Please enable JavaScript.
Coggle requires JavaScript to display documents.
Cloud & Application (In)security - Coggle Diagram
Cloud & Application (In)security
Confidentiality :pencil2:保密性 Only authorized party can get access to data.
Integrity :pencil2: 完整性 Guarantee the user that the data it transmitted matches the data received by the cloud service.
Authenticity :pencil2: 权威性 Is the data coming from an authorized source?
Availability :pencil2: 可用性 Service should be accessible and usable during a specified time period. For a cloud service, the time period is 24/7/365.
Threat :pencil2: 威胁 In computer security a threat is a possible danger that might exploit a vulnerability to breach security and therefore cause possible harm.
Vulnerability :pencil2: 弱点 A vulnerability is a weakness that can be exploited.
Attack Vectors :pencil2: 指的是攻击者用来入侵、破坏或利用云环境的各种路径或方法。
Cloud Security Threats :explode:
Malicious Intermediary 传输途中修改或植入有害数据
Insufficient Authorization 权限太宽泛
Traffic Eavesdropping 传输途中窃听
Denial of Service 拒绝服务攻击
Flawed Implementations 底层设计缺陷
Cloud Security :red_flag:
Cloud Security Is A Shared Responsibility，aws和用户共同维护云安全
Cloud Provider Responsibility
：protecting the infrastructure that runs all of the services offered in their Cloud
Cloud User Responsibility
：using IAM tools to apply the appropriate permissions
Security Mechanisms :red_flag:
Encryption 加密🔐
Symmetric Encryption
Asymmetric Encryption
Securing Web-based Data Transmission（SSL/TLS）
握手阶段（Handshake）
非对称加密：
用于密钥交换和身份验证
数据传输阶段
对称加密：
用于加密实际数据传输
数字证书：
由CA签发，确保服务器的合法身份。
Hashing：The hashing mechanism is used when a one-way, non-reversible form of data protection is required.
Digital Signature数字签名：结合非对称加密和hash，防止内容被篡改
Hardened Server Images：服务器镜像硬化，移除不必要的软件，比如java编译器，还有使用非登录用户
Application Security :red_flag:
Users Can Submit Arbitrary Input 限制用户输入
Attack Vectors
Core Defense Mechanisms🛡️
Session Management
Access Control
Authentication
Handling Hackers🛡️
Bypassing Client Side Controls
Attacking Authentication 避免没放盐的简单密码
Mapping the Application
Cross-site request forgery
（CSRF）注入恶意脚本，让有权限的用户执行