Dr.Anton Chuvakin, Loglogic ְ α -2
ۼ 2008-12-02
ȸ : 11,741
By Stephen Northcutt, SANS Technology Institute
January 28th,2008
Ttranslated by DigitalSecu
-̾-
, δ, ưưϰ perimeter/ ϰ ϴ ο ִ ̴ ° ϴ. Ե ̰ ū κ Դϴ. ĶϾƿ ִ ڿ ⸦ ϴ. ״ ø̼ ȭ ã ߴµ, ذϷ غ WAF ̻ Ǵ ߰ ͺ̽ 翡 ַ Ѵϴ, ֳϸ ַǵ ͺ̽ ̴߽ϱ. : 信 Ͽ ΰ Ѻ ֳ?
α ϰ Ȱ 縦 Ʈ尡 ֽϴ; Ǵ ͺ̽ α뿡 ʾҾ Ÿϴ. ١ϴ 簡 ƴϾϴ.
ֱٿ, 丮 ȿ ִ £ Ǿϴ. ⸦ 丮 ϳ ϴ ų(90 ʱ ķ) λ , α Ǵ ٸ ɵ Ű ַǿ ϳ Ȥ ̻ ߰ؾ߸ ߴٰ ߽ϴ.
: ? ó ʾҽϱ? ߽ϴ: ϰ αϴ ɷ ʰ ϴ ǰ?
쿡 մϴ, ʴ ǰ Դϴ. 뵵 Ϻδ:
- troubleshooting: ٿ ߰ ƴ
- å : ߴ°, Ǵ ?
- ؼ: 䱸
- : ߰ Ƴ?
- ȭ: 츮 ŷ
ִ°?
ü, ٰ ٸ ൿ 翡 Ʈ尡 ε ӵ ӵ ̶ մϴ.ٺ ̷! ()
α , ִ Ǽ ϳ Ұ ϴ Դϴ: ö̾ 뵵 α α, ø̼ α... α Ͱ (ξ - HR ) մϴ, Ƿ а ٵ ʿ䰡 ֽϴ: α ÷ο.
, α ̿ϱ ߽ϴ. ? ұ Ȥ ұ? 鰳 Ĩϴ : ! αװ ϴ ŭ ܼ ʴ; Ư 츮 Ʈ α մϴ.
ù°( α ϴ ̱⸦) ι° ҸŸ Դϱ?
1. ȿ α ؼ ɰϰ ջ Ŀ α ó ϴ Դϴ. α (: +м, ) ʴ´ٸ, ް Դϴ: Ҹ ʹ ޱ⸦ ϴ Դϴ.
2. Ե, α ˰ , ǹ̿ ǥ Ῡ 2Դϴ( 츮 MITRE CEE ǥ װ ذϷ ۾ ϰ ֽϴ)
α뿡 ܿ Ǵ ū Ǽ ΰ?
α ʴ Դϴ!
ϴ ų! ƽôٽ, ó 1995ϴ. ó α ϰ ִ Dr. Gene Schultz ⸦ ߽ϴ. װ մϴ. α ʴ´ , ּ α ؾ Ѵ. ؾ߸ û 𰡸 ִ. Ϲ ϴ ٸ Ǽ鿡 ?
, ٸ Ǽ鿡 ϴµ ð ֽϴ. Ե α ʴ ſ Դϴ. ̰ ũ ظ ġ ġ ǼԴϴ. Ⱓ Ѻ α뿡 õ ٸ Ǽ ϴ:
1. α ϴ : α ʴ Ϲ ѹ α ̴.
2. α ʴ : α Ǹϴ, ġ κ װ͵ ϴ Ϳ ܳϴ.
3. ʹ ܱⰣ α ϴ : α Ŀ ִ, α ʹ ª ұ ̴.
4. α 켱 ϴ : ̰ ٷο ٸ ʿ䰡 α鿡 Ͽ ǰ ºθ Ŵ¡ κ Ѵ.
5. ø̼κ α ϴ : Ǽ 츮 Ʈũ ý ȿ α κ Ʈũ gear ƴ϶ ø̼ǿ Ͼ Ϳ ̵Կ źγ ̴.
6. ƴ ϴ ڴ: ŷ α ߸ ִ: ߸ ͡ Ű ʹ ̴. ְ ٹ ̰Ͱ ƴ ϴ ̸ ϱ⡱ ϴ ̴.
ڰ ϰ α ǥ ?
α ǥ: ǥص ̷? ! װ ̷ ֽϴ. Common Event Expression(CEE- http://cee.mitre.org) ۵Ǿ, ٽ α ڵ( Ʈ ÷ ) ( α ) ϰ ִ. ̰ , 츮 ̹ ϰ ֽϴ.
澾, ϳ ڱ ȸ ִ ε..Ȱ Ͽ ϰ ִ ȸ 帮ڽϴ.
߰ ε Դϴ. ()
- α ض
- α ϶
- ÷ ٹ- â(siloed) ƴ϶- α뿡 ض
, ð ֽ Ϳ 帳ϴ. Դϴ, Anton Chuvakin ο ⸦ ֽ ֳ? ǻ տ ϸ ?
, ¥ ҹ ̸ ֽϴ: , Olga ð ̿ܿ , ŷ, , 豸, (, ), Ű(ܿ£), ī() ⱸ, ٸ ִµ ȳ . ()