ann in hung dung

7/31/2019 Ann in Hung Dung

1/31

MISOFT

Nng 1 -0 -2007 Dr. Vu Quoc Thanh, CISA

4:06:31 PM

TS. V Quc ThnhCI SA ( Ce r t i f i ed I n f o r m a t i on Sys t em Aud i t o r )

TG Cng ty MISOFT

Vi vn v An ninhng dng

PDF created with pdfFactory Pro trial version www.pdffactory.com
http://www.pdffactory.com/http://www.pdffactory.com/


2/31

MISOFT


4:06:31 PM

Pol icy

App l i ca t i onSecur i t y

Opera t ing Sys tem

Secur i t yI n f r a s t r u c t u r e

Secur i t y

An ninh ng dng l g?



3/31

MISOFT


Cc chun quc t ni g?

ISO 17799 ISO27001

PCI

Cobit 4.0 GLBA

.SOX

HIPAA

GLBA

FFIEC



4/31

MISOFT


4:06:31 PM

ATTT ang c chun ha:

Ct B 2006



5/31

MISOFT


4:06:31 PM

ATTT ang c chun ha:

Nng 2007



6/31

MISOFT


4:06:31 PM

ATTT ang c chun ha:

Btu pht trin

(new name for ISO/IEC 18028on IT network security)



7/31

MISOFT


4:06:31 PM

Ni dung ATTT theo ISO1. Chnh sch an ninh (Security Policy)2. T chc an ton thng tin (Organizing Information Security)3. Qun l s c an ton thng tin (Information Security

Incident Management)4. Xc nh, phn loi v qun l ti nguyn (Asset

Management)

5. An ninh nhn s (Human Resources Security)6. An ninh vt l v mi trng (Physical and Environmental

Security)7. Qun tr vn hnh v truyn tin (Communication and

Operations Management)8. Kim sot truy cp (Access Control)

9. Trang b, pht trin v duy tr h thng (Informations SystemAcquisition, Development and Maintenance)10. Qun l tnh lin tc nghip v (Business Continuity

Management)11. Tun th lut php v cc quy nh (Compliance)



8/31

MISOFT


4:06:31 PM

SecuritySecurity



9/31

MISOFT


4:06:31 PM

PCI: 12 yu cuBuild and Maintain a Secure Network1. Install and maintain a firewall configuration to protect data2. Do not use vendor-supplied defaults for system passwords and othersecurity parametersProtect Cardholder Data3. Protect Stored Data

4. Encrypt transmission of cardholder data and sensitive information acrosspublic networksMaintain a Vulnerability Management Program5. Use and regularly update anti-virus software6. Develop and maintain secure systems and applicationsImplement Strong Access Control Measures7. Restrict access to data by business need-to-know

8. Assign a unique ID to each person with computer access9. Restrict physical access to cardholder dataRegularly Monitor and Test Networks10. Track and monitor all access to network resources and cardholder data11. Regularly test security systems and processesMaintain an Information Security Policy

12. Maintain a policy that addresses information security

6. Develop and maintain secure systemsand applications



10/31

MISOFT


4:06:31 PM

Cc quy nh VN c cp

khng? LUT: GIAO DCH IN T NGHNH: V giao dch in

t trong hot ng ngnhng CH TH 03: Tng cng m

bo an ninh thng tin trnmng Internet

Quy ch: an ton, bo mt hthng CNTT trong ngnhNgn hng



11/31

MISOFT


4:06:31 PM

NetworkServer

WebApplications

% of At t acks % of Dollars

75%

10%

25%

90%

Sources: Gartner, Watchfire

Securit y Spending

of All At t acks on I nform ation Securit y

Are Directed t o the Web Application Layer75%75%

of All Web Applications Are Vulnerable2/32/3

Buffer Overflow Cookie Poisoning

Hidden Fields Cross Sit e Scri pt ing Stealt h Commanding Parameter Tampering Forceful Browsing SQL Inject ion Etc

An ninh ng dng sau? 75% cc cuc tn cng c thc hin t ni

b (Ngun: CSI/FBI, M).

Cc t chc chi rt nhiu tin ca v cng

sc cho vic xy dng h thng bo v mng nhng li cho php ngi s dng tngi d dng truy cp su vo cc h thng ng

dng ch bng tn v mt khu n gin(Ngun: Gartner)



12/31

MISOFT


4:06:31 PM

Tn cng ng dng lt qua tt c

cc lp bo v mngDesktop Transport Network Web Applications

AntivirusProtection

Encryption(SSL)

Firewalls/IPS

Strong Authentication, ManualPatching and Code Review



13/31

MISOFT


4:06:31 PM

Kh khn



14/31

MISOFT


4:06:31 PM

Cc vn cng ngh chnh ca

ANUD?I. Xc thc ++

II. Tch hp ANUD trong qu trnh pht

trinIII. ANUD Web

IV. An ninh dliu v CSDL



15/31

MISOFT


4:06:31 PM

I. Xc thc

S lng cc loi m c hi nhm n cp mt khu tng hn 425% k t5/2005 n thng 5/2006 (theo Anti-Phishing Working Group 2006)



16/31

MISOFT


4:06:31 PM

nh cp nh danh

Trong nm 2005 ring M c n 8.9 triungi ln (chim 4% s ngi ln M) trthnh nn nhn ca nh cp nh danh (theo

Javelin Strategy 2006). S lng cc trang Web nh cp nh danh sdng k thut phishing tng hn 360% t thng5/2005 n thng 5/2006 (theo Anti-PhishingWorking Group 2006)

Th trng th gii cc cng ngh xc thcchng nh cp nh danh t $200M USD vonm 2006 (theo UBS 2006)

nh cpnh danh ti phm hay khng?



17/31

MISOFT


4:06:31 PM

Cc cng ngh xc thc 2FASn phm / Cng ngh xc thc

Tnh dmang

theo

Tnh

sdng

Tnh

bomt

Chi ph

u tKhnngqun

tr

Khnngtch

hp

One-Time-Password Tokens 5 3 4 2 2 5

Dch v OTP 5 4 4 3 3 5

Smart Card (EMV) 5 3 5 3 3 5

Xc thc bng s PIN/TAN 5 5 3 3 3 5

Ma trn s IdentityGuard 5 5 5 4 4 5

Xc thc bng Mobile 4 3 5 3 5 5

Nhp gi tr xc thc trn bnphm o

5 3 2 5 5 2

Xc thc bng danh sch cc dys

5 2 2 4 5 2

Sim: 1 = km 5 = rt ttTheo ngun: Cng ty nghin cu nh gi cc sn phm cng ngh

Forrester Research



18/31


19/31

MISOFT


4:06:31 PM

II. Tch hp ANUD trong qu

trnh pht trin

Phn tch p dngThit k Pht trin/Kim tra

Iterations

Security Team



20/31

MISOFT


4:06:31 PM

i An ninh ng dng

Chuyn gia thit k an ninh (SecurityArchitect): chu trch nhim v thit k chung

Chuyn gia phn tch an ninh (Security

Analyst): chu trch nhim v yu cu v xydng cc Misuse Cases

Unit Hacker: Hack cc unit/module v ara cc hng dn khc phc

Chuyn gia cu hnh an ninh ng dng(Application Security Configurator)



21/31

MISOFT


4:06:31 PM

III. ANUD Web

Hacker tn cng t ngoi vo:



22/31

MISOFT


4:06:31 PM

Mc tiu hack ng dng Web

Thay i trang ch

n cp thng tin

Lm sp dch v(DoS/DDoS)

Chim ot tin



23/31

MISOFT


4:06:31 PM

Xu th Hack ng dng Web

2 l hng thng gp nht 2006: 21.5 % Cross Site Scripting 14 % SQL injection

Cc l hng ng dng Web chim 69% tng s tt ccc l hng c ghi nhn trong na u nm 2006.



24/31

MISOFT


4:06:31 PM

Tn cng Cross Site Scripting(XSS)

How?In form fieldsIn URLFrom phishing

What Can It Do?

Load pages from other sites Capture cookies Modify data contents Execute commands to the OS



25/31

MISOFT


4:06:31 PM

Khi nim Cross-Site Scripting L tn cng vo ngi sdnginternetang kt ni hp l ti web server cim yu

im yu trn web server nhng itng b tn cng l client

Client b la chy mt script cahacker di s trung gian ca webserver b li.



26/31

MISOFT


4:06:31 PM

V d v XSS-CSS trong Internet

Banking

`

User

Bank.comAttacker.com

http://bank.com/login/

Webpage + Cookies

InternetBankingCookie

Malicious link onwebpage or email with

malicious link

Mal ic ious L ink

http://bank.com/account.jsp? Send cookie to attacker.com

Ref lect ed Code

Send Cookie toattacker.com

InternetBankingCookie

Executed

RETURN

http://bank.com/login/http://bank.com/account.jsphttp://www.pdffactory.com/http://www.pdffactory.com/http://bank.com/account.jsphttp://bank.com/login/


27/31

MISOFT


4:06:31 PM

Tn cng SQL Injection

`

Hacker

WEB Site

Form FieldJohn Doe select * from accounts...

How?Insert SQL into form fields

What Can It Do?Read, Write, or Modify Database



28/31

MISOFT


4:06:31 PM

10 l hng ng dng Web

nghim trng nht theo OWASP1. D liu u vo khng c kim tra2. Li kim sot truy cp ngun ti nguyn3. Li lin quan n qu trnh qun l xc thc v

phin truy cp4. Li Cross Site Scripting (XSS)5. Li trn bm6. Li (SQL) Injection

7. Quy trnh x l li khng ng8. Lu gi thng tin km bo mt9. Tn cng t chi dch v (Denial-of-service)10. Qun l cu hnh km an ton



29/31

MISOFT


4:06:31 PM

Cng c qut tm l h ngh thng ng dng Web

Database Operat ing System

Web Server

Web Applicat ion Web Servi ces

Database Scanners Host Scanners

NetworkScanners

Web Applicati on Scanners



30/31

MISOFT


4:06:31 PM

Tng la ng dng Web

W AF - W ebApp l i ca t i onFi rew a l l s

NetCont inuum

ng dng

Web

CSDLNetwork

Firewall

Users



31/31

MISOFT


4:06:31 PM

IV. An ninh d liu v CSDL

Bo v d liu trn ng lun chuyn:Vn: b l, bsao chp, gi ra ngoi?

Bin php: m ha, chk s, Phn mm chng r r

thng tin Data Leakage Prevention (DLP), phn mmqun l cc thng tin vo ra Device Protector,

Bo v d liu lu gi:Vn: CSDL bxm nhp (hp php), bsao chp,

bph hoi?Bin php: m ha CSDL, kim ton CSDL, d tm

im yu CSDL,

ann in hung dung

Documents