Đang chuẩn bị nút TẢI XUỐNG, xin hãy chờ
Tải xuống
Chapter 14 – Security engineering. The objective of this chapter is to introduce issues that should be considered when you are designing secure application systems. When you have read this chapter, you will: understand the difference between application security and infrastructure security; know how life-cycle risk assessment and operational risk assessment are used to understand security issues that affect a system design; be aware of software architectures and design guidelines for secure systems development. | Chapter 14 – Security Engineering Lecture 1 Chapter 14 Security Engineering 1 Topics covered Security engineering and security management Security engineering concerned with applications; security management with infrastructure. Security risk assessment Designing a system based on the assessment of security risks. Design for security How system architectures have to be designed for security. Chapter 14 Security Engineering 2 Security engineering Tools, techniques and methods to support the development and maintenance of systems that can resist malicious attacks that are intended to damage a computer-based system or its data. A sub-field of the broader field of computer security. Assumes background knowledge of dependability and security concepts (Chapter 10) and security requirements specification (Chapter 12) Chapter 14 Security Engineering 3 Application/infrastructure security Application security is a software engineering problem where the system is designed to resist attacks. . | Chapter 14 – Security Engineering Lecture 1 Chapter 14 Security Engineering 1 Topics covered Security engineering and security management Security engineering concerned with applications; security management with infrastructure. Security risk assessment Designing a system based on the assessment of security risks. Design for security How system architectures have to be designed for security. Chapter 14 Security Engineering 2 Security engineering Tools, techniques and methods to support the development and maintenance of systems that can resist malicious attacks that are intended to damage a computer-based system or its data. A sub-field of the broader field of computer security. Assumes background knowledge of dependability and security concepts (Chapter 10) and security requirements specification (Chapter 12) Chapter 14 Security Engineering 3 Application/infrastructure security Application security is a software engineering problem where the system is designed to resist attacks. Infrastructure security is a systems management problem where the infrastructure is configured to resist attacks. The focus of this chapter is application security. Chapter 14 Security Engineering 4 System layers where security may be compromised Chapter 14 Security Engineering 5 System security management User and permission management Adding and removing users from the system and setting up appropriate permissions for users Software deployment and maintenance Installing application software and middleware and configuring these systems so that vulnerabilities are avoided. Attack monitoring, detection and recovery Monitoring the system for unauthorized access, design strategies for resisting attacks and develop backup and recovery strategies. Chapter 14 Security Engineering 6 Security risk management Risk management is concerned with assessing the possible losses that might ensue from attacks on the system and balancing these losses against the costs of security procedures that may reduce
