传统网络安全防御面临的新威胁:APT攻击

高级持续威胁(APT)攻击不断被发现,传统网络安全防御体系很难防范此类攻击,由此给国家、社会、企业、组织及个人造成了重大损失和影响。对近几年典型APT攻击事件和攻击代码进行了研究,分析了攻击的产生背景、技术特点和一般流程。彻底防御APT攻击被认为是不可能的,重视组织面临的攻击风险评估,建立新的安全防御体系,重点保护关键数据成为共识。为此,提出了建立一种新的安全防御体系,即安全设备的联动、安全信息的共享、安全技术的协作,并给出了基于社会属性、应用属性、网络属性、终端属性及文件属性的多源态势感知模型,以及安全信息共享和安全协作的途径。

The New Threat to Traditional Network Security Defense: APT Attack

Advanced Persistent Threat （APT） attacks are continually to be discovered, unfortunately traditional network security defense system can hardly prevent these attacks. So the APT attacks have caused significant damage and impact to the country, society, enterprises, organizations and individuals. Studying the typical APT attacks in recent years and analyzing the background, technical features and attack process confirmed that it is considered impossible to defense APT thoroughly. It has become a consensus to pay attention to the risk assessment, establish a new security defense system and focus on the protecting the critical information assets. So a situational awareness model based on multi-source data is proposed considering social property, application property, network property, terminal property and file property. Meanwhile, cases of secure information sharing and security collaboration are introduced.