以SNMP為基礎之資訊安全品質保證管理架構

An Information Assurance Management Framework using SNMP

柯光隆(Kuang-Lung Ko)

指導教授 ： 田筱榮 ； 黃世昆

中原大學/工學院/資訊工程研究所/碩士(2002年)

https://doi.org/10.6840/cycu200200337

摘要

隨著電腦網路連結的大幅增加，一個組織擁有上百台由網路連接的工作站已經很普遍。然而因為許多弱點資訊公告所附帶的惡意程式碼經由網路隨手可得，提供意圖不軌的攻擊者一個快速的入侵捷徑，使得這樣的環境卻常受網路安全問題與弱點入侵事件的威脅。除了運用各種安全措施加強防禦外，最根本的解決方法還是要能在補強程式公佈後儘快完成更新。而要維護多台機器上數百個軟體套件是一件相當繁瑣且容易有疏漏的工作。
因此我們提出一個資訊安全品質保證管理架構以協助管理者因未能成功及時更新系統而造成損失的情形發生。為了有效的管理和監控網路上眾多的機器，我們運用以代理者為基礎(Agent-based)的方式和標準SNMP網路管理通訊協定來達到系統管理的便利性與延展性。此系統也提供了使用者介面機制能幫助系統管理者更清楚方便的管理，進而大幅提升軟體的可靠度並減少被入侵的機會，尤其在Linux系統上有顯著良好的改善成效。

關鍵字

代理-監控者架構 ； 套件管理 ； 弱點資訊 ； 資訊安全保證

並列摘要

With the widespread utilization of computers and computer networks, it is common for an organization to have hundreds of workstations connected by computer networks and to get connected to the Internet. Without appropriate administration effort, such an environment is vulnerable to network security problems and intrusion events since a single vulnerability on any one of the workstations may be exploit and become a threat to the entire network environment. Besides employing security measures to defend against intruders, a permanent solution is to update the vulnerable software immediately after the patch has released. However, it is a very complex and difficult routine for an administrator managing an environment with a large number of workstations each in term with hundreds of software packages.
We propose an information assurance management framework (IAMF) to assist administrators on the timely update of vulnerable packages to avoid unnecessary damages. In considering scaling effect and the extensibility of our framework, we adopted an agent-based architecture and the standard SNMP protocol. The agents collect information of installed-packages on their hosts. The monitor inspects information reported by agents to identify the existence of vulnerabilities. The backend database gathers software information and vulnerability information from Internet repositories to provide the necessary data for information assurance. An implementation of the IAMF framework was done. It is demonstrated that the IAMF framework improves the reliability and security of an environment.

並列關鍵字

Vulnerability Information ； Agent/Monitor Architecture ； Software Management ； Information Assurance ； SNMP.

參考文獻

[10] CVE compatible products and services. http://cve.mitre.org/compatible/index.html.

[17] Hatefi, F.G.; Golshani, F.A. “New framework for secure network management”. In Proceedings of the 6th International Conference on Computer Communications and Networks, pages 510-515, September 1997.

[18] Introduction to SNMPv3. RFC 2570, April 1999.

[22] The NET-SNMP Project. http://net-snmp.sourceforge.net.

[23] The Open Source Development Website. http://sourceforge.net.