微软安全级别策略

《微软安全级别策略》由会员分享，可在线阅读，更多相关《微软安全级别策略（12页珍藏版）》请在装配图网上搜索。

1、微软安全级别策略1微软风险管理流程已过期已过期的风险的风险风险陈述风险陈述文档文档Top 103.计划计划 5.控制控制2.分析分析1.确认确认风险陈述风险陈述4.跟踪跟踪微软IT操作框架(Microsoft Operation Framework)Condition-consequence risk statements help to clearly articulate risk2为了得到每个风险可能造成的危害的量化结果基于可能性(Probability)和影响(Impact)可能性：该风险发生的几率影响：该风险发生后的损失或影响probability x impact=exposure

2、Example:75%x$500,000=$375,000目的是可以比较各风险，以得到风险处理的优先级计算风险的危害性(Exposure)3风险管理策略减少风险 Example:Minimize the probability(likelihood of the condition)Example:Minimize the impact(level of the consequence)风险转移Example:Move to different hardware Example:Subcontract to a third party风险规避Example:Dont undertake cer

3、tain projectsExample:Rely on proven,not cutting-edge,technology4微软安全响应中心位于Redmond的160人的微软安全响应中心(MSRC Microsoft Security Response Center)目标：帮助微软用户安全的使用微软系统和网络既是管理员又是黑客Subcontract to 3rd party(Foundstone,ISS)制定严格的安全规范和操作手则风险评估5微软安全通告的级别微软安全通告级别Critical 紧急该缺陷可能导致无需用户操作的互联网蠕虫病毒的传播Important 重要该缺陷可能导致用户数据

4、的机密性、完整性、或有效性受到伤害，或导致相关处理流程资源的完整性或有效性受到伤害Moderate.Exploitability is mitigated to a significant degree by factors such as default configuration,auditing,or difficulty of exploitationLow.A vulnerability whose exploitation is extremely difficult,or whose impact is minimal.微软安全策略的目标开发安全的产品(Get Secure)使用

5、户能方便的保持安全(Stay Secure)6微软建议的安全流程设计与开发信息安全策略制定详细的信息安全规范信息安全规范的有效实施管理员培训和普通用户的教育持续不间断的安全管理风险评估的标准与风险管理流程紧急处理机制灾难恢复机制自动安全通告机制7中国企业所常有的安全问题没有实施严格的账号和口令管理，或者需管理的账号和口令太多没有实时监测恶意的攻击行为不清楚系统的完整状况难以快速部署软件更新(Hot-fix)及服务包(Service Pack)内部用户任意安装软件，或随意修改系统配置“有法不依，执法不严”8我们的建议系统安全的前提是管理安全统一的信息安全风险评估的管理体制与管理方法Example

6、:independent security group inside Microsoft R&D,including Microsoft employee&3rd party统一的信息安全风险评估的技术标准及相关工作流程统一的建议性的信息安全管理策略和管理方法“有法必依，执法必严”9谢谢！谢谢！10微软Windows安全目标提供稳定的、健壮的、基于对象的系统安全模型是Windows系统架构中的基础模块安全必须考虑在前，很难事后添加满足DoD C2安全认证的要求满足商业用户的要求多用户能安全的使用和共享系统资源进程、内存、设备、文件、网络11Windows&SecurityScenarioSce

7、narioRisksRisksSolutionsSolutionsMobile UsersMobile Users Encrypted (EFS)Encrypted (EFS)PPTP,IPSEC,L2TP PPTP,IPSEC,L2TP Lost/Stolen LaptopLost/Stolen Laptop Dial-up AttacksDial-up AttacksE-commerceE-commerce False Identity/ImpostorFalse Identity/Impostor Theft data/moneyTheft data/money Transaction

8、modificationTransaction modification Public Key Infrastructure(PKI)Public Key Infrastructure(PKI)Integrated CA Integrated CA SSL/TLS SSL/TLSHome OfficeHome Office PPTP,IPSEC,L2TP PPTP,IPSEC,L2TP NTLMv2,Kerberos,PKI NTLMv2,Kerberos,PKI SSL/TLS,S/MIME SSL/TLS,S/MIME On-wire Internet AttacksOn-wire Int

9、ernet Attacks Dial-up AttacksDial-up Attacks False Identity/ImpostorFalse Identity/ImpostorLAN/WANLAN/WAN False Identity/ImpostorFalse Identity/Impostor Password Sharing/GuessingPassword Sharing/Guessing Adds/Moves/ChangesAdds/Moves/Changes Kerberos,NTLMv2 Kerberos,NTLMv2 Smart Cards,Biometrics Smar

10、t Cards,Biometrics Group Policy,Delegated Admin Group Policy,Delegated AdminApplicationsApplications False Identity/ImpostorFalse Identity/Impostor Password passingPassword passing Path of least resistance codingPath of least resistance coding Malicious Code(Trojan horse)Malicious Code(Trojan horse)

11、Kerberos,NTLMv2,Smart Cards Kerberos,NTLMv2,Smart Cards Impersonation,Auditing Impersonation,Auditing SSPI,CryptoAPI SSPI,CryptoAPI Code Signing and Policy Code Signing and Policy Public Key Infrastructure(PKI)Public Key Infrastructure(PKI)Integrated CAIntegrated CA IPSEC,L2TP,SSL/TSL,S/MIMEIPSEC,L2

12、TP,SSL/TSL,S/MIMEExtranetsExtranets False Identity/ImpostorFalse Identity/Impostor Data TheftData Theft On-wire Internet AttacksOn-wire Internet Attacks Active Directory Integration Active Directory Integration Delegated Administration Delegated Administration Auditing Improvements Auditing Improvements Security Templates Security TemplatesManagementManagement Too many places to secureToo many places to secure Unfamiliar with employee rolesUnfamiliar with employee roles Dont Know who did whatDont Know who did what Configuration and DriftConfiguration and Drift12