2026年实用网络安全提升指南

Markets & Mayhem 2026-10-26 45.1 KB 174.6K 882 𝕏 文章列表

本文是一份面向初学者和专业运维人员的网络安全实用指南，基于2026年Verizon数据泄露调查报告等权威数据，按攻击者入侵路径依次介绍关键防护措施：密码管理、多因素认证、补丁更新、网络分段、备份及电话身份验证。文章指出漏洞利用已首次超过凭证窃取成为最常见入侵方式，勒索软件占数据泄露的48%。作者强调最有效的防护往往简单廉价却常被忽视，如使用密码管理器、启用MFA（可降低99%以上账户入侵风险）、优先采用Passkey和硬件安全密钥等防钓鱼方案，并纠正了定期换密码等过时建议。

网络安全密码管理多因素认证 Passkey 勒索软件数据泄露补丁管理 NIST 安全指南

# A Practical Guide to Improving Your Security in 2026 **作者**: Markets & Mayhem **日期**: 2026-10-24T16:39:25.000Z **来源**: [https://x.com/Mayhem4Markets/status/2114034035542352190](https://x.com/Mayhem4Markets/status/2114034035542352190) --- ![Image](/doc/8890/image/img_8683cf701003.jpg) Passwords, patching, segmentation, backups, and a way to check who is really on the phone. A practical guide for beginners and for people who run networks for a living. Most successful attacks do not need a novel exploit. They use a password that was reused, a server that was not patched, or a person who was hurried. The controls that stop them are unglamorous, cheap, and routinely skipped. This guide covers those controls in the order an attacker meets them: credentials, software, the network, the device, and the people who approve the payment. It is written so a beginner can follow it start to finish, and detailed enough that someone who runs infrastructure for a living can use it as a checklist. ## Start with how attacks actually work The 2026 Verizon Data Breach Investigations Report found that vulnerability exploitation has overtaken stolen credentials as the most common way attackers get into a network. Exploitation accounted for 31% of breaches in that dataset, while credential abuse, the previous leader, fell to 13%. It is the first time credential theft has lost the top spot in the report's 19-year history. The same dataset shows how slowly organizations respond. Only 26% of vulnerabilities on CISA's Known Exploited Vulnerabilities list had been fully remediated across 13,000 organizations, down from 38% the year before, and the median time from detection to full remediation rose from 32 days to 43. Ransomware accounted for 48% of breaches, up from 44%, and 69% of victims did not pay. Third-party involvement rose 60% year on year and now appears in nearly half of all breaches. Those findings point to a small set of chokepoints: identity, patching, network reachability, and human verification. The Known Exploited Vulnerabilities catalog makes the scale concrete. As of October 23, 2026, it contained 1,756 entries, 272 of them added during 2026, and 361 flagged as used in known ransomware campaigns. These are flaws attackers actually used, not theoretical ones. A threat model is just three questions. What do I have that someone wants? Who would want it? What happens if they get it? For a household, the answers are usually money, email, photos, and identity. For a small business, add customer data, payment credentials, and the ability to keep operating. Beginners should assume commodity crime first: automated credential stuffing, phishing kits, and scanning for unpatched services. Advanced readers should add targeted phishing, supply-chain compromise, and insider or departing-employee risk. Perfect security is not available. The realistic goal is to raise the cost of an attack, shorten the time an intruder can operate unnoticed, and make recovery possible without paying. ## Passwords: unique, stored, and rarely rotated Password reuse is the multiplier that turns one breached database into a dozen compromised accounts. Attackers take lists of email and password pairs from one breach and try them against every other service, a technique called credential stuffing. That is why the email account deserves the strongest protection you can give it and every password should be unique. A password manager is the only practical way to have a different long random password for every account. NIST's current digital identity guidelines require verifiers to allow password managers and paste, and explicitly permit autofill. CISA recommends that small businesses require a manager and long, random, unique passwords of at least 16 characters. The manager itself becomes a single point of failure, so protect it with a long passphrase, a second factor, and a printed emergency kit stored somewhere physically secure. NIST sets the length floor: 15 characters for a password used alone, 8 when it is part of multi-factor authentication, and a maximum of at least 64 characters. It also forbids composition rules such as requiring a capital letter, a number, and a symbol, because those rules push people toward predictable patterns. Length and randomness do the work. A five-word passphrase is easier to remember and harder to crack than a short string of substituted characters. The advice to change passwords on a calendar schedule is wrong, and both major standards bodies now say so. NIST states that verifiers "SHALL NOT require subscribers to change passwords periodically," while requiring a forced change when there is evidence of compromise. The UK National Cyber Security Centre is blunter: "Regular password changing harms rather than improves security," because users make minor variations, stolen passwords are exploited immediately, and a reset tells you nothing about whether a compromise occurred. Rotation still has a place. Change a password when a service reports a breach, when someone who had access leaves, when a shared credential has been used by more people than intended, and when you suspect compromise. For everything else, spend the effort on uniqueness and a second factor instead. Breach monitoring closes the loop. Have I Been Pwned lets you check an address against known breaches and subscribe to alerts. Anything that appears there should be treated as compromised everywhere it was reused, and the email account itself should be checked first. The practical order for a beginner is: email, banking, the password manager, then every other account. Turn on the manager's breach alerts. Replace reused passwords as you log in to each site rather than trying to fix everything in one weekend. Advanced users can run a self-hosted vault, keep secrets in an encrypted store outside the browser, scan repositories for committed keys, and give each machine its own credentials rather than copying a personal vault onto a work laptop. ## Multi-factor authentication: the highest return, and its limits Multi-factor authentication is the single control with the clearest measured effect. CISA recommends it for email, banking, and business accounts, not as an optional extra. A Microsoft study of Azure Active Directory accounts found that MFA reduced the risk of compromise by 99.22% across the population and by 98.56% among accounts with known leaked credentials. More than 99.99% of MFA-enabled accounts remained secure during the investigation. Google's earlier study broke the result down by method. An SMS code blocked 100% of automated bots, 96% of bulk phishing attacks, and 76% of targeted attacks. An on-device prompt blocked 100% of bots, 99% of bulk phishing, and 90% of targeted attacks. No user who relied exclusively on security keys fell victim to targeted phishing during the investigation. The hierarchy that follows is not close. Passkeys and hardware security keys resist phishing because the credential is bound to the site's origin and the private key is never sent to the site. The FIDO Alliance, which develops the standard, describes a passkey as usable only on the site where it was created, so a lookalike domain cannot replay it. TOTP codes in an app are a strong second. Push notifications with number matching come next. SMS is better than nothing, but it is vulnerable to SIM swapping and interception. Email codes are the weakest option and should be treated as a last resort. NIST now requires systems at the second assurance level to offer a phishing-resistant option. That is a useful signal for anyone choosing between vendors. Passkeys are spreading, though unevenly. Dashlane's analysis of its own users found passkey authentications nearly doubled year on year to 2.5 million a month, and 57% of users now store at least one. Passkeys still remained a minority of logins on large sites such as Google, PayPal, and Amazon. For personal accounts, a passkey stored in a platform keychain or a hardware key is the best default. MFA is not a force field. Attackers bypass it by exhausting the user with repeated push prompts, by calling the help desk and impersonating the account owner, by porting the phone number, and by placing a reverse proxy between the user and the real login page. That last attack relays the one-time code in real time. All of them target the recovery and enrollment paths around MFA, not the cryptography. The countermeasures are procedural. Turn on number matching where it is offered. Remove SMS and voice call as fallback methods once a stronger method is enrolled. Register two security keys and store one off-site. Keep recovery codes offline. Never approve a prompt you did not initiate, and treat an unexpected MFA prompt as evidence that someone already has your password. For high-value accounts, ask the provider to require a hardware key for recovery changes. Beginners should enable MFA on email, banking, the password manager, social accounts, and any account that can reset the others. Advanced users should push for phishing-resistant authentication in the systems they administer, remove weaker fallbacks, and log help-desk resets as a security event rather than a convenience. ## Patch on a schedule, and stage the risk Exploitation of known vulnerabilities is now the leading way into a network, which makes patching a security control rather than an IT chore. The gap between disclosure and exploitation has compressed to days in many cases, and the KEV catalog exists precisely because attackers reuse flaws that defenders have had time to fix. The default for personal devices should be automatic updates, including the ones that require a restart. Browsers, phone operating systems, and desktop platforms all ship security fixes on a regular cadence, and an unpatched browser is one of the most common entry points for commodity attacks. A device that no longer receives security updates is a permanent liability, not a savings. Applying updates quickly does not mean applying them blindly. The update channel is itself part of the supply chain. The xz Utils backdoor, disclosed in March 2024, was inserted over years by a contributor who gained maintainer trust, and it shipped in development builds of major Linux distributions before it was caught. Vendor update servers have been compromised before. So has the software that performs the update. For organizations, the workable pattern is a pilot ring and a broad ring. Security updates go to a small group first, then everywhere within days. Feature updates wait longer. The goal is to catch a bad release before it reaches every machine without leaving the fleet exposed for months. For individuals, automatic updates with a short deferral window are a reasonable approximation of the same idea. Phones deserve separate attention because people keep them for years after the manufacturer stops shipping patches. Check the supported lifetime before buying, and treat the end of security updates as the end of the device's safe life for banking and email. ## The dependency problem: npm and the software supply chain Modern applications are mostly other people's code. A typical JavaScript project pulls in hundreds of transitive packages, and each one can run code on the developer's machine at install time. That is the attack surface the npm ecosystem has been teaching attackers to use. The Shai-Hulud worm, first seen in September 2025, added a post-install script to popular packages. The script harvested credentials and published them to attacker-controlled GitHub repositories. It also looked for npm tokens in the environment and used them to publish malicious versions of any package it could reach, which is what made it a worm rather than a one-off compromise. A second wave in November 2025 spread across roughly 700 packages and more than 25,000 repositories, exposing secrets from about 350 unique users. The TanStack compromise in May 2026 showed how far the damage travels. Attackers published 84 malicious versions across 42 packages under CVE-2026-45321. Installing one stole GitHub tokens, SSH keys, and cloud credentials from the machine. CrowdSec later reported that about 170 of its private GitHub repositories were copied using a token belonging to an employee who had just left, because his access had been left open. The defenses map onto the stages of that attack. Block install scripts. pnpm version 10 disables post-install scripts in dependencies by default and requires an explicit allow list for packages that genuinely need to build. npm supports ignore-scripts and, in current versions, an allowScripts field in package.json that approves specific dependencies rather than all of them. Most projects do not need arbitrary install scripts. The ones that do should be named. Install from the lockfile. npm ci and the equivalent commands in pnpm and Yarn install exactly what the lockfile records, rather than resolving fresh version ranges. That does not make a malicious release safe, but it stops a compromised transitive dependency from appearing silently between builds. Wait before adopting. npm added minimumReleaseAge in early 2026, a setting that refuses package versions younger than a configured number of days. pnpm has the same control, and Renovate can enforce it across automated dependency updates. A cooldown of three to seven days gives the registry, security vendors, and other users time to notice a bad release. It is the single cheapest defense against the Shai-Hulud pattern, because those packages were removed within hours to days. Check provenance. npm can publish signed provenance statements that bind a package to the source repository and build pipeline that produced it. Provenance is not a guarantee of good behavior, but it raises the cost of impersonating a maintainer and gives responders something to verify. Reduce token privilege. Long-lived npm tokens with publish rights are the worm's fuel. Use short-lived OIDC-based trusted publishing in CI, scope tokens to a single package, and never keep a publish token on a developer laptop. The same rule applies to GitHub, cloud, and registry credentials: a build machine should be able to read what it needs and publish only what it owns. Separate the build from the secrets. Build containers should not hold production database passwords or customer data. If a package executes code during install, the blast radius should be a disposable environment. For Node.js itself, the sensible pattern is long-term support releases and one major version behind the newest. Even-numbered Node releases become LTS; odd-numbered releases do not. Running the newest major on day one buys performance and features at the cost of exposing your build to the least-tested code in the ecosystem. Staggering updates does not eliminate supply-chain risk, and it will not stop a patient attacker who publishes a sleeper package and waits. It does remove the most common failure mode, which is a compromised release that is caught and pulled within a week while your CI installed it in the first hour. ## The network: one door, several rooms A home or small-office network usually has one router doing four jobs: firewall, switch, Wi-Fi access point, and DHCP server. Most of the security work happens in that box, and most of it is configuration rather than hardware. Start with the router's own hygiene. Change the default administrator password, disable remote administration from the internet, turn off WPS, and keep the firmware updated. UPnP is convenient for games and conferencing, and it also lets any device on the network open a hole through the firewall without asking. Turn it off unless something specific needs it, and if it does, restrict the rule to that device. NAT is not a firewall. It hides internal addresses, but it does not inspect traffic or stop a compromised device from reaching the internet. The firewall rule that matters is default-deny inbound, with explicit exceptions. Advanced users should add egress filtering, because most malware needs to call home and a default-deny outbound policy with an allow list breaks a large fraction of commodity attacks. DNS filtering is the most cost-effective network control most people can add. It works by refusing to resolve domains that appear on threat-intelligence blocklists, so a click on a phishing link or a malware command-and-control lookup fails before a connection is made. CISA runs a Protective DNS service for federal agencies on exactly this model, blocking or sinkholing queries that match threat indicators. Consumer equivalents include NextDNS, Quad9, and a local Pi-hole. The limits are real: newly registered domains may not be listed yet, IP-literal links bypass DNS entirely, and an attacker who controls the device can switch resolvers. Treat it as one layer, not a substitute for patching or MFA. Segmentation is the control that limits blast radius. Put guests on a separate SSID with client isolation, so a visitor's infected laptop cannot reach your file server. Put smart TVs, cameras, plugs, and speakers on an IoT network that can reach the internet but not your computers. Keep work machines and personal machines apart. On a consumer router, the guest network is usually enough for guests; IoT isolation often requires a VLAN-capable router or access point. On a prosumer firewall such as OPNsense or pfSense, create separate VLANs and write explicit rules that deny traffic between them, then allow only the specific flows you need. Smart appliances deserve their own paragraph. A cheap camera or plug often has a default password, a cloud dependency, and sometimes no update path. Put it on the IoT network, change the password, disable cloud features where local control exists, and check whether the vendor promises a support lifetime. A device that cannot be updated should not be able to see the rest of your network. The test is simple. From a guest or IoT device, try to reach a computer on the main network by address. If it answers, the segmentation is not working. Advanced users can run an internal scan from each segment and compare results, which turns a configuration belief into evidence. ## Devices, data, and the cloud Phones are the most personal computers people own, and the basics still matter. The NSA's mobile device guidance recommends powering the device off and on weekly, updating software as soon as possible, installing apps only from official stores, and using a six-digit PIN with a wipe-after-ten-failures setting. Rebooting helps because a lot of malware lives only in memory, but it does not remove a sophisticated implant that persists across restarts. Do it anyway. It is free. Remove apps you do not use. Every app is code with permissions, a network connection, and a vendor's update process. Review which apps can access location, microphone, camera, contacts, and photos, and revoke anything that does not need it. Check the connected-apps page of your major accounts for OAuth grants you no longer recognize, because an old integration with read access to your mail is a standing risk. Endpoint protection is worth having and worth not overthinking. Built-in protections on Windows, macOS, and Android cover the common cases, and modern EDR products add behavior detection and response for organizations that need it. Do not stack two antivirus products on one machine. Do enable ransomware-specific protections such as controlled folder access where they are available, and consider application allowlisting for high-risk users, because it stops unknown executables in a way that signature scanning cannot. Full-disk encryption is the control that matters when a device is lost or stolen. FileVault, BitLocker, and LUKS all encrypt the drive so that removing it and mounting it elsewhere yields ciphertext. NIST's storage encryption guidance describes the same principle for end-user devices. Turn it on, escrow the recovery key somewhere you can reach without the device, and test recovery before you need it. Remember the limits: encryption protects data at rest when the machine is powered off or locked. It does not protect an unlocked session, a cold-boot attack against memory, or a device that is seized while running. Removable storage needs the same treatment. A USB stick with client contracts or a backup of your photos should be encrypted with VeraCrypt, LUKS, or an equivalent container, and the passphrase should not be stored with it. For one-off transfers, an encrypted archive with a strong password sent through a different channel is a practical compromise. Cloud storage is where unencrypted data accumulates by accident. Provider-side encryption protects the disk the file sits on, not the file from the provider, from a misconfigured sharing link, or from an attacker who gets into your account. The shared-responsibility model puts access control, sharing configuration, and account security on you. Sync folders are the usual culprit: a folder shared with a client, a link set to "anyone with the link," or an old bucket that was never meant to be public. The practical rule is to encrypt before upload for anything sensitive. A Cryptomator vault, a VeraCrypt container, or a 7-Zip archive with AES-256 and a strong password keeps the contents unreadable to the provider and to anyone who finds a link. It also hides file contents from a compromised account. Filenames and folder structure can still leak unless the whole container is encrypted, so name the container something uninformative. Secrets deserve their own rule. API keys, database passwords, and private keys do not belong in a note, a spreadsheet, a chat message, or a repository. Use a secret manager or the password manager's secure notes, scan repositories for committed keys, and rotate anything that has ever been pasted into a shared document. ## People: deepfakes, trust phrases, and verification The Arup case is the clearest public example of what a cloned voice can do. A staff member in Hong Kong received a message that appeared to come from the firm's CFO about a confidential transaction, then joined a video conference with a fake CFO and several AI-generated colleagues. After the call, the employee transferred about $25 million to five Hong Kong bank accounts. The numbers say this is not an outlier. A 2025 Gartner survey of 302 security leaders found that 62% had experienced at least one deepfake attack in the previous 12 months, with 43% reporting a deepfake audio call and 37% a video call. A Pindrop survey of more than 250 US security leaders found that 74% had encountered a suspected deepfake in the previous year. Among those, one in four reported a single-incident loss above $1 million, and 49% reported losses of $500,000. Pindrop sells voice-authentication technology, so its survey carries a commercial interest in the result, but the direction matches the government and insurance data. Detection by ear is not a control. The FBI warned in May 2025 that cloned voices can sound nearly identical to the person being imitated. Training people to listen for artifacts is training them to fail slowly. A trust phrase is a shared secret that works as a challenge. Each family, team, or friend group agrees on a phrase that is never written in email, text, a chat, or a social post. When a request involves money, credentials, access, or anything irreversible, the requester must supply the phrase, and the responder must ask a question whose answer is not public. The phrase should be rotated after it has been used in a suspicious interaction, and it should not be the same across groups. The phrase is only half the control. The other half is a callback rule: hang up or stop the conversation, then call the person back on a number you already have, not the number that called you. For payments, require a second approver and a known bank account, and treat any change of bank details as a separate verification event. For access requests, use the ticket system rather than the channel the request arrived on. Email verification follows the same logic. Check the full address and the domain, not the display name. Expand the headers if you can and look at the return path and authentication results. DMARC, SPF, and DKIM help receiving systems reject forged mail, but they do not stop a lookalike domain or a compromised account, and NIST's trustworthy email guidance treats them as necessary but incomplete. When a message asks for something unusual, confirm it through a second channel that you initiate. The beginner version is three rules. Slow down when someone creates urgency. Verify through a channel you chose. Never move money on the basis of one conversation. The advanced version adds dual approval for payments, out-of-band verification of bank-detail changes, a documented callback directory, and a deepfake drill that tests whether the policy survives a convincing voice. ## Browsers, email, and messaging The browser is where most work happens, so it deserves more attention than the operating system for many people. Helium is a Chromium-based browser that ships a fork of uBlock Origin with its own filters and CNAME uncloaking, and it is explicit about being in beta. Firefox with uBlock Origin is the more mature version of the same idea. Brave is a third option with built-in blocking. Whichever you choose, keep extensions to a minimum. Every extension can read the pages you visit, and a compromised or sold extension is a direct path into your sessions. Check permissions before installing, remove what you do not use, and use separate browser profiles for banking, work, and casual browsing so that a bad page in one profile cannot see the cookies of another. Chrome's shift to Manifest V3 has weakened content blocking in that browser, and Google's removal of the remaining Manifest V2 workarounds in mid-2026 made the change permanent, which is one reason privacy-focused forks and Firefox remain relevant. Brand loyalty is beside the point. An effective content blocker removes a large share of malvertising and phishing infrastructure before it renders, and the browser you pick should let you run one. Email encryption is the place where good cryptography meets bad usability. S/MIME and OpenPGP are sound protocols, and NIST recommends S/MIME for end-to-end authentication and confidentiality, while noting that its use is not common and that certificate distribution remains a significant challenge. That sentence describes the whole problem: the crypto works, but finding and verifying the right key for the right person does not scale for most people. The practical stack is layered. Use a provider with end-to-end encryption for the mailbox itself, such as Proton Mail or Tuta, and understand that messages to other providers may not be end-to-end encrypted unless you use a password-protected message or a shared secret. For sensitive conversations, use Signal, whose Double Ratchet protocol provides forward secrecy and post-compromise security, and whose design minimizes the metadata the service holds. For files, encrypt the archive and send the password through a different channel. Never send a password and the encrypted file in the same email. TLS between mail servers protects the message in transit, not at rest and not from the provider. That distinction matters when the threat is account takeover, legal process, or a provider breach rather than a network eavesdropper. ## Linux is a better security choice The argument for Linux is real. The code is auditable, the package managers verify signatures, and updates come from a small number of repositories. There is no forced cloud account, and the desktop does not ship the macro-enabled office culture that produces so much Windows malware. For a user who is willing to learn it, a well-configured Linux desktop is a strong choice. The argument has limits, and pretending otherwise weakens it. Auditable is not the same as audited. The xz Utils backdoor was inserted into an open-source project by a contributor who spent years building trust, and it was caught by accident rather than by systematic review. The Linux kernel and its drivers are a large attack surface, desktop fragmentation means security features arrive at different times in different distributions, and many users disable Secure Boot because it interferes with drivers. Fewer endpoint-protection products exist for Linux desktops, antivirus is not the security model the way it is on Windows, and the user is often the system administrator whether they wanted the job or not. Market share changes the risk calculation. StatCounter put desktop Linux at 10.65% in North America in August 2026, while the US government's Digital Analytics Program showed 6.3%, and both figures come with methodological caveats. Growth invites attention. It does not make Linux uniquely dangerous, but it does mean the "nobody attacks Linux desktops" assumption is out of date. Android is the counterexample that proves the model can work: a Linux-based platform where the app store scans for harmful behavior and can disable apps remotely. When the whole stack is engineered together, Linux can be the most secure mass-market mobile platform. A Linux desktop assembled from parts is a different project, and it succeeds or fails on how carefully it is configured. The honest recommendation is conditional. Choose Linux if you will learn the firewall, the update mechanism, disk encryption, sandboxing (Flatpak or similar), and the permission model. Choose a hardened Windows or macOS system if you will not, because an unmaintained Linux install is not safer than a maintained Windows one. In all three cases, the controls that matter are the same: patching, encryption, least privilege, and backups. ## Using AI to audit your own systems A local AI agent can be a useful assistant for security work. It can read firewall rules and explain what they allow, parse authentication logs for anomalies, compare a configuration against a benchmark, draft a hardening script, and explain an error message in plain language. It is good at summarizing large amounts of text and at noticing patterns a tired human misses. It is also a new attack surface. Prompt injection is the top risk in OWASP's LLM Top 10. The project's 2026 agentic security report found it behind most agentic AI security failures in production and mapped it to six of the ten categories in its Top 10 for Agentic Applications. The root cause is architectural: models treat system instructions, user requests, and retrieved text as one stream, so hostile text in a document or web page can carry the same authority as an operator command. The "lethal trifecta" is an agent with access to private data, exposure to untrusted content, and the ability to communicate externally. Real incidents show the pattern. EchoLeak demonstrated a zero-click prompt injection against a production AI assistant. Mandiant documented an accounting agent that entered a runaway loop, made more than 15,000 high-cost API calls in under an hour, and generated about $50,000 in cloud charges. It also described an agent manipulated into cloning internal repositories and pushing them to an external GitHub account because GitHub was on the approved-domain list. The safe pattern is to treat the agent as an untrusted analyst. Give it read-only access to copies of logs and configuration, not to production. Run it in a disposable virtual machine with no credentials and restricted egress. Do not paste secrets into the prompt. Ask for a diff or a report, review it yourself, and apply changes through your normal change process. Cap its spending and log its actions. Start with questions, not commands. For beginners, the best use is tutoring: ask it to explain a setting, walk through a hardening guide, or translate an error. For advanced users, the best use is triage and review, with the agent on a short leash and a human accountable for the result. ## Fire drills, backups, and the first 30 days Backups are the control that turns a ransomware incident into an inconvenience instead of an extinction event. The classic rule is three copies of the data, on two media types, with one off-site. The modern version adds one immutable or offline copy and a restore test that is actually performed rather than assumed. CISA's ransomware guidance is explicit that attackers target accessible backups, because a victim who can restore does not need to pay. That means the backup system needs its own credentials, separate from the domain or cloud account it protects, and at least one copy that is offline or immutable. Cloud object storage with object lock, a tape or external drive kept disconnected, or a second provider with a separate account all satisfy the requirement. A synced folder is not a backup, because ransomware encrypts the sync source and the sync propagates. Encryption belongs on the backup as well as the source. A stolen backup drive should be unreadable, and an off-site copy should be encrypted with a key you control. Keep a retention schedule that matches how far back you might need to go, such as seven daily, four weekly, and twelve monthly copies, and prune on a schedule rather than when the disk fills. Test the restore. A backup that has never been restored is a hypothesis. Restore a file, a folder, and a full system at least quarterly, and record how long it took. The recovery time is the number that matters during an incident, and it is usually longer than people expect. A fire drill is the human equivalent. CISA publishes tabletop exercise packages for ransomware, phishing, and other scenarios, and the UK NCSC runs Exercise in a Box with facilitated scenarios for small organizations. The purpose is to find the places where the plan assumes a decision-maker who is on holiday, a contact list that is out of date, or a communications channel that depends on the system that just went down. A useful drill has five parts: a scenario, a decision log, a communications test, a restore test, and a written list of fixes with owners. Run one for a lost laptop, one for a ransomware encryption event, and one for a fraudulent payment request. The third is the one most organizations skip and the one most likely to be used against them. The first 30 days, for a beginner: Week one. Install a password manager and fix the email, banking, and social accounts. Turn on MFA everywhere it is offered, preferring an app or a passkey over SMS. Turn on automatic updates on every device. Week two. Turn on full-disk encryption and store the recovery key safely. Check phone app permissions and remove what you do not use. Set up breach alerts. Confirm that your phone still receives security updates. Week three. Set up backups with one offline or immutable copy, encrypt them, and restore a test file. Put guests on a separate network and move smart devices off the main one. Turn on DNS filtering. Week four. Write a one-page verification protocol with a trust phrase and a callback rule, and share it with the people who might ask you for money or access. Run a tabletop drill. Check the connected apps on your main accounts and revoke anything you do not recognize. For an advanced reader, add the supply-chain controls (install-script policy, lockfile installs, release cooldown, provenance, scoped tokens), egress filtering, VLAN separation with tested rules, an EDR pilot, and a quarterly restore drill with a measured recovery time. The pattern behind all of it is the same. Attackers look for the cheapest path: a reused password, an unpatched appliance, a person in a hurry. The defenses that work are the ones that remove the cheapest paths and make the remaining ones noisy. Little of this requires a large budget. It requires deciding that the boring controls are worth doing before the incident, not after. ## Glossary Adversary-in-the-middle (AiTM) phishing. A reverse proxy positioned between the user and the real login page, relaying credentials and one-time codes in real time. Backup immutability. A storage setting that prevents deletion or modification for a fixed period, so ransomware cannot encrypt the backup. BitLocker. Microsoft's full-disk encryption feature for Windows. Blocklist. A list of known-bad domains, passwords, or file hashes used to deny access. Credential stuffing. Trying username and password pairs stolen from one breach against other services. DMARC. An email authentication policy that tells receiving servers what to do with mail that fails SPF or DKIM checks. DNS filtering. Refusing to resolve domains that appear on a threat-intelligence blocklist. EDR. Endpoint detection and response. Software that watches for suspicious behavior on a device and can isolate or roll it back. FileVault. Apple's full-disk encryption feature for macOS. FIDO2 / passkey. A phishing-resistant authentication standard using public-key cryptography, bound to the site's origin. Full-disk encryption (FDE). Encrypting an entire storage device so its contents are unreadable without the key. Identity provider (IdP). The service that authenticates users and issues tokens for other applications. IoT. Internet of Things. Networked devices such as cameras, plugs, thermostats, and TVs. KEV. CISA's Known Exploited Vulnerabilities catalog, a list of flaws attackers are actually using. Least privilege. Giving an account or process only the access it needs for its task. Lockfile. A file that records the exact versions of dependencies a project installed. LUKS. The standard Linux disk-encryption format. MFA. Multi-factor authentication. Requiring two or more independent factors to sign in. MFA fatigue. Repeated push prompts sent until a user approves one out of annoyance or confusion. Minimum release age (cooldown). A package-manager setting that refuses versions newer than a configured number of days. NAT. Network address translation. It hides internal addresses but is not a firewall. North-south traffic. Traffic entering or leaving a network, as opposed to east-west traffic between internal systems. Passphrase. A password made of several words, easier to remember and longer than a typical password. Prompt injection. Hostile text placed where a model will read it, causing it to follow attacker instructions instead of the operator's. Provenance. A signed record tying a software artifact to its source repository and build process. Ransomware. Malware that encrypts data and demands payment for the key. Secure Boot. A firmware feature that verifies the bootloader's signature before running it. Segmentation / VLAN. Dividing a network into isolated segments so a compromise in one cannot reach another. SIM swapping. Convincing a mobile carrier to move a phone number to an attacker-controlled SIM, intercepting SMS codes. S/MIME and OpenPGP. Standards for encrypting and signing email. Tabletop exercise. A discussion-based drill that walks a team through a simulated incident. TOTP. Time-based one-time password, the six-digit codes generated by authenticator apps. Trust phrase. A shared secret used to confirm identity during a call or message, never transmitted in writing. UPnP. Universal Plug and Play, a protocol that lets devices open firewall ports automatically. Zero-day. A vulnerability that is exploited before a fix is available. ## Where to learn more Government guidance, free and maintained: - CISA cyber guidance for small businesses: [https://www.cisa.gov/cyber-guidance-small-businesses](https://www.cisa.gov/cyber-guidance-small-businesses) - CISA Known Exploited Vulnerabilities catalog: [https://www.cisa.gov/known-exploited-vulnerabilities-catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) - CISA tabletop exercise packages: [https://www.cisa.gov/resources-tools/services/cisa-tabletop-exercise-packages](https://www.cisa.gov/resources-tools/services/cisa-tabletop-exercise-packages) - CISA StopRansomware guide: [https://www.cisa.gov/stopransomware/ransomware-guide](https://www.cisa.gov/stopransomware/ransomware-guide) - UK NCSC top tips: [https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online](https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online) - UK NCSC Exercise in a Box: [https://www.ncsc.gov.uk/section/exercise-in-a-box/overview](https://www.ncsc.gov.uk/section/exercise-in-a-box/overview) - NSA mobile device best practices: [https://media.defense.gov/2021/Sep/16/2002855921/-1/-1/0/MOBILE_DEVICE_BEST_PRACTICES_FINAL_V3%20-%20COPY.PDF](https://media.defense.gov/2021/Sep/16/2002855921/-1/-1/0/MOBILE_DEVICE_BEST_PRACTICES_FINAL_V3 - COPY.PDF) - NIST SP 800-63B-4, Digital Identity Guidelines: [https://pages.nist.gov/800-63-4/sp800-63b.html](https://pages.nist.gov/800-63-4/sp800-63b.html) - NIST SP 800-177r1, Trustworthy Email: [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-177r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-177r1.pdf) Standards and project documentation: - CIS Critical Security Controls: [https://www.cisecurity.org/controls/v8](https://www.cisecurity.org/controls/v8) - OWASP Top 10 for LLM Applications: [https://genai.owasp.org/llmrisk/llm01-prompt-injection/](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) - FIDO Alliance passkeys: [https://fidoalliance.org/passkeys/](https://fidoalliance.org/passkeys/) - pnpm supply-chain guidance: [https://pnpm.io/supply-chain-security](https://pnpm.io/supply-chain-security) - npm documentation: [https://docs.npmjs.com/](https://docs.npmjs.com/) - Node.js release schedule: [https://nodejs.org/en/about/previous-releases](https://nodejs.org/en/about/previous-releases) - Signal specifications: [https://signal.org/docs/](https://signal.org/docs/) - Helium browser: [https://github.com/imputnet/helium](https://github.com/imputnet/helium) Tools and checks: - Have I Been Pwned: [https://haveibeenpwned.com/](https://haveibeenpwned.com/) - NextDNS: [https://nextdns.io/](https://nextdns.io/) - Quad9: [https://www.quad9.net/](https://www.quad9.net/) - Pi-hole: [https://pi-hole.net/](https://pi-hole.net/) - Cryptomator: [https://cryptomator.org/](https://cryptomator.org/) - VeraCrypt: [https://www.veracrypt.fr/](https://www.veracrypt.fr/) - OPNsense: [https://opnsense.org/](https://opnsense.org/) - Privacy Guides: [https://www.privacyguides.org/](https://www.privacyguides.org/) Books and longer courses, for readers who want depth: - Ross Anderson, Security Engineering (free online edition): [https://www.cl.cam.ac.uk/~rja14/book.html](https://www.cl.cam.ac.uk/~rja14/book.html) - NIST Cybersecurity Framework: [https://www.nist.gov/cyberframework](https://www.nist.gov/cyberframework) - CISA Learning: [https://www.cisa.gov/learn](https://www.cisa.gov/learn) ## 相关链接 - [Markets & Mayhem](https://x.com/Mayhem4Markets) - [@Mayhem4Markets](https://x.com/Mayhem4Markets) - [170K](https://x.com/Mayhem4Markets/status/2114034035542352190/analytics) - [https://www.cisa.gov/cyber-guidance-small-businesses](https://www.cisa.gov/cyber-guidance-small-businesses) - [https://www.cisa.gov/known-exploited-vulnerabilities-catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) - [https://www.cisa.gov/resources-tools/services/cisa-tabletop-exercise-packages](https://www.cisa.gov/resources-tools/services/cisa-tabletop-exercise-packages) - [https://www.cisa.gov/stopransomware/ransomware-guide](https://www.cisa.gov/stopransomware/ransomware-guide) - [https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online](https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online) - [https://www.ncsc.gov.uk/section/exercise-in-a-box/overview](https://www.ncsc.gov.uk/section/exercise-in-a-box/overview) - [https://media.defense.gov/2021/Sep/16/2002855921/-1/-1/0/MOBILE_DEVICE_BEST_PRACTICES_FINAL_V3%20-%20COPY.PDF](https://media.defense.gov/2021/Sep/16/2002855921/-1/-1/0/MOBILE_DEVICE_BEST_PRACTICES_FINAL_V3%20-%20COPY.PDF) - [https://pages.nist.gov/800-63-4/sp800-63b.html](https://pages.nist.gov/800-63-4/sp800-63b.html) - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-177r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-177r1.pdf) - [https://www.cisecurity.org/controls/v8](https://www.cisecurity.org/controls/v8) - [https://genai.owasp.org/llmrisk/llm01-prompt-injection/](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) - [https://fidoalliance.org/passkeys/](https://fidoalliance.org/passkeys/) - [https://pnpm.io/supply-chain-security](https://pnpm.io/supply-chain-security) - [https://docs.npmjs.com/](https://docs.npmjs.com/) - [https://nodejs.org/en/about/previous-releases](https://nodejs.org/en/about/previous-releases) - [https://signal.org/docs/](https://signal.org/docs/) - [https://github.com/imputnet/helium](https://github.com/imputnet/helium) - [https://haveibeenpwned.com/](https://haveibeenpwned.com/) - [https://nextdns.io/](https://nextdns.io/) - [https://www.quad9.net/](https://www.quad9.net/) - [https://pi-hole.net/](https://pi-hole.net/) - [https://cryptomator.org/](https://cryptomator.org/) - [https://www.veracrypt.fr/](https://www.veracrypt.fr/) - [https://opnsense.org/](https://opnsense.org/) - [https://www.privacyguides.org/](https://www.privacyguides.org/) - [https://www.cl.cam.ac.uk/~rja14/book.html](https://www.cl.cam.ac.uk/~rja14/book.html) - [https://www.nist.gov/cyberframework](https://www.nist.gov/cyberframework) - [https://www.cisa.gov/learn](https://www.cisa.gov/learn) - [Upgrade to Plus](https://x.com/i/premium_sign_up) - [12:39 AM · Oct 25, 2026](https://x.com/Mayhem4Markets/status/2114034035542352190) - [170.5K Views](https://x.com/Mayhem4Markets/status/2114034035542352190/analytics) - [View quotes](https://x.com/Mayhem4Markets/status/2114034035542352190/quotes) --- *导出时间: 2026/10/26 11:19:48* --- ## 中文翻译 # 2026年提升安全防护实用指南 **作者**： Markets & Mayhem **日期**： 2026-10-24T16:39:25.000Z **来源**： [https://x.com/Mayhem4Markets/status/2114034035542352190](https://x.com/Mayhem4Markets/status/2114034035542352190) **阅读**： 170K **点赞**： 863 **转发**： 135 **回复**： 44 --- ![Image](/doc/8890/image/img_8683cf701003.jpg) 密码、补丁、网络分段、备份，以及核实电话另一端真实身份的方法。这是一份面向初学者和以维护网络为业的从业者的实用指南。大多数成功的攻击并不需要新颖的漏洞利用。它们利用的是被重复使用的密码、未打补丁的服务器，或者一个匆忙行事的人。阻止这些攻击的控制措施并不光鲜、成本低廉，却经常被跳过。本指南按照攻击者遭遇这些措施的先后顺序展开：凭据、软件、网络、设备，以及批准付款的人。本指南写得让初学者能从头到尾跟得上，同时足够详细，让专业的基础设施运维人员可以把它当作检查清单使用。 ## 首先了解攻击的实际运作方式 2026年Verizon数据泄露调查报告发现，漏洞利用已经超过窃取凭据，成为攻击者进入网络的最常见方式。在该数据集中，漏洞利用占泄露事件的31%，而此前居首位的凭据滥用降至13%。这是该报告19年历史上凭据窃取首次失去榜首位置。同一数据集还显示了各组织的响应速度有多慢。在13,000个组织中，CISA“已知被利用漏洞”清单上的漏洞只有26%被完全修复，低于前一年的38%，而从检测到完全修复的中位时间从32天上升到43天。勒索软件占泄露事件的48%，高于此前的44%，其中69%的受害者没有支付赎金。第三方参与的案件同比上升60%，如今几乎出现在一半的泄露事件中。这些发现指向少数几个关键控制点：身份、补丁、网络可达性和人工核实。 “已知被利用漏洞”目录让这一规模变得具体。截至2026年10月23日，该目录包含1,756条记录，其中272条是2026年新增的，361条被标记为在已知勒索软件活动中被使用。这些是攻击者真正利用过的漏洞，而不是理论上的漏洞。威胁模型只需回答三个问题。我有什么是别人想要的？谁会想要它？如果他们得到了会发生什么？对家庭用户来说，答案通常是钱、电子邮件、照片和身份。对小企业来说，还要加上客户数据、支付凭据，以及持续运营的能力。初学者应首先假设自己面对的是普遍性犯罪：自动化撞库攻击、网络钓鱼工具包，以及对未打补丁服务的扫描。高级读者还应考虑定向钓鱼、供应链攻击，以及内部人员或离职员工的风险。完美的安全并不存在。现实的目标是提高攻击成本，缩短入侵者可以不被察觉地活动的时间，并确保在不支付赎金的情况下也能恢复。 ## 密码：唯一、妥善保存，且很少更换密码重复使用是一个放大器，它能把一个被泄露的数据库变成十几个失陷账户。攻击者从一次泄露中获取电子邮件和密码配对列表，然后到所有其他服务上逐个尝试，这种技术叫做撞库攻击。这就是为什么电子邮件账户值得你给它最强有力的保护，而且每个密码都应当是唯一的。密码管理器是让每个账户都拥有不同的长随机密码的唯一实用方法。NIST现行的数字身份指南要求验证方允许使用密码管理器和粘贴功能，并明确允许自动填充。CISA建议小企业要求员工使用密码管理器，以及至少16个字符的、长且随机唯一的密码。密码管理器本身会成为单点故障，因此要用一个长口令、第二因素加以保护，并打印一份应急工具包存放在物理上安全的地方。 NIST设定了长度下限：单独使用的密码为15个字符，作为多因素认证一部分时为8个字符，最长至少允许64个字符。它还禁止使用组成规则，比如要求包含大写字母、数字和符号，因为这些规则会把人推向可预测的模式。长度和随机性才是关键。一个五个单词的口令短语比一串字符替换的短密码更容易记忆，也更难破解。按日历周期定期更换密码的建议是错误的，现在两大标准机构都这样认为。NIST指出，验证方“不得要求用户定期更改密码”，但在有证据表明失陷时要求强制更改。英国国家网络安全中心则更加直白：“定期更改密码损害而不是提升安全性”，因为用户只会做细微变化，被窃取的密码会被立即利用，而且重置密码并不能告诉你是否真的发生了失陷。定期轮换仍有其用武之地。当服务报告泄露时、当有访问权限的人离开时、当共享凭据被超出预期范围的人使用时，以及当你怀疑失陷时，应当更改密码。其他情况下，把精力花在唯一性和第二因素上。泄露监控可以闭环。Have I Been Pwned让你可以检查某个地址是否出现在已知泄露中，并订阅警报。任何出现在那里的内容都应被视为在其被重复使用的所有地方均已失陷，而电子邮件账户本身应当首先检查。初学者的实际顺序是：电子邮件、银行、密码管理器，然后是其他所有账户。开启密码管理器的泄露警报。在登录每个网站时替换重复使用的密码，而不是试图在一个周末内修复所有问题。高级用户可以运行自托管的密码库，把机密保存在浏览器之外的加密存储中，扫描代码仓库中被提交的密钥，并为每台机器分配独立的凭据，而不是把个人密码库复制到工作笔记本上。 ## 多因素认证：回报最高，也有其局限多因素认证是经过测量的效果最明确的单一控制措施。CISA建议将其用于电子邮件、银行和企业账户，而不是可选项。微软对Azure Active Directory账户的一项研究发现，MFA使总体失陷风险降低了99.22%，在已知凭据泄露的账户中降低了98.56%。在调查期间，超过99.99%的启用MFA的账户保持安全。谷歌更早的研究按方法拆解了结果。短信验证码能阻断100%的自动化机器人、96%的大规模钓鱼攻击和76%的定向攻击。设备端提示能阻断100%的机器人、99%的大规模钓鱼和90%的定向攻击。在调查期间，没有任何只依赖安全密钥的用户成为定向钓鱼的受害者。由此得出的层级差距明显。通行密钥（Passkeys）和硬件安全密钥能抵抗钓鱼，因为凭据与网站的源绑定，私钥永远不会发送给网站。制定该标准的FIDO联盟描述说，通行密钥只能在其创建的网站上使用，因此仿冒域名无法重放它。应用中的TOTP验证码是强有力的第二选择。带数字匹配的推送通知次之。短信聊胜于无，但容易受到SIM卡交换和拦截攻击。电子邮件验证码是最弱的选择，应作为最后手段。 NIST现在要求第二保证级别的系统提供抗钓鱼选项。这对任何在供应商之间做选择的人都是一个有用的信号。通行密钥正在普及，尽管并不均衡。Dashlane对其自身用户的分析发现，通行密钥认证同比增长近一倍，达到每月250万次，57%的用户现在至少存储了一个通行密钥。但在Google、PayPal和Amazon等大型网站上，通行密钥仍然只占登录的少数。对于个人账户，存储在平台密钥链或硬件密钥中的通行密钥是最好的默认选择。 MFA不是力场。攻击者通过反复发送推送提示来轰炸用户、致电服务台冒充账户所有者、转移电话号码，以及在用户和真实登录页面之间放置反向代理来绕过MFA。最后那种攻击会实时中继一次性验证码。所有这些攻击都瞄准MFA周围的恢复和注册路径，而不是密码学本身。应对措施是流程性的。在提供数字匹配功能的地方开启它。一旦注册了更强的验证方法，就移除短信和语音通话作为后备方法。注册两把安全密钥，并将其中一把异地存放。把恢复代码保存在离线状态。绝不批准不是你发起的提示，并把意外的MFA提示视为有人已经掌握你密码的证据。对于高价值账户，要求服务商在恢复流程变更时必须使用硬件密钥。初学者应该在电子邮件、银行、密码管理器、社交账户以及任何可以重置其他账户的账户上启用MFA。高级用户应该在其管理的系统中推行抗钓鱼认证，移除较弱的后备方式，并将服务台重置操作记录为安全事件而不是便利服务。 ## 按计划打补丁，并分阶段控制风险对已知漏洞的利用如今是进入网络的首要途径，这使得打补丁成为一项安全控制措施，而不是IT杂务。从披露到被利用的间隔在许多情况下已压缩到数天，而KEV目录的存在正是因为攻击者会重复利用防守者本有时间修复的漏洞。个人设备的默认设置应该是自动更新，包括那些需要重启的更新。浏览器、手机操作系统和桌面平台都按固定的节奏发布安全修复，而未打补丁的浏览器是普遍性攻击最常见的入口之一。一台不再接收安全更新的设备是一个永久的负担，而不是节省。快速应用更新并不意味着盲目应用。更新渠道本身就是供应链的一部分。 xz Utils后门于2024年3月披露，它是由一名花费多年赢得维护者信任的贡献者植入的，在被发现之前已经进入了主要Linux发行版的开发构建中。供应商的更新服务器也曾被入侵过。执行更新的软件同样如此。对于组织而言，可行模式是试点圈和广泛圈。安全更新先推送给一小部分人，然后在数天内推送到所有地方。功能更新等待更久。目标是在糟糕的版本到达每台机器之前发现它，同时又不让整个设备群暴露数月。对个人而言，带短延迟窗口的自动更新是同一思路的合理近似。手机值得单独关注，因为人们在厂商停止提供补丁后仍会使用多年。购买前检查支持的年限，并把安全更新结束之日视为该设备用于银行和电子邮件的安全寿命终点。 ## 依赖问题：npm与软件供应链现代应用程序大部分是别人的代码。一个典型的JavaScript项目会引入数百个传递依赖包，而每一个都可以在安装时在开发者的机器上运行代码。这正是npm生态系统一直在教攻击者使用的攻击面。 Shai-Hulud蠕虫于2025年9月首次出现，它在热门软件包中添加了安装后脚本。该脚本收集凭据并将其发布到攻击者控制的GitHub仓库。它还会在环境中寻找npm令牌，并利用它们发布其所能触达的任何软件包的恶意版本，这正是它成为蠕虫而非一次性失陷事件的原因。2025年11月的第二波攻击扩散到约700个软件包和超过25,000个仓库，暴露了约350个用户的机密。 2026年5月的TanStack失陷事件展示了破坏传播的范围。攻击者在CVE-2026-45321下发布了横跨42个软件包的84个恶意版本。安装其中一个就会从机器上窃取GitHub令牌、SSH密钥和云凭据。CrowdSec后来报告说，约170个其私有GitHub仓库被复制，使用的是一个刚离职员工的令牌，因为他的访问权限没有关闭。防御措施对应于该攻击的各个阶段。阻止安装脚本。pnpm 10版本默认禁用依赖项中的安装后脚本，并对确实需要构建的软件包要求显式允许列表。npm支持ignore-scripts，在当前版本中还支持package.json中的allowScripts字段，可以批准特定依赖项而不是全部。大多数项目并不需要任意的安装脚本。需要的那些应该被明确列出。从锁文件安装。npm ci以及pnpm和Yarn中的等效命令会安装锁文件记录的确切内容，而不是重新解析版本范围。这并不能让恶意版本变得安全，但它能阻止被入侵的传递依赖在两次构建之间悄然出现。采用前先等待。npm在2026年初添加了minimumReleaseAge设置，拒绝发布时间小于配置天数的软件包版本。pnpm有同样的控制，Renovate可以在自动化依赖更新中强制执行。三到七天的冷却期给注册表、安全厂商和其他用户留出发现糟糕版本的时间。这是对抗Shai-Hulud模式最廉价的防御，因为那些软件包在数小时到数天内就被移除了。检查来源。npm可以发布签名的来源声明，将软件包与其源代码仓库和构建流水线绑定。来源证明并不能保证良好行为，但它提高了冒充维护者的成本，并为响应者提供了可验证的内容。降低令牌权限。拥有发布权限的长期npm令牌是蠕虫的燃料。在CI中使用基于OIDC的短期可信发布，将令牌限定在单个软件包范围内，并且绝不在开发者笔记本上保存发布令牌。同样的规则适用于GitHub、云和注册表凭据：构建机器应该能读取它需要的内容，并且只能发布它拥有的内容。将构建与机密分离。构建容器不应保存生产数据库密码或客户数据。如果某个软件包在安装期间执行代码，其影响范围应该是一次性环境。对于Node.js本身，明智的模式是使用长期支持版本，并落后最新版本一个大版本。偶数版本的Node发布成为LTS；奇数版本则不会。在发布首日运行最新的主版本，是以将你的构建暴露给生态系统中测试最少的代码为代价来换取性能和新特性。错开更新并不能消除供应链风险，也无法阻止一个发布休眠软件包然后静待时机的耐心攻击者。但它确实消除了最常见的失败模式：一个被入侵的版本在一周内被发现并撤下，而你的CI却在第一小时就安装了它。 ## 网络：一扇门，多个房间家庭或小型办公网络通常有一个同时承担四项工作的路由器：防火墙、交换机、Wi-Fi接入点和DHCP服务器。大部分安全工作都发生在这个盒子里，而且大部分是配置问题而非硬件问题。从路由器自身的基本维护开始。更改默认管理员密码、禁用来自互联网的远程管理、关闭WPS，并保持固件更新。UPnP对游戏和视频会议很方便，但它也让网络上的任何设备无需询问就能在防火墙上开洞。除非有特定需求，否则请关闭它；如果确有需要，将规则限制在该设备上。 NAT不是防火墙。它隐藏内部地址，但不检查流量，也无法阻止已失陷的设备访问互联网。重要的防火墙规则是默认拒绝入站，并设置显式例外。高级用户应添加出站过滤，因为大多数恶意软件需要回连，而带允许列表的默认拒绝出站策略能瓦解大部分普遍性攻击。 DNS过滤是大多数人都能添加的最具性价比的网络控制。它通过拒绝解析出现在威胁情报黑名单上的域名来工作，因此点击钓鱼链接或恶意软件命令与控制查询会在建立连接之前就失败。 CISA正是按照这一模式为联邦机构运行保护性DNS服务，阻断或沉洞匹配威胁指标的查询。面向消费者的等效产品包括NextDNS、Quad9和本地Pi-hole。其局限性是真实存在的：新注册的域名可能尚未被列入，IP字面量链接完全绕过DNS，而控制了设备的攻击者可以切换解析器。把它当作一层防御，而不是补丁或MFA的替代品。分段是限制影响范围的控制。把访客设备放在启用了客户端隔离的独立SSID上，这样访客被感染的笔记本就无法触达你的文件服务器。把智能电视、摄像头、智能插座和音箱放在一个可以访问互联网但无法访问你电脑的IoT网络上。工作机器和个人机器分开。在消费级路由器上，访客网络通常足以应付访客；IoT隔离通常需要支持VLAN的路由器或接入点。在OPNsense或pfSense等准企业级防火墙上，创建独立的VLAN并编写显式规则拒绝它们之间的流量，然后只允许所需的特定数据流。智能家电值得单独一段。廉价的摄像头或插座通常有默认密码、云依赖，有时根本没有更新途径。把它放在IoT网络上、更改密码、在存在本地控制的情况下禁用云功能，并检查厂商是否承诺支持年限。一台无法更新的设备不应能访问你网络的其他部分。测试很简单。从一台访客或IoT设备上，尝试按地址访问主网络上的一台电脑。如果它有响应，说明分段没有生效。高级用户可以从每个网段运行内部扫描并比较结果，这将配置上的“相信”转化为证据。 ## 设备、数据和云端手机是人们拥有的最私人的计算机，基本要求仍然重要。美国国家安全局（NSA）的移动设备指南建议每周关机再开机一次、尽快更新软件、只从官方商店安装应用，并使用六位数PIN码并设置十次失败后抹除数据。重启之所以有帮助，是因为很多恶意软件只存在于内存中，但它无法移除能在重启后存留的复杂植入物。但还是要重启。这是免费的。卸载你不使用的应用。每个应用都是带有权限、网络连接和厂商更新流程的代码。检查哪些应用可以访问位置、麦克风、摄像头、联系人和照片，并撤销不需要的权限。检查你主要账户的“已连接应用”页面，撤销你不再认识的OAuth授权，因为一个对邮件有读取权限的旧集成就是一个持续存在的风险。终端防护值得拥有，也不必过度纠结。Windows、macOS和Android上的内置防护覆盖了常见情况，而现代EDR产品为需要的组织增加了行为检测和响应功能。不要在一台机器上叠加两个杀毒产品。要启用可用的勒索软件专项防护，如受控文件夹访问，并为高风险用户考虑应用程序白名单，因为它能以签名扫描无法做到的方式阻止未知可执行文件。全盘加密是设备丢失或被盗时起作用的控制措施。FileVault、BitLocker和LUKS都会加密硬盘，使得将其取出并在别处挂载只能得到密文。NIST的存储加密指南对终端用户设备描述了同样的原则。开启它，把恢复密钥托管在一个无需该设备即可访问的地方，并在需要之前测试恢复流程。记住其局限：加密保护的是机器关机或锁定时静止的数据。它不保护未锁定的会话、针对内存的冷启动攻击，或在运行中被扣押的设备。可移动存储需要同样的处理。装有客户合同或照片备份的U盘应当用VeraCrypt、LUKS或等效容器加密，口令不应与它存放在一起。对于一次性传输，一个带强密码的加密压缩包通过另一渠道发送密码是一种务实的折中方案。云存储是未加密数据意外累积的地方。服务商端的加密保护的是文件所在的磁盘，而不是让文件对服务商、对配置错误的共享链接或对入侵你账户的攻击者保密。共享责任模型把访问控制、共享配置和账户安全放在你身上。同步文件夹是常见的罪魁祸首：与客户共享的文件夹、设置为“任何有链接的人”的链接，或从未打算公开的旧存储桶。实用规则是，任何敏感内容在上传前先加密。一个Cryptomator保险库、一个VeraCrypt容器，或一个带AES-256和强密码的7-Zip压缩包，可以让内容对服务商和任何发现链接的人都不可读。它还能在账户失陷时隐藏文件内容。文件名和文件夹结构仍可能泄露，除非整个容器被加密，所以给容器起一个无信息量的名字。机密信息有它自己的规则。API密钥、数据库密码和私钥不应放在笔记、电子表格、聊天消息或代码仓库中。使用机密管理器或密码管理器的安全笔记，扫描代码仓库中被提交的密钥，并轮换任何曾被粘贴到共享文档中的内容。 ## 人：深度伪造、信任短语与身份核实 Arup案是克隆声音能做到什么的最清楚的公开案例。香港的一名员工收到一条看似来自该公司首席财务官的关于机密交易的消息，随后参加了一场有假CFO和多名AI生成的同事的视频会议。通话结束后，该员工向五个香港银行账户转账约2,500万美元。数据表明这并非孤立事件。Gartner在2025年对302名安全负责人的调查发现，62%的受访者在过去12个月中经历过至少一次深度伪造攻击，其中43%报告遭遇深度伪造音频通话，37%报告视频通话。 Pindrop对250多名美国安全负责人的调查发现，74%在过去一年中遇到过疑似深度伪造。其中，四分之一的人报告单次损失超过100万美元，49%报告损失达50万美元。Pindrop销售语音认证技术，因此其调查对结果有商业利益，但方向与政府和保险业数据一致。靠耳朵辨别不是一种控制措施。FBI在2025年5月警告说，克隆的声音听起来可能与被模仿的人几乎无异。训练人们去听破绽，是在训练他们慢慢失败。信任短语是一个用作挑战的共享秘密。每个家庭、团队或朋友圈商定一个短语，它绝不出现在电子邮件、短信、聊天或社交帖子中。当请求涉及金钱、凭据、访问权限或任何不可逆的事情时，请求方必须提供该短语，而回应方必须提出一个答案非公开的问题。该短语在可疑互动中使用过之后应当轮换，而且不同群体之间不应相同。短语只是控制措施的一半。另一半是回拨规则：挂断或停止对话，然后用你已有的号码回拨对方，而不是来电号码。对于付款，要求第二审批人和已知的银行账户，并将任何银行信息变更视为单独的核实事件。对于访问请求，使用工单系统而不是请求到达的渠道。电子邮件核实遵循同样的逻辑。检查完整地址和域名，而不是显示名。如果可以，展开邮件头，查看回传路径和认证结果。 DMARC、SPF和DKIM帮助接收系统拒绝伪造邮件，但它们无法阻止仿冒域名或失陷账户，NIST的可信电子邮件指南将其视为必要但不充分。当邮件要求不寻常的事情时，通过你主动发起的第二渠道确认。初学者版本是三条规则。当有人制造紧迫感时放慢速度。通过你选择的渠道核实。绝不基于一次对话就转移资金。高级版本增加付款双人审批、银行信息变更的带外核实、记录在案的回拨目录，以及一次测试策略能否经受住逼真声音的深度伪造演练。 ## 浏览器、电子邮件与即时通讯浏览器是大部分工作发生的地方，因此对许多人来说它比操作系统更值得关注。Helium是一款基于Chromium的浏览器，它自带一个带有自有过滤规则和CNAME去伪装功能的uBlock Origin分支，并明确表示处于测试阶段。Firefox加uBlock Origin是同一思路更成熟的版本。Brave是第三个带内置拦截功能的选项。无论选择哪一款，尽量少装扩展。每个扩展都能读取你访问的页面，一个被入侵或被出售的扩展是进入你会话的直接通道。安装前检查权限，移除不使用的扩展，并为银行、工作和休闲浏览使用独立的浏览器配置文件，这样一个配置文件中的恶意页面无法看到另一个配置文件的Cookie。 Chrome转向Manifest V3削弱了该浏览器的内容拦截能力，而谷歌在2026年年中移除了剩余的Manifest V2变通方案，使这一变化成为永久性的，这是注重隐私的分支浏览器和Firefox仍然重要的原因之一。品牌忠诚度不是重点。一个有效的内容拦截器能在恶意广告和钓鱼基础设施渲染之前移除其中很大一部分，你选择的浏览器应该允许你运行一个。电子邮件加密是良好密码学遭遇糟糕可用性的地方。S/MIME和OpenPGP是健全的协议，NIST建议使用S/MIME实现端到端认证和机密性，同时指出其使用并不普遍，且证书分发仍然是一个重大挑战。这句话概括了整个问题：密码学是有效的，但为正确的人找到并验证正确的密钥对大多数人来说无法规模化。实用的技术栈是分层的。使用为邮箱本身提供端到端加密的服务商，如Proton Mail或Tuta，并了解发送给其他服务商的邮件可能没有端到端加密，除非你使用密码保护消息或共享秘密。对于敏感对话，使用Signal，其Double Ratchet协议提供前向保密和失陷后安全，其设计最小化了服务保存的元数据。对于文件，先加密压缩包，然后通过另一个渠道发送密码。绝不在同一封电子邮件中发送密码和加密文件。邮件服务器之间的TLS保护的是传输中的消息，而不是静态存储的消息，也不能阻止服务商查看。当威胁是账户接管、法律程序或服务商泄露而非网络窃听者时，这一区别很重要。 ## Linux是更好的安全选择支持Linux的理由是真实的。代码可审计，软件包管理器验证签名，更新来自少量仓库。没有强制的云账户，桌面也不会预装那种产生大量Windows恶意软件的启用宏的办公文化。对于愿意学习的用户来说，一台配置良好的Linux桌面是一个强有力的选择。这一论点有其局限，假装没有只会削弱它。可审计不等于已被审计。 xz Utils后门是由一名花费多年建立信任的贡献者植入开源项目的，而且它是被偶然发现的，而非通过系统性审查。Linux内核及其驱动程序是一个庞大的攻击面，桌面碎片化意味着安全功能在不同发行版中到达的时间不同，而且许多用户因为Secure Boot干扰驱动程序而禁用它。面向Linux桌面的终端防护产品较少，杀毒软件不像在Windows上那样是安全模型的一部分，而且无论用户是否想要这份工作，用户往往就是系统管理员。市场份额改变了风险计算。StatCounter的数据显示，2026年8月Linux在北美桌面市场份额为10.65%，而美国政府的数字分析计划显示为6.3%，这两个数字都带有方法论上的注意事项。增长会招来关注。这并不意味着Linux格外危险，但确实意味着“没有人攻击Linux桌面”的假设已经过时了。 Android是证明这一模式可以运作的反例：一个基于Linux的平台，其应用商店会扫描有害行为并能远程禁用应用。当整个技术栈被一起设计时，Linux可以成为最安全的大众市场移动平台。用零件组装的Linux桌面则是另一个项目，其成败取决于配置的细致程度。诚实的建议是有条件的。如果你愿意学习防火墙、更新机制、磁盘加密、沙箱（Flatpak或类似）和权限模型，就选择Linux。如果你不愿意，就选择加固过的Windows或macOS系统，因为无人维护的Linux安装并不比有人维护的Windows更安全。在这三种情况下，起作用的控制措施都是一样的：补丁、加密、最小权限和备份。 ## 用AI审计你自己的系统本地AI代理可以成为安全工作中的有用助手。它可以阅读防火墙规则并解释它们允许了什么，解析认证日志中的异常，将配置与基准进行比较，起草加固脚本，并用通俗的语言解释错误信息。它擅长总结大量文本，并注意到疲惫的人类会遗漏的模式。它也是一个新的攻击面。提示注入是OWASP LLM Top 10中的首要风险。该项目2026年的智能体安全报告发现，它是生产环境中大多数智能体AI安全失败的原因，并将其映射到其智能体应用Top 10中的六个类别。根本原因是架构性的：模型将系统指令、用户请求和检索到的文本视为同一个流，因此文档或网页中的恶意文本可以承载与操作员命令相同的权威。 “致命三要素”是一个拥有私有数据访问权限、暴露于不可信内容、并具备对外通信能力的智能体。真实事件展示了这一模式。EchoLeak演示了针对生产环境AI助手的零点击提示注入。Mandiant记录了一个陷入失控循环的会计智能体，在一小时内进行了超过15,000次高成本API调用，产生了约50,000美元的云费用。它还描述了一个被操纵的智能体，克隆内部仓库并将其推送到外部GitHub账户，因为GitHub在已批准域名列表上。安全的模式是把智能体当作不可信的分析师。给它对日志和配置副本的只读访问权限，而不是生产环境。在没有凭据且出站受限的一次性虚拟机中运行它。不要把机密粘贴到提示中。要求它给出差异或报告，自己审查，然后通过你的正常变更流程应用更改。限制其支出并记录其操作。从提问开始，而不是下命令。对初学者来说，最好的用途是辅导：让它解释一个设置、讲解一份加固指南，或翻译一条错误信息。对高级用户来说，最好的用途是分类和审查，让智能体在短绳上运行，由人对结果负责。 ## 消防演习、备份与最初30天备份是将勒索软件事件从灭绝事件转变为不便事件的控制措施。经典规则是：数据三份副本、两种介质类型、一份异地存放。现代版本增加了一个不可变或离线副本，以及一次真正执行而非想当然的恢复测试。 CISA的勒索软件指南明确指出，攻击者会针对可访问的备份下手，因为能恢复的受害者不需要支付赎金。这意味着备份系统需要自己的凭据，与其所保护的域或云账户分离，并且至少有一份离线或不可变的副本。带对象锁的云对象存储、保持断开连接的磁带或外置硬盘，或使用独立账户的第二家服务商都能满足这一要求。同步文件夹不是备份，因为勒索软件会加密同步源并随同步传播。备份和源数据一样需要加密。被偷走的备份硬盘应当不可读，异地副本应当用你控制的密钥加密。保留一个与你可能需要回溯的时间跨度相匹配的保留计划，例如七份每日、四份每周和十二份每月副本，并按计划清理，而不是等磁盘满了才清理。测试恢复。从未被恢复过的备份只是一个假设。至少每季度恢复一个文件、一个文件夹和一个完整系统，并记录所需时间。恢复时间是在事件发生时真正重要的数字，而且通常比人们预期的更长。消防演习是人工层面的等价物。CISA发布针对勒索软件、钓鱼等场景的桌面演练包，英国NCSC则为小型组织运行带引导场景的Exercise in a Box。其目的是找出计划中那些假设决策者正在度假、联系人列表已过时，或通信渠道依赖于刚刚宕机的系统的地方。一次有用的演练有五个部分：一个场景、一份决策日志、一次通信测试、一次恢复测试，以及一份带责任人的书面修复清单。为丢失笔记本、勒索软件加密事件和欺诈性付款请求各做一次演练。第三种是大多数组织会跳过的，也是最可能被用来对付他们的。初学者的最初30天：第一周。安装密码管理器，修复电子邮件、银行和社交账户。在所有提供MFA的地方开启MFA，优先选择应用或通行密钥而非短信。在每台设备上开启自动更新。第二周。开启全盘加密并安全存放恢复密钥。检查手机应用权限并移除不使用的。设置泄露警报。确认你的手机仍能接收安全更新。第三周。设置备份，包含一份离线或不可变副本，加密备份，并恢复一个测试文件。将访客设备放到独立网络上，将智能设备移出主网络。开启DNS过滤。第四周。撰写一份一页纸的核实协议，包含信任短语和回拨规则，并与可能向你请求金钱或访问权限的人分享。进行一次桌面演练。检查主账户上已连接的应用，撤销你不认识的任何内容。对于高级读者，增加供应链控制（安装脚本策略、锁文件安装、发布冷却期、来源证明、范围受限的令牌）、出站过滤、带已测试规则的VLAN分离、EDR试点，以及每季度测量恢复时间的恢复演练。这一切背后的模式都是一样的。攻击者寻找最便宜的路径：一个重复使用的密码、一台未打补丁的设备、一个匆忙的人。有效的防御是消除最便宜的路径，并让剩余的路径变得“吵闹”。这一切很少需要大预算。它需要的是在事件发生之前，而不是之后，就认定那些乏味的控制措施值得去做。 ## 术语表中间人攻击（AiTM）钓鱼。位于用户和真实登录页面之间的反向代理，实时中继凭据和一次性验证码。备份不可变性。一种存储设置，在固定期限内防止删除或修改，使勒索软件无法加密备份。 BitLocker。微软面向Windows的全盘加密功能。黑名单。用于拒绝访问的已知恶意域名、密码或文件哈希列表。撞库攻击。将从一次泄露中窃取的用户名和密码配对到其他服务上尝试。 DMARC。一种电子邮件认证策略，告知接收服务器如何处理未通过SPF或DKIM检查的邮件。 DNS过滤。拒绝解析出现在威胁情报黑名单上的域名。 EDR。终端检测与响应。监视设备上可疑行为并可隔离或回滚的软件。 FileVault。苹果面向macOS的全盘加密功能。 FIDO2 / 通行密钥。一种抗钓鱼认证标准，使用公钥加密技术，与网站源绑定。全盘加密（FDE）。加密整个存储设备，使其内容在没有密钥的情况下不可读。身份提供商（IdP）。为用户进行身份验证并为其他应用签发令牌的服务。 IoT。物联网。摄像头、插座、恒温器和电视等联网设备。 KEV。CISA的“已知被利用漏洞”目录，列出攻击者实际正在使用的漏洞。最小权限。仅授予账户或进程完成其任务所需的访问权限。锁文件。记录项目安装的依赖项确切版本的文件。 LUKS。标准的Linux磁盘加密格式。 MFA。多因素认证。要求两个或更多独立的因素才能登录。 MFA疲劳。反复发送推送提示，直到用户因恼怒或困惑而批准其中一个。最低发布年龄（冷却期）。软件包管理器的一项设置，拒绝发布时间小于配置天数的版本。 NAT。网络地址转换。它隐藏内部地址，但不是防火墙。南北向流量。进入或离开网络的流量，相对于内部系统之间的东西向流量。口令短语。由多个单词组成的密码，比典型密码更长、更容易记忆。提示注入。放置在模型会读取之处的恶意文本，使其遵循攻击者的指令而不是操作员的指令。来源证明。将软件制品与其源代码仓库和构建过程绑定的签名记录。勒索软件。加密数据并索要赎金以换取密钥的恶意软件。 Secure Boot。一种固件功能，在运行引导加载程序之前验证其签名。分段 / VLAN。将网络划分为隔离的网段，使一个网段的失陷无法波及另一个。 SIM卡交换。说服移动运营商将电话号码转移到攻击者控制的SIM卡上，从而拦截短信验证码。 S/MIME和OpenPGP。用于加密和签名电子邮件的标准。桌面演练。一种基于讨论的演练，带领团队走一遍模拟事件。 TOTP。基于时间的一次性密码，即认证器应用生成的六位数字验证码。信任短语。在通话或消息中用于确认身份的共享秘密，绝不以书面形式传输。 UPnP。通用即插即用，一种允许设备自动打开防火墙端口的协议。零日漏洞。在修复方案可用之前就被利用的漏洞。 ## 延伸学习资源政府指南，免费且持续维护： - CISA小企业网络安全指南： [https://www.cisa.gov/cyber-guidance-small-businesses](https://www.cisa.gov/cyber-guidance-small-businesses) - CISA已知被利用漏洞目录： [https://www.cisa.gov/known-exploited-vulnerabilities-catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) - CISA桌面演练包： [https://www.cisa.gov/resources-tools/services/cisa-tabletop-exercise-packages](https://www.cisa.gov/resources-tools/services/cisa-tabletop-exercise-packages) - CISA StopRansomware指南： [https://www.cisa.gov/stopransomware/ransomware-guide](https://www.cisa.gov/stopransomware/ransomware-guide) - 英国NCSC安全要点： [https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online](https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online) - 英国NCSC Exercise in a Box： [https://www.ncsc.gov.uk/section/exercise-in-a-box/overview](https://www.ncsc.gov.uk/section/exercise-in-a-box/overview) - NSA移动设备最佳实践： [https://media.defense.gov/2021/Sep/16/2002855921/-1/-1/0/MOBILE_DEVICE_BEST_PRACTICES_FINAL_V3%20-%20COPY.PDF](https://media.defense.gov/2021/Sep/16/2002855921/-1/-1/0/MOBILE_DEVICE_BEST_PRACTICES_FINAL_V3 - COPY.PDF) - NIST SP 800-63B-4，数字身份指南： [https://pages.nist.gov/800-63-4/sp800-63b.html](https://pages.nist.gov/800-63-4/sp800-63b.html) - NIST SP 800-177r1，可信电子邮件： [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-177r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-177r1.pdf) 标准与项目文档： - CIS关键安全控制措施： [https://www.cisecurity.org/controls/v8](https://www.cisecurity.org/controls/v8) - OWASP LLM应用Top 10： [https://genai.owasp.org/llmrisk/llm01-prompt-injection/](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) - FIDO联盟通行密钥： [https://fidoalliance.org/passkeys/](https://fidoalliance.org/passkeys/) - pnpm供应链安全指南： [https://pnpm.io/supply-chain-security](https://pnpm.io/supply-chain-security) - npm文档： [https://docs.npmjs.com/](https://docs.npmjs.com/) - Node.js发布计划： [https://nodejs.org/en/about/previous-releases](https://nodejs.org/en/about/previous-releases) - Signal技术规范： [https://signal.org/docs/](https://signal.org/docs/) - Helium浏览器： [https://github.com/imputnet/helium](https://github.com/imputnet/helium) 工具与检查： - Have I Been Pwned： [https://haveibeenpwned.com/](https://haveibeenpwned.com/) - NextDNS： [https://nextdns.io/](https://nextdns.io/) - Quad9： [https://www.quad9.net/](https://www.quad9.net/) - Pi-hole： [https://pi-hole.net/](https://pi-hole.net/) - Cryptomator： [https://cryptomator.org/](https://cryptomator.org/) - VeraCrypt： [https://www.veracrypt.fr/](https://www.veracrypt.fr/) - OPNsense： [https://opnsense.org/](https://opnsense.org/) - Privacy Guides： [https://www.privacyguides.org/](https://www.privacyguides.org/) 书籍与长篇课程，适合想要深入了解的读者： - Ross Anderson，《Security Engineering》（免费在线版）： [https://www.cl.cam.ac.uk/~rja14/book.html](https://www.cl.cam.ac.uk/~rja14/book.html) - NIST网络安全框架： [https://www.nist.gov/cyberframework](https://www.nist.gov/cyberframework) - CISA学习： [https://www.cisa.gov/learn](https://www.cisa.gov/learn) ## 相关链接 - [Markets & Mayhem](https://x.com/Mayhem4Markets) - [@Mayhem4Markets](https://x.com/Mayhem4Markets) - [170K](https://x.com/Mayhem4Markets/status/2114034035542352190/analytics) - [https://www.cisa.gov/cyber-guidance-small-businesses](https://www.cisa.gov/cyber-guidance-small-businesses) - [https://www.cisa.gov/known-exploited-vulnerabilities-catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) - [https://www.cisa.gov/resources-tools/services/cisa-tabletop-exercise-packages](https://www.cisa.gov/resources-tools/services/cisa-tabletop-exercise-packages) - [https://www.cisa.gov/stopransomware/ransomware-guide](https://www.cisa.gov/stopransomware/ransomware-guide) - [https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online](https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online) - [https://www.ncsc.gov.uk/section/exercise-in-a-box/overview](https://www.ncsc.gov.uk/section/exercise-in-a-box/overview) - [https://media.defense.gov/2021/Sep/16/2002855921/-1/-1/0/MOBILE_DEVICE_BEST_PRACTICES_FINAL_V3%20-%20COPY.PDF](https://media.defense.gov/2021/Sep/16/2002855921/-1/-1/0/MOBILE_DEVICE_BEST_PRACTICES_FINAL_V3%20-%20COPY.PDF) - [https://pages.nist.gov/800-63-4/sp800-63b.html](https://pages.nist.gov/800-63-4/sp800-63b.html) - [https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-177r1.pdf](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-177r1.pdf) - [https://www.cisecurity.org/controls/v8](https://www.cisecurity.org/controls/v8) - [https://genai.owasp.org/llmrisk/llm01-prompt-injection/](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) - [https://fidoalliance.org/passkeys/](https://fidoalliance.org/passkeys/) - [https://pnpm.io/supply-chain-security](https://pnpm.io/supply-chain-security) - [https://docs.npmjs.com/](https://docs.npmjs.com/) - [https://nodejs.org/en/about/previous-releases](https://nodejs.org/en/about/previous-releases) - [https://signal.org/docs/](https://signal.org/docs/) - [https://github.com/imputnet/helium](https://github.com/imputnet/helium) - [https://haveibeenpwned.com/](https://haveibeenpwned.com/) - [https://nextdns.io/](https://nextdns.io/) - [https://www.quad9.net/](https://www.quad9.net/) - [https://pi-hole.net/](https://pi-hole.net/) - [https://cryptomator.org/](https://cryptomator.org/) - [https://www.veracrypt.fr/](https://www.veracrypt.fr/) - [https://opnsense.org/](https://opnsense.org/) - [https://www.privacyguides.org/](https://www.privacyguides.org/) - [https://www.cl.cam.ac.uk/~rja14/book.html](https://www.cl.cam.ac.uk/~rja14/book.html) - [https://www.nist.gov/cyberframework](https://www.nist.gov/cyberframework) - [https://www.cisa.gov/learn](https://www.cisa.gov/learn) - [Upgrade to Plus](https://x.com/i/premium_sign_up) - [12:39 AM · Oct 25, 2026](https://x.com/Mayhem4Markets/status/2114034035542352190) - [170.5K Views](https://x.com/Mayhem4Markets/status/2114034035542352190/analytics) - [View quotes](https://x.com/Mayhem4Markets/status/2114034035542352190/quotes) --- *导出时间： 2026/10/26 11:19:48*

相关文档