軟件安全基礎(chǔ)課件-全文預(yù)覽
【正文】 interface……is this plex The work is the puter.Know your code. Trust your code1980 1985 1990 1995 2023黑客攻擊方式的進(jìn)化Password Guessing SelfReplicating CodePassword CrackingExploiting Known VulnerabilitiesBurglariesHijacking SessionsNetworked Management DiagnosisGUIAutomated Probes/ScansDistributed Attack ToolsStaged AttackAttack SophisticationIntruder KnowledgeLOWHIGH1980 1985 1990 1995 2023Disabling AuditsBack DoorsSweepersSniffersPacket SpoofingDenial of Service“Stealth”/Advanced Scanning TechniquesCrossSite ScriptingKnow your code. Trust your code傳統(tǒng)的 “加層 ”保護(hù)方案HackersWorms VirusesMalicious InsidersTraditional work/perimeter defensesCritical Software Automation Of Key Operational ProcessesKnow your code. Trust your code軟件的應(yīng)用因?yàn)闃I(yè)務(wù)和功能的需要必須打破傳統(tǒng)的保護(hù)層 ,直接與外面的系統(tǒng)交互Web Facing ApplicationsLegacy App IntegrationConnectivity w/ Partners SuppliersOutsourcingEmployee SelfServiceKnow your code. Trust your code為什么傳統(tǒng)的基于網(wǎng)絡(luò)方案不工作? Key– Network– Web? Restrict Access– Firewall– Everyone has access? Authenticate users– Windows / Unix auth– HTTP has WEAK authentication? Monitor for attacks– IDS / IPS– Critical traffic is in SSL Tunnel? Track users (state)– User of TCP/IP connections– HTTP is stateless? Block known attacks– IPS (Selfdefending works)– Web attacks are extremely hard to distinguish from normal activityKnow your code. Trust your codeInter DMZ Trusted InsideCorporate InsideHTTP(S)IMAP FTPSSH TELNETPOP3Firewall only allows PORT 80 (or 443 SSL) traffic from the Inter to the web server.Any – Web Server: 80Firewall only allows applications on the web server to talk to application server. Firewall only allows application server to talk to database server.IISSunOneApacheASP.NETWebSphereJavaSQLOracleDB2Know your code. Trust your code 軟件易于遭受的安全弱點(diǎn) :167。 Other Categories 軟件安全弱點(diǎn)的底線 :167。– 敏感數(shù)據(jù)需要加密– 用戶識(shí)別機(jī)制– 調(diào)整方針? 安全是一個(gè)突發(fā)的需求。非正式的、非標(biāo)準(zhǔn)的測(cè)試用例。 防火墻 應(yīng)用系統(tǒng)的加密技術(shù)Know your code. Trust your code安全操作指南? 系統(tǒng)的應(yīng)用階段．? 軟件安全受益于網(wǎng)絡(luò)安全的操作 .? 沒(méi)有足夠的日志信息去起訴已經(jīng)知道的攻擊．Know your code. Trust your code集成軟件安全實(shí)踐到軟件開(kāi)發(fā)生命周期Know your code. Trust your codeAbout black Hat and white hatDestructive activiti
教學(xué)課件相關(guān)推薦
鄂ICP備17016276號(hào)-1