Network security Internet into the next decade "outlet" _ news

, President of qihoo 360

On April 19, the XI General Secretary remarks at the national network Symposium, to China's future pointed out the direction of work networks and network security. General Secretary from the concept, technology and mechanism of multi-level network security was elaborated, will lead the network security industry market, promote the innovation and development of network security industry. Over the next decade, network security on the Internet "outlet".

New network security concept has spawned large market, the Internet industry will become the next decade "outlet"

Acquisition, General Secretary at the Symposium pointed out that to set up the right view of network security, to realize that cyber security is a holistic rather than fragmented; are dynamic rather than static; be open rather than closed, is relative and not absolute, is common and not in isolation.

General Secretary to the network concept of security, and outlines a clear roadmap for the industry. At present, the network security industry and investment in China and the United States compared to large gaps, must catch up.

According to renowned market research firm Gartner2015 year, 2015 years information security expenditures of us $ 83.378 billion, of which $ 33.938 billion in North America; Western Europe accounted for $ 22.514 billion, which accounted for $ 3.215 billion in greater China, not commensurate with the economy significantly, only United States 9%, one-tenth. According to another authority according to the research firm IDC, China information security IT into proportion of input in 1%-2%, compared with North American and European enterprise information security expenditure proportion of IT spending reached 8%-14%.

The serious lack of information on safety input, not only caused huge problems of network security in China, and the network security industry and technological innovation of desertification.

General Secretary, said "the idea decided to act", in the new concept of network security guidance, to correct two mistakes of the past practices: first, security equipment and security software installed as a security measure for once and for all. In order to avoid interception, network attacker to "minute", but send 360 Safety Center found Trojan samples nearly every day, various hardware and software vulnerabilities, Web site vulnerabilities found every day more than 120, every horse and every vulnerability is likely to compromise our pre-deployment security equipment and security software, so security must be dynamic. Second, focus on the development of light security. Addition of the information is for the development, can lead to direct benefits, and safety is the essence of subtraction, put into effect cannot be seen easily after, so often settle for security in order to meet the minimum requirements for the target. General Secretary said "security is a prerequisite for development," "far-reaching network security on national security", under the guidance of our new concept of network security, rapid change.

United States has taken the lead in implementing the action. Obama 2016 budget reporting requirements, the Federal Government added $ 14 billion to support the development strategies of network security at the Government level, this means a total 11% 2015 fiscal year.

If we spent the last ten years, investment in network security catch up with the United States, the market capacity is amazing. United States 15% annual growth forecast decade United States increases 4 times, if China's growth is the United States twice times (years 30%), ten years is 14 times, nearly 4, quadruple every 5 years. There is no doubt that network security will be on the Internet for the next decade "outlet".

At generating market at the same time, security services share will rise significantly. As the acquisition, General Secretary said: "information technology changes too fast, past scattered independent networks become highly correlated and interdependent, network sources of security threats and attack methods are constantly changing, that relies on a few safety devices and security software like the idea of eternal security is outdated and needs to establish a dynamic, comprehensive protection concept. ”

In the United States and other developed countries, network security services in the security market share of more than 50%, but in China, the Government and enterprises are not willing to pay for equipment and software, and do not want to purchase services, network security service market is less than 10%.

Implementation of the responsibility system for network security, survival of the fittest mechanism to promote technological innovation

Learn General Secretary clearly pointed out: "to implement the responsibility system for network security, developing cybersecurity standards, clear protection, protection levels, protective measures. What to the heavily guarded, defend, which guaranteed by the local government, the moderate precautions, where market forces protection, to have a clear account. ”

In our country, the field of network data breaches occur almost daily. Each year, the great information security incidents, in 2015, for example social security system vulnerabilities reported incidents, NetEase to billions of users, data leakage. Based on publicly reported information from early 2011 to 2015, known to have been leaked information has reached 1.127 billion. That's just the tip of the iceberg, there are too many leaks of information has not been made public, circulated underground.

360 established sky vulnerability vulnerability response platform is the largest platform, has now collected more than 80,000 multiple vulnerabilities last year received 43,499 vulnerability, 1410 vulnerability may result in disclosure of personal information, exposure information as much as 5.53 billion. These vulnerabilities in the proportion of Governments, enterprises and institutions is very high, but the fix for vulnerability rate and efficiency is extremely low. Last year, we comb the University website vulnerabilities on the sky platform showed that from April 2014 to March 2015, the 12-month period, effective University website vulnerabilities appear on the sky platform up to 3,495, involving a total of 1088 College website, including 2,611 high-risk vulnerabilities, 74.7%. Alarming is that over the past year, after having been informed of the Web site vulnerabilities, fix University website is only 35, only 186 vulnerability is fixed, 96.8% University website in total disregard of security vulnerabilities exist, 94.6% University website security vulnerabilities have not been repaired.

Lack of accountability systems in network security industry, was the root cause of all these faces. In our country, no matter how serious information security incidents occur, there is no corresponding responsibility. Although well-established information carrier in accordance with the vital registration and classification to protect information classified security protection system, but because of the lack of a legal basis, the competent authorities did not like the safety supervision Department has to mining accidents, car accidents, fires and other accidents in defining rights and punishment, this mechanism does not work.

In this system, we have "access" to the minimum quality standards, as the exemption cards, Government and State-owned enterprises as the main buyer, only to process regardless of the results, select device only "evidence" doctrine, the bid with the lowest price. Under the guidance of such a system, a low level competition became mainstream, constantly beat talent and investment on research and development is seriously insufficient, woe betide anyone who is creative, who put in more technically.

In this connection, the General Secretary discusses very strong XI: "when people used aircraft Cannon, we still use machetes Spears, that is not enough, attack and defense power to the peer. Technology technology technology technology, magic high and one foot taller, DAO Zhang. "This requires that we must have a clear understanding in the security industry must be result-oriented, this is" 0 and 1 "relationship. In this industry, need is survival of the fittest, not the "lowest bidder". Only on technological innovation, to make aircraft cannon.

Leading the "awareness of network security posture" core technologies, with big data "safety"

"Unaware of the risk is the biggest risk. "Acquiring this argument much insight to network security, General Secretary," concealment of network security with strong, technical vulnerabilities, security risks might be hiding a few years are not found, the result is ' who came in didn't know, friend or foe did not know, and what they did not know, ' long-term ' lurking ' in there, once you have attack. Maintain network security, first of all you want to know where the risks, what kind of risk is, what happens when risk, is the so-called ' astute listening in the silence, specified in is not. Awareness of network security posture is the most fundamental and most basic task. "Awareness of network security posture is emerging technology, it contains loopholes in mining technology, network attack technology, software, sample analysis, and network address resolution database, network access logs databases, files, black and white list database and other data systems and analysis techniques, it is the traditional security + Internet + data.

360 is the world's largest Internet security firms, have unique advantages in network security situational awareness, so there are conditions in the core areas of technology leader. Last December, the world Internet Conference in Wuzhen, 360 show has hundreds of patents "cyber threat with situational map" using visualization techniques, you can automatically see APT attacks and unknown threats, learning General Secretary before the map details about technology, giving praise and high expectations on future development.

After 10 years of development, the 360 coverage of mobile and PC users in the country reached 96.1%, the 1.3 billion Terminal, trouble on the sensitive perception of the Internet, coupled with our unique sample library, the main anti-library, Internet domain names database, vulnerability database, and third-party data sources such as, form the world's largest network security database. According to the above data, and advanced analysis capabilities, we have built the world's first unknown threat detection and tracing system. Up to now, the 360 APT events have discovered more than 20, continuous analysis of track 16 of them confirmed as science and technology, education, energy and transport fields targeted attacks. Next, we have to increase the pace of internationalization, to "go out".

Learning advocated by General Secretary: "to establish the Government and enterprise network security information-sharing mechanisms, in terms of data openness and information sharing, to strengthen the argument, the EC Commission and play to 1+1 effect greater than 2 in order to use available data resources from all sources, data mining analysis of strengthening and better awareness of network security posture, and risk prevention. ”

Perception data, rely on technology, defensive ability, and size, and collaboration. According to the General Secretary of open data, information sharing, advocacy, these well, will enable enterprises to grow, we have more confidence to maintain awareness of network security posture, a core technology's leading edge.

Responsible editor: Ms. fan Ying Wu

I want feedback
Save a Web page
China NET

网络安全将成未来十年互联网“风口”_新闻资讯

　　360公司总裁 齐向东

　　4月19日，习近平总书记在全国网信工作座谈会上的讲话，给我国未来网信和网络安全工作指明了方向。总书记从观念、技术、机制多层次对网络安全进行了阐述，将催生网络安全行业大市场，促进网络安全行业的大创新、大发展。未来十年，网络安全将站上互联网的“风口”。

　　新网络安全观催生大市场，行业将成未来十年互联网“风口”

　　习总书记在座谈会上指出，要树立正确的网络安全观，要认识到网络安全是整体的而不是割裂的；是动态的而不是静态的；是开放的而不是封闭的；是相对的而不是绝对的；是共同的而不是孤立的。

　　总书记对网络安全观的阐述，勾画了明确的行业发展路线图。目前，我国网络安全产业规模和投入与美国相比，差距巨大，必须奋起直追。

　　知名市场研究机构Gartner2015年发布的数据显示，全球2015年信息安全支出达833.78亿美元，其中北美地区339.38亿美元；西欧地区占225.14亿美元，而大中华区占32.15亿美元，与经济体量明显不相称，仅为美国的9%，不足十分之一。另据权威调研机构IDC的数据显示，我国信息安全投入占IT投入比重在1%-2%，同期北美和欧洲企业信息安全投入占IT支出比重达到8%-14%。

　　信息安全投入上的严重不足，不仅导致我国网络安全的巨大隐患，而且使网络安全产业和技术创新荒漠化。

　　总书记说“理念决定行动”，在新网络安全观指导下，要纠正过去的二种错误做法：其一，把安装几个安全设备和安全软件当作一劳永逸的安全措施。为了躲避拦截，网络攻击者以“分钟级”千变万化，360安全中心每天发现木马样本近千万个，每天发现的各种软硬件漏洞、网站漏洞超过120个，每一个木马每一个漏洞，都可能攻破我们预先部署的安全设备和安全软件，所以安全防护必须是动态的。其二，重发展轻安全。信息化是给发展作加法的，能带来直接效益，而安全是作减法的，投入之后轻易看不到效果，所以往往对安全应付了事，以满足最低要求为目标。总书记说“安全是发展的前提”，“网络安全对国家安全牵一发而动全身”，我们要在新网络安全观指导下，快速改变。

　　美国已经率先从态度落实到了行动。奥巴马发布的2016年财年预算报告要求，联邦政府要新增140亿美元用于支持政府层面的网络安全发展战略，这意味着较2015财年总额增长了11%。

　　如果我们花十年时间，在网络安全投入上赶上美国，市场容量是惊人的。以美国年增长15%预估，十年美国增幅将翻4倍，如果我国的增速是美国的2倍（年增30%），十年则是14倍，接近4番，也就是每5年翻两番。毫无疑问，网络安全将站上下一个十年互联网的“风口”。

　　在催生大市场的同时，安全服务的份额将大幅攀升。正如习总书记所说：“信息技术变化越来越快，过去分散独立的网络变得高度关联、相互依赖，网络安全的威胁来源和攻击手段不断变化，那种依靠装几个安全设备和安全软件就想永保安全的想法已不合时宜，需要树立动态、综合的防护理念。”

　　在美国等发达国家，网络安全服务在安全市场的比重都超过了50%，而在中国，政府和企业只愿意买设备和软件，不愿意购买服务，网络安全服务市场占比不足10%。

　　推行网络安全责任制，优胜劣汰机制促进技术大创新

　　习总书记明确指出：“要落实网络安全责任制，制定网络安全标准，明确保护对象、保护层级、保护措施。哪些方面要重兵把守、严防死守，哪些方面由地方政府保障、适度防范，哪些方面由市场力量防护，都要有本清清楚楚的账。”

　　在我国，网络领域的数据泄漏几乎每天都在发生。每年，都会爆发大的信息安全事故，例如2015年被公开报道的社保系统漏洞事件、网易过亿用户数据泄漏等。根据公开报道过的信息，从2011年到2015年年初，已知被泄漏的信息就已经达到了11.27亿条。这只是冰山一角，还有太多被泄漏的信息没有被公开，在地下流传着。

　　360建立的补天漏洞响应平台是目前国内最大的漏洞平台，目前已经收集了8万多个漏洞，仅去年一年，收到的43499个漏洞中，有1410个漏洞可能造成个人信息泄露，有泄露风险的信息量高达55.3亿条。 这些漏洞里政府和企事业单位占比很高，但他们对漏洞的修复比例和效率极其低下。去年，我们针对补天平台上的高校网站漏洞进行梳理后发现，自2014年4月至2015年3月的12个月间，补天平台上显示的有效高校网站漏洞多达3495个，涉及高校网站1088个，其中，高危漏洞2611个，占74.7%。令人担忧的是，过去一年间，在被告知网站存在漏洞后，会修复漏洞的高校网站只有35个，仅186个漏洞被修复，96.8%的高校网站完全无视安全漏洞的存在，94.6%的高校网站安全漏洞未被修复。

　　网络安全行业追责制度的缺失，是造成上述种种怪相的根本原因。在我国，不管发生多么严重的信息安全事故，都没有人承担相应的责任。虽然早已建立了对信息和信息载体按照重要登记分级保护的信息安全等级保护制度，但因为缺少法律依据，主管部门没有像安监部门那样拥有对矿难、车祸、火灾等事故的责任界定权和处罚权，这个机制并未发挥作用。

　　在这种制度下，大家都把“准入”这个最低的质量标准，当作了免责牌，作为主要买方的政府和国企，只对过程负责而不考虑结果，选择设备时唯“证”主义、最低价中标。在这样的制度导向下，低水平恶性竞争成为了主流，不断的压价使企业在人才和研发上投入严重不足，技术上谁创新、谁投入多谁倒霉。

　　在这一点上，习总书记的论述非常有力：“人家用的是飞机大炮，我们这里还用大刀长矛，那是不行的，攻防力量要对等。要以技术对技术，以技术管技术，做到魔高一尺、道高一丈。”这就要求我们必须有清楚的认识，在安全这个行业，必须以后果为导向，这是“0和1”的关系。在这个行业，需要的是优胜劣汰，而不是“价低者得”。只有对技术的不断创新，才能造出飞机大炮。

　　领跑“感知网络安全态势”核心技术，用大数据“看见安全”

　　“没有意识到风险是最大的风险。”习总书记对网络安全的这段论述非常精到，“网络安全具有很强的隐蔽性，一个技术漏洞、安全风险可能隐藏几年都发现不了，结果是‘谁进来了不知道、是敌是友不知道、干了什么不知道’，长期‘潜伏’在里面，一旦有事就发作了。维护网络安全，首先要知道风险在哪里，是什么样的风险，什么时候发生风险，正所谓‘聪者听于无声，明者见于未形’。 感知网络安全态势是最基本最基础的工作。” 感知网络安全态势是新兴技术，它包含漏洞挖掘技术、网络攻击技术、软件样本行为分析技术以及由网络地址解析数据库、网络访问日志数据库、文件黑白名单数据库等组成大数据系统与分析技术，它是传统安全+互联网+大数据。

　　360是全球最大的互联网安全公司，在网络安全态势感知上有得天独厚的优势，所以有条件在这个核心技术领域领跑。去年12月，在乌镇的世界互联网大会上，360展示的拥有数百项专利的“网络威胁态势感知地图”，利用可视化的技术，可以自动看见APT攻击和未知威胁，习总书记在地图前详细了解了有关技术，给予了好评并对未来发展提出了殷切期望。

　　经过10年发展，360在国内的手机和PC用户覆盖率达到96.1%，这13亿个终端，能敏感地感知互联网上发生的风吹草动，加上我们独有的样本库、主防库、互联网域名信息库、漏洞库、第三方数据源等，构成了全球最大的网络安全大数据库。结合上述大数据和领先的分析能力，我们建成了全球首个未知威胁发现和溯源系统。截至目前，360已发现了20多起APT事件，持续分析跟踪其中16起确认为针对科技、教育、能源和交通多个领域的定向攻击活动。下一步，我们还要加大国际化步伐，进一步“走出去”。

　　习总书记倡导：“要建立政府和企业网络安全信息共享机制，在数据开放、信息共享方面，要加强论证，该统的可以统起来，发挥1+1大于2的效应，以综合运用各方面掌握的数据资源，加强大数据挖掘分析，更好感知网络安全态势，做好风险防范。”

　　感知能力靠数据、靠技术，靠对抗能力，还要靠规模，靠协作。按照总书记数据开放、信息共享的倡导，把这些做好了，将更有利于龙头企业的成长，我们也更有信心保持感知网络安全态势这一核心技术的领跑优势。

责任编辑：樊英武

我要反馈
保存网页
中国网