Игнатьев В.А. - Информационная безопасность современного коммерческого предприятия

004.05 67.
408 266
:
.
, ..,,
. B.C.

. .. , ... .

. .. , . .. ..
.. 266
: . :
, 2005. 448 . ISBN 5-94178-070-2

.
,
.
.
, .
.

,
.

,
,

.
,

,
, ,
, ,
.
004.05 67.408
.. , , 2005 "" , 2005
ISBN 5-94178070-2
1
2
3
3.1. -

3.1.1.
3.1.2.
3.1.3.
3.2

3.3
3.4
3.5
3.6

3.6.1
3.6.2
-

3.6.3
3.6.4
3.6.5 220

3.6.6
4
4.1.

4.2

4.3
4.4.

5
5.1.
5.2
5.3

5.4
5.5
.
5.6
5.7
5.8
5.9
6

6.1
6.1.1 ISO 17799: Code of Practice for Information
Security Management
6.1.2 ISO 15408: Common Criteria for Information
Technology Security Evaluation
6.1.3 SysTrust
6.1.4 BSI\IT Baseline Protection Manual
rd
6.1.5 COBIT 3 Edition
6.1.6 SCORE
SANS/GIAC Site Certification
6.2
2
-
7.1
.
7.2
7.3
7.4
8 ()
8.1
8.2
8.3
9
9.1
9.2
9.3
9.4
10
10.1
10.2 ,
10.3
11
11.1 ,
11.2
11.2.1
11.2.2

11.2.3
12
12.1
12.1.1
12.2
12.3
12.4
12.4.1
12.4.2
12.4.3 Bluetoot h
13
13.1

13.2
4 -
14
15
15.1

15.2
15.3
15.4
16

16.1
16.2
16.2.1
16.2.2

16.3
17
17.1

17.2

17.3
1
2

3

.

,
,

.

- .
.
,
, .
.

,
,
,
.
-
.
,

,
,
.
, ,

.
7 12 .

, ,
,
.

,

-
,
, , ,
,
.

90- .
. ,
, ,
. , ,

() ,
, .

. 2000 .
,
,
, ,
, . ,
,
,
.
,

,
. ,

. 11-

.

( IS O 15408:19991-3), .
2000 .
.
,
,

.

,

:
,

,
,
,
. -
.
, ,
,

.
, ,
.
,
9 .
.
140 . .
,
20%
, 40% 16%
, 33% 2 -5
, 50% - 2 - 3 [42].
(,
. ) .
, ,

, ,
, ,
.
- ,
.
,
,

,
, .
, . . , ,
- . ,

.
:
, ;
, ,
;
.
.
, , .
,
. . .
,
,
- ,
,
.
Internet-,

-- .

, , ,

[1]. 90% Web, ,

.
2003
.

, - , ,
, -
.
:
,
,
,
.
2002 .
2,7 4,2 . . [1].

:
,
. ,

.

.
:
- ;
- 24 7;
-
;
- .

: .

. :
, ;

;

;
.
-
, ,
. .

[104], ,

,
, ,
, , ,
.
,
, - .
:
( )?
: .
.
, ,
.
,
.
: , - . ,
,
-
(
, ).
.
, ,
.
- , .
- , ,
. , - ,
, -
.
, ,
, [116].
?
- . () : , , ,
, . ,
,
, .
. , , , , , , .
,
,
.

-
.

.
- . ,
, , , .
, .
- ,

, ,
. , , .
, ,
.
.
, -
- . - .
- . ,
,
.

. (
) ,
, .

.

.
, , , ,
.

.

,

- .

.
, [ 106]:" ,
, , ,
, .
.
,
,

.
?
,
.
(
, ..) .

. ,
-
,

.

. Int ernet-,
, Web-,

( ) .
.
, ,

.
(
,
,
..). ,
. ,
,
- .
. "
, ,
. ,
,

, .
Web-
,
, .
?
,
: .
, , ,
,
,
, ..
, .
.

, . .
,
.
, ,
.
? -
. .
-
. -
, ..
.
, ,
.

(, ),
,
-
, ,
, .
, , ,
. ,
,
,
.
,
,
, ,
,

,

,
.
,

, , , ,
.

,
, , , . .
,
,
,
? , [2]:
- ;
-
;
- .
,
:
) :
- ;
- ( , , , );
- ;
- ;
- ,
, , ;
- , ,
;
- , ;
- ;
- ;
- ,
;
- , -
;
- ,
;
- ;
- , ,
;
- ;
- , )
:
- ;
- , ;
- ;
- - ;
- ;
- ;
- ;
- ;
- ;
- , , ,
;
- ;
- ;
- ;
- .
,

:
- ;
- ;
- ;
- ,
Gartner Group [31] 4
:
0- :
- ,
;
- ;
-
, (
, ).
1- :
- ,
(, )
() ;
- - ;
-
, IK
, ,
VPN ( ), ..

2- :
- ,

,

-
;
- ;
-
, web-, IDS (
), , SSO
( ), PK I (
) (
, , ,
, , ).
3- :
- , CISA (
);
- ;
-

, CS IRT (
), SLA (
).
Gartner Group ( 2001
) :
0 - 30%,
1 - 55%,
2 - 10 %,
3 - 5 %.
Gart ner Group 2005
:
0 - 20%,
1 - 35%,
2 - 30 %,
3 - 15 %.
[2], (55%)

(1 ).
(
2 3)
.
, ,
.

, .

.

[31]:
- (
, );
- ;
- ;
- , ;
- ;
- .

:
- (
);
- (, , ,
ERP);
- (, ,
);
- ( , www ..).
,
, ,

(,
- ).

,
,
.

1.1:
1.1
/
,
( )
( ). ,
.

ISO TR 13335 [129].
- :
- (, , ,
..);
-
( , );
- ( ,
, );
-
(, , );
- ( ,
);
- (
).
-
-
(
).
,
.
- ,
.
,
:
- ;
- ;
- ;
- ;
- ;
- .
- .

.

:

( ).

.

.
:
- ;
- .
, .

.
- .
, ,
( )
( ).
.
:
- ;
- ;
- ;
- ;
- ;
- ;
- ;
- ;
- .

,
, .

.

,

.
,

,

,
,
.

,
, , ,
..

.
,
.

, ,

,

.
,
,
,

, ,
,
, , ,
, , ,

,
,
. ,
.
, , ,
,
, - .

,
,
.
.

[109]:
- -
(, , , , , , , ..);
- - ,
, , ;
(, .)
, ..;
- - ,
, , , ..;
- - .
[50].
:
- ;
- ;
-
;
- ;
- , .
:
-
;
- ( , ,
,
.);
- ;
- ;
-
, ,
, ;
- - ;
-
,
, .
[42]:
1. . ( ,
),
.
, ,
.
, ,
.

. ,
, ,

.

,
.
2. , , .
,
,
,
,
.

( )
.
,
.
3. . ,
( )
.

.

, ,

.
4. .
,
, ,
.

, .

, -
.
:
(, ,
, ) (,
,
). , :
- , ,
, ,
(,
, );
- , ;
- -
;
- ,
(, ,
).
-
:
. , :
- ,
(, ,
, , , ,
.);
- -
;
( -
,
, ,
).
. :
- ,
(
,
,
: , , ,
, , );
- , ( , ,
( ), -
, . .).

,
, .
,
, ,
, [2]:
- () ,
, ,
(-,
,
.);
, ,
, ,
.. , ; , ,
(, ,
. .);
- () ,

()
.
) , .

, ,
.

.

, -, ,
, ,
,
.
, .

- . ,
.
,

, .

,
,
, .

, , .
,
.
, -
,
.
,
, ,
.

, ,
.. ,
, ..
) , .
:
- , , , ;
- ,
(
, ,
, ,
);
-
(, ,

);
- ,

,
.
, , [42]:
- ()

;
- ;
- ();
- ;
-
;
- ;
- ;
-
;
-
;
- ;
- ( );
- ;
- ;
- .
:
- (
,
, , , )
;
- ;
- ;
- ;
- , ;
- ,
, ,
.

, , , -.
:
-
, ;
- ;
- (,
);
- ;
- . :
- ;
- ;
- .
:
- ;
- ,
;
-
;
- ;
-
.
:
-
;
-
;
- ,
;
- - ;
- .
- :
-
-
;
- , .

,
,
,
,
[45].
, ,
, , ( ,
;
).
, ,
, ,
.
,
.

. , ,
,
.
.
,
.

.

,
.

,
.
,
( TCP ).

TCP

TCP ,
,
.
TCP

.
, , . , ,
, TCP,
:
- ;
- ,
;
-
.
.
, TCP .
USD,
USD.
TCP.
, .
,
, ,
TCP .

,
TCP.
- .
:
1) .
2) .
3) .
4) .
.
,
, .

. ,
- .
.

:
?:
1. .
2. .
3. .
4. .
5. .
,

, ,
. ,
()
, .

, ( ).
,
(
) ,

.
TCP .
3

[101].
1- - ,
, ,
, :
- ;
- ;
- ..
2- - ,
, .
:
-
;
- ;
- , ;
-
;
- , .. ,
;
- ;
-
;
-

, ;
-
, , . .
,

( , .)

.
3- - :
-
(
);
- ,

;
- .
4- - :
-
;
- , , , .
() ,
,
[109]:
:
- ;
- ;
- . :
- ;
- ;
- .
:
-
, ;
- , , ..

.
3.1. -

:
, ,

, .
,
,
.

, ,
, ,
.
3.1.1.
,
,
,

. 2,5

10-15 . ,
,

.
500 ,
,
( ),
.

,
,
*
( 2- 32-)
.

.
,
,
. , ,
,

, ,
.

,
,
.
,

.

(.. - )
,

( , , , ..).
, , .

-

.
,
,
.
. ,
,

. ,

43 , ,
1 .
3.1.2.
,

,
,
: , , , .
, ,
.
,
, , .
-
.

30 ,
(VOX, VAS),
, ,
, .
.
Olympus, Sony, Pans onic, Uher,
.
- ,

,
,
, ,

.
3.1.3.

.
,
, .
, , . :
- ;
- .

-
,
( ,

).

.

:
- ;
- , ;
- ;
- .
,

.
.
1-2 .
( ,
).
,
:
- ,

;
- ,
;
- ,
.

,
.
,

.
, ,
:
- (
);
- (
, ).
,

40 1,5 .
,
, , , , , .., ,
, .

:
- ( 20 1.5 );
- ( 30 25 );
- ( 15 10 );
- .
.
,
,
,

(, , , ..).

, ,
.

. 220 ,
,
, , .
,

( ),
() .
, ,
.
,
,
, ,
. ,
, .
, ,
,
.
.

FM -
.

(),

.
,
..
.

-
-.

, ,
.

,
,
:
-
;
-
,
, , ;
-
;
-
;
- ;

;
-
;
-
;
-
( );
-
.
3.2

-, -,
.

,
, ,
.

.
,
200 1 .

.
3.3
() .
.
, , .

, ,

, .

.
(- ),
,

?,

250 . , ,
SIPE LASER 3-DA S UPER .
, :
- (, , , );
- ( ,
, - , .);
- ;
- .
,
,
.

. ,

.
3.4
, ,

.
,

.
,
.
:
- , ;
- ,
( ).

.
,
,
, :
-

(
;
- .
;
-
;
- ;
- ;
- () ;
- ;
- ;
- ;
- ;
-
;
-
();
- ;
- ;
-
;
- ;
- .

.
, ,
,
. ,
,

, ,
. .

. ,
, :
- ,
;
- , ,
;
- , .
3.5

(),
.

( ) ,
.
, , .
,
,
. ,

500 -1500 , 100-
150 .

.

.
( )
.
3.6

,

, ,

. :
- ;
-
- ;
- ;
- ;
- 220
;
- .

.
3.6.1

:
- (
( ));
- (
());
- ( ).
-

. , ,
,
.
-
.

.
, ,
,
.
, .

( ),
.
,
.
,

.

,
.
.

,
.
,
.
.
, ,
,
.

, .

. ,

.
.
3.6.2
-
,
,
,
.

. ,

.
,
,
, ,

.
- ,
,
.
,
,
.
,
. ,

, ,
, ..
,
,
,
,

() . .
- ,
,
- . ,
,
, .
3.6.3
-
.
.
:
- , -;
- ;
- (SoundBlaster);
- ().
( )

, -
.
3.6.4

. ()
,
.
,
.

AMPS, DAMPS, NAMPS, NMT450, NMT-4501,
.

*
,
, .
16 .
,
,
, ,

.

5 60 . GSM-
. GSM (Groupe Speciale Mobile),

(European Telecom munications Standard institute),
-
79 . ,
. , GSM
,
, ,
, .
,
GSM- , .

.
.
3.6.5 220

. ,
, 220 .
(, ..).
,
.
10 350 .
, ,

.
,
,
.

,

, .
3.6.6
-
,
POCSA G, FLE X, .
( )

( -I ).
, , ..
,
.
()

.
, ,

-.

.
,
,

, , , , . ,
. ,

,

.

.
, . .
,

.
( , , ,
. .),
,

,

, .

. , ,

, ,
, .

- ,
.

,
. ,
,
,
,
.
, , ISO 17799, 9001, 15408, BSI ,

.
,
-
[59].
-, ,
,
-,
,
.
-,

. :
-
,

;
-
;
-
- ;
- ,
,
;
-
,
-
,
.
.

,
, ,
.

(
, ,

),
,

,

.

,
,
,
, ,
,
.
4.1.
[59]:
1)
,
,
-,
. .
2) , -, ,

,
3) - ;
4) .
5)
- .
6) ,
.
7) .
.

-
,
ISO .
,
(
,
Internet).
,
, ,
.

(
, , ,
), .

(

,

,
-,
,
).
-

,
.

,
, .. 128 139
, , , .

- .

--
.

- ,
, :
- , ,

;
- - - .
,
, ,
:
-
,
;
- (

ISO 15408, IS O 17799, ISO 9001

);
-
;
-
-

-
;
- - - .

.

,
,
.

.

( )
[32]:
- ;
- ;
-
.
4.2

.
, ,
, - ,
.
, .
,

,
( ).

,
.
, :
- & ;
- -
;
- ;
- ,
.

,
. , -
.
.

i.
.

,
,

,
.
,
, :
- ;
-
;
- , ;
- ;
- , , ;
- , ;
-
;
-
-

;
- ;
- ;
- ;
- -

,
;
- ;
- , , ;
-
.

,
.

:
- ;
- ;
- -
- ;
- - , ;
- ;
- ;
- ,
;
-
.

,
,

-
.
, ,
,
.
:
- / , ;
-
;
-
;
-
;
- ( , ,
..);
- , ;
- , ;
- ;
- .
,

.

.
,
,
.

, , ,
, ,
.
. : .
4.3

,

, .

.

,
.
.
:
- ;
- ;
-
;
,
;
- ,
.
:
- ;
- ;
- ;
-
;
- .

.
(Cobit, ISO 13335, NIS T SP 800-30).
,
, .
4.4.

:
) :
- , - - ;
- ;
- ,
;
- ,
;
- , ,
;
- ;
-
;
- .
) - :
-
;
- , , ,
;
-

;
- ,
, ;
-
;
-
;
- ;
- ;
- ,
.
) ,
:
- , , ;
- , ;
- ,
;
- ,
;
-
.
) ,
:
- ,
,
;
- .*
;
- -

;
- , ;
- - ,
.
) ,
:
-
;
-

;
- , ;
-
;
-

.

:
- ;
- ;
- ;
- ;
- ;
- - - ;
-
;
- ;
- ;
-
;
-
.
,
, ,
.

. ,

,
.

.
,
, ,

.
.
5

,
.
,

,
, [43].

[50].

.

,
,
,
.

,
Internet ,
.
,
, ,
.
,

,
.
,
P rincipiis obsta- .
.
5.1.

,

. ? ? ?
? , , ?
,
.
,
: - ,
;
-
(, , , ,
..);
- , ;
- ,
;
-
, ,

;
- , (, , ,
..);
- .

.

, ? ? ?

.

, , ,
, ,
.
,
?, ..
,
.

,
, ,
,
.
,
, , ,
.
, , ,

.

,

, 4
,
.
, ,
- [50].

,
,
,
.
, ,
, ,
[ 43].

( )
, .
.
, ( , )
,
.
,
.
,

,
, ,
, .
- .

. ,
[43]:
-
,
;
- -
ISO 17799;
-
IS O 15408 ;
-
,
.
,
(, ,
), ,
.

,
.
, ,
,
, , ,
,
.
,

, ,

.

.

.

.

,
,

.
:
-
;
-
;
- ;
- ;
-
;
- .

,
.
,

.
, , :
- ;
- ;
- , ,
;
-
;
- .

, ,
,
,
. ,

.
,
,
.

( , )

,
-
,
.
,
, ,
,

- . ,

, , ,
. , ,
, .
5.2
,
,
,
,
.

,
, , ,
, , [43].
. -
, ,
,
.
, ,

III ,
.
5.1

VII
VI
V
IV
III
II
,

, ( ,
.)
III VI
- ,

, ,
-.

.
, , ,
,
. ,
,
,
.
V II . , .. .
-
,
,
,
. , ,
(,
, , Internet) , ,
. -
,
, .
.
, ,
, .

? . ,
.
.

, ,
.

.
, ,
,

,
,
..

.
:
,
.
- ,
,

, .
,

.
,
, ,
.
.
, I VII
. ,
,
, , ,
,
?

.
.
, -
. ,
,
.

. ,
.
III . ,
.
. .
III
,
, ,
-.

.
,

,
. ,
,
,
.
,
, ,

, ,
.
,

,
.
-
,
,

.
, ,
,
. , ,
,
, , , . ,
,
, - .
, ,
, '* .

,
.
5.3

[5]:
.
,

.
. .

.
.

. ,
,
.

( )
.
.

,
,
,

.

( ) (
, ).
.

- .
. , .
.

,
.
.

,
( , , ,
. .)
.
. ,
,
,
.
5.4

,
( ,
..) [6]:
- ( ). (, )
.
10 . ,
(,
).
- .
. ,
( ),
, ,
.
- .
( ) .
,
(, 10 --
)
.
- . ,

. , . ,
( , . )
. 100
,

.
- . -, ,
. , - -
, .
, ,
,
. :
, ,
, .
, , , .
- .
,
. ,
,
(, , )? ,
, -
,
. :
90%, (
) 99,9%. , ,

.

.
5.5
.
[42]:
- ;
- ;
- ;
- ;
- ;
- .
- ( ,
. .).

.
:
- , .
( );
- ( )
;
- ( ,
, );
- ;
- ()
;
- (, , ,
) .
-
.
- ,
,
,
.
- ,

,
,
.
- ,

.

:
- ,
- ,
- ,
- -,
- ,
- ,
- ,
- - .

,
.

, ,
, ,
;

;
.
, ,

.

:
,
,
, ..

, ,
,
,
: , , , .

,
, ,
,
.
5.6
. 20 ,
:
- , , , ,
;
-
, , , ,
;
-
.

: ,

,
,
,
.

.
:
-
( );
- , ,
,
, ;
-
;
-

,
,
;
-
,
,

.

(,5), (ISO 15408)
(ISO 17799) [59].

,
, ISO/ IEC 15408

,
ISO/IE C 17799

.
. 5.1.

.
:
- ,
;
-
(
),

;
- - ,
:
(

).

.

.
() ,
.

:
-
, ;
- , ;
-
;
- ;
- ;
- ;
- .
.
,
.
, .
,
, , . 2
,
- -
,
(, ,
, , ).
( . 2
), ..

. , -
.

.
, , :
,
,

,
,

.. ,

.

,
.
.

.
, ()
.
,
, ,
.
,
.

, ,
, ,

,
.
5.7
-
,
.

,
.
,
,
.

,

,
.

. ,

,
, .
(
). , ,
, ,
[59].

.
,

.
, , ,
, , .
,
.
, , (
), ,
, , .
:
- ;
-
;
-
( );
- ;
- .

.
,

.
:
-
, ;
-
;
- ,
,

.
5.8
, ,
,
[89].

(
) ,

: , ,
,
, , ,
.
.
,
.

,
,
.
, -
, - .
,
:
- ;
-
;
-
.
,
, .
-
, .
,
, .
, , .
,
:

.

, :
-
( ,
,
);
- ( - ,
, ,
);
- ( ,
, );
- ( ,
- ,

).

. ,
, ,
, . .

.
,

(
-
).
, - ,
-
.

, ,
-
, ,

,

,
.
,
,
,
,
, ,
.
, ,

,
, , .
5.9

, ,
.

- , ,
.
,
- .

,
.
.
,
, ,
- .
( )
,
.

[14].
,
, .
, ,

.

?

( ). :
? ,
,
.
( ) ?

.
, -
.
-

. ,
.
, ,
, .

.
,

.
,
.

. ,
,
,
.
,

.
,
.

,
.

,
,
:
, ,
, ,
.

.

,
,
,
, . .

.
, .

,
()
.
,
.

,
,
(), ,
.
6

6.1
140
[81].
30 .

,

, ,
,

, .
,

. , ,
ISO 15408,
ISO 17799 (BS 7799), BS I;
COB IT, SAC, COS O, SAS
78/94 , .
ISO 15408, ISO 17799 (BS7799), BSI; COB IT, SAC, COS O,
SAS 78/94
[60].
-,
.
-,
.
,
,
.
, .
,
,

,

.

, .

, ,

.
,

[22]:
- .
- .
- .
IS017799 ISO15408
. ,
[4]. IS017799
, ISO
15408 ,
- .
SysTrust , ..

,

.
BS I\IT Baseline Protection Manual
, ,

,
.

,
S CORE,

.

SANS/GIAC Site Certific ation, SA NS,

.
6.1.1 ISO 17799: Code of Practice for Information Sec urity
Management
ISO 17799: Code of Practice for Information
Security Management ( ), 2000 . ISO 17799
BS 7799.
,

, - , , , .
ISO 17799 [51]

,

.
IS O 17799,

, ,
,
, ,
, ,
, .
,
[4].
ISO 17799
,
,
.
ISO 17799 [51].
1.
2. :
- ;
- , ;
- ;
3. :
- ;
- .
4. :
- ;
- ;
- .
5. .
6. :
- ;
- ;
- (, );
- ;
- ;
- ;
- .
7. :
- ;
- ;
- ;
- () ;
- ;
- ;
- ;
- .
8.
:
- ;
- ;
- ;
- ;
- .
9. :
- ;
- ;
- ;
- , .
10. :
- ;
- ;
- ;
- .
, ISO 17799 (
), [4].

.
, ,
,
, ,
-.

,

, IS O 17799.
, ,
, ,
,

, , .

.
:
- ;
- ;
-
;
- ;
- ;
- ;
- ,
;
- ;
- ;
- .

,
,

,

. .
ISO/IE C 17799:2000 (BS 7799
1:2000) [60]

:
- .
- .
- .
-
,
- .
- .
- .
- .
- .
- , .
- -
.
-

.
BS 7799-2:2000
-Information
security management P art 2: S pecification for information sec urity
management systems,

.

.

- British Standards Institution(BS I) [103],
1995-2003 :
- -
-Information security managment: an int roduction.

- BS
7799 -Preparing for BS 7799 sertification.
- BS 7799 -Guide
to BS 7799 risk assessment and risk management.
- BS 7799-Are
you ready for a BS 7799 audit.
- -BS 7799Guide to BS 7799 auditing.
-
-Code of practice for IT management.

,
BS 7799
Joint Technical Committee IS O/IEC JTC 1
- British Standards
Institution(BSI), UK AS (United Kingdom
Accredited Servic e).

BS ISO/ IEC 7799:2000 (BS 77991:2000). , ,
.
,
ISO 9001 ISO 9002 BS ISO/IE C 7799:2000 (BS 77991:2000)

ISO 9001 9002 ,
.

BS IS O/ IE C 7799:2000
(BS 7799-1:2000).

,

.
2002 IS O 17799
(BS7799) .

,

. ,
IS O 17799 (BS 7799)

,

.
ISO 17799 .
IS O 17799
, [83].

, ,
, .

,
,
,

.
ISO
17799.
,

- ISO 17799

.
,
ISO 17799.
,

IS O 17799?
, :

,

,

.

,
,
.
BS 7799 (ISO 17799)

,
,
,

, ISO 17799,

.

, ISO 17799.
ISO
17799,
IS O 17799
,
,

.
.
,
, ,
,
,
.
,
,
ISO 17799,
(KPMG .),

UKAS (United Kingdom
Accreditation Service) -
.
6.1.2 ISO 15408: Common Criteria for Information
Technology Security Evaluation
/ 1540899

( ),
ISO 15408: Common Criteria for Information Technology

Security Evaluation
.

( ) (security functional requirements)

(security assurance requirements).
. , ,
2001
, ,
50 %

[61].
() ,
,
.
,

[60]. -
,
.
,
.
,

()
,
,
. ,

.

.
,

,
,
/ 15408 99. -
[81]:
- ;
- ;
- ;
- ;
- .
-
, .
,
,

.
,
,

.

- ,

,
[4].

, , .
,
.

.
, ,

AVA: Vulnerability Assessment.
,
,
:
- ;
- ,
,
;
- ( ) , ;
- () , .
,
.

[60].

. ,
,
,
.
6.1.3 SysTrust
, ,
,
,
,
.
,

.

.
,
(American Institute of
Certified Public Accountants (AICPA))
(Canadian Institute of Chartered
Accountants (CICA)) SysTrust
, .
SysTrust
,
.
SysTrust (A vailability), (Security),
(Integrity) (Maintainability),

,
, ,
.
.

.

, , ,
.

,
.
AICPA/CICA S ysTrust Principles and Crit eria
for Systems Reliability, Version 2.0 ( -
).
SysTrust
(SysTrust engagement)
, , (SysTrust Principles and Criteria),
.

.

SysTrust,
(unqualified attestation report).

.
,
.
(management's assertion)
,
Sys Trust.
SysTrust

(Statement on Standards for Attestation E ngagements (SSAE) No. 10,
Attestation Standards, AT sec. 101 Attest Engagements.)

Sys Trust
Ernst&Young
BeeOffice, [119].
6.1.4 BSI\IT Baseline Protection Manual
(IT B aseline Protection Manual)

(BS I - B undesamt fbr Sicherheit in der Informationstechnik
(German Information Security Agency).
, ,

.
,
.

.
BS I [60]:
-
(

,

).
-
.
-
(
,
, ).
-
( ,
, , ).
- ( ,
DOS, Windows UNIX).
-
, Novell NetWare, UNIX
Windows ).
- , Cisco
Systems.
-
( 600 ).
,
: -
.

Web- BSI (www.bci.de).

1600 [4]. BSI\IT B aseline P rotection Manual
.
,

.
rd
6.1.5 COBIT 3 Edition

,

,
, , ,

ISACA, ,
. 1969
23000
100 , [60]. ISACA
26000
(CICA - Certified Information System
Auditor), ,
, ,
.
ISA CA , ,
,
,
.
ISACA
, ,

.
,

.
rd
COB IT 3 Edition (Control Objectives for
Information and related Tec hnology),
.
1: (Executive Summary).
2: (Framework).
.
3: (Control Objectives).
4: (A udit Guidelines).

BS ISO/ IEC 17799:2000 (BS 77991:2000).
,

. COBIT (Control Objectives for Information and
related Technology -
) ,
1996 .
COBIT :

.
COB IT
, ,
- .
.

-,
, .
,
.
, ,
, : ,
.
- ,
.

.
-, - ,

,
, .
, - ,
.
6.1.6 SCORE SANS/GIAC
Site Certification
SCORE (Security Consensus Operational Readiness E valuation)
SANS
(Center for Internet Security(CIS)).
-

SCORE (
)
. ,
,
SCORE,
, CIS, ,
(minimum standards benchmarks)
.

CIS.
(GIAC Site
Certification program), SANS,

,
, SCORE.
GIAC Site Certification

. ,
, .

, ,

.
.
.

,

.

,

.

, .
,
,

, ,

,
.
,
,
, ,
,
, .
IS017799 ISO15408

, . IS017799
,
ISO15408 ,
- .
Sys Trust

.
BS I\IT Baseline Protection Manual

,
.

,
S CORE,
.

SANS/GIAC Site Certific ation, SA NS,
,

.
BSI,
,
ISO 15408, ISO 17799 COB IT

,
.
.
BSI
,

.
IS O 17799 COB IT

.
,

. ,

,

.
6.2

.

,

2000 ,
( ) [61].

,

.

[41]:
- 26
( );
- 8 () ;
- 40
.

, ,
,

.

,
:
-
;
-
,

( 60-
/, 30 -

,
50- , ,
).

2001

:
1.
/ 15408-2002 ( 1, 2, 3),
,

( / 15408 -2000
( 1, 2, 3), ).
2. ,
6
, [61]:
-
;
-
;
- .
3.
[41]:
-
;
- .
:
- ;
-
.
4
/.
- 6 ,
, ,

.
, .
4. ,
.
.
5. 2003 :
-
( ,
, );
- ,

, ,
.

,
.
6.

:
I. 2002
2002 2010
,
.
:
- ;
- ;
- . 38
.
II.

,
,

,
,

.

, ,
.
35
.
III.

2003-2010
.
:
- ;
-
;
-
, .
, .
: 2004-2005 .

,
:
- ,
;
-
, ,
;
- , , ;
- , ,
.

( ,
, , , )

,
.

,
2003~
2010
,
,

:
-
/
15408-2002 ( );
-

/
15408-2002;
-
,
( ),
.

,
,

.

.

,

.
, .

, .
, ,

,
,
,
Int ernet (, .) .
, . . , ,
,
, . , ,

.
Internet , , ,
,
, .
, ,

,
. ,

. , ,
, ,
.
[17] .
158 , - , - 90,
- , -. ,
,
3,5 8 .
,
, (
)
.
,
150 .
,
, , ,
-
, , , ,
. -
,

, [87].
,
,
.
, 400 .
12 ,
250 .
Internet , .
-
, (
),

,
,
.
,
, -
.
,
,
.
,
,
.

[40] - , , , ,
. - ,
,
. -
. - ,

. , , ,
, .
- ,

.
7

7.1
.
: -, ,

-,
- .

. , ,
.

.
, ,
.

. ,

( ), ,
. .
[74]:
- -
,
;
- -
, ,
;
- - - ,
: ,
, , ..
-
- () .
(. 7.1)
,
.
,
. ,
.
. 7.1
.

, ()
, , .
,
. ,
/
.

.

.
1.
,
, :
-
( ), ;
- ;
- ;
- ;
- .
2. :

.
3. .
4.
:
, ,

.

,
.
, , , ,
..

.
,
.
,
,
.
, :
- ;
- ,
;
- ;
- .

. ,
, , .
.

, .

(, ) .
,
.
, ,
:
- - ;
- ;
- - ,
, ;
- - , .
, ,
.
,

.
7.2

[58]:
1. -
.
2. - ,
.
3. - , - .
4. -
.

.

.
.
:
- ;
- ;
- ;
- ;
- ;
- .
,
( ),
- ,

, . ,
[16]:
-
,
;
- -
, ,
.
, :
- ;
-
().
, , , ,
,
.
, (

, , .
, .
,

.
,

:
- , ,

,
(
,
,
..);
-
,
;
- - (, ,
..).

,
,
. ,

,

,
. ,

,

.
,
,
.

. ,
, , ,
.

:
-
(

);
- ;
-
;
- , ( ),

,
;
- ,

, ,
;
-
.
, ,
,

.
.

- .

()
,
.
:
1) .

.
2) .
.
3) .

,
.
,
,

( ,
..),

-
,

,
( , ,
) .

.
,
[84]:
- - ,
;
- ;
- .
, ,
,
. (
, , , ..),
(-
, ,
),
.

. :
- ;
- ( ,
,
);
- ( ,
..).
7.3

[78]

- .
,

.
.

( ), ,
.
,
,
.
.
.
, .
, -, , ,
.
, UNIX
VMS, ,
,
.
- ,
. ,
.
,
(,
-).
.

( , , ,
).
, .

.

, , .
.

.
.

.
,

.

,
, .

.
,
.
,
.
- ,
USB ,
,

( USB -
, ).

Windows ,
. USB-
, PIN- .
, ,
-
.
USB-, PIN-, -
.
USB- -,
,
.

.
(
). ,
. ,
DES
- (HMA C-MD5).
,
.
PIN-,
.

.

- , , -
, ,
. ,

.
.
,
.
(, ,

),

(
, ).
(,
)
.
()
,
.
( )
. ,
-
- .
, 200 -400 .

(
). ,

.
,
.

, .

.
,,

.
iButton,
-,

USB--)
.
7.4

. ,
. ,

.
, .
[30]:
1) , , ,

?
2) -

?
3)
?
( ,
, ), (
)
.
,
,
. ,
:
- (,
);
- ( ,
);
- (web- ).

.
,
, ,
(VLA N) IPSec.
,

.
,
.

.

[70].
-
, .
,
,
,
, (
, ) ,
.
, ,
,
.

.
,

: ,
(
). ( )
,
,
,
(). ,
: , ,
.
, ,
..

.

,
( ).
.

,
( ).

.
,
. ,
, ,
(, , ) .

,
.

. (
, .)
,

( ).

.

. ,

.
,
.

, .
, ,
(
).
,
, ,
, ,
.
,
.
,
,
.
,

, - ,
, ..
: ,

,
, . ,

. ,
,
,
. (
).
(
) ,
.
,
.
,
,
,
, ,
, .
,
,
:
- ,
( ,
);
- ,
, ;
- ,
;
- .

,
, , Novell [84]. , ,
NetWare, (
, ),

.
, , ..
,
.
- -
.
(
- -)
-
, ,
.. ,
-
,

-
, , ,
, .

, ,
, Kerberos,
:
- , , , ,
..;
- (authentication server),
. ,

.
, ,
;
- Ticket-granting server ( )

, ,
. , ,
.
,

.
,
,

( )
.
.
,
, .

- ,
.

.
,
.

. , A T& T
Remote Port Securiti Device (P RSD),

: RPS D Lock (),
, RPS D Key (),
, RPSD Key
Lock
:
- ,
;
- .
8 ()
( ) ,
,
, - .
,
(,
),
, .
-,

,

.
8.1
firewall.
firewall (.- )
, .
,
-
, ,
, ,

. ,
. ,
. , ;
,
, ,
.
- .
,
,
, .
. 8.1.
8.1
, ^
, ? ,
^**
, xiaxo
.
, ,
,
, .

, .
, (, )
[26]:
- ( packet-filtering firewall);
- (circuit-level gateway);
- (application-level gateway);
- (stateful inspection firewall).

, -
,
. ,
, .
.
.
. : ,
-
[27].

, ,
.
, IP . ,

,
( ),
:
- ;
- ;
- ;
- ;
- .
( ,
),
., , .
, ,

, ,
.
, ,
. ,
,
, ,
.

,
.
,
, ,
. ,
, ,
( Internet- ), IP . ,

,
, ,
- , -
.
,
,
. TCP UDP (User Datagram Protocol).

(, Telnet FTP),
( Telnet FTP ).
,
, TCP/ IP:
TCP/IP
(
, .. ),
. , Telnet
TCP/IP 23.
Telnet ,
,
, 23
123.45.6. 7 (IP- Telnet), ,
. ,
, .
, ,
Cisco, Internet.
[28]:
- ;
- .
[28]:
- ( ) ;
- ,
TCP UDP;
- ;
- IP- IP- ,
, IP -.

( )
( ), ,
.
,
IP- TCP, ..
,
.
, -
, .
, , ,

(, DNS- IP-
). , ,

TCP
TCP-,
SYN
()

( ).
TCP, SY N , 1000,
. , ,
,
, , (
1001), , , SY N
. :
SYN (, 2000),
,
2001.
.
,
SY N , ,
TCP -,
.
,

TCP, ,
.
,
.
, ,
, .
,
, .

,
( pipe proxies),

, , (
TCP/IP) .
-
: -
(proxy server). ,
- (
),
.
-
,
(address translation),
IP-
IP -.
, .

,
()
(
). IP-
IP -,
.
, spoofing
( ).

,
, . .
,
,
. ,
,
Web-,
.
, *
,

. ,

, .

,
,
-, -
,
- ,
.
, ,

: -, , -,
.
,
,
, . ,
-

Telnet
,
,
. ,

, . ,
FTP Telnet,
, .
,
,

.
,
.
,
(FTP, Telnet, HTTP .). ,
,
FTP P ut,
, FTP -,
.
,
FTP
,
.

, , . ,
BorderWare Firewall
Server Secure Computing
, ,
, .
Black Hole Milkyway Networks

,
.
[28]:
- Internet;
-
,

;
i't -
. [28]:
- , ;
- , .

.
, ,
IP-
.
, ,
. , ,

,
, .
,
,
, P ut Get
FTP. , ,

- .
:
- , -
.
.
, ,
.

.
.
-,
, , ,
.

,
,
,
.
.
, ,
, , ,
. ,
100% -
.
8.2
,
, . , ,
,
,

(
,
).

,
[35]. , CRM- .
, KMI
(remote method invocation) , Java,
,
.

.
,
, VPN (virtual private net work),
,
, ,
Internet/Intranet. , VPN

- , .
, VPN
. VPN
, Web .
VPN, , . ,
eTrust Firewall ,
VP N, .. eTrust Firewall
,
, VPN,
,
.
,
, VPN. VPN
, .
VPN
, 60%, - Cisco
Systems Check Point. , . Cisco
-
Cisco. Check Point
,
[24].
8.3
,
IP-, ,
, SYN,
(Denial of Service, DoS). ,

, HTTP, DNS, ftp, NetMeeting [24].

.
.

.

, , ITSEC (Information Technology

Security Evaluation and Certification Scheme) IASC (Information
Assurance and Certification Services ),

Common Criteria Standard.

, Gartner Group, Checkpoint
Software, Cisco Systems, Microsoft, NetScreen Technologies
Symantec Corporation [112].
, Check Point Software Tec hnologies,
Cisco Systems NetScreen Technologies
- , Microsoft
Symantec - ,

.
8.1

URL
Check Point
Software
Technologies
http://www.checkpoint com
VPN-1 (
Nokia IP330)
Cisco Systems,
Inc.
http://wwwxisco.com/
Microsoft
http://www microsoft.com/
NetScreen
Technologies
http.//www.netscreen,com/
Symantec
Corporation
http://www Symantec com/
VPN-1;

Windows
PIX Device
Cisco PIX Firew all
Manager ( 500 Series,

Cisco PIX
Firew all 500

Series)
Internet Security and

Acceleration
NetScreen
Server
5000
Enterprise
Firew all 7.0
Windows
NetScreen 5000,

Windows, Solans
Nok ia IP330
Nokia IP330
,
Internet.

Nokia IP Network Security, 1 330 ,

. 1U

.
Nokia IP330 IP- , RIP vl/ RIP v2, IGRP, OSPF,
RIP ng BGP 4 unieast-, PIM-DM, PIM-SM
DVMRP (multicast) .

[94].
IP330
Nokia Voyager, Nokia Horizon Manager,

.
,

.
,
,

Nokia. ,
Internet ,
.

[95].
Cisco PIX Firewall
(
),
,
.
PIX (Private Internet Exchange) Firewall
Cisco Systems [95]
.
P IX Firewall , UNIX;
.
PIX
Firewall
,
UNIX.

,
.
PIX Firewall Internet.

;
.
P IX Firewall ,
, .
.
PIX Firewall Internet
. P IX Firewall
(stateful) NA T (Network Address Translation -
).
Internet,
, ,
, TCP
TCP. PIX Firewall
Internet
.
PIX Firewall ,
TCP/IP, , IP. NA T IP ,
Internet (IA NA -Internet Assigned Numbers
Authority) ( RFC 1918).
Cisco P IX Firewall Privat e Link,

Internet
PIX Firewall
DES (DES -Data Encry ption Standard).
NetScreen 5000
Juniper Net works (NetScreen Technologies)

,

(firewall),
(VP N),
(bandwidth manager) [52].

.
, (. .
), ,
(..
IpS ec) NetScreen

(AS IC).
10 , (systems) ( applianc es),
,
,
ScreenOS,

,

GigaScreen ASIC
.
- 5000 -
; NetScreen-5200 5400
[24]. NetScreen1000:
.
. NetScreen-5000
-
DoS-, JPSec VPN,
.
12 / 5400 4 /
5200; VP N,
Triple-DES 128- , - 6 2 / .
NetScreen 5400 mini-GBIC (S X
LX) 72 10/ 100 / 24 mini-GB IC (S X LX);
5200 mini-GB IC (S X LX)
24 10/100 /,
mini-GB IC.
.
1. (firewall).
2. (Denial of Servic e, DoS).
3. (Virtual Private Networks, VPN).
4. (High A vailability).
5. .
6. .
7. DHCP /.
8. .
Symantec Enterprise
Firewall 7.0
,
, ,

, Symantec Enterprise Firewall [158] J

.
, ,

,
, ,
.
, ,
Symantec Enterprise Firewall 7.0
Advanced Encryption Standard (AES)
1.5 /.
Windows NT/2000
Solaris, Symantec
Enterprise Firewall ,
-
,

.
,
:
-
;
- / ;
- ;
;
- DoS
.

( )
Agnitum Outpost Firewall [97]. 2004
2.1.
, ,
,
, :
: 1.0, Pro
500 [6].

. Outpost Firewall
:
. -
, :
,
.
Outpost Firewall :
, ,
cookies, .
(plug-in)
,
.
Outpost
Firewall,
Kaspersky
Anti-Hacker [112].
Anti-Hacker
,
.

PortsLock - [6]. PortsLock - ,

Windows NT/ 2000/ Windows Server 2003.
TCP/ IP
.
IP-
-
NTFS .
,

.
PortsLock
( , , . .)
,

,
.

VipNet Office, VipNet Tunnel VipNet Corporate [46].
-f ,
VPN [46].
- - VPN
[46].

, VP N [46].
,

,
,
.
9

9.1

(Intrusion Detection Systems - IDS)* 1997 ISS. ,
,
, ,
. -
.
. ,

, 80- .
.
,
-
. ,
, . ,
,
,
. , ,
, .

. , -
,
. .

.
.
,
,

. ,
.
,
. ,
,
- .

.
,
.
. .

. ?
?
? ?
? ? ,
, (,
) ,
,
.

. . ,
.
.
. ,
.
,
. ,
- .

.
- .

.
, ,
. , .
, . ,
. ,

[19]. , ,
:
- ;
- .
.
, ,
. -
,
.
,
.

-.
. ,
,
,
. ,
.
. ,
.

.
:
- ;
- ;
- .
,
, .

.
-
, , .
,
.

.
, , , -
.
. ,
.
,
, .
.
.
:
- ;
- ;
- .

-
.

. . ,

IP-.
,
.
.
, .
,

.
, IP -
.
,

.
, ,

.
9.2
, ( )
,

TCP/IP.
, ,

. ,

CE RT,
,
2004 ,
, 2003 .
2003 , ,
,
.
,

[73].

:
- ;
- ;
- SNMP -trap
(, HP Open View, IBM
Tivoli, CA Unicenter .).

,
, :
- TCP- , .
TCP- RS T;
-
.

,
;
-
, .
()

,

.
OPSEC Checkpoint FW-1;
- ,
.

.
,
,
.
, ,
.
,
,

,
.
: ,
, .

,
.
, ,
.
,
,
.
.

,
.

,
. , , Web-
Apache, Linux,
Nimda, web-
Microsoft IIS, ,
, Web-
. ,
,
.
9.3
, Gartner
Group [38], Cisco Systems, Internet Security Systems,
Enterasys Net works Symantec. Butler Group,
Computer Associates
Entercept Security Technology.
, ,
Symantec
Ent ercept
Security
Technology.
Cisco IDS 4210 -
, - ,
.
9.1
[112].
9.1

URL
Cisco Systems,
inc.
http://www.cisco.com/
Cisco IDS 4210

eTrust
Cisco IDS 4210,

Windows
Computer
Associates
http://www.cai.com/
Intrusion
Detection 2.0
Windows
Entercept
Security
Technology
Internet Security
Systems
http://www.entercept.co
m/
Entercept
2.5
Windows, Solaris
http://www.is s.net/
RealSecure
Netw ork
Protection
Dragon
Windows, RedHat
Linux, Solaris,
ADC, HP- UX,
Nokia
Entcrasys
Netw orks
http://www.enterasys.co
m/
Intrusion
Detection
System
Symantec
Host Intrusion
Sjmantec
Corporation
http://www.Symantec.co
m/
Detection
System,
Symantec
Intruder Alert
Windows, Linux,
Solaris, AIX
Windows, Novel
NetWare,
UNIX;
|

Tivoli En
terprise, BMC
Patrol, HP Open
View
Cisco
Secure IDS
Cisco Secure IDS : Cisco Secure IDS
Sensor, Cisco IDS Host Sens or, Catalyst 6500 IDS Module [79]. Cisco
IDS Network Sensor -
,

.
IDS Sensor
Cisco Secure IDS
Director.
Cisco IDS Host Sensor ,
, , ,
- .
, Cisco IDS Host Sensor
,
.
Catalyst 6500 I DS Module
,
IDS
, Catalyst 6500.
Cisco IDS 4210 45 /
1/1, ,
Ethernet .
Cisco IDS 4235 200 /,
,
.
Cisco IDS 4250 500 /
.
Cisco ,

[91].
.
Cisco IDS
. Cisco IDS
:
- . Cisco
IDS Sensor S oft ware Version 4. 0

.
- . Cisco
Threat Response
,
.
- . -
,

.
- .

.
Cisco IDS .
, , -
.
eTrust Intrusion Detection
Computer Associates
,
eTrust [39].
- eTrust
intrusion
Det ection,

(denial of service - DoS).

,
eTrust Firewall, Checkpoint Firewall-i,
Cisco Systems. -
-
.
Entercept 2.5
Entercept [56].
,
,
.
Entercept

API ,
. ,
.
,

. ,
(,
).
-
Entercept,
.
Entercept .
.

,
.

.
.
: ,
, , .
,
Entercept
,
. Entercept
,
,
.
,
.

() ,
.
.
, Enterc ept
.
GirlFriend,
UniCode,
LOphtCrack.
Entercept
,
. , -
,
.
RealS ecure
RealSecure Int ernet Security Systems, Inc.
[72].
RealSecure
, .
, , -
,
Ethernet, Fast Ethernet, FDDI, TokenRing Gigabit Ethernet,

,
Windows 2000, Windows NT, Solaris, linux, HP
UX AIX.
RealSec ure
, ,
, Web-, ,
, , ..
, :
- ;
- e-mail, ,
;
- ;
- SNMP -
;
- ;
- ;
-
;
- ( .. Internet);
- ;
-
.
RealSecure
,
, .
Dragon
Dragon - ,
,
[75]. Dragon
(),
.

.

, .

.
Dragon.
Dragon , ,
.

.
Network Intrusion Detection
System (NIDS), Host Based Intrusion Detection System (IIIDS ).

. ,
, Policy Manager

.
,

.

,
.
-
MD5 ( ),
, , S NMP,
Windows NT.
,
( , -, UNS - FTP -).
- log-
,
, SNMP
SYSLOG. ,

, syslog-,
-, syslog-co-
Dragon .
(Checkpoint FW-1, Symantec Raptor,
Rapidstream, Netscreen, Cyberguard, Cisco P IX)
.
, -
.

.
,
, : Secure Shell, Sendmail, Qmail, Bind, Internet
Information Server Apache.
- log- ,
, SSH-
-,
SSL.
,
. SSH, , ..
-
, ,
,
.
E nterprise S ensor,
E vent Flow P rocessor, Policy
Manager .
.
Dragon .
() .
-
. ,
,
. Dragon
(policy manager, rtlormt ool config, real time
console, forensics console, trending console),
-.
Policy Manager
.
(
).
.
Policy Manager
.
.
Alarmtool
.
: ,
,
S NMP, SMTP (e-mail), SYSLOG. , Alarmtool
,
,
, .

.

, .
,
, .

.
24 .
, , ,
,
.
1, 5 15 . /
Forensics Trending-.

,
, .

.
MySQL, .

MySQL. ,
Oracle, Sybase MS-SQL.
: ,
,
.
(E vent Flow Processor - EFP)
.
EFP
, . Dragon
,
, . ,
EFP , ,
EFP, ,
.
Dragon
Dragon :
- ;
- ,
,
,
, ,
;
-
,
,

.

.
:
1. ,
.
, , .
2.
, . , IP-
.
3. ,
. , , .
Symantec Intruder Alert
Symantec Intruder Alert (ITA )
IDS (hostbased),
[67].

.
,
. ITA
.

, 14
.

.
ITA 35
- ,
UNIX, Windows NetWare.
.
ITA . IT A
- .

-.
400- .
ITA
: ITA Admin View.
ITA Admin
, ,
. IT A Admin

:
- ;
- ;
- Web-
Symantec;
- ;
- ;
-
;
- ITA

.
ITA View
,
ITA
.
ITA,

,
, , ,
;

ITA Manager. ,
,
,

.
,
.
UNIX ITA Manager .
Windows NT NLM-
NetWare.
ITA Agent
, ,
.

,
ITA.
,
.
.

. UNIX Windows NT
, ,

(syslog, wtmp, process accounting, btmp,
2 . . UNIX ,
Windows NT).
ITA A gent
,

. NetWare ITA Agent
,
.
9.4

(:
)
,
, .
,
.
,
.
[76]:
- ,
;
- , ;
- ;
- .

,
TCP/IP.
,
.

- .
,
.

,
.
,
.

.

.

.

, .

.
:
-
;
- ,
;
- , ;
-
;
,
, .

:
- ,
.
,
, .
- ,
.

, , Web-,
.
.
- -, ,

.
- , , ,
.

,
.
- , ,
. ,

.

1)
.
2) .
3)
,
4) ,
5) -
.

,

.
SE CRET NET
- SECRE T
NE T ( )
,
,

[69].
Secret Net Windows 95,
Windows 98, Windows NT Windows 2000

,
.
Secret Net ,
.
SECRE T NE T [68];
-
(Touch Memory, Smart Card, Smarty, Proximity
..);
- 16 ;
-
;
-
CD-ROM ;
-
;
-
(
);
- ;
-

;
- ;
-
Config.sys Autoexec.bat;
-
;
- ,
;
-
, -

.
:
- ;
- ;
-
.
Secret Net
Sec ret Net,

,
,

.
-
-
( )
-

(VPN) ,
TCP/IP (, Internet), [69]:
- ,
;
- ;
-

- .
VP N
,
(
).
3
,

.
( CSP),
- ( ) .
10
10.1
, .
, 2002
12 34
,
(Linux, Microsoft .NE T, FreeBS D,
, Microsft SQL Server) [112].

: ,
, ..,
.

- 96,4% ,
(Web-, FTP-, 2-, IRC .) - 2,3% ( , CD-ROM, 1 .) - 1,3%.
, . , ,
-
-
.
. ,
( )
,
.
, , , -

,
, - .
:
-
;
-
.
( ) - ,
(!)
,
, (
)

.

.
:
(
),
(
). :
,

,

.
-, know-how .
:
( ),
.
.
:
- , .
,
,
.
.
,
: ,
:
-,

. - .

, ?
-
.
- 3060% ( ,
). ,

- .
, ,
, ,
.
:
- (
) ;
- ;
- () ;
- .

, -
. , .

,
. Intel
,
[84].

,
. 1
,
.
10.2 ,
, ,
,
, ,
, .
,
,

,
.
.
,
,
.
,
,

.

,

,
.
,
.
[112]:
- ;
- ;
- ,
(,

, ).
[112]
,
:
1. -
,
.
2.
, - /, .
. .
(. ), ,
(), ..
.
3.
,
, ,
.
4. , ,
.

,
,

, ,
.
, -

[] [Cancel] ,
,
.
, , ,
()
.

.
, -
.
,
. ,
100% -
,
( 99 %)
. 1%,
, 99 %,
, .
1,99 %. ,

.

,
, ,
.. ,

,
,
,
,
,

.

, ,
,
.
, . , OneHalf
Windows95 WindowsNT.
( )
DOS -,
:
, Windows 95/ NT
()
. , Windows, .
. 100%-
, , ,
. ,
- Novell NetWare,
Windows NT, , -, , / .

, .
.
,

.
, ,
.
,
, -
.

,

.
, ,
.
Gartner Group,

Network Associates, Symantec, TrendMicro.
S ophos, Computer Associates, FSecure.

, , SMTP- , Web-
FTP -,
.
, ,
.
10.1 ,

URL
Computer
Associates
http://www.cai.coin/
Stune
http://www.f-secure.com/
eTrust Antivirus
6.0 eTrust
Antivirus
Groupware
F-Secure AntiVirus Total Suite
Windows, Linux, Solaris ,

Novell NetWare; Microsoft
Exchange, Lotus
Notes/Domino
Windows, Lmux, Microsoft
Exchange,
Windows e Linux,

Netw ork
Associates
http://www.mcafeeb2b.co
m
McAfee Activ e Vi- Windows Microsoft Exchange,

rus Defence
Lotus Notes/Domino
Sophos
http://www.sophos.com/
Sophos Anti-Virus,
Mail Monitor,
Enterprise
Manager
Symantec
Corporation
http://www.symantec.com/ Symantec
Antivirus
Enterprise Edition
8.5
http://www.trendmicro.com InterScan
/
VirusWall
Windows, Novell, NetWare,

Microsoft Exchange, Lotus
Notes/Domino
Business Optimal
Windows, Linux, Solaris ,

FreeBSD/OpenBSD/B
SDi,OS/2, Novell NetWare;
Microsoft Exchange, Lotus
Notes/Domino,

Linux, Solaris,
FreeBSD/OpenBSD/B SDi
TrendMicro
http://www.kaspersky.ru/
Windows, Novell, NetWare,

Linux, Solaris, FreeBSD, SCO
UnixWare, SCO OpenServer,
HP-UX, AIX, Compaq True64
UNIX, OS/2, OpenVMS
Windows, Linux, Solaris, HP

UX, ADC;
Cisco, Microsoft, Lucent,
NetScreen, Check Point
htttp://www.dials ru/
Dr. Web Dr. Web Novell NetWare,

Enterprise Suite (
Linux, Solaris, FreeBSD
)
.
eTrust Antivirus
eTrust Antivirus Computer Associates international,
Inc. (CA ) ,
.
, eTrust A ntivirus

,
.
, ,
eTrust
TA RGE T (Threat A nalysis and Response Global Emergency)
(!
[130].
eTrust Antivirus

.

.
, eTrust Antivirus

.

(Virus Block)
.

, .

.

eTrust Antivirus. eTrust Antivirus

. , eTrust Antivirus
.
. 100% eTrust TA RGE T, eTrust Antivirus
,
.
eTrust A ntivirus
,
.
. eTrust Antivirus

,
.

.
eTrust Antivirus :
- ;
- , ;
- ,
Internet/ Intranet;
-
,
;
- ,
, ; ,
, ,
;
- Lotus Notes Microsoft
Exchange Server;
- Computer
Associates.
eTrust Antivirus:
. .

.

:
.
.
eTrust Antivirus

.

, Microsoft Exchange
Lotus Notes/Domino; ;
( roaming us ers);
(Virus Block);
.
.
.
,

.
,
, ..

.
, .
SMTP, , HTTP
,

.
eTrust TARGE T. eTrust TARGE T
,

,
, .
eTrust Antivirus
.
.
eTrust Antivirus ICSA Labs, West Coast Labs
Virus Bulletin 100 % .
. Report Builder, LDAP
ODB C ,

.
.
, ,
,
,

.
eTrust Audit
.
Sophos Anti-Virus
Sophos Anti-virus (SAV) ,

.
SAV ,
, West Coast labs, ICSA Labs
Virus Bulletin [93].

. Sophos Anti-Virus
,
.
Sophos Anti-Virus ,
LZE XE, PKLITE, UUENCODE DIE T.
Zip, ARJ, TA R, GZIP,
RAR, Unix ELF, , Unix-
compress, Binhex
MacBinary Macintosh, Windows NT/2000/ XP
NetWare. InterCheck
.
,
,
- , CD-, ,
, ,
.
InterCheck,
.

.
,
. ,

. Sophos Anti-Virus
,
,
, .

,
,
,
.
Enterprise Manager SAV #
, . Ent erprise Manager
, SAV
,
(
Remote Updat e). Enterprise Manager
.
Sophos Anti-Virus
,
, .
Enterprise Manager
Enterprise Manager ,
Sophos
[128].

. ,
Sophos Anti-Virus, E nterprise Manager . , 10 Q0

Windows
.
Reporter
. , ,
.
Report er , Sophos Anti-Virus,
,
.
Sophos Anti-Virus,

.
Sophos Enterprise Manager
,
Sophos Anti-Virus
. Enterprise Manager
Sophos
Anti-Virus , web S ophos databank. Sophos
Anti-Virus ,
,
.
S ophos
(, ,
)
. Remot e Update

web- ,
.
,
(
),
.
Enterprise Manager :
1. Sophos Databank web-,
S ophos Anti-Virus .
Enterprise
Manager .
2. Library ,
.
(CID),
.
3. Reporter ,
.
,
.
4. Console
Library Reporter .
5. SAVAdmin Windows. ,
,
.
Symantec Antivirus Enterprise Edition
Symantec A ntivirus Enterprise Edition
, ,

[126]. Digital
Immune System
. NAVE X

Norton Antivirus
,
.
Windows, Solaris NetWare,
.
,
. Symant ec System Center
IT- Symantec A ntivirus
, ,

. Symantec System
Cent er

,
. Central
Quarantine
LiveUpdate

.
Symantec Security Response

Symantec Antivirus Enterprise Edition.

.
InterScan Virus Wall
Trend Micro Int erScan Virus Wall for Small and Medium
Business
-,
[100]. ,
,
-,
.
, InterScan Virus Wall for Small
and Medium Business
,
,
, ,
.
InterScan Virus Wall for Small and Medium
Business ,
SMTP, HTTP FTP,
-.
, ,
,
.

-.

-. InterScan Virus Wall
for Small and Medium Business
, -
- .
,

.
, SMTP, HTTP, FTP ,
,
.
. ,
SMTP, . InterScan Virus Wall
for Small and Medium Business ,
,

.
. InterScan
Virus Wall for Small and Medium Business ,

,
.
,
SMTP .
. InterScan
Virus Wall for Small and Medium Business
,
.
,

,
.
. InterScan Virus Wall
for Small and Medium Business
,

.
( , Java),
,
.
Kaspersky Anti-Virus
,
- ,
, -
.
,
, ,
, ( )
,

[112].
P ersonal,
Personal Pro K aspersky Security PDA
.

Business
Optimal
,
- , - ,
.
Kaspersky Security Corporate Suite - ,

.
Business Optimal
Business Optimal

.

.
Business Optimal -
,
, .

.
Business Optimal
,

.
.
Business Optimal
.

, , -.
.
Business Optimal ,
.
.
Kas persky Updater

.

, .
;
, Kaspersky Updat er
.
.
.
.
Business
Optimal
. B usiness Optimal

,

24 .
Kaspersky Corporate Suite
,

Kaspersky Corporate Suite.
1) .
2)

.
3)
,
.
4)
,
.
Kaspersky Corporate Suite
24 , 7 ,
.
,
Corporate S uite
, .
Kaspersky Anti-Spam
Kaspersky Anti-Spam -
,
, ISP-,
, ,
.

, ,
, ,
, ,
.
( !) ,

.
Kaspersky SMTP-Gateway Linux/Unix.

Kaspersky SMTP -Gateway Linux/Unix
,
,

SMTP-.

, ,

.
Kaspersky SMTP-Gateway
()

.
Dr. Web Enterprise Suite
Dr. Web Enterprise Suit e -
Dr. Web ,

[92].
Dr. Web Enterprise Suite ,
,
( ), :
- Dr. Web
,
;
-
,
;
-
Dr. Web,

Dre Web;
-
;
- ( ,
)

.

Dr. Web
Enterpri se Suite :
- Dr.
Web Enterpri se Suite
,
;
- ,
, , ,
IP, IP X NetBIOS
;
- ,

;
- Dr. Web
Enterpri se Suite, ,
, ;
- ;
-
,
Windows,
UNIX-;
- ( )
.
1996 Doctor Web
.

,
.
,
. :
.
.
Virus Bulletin
2002
.
VB100% - [3].
VB100% ,
, 100%
In the Wild, ,
. (In the Wild),

,
,
.
Doctor Web
Virus Bulletin,
VB100%. 2003
: Doctor Web 100%
.
4*100% ( , ) Doctor Web
2001.
10.2
2008
Virus B ulletin, Doctor Web
,
VB100%.
10.2
In the Wild
iDialode Science Doctor Web
100
100
100
100
EsetNOD32
100
100
99,94
100
Symantec Norton FntiVirus
100
100
100
99,81
CA Vet Anti-Virus
100
100
99,35
100
FRISK F- Prot
100
100
97,50
99,81
Norman Virus Control
100
100
96,49
98,65
Sophos Anti Virus
100
99,66
95,48
99,50
Trend PC-cillin
100
99,99
93,86
99,83
Virus Buster
100
100
93,33
99,81
Doctor Web ,
. ,
SpIDer Guard Doctor Web
SpIDer Netting

.

- ,
. 2000
Doctor Web
. ,
. ,

, Doctor Web
.
2004
-
, Adware/Spyware [127]*
, ,
, ,
,

,
-
.
Dr.Web
,

Adware/Spyware ,
.

Dr.Web, ,
Dr. Web

,
Doctor Web
.
10.3
[112]
.
1.
Word/Excel, . ,
(),
.
-
, (
Internet ). ,
,
Int ernet.
2. .

:
;
(
, ) ..
,
, . ,
.

.
, , ,
.
3.
,

.
,
.

(
),
.
,
(, WWW- Microsoft
, - Wazzu).
4. ,
.
, .

.
, -
BBS -
. ,
, ,
, -
.
,
-
.
,
.
,
. ,

.
5. .

( ) ( ,
, , ..)
,
, ,

.
6. ,
.
backup-. ,
, , ,

.
-
backup
.
,
, .
11
11.1 ,
, -
, . ,
,

,

- ..

. ,
,
.

,

.

. , MIME

, .
.
,

,

,
, ..
MessageLabs .
Scotsman,
,
2004 ,
. , 2003
208 , 2002 392 [107].

,
.

,
.
. , ,
(exe, com, bat) ,
OLE- (, MS Office).

.
, ,

.

.
, , ( Denial of Service)
(mail-bombs), ,
, ,

.
2004
63,5 ,
.
37, 9 , 2002 - 1,5

-
,
[107].
.

.
,
, ,
.
, ,
,
,
(, - ,
,
..).
,
:
-
( );
- ( );
- (
).
,
(,
,
, ..). , ,
,

,
.
,
.

. ,
,
, ,
, , ,
,
,
.
,
, , ,

, ,
.
30%
,
. ,

,
,
,
,
,
(, ,
..).
.
, ,
, ..
.
,
,
.
, , ,
,
.
,
. ,
, ,

,
.

-
( ,
,
(),
). ,
.
,

.
,
,
,
.
, .

, .

,
.

.
,
.

, .
,
,
,

, - .
,
(
,

..), , ,
. ,

.
,
.

, ,
, ,
,
.

, ,

, ,

..

(
).
-,

-
,
.
. ,
.

. -,
, -
,
,
.

.

-
. ,
.
, , , .
. ,
.
. ,
, ,
, ,

.
11.2
, ,
.
-

.

.

, .
, ,

.
,
, ,

,

.

, (content security software).

.
:
- ;
- :
- ;
- ;
- ( );
- ;
-
;
-
;
- .

.
:
- ( , );
- ;
- ;
- ..
11.2.1
- ,
. ,
.

. ,
,
.
.

. ,
,
- ,
, .
,
, .
, ,

.
,
, , .
, ,
.

.
:
-
,
;
-
;
- ( , ,
);
- , .. , ,

,
;
- ;
- ,
;
- ;
-
.
, ,
-
,
.
:
1. , -

.
2. ,

.
3.
.
4.

.
5. ,

.
11.2.2

,

.
.

.
.
-
,

.
:
1. .
2.
.
3.
(
, ..).
4.
.
5. .
6.

.

.

.
,
,
.

.
-
.
,
. ,
,
.
, ,
, .

,

.
:
(
).

,
,
, ,
.
,

.

,
.

.
,
.
.
(MIME -, , ..),

,

(,
).

,
(, ).
,
.
, .
, ,
.

.
() .

.
. ,

. ,
,
.

.
.
.

. :
IP-
, (
), -

(from/subject),
RFC-822 ..
.
,

.
- (cookies),
(Java, ActiveX, JavaScript, VBScript
..), ,
( Automatic Mail-to).

.
( , , ..)
( .. ).
,
: ;

; ;

.,
, ,
,
.
,
.
, ,
. ,
,
.
,
on-line

. ,

, ,
,
..
11.2.3
.
,
, ,
, . ,
, , , ,
.

. ,
,
:
- ;
- (,
);
- (MS Office, ,
..);
- ( ) ;
- .
, : ,
, IME-, ,
.
.
,
, ,
.

.
, , .
- ,

, ,
(,
), .

, ,
Open Relay Black List (ORBL).
,
,
, .
,
.

100
%
-
79,7 %.
, ,
(1,2 %
).
.
, .
,
.
,
.

,
9 .

.
,
. ,
8000 ,
. 0,5 %
- ,
.
,
, ,
,
.

.

. -, . .
, ,
.
.
.
-, . ,
, ,
(mime-type).

,
.
JPEG, picture.jpg page.txt
.
-,
,
.
,
,
, ,
,
.

.

..

, , , . ,

, -
.. ,
,
,
.
: , ,
,
, .
.
.
- (, ,
..). ,
-
, , ,
, .. ,
, .
. ,
?
-,
.
, ,

.
, ,
,
. ,
, .
,
? ,
, , ,
.
.

.

, .
, ,

.
,

( ) ,
,
,
..

.

.

.
-
,

,
,
.
, -
.

.

,

. ,

,
SQL,
.

(1251, 866 ? IS 08859-5, KOI8R, MAC), .

,
.
,
. ,
, ,
.
.
,
.
,

,
.

,
. ,
-

,
.

.
, , ,

. , ,
-

,
,
.

,
,
,

.
, ,
. -,
,
. , -,

,
.
- MAILs weeper
,

( ) MA ILsweeper
ClearS wift ().
- MAILsweeper , ,
. :
1.
.
2. , ..
( , MIME-, ,
..).
3.
.
4.
.
:
- , ..
, ,

;
- ,
, ;
-
,
.
MAILsweeper ,

.

,
.
-
, UNIX ,
Oracle. -
,
5 ,
5000. , ,
,
,
MA ILsweeper MS Windows NT Windows
2000. MAILs weeper
.
- ,

.
:
, , MIME-,
, .

.
.
,

.
-, MAILsweeper .
MAILsweeper
. , MA ILs weeper

.
. - ,
.
,
,
, .

.
MAILs weeper
( )
( ), , , , .
-
, . MAILsweeper
.
,
.
-
, Oiacle.
on-line

.
.
,
,
(P artitioning),
.
MAILsweeper
. .
. -
.

(, ,
..) MIME -. ,

.
, ,
ClearS wift
MAILs weeper , A rchivist.

:
, , , (),
-.
-
. ,

( SQL,
Oracle Report, Crystal Report).
*
(, , ..),
.
,
MS Excel.
MAILsweeper
Crystal Report.
Microsoft SQL server.

(1251, 866, IS 08859-5, KOI8-R, MAC),
, (,
) .
,
.
MAILsweeper
,
(,
) ,
MIME -.
- ,

, .
,
-.
,
,
( ,
, ,
..)
(HP Open View).
- .
, -
( ),

,
MAILsweeper
Archivist,
. , ( - )
.
, ,
,
,
. , -

S/MIME.
- , MA ILs weeper
,
, - .
-

.
-

.
.
,
N 465 14.06.2001. MAILs weeper ,

.
, , - .

.
, .
ClearS wift

( ).
.
. ,
.
.

,
, .
.

. ,
:
1. .
2. .
3. .
4. (
).
5. .

,
2001 . (-). 6.3.11.5 :

, .. .

( ).
,

,

,
,

. -,

.
,
,
,
, .
: [80]. - ,
( ). - ,
,
. - , -, ,
.. (,
).
:
- ( )
, .. ,
( ).
; /,
.
, - ,
(
) , .
- , .. ,
- ( ,
..). , ,
, .
, , -
..

.
,

. -, (
). -,
,
,
, ,
, . -,
, , ,

( ,
, , ).
[34].
, , . .
.

, , ,
. ,
,
.

, ,

.

,
.
,

, , , ,
.
12

, , ,
. , ,
,

, ,
.
,

,
.

[58]:
-

;
- , ?
;
-
, ,
.
, ,
, ,
.
,
,
. ,
,
, ,
.

,
.
,
,

, .
12.1

.
, ;
.
,

,
. , 1 [ 77]
, .
, , .

.
, .

.

, ,
.
:
-
.

, , ,

, ,
.
, ,
. , ,
,
.
,
,
.

.

[58]. ,

. ,
, ,

.
.

- . ,
, ,
,

,
.
, ,
, , ,
-
,
,
.
,

.

.

,
,
. ,
,
.
-
.
[12]

( ).

: ,

.
:
- ,
;
- , , ;
-
, :
;
-
;
- ;
- , ;
- ;
-
;
- , , , ,
, ,
;
- ;
- ,

;
-
;
-

;
-
;
-

, ,
.

.

()

.

.
, .
-. ,

,
.

,

.

,
.

, ,
, - ,
.

,
. ,
,
.
.

, -
,
.

,
.
,
,
.
,

,
,
.
,
,

.
,
- .
, ,
,
. ,
.

.
,
,
.

,
.
.
,

.
,
. , ,

,
, .

.

,
,

,
.

,
.

.
: , (,
)

.
,

,
.

, ,
.

.

. ,
,

,
.
, ,

.
:
- ;
-

;
-
,
;
- , ;
-
;
-
.

.
- .

, ,
,
.
, ,

.
, .

,

,
.

.

. :
- , , ,
,
,
,
;
- ,

;
-
;
-
,
;
-

;
- , .

, .

. ,
, :
- , ,
;
- ,
;
- ,
.
,
.
,
. , ,
, , ,
, .
,
,
( , , ),
,
.

,

.

.
(
,
, ,
, , )
,

, ,
.
, ,
, ,
,
, .

.
-

,

. ,

.

.
,

.

, . , .

,
.
: , ,

,
,
.

.
,

.

.
(,
), -.
, ,
.
,

.
,
.

.
.

.
,

,
.

.
12.1.1

.
12.1
,
[11].
12.1 ,

(-2, -2)
,
, ,

- |

,

2
3
4

( ,
Olimpus)
,

5
6
7
8

( 7215, 7202,
Comet)
(NR-900EM,
NGE-400, 23)

(90/,-1, )

(, -5, D-008)
10

(,
: -5
SELSP-18/T)

(6000, , -1, OSC-5000)
(IRIS VCF-2000,
)
(1401,-3)

(, ,
)

-4
11
12
13
14
15

,
- ,

,
, -5.
,
.

,
.

,
, .
, ,

.

, ,
-
.
, , .

.

,
.

, -5, SEL SP-18/ T [102] [124] .
,

.
-
.

,
.

, .

, . ,

,
,
.
-
.
,
.
- .

-6000
[ 121],

.

.

(,
)
.
.

,

.

,

.

, ,
,
.
.
,

.
-

, .

,
.
,
, , ,

.

,
. ,
,
, , ,
..

. ,
,

.

( ). , -5
,
, , , .
-
.

, ,
. , ,
:
,
, , .

.

.
,

,
,
,
,
.
,
,
. ,
,
.

- [125],
- -4 [124].
12.2
,

,
. :
[58]:
- , ,
;
- ,
;
- , ,

,
;
-
:

;
- ,
, , ;
- , , ,
. ,
, , ,
.

, , ,
.

.
,
, .
,
() , -
. ,
, .
.

,

.
.
,

,

- , .
12.3
,
.
,
.
, ,
(, , ),

.

[58]:
- , ;
- ,
;
-
() .
,
, ,

.
, ,
.

.
12.4
, ,
,
,
.
, ,
, ..

.
, , , ,

.
,
, [122]:
-

,

;
-
;
-

, ,
;
-
, () .

,
.
:
- ;
-
,
;
-

( , );
- , ;
- .
,
,
, .

,
.
,

.
12.4.1

.

(
, , ).
, ,
. ,
,

.

( -
), ,
, , (
).

[55]:
,
,
.
.

. .
: ,
! .
, -
.

.
,
- ,
.

. ,

.
, , ,
.

. ,
: .
,
. , ,
,
.

.
- (),
: , , ..

- .
- - .
, , ,
. ,
,
. ,
.
,
, . -

(,
)
,
. ,
.
:
, , ,
, .

. , 90%
- ,
.

- - V oice Coder 2400
[46]. .
, ,
,
: [98],
[114],
[115].
,
-
.
12.4.2

: NMT 450i, GSM, DAMPS.
,
- 450.
, 800, 900, 1800 .
NMT 4501
[57].
, , , .

.
. ,
,
, , , ,

.
,
( )

.

.

.
-

.
,
.
, GSM DAMPS
.

NMT 4501.
, ,
.
,

.
. ,

. ,
, , ,
,
.
, ,

.
, ,
,
CryptoGrapher [46], -
. ( )

GSM ,
.
12.4.3 Bluetoot h

.
, ,
.
IEEE 802.11 :
,

.
, , Bluetooth.
15 ,

Bluetooth.
[33].

Bluetooth , ,
Bluetoot h

802.11. , ,
,
Bluetooth .
Bluetooth
,

.
Bluetoot h
[82], .
[10].
Securiti mode 1 (non secure) -
bluetooth . .
Securiti mode 2 (servise level enforced security)

. ,
( )
( ).
,
.
Securiti mode 3 (link level enforced security) ,
( ).
, Bluetooth
: , .
( )
, , ,
, , .
, ,
48- - ( bluetooth device
address, BD_ADDR), , ,
, 128- .

(
, - ).
,
, ,
.

.
, .
,
.
() - , bluetooth ,
.
bluetooth- :
(trusted), (non-trusted) (unknown).
()
,
, ,

(lay er s ecurity service). ,

, - , - .
, , , .
128-
.
(decryption key)
.

, ,
.
, Bluetooth

. , ,
.
Bluetooth, , ,

, ,
bluetooth .
bluetooth-
, bluetooth-
spoofing-
( )
.
Bluet ooth (pairing) ,
.
,

.
.
,
.
, ,
(

).
.

.
-
. ,
,
. ,

, .
,
, ,
.
bluet ooth
. ,
bluet ooth, -
.
13

13.1

,
.
, , -
, ,
( ,
!).
,

,
, ,
.
,
,
, ,
,
, .
- ,
, ,
, ,
,
, .
:
,
. , ,
,
,
.
, ,
(,
).
? ,
, ,
,
, ,
..
, ,
.
.

. ,
, .
, -
, , .
.
13.2

. , ,

,
, 80%
[71].

.

[71]:
- ;
- .
(.
13.1) :
- ;
- .
. 13.1
, ,
.
, ,
, .
,
..
(, ,
) 30.

.

.
.
(. 13.2)
:
- - ();
- ();
- ();
- - ();
- ();
- - ();
- ( ) .
. 13.2

-
. (
6.30-97).

,

,
. , :
( ).
, , . 1.

,
,
.

.

.
.

:
- ;
- ;
- .
(.13.3)
.
:
- ;
- ;
- (
).
() - 2- .
.

(. 13.4), .
. 13.3
- -
-

- (- )
. 13.4
, :
- ;
- ;
- .

.

.
.

(. 13. 4).

.

.

.
:
- ;
- ;
- .

(. 13.5):
; ; ;
; .
. 13.5
2-
.
. ,
()
.

.
. 13.6.
. 13.6

(. 13.7).
(
)
(...
)
(
)
. 13.7

,
.

,
,
( )
.

.

, :
- ;
-
;
- ,
.
, ,
.
,
.
.

,
.

.
, , ,

.
4 -

,

.

,
,
,

,

, . ,

,
,
.
, :
, , [111].

.
,

. ,
.
:
! .
- :

.
,

.
-
, , ,

,
, .
-
, . ,

,
, ,

.

.

, -
.

.
, ,
, , ,
,
.
14

, , ,

, .

,
.

, (. 14.1).
. 14.1
,
(. 14. 2).
. 14.2
: , ..
,
.

, .
[ 120]: , ,
-,
.

, ,
,

.
:
1) ,
-
.
2) ,

,
.
3)
.
4)
, .
5) ,
.
6) , ,
;
.
7)
.
8) .
9) ,
,
,
.
10) ,
.
11) , , ,
.
12) .
13) .
14) , -
.
15) .
16)

.

,
[113]:
- ;
- ;
- ;
- .

:
- , , ,

.;
-
;
- ,
,
, , ;
-

;
-
;
- - .

- ,
. ,
, , ,
.
, ,

.
,
,
.
, .

- , ,

.
:
-
;
-
.
:
- ,
, , ;
- , ;
- ;
-
.
, ,

.
,
.
50 -60 %
.
,
, ,

.
- ,
.
15
15.1

,
(, ,
.. ),

, .
,
[49]. .

. .
.
.

.
,
, , , ,
,
. ,

, ,
.
. ,

.

, ..
.
, (
),
- , ,
, , ,
..).
,
,
.

.
. - ,
, .
, ,

.

. ,
,
. :
- ;
-
;
- ;
- ;
-
.
.
.
.

.
.
,
, ,
.
,
,
.
. ,
,
, , .

[37]: , ,
, -*
,
.
,
.
( - .. ),
() -
.
- ,
(Word, Excel . .).

,
.

. ,
,
,
.

. -

.
, ,
(),

,
.
- ( to
lame - ), ,

, ,
.
, ,
,
- .
,
.
, 75 %
, ,

[61].
.
[38], 75 %

. ,
53,6 % , -32,7 %
- 3,5 %

.
, , 25 % -
,
, 50 %
.
, , ,
. ,
, [88].
,
, .

.
.

Ernst & Young (
103 . 140
,
1993 .)
2003 . , 1233
, 51 .*
[123] , 70 %

.
, ,
-
, .

-
,
.
70 %

.
, Ernst &
Young
, , ,
,
, .

,
[123].
15.2

,
,
,
.
, ,
.

. ,
. ,
,
.

,
,
.
, ,
.
: ,
, , ,
.
, -
[20]. , , ,
,
. - [88]:
- , ;
-
;
-
;
- , ;
- ;
- ;
- ,
, ;
-
,
;
-
.
.
, .

.

. ,
, ,
,
, ,
.
,
:
-
-
, ;
- ;
- ;
- , e
;
-
.
:
- ;
- ( , , ),

;
- ,
: N
() .
;
-
.

,
,
.
, ,
.
,
,
- :
. , : - , - - .
,
,
. :

, ,
, .
15.3

,
.

: .
.

[23].

( : -).

: (: , , -
).
(: , ).
,
(:
?).
, :
- ,
, ( );
- ,
( ).
,
,
.
- ,
, ,
.
( , ,
, ).

: , ,
, , ,
- ,
, .
:
- - ,
- - ,
- - ,
- - .

.
. -
- ,
. -
, ,
,
,
,

, .
.
1.
(, , ),
,

.
2. ,
: ,
. -
.
3.
,
, .
4. . .
, :
- ( !);
- ( 20 % ,
);
-
( );
- ;
- ,
.
:
- : , ;
- ;
- ;
-

,

;
- (, ,
)
,
(, ), ;
-
,
,
, (
, );
-
, ,
,
.
,
,

,

.
:
- , , , , ;
- (
-
), ,
, (
);
- .

.
- , , ,
, , ,
, .. ,
.
.

.

.
.
-, , ,
.
-, ,
. ,
!
, ,

. - ,
.
,
- .
,
,
,
.
-
, , ,
,
?
[62].
-, ,
, ,
.
-,
.
-, ,
, .

, ,
,

.

,
. ,
, , ,
,
,
.
, :
, ,
, .
: , ,
-
, , ,
.
,
.

, ,
,
.. ,
.

,
,
,
.
,
.

. ,

,
,
.
15.4

.
,
- (CyberSlacking) [105].

, ,
.
,
,
,
,

- .
,

,
. , ,
, ,
, .
,
( )
. ,
?
,
,
,
, ,
.
, -,
, ,
(ISP ,
), -
.
- ,

: ,

,

,
[105]:
- ,
, ,
Web- ;
- ;
- , ;
-
.
, , -
, ,
.

, :
- , ,

;
- , ,
HTML- ,
, .
16

,
,
, , -
, , , -
, ,
.

, ,
,
, ..

Ernst & Young 2003 [44]. ,

, , ,
,

, ,
.
-
, ,
.
! , ,
-
-

, :
- ,
;
- .

,
;
-
. - .
, ,
.
,
. , ,
.
,
,
, ,
,
:

.

.

,
.
, ,
.

. . ,

,
.
16.1
,
():
1) CIS O (Chief Information Security Officer)
, ,
,
, -.
2) BISO (Business Information Security Officer) /
,

, - ,
.
Gartner Research 2001 ,
Global 2000,

.
CISO
/
( ). ,
/ ()
(CISO)
.
. CISO

. ,
, . , Gartner Research
2001, CIS O ,
.
( )

, : ,
,
, .

( Chief Privacy
Officer), .
CISO .

.
.
,

, .

[94], ,

. ,

,
. -

.
,
.
.
BISO
, ( ,
), CISO,
,

.
, CIS O
,
. CISO
,

.
,
.
CIS O, -, ,

, , . ,

. CISO
, ,
.
CIS O,
, ,

.
() ,
. CISO.

. ,
.
,
. ,
.

.

.

.
CISO.

.
Gartner Research, ,
Global 2000, :
- CISSP ( ISC)
40 % ;
- SANS 15 % ;
- (MCSE, CISA, , ) 25 %.
CISO.
, CISO :
- , ,
, ;
-
;
- , ;
-
, ;
-
;
-
;
- ,

,
,
,
;
- , , ,
;
- -

;
-
,
;
- -
, ,
.
,
CIS O.
1. CIS O .
CISO
, .
2. , , , .
: , ,
.
3. ,
.
,

.
CIS O , /
.
4. CIS O
, ,
.
5. CIS O .
16.2

.

,
. ,
,
. , ,
.
,
.
,
,
. ( ,
Zurich North America) [118].
, ,
. ,
-
,
.
, .

,
,
, .

.
, .
, , , , .

.
?
1.
.
,
, .
2. ,
- .
3. ,

, .
4. ,

.
5. ,
.
, .
?
, , .
,
.
. , ,
, ,
. ,

.
- .

Nessus, LAN Guard, XSpider (
), Snort ( ), RA T
(Router A nalysis Tool, ).

.
, .
.

, .
, , ,

.

(
, ).
. 10
,
100 .
.
,
.

.
.

. ,
,
.
- .
.

. ,
,
, .
.
. ,

,
,

.
, .
, Symantec,
Cisco Systems Check Point Software Tec hnologies,
.
.
16.2.1

,
. ,

,

,
. ,
, ~
.
,
( ),
, .
, ,
.
.
,
^ , , [65]:
- ,

(),

;
- ,
,
, ,
,
- ;
- ,
,

.

-
,
[48]:
-
, ;
- ,

;
- ,
,

,
;
- ,
,
, ,
,
( ),

.
,
, , ,
, , ,
,
.
-
,

,

.

:
-
Internet/Intranet, ,
, , IP-
,
,

;
-

;
-
, ,
.
16.2.2

, ,
?
,
( ) ,
, ,
,

.

( ) ,

.

, , ,
,
.
, , ,
,
,
( )
,
.
, [65]
,
,
,
,
.
,
- , .

.

.
,
.
, ,
, ,
, ,
.
, ,
,
.
, ,
,
.

? -
IT-,
,
,
.

, ,
.
,

,
,
,
.

- , -,
.
, , ,

.
,
.
[66] ,
-
2 ,

- ,
.

,

, , ,

.
16.3
, , ,
,
.
.
,
. ,
.
:
?
, .

[13].
1) .

(), ,
, , , ,
. ,
,
. .
2) ,

. ,
.
,
,

().
3) .
: - . , ,
. ,
, ,
.
4)
.
: .
.
,
(, , )
.
,
, .
.

, ,

.
.
,
.
, -

. ,
.

.
.
,

. ,
.

.

, ,
,
.
CISO (
). ( ,
,
)
, , .
17

,
,

. [120]:
- ,
, ,

;
-

, ;
- , ,
,
.

[113]:
- ;
- ;
- ;
-
.
17.1

, 9
2000 . N -1895,
,

( 5. 4 27 2001 .),
.
, 10 -12 2003.
,
.
, , , 2005
,
.
.
,
,
.

( )

.
(
),

.
,
[15]:
) ,
;
.;
)

;
)
;
) .

;
)

,
;
)
;
)

.

[9],

- . :
1.

.
2.
,
.
3.

.
4.
,
, ,
.
5. ,
.
6. -
,
.
,

. ,
,

,
,

.

[15].
, , ,

,

.

.
,

, (2002-2003
.) ,

, :
,
,
,
, -
,
(. 3).
,

, ,

, .

:
-

, , (
,
,
..);
-
, -
,
;
- , ,
;
- , , ,

, ,
,
;
-
, ,

,

,
;
-
,

,

, , .

, ,
.
,
,
, .
,

.
17.2

,

,
.

.
, .
,

(75 -80% ),
20%
[63].
, , ,
, ,

,
,

.
, , .
,

, , .

, , -
,
. ,
,
.
, IP -,

,
.
,

,

, . 3 . 138
, ,
,

,

,
,
, ,
,

.
, , . 138 ,
, ,
, ,
:
,
,
,
,
.
,
,
,

, ,
,

, .
138 , , ,
. ,
, ,
.
, . ,
, ,
, (. 2 . 23),
. ,
,

.
. 23 ,
,
, ,
, , ,
.
.
. 24 , , ,
.
, ,
,

, .
, ..
,
. ,
. 8 - , . 11
, ,
. -
5 1995 . ,
-
:
1) , ,
;
2) , , ,
;
3) , , ,
.

:
1) ;
2) , ,
;
3) ,
,
, .
, -
, :
- 24 , - 48 .
. 2 . 138

, .
. 3 . 138 , .
,
,
.

, ,
. 1 2 . 138 .
(,

. 1 3 . 138 .
, :
137
,
,
,
,

,

,

,
,
,
.
,
,
,
,
,

,
.
. 23 ,
,
.
. 17 ,
.
,
,

, - .

24 1993 . N 13
, 23 25
, ,
23 ,
, , ,

.
. 63 7 2003 . N 126- ,
,
, ,
,
. ,
,
,
, ,
.
, ,
, ,
, .
. 9 ,
, , ,
.

.
,
, . 9
,
,

.

( ) , , ,
, ,
, ,
,
,
,
,

.

,
, , ,
,
.
,
:
,
. :
,
( , ..)? -
!
, .
:
. ,
,
,
,
.
-
, , ,
,
, ,
, , ,
.

, .

.
: ,
, ,
?
,

.
, ,
,
,
.
,
,

,
, , ,
.
17.3
[99],
50 % .
;
. MessageLabs, 2002
, , , 199.
, ,
:
. , ,
: ,
, ,
.
:
MessageLabs, 10%
. ,
, ,
.
? 1.1
[117], -

(
SMS, IRC ..),
. , ,
,
.

-
. ,
( Web-, .. ), ,
- ,

, ,
, .

-
( ) .

-
.

.
[64]:
- , () ,
;
- ( )
( )
, ;
,
; ) ,

(chain letter); () ,
,
() ;
- ,
,
;
- ( ,
, Web- ..)
,
, ;
-
, :

;
;
, ,

( ,
, ,

;
).

,
, .

,

[108].
: ,
.
. 4
, :
- , , ,
, ,
;
- , ,
-
;
- , ,

, , ,
;
- , ,
, , ,
, .
. 5 ,
, :
- , , , ,
,

;
- ,
, ,
;
- ,
, ;
-
;
-
,
, ,
;
- , , ;
- , ;
-
, ,
, ;
- ,
,
;
-
;
- ,
;
- , .

, ,
3 15 ,
(
) .
, , , ,
.
?

,
,
,

. . 3 . 13
,

.
, ,

.
,
. 1 . 1064
. , ,
, ,
( . 150 ), ,
. ,
, ..
,
( . 151, 1099 ). ,

, (
).

, ,
, - , ,
. ,
,
-

, , ,
.
,
( ,
, ,
, ),

,
,
, .
, ,

. ,
; -
.
,
,

: , -
..
,
, , .
,
,
subject.

.

,
.
, ,
.
- . :
-,
, ,
, ,
? :
, ,
, ,
. 2 . 23 :
, , ,
.
., . 1. . 24
:
,
,

, . 4, . 29 :
, , ,
.
:
-
;
-
.

:

, ,
, , ,
. 138
. 32 .
,
,

. ,
, ,

.
, , ,
.
, , , ,
,
, , ,
. ,
, ,

.
, ,
, ,
.. , ,
, ,

,
.
, ,
, ()
, ,
,
( . 138, ),
( . 137 )?
. 137
, , ,
(
- ).
, ,
,
, , ,
. . , ,
-

, .
, -
,
, ,
, ,
, .
,
: , , , , .
-
, Internet.

, ,
,
Internet- ,
.

,
,
,
,
.
, .
, ,

, , ,
,
, ,
- .

- ,
- .

, ,
.
,
, ,
. ,
, ,
.
. -
- .
, -
.
Acce ss () -
,
,
Acce ss control ( , )
, .
:
- ,
;
- , ,
;
- ,
.
Acce ss control mechanism ( ) , ,

,
.
Acce ss level ( ) -
.

.
Acce ss type ( ) - , , .. ( read, write,
execute, append, modify, delete).
Accountability () - , (. subject)

.
Acti ve threat ( ) - .
Archi ve ( ) -
.
, .

, .

, (retrieve).
Asset () - ,
.
.

:
- ( );
- ( , ,
);
- ( , , ,
);
- (
, ,
..).
Assurance () - .
Attack () -
.
.
Auditing () - -
, .
:
- ,
;
- ;
- .
Audit trail ( ) -
, ,
,
,
.
Authenti cate (, ) ,
,
.

.
Authorization () -
, .
Automated information system (AIS) - (
, )
, , ,
, , /
.
Automated information system security ( ) -
, APIS ( ) , .
Availability of data ( ) -
, , ;
, , ,
.
B
Baseline Security ( ) , Baseline Sec urity
Survey.
.
Bella-LaPadula model ( -) - ,
.
.
,
(
),
.
,

( ).
, ,
(
)
- .
Boot-sector virus ( ) - ,

.
Buffer () -
.

- .

Clearance ( ) -
,
- .
(, ) .
Computer virus ( ) - , (
), . ,
.

,
.
Confidentiality () - ,
( ).
Contingency plan (backup plan, recovery plan) ( , ) - ,

,

.
Cookie () - , - . -
.
, , , ,
, .
cookie, Internet Explorer 6.0
cookie,
.
Covert channel ( ) - , ,
.
Covert storage channel ( ) -
,

.
(,
),
.
Covert timing channel ( ) -
,
(,
) ,

Cryptography () - ,
,
, .
D
Data archiving ( ) -
.
Data holding ( ) - , .
:
1) , ;
2) ,
,
;
3) , ,
.
Data Integrity ( ) - ,
.
Data management ( ) - , , , , ,
.
Data security ( ) -
( ) ,
.
Data striping ( ) -
,
.
-

,
.
Denial of service ( ) -
,
,
. ,
..
Di sk duplexing ( ) - ,
,
.
.
.
Di sk duplicating . Disk duplexing.
Di sk mirroring . Disk duplexing.
Di sk striping ( ) -
, 64
,
.
.
Di scretionary acce ss control (DAC) ( ) -
. ,
, / , .
,

(
).
Domain () - (, ) ,
, .
.
Dongle ( ) -
,
.
, ..
End-to-end encryption (, ) - , ,
.
Evaluated Products Li st EPL ( ) - ,
,
, Trusted Computer.
F
File infector ( ) - , ,
. -,
, , - .
Firewall ( ) -

.
Formal security policy model (
) -
.
, ,
.
( ),
:
- ;
- , ,
,
.
.
H
Hacker () - , :
-
;
-
;
- ..

.
Hierarchical Storage Management, HSM (
) - .

( -
-
),
, (
).
Hot reservation ( ) -

.
I
Identification () -
, , ( ).
Incremental backup storage ( ) - ,
,

.
Information flow control (
) - ,
,
(
- , .
).
,
,
( ).
Information security ( ) - :
1) -
;
2) -
;
3) -
.
Information Security Management System ( ) - , .
Integrity () - . data integrity system integrity.
Intruder () - ,

.
,
, .
L
Least privilege ( ) - , ,

,
. ,

.
Link encryption ( ) - , ;
(
).
Lloyd's Electronic & Computer Crime Policy (

) -

.
.
Logic bomb ( ) - ,

, .
M
Mandatory access control (MAC -
) - ,
( ),

.
Masquerading () - , ,

, .
Migrate/Demigrate (/) - HSM
. ,
, .
Misinformation () - - -
,
- .
Multilevel security ( ) -
, -
,
,
.
N
National Computer Security Center (NCS C,
, ) - ,

.

.
-
(DoD
Computer Security Center).
Need-to-knew ( ) - ,

.
Network security ( ) - , :
- ;
- ;
- .
, , .
Object () - , ,
.
.
: , , , , ,
, , , ,
; (, ,
..); ( ,
..).
Object reuse ( )
(, , , , ),
&.

.
P
Passive threat ( ) -

.
Peer-to-peer , , ,
,

Penetration () - .
Personnel securi ty ( ) - , , , ,

.
Physical security ( ) -
,
(, ,
, , ..)
.
Platform for privacy preferences initiative ( ) -

- .
,
.
Plug-and-Play ( ) -

, BIOS
.
, -,
,
.
Preferred Products Li st (PPL,
) - (
), TEMPES T
-
( ) . PPL Information System
Security Products and S ervices Catalogue, .
Process () - . .
domain subject.
Protocol s () - , ,
(, ).
R
Recovery procedures ( ) , ,
.
Reference monitor concept ( ) , ,
.
.
Reserved copy ( ) - () . ,
.
.
Ri sk analysi s ( ) -
,
,
.
Ri sk a sse ssment ( ) - ,

.
Ri sk Management ( ) - .
S
Save ( ) -
.
, .

, .

, (retrieve).
Secure Sockets Layer, SSL ( ) , ,
. SSL

.
Secure state ( ) - ,

.
Security administrator ( ) - ,
,
.
Security architecture ( ) - ISO OS I,
.
:
- ;
- ;
- ;
- .
:
- ,
;
- ,
.
Security flaw ( ) -
,
,
.
Security kernel ( ) - (),
.
,
.
Security level ( ) - ( )
, .
Security policy ( ) - -
,
, .
Security policy model ( ) , .
,
.
Security Ri sk ( ) - .
Security system ( ) - :
, , ,
..
Sensitive information ( ) -
, , ,

, ,
,

.
- , ,
,
,
(
)
( ) .
Subject () - ,
, ,

.
- .
System integrity ( ) - ,
,
,
.
System Evaluation Criteria, TCSEC ( ) - , ()
, :
-
;
- ,
.
TEMP EST - ,
.
Threat ( ) - - . -
- ,
.
Trojan horse ( ) - ,

,
.
Trusted Computing Base, ( , ) - ,
,

. ,

.

,
.
Trusted path ( ) - ,

().
,
,

.
Trusted software ( ) , ().
U
USB (Universal Serial Bus) -
.
.
V
Verification () -
(,
,
, )
.
.
Vulnerability () -
, ,
, , ,
. :
- ;
- ,

.
W
Worm () - , .
,
.
WWW, World Wide Web, -
,
.
X
XML (extensible Markup Language) -
.
.
(security) ,
, -
, ,
. ,
,
, - .
(end-to-end
encryption) - ,
, .
,
(automated information system) (AIS) -

, , ,
, , /
.
(authorization) -
, .
-
,
. ,
-
,
. , ,

.
(Security administrator) ,
,
.
- ,
.
( Active threat) - .
(ri sk analysi s) -
,
,
.
- - ,

.
(Data archiving) -
.
(Archive Save) - .
,
.
,
.
,
(retrieve).
(Security architecture) - ISO OS I,
.
:
- ;
- ;
- ;
- .
:
- ,
;
- ,
.
(attack ) -
.
.
(auditing) - -
, .
:
- ,
;
- ;
- .
, (authenticate) ,
9
.

.
-

(Baseline) - , . ,
,
.
,

.
( Baseline Security) - , Bas eline Security Survey.
.
(secure state) - .,

.
(automated information system securi ty) -
, APIS
(
) ,
.
(data security) -
( ) ,
.
- - () ,

() ( ).
(network security) - , :
- ;
- ;
- .
, , .
(reliability) - , ,
; ,
;
.
- (busine ss integrity) - , . - , - , ,
, , ,
.
(firewall) - ( ) ,
,

.
,
, .
(sec urity flaw) -
,
,
.
(Buffer) -
,

- .
- ,
(World Wide Web, WWW)
, .
- - ,
-. -
HTML- -
. Microsoft Internet Explorer, Netscape Navigator, Opera.
- - HTML-, .
- -
,
- . -
, .
(verification) -
(,
,
, )
.
.
(attachment) - .
,
.. ,
.
(recovery procedure s) , ,
.
(WWW, World Wide Web) -
,
.
(assurance) -

.
- ,
.
.
(Hot re servation) -

.
(misinformation) - - -
,
() - .
-
,
.
(Trusted
Computing Ba se, TCB) -
,
,

. ,

.

,
.
-
.
.
(trusted path) - ,

().
,
,

.
(trusted software) , ().
(acce ss) -
,
.
(availability of data) -
, , ,
, , ,
.
- ,
.
3
(boot-sector virus) - ,

.
- , ( )
( ,
, , ,
,
).
- ,

.

.
- , , , ,

.
- ,

,
.
- -
,
.

,
, .
,

.
-
, .
:
- ( )
- ( ).

(Trustworthy
Computing) , :
, ;
, - .
(Di sk mirroring; Di sk
duplexing; Disk duplicating) -
,
.
.
.
(intruder) - ,

.
,
, .
(identification) -
, , ( ).
( di scretionary acce ss
control DAC) - .
,
, () , .
,

(
).
() - ,
, ( ,
TCP/IP) 50 . (WAN, WWW).
( ) - , ,
.
1 ,
.
- , , , , , .
- : , .
.

. -

.
- ,

.
- , ,
( ,
, , ,
).
() - ,
, .

(Public
Key
Infrastructure, PKI) -
,
.
-, (Chief Information Officer, CIO) -
,
.
(link encryption) - -
, ;
(
).
- , (,
).
- , , , ,
.
- , , :
- ;
- ,
;
- ,
.
-
.
(computer virus) - , (
), . ,
.

,
.
- , .
-
:
- ;
-
;
- , .
, (acce ss control)
, .
:
- ,
;
- , ,
;
- ,
.
(confidential information) ,

.
,
.
(confidentiality) - ,
( ).
(privacy) - ,
, ,
,
(Fair Information Principles).

- .
(reference monitor concept) , ,
.
.
(Incremental backup storage) - ,
,

.
(cryptography) - ,
, , .
(sensi tive information) -
, , ,

, ,
,

.
- , ,
,
,
( ) ( ) .
- ,
.
.
(personnel security) - , , , ,

.
(logic bomb) - ,

, .
(masquerading) - , ,

, .
-

-
.
(firewall) -

.
(access control mechanism) , ,
,
,
.
/ (Migrate/Demigrate) - HSM
. ,
, .
(least privilege) - , ,

,
. ,

.
(multilevel security) -
,
,
,
.
- (Bella-LaPadula model) - ,
. .
,
(
),
.
,
( ). , ,
( ) - .
( security policy model) , .
,
.
- -
.
- ,
.
- ,
.
- , ( , , ).
,
(National Computer Security Center NCS C) - ,

.

. -
(DoD
Computer Security Center).
(illegal interference) -

, , ,
-

.
(illegal access) - , , ,
:
- ;
-
;
-
.
(domain) - (; ) ,
, .
.
- ,
, , , , , , ,
,
,
,

.
(object) - , ,
.
.
: , , , , ,
, , , ,
; (, ,
..); ( ,
..).
-
, ,
,

(, , ),
, ,
.
(end-to-end encryption) . .
[] - ,
.
- , ,
.

.
(system Evaluation Criteria (TCSEC) , ()
, :
-
;
- ,
.
(denial of service) -
,
,
. ,
..
-
.
(Ri sk Asse ssment) - ,

.
- ,
.
(Pa ssive threat) -

.
- .
(cookie) - , - . -
.
, , , ,
, .
cookie, Internet Explorer 6.0
cookie,
.

, (contingency plan (backup plan,
recovery plan) - ,

, .
-
,
.
(object reuse) - (, , , , ),
.

.
(Plug-and-Play) -
.
, B IOS
.
, ,
,
.
(accountability) - , (. subject)

.
( Lloyd's Electronic &
Computer Crime Policy) -

.
,
(security policy) - ,
,
, .
(Security policy) ,
,
.
(mandatory acce ss
control MAC) - ,
( ),

.
(Full) - ,
( , ).
:
- ;
- ;
- , .
- -,
.

-,
.
- ,
.
- ,
- , , ,
. .
() - ,
, ,
.
() - , ,
.

(Platform for pri vacy preference s initiative, P3P) - .
, .
- ,
( )
,
.
() - ,
.
-
,

().
.
, .
- ,
.
(penetration) - .
(protocol s) - , ,
(, ).
(proce ss) - . . -
domain subject.
(Data striping) -
,
.
-

,
.
(Re served copy) - () . ,
.
.
(Asset) - ,
.
.

:
- ( );
- ( , ,
);
- ( , , ,
);
- (
, ,
..).
(Security
Risk) - .
-
,
.

1) ,
().
, ,

.
2) ,
, .
- ,
.
. .
- (, )
.
- , , , ,
.
(Security system) - :
, , ,
..
-
,
,
.

(Information Security Management System) - ,

,
(audit trail) -
, ,
,
,
.
(covert timing channel) -
,
(,
) ,

.
(covert channel) - , ,
.
(covert storage channel) - ,

.
( ,
),
.
(Secure Sockets Layer, SSL) , ,
. SSL

.
- ,
.
- - . - ,
.
(Total Cost of Ownership,
TCO) -

.
,

.
(evaluated Products Li st
EPL) - , ,
, Trusted Computer.
(Preferred Products
List PPL) - (
), TEMPES T

( ) . PPL Information System
Security Products and S ervices Catalogue, .
- :
- , ,
, ,
;
- ;
- .
- , ,
,
.
(Hierarchical
Storage Management, HSM) - .

( -
-
),
, (
).
( ) - ,
, , .
(subject) - ,
, ,

.
- .
, , . .,
.
- ,
.
(acce ss type) - , , .. ( read, write,
execute, append, modify, delete).
(token) - -,
.
USB-
( - .).
(Trojan horse) - ,

,
.
(threat) - - . -
- ,
.
- , ,
,
, , .
- ,
, .

, ,
.
- , .
- , .
:
- ;
- ;
- ;
- ;
- .
(Data management) - , , , , ,
.
(Acce ss control) . .
(Information flow
control ) - ,
,
(
- , .
).
,
,
( ).
(Ri sk Management) - .
(Security level) - ( )
, .
(Acce ss level) -
.

.
(Clearance) -
,
- .
(, )
.
(Vulnerability) -
, ,
, , ,
. :
- ;
- ,

.
(File infector) - ,
,
. -,
, , - .
, , ,
, , ,
.
(Physical iecurity) -
,
(, ,
, , ..)
.
- ,
.
( Formal
security policy model) -
.
, ,
.
( ),
:
- ;
- , ,
,
.
.
(Interoperability) -
.
X
(Hacker) - , :
-
;
-
;
- ..

.
(Data holding) - -
, .
:
- , ;
- ,
,
;
- , , .
(Data Integrity) - ,
.
(Integrity) - . .
- ,
,
. ,
, ,
,
.
- ,
, . ,
MS-DOS
-
.
(worm) - ,
.
,
.
(Sensitive information) , ,

( ) .
- , . ,
,
. ,
, ,
.
- , .
(Dongle) -
,
.
, ..
(Security kernel) - ( ),
.
,
.
2

1. 29.12.1994 N 77- (.
23.12. 2003)
( 23.11.1994).
2. 29.07. 2004 N 98 -
( 09.07.2004).
3. 07.07.2003 N 126 - ( .
23.12. 2003) ( 18.06.2003).
4. 10.01.2002 N 1-
(
13.12. 2001).
5. 04.07.1996 N 85- (.
29.06. 2004)

( 05.06.1996).
6. 12.08.1995 N 144- (.
29.06. 2004) -
( 05.07.1995).
7. 18.07.1995 N 108- (.
20.08. 2004) ( 14.06.1995).
8. 20.02.1995 N 24- (.
10.01. 2003) ,
( 25.01.1995).
9. 21.07.1993 N 5485-1 (. 29.06.2004)
.
10. 09. 07.1993 N 5351 -1 (. 20. 07.2004)
.
11. 23.09. 1992 N 3523-1 (. 24.12.2002) '
.
12. 27.12.1991 N 2124-1 (. 29.06.2004)
.
13. 17.12.1997 N 1300 (.
10.01. 2000)
.
14. 06.03.1997 N 188
.
15. 30.11.1995 N 1203 (.
29.05. 2002)

,
.
16. 22. 11.1991 N 1920 -1
.
17. 30.04.2002 N 290
(. 06.02.2003)
.
18. 26.06.1995 N 608
(. 29.03.1999)
.
19. 05.12.1991 N
35 (. 03.10.2002) ,
.
20.

( . 09.09.2000 N
-1895).
21.

( 5.4 27 2001 .).
22. 28147-89. .
. .
23. 34.10-94. . .

.
24. 50600-93.
. . .
25. 50922-96 .
.
26.
/
15408-1-2002.
. .
.
1. .
27.
/
15408-2-2002.
. .
.
2. .
28.
/
15408-3-2002.
. .
.
3. .
3
.
.
.
.
.
.
- .
.
.
.
.
.
.
.
.
.

.
.
TCP .
BISO Business Information Security Officer (/
,

, - ,
).
CIO Chief Information Officer (
/).
CISA Chief Information S ecurity Administrator (

).
CIS O Chief Information S ecurity Officer (
, ,
,
, -).
Chief P rivacy Officer ( :
).
CSI Computer Security Institute (
).
CSIRT Comput er Security Incident Respons e Team (
).
DDoS Distributed Denial of Service (
).
DoS Denial of Service ( ).
IASC Information Assurance and Certification Services
(, ).
IDS Intrusion Detection Systems ( ).
ITSEC Information Technology Security E valuation and
Certification Scheme ( , ).
VPN Virtual Private Network ( ).

1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
.. ,
http://www.infoforum.ru/, 2004.
..
, http://www.bezpeka.com/.
., - , http://www.infoforum.ru/, 2003.
. ,
http://www.globaltrust.ru/security, 2002.
. : ?
http://www.cio-world.ru/bsolutions, 2004.
. . , http:// www.cioworld.ru/, 2004.
.., .. , ,
http://www.zahist.narod.ru/.
.., .
. - .: , 2003.
. ,
http://www.crime-research.ru/, 2003.
A BLUE TOOTH + LINUX,
// . 2004. - 10(23).
.., . ?
, ! http://www.nelk.ru/, 2000.
.., .. ?
, http://www.nelk.ru/, 2000.
. , http:// crimeresearch.ru/, 2003.
, ,
http://www.infoforum.ru/detail, 2004.
..

, http://www.infoforum.ru/, 2004.
., .
, http://www.itsecurity.ru/.

//-. - 2003* - 06.
. :
,- .: -
, 2003. - 239 .
19. . , http://
www.infobez.ru/article, 2004.
20. .. : . .: - .-. -, 2000.
21.
, http://www.fcenter.ru/forprint, 2004.
22. . ISO
17799 ,
23. .. . !
. - : - -, 2000.
24. : // . - 2002. - 34 (352).
25. , http://
www.lib.csu.ru/dl/bases, 2003.
26. . -Firewalls, http://
www.jurilight.ru/, 2000.
27. . , http://ekorinfo.ru, 2004.
28. B.C.
, http://
www.informost.ru/.
29. . ., . . . .: , 2000.
30.
, http://www.secure.com.ru/modules, 2004.
31. .
? http://www.isaca.ru/.
32. , .} ,

//
. - 2004,- 3.
33. . Bluetooth
, http://hitech.compulenta.ru/,
2003.
34. , http://www.security.strongdisk.ru/.
35.
, http://www. viacom.ru/, 2001.
36. : ,
37. ., .
38.
39.
40.
41.
42.
43.
44.
45.
46.
47.
48.
49.
50.
51.
52.
53.
54.
55.
56.
: , http://it2b.ru, 2002.
., . // . , 2003. - 3.
. eTrust// . 2003. 07-08.
.. , http:/
/www.infosecurity.ru/, 2004.
..
,
.. : , , . .,
. , 2001.
. :
// . 2002. - 07-08.
. // -. 2003.
- 10.
..
. :
//. Intelligent Enterprise ( ). 2002. - 9 (50).
.. . -2- ., . .
.: -, 2003.
.. // ^ .
2002. - 2.
..
, ,
http://www. fact.ru/.
..
,
http://www.bezpeka.com/.
.
, http://www. dsec.ru/.
, http://www.dit.bz/.
..
, http://www.sec4all.net/.
. , http://www.cio-world.ru/offline,
2003.
-
. David Ludlow.
: . , http://www.dega.ru/.
57. , http://
www.premier.tomsk.ru/, 2003.
58. .
,
http://www.in4business.ru/, 2003.
59. .
, http://zeus.sai.msu.ru:7000/security, 2000.
60. .
, http://zeus.sai.msu.ru:7000/security, 2003.
61. .., ..
,
62. , :
?// . 2001. - 3.
63. ..

, http://
www.infoforum.ru/detail, 2004.
64. ..
// .- 2003. - 07-08.
65. 3JB. ,
// . - 2003. - 3.
66. .
, http://cnews.ru/, 2003.
67. IDS, http://www.globaltrust.ru/.
68. - -1.95
-2000, http://www.mascom.ru/.
69. - , http:// www.nz.spb.ru/.
70. , http://
doc.marsu.ru/.
71. .
, http://www.informost.ru/, 2001.
72. , http://www.ekey.rii/
73. .
, http://
www.infoforum.ru/, 2004.
74. .
: , http:// www.itprotect.ru/, 2001.
75. Dragon,
www.ecoprog.ru/.
76. , http://
www.ekey.ru/.
77. , http://www.pps.ru/.
78. :
, http://www.inforra.ru/, 2001.
79. Cisco
Secure Intrusion Detection System, http://www.incom.ua/.
80. , http://
www.bre.ru/.
81. .. ,
, http://
www.infoforum.ru/detail, 2004.
82. . bluetooth: , ,
- bluetoot h, http:// zoom.cnews.ru/.
83. ISO 17799 http://www.softlab.ru, 2001.
84. . ,
http://econom.nsu.ru/.
85. . :
- ! http://www.rnivc.kis.ru/.
86. , .
no4Tbi//Jet Info,- 2003. - 6.
87. . : ,
http://www.pl -coniputers.ru/article, 2003.
88. . . . . .: -, 2001.
89. . ,
http://www.connect.ru/.
90. .. ,- .:
, 2003.- 639 .
91. Cisco Systems, http://www.dit.bz/.
92. Dr. Web Enterprise Suite, http://www.lotta.udm.ru/ drweb.
93. F-Secure Internet Gatek eepeK 6.40, http://
www.lavt eam.com/modules, 2004.
94. Nokia IP 330, http://www.bbs-koi.uni.ru/dist.htm.
95. Nokia IP 330, http://www.qsoft.kulichki.com, 2004.
96. Symantec Enterprise Firewall 7.0 http://www.softline.uz/
product.asp.
97. http://www.agnitum. ru/
98. http://www.ancud.ru/
99. http://www.antispam.ru/
100. http://www.apl.ru/
101. http://www.bezpeka.com/
102. http://www.bnti.ru/
103. http://www.bsi-global.com/
104. http://www.dist-cons.ru/
105. http://www.emd.ru/
106. http://www. findme.ru/
107. http://www.goldfaq.ru/modules/news =138, 2004
108. http://www.ifap. ru/
109. http://www.infos ec.ru/
110. http://www.infos ecurity.ru/
111. http://wwwit2b.ru/it2b3.html
112. http://www.kaspersky.ru/
113. http://www.kunegin.narod.ru/ref3.htm
114. http://www.masrom.ru/
115. http://www.nelk.ru/
116. http://nextaz.com/
117. http://www.ofisp.org/
118. http://www.osp. ru/
119. http://www.processcertify.ey.com/
120. http:// www.reg.t72.ru/
121. http://www.secnews.ru/
122. http://www.security.com.ua/
123. http://www.seeuritylab. ru/48191.html, 2004
124. http://www.sezon.iwarp.com/
125. http://www.shop.sec.ru/
126. http://www.softline.uz/
127. http://www.softodrom.rU/article/3/763_l.shtml, 2004
128. http://www.software.kz/
129. http://www.standard.md/
130. http://www. viacomp.ru/
..
..
..
60x84 1/16

. . . 26,04
300 .
99 1.04.2005
309530,
. , .,
- , . 40.
. (0725) 32-25-29
. 8-0014 07.08.2000 .

" ".
309530, . , .,
- , . 40.
. (0725) 32-25-29

Игнатьев В.А. - Информационная безопасность современного коммерческого предприятия

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Игнатьев В.А. - Информационная безопасность современного коммерческого предприятия

Uploaded by

Copyright:

Available Formats

004.05 67.

SANS/GIAC Site Certific ation, SA NS,

-Information security managment: an int roduction.

IS O 17799 (BS 7799)

BS 7799 (ISO 17799)

ISO 15408: Common Criteria for Information Technology

6.1.5 COBIT 3 Edition

GIAC Site Certification

Remote Port Securiti Device (P RSD),

, , ITSEC (Information Technology

Assurance and Certification Services ),

http://www Symantec com/

Internet Security and

Nokia IP Network Security, 1 330 ,

(bandwidth manager) [52].

Cisco IDS 4210

Cisco IDS 4210,

Ethernet, Fast Ethernet, FDDI, TokenRing Gigabit Ethernet,

Sec ret Net,

S ophos, Computer Associates, FSecure.

Windows, Linux, Solaris ,

McAfee Activ e Vi- Windows Microsoft Exchange,

Windows, Novell, NetWare,

Windows, Linux, Solaris ,

Windows, Novell, NetWare,

Windows, Linux, Solaris, HP

Dr. Web Dr. Web Novell NetWare,

Virus Wall for Small and Medium Business ,

Kaspersky Security Corporate Suite - ,

Kaspersky SMTP-Gateway Linux/Unix.

. (In the Wild),

iDialode Science Doctor Web

Symantec Norton FntiVirus

Norman Virus Control

Sophos Anti Virus

(lay er s ecurity service). ,

(Word, Excel . .).

Ernst & Young 2003 [44]. ,

(Router A nalysis Tool, ).

(automated information system) (AIS) -

(Fair Information Principles).

(National Computer Security Center NCS C) - ,

You might also like