Analysis of deep security definition and encryption technology

0x01 Three elements of safety

The basic goal of safety ：

• Confidentiality ： Prevent information from being leaked to unauthorized persons , For example, network monitoring 、 Sniff attacks, etc . measures ： Encrypt data 、 The encrypted 、 Access control .
• integrity ： Prevent information from being maliciously tampered with by unauthorized persons . measures ： hash 、 Access control 、 Software digital signature 、CRC etc. .
• Usability ： Timely and reliable access to data and resources . measures ：RAID、 colony 、 Load balancing 、 Backup 、 Roll back .

  

The security policy defines what we can do , What can't be done , And give confidentiality 、 integrity 、 Usability is defined , Security mechanisms as methods and tools , Security policies can be strengthened .

The opposite of the three elements ：

• Disclosure（ Let the cat out of the ）
• Destruction（ damage ）
• Alteration（ Tampering ）

0x02 The term

• Be trusted ： Whether or not the code is flawless ( Almost all systems have vulnerabilities ), We all rely on some systems to implement the right strategy .
• trustworthy ： We believe that there are no loopholes in the system that may lead to violation of relevant security policies .
• recognition ： A statement by a third party that a system or software is trustworthy with respect to a particular policy and a particular operating environment .
• privacy ： Protected personal information , Information that cannot be accessed without authorization .
• Identification ： The system authenticates the user identity .
• to grant authorization ： Assign access rights to authorized principals .
• Audit ： Independent review and audit of system records .

Effective security posture

• Secure security measures
• The system is updated to the latest version
• Minimum privilege

Attacker type

• For opportunists or bottom-up （Bottom up） The attacker ： Look for weaknesses , Use tools to scan for vulnerabilities , Once you enter, you will improve your access , Because the system or the user ID Has leaked . The control framework is crucial for such attackers , Need to know the paths that may be exposed , Trace to sensitive data .
• For goal oriented top-down （Top down） The attacker ： Understand your organization and system , The target of the attacker is to destroy some components of the system or access specific data , Spread the threat through the threat carrier . A strong security posture is required , Train privileged employees , A strong framework to protect against hazards , Powerful defense mechanism address destructiveness .

  

Attacker terminology

• threat （thread）： The tool or method has the ability to take advantage of the potential danger brought by vulnerability to violate the expected strategy of the system .

• risk （risk）： Business impact , Negative possibilities

• Vulnerability （vulnerability）： System 、 Program 、 A weakness in the process or configuration , Flaws that allow threats to compromise their security , Cause the attacker to violate the expected policy of the system （intend policy）

• attack （attack）： Try to exploit the vulnerability to attack the system , Violate the expected strategy of the system .

• Compromise or invade （compromise ｜ intrusion）： Successful behavior that violates the expected strategy of the system .

• penetration （penetrate）： A successful attack that exploits a vulnerability in the system or its configured code base ( intrusion ).

• Denial of service （denial of service）： An attack that prevents authorized access to resources , Make the target inaccessible by destroying it or making it inaccessible with unwanted requests .

  

• damage （subversion）： Intentionally change the code base or configuration of the system , So as to change the correct implementation of the strategy . This includes installing back doors and other control channels in violation of system related policies .

• Security （security）： A secure system means that the system implements a strong security policy , A system can only be secure under a specific set of policies and a set of stated assumptions . No system is absolutely safe .

• Trusted computing basis （trust computing base）： Part of the system will affect the security of the whole computer , An undeclared assumption about the security system is TCB Implemented correctly and not broken .

• Attack side （attack surface）： Accumulation of all parts of the system , Leak on the attack surface , Attackers can find and exploit vulnerabilities to attack the security of the system .（ Violation of system security policy ）
  
   

  

Frequent attacks ：

• Error code
• Protocol design failed
• Weak password
• Social engineering
• Internal threats
• Wrong configuration
• Incorrect policy norms
• A stolen key or identity
• Denial of service

The role of policies in security construction

• policy ： Define what we should do , How the security mechanism should operate .
• Strengthen and maintain security policies through security mechanisms ： Provide protection 、 explain 、 assessment .
• Implement through software ： Correctly implement the software according to the safe and perfect software engineering principles .

0x03 Security mechanism

• encryption
• Virtual private network
• The checksum
• Intrusion detection
• Key management
• Intrusion response
• Authentication
• development tool
• to grant authorization
• Virus scanning
• accounting
• Policy management
• A firewall
• Trusted hardware

Today's security situation

Now , Most security services are deployed to handle simple things , Security is implemented at a single point in the network or at a single layer in the protocol stack ：

• A firewall
• lPSec
• SSL
• Virus scanning
• Intrusion detection

The implementation of system security is not so easy , It must be better integrated with the application .
At the level that must eventually be specified , Security policies belong to application level objects , And identify application level entities ( user ). Because today's systems lack central control points , The implementation of security becomes more difficult .

0x04 Encryption technology

Cryptography is the foundation of many basic security services ,

• Confidentiality（ confidentiality ）
• Data integrity（ Data integrity ）
• Authentication（ Authentication ）

One letter replacement password

• Information unit ( Letter ) Permutation
• 26! Sort of arrangement , Each arrangement is considered a key , Hard to remember

Encryption attacks

Only ciphertext attacks （ciphertext-only attack）

Only know encrypted text （ Ciphertext ） An exhaustive attack .
I only know ciphertext , for example ,Alice towards Bob Send ciphertext , All you get from the attack is the ciphertext .

Known plaintext attack

Some given plaintext and corresponding ciphertext are obtained , Here it can be any nonempty subset of .
Even if you don't know the complete inscription , You can often know part of him , The beginning of an email is usually predictable , Or there is a fixed signature at the end IP Baotou is also very predictable , Using these predictable data, we can get some English , And carry out known plaintext attack through the comparison of plaintext and ciphertext .

Choose plaintext attack

In addition to knowing the encryption algorithm , You can also select Clear text messages , And you can know the corresponding encrypted ciphertext , That is, know the selected plaintext and encrypted ciphertext .

• Offline attack ： Before getting the ciphertext, the attacker should do all the plaintext messages that he wants to encrypt .
• Online attacks ： Select a new plaintext according to the obtained ciphertext .

Symmetric key （Symmetry key） encryption

A single key can be used for encryption and decryption , Keys are usually very short , Because the key space is densely filled .
Ex: AES, DES, 3DES, RC4,Blowfish. IDEA. etc.

Asymmetric encryption （Public key/Asymmetric）

A key is used for encryption , A key is used to decrypt ; Keys are usually very long , Because the key space is sparsely filled .
Ex: RSA, El Gamal, DSA, etc.

One time password book

Generate the key stream size of truly random data to be encrypted .
encryption ： Exclusive or plaintext using key stream .
Decrypt ： XOR again with bond flow .

There is no guarantee of integrity , Change in ciphertext 1 Bits will cause other bit ratio transformations in the plaintext .
If the key is reused or the key is pseudorandom , Security is compromised .

Stream encryption

Stream ciphers are linear , So the same key can encrypt and decrypt messages . Pseudo random secret key streams are usually generated serially from random seed values using digital shift registers , The seed value is used as the key to decrypt the stream .

Stream cipher represents a symmetric encryption method different from block cipher . Stream ciphers usually execute at a higher speed than block ciphers and have lower hardware complexity .

Stream cipher encrypts bits at one time 、 Bytes or blocks , But counterpoint 、 The conversion performed by a byte or block depends on the position in the input stream , It may also depend on earlier blocks in the stream .

0x05 Security mitigation methods

Phishing attack measures ：

• Website monitoring service
• Delegation and certification
• Spread awareness
• Report suspected websites

Database attack mitigation measures :

• Identity and access control configurations and policies need to be set for all data stores , And realize differential privacy
• take ip Put on the firewall white list

Mitigation measures ：

• testing ： Rate limiting individuals IP Address and analysis browsing mode
• Strict access restrictions require login to access
• Use verification code if necessary
• Create honeypot page

0 Attachments