it-e-62 Security Policy Design Issues

When designing a firewall system and its corresponding security policy, a number of
questions should be answered. The first question involves the company's expected level of
security. Is the company trying to restrict all access to services not deemed essential to the
business? Or does the company wish to allow all or most types of transactions, thus asking the
firewall system only to audit transactions and create an orderly request for transactions?
Restricting all access to services not deemed essential requires a more elaborate firewall system
and thus more work and expense. Allowing most types of transactions requires a simpler system
that only performs queue management operations and creates an audit trail.
A second question stems from the first decision: How much money is the company willing
to invest in a firewall system? Commercially-purchased firewall systems can be powerful,
complex, and expensive. It is possible, however, to construct a home-grown firewall system that
takes advantage of the capabilities of existing equipment, such as routers and network operating
systems. As we saw earlier, it is possible to restrict access into a system based on time of day,
day of week, and location. It is also possible to use existing software to create an audit trail of all
incoming and outgoing transactions. Depending on the detail of auditing required, additional
software can be purchased and installed that will work in concert with network operating system
software to provide any desired level of audits.
Similarly, many routers can be programmed to restrict access to certain kinds of traffic. A router
can be programmed to accept and reject requests with specific IP addresses or a range of IP addresses.
Routers can also be programmed to deny access to certain port addresses at the TCP level.
A third question relates to the company's commitment to security. If the company is serious
about restricting access to the corporate network through a link such as the Internet, will the

company be equally serious about supporting security on any and all other links into the
corporate network environment? Dial-up modem access, wireless network access, and other
telecommunication links should also be considered when making security decisions. Fax
machines, both stand alone and computer based, as well as removable disk media are two more
examples of how data may enter or leave a corporation. Any security policy must take these
entrance and exit points, as well as the Internet, into consideration.
Having a well-designed security policy in place will make the jobs of network support staff
clearer. The staff employees will know what the network users can and cannot access and where
they can and cannot go. A well-designed security policy will make enforcement more
straightforward, and it will allow the staff to react properly to specific security requests. The
policy will also make clear the goals and duties of network employees in enforcing security with
respect to requests from the outside. If there is a good security policy, the users themselves will
have a better understanding of what they can and cannot do. This understanding will hopefully
assist the network staff in conducting their jobs and will allow the company to maintain security
in an increasingly insecure world.
Perhaps because companies have well-designed security policies in place, many people who
use the Internet to purchase items online are growing comfortable with the fact that, if they
transfer credit card information during a secure session, their data is safe from hackers and other
eavesdroppers. This sense of security may change, however, because the Internet Engineering
Task Force is considering whether to allow a backdoor entry into all Internet traffic. This
backdoor entry would allow authorized persons to intercept any data traffic on the Internet. Since
this proposal appears to be a violation of privacy, why would anyone want to create such a
backdoor?
At the core of the argument is the fact that standard telephone systems currently allow
agencies of the U.S. government to wiretap communications. This wiretap occurs at the
telephone central office and is built into central office telephone switches.
The act that allows wiretapping (the Communications Assistance for Law Enforcement Act)
has been in existence since 1994. Now that the Internet is beginning to carry voice traffic, should
it also be possible for the U.S. government to wiretap voice transactions on the Internet? As one
critic of the proposal states, if they can tap voice, then they can tap data. Furthermore, if the
designers of the Internet create such a backdoor, it is also possible that this knowledge could fall
into the wrong hands and be used for criminal intent.
This issue is further complicated by the fact that many businesses presently encrypt all data
leaving the corporate network. Most encryption techniques used by businesses are so effective
that virtually no one, including the government, can crack them. If the network does the
encryption just before the data leaves corporate boundaries, then it would be the responsibility of
the corporate network support personnel to provide the U.S. government, if asked, with
unencrypted data. If, on the other hand, the encryption is applied at the user workstation before it
is inserted onto the corporate network, who will supply the U.S. government with the

unencrypted data? Clearly, this issue will be hotly debated for some time to come.
Despite the fact that a company may have a well-designed security policy in place, external
events are making this area more complex all the time.

1, deem  [di:m]
vt. 认为,视作;相信
vi. 认为,持某种看法;作某种评价

2, stems 
n. 茎(stem的复数);树管;阻挡物
v. 起源于(stem的三单形式);除去…的茎;给…装杆;止住
3, wiretap  ['waiə,tæp]
v.&n. 窃听或偷录,窃听情报,窃听装置

Continue reading it-e-62 Security Policy Design Issues

it-e-61 Computer Security

The techniques developed to protect single computers and network-linked computer systems
from accidental or intentional harm are called computer security. Such harm includes destruction
of computer hardware and software, physical loss of data, and the deliberate invasion of
databases by unauthorized individuals.
Data may be protected by such basic methods as locking up terminals and replicating data in
other storage facilities. Most sophisticated methods include limiting data access by requiring the
user to have an encoded card or to supply an identification number or password. Such procedures
can apply to the computer-data system as whole or may be pinpointed for particular information
banks or programs. Data are frequently ranked in computer files according to degree of
confidentiality.
Operating systems and programs may also incorporate built-in safeguards, and data may be
encoded in various ways to prevent unauthorized persons from interpreting or even copying the
material. The encoding system most widely user in the United States is the Data Encryption
Standard (DES) designed by IBM and approved for use by the National Institute of that are then
repeated several times. Very large-scale computer systems, for example, the U.S. military's
Advanced Research Project Agency Network (ARPANET), may be broken up into smaller
subsystems for security purposes, but smaller system in government and industry are more prone to
system-wide invasions. At the level of personal computers, security possibilities are fairly minimal.
Most invasions of computer systems are for international or corporate spying or sabotage,
but computer hackers may take the penetration of protected databanks as a challenge, often with

no object in mind other than accomplishing a technological feat. Of growing concern is the
deliberate implantation in computer programs of worms or viruses that, if undetected, may
progressively destroy databases and other software. Such infected programs have appeared in the
electronic bulletin boards available to computer users. Other viruses have been incorporated into
computer software sold commercially. No real protection is available against such bugs except
the vigilance of manufacturer and user.

1, invasion  [in'veiʒən]
n. 入侵,侵略;侵袭;侵犯

2, sophisticated  [sə'fistikeitid]
adj. 复杂的;精致的;久经世故的;富有经验的
v. 使变得世故;使迷惑;篡改(sophisticate的过去分词形式)
3, pinpointed 
v. 指出正确的位置;准确地找到(pinpoint的过去分词)
4, sabotage  ['sæbətɑ:ʒ, ,sæbə'tɑ:ʒ]
vt. 妨害;对…采取破坏行动
vi. 从事破坏活动
n. 破坏;破坏活动;怠工
5, penetration  [,peni'treiʃən]
n. 渗透;突破;侵入;洞察力
6, implantation  [,implɑ:n'teiʃən, -plæn-]
n. 移植;灌输;鼓吹
7, vigilance  ['vidʒiləns]
n. 警戒,警觉;警醒症

Continue reading it-e-61 Computer Security

数据库同步--可别忘记了

对于数据库同步,使用者往往将注意力放在了事务上,但是可别忘记了数据库操作方法的同步性。

JDBC中:setAutoCommit(boolean autoCommit)这个方法可不是什么同步方法,如果一个connection被多个线程使用,这种方式就达不到同步的要求。因为说不定哪个线程马上又调用setAutoCommit

保持同步的方法是:保证connection只被一个线程使用:

1:使用ThreadLocal(HibernateSessionFactory的方法,ibatis的SqlMapClient内部也是使用了ThreadLocal,所以你可以放心使用单例的SqlMapClient,它是线程安全的)。

2:使用连接池获取connection,用完后关闭。

3:在一个操作内使用同步块。

Continue reading 数据库同步--可别忘记了

tomcat jndi数据源--麻烦?

不知为什么Tomcat配置jndi数据源要这么麻烦,其原因是path这个属性,指定为空字符串表示是默认的应用而不是指全部应用。所以你无法多个应用共用一个jndi资源。后来再仔细看看文档,原来放在$CATALINA_HOME/conf/context.xml中的配置才可以“共享”(这事就不要设置path了)。误导误导!!!

Continue reading tomcat jndi数据源--麻烦?

opengl 编程指南笔记

首先要整vc6环境,鉴于之前vc6的使用经验,我的神--头疼:

http://space.itpub.net/17267437/viewspace-545635

还是算了吧,打算用eclipse开发。

http://www.ferdychristant.com/blog/articles/DOMM-72MPPE

http://blog.csdn.net/heshiyou_2009/article/details/5897878

http://blog.csdn.net/wangjun_pfc/article/details/1819424

http://www.ibm.com/developerworks/cn/linux/opensource/os-ecc/

http://metaphy.iteye.com/blog/560534

感觉eclipse开发C还是不行!

下个CDT,没有快捷键设置,没有字体设置……

Continue reading opengl 编程指南笔记

it-e-60 Secure Networks and Policies

What is a secure network? Can an Internet be made secure?[1] Although the concept of a
secure network is appealing to most users, networks cannot be classified simply as secure or not
secure because the term is not absoluteˆeach group defines the level of access that is permitted
or denied. For example, some organizations store data that is valuable. Such organizations define
a secure network to be a system prevents outsiders from accessing the organization's computers.
Other organizations need to make information available to outsiders, but prohibit outsiders from
changing the data. Such organizations may define a secure network as one that allows arbitrary
access to data, but includes mechanisms that prevent unauthorized changes. Finally, many large
organizations need a complex definition of security that allows access to selected data or services
the organization chooses to make public, while preventing access or modification of sensitive
data and services that are kept private.
Because no absolute definition of information secure exists, the first step an organization
must take to achieve a secure system is to define the organization's security policy. The policy
does not specify how to achieve protection. Instead, it states clearly and unambiguously the items
that are to be protected.

Defining an information security policy is complex. The primary complexity arises because an
information security policy cannot be separated from the security policy for computer systems
attached to the network. In particular, defining a policy for data that traverses a network does not
guarantee that data will be secure. Information security cannot prevent unauthorized users who
have accounts on the computer from obtaining a copy of the data. The policy must hold for the data
stored on disk, data communicated over a telephone line with a dialup modem, information printed
on paper, data transported on portable media such as a floppy disk, and data communicated over a
computer network.
Defining a security policy is also complicated because each organization must decide which
aspects of protection are most important, and often must compromise between security and ease
of use. For example, an organization can consider:
Data Integrity'
Data Availability'
Data Confidentiality and Privacy.

 

appealing

  • a. 引起兴趣的,动人的

    Continue reading it-e-60 Secure Networks and Policies

  • hibernate工程,正向还是反向?

    我用hibernate都是反向工程即先有数据库schema再生成dao,mapping file。

    我记得最早我这么做时就已经比较过了,但是现在又忘了为什么……

    这次做的项目先用的是mongodb,自己写的pojo,dal,现在要转为使用mysql,在想这回来个正向工程吧。查了一下,正向工程要先写mapping file或是在pojo上写注解,再用xdolet或者SchemaExport反向生成。想想,哎呀算了吧,看见xml就头疼!况且已经有了数据库设计的模型,转成sql很容易。最后还是决定反向工程。

    那答案就很清楚了,一般数据库设计都是先使用工具建好模型直接生成schema就可以。在反向自然是顺理成章的事。

    这篇文章也讨论了这个问题:http://www.iteye.com/topic/123

    从这四种自动生成工具来看, mapping file, java file and DDL,只要知道任何一种文件,都可以得到另外两种文件, 
    如: 
    1. 只有mapping file: 
    mapping file---hbm2java----java---SchemaExport----DDL 
    2.只有DDL 
    DDL---Middlegen---hbm----hbm2java----java 
    3.只有Java 
    java---XDoclet---hbm----SchemaExport----DDL

    Continue reading hibernate工程,正向还是反向?

    it-e-59 Internet Firewall Concept

    A packet filter is often used to protect an organization's computers and networks from
    unwanted Internet traffic. The filter is placed in the router that connects the organization to the
    rest of the Internet.
    A packet filter configured to protect an organization against traffic from the rest of the
    Internet is called an Internet firewall; the term is derived from the fireproof physical boundary
    placed between two structures to prevent fire from moving between them. Like a conventional
    firewall, an Internet firewall is designed to keep problems in the Internet from spreading to an
    organization's computers.
    Firewalls are the most important security tool used to handle network connections between
    two organizations that do not trust each other. By placing a firewall on each external network
    connection, an organization can define a secure perimeter that prevents outsiders from interfering
    with the organization's computers. In particular, by limiting access to a small set of computers, a
    firewall can prevent outsiders from probing all computers in an organization or flooding the
    organization's network with unwanted traffic.

    A firewall can lower the cost of providing security. Without a firewall to prevent access,
    outsiders can send packets to arbitrary computers in an organization. Consequently, to provide
    security, an organization must make all of its computer secure. With a firewall, however, a
    manager can restrict incoming packets to a small set of computers. In the extreme case, the set
    can contain a single computer. Although computers in the set must be secure, other computers in
    the organization do not need to be. Thus, an organization can save money because it is less
    expensive to install a firewall than to make all computer systems secure.

     

    1, perimeter  [pə'rimitə]
    n. 周长;周界;[眼科] 视野计

    2, interfering  [,intə'fiəriŋ]
    adj. 干涉的;多管闲事的
    v. 妨碍(interfer的ing形式)

    3, arbitrary  ['ɑ:bitrəri]
    adj. [数] 任意的;武断的;专制的

    Continue reading it-e-59 Internet Firewall Concept

    it-e-58 Network Security Report

    Any one responsible for the security of a trusted network will be concerned when connecting
    it to a distrusted network. In the case of connections to the Internet this concern may be based
    largely on anecdotal evidence gleaned from widespread media coverage of security breaches. A
    closer inspection of the facts and statistics behind some of the media coverage will, however, only
    serve to deepen that concern. For example, the US National Computer Security Agency (NCSA)
    asserts that most attacks to computer systems go undetected and unreported, citing attacks made
    against 9,000 Department of Defence computers by the US Defence Information Systems Agency

    (DISA). These attacks had an 88 percent success rate and went undetected by more than 95 percent
    of the target organizations. Only 5 percent of the 5 percent that detected an attack, a mere 22 sites,
    reacted to it.
    It is noteworthy that these sites belong to the US Department of Defence (DoD) and were
    not commercial sites, which may give security less priority than the DoD.
    NCSA also quote the FBI as reporting that in more than 80 percent of FBI investigated
    computer crimes, unauthorized access was gained through the Internet.
    Putting a value on the damage done by such attacks is difficult but a 1995 survey conducted
    by Ernst & Young, a New York based accounting firm, reported that one third of businesses
    connected to the Internet reported up to 100 000 USD in financial loss over a two year period due
    to malicious acts by computer users outside the firm. A little more than two percent of connected
    companies reported losses of more than 1M USD.
    There is amazement in the computer security industry at the level of ignorance to the
    problem. To understand the risks often involves a steep learning curve and they have few real
    parallels in everyday life, for example nobody worries that a burglar will be able to trick their
    front door into opening by posting cryptic messages through the letterbox. When there is a good
    "hacker" story to report the press goes into frenzy, but the general level of awareness is still
    surprisingly low. For example, the Sunday Times which prides itself on providing accurate
    coverage of IT issues published an article recently that claimed that most businesses worry too
    much about Internet security. The article goes on to explain that encryption is all that is needed to
    be completely secure. The article focuses purely on privacy of communication and completely
    misses the possibility of an attack originating from the Internet.

     

    1, anecdotal  [,ænik'dəutəl]
    adj. 轶事的;轶事一样的;多轶事的

    2, glean  [ɡli:n]
    vt. 收集(资料);拾(落穗)
    vi. 收集;拾落穗
    3, breach  [bri:tʃ]
    n. 违背,违反;缺口
    vt. 违反,破坏;打破
    4, citing 
    vbl. 引用,引证,举例
    5, burglar  ['bə:ɡlə]
    n. 夜贼,窃贼
    6, cryptic  ['kriptik]
    a. 秘密的(使用密码的,意义深远的)

    Continue reading it-e-58 Network Security Report

    我来谈谈web框架

    首先声明:一家之言,权当笑尔。

    我做web有些时候了,刚开始做.net时遇到一个前辈写的框架,一堆xml配置,配置用什么.net控件,样式是什么。一个页面用一个xml配置就出来了。哎呀我的个天,那个xml真是看着头疼啊,做梦都是xml。一个不小心配错了就报错,但是找错又不直观。动态生成的控件,无法使用vs调试。每添加个新功能还是得改代码。我当时很纳闷,为什么要这样写呢?抛弃了.net提供的优点不说,把个逻辑混成一团分不开,我好郁闷,二次开发就是这么痛!现在想一想,大概是她想保持界面风格一致吧,受够排版的苦了?这也造成了我对xml极度的反感。

    后来做java,刚开始很喜欢框架,见个新框架就很激动,抱着这个action看又抱着那个action看。但是实际用的过程中比起.net组件化的架构确实要差一些,后来自己写了个框架sopo。意思是简单好用。

    JSF

    我最先用的是jsf,那时国内都是struts,而jsf正是刚提出来的时候,大概公司的技术领袖被sun的王婆卖瓜吹得晕乎了,决定使用jsf。我就开始jsf了,要自己开发jsf组件,开发一个还好,开发那么多我就烦了,这是什么个东西??我要开发个组件要配置一堆xml,经常配错就报莫名其妙的错误,你根本想不到是配置造成的。哎我嘞个去,又是这个xml。jsf组件开发也是MVC模型,写个组件起码要3个类(我写个tree组件有十几个类),它还有个绘制器的概念,意思是说哎呀你写个模型可以使用不同的绘制器来展示就可以了,像手机的用手机绘制器,浏览器用html绘制器。刚开始我还蛮认同的,后来一到写绘制器就心里就窝火:你XXX的能在html上站稳脚跟就不错了,还手机的,看我以后还用不用你@#¥@#¥。还有个特点就是慢,如今jsf都这么多年了,我打开一个jsf的网站,感觉就是-----慢。也难怪,本来一步就可以做好的事情,非要拆开一二三四五六,能不慢吗?这也反映了java普遍存在的问题---学院学究,摊子太大,脱离实际!

    后来换了家公司,他们也是上了jsf的套,正好找到我来救火,一看,匆匆忙忙组件都不会写,还用的richfaces。richfaces写组件还要依照他们规范来写客户端脚本。不过我倒觉得richfaces做的要好些,他的实现理念还比较创新,与ajax结合的比较好。我还发现了richfaces当时刷新请求机制的顺序问题,让richfaces的开发者改了。这家公司后来也怕了jsf,决定不再使用。

    Tapestry

    后来听说tapestry性能好,我就开始试用。它是基于模板的展现,但是我一直想找动态创建组件的方法,没有。看了源码,也没什么好办法实现!找资料,很少,而且我觉得tapestry4之前都比较复杂,虽然tapestry5似乎是意识到了这一点,大刀阔斧的删了很多鸡肋。但是一直没有火起来啊!用的人少,自己用的也不是很顺手。我对他的兴趣也越累越淡,弃之。

    webwork

    口口声声是说基于组件的,但是我想找到动态创建组建的方法,还是没有??页面上要写组件,代码里面还是要通过id才能获得@@。晕……其他的我也不想说了,不是我想要的。

    Strust2

    Struts出来的早,别人用着都好,MVC嘛,简单就是美,我认同硬道理--实际用的人多就是有道理的。struts2是基于webwork2的, MVC很好,我首先自己开发标签,(开发struts2标签见我的文章 http://kazge.com/archives/71.html)。感觉不爽。

    来看看广为流传的struts2的特点:

    Struts2 Action有以下特点:
    —  Action类完全是一个POJO,因此具有很好的代码复用性。
    —  Action类无需与Servlet API耦合,因此进行单元测试非常简单。
    —  Action类的execute方法仅返回一个字符串作为处理结果,该处理结果可映射到任何的视图,甚至是另一个Action。

    前两点我很赞同,第三点我很痛恨,因为涉及到xml.我还要用到过导航继承,那个配置哦,配得我头都是昏的。我真搞不懂,不就是个导航吗?有必要搞得这么复杂吗?实现个页面要配置几个地方,这是个问题啊。曾经有人问我一个struts2的程序为什么那样写,就是个登陆的功能,这个跳到那,那儿再跳到远方……他看半天没看懂¥%¥%。哎---无语。

    struts2还提供多种“特性”,什么多种模板语言啊,titles啊,实际你用起来,觉得完全就是忽悠人,就算是吃饱了撑着一个项目里面用多个模板语言,它实际支持的很不好,这毛病那毛病,你用了就知道。

    许多细节地方我都不说了,反正我用struts2很恼火。

    SpringMVC

    这个和spring结合的话倒是很方便,不过它的映射仍然需要配置或者是写注释。每写个页面要写个模板,控制器,配置mapping。我比较反感的是不能省略配置映射这一步---哪那么多配置的!!不过相对于其他来说,还是比较简洁的。如果以“保持团队编程风格一致”这个理由(我可是很不认同这个观点)来说非得选个框架的话,我就会选它。

     

    我相信许多熟手都会自己掌控住一个灵活的适合系统的框架。通过对底层几种技术的柔和应用来构建系统,而不需要这些另外的框架。毕竟,那只是个框架,它只提供了一种工具而已。

    Continue reading 我来谈谈web框架

    Pagination


    Total views.

    © 2013 - 2019. All rights reserved.

    Powered by Hydejack v6.6.1