|
Bilgi ve Ağ Güvenliği-
Kaynaklar
Bilişim Güvenliği'ne ilişkin kurumsal güvenlik kullanıcılarının
tüm sorularını cevaplıyoruz. Eğer sorunuzun cevabını
bu bölümde bulamazsanız lütfen bize iletin.
Ekteki
InfoSecure sunumu, güvenlik yönetiminin bir diğer güncel konusu
uygulama güvenliğine ilişkin olarak InfoSecure tarafından
yapılan kontrolların tariflerini içermektedir. Daha fazla bilgi ve sorularınız için InfoSecure ile iletişim
kurabilirsiniz.
Ekteki
InfoSecure sunumu, güvenlik yönetiminin güncel konusu ISO
17799 / BS7799 standardı ile ilgili giriş seviyesi temel
bilgi almak isteyenler için hazırlanmıştır. Daha fazla bilgi ve sorularınız için InfoSecure ile iletişim
kurabilirsiniz.
Güvenlik
organizasyonu kurmak ve güvenlikle ilgili görevlendirmeleri
yapmak sürecinde pozisyon ve görev tanımları yapma aşamasında
olan kuruluşlara yardımcı olması amacıyla bazı görev
tanımları ve gereklilikleri açısından örnek teşkil
etmek amacıyla hazırlanmıştır. Daha fazla bilgi ve sorularınız için InfoSecure ile iletişim
kurabilirsiniz.
Birçok
devlet ve özel sektör kuruluşu güvenlik denetimi işi ile
ilgili olarak teklif alma çalışmaları gerçekleştirirken,
yapılacak işin içeriğini ve kritik şartlarını tarif
etmekte problem yaşamaktadır. InfoSecure bu dokümanı,
İnternet ve İntranet bölgelerindeki güvenlik denetimleri
ve güvenlik politikası hazırlığı ile ilgili
kullanabilmeniz için taslak şartname olarak hazırlamıştır.
Daha fazla bilgi ve sorularınız için InfoSecure ile iletişim
kurabilirsiniz.
Güvenlik
politikasının en üst dokümanı olan ve üst yönetim tarafından
imzalanarak güvenliliğe bağlılığı ve uyulması gereken
en üst düzey ve yaygın kuralları tarif eden kurumsal güvenlik
politikası ifadesi ile ilgili olarak öğrenme sürecindeki
şirketlere bir örnek teşkil etmek üzere hazırlanmıştır.
Daha fazla bilgi ve sorularınız için InfoSecure ile iletişim
kurabilirsiniz.
- Genel Sorular
- Soru 1
What's to worry about?
- Soru 2
Exactly what security risks are we talking about?
- Soru 3 Are
some Web servers and operating systems more secure than others?
- Soru 4 Are
some Web server software programs more secure than others?
- Soru 5 Are
CGI scripts insecure?
- Soru 6 Are
server-side includes insecure?
- Soru 7 What
general security precautions should I take?
- Soru 8 Where
can I learn more about network security?
- İstemci Tarafı Güvenliği
- Soru 1 How
do I turn off the "You are submitting the contents of a form insecurely"
message in Netscape? Should I worry about it?
- Soru 2 How
secure is the encryption used by SSL?
- Soru 3 When
I try to view a secure page, the browser complains that the site certificate
doesn't match the server and asks me if I wish to continue. Should I?
- Soru 4 When
I try to view a secure page, the browser complains that it doesn't recognize
the authority that signed its certificate and asks me if I want to continue.
Should I?
- Soru 5 How
private are my requests for Web documents?
- Soru 6
What's the difference between Java and JavaScript?
- Soru 7 Are
there any known security holes in Java?
- Soru 8 Are
there any known security holes in JavaScript?
- Soru 9 What
is ActiveX? Does it pose any risks?
- Soru 10 Do
"Cookies" Pose any Security Risks?
- Soru 11 I
hear there's an e-mail message making the rounds that can trash my hard disk
when I open it. Is this true?
- Soru 12 Can
one Web site hijack another's content?
- Soru 13 Can
my web browser reveal my LAN login name and password?
- Spru 14 Are
there any known problems with Microsoft Internet Explorer?
- Soru 15 Are
there any known problems with Netscape Communicator?
- Soru 16 Are
there any known problems with Lynx for Unix?
- Soru 17
Someone suggested I configure /bin/csh as a viewer for documents of type
application/x-csh. Is this a good idea?
- Soru 18 Is
there anything else I should keep in mind regarding external viewers?
- SunucuTarafı Güvenliği
- General
- Soru 1 How
do I set the file permissions of my server and document roots?
- Soru 2 I'm
running a server that provides a whole bunch of optional features. Are any
of them security risks?
- Soru 3 I
heard that running the server as "root" is a bad idea. Is this true?
- Soru 4 I
want to share the same document tree between my ftp and Web servers. Is
there any problem with this idea?
- Soru 5 Can
I make my site completely safe by running the server in a "chroot"
environment?
- Soru 6 My
local network runs behind a firewall. How can I use it to increase my Web
site's security?
- Soru 7 My
local network runs behind a firewall. How can I get around it to give the
rest of the world access to the Web server?
- Soru 8 How
can I detect if my site's been broken into?
- Windows NT Servers
- Soru 9 Are
there any known problems with the Netscape Servers?
- Soru 10
Are there any known problems with the WebSite Server?
- Soru 11
Are there any known problems with Purveyor?
- Soru 12
Are there any known problems with Microsoft IIS?
- Soru 13Are there
any known security problems with Sun Microsystem's JavaWebServer?
- Soru 14Are there
any known security problems with the MetaInfo MetaWeb Server?
- Unix Servers
- Soru 15
Are there any known problems with NCSA httpd?
- Soru 16
Are there any known problems with Apache httpd?
- Soru 17
Are there any known problems with the Netscape Servers?
- Soru 18
Are there any known problems with the Lotus Domino Go Server?
- Soru 19
Are there any known problems with the WN Server?
- Macintosh Servers
- Soru 20
Are there any known problems with WebStar?
- Soru 21
Are there any known problems with MacHTTP?
- Soru 22
Are there any known problems with Quid Pro Quo?
- Other Servers
- Soru 23
Are there any known problems with Novell WebServer?
- Server Logs and Privacy
- Soru 24
What information do readers reveal that they might want to keep private?
- Soru 25
Do I need to respect my readers' privacy?
- Soru 26
How do I avoid collecting too much information?
- Soru 27
How do I protect my readers' privacy?
- CGI Scripts
- General
- Soru 1
What's the problem with CGI scripts?
- Soru 2 Is
it better to store scripts in the cgi-bin directory or to identify them
using the .cgi extension?
- Soru 3 Are
compiled languages such as C safer than interpreted languages like Perl
and shell scripts?
- Soru 4 I
found a great CGI script on the Web and I want to install it. How can I
tell if it's safe?
- Soru 5
What CGI scripts are known to contain security holes?
- Language Independent Issues
- Soru 6 I'm
developing custom CGI scripts. What unsafe practices should I avoid?
- Soru 7 But
if I avoid eval(), exec(), popen() and system(), how can I create an
interface to my database/search engine/graphics package?
- Soru 8 Is
it safe to rely on the PATH environment variable to locate external
programs?
- Soru 9 I
hear there's a package called cgiwrap that makes CGI scripts safe?
- Soru 10
People can only use scripts if they're accessed from a form that lives on
my local system, right?
- Soru 11
Can people see or change the values in "hidden" form variables?
- Soru 12
Is using the "POST" method for submitting forms more private than "GET"?
- Soru 13
Where can I learn more about safe CGI scripting?
- Safe Scripting in Perl
- Soru 14
How do I avoid passing user variables through a shell when calling exec()
and system()?
- Soru 15
What are Perl taint checks? How do I turn them on?
- Soru 16
OK, I turned on taint checks like you said. Now my script dies with the
message: "Insecure path at line XX" every time I try to run it!
- Soru 17
How do I "untaint" a variable?
- Soru 18
I'm removing shell metacharacters from the variable, but Perl still thinks
it's tainted!
- Soru 19
Is it true that the pattern matching operation
$foo=~/$user_variable/ is unsafe?
- Soru 20
My CGI script needs more privileges than it's getting as user "nobody".
How do I run a Perl script as suid?
- Protecting
Confidential Documents at Your Site
- Soru 1 What
types of access restrictions are available?
- Soru 2 How
safe is restriction by IP address or domain name?
- Soru 3 How
safe is restriction by user name and password?
- Soru 4 What
is user verification?
- Soru 5 How
do I restrict access to documents by the IP address or domain name of the
remote browser?
- Soru 6 How
do I add new users and passwords?
- Soru 7 Isn't
there a CGI script to allow users to change their passwords online?
- Soru 8 Using
.htaccess to control access in individual directories is so
convenient, why should I use access.conf?
- Soru 9 How
does encryption work?
- Soru 10
What are: SSL, SHTTP, Shen?
- Soru 11 Are
there any "freeware" secure servers?
- Soru 12 Can
I use Personal Certificates to Control Server Access?
- Soru 13 How
do I accept credit card orders over the Web?
- Soru 14
What are: CyberCash, SET, Open Market?
- Denial of Service
Attacks
- Overview
- Soru 1
What is a Denial of Service attack?
- Soru 2
What is a Distributed Denial of Service attack?
- Soru 3 How
is a DDoS executed against a website?
- Soru 4 Is
there a quick and easy way to secure against a DDoS attack?
- Soru 5 Can
the U.S. Government make a difference?
- Step-by-Step
- Soru 6 How
do I check my servers to see if they are active DDoS hosts?
- Soru 7
What should I do if I find a DDoS host program on my server?
- Soru 8 How
can I prevent my servers from being used as DDoS hosts in the future?
- Soru 9 How
can I prevent my personal computer from being used as a DDoS host?
- Soru 10
What is a "smurf attack" and how do I defend against it?
- Soru 11
What is "trinoo" and how do I defend against it?
- Soru 12
What are "Tribal Flood Network" and "TFN2K" and how do I defend against
them?
- Soru 13
What is "stacheldraht" and how do I defend against it?
- Soru 14
How should I configure my routers, firewalls, and intrusion detection
systems against DDoS attacks?
|
