软体品质与资讯安全

《软体品质与资讯安全》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、軟體品質與資訊安全交通大學資訊工程系黃世昆OutlineBackgroundSoftwareAttackBasicSoftwareProcessVulnerabilitySoftwareExploitabilityDynamicandStaticDefenseConclusionSoftwareEngineeringandWorms1968(conferenceonsoftwarecrisisafterICinvention,withmorecomplexsoftware)1988(Nov2)InternetWorm2001

2、(July19)CodeRedWorm(after1988)2003(Aug11)BlasterWorm(impactMS)2005WormsAnywhereandAnytimeMicrosoftSoftwareauto-updatesmorefrequentlySoftwareAttackBasicTheStrengthofCryptography“128-bitkeysmeanstrongsecurity,while40-bitkeysareweak”“triple-DESismuchstrongerthansingle

3、DES”“2,048RSAisbetterthan1,024bitRSA”“lockyourfrontdoorwithfourmetalpins,eachofwhichinoneof10positions”.Therewillbe10,000possiblekeys…almostimpossibletobreakinNO!!!StrengthofCryptographyBurglarswon’ttryeverypossiblekeysorpickthelock.Theysmashwindows,kickindoors,and

4、usechainsawtothehousewall.Mostofusdesign,analyzeandbreakcryptographicsystem.Fewtrytodoresearchonpublishedalgorithms,protocolsandactualproducts.FromBruceSchneierWedon’thavetotryeverypossiblekeyorevenfindflawsinthealgorithms.Weexploiterrorsindesign,errorsinimplementa

5、tion,anderrorsininstallation.Sometimesweinventanewtricktobreakasystem,butmostofthetimeweexploitthesameoldmistakesthatdesignersmakeoverandoveragain.SecurityAttackDynamicEventoccurduringtheexecutionofapieceofsoftware.Attackmadepossible:weaknessesmustexistinthesystems

6、equenceofweaknessexploitinginputsignalstothesystemisrequiredThreatthreat:anagentoutsideofasoftwaresystemtoexploitavulnerabilitythroughattacksVulnerabilitypotentialdefectorweaknessinaninformationsystemknowledgerequiredtoexploitthedefectStateSpaceVulnerabilitySystems

7、tate:currentconfigurationoftheentitiesinthesystemAuthorizedorunauthorizedstate:giveninitialstateusingasetofstatetransitionsdefinedbysecuritypolicyVulnerabilitystate:authorizedstatefromwhichanunauthorizedstatecanbereachedusingauthorizedstateCompromisedstate:theautho

8、rizedstateaboveAttack:beginsinvulnerabilitystateStateSpaceAttackVulnerabilityStateAuthorizedState(compromisedbytheattack)UnauthorizedStateAttack軟