Framework - Universiti Putra Malaysia框架-马来西亚博特拉大学.pptVIP

Framework Chapter 1 Panko, Corporate Computer and Network Security Copyright 2003 Prentice-Hall Figure 1-1: CSI/FBI Computer Crime and Security Survey Annual survey conducted by the Computer Security Institute () in cooperation with the FBI. Based on replies from 503 U.S. Computer Security Professionals. If fewer than 20 firms reported quantified dollar losses, data for the threat are not shown. Figure 1-1: CSI/FBI Computer Crime and Security Survey Figure 1-1: CSI/FBI Computer Crime and Security Survey Figure 1-1: CSI/FBI Computer Crime and Security Survey Figure 1-1: CSI/FBI Computer Crime and Security Survey Figure 1-2: Other Empirical Attack Data Riptech Analyzed 5.5 billion firewall log entries in 300 firms in five-month period Detected 128,678 attacks—an annual rate of 1,000 per firm Only 39% of attacks after viruses were removed were directed at individual firms Figure 1-2: Other Empirical Attack Data SecurityFocus Data from 10,000 firms in 2001 Attack Frequency 129 million network scanning probe packets (13,000 per firm) 29 million website attack packets (3,000 per firm) 6 million denial-of-service attack packets (600 per firm) Figure 1-2: Other Empirical Attack Data SecurityFocus Attack Targets 31 million Windows-specific attacks 22 million UNIX/LINUX attacks 7 million Cisco IOS attacks All operating systems are attacked! Figure 1-2: Other Empirical Attack Data Honeynet project Networks set up for adversaries to attack Windows 98 PC with open shares and no password compromised 5 times in 4 days LINUX PCs took 3 days on average to compromise Figure 1-3: Attack Trends Growing Incident Frequency Incidents reported to the Computer Emergency Response Team/Coordination Center 1997: 2,134 1998: 3,474 (75% growth from previous year) 1999: 9,859 (164% growth) 2000: 21,756 (121% growth) 2001: 52,658 (142% growth) Tomorrow? Figure 1-3: Attack Trends Growing Randomness in Victim Selection In the past, large firms were targeted Now, targeting is increasingl