PowerPoint ... ..
3

Compliance

Infrastructure


: :
: ( )
:
: :
Compliance
5
+
/ [ 9]
Unix, Windows, Network , DBMS, WEB/WAS, , , PC
313

,


IT
, CISO CEO
4.
11.2.10

7.3.12


A.12.6.1


- , , ,
- , - , ,

1 1
1 .
- - (, ) - (, , ) - () - ( ) - - (, )
‘
.
- 3 100

7

500
How Much? Man/Months (50EA:Max.)
1M/M : 10,000,000 : 100,000,000
….. 500EA
8

How Often? 1~2 / 1 or
How Much? Man/Months (50EA:Max.) ->
What Method? Script
What Target? Sampling




, !!!
7.
9

( )

( )
ROI
FFIEC, HIPPA
11
1. -
12

Q. ?


()
:

.


, .
, . ex) abc1234!@# -> ex) abc12345 ->
2.
13
1 2 3 4 5
!! .


25 D
92 A+
87 A
83 A
96 A+
OK OK
OK OK
OK OK




2. -
14
1
2
15

?
?



Q. ?
16


SID

.
.
.
3
All or Nothing.
100 – 1 = 0
.

19


1,000 , 100 /1MM
21
100%
()



22
Sybase
Weblogic
:


4.
with Agent
• Resource Free
• SSH, Winexec
Agent Zero, Agent , ACL ( ) ,
4-free
Internet
PC
Network
SolidStep

6. – Gmail like UI
SolidStep .
25
3 * / *
-) , , -) // -)


192.10.10.1_Unix
26
3 DB ERP ? DB ??
IT
192.10.10.1_Unix
6. -
IP . SolidStep () / .
ERP DB

UI ‘’ , / .
27
6. –
ID
1
3

4 , UI ,
SolidStep 2.5 . .
28
Cycle SolidStep
P

, ,






( )
,
WISWIG



6. –
, .
‘’ (1) 100% (2) .
30 30



7.
31
1
program ,


SS-Standard Quad Core
SS-Premium Xeon Quad
Core 3.5Ghz 32GB
HW appliance
8.




• ,




,
(), ZERO

1.
SolidStep IT , ,
.
/ KT, LG U+, , , LG, CJ,
LIG, KB, , KG,

50,000 , 200,000 . ( : )


9,000 1
SolidStep .
PC AD - MAP
9,000 ,
Windows Server
Unix Server
PC
99% 99% 99%
100%
LG U+ 10
SolidStep .


12 6,000 ,
100%


SolidStep .
37


1,600 ,

: ,
A.P.T

. , .
38
Appendix
40
UID



(C2 Level)




root
root umask
PATH
UMASK
sulog, last
Update


r
NFS
NFS
SMTP
SNMP
FTP Anonymous

(scheduling)
root cron
root cron
1. : 2/5 (OS : Windows)
41
,




SAM





Telnet



Everyone

( )
Autologon

SID/

NetBIOS
1. : 3/5 (DBMS)
42


OS
PL/SQL Package
Alert Log
Trace Log
$TNS_ADMIN
IP


DBA Fixed server role SA null Guest Public update With grant option xp_cmdshell procedure Startup stored procedure Registry extended stored procedure
DB SQL Mail HOT FIX
My-SQL

root null root mysql.user grant_priv Initialization (my.cnf) mysql.server $datadir Update
1. : 4/5 (WEB/WAS)
43
IIS
FTP SMTP NNTP ISAPI DLL Sample WebDAV DB (.asa ) Update
Jeus


JEUS
JEUS /




Apache
Apache root / FollowSymLinks MultiViews Manual HTTP Method CGI Apache Apache Apache Apache
Tomcat


Tomcat
Tomcat /
Examples

1. : 5/5 (Network)
44
VTY (ACL)
Session Timeout
SNMP
Spoofing

Cisco

SNMP ACL


VTY (ACL)
Session Timeout
SNMP
SNMP ACL

HP(3Com)

SNMP ACL


Tel. 02) 6124-6694~5