Red Hat 계정으로 회원 프로필, 기본 설정 및 고객 상태에 따라 다음의 서비스에 액세스할 수 있습니다.
아직 등록하지 않으셨습니까? 등록해야 하는 이유:
- 한 곳에서 기술 자료 문서를 탐색하고, 지원 사례와 서브스크립션을 관리하고, 업데이트를 다운로드 할 수 있습니다.
- 조직 내의 사용자를 보고, 계정 정보, 기본 설정 및 권한을 편집할 수 있습니다.
- Red Hat 자격증을 관리하고 시험 내역을 조회하며 자격증 관련 로고 및 문서를 다운로드할 수 있습니다.
Red Hat 계정으로 회원 프로필, 기본 설정 및 자신의 고객 상태에 따른 기타 서비스에 액세스할 수 있습니다.
보안을 위해, 공용 컴퓨터 사용 중에 Red Hat 서비스 이용이 끝난 경우 로그아웃하는 것을 잊지 마십시오.로그아웃
Most people don’t consider their average USB memory stick to be a security threat. In fact, in a social engineering experiment conducted in 2016 at the University of Illinois and detailed in this research paper, a group of researchers dropped 297 USB sticks outside in the parking lot, in the hallway, and classrooms. Of the 297 USB sticks dropped,
290 were picked up and 135 (45%) called home. In order to encourage people to pick them up, some keys had door keys attached, some said “confidential” and some said “final exam” and had file names. As a result, the most opened keys were those collected in the parking lot (53%), while 68% of collectors said that they had plugged it in and opened files to determine the owner. Also, 20% of keys were opened in the first hour, and 70% within 35 hours. This type of social engineered USB attack is effective with an estimated success rate of 45-98% and expeditious with the first drive connected in less than six minutes. One of the researchers who conducted this experiment, Elie Bursztein, presented his findings at the 2016 Black Hat Conference and declared that they had been able to drop the USB sticks and it was “job done”.
Another reminder of the damage a USB security attack can cause is the highly destructive Stuxnet worm that was used to degrade and destroy hundreds of centrifuges at Iran’s uranium enrichment facility at Natanz a few years ago. This attack was in fact, initially introduced into the systems via an infected USB stick.
The fact that users plug such storage devices into corporate computers is obviously a nightmare for IT security professionals. USB sticks can be loaded with spyware, malware, or Trojans, which can not only steal your data but even destroy your computer. The good news is that, if you are a Red Hat Enterprise Linux user, you can prevent these USB attacks with USBGuard, which is included with the release of Red Hat Enterprise Linux 7.4. Inspiration for this is drawn from exploits like BadUSB.
USBGuard is a software framework that protects your systems against rogue USB devices by implementing basic whitelisting and blacklisting capabilities based on device attributes. This allows you to define access control to USB devices. For example, you can define what kind of USB devices are authorized and how a USB device may interact with your system. It enables you to lock down all USB devices from user space.
There are three main use cases for USBGuard: USB device whitelisting, USB device blacklisting, and triggering actions on USB device events. USBGuard can permit only known devices to create interfaces to it via USB (aka USB device whitelisting). Conversely, if a user doesn’t want to use a particular class of interfaces, he/she can block devices that want to communicate with the computer as an interface from that class (aka USB device blacklisting). The final use case for USBGuard would be triggering actions on USB device events, such as when a particular USB device or USB device class is inserted, removed, etc. This feature might be used for auditing USB usage, screen locking ,etc.
USBGuard is not installed by default. However, in Red Hat Enterprise Linux, you can install the precompiled packages in the Extras repository. Once installed, you control USBGuard by the settings in its usbguard-daemon.conf file, which is the USBGuard daemon configuration file. Then the daemon will decide which USB device to authorize based on a policy defined by a set of rules. When a USB device is inserted into the system, the daemon scans the existing rules sequentially and when a matching rule is found, it either authorizes(allows), deauthorizes (blocks), or removes (rejects) the device, based on the rule target. The default is to block the device until a decision is made by the user.
A quick way to start using USBGuard to protect your system from USB attacks is to first generate a policy for your system. Then, start the usbguard-daemon (systemctl start usbguard.service). You can use the USBGuard CLI command and its generate-policy subcommand to generate an initial policy for your system instead of writing one from scratch. The tool generates an allow policy for all devices currently connected to your system at the moment of execution. There are several options to tweak the resulting policy as outlined here. The typical workflow for generating an initial policy could look like this:
# usbguard generate-policy > rules.conf
# vi rules.conf
(review/modify the rule set)
# sudo install -m 0600 -o root -g root rules.conf /etc/usbguard/rules.conf
# sudo systemctl start usbguard.service
So what are you waiting for? If you want to safeguard your systems against USB based security attacks, be sure to install and utilize USBGuard for all your Red Hat Enterprise Linux systems!