Skip to content

白名單的原理 : 讓誰進家門?

應用程式白名單是防止未知軟體在電腦上執行的有效方法。NIST 為應用程式白名單提供了良好的遵循建議: “應用程式白名單是根據定義明確的基準上,授權在主機上允許執行應用程式及其元件和(程式庫等等)清單”。應用程式白名單機制在現實運作中是直接有效的理由是,對比於黑名單,你必須事先知道一切可能的壞人特徵點;顯然時效性與有效性都大打折扣。此外,黑名單方式無法有效面對未知威脅。

應用程式白名單技術恰好相反,僅允許預先核准的程序、可執行程式、程式庫和服務在系統上執行,同時阻止執行其他所有程式執行。當應用程式嘗試執行時,它會根據清單自動檢查,如果符合規則,就允許執行。 應用程式白名單技術正好遵循預設拒絕及最少授權的安全規範,這種模式比純粹防病毒技術或 IDS 應用的黑名單方法要嚴格得多、限制性更強,被SANS,NIST認為是最佳安全建議之一。例如他們將關鍵基礎建設安全控制設施(現在由 CIS 維護)納入應用程式白名單機制,作為最基本的安全措施 。

 

白名單的好處

降低被攻擊面

基於除了白名單中的程式之外,防止未經授權任何程式執行,這樣大大降低了惡意程式或使用者的攻擊面。在網際網路上有一大堆不知名程式,有人可能需要或不小心下載,其中一些可能有意料之外的副作用或者就是惡意程式;在白名單機制之下,預設是被禁止執行的。

 

降低保護時間差

安全的維護不再過於依賴無時無刻永、無止境的安全性更新維護。不論作業性統、防毒軟體、文書軟體,一直需要持續更新修補漏洞,才免於被惡意程式利用。當然更新修補很重要,然而,從漏洞被發現到修補機制完成,存在一定的時間差。

 

預防未經授權存取

如果不在白名單上的應用程序嘗試執行,則會被阻止。這點可以防止惡意程式存取檔案資源、網路資源,以及安裝沒有授權的軟體。例如,軟體本身不安全、浪費計算資源(P2P)、或者有授權疑慮等。

 

阻止未知的惡意程式

與傳統的防病毒軟體相反,並不依賴於已知的簽章特徵或其他啟發式檢測方法。這就是為什麼”未知”惡意檔可以被阻止。

 

消減基本攻擊和下載執行的攻擊方式

應用程式白名單減輕了一大堆的基本攻擊,SANS,Gartner等研究都確認大多數攻擊(80-90%),可以透過簡單的應用程式白名單機制阻止。

 

攻擊者被迫使用更刁鑽方式或更換目標

攻擊者必須尋找其他工具和方法,使其程式看起來正常,以通過該白名單機制的防守。這將加深攻擊的難度,駭客被迫投入時間和精力成本在準備攻擊程序方法,這可能導致他們尋找更弱的目標受害者。

 

收集用來事故應變的證據資訊

應用程式白名單追蹤哪些可執行檔被阻止,哪些應用程式正在組織內系統上被執行,也可以監測任意不必要的命令及工具的執行情況, 而且偵測未經授權的更改。 攻擊活動所產生的活動軌跡記錄就會出現。 由於初始攻擊準備活動被阻止或被記錄,更容易被發現可能的攻擊活動。

 

因此應用程式白名單提高了程式執行的可見性和對應訊號跡象,從而為事故應變應團隊提供了有價值的資訊。

 

白名單的缺點與限制

白名單機制最大挑戰莫過於,適當而及時的維護。面對多變現實的環境,每天都有作業系統的修補更新,應用程式更新,驅動程式更新。在一般的使用者環境,更容易造成業務運作不便。

  1. 信任程式的認可管理

    這是在管理應用程式白名單解決方案時面臨的主要挑戰。處理這一挑戰的兩種選擇。第一種選擇是賦予管理者或使用者責任,自行負責識別和驗證白名單的應用程式。另一種選擇是依靠已驗證的由第三方威脅情報服務,提供信任應用程式的資料庫。

  2. 白名單內容更新管理

    將應用白名單與修補程式收集管理是另一個重要的挑戰。在白名單中的當應用程式,其識別屬性參數(Hash或Signature)被保留以供規則比對。當已安裝更新或修補程式之後,應用程式的標識屬性參數將被變更,從而與白名單的內容不一致而被拒絕執行。此問題可能需要透過信任機制來解決,信任的更新程式,如windows updater,或信任的使用者,所更新的修補或程式,有條件的自動加入白名單中 。

  3. 偽造供應商憑證

    當前的技術可以驗證和檢查應用程式數位簽章名的有效性,但在對應用程式白名單解決方案的挑戰是偽造供應商的簽章憑證。有許多使用被盜憑證證書的惡意軟體案例 ,如果安全策略允許憑證軟體,則惡意軟體將會被誤認為是來自特定的供應商的應用程式。

  4. DLL 白名單影響效能

    當應用程式白名單延伸到包括DLL(動態連結庫) 白名單,載入應用程式時對效能有相當大的影響。 雖然DLL白名單提供了更好的安全附加優勢,但考慮到性能衰退問題成了一個艱難的取捨。

 

結論

應用白名單正在逐漸演變為解決零日威脅的有效的方案, 此方法僅允許列入白名單的執行應用程式,而所有其他應用程式被阻止;就不用擔心修補空窗,甚至是未被揭露的漏洞被利用。基於這些特點,可能在關鍵基礎設施控制設備,角色固定的伺服器,獨立運作的設備上,比一般終端使用者更適合。

關於Version 2

Version 2 Digital 是立足亞洲的增值代理商及IT開發者。公司在網絡安全、雲端、數據保護、終端設備、基礎設施、系統監控、存儲、網絡管理、商業生產力和通信產品等各個領域代理發展各種 IT 產品。透過公司龐大的網絡、通路、銷售點、分銷商及合作夥伴,Version 2 提供廣被市場讚賞的產品及服務。Version 2 的銷售網絡包括台灣、香港、澳門、中國大陸、新加坡、馬來西亞等各亞太地區,客戶來自各行各業,包括全球 1000 大跨國企業、上市公司、公用事業、醫療、金融、教育機構、政府部門、無數成功的中小企及來自亞洲各城市的消費市場客戶。

關於精品科技
精品科技(FineArt Technology) 成立於1989年,由交大實驗室中,一群志同道合的學長學弟所組合而成的團隊,為一家專業的軟體研發公司。從國內第一套中文桌上排版系統開始,到投入手寫辨識領域,憑藉著程式最小、速度最快、辨識最準等優異特性,獲得許多國際大廠的合作與肯定。歷經二十個寒暑,精品科技所推出的產品,無不廣受客戶好評。

Portnox CLEAR vs. On-Premise NAC: A Look at Total Cost of Ownership (TCO)

On-Premise NAC vs. SaaS NAC

 

Set-Up & Configuration

Unlike traditional on-premise NAC solutions that require hardware appliances, software, and other on-premise elements, you can create your dedicated instance of Portnox CLEAR cloud-delivered NAC-as-a-Service in minutes.

Portnox CLEAR has been built from the ground up to simplify policy configuration, allowing for deployment timelines that can be measured in hours. In contrast, traditional on-premise NAC deployments can be measured in weeks or months.

Set-Up Costs Eliminated with Portnox CLEAR: Need for on-site appliances, need for third-party expertise, man-hours dedicated to systems training

Savings Value: HIGH

 

Scalability & Performance

As a cloud service, Portnox CLEAR eliminates the need for the capacity planning of on-premise NAC software or appliances. It also eliminates the need to expand capacity or upgrade appliances to meet future growth needs as required by traditional on-premise NAC.

Portnox CLEAR can automatically control the virtual machine size and the scale up or down rules. Dedicated F5 load balancers are spun up as well as auto-scale, so you never have to be concerned with service performance or scalability – it will automatically expand as needed to meet demand.

Performance Costs Eliminated with Portnox CLEAR: Man-hours dedicated to capacity planning, need for on-site appliance upgrades, need for local load balancing

Savings Value: MODERATE

 

Lifecycle Maintenance

Another hidden cost of on-premise is maintenance. All you have to do is search the web – in most cases you’ll find that vendors have lengthy manuals that outline the painful steps and procedures necessary to keep the software or its associated appliances updated.

These upgrades often come with time limits that can force you to start over and re-do your work. Worse yet, one simple mistake during these upgrades can take your network down for many hours or days. And guess what? You often get to go through these upgrades multiple times per year.

With Portnox CLEAR, never worry about software or hardware end-of-life, or costly, complex upgrades requiring hours and days of work and a never-ending checklist of to-dos. As a cloud-delivered service, Portnox CLEAR is always running the most up-to-date version with the latest features and capabilities. At the end of the day, Portnox CLEAR customers enjoy continuous service availability with ZERO lifecycle maintenance costs.

Maintenance Costs Eliminated with Portnox CLEAR: Software upgrades, NAC downtime, need for third-party expertise

Savings Value: HIGH

Michael Marvin

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About Portnox
Portnox provides simple-to-deploy, operate and maintain network access control, security and visibility solutions. Portnox software can be deployed on-premises, as a cloud-delivered service, or in hybrid mode. It is agentless and vendor-agnostic, allowing organizations to maximize their existing network and cybersecurity investments. Hundreds of enterprises around the world rely on Portnox for network visibility, cybersecurity policy enforcement and regulatory compliance. The company has been recognized for its innovations by Info Security Products Guide, Cyber Security Excellence Awards, IoT Innovator Awards, Computing Security Awards, Best of Interop ITX and Cyber Defense Magazine. Portnox has offices in the U.S., Europe and Asia. For information visit http://www.portnox.com, and follow us on Twitter and LinkedIn.。

Walking Meetings: perfect new idea or the dumbest thing ever?

What are Walking Meetings and how can they help us?

I hope you are not tired of “trend” terms, the neologisms that multiply everywhere and the upstart concepts that you can’t seem to memorize that well because they always sound like something else. I actually hope you are not, because here it comes another one, fresh from the oven. Take note, because as soon as you learn about it, as it usually happens, it will start mysteriously proliferating around your acquaintances. Today, in our alien-green Pandora FMS blog, we talk about what Walking Meetings are.

What are Walking Meetings?

Walking Meetings, *drum rolls*, are nothing more than work meetings while you walk. Yes, instead of sitting in an expensive and comfortable desk chair you take a stroll. Therefore, if you work remotely, we recommend you to have a pretty big living room, otherwise, it won’t work, we guarantee…

One of the excuses that surround the concept for its immediate implementation is that it helps us alleviate the sedentary lifestyle of today’s jobs. And it is true that we are all fed up with those pounds we seem to be gaining afterwork, a concept with which I hope you are familiar with, because it is one of the few that truly succeeds today and it is worth it. Although, as for me, I would continue to call it “things got out of hand and I ended up having a hard time the next day at the office.”

Walking Meetings or “Walking while you talk to your boss“, in addition to lowering the volume of your stomach, would help you relax, set you in a good mood and foster a positive environment. The bad thing is that if you are immersed in teleworking and you no longer have data on your business cell phone, your walk would be limited to the place where you still have Wi-Fi connection. That is why it is better to have a big living room.

As we already knew from the famous peripatetic school, walking while talking encourages creativity and reasoning. It is not surprising then that Aristotle strolled around the gardens bordering the temple of Apollo, along with his disciples, to teach them while they did some exercise to digest lunch better.

I know that maybe you are more of an oval noble wood table, blazer and tie, cards and Power Point, seriousness and silence person, while someone explains the new ideas that will no doubt relaunch the company. But things are evolving and what is trending now are Walking Meetings, something like walking the dog but with your work colleagues and while someone assigns, by Skype or in strict presence, the tasks of the week. Sorry, boomer, the elevator pitch is more popular than the static monologues of seniors of the company remembering better times, back in the old days. Dynamism and fluidity, relaxation and conversation, pedestrian exercise and rhythm, cardio and walking, project solutions and original answers. That is what prevails nowadays. And we welcome it with open arms. I have already bought my sneakers for that purpose!

But Walking Meetings already existed

As it is often the case with these types of newly coined concepts, Walking Meetings already existed. There we also have freeganism, for example. Which is basically, for those of you who may not know, “the collection of food that has previously been thrown away or discarded because its expiration date is near or past.” That was already in motion since garbage existed, however now it has a striking name, which some may consider unnecessary, and different nuances, ranging from hipsterism to anti-consumerism.

With Walking Meetings it is the same thing happening again, there were already conversations in the hallway on the way to the cafeteria or restroom, but they have finally become institutionalized and we now have a new excuse to wear shorts to work.

So what before could be a meal for those leading two different companies to reach an agreement of vital importance until way later after dinner, now they meet at the park to talk between gasps while keeping a light gallop. Of course, it is much better for strengthening the core, than the digestive gin tonics and a cigar after a good steak.

Possible benefits of Walking Meetings

  • Promoting creativity:

For some causal reason, walking is better. Synapses proliferate, our neurons sparkle, everything seems clearer, and creativity arises, from ear to ear, with a rainbow glow. Stanford University does not have to come to tell us about its experiments with sedentary and athletic people, we all know that movement shakes our heads and favors creation.

  • Exercise included:

Until we can eat popcorn without choking and pay attention to Netflix as we drive around with the porch, walking while working is the closest thing to doing something uplifting while exercising. You take a break from the screen for once, relax your burned corneas, and make other just as interesting muscles work.

  • Ideal for dealing with complicated topics:

Being locked up, immobile and face to face with someone is not the healthiest way to deliver sensitive news. It is much better to enjoy the air, space, exercise to distress and see the landscape views. If things get ugly you can always accelerate until you leave your teammates behind.

  • Good vibes:

Do you remember how good it felt when the teacher decided to teach the class outside because it was too good a day to be inside? Well, the same happiness and good vibes arouse Walking Meetings in the open air. Encouragement and positivism will flood us when we listen to something more than the photocopier in the background and we see something more than the gray facing of our cubicle.

I hope that with this information you can guess by yourself whether Walking Meeting instauration is worth it and you should give it a chance or whether you should just completely ignore them. Maybe you like them and they seem appropriate but with another name, something more simple and humble like “Meetings strolling” or the always cool “Marathon Meeting” or “Running Reunioning”.

But once you’ve gotten into these ins and outs, would you like to keep going? Go even further but into the world of technology? What about spending a couple of minutes to find out what computing system monitoring is and why it is also very important?

Monitoring systems are responsible for supervising technology (hardware, networks and communications, operating systems or applications, for example) in order to analyze its performance, and to detect and alert about possible errors. And this leads us to Pandora FMS, that wonderful tool thanks to which this blog is possible.

Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.

About Version 2 Digital

Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.

Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.

About PandoraFMS
Pandora FMS is a flexible monitoring system, capable of monitoring devices, infrastructures, applications, services and business processes.
Of course, one of the things that Pandora FMS can control is the hard disks of your computers.

×

Hello!

Click one of our contacts below to chat on WhatsApp

×