April 2023
Beginner to intermediate
396 pages
8h 23m
Korean
Content preview from 자바 개발자를 위한 데브옵스 툴
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
239
7
장
바이너리 보안
SLDC
초반에 취약점 발견
• 기능 개발이 완료되는 즉시 취약점을 검색할 수 있다.
SLDC
이후에 취약점 발견
• 개발 주기가 끝난 뒤 취약점을 발견할 수 있다.
취약점 조치 비용 감소
• 개발 주기 초반에 취약점이 발견되므로 쉽고 빠르게
조치할 수 있다.
•
QA
단계에 진입하기 전에 취약점을 조치할 수 있는
경우가 많다.
취약점 조치 비용 증가
• 개발 주기를 마치고 취약점이 발견되므로 개선 조치
는 다음 개발 주기에 배정되는 경우가 많다.
• 치명적인 취약점은 긴급 릴리스로 조치해야 한다.
런타임 및 환경 문제 발견 불가
• 정적 코드를 스캔하므로 런타임 취약점을 발견할 수
없다.
런타임 및 환경 문제 발견 가능
• 실행 중인 애플리케이션을 동적으로 분석하므로 런타
임 취약점을 발견할 수 있다.
모든 종류의 소프트웨어 대상
• 웹 애플리케이션, 웹 서비스,
thick
클라이언트 등에
모두 활용된다.
웹 애플리케이션 또는 웹 서비스 대상
• 그 외 소프트웨어 유형에서 활용도가 낮다.
두 테스트 기법의 장단점을 비교하면 양쪽이 서로 배타적이지 않다는 것을 알 수 있다. 오히려
두 기법은 서로를 완벽하게 보완한다.
SAST
는 알려진 취약점을 식별하고
DAST
는 아직 알려
지지 않은 취약점을 식별한다. 일반적인 취약점 패턴을 기반으로 새로운 ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.