1. 大約有60~80的網路濫用(misuse)是出自於內部網路
  2. 三個安全的目標為
    1. confidentiality (Keep Data Private)
    2. integrity (Data has not been modified in transmit)
    3. availability (A measure of the data’s accessibility)
  3. 政府和軍隊使用的機密等級範例
    1. Unclassified
    2. Sensitive but unclassified(SBU)
    3. Confidential
    4. Secret
    5. Top-Secret
  4. 美國政府的三種機密等級
    1. Confidential
    2. Secret
    3. Top-Secret
  5. 組織使用的機密等級範例
    1. Public
    2. Sensitive
    3. Private
    4. Confidential
  6. 可用於資料分級的特徵
    1. 價值 (Value)
    2. 年份 (Age)
    3. 可用期 (Useful life)
    4. 相關者 (Personal association)
  7. 分類原則
    1. Owner
    2. Custodian (保管人)
    3. User
  8. 安全方案控制
    1. Administrative Control
    2. Physical Control
    3. Technical Control
  9. 承8. 以上方法又可以分為下列的控制方案
    1. Preventive
    2. Deterrent (遏止的)
    3. Detective
  10. 描述安全事件需要紀錄的項目
    1. Motive
    2. Means
    3. Opportunity.
  11. 不同等級的法律規範
    1. Criminal law
    2. Civil law
    3. Administrative law
  12. 五種概分的攻擊種類
    1. Passive
    2. Active
    3. Close-in
    4. Insider
    5. Distribution
  13. Defense in Depth design philosophy
    1. Defend multiple attack targets in the network
    2. Create overlapping defenses
    3. Let the value of protected resource dictate the strength of the security mechanism
    4. Use strong encryption technologies
      1. AES
      2. PKI
  14. NIDS, NIPS, HIPS
    1. NIDS (Network-based Intrusion Detection System)
    2. NIPS (Network-based Intrusion Prevention System)
    3. HIPS (Host-based Intrusion Prevention System)
  15. Types of IP Spoofing Attacks
    1. NonBlind Spoofing (攻擊者和目標在同一個subnet)
    2. Blind Spoofing (攻擊者和目標在不同subnet)
  16. Source Routing 的二種類型
    1. Loose
    2. Strict
  17. 防止IP spoofing Attacking的方法
    1. ACL
    2. IPsec tunnel
    3. cryptographic authentication
  18. 機密性攻擊方法
    1. Packet Capture
    2. Ping sweep and port scan
    3. Dumpster diving
    4. EMI interception
    5. Wiretapping
    6. Social engineering
    7. Sending information over overt channels
    8. Sending information over covert channels
  19. 完整性攻擊方法
    1. Salami Attack
    2. Data diddling
    3. Trust relationship exploitation
    4. Password attack
      1. Trojan horse
      2. Packet capture
      3. Keylogger
      4. Brute force
      5. Dictionary attack
      6. Botnet
      7. Hijacking a session
  20. 可用性攻擊方法
    1. Denial of Service (DoS)
    2. Distributed denial of service (DDoS)
    3. TCP SYN flood
    4. ICMP attacks
    5. Electrical disturbances
      1. Power Spike
      2. Electrical surge
      3. Power fault
      4. Blackout
      5. Power sag
      6. Brownout
    6. Attacks on a system’s physical environment
      1. Temperature
      2. Humidity
      3. Gas
arrow
arrow
    全站熱搜

    qmaw 發表在 痞客邦 留言(0) 人氣()

    E-mail轉寄