/catalog/296695a3fdd74f71b4ced1996c9b6856//Document/544746990256197.html/Document/544471531282501.html/Document/544104164757573.html/Document/542014578585669.html/Document/541568788664389.html/Document/539454798217285.html/Document/539453662449733.html/Document/539106840522821.html/Document/539106318127173.html/Document/537759498522693.html/Document/537758873952325.html/Document/536670380744773.html/Document/536669918658629.html/Document/535274533212229.html/Document/535274076639301.html/Document/534838127284293.html/Document/534837539852357.html/Document/534514390343749.html/Document/534513902743621.html/Document/534129665769541.html/Document/534128754413637.html/Document/531769332838469.html/Document/531768875597893.html/Document/530599306571845.html/Document/530598883192901.html/Document/529281313382469.html/Document/529280904593477.html/Document/528111744671813.html/Document/528111122219077.html/Document/527768380964933.html/Document/527767993040965.html/Document/526809318363205.html/Document/526808901791813.html/Document/525648271851589.html/Document/525647771697221.html/Document/524949682458693.html/Document/524949227167813.html/Document/524290312802373.html/Document/524289770504261.html/Document/523187817824325.html/Document/523187349782597.html/Document/522458063388741.html/Document/522457524322373.html/Document/522111178473541.html/Document/522110478868549.html/Document/521742111748165.html/Document/521740472320069.html/Document/520680288002117.html/Document/520679709044805.html/Document/520421404913733.html/Document/520420916084805.html/Document/519695556915269.html/Document/519695178637381.html/Document/519286084939845.html/Document/519285550596165.html/Document/517527679774789.html/Document/517527163703365.html/Document/512185975087173.html/Document/511946871631941.html/Document/511946429853765.html/Document/510490688409669.html/Document/510490145665093.html/Document/509474966245445.html/Document/509474292002885.html/Document/508381305012293.html/Document/508380165513285.html/Document/507942179053637.html/Document/507941613613125.html/Document/507336815288389.html/Document/507336323162181.html/Document/506969107042373.html/Document/506968450326597.html/Document/505888177782853.html/Document/505887157772357.html/Document/505549163270213.html/Document/505548496027717.html/Document/505143668654149.html/Document/505143105032261.html/Document/504503398395973.html/Document/504502746468421.html/Document/503017040437317.html/Document/503016609853509.html/Document/502718247415877.html/Document/502717705343045.html/Document/502361750245445.html/Document/502361307697221.html/Document/501990556381253.html/Document/501989827113029.html/Document/500880675987525.html/Document/500880224911429.html/Document/500250144956485.html/Document/500232490541125.html/Document/499908522852421.html/Document/499907986919493.html/Document/498447282262085.html/Document/498446788378693.html/Document/498103952822341.html/Document/498103476068421.html/Document/497705815789637.html/Document/497703055208517.html/Document/497352259182661.html/Document/497351210856517.html/Document/496977382301765.html/Document/496976846573637.html/Document/495934617931845.html/Document/495933266260037.html/Document/495577945600069.html/Document/495576688218181.html/Document/494873100378181.html/Document/494872714567749.html/Document/494515031642181.html/Document/494514507194437.html/Document/492829277941829.html/Document/492826934538309.html/Document/492478892306501.html/Document/492478432673861.html/Document/492048771612741.html/Document/492048321876037.html/Document/491018538238021.html/Document/491017994391621.html/Document/490617591144517.html/Document/490616589226053.html/Document/490277546360901.html/Document/490277081866309.html/Document/488480491106373.html/Document/488479777673285.html/Document/488131539537989.html/Document/488129496956997.html/Document/487787449102405.html/Document/487786620837957.html/Document/487425698246725.html/Document/487425161941061.html/Document/487077007417413.html/Document/487076470157381.html/Document/486012783796293.html/Document/486011843792965.html/Document/485654058504261.html/Document/485653628149829.html/Document/485285488848965.html/Document/485005121204293.html/Document/485004810907717.html/Document/483634668224581.html/Document/483162688110661.html/Document/482456439619653.html/Document/480691329347653.html/Document/479981549019205.html/Document/479640516874309.html/Document/478581868011589.html/Document/478211995488325.html/Document/477860005101637.html/Document/477516631253061.html/Document/476091023597637.html/Document/475748190408773.html/Document/475747825885253.html/Document/475390229778501.html/Document/475389762682949.html/Document/475021811523653.html/Document/475021482278981.html/Document/474681074966597.html/Document/474680715309125.html/Document/473641910472773.html/Document/473641599152197.html/Document/472917246013509.html/Document/472916949708869.html/Document/472553316364357.html/Document/472553009672261.html/Document/472222551654469.html/Document/472222166081605.html/Document/470772911669317.html/Document/470772523974725.html/Document/470491812298821.html/Document/470491020734533.html/Document/470144418017349.html/Document/470144062480453.html/Document/469355727437893.html/Document/469355344896069.html/Document/469002772238405.html/Document/469002372866117.html/Document/465854760509509.html/Document/465854252036165.html/Document/465481503801413.html/Document/465481068789829.html/Document/465193214992453.html/Document/465192312610885.html/Document/464860703494213.html/Document/464860235079749.html/Document/463357444149317.html/Document/463351258955845.html/Document/462989079121989.html/Document/462988335923269.html/Document/462660239003717.html/Document/462658920042565.html/Document/461304163098693.html/Document/461301616328773.html/Document/460881708830789.html/Document/460876803891269.html/Document/460520743743557.html/Document/460513554071621.html/Document/460169107955781.html/Document/460168465489989.html/Document/459825920966725.html/Document/459825340420165.html/Document/458389364535365.html/Document/458388990779461.html/Document/458052748820549.html/Document/458051490840645.html/Document/457785747443781.html/Document/457785205239877.html/Document/457346283610181.html/Document/457345117622341.html/Document/456266454548549.html/Document/456265627877445.html/Document/455911269912645.html/Document/455557920325701.html/Document/455557492965445.html/Document/455218049572933.html/Document/454857812234309.html/Document/453789017641029.html/Document/453449959817285.html/Document/453079570784325.html/Document/452403319308357.html/Document/451310486503493.html/Document/450994786713669.html/Document/450345001971781.html/Document/449962449588293.html/Document/448929358094405.html/Document/448230949081157.html/Document/447863453311045.html/Document/446102887440453.html/Document/445725270851653.html/Document/445022107115589.html/Document/443641819930693.html/Document/443271687684165.html/Document/443270796382277.html/Document/443270370861125.html/Document/441430268338245.html/Document/441419688190021.html/Document/441419056222277.html/Document/440429294637125.html/Document/438340763410501.html/Document/437986291200069.html/Document/437603819495493.html/Document/436191615103045.html/Document/435855229702213.html/Document/435147718438981.html/Document/434051877818437.html/Document/433366954807365.html/Document/432997464641605.html/Document/432628688769093.html/Document/432266670596165.html/Document/430907430723653.html/Document/428784032424005.html/Document/428385797652549.html/Document/428062862630981.html/Document/427712386293829.html/Document/426283111870533.html/Document/424188637298757.html/Document/423430430916677.html/Document/422738450387013.html/Document/421335462469701.html/Document/420956089200709.html/Document/420244068835397.html/Document/419142595375173.html/Document/418879737671749.html/Document/418156051357765.html/Document/417780141715525.html/Document/416729842651205.html/Document/416373677670469.html/Document/416014651207749.html/Document/414600654966853.html/Document/414232150913093.html/Document/413894034452549.html/Document/411749575036997.html/Document/411444007235653.html/Document/410989555187781.html/Document/410365315555397.html/Document/408937260335173.html/Document/408592682856517.html/Document/408239118336069.html/Document/402940329152581.html/Document/401521045061701.html/Document/401149456379973.html/Document/400819542675525.html/Document/400464907001925.html/Document/399363703992389.html/Document/399019061391429.html/Document/398327264952389.html/Document/397988956139589.html/Document/396547962679365.html/Document/396188926316613.html/Document/395839580831813.html/Document/395509538283589.html/Document/393696815161413.html/Document/393356444545093.html/Document/393008819511365.html/Document/391891180220485.html/Document/391256916983877.html/Document/390918744105029.html/Document/390528820486213.html/Document/389136971677765.html/Document/388763822231621.html/Document/388416565977157.html/Document/388045527777349.html/Document/386637062586437.html/Document/386290355249221.html/Document/386290343432261.html/Document/385922848862277.html/Document/384498574901317.html/Document/384178599956549.html/Document/383813990293573.html/Document/383450832826437.html/Document/383112784425029.html/Document/381983009394757.html/Document/381676021035077.html/Document/381338668412997.html/Document/380973198676037.html/Document/380625301606469.html/Document/376028059926597.html/Document/374587749163077.html/Document/374252417724485.html/Document/373905092177989.html/Document/373540837523525.html/Document/373226847809605.html/Document/311601443917893.html/Document/311285189517381.html/Document/310134890274885.html/Document/309794452426821.html/Document/309507604934725.html/Document/304898482892869.html/Document/304549706600517.html/Document/304188584996933.html/Document/303818784497733.html/Document/302700517105733.html/Document/302416475320389.html/Document/302077848256581.html/Document/301288627347525.html/Document/300279638184005.html/Document/274792263872581.html/Document/273024381308997.html/Document/272683642789957.html/Document/272351623921733.html/Document/271961406242885.html/Document/271560844214341.html/Document/270477420015685.html/Document/269881559916613.html/catalog/c51244b85e704db9a2a34ca396e9fe27//Document/375674108960837.html/Document/340619525128261.html/Document/340263572500549.html/Document/337103780888645.html/Document/336726028042309.html/Document/336395351863365.html/Document/336019384291397.html/Document/334605603291205.html/Document/334264344903749.html/Document/333908786077765.html/Document/333537608929349.html/Document/332422937043013.html/Document/323979240091717.html/Document/323624591507525.html/Document/322518056206405.html/Document/322224629981253.html/Document/321870777405509.html/Document/321154810175557.html/Document/319738524639301.html/Document/319395521761349.html/Document/319038449188933.html/Document/318684198744133.html/Document/317575537291333.html/Document/316584392339525.html/Document/297463116619845.html/Document/296410729726021.html/Document/294281412902981.html/Document/289614801383493.html/Document/289336711553093.html/Document/288989717336133.html/Document/267736666357829.html

安全测试国家标准解读——环境安全

下面的系列文章主要围绕《GB/T 38674—2020 信息安全技术 应用软件安全编程指南》进行讲解。对该标准中一些常见的漏洞进行了梳理,大家感兴趣的话可以自己去下载下来学习一下,里面有一些最佳实践是比较好的。

 

本标准从程序安全和环境安全两个方面提出了提升应用安全性的编程最佳实践。其中,程序安全部分描述软件在资源使用、代码实现、安全功能方面的安全性规范,环境安全部分描述软件的安全管理配置规范。前面的文章为大家讲解了程序安全和代码安全,本文我们继续问大家讲解环境安全。

软件安全测试

环境安全这部分主要包含:第三方软件使用安全  、开发环境安全 、运行环境安全这三部分。这个也是我们在系统设计的环节就要考虑好这些问题。


在系统的设计过程中,我们会用到哪些第三方的软件,这些软件我们要用哪一个版本,哪个版本是安全的,我们的开发环境怎么配置,运行环境怎么来配置,都要提前做好规划。防止不同的人员,用不同的环境、不同的版本造成的安全问题。


【第三方软件使用安全】

软件安全检测

针对第三方软件也要进行代码的安全审计,因为第三方的软件也不一定是安全的。

【开发环境安全】

软件代码安全

开发环境这部分强调要使用统一的官方编译器,确保安装了所有的补丁。还要去掉调试开关,这个也非常重要,很多黑客的攻击就是通过调试开关这里进入的。
另外就是源代码的安全管理,怎么保护源代码不被非法访问,以及开发环境与实际物理环境进行隔离。


【运行环境安全】

软件web安全

应用软件发布前去除所有与调试和测试相关的代码、配置、文件等。这一条是我们在代码审计中经常发现的问题。
很多开发人员非常不注意,测试代码和开发代码不是那么明确,上线的时候也不把测试代码去掉,很多测试代码就跟着上线了,就会暴露一些敏感信息。


像前面举的携程的例子,就是它的调试信息被获取到了,这个问题虽然不是一个大问题,可能我们开发各个方面都很注意,开发能力也非常强,但是在这些环节如果不注意的话就会产生非常大的风险。这一块如果开发人员没有时间和精力去做的话,可以让测试人员来帮忙测试。


安全配置信息只能是只读的,对重要的配置信息进行安全防护,像一些配置文件,如果明文放到一些不安全的路径下面,就很容易被黑客获取到。

如果应用软件部署在客户端,例如移动APP,宜使用混淆、签名、加固等措施防止逆向获取源代码。现在移动应用上线前也会针对这部分进行检查,必须要做一定的处理。


软件安全中,环境安全这部分往往是开发人员特别不注意的地方,而这些地方一旦出现问题都是一些比较大的问题,大家多去了解一下,在开发过程中多去规避这些问题。

以上就是我们对软件安全开发国家标准的解读,这个标准的内容是比较多的,里面也有很多最佳实践,大家可以去看一下。