IGCSE、A-Level 与 AP IGCSE, A-Level & AP 练习单预览

保护设备

AP 网络安全 · 第 4 主题

训练
本章视频课 打开视频页面
9:32

Securing Devices

It is Monday morning in a busy hospital. In under a minute, the screens in the ward, the pharmacy and the records office all change. Every file on them is…

英文讲解 · 内嵌中英文字幕

讲义 双页 词汇表 双页 词汇测验 1 双页 词汇测验 2 双页 词汇测验 3 双页 词汇测验 4 双页 词汇测验 5 双页 词汇测验 6 双页 词汇测验 7 双页 词汇测验 8 双页 词汇测验 9 双页
4.1

设备漏洞与攻击
大纲
Learning ObjectiveEssential Knowledge

4.1.A
Identify types of computing devices.

  • 4.1.A.1 Server computers are devices that provide one or more services to other computers (e.g., DNS, DHCP, FTP). Any computer can be a server, and in an enterprise environment servers typically have more processing power and storage than a personal computer.
  • 4.1.A.2 Personal computers are devices that are designed to be used by one person for work or recreational purposes (e.g., word processing, graphic design, web browsing, and media production or viewing). These include desktop, laptop, and notebook computers.
  • 4.1.A.3 Handheld computers (also called mobile computers or information appliances) are smaller than personal computers and run on battery power. These include tablets, smartphones, and wearable technology like smart watches.
  • 4.1.A.4 Embedded computers are devices that are part of a machine. Embedded devices have specific instruction sets for interfacing with the specialized components of the machine they’re embedded in. Embedded computers tend to be slower and cheaper than other computers and have minimal storage.
  • 4.1.A.5 Everyday devices with embedded computers are often called Internet of Things (IoT) devices. Embedded computers are found in transportation (e.g., cars, trains, and airplanes), devices that operate critical infrastructure (e.g., operating circuit breakers at electrical substations and pumps at water treatment plants), medical equipment (e.g., IV pumps, MRI scanners, pacemakers, and insulin pumps), and everyday devices like washing machines, coffee makers, and thermostats.

4.1.B
Identify the type of malware used in a cyberattack.

  • 4.1.B.1 Malware is malicious software that can damage or destroy a device or network, or allow an adversary access to a device and the data on the device.
  • 4.1.B.2 Malware is often used as a tool to accomplish part of an adversary’s plan to achieve their ultimate goal(s). There are many types of malware, such as:
    • Viruses are malware that must be activated by a user executing or opening a file.
    • Worms spread from one computer to another without human interaction.
    • Trojans are malware embedded in other software that seems harmless. Remote access trojans (RATs) provide an adversary with remote access to the target system.
    • Ransomware encrypts a device’s files, preventing the user from accessing files on the device. The ransomware typically presents the user with a screen demanding payment and promising to give the user a decryption key for their files if the user pays within a fixed amount of time.
    • Spyware tracks a user’s actions on a computer and sends information back to an adversary.
    • A keylogger is software or hardware that logs the users keystrokes and sends the information back to the adversary. Adversaries can often extract usernames and passwords from keylogger data.
    • Logic bombs are set to trigger their effect only when a specific set of conditions are met; the conditions can include time and date, specific type or version of the operating system, character set the computer is using, etc.
    • A rootkit is sophisticated malware that gets into the target computer’s operating system and can control nearly every aspect of the system, including making the rootkit itself invisible to detection.
  • 4.1.B.3 While most malware is a file or a collection of files, fileless malware is malicious code that lives in RAM and uses legitimate programs already installed on a device to compromise it.

4.1.C
Explain how adversaries can exploit common device vulnerabilities to cause loss, damage, disruption, or destruction.

  • 4.1.C.1 Adversaries can develop exploits for known vulnerabilities in software (including operating systems). Devices with unpatched software are vulnerable to these exploits, which could allow an adversary to crash a system, view user actions, enable or disable various services or components on the device (e.g., turning on a webcam or microphone), or even take control of the device to issue their own commands including commands to steal or destroy information on the device.
  • 4.1.C.2 Adversaries can take advantage of weak authentication requirements by guessing a user’s password or using social engineering to get a user to divulge their password.
  • 4.1.C.3 When systems don’t have a password on the basic input output system (BIOS) or unified extensible firmware interface (UEFI), an adversary can boot a computer into a special mode (e.g., “recovery mode”) that gives them higher-level privileges. Without BIOS or UEFI protection, adversaries can load their own operating system onto a device from an external drive and use specialized tools to alter or create user profiles, including changing user passwords.
  • 4.1.C.4 Adversaries can load malware onto an external drive, and if autorun is enabled, then a device will run the malware when the external drive is inserted.
  • 4.1.C.5 Adversaries can leverage open ports to connect to a device.
  • 4.1.C.6 Adversaries can send malicious data to devices to disrupt them or attempt to take control of them. Devices that have no firewall (or a misconfigured firewall) cannot filter out this malicious data.
  • 4.1.C.7 Adversaries often attempt to install malware on a device to disrupt or control it. Devices lacking anti-malware software are more vulnerable to this type of attack.

4.1.D
Assess and document risks from device vulnerabilities.

  • 4.1.D.1 Risk from device vulnerabilities can come from unauthorized access or malware that allow an adversary to impersonate an authorized user, remotely control a device, encrypt a device’s drive to ransom the data, or wipe a device’s memory, destroying data or rendering the device inoperable. The level of risk varies depending on the criticality of the device or the services the device provides or data it stores.
  • 4.1.D.2 High risks from device vulnerabilities involve potentially compromising sensitive data or critical operations.
    • Illustrative examples for 4.1.D.2:
      • An organization has not installed the most recent update for their email server which included a patch for a known critical vulnerability.
  • 4.1.D.3 Moderate risks from device vulnerabilities can arise from weak authentication requirements or from vulnerabilities that would be less likely to be exploited.
    • Illustrative examples for 4.1.D.3:
      • A water treatment plant has embedded systems controlling pumps. The pumps can be remotely accessed via username and password for remote management for the plant, but the devices do not require multi-factor authentication (MFA).
  • 4.1.D.4 Low risks from device vulnerabilities are typically related to vulnerabilities that, if exploited, would have little impact.
    • Illustrative examples for 4.1.D.4:
      • An employee’s laptop has telnet port 23 open.

来源:美国大学理事会 AP 课程与考试说明

一个设备是任何计算机——一台服务器、一台个人笔记本电脑、一部智能手机,或一台建入一台机器里的嵌入式计算机(embedded computer)。带嵌入式计算机的日常设备被称为物联网(IoT)(Internet of Things)设备,而它们运行从水泵到洗衣机的一切。

设备的四大类别,以及类别为什么重要

类别 是什么 安全后果
服务器 为许多用户运行服务的共享机器 价值最高的目标;一次被攻破就波及所有人
个人计算机 台式机与笔记本 通用设备,用户装什么就跑什么
手持计算机(handheld computers,也叫移动计算机或信息终端) 比个人计算机更小、依靠电池供电——智能手机、平板、智能手表以及其他可穿戴技术 容易丢失或被盗,而且常常被带到不可信的网络上
嵌入式计算机(embedded computers) 作为机器的一部分的计算机——汽车的发动机控制器、恒温器、医用输液泵 拥有用于与自身部件对接的专用指令集,而且往往更慢、更便宜、存储极少,所以安全特性常被省略,更新也很少

最后一行正是嵌入式与物联网设备频繁出现在攻击情景中的原因:让它们便宜的那些限制,同时也让它们难以防护。

对一个设备的主要威胁是恶意软件(malware)——恶意的软件。学这些类型:

  • 病毒(virus)——必须由一个用户打开一个文件来激活。
  • 蠕虫(worm)——自己扩散,没有人的动作。
  • 木马(Trojan)——藏在看起来安全的软件里面;一个远程访问木马(RAT)(remote access trojan)给对手远程控制。
  • 勒索软件(ransomware)——加密你的文件并要求为密钥付款。
  • 间谍软件(spyware)——秘密地追踪你做什么。
  • 键盘记录器(keylogger)——记录每个击键以窃取密码。
  • 逻辑炸弹(logic bomb)——只在一个条件被满足时触发(一个日期、一个版本)。
  • Rootkit——深深地藏在操作系统里,甚至能使自己不可见。

大多数恶意软件是一个文件,但无文件恶意软件(fileless malware)不同:它只存在于 内存(RAM)里并滥用设备上已经有的合法程序,不留下文件给一个扫描器找到。

对手利用未打补丁的软件(unpatched software)、弱密码、无保护的 BIOS/UEFI 启动设置,和开放的端口。我们按设备的价值和关键性给设备风险评级——一家医院未打补丁的电子邮件服务器是高风险,而一个员工带一个未使用的开放端口的笔记本电脑是低。

探索

Name the malware from its behaviour

Each kind of malware has one defining trait: a worm self-spreads, a virus needs a user to run it, ransomware encrypts for money, and a rootkit hides deep in the OS.

词汇表 训练
英文 中文 拼音
embedded computer/emˈbedɪd kəmˈpjuːtə/ 嵌入式计算机 qiàn rù shì jì suàn jī
Internet of Things (IoT)/ˈɪntənet ɒv θɪŋz/ 物联网 wù lián wǎng
handheld computers/ˈhændheld kəmˈpjuːtəz/ 手持计算机 shǒu chí jì suàn jī
malware/ˈmælweə/ 恶意软件 è yì ruǎn jiàn
Virus/ˈvaɪrəs/ 病毒 bìng dú
Worm/wɜːm/ 蠕虫 rú chóng
Trojan/ˈtrəʊdʒn/ 木马 mù mǎ
remote access trojan (RAT)/rɪˈməʊt ˈækses ˈtrəʊdʒn/ 远程访问木马 yuǎn chéng fǎng wèn mù mǎ
Ransomware/ˈrænsəmweə/ 勒索软件 lè suǒ ruǎn jiàn
Spyware/ˈspaɪweə/ 间谍软件 jiàn dié ruǎn jiàn
Keylogger/ˈkiːlɒɡə/ 键盘记录器 jiàn pán jì lù qì
Logic bomb/ˈlɒdʒɪk bɒm/ 逻辑炸弹 luó jí zhà dàn
fileless malware/ˈfaɪlləs ˈmælweə/ 无文件恶意软件 wú wén jiàn è yì ruǎn jiàn
RAM/ræm/ 内存 nèi cún
unpatched software/ʌnˈpætʃt ˈsɒftweə/ 未打补丁的软件 wèi dǎ bǔ dīng de ruǎn jiàn
patch/pætʃ/ 补丁 bǔ dīng
embedded computers/emˈbedɪd kəmˈpjuːtəz/ 嵌入式计算机 qiàn rù shì jì suàn jī
观看视频课 练习卷 双页
4.2

身份验证
大纲
Learning ObjectiveEssential Knowledge

4.2.A
Explain why hashes (also called hash outputs, checksums, message digests, or digests) are used to store passwords.

  • 4.2.A.1 A cryptographic hash function (also called a message digest function) is a mathematical algorithm that takes binary data of an arbitrary length, processes it according to a set of instructions, and outputs a fixed-length binary string called the hash (or checksum or message digest). Well known cryptographic hashes include:
    • MD5
    • SHA-1, SHA-256, SHA-512 (SHA stands for Secure Hash Algorithm)
    • NTHash
    • RIPEMD-160
  • 4.2.A.2 An n-bit hash has $2^n$ possible outputs. The number of inputs is infinite, and so inevitably two different inputs will produce the same hash. This is called a collision.
  • 4.2.A.3 Cryptographic hash functions have the following properties:
    • Hashes are collision resistant; it is difficult to find two different inputs to the same hash function that produce the same output.
    • Hashes have pre-image resistance; given a hash, it is infeasible to figure out the input that generated the hash.
    • Hashes are repeatable; the same input will always produce the same hash.
    • Hashes have a fixed length; the length in bits of the hash for a specific hash function is constant regardless of the size of the input.
  • 4.2.A.4 Adversaries try to compromise hashing functions by forcing collisions in their output. If an efficient algorithm exists to force a collision for a specific hash function, then that hash function will be deprecated (no longer used in secure settings). MD5 and SHA1 are examples of deprecated hash functions.
  • 4.2.A.5 Password-based authentication services shouldn’t store passwords in plaintext, so that if an adversary gains access to the user:password directory they won’t immediately know the passwords for all users. Instead, user passwords should be hashed and the hash stored in a database. When a user enters their password, it is hashed, and the hash is compared to the hash stored on file. If the hashes match, then the user is authenticated.
  • 4.2.A.6 If two users had the same password, then their passwords would have identical hashes in the user:password directory. To prevent this, a few random bits (called salt) are hashed with a user’s password to generate the hash. Each user’s salt is unique, so even if two users have the same password they will have a different password hash because they have different salt.

4.2.B
Explain how password attacks exploit vulnerabilities.

  • 4.2.B.1 If an adversary can compromise the password of a legitimate user, and that user’s organization has not enabled MFA or other authentication protections, then the adversary can act within that organization with all the access and rights available to the user.
  • 4.2.B.2 Password attacks can be classified as online or offline.
    • Online password attacks attempt user:password combinations in an active authentication portal.
    • Offline password attacks have captured a user:password database and can run password attacks against the database on their own computer. This method bypasses any account lock out protections that may be in place.
  • 4.2.B.3 Many users reuse the same passwords (or variations of the same password) for all the services and accounts they have, despite warnings not to. When an organization’s user database is stolen, the usernames, emails, and passwords are sold to adversaries or posted online. Adversaries often begin an attempt to compromise an account by trying stolen or leaked credentials for a target individual.
  • 4.2.B.4 Many users set passwords that are easy to guess, and adversaries will attempt to guess common passwords for a user’s account. Password spraying is an attack where an adversary attempts a common password against many different user accounts.
  • 4.2.B.5 Some services and devices (e.g., switches, routers, and IoT devices) are preconfigured with a default administrative user and password. Credential stuffing is an attack where an adversary attempts to gain access to these services or devices using common default credentials or account credentials that have been stolen.
  • 4.2.B.6 Offline password attacks use automated hash-cracking tools to hash possible passwords and compare them against a captured hash. Although hashes can’t be reversed, an adversary can use these tools to hash many potential passwords and compare them to the target hash. If an adversary finds a hash that matches, they can use the password that generated the hash to login to the user’s account. Offline attacks include:
    • Brute force attacks, where an adversary uses an automated tool to test all the potential passwords that a user could have
    • Dictionary attacks, where an adversary uses an automated tool to test a list of common passwords
  • 4.2.B.7 A rainbow table attack uses a list of common passwords to generate a rainbow table. A rainbow table is a table that contains each potential password and its hash. The table is then sorted by the hashes, and the adversary uses an automated tool to search the list of hashes for the captured hash. If the hashes match, then the adversary has found a password that generates the same hash, and the password will allow the adversary to login to the user’s account.

4.2.C
Determine the type of authentication used to verify the identity of a user.

  • 4.2.C.1 Authentication mechanisms are technical controls that verify the identity of a user to ensure that only authorized users access a system. The proof the user provides to identify themselves is called a factor. Common authentication factors include:
    • Something the user knows (knowledge factor)
    • Something the user has (possession factor)
    • Something the user is (biometric factor)
    • Somewhere the user is (location factor)
  • 4.2.C.2 Knowledge factors can be passwords, PINs, or answers to preselected challenge questions. For a knowledge factor to be effective it needs to be something an adversary can’t easily guess; however, knowledge factors that are difficult for an adversary to figure out can also be harder for a user to remember.
  • 4.2.C.3 A possession factor is an object a user has that is unique to them, such as an access card, a bank card, a cell phone, or an authentication token. The more difficult it is for an adversary to obtain the object (or a copy of it), the more secure the possession factor is.
  • 4.2.C.4 Biometric factors measure features of the human body and can include fingerprints, palm prints, facial recognition, iris or retina scans, or voice identification. Biometric factors are difficult for an adversary to duplicate because they are unique to an individual.
  • 4.2.C.5 Location factors use information about Wi-Fi signals, GPS data, time zone settings, and even IP address information to make determinations about location. Rules can be established for allowing or denying access based on a location factor.
  • 4.2.C.6 Multifactor authentication (MFA) is when a system uses more than one factor to authenticate a user. MFA is more secure than single-factor authentication because it requires the user to provide at least two separate factors of authentication.

4.2.D
Configure login settings to make a device more secure.

  • 4.2.D.1 Requiring complexity in passwords is a login setting that can be configured. When enabled, users setting a new password must include at least one character from each character set. Passwords with characters from each character set are significantly harder for an adversary to crack than passwords that use characters from only one or two character sets. The main character sets often required are:
    • Uppercase letters (A–Z)
    • Lowercase letters (a–z)
    • Numeric digits (0–9)
    • Special characters (!”#$%&’()*+,-./:;<=>?@ [ \ ] ^_`{|}~)
  • 4.2.D.2 Requiring a minimum password length is a login setting that can be configured. This means that users must have at least a certain number of characters in their password. The longer and more complex a password is, the longer it will take a digital tool to crack the password.
  • 4.2.D.3 Requiring a maximum password age is a login setting that can be configured. When configured, users will receive a prompt to change their password a certain number of days after their last password change, usually every 90 or 120 days. If a user’s password has been compromised, changing it could prevent an adversary from gaining access to the user’s account. However, some national standards recommend that organizations not require users to change their passwords on predefined intervals to discourage users from developing password patterns (e.g., PasswordFall2028).
  • 4.2.D.4 Requiring the system to store a certain number of previous user passwords is a login setting that can be configured. This prevents a user from reusing a password. Many organizations store users’ previous 5–10 password hashes to prevent reuse.
  • 4.2.D.5 Requiring a lockout period after a certain number of invalid login attempts is a login setting that can be configured. This prevents an adversary from continuously randomly attempting wrong passwords. Many organizations lock a user’s account after 3–5 invalid login attempts. The period of the lockout varies.

来源:美国大学理事会 AP 课程与考试说明

多因素认证
一个人把手指按在一个小型光学指纹扫描仪上
指纹扫描仪:生物特征认证检查你"是"什么,这比密码更难被攻击者窃取或猜到

要安全地存储密码,系统使用一个密码散列函数(cryptographic hash function)——一个把任何输入变成一个固定长度字符串叫散列值(hash)(或摘要)的单向数学算法。散列有三个关键的性质:它们是抗碰撞(collision resistant)的(难以找到两个有相同输出的输入)、有抗原像(pre-image resistance)(你不能反推到输入),和可重复(相同的输入总是给出相同的散列)。

一个散列函数把任何输入变成一个固定长度的摘要,而且不能被逆转
一个散列函数把任何输入变成一个固定长度的摘要,而且不能被逆转

真实的散列函数有名字。安全散列算法(SHA)(Secure Hash Algorithm)家族——SHA-256 和 SHA-512——是今天的标准。对手通过尝试强制一次碰撞(两个不同的输入有相同的散列)来攻击一个散列函数;一旦存在一种高效的碰撞攻击,那个函数就被弃用(deprecated)(从安全用途中退役)。MD5 和 SHA-1 是经典的被弃用的例子——今天绝不要依赖它们来保护数据。

一个服务从不存储你的明文密码。它存储散列值;当你登录时,它把你打的散列并比较。要阻止两个相同的密码产生相同的散列,几个叫盐值(salt)的随机位在散列之前被添加,所以每个存储的散列都是唯一的。

Worked example. 两个用户都选择密码 sunshine。没有盐值,两个存储的散列会相同,所以破解一个立即破解另一个。给每个用户一个唯一的盐值——比如说 x7 和 q2 ——而服务转而散列 sunshinex7 和 sunshineq2。这两个存储的散列现在看起来完全不同,所以对手必须分别攻击每个账户。这就是为什么一个被窃取的散列数据库在散列被加盐时危险得多。

对手用密码攻击回击。在线攻击对一个实时登录猜测;离线攻击窃取散列数据库并在他们自己的机器上破解它(这样就绕过了任何账户锁定保护)。技术包括:

  • 暴力破解(brute force)—— 自动化工具逐一尝试每一个可能的密码;最终一定能成功,但很慢,而且随密码长度爆炸式增长。
  • 字典攻击(dictionary attack)—— 工具先尝试一份常用词和已知密码的清单,因为大多数人选的密码都容易猜。
  • 密码喷洒(password spraying)—— 一个常见密码对许多账户(这样能躲开锁定,因为锁定是按每个账户计失败次数的)。
  • 撞库(credential stuffing)—— 重用窃取或默认的凭据,利用人们跨网站重复用密码这一点。
  • 彩虹表(rainbow table)—— 一张密码及其散列的预计算表,按散列排序,这样一个捕获的散列可以直接查表,而不必重新计算。

Password policy settings

管理员通过配置登录设置来加固账户 —— 考试要你能说出它们的名称,并说明每一项防的是什么:

设置 作用 它减慢的攻击
复杂度(complexity) 要求每个字符集(大写、小写、数字、特殊字符)各出现一个 暴力破解 / 字典攻击
最小长度(minimum length) 要求至少 N 个字符 —— 长度比什么都重要 暴力破解(呈指数增长)
最长有效期(maximum age) 每约 90-120 天强制更换一次 限制一个被窃密码还能用多久
密码历史(password history) 保存最近 5-10 个散列,禁止重用 阻止重新用回一个旧的(可能已泄露的)密码
锁定(lockout) 在 3-5 次错误尝试后锁定账户 暴力破解 / 在线猜测

有一个值得得分的细节:一些国家标准现在反对强制到期更换,因为定期更换会把用户逼成可预测的模式,比如 PasswordFall2028。密码管理器(password manager)才真正解决了根本问题 —— 它为每个网站生成并保存一个又长又独特的密码,这样就没有一个密码会被重用或被猜到。

身份验证因素(authentication factors)证明你是谁,并落入几类:你知道的东西(一个密码)、你拥有的东西(一个令牌或手机)、你是的东西(一个像指纹或视网膜扫描的生物特征(biometric)),和你在的某处(一个位置因素)。使用两个或更多是多因素身份验证(MFA)(multifactor authentication)——远强于单独一个密码。

可移动介质,以及自动运行带来的问题

对手可以把恶意软件放到一个外部驱动器上——U 盘、移动硬盘——然后丢在会被人捡到的地方。如果自动运行(autorun)是开启的,设备会在插入的那一刻就从该驱动器运行程序,不需要任何点击,于是恶意软件在用户还没决定是否信任之前就已经执行了。

有两种控制手段应对它,考试要求两个都点出来:

  • 禁用自动运行,让插入驱动器本身永远不会运行任何东西。
  • 禁止用户连接外部驱动器或介质,由制度和一项封锁 USB 端口的技术控制共同执行——这正是许多高安全环境从物理上或逻辑上关闭这些端口的原因。
探索

How a hash maps any input to a fixed slot

A hash function sends every input to a fixed-length output. The same input always lands in the same place (repeatable), and you cannot work backwards from the slot to the input.

词汇表 训练
英文 中文 拼音
cryptographic hash function/ˌkrɪptəˈɡræfɪk hæʃ ˈfʌŋkʃn/ 密码散列函数 mì mǎ sàn liè hán shù
hash/hæʃ/ 散列值 sàn liè zhí
collision resistant/kəˈlɪʒn rɪˈzɪstənt/ 抗碰撞 kàng pèng zhuàng
pre-image resistance/priː ˈɪmɪdʒ rɪˈzɪstəns/ 抗原像 kàng yuán xiàng
deprecated/ˈdeprɪkeɪtɪd/ 弃用 qì yòng
salt/sɒlt/ 盐值 yán zhí
brute force/bruːt fɔːs/ 暴力破解 bào lì pò jiě
dictionary attack/ˈdɪkʃənəri əˈtæk/ 字典攻击 zì diǎn gōng jī
password spraying/ˈpæswɜːd ˈspreɪɪŋ/ 密码喷洒 mì mǎ pēn sǎ
credential stuffing/krɪˈdenʃl ˈstʌfɪŋ/ 撞库 zhuàng kù
rainbow table/ˈreɪnbəʊ ˈteɪbl/ 彩虹表 cǎi hóng biǎo
complexity/kəmˈpleksɪti/ 复杂度 fù zá dù
minimum length/ˈmɪnɪməm leŋθ/ 最小长度 zuì xiǎo cháng dù
maximum age/ˈmæksɪməm eɪdʒ/ 最长有效期 zuì zhǎng yǒu xiào qī
password history/ˈpæswɜːd ˈhɪstəri/ 密码历史 mì mǎ lì shǐ
lockout/ˈlɒkaʊt/ 锁定 suǒ dìng
password manager/ˈpæswɜːd ˈmænɪdʒə/ 密码管理器 mì mǎ guǎn lǐ qì
biometric/ˌbaɪəʊˈmetrɪk/ 生物特征 shēng wù tè zhēng
multifactor authentication (MFA)/ˌmʌltɪˈfæktə ɔːˌθentɪˈkeɪʃn/ 多因素身份验证 duō yīn sù shēn fèn yàn zhèng
autorun/ˌɔːtəʊˈrʌn/ 自动运行 zì dòng yùn xíng
观看视频课 练习卷 双页
4.3

设备防护
大纲
Learning ObjectiveEssential Knowledge

4.3.A
Identify managerial controls related to device security.

  • 4.3.A.1 An acceptable use policy will describe the range of activities that are permissible, prohibited, or required by users on devices owned by an organization and may include:
    • Prohibiting users from accessing specific websites or types of websites (e.g., social media or gaming)
    • Requiring users to keep software updated
    • Allowing users to connect peripheral devices
    • Prohibiting users from connecting external drives or media
  • 4.3.A.2 A password policy will detail the requirements for user passwords within an organization and may include:
    • A minimum or maximum password length
    • A minimum or maximum amount of time a user may keep the same password
    • A prohibition of password reuse
    • Rules for password construction (e.g., no dictionary words and character set requirements)
    • A suggestion to use secure password management tools instead of writing passwords down
  • 4.3.A.3 A software installation policy will describe what (if any) software users are allowed to install on their devices and usually also a process for users to request specialized software they may need to perform their role, and it may include:
    • A prohibition against users installing software on their devices
    • A process for users to request new software needed for their role
    • A list of approved software for users

4.3.B
Explain how anti-malware software can make a device more secure.

  • 4.3.B.1 Anti-malware software (sometimes called antivirus software) has tools to quarantine and remove malware that can corrupt, spy on, or destroy a system. Malware contains indicators that make it detectable; these indicators are called signatures.
  • 4.3.B.2 Anti-malware software has a database of malware signatures. It periodically scans the files on a device and checks to see if any of the files match any of the signatures in its database. If there is a match, the software quarantines and removes the malicious files.

4.3.C
Explain why keeping a device’s operating system and software updated makes it more secure.

  • 4.3.C.1 When vulnerabilities in operating systems and software are found, the vendor or organization that maintains the operating system software will fix it and send an update. A small update is called a patch.
  • 4.3.C.2 Ensuring that a computer’s operating system and software applications are updated to the most recent version prevents adversaries from taking advantage of a known vulnerability.

4.3.D
Configure a host-based firewall.

  • 4.3.D.1 Host-based firewalls allow or deny traffic into or out of a single device. This provides an extra layer of security in case a host is connected to a compromised network.
  • 4.3.D.2 A host-based firewall is software that runs on a device and follows a set of rules (an ACL) like a network-based firewall. Firewall rules are implemented in order, applying the first rule that matches.
  • 4.3.D.3 A host-based firewall can also block specified types of outbound traffic. Host-based firewalls should always block ports or services not needed for a given device.
    • Illustrative examples for 4.3.D.3:
      • A host-based firewall is configured to block outbound FTP traffic. This prevents an adversary with remote access to the host from using FTP to exfiltrate a file to the adversary’s server.
  • 4.3.D.4 The rules for a host-based firewall can allow or deny traffic based on source or destination port or IP address, service, protocol, or application.

来源:美国大学理事会 AP 课程与考试说明

管理控制设定规则:一个可接受使用政策(acceptable use policy)列出用户可以和不可以做什么、一个密码政策设定长度和重用规则,而一个软件安装政策控制什么能被安装。

技术控制做工作。反恶意软件(anti-malware software)保持一个恶意软件特征的数据库并隔离任何匹配的文件。保持操作系统和应用更新——安装每个补丁(patch)——在对手能使用它们之前关闭已知的洞。一个主机防火墙(host-based firewall)控制进出一个单一设备的流量,阻止它不需要的端口和服务。

一个反恶意软件扫描器窗口:已扫描 3106 个文件,发现两个威胁,带有隔离和更新控件
反恶意软件根据一个特征数据库扫描文件并隔离任何匹配项——这次扫描标记了两个威胁
词汇表 训练
英文 中文 拼音
acceptable use policy/əkˈseptəbl juːs ˈpɒlɪsi/ 可接受使用政策 kě jiē shòu shǐ yòng zhèng cè
Anti-malware software/ˈænti ˈmælweə ˈsɒftweə/ 反恶意软件 fǎn è yì ruǎn jiàn
host-based firewall/həʊst beɪst ˈfaɪəwɔːl/ 主机防火墙 zhǔ jī fáng huǒ qiáng
观看视频课 练习卷 双页
4.4

检测设备攻击
大纲
Learning ObjectiveEssential Knowledge

4.4.A
Explain how to detect attacks against devices.

  • 4.4.A.1 System processes and settings, login attempts, file download attempts, and user actions are logged by computing systems. These logs can be used to reconstruct circumstances leading up to and during a cyber incident.
  • 4.4.A.2 An indicator of compromise (IoC) is evidence that an adversary has compromised a device or network.
  • 4.4.A.3 Authentication logs (or auth logs) record every attempted login on a system. Analysis of authentication logs can reveal attempted attacks.
  • 4.4.A.4 Host-based IoCs are discovered when analyzing logs and configuration settings. Indicators, such as the following, can be found in authentication logs, user activity logs, and system configuration files:
    • Unusual files being created or modified
    • Unexpected processes or services
    • Unauthorized changes to system configuration settings
    • Unauthorized software installation or update
  • 4.4.A.5 File-based IoCs are discovered when analyzing files on a device. Indicators are usually found in executable files and can include:
    • Files whose hash matches known malware
    • File names that are known to be created by a certain piece of malware
    • File paths that are associated with malicious activity
  • 4.4.A.6 Behavior-based IoCs are discovered when analyzing logs. Indicators can be found in authentication logs and access logs and can include:
    • Multiple failed login attempts
    • Unusual login times or locations
    • Unauthorized attempts to access sensitive data
    • Attempts to elevate user privileges on a system

4.4.B
Determine controls for detecting attacks against a device.

  • 4.4.B.1 Performance is a criterion for determining a detection method. Detection tools use system memory and processing power and can impact the performance of a device. Anomaly-based detection tools use more system resources than signature-based tools. Signature-based detection is a better option for devices with less powerful system resources. Many embedded devices do not have enough system resources to run any detection tools on the device.
  • 4.4.B.2 Cost is a criterion for determining a detection method. Organizations that purchase detection software need to consider the cost of purchasing enough software licenses for the number of devices they need to monitor. Some organizations purchase an endpoint detection and response (EDR) service from a third-party vendor. Although these services are expensive, they provide a holistic, unified approach to threat detection for an organization’s devices; they typically include a centralized alert platform for monitoring possible attacks on devices.
  • 4.4.B.3 Sensitivity or criticality of the device is a criterion for determining a detection method. Devices that store or process sensitive information or provide critical services are more likely to be targeted by adversaries and benefit from a hybrid-detection model to offer maximum protection, when possible.

4.4.C
Evaluate the impact of a device detection method.

  • 4.4.C.1 Speed and performance are factors in evaluating the impact of a detection method. Signature-based detection is faster than anomaly-based detection in general, and that effect is compounded on devices, which often lack the processing power to effectively run anomaly-based detection tools. Implementing resource-intensive detection tools on devices can degrade device performance.
  • 4.4.C.2 Phase of the attack is a factor in evaluating the impact of a detection method. To carry out actions on a device, adversaries must first bypass a combination of physical- or network-layer protective, deterrent, and detective security controls. Detecting and stopping an attack at the device level can prevent adversaries from accessing sensitive data or disrupting critical services.
  • 4.4.C.3 False positives versus ease of bypassing detection is a factor in evaluating the impact of a detection method. Most device-level detection tools are signature-based, and signature-based detection has a low rate of false positives. However, signature-based detection is easier for adversaries to bypass.

4.4.D
Apply detection techniques to identify indicators of password attacks by analyzing log files.

  • 4.4.D.1 Online password attacks can be detected in authentication logs. A single user attempting many wrong passwords is an indicator of an online password attack. If a user:password hash database has been compromised, all the user passwords in the database should be considered insecure and all users should be forced to reset their passwords.
  • 4.4.D.2 If an authorized user is logging in from a different location or IP address than expected, or at a different time than normal, this can be an indicator that the user’s password has been compromised.
  • 4.4.D.3 An indicator of password spraying is many users trying to log in within seconds of each other from one IP address or from unusual IP addresses.
  • 4.4.D.4 An indicator of credential stuffing is a series of default user:password combinations being attempted on a device in quick succession, often from the same IP address.
  • 4.4.D.5 Offline password attacks can’t be detected, because the attack takes place on the adversary’s computer.

来源:美国大学理事会 AP 课程与考试说明

设备记录登录、文件变化和进程,而这些日志揭示一个入侵指标(IoC)(indicator of compromise)——一个对手进入的证据。基于主机的 IoC 显示为意想不到的进程或改变的设置;基于文件的 IoC 是散列匹配已知恶意软件的文件;基于行为的 IoC 是像许多失败的登录或不寻常的登录时间这样的东西。

选择一个检测方法意味着权衡性能(基于特征更轻,对弱设备更好)、成本(一个端点检测与响应(EDR)(endpoint detection and response)服务强大但昂贵),和设备有多敏感。读身份验证日志暴露密码攻击:一个用户的许多错误密码标志一个猜测攻击;许多用户从一个 IP 失败标志密码喷洒;一阵默认凭据标志撞库。不过,离线攻击不能被检测——它们在对手自己的计算机上发生。

速度本身就是一个安全因素。 基于特征的检测把看到的内容与一份已知恶意模式的清单比对,所以它比基于异常的检测更快——后者必须先学习"正常"是什么样,再用这个模型去衡量每一个事件。基于异常的检测能抓到还没有特征的攻击,但它耗费的处理能力大得多;而在本就缺乏算力的设备上,影响会叠加:检测跑得慢、设备变卡,最终这套方法根本没能被有效地实施。

词汇表 训练
英文 中文 拼音
indicator of compromise (IoC)/ˈɪndɪkeɪtə ɒv ˈkɒmprəmaɪz/ 入侵指标 rù qīn zhǐ biāo
endpoint detection and response (EDR)/endˈpɔɪnt dɪˈtekʃn ænd rɪˈspɒns/ 端点检测与响应 duān diǎn jiǎn cè yǔ xiǎng yìng
观看视频课 练习卷 双页
4.4

考试技巧
  • 知道每个恶意软件类型的定义特征:蠕虫自我扩散、病毒需要一个用户、勒索软件为钱加密、RAT 给远程控制、rootkit 隐藏。
  • 一个散列是单向和固定长度的;盐值使相同的密码散列不同。绝不说一个服务"存储密码"——它存储加盐的散列。
  • 说出真实的算法:SHA-256/SHA-512 是现行的;MD5 和 SHA-1 因为存在高效的碰撞攻击而被弃用。
  • 把密码攻击匹配到它的日志特征:一个用户 + 许多错误密码 = 猜测;许多用户 + 一个 IP = 喷洒;默认凭据 = 撞库。
  • 把身份验证因素分成知道 / 拥有 / 是 / 在哪里,并记住 MFA 结合两个或更多——一个指纹加一个密码,不是两个密码。
  • 离线密码攻击不能被检测,因为破解在对手的机器上发生——一个最爱的考试"陷阱"。

本主题的互动课程

逐步学习,并即时检测练习。

AP 网络安全历年真题

AP 网络安全的更多主题

登录或创建账号

IGCSE, A-Level & AP