tailieunhanh - ecomm book hack proofing your ecommerce site phần 5

They của mọi người cần phải được nhận thức của bảo mật của bạn cần phải nhận thức được tác động là an ninhtừ, cùng một công ty sở hữu cả chủ thẻ và mối quan hệ thương gia và các bước trong như một | 250 Chapter 4 Designing and Implementing Security Policies of a successful penetration. If the intruder is able to reach a host s operating system he may still be thwarted by host-based intrusion detection host-based access controls and application level security. By a successive failure at every step or tier of the implementation an intruder may violate the company s acceptable use policy and thereby succeed in the targeted attack. But that assumes that every tier is implemented perfectly and contains no unknown security vulnerabilities which is not security at any tier depends on the success of security at every tier in succession. Perimeter security primarily concerns itself with lower protocol layers where policy can be enforced by limiting traffic flows at those layers. Host and applications security represents the upper protocol layers where session controls and application security can be used for enforcement. Network security mechanisms fill in any gaps between the two and perform logging and auditing enforcement functions. Let s look at a specific policy one that defines the kind of traffic allowed on the internal security policy specifies that certain kinds of traffic will be restricted it specifies what traffic the enforcement mechanism should restrict where in general terms it needs to restrict it and who is expected to implement the enforcement mechanism. In the case of data networking the how for enforcing this policy might be a firewall VPN or remote access solution. For internal network security how might be router access lists domain-based access controls and network traffic monitors. For host and application security how might be NT domain security TCP wrappers to log port connections and host-based intrusion social aspect is even covered by educating users and training recovery staff for handling incidents. Every tier implements the same policy just in a different way. We talked about policy managers .