Recommended
More Related Content
Similar to Supplement V1.2
Similar to Supplement V1.2 (20)
Recently uploaded
Recently uploaded (20)
Supplement V1.2
- 1. • 本投影片僅供教育訓練用，如有侵權，請留言通 知，將立即刪除，謝謝。 • The slide is for education purpose only. Please leave your comment if there is any copyright infringement. I will delete it immediately. Thank you.
- 3. 法規名稱：公開發行公司建立內部控制制度處理準則 法規名稱： •二、參考「金融控股公司內部控制及稽核制度實施辦法」 、「銀行內部控制及稽核制 度實施辦法」、「票券商內 部控制及稽核制度實施辦法」及「保險業內部控制及 稽 核制度實施辦法」規定，公開發行公司內部稽核及自行檢 查報告、工作底稿及相關資料保存年限統一為至少保存五 相關資料保存年限統一為至少保存五 年。（修正條文第十三條及第二十二條) •十、為落實公開發行公司內部稽核單位執行年度稽核計畫 之機制，明定公司應依風險評估結果 應依風險評估結果擬訂其年度稽核計畫 應依風險評估結果 ，並確實執行，且其年度稽核計畫之稽核項目範圍應涵蓋 公司於內部控制制度訂定之重要控制作業。 (修正條文第 十三條)
- 4. Qualitative Risk Analysis Example 教育部 TANet 網路中心導入資訊安全管理制度計畫教育訓練教材 http://cissnet.edu.tw/download_tanet.aspx
- 5. FMEA Output RPN=SEV x PF x DET PRN: Risk Priority Number SEV:Severity PF:Probability Factor DET:Detection Effectiveness Rers: http://www.siliconfareast.com/fmea_quickref.htm#table
- 7. I. Risk Assessment in NIST SP-800 30 source: NIST Sp800-30
- 8. I. Risk Assessment in NIST SP-800 30 (cont.) source: NIST Sp800-30
- 9. Risk Management Threats Risk Identification Vulnerabilities Quantitative Analysis Qualitative Analysis Risk Risk Analysis FMEA Assessment FTA OCTAVE Risk Likelihood Management Risk Evaluation Impact Acceptance Reduction Risk Mitigation Transference Avoidance
- 10. Access Control
- 11. Access Control Conceptual Diagram Access Control 2007/6/8 Anything You Do Identify Identification Will Be Youself Logged Prove It Accountability Authentication (I need to Verify you) Do What I Authorization Tell You to Do
- 12. TACACS+ and RADIUS Comparison Criterion TACACS+ RADIUS Transport TCP (reliable; more overhead) UDP (unreliable; higher performance) Authentication Can be separated (more flexible) Combined and Authorization Multiprotocol Supported (IP, Apple, NetBIOS, IP only Support Novell, X.25) Access to Supports two methods to control Not supported Router CLI the authorization of router Commands commands on a per-user or per- group basis Encryption Packet payload Passwords only http://etutorials.org/Networking/network+management/Part+II+Implementations+on+the+Cisco+Devices/Chapter+9.+AAA+Accounting/Diameter+Det ails/
- 13. RADIUS and Diameter Comparison Characteristic RADIUS Diameter Transport protocol Connectionless (UDP 1812). Connection-oriented (TCP, SCTP, 3868). Transport security Optional IPsec. IPsec or Transport Layer Security (TLS) is required. Architecture Client-Server model Peer-to-peer model State Stateless Stateful(Session ID, transaction status) Authentication Pre-shared key Pre-Shared key, digital certificate PAP, CHAP, EAP PAP, CHAP, EAP Only client to server re- Mutual re-authentication authentication Authorization Bind with re-authentication Re-authorization any time Accounting Real-time accounting Real-time accounting Confidentiality Only encrypt password Encrypt all data, or IP header(IPSec) Integrity Poor Good Scalability Poor Good Extensibility Vendor-specific Public use Security model Supports only hop-by-hop security. Supports end-to-end and hop-to- Every hop can modify information hop security. End-to-end guarantees that cannot be traced to its origin. that information cannot be modified without notice.
- 14. XACML Policy Sample <Policy PolicyId="SamplePolicy" RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:permit- overrides“> <!-- This Policy only applies to requests on the SampleServer --> <Target> <Subjects> <AnySubject/> </Subjects> <Resources> <ResourceMatch MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal"> <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">SampleServer</AttributeValue> <ResourceAttributeDesignator DataType="http://www.w3.org/2001/XMLSchema#string" AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id"/> </ResourceMatch> </Resources> <Actions> <AnyAction/> </Actions> </Target> <!-- A final, "fall-through" Rule that always Denies --> <Rule RuleId="FinalRule" Effect="Deny"/> </Policy>
- 16. Cryptography
- 17. 2DES Meet-in-the-Middle Attack If DES1 encrypted output equals DES2 decrypted output, then key1 and key2 cracked known known Source: www.giac.org/
- 18. Keyed Hash HMAC Source: http://www.unixwiz.net/
- 19. Algebraic Cryptanalysis E E Message E
- 20. Null Cipher “A re you deaf, Father W illiam !” the young m an said, “D id you hear w hat I told you just now ? “E xcuse m e for shouting! D on’t w aggle your head “Like a blundering, sleepy old cow ! “A little m aid dw elling in W allington Tow n, “Is m y friend, so I beg to rem ark: “D o you think she’d be pleased if a book w ere sent dow n “E ntitled ‘The H unt of the Snark?’” - “Pack it up in brow n paper!” the old m an cried, “A nd seal it w ith olive-and-dove. “I com m and you to do it!” he added w ith pride, “N or forget, m y good fellow , to send her beside “E aster G reetings, and give her m y love.”
- 21. Diffie-Hellman Key Agreement Operation
- 22. Diffie-Hellman Key Agreement Operation
- 23. Security Architecture and Design
- 24. Zachman Framework An Overview of Enterprise Architecture Framework Deliverables by Frank Goethals
- 25. DoDAF Framework Enterprise Architecture A-to-Z
- 27. Common Criteria Flow an implementation- independent Protection Category of Product statement of security Profile (i.e., “firewalls”) needs for a TOE type. a set of software, firmware and/or Target of Specific Product (i.e., hardware possibly Evaluation Cisco PIX 5xx) accompanied by guidance. Security Vendor claims: an implementation- Specifications and dependent statement Target features of security needs for a specific identified TOE Functional Assurance Requirements Requirements
- 28. Implementation of Evaluated Products TEST plan based on Evaluation stated requirements EAL Levels 1 Functionally Tested 2 Structurally Tested 3 Methodically Tested 4 Methodically Designed, Tested, Reviewed 5 Semiformal testing 6 Semiformal verification 7 Formal verification and testing Based on production Certification environment Accreditation
- 31. KDD Process
- 32. Neural Network
- 33. Expert System Source:idrinfo.idrc.ca
- 34. Waterfall Method http://www.softwebsolutions.com/our_process.html
- 35. Spiral Method http://en.wikipedia.org/wiki/Spiral_model
- 36. Iterative Method Wikipedia
- 37. Inheritance Parent Class Animal Virtual Function Talk() Child Class Child Class Cat Dog Function Talk("") Function Talk("")
- 38. Polymorphism 1. class Animal { 2. virtual public Talk(){ } 3. } 4. class Dog extends Animal { 5. public Talk() { speak "汪" } 6. } 7. class Cat extends Animal { 8. public Talk() { speak "喵" } 9. } 10.Function AnimalTalk( Animal objSomeAnimal) 11.{ 12. objSomeAnimal.Talk; //polymophism; late binding 13.} 14.Animal objCat = new Cat; 15.Animal objDog = new Dog; 16.//Without polymorphism 17.objCat .Talk; //"喵" 18.objDog .Talk; //"汪" 19.//With polymorphism 20.AnimalTalk(objCat); //"喵" 21.AnimalTalk(objDog); //"汪" • 在本範例中，AnimalTalk程序接受 (Accept) 屬於 Animal 型別而名為 objSomeAnimal 的參數，所以我 們可以在 run-time傳送如 Cat或Dog衍生自 Animal 類別的類別。此項設計的優點在於，您可加入衍生 可加入衍生 類別的新類別， 程序中的用戶端程式碼。 自 Animal 類別的新類別，而不需要變更 AnimalTalk程序中的用戶端程式碼 程序中的用戶端程式碼
- 39. 2-phase commit
- 40. LRCI
- 41. EnCase – File System
- 42. EnCase Timeline
- 43. 稽核自動化平台
- 44. Telecommunication and Network Security
- 47. Partial Mesh as HA
- 48. Link Layer Encryption vs. End-to-end Encryption
- 49. ISDN Application
- 50. MPLS http://www.isoc.org/
- 51. IPSec Mode - Concise http://technet.microsoft.com/en-us/library/cc759130(WS.10).aspx#w2k3tr_ipsec_how_vvlc
- 52. PPTP and L2TP Data Format
- 53. Smurf http://www.techexams.net
- 54. FDDI Dual Counter-Rotating Ring
- 55. Routing Protocols Open Hop Class Authentica Category Network less tion RIPv1 RFC 15 No None Interior Small 1058 Distance vector RIPv2 RFC 15 Yes Password Interior Small 2453 MD5 Distance vector Medium IGRP Cisco 255 No None Interior Small Distance vector EIGRP Cisco 255 Yes Password Interior Large MD5 Hybrid OSPF RFC none Yes Password Interior Large 2328 MD5 Link-state Hetero ISIS ISO Yes Password Interior Large 10589 Link-state EGP Exterior AS-AS Distance vector BGP RFC CIDR MD5 Exterior AS-AS 1771 Distance vector Cisco® Certified Network Associate Study Guide
- 56. Subnetting vs. supernetting One Class C 8 contiguous Class C http://medusa.sdsu.edu/network/CS576/Lectures/ch05_Subnetting.pdf
- 57. VPN – Site to Site
- 58. NetBios
- 59. War Dialer - PhoneSweep
- 60. Finger
- 66. BCP
- 67. BIA Process Owner Impact Business Activity Geographic Timescale Extent MTPD RPO
- 68. 4.1 INCIDENT RESPONSE STRUCTURE
- 70. RTO < MTPD(MTD)
- 71. Trailer
- 72. Scope
- 73. BCM is a Balancing Act(cont.) High Cost High Loss recovery strategy disruption Cost/Loss Cost/Loss Cost/Loss Cost/Loss Cost/Loss Cost/Loss Cost/Loss Cost/Loss Cost Cost Cost Cost Cost Cost Cost Cost Optimal Lose Business Point Time 73
- 75. OS
- 76. Heat and cool air http://www.adc.com/us/en/Library/Literature/102264AE.pdf
- 77. Data loss on transportation