1-云计算推动下一代安全实践.pdf

云计算推动下一代安全实践 赵 粮 Richard.zhao@ 中国计算机大会 2011/11/24-26@深圳 ? 2011 绿盟科技 OPERATION MALAYSIA 传统的Firewall/IPS在快速上升的DDoS面前无能为力 可怜的Sony PlayStation Network 可怜的Sony PlayStation Network-2 RSA SecurID遭受的APT 世界范围内的APT攻击 General commercial security devices can’t help on those APT and other sort of advanced targeted attacks! Data Source: Revealed - Operation Shady RAT, By Dmitri Alperovitch, McAfee 当前安全实践的现状 . Clear perimeter between security zone and insecurity zone (and DMZ) . Security policy mostly based on IP addresses, ports, etc. . Silos of various security devices . Mission impossible for signatures update to catch up with zero-day threats . Infidelity of communications from users to vendors . … SOC/SIEM也问题重重 Business Security Infrastructure Security Security R Capability/ Services I P 当前的安全运维实践之金字塔分析… ? 深入理解业务，保证安全和业务应和 ? 安全核心能力的发展、供应商管理等 ? 防火墙/IDS策略检查和调优 ? 安全状态评估 ? 安全不项目管理、配置变更管理流程集成 ? 补丁 ? 身份帐号管理 ? 安全事件响应 ? 漏洞扫描和评估、安全配置核查 ? 因为技能、工具和资源丌足，忙于 各种应急，应 付客户抱怨 展望“下一代安全”体系 Business ? Intimate Partnership between customer and providers Knowledge ?Cloud Intelligence Architecture ? Service Oriented ? Open Plugin-enabled Team ?Real Time Response ?Global Operated Intimate Partnership ? User Team better focus on business requirements and policy tuning ,etc. moving upward at the value pyramid, e.g. – 80% resources business requirements, communications, and other core competency building – while 20% for vendor manage