Transcript 下載講議
校園網路資訊安全威脅與應用技術探討 陳家慶 (Jacob Chen) (02) 2796-1666#204 BS7799# 802 [email protected] AGENDA 校園網路安全機制 Zero-Day Attack 時代來臨 多層次網路安全防護介紹 個人防毒防駭管理 Instant Messaging (IM) and Peer 2 Peer (P2P) Q&A CONFIDENTIAL 校園網路安全機制 校園網路安全防範體系 電腦安全的模型包含四個主要部分： • Policy(安全策略) Protection • Protection(防護) • Detection(檢測) • Response (回應) Policy Response 防護、檢測和回應組成了一個所謂的“完 整的、動態”的安全迴圈，在安全策略的 整體指導下保證資訊系統的安全。 Detection 動態的網路安全管理 • 網路安全防範體系應該是動態變化的。 • 安全防護是一個動態的過程，新的安全漏洞不斷出現 ，駭客的攻擊手法不斷翻新，而校園資料中心自身的 情況也在不斷地發展變化，在完成安全防範體系的架 設後，必須不斷對此體系進行及時的維護和更新，才 能保證網路安全防範體系的良性發展，確保它的有效 性和先進性。 網路安全管理示意圖 • 網路安全防範體系構建是以安全策略為核心，以安 全技術作為支撐，以安全管理作為落實手段，並通 過安全培訓加強所有人的安全意識，完善安全體系 賴以生存的大環境。 • 安全體系的示意圖 安全培訓 安全管理 安全評估 防火牆 入侵偵測 漏洞補強 安 全 服 務 (支援廠商) 安全技術層 • 最底層是安全技術層： 常見的安全技術和工具主要包括防火牆、安全漏洞掃 描、安全評估分析、入侵檢測、網路陷阱、入侵採證 、備份恢復和病毒防範、漏洞補強等。 • 這些工具和技術是網路安全體系中最直覺的部分，缺 少任何一種都會有巨大的危險，因為網路安全防範是 一個整體概念。但是校園網往往經費有限，不能全部 部署，這時就需要我們在安全策略的指導下，統一規 劃、分步實施。在網路安全體系中它們不能簡單地堆 砌，而是要合理部署，相互聯動，形成一個靈活的防 護機制。 安全管理 • 安全管理： 安全管理貫穿整個安全防範體系，是安全防範體系的 核心。代表了安全防範體系中 ”人”的因素。 • 安全不是簡單的技術問題，不落實到管理，再好的技 術、設備也是徒勞的。一個有效的安全防範體系應該 是以安全策略為核心，以安全技術為支撐，以安全管 理為落實。安全管理不僅包括行政意義上的安全管理 ，更主要的是對安全技術和安全策略的管理。通過安 全制度的落實，獲得有效的網路安全保障。 安全培訓 • 安全培訓： 最終用戶的安全意識是資訊系統是否安全的決定因素 ，因此對校園網路用戶的安全培訓是整個安全體系中 重要、不可或缺的一部分。 安全服務 • 安全服務： 這是學校網路管理的一個重要的方面，透過網路安 全服務商，定期對教育網、各區網路中心及其直屬 學校的網路管理人員、安全管理制度、網路設備進 行安全巡查、技術諮詢和技術檢測，對發現的問題 及時解決。 • 安全服務內容包括以下幾個方面： – – – 系統級安全服務 應用級安全服務 客戶級應用安全服務 安全政策的制訂 • 安全策略的制定 校園網通過教育城域網、電信VPN、有線電視網等多種形 式與國際網相聯。在安全結構上可以分為三級；市級教育 網網路中心、區級教育網路、學校校園網，安全結構覆蓋 了中小學。使用的作業系統包括Windows server 2000、 Linux、Windows XP等；使用的應用軟體主要包括SQL Server、IIS等。 • 安全體系與安全目標 各級網路在出口加裝防火牆、防病毒，保證所有的機器都 受到保護，能夠抵禦一般水準的駭客和病毒攻擊；實現完 善的安全審計和採證機制，保證受到入侵和不良資訊損害 後有記錄可供查詢。鑒於大多數安全事件來自于管理員的 安全管理政策制訂不周。因此，在明確事故責任上可建立 安全預警系統，抵禦較高水準的駭客攻擊。同時，明確擬 訂資料中心內伺服器的安全優先順序等。 Education Network Security Solution _ Fortinet 20050523 Internet TANET Backbone 1 校務行政 Services FG3000 adds Antivirus & IDS/IDP protection at Internet as transparent mode behind existing firewall 3 3 2 2 DMZ FG800, provides Antivirus, IDS/IDP and Firewall protection, and traffic shaping functionality for dorms TS 1 Dorms FG500A adds Antivirus, IDS/IDP protection for Application services Labs 5 College building 5 Core Network 4 Data Center FG400A add Antivirus, IDS/IDP as transparent mode behind existing Firewall 4 連線學校網路安全 6 FG60 X132台 防毒. 防入侵攻擊 Firewall,p2p, skype FG3000 provides in-line firewall, Antivirus, IDS/IDP , Firewall functionality to data center 安全技術的應用及安全工具的部署 • 在區域網的入口架設防火牆，並實現VPN的功能，在 網路入口處建立第一層的安全屏障，VPN保證了管理 員在家裏或出差時能夠安全接入資料中心。利用防火 牆的網段隔離功能，設置DMZ區。使用入侵監測系統 對資料中心內的所有資料流程動進行即時檢測。使用 認證伺服器對資料存取進行統一的認證。在資料中心 建立病毒控管中心，達到網路防病毒功能，為資料中 心和校園網路接入終端提供防毒服務。根據功能將伺 服器劃分成伺服器群，使用多級防火牆實施進一步的 保護：二級防火牆保護資料庫系統和應用伺服器群。 使用安全日誌及評估伺服器保護關鍵日誌，方便管理 員管理，並作為採證的依據。通過統一的漏洞補強伺 服器，完成網內系統軟體的升級和漏洞自動補強。 安全管理制度的形成與發展 • 安全管理貫穿安全防範體系的始終。僅有安全技術防 範，而無嚴格的安全管理體系相配套，是難以保障網 路系統安全的。必須制訂一系列安全管理制度，對安 全技術和安全設施進行管理。實現安全管理必須遵循 可操作、全局性、動態性、管理與技術的結合、責權 分明、分權制約及安全管理制度化等原則。 • 透過安全管理制度，使各級管理人員在網路安全的重 要性方面，有了統一的認識，對網路安全的責任更加 明確。建立了以網路、系統管理員為中心的日常安全 管理流程，並根據日常的安全管理工作情況去優化網 路安全體系，從而保證了整個網路安全體系的動態性 和有效性。 安全培訓與用戶服務 • 最終用戶的安全意識和技術能力是校園資訊系統是否 安全的決定因素。因此對校園網網路管理員和最終用 戶的安全培訓是整個安全體系中重要、不可或缺的一 部分，特別是在目前病毒氾濫的大環境下，通過定期 培訓、及時發放病毒警告通知、敦促大家務必做到漏 洞補強等方法，增強安全意識，進而提高整個網路的 安全性。 校園網路安全最終目的 • 應該說明的是，校園網路安全需要在教育城域網、區 級網、校園網三級系統上，建立統一的安全管理技術 方案，制定有效的安全策略，形成統一的安全服務體 系，是我們最終的目標。 無時差攻擊時代來臨--Worm_ZOTOB (Zero Day Attack) Network Security Market EcoSystem Industry Moving Towards Appliances With Greater Functionality Unified Threat Management Appliances CAGR: 80.1% 100% $1.9 $0.1 SCM Appliance CAGR: 54.1% PROJECTED GROWTH 2003 – 2008E 60% SCM Services CAGR: 50.3% $0.1 $0.1 Messaging Security 40% Corporate Firewall Desktop User Provisioning Web $0.3 Filtering 20% $2.7 $1.5 HIGH 0% Legacy Auth. $0.7 Enterprise VPN/Firewall Software $0.8 $0.5 Advanced Auth. $0.3 PKI $0.4 Security Mgmt Vulnerability Mgmt $0.1 Host SSO Firewall Hardware $0.5 $0.1 Directory Services (20%) Hardware Auth. Tokens Web SSO $0.3 Host ID&P $0.2 $0.4 Antivirus $0.3 $0.4 $0.1 Network ID&P $0.2 Appliance Network ID&P Software $0.1 Consumer Firewall Desktop $0.2 INDUSTRY CONCENTRATION Note: Industry concentration values denote sectors where the top 3 vendors combined hold between 15% market share (low concentration) to 85% market share (high concentration). Security management market includes security information event management, patching and remediation, forensics, policy and compliance, security systems and configuration management. Source: IDC and BAS estimates. LOW ZotoB 病毒成因及分析 • ZotoB病毒利用了8月9日微軟發布的即插即用(PNP)中 的漏洞（MS05-039）,在微軟發布安全公告後短短的4 天之内即出現.一週內就幾乎出現了近十種有不同感染 途徑的變種 • 2004/8/13 ZotoB.A -- 攻擊MS PNP漏洞 • 2004/8/15 ZotoB.C -- Email • 2004/8/16 ZotoB.D – Netbios/SMB, Email, MSN … ZotoB 病毒成因及分析 • 修改系统的host文件，添加如下内容： Botzor2005 Made By .... Greetz to good friend Coder. Based On HellBot3 MSG to avs: the first av who detect this worm will be the first killed in the next 24hours!!! 127.0.0.1 www.symantec.com 127.0.0.1 securityresponse.symantec.com 127.0.0.1 symantec.com 127.0.0.1 www.sophos.com 127.0.0.1 sophos.com 近年來重大攻擊事件 保護你的電腦關鍵三步驟 --- UTM Gateway : A New Generation of Security Platforms Hacker X Email Spam Viruses worms X X FortiGate Internet X www.find_a_new_job.com www.free_music.com www.pornography.com Real-Time Content Security at the Network Edge Banned content Intrusions Complete Content Inspection - Why firewall is not enough DATA PACKETS STATEFUL INSPECTION FIREWALL http://www.freesurf.com/downloads/Gettysburg Four score and BAD CONTENT our forefathers brou ght forth upon this continent a new nation, Inspects packet headers only – i.e. looks at the envelope, but not at what’s contained inside n liberty, and dedicated to the proposition that all OK OK OK OK Not Scanned Packet “headers” (TO, FROM, TYPE OF DATA, etc.) CONFIDENTIAL Packet “payload” (data) Deep Packet Inspection DEEP PACKET INSPECTION Performs a packet-by-packet inspection of contents But can easily miss complex attacks that span multiple packets Undetected http://www.freesurf.com/downloads/Gettysburg OK Four score and BAD CONTENT our forefathers brou ! ght forth upon this continent a new nation, OK n liberty, and dedicated to the proposition that all • Fragmentation can hide malicious content • True security relies on multiple security layers OK Complete Content Inspection COMPLETE CONTENT PROTECTION 1. Reassemble packets into content http://www.freesurf.com/downloads/Gettysburg Four score and BAD CONTENT our forefathers brou ght forth upon this continent a new nation, n liberty, and dedicated to the proposition that all DISALLOWED CONTENT Four score and seven years ago our BAD CONTENT forefathers brought forth upon this BAD CONTENT NASTY THINGS NASTIER THINGS CONTENT !! BAD a new liberty, and dedicated to the proposition that all… !! ATTACK SIGNATURES 2. Compare against disallowed content and attack lists 內容安全保護的疑慮 • 需要完整的內容重組 – 在主機/個人電腦端重組 – 需要即時的更新/防護軟體,可否即時獲得保護 • 防毒/個人防火牆的特徵值(signatures) – 使用該台電腦的資源 • 消耗網路資源 – 即使即時阻絕感染,但是仍耗費了網路資源 Complete Content Protection Requires Enormous Processing Power A Multi-Layered Security Solution is Required Email Spam 1000 10 PROCESSING POWER REQUIRED 100 Complete Content Protection Inappropriate Web Content Worms Trojans Viruses Sophisticated ntrusions Deep Packet Inspection Denial of Service Attacks Simple Intrusions Stateful inspection 1 1990 1995 2000 2005 Multi-Layered Security Requirement - A collection of best in class security applications • Firewall • Antispam – Defend against intrusions • Antivirus – Protect email from virus infection • IPS – Protect against malicious attacks – Reduce unwanted email • Web filters – Eliminated unproductive webbrowsing • VPN – Delivering secure remote access VPN URL Filters Antivirus Firewall Servers IPS Antispam Users Multi-Layered Security – Advantages and Disadvantages • Advantage • Competitor Disadvantages – Provides comprehensive security approach – Minimizes down-time from individual threats – Requires multiple products – Increases network complexity and operational cost – Does not defend against “blended threats” VPN URL Filters Antivirus Firewall Servers IPS Antispam Users Multi-Layered Security - The Fortinet approach • Advantage • Competitor’s Disadvantage – Provides comprehensive security approach – Minimizes down-time from individual threats – Requires multiple products – Increases network complexity and operational cost – Does not defend against “blended threats” VPN URL Filters Antivirus Firewall Servers IPS / IDS Antispam Users FortiGate Antivirus Firewalls - A new generation of security solutions • Advantage – Provides comprehensive security approach – Minimizes down-time from individual threats • FortiGate Unified Threat Management Solutions – – – – – – Firewall (ICSA Certified) Antivirus (ICSA Certified) IPS (ICSA & NSS Certified) URL filtering Antispam VPN (ICSA Certified) Servers “Fortinet, with the only ASIC based Antivirus accelerated UTM appliances, led the UTM market with a 29.5% share of the worldwide market.” -- IDC, 2004 Users Fortinet Developed Products for Complete Real Time Network Protection Best-in-Class Applications Included in Every FortiGate FortiOS Operating System 多層次網路安全防護介紹 多層次防護 (IDS/IPS) • • • IDS/IPS Antivirus Features Web (URL) Filtering VPN ZotoB 病毒成因及分析 WHY IDS ? ZotoB病毒利用了8月9日微軟發布的即插即用(PNP)中的漏洞 （MS05-039）,在微軟發布安全公告後短短的4天之内即出現.一週內 就幾乎出現了近十種有不同感染途徑的變種 What does IDS work ? 2004/8/13 ZotoB.A -- 攻擊MS PNP漏洞 2004/8/15 ZotoB.C -- Email Performs specific packets inspection and behavior analysis 2004/8/16 ZotoB.D – Netbios/SMB, Email, MSN … 1. Signature IDS 10 http://www.freesurf.com/downloads/Gettysburg OK Four score and BAD CONTENT our forefathers brou ! 2.Behavior OK ght forth upon this continent a new nation, n liberty, and dedicated to the proposition that all Intrusion detection highlights • ICSA certified & NSS proven • High speed performance – ASIC-based IDP – Real-time detection • Signature database of 1,700 known hacker attacks • Timely and automated updates of attack signatures – Through the FortiProtect Distribution Network • Customizable e-mail alerts – Alerts can be filtered to avoid generation numerous, redundant alerts from a single attack • Very easy to configure and easy to maintain • Dramatically lower cost than stand-alone NIDP 多層次防護 (AntiVirus) • • • IDS/IPS Antivirus Features Web (URL) Filtering VPN Protocol-based Antivirus Benefits • According to protocol – to adapt different kinds of file format or Characteristic of different application. i.e. like compression file type , ZIP, RAR…. outlook, outlook express or Unix Mailbox • IM/P2P Scanning – Including MSN, Yahoo Msg, AOL …. Antivirus highlights • Only ICSA-certified hardware-based AV gateway • Scanning method – Signature based – Macro scanning • Scanning efficiency – Contextual scanning – compare data with the appropriate method and the appropriate portion of the database according to the nature of the data • High performance – Only solution ASIC-accelerated for real-time scanning – Scans real-time (Web) traffic without noticeable delay – No other gateway AV product can match performance – 5x to 10x more performance than conventional software solutions Antivirus highlights • Supported protocols: – Email traffic: SMTP, POP3, IMAP – Web traffic: HTTP (content, downloads, and web mail) – FTP traffic – Support non standard ports (SMTP, POP3, IMAP, HTTP) – IM/P2P • Transparent to end users – No special configuration on the client side (requires no proxy setup) – Quarantine service of infected files • Customized replacement messages (mail, FTP, Web) ZotoB 病毒成因及分析 ZotoB病毒利用了8月9日微軟發布的即插即用(PNP)中的漏洞 （MS05-039）,在微軟發布安全公告後短短的4天之内即出現.一週內 就幾乎出現了近十種有不同感染途徑的變種 2004/8/13 ZotoB.A -- 攻擊MS PNP漏洞 2004/8/15 ZotoB.C -- Email 2004/8/16 ZotoB.D – Netbios/SMB, Email, MSN … 10 多層次防護 (Content Filter) • • • IDS/IPS Antivirus Features Web(URL) Filtering VPN The Fortinet Solution: FortiGate Antivirus Firewalls + FortiGuard Service • No additional hardware required • No need to download large database to FortiGate units • URL ratings are always up to date • Local FortiGate caching of ratings greatly improves performance • FortiGate solution also scans HTML content for keywords/phrases • Lower cost • Multi-language recognition • Reduction in false positives – Policy-based IPS applies scanning only where needed FortiGuard Web Filtering Solution Internet URL requests from users are checked against internal cache in FortiGate unit – if not yet rated, FortiGate unit sends rating request to FortiGuard hosting site FortiGate unit allows or denies page based on requestor’s Content Profile FortiGuard URL Database FortiGuard Hosting Sites (data mining) (Worldwide) Web Filtering Policy Actions Category Groups Individual Categories FortiNet 多層次防護 (VPN) • • • IDS/IPS Antivirus Features Web (URL) Filtering VPN Firewall/VPN Benefits • Reliable Network Protection – The best first layer of defense against the worst network condition • Fast response to threats – Integrated management of AV, FW, NIDS and NIPS • Investment protection – Sits transparently behind another vendor’s firewall • VPN Support – – – – IPSEC VPN : Site to Site VPN , Site to Client VPN SSL VPN (3.0) PPTP/ L2TP User Authentication : Local, RADIUS, LDAP(AD included) 為何需要 SSL VPN? • 降低網管人員負擔 – 無需安裝客戶端軟體 • 降低網管人員遠端軟體故障排除工作 – SSL 可輕易的穿過大多數防火牆 • 降低產品間的整和性困難 • 安全性的加強 – 策略性的控管 – 進而針對應用程式，甚至控管各別的URL。 SSL VPN 優點 • 有完整內容過濾的存取 – 深層檢測SSL VPN用戶流量 – 檢測SSL VPN用戶流量無惡意的內容 – 具下列多種保護: • 防毒, 入侵防禦, 防火牆, 內容檢測, 垃圾郵件過濾 多重防禦引擎偵 測及 阻絕 惡意 內容 使用者建立SSL VPN連線 Corporate LAN VPN 流量解密 SSL VPN 和檢測 SSL VPN Users FortiGate System 個人防毒防駭管理 保護你的電腦關鍵三步驟 --- FortiClient V.20 產品特寫 業界最先進的桌面(Client端)安全防護解決方案. 整合 : VPN, 防毒, 防駭, 個人防火牆, Web內容過濾防護 之完整安全防護產品. (Anti-Spam 功能 coming soon) 移植大型安全閘道器之掃瞄偵測引擎技術 - 掃瞄效率超高 - 偵測能力超強 - 防護功能完整 直覺式介面, 設定及操作容易 而不減損功能之完整性 FortiClient Overview << 四大功能 >> 1 VPN 虛擬私人通道 2 AntiVirus 防毒, 防駭 3 Firewall 個人防火牆 4 WebFilter 網頁內容過濾 General 主畫面 Update 病毒碼更新設定 Log 安全防護記錄 AntiVirus Features AntiVirus Features • Passes VB100 Certification – Product ready AntiVirus feature • Completed AV + Grayware detection • Code emulator – Provides polymorphic virus detection – Used to extract virus body from “morphed” code – Also used as generic extraction engine • Repair engine – Provides virus cleaning capabilities AntiVirus Features • Optimized AV engine – Scan files – Scan Grayware - Spyware (間諜軟體) - Adware (廣告軟體) - Dialer (偷撥軟體) - Key Logger (鍵盤記錄) Firewall Features Firewall Features • Intrusion detection – Block common network attacks without signatures – Improves performance • Fully Qualified Domain Name (FQDN) support for: – Blocked addresses – Address groups – Service groups View Connections Like as netstate -a Firewall Features • Intrusion detection – Block common network attacks without signatures – User configuration options for detected intrusions • Trust • Block • Don’t trust Configurable Firewall Rules • User can define personal firewall rules • Source and Destination – Existing zones – IP addresses / groups • Protocols • Times Web Filtering / Popup Blocker Web Filtering ( 閘道型設備等級之 URL內容過濾功能) • Web Filter 內容分級過濾 Password Control >>同時滿足企業與家用之需求<< Web Filter Block Sample Log Features LOG Feature • Provide - AV - Firewall - VPN -WebFilter - Schedule - Update all information • Export as Log file Instant Messaging (IM) and Peer 2 Peer (P2P) IM and P2P Support • Statistics – Record cumulative statistics for all IM & P2P traffic – Extended statistics & reporting will be done by the FortiLog. • Logging – Log IM & P2P communications • Control – Explicitly allow or deny IM and P2P communications (including partial blocking of various parts of the application, such as file blocking). – Ability to view & block current IM users or block new user connections for a particular IM application IM/P2P Traffic Control • IM/P2P – Blocking & Rate Limiting – IM/P2P policies provide blocking and rate limiting controls IM/P2P Replacement Messages • Provides message response to IM/P2P access IM/P2P Logging • Logging of IM/P2P usage • IM fields include: – – – – – – – Date Time IM (MSN, Yahoo!, AIM, ICQ, etc) Sender (username) Receiver (username) Message (truncated) Attachment (indicates file sent) IM/P2P User Control • User details are available – Administrator can view active users per protocol – Controls can be created from active users • White list / black list concept Why UTM? • Proven Experience & Leading in the Security Gateway Market - 80,000 units deployed - No.1, 29.5% market share in UTM, IDC 2004 report - 台中縣網167台, 清華大學, 淡江大學, 靜宜大學, 成功大學, 台北縣網, 宜蘭大學, 佛光大學 ,40餘所大專院校 • Best Performance in IDP / Antivirus Security Gateway - 10x performance in Antivirus - 50% reduce cost • Certified - 5x ICSA certified – Antivirus, NIDS, Firewall, IPSecVPN,SSLVPN - NSS, EAL4+, FISP certified • 2004年 資策會 票選 第 1 名 Security Gateway & MIS Manager Best Choice • 2005年 NBL 交大網路測試中心 第 1 名- 防毒網安設備 測試評比 台灣多層次防火牆領導品牌 ‘第一名’ 根據IDC 2004 最新報 導，FORTINET在 UTM 市場以 29.5% 取得 第一名市場佔有率 1 Many Awards and Industry Certifications FORTINET 資訊網路安全解決方案 FortiProtect 提供7x24 即時安全防護與應變中心 FortiMail提供垃圾郵件管理 FortLog提供完整的安全紀 錄與詳盡的統計分析報表 FortiManager提供集 中控管與設定服務 FortiGate ASIC Base 全系列網安閘道器 FG50A/60/100A/200A /300A/400A/500A/800 /3000/3600/ 4000/5000 滿足顧客 網安需求與高速效能 FortiClient提供desktop Person firewall & 防毒 防駭 與 VPN 服務 Global Infrastructure Ensures Rapid Response to New Threats More than 10 Fortinet Threat Response Teams and FortiGuard Distribution Servers - Automatic AV & IDP Updates Can Reach All FortiGate Units Worldwide in Under 5 Minutes - Real Time Protection for Antispam & Web Content Filtering Services FortiGuard Center Web Portal & Email Bulletins The New Generation of Security Solutions Fortinet Differentiators - Products, Technology, Service & Support And Lowest Total Cost of Ownership Thank You!