https://www.clearsec.org/wikis/ise/ises/12_%E5%AE%89%E5%85%A8%E5%AE%A1%E8%AE%A1/Recent content in 安全审计 on ClearSec WikiHugozh-cnFri, 15 Nov 2024 09:44:26 +0800https://www.clearsec.org/wikis/ise/ises/12_%E5%AE%89%E5%85%A8%E5%AE%A1%E8%AE%A1/12.1_%E5%AE%A1%E8%AE%A1%E6%A6%82%E8%BF%B0%E8%A6%81%E6%B1%82%E4%B8%8E%E5%88%86%E7%B1%BB/Fri, 15 Nov 2024 09:44:26 +0800https://www.clearsec.org/wikis/ise/ises/12_%E5%AE%89%E5%85%A8%E5%AE%A1%E8%AE%A1/12.1_%E5%AE%A1%E8%AE%A1%E6%A6%82%E8%BF%B0%E8%A6%81%E6%B1%82%E4%B8%8E%E5%88%86%E7%B1%BB/<h3 id="网络安全审计概述">网络安全审计概述</h3> <p>AAAA 认证 授权 账号 <strong>审计</strong></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.1_%E5%AE%A1%E8%AE%A1%E6%A6%82%E8%BF%B0%E3%80%81%E8%A6%81%E6%B1%82%E4%B8%8E%E5%88%86%E7%B1%BB/d229087c10ad709e7f734ec8d5d8ec94_MD5.png" alt=""></p> <h3 id="等保五个级别对审计的要求">等保五个级别对审计的要求</h3> <p>等保是从二级开始引入审计</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.1_%E5%AE%A1%E8%AE%A1%E6%A6%82%E8%BF%B0%E3%80%81%E8%A6%81%E6%B1%82%E4%B8%8E%E5%88%86%E7%B1%BB/6d7c7e7cb3989411a6c0e5cc8e8d42e1_MD5.png" alt=""></p> <h3 id="网络安全审计系统类型">网络安全审计系统类型</h3> <p>快捷键Win+R，输入“eventvwr.msc”打开事件查看器。</p> <p>compmgmt.msc打开计算机管理-有共享管理、用户管理、事件查看器、计划任务、性能、设备查看器、磁盘管理和系统服务及应用程序管理。</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.1_%E5%AE%A1%E8%AE%A1%E6%A6%82%E8%BF%B0%E3%80%81%E8%A6%81%E6%B1%82%E4%B8%8E%E5%88%86%E7%B1%BB/b775807f0c88b1840d4c6c0d2efa0449_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.1_%E5%AE%A1%E8%AE%A1%E6%A6%82%E8%BF%B0%E3%80%81%E8%A6%81%E6%B1%82%E4%B8%8E%E5%88%86%E7%B1%BB/94669d10dc3eca5ebc9f1d1e233a1552_MD5.png" alt=""></p>https://www.clearsec.org/wikis/ise/ises/12_%E5%AE%89%E5%85%A8%E5%AE%A1%E8%AE%A1/12.2_%E5%AE%A1%E8%AE%A1%E6%9C%BA%E5%88%B6%E4%B8%8E%E5%AE%9E%E7%8E%B0%E6%8A%80%E6%9C%AF/Fri, 15 Nov 2024 09:44:26 +0800https://www.clearsec.org/wikis/ise/ises/12_%E5%AE%89%E5%85%A8%E5%AE%A1%E8%AE%A1/12.2_%E5%AE%A1%E8%AE%A1%E6%9C%BA%E5%88%B6%E4%B8%8E%E5%AE%9E%E7%8E%B0%E6%8A%80%E6%9C%AF/<h3 id="分类系统日志采集网络流量获取">分类|系统日志采集&amp;网络流量获取</h3> <p>分类：主机、网络通信、应用。</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.2_%E5%AE%A1%E8%AE%A1%E6%9C%BA%E5%88%B6%E4%B8%8E%E5%AE%9E%E7%8E%B0%E6%8A%80%E6%9C%AF/b349e85c0eb13a4ed62264f84fe77415_MD5.png" alt=""></p> <p>共享网络监听：通过集线器共享网络流量。集线器将入口流量转发到所有出口。共享网络已被淘汰。</p> <p>交换机端口镜像：需在交换机上配置。</p> <p>网络分流器：其实是定制的交换机，适用于大流量场景。一般是运营商在用。</p> <h3 id="数据捕获软件-wireshark-libpcap">数据捕获软件-Wireshark-Libpcap</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.2_%E5%AE%A1%E8%AE%A1%E6%9C%BA%E5%88%B6%E4%B8%8E%E5%AE%9E%E7%8E%B0%E6%8A%80%E6%9C%AF/f5626b559256c3e8cd394c5c5608652b_MD5.png" alt=""></p> <h3 id="网络审计-数据安全分析技术">网络审计 数据安全分析技术</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.2_%E5%AE%A1%E8%AE%A1%E6%9C%BA%E5%88%B6%E4%B8%8E%E5%AE%9E%E7%8E%B0%E6%8A%80%E6%9C%AF/6fabc4b7d93908b986cd87b99c5f6dc1_MD5.png" alt=""></p> <h3 id="网络审计-数据存储技术">网络审计 数据存储技术</h3> <p>分散存储、集中存储</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.2_%E5%AE%A1%E8%AE%A1%E6%9C%BA%E5%88%B6%E4%B8%8E%E5%AE%9E%E7%8E%B0%E6%8A%80%E6%9C%AF/b9b994a8d774c03b99491b301924e60c_MD5.png" alt=""></p> <p><strong>态势感知就能集中存储。</strong></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.2_%E5%AE%A1%E8%AE%A1%E6%9C%BA%E5%88%B6%E4%B8%8E%E5%AE%9E%E7%8E%B0%E6%8A%80%E6%9C%AF/d3c7d732dc1e551115b291fc80cbd777_MD5.png" alt=""></p> <h3 id="网络审计-数据保护技术">网络审计 数据保护技术</h3> <p>系统分权：操作员、安全员、审计员。</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.2_%E5%AE%A1%E8%AE%A1%E6%9C%BA%E5%88%B6%E4%B8%8E%E5%AE%9E%E7%8E%B0%E6%8A%80%E6%9C%AF/15511acd83339a8298acff9ead9f9c0a_MD5.png" alt=""> 审计三权分立</p> <p>数据加密、强制访问措施、隐私保护、审计数据完整性保护。</p>https://www.clearsec.org/wikis/ise/ises/12_%E5%AE%89%E5%85%A8%E5%AE%A1%E8%AE%A1/12.3_%E5%AE%A1%E8%AE%A1%E4%BA%A7%E5%93%81%E4%B8%8E%E5%BA%94%E7%94%A8/Fri, 15 Nov 2024 09:44:26 +0800https://www.clearsec.org/wikis/ise/ises/12_%E5%AE%89%E5%85%A8%E5%AE%A1%E8%AE%A1/12.3_%E5%AE%A1%E8%AE%A1%E4%BA%A7%E5%93%81%E4%B8%8E%E5%BA%94%E7%94%A8/<p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.3_%E5%AE%A1%E8%AE%A1%E4%BA%A7%E5%93%81%E4%B8%8E%E5%BA%94%E7%94%A8/00af12b2b0bb112d5954812897ae5de8_MD5.png" alt=""></p> <h3 id="网络安全审计产品日志-主机-数据库">网络安全审计产品（日志-主机-数据库）</h3> <p>EDR是一个相当综合的产品，在许多产品的章节都有它。</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.3_%E5%AE%A1%E8%AE%A1%E4%BA%A7%E5%93%81%E4%B8%8E%E5%BA%94%E7%94%A8/e808879cad69d46ddc2d012b7f24f53e_MD5.png" alt=""></p> <h3 id="网络安全审计产品上网行为管理">网络安全审计产品（上网行为管理）</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.3_%E5%AE%A1%E8%AE%A1%E4%BA%A7%E5%93%81%E4%B8%8E%E5%BA%94%E7%94%A8/bf22498447aa933f74a5dd581f0ba03c_MD5.png" alt=""></p> <p>qq这种需要协议加密的产品，需要在客户端安装代理来解密流量。</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.3_%E5%AE%A1%E8%AE%A1%E4%BA%A7%E5%93%81%E4%B8%8E%E5%BA%94%E7%94%A8/537599fc4a2d2b869a15c7685bed6aad_MD5.png" alt=""><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.3_%E5%AE%A1%E8%AE%A1%E4%BA%A7%E5%93%81%E4%B8%8E%E5%BA%94%E7%94%A8/bb79056f489c9f66bf72494dc50f317f_MD5.png" alt="">工控产品就是加入了工控协议。</p> <h3 id="网络安全审计产品运维审计-堡垒机">网络安全审计产品（运维审计-堡垒机）</h3> <p>等保中-堡垒机有集中管理功能，作为安全管理中心测评。</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.3_%E5%AE%A1%E8%AE%A1%E4%BA%A7%E5%93%81%E4%B8%8E%E5%BA%94%E7%94%A8/5bb7e8d3dfc99add8f4c58d690475900_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.3_%E5%AE%A1%E8%AE%A1%E4%BA%A7%E5%93%81%E4%B8%8E%E5%BA%94%E7%94%A8/ce4c87e0c2c8192bb9ac0f4d04211d79_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.3_%E5%AE%A1%E8%AE%A1%E4%BA%A7%E5%93%81%E4%B8%8E%E5%BA%94%E7%94%A8/99cf3a8c7d76ce85060f3baeb73e5298_MD5.png" alt=""></p> <p>堡垒机也能有单点登录的功能。</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.3_%E5%AE%A1%E8%AE%A1%E4%BA%A7%E5%93%81%E4%B8%8E%E5%BA%94%E7%94%A8/76f106ee29291f14aac41c59d4756d53_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.3_%E5%AE%A1%E8%AE%A1%E4%BA%A7%E5%93%81%E4%B8%8E%E5%BA%94%E7%94%A8/481e53ae275d696509480b82dc28c468_MD5.png" alt=""></p> <p>如何实现仅通过堡垒机登录？在服务器那边或者网络上设置仅堡垒机IP可以连接。</p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.3_%E5%AE%A1%E8%AE%A1%E4%BA%A7%E5%93%81%E4%B8%8E%E5%BA%94%E7%94%A8/f6ab6aed4c95a247609f9d067b8a5603_MD5.png" alt=""></p> <h3 id="网络安全审计应用">网络安全审计应用</h3> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.3_%E5%AE%A1%E8%AE%A1%E4%BA%A7%E5%93%81%E4%B8%8E%E5%BA%94%E7%94%A8/55f0153c431e6290d9c6794af17cb2f8_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.3_%E5%AE%A1%E8%AE%A1%E4%BA%A7%E5%93%81%E4%B8%8E%E5%BA%94%E7%94%A8/e9180d7999552b66e398484decc19491_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.3_%E5%AE%A1%E8%AE%A1%E4%BA%A7%E5%93%81%E4%B8%8E%E5%BA%94%E7%94%A8/5e1de1ed88fd2d85f87113871f7ddaac_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.3_%E5%AE%A1%E8%AE%A1%E4%BA%A7%E5%93%81%E4%B8%8E%E5%BA%94%E7%94%A8/03b78b6243463a0fca8d6cb73ca41d35_MD5.png" alt=""></p> <p><img src="https://www.clearsec.org/wikis/_resources/%C2%A712.3_%E5%AE%A1%E8%AE%A1%E4%BA%A7%E5%93%81%E4%B8%8E%E5%BA%94%E7%94%A8/633b666234f0525dc0e7d44c2618deae_MD5.png" alt=""></p>