What is a secure network? Can an Internet be made secure? Although the concept of a
secure network is appealing to most users, networks cannot be classified simply as secure or not
secure because the term is not absoluteeach group defines the level of access that is permitted
or denied. For example, some organizations store data that is valuable. Such organizations define
a secure network to be a system prevents outsiders from accessing the organization's computers.
Other organizations need to make information available to outsiders, but prohibit outsiders from
changing the data. Such organizations may define a secure network as one that allows arbitrary
access to data, but includes mechanisms that prevent unauthorized changes. Finally, many large
organizations need a complex definition of security that allows access to selected data or services
the organization chooses to make public, while preventing access or modification of sensitive
data and services that are kept private.
Because no absolute definition of information secure exists, the first step an organization
must take to achieve a secure system is to define the organization's security policy. The policy
does not specify how to achieve protection. Instead, it states clearly and unambiguously the items
that are to be protected.
Defining an information security policy is complex. The primary complexity arises because an
information security policy cannot be separated from the security policy for computer systems
attached to the network. In particular, defining a policy for data that traverses a network does not
guarantee that data will be secure. Information security cannot prevent unauthorized users who
have accounts on the computer from obtaining a copy of the data. The policy must hold for the data
stored on disk, data communicated over a telephone line with a dialup modem, information printed
on paper, data transported on portable media such as a floppy disk, and data communicated over a
Defining a security policy is also complicated because each organization must decide which
aspects of protection are most important, and often must compromise between security and ease
of use. For example, an organization can consider:
Data Confidentiality and Privacy.
Continue reading it-e-60 Secure Networks and Policies
从这四种自动生成工具来看， mapping file, java file and DDL，只要知道任何一种文件，都可以得到另外两种文件，
1. 只有mapping file:
Continue reading hibernate工程，正向还是反向？
A packet filter is often used to protect an organization's computers and networks from
unwanted Internet traffic. The filter is placed in the router that connects the organization to the
rest of the Internet.
A packet filter configured to protect an organization against traffic from the rest of the
Internet is called an Internet firewall; the term is derived from the fireproof physical boundary
placed between two structures to prevent fire from moving between them. Like a conventional
firewall, an Internet firewall is designed to keep problems in the Internet from spreading to an
Firewalls are the most important security tool used to handle network connections between
two organizations that do not trust each other. By placing a firewall on each external network
connection, an organization can define a secure perimeter that prevents outsiders from interfering
with the organization's computers. In particular, by limiting access to a small set of computers, a
firewall can prevent outsiders from probing all computers in an organization or flooding the
organization's network with unwanted traffic.
A firewall can lower the cost of providing security. Without a firewall to prevent access,
outsiders can send packets to arbitrary computers in an organization. Consequently, to provide
security, an organization must make all of its computer secure. With a firewall, however, a
manager can restrict incoming packets to a small set of computers. In the extreme case, the set
can contain a single computer. Although computers in the set must be secure, other computers in
the organization do not need to be. Thus, an organization can save money because it is less
expensive to install a firewall than to make all computer systems secure.
1, perimeter [pə'rimitə]
n. 周长；周界；[眼科] 视野计
2, interfering [,intə'fiəriŋ]
3, arbitrary ['ɑ:bitrəri]
adj. [数] 任意的；武断的；专制的
Continue reading it-e-59 Internet Firewall Concept
Any one responsible for the security of a trusted network will be concerned when connecting
it to a distrusted network. In the case of connections to the Internet this concern may be based
largely on anecdotal evidence gleaned from widespread media coverage of security breaches. A
closer inspection of the facts and statistics behind some of the media coverage will, however, only
serve to deepen that concern. For example, the US National Computer Security Agency (NCSA)
asserts that most attacks to computer systems go undetected and unreported, citing attacks made
against 9,000 Department of Defence computers by the US Defence Information Systems Agency
(DISA). These attacks had an 88 percent success rate and went undetected by more than 95 percent
of the target organizations. Only 5 percent of the 5 percent that detected an attack, a mere 22 sites,
reacted to it.
It is noteworthy that these sites belong to the US Department of Defence (DoD) and were
not commercial sites, which may give security less priority than the DoD.
NCSA also quote the FBI as reporting that in more than 80 percent of FBI investigated
computer crimes, unauthorized access was gained through the Internet.
Putting a value on the damage done by such attacks is difficult but a 1995 survey conducted
by Ernst & Young, a New York based accounting firm, reported that one third of businesses
connected to the Internet reported up to 100 000 USD in financial loss over a two year period due
to malicious acts by computer users outside the firm. A little more than two percent of connected
companies reported losses of more than 1M USD.
There is amazement in the computer security industry at the level of ignorance to the
problem. To understand the risks often involves a steep learning curve and they have few real
parallels in everyday life, for example nobody worries that a burglar will be able to trick their
front door into opening by posting cryptic messages through the letterbox. When there is a good
"hacker" story to report the press goes into frenzy, but the general level of awareness is still
surprisingly low. For example, the Sunday Times which prides itself on providing accurate
coverage of IT issues published an article recently that claimed that most businesses worry too
much about Internet security. The article goes on to explain that encryption is all that is needed to
be completely secure. The article focuses purely on privacy of communication and completely
misses the possibility of an attack originating from the Internet.
1, anecdotal [,ænik'dəutəl]
2, glean [ɡli:n]
3, breach [bri:tʃ]
5, burglar ['bə:ɡlə]
6, cryptic ['kriptik]
Continue reading it-e-58 Network Security Report
Struts出来的早，别人用着都好，MVC嘛，简单就是美，我认同硬道理--实际用的人多就是有道理的。struts2是基于webwork2的， MVC很好，我首先自己开发标签,(开发struts2标签见我的文章 http://kazge.com/archives/71.html)。感觉不爽。
— Action类无需与Servlet API耦合，因此进行单元测试非常简单。
Continue reading 我来谈谈web框架
In recent years, Internet changes our life a lot. We use e-mail and Internet phone to talk with
our friends, we get up-to-date information through web and we do shopping in the cyber-market.
Internet has many advantages over traditional communication channels, e.g. it's cost effective, it
delivers information fast and it is not restricted by time and place. The more people use Internet,
the more concerns about Internet security.
In person-to-person community, security is based on physical cues. To name but a few, we
use our signature to authenticate ourselves; we seal letters to prevent others inspection and
modification; we receive receipt with the shop's chop to make sure we paid; we get information
from a reliable source. But in the Internet society, no such physical cue is available. There are
two areas that we concern about in Internet communication. The first one is secrecyhow do we
ensure no one reads the data during its transmission? The second one is authenticationhow do
we be sure that the identity of someone claiming "who it is". Imagine one day you receive an
e-mail, which the e-mail sender is "Bill Gates". How do you confirm the e-mail is actually sent
by Bill Gates?
Encryption is the way to solve the data security problem. In real life, if Tom wants to talk with
Mary secretly, he can choose a room with nobody there and talk with Mary quietly, or he can talk
with Mary using codes understandable by Tom and Mary only. We take the second approach
encryptionto transmit data through Internet. There are two kinds of encryption techniques
symmetric key encryption and asymmetric key encryption.
For symmetric key encryption, both parties should have a consensus about a secret encryption key.
When A wants to send a message to B, A uses the secret key to encrypt the message. After receiving the
encrypted message ,B uses the same (or derived)secret key to encrypt the message.The advantage of
using symmetric key encryption lies in its fast encryption and decryption processes(when compared
with asymmetric key encryption at the same security level). The disadvantages are , first, the encryption
key must be exchanged between two parties in a secure way before sending secret messages. Secondly,
we must use different keys with different parties. For example, if A communicates with B, C, D and E,
A should use 4 different keys. Otherwise, B will know what A and C as well as A and D has been
talking about. The drawbacks of symmetric key encryption make it unsuitable to be used in the Internet,
because it's difficult to find a secure way to exchange the encryption key.
For asymmetric key encryption, there is a pair of keys for each party: a public key and a
private key. The public key is freely available to the public, but only the key owner gets hold of
the private key. Messages encrypted by a public key can only be decrypted by its corresponding
private key, and vice versa. When A sends message to B, A first gets B's public key to encrypt
the message and sends it to A. After receiving the message, B uses his private key to decrypt the
message. The advantage comes in the public key freely available to the public, hence free from
any key exchange problem. The disadvantage is the slow encryption and decryption process.
Almost all encryption schemes used in the Internet uses asymmetric key encryption for
exchanging the symmetric encryption key, and symmetric encryption for better performance.
Asymmetric key cryptography seems to attain secrecy in data transmission, but the authentication
problem still exists. Consider the following scenario: when A sends a message to B, A gets B's
public key from the Internetbut how can A know the public key obtained actually belongs to B?
Digital certificate emerges to solve this problem.
Digital certificate is an identity card counterpart in the computer society. When a person
wants to get a digital certificate, he generates his own key pair, gives the public key as well as
some proof of his identification to the Certificate Authority (CA). CA will check the person's
identification to assure the identity of the applicant. If the applicant is really the one "who
claims to be", CA will issue a digital certificate, with the applicant's name, e-mail address and the
applicant's public key, which is also signed digitally with the CA's private key. When A wants to
send B a message, instead of getting B's public key, A now has to get B's digital certificate. A
first checks the certificate authority's signature with the CA's public key to make sure it's a
trustworthy certificate. Then A obtain B's public key from the certificate, and uses it to encrypt
message and sends to B.
Authentication is an important part everyday life. The lack of strong authentication has
inhibited the development of electronic commerce. It is still necessary for contracts, legal
documents and official letters to be produced on paper. Strong authentication is then, a key
requirement if the Internet is to be used for electronic commerce. Strong authentication is
generally based on modern equivalents of the one time pad. For example tokens are used in place
of one-time pads and are stored on smart cards or disks.
 Many people pay great amounts of lip service to security, but do not want to be bothered
with it when it gets in their way. It's important to build systems and networks in such a way that
the user is not constantly reminded of the security system around him. Users who find security
policies and systems too restrictive will find ways around them. Security is everybody's business,
and only with everyone's cooperation, an intelligent policy, and consistent practices, will it be
1, cue [kju:]
2, chop [tʃɔp]
3, secrecy ['si:krəsi]
4, symmetric [si'metrik]
5, asymmetric [,eisi'metrik]
6, consensus [kən'sensəs]
7, cryptography [krip'tɔɡrəfi]
Continue reading it-e-57 Internet Security
It might be a stretch to call the recent "Melissa" virus a positive event because it disrupted
thousands o government and commercial computer systems. But it did put the focus on content
filtering, a network security technology that observers say has been undervalued. In the long run,
many believe this new focus will prove beneficial to users.
As a macro virus attached to an e-mailed Microsoft Corp. Word document, Melissa would
not have been picked up by traditional security solutions such as firewalls or intrusion-detection
systems, which are designed to detect items that break certain global access rules. The only way
to detect a virus such as Melissa is to examine what is inside the e-mail, which can only be done
through content filtering, supporters of the technology said.
Filtering products have been around for years, but manufacturers have been struggling to
meet the needs of organizations that employ varying security policies among different users.
Recently, however, vendors have released filtering products that can be tailored to the needs of
user groups, and industry has begun working on standards that allow these products to work with
Content filtering encompasses several areas of protection. As well as guarding against
viruses, it includes:
E-mail filtering, which controls incoming e-mail that contains spam, file attachments that
are too large or hoax e-mails. It also can be used internally to make sure confidential information
is not accidentally or intentionally sent outside of the organization.
Uniform Resource Locator filtering, which blocks access to inappropriate sites not connected
to a user's work needs.
Malicious-code protection, which prevents hostile code embedded in Java and ActiveX
scripts in otherwise innocuous World Wide Web pages from reaching the user's browser and
The most obvious benefit of filtering products is the ability to boost network security, but
many organizations also use them for internal network control. For example, URL filters can be
used to block access to certain sites and to maintain productivity. Message Inspector, an e-mail
filter produced by Elron Software Inc. uses context-sensitive filtering to weed out offensive or
sensitive communications in e-mail, newsgroups or FTP sites. Message Inspector is an example
of the newer generation of filter products that examine messages for words and phrases used in
conjunction with each other to narrow the range of filter targets. This strategy differs from the
one employed by traditional products that block communications based on factors such as
keywordsa process that can generate a lot of "false positive" alarms.
Melissa presented a clear idea of why people need a gateway-based virus-detection product,
"Viruses need to be kept out of the enterprise altogether because you just can't update all
virus-detection software on desktops in time to catch them."
The International Computer Security Association is working on what it calls the Common
Content Inspection program to define a general application program interface (API) that would
enable filter vendors to fit their products to a range of firewalls.
1, disrupt [dis'rʌpt]
2, hoax [həuks]
Continue reading it-e-56 Content Filtering Sifts out Viruses
Backdoor programs are typically more dangerous than computer viruses, as they can be
used by an intruder to take control of a PC and potentially gain access to an entire network.
Backdoor programs, also referred to as Trojan horses, are typically sent as attachments to
e-mails with innocent-looking file names, tricking users into installing them. They often enable
remote users to listen in on conversations using the host computer's microphone, or even see
through its video camera if it has one. Back Orifice (BO) 2000 is a backdoor program designed
for malicious use. Its main purpose is to maintain unauthorized control over another machine for
reconfiguration and data collection. It takes the form of a client/server application that can
remotely control a machine without the user's knowledge to gather information, perform system
commands, reconfigure machines and redirect network traffic.
With BO an intruder has to know the user's IP address to connect, or could scan an entire
network looking for the victim. Once connected, the intruder can send requests to the BO 2000
server program, which performs the actions the intruder specifies on the victim's computer,
sending back the results.
BO is installed on the server machine simply through the execution of the server application.
This executable file is originally named bo2k.exe, but it can be renamed. The configuration wizard
will step through the various configuration settings, including the server file (the executable), the
network protocol, port number, encryption, and password. Once this process is complete, running
bo2kgui.exe executes the user interface for BO.
It is very difficult to detect BO, because it is so highly configurable. In addition, backdoor
programs are multi-dimensional, so several detection methods are recommended to achieve maximum
protection and awareness of the installation of BO 2000 on a machine or series of machines on a
We recommend coupling the use of an updated version of anti-virus software to detect
which machines on the network have BO installedand intrusion detection software to identify
attacks over the network.
Users are urged to follow three important precautions:
Do not accept files from Internet chat systems.
If you are connected to the Internet, do not enable network sharing without proper security
Do not open e-mail attachments: never run any executable files sent to you (.exe files or .zip
files with a.exe in them). It is safer if these are run through a virus checker first, but they could be
new backdoor programs or viruses that a virus scanner will not detect. It is safe to open Word
documents and Excel spreadsheets if the Microsoft Auto-Run feature is turned off. Allowing
macros to run automatically can spread e-mail viruses such as Melissa. Many people send each
other animations in e-mail: it is easy to put a backdoor program into one of these and users
cannot tell when they infect their computers with Back Orifice 2000.
1, potentially [pə'tenʃəli]
Continue reading it-e-55 Backdoor
Continue reading FTP连接后出现无法显示列表或列表错误问题的解决方法
Just as human viruses invade a living cell and then turn it into a factory for manufacturing
viruses, computer viruses are small program that replicate by attaching a copy of themselves to
another program. Once attached to the host program, the virus then lock for other programs to
"infect". In this way, the virus can spread quickly throughout a hard disk or an entire organization if
it infects a LAN (Local Area Network) or a multi-users system.
 Skillfully written virus can infect and multiply for weeks or months without being detected.
During that time, system backups duplicate the viruses, or copies of data or programs made and
passed to other systems to infect. At some pointdetermined by how the virus was programmed
the virus attacks. The timing of the attack can be linked to a number of situations, including: a
certain time or date; the presence of a particular user ID; the use or presence of a particular file; the
security privilege level of the user; and the number of times of a file is used.
Likewise, the mode of attack varies, so-called "being" viruses might simply display a
message, like the one that infected IBM's main computer system last Christmas with a season's
Malignant viruses, on the other hand, are designed to damage your system. One common
attack is to wipe out data, to delete files, or to perform a format of disk.
There are four main types of viruses: shell, intrusive, operating system, and source code.
Shell viruses wrap themselves around a host and do not modify the original program.
Shell program are easy to write, which is why about half of all viruses are of this type. In
addition, shell viruses are easy for programs like Data Physician to remove.
Intrusive viruses invade an existing program and actually insert a portion of themselves
into the host program. Intrusive viruses are hard to write and difficult to remove without
damaging the host file.
Shell and intrusive viruses most commonly attack executable program filethose with.
COM or. EXE extensionalthough data are also at some risk.
Operating system viruses work by replacing parts of operating system with their own
logic. Very difficult to write, these viruses have the ability, once booted up, to take
total control of your system. According to Digital Dispatch, known versions of operating
system viruses have hidden large amounts of attack logic in falsely marked bad disk
sectors. Others install RAM-resident programs or device drivers to perform infection or
attack functions invisibly from memory.
Source code viruses are intrusive programs that are inserted into a source program
as those written in Pascal prior to the program being compiled. These are the least
common viruses because they are not only hard to write, but also have a limited number
of hosts compared to the other types.
New computer viruses are written all the time, and it's important to understand how your
system can be exposed to them and what can do to protect your computer. Follow the suggestions
listed below to substantially decrease the danger of infecting your computer system with a
potentially dangerous computer virus.
Be very cautious about inserting disks from unknown sources into your computer.
Always scan the disk's files before operating any of them.
Only download Internet files from reputable sites.
Do not open e-mail attachments (especially executable files) from strangers.
Purchase, install, and use an anti-virus software program. The program you choose must
provide three functions:
As new viruses are created everyday, upgrade your anti-virus software regularly.
1, invade [in'veid]
2, replicate ['replikit, 'replikeit]
3, wipe [waip]
Continue reading it-e-54 Computer Viruses