安全编排与自动化响应平台在医院网络安全中的应用探索

Exploration of the Application of Security Orchestration and Automated Response Platform in Hospital Network Security

目的为解决当前医疗机构使用多种不同的安全设备造成医院安全运维难度大以及无法统一管理等问题,探索建设和应用面向医院安全管理的安全编排与自动化响应平台。方法从全网覆盖、异构联动、综合分析、快速响应的设计角度出发,构建一个安全编排与自动化响应平台,将原本分散且各自独立的安全设备和系统协同联动起来。结果建成了医院安全编排与自动化响应平台,实现了安全能力的集成与编排。自2022年7月上线以来,共监测到外部系统攻击123150次,协助修复应用系统漏洞43个,封锁恶意攻击IP达5019个。结论安全编排与自动化响应平台能够提升医院系统的安全响应及时性和防御实效性,实现全网威胁统一监测分析与运维。

Objective To solve the problems in hospital safety operation and maintenance caused by the use of various security devices in current medical institutions,as well as the inability to manage and configure them uniformly,we explore the construction and application of a security orchestration and automated response system for hospital safety management.Methods Starting from the design perspective of full network coverage,heterogeneous linkage,comprehensive analysis,and rapid response,a security orchestration and automated response platform is constructed to collaboratively link the originally dispersed and independent security devices and systems.Results The hospital security orchestration and automated response platform has been established to integrate and orchestrate security capabilities.Since its launch in July 2022,a total of 123150 external system attacks have been detected,assisting in fixing 43 application system vulnerabilities and blocking 5019 malicious attack IPs.Conclusion The platform can enhance the timeliness and defense effectiveness of hospital systems,and achieve unified monitoring,analysis,and operation of threats across the entire network.