November 2019
Beginner to intermediate
406 pages
9h 21m
Chinese
Content preview from Java持续交付
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
安全、漏洞和威胁
｜
315
有技术能力自己修复依赖项的漏洞。这时你需要做出一个艰难的决定，是否选择什么都
不做，虽然这样做很容易，但是也很危险。
你需要对系统的安全性、已知漏洞和攻击途径进行全面的分析和审计。你必须在组织内
通报风险，并且将已知的漏洞记录下来。你还可以采取一些措施来降低风险，对于可以
获取系统访问权限的已知漏洞，你可以提高访问实例的安全性。如果没有已知的漏洞，
或者攻击途径非常有限，你可以选择不做任何操作。但是要注意的是，这不只是一项技
术决策，也需要业务部门考虑风险。
降低风险影响是一个业务决定 ：成为一名专家
我们再次强调忽视安全或漏洞问题的风险。如果你确定发现了一个问题，必须
通知相关的业务团队并与其密切合作，因为如何降低风险不仅是一个技术问题，
还与业务息息相关。直接忽略问题（或者第一时间不检查它们），最好的结果
可能会被认为不专业，但是最坏的结果可能就是过失犯罪。
与部署平台相关的安全问题
你在本书中接触到的部署平台，大概三分之一都提供了与安全相关的配置和实践，因此
了解这方面的内容是有必要的。
手动和自动的渗透测试
即使你的网站没有法规和合规方面的要求，定期聘请专业的渗透测试人员检查系
统，也会带来很多好处。与进行探索性测试的人员相似，许多渗透测试专家的思
维方式与工程师不同，因此他们能够在漏洞被利用之前发现潜在的安全问题。
除了手动进行渗透测试以外，我们还建议进行自动化扫描。这方面领先的开源工
具是
OWASP Zed Attack Proxy
（
http://bit.ly/1NIcfdT ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.