5.6 Detecting Attacks on Data and Applications（检测数据与应用攻击）

LO 5 · EK 16 ｜ 严格按大纲顺序学习

▶ 从第一个 EK 开始看课件（幻灯片，可翻页/全屏） 点击下方任意 EK 编号（如 5.6.A.1）也可直接进入对应课件页

学习目标 Learning Objectives

5.6.A Explain how to detect attacks on data.

- [5.6.A.1](/ek/5.6.A.1) — Devices track and log when data are accessed and by whom. The process of recording and monitorin… - [5.6.A.2](/ek/5.6.A.2) — A honeypot is a file that appears as if it contains valuable data (e.g., credit card information… - [5.6.A.3](/ek/5.6.A.3) — Cryptographic hash functions can generate a digest for data and can reveal if data have been alt…

5.6.B Determine controls for detecting attacks against applications or data.

- [5.6.B.1](/ek/5.6.B.1) — Cost is a criterion in determining detective controls. Detective controls like honeypots and usi… - [5.6.B.2](/ek/5.6.B.2) — Sensitivity or criticality of data or applications is a criterion in determining detective contr… - [5.6.B.3](/ek/5.6.B.3) — Classification of data is a criterion in determining detective controls. Data that have been cla…

5.6.C Evaluate the impact of a method for detecting attacks against an application or data.

- [5.6.C.1](/ek/5.6.C.1) — To operate at an effective speed, log analysis needs to be augmented with some automation. Honey… - [5.6.C.2](/ek/5.6.C.2) — Some DLP tools, honeypots, and realtime automated log analysis provide alerts as an attack is ha… - [5.6.C.3](/ek/5.6.C.3) — False negatives can occur in applications and data attack detection. Cryptographic hash function…

5.6.D Identify whether a file has been altered by verifying its hash.

- [5.6.D.1](/ek/5.6.D.1) — Cryptographic hash functions can help identify changes in a file because they are repeatable: th… - [5.6.D.2](/ek/5.6.D.2) — Hashes can be calculated using the command line on a computer, a website, or specialized softwar… - [5.6.D.3](/ek/5.6.D.3) — A file can be hashed and its hash output recorded. Then it can be hashed again later, and the se…

5.6.E Apply detection techniques to identify and report indicators of application attacks by analyzing log files.

- [5.6.E.1](/ek/5.6.E.1) — SQL injection attacks can be detected by reviewing application and server logs of user input for… - [5.6.E.2](/ek/5.6.E.2) — XSS attacks can be detected by reviewing user input for suspicious tags, particularly the <sc… - [5.6.E.3](/ek/5.6.E.3) — For web applications, buffer overflows can be detected by checking the amount of data the user i… - [5.6.E.4](/ek/5.6.E.4) — Directory traversal attacks can be detected by reviewing application and server logs. HTTP GET r…

---

← 返回单元 Unit 5