网络战争防御策略：自适应企业保护检测与反应方法

需积分: 5 89 浏览量更新于2024-07-16 收藏 2.03MB PDF 举报

"Advanced Persistent Security：A Cyberwarfare Approach" 本书是 Ira Winkler 于 2017 年出版的《Advanced Persistent Security：A Cyberwarfare Approach》，是一本关于网络安全和网络战争的书籍。本书的作者 Ira Winkler 是一位经验丰富的网络安全专家，拥有多年的网络安全经验。本书的主要内容是讨论如何实施网络安全保护、检测和反应策略，以抵御网络攻击和网络战争。本书涵盖了网络安全的各个方面，包括网络安全架构、威胁智能、安全监控、事件响应、灾难恢复等领域。在本书中，作者 Ira Winkler 详细介绍了网络安全的概念、原则和技术，包括网络安全架构、加密技术、身份验证、访问控制、入侵检测和防火墙等。同时，作者还讨论了网络战争的概念和技术，包括网络攻击、网络防御、网络监控和网络事件响应等。本书的目标读者群是网络安全专业人员、IT 管理人员和企业高管等。通过阅读本书，读者可以了解网络安全的基本概念和技术，学习如何实施网络安全保护和检测策略，以保护企业的网络资产免受网络攻击和网络战争的威胁。以下是本书的主要知识点： 1. 网络安全架构：本书介绍了网络安全架构的概念和设计原则，包括网络安全域、安全区域、防火墙、入侵检测系统等。 2. 威胁智能：本书讨论了威胁智能的概念和技术，包括威胁情报、威胁分析、威胁评估等。 3. 安全监控：本书介绍了安全监控的概念和技术，包括安全事件监控、安全日志分析、安全信息管理等。 4. 事件响应：本书讨论了事件响应的概念和技术，包括事件响应策略、事件响应过程、事件响应团队等。 5. 灾难恢复：本书介绍了灾难恢复的概念和技术，包括灾难恢复策略、灾难恢复过程、灾难恢复团队等。 6. 网络战争：本书讨论了网络战争的概念和技术，包括网络攻击、网络防御、网络监控和网络事件响应等。 7. 加密技术：本书介绍了加密技术的概念和原则，包括对称加密、非对称加密、数字签名等。 8. 身份验证：本书讨论了身份验证的概念和技术，包括用户名/密码认证、生物特征识别、智能卡认证等。 9. 访问控制：本书介绍了访问控制的概念和技术，包括访问控制模型、访问控制列表、访问控制协议等。 10. 入侵检测：本书讨论了入侵检测的概念和技术，包括入侵检测系统、入侵检测规则、入侵检测报警等。本书《Advanced Persistent Security：A Cyberwarfare Approach》是一本非常有价值的网络安全书籍，涵盖了网络安全的各个方面，提供了许多实用的网络安全技术和策略。

Yes, the process must include the appropriate tools, but as Snowden demon-

strated all too clearly, tools (including background checks and awareness),

even in the most secure organization in the world, can be completely useless.

ADVANCED PERSISTENT THREAT AND ADVANCED

PERSISTENT SECURITY

Clearly, we came up with the term Advanced Persistent Securi ty to imply it

counters APT. Typically, APT refers to China or some other nation-state, such

as Russia, Iran, North Korea, or well-funded and established criminal entities.

Let us examine what this means. Breaking down the term backwards, the orga-

nizations or entities who want to compromise you are a threat by deﬁnition. So

the word, threat, applies.

Persistent is a relative term, but if you assume it to mean that an attacker will

not give up when met with trivial countermeasures, the n, yes, the attacker is

persistent. You need to consider that just about any organization has some-

thing of value. You need to assume that you are going to face an attacker

that is not going to test default passwords and give up.

A persiste nt attacker will probe a network, scour social networks for informa-

tion they can ﬁnd about the target’s employees, and perform extensive recon-

naissance. To a large extent, they might know the target organization better

than most employees. When there is a lot of money, or other reward, such as

the treasure trove of information from the Ofﬁce of Personnel Management

(OPM) hack, should it not be expected that an attacker will go through all of

this effort?

Consider that the Target hack yielded the criminal, or criminals, millions of

dollars. Why would a criminal not devote several months of effort to the crime?

Every organization should consider that they hold more than enough value to

motivate any criminal to be persistent.

Any organization that does not think they have enough value to motivate a

criminal to be persistent should be out of business.

Then considering the term advanced, it is almost irrelevant at some point. The

term APT includes advanced by default; however, most persistent threats do not

have to be advanced to be successful. When you consider the Sony hack,

although North Korea may have advanced technologies, the attack itself did

not utilize any advanced techniques. Spear phishing messages were sent to trick

administrators to divulging their passwords. The malware they used was previ-

ously known and should ha ve been detected by most antimalwar e software.

The attackers did not have to compromise any authentication beyond

passwords. There was no net work segmentation that the attackers had to

Advanced Persistent Threat and Advanced Persistent Security

compromise. Hard work was exponential ly more valuable than anything that

would be considered advanced.

So while attackers such as China, Iran, Russia, and the United Sta tes might have

zero-day attacks, which might be considered unstoppable attacks, assuming

you are actually running the software, rarely do they have to use those

techniques.

However, the key point is that any motivated attacker will go beyond the trivial

attacks that most organi zations design their security programs to prevent. The

organizations implement countermeasures that are speciﬁc to a given attack

vector and are not frequently coordinated with other countermeasures. The

motivated attacker will quickly adapt to countermeasures in place and try other

attack vectors. They will eventually get in, and without a proper detection pro-

gram in place, the y will be successful.

Advanced Persistent Security creates an overall program to address motivated

attackers by being persistent in proactively defending against attackers, while

simultaneously searching for signs of successful attacks. Of course, there is a

comprehensive response program in place, so that there is a rapid reaction

when potentially successful attacks are detected.

Although we wish we did not have to propose this concept as something new

and revolutionary, most security programs do not have this level of

sophistication.

APPLYING ADVANCED PERSISTENT SECURITY

TO THE SONY HACK

At the beginning of this chapter, we discussed the co untermeasures that would

have prevented the Sony hack. Again, Ira let stand the comments that an

attacker would have eventually compromised the organization. As you can

tell, we actually agree that a motivated attacker would eventually have gained

entry to the organization’s network and infrastructure.

However, by applying the Advanced Persistent Security principles, the inevi-

table penetration would have been detected. No matter how the attacker gained

entry into the Sony network, monitoring the log ﬁles would have detected that

outside parties were attempting to remotely access the network as administra-

tors. Anti-malware software would have detected the installed malware. Behav-

ioral analytics software would have detected the attempts to access date ﬁles

and personal emails. Users would have reported the phishing messages and

that would have helped to alert the company to delete unopened email mes-

sages and be on the alert for other attacks. Data leak prevention software should

have detected the exﬁltration of movies, emails, and critical ﬁles. The security

CHAPTER 1: What Is Advanced Persistent Security?

剩余235页未读，继续阅读

minorsnow

粉丝: 0
资源: 3

网络战争防御策略：自适应企业保护检测与反应方法

Advanced Persistent Security_ A Cyberwarfare

Advanced Persistent Security:先进的持久威胁安全性-开源

"material studio castep模块出现的报错\"m\" failed to load its persistent state:"

{"acknowledged":true,"persistent":{"indices":{"breaker":{"total":{"limit":"70%"}}}},"transient":{}}

using CrowApp = crow::App<crow::SecurityHeadersMiddleware, crow::persistent_data::Middleware, crow::token_authorization::Middleware>;using CrowApp = crow::App<crow::SecurityHeadersMiddleware, crow::persistent_data::Middleware, crow::token_authorization::Middleware>; 这段代码什么意思

failed to provision volume with StorageClass "": unable to create directory to provision new pv: mkdir /persistentvolumes: file exists

{ "persistent": { "search.max_buckets": 2000000 }

PUT _cluster/settings { "persistent": { "action.auto_create_index": "true" } }

UnpicklingError: A load persistent id instruction was encountered, but no persistent_load function was specified.

Write a 5,000-word thesis on "Application of Sandbox Technology in Cybersecurity Engineering."

最新资源