2017 物联网安全现状 The Status of IoT Security in 2017 商业消费者和工业之间连接的事物数量迅速增长 Number of connected "things in commercial, consumer and industries grow rapid

Size: px

Start display at page:

Download "2017 物联网安全现状 The Status of IoT Security in 2017 商业消费者和工业之间连接的事物数量迅速增长 Number of connected "things in commercial, consumer and industries grow rapid"

亮叠咸
5 years ago
Views:

1 数据驱动边缘计算安全 Data Driven Edge Computing Security 吴云坤, 总裁, 360 企业安全集团 Yunkun, Wu, President, 360 Enterprise Security

2017 物联网安全现状 The Status of IoT Security in 2017 商业消费者和工业之间连接的事物数量迅速增长 Number of connected "things in commercial, consumer and industries grow rapidly 2015: 安装了 49 亿个物联网端点 4.

2 2017 物联网安全现状 The Status of IoT Security in 2017 商业消费者和工业之间连接的事物数量迅速增长 Number of connected "things in commercial, consumer and industries grow rapidly 2015: 安装了 49 亿个物联网端点 4.9B IoT endpoints 2020: 安装基数增长至 204 亿 20.4B IoT endpoints 物联网安全不是一个新网络范式, 它需要的是混合方法 IoT security is not a new network paradigm but requires hybrid approaches. 工业界和政府活动正在迅速发展和适应 Industry and government activities are evolving and improving rapidly 现实世界的物联网攻击往往击中了主流 IoT attack hit mainstream 未来超过 50% 的数据需要在网络边缘侧分析处理与储存! More than 50% data will be analyzed, processed and storage at the network Edge

3 物联网和边缘计算安全现状 : 关键且脆弱 Status of IoT Edge Computing Security : Critical and Vulnerable 智能交通 Smart transportati on No Design for Security 设计时未考虑安全数量多分布广环境复杂 Large Quantity Widely Spread Complex Environment 智能电网 Smart Grid 智能工厂 Smart Factory 应用在关键领域 Critical Industry 智慧城市 Smart City 智慧医疗 Smart Healthcare 资源受限计算存储传统防护手段不适用 Tradition Protection is no longer appropriate 安全性差 Poor Security Performance Limited Hardware Performance(Co mpute, Storage)

物联网和边缘计算安全现状 : 安全事件频发 Status of IoT Edge Computing Security : Security incidents occur frequently 2015 年 6 月,360 安全专家公开展示了利用某汽车厂商云服务漏洞, 可以开启汽车的车门发动汽车

vendor s Cloud Service in June 2015, and soon released the cases of cracking Tesla.

grid, which was the 1 st massive attack to power utilities in the world 2016 年 10 月 22 日, Mirai 病毒将数百万路由器智能摄像头当做肉鸡向美国域名服务器管理机构 Dyn 发动大规模的 DDos (

4 物联网和边缘计算安全现状 : 安全事件频发 Status of IoT Edge Computing Security : Security incidents occur frequently 2015 年 6 月,360 安全专家公开展示了利用某汽车厂商云服务漏洞, 可以开启汽车的车门发动汽车开启后备箱等操作, 后续公布了破解特斯拉等车型的演示案例 360 Security experts announced that they can open the doors, start the engine through the vulnerabilities of an automobile vendor s Cloud Service in June 2015, and soon released the cases of cracking Tesla 年 12 月 23 日, 乌克兰电力网络受到攻击, 导致伊万诺 - 弗兰科夫斯克州大停电, 成为全世界第一起黑客攻击造成电网大规模停电事件 Ukraine Ivano-Frankivsk State was power off because of the attack of power grid, which was the 1 st massive attack to power utilities in the world 2016 年 10 月 22 日, Mirai 病毒将数百万路由器智能摄像头当做肉鸡向美国域名服务器管理机构 Dyn 发动大规模的 DDos ( 分布式拒绝服务 ) 攻击, 致使美国互联网大面积瘫痪 2017 年 10 月,360 又发现类似病毒 IoT_Reaper, 破坏力更大 On Oct. 22, 2016, the Mirai virus put millions of routers and smart cameras as "broilers" on a massive DDoS attack on the U.S. DNS server Dyn, causing widespread disruptions.

5 网络安全新常态 New Normal of Network Security 漏洞产业化 Vulnerability Industrialization Attack is becoming Complicated 攻击复杂化军火民用化 Civilian use of Munitions Normalization of Critical Safeguard 重保常态化应急小时化 Emergency Response within an Hour 安全法制化 Legalization of Security

discovered but not patched vulnerabilities 假设 3 系统已经被渗透 The system

6 四个假设 Four hypotheses 假设 1 系统一定有未被发现的漏洞 The system must have undiscovered vulnerabilities 假设 2 一定有已发现但未修补的漏洞 There must be discovered but not patched vulnerabilities 假设 3 系统已经被渗透 The system has been infiltrated 假设 4 内部人员不可靠 Insiders are not reliable 360 专项态势感知永恒之蓝传播态势 : 中国

7 网络安全能力的叠加演进 Overlay Evolution of Network Security Capabilities 依赖 Dependency 架构安全被动防御积极防御威胁情报进攻反制强身健体 Strengthen the Body 纵深防御 Defense in Depth 检测响应 Detection & Response 掌握敌情 Know the Intelligence 先发制人 Preemptive 进化 Evolution 安全体系安全域安全加固补丁管理应用内建传统安全收缩攻击面消耗攻击资源迟滞攻击安全分析追踪溯源响应处置人的参与信息收集情报生产分析验证情报猎捕法律手段反制措施自我防卫降低平均检测时间 (MTTD)/ 平均响应时间 (MTTR) Reduce the Mean Time to Detect(MTTD), Reduce the Mean Time to Response(MTTR)

Integrated Controller 可以通过本地无线网络或者物理篡改进行攻击 Attack through Local Wireless Network or Physical Temper 通过 Internet

8 物联网和边缘计算安全现状 : 攻击路径分析 Status of IoT Edge Computing Security : Attack path Analysis 边缘 Edge 防护能力较弱 Poor Protection Capabilities IoT 平台 Platform 风险聚集 Risks Accumulation 企业 Enterprises 传感器 Sensors 加速器 Acceleraters 物 Things 集成控制器 Integrated Controller 可以通过本地无线网络或者物理篡改进行攻击 Attack through Local Wireless Network or Physical Temper 通过 Internet 或者无线网络攻击 Attack through Internet or Wireless Network 通过本地无线网络或者用户终端进行攻击 Attack through Local Wireless Network, Users or Endpoints

9 物联网和边缘计算安全现状 : 防护措施 Status of IoT Edge Computing Security : Protection Methods 边缘 Edge IoT 平台 Platform 风险聚集 Risks Accumulation 企业 Enterprises 传感器 Sensors 加速器 Acceleraters 物 Things 集成控制器 Integrated Controller 终端准入 Access Control 持续监测 Continuous Detection 设备自身安全 Device Security 轻量级加密 Lightweight Encription 建立安全运营中心 SOC 构建安全监测和响应能力 Detection and Response Capabilities 企业级安全解决方案威胁情报和态势感知 Threat Intelligence and Situation Awareness 动态监测与持续响应 Dynamic Detection and Continuous Response

10 数据驱动安全创新理念 Data Driven Security Innovation Concept 外部数据本地数据 Data is the Foundation Drive is the means Security is the Target 数据驱动安全也适用于边缘计算安全 Data driven security is also applicable to edge computing security

11 数据驱动的边缘计算协同联动防御体系 Data driven edge computing collaborative linkage defense system 安全运营平台 SOC 应急响应中心 ERC 大数据安全分析 Big-Data Security Analyze 创新的安全服务 Innovated Security Services 边缘计算安全领域 Edge Computing Security 情报威胁情报中心 Threat Intelligence Center Intelligence 数据 Data 态势感知系统 Situation Awareness System

12 数据驱动安全 2.0 Data Driven Security 2.0 Security Training Operating Mechanism Man-machine Collaboration Capacity Mechanism Data Collaboration Security Operation Security Training Technical mechanism Product Collaboration

13 人是安全问题的根源, 也是安全运营的核心 People are the root of Security problems, and are also the core of Security operation 黑客 hackers APT 组织 APT organization 安全运维人员安全分析人员 Safety operation and maintenance personnel Security analyst 内部员工 Internal employees 外包人员 Outsourcing personnel 安全问题的根源 The root of security problems 安全运营的核心 The core of security operation 安全本质是人与人的对抗 The essence of security is the confrontation between people 安全咨询人员攻防研究人员 Security consultant Offensive and defensive researchers

72 小时应急响应中人的作用 The role of human in 72 hour emergency response 1500+ 安全应急响应人员安全工程师上门紧急响应 1700+ 客户机构的现场支持监管机构部委金融机构

14 72 小时应急响应中人的作用 The role of human in 72 hour emergency response 安全应急响应人员安全工程师上门紧急响应客户机构的现场支持监管机构部委金融机构大型央企客户机构的电话支持工具 U 盘或光盘 9 个版本安全预警通告 7 个安全修复指南文档操作指南事件百问开机手册等 6 个安全软件修补工具补丁扫描修复解密多类别工具人均睡眠时间 <4 小时

面临的挑战 : 两个失效定律 The Challenge: two Laws of Failure 检测分析手段的缺乏 Lack of detection and analysis methods 响应处置的高效闭环 Efficient closed loop for response processing 没有技术手段保障的运营机制一定会失效数据驱动的产品协同 Data

15 面临的挑战 : 两个失效定律 The Challenge: two Laws of Failure 检测分析手段的缺乏 Lack of detection and analysis methods 响应处置的高效闭环 Efficient closed loop for response processing 没有技术手段保障的运营机制一定会失效数据驱动的产品协同 Data Driven Product collaboration 技术机制大协同 Great synergy 人为核心的安全运营 Human Centered Security Operation 运营机制没有人员参与运营的技术机制一定会失效安全能力的不足 Deficiency of security capability 安全人才的缺乏 Lack of security personnel

16 安全大数据是构建安全能力平台的基础 Security Big Data is the Foundation of Building Security Capability Platform 威胁情报中心 Threat Intelligence Center 应急响应中心 Emergency response center 安全运营中心 Safe operation center 网站云监测 Website cloud monitoring 网站云防御 Website cloud defense 云查杀平台 Cloud killing platform 360 云端安全能力平台

17 数据驱动的创新安全运营服务 Data Driven Innovative Security Operations Services 360 云端安全能力平台 360 cloud security capability platform 安全赋能

汇聚互联网安全攻防人才的力量 Gather the power of Internet security attack and defense personnel 公益开放协同 36082 已注册白帽子数量永久保护漏洞信息企业政府

18 汇聚互联网安全攻防人才的力量 Gather the power of Internet security attack and defense personnel 公益开放协同已注册白帽子数量永久保护漏洞信息企业政府漏洞安全补天漏洞响应平台协同白帽白帽提高安全防护能力全社会解决网络安全隐患培养网络安全人才引导青少年正向成长 Solve network security risks and cultivate cyber security talent

19 网络安全人才培养与实训 Network security personnel training and training 校企合作 360 网络空间安全学院 School enterprise cooperation Network Security Institute 丰富的专业教材先进的安全设备完整的知识架构准确的职业解析专业与实验室建设安全师资培训多维的教学内容多维的育人体系多维的合作方式前沿的安全技术开放的综合实训实用的技能训练优质的就业推荐合作科研团队技能认证与竞赛强大的品牌影响 Strong brand influence 360 安全创新中心 360 Security Innovation Center 领先的安全能力 Leading security capability 大数据协同安全国家工程实验室 National Engineering Laboratory for cooperative safety of big data 成熟的安全产品 Mature security products 完善的认证体系 Perfect certification system

20 万物智联, 是安全的尺度 Wisdom Alliance, people are safe standards

21 谢谢 Thank You

Microsoft PowerPoint - 06. Zhang Guohua.ppt [Compatibility Mode]

Microsoft PowerPoint - 06. Zhang Guohua.ppt [Compatibility Mode] 2015 年中欧城镇化伙伴关系论坛可持续城市交通规划分论坛 Synergy of Transport, Industrial & Spatial Planning in the Age of New-type Urbanization 中国新型城镇化与交通产业空间协同规划 Zhang Guohua Comprehensive

2017 物联网安全现状 The Status of IoT Security in 2017 商业 消费者和工业之间连接的 事物 数量迅速增长 Number of connected "things in commercial, consumer and industries grow rapid

2017 物联网安全现状 The Status of IoT Security in 2017 商业消费者和工业之间连接的事物数量迅速增长 Number of connected "things in commercial, consumer and industries grow rapid