威胁与风险 · 网络安全入门

为什么需要它

直觉理解

定义

CIA 三要素

Confidentiality, integrity and availability: the three properties security protects. Data is kept secret from the wrong people, unchanged by the wrong people, and reachable by the right people.

机密性、完整性、可用性：安全要保护的三种性质。数据不被不该看的人看到，不被不该改的人改动，该用的人随时用得上。

风险 Risk

A simple risk score is likelihood × impact, each rated on a small scale such as 1 to 5. Higher scores are fixed first.

最简单的风险分数是：可能性 × 影响，两个都用 1 到 5 这样的小刻度打分。分数越高越先处理。

示例

1
2
3
4
5
6
7

incidents = {
    "Someone reads the customer list": "confidentiality",
    "A price is changed from 100 to 1": "integrity",
    "The website is down for 3 hours": "availability",
}
for event, goal in incidents.items():
    print(goal.upper(), "-", event)

1
2
3
4
5
6
7
8
9
10
11
12
13
14

risks = [
    ("Weak admin password", 4, 5),
    ("Stolen laptop", 2, 4),
    ("Server disk full", 3, 2),
]

def score(risk):
    name, likelihood, impact = risk
    return likelihood * impact

for risk in risks:
    print(risk[0], score(risk))
ranked = sorted(risks, key=score, reverse=True)
print("Fix first:", ranked[0][0])

常见错误

小测验

1
2
3
4
5
6
7
8
9

likelihood = 3
impact = 4
score = likelihood * impact
if score >= 15:
    print("high")
elif score >= 8:
    print("medium")
else:
    print("low")

动手练习

3 道练习，分三层：先预测程序的输出，再按新需求改程序，最后从零写一个。代码在浏览器里运行，提交马上判题。

1. 预测输出最大的风险

   准确写出这段程序的输出。

2. 改需求只看严重的

   程序会打印每个风险和分数。修改它，让它只打印分数不低于 10 的风险，格式如下：

   HIGH: Weak admin password (20)

3. 从零写风险等级

   写一个函数 risk_level(likelihood, impact)，返回：

   • 可能性 × 影响不少于 15 时返回 "high"
   • 不少于 8 时返回 "medium"
   • 其他情况返回 "low"

本课术语