Security is no small matter-technical team defense

Security is no small matter-technical team defense

I. Internal Defense

Internal Defense requires hard work. Different recruitment standards lead to different levels of technical teams. A technical team of thousands of people must have a fixed process to control the launch quality.

1.1 Basics

The infrastructure includes: Basic code framework, basic network environment, basic hardware environment, and basic system environment.

Basic code framework: removes the first layer of framework services such as xss and SQL Injection in a unified manner to ensure that they appear in the induction learning process of each technician.

Basic Network Environment: business isolation and flexible network with higher requirements for basic O & M network engineers, ensuring that each new machine is in a correct and secure network.

Basic hardware environment: Ensure that new hardware appears in the correct and safe place. hardware with high security requirements has fixed options.

Basic System Environment: investment in new systems, installation and Setup of security standards.

1.2 go Lookup

The routine inspection also periodically checks the security of the changed system.

Collection: mainly for collection services. As the company is large, various small businesses may not be comprehensive, with special attention to edge businesses. A good thing is to collect data in the online system.

Verification: various detection methods, scanning scripts, should be process-oriented, code-oriented, as much as possible to shorten the running time of the entire company, and expand the area as much as possible.

1.3 keep up

Keep up with open-source software. If it is being used, keep up with its security change announcement. Resolve major vulnerabilities as soon as possible after they are released to reduce the impact time.

It is required to effectively register and record open source projects used by the entire company, and thousands of companies may miss this. A good thing is to test open-source projects in the launch system.

1.4 key points

The focus is to focus on items that frequently report vulnerabilities to ensure that these items are: 1. do not reference or save important data 2. do not communicate with other services in the trusted network segment 3. repeat the first three points more frequently

1.5 important

Important projects must adhere to the principle of absolute prohibiting the flow of data, absolute prohibiting the storage of plaintext important data, even if the ceo said it would not work.

Ii. External attack

The external attack refers to a series of methods that allow the launch of Short-board projects or people. The only thing to do is to do everything possible to find the short-board as soon as possible.

2.1 foreign aid

There are many foreign aid providers, including various white hat platforms and security vendor platforms. The bottom blood also needs to have a good relationship with them and be willing to be blackmailed. It is very effective to get in touch with them as soon as a major short board is discovered.

2.2 self-built

The self-built security response platform is a supplement to foreign aid. Many short-board SQL injections, such as xss, are very obvious problems. Many of them are not enough to be "bottom-up", but they are too small to generate and often have short-board teams, technical training and other activities should be considered.

Iii. Alternative

Non-technical vulnerabilities lead to leaks, personal management password theft, VPN password theft and other similar alternative incidents, requiring each department not to have a flat permission control system, each person should control one, this can reduce personal mistakes and turn them into disasters.

Iv. Summary

An Internet technology company is definitely not a security vulnerability because the boss pays a lot of money, or the more money the boss pays, the more important it is, the real attention is reflected in the daily work of R & D personnel.

Your company has never experienced any security issues. It does not mean that your team has no short board, it does not mean that your online website has no vulnerabilities, or your user data has not been sold on the black market.

Do not care whether there are any vulnerabilities, just be serious.