CN108833358A - Method and system for managing security baseline - Google Patents

Abstract

The present invention provides a security baseline management method and system, the method: Step 1. The client receives the task; the task includes the task of operating the security configuration items of the operating system; Step 2. The client judges the task type; the Task types include security scan tasks, repair tasks, and restore initial configuration tasks; Step 3. When the task is a security scan task, the client scans the security configuration items of the operating system to obtain the scan value of the security configuration items; The baseline value of the security configuration item; compare the scanning value of the security configuration item with the baseline value set by the security policy to determine whether the security configuration item is compliant; the client returns the result of the security scanning task; return to step 1. The system includes a client; the client includes a subtask management module and a safety baseline safety component module. The invention scans and repairs security configuration items, improves the security and compliance of the operating system, and effectively prevents damage to the host computer by unknown malicious behaviors.

Description

Method and system for managing security baseline

technical field

The invention belongs to the field of server host security, and in particular relates to a security baseline management method and system.

Background technique

Operating system security baseline: The security baseline is the minimum security guarantee of an operating system, that is, the most basic security requirements that the information system needs to meet.

Security configuration: Due to the negligence of the information administrator, it involves user accounts, user passwords, access authorization, system logs, etc., reflecting the security vulnerability of the system itself.

With the rapid progress of enterprise information construction, it is facing more severe information security risks. In information security risks, whether the information system configuration operation is safe is an extremely important aspect. Security configuration errors are generally caused by human error, and meeting the security configuration requirements of a large number of information system equipment requires relatively high professional and technical levels of operation and maintenance personnel. Information security baseline management plays a vital role in improving the security of enterprise network and information system.

Faced with a huge variety of assets in the information system, as an information system operation and maintenance personnel, it is difficult to perform security configuration analysis on massive information assets, identify items that do not meet security specifications, and rectify them to meet security specifications. matter.

After the previous security configuration repair is completed, the security and compliance of the operating system have been improved, but it may affect the normal operation of the user's existing business, even if the software is uninstalled, it cannot be restored.

This is a deficiency of the prior art. Therefore, it is very necessary to provide a safety baseline management method and system for the above-mentioned defects in the prior art.

Contents of the invention

The object of the present invention is to provide a security baseline management method and system to solve the above-mentioned technical problems, aiming at the difficulty in analyzing and identifying the asset security configuration of the above-mentioned information system and the defect that the normal business cannot be restored after the security configuration is repaired.

To achieve the above object, the present invention provides the following technical solutions:

A method for managing a security baseline, comprising the steps of:

Step 1. The client receives the task; the task includes the task of operating the security configuration item of the operating system; the security configuration item includes identity authentication, access control, security audit, remaining information protection, intrusion prevention, malicious code prevention and resource control;

Step 2. The client judges the task type; the task type includes a security scan task, a repair task and a recovery initial configuration task;

Step 3. When the task is a security scanning task, the client scans the security configuration items of the operating system through the security baseline security component to obtain the scan value of the security configuration items;

Obtain the baseline value in the security policy;

Compare the scan value of the security configuration item with the baseline value set by the security policy to determine whether the security configuration item is compliant;

The client returns the result of the security scanning task;

Return to step 1.

Further, the following steps are also included:

Step 4. When the task is a repair task, the client scans the security configuration items of the operating system through the security baseline security component;

Obtain the scan value of the security configuration item;

Obtain the baseline value in the security policy;

Compare the scan value of the security configuration item with the baseline value set by the security policy to determine whether the security configuration item is compliant;

If not, set the security configuration item to the baseline value in the security policy through the security baseline security component;

If it complies with the regulations, do not operate;

The client returns the result of the repair task;

Return to step 1.

Further, in step 3 and step 4, when the client scans the security configuration items of the operating system, it is judged whether it is the initial scan;

If it is the first scan, save the first scan value of the security configuration item;

If it is not the first scan, no operation is performed;

After step 4 also include:

Step 5. When the task is to restore the initial configuration task, the client obtains the initial scan value of the security configuration item, sets the security configuration item of the operating system to the initial scan value through the security baseline security component, and restores the state at the time of the initial scan. The terminal returns the execution result of restoring the initial configuration task;

Return to step 1.

Further, step 1A is also included before step 1: the client receives a security policy; the security policy includes scan settings, repair settings, and security configuration item settings;

Scanning settings include setting whether to enable scheduled scanning and setting the scanning frequency;

The repair setting includes setting the repair range;

Security configuration item settings, including setting baseline values;

Users can flexibly configure the baseline value and open status of security configuration items, adjust the security level as needed, and balance the security and convenience of the host.

Further, the baseline value is set by selecting the grade of the baseline value from grade templates of security configuration items stored in the expert knowledge base, and the grade templates of security configuration items include high grade, middle grade and low grade. Users can uniformly configure the baseline values of the security configuration items of the operating system through unified configuration management. The expert knowledge base has built-in security configuration policy templates of different security levels to construct a more secure operating system platform and reduce the compliance of the host operating system. risks of.

Further, in step 3, step 4 and step 5, the client returns the log while returning the task result. The management platform receives the logs sent by the client and generates log reports. The log report is a detailed security assessment report, which can more intuitively represent the security status of the client operating system and the operations performed on the security configuration items of the client operating system.

Further, before step 1, the following steps are also included:

Step 1B. The management platform performs baseline management on the assets of the operating system where the client is located;

The assets of the operating system include physical machines, virtual machines and virtualization software;

Baseline management of operating system assets includes automatic asset discovery, manual asset entry, and asset grouping;

Step 1C. The management platform creates a task and sends the task to the client.

The present invention also provides following technical scheme:

A security baseline management system, including a client;

The client includes a subtask management module and a security baseline security component module;

The subtask management module is used to receive tasks, send execution commands to the security baseline security component module, and return execution results;

The tasks include a security scanning task, a repairing task, and a restoring initial configuration task;

The security scan task is used to scan the real-time security configuration items of the operating system where the client is located, obtain the scan value of the security configuration item, and judge whether it is the first scan. When it is the first scan, save the initial scan value of the security configuration item; it is also used to Obtain the baseline value in the security policy, compare the scan value of the security configuration item with the baseline value set by the security policy to determine whether the security configuration item is compliant; the security configuration item includes identity authentication, access control, security audit, and residual information protection, intrusion prevention, malicious code prevention, and resource control;

The repair task is used to scan the real-time security configuration items of the operating system where the client is located, obtain the scan value of the security configuration item, obtain the baseline value in the security policy, and compare the scan value of the security configuration item with the baseline value of the security policy set To determine whether the security configuration item is compliant; when the scan value of the security configuration item is not in compliance, set the security configuration item to the baseline value in the security policy;

Restoring the initial configuration task is used to obtain the initial scanning value of the security configuration item, set the security configuration item of the operating system to the initial scanning value, and restore the state at the initial scanning;

The security baseline security component module is used to perform a security scanning task to obtain the value of a security configuration item; it is used to perform a repair task or restore an initial configuration task to set the value of a security configuration item.

Further, it also includes a management platform, the management platform and the client are connected through the message middleware; the message middleware adopts the message bus of RabbitMQ;

The management platform includes a task management module;

The task management module is used to create a task and send the task to the subtask management module of the client, and receive the task execution result returned by the subtask management module of the client.

Further, the management platform and the client adopt B/S architecture or C/S architecture. The combination of B/S architecture and C/S architecture has a wider scope of application.

Further, the client also includes a sub-policy management module;

A sub-policy management module, configured to receive a security policy;

The management platform also includes a policy management module and a knowledge base management module;

The knowledge base management module is connected with an expert knowledge base;

A policy management module, configured to set and send a security policy to the sub-policy management module of the client; the security policy includes scan settings, repair settings, and security configuration item settings;

The expert knowledge base is used to store level templates of security configuration items; the level templates include high-level templates, intermediate-level templates and low-level templates;

The knowledge base management module is used to upgrade the expert knowledge base; through continuous improvement and expansion of the knowledge base, it can help customers solve problems caused by operating system updates, business system upgrades, and outdated knowledge bases, reducing maintenance costs.

Further, the management platform also includes an asset management module;

The asset management module is configured to perform baseline management on the assets of the operating system where the client resides; the assets of the operating system include physical machines, virtual machines, and virtualization software.

Further, the client also includes a log management module, and the management platform also includes a log report module;

Log management module, used to send logs;

The log report module is used to receive logs from the client log management module, perform statistical analysis on asset compliance of assets or asset groups within a specified time period, and generate log reports; the types of log reports include Word, PDF, and Excel.

The beneficial effects of the present invention are:

The present invention comprehensively scans the security configuration items of the operating system through the security baseline security component module, and provides a repair function of the security configuration items, improves the security and compliance of the host operating system, and effectively prevents damage to the host by unknown malicious behaviors; When a security scan is performed, the scan value of the security configuration item of the current host operating system is saved. When the security configuration item is repaired and the normal business is affected, the security configuration item is restored to the initial scan value through the security baseline security component module to ensure that the business does not Being selected, the maintenance cost is reduced;

The invention automates the process of manual local audit data extraction, manual analysis and preparation of safety assessment reports, can comprehensively collect system vulnerability information and safety problems, uniformly investigate various safety hazards, and provide a centralized level of safety management capacity building.

In addition, the design principle of the present invention is reliable, the structure is simple, and has very wide application prospects.

It can be seen that, compared with the prior art, the present invention has outstanding substantive features and remarkable progress, and the beneficial effects of its implementation are also obvious.

Description of drawings

Fig. 1 is method flowchart of the present invention;

Fig. 2 is a schematic diagram of the system of the present invention;

Among them, 1-management platform; 1.1-task management module; 1.2-policy management module; 1.3-knowledge base management module; 1.4-asset management module; 1.5-log report module; 2-client; 3-message middleware; 4 - Expert knowledge base.

Detailed ways:

In order to make the purpose, features and advantages of the present invention more obvious and understandable, the technical solutions in the present invention will be clearly and completely described below in conjunction with the drawings in the specific embodiments of the present invention.

Example 1:

As shown in Figure 1, step 1. The client receives the task; the task includes the task of operating the security configuration item of the operating system;

Step 2. The client judges the task type; the task type includes a security scan task, a repair task and a recovery initial configuration task;

Step 3. When the task is a security scanning task, the client scans the security configuration items of the operating system; obtains the scan value of the security configuration items;

Determine whether it is the first scan; if it is the first scan, save the first scan value of the security configuration item;

If it is not the first scan, no operation is performed;

Obtain the baseline value in the security policy;

Compare the scan value of the security configuration item with the baseline value set by the security policy to determine whether the security configuration item is compliant;

The client returns the result of the security scanning task;

Return to step 1;

Step 4. When the task is a repair task, the client scans the security configuration items of the operating system;

Obtain the scan value of the security configuration item;

Determine whether it is the first scan; if it is the first scan, save the first scan value of the security configuration item;

If it is not the first scan, no operation is performed;

Obtain the baseline value in the security policy;

Compare the scan value of the security configuration item with the baseline value set by the security policy to determine whether the security configuration item is compliant;

If not, set the security configuration item to the baseline value in the security policy;

If it complies with the regulations, do not operate;

The client returns the result of the repair task;

Return to step 1;

Step 5. When the task is to restore the initial configuration task, the client obtains the initial scan value of the security configuration item, sets the security configuration item of the operating system as the initial scan value, restores the state at the time of the initial scan, and the client returns to restore the initial configuration the results of the execution of the task;

Return to step 1.

The above-mentioned embodiment 1, before step 1, also includes step 1A: the client receives the security policy; the security policy includes scanning settings, repair settings and security configuration item settings;

Scanning settings include setting whether to enable scheduled scanning and setting the scanning frequency;

The repair setting includes setting the repair range;

Security configuration item settings, including the setting of baseline values; to set baseline values, select the level of baseline values from the level templates of security configuration items stored in the expert knowledge base. The level templates of security configuration items include advanced, intermediate and lower;

Users can flexibly configure the baseline value and open status of security configuration items, adjust the security level as needed, and balance the security and convenience of the host. Users can uniformly configure the baseline values of the security configuration items of the operating system through unified configuration management. The expert knowledge base has built-in security configuration policy templates of different security levels to construct a more secure operating system platform and reduce the compliance of the host operating system. risks of.

The above embodiment 1, before step 1, also includes the following steps: Step 1B. The management platform performs baseline management on the assets of the operating system where the client is located;

The assets of the operating system include physical machines, virtual machines and virtualization software;

Baseline management of operating system assets includes automatic asset discovery, manual asset entry, and asset grouping;

Step 1C. The management platform creates a task and sends the task to the client.

In step 3, step 4 and step 5, the client returns the log while returning the task result;

In step 5, before returning to step 1, the method further includes: the management platform receives the log sent by the client, and generates a log report. The log report is a detailed security assessment report, which can more intuitively represent the security status of the client operating system and the operations performed on the security configuration items of the client operating system.

Example 2:

Embodiment 2 is to apply the above embodiment 1 to operate the security configuration items of the client operating system.

The management platform creates a security scan task and sends the security scan task to the client;

The client receives the task sent by the management platform and determines that the task type is a security scanning task;

When the task is a security scan task, the client scans the security configuration items of the operating system through the security baseline security component to obtain the scan value of the security configuration items, and the client judges that it is not the first scan;

Obtain the baseline value in the security policy;

The client compares the scan value of the security configuration item with the baseline value set by the security policy to determine whether the security configuration item is compliant; it determines that the access control in the security configuration item is not compliant;

The client returns the result of the security scanning task;

The management platform receives the execution result of the security scanning task returned by the client, and the access control of the security configuration items of the client is not compliant;

The management platform creates a repair task and sends the repair task to the client;

The client receives the task sent by the management platform and judges that the task type is a repair task;

When the task is a repair task, the client scans the security configuration items of the operating system through the security baseline security component, obtains the scan value of the security configuration item, obtains the baseline value of the access control in the security policy, and compares the security configuration item by scanning value and the baseline value set by the security policy to judge whether the security configuration items are compliant;

The access control of the security configuration item is not compliant, and the access control of the security configuration item is set to the baseline value in the security policy through the security baseline security component, and the client returns the result of the repair task;

The management platform receives the execution result of the repair task returned by the client, and the repair task of access control of the security configuration item of the client is completed;

At this time, if the operating system of the client has affected the normal business due to repairing access control, continue with the following steps;

The management platform creates an initial configuration task and sends the recovery initial configuration task to the client;

The client receives the task sent by the management platform and judges that the task type is to restore the initial configuration task;

When the task is to restore the initial configuration task, the client obtains the initial scan value of the security configuration item, sets the access control of the security configuration item of the operating system to the initial scan value through the security baseline security component, restores the state at the time of the initial scan, and the client returns Restore the execution result of the initial configuration task;

The management platform receives the execution result of the restore initial configuration access control task returned by the client, and the restore initial configuration task of the client's security configuration items is completed.

In the above-mentioned embodiment 2, before the security operating system of the client is scanned, the management platform sends a security policy to the client; for example, it is set to scan once every 30 minutes; the access control in the security configuration is set to select high-level, medium-level and low-level The high-level templates in the templates, that is, access control adopts strict control, such as low-privilege access prohibition; the high-level, medium-level and low-level templates that control access in security configuration items are stored in the expert knowledge base, and the expert knowledge base also supports upgrades to ensure security. The templates of each level of access control in configuration items comply with the latest standards and requirements.

Example 3:

As shown in Figure 2, the present invention also provides a management system of a security baseline, including a management platform 1 and a client 2, and the management platform 1 and the client 2 are connected through a message middleware 3; the message middleware 3 adopts the message bus of RabbitMQ ; Management platform 1 and client 2 adopt B/S architecture or C/S architecture; the number of client 2 is several, that is, the management platform manages the security of multiple clients;

The management platform 1 includes a task management module 1.1, a policy management module 1.2, a knowledge base management module 1.3, an asset management module 1.4, and a log report module 1.5; the knowledge base management module 1.3 is connected to an expert knowledge base 4;

The client 2 includes a sub-task management module 2.1, a security baseline security component module 2.2 and a sub-policy management module 2.3;

The task management module 1.1 is used to create a task and send the task to the subtask management module 2.1 of the client 2, and receive the task execution result returned by the subtask management module 2.1 of the client 2;

The tasks include a security scanning task, a repairing task, and a restoring initial configuration task;

The security scan task is used to scan the real-time security configuration items of the operating system where the client is located, obtain the scan value of the security configuration item, and judge whether it is the first scan. When it is the first scan, save the initial scan value of the security configuration item; it is also used to Obtain the baseline value in the security policy, compare the scan value of the security configuration item with the baseline value set by the security policy to determine whether the security configuration item is compliant; the security configuration item includes identity authentication, access control, security audit, and residual information protection, intrusion prevention, malicious code prevention, and resource control;

The repair task is used to scan the real-time security configuration items of the operating system where the client is located, obtain the scan value of the security configuration item, obtain the baseline value in the security policy, and compare the scan value of the security configuration item with the baseline value of the security policy set To determine whether the security configuration item is compliant; when the scan value of the security configuration item is not in compliance, set the security configuration item to the baseline value in the security policy;

Restoring the initial configuration task is used to obtain the initial scanning value of the security configuration item, set the security configuration item of the operating system to the initial scanning value, and restore the state at the initial scanning;

The policy management module 1.2 is used to set and send a security policy to the sub-policy management module 2.3 of the client 2; the security policy includes scanning settings, repair settings and security configuration item settings;

The expert knowledge base 4 is used to store level templates of security configuration items; the level templates include high-level templates, intermediate-level templates and low-level templates;

Knowledge base management module 1.3, used to upgrade expert knowledge base 4;

The asset management module 1.4 is used to perform baseline management on the assets of the operating system where the client 2 is located; the assets of the operating system include physical machines, virtual machines and virtualization software;

The log report module 1.5 is used to receive the logs of the log management module 2.4 of the client 2, perform statistical analysis on the asset compliance of assets or asset groups within a specified time period, and generate log reports;

The subtask management module 2.1 is used to receive the task of the task management module 1.1 of the management platform 1, send an execution command to the safety baseline security component module 1.1, and return the task execution result to the task management module 1.1 of the management platform 1;

The security baseline security component module 2.2 is used to perform security scanning tasks to obtain the values of security configuration items; to perform repair tasks or restore initial configuration tasks to set the values of security configuration items;

The sub-policy management module 2.3 is used to receive the security policy set by the policy management module 1.2 of the management platform 1;

The log management module 2.4 is used to send logs to the log report module 1.5 of the management platform 1.

The embodiments of the present invention are illustrative, rather than limiting, and the above-mentioned embodiments are only to help understand the present invention, so the present invention is not limited to the embodiments described in the specific implementation manner, and those skilled in the art according to the technology of the present invention Other specific implementation modes derived from the scheme also belong to the protection scope of the present invention.

Claims (10)

1. A management method of a safety baseline, characterized in that, comprising the steps of: Step 1. The client receives the task; the task includes the task of operating the security configuration item of the operating system; Step 2. The client judges the task type; the task type includes a security scan task, a repair task and a recovery initial configuration task; Step 3. When the task is a security scan task, the client scans the security configuration items of the operating system to obtain the scan value of the security configuration items; Obtain the baseline value in the security policy; Compare the scan value of the security configuration item with the baseline value set by the security policy to determine whether the security configuration item is compliant; The client returns the result of the security scanning task; Return to step 1. 2. The management method of a kind of safety baseline as claimed in claim 1, is characterized in that, also comprises the steps: Step 4. When the task is a repair task, the client scans the security configuration items of the operating system; Obtain the scan value of the security configuration item; Obtain the baseline value in the security policy; Compare the scan value of the security configuration item with the baseline value set by the security policy to determine whether the security configuration item is compliant; If not, set the security configuration item to the baseline value in the security policy; If it complies with the regulations, do not operate; The client returns the result of the repair task; Return to step 1. 3. The management method of a kind of security baseline as claimed in claim 2, is characterized in that, in step 3 and step 4, when client scans the security configuration item of operating system, judges whether it is initial scanning; If it is the first scan, save the first scan value of the security configuration item; If it is not the first scan, no operation is performed; After step 4 also include: Step 5. When the task is to restore the initial configuration task, the client obtains the initial scan value of the security configuration item, sets the security configuration item of the operating system as the initial scan value, restores the state at the time of the initial scan, and the client returns to restore the initial configuration the results of the execution of the task; Return to step 1. 4. The management method of a kind of safety baseline as claimed in claim 1, is characterized in that, Step 1A is also included before step 1: the client receives a security policy; the security policy includes scan settings, repair settings, and security configuration item settings; Scanning settings include setting whether to enable scheduled scanning and setting the scanning frequency; The repair setting includes setting the repair range; Security configuration item settings, including setting baseline values. 5. the management method of a kind of safety baseline as claimed in claim 3 is characterized in that, Before step 1, the following steps are also included: Step 1B. The management platform performs baseline management on the assets of the operating system where the client is located; The assets of the operating system include physical machines, virtual machines and virtualization software; Baseline management of operating system assets includes automatic asset discovery, manual asset entry, and asset grouping; Step 1C. The management platform creates a task and sends the task to the client. 6. A security baseline management system, characterized by comprising a client (2); The client (2) includes a subtask management module (2.1) and a security baseline security component module (2.2); The subtask management module (2.1) is used to receive tasks, send execution commands to the security baseline security component module (2.2), and return the execution results; The tasks include a security scanning task, a repairing task, and a restoring initial configuration task; The security baseline security component module (2.2) is used to perform security scanning tasks to obtain the values of security configuration items; it is used to perform repair tasks or restore initial configuration tasks to set the values of security configuration items. 7. The security baseline management system according to claim 6, further comprising a management platform (1), and the management platform (1) is connected to the client (2) through a message middleware (3); The management platform (1) includes a task management module (1.1); The task management module (1.1) is used to create a task and send the task to the subtask management module (2.1) of the client (2), and receive the task execution result returned by the subtask management module (2.1) of the client (2). 8. A security baseline management system according to claim 7, characterized in that the client (2) further includes a sub-policy management module (2.3); A sub-policy management module (2.3), configured to receive security policies; The management platform (1) also includes a strategy management module (1.2) and a knowledge base management module (1.3); The knowledge base management module (1.3) is connected with the expert knowledge base (4); A policy management module (1.2), configured to set and send a security policy to the sub-policy management module (2.3) of the client (2); the security policy includes scan settings, repair settings, and security configuration item settings; An expert knowledge base (4), used for storing level templates of security configuration items; the level templates include high-level templates, intermediate-level templates and low-level templates; The knowledge base management module (1.3) is used to upgrade the expert knowledge base (4). 9. A security baseline management system according to claim 7, characterized in that the management platform (1) further includes an asset management module (1.4); An asset management module (1.4), configured to perform baseline management on the assets of the operating system where the client (2) resides; the assets of the operating system include physical machines, virtual machines, and virtualization software. 10. The security baseline management system according to claim 7, characterized in that, the client (2) further includes a log management module (2.4), and the management platform (1) also includes a log report module (1.5); Log management module (2.4), used to send logs; The log report module (1.5) is used to receive the logs of the client (2) log management module (2.4), perform statistical analysis on asset compliance of assets or asset groups within a specified time period, and generate log reports.