February 2021
Beginner to intermediate
252 pages
5h 36m
Korean
Content preview from 컨테이너 보안: 컨테이너화된 응용 프로그램의 보안을 위한 개념, 이론, 대응법과 모범 관행까지
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
14.1 주입
229
제
14
장
컨테이너와
OWASP
10
대 위험
보안 분야에서 일하는 독자라면
Open
Web
Application
Security
Project
, 줄여서
OWASP
(
https
://
owasp
.
org
)라는 프로젝트를 들어 보았을 것이다. 어쩌면
OWASP
지역 분
과의 일원인 독자도 있을 것이다.
OWASP
는 정기적으로
10
대 웹 응용 프로그램 보안 위험을
발표한다.
모든 응용 프로그램 (컨테이너화된 것이든 아니든 )이 웹 응용 프로그램은 아니지만, 그래도
OWASP
의
10
대 위험 목록은 어떤 종류의 공격을 가장 조심해야 할지 고찰할 때 좋은 자료이
다.
OWASP
웹사이트에는 그런 공격들의 자세한 설명과 그 방지책도 나와 있다. 이번 장에서
는 현재의
10
대 위험 (
https
://
owasp
.
org
/
www
-
project
-
top
-
ten
)을 소개하고
1
컨테이너 보안
에 특화된 완화책이나 고려 사항도 제시한다.
14.1
주입
응용 프로그램에 코드 주입 (
code
injection
) 취약점이 있으면 공격자는 데이터로 가장한
실행 코드를 응용 프로그램에 주입해서 실행할 수 있다. ‘꼬마 바비 테이블 (
Little
Bobby
Tables
)’이 등장하는
xkcd
의 불후의 명작(
https
://
xkcd
.
com
/
327
)보다 코드 주입의 효과를 더
1
OWASP ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.