資安健檢因應配套

1

2015/02/05

CISM, CISSP, CSSLP CEH, ECSA, LPT

http://www.gss.com.tw/?utm_source=slideshare&utm_medium=presentation

3


4

NIST SP 800-115

(review)

(identify)

(validate)

NIST SP 800-53A

(examine)

(review)

(inspect)

(observe)

(study)

(analyze)

(interview)

(test)


5

NIST SP 800-53 Security and Privacy Controls for

Federal Information Systems and Organizations

NIST SP 800-53A Federal Information Systems and Organizations:

Building Effective Assessment Plans


6


7

()

()


8

()

(1~51)


NIST Cybersecurity Framework

9

() Identify

Protect

Detect

Respond

Recover


:

10


11


12

()

(DNS Server)IP


-

13

(log management) IDS/IPSDLP()

? ? ? ?

NIST SP 800-92 Log Aggregation Guidelines

Events


-

14

IP IP? ?

Network Forensics


A T T A C K C O N T I N U U M

BEFORE DURING AFTER See it,

Control it

Intelligent &

Context Aware

Retrospective

Security

Network | Endpoint | Mobile | Virtual

Point-in-Time Continuous

15

: SourceFire


()

16

: PaloAlto Networks


()

3

2 1

17

: Damballa


()

18

Dynamic

Generation

Algorithm (DGA)

Victim

DNS Recursive

DNS Authoritative

Firewall Egress

C&C Criminal Server

Proxy Filtering

TCP/IP Session

Configuration

File

C&C Location

Behaviors Seen & Benefits Malicious DNS queries Domain fast-fluxing detection New domain queries Unique victim enumeration Detection prior to egress DNS query termination

Behaviors Seen & Benefits C&C connection behaviors/success URI identification (incl. HTTPS) Malicious file identification (Malware) Unique victim enumeration Bytes-in & bytes-out monitoring Full packet capture Session termination

Behaviors Seen & Benefits C&C connection behaviors/success URI identification (incl. HTTPS) Malicious file identification (Malware) Unique victim enumeration Full packet capture Detection prior to egress Session termination

: Damballa


() : SourceFire

19


20


-

21


22

22

(web)


23

Database

Network Appliance

Virtual Server

Windows/ UNIX/Linux

Application

Multiple Device Types

CA ControlMinder

Secure Password Storage

Session Recording


24

() (check-out check-in)


25

WHO WHEN WHERE WHAT


26

Contractor / Partner

Password Admin

Auditor

Systems Admin

Applications

Folders

Data


27

WHO WHEN WHERE WHAT


28


29

(deadlock)CPU()


:Apple SSL Bug

30

Apple SSL


:

31

A1315xxxxx

0920123xxx

DESIGN REVIEW


-

32

OWASP Top 10

SANS Top 25


-

33


()

34


()

35

Cigital Touchpoint Model


36


37

1.

2. 3.


()?

38


39

AD


40

https://www.checkmarx.com/glossary/software-code-analysis-securing-applications/

Checkmarx


-

41

OpenSAMM www.opensamm.org

Level 1:

Level 2:

Level 3:

BSIMM-V www.bsimm.com

Level 1:

Level 2:

Level 3:&

BSIMM-V


42

Microsoft .NET Coding Guideline

Oracle Java Coding Guideline

Apple Coding Guideline

Android Security Tips

CERT Secure Coding Guidelines


43

Cigital E-Learning (Commercial)

SAFECode (Free)

GSS Instructor-led Training


44

5,000XSS ()

privacy violation passwordlogger()

passworddatabase()


45

jQuery1.6.4

Struts 2Spring 3.x

API

OWASP Top 10 Risk

()


46


47

Q&A

please visit

www.gss.com.tw/index.php/focus/security

http://www.gss.com.tw/?utm_source=slideshare&utm_medium=presentationhttp://www.gss.com.tw/index.php/focus/security?utm_source=slideSecurityCheck&utm_medium=slideshare

Software

資安健檢因應配套