鄭林zl電子商務(wù)安全威脅分析和對策

鄭林zl電子商務(wù)安全威脅分析和對策第1頁/共22頁ReportedInstitutionDataBreachedDec2010McDonald’s1.3millionconsumersdatarecordsincludingname,add,phone,birthdateandgenderDec2010Honda/Acura3rdpartymarketingfirmSilverPop-4.9millionaccountsJuly2010UCSFMedicalCenterEmployeeusedcolleagues’SSNs,PIItofillouthundredsofsurveysandredeemAvouchersJuly2010BuenaVistaUniversityPIIforapplicants,students,staff,anddonorsgoingbackto1987stolenfromBVUdatabaseJune2010Univ.ofMaineHackersstolePII/clinicaldatafor3,500studentsJune2010DigitalRiver,Inc.Hackers(andpossiblyinsiders)copy200,000personalrecordsMar2010TSATerminateddeveloperplacedmalwareinterrorismsuspectDBFeb2010CeridianAttackyieldedSSNsandbankaccountdatafor27,000employeesof1,900companiesfrompayrollprocessorJan2010IowaRacing&GamingComm.HackergainedaccesstodatabasecontainingPIIofmorethan80,000employeesDec2009RockYouSQLinjectionresultedinbreachof32millionuserpasswordsNov2009T-MobileEmployeesoldmillionsofcustomerrecordstorivalcarriersAug2009Heartland130Million+credit/debitcardrecordsSource:PrivacyRightsClearinghouse

安全威脅直接影響到機(jī)構(gòu)和個人的經(jīng)濟(jì)收益第2頁/共22頁

安全威脅直接影響到機(jī)構(gòu)和個人的經(jīng)濟(jì)收益CompanyBreachSony/gaming/news/2011/04/sony-looking-into-compensating-psn-users-fbi-gets-involved.arsOutsiderhackreportedover70millionuserrecordsstolenNewZealandDept.ofInternalAffairs/new-zealand-government-sites-attacked-0640/Outsider

DenialofServiceviaoutsiderhackintothedatabaseviasqlinjectionVodafoneAustralia/news/Vodafone-Australia-Shuts-Down-Dealer-over-Dubious-Practices-179994.shtmlInternalemployeesatCommunicationsDirectPtyLtdandVodafonefiredandoverunauthorizedaccesstoVodafonecustomerrecordsDellAustralia.au/technology/security/dell-australia-customer-details-stolen-in-major-global-data-breach-20110407-1d4yd.htmlMarketingdatabaseproviderEpsilonbreach–40BillionemailsstolenworldwideSouthKoreaHyundaiCapital/article/2011/04/11/us-korea-regulator-hyundai-idUSTRE73A0DJ20110411OutsiderhackofthefinancialarmofHyundaistealingover400,000customerrecordsM/besafe/jobseeker/index.aspxOutsiderhackstealinguser-ids,passwords,emailaddresses,phonenumbersanddemographicdataHonda/2011/01/japanese-automaker-honda-data-breach-affects-4-9-million-customers/Outsiderhackof4.9MillioncustomerrecordsKDDIJapan/incidents/315-japan-telecom-carrierOutsiderhackof5Millioncreditcardrecords第3頁/共22頁安全還是不安全？May1,20234第4頁/共22頁電子商務(wù)交易安全環(huán)節(jié)May1,20235數(shù)據(jù)中心及周邊系統(tǒng)交易終端交易過程第5頁/共22頁數(shù)據(jù)中心安全設(shè)計參考框架May1,20236第6頁/共22頁數(shù)據(jù)中心安全設(shè)計參考框架May1,20237第7頁/共22頁服務(wù)器虛擬化環(huán)境下的安全防護(hù)HypervisorTraditionalIPSPhysicalServerNetworkSecurityPlatform(IPS)NextGenFirewallNote:McAfeeFWdoesnotsupportinter-VMCommunications(VMotion)同一物理機(jī)上虛擬機(jī)之間的安全隔離8第8頁/共22頁服務(wù)器虛擬化環(huán)境下的安全防護(hù)May1,20239TraditionalIPSNetworkSecurityPlatform(IPS)對虛擬服務(wù)器的安全加固和變更控制HypervisorPhysicalServerNextGenFirewallToPsforServers第9頁/共22頁服務(wù)器虛擬化環(huán)境下的安全防護(hù)May1,202310TraditionalIPSNetworkSecurityPlatform(IPS)對虛擬化系統(tǒng)上運(yùn)行的數(shù)據(jù)庫提供安全保護(hù)HypervisorPhysicalServerNextGenFirewallToPsforServersDAM第10頁/共22頁服務(wù)器虛擬化環(huán)境下的安全防護(hù)May1,202311TraditionalIPSNetworkSecurityPlatform(IPS)Hypervisor感知的病毒防范HypervisorPhysicalServerNextGenFirewallToPsforServersDAMMoveAVforServers第11頁/共22頁高級持續(xù)性威脅（APT）攻擊示意InternetUSERS&

PARTNERSSaaSBRANCHOFFICECORPORATELAN第12頁/共22頁交易終端的安全性May1,202313真正的挑戰(zhàn)第13頁/共22頁傳統(tǒng)的基于特征的惡意代碼防御技術(shù)FilePropertiesPropertyValuesDetectionNameSample1Length94134bytesMD5B075a2b81336caedcccdec336811f461SHA1772e79026bef86044e308d290d4d4fdf1167091cSamplesubmittedandprocessedAddtocloudAddtolocalvirussignaturefileNewsampleMay1,202314第14頁/共22頁傳統(tǒng)的基于特征的惡意代碼防御技術(shù)FilePropertiesPropertyValuesDetectionNameSample1Length94134bytesMD5B075a2b81336caedcccdec336811f461SHA1772e79026bef86044e308d290d4d4fdf1167091cSamplesubmittedandprocessedAddtocloudAddtolocalvirussignaturefileMay1,202315第15頁/共22頁交易終端的安全性May1,202316硬件輔助的安全防護(hù)防止Rootkit動態(tài)白名單技術(shù)防范未知威脅外設(shè)控制防止非法U盤等外設(shè)Internet網(wǎng)站安全信譽(yù)防止誤訪問惡意站點(diǎn)可管理性？？？第16頁/共22頁交易過程的安全性May1,202317第17頁/共22頁其它方面：用戶的信心McAfeeSECURE?主要為在線交易相關(guān)站點(diǎn)提供安全性證明在超過五十個國家中擁有數(shù)萬客戶有8萬多個站點(diǎn)擁有McAfeeSECURE的可信標(biāo)志互聯(lián)網(wǎng)零售商前500家中超過一半采用該服務(wù)為商家增加的交易量平均為12%多語言支持-英語、日語、中文、西班牙、匈牙利、德語第18頁/共22頁全世界的無產(chǎn)階級，聯(lián)合起來！McAfeeLabsMFEProductsOtherfeeds&analysisServersFirewallsEndpointsAppliancesFileReputationEngineWebReputationEngineNetworkThreatInformationIPandSenderReputationEngineVulnerabilityInformationGlobalThreatIntelligenceEmailFirewallIPSDLPWebAWLePOAV第19頁/共22頁結(jié)語May1,202320“Companiesspendmillionsofdollarsonfirewallsandit'smo