Please enable JavaScript.
Coggle requires JavaScript to display documents.
정보보안 총괄 (Computer Science
[ACM(Association for Computing Machinery) 분류]…
정보보안 총괄
Information Systems
[wiki]
- formal, sociotechnical, organizational system designed to collect, process, store, and distribute information
Database Management Systems(DBMS)
[wiki]
- A database is an organized collection of data, generally stored and accessed electronically from a computer system. Where databases are more complex they are often developed using formal design and modeling techniques.
Types
Relational DataBase(RDB)
[TTA]
Types
-
-
MySQL
Related Secuirty Command
- skip-networking : 서버는 로컬에서의 유닉스 소켓 접속만을 허용하게 된다.
-
-
-
Structured Query Language(SQL)
[코글]
데이터 처리 조작 언어
(DML, Data Manipulation Language)
Derivative or Supplement
Prepared Statement
[위키] [블로그-효율내용] [티스토리-보안]
- In database management systems (DBMS), a prepared statement or parameterized statement is a feature used to execute the same or similar database statements repeatedly with high efficiency.
데이터 접근 제어 언어
(DCL, data control language)
데이터 정의어
(DDL, Data Definition Language)
-
Derivative or Supplement
Issue
어마어마한 증폭 가능케 해주는 멤캐시드, 새로운 위협(180228)
[보안뉴스]
Database Security
[wiki] [ITwiki]
- Database security concerns the use of a broad range of information security controls to protect databases against compromises of their confidentiality, integrity and availability.
-
-
-
Security and Privacy
[wiki]
Threat
[wiki]
- In computer security, a threat is a possible danger that might exploit a vulnerability to breach security and therefore cause possible harm.
Advanced Persistent Threat(APT)
[wiki]
-
Defenses
IT 베이스라인 방어 접근법
(IT Baseline Protection)
[위키]
- The IT baseline protection approach from the German Federal Office for Information Security is a methodology to identify and implement computer security measures in an organization.
업무연속성계획(BCP)
(Business Continuity Planning)
[위키]
- Business continuity planning (or business continuity and resiliency planning) is the process of creating systems of prevention and recovery to deal with potential threats to a company. In addition to prevention, the goal is to enable ongoing operations before and during execution of disaster recovery.
Firewall
[Wiki]
- firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. A firewall typically establishes a barrier between a trusted internal network and untrusted external network, such as the Internet.
Software
Linux
Apps
Netfilter
[wiki]
- Netfilter is a framework provided by the Linux kernel that allows various networking-related operations to be implemented in the form of customized handlers.
-
iptables
[wiki] [Tutorial] [Blog-Tutorial2] [limit 보충설명]
- iptables is a user-space utility program that allows a system administrator to configure the IP packet filter rules of the Linux kernel firewall, implemented as different Netfilter modules
-
-
Derivative or Supplement
Web Application Firewall
[wiki]
- A web application firewall (or WAF) filters, monitors, and blocks HTTP traffic to and from a web application. A WAF is differentiated from a regular firewall in that a WAF is able to filter the content of specific web applications while regular firewalls serve as a safety gate between servers. By inspecting HTTP traffic, it can prevent attacks stemming from web application security flaws, such as SQL injection, cross-site scripting (XSS), file inclusion, and security misconfigurations.
Software
ModSecurity (Modsec)
[wiki]
- ModSecurity, sometimes called Modsec, is an open-source web application firewall (WAF). Originally designed as a module for the Apache HTTP Server, it has evolved to provide an array of Hypertext Transfer Protocol request and response filtering capabilities along with other security features across a number of different platforms including Apache HTTP Server, Microsoft IIS and Nginx.
Application Security
[wiki]
- Application security encompasses measures taken to improve the security of an application often by finding, fixing and preventing security vulnerabilities.
Types
Secure Coding
[wiki]
- Secure coding is the practice of developing computer software in a way that guards against the accidental introduction of security vulnerabilities. Defects, bugs and logic flaws are consistently the primary cause of commonly exploited software vulnerabilities.
Authentication
[wiki]
Authentication is the act of proving an assertion, such as the identity of a computer system user.
Password Authentication
Credential Stuffing
[wiki]
- Credential stuffing is a type of cyberattack where stolen account credentials typically consisting of lists of usernames and/or email addresses and the corresponding passwords (often from a data breach) are used to gain unauthorized access to user accounts through large-scale automated login requests directed against a web application.
Network Security
[wiki]
- Network security consists of the policies and practices adopted to prevent and monitor unauthorized access, misuse, modification, or denial of a computer network and network-accessible resources.
Types of Attacks
- Networks are subject to attacks from malicious sources. Attacks can be from two categories: "Passive" when a network intruder intercepts data traveling through the network, and "Active" in which an intruder initiates commands to disrupt the network's normal operation or to conduct reconnaissance and lateral movements to find and gain access to assets available via the network.
Active
-
Web Application Security
[wiki] [TTA]
- Web application security is a branch of information security that deals specifically with security of websites, web applications and web services. At a high level, web application security draws on the principles of application security but applies them specifically to internet and web systems
Cross Site Scripting(XSS)
[TTA] [KISA] [OWASP]
-
반사 XSS 공격
(Non-persistent or Reflected)
- 웹 애플리케이션의 지정된 변수를 이용할 때 발생하는 취약점을 이용
저장 XSS 공격
(Persistent or Stored)
- 취약한 웹 애플리케이션을 이용하여 웹 서버에 영구적으로 저장
예) 게시판
Cross-Site Request Fogery(CSRF)
[KISA] [TTA]
File Inclusion Vulnerability
[wiki]
- A file inclusion vulnerability is a type of web vulnerability that is most commonly found to affect web applications that rely on a scripting run time. This issue is caused when an application builds a path to executable code using an attacker-controlled variable in a way that allows the attacker to control which file is executed at run time.
(Address Resolution Protocol Spoofing)
[TTA] [위키]
Denial-of-Service Attack(DoS)
[wiki]
- denial-of-service attack is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host connected to the Internet.
Attack Techniques
-
SYN Flood
[wiki]
- A SYN flood is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic.SYN flood is a protocol attack
Slowloris
[wiki)] [IT위키]
- Slowloris allows a single machine to take down another machine's web server with minimal bandwidth and side effects on unrelated services and ports.
Passive
Sniffing
Promiscuous Mode
[wiki]
- promiscuous mode is a mode for a wired network interface controller (NIC) or wireless network interface controller (WNIC) that causes the controller to pass all traffic it receives to the central processing unit (CPU) rather than passing only the frames that the controller is specifically programmed to receive. This mode is normally used for packet sniffing that takes place on a router or on a computer connected to a wired network or one being part of a wireless LAN.
Computer Security Model
[wiki]
강제적 접근 통제(MAC)
(Mandatory Access Control)
[TTA] [IT위키]
역할 기반 접근제어(RBAC)
(Role Based Access Control)
[TTA] [IT위키]
벨-라파듈라 보안 모델
(Bell-LaPadula Security Model)
[TTA] [IT위키]
비바 무결성 모델(Biba Integrity Model)
[TTA] [IT위키]
임의적 접근제어(DAC)
(Discretionary Access Control)
[TTA] [IT위키]
Intrusion Detection System(IDS)
[TTA1] [TTA2] [위키]
- An intrusion detection system is a device or software application that monitors a network or systems for malicious activity or policy violations. Any intrusion activity or violation is typically reported either to an administrator or collected centrally using a security information and event management (SIEM) system. A SIEM system combines outputs from multiple sources and uses alarm filtering techniques to distinguish malicious activity from false alarms
Category
- IDS can be classified by where detection takes place (network or host) or the detection method that is employed (signature or anomaly-based)
-
-
Derivative or Supplement
침입방지시스템(IPS)
(Intrusion Prevention System)
[TTA] [위키]
-
-
소프트웨어(SW)
Snort
[TTA] [TTA2-탐지규칙 요구사항] [wiki]
- Snort is a free open source network intrusion detection system and intrusion prevention system created in 1998 by Martin Roesch, founder and former CTO of Sourcefire. Snort is now developed by Cisco, which purchased Sourcefire in 2013.
-
Cryptography
암호학적 해시함수 & 메시지 인증코드
(Cryptographic hash function)
(Message Authentication Codes)
[위키]
공통 기능
(Common Functions)
메시지 다이제스트 알고리즘(MD5)
(Message Digest Algorithm 5)
[TTA] [MD5 익스플로잇]
Cyberattack
[wiki]
- In computers and computer networks an attack is any attempt to expose, alter, disable, destroy, steal or gain unauthorized access to or make unauthorized use of an asset. A cyberattack is any type of offensive maneuver that targets computer information systems, infrastructures, computer networks, or personal computer devices.
Types
Supply Chain Attack
[wiki]
- A supply chain attack is a cyber-attack that seeks to damage an organization by targeting less-secure elements in the supply network. A supply chain attack can occur in any industry, from the financial sector, oil industry or government sector. Cybercriminals typically tamper with the manufacturing process of a product by installing a rootkit or hardware-based spying components.
Information Security
[wiki]
- Information security, sometimes shortened to infosec, is the practice of protecting information by mitigating information risks. It is part of information risk management. It typically involves preventing or at least reducing the probability of unauthorized/inappropriate access to data, or the unlawful use, disclosure, disruption, deletion, corruption, modification, inspection, recording or devaluation of information.
-
Penetration Test
[wiki]
- A penetration test, colloquially known as a pen test, pentest or ethical hacking, is an authorized simulated cyberattack on a computer system, performed to evaluate the security of the system.
Method
-
-
Black Box
[wiki]
- Black-box testing is a method of software testing that examines the functionality of an application without peering into its internal structures or workings.
-
-
-
-
Software Engineering
[wiki]
- Software engineering is the systematic application of engineering approaches to the development of software. Software engineering is a branch of computing science.
Related fields
프로젝트 관리
(Project Management)
[위키]
프로젝트 위험 관리
(Project Risk Management)
[위키]
- Risk management activities are applied to project management. Project risk is defined by PMI as, "an uncertain event or condition that, if it occurs, has a positive or negative effect on a project’s objectives."
위험관리계획
(Risk Management Plan)
[위키]
- A risk management plan is a document that a project manager prepares to foresee risks, estimate impacts, and define responses to risks.
위험대응
(Risk Response)
회피(Avoid)
- Change plans to circumvent the problem
제어(Control, Mitigate, Modify, Reduce)
- Reduce threat impact or likelihood (or both) through intermediate steps
수용(Accept, Retain)
- Assume the chance of the negative impact (or auto-insurance), eventually budget the cost (e.g. via a contingency budget line)
전가(Transfer, Share)
- Outsource risk (or a portion of the risk) to a third party or parties that can manage the outcome. This is done financially through insurance contracts or hedging transactions, or operationally through outsourcing an activity.
정보보호 위험관리 가이드
(KISA : 수탁기관[한국정보시스템감사통제협회])
[KISA]
- 정보보호관리체계 인증 획득에 관심이 있는 업체 및 기관이 정보보호관리체계를 쉽게 수립할 수 있도록 방법론과 설명을 제공하고 정보보호관리체계 인증제도에 대한 해설서를 제공함으로써 수요기관의 정보보호 수준을 향상시키고 정보보호관리체계 인증을 활성화시켜 궁극적으로 국가정보통신기반의 신뢰성 확보 및 정보보호수준을 제고하는데 그 목적이 있다.
제3장 위험분석 방법론
제1절 위험의 구성요소
위험의 구성 요소
- 4 more items...
제2절 위험분석 방법론 소개
- 정보기술 보안 관리를 위한 국제 표준 지침인 ISO / IEC 13335-1에서는 위험분석 전략을 크게 4가지로 나눈다.
- 베이스라인 접근법(Baseline Approach)
- 비정형 접근법(Informal Approach)
- 상세 위험분석(Detailed Risk Analysis)
- 복합 접근법(Combined Approach)
-
-
-
-
예측
(Forecasting)
[위키]
- Forecasting is the process of making predictions of the future based on past and present data and most commonly by analysis of trends.
정성법
(Qualitative)
Delphi Method
[위키]
- The Delphi method or Delphi technique is a structured communication technique or method, originally developed as a systematic, interactive forecasting method which relies on a panel of experts. The technique can also be adapted for use in face-to-face meetings, and is then called mini-Delphi or Estimate-Talk-Estimate (ETE). Delphi has been widely used for business forecasting and has certain advantages over another structured forecasting approach, prediction markets.
-
-