Securing Applications and Data
AP Cybersecurity Topic 5 9:47 English narration · English + 中文 subtitles burned in
Chapters
Transcript
A company spent a fortune on firewalls, locked doors and strong passwords.
一家公司在防火墙、门禁和强密码上花了大价钱。
Then somebody typed a few strange characters into a login box — and the database opened.
后来有人在登录框里输入了几个奇怪的字符——数据库就打开了。
No password was ever guessed.
没有人猜出任何密码。
The application simply believed what the user typed.
应用程序只是相信了用户输入的东西。
Unit Five.
第五单元。
The programs and the data are the target now.
这一次，程序和数据就是目标。
If a normal user is given administrative privileges, an adversary who steals that account gains sweeping power.
若普通用户被赋予管理权限，对手一旦盗取该账户就获得极大权力。
We will name the injection attacks, decide who may touch which file, and lock the data itself with cryptography.
我们会说出各种注入攻击的名称，决定谁可以接触哪个文件， 并用密码学把数据本身锁起来。
Let's begin.
让我们开始吧。
Four attacks, and the exam wants all four by name.
四种攻击，考试要求你能说出全部四个名字。
SQL injection puts database commands into an input box, to read or change records.
SQL 注入把数据库命令塞进输入框，用来读取或修改记录。
Cross-site scripting, X S S, injects a script that runs in another user's browser.
跨站脚本注入一段脚本，它随后在别的用户的浏览器里运行。
A buffer overflow sends more data than the buffer can hold, so it spills into nearby memory and runs the attacker's code. And directory traversal climbs out of the folder to reach forbidden files.
缓冲区溢出发送的数据超过缓冲区能容纳的量，于是溢出到旁边的内存， 并可能运行攻击者的代码。
Data validation stops all four: check what arrives before you trust it.
目录遍历则爬出文件夹，去访问它本不该看到的文件。
Before we protect data, we must say where it is.
在保护数据之前，先要说清楚它在哪里。
Data at rest sits on a drive.
静态数据存放在硬盘上。
Data in transit is moving between devices.
传输中数据正在设备之间移动。
Data in use is being processed right now.
使用中数据此刻正在被处理。
The first two can be encrypted, so a thief who steals the drive reads nothing.
前两种可以加密，这样小偷即使偷走硬盘也读不到内容。
Data in use must be decrypted, so access control guards it instead.
使用中数据必须解密才能处理，所以改由访问控制来守护它。
Some data is regulated — the law says how you must store and handle it.
有些数据是受监管的：法律规定了你必须如何存储、传输和处理它。
An organisation that collects it must label the data and hold policies that keep storage, transmission and handling compliant.
收集这类数据的组织必须给它贴标签，并制定政策，使存储、传输和处理保持合规。
Learn three pairs.
记住三组配对。
Personally identifiable information, P I I, is anything that identifies a person; the Privacy Act covers it, with COPPA for children.
个人身份信息是任何能识别出某个人的信息， 由《隐私法》管辖，儿童则适用 COPPA。
Protected health information, P H I, covers treatment and payment records; its law is HIPAA.
受保护健康信息涵盖治疗和付费记录，它的法律是 HIPAA。
Payment card information means the card number and security code; its rules are PCI DSS.
支付卡信息指卡号和安全码，它的规则是 PCI DSS。
Compliance means meeting those rules, and each state may add its own. Remember the ladder: data labelled high sensitivity needs stronger protection than moderate, and unencrypted storage of any of it is the finding an auditor writes up first.
还要记住这个阶梯：数据越敏感，保护就要越强。
Access control decides which subjects — users — may perform which operations on which objects, the files.
访问控制决定哪些主体——也就是用户——可以对哪些客体，也就是文件， 执行哪些操作。
Four models, each with a different decider.
有四种模型，每种的决定者都不同。
Role-based — R B A C — follows your role: every accountant reaches payroll.
基于角色的访问控制看你的角色：所有会计都能进入工资系统。
Rule-based, RuBAC, follows a condition, like office hours.
基于规则的访问控制看条件，比如只在办公时间内。
Discretionary, D A C, lets the owner decide.
自主访问控制由文件的所有者决定。
Mandatory, M A C, puts a central administrator in charge, and the Bell-LaPadula model is the classic example.
强制访问控制则交给中央管理员。
Above all four sits the principle of least privilege: only the access needed, no more.
凌驾于四者之上的是最小权限原则：只给需要的权限，不多给。
On a Linux system every file carries three permissions — read, write and execute — for three groups: the owner, the group, and everyone else.
在 Linux 系统里，每个文件都带有三种权限——读、写、执行—— 分别对应三个群体：所有者、组、以及其他所有人。
Read is four, write is two, execute is one.
读是四，写是二，执行是一。
Add up what each group needs, then write the three digits in order.
把每个群体需要的权限加起来， 再按顺序写下这三个数字。
Here the owner has all three, making seven; the group has read only, four; others get nothing, zero.
这里所有者三种权限都有，加起来是七； 组只有读，是四；其他人什么都没有，是零。
The exam's favourite question.
考试最爱考的题目。
A head teacher wants only herself to read and edit a file. Her staff group may read it. Nobody else may touch it.
一位校长希望只有她自己能读和修改一个文件， 她的员工组可以读，其他人一律不能碰。
The owner needs read and write: four plus two makes six.
所有者需要读和写：四加二等于六。
The group needs read only: that is four.
组只需要读：也就是四。
Others get nothing: zero.
其他人什么都不给：零。
So the command is chmod six four zero.
所以命令就是 chmod 六四零。
Written as letters, that is read-write, then read, then nothing.
写成字母，就是可读可写、然后只读、然后什么都没有。
And if she also wanted to run the file, add execute to make seven.
如果她还想运行这个文件，就再加上执行，变成七。
Now we lock the data itself.
现在我们来锁住数据本身。
Cryptography hides information.
密码学的作用是隐藏信息。
An encryption algorithm mixes plaintext with a key to produce ciphertext, and decryption reverses it.
加密算法把明文和密钥混合产生密文，解密则把这个过程反过来。
This machine is an Enigma, used in the Second World War.
这台机器是恩尼格玛密码机，在第二次世界大战中使用。
Its rotors scrambled every letter, and for years it looked unbreakable — until it was broken.
它的转子把每一个字母都打乱，多年里它看上去无法破解——直到它被破解。
The number of possible keys is called the keyspace.
可能密钥的数量叫做密钥空间。
Every extra bit doubles it, so a longer key takes far longer to guess.
密钥每多一位，密钥空间就翻一倍， 所以更长的密钥要猜的时间长得多。
Symmetric encryption uses the same key to lock and to unlock.
对称加密用同一把密钥来加锁和解锁。
The standard is AES, a block cipher that protects your Wi-Fi, your browsing and your files.
标准算法是 AES，一种分组密码，它保护着你的无线网络、上网和存储的文件。
But both sides need the same secret key — so how do you hand it over safely?
但双方都需要同一把秘密密钥——那你要怎么安全地把它交给对方呢？
Here are the two families side by side.
把两大类放在一起看。
On one side, one shared key does both jobs — fast, but you must deliver that key somehow.
一边是一把共享密钥同时完成两件事——速度快， 但你必须设法把它送到对方手上。
On the other, a pair of keys: one everybody may see, one nobody else ever sees.
另一边是一对密钥： 一把人人都能看到，另一把谁也见不到。
Whatever the first locks, only the second unlocks.
第一把锁上的东西，只有第二把能打开。
Look at the direction carefully, because this is where marks are lost.
请仔细看方向，因为分数就丢在这里。
To send Bob a secret you encrypt with Bob's public key — the key he publishes openly.
要给鲍勃发送秘密， 你用鲍勃的公钥加密——那是他公开发布的密钥。 密文随后传输出去。
Only Bob's private key, which never leaves him, turns it back into the message. No secret was shared in advance.
只有鲍勃的私钥，也就是从不离开他的那把钥匙， 才能把它变回原来的消息。
The common algorithms are RSA and elliptic curve cryptography, E C C — and note that a key pair only works within the same algorithm.
事先没有共享过任何秘密。 常见的算法是 RSA 和椭圆曲线密码学。
Good software is safe before it ships.
好的软件在发布之前就是安全的。
Secure by design means security is built into every phase of development, not bolted on at the end. The three commitments have names worth using: take ownership of its customers' security outcomes, radical transparency and accountability, and organisational structure and leadership that puts security first.
安全设计意味着安全被融入开发的每一个阶段， 而不是最后才加上去：公司要对客户的安全结果负责、公开地分享问题， 并由领导层带头抓安全。
Secure by default means the product arrives with its protections already enabled.
默认安全意味着产品到手时，保护功能已经处于开启状态。
And the best answer for injection attacks is input sanitization: reject the special characters that can bend a system.
而应对注入攻击最好的答案是输入清理：拒绝那些能操纵系统的字符。
Protecting applications starts before the first line of code.
保护应用程序，要从写第一行代码之前就开始。
Secure by design builds security into every phase, not as an afterthought.
安全设计把安全写入每一个开发阶段， 而不是事后补上。
Secure by default means the product ships with those protections already enabled.
默认安全意味着产品出厂时，那些保护已经打开。
The company must take ownership of its customers' security outcomes, share problems quickly, and put leadership behind the work.
公司必须对客户的安全结果负责，迅速公开问题，并由领导层推动这项工作。
Input sanitization then rejects the quote, the double quote and the semicolon, so injection never reaches the query.
然后输入清理会拒绝单引号、双引号和分号，注入就到不了查询。
A paper may show a login box and ask how you stop the injection.
试卷可能给出一个登录框，问你怎样拦住注入。
Pause and name the defence.
先暂停，说出防御的名称。
Step one: special characters can rewrite a query.
第一步：特殊字符能改写一条查询。
Step two: sanitization rejects them before processing.
第二步：清理在处理之前拒绝它们。
Step three: that same door stops SQL injection, XSS and directory traversal together.
第三步：同一道门同时拦住 SQL 注入、跨站脚本和目录遍历。
The mark is the name of the defence, not a list of attacks.
得分点是防御的名称，不是一串攻击名单。
How do we notice an attack?
我们怎样才能察觉到攻击呢？
Systems keep accounting records — logs of who reached what, and when.
系统会保留审计记录——记录谁在什么时候访问了什么。
But a busy network writes far more lines than anyone can read, so log analysis must be automated.
但繁忙的网络写下的日志远远超过任何人能读完的量，所以日志分析必须自动化。
A honeypot is cheap and clever: a fake file that looks valuable.
蜜罐既便宜又巧妙：一个看起来很值钱的假文件。
Nobody has an honest reason to open it, so any access at all is an immediate alarm.
没有人有正当理由去打开它，所以任何一次访问都立刻是警报。
Cost matters too — honeypots are nearly free, a data loss prevention service is not.
成本也很重要——蜜罐几乎免费，数据泄露防护服务却不是。
Hashes give us a second detector.
哈希给了我们第二种探测手段。
Run a file through a hash function and you get a short digest.
把一个文件送进哈希函数，会得到一段短短的摘要。
Change one character and the digest changes completely — watch it here.
只要改动一个字符，摘要就完全变了——看这里。
Store the digest of an important file, then calculate it again later.
所以先把重要文件的摘要存下来，过一段时间再算一次。
If the two do not match, the file was altered.
如果两者对不上，说明文件被改动过。
Cryptographic hashes are near-instantaneous to check, which is why data loss prevention — D L P — tools use them to spot anyone trying to delete or copy sensitive files.
密码学哈希几乎瞬间就能校验，所以数据丢失防护（DLP）工具用它来发现 任何试图删除或复制敏感文件的人。
Finally, the skill the exam tests most: read a log, name the attack.
最后，是考试最常测的技能：读日志，说出攻击的名称。
This line contains or one equals one, followed by two dashes — that is SQL injection, and the dashes hide the rest of the query.
这一行里有"或者一等于一"，后面跟着两个短横——这是 SQL 注入， 两个短横把查询的其余部分藏了起来。
This line carries a script tag where a user name should be — cross-site scripting.
这一行在本该是用户名的地方带着脚本标签—— 跨站脚本。
This one is full of dot dot slash sequences climbing toward the password file — directory traversal.
这一行满是"点点斜杠"，一路往密码文件爬——目录遍历。
And this one is one field holding thousands of identical characters — a buffer overflow.
而这一行是一个字段里塞了成千上万个相同的字符——缓冲区溢出。
Four things to carry away.
带走四件事。
Read the log, and the evidence names the attack.
读日志，证据会告诉你攻击的名称。
Know the decider: role, condition, owner, or admin.
记住决定者：角色、条件、所有者，还是管理员。
Add four, two and one for each group when you set permissions.
设置权限时，为每个群体把四、二、一加起来。
And symmetric shares one key, while asymmetric solves the sharing problem.
还有，对称加密共用一把密钥，非对称加密解决了分发的问题。
Three marks students throw away.
三个学生常丢的分。
First, never answer that a log looks suspicious — quote the evidence and name the attack.
第一，绝不要只回答"这条日志看起来可疑"—— 要引用证据，并说出攻击的名称。
Second, practise permissions in both directions: numbers into letters, and letters back into numbers.
第二，权限要双向练习： 数字换成字母，字母再换回数字。
Third, when you send a secret you encrypt with the recipient's public key, never your own private key.
第三，发送秘密时， 你要用接收者的公钥加密，绝不能用自己的私钥。
Get those right, and this unit is yours.
把这些做对，这个单元就是你的了。