January 2021
Intermediate to advanced
547 pages
12h 4m
Chinese
Content preview from 网络安全评估（第三版）
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
42
｜
第
3
章
使用上述分类学来定义可能导致应用程序产生不可预期行为的错误根源。注
意：上述分类方法没有定义攻击类别（如侧信道攻击）。
威胁建模
攻击者着力于定位和渗透系统组件与功能中存在的安全弱点。上面提供的分
类学可以对软件包中的低层错误进行描述和归类，但对整体环境中存在的一
些更大的安全问题没有涉及（如数据传输中的完整性，或加密密钥处理方式
等）。要理解系统中存在的一些实际风险，可以通过如下要素进行威胁建模：
•
个别的系统组件。
•
攻击者目标。
•
暴露的系统组件（可用的攻击面）。
•
每种攻击方法的经济成本与可行性。
系统组件
可渗透的漏洞存在于信息基础设施（如
hypervisors
、软件交换、存储节点和
负载均衡设备等）、操作系统、服务器软件、客户端应用程序，以及终端用
户自身等多个环节。图
3-3
展示了典型环境中硬件、软件和
Wetware
之间的
相互关系。
攻击者目标
攻击者的目标可能包括如下几方面：
暴露或修改数据
在计算机系统中，数据以多种形式存在，从服务器端数据库到传输中的数
据，以及客户端软件处理的信息等。攻击者通常会谋求暴露机密数据，或
对其进行修改以获利（如获取可用于提升权限的认证令牌，或对内存中相
关标记进行修改以禁用某些安全功能等）。
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.