云计算应用层安全检测与治理.pptxVIP

TDA –云计算时代应用层安全检测和治理Classification PPT 结构:TDA 的必要性,唯一性,技术性,差异性 .客户(用于客户快速介绍)TDA 应用层安全监测 详细PPTClassification TDA 应用层监控的必要性Gartner统计高达70%的网络威胁是基于应用层而非网络层的网络与边界用代码比对的方式,无法有效侦测现在的威胁客户在网络基础架构的侦测设备:IDS仅能提供网络层的信息，而不能提供应用层的安全威胁信息，如敏感信息打包外传等Gartner 权威报告: 新一代防火墙邮件/网页 网关 : 信誉评估功能,沙盒功能Gartner 建议:多层次防御体系边界入侵式侦测:需侦测殭尸活动,黑名单时时更新应用层安全监控:沙盒功能,文件漏洞侦测,服务器存取监控,回复通讯监控网络桌面,服务器权限管理个人防火墙应用系统与系统补丁Classification 趋势科技TDA 在应用层监控的国内唯一性Classification TDA 在应用层监控的技术性威胁生命周期攻击:外对内威胁侦测控制:内对内威胁侦测渗透潜伏:内对外威胁侦测动态文件分析引擎:沙盒系统已知病毒监控模块-文件-手机服务器存取监控模块应用程序监控模块异常外连联机监控模块恶意网页监控模块蠕虫,零日攻击监控模块Classification TDA 应用层安全监控的差异性威胁生命周期攻击:外对内威胁侦测控制:内对内威胁侦测渗透潜伏:内对外威胁侦测动态文件分析引擎:沙盒系统已知病毒监控模块-文件-手机服务器存取监控模块应用程序监控模块异常外连联机监控模块恶意网页监控模块蠕虫,零日攻击监控模块入侵检测设备No ,有些厂商会有OEM 引擎NoYes ,主要是系统漏洞侦测,缺文件漏洞侦测Yes , 有服务器攻击侦测,无存取监控No ,日志风暴.有日誌沒有知識庫判斷YesNoYes,没有手机类病毒侦测NoYes,主要是文件漏洞侦测,缺系统漏洞攻击包分析NoNo , Yes基本用URL 黑名单方式,需要有信誉服务网关设备Classification 我们的客户详细介绍内容Classification 越后期变数越多，侦测及防御越难有成效社交攻击邮件: 90% 以上使用方式客制化恶意夹档挂马网址服务器漏洞攻击木马,殭尸,后门漏洞,密码探测接收远程指令控制处理成本攻击步骤窃取数据与权限内网渗透,取的机敏资料资料外传渗透潜伏攻击的变数The Targeted Attack ProcessStage 0Stage 1Stage 2Stage 3Stage 4Preparation for attackInitial penetrationEstablishment of attack platformSystem investigationAttack on the ultimate targetThey steal information via the backdoor. In some cases, using information stolen, they repeat attacks.APT is the attack which the attackers keep attack platform which established in the target organizations to repeat penetrations and data thefts. This attack is the one tend to be repeated several times.As a preparation stage before they conduct attacks, the attackers investigate information of target organization.For that, they attack organizations around target to collect platform information for initial intrusion like Emails exchanges between that organization and the target.Using this information, they conduct attacks which increase the success rate of the initial penetration. Various methods are used in the initial penetration stage. Suspicious (targeted) email is one such method. These met