Dr.Anton Chuvakin, Loglogic ְ α -1
ۼ 2008-12-02
ȸ : 13,230
By Stephen Northcutt, SANS Technology Institute
January 28th,2008
Loglogic Dr.Anton Chuvakin SANS ҿ ͺ信 ߴ. װ ð Ҿ Ϳ ʹ Ѵ. ״ ý α뿡 ְ ̸ װ ٹϴ ȸ α Ϸ ̹Ƿ, 츮 İ ȸ Ϳ 縦 ǥѴ.
Dr. Chuvakin, ü α о߿ ־ Խϴ; 츮 翡 10 Ȥ ̻ ߽ϴ. ̰ Ͻ ΰ ƴ 츮 10 Ȥ ̻ ȿ ؾ ִ ǰ?
׳ Anton, Stephen ҷּ. α Ȯϰ ǻ ٸ ̳ IT ʿ մϴ. ̸ α - ̷!- ̿밡ϵ α ÷ α ϴ ˷ logjam ʴ Դϴ.
Anton.. logjam̶ մϴ, ƶ ǹ̰ ϴϱ. ڿ ö̾ ܵ α м ϴ ǰ Ű?
Log=accountability(å). α ϰ , åӼ ϴ ƾ մϴ. װ ϰ ϴ Դϱ? α ϰ, ϰ ϱ⸦ 䱸ϴ ֱ κ Ե α ν ؾ մϴ.
մϴ. 澾, α ϴ = ̶ ο ֽ ֳ?
, ϴ: Sarbanes-Oxley Ϻ (аԴ ܺ 顱 ǹϴµ ) α ( , װ͵ ϱ ʿ伺 ) ߴٸ, ٸ ͵ մϴ : FISMA () α 並 ǹȭϰ HIPAA(Ƿ) װ ϰ ֽϴ.
ɵ ϴ ٹ ִµ, ̰͵ ϳ ߿ ĺϰ װ Ȯ ȣǴµ δ ̴ϴ. ſ ̰ Ǹ Ҹ ̾ϴ: ð ĺϰ Ϸ ? 2006 ̷, ߰(digital discovery) Ͼ, Ͽ Ϻ ۾ ϴ. 츮 ϸ, ߿ ϴ ۾ ȭ ֽϴ. α α м , ٷ Դϴ. ߽ ȣ Űó ٶ ֽϱ?
Ʈũ ý ߽ɿ ߽ ߴϴ ֱ ¡ ü Ʋ ȭ ɷµ ʿ ݴϴ. װ ϳ? α, ̹ ɷ ֽϴ! α Űó ġν ̿ϱ⸸ ϸ ˴ϴ.
ϰ ִ( м ӿ ϴ ƴϴ) ŵ ֽϴ:
- ؼ ͺ̽ ȿ ߵǰ ִ. ͺ̽ ̶ κ Ϳ Դϴ.
-ֱ ǰ ο ͡ Ӹ ƴ϶ ϰ ϴ ־ϴ.
-߰, ID ȿ ߵǴ ״: Ŀ Ʈũ ̸ (δ ƴϴ!) Ӹ ƴ϶, ͷ Ϸ ǵ ϴٴ ˱ ߽ϴ
̿ , Ʈũ/ý ӵ ȭ ϰ ֽϴ. ̰ ϰ ͺ̽; Desktop ; Ϳ; 縦 ʿ伺 ϴ;
澾, α ϰ Ǵ ְ dz. NIST SP 800-92, Guide to Computer Security Log Management оµ, α Ϲ ҽ ־ϴ. Ǹϰ ҽϴ, ٸ α ҽ ִٴ ˰ ֽϴ. ͵ α Ѵٰ Ѵٸ, װ ó ?
NIST SP 800-92: http://crsc.nist.gov/publications/nistpubs/800-92/SP800-92.pdf
츮 ٷ α ҽ ϰ ִٴ Ͽϴ: ȭ IDS α鿡, , α ҽ-ͺ̽, ø̼ǵ Ÿ - Ȯǰ ֽϴ.
ϸ, , ϴ ȭ Ǵ Ʈũ ڴ ּ ɻ PIX Ǵ Checkpoint αϴ ܼ Ŀؼ ϴ. , ȭ α м α 翡 ʱ Ͻ ߽ϴ. ǥ syslog ȭ α α 䰡 ϴ.
, ý ڵ α ϴ ˾Ҿ , Ŵ ý(Windows Unix/Linux ) α м ֱٱ ߽ϴ. , ߿ ( ߿ ) κ α ϴ LASSO agentless α ظ ҽϴ. ݸ, н α м syslog Ͽ α ϵ Ῡ ϰ ȭǾϴ.
ϰԴ, ̸ α ̸ ټ ߾ϴ: ߸ǰų(̸ ) Ǵ ɰϰ ߸(ܺڰ α ȯ) ̸ α Ǹ ˴ϴ. Native centralization α ˵ ̸ α м ߽ϴ.
, ͺ̽ α Ƹ ۳ κ IT ڵ ̴ ʾҾϴ. ̰ λϰ ֽϴ! , IT ܵRDBMS α ɵ ִ , װ͵ κ ۵ ٴ ǿ ߽ϴ. ϳ ̰ Դϴ. ϴ ȴٸ( ͽ ؾ ϴ ȴٸ), Oracle, MS SQL, DB2, MySQL Ǹ α մϴ.
ϱ? Web application large enterprise application framework ü ϰ , ħ װ͵ α Ͱ , ٸ ŷڹ 뿡 ũ Ѵٴ ݱ ߽ϴ. ξ α α ַ ⸦ ϰ ֽϴ. ߰ desktop α м ʹ ȵ˴ϴ. ̷, پ α ҽ ȥչ ߰ Դϴ. Ŀ ø̼, ٸ ġ Ʈ 鸮⸦ Դϴ.
̷, 츮 ȭ α, α ̸ϰ α, ̽( ִ), ٸ ø̼ǵ IT α ҽ ֽ߽ϴ.
ϴ. Ҹ Ǹϰ ߿ϰ 鸮..̲ ΰ? ֳĸ ߰Ǵ ̰ŵ? û α ϰ ϴ Ͻ ΰ?
鸱 ְ ̰ ֿ ƮԴϴ; , Źͽ ӿũ ǥص α α ٷ Դϴ. ֱ PCI, NIST 800-92, ITIL Ʈ ٸ ͵ . Ϲ α װ͵ ϰ ϴ ǹȭϰ ֽϴ.
ö̾ ġ Ͼ ϱ? ö̾Դϴ. Ÿ Ѱ ִµ, װ α õǾ ֽϴ: e-discovery. α ŷμ ʿ䰡 ְ α ÷ س Ұ̶ Ҹմϴ.
- -