安全与可信security and truted脆弱性安全 vs 结构性安全.ppt

* 总结 Conclusion 脆弱性安全Vulnerability-oriented security 结构性安全Structural security 结构性安全中的脆弱性 Vulnerabilities in structures 结构性威胁Structural threats * 总结：一个可以持续研究下去的课题Conclusion: A good problem to keep approaching 脆弱性防御 V.O. defend 结构性防御 Structural defend 脆弱性攻击 V.O. attack 结构性攻击 Structural attack 脆弱性和结构性 Vulnerability-oriented vs. structural 攻击和防守 defend vs. attack * 谢谢…Thanks… * * 这个框架是德国信息安全局(BSI)发布的信息安全框架。 将框架总体分成三个部分，左面是IT components, 右边是威胁，中间是防护措施。 每个项目都和其他互相链接。 * * * TCG的IWG和TNC的对应关系the IWG and TNC architecture * TNC体系结构TNC architecture * TNC体系结构下的消息流Message flow between components * 拥有TPM的TNC体系结构The TNC architecture with the TPM * 思科的自防御网络体系Cisco’s self-defending network * 思科的自防御网络体系Cisco’s self-defending network * 松散安全结构的代表——框架和方案Loose security structure — Framework 松散结构中的各个部件关联关系，常常靠人的集成来实现 The connection among the components of loose structure is always integrated by human. 松散结构常常表现为框架Framework 技术框架Technology framework 管理体系Management system ISO27001, ISO20000, etc. * * 技术功能是PDR的衍生PDR can express technology framework * 检测能力是松散技术结构的关联要素Detection make the loose structure tight 攻击者不得不面对越来越多的 Attackers have to face more 入侵检测 IDS 漏洞扫描 scanner 应用审计系统 Application auditing system 日志系统 log system 蜜罐 honey pot 取证系统 forensic system 监控平台 monitoring platform 等等 etc. * 一个信息安全管理体系的结构Structure of a ISMS (modified ISO27001) * 结构性安全中的脆弱性Vulnerabilities in structures * 你对刚才阐述的结构性安全有什么感觉？What’s your feeling about structural security? 复杂 complex 怀疑其完备性 concern about the completion 成本 cost 蠢人永远有 stupid guys are there … … * 不要被“结构性安全”给忽悠了！Do not be misled by structural security 不要被“结构性安全”给忽悠了！脆弱性安全和结构性安全并不是对立的，也不是两个发展阶段；脆弱性安全也有结构，结构性安全也有脆弱性。 Do not be misled by structural security Vulnerability-oriented security also has structure Structural security also has vulnerabilities * 借助非技术环节来侵害技术结构Find vulnerabilities from non-technology parts Randomly Generated Symmetric Key (seed + PRNG) Alice Public key Private key Private key Public key Bob * 借助非技术环节来侵害技术结构Find vulner