Improve your Security #3: Online Protection
三步提高你的安全性：在线保护
It is usually said that those who are behind a hardware router are protected
from any danger. This is true in regard to the connections that come from
outside but it is not true for the dangers which come from inside the local
network. We must not forget that most of threats are landing on users’
computers via email or web traffic (either drive-by downloads or web bugs
and exploits). Thus it is important to use multiple layers when it comes to
online protection. For the sake of simplicity, I separated the protection
layers in three areas: External area, Network and Personal area.
我们通常说那些在硬件路由器后面的受到保护免遭任何危险。对于来自外面的连接这是正确的，
但是对于来自内部网络的连接却不正确了。我们一定不要忘记，大部分威胁进入到用户的电脑
是通过电子邮件或网络监控设置（要么路过式下载，要么网络漏洞和产品）。因此，当谈到在线保护
时，使用多层保护是重要的。为了简单，我把保护层分作三个区域：外部区域，网络和个人区域。
In each of these layers protection mechanisms have to make sure that each
category of threats can be filtered before it produces some damages to the
end user.
在每个层里面，保护机制必须确保每个威胁种类在它把破坏带到终端用户之前
能被过滤。
Layer 1
第一层
This security layer has to ensure that only the authorized applications are allowed to receive
and send data to other computers in the Internet. It mustn’t filter any connections which are
taking place inside the network area. This effect can be produced either with a hardware device
or with software and, in general, with a combination of both. Hardware devices are hardware
firewalls, routers, modems, NAT servers, and so on. Any device which can control the network
traffic coming from or going to outside the network can be used here. Software firewalls
installed on each device which connects to the network have also the same role.
这个安全层必须确保，在因特网里面，只有授权应用被允许接收和发送数据到其他计算机里。它不得过滤任何
发生在内部网络区域连接。这个作用要么被硬件部件产生，要么被软件产生，总之，要联合他们两个。
硬件部件有硬件防火墙，路由器，调制解调器，内部服务器，等等。任何能控制来自外部网络或出去外部网络的
网络通信的部件都能用在这里。安装在每个部件上的软件防火墙也具有相同的作用，这些部件连接到网络里。
Special devices
特殊部件
A special category of hardware which resides as this level is represented by proxies, network
monitors and network intrusion detection devices.
属于这个级别的硬件的一个特殊种类通过代-理，网络监视器和网络入侵检测设备来展现。
Proxies are devices which take the responsibility from the user to communicate with the
external network. This makes them extremely important, because if they fail, the user is
directly exposed to the raw, unfiltered data coming from the Internet. Example of proxies
are web proxies (Apache, Squid, IIS, etc.) and SMTP Servers.
代-理是负责用户连接到外部网络的设备。这使得他们非常重要，因为如果他们失败了，用户直接暴露在原始的
，没经过过滤的来自因特网的数据。代-理的例子有网络代-理（Apache，Squid，IIS等）和SMTP服务器。
Monitoring involves examining network traffic, activity, transactions, or behavior to detect
security-related anomalies. In medium-large companies there should be special appliances or
computers which filter and monitor the network traffic according to some policies. Monitoring
can also be implemented per protocol, thus such functions can be found in Web Proxies, Mail
proxies and so on.
监视器包括检查网络通信，活动，交易，或者行为，来发现与安全相关的反常现象。按照一些政策方针，大中型
公司应该有用于过滤和监视网络通信的特殊设备或计算机。监视器也可以用来实施每个协议，因此这些功能也能
在网络代-理，邮件代-理等找到。
A network intrusion detection system (NIDS) attempts to identify inappropriate activity on the
network. It provides the same functionality as a burglar alarm system — in case of a possible
intrusion, the system issues an alert. NIDS work on the principle of comparing new behavior
against normal or acceptable behavior previously defined. Usually, a NIDS device listens the
network traffic and when it founds something unusual it reacts accordingly:
网络入侵检测系统试图识别网络上不恰当的活动。它的作用相当于防盗警钟系统---如果发生可能的入侵，
该系统发出警报。NIDS的工作原理是，将新行为与正常的或预先定义可接受的行为作对比。一般地，NIDS设备
监听网络通信，当他发现不用寻常的东西时它会作出相应的反应：
- It creates a dynamic firewall rule to prevent a DoS
他创建一个动态的防火墙规则去防止DoS遭受威胁
- Saves the packets for further analysis
保存数据包作进一步分析
- Informs various entities that an attack is taking place
通知各单位发生攻击
- Terminates connections
终止连接
So, if monitoring is the passive element, a NIDS is the active element in a network.
因此，在网络里，如果监视器是个被动组件，那么NIDS是个主动组件。
Hardening the devices
强化组件
No matter how intelligent the devices at this layer are, they have the same problems as all
other devices which operate at any layer: they have bugs which can be exploited. Bugs can be
found in the software running on these devices as well as in hardware. This is why it is
important to keep these devices updated and replace them as soon as a newer and better version
is available. A very important factor which makes these devices heavier to exploit is to use
only the minimum services which are required for the device to perform its functions.
在这个层里面的组件无论多智能，他们与其他所有的运行在任何层里面的组件一样有相同的问题：他们有能被开发
利用的漏洞。运行在这些部件上的软件可以发现漏洞，硬件里也有漏洞。这就是为什么如此重要去持续组件升级
，并且只要有更新的和更好的版本可用，就会替换他们。让这些设备较重的开发的一个重要的因素
是，使用对服务需求最小的设备发挥其功能。
Layer 2
第二层
On this layer reside various software applications which can filter the received data for
malicious content. This includes web filters (filtering the protocols HTTP and FTP), Antispam
and Antiphishing filters, IM filters, etc.
这一层属于各种软件应用，软件能够过滤接收到的数据中的恶意内容。这包括网络过滤（HTTP协议和FTP协议
过滤），发垃圾邮件和反网络钓鱼过滤，即时通信过滤等。
A special category of programs operating at this level are applications which monitor the
behavior of other applications. They can be Host Intrusion Prevention Software or a special
component in the operating system (like Data Execution Prevention in Windows).
运行在这个级别的程序的特殊分类是应用程序，这些应用程序监视其他应用程序的行为。他们可能是主机入侵防御软件
或者操作系统里的一个特殊组件（像Windows的数据执行保护）。
Lately, because of the publicity made for tools like Firesheep a new category of programs
started to become more popular: session encryption software. This kind of software can be
integrated inside a browser and practically encrypts all the data transferred between the
user and some websites. Since not all websites have the capability to encrypt the traffic,
the effect of such tools remains limited.
最近，因为宣传有助于像Firesheep这类工具，一种新的程序种类开始变得更受欢迎：会议加密软件。
这种软件能被整合到浏览器里面，并且几乎可以将所有在用户和一些网页之间转移的数据加密。
由于并不是所有的网页有能力将通信加密，这类软件的作用仍然有限。
Layer 3
第三层
This layer is the last and represents the end user. This can be a real person (usually) or
a layer of software which performs some tasks automatically. Let’s assume that we have a user
standing in front of his computer. No software can fully protect the user against all threats.
The reason for this is not that the software is bad but because the security software is not
allowed to operate in the same way as the malicious software does. This is why the last
category will always have an advantage over the security software. What the malicious software
does illegally, the security software has to do with a lot of work and intelligence.
这一层是最后的，并且代表终端用户。这可能是一个真实的人类（通常地），或者自动执行某些任务的一层软件。
我们假设，我们有一个用户站在他的计算机前。没有软件能够完全保护用户免遭所有威胁。原因并不是软件差，
而是因为安全软件不被允许做恶意软件所做的同样的操作。这就是为什么最后的种类总是由优于安全软件。
恶意软件做了些什么，安全软件必须处理更多工作和情报。
So, the last barrier between the fraudsters which want to take control of the user’s computer
and private data is the user himself. In cyber attacks the human factor plays a very important
role: It can decide if an attack is successful or not. If the user makes sure that the data is
correctly structured (not everything in one place) and protected (maybe not necessarily stored
local, but at least encrypted), the damages which an external attacker can do can be close to
zero.
因此，在欺诈之中，想控制用户电脑和私人数据的最后的屏障是用户自己。在网络攻击里，人为因素扮演着重要
的角色：他能够决定攻击是否成功。如果用户确保数据被正确构成（不都在一个地方）和被保护（可能没必要储
存在本地，但至少加密），外部攻击者所能造成的破坏接近于零。
If the user deactivates the security software for whatever reason, if he ignores the warnings
he receives and provides all kind of information to any website he sees, then no software can
prevent this.
如果用户无论什么原因都关闭他的安全软件，如果他忽略收到的警报并且发送所有种类信息到任何他看到的网页，
那么没有任何一款软件能够防止入侵。
原文出处：http://techblog.avira.com/en/
|
发表于 2011-3-3 08:26:15
楼主
求加技术魅力
这次来真的了
发表于 2011-3-3 13:02:25
学习下
