untitled

Size: px

Start display at page:

Download "untitled"

せとかかなり
5 years ago
Views:

1 Special Publication Peter Mell Karen Kent Joseph Nusbaum

3 NIST Special Publication Peter Mell Karen Kent Joseph Nusbaum Gaithersburg, MD Carlos M. Gutierrez Michelle O'Neill William A. Jeffrey

5 NIST: National Institute of Standards and TechnologyNIST ITL: Information Technology Laboratory NIST Special Publication 800 Special Publication Special Publication iii

6 Peter MellNISTKaren Kent Joseph Nusbaum Booz Allen Hamilton Tim Grance Murugiah SouppayaNISTGaglianoThomas Goff Pius Uzamere3 Booz Allen Hamilton Mike DanseglioMicrosoftKurt DillardMicrosoftMichael GerdesGetronics RedSiren Security SolutionsPeter SzorSymantec Miles Tracy Lenny ZeltserGemini Systems LLC NIST Special Publication iv

7 Web v

8 A... A-1 B... B-1 B.1... B-1 B.2... B-2 C... C-1 D... D-1 E... E-1 F... F-1 G...G vi

9 A A-2 A A-6 A-3... A-8 A-4... A-10 A-5... A-12 vii

12 IT NIST NIST Special Publication Recommended Security Controls for Federal Information SystemsSystem and Information Integrity NIST Special Publication Computer Security Incident Handling Guide 4 Copyright 2008 NRI ES-2

17 Federal Information Security Management Act of FISMA National Institute of Standards and TechnologyNIST NIST Office of Management and Budget OMB CircularA-130 8b3 Securing Agency Information Systems A-130 IVAnalysis of Key Sections A-130 III Copyright 2008 NRI 1-1

24 JavaActiveXJavaScriptVBScript Nimda 1 JavaScript 2.5Nimda 2.5 Nimda 7 4 HTML Web Nimda Nimda Windows Nimda Windows NetBIOS Nimda Web Nimda Web Microsoft IIS Web Web Nimda Web P2P Nimda Nimda Bugbear Bugbear 2.6 Web 8 1 Web 7 8 Nimda CERT /CC CA Nimda CERT /CC Advisory CA Nimda Wormhttp:// Web Copyright 2008 NRI 2-6

26 + 9 DDoS DDoS Trinoo Tribe Flood Network + RAT RAT Web RAT SubSevenBack OrificeNetBus PIN KeySnatchSpysterKeyLogger Pro UNIX Linux Windows OS LRK5KnarkAdoreHacker Defender Web Web Web Web Web Web 9 10 Copyright 2008 NRI 2-8

29 1 Web Web OS Good Times Morris Melissa 1999 LoveLetter Threat Assessment of Malicious Code and Human Threats Lawrence E. BasshamW. Timothy Polk NIST Short History of Computer Viruses and AttacksBrian KrebsWashington Post Virus TimelineInfoplease Copyright 2008 NRI 2-11

36 IT IT IT IT IT U.S. Computer Emergency Readiness TeamUS-CERT NIST SP Creating a Patch and Vulnerability Management Programhttp://csrc.nist.gov/publications/nistpubs/index.html MITRE Corporation Common Malware EnumerationCME CME CME Copyright 2008 NRI 3-4

38 OS OS IPS NIST SP IT Security Configuration Checklists Program for IT Productshttp://csrc.nist.gov/checklists/ NIST SP Guideline on Network Security Testinghttp://csrc.nist.gov/publications/nistpubs/index.html Copyright 2008 NRI 3-6

47 28 IP IP Web HTTP Hypertext Transfer Protocol NAT NAT NAT 1 NAT IP 10 IP IETFInternet Engineering Task Force RFCRequest for Comment2267Network Ingress Filtering: Defeating Denial of Service Attacks Which Employ IP Source Address Spoofing IP Copyright 2008 NRI 3-15

4. NIST SP 800-61Computer Security Incident Handling 4-1 SP 800-61 4-1 4.

83 Witty Cooperative Association for Internet Data Analysis CAIDA 1 42 Witty 1 1 Witty OS 1 42 The Spread of the Witty Wormhttp:// CAIDA Slammer The Spread of the Sapphire/Slammer Worm 10 Witty Slammer The Top Speed of Flash Wormshttp:// Copyright 2008 NRI 5-1

105 C Antivirus Software Backdoor TCP UDP Blended Attack Boot Sector VirusMBR Compiled Virus Cookie Web Deny by Default Disinfecting Egress Filtering False Negative False Positive File Infector Virus Host-Based Intrusion Prevention System Indication Ingress Filtering Interpreted Virus Keystroke Logger Copyright 2008 NRI C-1

106 Macro Virus Malicious Code Malware Mass Mailing Worm Memory Resident Mobile Code Multipartite Virus Network Service Worm Network-Based Intrusion Prevention System Obfuscation Technique On-Access Scanning On-Demand Scanning Payload Persistent CookieWeb Phishing Precursor Copyright 2008 NRI C-2

107 Proxy Quarantining Remote Administration Tool Rootkit Session Cookie Web Signature Spyware Spyware Detection and Removal Utility Tracking Cookie Web Trigger Trojan Horse Virus 1 Web Web Browser Plug-In Web Web Web BugWeb HTML Web Worm Zombie Copyright 2008 NRI C-3

109 D ACL APWG ASC AVIEN BIOS CAIDA CARO CD CIAC CME CSRC DDoS DNS DShield DVD EICAR FAQ FISMA FTC FTP HTML HTTP ICMP ID IDS IETF IIS IP IPS ISC IT ITL MAC MBR NAP NAT Access Control List Anti-Phishing Working Group Anti-Spyware Coalition Anti-Virus Information Exchange Network Basic Input/Output System Cooperative Association for Internet Data Analysis Computer Antivirus Research Organization Compact Disc Computer Incident Advisory Capability Common Malware Enumeration Computer Security Resource Center Distributed Denial of Service Domain Name System Distributed Intrusion Detection System Digital Video Disc European Institute for Computer Antivirus Research Frequently Asked Questions Federal Information Security Management Act Federal Trade Commission File Transfer Protocol Hypertext Markup Language Hypertext Transfer Protocol Internet Control Message Protocol Identification Intrusion Detection System Internet Engineering Task Force Internet Information Services Internet Protocol Intrusion Prevention System Internet Storm Center Information Technology Information Technology Laboratory Media Access Control Master Boot Record Network Access Protection Network Address Translation Copyright 2008 NRI D-1

110 NIST NSRL OMB OS PDA PIN RAT RFC SI SMTP SP TCP UDP USB US-CERT VBScript VLAN VPN National Institute of Standards and Technology National Software Reference Library Office of Management and Budget Operating System Personal Digital Assistant Personal Identification Number Remote Administration Tool Request for Comment System and Information Integrity Simple Mail Transfer Protocol Special Publication Transmission Control Protocol User Datagram Protocol Universal Serial Bus United States Computer Emergency Readiness Team Visual Basic ScriptVisual Basic Virtual Local Area Network Virtual Private Network Copyright 2008 NRI D-2

111 E Erbschloe, Michael.Trojans, Worms, and Spyware:A Computer Security Professional's Guide to Malicious Code.Butterworth-Heinemann, Feinstein, Ken. How to Do Everything to Fight Spam, Viruses, Pop-Ups, and Spyware.McGraw-Hill Osborne Media, Grimes, Roger.Malicious Mobile Code:Virus Protection for Windows.O Reilly, McClure, Stuart, et al.hacking Exposed:Network Security Secrets & Solutions, Fifth Edition.McGraw-Hill Osborne Media, Nazario, Jose.Defense and Detection Strategies Against Internet Worms.Artech House Publishers, Prosise, Chris, et al.incident Response and Computer Forensics, Second Edition.McGraw- Hill Osborne Media, Schweitzer, Douglas.Securing the Network from Malicious Code:A Complete Guide to Defending Against Viruses, Worms, and Trojans.Wiley, Skoudis, Ed, and Lenny Zeltser.Malware:Fighting Malicious Code.Prentice Hall PTR, Szor, Peter.The Art of Computer Virus Research and Defense.Addison-Wesley, Tittel, Ed. PC Magazine Fighting Spyware, Viruses, and Malware. John Wiley & Sons, Virus Bulletin ().Virus Bulletin Ltd. Copyright 2008 NRI E-1

113 F Anti-Phishing Working GroupAPWG Anti-Spyware CoalitionASC Anti-Virus Information Exchange NetworkAVIEN Common Malware EnumerationCME Computer Antivirus Research OrganizationCARO Computer Incident Advisory CapabilityCIAC Cooperative Association for Internet Data AnalysisCAIDA Distributed Intrusion Detection SystemDShield European Institute for Computer Antivirus ResearchEICAR Internet Storm CenterISC SANS Institute United States Computer Emergency Readiness TeamUS-CERT Virus Bulletin Viruslist.com WildList Organization International URL C Net Download.com Spyware Center Computer Associates Virus Information Center CSRC Practices & Checklist/Implementation Guides F-Secure Security Information Center McAfee AVERT Virus Information Library SANS Malware FAQ SecurityFocus Virus Sophos Virus Analyses Spywaredata.com Symantec Security Response Search and Latest Virus Threats Page Trend Micro Virus Encyclopedia Search Unassigned IP Address Ranges Vmyths.com Truth About Computer Virus Myths & Hoaxes URL px html Copyright 2008 NRI F-1

114 Focus-Virus F-Secure Radar Incidents McAfee AVERT Alerts Sophos Notification Symantec Security Response Alerting Offerings Trend Micro Newsletters URL CAIDA, The Spread of the Sapphire/Slammer Worm CAIDA, The Spread of the Witty Worm CAIDA, The Top Speed of Flash Worms CARO, CARO Virus Naming Convention FTC, How Not to Get Hooked by a Phishing Scam IETF, RFC 2267, Network Ingress Filtering:Defeating Denial of Service Attacks Which Employ IP Source Address Spoofing Infoplease, Computer Virus Timeline Microsoft, The Antivirus Defense-in-Depth Guide NIST, SP , Guidelines on Active Content and Mobile Code NIST, SP , Intrusion Detection Systems NIST, SP , Creating a Patch and Vulnerability Management Program NIST, SP , Guideline on Network Security Testing NIST, SP , Guidelines on Electronic Mail Security NIST, SP , Recommended Security Controls for Federal Information Systems NIST, SP , Computer Security Incident Handling Guide NIST, SP , Security Configuration Checklists Program for IT Products NIST, SP , Guide to Applying Forensic Techniques to Incident Response NIST, Threat Assessment of Malicious Code and Human Threats Washington Post, A Short History of Computer Viruses and Attacks URL ire.html s/topspeed-worm04.pdf curity/avdind_0.mspx Copyright 2008 NRI F-2

115 G Host scan, 4-20, 4-25 IT, 4-7 Web, 3-17 Web, 2-7, C-3 Web, 3-18 Web, 2-9, C-3., 4-5, 2, 3-17, 3-21, 3-11, 3-13, 3-15, 3-20, 4-1, A-1, 4-1, B-1, B-1, 4-1, 4-2, B-1, 4-24, 4-27, B-1, 4-1, 4-5, 4-1, 4-21, 4-26, 4-8, 4-16, 4-18, 4-20, 4-19, 4-1, 4-25, 4-1, 4-11, 4-23, 4-25, A-1, 4-14, 4-11, 4-12, 4-15, 4-1, 4-23, 4-27, 4-10, 1, 2,, 3, 4, 4, 3, 4, 3, 4, 1, 3-1, 2-1, 2-11, 2-12, 2-14, C-3, 2-1, 2-2, 2-11, 2-12, C-1, 2-1, 2-11, 2-12, C-1, 2-3, 2-12, 2-3, 2-1, 2-4, 2-2, 2-12, C-1, 2-2, 2-12, C-1, 2-1, 2-3, 2-2, 2-12, C-2, 2-3, 2-2, C-2, 2-11, 2-14, 2-3, 2-3, 2-3, 2-12, C-2, 2, 2-4, 3-1, 3-7, 3-21, C-1, 3-7, C-2, 3-8, 3-7, 3-7, 3-9, 3-7, C-2, 2-8, 2-12, C-1., 2-7, 3-18, C-1, 2-7, C-3, 2-7, C-2, 2-7, C-3, C-3, 1, 2-1, 2-5, 3-11, 5-1, C-3, 3-11, C-3, 3-12, 3-17, 4-7., 4-24, 4-24, 2-8, C-3, 3-15, C-1, C-3, 3, 2-4, 2-12, 2-13, 2-14, C-3, 3-15, 4-19, 4-4, 4-19, 2-7, 2-12, C-1, 3-1, 3-5, 3-20, 3-8, 2, 3-14, 3-14, 3-14, 3-16, 3-21, 1, 2-10, 2-14, 3-3, 5-1, C-2, 3-8, C-1, 3-8, C-1, 3-11, 5-1, 3-15, C-3, 4-4, C-2. Copyright 2008 NRI G-1

116 , 3-6, 2-8, 3-18, 1, 3-1, 4-24, 3-1, 3-20, 3-19, 1, C-2, 5-1, 2-11., , 2-5, C-2, 4-7, 2-8, 2-12, C-3, 2, 3-14, 3-16, 3-21, 3-16, 4-18, 2-8, 2-12, C-3, 4-18, 4-18, 4-19, 2-4, 2-6, 2-12, 2-14, C-3, 2-4, 2-13, C-2, 2-4, 2-13, C-2, 1,, 2-5, 2-6, 2-12, 2-13, 2-14, 3-18, 3, 1, 2, 3-2, 3-20, 4-1, 4-15, :, C-3, C-1, A-1, A-1, :, A-1, A-1, 1, 2, 3-5, 3-6, 3-20, 3, :, 2-5, 2-7, :, 2-6, 2-12, 2-13, C-1, 3-5, :, 3-5, 3-15, C-1, 4-10, 2, 3-12, 4-19, 3-12, 3-21, 4-13, C-2, 3-13, C-1, 3-4, 1, 2, 3-4, 3-20,, 4-20, 4-5, C-2, 4-5, 4-7, C-1, 3-17, 4-14, 4-23, 3-19, 4-13, 2-9. :, C-2, 3-15, C-1. :. :, 2-8, 3-13., 4-3 Copyright 2008 NRI G-2

今企業が取るべきセキュリティ対策とは策

今企業が取るべきセキュリティ対策とは策 AGENDA 2 2 2002 Symantec Corporation. 70,000 (Code Red, Nimda) Number of Known Threats 60,000 50,000 40,000 30,000 20,000 DOS (Yahoo!, ebay) (Love Letter/Melissa) 10,000 (Tequila) 3 3 2002 Symantec Corporation.