidence such as the frequency of inspections and audit results over the years.

[0063] 1. The design process involves multiple parties and is representative. (1) The weights are determined by the “Indicator Design Expert Group”, taking into full account the actual business needs of each party; (2) Before each round of weight setting, experts are organized to conduct "indicator importance level classification and scoring", using a simplified version of AHP or a five-level scoring method; (3) Average the weights of multiple people, remove extreme values, and form a consensus weight with high consistency among experts.

[0064] 2. Reasons for not using automatic weighting (1) Average weighting weakens the role of key indicators and makes it difficult to distinguish "key control areas"; (2) Data-driven automatic weighting may be misled by short-term fluctuations, outliers, etc. (3) Cybersecurity governance emphasizes “institutional guidance + risk prevention”, and experts believe that this is more in line with corporate management logic.

[0065] Therefore, in the process of summarizing scores for multiple indicators, this system adopts an expert weighting scheme. This is a structured weighting process based on scientific evaluation models (such as AHP and rules of thumb), rather than subjective and arbitrary assignment. This mechanism also has a certain degree of transparency and traceability, and can be adjusted and optimized based on implementation feedback.

[0066] In one embodiment, the primary indicators include at least two of the following: security management, security technology, security construction, and security operation; The secondary indicators under the aforementioned safety management include at least two of the following: safety organization, safety system, and personnel management. The secondary indicators under the aforementioned security technology include at least two of the following: data center security, network security, host security, application security, data security, and endpoint security. The secondary indicators under the security construction include: security investment, completion rate of the three synchronizations, and at least two of the following: supply chain security. The secondary indicators under the security operation include at least two of the following: security monitoring and early warning, major event protection, graded protection management, inspection and supervision management, security vulnerability management, security incident management, emergency drill management, asset management, security operation and maintenance, security notification management, security training management, and attack and defense drill management. The three-level indicators under the security organization include: security organization completeness rate, implementation status of separation of duties among the three personnel, and whether a specific organization within the enterprise participates in at least one of the following cybersecurity-related thematic meetings: The three-level indicators under the security system include at least one of the following: the completeness of the network security management system and the timeliness of network security system updates; The three-level indicators under personnel management include at least one of the following: personnel background check coverage rate, job confidentiality agreement signing rate, timely account cancellation rate of departing employees, and privileged account control rate. The three-level indicators for data center security include at least one of the following: the completeness of the data center's physical protection, the frequency of data center inspections, and the status of data center access control. The three-level indicators under network security include at least one of the following: network partitioning and isolation implementation status, network boundary security device deployment rate, and network boundary device policy update timeliness rate. The three-level indicators under host security include at least one of the following: host security protection coverage, host patch update timeliness rate, and number of host security incidents; The three-level indicators under application security include at least one of the following: application system three-person role configuration rate, user identity authentication strategy strength, application system two-factor authentication configuration rate, and middleware component patch update rate. The three-level indicators under data security include at least one of the following: data storage encryption coverage, data backup coverage, external business data encryption transmission coverage, and data classification and grading implementation rate. The three-level indicators under the terminal security include at least one of the following: terminal protection system installation rate, terminal behavior audit execution rate, and terminal access percentage. The three-level indicators under the aforementioned safety investment include: the proportion of safety investment; The three-level indicators under the three-synchronization completion rate include: synchronous planning completion rate, synchronous construction completion rate, and synchronous operation completion rate; The three-level indicators under supply chain security include at least one of the following: supply chain security risk assessment coverage, open source component security inspection rate, and open source component asset inventory rate. The three-level indicators under the security monitoring and early warning system include at least one of the following: network security monitoring and protection capability coverage and threat alarm handling rate; The three-level indicators under the major event protection include at least one of the following: whether a self-inspection was carried out in the early stage of the major event protection, the score completed during the duty period, the timeliness of the event response during the major event, and whether a summary and review was carried out in the later stage of the major event protection. The three-level indicators under the graded protection management include at least one of the following: graded filing completion rate, graded protection assessment completion rate, and graded protection assessment rectification completion rate. The three-level indicators under the inspection and supervision management include at least one of the following: the timely completion rate of inspection and supervision tasks and the timely completion rate of problem rectification. The three-level indicators under the security vulnerability management include at least one of the following: vulnerability scan execution rate, vulnerability remediation timeliness rate, and vulnerability handling false alarm rate. The three-level indicators under the security incident management include at least one of the following: incident response plan completeness rate, security incident handling timeliness rate, and number of security incidents; The three-level indicators under the emergency drill management include at least one of the following: drill plan development status, drill execution rate according to plan, and drill problem rectification completion rate. The three-level indicators under asset management include at least one of the following: asset reporting completeness, asset confirmation timeliness, and asset data accuracy. The three-level indicators under the security operation and maintenance include at least one of the following: security log audit coverage, whether security inspections are carried out, whether security self-inspections are carried out, security device policy optimization score, and security baseline verification coverage. The three-level indicators under the security notification management include at least one of the following: notification response timeliness rate and notification issue closure rate; The three-level indicators under the security training management include at least one of the following: number of self-organized training sessions, security training participation rate, security training assessment pass rate, cybersecurity knowledge assessment participation rate, and cybersecurity knowledge assessment pass rate. The three-level indicators under the attack and defense exercise management include at least one of the following: whether a risk assessment was conducted before the attack and defense exercise, the timeliness of vulnerability rectification during the exercise, the completion rate of vulnerability rectification during the exercise, and whether a summary and review of the attack and defense exercise was conducted.

[0067] In another embodiment, the method further includes: Based on the reporting applications sent by each entity to be evaluated, the three-level network security indicator system is adaptively adjusted, and the first-level, second-level, and third-level indicators suitable for each entity to be evaluated are determined.

[0068] Considering the differences in cybersecurity construction among subsidiaries (i.e., each entity to be evaluated) within a group enterprise, there may be situations where "inapplicable indicators" exist. Therefore, before setting up the indicator system, it is necessary to submit an application for approval. This allows for dynamic adjustments to the cybersecurity indicator system based on the actual situation of each subsidiary. By deleting or adjusting indicators, the designed indicator system can be made more scientific and in line with the actual situation of each subsidiary, so as to conduct a more objective and accurate cybersecurity assessment.

[0069] The cybersecurity assessment of each entity to be evaluated, based on the total cybersecurity score, includes: Based on the total cybersecurity score, each object to be evaluated is ranked. Based on the total network security score and the pre-set network security level classification standards, the network security level to which each object to be evaluated belongs is determined. For example, based on the scoring range, cybersecurity levels can be divided into: initial stage, construction stage, standardization stage, optimization stage, and excellence stage. This can serve as an important tool for subsidiaries and business segments to conduct self-inspection, self-evaluation, and continuous improvement. The group can also use this to conduct phased assessments, horizontal comparisons, and key supervision to promote continuous improvement in the management efficiency of cybersecurity indicators in various units.

[0070] The multi-level cybersecurity indicator system designed in this application provides an indicator analysis system comprising 4 dimensions (primary indicators), 24 categories (secondary indicators), and 75 specific elements (tertiary indicators). It also proposes a scenario-based dynamic measurement value analysis scheme based on relative activity factors and relative improvement factors. This scheme allows managers to observe the responsiveness of various subsidiaries to the group's cybersecurity management priorities through dynamic changes in indicator data, without manually adjusting indicator weights.

[0071] The following is an example of primary, secondary, and tertiary indicators in a complete cybersecurity indicator system:

[0072] The following simple example further explains the indicator system: For ease of explanation, we will only consider a simplified secondary indicator system consisting of two scenarios and five indicators, as shown in the table below:

[0073] Original experimental data: The table below shows the actual performance data of three subsidiaries of a certain group over three consecutive assessment periods, including changes in activity level (example only uses "number of visits") and indicator scores (90 points or above is the standard). The activity level and performance of the three subsidiaries in the three assessment cycles.

[0074] It can be seen from the above table: ] ]

[0075] The relative activity factors for the two scenarios are calculated as follows:

[0076]

[0077] Calculation of relative improvement factor: Taking Company A's indicator 1 as an example, its average offset is:

[0078] Furthermore, calculations show that among the data from the three subsidiaries, the minimum deviation percentage is 0 and the maximum deviation percentage is 2.00. If we assume the relative improvement factor ranges from [0.6, 1], then the relative improvement factor for Company A's indicator 1 is:

[0079] The table below shows the calculation results of the relative improvement factors for five indicators for the three subsidiaries: The relative improvement factor calculation results (value range [0.6, 1])

[0080] Calculation of dynamic measurement values: Taking Company A's indicator 1 as an example, its dynamic measurement value is:

[0081] Dynamic measurement values ​​of five indicators of the three subsidiaries

[0082] Therefore, we can conclude that:

[0083]

[0084]

[0085] Comprehensive indicator calculation and effect analysis: The comprehensive indicator scores for the three subsidiaries were as follows:

[0086]

[0087]

[0088] The conclusion is that, in the latest performance evaluation cycle, Company C had the best overall cybersecurity indicators, while Company A had the worst.

[0089] The table below compares the calculation results of the comprehensive index with and without scenario-based analysis.

[0090] Comparison of different indicator evaluation methods

[0091] It can be seen that regardless of the algorithm used, Company A consistently performs the worst. However, whether the average of the five indicators is calculated directly, or the evaluation is conducted using only the tiered indicator framework without considering scenario-based analysis, Company B's score is slightly higher than Company C's. In scenario-based analysis, which considers both activity and relative improvement factors, Company C's performance surpasses that of Company B.

[0092] The reason for this difference is mainly because: 1. The company is currently focusing on promoting safety system management, and has allocated a higher activity weight (0.5) for this purpose. The active actions of various subsidiaries have also made the activity factor (0.53) in the safety system management scenario higher than the activity factor (0.47) in the safety training management scenario.

[0093] 2. Company C achieved more significant progress than Company B in both indicators under the safety system management scenario, thus obtaining a higher overall score.

[0094] In other words, although Company B's overall performance was also very good, Company C achieved better results and more significant progress in the key tasks that the company has been focusing on recently, thus receiving a higher score. Scenario-based analysis methods further encourage units that focus on key tasks and continuously make improvements until the relevant indicators are met.

[0095] The multi-level cybersecurity indicator evaluation framework based on scenario-based analysis proposed in this application has significant application advantages: the operator of the evaluation system does not need to frequently modify the hierarchical weights of the framework, nor does it need to pay special attention to the activity weights. Through automated data collection, it can naturally perceive the group company's work priorities within a certain period and give the best evaluation results to the subsidiaries that have made the most significant progress. When the group company is simultaneously advancing multiple key tasks, this indicator evaluation system can also adapt well to the scenario and automatically achieve unified, comprehensive evaluation indicators that are consistent with the actual production of subsidiaries.

[0096] On the other hand, embodiments of the present invention provide a network security assessment system, such as... Figure 2 As shown, the system deploys a multi-level network security indicator system, which includes: multiple indicator levels, each indicator level containing at least one network security indicator, and each higher-level network security indicator consisting of at least one lower-level network security indicator. The system includes: The acquisition module 201 is used to acquire multiple objects to be assessed that require cybersecurity assessment from a group enterprise; The first determining module 202 is used to determine the network security indicators included in the lowest indicator level of the object to be evaluated, and the current measurement value corresponding to each network security indicator; The second determining module 203 is used to determine the relative activity factor and relative improvement factor corresponding to each network security indicator included in the lowest indicator level of the object to be evaluated. The relative activity factor is used to characterize the proportion of the activity level of a certain scenario in all scenarios defined by the multi-level network security indicator system to the total activity level of all scenarios. The relative improvement factor is used to characterize the contribution of the relative improvement of the score of a certain indicator within a set period to the score of that indicator to the overall score of the indicator. The first calculation module 204 is used to calculate the dynamic measurement value of the corresponding network security indicator based on the current measurement value, the relative activity factor and the relative improvement factor. The second calculation module 205 is used to calculate the total network security score of each object to be evaluated by iteratively calculating the dynamic measurement values ​​of each network security indicator of each object to be evaluated. The evaluation module 206 is used to conduct a cybersecurity evaluation of each object to be evaluated based on the total cybersecurity score.

[0097] Thirdly, embodiments of the present invention provide an electronic device, including: a memory and a processor, wherein the memory and the processor are connected; Memory, used to store computer programs; A processor is used to invoke a computer program stored in memory to perform any of the above methods.

[0098] Fourthly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when run by a computer, performs any of the methods described above.

[0099] The computer-readable media in this application embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, and optical disc read-only memory (CD). ROM, digital multifunction optical disc (DVD) or other optical storage, magnetic cassette tape, magnetic magnetic disk storage or other magnetic storage devices or any other non-transfer medium, may be used to store information that can be accessed by computing devices.

[0100] The computer instructions stored in the storage medium of the above embodiments are used to cause the computer to perform the method described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0101] It should be noted that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the methods, systems, and media are basically similar to the method embodiments, so the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the method embodiments. The methods, systems, and media described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components indicated as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the solution in this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0102] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A method for network security assessment based on a multi-level network security indicator system, characterized in that, The method is used in a network security assessment system, which deploys a multi-level network security indicator system. This system includes multiple indicator levels, each level containing at least one network security indicator, and each higher-level network security indicator is composed of at least one lower-level network security indicator. The method includes: Identify multiple entities within a group of enterprises that require cybersecurity assessment; Determine the network security indicators included in the lowest indicator level of the object to be evaluated, and the current measurement value corresponding to each network security indicator; The relative activity factor and relative improvement factor are determined for each cybersecurity indicator included in the lowest indicator level of the object to be evaluated. The relative activity factor is used to characterize the proportion of the activity level of a certain scenario in all scenarios defined by the multi-level cybersecurity indicator system to the total activity level of all scenarios. The relative improvement factor is used to characterize the contribution of the relative improvement of the score of a certain indicator within a set period to the score of that indicator to the overall score of the indicator. Based on the current measurement value, the relative activity factor, and the relative improvement factor, the dynamic measurement value of the corresponding network security indicator is calculated. Based on the dynamic measurement values ​​of each network security indicator of each object to be evaluated, the total network security score of each object to be evaluated is calculated iteratively step by step. Based on the total cybersecurity score, a cybersecurity assessment is conducted on each object to be evaluated.

2. The method according to claim 1, characterized in that, The multi-level cybersecurity indicator system is a three-level cybersecurity indicator system. The cybersecurity indicators are arranged in descending order of level: Level 1 indicators, Level 2 indicators, and Level 3 indicators. Each Level 1 indicator includes multiple Level 2 indicators, and each Level 2 indicator includes at least one Level 3 indicator. The lowest level of the evaluation object contains Level 3 cybersecurity indicators. Determining the relative activity factor corresponding to each cybersecurity indicator in the lowest level of the evaluation object includes: The relative activity factor corresponding to each tertiary indicator of the object to be evaluated is determined based on the following formula; definition N The first scenario, the... i Relative activity factor of each scenario for: ； in, For the first i The activity parameters for each scenario are used to characterize the frequency of operations. The activity parameters include one or more of the following: number of visits, number of confirmation updates, and number of confirmation executions. The number of visits is used to characterize the intensity of interaction between the user and the system; the number of confirmation updates is used to characterize the frequency of control measures or actual operations triggered; and the number of confirmation executions is used to characterize the intensity of interaction with data resources. Indicates the first i The weighting factor for activity in each scenario, with the denominator representing the weighted sum of activity across all scenarios, and the sum of activity factors for all scenarios being 1.

3. The method according to claim 2, characterized in that, Determine the relative improvement factor for each cybersecurity indicator included in the lowest indicator level of the object to be evaluated, including: Assume the first The first subject to be evaluated The current value of the third-level indicator is The historical average value within the evaluation period is Then the percentage deviation of the third-level indicators of the object to be evaluated for: ； Then the first The first subject to be evaluated Relative improvement factor of the third-level indicators for: ； in, The maximum percentage deviation among all tertiary indicators for all objects to be evaluated. The minimum percentage offset among all tertiary indicators for all objects to be evaluated, 0 ≤ α <1.

4. The method according to claim 2, characterized in that, The method further includes: Determine the business weight and dynamic weight corresponding to each tertiary indicator; Based on the dynamic measurement values ​​of each cybersecurity indicator for each of the aforementioned objects to be evaluated, the total cybersecurity score for each object to be evaluated is calculated iteratively at each level, including: Based on the dynamic measurement values ​​of each of the three-level indicators for each of the objects to be evaluated, calculate the cybersecurity score corresponding to each of the three-level indicators; Based on the network security scores corresponding to the three-level indicators, as well as the corresponding business weights and dynamic weights, the network security scores of each secondary indicator are calculated. Based on the cybersecurity scores of each secondary indicator and the corresponding expert weights, the cybersecurity scores of each primary indicator are calculated. Based on the cybersecurity scores of each primary indicator and the corresponding expert weights, the total cybersecurity score for each of the objects to be evaluated is calculated.

5. The method according to claim 2, characterized in that, The total cybersecurity score for each object to be evaluated is calculated iteratively based on the dynamic measurement values ​​of each cybersecurity indicator for each object to be evaluated, including: The total cybersecurity score for each of the objects to be evaluated is calculated based on the following formula: ； Where S refers to the total cybersecurity score of the object being evaluated, and V... i The cybersecurity score of the i-th tertiary indicator of the object to be evaluated. This refers to the business weight corresponding to the i-th tertiary indicator. B refers to the dynamic weight of the i-th tertiary indicator. j The j-th secondary indicator of the object to be evaluated. The expert weight of the j-th secondary indicator, A k The k-th primary indicator of the object to be evaluated. The expert weight refers to the k-th primary indicator; the expert weight is used to characterize the relative importance of the corresponding level indicator among the other indicators at the same level.

6. The method according to claim 2, characterized in that: The primary indicators include at least two of the following: safety management, safety technology, safety construction, and safety operation. The secondary indicators under the aforementioned safety management include at least two of the following: safety organization, safety system, and personnel management. The secondary indicators under the aforementioned security technology include at least two of the following: data center security, network security, host security, application security, data security, and endpoint security. The secondary indicators under the security construction include: security investment, completion rate of the three synchronizations, and at least two of the following: supply chain security. The secondary indicators under the security operation include at least two of the following: security monitoring and early warning, major event protection, graded protection management, inspection and supervision management, security vulnerability management, security incident management, emergency drill management, asset management, security operation and maintenance, security notification management, security training management, and attack and defense drill management. The three-level indicators under the security organization include: security organization completeness rate, implementation status of separation of duties among the three personnel, and whether a specific organization within the enterprise participates in at least one of the following cybersecurity-related thematic meetings: The three-level indicators under the security system include at least one of the following: the completeness of the network security management system and the timeliness of network security system updates; The three-level indicators under personnel management include at least one of the following: personnel background check coverage rate, job confidentiality agreement signing rate, timely account cancellation rate of departing employees, and privileged account control rate. The three-level indicators for data center security include at least one of the following: the completeness of the data center's physical protection, the frequency of data center inspections, and the status of data center access control. The three-level indicators under network security include at least one of the following: network partitioning and isolation implementation status, network boundary security device deployment rate, and network boundary device policy update timeliness rate. The three-level indicators under host security include at least one of the following: host security protection coverage, host patch update timeliness rate, and number of host security incidents; The three-level indicators under application security include at least one of the following: application system three-person role configuration rate, user identity authentication strategy strength, application system two-factor authentication configuration rate, and middleware component patch update rate. The three-level indicators under data security include at least one of the following: data storage encryption coverage, data backup coverage, external business data encryption transmission coverage, and data classification and grading implementation rate. The three-level indicators under the terminal security include at least one of the following: terminal protection system installation rate, terminal behavior audit execution rate, and terminal access ratio; The three-level indicators under the aforementioned safety investment include: the proportion of safety investment; The three-level indicators under the three-synchronization completion rate include: synchronous planning completion rate, synchronous construction completion rate, and synchronous operation completion rate; The three-level indicators under supply chain security include at least one of the following: supply chain security risk assessment coverage, open source component security inspection rate, and open source component asset inventory rate. The three-level indicators under the security monitoring and early warning system include at least one of the following: network security monitoring and protection capability coverage and threat alarm handling rate; The three-level indicators under the major event protection include at least one of the following: whether a self-inspection was carried out in the early stage of the major event protection, the score completed during the duty period, the timeliness of the event response during the major event, and whether a summary and review was carried out in the later stage of the major event protection. The three-level indicators under the graded protection management include at least one of the following: graded filing completion rate, graded protection assessment completion rate, and graded protection assessment rectification completion rate. The three-level indicators under the inspection and supervision management include at least one of the following: the timely completion rate of inspection and supervision tasks and the timely completion rate of problem rectification. The three-level indicators under the security vulnerability management include at least one of the following: vulnerability scan execution rate, vulnerability remediation timeliness rate, and vulnerability handling false alarm rate. The three-level indicators under the security incident management include at least one of the following: incident response plan completeness rate, security incident handling timeliness rate, and number of security incidents; The three-level indicators under the emergency drill management include at least one of the following: drill plan development status, drill execution rate according to plan, and drill problem rectification completion rate. The three-level indicators under asset management include at least one of the following: asset reporting completeness, asset confirmation timeliness, and asset data accuracy. The three-level indicators under the security operation and maintenance include at least one of the following: security log audit coverage, whether security inspections are carried out, whether security self-inspections are carried out, security device policy optimization score, and security baseline verification coverage. The three-level indicators under the security notification management include at least one of the following: notification response timeliness rate and notification issue closure rate; The three-level indicators under the security training management include at least one of the following: number of self-organized training sessions, security training participation rate, security training assessment pass rate, cybersecurity knowledge assessment participation rate, and cybersecurity knowledge assessment pass rate. The three-level indicators under the attack and defense exercise management include at least one of the following: whether a risk assessment was conducted before the attack and defense exercise, the timeliness of vulnerability rectification during the exercise, the completion rate of vulnerability rectification during the exercise, and whether a summary and review of the attack and defense exercise was conducted.

7. The method according to claim 6, characterized in that, The method further includes: Based on the reporting applications sent by each entity to be evaluated, the three-level network security indicator system is adaptively adjusted, and the first-level, second-level, and third-level indicators suitable for each entity to be evaluated are determined. The cybersecurity assessment of each entity to be evaluated, based on the total cybersecurity score, includes: Based on the total cybersecurity score, each object to be evaluated is ranked. Based on the total network security score and the pre-set network security level classification standards, the network security level to which each object to be evaluated belongs is determined.

8. A network security assessment system, characterized in that, The system deploys a multi-level network security indicator system, which includes multiple indicator levels. Each indicator level contains at least one network security indicator, and each higher-level network security indicator is composed of at least one lower-level network security indicator. The system includes: The acquisition module is used to acquire multiple entities from group enterprises that require cybersecurity assessment. The first determining module is used to determine the network security indicators included in the lowest indicator level of the object to be evaluated, and the current measurement value corresponding to each network security indicator. The second determining module is used to determine the relative activity factor and relative improvement factor corresponding to each network security indicator included in the lowest indicator level of the object to be evaluated. The relative activity factor is used to characterize the proportion of the activity level of a certain scenario in all scenarios defined by the multi-level network security indicator system to the total activity level of all scenarios. The relative improvement factor is used to characterize the contribution of the relative improvement of the score of a certain indicator within a set period to the score of that indicator to the overall score of the indicator. The first calculation module is used to calculate the dynamic measurement value of the corresponding network security indicator based on the current measurement value, the relative activity factor and the relative improvement factor. The second calculation module is used to iteratively calculate the total cybersecurity score of each object to be evaluated based on the dynamic measurement values ​​of each cybersecurity indicator of each object to be evaluated. The evaluation module is used to conduct a cybersecurity evaluation of each object to be evaluated based on the total cybersecurity score.

9. An electronic device, characterized in that, include: Memory and processor, and the connection between memory and processor; Memory, used to store computer programs; A processor for invoking a computer program stored in memory to perform the method as claimed in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, It stores a computer program, which, when executed by a computer, performs the method as described in any one of claims 1-7.

Images