透视Microsoft安全响应过程.ppt

网络进攻时序线 发现漏洞 完成补丁 公布补丁 黑客破解补丁 开发病毒/蠕虫 释放病毒/蠕虫 No Exploit 只有微软及发现者知道漏洞存在 No Exploit 只有微软及发现者知道漏洞存在 No Exploit 公众知道漏洞存在，但不知道怎样攻击 No Exploit 知道怎样攻击，但病毒/蠕虫尚未出现 No Exploit 病毒/蠕虫尚未出现，但未被释放  Exploit 病毒/蠕虫被释放; 感染未被修补系统 用户与黑客赛跑 实例分析：Blaster 蠕虫 微软被通知漏洞存在 公布补丁 进攻样板程序出现 蠕虫出现 七月1日 七月16日 七月25日 八月11日 通知漏洞 RPC/DDOM 漏洞被发现 微软启动最高级别快速反应程序 安全公告 公布MS03-026 (7/16/03) 继续与安全分析家，媒体，IT社区，合作伙伴，政府部门保持联系 进攻样板程序 X-focus (中国黑客组) 出版进攻样板程序 微软警告用户尽快安装补丁 蠕虫 Blaster 蠕虫出现; 变种及其它病毒同时出现 (例如. “SoBig”) Blaster 展现了安全分析师，软件公司，以及黑客之间的复杂的互动关系 补丁越来越多 进攻样板程序出现时间缩短 进攻样板程序越来越多精巧 151 180 331 Blaster Welchia/ Nachi Nimda 25 SQL Slammer 补丁至进攻样板程序之间的天数 网络进攻趋势 * ? 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary. * * ? 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary. * * ? 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary. * * ? 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary. * * ? 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary. * * ? 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary. * * ? 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary. * * ? 2005 Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no wa