February 2021
Beginner to intermediate
372 pages
6h 48m
Korean
Content preview from 웹 애플리케이션 보안: 정찰, 공격, 방어 세 단계로 배우는 웹 애플리케이션 보안의 모든 것
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
296
3
부
방어
임시 점수는 같은 채점 범위(
0
~
10
)를 따르되 취약점 자체를 측정하는 대신 완화의 적절성과
취약점 보고서의 신뢰성을 측정한다.
21.3.3
CVSS
: 환경 점수
CVSS
환경 점수는 해커가 익스플로잇했을 때 가장 위험한 데이터나 작업이 무엇인지 이해하
기 위해 특정 환경 (조직의 애플리케이션 )을 자세히 평가한다 (그림
21
-
4
).
그림
21-4
CVSS
환경 점수는 익스플로잇되는 맥락(환경)을 근거로 취약점을 측정한다.
환경 채점 알고리즘은 기본 점수 입력을 모두 취하되 애플리케이션의 기밀성, 무결성, 가용성
의 중요성을 상세히 나타내는 세 가지 요구사항을 더해 채점한다.
그 세 가지 필드는 다음과 같다.
기밀성 요구사항
애플리케이션이 요구하는 기밀성 수준이다. 자유롭게 사용할 수 있게 공개된 애플리케이션
은 점수가 낮을 것이고 엄격한 구조적 요구사항이 있는 애플리케이션(헬스 케어, 정부 등 )
은 점수가 높을 것이다.
무결성 요구사항
해커에 의해 애플리케이션 상태가 변경되는 것이 조직에 끼치는 영향도를 나타낸다. 테스트
샌드박스를 생성하고 곧 폐기하는 애플리케이션은 기업의 중요한 세무 기록을 저장하는 애
플리케이션에 비해 점수가 낮다.
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.