The information security architecture of "insider": Trust system

The "vase" model of security architecture divides information security into three-dimensional system of "protection-monitoring-trust", in which the protection and monitoring system is mainly faced with external intruders, while the trust system is aimed at the security management of internal users. The source of the distinction is because internal users are traceable, controllable, the enterprise can clearly ask the employee on the internal network to use what, do not use what, but not for external personnel, so the trust system is the "legitimate" users of security protection, of course, including through the public network access to the "one's Own" ( VPN user).

The main goal of the trust system is to protect the information resources through the control of the user's rights, to use the method of obtaining evidence, to deter the vandals and to reduce the loss of security. Therefore, the focus of the trust system is the control in the process of user access, and after the discovery of "strange", users can reproduce the behavior and evidence.

The protection system is characterized by every effort to keep hackers from coming in, the characteristics of the monitoring system is always vigilant to see who "like" hackers on the key monitoring, and the characteristics of the trust system must first let employees work, must give him "sufficient" authority to complete the business, the staff of a lot of behavior only to finish, even after a period of time, To determine if it has a problem. Therefore, the trust system is a track of the process, the determination of the legality of the person's specific behavior. The difference of trust system is to establish mutual trust first, open the door to greet you, and find that you have "broken faith" behavior, to be able to provide sufficient, not forged evidence.

From the process diagram of the trust system, the establishment of trust is realized by identity and authorization, and the monitoring of the user's violation is realized through the audit log.

Starting from the user login, has been to the user exit, the Trust system deployment is divided into three stages, the first is the identity of the login, the second is based on the identity of the user authorization to access the control, and finally the user Access behavior audit.

User login:

Typically, there are three places that require user login management: Host login, network login, application login. The goal of the login process is identity authentication, which is to identify the user's password (known as the identification factor), the common method is "account + password", or the CA system provided by the ID books and so on.

As a factor of identity identification should have the characteristics of not easy to forge, not easy to imitate, generally there are three categories:

Can be remembered, such as password passwords, can be character and number combination string

Can carry, such as certificate key, ID card, RF chip, etc.

Owned by oneself, such as fingerprints, iris, DNA, etc.

In order to distinguish the computer simulator login, you can also use the CAPTCHA (fully automatic public machine separation Turing Test) technology, in the temporary generation of images containing the generation of numbers and letters, people identified after the backfill to the certification side, of course, the computer to automatically identify the very difficult.

In the process of user login, there are three issues that deserve attention: