November 2020
Beginner to intermediate
214 pages
5h 10m
Chinese
Content preview from 数据库可靠性工程：数据库系统设计与运维指南
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
126
｜
第
9
章
可重现性
（
reproducibility
）
重复攻击的难度有多大？
• 0
：即使是应用程序的管理员也很难重现或不可能重现。
• 5
：需要一到两个步骤，也许需要成为授权用户。
• 10
：只要有浏览器和地址栏就够了，不需要任何验证。
可利用性
（
exploitability
）
利用该威胁的必要条件有哪些？
• 0
：高级编程和网络知识，定制或先进的攻击工具。
• 5
：
网络上已有的恶意软件，或者通过攻击工具可以轻松利用漏洞。
• 10
：仅需一个
Web
浏览器。
影响的用户
（
affected users
）
影响了多少用户？
• 0
：一个都没有。
• 5
：有一些，但非全部。
• 10
：所有用户。
可发现性
（
discoverability
）
发现这个漏洞的难度有多大？
• 0
：几乎不可能，需要源代码或者管理员权限。
• 5
：可以通过猜测或通过监控网络轨迹发现。
• 9
：这类漏洞的细节已在网上公开，通过搜索引擎很容易搜到。
• 10
：相关信息在浏览器地址栏或者表单中可见。
当逐个考虑每个潜在的攻击媒介时，通过这种分类，可以决定将精力和资源集中在哪里。
9.3.3
基本预防措施
下面讨论各种可行的预防措施，并提供各种数据存储中的示例，其中包括之后将讲解的通
用缓解技术，其中一些技术适用于多个类别。
配置
从数据库中删除所有不必要的功能和配置。许多数据库系统功能丰富，而大多数应用程
序只能用到其中一小部分功能，关闭不必要的功能可以减少攻击媒介。
打补丁
持续扫描数据库的漏洞并打补丁。保持最新状态将降低漏洞被利用的风险。 ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.