Computer Prepress Security Technology Continued

At present, several domestic anti-virus softwares that are popular have accounted for more than 80% of the domestic market. Among them, Rising RAV, Jiangmin KV300, Source VRV, and Jinchen KILL have considerable influence. In addition, foreign anti-virus software products have gradually entered China, such as NAI, ISS, and CA. The prepress publishing system can reasonably choose to use anti-virus software based on the actual status of the virus. When using anti-virus software, you should consider the certain functions that the software used should have. The main features that should be available include:

(1) Check whether the program running the request is infected with a known virus, refuse to run the request, or shield its functions of infection and destruction.

(2) The program resides in the monitoring of the request, issues a warning or is registered for further processing.

(3) Monitor directly the program residing in MCB mode, or register it for subsequent processing.

(4) Monitor requests for reading and writing executable files, because file viruses mainly rely on infection executable files.

(5) The file to be accessed is checked using a file verification code that is generated in advance, and when an abnormality is found, a virus check is performed and an alarm is issued. The generation of the check code requires a good algorithm, otherwise it will not be able to detect the change of the file due to the infection of the virus.

(6) Surveillance of some special interrupt vector changes within the computer system, registration or alerting.

(7) The virus protection program should check whether the DOS boot sector is infected with the virus or use a pre-generated verification code to check. Writes to this sector should also be checked.

(8) The main boot sector in the hard disk is a sector that the general DOS program does not need to access. Unless partitioning is to be performed, the contents of this sector should not be changed at ordinary times. Antivirus programs should provide protection for this sector. Many antivirus programs also do this, and an alert should be issued when a write or formatting operation to the master boot sector occurs.

(9)Provide protection for important system files, such as COMMAND.COM necessary for booting. Non-virus changes to such files will generally only occur when the operating system version is updated. This will not be a frequent occurrence.

(10) Provides a full write-disable function to the disk and provides protection for certain partitions by dividing the appropriate partition size.

Fourth, network hackers to prevent

Cyber ​​hackers are people in the computer network who decipher various passwords and use illegal means to carry out other people's computer systems to steal important data information and destroy computer network systems.
l. Network hackers attack the network.

The main method of network hacker attacks on the network is to find security vulnerabilities in the computer system, thereby launching relentless attacks, the main route is the Internet. There are several specific methods for cyberhackers to attack the network: obtaining passwords, placing Trojan horse programs, WWW spoofing techniques, email attacks, attacking other nodes through a node, network monitoring, searching for system vulnerabilities, exploiting an account for attack, and stealing Take privileges and so on.

2. Protection against hackers.

Prevention of hackers can use the following measures:

(l) Hosts that use telnet, ftp, etc. to transfer passwords for important confidential information applications should set up a separate network segment.

To prevent a computer from being compromised, the attacker installs the sniffer.

Caused the entire network segment to be fully exposed. In case of conditions, important hosts should be installed on the switch, so as to avoid sniffers overhearing passwords.

(2) Dedicated hosts only provide special functions. For example, hosts running important processes in network management and databases should not run programs with relatively large security holes. The access control in the router segment of the network management network should be limited to the minimum. It is necessary to study the process port numbers necessary for various types of processes and close unnecessary ports.
(3) The log files of each host opened to the user are all directed to one syslogd
On the server, centralized management, the server can be hosted by a UNIX or Windows NT host with a large-capacity storage device, and periodically check the data on the backup log host.
(4) The network manager must not access the Internet and should set up a special computer to use ftp or WWW download tools and information.
(5) Hosts providing e-mail, WWW, and DNS functions should not install any development tools to prevent attackers from compiling attack programs.
(6) The principle of network configuration should be "Minimization of user rights", for example, closing unnecessary or unknown network services without e-mailing passwords.

(7) Download and install the latest operating system and other application software security and upgrade patches, install several necessary security enhancements, limit access to the host, strengthen the log records, perform integrity checks on the system, and regularly check the user's vulnerability Password and notify the user to modify it as soon as possible. Important users' passwords should be modified regularly, and different hosts use different passwords.