安全系列课程()实现内网安全解决方案-.pptVIP

Practical Security for Intranet Solutions 孙巍 sunwei@ Session Overview Introduction to Security for Intranet Applications Data Security Fundamentals Managing Identities Authenticating Identities in Intranet Applications Authorizing Identities in Intranet Applications Introduction to Security for Intranet Applications Introduction to Security for Intranet Applications Data Security Fundamentals Managing Identities Authenticating Identities in Intranet Applications Authorizing Identities in Intranet Applications Characteristics of Intranet Environments Users are known Data is sensitive Biggest threat is internal Securing Data Store sensitive data securely Treat the storage medium as if it were at risk Storing Identity Information Directory or database Centralized or distributed Well-defined schema Encryption or hashing Authenticating Identities Authorizing Identities Securing Communication Treat intranet applications like Internet applications Use SSL to secure communication Data Security Fundamentals Introduction to Security for Intranet Applications Data Security Fundamentals Managing Identities Authenticating Identities in Intranet Applications Authorizing Identities in Intranet Applications Data Security in Applications Data security is essential to ensure that: Confidential data remains private Important data is not tampered with or deleted Authorized users have access to their data Data can be secured using: Permissions Encryption Data Security and Permissions Typically, data files provide permissions based on the following actions: Full control Modify Read Execute Read Write What Is Encryption? There are two main approaches to encryption: Symmetric encryption Asymmetric encryption Both approaches can be used within the same session Data Security and Encryption Use encryption when storing or transmitting sensitive data Longer encryption key = Stronger encryption Data Encryption in the .NET Framework Best Practices for Data Security Managing Id