1应用软件安全基础

41%
0% 1% 2% 2% 3%
15%
36%
Source: NIST
Gartner Group 2004
Encryption Module Network Protocol Stack Other Communication Protocol Hardware Operating System Non-Server Applications Server Applications
✓ 保护我们Байду номын сангаас业务不会被恶义的家伙破坏”
✓限制责任和义务,满足法规和标准
incidents & exploits (#)
✓ 避免对公司品牌和声誉造成破坏
信息安全的现状
Know your code. Trust your code
• 然而在事实上: 我们每年都花了数百万的资金在信息安全
上,但是效果并不如意,我们遭遇的安全问题越来越多.
Know your code. Trust your code
In 2004, average time from vulnerability announcement to 1st attack = 5.8 days (99 days, 2003)
532% increase in CERT incidents reported (2000-2003)
基本概念
Know your code. Trust your code
• 软件安全的定义:在软件受到恶意的攻击下，软件 能够正常运行（功能/性能)
• 软件安全课题:了解产生软件安全的风险并怎样去 管理他们:
“ Building secure software: designing software to
impact ($40B)
info-sec spending
($17B)
breaches grow dramatically - seriously impacting: uptime, regulatory compliance,
liability, brand and reputation
分析机构的最近统计
be secure, make sure that software is secure
,educating software developers ,architects and
users about how to build security in”
软件安全的重要性
Know your code. Trust your code
operating systems or web browsers, but all types of
applications - particularly applications that automate key business processes.”
92% of reported vulnerabilities are in applications, not networks
Know your code. Trust your code
软件安全基础
-Develop Security Software
主题
Know your code. Trust your code
• 基本概念. • 软件安全的重要性. • 分析软件安全越来越严重的原因和根源. • 解决软件安全问题的措施和方法.
结论
Know your code. Trust your code
目前我们信息安全的主要问题是： 应用软件安全问题!!!
Know your code. Trust your code
软件安全越来越严重的原因
• 为什么软件安全问题日益增长 • 黑客攻击方式的进化 • 传统的分层保护方案减轻系统的风险 • 为什么传统的基于网络的方案不工作 • 黑客可直接利用软件的弱点达到攻击系统 • 演示如何通过攻击软件达到窃取商业信息和破坏应用系
• 信息安全的期望 • 信息安全的现状 • 软件安全漏洞的发展趋势 • 传统解决信息安全的努力和投资方向
• 软件安全在信息安全中的重要地位
信息安全的期望
Know your code. Trust your code
• 在原理上: 我们花更多钱去降低的安全事件和安全利用,以 此来帮助我们:
info-sec spending ($)
Know your code. Trust your code
传统信息安全的方法和投资 方向
Know your code. Trust your code
软件安全在信息安全中的重要地位
The experts are telling us: we have a SOFTWARE problem
“Over 70% of security vulnerabilities exist at the application layer, not the network layer. It’s not just
Know your code. Trust your code
软件安全漏洞的发展趋势
CERT 2006年的报告
Know your code. Trust your code
Why?
• 我们的钱花在哪儿 去了?
• 为什么我们的安全 工作毫无效果?
Know your code. Trust your code
43% report an increase in e-crimes and intrusions versus previous year
On average, 48 new vulnerabilities per week were disclosed in 1H04These four factoids are just a sampling of results found by the FBI, Carnegie Mellon’s SEI CERT Coordination Center (an industry body that focuses on alerting corporations of security vulnerabilities), and Symantec in its 5th Internet Security Threat Report (Jan - June 2004).