1應用軟件安全基礎-在線瀏覽
2025-03-17 03:20本頁面
【正文】 DoorsSweepersSniffersPacket SpoofingDenial of Service“Stealth”/Advanced Scanning TechniquesCrossSite ScriptingKnow your code. Trust your code傳統(tǒng)的 “加層 ”保護方案HackersWorms VirusesMalicious InsidersTraditional work/perimeter defensesCritical Software Automation Of Key Operational ProcessesKnow your code. Trust your code軟件的應用因為業(yè)務和功能的需要必須打破傳統(tǒng)的保護層 ,直接與外面的系統(tǒng)交互Web Facing ApplicationsLegacy App IntegrationConnectivity w/ Partners SuppliersOutsourcingEmployee SelfServiceKnow your code. Trust your code為什么傳統(tǒng)的基于網(wǎng)絡方案不工作? Key– Network– Web? Restrict Access– Firewall– Everyone has access? Authenticate users– Windows / Unix auth– HTTP has WEAK authentication? Monitor for attacks– IDS / IPS– Critical traffic is in SSL Tunnel? Track users (state)– User of TCP/IP connections– HTTP is stateless? Block known attacks– IPS (Selfdefending works)– Web attacks are extremely hard to distinguish from normal activityKnow your code. Trust your codeInter DMZ Trusted InsideCorporate InsideHTTP(S)IMAP FTPSSH TELNETPOP3Firewall only allows PORT 80 (or 443 SSL) traffic from the Inter to the web server.Any – Web Server: 80Firewall only allows applications on the web server to talk to application server. Firewall only allows application server to talk to database server.IISSunOneApacheASP.NETWebSphereJavaSQLOracleDB2Know your code. Trust your code 軟件易于遭受的安全弱點 :167。 Buffer Overflows167。 Other Categories 軟件安全弱點的底線 :167。 Compliance167。– 敏感數(shù)據(jù)需要加密– 用戶識別機制– 調整方針? 安全是一個突發(fā)的需求。正式的、標準的測試用例。非正式的、非標準的測試用例。滲透測試能夠直觀的讓管理人員知道自己網(wǎng)絡所面臨的問題。 防火墻 應用系統(tǒng)的加密技術Know your code. Trust your code安全操作指南? 系統(tǒng)的應用階段．? 軟件安全受益于網(wǎng)絡安全的操作 .? 沒有足夠的日志信息去起訴已經(jīng)知道的攻擊．Know your code. Trust your code集成軟件安全實踐到軟件開發(fā)生命周期Know your code. Trust your codeAbout black Hat and white hatDestructive activities as those about Attacks, exploits, breaking softwareConstructive activitiesas those about design defense and functionalityKnow your code. Trust your codeExternal AnalysisWhy only seven?Know your code. Trust your code安全知識? 軟件安全的最大的挑戰(zhàn)是我們缺乏在 軟件安全方面的知識和經(jīng)驗．因此我們需要，也非常有必要給我們的開發(fā)人員設計人員，分析人員更多的有關軟件安全的知識的培訓，以期他們具備豐富的軟件安全的知識．Know your code. Trust your code安全知識Attacks are plex and follow patterns? Make the Client Invisible? Target Programs That Write to Privileged OS Resources ? Use a UserSupplied Configuration File to Run Commands That Elevate Privilege ? Make Use of Configuration File Search Paths ? Direct Access to Executable Files ? Embedding Scripts within Scripts ? Leverage Executable Code in Nonexe
教學課件相關推薦
鄂ICP備17016276號-1