06_보안 [Mark Down]

06_보안

0601_보안 개요

보안 개요

• 보안특징
• 정보보호구현방법에따른분류
• 암호화
• 암호공격기법
• 암호알고리즘보안강도

0602_암호화🚩

대칭 암호화🚩

• 대칭암호화(Symmetric Encryption)🚩132관1_(4)
• 블록암호화(Block Encryption) 🚩127관4_(6)
• ECB(Electronic CodeBook)모드🚩127관4_(6)
• CBC(Cipher Block Chaining)모드🚩127관4_(6)
• CFB(Ciper FeedBack)모드🚩127관4_(6)
• OFB(Output FeedBack)모드🚩127관4_(6
• 스트림암호화(Stream Encryption)
• 블록암호화알고리즘🚩130관1_(6)
• AES(Advanced Encryption Standard)
• DES(Data Encryption Standard)
• LEA(Lightweight Encryption Algorithm)
• SEED(대한민국암호화표준)
• 파이트스구조(Feistel Structure)
• 순서보존암호화(Order Preserving Encryption)
• 형태보존암호화(Format Preserving Encryption)

비대칭 암호화🚩

• 비대칭암호화(Asymmetric Encryption)🚩132관1_(4)
• 엘가멜(ElGamal)
• 타원곡선(Elliptic Curve)
• RSA(Rivest Shamir Adleman)알고리즘🚩126관4_(5)
• DSA(Digital Signature Algorithm)🚩126관4_(5)
• 디피헬만(Diffie Hellman)
• 동형암호(Homomorphic Encryption)🚩133관1_(5),125관1_(2)

해시 및 서명🚩

• 암호학적해시함수(Cryptographic Hash Function)
• HMAC(Hash-based Message Authentication Code)
• 메시지인증코드(Message Authentication Code)🚩127관1_(5)
• 전자서명디지털서명(Electronic Digital Signature)
• 이중 서명(Double Signature)

양자 암호화🚩

• 양자암호통신(Quantum Cryptography)🚩128관4_(4)
• BB84(Bennett and Brassard 1984)
• 포스트양자암호(Post Quantum Cryptography)🚩125관1_(9)
• 양자해킹(Quantum Hacking)

0603_인증 및 접근 제어🚩

인증 방식🚩

• 인증(Authentication)🚩128관4_(6)
• 식별(Identification)🚩128관4_(6
• 무자각지속인증(Implicit Continuous Authentication)🚩120관1_(3
• 영지식증명(Zero Knowledge Proof)
• OTP(OneTime Password)
• 스마트OTP
• 챌린지응답방식(Challenge response방식)
• 패턴기반인증
• 생체인식기술
• 비대면실명확인
• 전자지문(Digital Fingerprint)

인증 장치

• SIM(Subscriber Identity Module)
• USIM(Universal Subscriber Identity Module)
• e-SIM(Embedded SIM)

인증 매체🚩

• 정보시스템의사용자인증🚩120관4_(1
• 인증서(Certificate)
• OTC(One Time Code)
• 생체인식Database

인증 프로토콜🚩

• FIDO 1.0(Fast Identity Online 1.0)
• FIDO 2.0(Fast Identity Online 2.0)
• Oauth,Oauth 2.0
• S-HTTP(Secure HTTP)
• 커버로스(Kerberos)
• RADIUS(Remote Authentication Dial In User Service)
• AAA(Authentication, Authorization, Accounting)
• DIAMETER
• PKI
• LDAP(Lightweight Directory Access Protocol)🚩129관2_(2)
• Linux PAM(Pluggable Authentication Modules)
• SSO(Single Sign On)

신원 및 접근 관리🚩

• 분산ID(Decentralized Identity)🚩122관3_(3)
• IAM(Identity and Access Management)

접근 제어🚩

• 접근제어(Access Control)🚩133관4_(3),129관2_(2)
• MAC(Mandatory Access Control)🚩133관4_(3),129관2_(2)
• DAC(Discretionary Access Control)🚩133관4_(3),129관2_(2)
• RBAC(Role Based Access Control)🚩133관4_(3),129관2_(2)
• 제로트러스트(Zero Trust)
• 제로트러스트가이드🚩
• 제로트러스트보안(Zero Trust Security)모델🚩131관2_(4)
• 트러스트보안(Trust Security)모델🚩131관2_(4)

접근제어모델🚩

• 벨라파듈라(BLP)모델🚩127관2_(6)
• 비바(BIBA)모델🚩127관2_(6)
• Clark and Wilson모델🚩127관2_(6)
• 브루어내시모델(Brewer Nash Model,만리장성)

0604_공격 기법🚩

프로토콜 기반 공격

• ARP Spoofing(Address Resolution Protocol Spoofing)
• ARP Poisoning(Address Resolution Protocol Poisoning)
• ARP Redirect
• IP Spoofing(Internet Protocol Spoofing)
• Smurfing(Smurf Attack)
• TCP SYN Flooding
• Slowloris(DoS)
• Slowloris Read DDos Attack
• RUDY(R U Dead Yet)
• DoS,DDoS(Denial of Service,Distributed Denial of Service)
• PDoS(Permanent Denial of Service)
• SSLv2 DROWN(Decrypting RSA with Obsolete and Weakened eNcryption)
• 스니핑(Sniffing)
• Race Conditioning

멀웨어 기반 공격🚩

• 바이러스(Virus)
• 웜(Worm)
• 루트킷(Rootkit)
• 악성봇(Malware Bots)
• 좀비(Zombie)
• 스파이웨어(Spyware)
• 워너크라이(WannaCry)
• 랜섬웨어(Ransomware)🚩128관1_(12)
• RaaS(Ransomeware as a Service)🚩128관1_(12)
• Malvertising
• 인포스틸러(InfoStealer)🚩129관4_(1)
• 크라임웨어(Crimeware)
• 쉐도우(Shadow)
• 크립토재킹(Cryptojacking)

시스템 취약점 활용 공격🚩

• TOCTOU(Time Of Check, Time Of Use)🚩125관2_(4)
• 은닉채널(Covert Channel)
• Buffer Overflow
• Heap Overflow
• 멜트다운(Meltdown)
• 세션하이재킹(Session Hijacking)
• Shell Code
• Exploit
• 포멧스트링(Format String)

AI 기반 공격🚩

• 적대적공격(Adversarial Attack)🚩130관3_(4),124관1_(12),123관2_(2)
• 적대적예제공격(Adversarial Examples)
• 데이터중독공격(Data Poisoning)
• 모델탈취공격(Model Stealing)
• 모델탈신공격(Model Inversion)
• 적대적학습(Adversarial Training)
• 입력변환(Input Transformation)
• 데이터검증(Data Sanitization)
• 로버스트학습(Robust Learning)
• 질의제한(Query Limiting)
• 차별적응답제공(Differential Privacy)
• 차별적프라이버시(Differential Privacy)
• 암호화된연산(Encrypted Computation)

웹 애플리케이션 공격🚩

• XSS(Cross Site Scripting)
• CSRF(Cross Site Request Forgery)
• SSRF(Server Side Request Forgery)
• 인젝션(Injection)🚩124관2_(6)
• Web Shell
• 워터링홀공격(Watering Hole Attack)
• 크리덴셜스터핑(Credential Stuffing)🚩131관1_(10)
• brute force attack
• DBD(Drive By Download)

사회공학 기반 공격🚩

• 사회공학
• 피싱(Phishing)
• 스피어피싱(Spear Phishing
• 파밍(Pharming)
• 큐싱(Qshing)🚩132관1_(6)
• 스미싱(Smishing)
• 비즈니스스캠(Business Scam)
• 스팸메일(Spam Mail)
• Anti Spam
• 다크패턴(Dark Pattern)🚩134관2_(2)

고급 지속 위협🚩

• 스턱스넷(Stuxnet)
• 미라이봇넷(Mirai Botnet)🚩126관4_(3
• 레터럴무브먼트(Lateral Movement)
• 프리크라임(Pre-Crime)
• 공급망공격(Supply Chain Attack)
• Ransome Web
• 안티포렌식(Anti-Forensics)🚩133관3_(1)

물리적 공격 기법🚩

• EMP공격(ElectroMagnetic Pulse attack)🚩125관2_(5)
• 부채널공격(Side-Channel Attack)

0605_방어 및 관리 기법🚩

네트워크 보안🚩

• 망분리(Network Segregation)
• 방화벽(Firewall)
• 웹방화벽(Web Firewall)
• 무선랜보안(Wireless LAN Security)
• TCP래퍼(TCP Wrapper)
• VPN(Virtual Private Network)🚩133관4_(6),126관4_(4),120관3_(4)

애플리케이션 보안🚩

• 시큐어코딩(Secure Coding)
• SW난독화(Software Obfuscation)
• XML보안
• CDR(Content Disarm & Reconstruction)🚩121관1_(10)
• DRM(Digital Rights Management)
• DLP(Data Loss Prevention)
• 변조(Modification)🚩127관1_(9)
• 위조(Fabrication)🚩127관1_(9)

통합 보안 관리 시스템🚩

• UTMS(Unified Threat Management System)
• ITMS(Intelligent Threat Management System)
• End Point보안
• SOAR(Security Orchestration,Automation and Response)🚩127관3_(6)
• C-TAS(Cyber Threat Analysis System)
• 융합보안(Convergence Security)

침입 탐지와 예방🚩

• IDS(Intrusion Detection System)침입탐지시스템🚩124관3_(6)
• IPS(Intrusion Prevention System)침입방지시스템🚩124관3_(6)
• EDR(Endpoint Detection and Response)
• RASP(Runtime Application Self Protection)
• 네트워크스캐닝(Network Scanning)🚩126관1_(12)
• 화이트해커(White Hacker)

위협 탐지 기법

• 시그니처탐지기법(Signature Based Detection)
• 휴리스틱탐지기법(Heuristic Detection)
• 평판기반탐지(Reputation Based Detection)
• 행위기반탐지기법(Behavior Based Detection)
• 샌드박스(Sandbox)
• ATT&CK

정책과 규제 관리

• PEC(Policy Enforcement Control)
• PIT(Privacy Impact Test)
• PMI(Policy Management Infrastructure)
• Secure SDLC-PM존재
• 정보통신망법

보안 평가와 테스트

• 쇼단(Shodan)
• ASM(Attack Surface Management)
• STRIDE(Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege)
• 사이버게놈(Cyber Genome)
• CARTA
• MTD(Moving Target Defense)

0606_네트워크 보안🚩

네트워크 프로토콜

• RARP(Reverse Address Resolution Protocol)
• DNSSEC(Domain Name System Security Extensions)🚩
• IPv6보안
• IP터널링,터널링(IP Tunneling)
• MPLS VPN(Multi Protocol Label Switching Virtual Private Network)
• SNI(Server Name Indication)

네트워크 전송 보안 기술🚩

• IPSec(Internet Protocol Security)VPN🚩133관4_(6)
• SSL(Secure Socket Layer)VPN🚩133관4_(6)
• SSL Offloading(Secure Sockets Layer Offloading)
• 전송계층보안TLS(Transport Layer Security)
• MoVPN(Mobile Virtual Private Network)

네트워크 보안 관리 기술

• SIEM(Security Information and Event Management)
• ESM(Enterprise Security Management)
• SRM(Security Risk Management)
• FDS(Fraud Detection System)

0607_웹,애플리케이션 보안🚩

웹 보안 위협

• OWASP Top 10(Open Web Application Security Project)
• CVE(Common Vulnerabilities and Exposures)
• CWE(Common Weakness Enumeration)

웹 보안 보호 기법🚩

• 전자봉투(Electronic Envelope)🚩133관1_(4)
• 전자문서증명서🚩121관4_(2)

애플리케이션 보안 기술🚩

• TPM(Trusted Platform Module)🚩132관1_(8)
• 자동화분석
• 정적분석
• 동적분석

0608_사이버 보안 전략과 관리🚩

사이버 공격 전략

• 사이버전(Cyber Warfare)
• 사이버범죄(Cyber Crime)
• 사이버킬체인(Cyber Kill Chain)
• APT(Advanced Persistent Threat)
• 사이버망명(Cyber Asylum)

사이버 공격 대응 방법🚩

• 사이버범죄의유형및대응방안🚩123관4_(3)
• 사이버레질리언스(Cyber Resilience)
• 사이버디셉션(Cyber Deception)
• PD(Real-Time Protection Detection)
• Honey Pot
• 탈린매뉴얼(Tallinn Manual)

클라우드 보안

• 클라우드DaaS인증
• CASB(Cloud Access Security Broker)
• CWPP(Cloud Workload Protection Platform)
• CSPM(Cloud Security Posture Management)
• SASE(Secure Access Service Edge)

디지털 아이덴티티🚩

• IoT보안🚩126관4_(3)
• 모바일바이오인식
• 모바일신분증(Mobile Identification)🚩121관1_(11)
• 디지털 ID
• GADI(Global Architecture for Digital Identity)🚩123관1_(12)

디지털 포렌식 기법🚩130관4_(2),126관4_(6),121관2_(3)

• 디지털포렌식(Digital Forensic)
• 파일카빙(File Carving)🚩126관4_(6)
• 파일슬랙(File Slack)🚩126관1_(13)
• 스마트폰포렌식(Smartphone Forensic)
• 클라우드포렌식(Cloud Forensic)
• 네트워크포렌식(Network Forensic)
• E-Discovery

0609_개인정보 보호🚩

개인정보 규제🚩

• GDPR(General Data Protection Regulation)
• CBPR(Cross Border Privacy Rules)🚩132관3_(5)
• APEC프라이버시9원칙🚩132관3_(5)
• 프라이버시8원칙(Privacy 8 Principles)
• 프라이버시보호모델(Privacy Protection Model)
• PbD(Privacy by Design)🚩133관2_(5)
• 데이터3법🚩128관2_(4),121관3_(4)
• 개인정보보호법🚩133관2_(5),130관2_(4)
• 개인정보의안전성확보조치기준🚩131관4_(2),127관2_(5)
• 신지식재산권

개인정보 표준

• ISO,IEC 27701
• ISO,IEC 27559
• ISO 25237
• ISO,IEC 29100

개인정보 보호 기술🚩

• K익명성(K-Anonymity)
• L다양성(L-Diversity)
• T근접성(T-Closeness)
• 개인정보보호강화기술(Privacy Enhancing Technology)🚩134관1_(11)
• CCTV개인정보보호
• 스테가노그래피(Steganography)
• 가명처리🚩128관1_(10)
• 익명처리🚩128관1_(10)
• 콘텐츠보안
• 데이터마스킹
• Water Marking
• Finger Printing
• PPDM(Privacy Preserving Data Mining)
• PPDP(Privacy Preserving Data Publishing)
• 다자간계산(MPC, Multi-Party Computation)🚩133관4_(1)

개인정보 보호 절차🚩

• 개인정보비식별조치가이드라인(De-identification Guidelines)🚩120관4_(5)
• PIA(Privacy Impact Assessment)
• AI개인정보보호자율점검표🚩125관3_(4)

• 가명정보결합및반출방법🚩121관3_(4)
• 데이터전송요구권
• 잊혀질권리(Right to be Forgotten)
• P3P(Platform for Privacy Preferences)
• 고객확인절차(KYC,Know Your Customer)🚩122관1_(10)
• 디지털윤리(Digital Ethics)
• 정보윤리(Information Ethics)🚩123관4_(3

0610_정보보호 관리와 표준 체계🚩

정보보호 관리 시스템🚩

• ISMS(Information Security Management System)🚩131관3_(6),124관4_(4)
• ISMS-P(Information Security Management System-Personal)🚩131관3_(6)
• G-ISMS(Government-Information Security Management System)
• 정보보호정책🚩132관4_(6)
• 정보보안거버넌스

보안 인증과 표준🚩

• PCI DSS(Payment Card Industry Data Security Standard)
• CC(Common Criteria)
• CC-cPP(Common Criteria Collaborative Protection Profile)
• 정보보호제품신속확인제도🚩129관1_(11)
• FIPS(Federal Information Processing Standard)140-2🚩132관4_(1)
• ISA,IEC 62443🚩132관1_(5)
• INDECS(International Network for Data Exchange and Communication Security)
• DOI(Digital Object Identifier)
• 정보보호산업진흥법
• 전자서명법🚩122관4_(3)

국제 정보보안 관리 표준

• ISO/IEC 27000 시리즈
• ISO/IEC 27100
• ISO 27001
• ISO 27002
• ISO 28000

보안 리더십과 관리 역할🚩

• CPO,CSO(Chief Privacy Officer,Chief Security Officer)
• CISO(Chief Information Security Officer)🚩121관2_(6)
• EAM(Enterprise Asset Management)

0611_보안취약점 대응방안🚩

관리적 보안🚩

• 인터넷뱅킹보안취약점
• 오픈소스보안취약점(Open Source Security Vulnerabilities) 🚩134관3_(3)
• PoS보안취약점

물리적 보안🚩

• CPU보안취약점
• 3D프린팅취약점
• IoT보안취약점🚩126관4_(3)
• 드론의보안위협과대응방안🚩130관1_(5)
• 스마트그리드보안취약점
• 스마트팩토리보안취약점
• 스마트카보안취약점

기술적 보안🚩

• DB보안취약점
• 생성형AI보안취약점🚩133관3_(2)
• 딥러닝취약점
• 머신러닝보안취약점🚩130관3_(4),123관2_(2)
• 블록체인플랫폼보안취약점🚩120관4_(6)
• NFT마켓플레이스보안취약점🚩128관4_(1)
• 양자암호통신보안취약점🚩128관4_(4
• 메타버스보안취약점🚩126관4_(1)
• Open API보안취약점🚩134관4_(4)
• DNS취약점
• 가상화폐보안취약점(Cryptocurrency Security Vulnerability)
• 무선랜보안취약점(Wireless LAN Security Vulnerability)
• 가상화,하이퍼바이저보안취약점(Virtualization and Hypervisor Security Vulnerability)
• 클라우드보안취약점
• 모바일보안취약점