I. Overview of Information Security
Information :
Information is used to eliminate random stuff uncertain. ---- Shannon
Information used to eliminate uncertainty.
Relations between the two information data : the information is valuable data, attribute data is recorded reaction objective things. After the data processing can become information, treatment information into digitized data.
Information Security :
Generally refers to the system information is protected, it can be continuous and reliable operation, business continuity. Information security threats to the fundamental purpose is to make information from internal, external, natural and other factors.
Information security basic attributes : CIA model
- Confidentiality (Confindentiality)
- Integrity (Integrity)
- Availability (Availability)
Extended attributes on the CIA model :
- Truth
- Repudiation
- Controllability
Information security features :
- Relativity
- Timeliness
- Correlation
- Complexity
- Uncertainty
Information security development stage
1. 通信安全阶段：防窃听和数据加密
2. 计算机系统安全段：密码学算法和信息安全模型
3. 网络安全阶段：防火墙，VPN
4. 网络保障阶段：综合技术，管理和工程等措施进行保障
Information Security
Information security model P2DR model policy, protection, detection, response. This is a complete, dynamic safety loop.
Information Systems Security
Information system: a processing data input and output, the data is stored, the system control system.
Information system security model
through the support elements to protect the security of information systems life cycle within the security features
Second, information security technology
Cryptography
Encryption and decryption (Confidentiality of CIA)
对称加密：又称单一密匙
由于加密密钥和解密是完全相同的，所以密钥在传输的途中泄露就会导致信息泄露，通常密钥不和密文在同一个网络通道内传送，而是，单独的一个确保安全的通道。
非对称加密
公钥和私钥是绝对不可相互推导的，公钥存在于密钥库中，私钥是由接收者自己保管的，所以，不用像对称加密一样需要一个单独的安全通道来进行密钥的传送。
混合加密
采用对称加密的壳，利用非对称加密对对称加密的密钥进行加密处理，相当于利用非对称加密创建了一个安全通道来传送对称加密的密匙。
哈希算法（解决CIA中的完整性）
Hash算法是一个不可逆的算法，几乎不可能从Hash值来得到原文件的内容
文件通过Hash单向散列得到一个Hash值，将Hash值和原文件一起进行加密后传送，接收者解密后得到原Hash值和文件，验证过程：将文件通过Hash加密得到一个新的Hash值，比较新Hash值和原Hash值是否一致来验证文件的完整性。
数字签名（解决CIA中的不可否认性）
加密过程和Hash算法分别解决了CIA中的机密性，不可否认性，但是，还无法保证信息是否是真实，是我们所期待的对象发的，而不是第三方发的虚假信息
数字签名工作原理
与Hash加密相比较，在得到Hash值的基础上用A的私钥进行加密（这一步就是 A对文件进行数字签名）
数字证书与公钥基础设施
数字证书
由可信第三方颁发（CA）的数字证书，用于证明用户身份的可信度(类似于公安局给公民颁发身份证，来证明其合法身份）
公钥基础设施
- 公钥管理平台PKI（Public Key Infrastructure） 为网络应用提供加密和数字签名等密码服务所需要的秘匙和证书管理体系。
- 权威认证机构CA（Certification Authority） 主要作用是 证书的办法和管理，建立证书黑名单，RA（用户注册系统）的设立，审查和管理
PKL，CA，RA三者的关系：PKL是基础，证书中心，CA的认证中心，对数字证书进行签名，RA是辅助CA工作，用于接收和审核用户的证书申请。
身份认证
用于鉴别用户身份：
三种基本认证方式
- 用户所知道的：密匙，口令
- 用户所拥有的：印章，U盾
- 用户所具有的：指纹，虹膜
更加安全的是：双因素进行认证：例如静态密码+短信验证
对于虚假网站，用户也可以对服务器进行身份验证
访问控制
访问控制基本概念
访问控制一般是由三者组成的：主体，客体，控制策略
- 主体：发起访问请求的实体
- 客体：被访问资源的实体
- 控制策略：主体对客体访问规则的集合
访问发生的两个步骤：
- 认证：判断主体是普通用户，管理员还是审计用户
- 授权 ：授予用户的访问权限
访问控制基本技术
- Discretionary Access Control (the DAC) : set by the resource owner (such as Administrator), who may have what permissions to access what resources
- Mandatory Access Control (the MAC) : a body is determined by whether the system can access a particular object, the subject if a certain object is not accessible, then the other body can not be accessed by the guest of the body, which is cut off an access path. The strength of strong Mandatory Access Control.
- Role-based access control (RBAC) : set role-based access rights.
security audit
Log : Event recording system of hardware, software and information systems issues, but also can occur in a monitoring system
audit : the log analysis, useful information.
Security Audit Category
- Passive audit: Record system activity, not processing the information
- Mandatory audit :: end a login session, rejected some of the host access (including web sites, FTP servers, email servers), the source location tracking illegal activities such acts.
Role security audit
- (For humans) threats and warn potential attackers and legitimate users of misuse of authorization
- Provide valuable (for the system) system log, it is conducive to the timely detection of system intrusions and potential loopholes
- (For repair purposes) after a failure, the failure is conducive to assess losses, reconstruction and repair of data
- (For the policy terms) in favor of the revised decision and the subsequent deployment
