1 - Security Goals 安全测试 教学课件.pptVIP

Agenda Seven Key Security Concepts: Authentication Authorization Confidentiality Data / Message Integrity Accountability Availability Non-Repudiation System Example: Web Client-Server Interaction 1.1. Security Is Holistic Physical Security Technological Security Application Security Operating System Security Network Security Policies Procedures All Three Required 1.1.1. Physical Security Limit access to physical space to prevent asset theft and unauthorized entry Protecting against information leakage and document theft Ex: Dumpster Diving - gathering sensitive information by sifting through the company’s garbage 1.1.2. Technological Security (1) (Application Security) No flaws in identity verification process Configure server correctly local files database content Interpret data robustly 1.1.2. Technological Security (2) (OS Network Security) Apps (e.g. servers) use OS for many functions OS code likely contains vulnerabilities Regularly download patches to eliminate (e.g. Windows Update for critical patches) Network Security: mitigate malicious traffic Tools: Firewalls Intrusion Detection Systems 1.1.3. Policies Procedures Ex: Social engineering attack - taking advantage of unsuspecting employees (e.g. attacker gets employee to divulge his username password) Guard sensitive corporate information Employees need to be aware, be educated to be somewhat paranoid and vigilant Security Concepts Authentication Authorization Confidentiality Data / Message Integrity Accountability Availability Non-Repudiation Archetypal Characters Alice Bob – “good guys” Eve – a “passive” eavesdropper Mallory – an “active” eavesdropper Trent – trusted by Alice Bob 1.2. Authentication Identity Verification How can Bob be sure that he is communicating with Alice? Three General Ways: Something you know (i.e., Passwords) Something you have (i.e., Tokens) Something you are (i.e., Biometrics) 1.2.1. Something you KNOW Example: Passwords Pros: Simple to implement S