Soft test-system architect knowledge points extraction-system architect tutorial (2nd edition)
Information Security Fundamentals
1. Five elements of information security: confidentiality, integrity, availability, controllability, and reviewability
2. The scope of information security includes: equipment security, data security, content security, behavioral security
- Equipment security: It is the primary issue of information system security and the material basis of information system security, including three aspects: equipment stability, equipment reliability, and equipment availability
- Data security: Take measures to ensure that data is protected from unauthorized disclosure, tampering and destruction, including three aspects: data confidentiality, data integrity, and data availability
- Content security: It is the political, legal, and moral requirements of information security, including: the information content is politically healthy, conforms to the laws and regulations of the country, and conforms to the good moral norms of the Chinese nation
- Behavior security: refers to the final provision to users through behavior to ensure the behavior security of the information system, so as to finally ensure the information security of the system. The characteristics are: confidentiality of behavior, integrity of behavior, and controllability of behavior
3. Information storage security: security of information use (such as user identification and verification, user access restriction, security issue tracking, etc.), system security monitoring, computer virus prevention, data encryption and prevention of illegal attacks, etc. 1.
Information safe to use
- User identification and verification: identification based on human physical characteristics (signature recognition method, fingerprint, voice), identification of special security items owned by users (smart IC card, magnetic stripe card)
- User access restriction: isolation control method, restriction method
2. System security monitoring
3. Computer virus prevention and control
4. Network security
1. Network security vulnerabilities (physical security, software security vulnerabilities, incompatible use of security vulnerabilities, choosing an appropriate security philosophy) 2.
Network security threats (unauthorized access, information leakage or loss, damage to data integrity, Denial of service attack)
3. Objectives of security measures (access control, authentication, integrity, auditing, confidentiality)
Composition Framework of Information Security System
The framework is usually jointly constructed by the technical system, organizational structure, and management system
1. The technical system involves: basic security equipment, computer network security, operating system security, database security, terminal equipment security, etc. 2. Organizational structure system
: composed of institutions, positions and personnel The three modules of the organization constitute a system
3. Management system: it is the soul of information system security, consisting of legal management, system management and training management
Information encryption and decryption technology
Symmetric key encryption algorithm: encryption key and decryption key are the same, DES, IDEA, AES
asymmetric key encryption algorithm: encryption key and decryption key are different, RSA
public key encryption, private key decryption, can be realized Confidential communication; private key encryption, public key decryption can realize digital signature
key management technology
Key Management for Public Key Cryptography: Public Release, Public Directory, Public Key Certificate
Access Control and Digital Signature Technology
The basic model of access control: subject, object, and control strategy
The implementation technology of access control: access control matrix, access control table, capability table, authorization relationship table
Digital signature:
A sends a signed message P to B:
1. B can verify that the message P is indeed from A.
2. A cannot deny sending P in the future
. 3. B cannot fabricate or change the message P
Anti-Attack Technology of Information Security
1. Factors to be considered in key generation: increasing the key space, selecting a strong key, and the randomness of the key
2. Denial of service attack and defense
1. Classification of traditional denial of service attack:
consume resources, destroy or change configuration information, physically destroy or change network components, and use processing errors in service programs to disable services
2. Distributed denial of service attack DDoS
phenomenon after being attacked by DDoS:
- The attacked host has a large number of waiting TCP connections
- A large number of arriving data packets are not part of the website service connection, and often point to arbitrary ports on the machine
- The network is flooded with a large number of useless data packets, and the source address is false
- Create high-flow useless data to cause network congestion, making the victim host unable to communicate with the outside world normally
- Using the service provided by the victim host and the flaws in the transmission protocol, repeatedly send service requests, so that the victim host cannot process all normal requests in time
- In severe cases, it will cause a crash
3. Defense methods against denial of service attacks
- Strengthen the feature recognition of data packets
- Set up firewall to monitor localhost port usage
- Statistics on the amount of communication data can also obtain information about the location and number of attacking systems
- Correct the discovered problems and system vulnerabilities as much as possible
4. Spoofing attack and defense
- ARP spoofing (cure ARP table, use ARP server, two-way binding, ARP protection software)
- DNS spoofing (passive listening detection, false packet detection, cross-check query)
- IP spoofing (delete de/etc/hosts.equiv, $HOME/.rhosts in UNIX, modify /etc/inetd.conf so that the RPC mechanism cannot be applied, set the firewall to filter messages from outside and the source address is internal IP)
5. Port scanning
3. System vulnerability scanning
1. Network-based vulnerability scanning
2. Host-based vulnerability scanning (advantages: large number of scanned vulnerabilities, centralized management, and small network traffic load)
Guarantee System and Evaluation Method of Information Security
1. Computer information system security protection level
1, user independent protection level
2, system audit protection level
3, security mark protection level
4, structured protection level
5, access verification protection level
2. Safety risk management
Before the implementation of risk assessment, the contents should be considered:
1. Determine the scope of risk assessment
2. Determine the objectives of risk assessment
3. Establish an appropriate organizational structure
4. Establish a systematic risk assessment method
5. Obtain top management approval of the risk assessment plan by the
The risk calculation process is as follows:
1. Identify information assets and assign values
to assets 2. Analyze threats and assign values to the possibility of threats
3. Identify the vulnerability of information assets and assign values to the severity of weaknesses
4. Calculate the possibility of security incidents based on threats and vulnerabilities
5. Calculate the risk value of information assets in combination with the importance of information assets and the possibility of security incidents
Other articles recommended by the author, welcome to learn:
Based on Spring Boot 3.1.0 series of articles
- Spring Boot source code reading initialization environment construction
- Detailed explanation of the overall startup process of the Spring Boot framework
- Detailed Explanation of Spring Boot System Initializer
- Detailed explanation of Spring Boot listener
- Detailed explanation of Spring Boot banner
- Spring Boot property configuration analysis
- Analysis of Spring Boot property loading principle
- Analysis of Spring Boot exception reporter
- Build Spring Boot 3.0 native executables with GraalVM
- Spring Boot 3.x microservice upgrade experience
Prometheus series of articles
- Introduction and installation of Prometheus
- Intuitive experience of PromQL and its data types
- PromQL selectors and operators
- Functions of PromQL
- Prometheus alarm mechanism introduction and command interpretation
- Prometheus alarm module configuration depth analysis
- Prometheus configuration authentication
- Prometheus dynamically pulls monitoring services
- Prometheus monitors cloud Mysql and self-built Mysql
Grafana series of articles, version: OOS v9.3.1
- Introduction and installation of Grafana
- Introduction to configuration parameters of Grafana monitoring large screen (1)
- Introduction to configuration parameters of Grafana monitoring large screen (2)
- Grafana monitors large-screen visualization charts
- Grafana query data and transform data
- Introduction to Grafana Alarm Module
- Grafana alarm access Feishu notification
Spring Boot Admin Series
- Spring Boot Admin Reference Guide
- The problem that the SpringBoot Admin service is offline and does not display health information
- Loading of Spring Boot Admin2 @EnableAdminServer
- Detailed Explanation of Spring Boot Admin2 AdminServerAutoConfiguration
- Detailed Explanation of Spring Boot Admin2 Instance Status Monitoring
- Spring Boot Admin2 custom JVM monitoring notification
- Spring Boot Admin2 custom exception monitoring
- Spring Boot Admin monitoring indicators connected to Grafana visualization