9 Security 安全性

With Jungwoo Ryoo and Phil Laplante

Your personal identity isn’t worth quite as much as it used to be—at least to thieves willing to swipe it. According to experts who monitor such markets, the value of stolen credit card data may range from $3 to as little as 40 cents. That’s down tenfold from a decade ago—even though the cost to an individual who has a credit card stolen can soar into the hundreds of dollars.
你的个人身份已经不像以前那么值钱了，至少对那些想偷的小偷来说是这样。据监控此类市场的专家称，被盗信用卡数据的价值可能在3美元到40美分之间。这比十年前下降了十倍，尽管信用卡被盗的个人成本可能飙升至数百美元。
—Forbes.com (Taylor Buley. “Hackonomics,” Forbes.com, October 27, 2008, http://www.forbes.com/2008/10/25/credit-cardtheft-tech-security-cz_tb1024theft.html)

Security is a measure of the system’s ability to protect data and information from unauthorized access while still providing access to people and systems that are authorized. An action taken against a computer system with the intention of doing harm is called an attack and can take a number of forms. It may be an unauthorized attempt to access data or services or to modify data, or it may be intended to deny services to legitimate users.

安全性是对系统保护数据和信息免遭未经授权访问，同时仍提供对授权人员和系统的访问权的一种度量。 针对计算机系统采取的旨在造成伤害的行为称为攻击，并且可以采取多种形式。 这可能是未经授权的访问数据或服务或修改数据的尝试，或者可能是拒绝向合法用户提供服务。

The simplest approach to characterizing security has three characteristics: confidentiality, integrity, and availability (CIA):

表征安全性的最简单方法具有三个特征：机密性，完整性和可用性（CIA）：

1. Confidentiality is the property that data or services are protected from unauthorized access. For example, a hacker cannot access your income tax returns on a government computer.
   机密性 是保护数据或服务免遭未授权访问的属性。 例如，黑客无法在政府计算机上访问您的所得税申报表。
2. Integrity is the property that data or services are not subject to unauthorized manipulation. For example, your grade has not been changed since your instructor assigned it.
   完整性 是数据或服务未经未经授权操纵的属性。 例如，自从您的老师给您评分以来，您的成绩没有改变。
3. Availability is the property that the system will be available for legitimate use. For example, a denial-of-service attack won’t prevent you from ordering book from an online bookstore.
   可用性 是系统可用于合法使用的属性。 例如，拒绝服务攻击不会阻止您从在线书店订购书籍。

Other characteristics that are used to support CIA are these:

用于支持CIA的其他特征包括：

4. Authentication verifies the identities of the parties to a transaction and checks if they are truly who they claim to be. For example, when you get an email purporting to come from a bank, authentication guarantees that it actually comes from the bank.
   身份验证 可验证交易各方的身份，并检查他们是否真实地声称自己是谁。 例如，当您收到一封声称来自银行的电子邮件时，身份验证可确保该邮件实际上来自银行。
5. Nonrepudiation guarantees that the sender of a message cannot later deny having sent the message, and that the recipient cannot deny having received the message. For example, you cannot deny ordering something from the Internet, or the merchant cannot disclaim getting your order.
   不可否认性 保证消息的发送者以后不能拒绝发送消息，并且接收者不能拒绝接收消息。 例如，您不能拒绝从Internet订购商品，或者商人不能否认获得您的订单。
6. Authorization grants a user the privileges to perform a task. For example, an online banking system authorizes a legitimate user to access his account.
   授权 向用户授予执行任务的特权。 例如，在线银行系统授权合法用户访问其帐户。

We will use these characteristics in our general scenarios for security. Approaches to achieving security can be characterized as those that detect attacks, those that resist attacks, those that react to attacks, and those that recover from successful attacks. The objects that are being protected from attacks are data at rest, data in transit, and computational processes.

为了安全起见，我们将在一般情况下使用这些特征。 可以将实现安全性的方法的特征描述为检测攻击的方法，抵抗攻击的方法，对攻击做出反应的方法以及从成功攻击中恢复的方法。 受保护不受攻击的对象是静态数据、传输中的数据和计算过程。