CN110086812A - A kind of safely controllable intranet security patrol police's system and method - Google Patents

Abstract

The present invention relates to the field of computer security, in particular to a safe and controllable intranet security patrol system and method. The method installs an intranet asset mark on a network device in the intranet; judges whether the intranet asset mark includes a login credential information; if yes, execute vulnerability scan with login credential on the network device; otherwise, execute vulnerability scan without login credential on the network device. The present invention scans the network equipment in the intranet for vulnerabilities only when it meets specific conditions. The vulnerability scanning process accidentally damages the host system.

Description

A safe and controllable intranet security patrol system and method

technical field

The invention relates to the field of computer security, in particular to a safe and controllable intranet security patrol system and method.

Background technique

With the increasingly widespread network applications, network security, especially "intranet security" has become one of the key issues faced by IT applications. Various products for intranet security represented by intranet patrol police are increasingly valued by users.

As a network security product aimed at active management, control and monitoring of internal networks and private networks, the intranet security patrol system aims to solve the security management, security control, and behavior monitoring of private networks within enterprises and governments. and security control methods to effectively control the hidden dangers of the internal network with technical means. By monitoring and recording each network behavior, the hidden dangers of the network can be visualized, thereby greatly improving the security of the internal private network, truly Ensure that every network user uses data and information legally within the scope of authorization.

At present, the mainstream intranet security patrol system lacks an effective security boundary detection mechanism, so that when a destination IP address or an IP address range is given, it is easy to generate other non-target host systems outside the IP address or address range. Penetration testing and security auditing, sometimes not only fail to achieve the effect of security reinforcement, but even cause damage to the hosts in the core generation network, affecting the normal operation of system services.

At present, mainstream intranet security products lack a boundary audit mechanism and effective target host security detection and certification marks. When performing penetration testing and security assessment on intranet hosts, it may be due to the interconnection of internal LANs, which may lead to proliferation or wrong attacks. Some non-target host systems that are normally running are threatened by the intranet security patrol system. Some systems that do not want to be scanned and detected may accidentally damage the host system due to the running of the vulnerability verification script, resulting in information leakage, unauthorized access, and even automatic attack POC that paralyzes the system, such as: Eternal Blue (vulnerability number ms17-010) vulnerability verification script It can make the host of the Windows system blue screen, resulting in denial of service.

SUMMARY OF THE INVENTION

In order to solve the above-mentioned problems, the object of the present invention is to provide a security patrol system and method for the intranet, which scans the network equipment in the intranet for vulnerabilities only when it meets specific conditions, and the characteristic condition is that the network The intranet asset identification information sent by the device includes login credential information.

Based on this, the present invention provides a safe and controllable intranet security patrol system, which is characterized in that it includes: an asset management module, a vulnerability scanning module, a security audit module and a network management module;

The asset management module is configured to receive intranet asset identification information sent by network devices in the intranet; the intranet asset identification information is used for asset authentication identification and asset management;

The vulnerability scanning module is used to judge whether the network equipment in the intranet has the login credential information in the intranet asset mark, if so, then scan the vulnerability of the network equipment; if not, do not perform vulnerability scanning on the network equipment scanning; the asset management module uses the login credential information to remotely manage the network device and security device;

The security audit module is used to audit the network equipment and the security equipment, and find problematic equipment with security issues;

The network management module is used to perform security repair on the faulty equipment.

As a preferred technical solution, the asset management module is also used to configure network asset library units with different attributes; the network asset library unit is used to configure intrusion detection tasks and security audit tasks of network devices in the network asset library .

As a preferred technical solution, the intranet asset flag information also includes running flag information; the running flag information is used to discover network devices and security devices in the intranet;

As a preferred technical solution, the security issues include: discovering misconfigurations, abnormal logins, and violations of security policies; the violations of security policies include: the system-level security policies of the network equipment and the security policies of the security equipment. System-level security policy.

As a preferred technical solution, the network management module is also used to determine whether the security problem can be automatically repaired, and if so, perform automatic security repair; if not, send a cooperation notification or a security warning to the intranet security officer.

Based on this, the present invention also proposes a safe and controllable intranet security patrol method, which is characterized in that it includes:

Install the logo, that is, install the intranet asset logo on the network equipment in the intranet;

Vulnerability scanning, that is, judging whether the intranet asset mark includes login credential information; if so, performing vulnerability scanning on the network device; if not, not performing vulnerability scanning on the network device.

As a preferred technical solution, after installing the flag and before vulnerability scanning, the intranet security patrol method also includes: registering assets, that is, judging whether the intranet asset flag includes running flag information, and if so, registering the network device Register as a vulnerability scanning device; if not, end the intranet security patrol method.

As a preferred technical solution, after the vulnerability scanning, the intranet security patrol method further includes: security audit, performing a security audit on the vulnerability scanning device.

As a preferred technical solution, after the vulnerability scanning, the intranet security patrol method also includes: security repair, performing a security repair operation on the vulnerability scanning device, and the security repair includes: policy strengthening, version update, vulnerability repair and patch updates.

Therefore, the security and controllable intranet security patrol system and method proposed by the present invention consider that the network device wants to be scanned and detected only when the network device contains login credential information. The system that does not want to be scanned and detected does not perform vulnerability scanning because it does not contain login credential information, thus avoiding the running of the vulnerability verification script. Avoid accidental damage to the host system during the vulnerability scanning process, resulting in information leakage, unauthorized access, and even automatic attack POC that paralyzes the system, such as: Eternal Blue (vulnerability number ms17-010) vulnerability verification script can cause the host computer of the Windows system to blue screen, resulting in rejection occurrence of services.

Description of drawings

Fig. 1 is the network topology diagram of the intranet security patrol system of the embodiment of the present invention;

Fig. 2 is the frame diagram of the intranet security patrol system of the embodiment of the present invention;

Fig. 3 is the flow chart of the intranet security police patrol method of the embodiment of the present invention;

Fig. 4 is a flowchart of an intranet security patrol method introducing an asset registration step according to an embodiment of the present invention.

Detailed ways

The specific embodiments of the present invention will be described in further detail below with reference to the accompanying drawings and embodiments. The following examples are intended to illustrate the present invention, but not to limit the scope of the present invention.

Example 1

Referring to accompanying drawing 1, the intranet security patrol server that the present invention proposes can be installed on the core switchboard of intranet, makes things convenient for intranet security patrol server to manage the network equipment in intranet like this.

Referring to accompanying drawing 2, the safe and controllable intranet safety patrol system that the present invention proposes comprises: asset management module, loophole scanning module, safety audit module and network management module;

The asset management module is configured to receive the intranet asset identification information sent by the network equipment in the intranet.

The vulnerability scanning module is used to judge whether the network equipment in the intranet has the login credential information in the intranet asset mark, if so, then scan the network equipment for vulnerabilities; otherwise, do not scan the network equipment for vulnerabilities;

The security audit module is used to perform a security audit on network equipment and security equipment in the intranet, that is, to find problematic equipment with security problems in the intranet;

The network management module is used to perform security repair on the faulty equipment.

In the network equipment running in the intranet, all the intranet asset flags are installed and running. In the embodiment of the present invention, the flag can be the Mutex semaphore of the network equipment, which can be used for asset authentication and asset management. After the network device in the intranet is installed with the intranet asset flag, it automatically sends encrypted intranet asset flag information to the intranet patrol server. The encryption process may use HTTPS protocol, RSA encryption algorithm, MD5 encryption algorithm, etc., but is not limited to the above encryption means.

The vulnerability scanning module supports a plug-in verification detection mechanism to detect and verify the vulnerabilities of network devices in the intranet. It is mainly to quickly respond to new security vulnerabilities on the Internet and investigate risks, and evaluate the discovered vulnerabilities. This module and the asset management module Linkage work.

In order to avoid spreading or mistaken attacks, the vulnerability scanning module detects whether there is any login credential information stored in the collected intranet asset identification information of the network device. If there is the login credential information, the vulnerability scanning activity of the network device is in In the intranet security patrol system, it is within the scope of authorization; if not, then the intranet security patrol system does not authorize the vulnerability scanning module to scan the network device for vulnerabilities.

The security audit module mainly conducts security audits on various servers (such as: Web servers, database servers, FTP servers, mail servers, etc.), PC hosts, routers, switches and other network devices, and firewalls and other security devices. The security audit module conducts security policy audits at the host system level and network security system level by analyzing the intranet asset representation information containing login credentials sent by the network device. The security audit module can read the audit log information, and identify security problems from the audit log, such as: misconfiguration, abnormal login, behaviors violating security policies, and the like.

The network management module performs automatic security repairs on the detected target system according to the security problems found by the security audit module. Processing, that is, a security repair that requires the cooperation of security management personnel, and a cooperation notification or security warning is issued to the intranet security personnel.

Example 2

On the basis of Embodiment 1, the intranet asset flag information further includes running flag information. After the intranet patrol server receives the operation flag, it registers the asset information as a credential for subsequent intrusion detection, security audit, and asset management.

The intranet security officer can use the network asset library unit in the asset management module to divide IT assets and create different asset libraries according to the attributes of the network equipment. Through the network asset library unit, intranet security officers can flexibly create intrusion detection tasks and security audit tasks. The network asset library unit supports asset management functions such as adding and deleting assets, and enables or customizes the intrusion detection of discovered network devices. Intranet security personnel can use the keyword search function to filter out qualified network devices and add them to the vulnerability scanning task .

Example 3

Referring to accompanying drawing 3, it is a flow chart of the safe and controllable intranet patrol method proposed by the present invention. The intranet security patrol method includes:

Install the logo, that is, install the intranet asset logo on the network equipment in the intranet;

Vulnerability scanning, that is, judging whether the intranet asset mark includes login credential information; if so, performing vulnerability scanning on the network device; otherwise, not performing vulnerability scanning on the network device.

Security audit, performing a security audit on the vulnerability scanning device;

Security repair, performing a security repair operation on the vulnerability scanning device, the security repair includes: policy enhancement, version update, vulnerability repair and patch update.

The meanings of the terms in this embodiment are the same as those in Embodiment 1 and Embodiment 2 of the present invention. Here, I won't go into details.

Example 4

Referring to FIG. 4 , this embodiment is based on Embodiment 3, and the intranet asset flag information also includes running flag information. After the intranet patrol server receives the operation flag, it registers the asset information as a credential for subsequent intrusion detection, security audit, and asset management.

The intranet patrol method proposed by this application is based on embodiment 3. After the flag is installed and before the vulnerability scan, the following steps are added: registering assets, that is, judging whether the intranet asset flag includes running flag information, and if so, add the following steps: The network device is registered as a vulnerability scanning device; if not, the intranet security patrol method is ended.

The intranet security officer can use the network asset library unit in the asset management module to divide IT assets and create different asset libraries according to the attributes of the network equipment. Through the network asset library unit, intranet security officers can flexibly create intrusion detection tasks and security audit tasks. The network asset library unit supports asset management functions such as adding and deleting assets, and enables or customizes the intrusion detection of discovered network devices. Intranet security personnel can use the keyword search function to filter out qualified network devices and add them to the vulnerability scanning task .

Therefore, the security and controllable intranet security patrol system and method proposed by the present invention consider that the network device wants to be scanned and detected only when the network device contains login credential information. The system that does not want to be scanned and detected does not perform vulnerability scanning because it does not contain login credential information, thus avoiding the running of the vulnerability verification script. Avoid accidental damage to the host system during the vulnerability scanning process, resulting in information leakage, unauthorized access, and even automatic attack POC that paralyzes the system, such as: Eternal Blue (vulnerability number ms17-010) vulnerability verification script can cause the host computer of the Windows system to blue screen, resulting in rejection occurrence of services.

The above is only a preferred embodiment of the present invention, it should be pointed out that for those of ordinary skill in the art, without departing from the technical principle of the present invention, some improvements and replacements can also be made, these improvements and replacements It should also be regarded as the protection scope of the present invention.

Claims (10)

1. A safe and controllable intranet security patrol system is characterized in that it comprises: an asset management module, a vulnerability scanning module, a safety audit module and a network management module; The asset management module is configured to receive intranet asset identification information sent by network devices in the intranet; the intranet asset identification information is used for asset authentication identification and asset management; The vulnerability scanning module is used to judge whether the network equipment in the intranet has the login credential information in the intranet asset mark, if so, then scan the vulnerability of the network equipment; if not, do not perform vulnerability scanning on the network equipment scanning; the asset management module uses the login credential information to remotely manage the network device and security device; The security audit module is used to audit the network equipment and the security equipment, and find problematic equipment with security problems; The network management module is used to perform security repair on the faulty equipment. 2. Intranet security patrol system as claimed in claim 1, characterized in that: The asset management module is also used to configure network asset library units with different attributes; The network asset library unit is used to configure intrusion detection tasks and security audit tasks of network devices in the network asset library. 3. Intranet security patrol system as claimed in claim 2, characterized in that: The intranet asset flag information also includes running flag information; The running flag information is used to discover network devices and security devices in the intranet. 4. Intranet security patrol system as claimed in claim 1, characterized in that: The security issues include: discovery of misconfiguration, abnormal login, and violation of security policies; The violation of the security policy includes: a system-level security policy of the network device and a system-level security policy of the security device. 5. Intranet security patrol system as claimed in claim 1 or 4, characterized in that: The content of security repair performed by the network management module on the problematic device includes: policy strengthening, version update, bug fix and patch update. 6. Intranet security patrol system as claimed in claim 1 or 4, characterized in that: The network management module is also used to determine whether the security problem can be automatically repaired, and if so, perform automatic security repair; if not, send a cooperation notification or a security warning to the intranet security officer. 7. A safe and controllable intranet security patrol method, characterized in that it comprises: Install the logo, that is, install the intranet asset logo on the network equipment in the intranet; Vulnerability scanning, that is, judging whether the intranet asset mark includes login credential information; if so, performing vulnerability scanning on the network device; if not, not performing vulnerability scanning on the network device. 8. Intranet security patrol method as claimed in claim 7, is characterized in that, after installing sign and before vulnerability scanning, described intranet security patrol method also comprises; Registering assets means judging whether the intranet asset flag includes running flag information, if so, registering the network device as a vulnerability scanning device; if not, ending the intranet security patrol method. 9. Intranet security patrol method as claimed in claim 7 or 8, is characterized in that, after vulnerability scanning, described intranet security patrol method also comprises: Security audit, performing a security audit on the vulnerability scanning device. 10. Intranet security patrol method as claimed in claim 9, is characterized in that, after vulnerability scanning, described intranet security patrol method also comprises: Security repair, performing a security repair operation on the vulnerability scanning device, the security repair includes: policy enhancement, version update, vulnerability repair and patch update.