微軟安全級別策略

微軟安全級別策略1微軟風(fēng)險(xiǎn)管理流程已過期已過期的風(fēng)險(xiǎn)的風(fēng)險(xiǎn)風(fēng)險(xiǎn)陳述風(fēng)險(xiǎn)陳述文檔文檔Top 103.計(jì)劃計(jì)劃 5.控制控制2.分析分析1.確認(rèn)確認(rèn)風(fēng)險(xiǎn)陳述風(fēng)險(xiǎn)陳述4.跟蹤跟蹤微軟IT操作框架(Microsoft Operation Framework)Condition-consequence risk statements help to clearly articulate risk2為了得到每個(gè)風(fēng)險(xiǎn)可能造成的危害的量化結(jié)果基于可能性(Probability)和影響(Impact)可能性：該風(fēng)險(xiǎn)發(fā)生的幾率影響：該風(fēng)險(xiǎn)發(fā)生后的損失或影響probability x impact=exposureExample:75%x$500,000=$375,000目的是可以比較各風(fēng)險(xiǎn)，以得到風(fēng)險(xiǎn)處理的優(yōu)先級計(jì)算風(fēng)險(xiǎn)的危害性(Exposure)3風(fēng)險(xiǎn)管理策略減少風(fēng)險(xiǎn) Example:Minimize the probability(likelihood of the condition)Example:Minimize the impact(level of the consequence)風(fēng)險(xiǎn)轉(zhuǎn)移Example:Move to different hardware Example:Subcontract to a third party風(fēng)險(xiǎn)規(guī)避Example:Dont undertake certain projectsExample:Rely on proven,not cutting-edge,technology4微軟安全響應(yīng)中心位于Redmond的160人的微軟安全響應(yīng)中心(MSRC Microsoft Security Response Center)目標(biāo)：幫助微軟用戶安全的使用微軟系統(tǒng)和網(wǎng)絡(luò)既是管理員又是黑客Subcontract to 3rd party(Foundstone,ISS)制定嚴(yán)格的安全規(guī)范和操作手則風(fēng)險(xiǎn)評估5微軟安全通告的級別微軟安全通告級別Critical 緊急該缺陷可能導(dǎo)致無需用戶操作的互聯(lián)網(wǎng)蠕蟲病毒的傳播Important 重要該缺陷可能導(dǎo)致用戶數(shù)據(jù)的機(jī)密性、完整性、或有效性受到傷害，或?qū)е孪嚓P(guān)處理流程資源的完整性或有效性受到傷害Moderate.Exploitability is mitigated to a significant degree by factors such as default configuration,auditing,or difficulty of exploitationLow.A vulnerability whose exploitation is extremely difficult,or whose impact is minimal.微軟安全策略的目標(biāo)開發(fā)安全的產(chǎn)品(Get Secure)使用戶能方便的保持安全(Stay Secure)6微軟建議的安全流程設(shè)計(jì)與開發(fā)信息安全策略制定詳細(xì)的信息安全規(guī)范信息安全規(guī)范的有效實(shí)施管理員培訓(xùn)和普通用戶的教育持續(xù)不間斷的安全管理風(fēng)險(xiǎn)評估的標(biāo)準(zhǔn)與風(fēng)險(xiǎn)管理流程緊急處理機(jī)制災(zāi)難恢復(fù)機(jī)制自動(dòng)安全通告機(jī)制7中國企業(yè)所常有的安全問題沒有實(shí)施嚴(yán)格的賬號和口令管理，或者需管理的賬號和口令太多沒有實(shí)時(shí)監(jiān)測惡意的攻擊行為不清楚系統(tǒng)的完整狀況難以快速部署軟件更新(Hot-fix)及服務(wù)包(Service Pack)內(nèi)部用戶任意安裝軟件，或隨意修改系統(tǒng)配置“有法不依，執(zhí)法不嚴(yán)”8我們的建議系統(tǒng)安全的前提是管理安全統(tǒng)一的信息安全風(fēng)險(xiǎn)評估的管理體制與管理方法Example:independent security group inside Microsoft R&D,including Microsoft employee&3rd party統(tǒng)一的信息安全風(fēng)險(xiǎn)評估的技術(shù)標(biāo)準(zhǔn)及相關(guān)工作流程統(tǒng)一的建議性的信息安全管理策略和管理方法“有法必依，執(zhí)法必嚴(yán)”9謝謝！謝謝！10微軟Windows安全目標(biāo)提供穩(wěn)定的、健壯的、基于對象的系統(tǒng)安全模型是Windows系統(tǒng)架構(gòu)中的基礎(chǔ)模塊安全必須考慮在前，很難事后添加滿足DoD C2安全認(rèn)證的要求滿足商業(yè)用戶的要求多用戶能安全的使用和共享系統(tǒng)資源進(jìn)程、內(nèi)存、設(shè)備、文件、網(wǎng)絡(luò)11Windows&SecurityScenarioScenarioRisksRisksSolutionsSolutionsMobile UsersMobile Users Encrypted (EFS)Encrypted (EFS)PPTP,IPSEC,L2TP PPTP,IPSEC,L2TP Lost/Stolen LaptopLost/Stolen Laptop Dial-up AttacksDial-up AttacksE-commerceE-commerce False Identity/ImpostorFalse Identity/Impostor Theft data/moneyTheft data/money Transaction modificationTransaction modification Public Key Infrastructure(PKI)Public Key Infrastructure(PKI)Integrated CA Integrated CA SSL/TLS SSL/TLSHome OfficeHome Office PPTP,IPSEC,L2TP PPTP,IPSEC,L2TP NTLMv2,Kerberos,PKI NTLMv2,Kerberos,PKI SSL/TLS,S/MIME SSL/TLS,S/MIME On-wire Internet AttacksOn-wire Internet Attacks Dial-up AttacksDial-up Attacks False Identity/ImpostorFalse Identity/ImpostorLAN/WANLAN/WAN False Identity/ImpostorFalse Identity/Impostor Password Sharing/GuessingPassword Sharing/Guessing Adds/Moves/ChangesAdds/Moves/Changes Kerberos,NTLMv2 Kerberos,NTLMv2 Smart Cards,Biometrics Smart Cards,Biometrics Group Policy,Delegated Admin Group Policy,Delegated AdminApplicationsApplications False Identity/ImpostorFalse Identity/Impostor Password passingPassword passing Path of least resistance codingPath of least resistance coding Malicious Code(Trojan horse)Malicious Code(Trojan horse)Kerberos,NTLMv2,Smart Cards Kerberos,NTLMv2,Smart Cards Impersonation,Auditing Impersonation,Auditing SSPI,CryptoAPI SSPI,CryptoAPI Code Signing and Policy Code Signing and Policy Public Key Infrastructure(PKI)Public Key Infrastructure(PKI)Integrated CAIntegrated CA IPSEC,L2TP,SSL/TSL,S/MIMEIPSEC,L2TP,SSL/TSL,S/MIMEExtranetsExtranets False Identity/ImpostorFalse Identity/Impostor Data TheftData Theft On-wire Internet AttacksOn-wire Internet Attacks Active Directory Integration Active Directory Integration Delegated Administration Delegated Administration Auditing Improvements Auditing Improvements Security Templates Security TemplatesManagementManagement Too many places to secureToo many places to secure Unfamiliar with employee rolesUnfamiliar with employee roles Dont Know who did whatDont Know who did what Configuration and DriftConfiguration and Drift12