Yuntian Security - Taishan Shield network security operation platform-百老汇app

介绍

Taishan Network security operation platform is a comprehensive security control and operation platform integrating SOC and security services, providing security control and aggregation capabilities for cities, regions, industries and enterprises to maximize security service delivery, unified management and unified command。Based on the security big data center and security brain, quickly build a three-dimensional, intelligent, active, dynamic security operation and management system。Provide the dual capabilities of security protection and security operation in cyberspace。It adopts a large-scale, intensive, networked, systematic, data-oriented, and intelligent aggregated service model to introduce national information security resources, gather industrial information security capabilities, and protect national critical infrastructure and important information systems by means of big data, artificial intelligence, and cloud computing platforms。Provide management, operation and decision support for security early warning, effective monitoring, effective traceability, effective disposal, and security governance, realize the transformation from passive security protection to active security management and control, and form a new model of sustainable development of security infrastructure construction。

solution

Taishan Shield security operation platform is based on security big data center and security brain，Realize data collection, intelligent analysis, perception identification, real-time monitoring, intelligent prediction, response and disposal, early warning notification and security governance, and realize security operations such as asset management, situation awareness, system defense, command and dispatch, offensive and defensive drills, network security, business security and data security，Service transaction, security community, service provider management platform, operation and maintenance operation platform and security operation management platform service operation based on the security trading platform scenario，Form a security management platform with security service transaction, comprehensive data management and comprehensive security incident management capabilities。The platform utilizes a variety of threat detection technologies, big data association analysis and machine learning techniques，In conjunction with the National Threat Intelligence Data Service，Comprehensive mapping, risk detection and attack tracing of its important and critical information infrastructure，It deeply describes the data situation of people, things, places, things and related relationships at the level of network security。It has realized the pre-warning, discovery in the incident, backtracking, early warning notification and so on。Build a closed loop of network security management from a global perspective。

01

Establish a network security data collection and intelligence sharing mechanism

The platform brings together key information infrastructure security monitoring data, national platform data, industry authorities monitoring data, cybersecurity incident and threat intelligence data，And use big data, artificial intelligence, blockchain and earthworm box and other technologies to summarize, analyze, research and judge all kinds of data，Timely detection of regional cybersecurity risks，We will effectively raise the level of cybersecurity monitoring, early warning and protection，Promote cybersecurity information sharing。

02

Establish a comprehensive management platform for security operation coordination and defense

The security related people, things, things, places and their mutual relations are unified and coordinated, and the policy linkage and disposal mechanism of security orchestration, automation and response (SOAR) is developed to solve the single security protection of fragmented information security data island。

03

Build a management platform with unified command and dispatch capability for network security

Build a network security command platform to realize core business systems such as threat perception, real-time monitoring, information reporting, emergency command, supervision objects, intelligence information, inspection and supervision, management evaluation, and offensive and defensive drills, and comprehensively improve the level of network security collaborative supervision and command services。
04

Establish a network security information announcement, early warning and notification mechanism

Coordinate with third-party regulatory departments (public security, network information, big data bureau, etc.) to protect critical information infrastructure, and uniformly release authoritative network security information。When network security events, vulnerabilities, hidden dangers, and malicious trojans occur, the real-time monitoring system monitoring data, upper-level security event notification, and third-party intelligence sources are used for security event notification and early warning。At the same time, it releases major network security vulnerability reports, virus notifications, related network security incidents, security analysis reports and other information, provides disposal measures and suggestions, and provides network security services。

05

Establish an emergency response mechanism for cyber security incidents

Coordinate with various regulatory authorities, industry authorities, local support units, etc., to ensure orderly coordination and command in the event of major cybersecurity incidents or major events and meetings。For major security incidents affecting critical information infrastructure, the province has established a sound emergency response mechanism and process, and formulated integrated emergency plans for various types of network security emergency incidents to effectively ensure network security。Build a library of emergency plans, accumulate knowledge of historical emergency plans, typical cases, and actual combat exercises, and provide guidance for the coordination and command of subsequent cyber security incidents and major support activities。

06

Establish a cyber security mechanism for major events

During the guarantee period of major activities, jointly formulate the guarantee plan, determine the guarantee time range, management scope, responsible person and participants, formulate the inspection work plan, formulate the guarantee exercise plan, formulate the emergency plan and formulate the guarantee duty schedule。
07

Establish a joint inspection and work evaluation incentive mechanism

Set up joint inspection teams with regulatory departments, industry authorities, assessment agencies, etc., and provide technical support with security enterprises and technical support units to carry out on-site safety inspections and information investigations。Carry out regular and irregular inspection of key information infrastructure, establish a joint inspection mechanism for network security, form a joint supervision force with online monitoring and offline inspection, and find out the network security situation of key information infrastructure in the province。

08

Establish B2B security operation service sharing model

Form trading orders on the secure service trading platform (mall)，The security operation center decomposes services according to the service catalog and service standard system and sends them to the security operation and maintenance service provider，Its safety operation and maintenance engineers carry out operation and maintenance operations according to service standards and work orders in accordance with safety service rules, safety service standards and specifications, and safety service operation manuals，The customer formed a scoring and evaluation, combined with the performance appraisal mechanism and the service tracking return visit mechanism to form a security governance upgrade strategy，Complete the closed loop of service trading operations。

Program advantage

System characteristics

01

Open architecture Layered and decoupled technology architecture adapted to multiple scenarios
The platform decouples data collection function, data storage analysis function and business system function, and builds an open technology architecture based on IaaS, PaaS, DaaS and SaaS, which can be compatible with and adapt to users' existing diversified IT environments such as cloud computing and big data。
02

Multi-source heterogeneous data acquisition capability
Fully support different brands of different types of security data acquisition equipment and different sources of different structures of data，Adopt a variety of data docking methods such as active acquisition, active acquisition and passive reception，Based on data center data visualization, intelligent governance，To form an all-round security data collection and analysis capability of all elements in cyberspace。
03

The supervision of geographic information in cyberspace can be seen
The visualization technology based on network geographic map information integrates network security events and cyberspace asset data to enrich the visual expression from the dimensions of geography, assets and events, comprehensively display and describe the distribution and attributes of cyberspace resources, and realize the visual expression of cyberspace elements。Events are used as trigger conditions，Quickly concatenate events, assets, and geographic elements through graphics，Clarify the interaction between the various elements，To form a set of dynamic, real-time, reliable and effective cyberspace operational command map，Make the asset base more clear, incident discovery more accurate, threat positioning more accurate, threat analysis more intelligent, threat tracing more automatic;Improve the capabilities and efficiency of business units in incident discovery, forensic location, and traceability，Make the work of functional departments more intelligent, automatic and visual。
04

Closed-loop early warning notification process based on industry supervision scenarios
The platform supports mobile apps, Dingding, wechat mini programs, SMS and other notification methods to achieve second-level notification and feedback of important security events and threats, thus forming a complete network security supervision business closed loop with zero loss of regulatory data。
05

7X24 hours online experts on duty, security warning zero false alarms
The platform establishes forensic research and judgment to ensure zero false positives in the monitored vulnerabilities, assists users in customizing special notifications and provides 7×24 hours emergency response, escorting the safety of the user system。
06

Professional experts and service team
The company has a huge security analysis experts and security service team, to provide the "cloud + platform + service" operation model, to provide users with timely and effective security services, to provide security for the uninterrupted and stable operation of the business。

In reality, security operation faces many challenges

With the increasing size of traditional security systems, enterprises often face the following security challenges in the process of security operations:
In order to improve safety, safety equipment is constantly piled up, and the increase in the number of equipment increases the difficulty of operation and maintenance.
All kinds of security equipment are relatively dispersed and isolated, forming security islands;
Massive security logs contain various false positives, which makes manual analysis difficult.
Traditional safety equipment can only analyze past or present problems without predicting future risks.
Traditional security equipment can not store the original data information, security events, traceability is difficult;
Lack of security operation personnel and insufficient analysis and processing of data。
The industry's thinking on security threat detection and defense has changed dramatically, recognizing the need for a single device, a single method, and a focus from the past
Threat single-stage, real-time detection evolves to the establishment of a defense system in depth, from passive to active, looking at the problem from the whole threat attack chain, and building a situational awareness system based on big data analysis is the most effective means of response。

首页

Industrial control safety

Introduction to industrial control safety

Cloud series products

Net series products

End series product

Inspection series

Industrial Control Safety Information Center

New service of industrial control safety

Offensive and defensive security

Data security

Operation and maintenance + Security

Safe operation

Introduction to safe operation

Product series

solution

Security service

Safe community

Education and training

Industry program

Into the sky

介绍

solution

Program advantage

In reality, security operation faces many challenges

01

Establish a network security data collection and intelligence sharing mechanism

02

Establish a comprehensive management platform for security operation coordination and defense

03

Build a management platform with unified command and dispatch capability for network security

04

Establish a network security information announcement, early warning and notification mechanism

05

Establish an emergency response mechanism for cyber security incidents

06

Establish a cyber security mechanism for major events

07

Establish a joint inspection and work evaluation incentive mechanism

08

Establish B2B security operation service sharing model

01

02

03

04

05

06

With the increasing size of traditional security systems, enterprises often face the following security challenges in the process of security operations:

In order to improve safety, safety equipment is constantly piled up, and the increase in the number of equipment increases the difficulty of operation and maintenance.

All kinds of security equipment are relatively dispersed and isolated, forming security islands;

Massive security logs contain various false positives, which makes manual analysis difficult.

Traditional safety equipment can only analyze past or present problems without predicting future risks.

Traditional security equipment can not store the original data information, security events, traceability is difficult;

Lack of security operation personnel and insufficient analysis and processing of data。

The industry's thinking on security threat detection and defense has changed dramatically, recognizing the need for a single device, a single method, and a focus from the past

Threat single-stage, real-time detection evolves to the establishment of a defense system in depth, from passive to active, looking at the problem from the whole threat attack chain, and building a situational awareness system based on big data analysis is the most effective means of response。

Industrial control safety

Offensive and defensive security

Data security

Safe operation

Education and training

Industry program

Into the sky

400-666-3110

(Monday to Friday: 08:30-17:30)

Email: yuntian@dongbeizhenzi.com

Address: Building 1, Phase 3, Century City, Zhonggrun

Yuntian security subscription number Cloud Sky Security Service number

Shandong Yuntian Safety Technology Co., LTD. All rights reserved Lu ICP No. 17007379-1

Lu public network Anbei 37010202002190