【Entrust】金融业无纸化平台下的网络身份认证和数据安全策略（32页）.pptx

1、尹东梅,金融业无纸化平台下的网络身份认证和数据安全策略,行业要求及新规,2016年11月7日颁布的中华人民共和国网络安全法2016年9月30日，261号文,1,移动化应用场景,审批&签名,交易验证,手机逐渐代替电脑,物理访问,VPN 登陆,逻辑访问,2,移动化的可信身份保障,3,移动身份认证,4,实时欺诈监控,77.9%的网站仍在使用HTTP,5.2%的网站拥有不完整的证书链,19.2%仍然支持脆弱/不安全的加密网站,42.3%的网站仍然支持 SSL 3.0,https:/www.trustworthyinternet.org/ssl-pulse/,83.1%的主动攻击来自于“心脏流血”,5.

2、5%容易受到 CRIME 的攻击,36.7%不支持Forward Secrecy,无处不在的安全隐患,77.9%,5.2%,19.2%,42.3%,83.1%,5.5%,36.7%,5,新攻击方式及漏洞频现,HeartbleedExploit of Heartbeat extension in OpenSSL 1.0.1.(widely used in web servers,O/Ss)-Anything with OpenSSL is vulnerableFix:Update your version of OpenSSLReplace any keys and certificates o

3、n those machinesAsk users to change passwordsRemaining vulnerabilities:Many certificates replaced without replacing keys!,FREAKFactoring RSA Export(Android)KeysA MITM attack that forces browser to use weaker encryption key,providing attacker access to all encrypted infoResult of US govt policy preve

4、nting stronger encryption from being exportedFix:At server,disable support for insecure ciphersCheck your server at Remaining vulnerabilities:36%of servers still accept“export grade crypto”,POODLEPadding Oracle On Downgraded Legacy EncryptionAttacker can downgrade SSL/TLS sessionFix:Stop supporting

5、SSL 3.0(Browsers already doing this)Patch servers to avoid TLS vulnerabilitiesRemaining vulnerabilities:Check your server at,DROWNDecrypting RSA using Obsolete and Weakened eNcryptionAdapts an old SSLv2 vulnerability Can be used against any TLS protocol with same RSA keyFix:SSL v2 needs to be disabl

6、ed everywhere,without exception.But,this has always been the case,given that weve known about the various SSL v2 vulnerabilities for more than 20 years now,6,现状,Slow website performanceImproperly installed certificatesExpired certificatesMisconfigured serverUser security warnings,FREAKSuperFishPOODL