Defending a system
Cyber security Lesson 5 2:04 English narration · English + 中文 subtitles burned in
Chapters
Transcript
Defences are usually given as a list, and that hides the point.
防御通常被列成一张清单，而那把重点藏起来了。
Draw them as rings instead.
改成画成一圈一圈。
An attacker coming from outside meets one wall after another: the firewall at the edge, then anti-malware on the machine, then access levels inside, and only then the data.
一个从外面来的攻击者会撞上一堵又一堵墙： 边界上的防火墙，然后是机器上的杀毒软件， 再然后是内部的权限分级，最后才是数据。
Each layer catches what the one outside it missed, and that is what defence in depth means.
每一层都接住了外面那一层漏掉的东西， 这就是"纵深防御"的意思。
Two things sit at the outermost ring.
最外面那一圈上有两样东西。
A firewall sits between your network and the internet and blocks traffic that breaks the rules you set.
防火墙坐在你的网络和互联网之间，拦下违反你所设规则的流量。
A proxy server stands in front of your servers, hiding and filtering what reaches them.
代理服务器挡在你的服务器前面，隐藏它们、过滤到达它们的请求。
Both work before anything important is touched — and the cheapest attack to stop is the one that never arrives.
两者都在任何重要东西被碰到之前起作用—— 而最省事的攻击，是那个根本没到达的攻击。
Then the software layer, and the dullest defence on the list is the one that matters most.
然后是软件那一层，而清单上最无聊的那条防御，恰恰是最要紧的。
A hole is found; a fix is released; you install it; the attack fails.
一个漏洞被发现；一个补丁被发布；你把它装上；攻击失败。
Skip the third box and the attack works.
跳过第三格，攻击就成功了。
Most successful attacks use old, known holes — attackers read the published fixes precisely to find machines that have not applied them.
大多数成功的攻击用的都是旧的、已知的漏洞—— 攻击者去读那些公开的补丁，正是为了找出还没打补丁的机器。
The innermost layer is about what happens AFTER something gets through.
最里面那一层，管的是有东西"已经进来之后"会怎样。
Give each person only the rights they need: a student account can reach their own work, a teacher account can reach class grades.
给每个人只给他需要的权限： 学生账号能看到自己的作业，教师账号还能碰到班级成绩。
So if a student account is broken into, the attacker still cannot change a grade.
于是，如果一个学生账号被攻破，攻击者依然改不了成绩。
The breach is contained, and lesson fifteen calls this least privilege.
入侵被控制在一小块范围内， 而第 15 课把这叫做"最小权限"。
Four things to take with you.
带走四点。
One: a firewall blocks traffic by rules at the edge.
第一：防火墙在边界按规则拦流量。
Two: anti-malware finds and removes known malware.
第二：杀毒软件找出并清除已知的恶意软件。
Three: updates close the old holes most attacks use.
第三：更新补上大多数攻击所利用的那些旧漏洞。
Four: access levels contain the damage when one account falls.
第四：权限分级在某个账号失守时把损害控制住。
Now do the tasks below.
现在去做下面的题。