安全系列課程實(shí)現(xiàn)內(nèi)網(wǎng)安全解決方案

1、1Practical Security for Intranet Solutions 孫巍孫巍2Session Overview Introduction to Security for Intranet Applications Data Security Fundamentals Managing Identities Authenticating Identities in Intranet Applications Authorizing Identities in Intranet Applications3Introduction to Security for Intranet

2、Applications Introduction to Security for Intranet Applications Data Security Fundamentals Managing Identities Authenticating Identities in Intranet Applications Authorizing Identities in Intranet Applications4Characteristics of Intranet Environments Users are known Data is sensitive Biggest threat

3、is internal5Securing Data Store sensitive data securely Treat the storage medium as if it were at riskData ThreatsData TamperingAccess to SensitiveData in Storage6Storing Identity InformationDirectoryActive DirectoryADAMGeneric LDAPDatabaseSQLA repository that contains digital identitiesIdentity Sto

4、re Directory or database Centralized or distributed Well-defined schema Encryption or hashing7Authenticating IdentitiesA process that checks the credentials of a security principal against values in an identity storeAuthenticationAuthentication ThreatsUser ImpersonationAccount Hijacking8Authorizing

5、IdentitiesThe process of resolving a users entitlements with the permissions configured on a resource to control accessAuthorizationAuthorization ThreatsData TamperingDisclosure of Confidential DataElevationof PrivilegeUnauthorized Access9Securing Communication Treat intranet applications like Inter

6、net applications Use SSL to secure communicationCommunication ThreatsMan in the MiddleWireless DataInterceptionSecuring the data stream between the application and the client or between two applicationsSecuring Communication10 Introduction to Security for Intranet Applications Data Security Fundamen

7、tals Managing Identities Authenticating Identities in Intranet Applications Authorizing Identities in Intranet ApplicationsData Security Fundamentals11Data Security in Applications Data security is essential to ensure that: Confidential data remains private Important data is not tampered with or del

8、eted Authorized users have access to their data Data can be secured using: Permissions Encryption12Data Security and Permissions Typically, data files provide permissions based on the following actions: Full control Modify Read & Execute Read Write File based data security scheme that limits acc

9、ess based on the users authorization levelPermissions13What Is Encryption? There are two main approaches to encryption: Symmetric encryption Asymmetric encryption Both approaches can be used within the same sessionA method of transforming data by passing it through a cryptographic function to genera

10、te data in a format that can read only by an entity that knows the specific decryption key and algorithmEncryptionDo not write your own encryption routines Use the ones provided14Data Security and Encryption Use encryption when storing or transmitting sensitive data Longer encryption key = Stronger

11、encryptionStoring DataRetrieving Data1Collect2Encrypt3Transmit4Store1Retrieve2Transmit3Decrypt4Read15SymmetricDESTripleDESRijndaelRC2 AsymmetricDSARSAData Encryption in the .NET FrameworkAn electronic signature used to ensure the authenticity, integrity, and non-repudiation of an electronic document

12、Digital signature16Best Practices for Data SecuritySecure all sensitive data as if the media itself were at riskChange symmetric keys oftenUse existing cryptographic functions 17Managing Identities Introduction to Security for Intranet Applications Data Security Fundamentals Managing Identities Auth

13、enticating Identities in Intranet Applications Authorizing Identities in Intranet Applications18 ApplicationsConsume digital identity Evaluate entitlements Common intranet identity storesActive DirectoryADAMSQLGeneric LDAPApplications and Identity StoresDo not invent identity stores for your applica

14、tion 19Access ManagementControlling user access to resources Authentication Credential mapping AuthorizationA state that describes the agreements between different parties and systems for sharing identity informationTrust20Identity Flow There are three models for flowing the identity of an authentic

15、ated user in distributed environments: Impersonation/delegation Trusted subsystem Credential mappingThe action of passing identity information between resourcesIdentity Flow21Designing Access-Management StrategiesThe following steps identify a process that will help you develop an authentication and

16、 authorization strategy for your application:Identify resources1Choose an authorization strategy2Choose the identities used for resource access3Consider identity flow4Choose an authentication approach5Decide how to flow identity622Best Practices for Identity ManagementMinimize the number of identity

17、 stores within your organizationUse Active Directory for your identity storeUse an identity store that exists rather than creating your own 23 Introduction to Security for Intranet Applications Data Security Fundamentals Managing Identities Authenticating Identities in Intranet Applications Authoriz

18、ing Identities in Intranet ApplicationsAuthenticating Identities in Intranet Applications24Authentication Options for Intranet ApplicationsThe following are common authentication methods for intranet applications:Least SecureMost SecureBasicAnonymousDigest, NTLMKerberos, X.509 client certificate25An

19、onymous Authentication No authentication = Anonymous access Anonymous access does not provide any identity information Anonymous access provides no security Give anonymous users read-only access26Basic Authentication Specified in HTTP 1.0 Inherently insecurepasswords sent in Base64 encodingUsername

20、& PasswordAccess or DenySecure the authentication stream by using an SSL connection 27Integrated Windows Authentication Preferred authentication mechanism for intranet applications Kerberos is replacing NTLM KerberosWindows 2000 ServerWindows Server 2003NTLMWindows NT ServerWindows 2000 ServerWi

21、ndows Server 200328User name and hashed password 2Compares hashed password3Access or deny access4Challenge with code1Digest Authentication and NTLM Digest credentials: user name & hashed password NTLM credentials: domain name, user name, & hashed passwordDoes not secure the data stream29Kerb

22、eros Authentication Relies on public-key cryptography and digital-signature technology Windows provides certificate authority serviceClient requests a client ticket1Client requests session ticket to application3Kerberos server replies with ticket4Client sends tickets to application5Application sends

23、 validation (optional)6Kerberos server replies with ticket2345621ClientApplicationKerberos Server30X.509 Client Authentication Requires the exchange of digital certificates Level of security is related to contents of certificate Trusted certificate authority issues certificate Commonly used in extra

24、net access, not intranet, accessClient requests certificate from authority1Client sends certificate to application3Application decodes certificate4Certificate authority replies with certificate2321ClientApplicationCertificateAuthority31Best Practices When Using AuthenticationUse SSL to secure the au

25、thentication stream when necessarySecure the data streamUse Windows Integrated authentication for intranet applications 32 Introduction to Security for Intranet Applications Data Security Fundamentals Managing Identities Authenticating Identities in Intranet Applications Authorizing Identities in In

26、tranet ApplicationsAuthorizing Identities in Intranet Applications33Two options for authorization in intranet applications:Access control list - A list of security identities and actionsaccess control entriesthat apply to an objectRole-based access controlAuthorization Options for Intranet Applicati

27、ons34Access Control Lists Discretionary ACL (DACL) - identifies the trustees that are allowed or denied access to a securable object System ACL (SACL) - enables administrators to log attempts to access a secured object Use APIs to write ACLs; do not try to manipulate them directly35Impersonation Authentication package authenticates and builds security context Application or service uses the security context to impersonate the