cissp中文培训课件国内知名机构-操作安全

SecurityControlsandAuditing 1 控制与保护(ControlsandSecurityControlsandAuditing1 控制与保护(Controlsand1.11.1保护的资终端用户资源(员工使用的windows98／2000/XP主机网络资源(路由器、交换机 系统服务器资源(包括操作系统，数据库Web，FTP和e-mail服务器信息资源(包括人力资源和电子商务数据库ProcessingequipmentProcessingequipmentSensitive/CriticaldataSystemSystemlogs/audittrailsViolationreportsBackupfilesSensitiveforms1.2识whatcanbedonetoprotectithowistheitemused?Describepermissionsets(whocanread,write,orexecutethefiles,forexample)forthedifferenttypesofobjectswithinyourinfrastructure1.3目对 、减少脆弱性、限制安全事故产生的影功形1.3目对 、减少脆弱性、限制安全事故产生的影功形控制（实践、规程、制度PreventativeAredesignedtolowertheamountandimpactofunintentionalerrorsthatareenteringthesystemandtopreventunauthorizedintruderfrominternallyorexternallyaccessingthesystem.保护脆弱点，减 的影响，或者避免的成CategoriesCategoriesof检测控制DetectiveAreusedtodetectanerroronceithasoccurred.检测击/错误的发纠正/恢复CorrectiveControlsRecoveryControls:Areimplementedtomitigatetheimpactofalosseventthroughdatarecoveryprocedures.减 的影Categoriesof威慑控制DeterrentDontrol/DirectiveAreusedtoencouragecompliancewithexternal减 发生的可能应用控制ApplicationArethecontrolsthataredesignedintoasoftwareapplicationtominimizeanddetectthesoftware'soperationalirregularitiesCategoriesCategoriesof事务控制TransactionTypesofcontrolsare:Input,processing,output,changeandtestcontrols.输入控制：事务进入更改控制：系统置变化时的据完整性测试控制：系统测试时的 性和1.3.2OrangeBook操作保障OperationalfocusesonbasicfeaturesandarchitectureofaSystemintegrityCovertchannel TrustedfacilitymanagementTrustedrecoveryLifecyclecontrolsandstandardsrequiredforbuildingandmaintainingasystem-Lifecyclecontrolsandstandardsrequiredforbuildingandmaintainingasystem-SecurityDesignspecificationandtestingConfigurationmanagementTrusteddistrbutionCovert -Thesystemmustprotectagainstcovertstorage-B3andThesystemmustprotectagainstbothcovertstorageandcoverttimingchannels(隐蔽定时通道）.Itmustperformacovertchannelysisforbothtypes.TrustedFacilityTrustedFacilitySystemsmustsupportseparateoperatorandsystemadministratorroles.支持操作员与系统管理员角色分离B3andA1:Systemmustclearlyidentifyfunctionsofthesecurityadministratortoperformthesecurity-relatedfunctions.TrustedRecovery可信恢复TrustedEnsuresSecurityisnotbreachedwhenacrashesorSystemmustberestartedwithoutcompromisingTrustedTrustedRecoveryIsonlyrequiredforB3andA1levelsystems.Twoprimaryactivities:FailureBackingupallcriticalfilesonaregularbasis.Systemrecovery:reboot,recoverallfilesystems变更控制(RequiredB2,B3andConfiguration/ChangeManagementControl: 系统变化网影响安全的其他变变更控制的目标：避免系统变化对于安全性的无确保将要发生的变更已经通知到每个相关用户分析实现系统变更后的效果 -Applyingtointroducea-Catalogingtheintended-确保将要发生的变更已经通知到每个相关用户分析实现系统变更后的效果-Applyingtointroducea-Catalogingtheintended-文档变 ingthe-Testingthe-Reportingthe行行政控制人员安全alSecurity责任分离SeparationofDuties LeastPrivilege需要知道Needto变更控制Change/Configuration记录保留RecordRetentionandEmploymentScreeningorBackgroundChecks雇佣选或背MandatoryVacationMandatoryTakingofVacationinOneWeekIncrement强制休假JobActionWarningsor警告或解RotationofLimitingthelengthoftimeaperformsdutiesbeforebeingmovedSeparationSeparationofduties责任分离分权制–三权分系统管理员、安全管理员系统管理员增删用安全管理员安全审计员评审审计数据,日志Two-manTwooperatorsreviewandapprovetheworkofeachDualTwo-manTwooperatorsreviewandapprovetheworkofeachDualBothoperatorsareneededtocompleteasensitiveLeastPrivilegeReadOnly只读：只可以数Read/write读/写：可以修 的数AccessChange修改：可以修改源数据和的执行执行一个工作所需要的特定计算机操作员备安装和卸载作业控制分析总体质生产调度员度建立处理周期和日生产控制分析打印和分发计算机报表和缩微磁带管理员和 交换磁)Data–ReferstothedataleftonthemediaafterthemediahasbeenerasedDueCareandDueStepsthataretakentoshowthatacompanyhastakenresponsibilityfortheactivitiesthattakeplacewithinthecorporationandhavetakenthenecessarystepstohelpprotectthecompany,itsresourcesand–是否采取了适当的防范保护措施应该的努力DueDiligence:Continualactivitiesthatmakesurethemechanismsarecontinuallymaintainedand是否在日常管理中尽到责ResourceProtectionSoftwareMediaResourceProtectionPhysicalAccessControls ResourceIstheconceptofprotectinganorganization'scomputingresourcesandassetsfromlossorcompromise.Covershardware,softwareanddataresources.anythingthatisacomputerResourceProtectionSoftwareMediaResourceProtectionPhysicalAccessControlsResourceIstheconceptofprotectinganorganization'scomputingresourcesandassetsfromlossorcompromise.Covershardware,softwareanddataresources.anythingthatisacomputerresource(software,data,HardwareControls:HardwareMaintenanceMaintenanceAccountsDiagnosticsPortControlHardwareHardwareControls:HardwareMaintenanceMaintenanceAccountsDiagnosticsPortControlHardwarePhysicalControlSoftware 软件测试Software软件工具Software软 SafeSoftware备份控制Backup面面系统安装防产品定义及时更防系统安全策注意的蠕培训所有的电子文档安全管理制度的制定 防护管理制度的定期或不定期检查重要的软件进行异地交叉备份，相互定期检验备份软件的有效性也非常重PrivilegedEntityControls/PrivilegedoperationsSpecialaccesstosystemcommandsAccesstospecialparametersAccessPrivilegedEntityControls/PrivilegedoperationsSpecialaccesstosystemcommandsAccesstospecialparametersAccesstothesystemcontrolprogram MediaResourceAreimplementedtoprotectanysecuritythreatbyintentionalorunintentionalexposureofsensitivedata保护敏感信息和介质的创建，处理 ，清理和破坏介质介质安全控使用记录控制Access恰当丢弃：重写、消磁、销毁ProperMediaViabilityMarking：物理标记不同于逻辑标卷名和版处理Handling：使用、清洁和中防止物理损Storage：温度、湿度、灰、液体、电磁、PhysicalPhysicalAccessPiggybacking:Iswhenanunauthorized throughadoorbehindanauthorized .Theconceptofa“mantrap”isdesignedtopreventit. 用户尾随用户进2Auditing Containsthemechanisms,toolsand2AuditingContainsthemechanisms,toolsandtechniqueswhichpermittheidentificationofsecurityeventsthatcouldimpacttheoperationsofacomputerfacility.MonitoringMonitoring检测Intrusiondetection渗透测试Penetrationtesting异常分析ViolationSnifferPromiscuousmode混杂模式Switchednetwork交换网络Network-basedIDSHost-basedIDSSignaturebased ClipClipThresholdsforcertaintypesoferrorsormistakesallowedandtheamountofthesemistakesthatcantakeplacebeforeitisconsideredsuspicious.Oncethe levelhasbeenexceeded,furtherviolationsrecordedfor某种错误允许发生的渗透测试Penetrating–模仿者（聪明的、有创意的、拥有丰富资源的）的击行自我测试或者第测探测轮廓(footprintor社会工程(social枚举扫描探测(scanand渗((pen-行为探测轮廓(footprintor社会工程(social枚举扫描探测(scanand渗((pen-行为数据，后门，痕迹擦除–Traceroute, 网络级：扫描应用级：服务安全存活扫sweep端口扫扫Nessus,缓冲缓冲溢出buffer猜测password越 non-authorization权限提升elevated2.2IsthefoundationofoperationalsecuritycontrolsAuditTrails审计记录Enablesasecuritypractitionertotracea创建和受保护客体的 审计记录，并能非对 问题和解决问题的过程进行控制，包括对于给定的可控级别，减少故障减轻问题的影响. 对 问题和解决问题的过程进行控制，包括对于给定的可控级别，减少故障减轻问题的影响.3与3与aneventthatcouldcauseharmbyviolatingthe意外损失Accidental有意或非有意的行为造成的-Operatorabuseofprivilegesinputerrorandomissions-TransactionprocessingInappropriate不恰当的内容Inappropriate浪费公司WasteofCorporateResources或种族SexualorRacialHarassment权利AbuseofPrivilegesorRightsExternalweaknessinasystemthatenablessecuritytobeWeaksegregationofTraffic/Trend MaintenanceAccountsDataScavengingAttacksNetworkAddressHjackingHackandAttack-PortScanningandHackandAttack-PortScanningandNetworkingmap:Networkingmap toolssendoutseeminglybenignpacketstomanydifferentsystemsonanetwork.Portscanningidentifiesopenportonacomputer.IsautilityusedinIBMmainframecentersandhasthecap