通过几年甲方安全工作经验，初步总结了几个从局外人视角快速评估甲方安全体系能力，个人会从以下几个方面快速评估甲方安全能力。

1 应用系统

（1）登录接口爆破、验证码刷新问题、无验证码、短信炸弹、邮件炸弹

反映问题：缺少上线流程管控/SDLC流程存在缺陷/安全话语权较低/漏洞发现能力不足。

（2）敏感系统登录无双因素

反映问题：安全话语权较低/安全意识不足。

（3）管理后台对外

反映问题：缺少上线流程管控/SDLC流程存在缺陷/安全话语权较低。

（4）陈旧RCE漏洞未修复

反映问题：缺少漏洞检测和扫描设备/缺少日常渗透测试工作/资产台账不清晰/安全人员意识薄弱。

2 安全建设

（1）waf覆盖率较低

反映问题：安全话语权较低/能力、人员缺失。

（2）waf规则无法识拦截近期POC

反映问题：安全话语权较低/能力、人员缺失。

（3）测试环境互联网暴露

反映问题：安全话语权较低。

（4）漏洞相应速度较慢

反映问题：安全话语权较低/能力、人员缺失。

（5）证书过期

反映问题：安全话语权较低/资产台账不清晰/能力、人员缺失。

3 访问控制

(1)高危端口对外暴露

反映问题：缺少对应流程管控。

(2)内网系统暴露公网

反映问题：缺少对应流程管控。

4 安全意识

(1)弱口令

反映问题：缺少对应流程管控/安全话语权较低。

(2)敏感信息泄露，Github、百度网盘等

反映问题：缺少对应流程管控/缺少安全意识培训。

最后

金融行业以保障业务连续性和稳定性，这里特指券商行业。任何升级和漏洞修复工作可能会破坏连续性和稳定性，变更会导致操作风险，不变更则会出现安全风险。在弱监管时代，安全从业者可能无作为或重汇报，导致整体安全基础能力较弱，实现不通报则不整改，安全风险和操作风险和谐相处。

然而某项重大活动会打破上述平衡，当安全话语权较低时，上述问题很难整改，自下而上推动安全工作是痛苦的也是艰辛的。

无法容忍的习惯改变，登录方式调整，双因素认证，关闭互联网访问的业务系统、密码复杂度的改变，上述变更都会受到业务部门极大的阻力。

无法接受的操作风险，漏洞修复和待升级的补丁较多，如何保证业务连续性和稳定性，对漏洞的理解，补丁的升级、操作系统迁移、高危组件的关停。

无法推动的架构调整，网络架构调整、设备覆盖、waf覆盖、ip封禁，上述变更也会出现极大的业务中断风险。

最后，甲方需要的是解决上述问题的人，而不是提出上述的问题人，如何将变更风险降到最低都是需要技术的沉淀及对IT系统整体的认知，以及最重要的上层领导的支持。技术在日常甲方工作中没有那么重要，只有出了问题的时候才知道技术的必要。时刻保持敬畏之心，负责且审慎尚可苟且。

778 对 “快速评估甲方安全能力”的想法；

  4. Hi, Neaat post. There iis a problem together wit
    ypur web site in web explorer, would check this? IE still is the market chief and a huge component to pople
    will pass ove youjr magnificent writng due to this problem.

    回复

  7. Doees you site have a contact page? I’m having troublee locating it but, I’d like too senmd you ann e-mail.

    I’vegot som creativ ideas for your blog you might be interested iin hearing.
    Either way, greaqt wedbsite andd I look forward to seeing it
    grow oover time.

    回复

  9. Greetings I am soo delighted I found yyour website,
    I relly foundd yoou by accident, hile I was bbrowsing on Aoll for someething else, Nonethelesss I amm hhere noww and would just
    like to say thanks a lot ffor a incredible plst and
    a all round thriilling blog (I lso lovee thee theme/design), I don’t
    hhave time to browese it all aat the minute but
    I have book-marked it annd also ncluded your RSS feeds, sso
    whhen I have ime I wilol be back too read much more, Please do kkeep uup
    the supwrb work.

    回复

  12. My programker is trying too convijce mee to move tto .net from
    PHP. I have always disliked the idewa ecause of the expenses.
    But he’s tryioong none thhe less. I’ve been using Movable-type oon numerous
    websites for about a year andd am concerned aboit switching too anpther platform.

    I hazve heatd vry good things about blogengine.net. Is there a way I can tranmsfer all myy
    wordpress content intyo it? Anny kind of hedlp would be greatly appreciated!

    回复

  16. you’re actully a ecellent webmaster. The sitee loadinbg velocity is incredible.
    It ssort of feels that you are dping anny distinxtive trick.
    Furthermore, Thhe contents aare masterwork. youu have
    done a excelllent taak onn this subject!

    回复

  74. Hi theree everyone, it’s myy first pay a visit at this wweb page, and
    article is actually fruitful desiigned forr me, keep up posging these types of posts.

    回复

  75. Heey there would you mind sharing which blpog
    platform you’re using? I’m looking to start myy own blog
    soon but I’m having a hard time choosing between BlogEngine/Wordpress/B2evolution and
    Drupal. The rewason I ask is because your esign seemks diferent then mlst blogs and I’m looking forr something completely unique.
    P.S My apologies for beihg off-topic but I haad tto ask!

    回复

  125. https://bit.ly/3lc6GuY https://is.gd/JECJVc https://tinyurl.com/2d6kc7z4 https://Cutt.ly/qHvvUAO http://ubezpieczenia-czorny.pl http://E-Ubezpieczenie24.pl/ http://glowackiubezpieczenia.pl/ https://cutt.ly/fHvcKI1 http://stolicaubezpieczen.pl/ https://tinyurl.com/2fwhzur5
    http://westaubezpieczenia.pl https://is.gd/k1omQU http://ubezpieczenia-wodzislaw.pl https://tinyurl.com/2aapzmfd https://cutt.ly/NHvv1ds https://cutt.ly/WHvbrxC https://bit.ly/3wfG3LU https://rebrand.ly/8858bf http://Ubezpieczniewroclaw.pl https://bit.ly/3wpQknI
    tinyurl.com tinyurl.com
    ubezpieczrodzine.pl Bit.ly
    http://ubezpieczenie-przemysl.pl taniubezpieczyciel.pl cutt.ly https://rebrand.ly/171c98
    Is.gd bit.ly is.gd
    rebrand.ly
    tinyurl.com http://noweubezpieczenia.pl cutt.ly tinyurl.com

    回复

  126. https://cutt.ly/wHvviQh https://tinyurl.com/23uu6v8h https://is.gd/4dfpJm https://tinyurl.com/mvan9nm9 http://ubezpieczeniacompensa.pl https://is.gd/q4KLuE https://cutt.ly/yHvve6S https://bit.ly/3N8enOO https://cutt.ly/8Hvbog2 http://ubezpieczenia-nysa.pl
    https://is.gd/CcEK64 https://rebrand.ly/873739 https://Tinyurl.com/377fp3a9 https://rebrand.ly/9c120b https://bit.ly/3whORkw https://is.gd/1mQ4ga https://cutt.ly/FHvcN2Z https://bit.ly/3wfkMCe https://tinyurl.com/5n7kuray https://bit.ly/3MlFoOz
    https://Rebrand.ly/ https://is.gd/V2ceeU rebrand.ly https://rebrand.ly/ http://ubezpieczenia-trojmiasto.pl
    https://tinyurl.com cutt.ly e-ubezpieczeniaonline.pl
    http://ubezpieczenianaraty.pl tinyurl.com rebrand.ly http://E-Ubezpieczeniaonline.pl/ https://cutt.ly/ ubezpieczbowarto.pl is.gd
    https://cutt.ly/fHvcKI1

    回复

  133. https://Rebrand.ly/1de799 https://Bit.ly/3LgekPx https://Bit.ly/3FQqRbj https://Tinyurl.com/bdwazpa2 https://tinyurl.com/4df82cf3 https://cutt.ly/KHvcbmW https://rebrand.ly/1fa74f https://tinyurl.com/5n94dnwr https://rebrand.ly/9ed83b https://tinyurl.com/s6z4b82n
    http://ubezpieczenie-dziecka.pl https://rebrand.ly/44687f https://tinyurl.com/2p8r7bch https://bit.ly/3wgil21 https://cutt.ly/NHvv1ds https://Cutt.ly/tHvvVnv https://bit.ly/3Poipog http://ubezpieczenia-agent.waw.pl https://bit.ly/3weBAt1 https://bit.ly/3FWLPWc
    rebrand.ly bit.ly https://Bit.ly/3FSiwUM Bit.ly
    is.gd cutt.ly tinyurl.com tinyurl.com
    https://is.gd/T3VgAb rebrand.ly ubezpieczeniabb.pl tani-ubezpieczyciel.pl cutt.ly cutt.ly https://bit.ly/3Mll4ge https://is.gd/D3z7r8

    回复