Auto saved by Logseq
This commit is contained in:
Ryan
parent
143c15d37d
commit
b0f5d49bb1
File diff suppressed because it is too large
Load diff
File diff suppressed because it is too large
Load diff
2406
logseq/bak/pages/总复习2023t1/2023-06-15T09_49_22.624Z.Desktop.md
Normal file
2406
logseq/bak/pages/总复习2023t1/2023-06-15T09_49_22.624Z.Desktop.md
Normal file
File diff suppressed because it is too large
Load diff
2403
logseq/bak/pages/总复习2023t1/2023-06-15T09_49_35.105Z.Desktop.md
Normal file
2403
logseq/bak/pages/总复习2023t1/2023-06-15T09_49_35.105Z.Desktop.md
Normal file
File diff suppressed because it is too large
Load diff
|
|
@ -1548,14 +1548,14 @@
|
|||
collapsed:: true
|
||||
- 如果能实施有效的管理，机会漏斗在一年中可以收集成百上千个机会，这些机会中有些对于企业的其他活动没有意义，因为在多数情况下，有太多的机会要求企业立即去把握。因 此，产品规划流程的第二步就是要选出最有希望的项目。对已有产品领域中新产品机会进行 评价和优先级排序时，需要仔细讨论以下四个基本方面：竞争策略、市场细分、技术曲线和产品平台。·In this step, the organisation is looking to decide which of the projects to pursue·There are four perspectives that can be used to assist in the evaluation and analysis of each of the projects l Competitive strategy l Market segmentation l Technological trajectories l Product platforms 在这么多提交上来的想法和项目中你要进行选择，选择一个好的项目最主要的是看它能不能挣钱。可以从以下四个角度去思考：1.技术曲线：有没有能力做成这个项目 2.产品平台：能不能做成一系列产品 3.市场细分：产品投放到哪，以及市场定位是什么 4.竞争策略：怎么在同类型产品中脱颖而出，占据市场
|
||||
- collapsed:: true
|
||||
* 竞争策略competitive strategy决定了它在市场和产品上针对竞争者的基本运作方法
|
||||
- * ● 技术优势 (technology leadership): 为实施这一策略，企业必须强调新技术的研究和开发，并将其应用到产品开发流程中。 A focus on basic research and development of new technologies
|
||||
- * ● 成本优势 (cost leadership): 这一策略要求企业在生产效率上进行竞争，可以实行规模经济，使用先进的制造方法和低成本的劳动力，或者引入更好的管理生产系统。Competitive focus on production efficiency
|
||||
- * ● 以顾客为中心 (customer focus): 为实施这一策略，企业必须跟新老顾客保持密切联系以评价其需求和偏好的变化。精心设计的产品平台有助于快速开发拥有满足顾客 偏好的新特点或新功能的派生产品。这种策略将造就用来满足不同层次顾客需求的多种产品生产线。 The organisation works closely with customers to assess changing needs and preferences
|
||||
- * ● 模仿策略 (imitative): 这一策略要求紧跟市场趋势，允许竞争者探索每一部分已获成功的新产品。当确定了可行机会之后，企业快速开始模仿成功竞争者的新产品。快速的 发流程对于这一策略的有效实施至关重要When a clear opportunity has been identified and has been successful, the organisation launches a competitive version.
|
||||
- * 市场细分Market Segmentation一般认为顾客属于市场的不同部分。把市场分为不同的部分，使企业能够按照各详细定义的顾客群来考虑竞争者的行动和企业已有产品的市场力度。通过将竞争者的产品和企业自己的产品对应到各个细分市场，企业就可以评价哪些产品机会最好，以揭示出企业自身的(或竞 争者的)产品生产线问题Divide the market into segments in order to be more focused on the customer and competitors
|
||||
- * 技术曲线Technological Trajectories在技术密集型企业，产品规划的关键决策是什么时候在生产线上采用一种新的基本技术。When to shift to implementation of the new technology as part of the core product range
|
||||
- * 产品平台规划Product Platform Planning产品平台是指由一系列产品共享的一整套资产。通常，零件和部件是这些资产中最重要的部分。 一个有效的平台可以更快更容易地制造出许多衍生品，每种产品提供一个特定细分市场所需要的特点和功能由于平台开发项目在时间和资金上的消耗是衍生品开发项目的2～10倍，企业不可能使 每个项目都成为平台开发项目
|
||||
- 竞争策略 competitive strategy 决定了它在市场和产品上针对竞争者的基本运作方法
|
||||
* - ● 技术优势 (technology leadership): 为实施这一策略，企业必须强调新技术的研究和开发，并将其应用到产品开发流程中。 A focus on basic research and development of new technologies
|
||||
* - ● 成本优势 (cost leadership): 这一策略要求企业在生产效率上进行竞争，可以实行规模经济，使用先进的制造方法和低成本的劳动力，或者引入更好的管理生产系统。Competitive focus on production efficiency
|
||||
* - ● 以顾客为中心 (customer focus): 为实施这一策略，企业必须跟新老顾客保持密切联系以评价其需求和偏好的变化。精心设计的产品平台有助于快速开发拥有满足顾客 偏好的新特点或新功能的派生产品。这种策略将造就用来满足不同层次顾客需求的多种产品生产线。 The organisation works closely with customers to assess changing needs and preferences
|
||||
* - ● 模仿策略 (imitative): 这一策略要求紧跟市场趋势，允许竞争者探索每一部分已获成功的新产品。当确定了可行机会之后，企业快速开始模仿成功竞争者的新产品。快速的 发流程对于这一策略的有效实施至关重要 When a clear opportunity has been identified and has been successful, the organisation launches a competitive version.
|
||||
* - 市场细分 Market Segmentation 一般认为顾客属于市场的不同部分。把市场分为不同的部分，使企业能够按照各详细定义的顾客群来考虑竞争者的行动和企业已有产品的市场力度。通过将竞争者的产品和企业自己的产品对应到各个细分市场，企业就可以评价哪些产品机会最好，以揭示出企业自身的(或竞 争者的)产品生产线问题 Divide the market into segments in order to be more focused on the customer and competitors
|
||||
* - 技术曲线 Technological Trajectories 在技术密集型企业，产品规划的关键决策是什么时候在生产线上采用一种新的基本技术。When to shift to implementation of the new technology as part of the core product range
|
||||
* - 产品平台规划 Product Platform Planning 产品平台是指由一系列产品共享的一整套资产。通常，零件和部件是这些资产中最重要的部分。 一个有效的平台可以更快更容易地制造出许多衍生品，每种产品提供一个特定细分市场所需要的特点和功能由于平台开发项目在时间和资金上的消耗是衍生品开发项目的 2 ～ 10 倍，企业不可能使 每个项目都成为平台开发项目
|
||||
- 评 价 全 新 产 品 的 机 会（这个不是四个基本方面里的，但 PPT 里写出来了，应该是指在四个基本方面结束/以外的评估方法）除了已有产品领域的新型产品之外，企业还将面对许多机会，如新的市场或全新技术。 尽管在使用新技术或为进入新市场而进行的产品开发中投入紧缺资源有很大风险，但是这 种投入对于定期更新产品组合是必要的
|
||||
collapsed:: true
|
||||
- ● 市场规模(单位/年 · 平均价格)
|
||||
|
|
@ -1578,36 +1578,36 @@
|
|||
- 技 术 储 备 ：基础技术的稳健性对于规划流程十分重要。 一 种被证实了的、成熟度高的技术可以快速可靠地集成到产品中去。 Technology readiness
|
||||
- 市场准备： 产品上市的顺序决定了最初使用者的购买意图 — — 是先购买低端产品，再买 更高价的产品，还是直接购买价格高的高端产品。 一方面，改进的产品上市太快，会打击紧追产品更新步伐的顾客；另一反面，新品上市太慢会面临落后于竞争者的风险。 Market readiness
|
||||
- 竞 争 ：竞争性产品的预期上市将会加快开发项目的进度。Competition
|
||||
* product planl This is the set of projects approved by the planning processl These are sequenced in time l The plan may include a mix of fundamentally new products, platform projects and derivative projects l The updating of these plans is usually undertaken on a periodic basis e.g. quarterly or annually（这个同样不属于资源分配和时间安排里的两步，但是PPT放上去了）
|
||||
- product planl This is the set of projects approved by the planning processl These are sequenced in time l The plan may include a mix of fundamentally new products, platform projects and derivative projects l The updating of these plans is usually undertaken on a periodic basis e.g. quarterly or annually（这个同样不属于资源分配和时间安排里的两步，但是 PPT 放上去了）
|
||||
- (4)完成项目前期规划 Complete pre-project planning
|
||||
collapsed:: true
|
||||
* 当项目确定下来，但是还未进行物质资源的分配时，就需要进行项目前期规划。这一过程涉及一个小的跨职能团队，通常被称为核心团队 (core team)，分别代表技术、市场、制造和服务部门等多方。¡ After project approval, but before the commitment of resources, a pre-project planning activity takes place¡ This activity involves a small, cross-functional team – the Core Team
|
||||
- 任务陈述（mission statement） #flashcard
|
||||
- * ● 对产品的概括性描述 (用一句话描述):这一描述通常包括产品的主要用途，但要避免包含特定的产品概念。实际上它可以是产品的前景说明。 A brief description of the product
|
||||
- * ● 获益方案 (或称为获益建议， benefit proposition): 这一部分阐述了顾客会购买商品的几个关键原因。Typically includes the key customer benefit of the product
|
||||
- * ● 主要商业目标： 除了支持公司战略的项目目标之外，这些目标通常包括时间、成本和质量目标(如产品的上市时间、预期财务效益和市场份额目标等)。 ¡ The goals which support the corporate strategy ¡ The goals for l Time e.g. timing for product introduction l Cost e.g. desired financial performance l Quality
|
||||
- * ● 产品目标市场： 每一种产品可能会有几个目标市场。任务陈述的这一部分确定了一级市场和二级市场。 Target market for the product Primary and secondary markets that should be considered in the development effort
|
||||
- * ● 指导开发工作的设想和限制： 必须仔细地制定设想，尽管它会限制可能的产品概念范 围，但是它有助于项目管理。有关设想和限制的决策信息可以附加到任务书中。 Assumptions and constraints that guide the development effort
|
||||
- * ● 利益相关者 (stakeholder): 确保开发流程中的细微问题均被考虑到的一种方法是，清楚地列出产品的所有利益相关者，也就是所有受产品成败影响的人群。利益相关者列表以末端使用者(最终的外部顾客)和做出产品购买决定的外部顾客开始，包括企业内 部与产品相关的人，如经销商、服务商和生产部门。利益相关者列表可以提醒团队考 虑被产品影响到的每个人的需求。¡ List all of the product’s stakeholders to ensure that many of the subtle development issues are addressed ¡ The list of stakeholders serves as a reminder for the team to consider the needs of everyone who will be influenced by the product
|
||||
- 当项目确定下来，但是还未进行物质资源的分配时，就需要进行项目前期规划。这一过程涉及一个小的跨职能团队，通常被称为核心团队 (core team)，分别代表技术、市场、制造和服务部门等多方。¡ After project approval, but before the commitment of resources, a pre-project planning activity takes place¡ This activity involves a small, cross-functional team – the Core Team
|
||||
* 任务陈述（mission statement） #flashcard
|
||||
* - ● 对产品的概括性描述 (用一句话描述):这一描述通常包括产品的主要用途，但要避免包含特定的产品概念。实际上它可以是产品的前景说明。 A brief description of the product
|
||||
* - ● 获益方案 (或称为获益建议， benefit proposition): 这一部分阐述了顾客会购买商品的几个关键原因。Typically includes the key customer benefit of the product
|
||||
* - ● 主要商业目标： 除了支持公司战略的项目目标之外，这些目标通常包括时间、成本和质量目标(如产品的上市时间、预期财务效益和市场份额目标等)。 ¡ The goals which support the corporate strategy ¡ The goals for l Time e.g. timing for product introduction l Cost e.g. desired financial performance l Quality
|
||||
* - ● 产品目标市场： 每一种产品可能会有几个目标市场。任务陈述的这一部分确定了一级市场和二级市场。 Target market for the product Primary and secondary markets that should be considered in the development effort
|
||||
* - ● 指导开发工作的设想和限制： 必须仔细地制定设想，尽管它会限制可能的产品概念范 围，但是它有助于项目管理。有关设想和限制的决策信息可以附加到任务书中。 Assumptions and constraints that guide the development effort
|
||||
* - ● 利益相关者 (stakeholder): 确保开发流程中的细微问题均被考虑到的一种方法是，清楚地列出产品的所有利益相关者，也就是所有受产品成败影响的人群。利益相关者列表以末端使用者(最终的外部顾客)和做出产品购买决定的外部顾客开始，包括企业内 部与产品相关的人，如经销商、服务商和生产部门。利益相关者列表可以提醒团队考 虑被产品影响到的每个人的需求。¡ List all of the product’s stakeholders to ensure that many of the subtle development issues are addressed ¡ The list of stakeholders serves as a reminder for the team to consider the needs of everyone who will be influenced by the product
|
||||
- (5)对结果和过程进行反思 Reflect on the results and the process
|
||||
collapsed:: true
|
||||
* 在规划流程的最后一步，团队应该问几个关于评价过程和结果质量的问题。我们推荐的问题是：
|
||||
- ● 机会漏斗收集到各种令人激动的产品机会了吗?
|
||||
- ● 产品规划支持企业的竞争策略吗?
|
||||
- ● 产品规划是否针对企业现在面临的最重要的机遇?
|
||||
- ● 分配给产品开发的资源足以贯彻企业的竞争策略吗?
|
||||
- ● 使有限资源发挥最大作用的方法被充分考虑了吗?例如产品平台的使用、合资，以及 与供应商合作等。
|
||||
- ● 核心团队接受最终任务书的挑战了吗?
|
||||
- ● 任务书的各个部分一致吗?
|
||||
- ● 任务书的假定条件真的必要吗?项目的限制过多吗?开发团队能自由开发最好的产 品吗?
|
||||
- ● 怎样才能改进产品规划流程?
|
||||
- 在规划流程的最后一步，团队应该问几个关于评价过程和结果质量的问题。我们推荐的问题是：
|
||||
* ● 机会漏斗收集到各种令人激动的产品机会了吗?
|
||||
* ● 产品规划支持企业的竞争策略吗?
|
||||
* ● 产品规划是否针对企业现在面临的最重要的机遇?
|
||||
* ● 分配给产品开发的资源足以贯彻企业的竞争策略吗?
|
||||
* ● 使有限资源发挥最大作用的方法被充分考虑了吗?例如产品平台的使用、合资，以及 与供应商合作等。
|
||||
* ● 核心团队接受最终任务书的挑战了吗?
|
||||
* ● 任务书的各个部分一致吗?
|
||||
* ● 任务书的假定条件真的必要吗?项目的限制过多吗?开发团队能自由开发最好的产 品吗?
|
||||
* ● 怎样才能改进产品规划流程?
|
||||
不重视产品开发的公司所面临的的问题
|
||||
● 不能以有竞争力的产品占有足够的目标市场份额。
|
||||
- ● 产品引入市场的时间安排不合理。
|
||||
- ● 总开发能力与所从事的项目数量不匹配。
|
||||
- ● 资源分配不合理， 一些项目人员过多而另外一些却人手不足。
|
||||
- ● 构思错误的项目，启动后又取消。
|
||||
- ● 项目方向经常变动。l ·Inadequate coverage of target markets with competitive products l ·Poor timing of market introductions of products l ·Mismatches between aggregate development capacity and the number of projects pursued l ·Poor distribution of resources, with some projects overstaffed and others understaffed l ·Initiation and subsequent cancellation of illconceived projects l ·Frequent changes in the directions of projects
|
||||
* ● 产品引入市场的时间安排不合理。
|
||||
* ● 总开发能力与所从事的项目数量不匹配。
|
||||
* ● 资源分配不合理， 一些项目人员过多而另外一些却人手不足。
|
||||
* ● 构思错误的项目，启动后又取消。
|
||||
* ● 项目方向经常变动。l ·Inadequate coverage of target markets with competitive products l ·Poor timing of market introductions of products l ·Mismatches between aggregate development capacity and the number of projects pursued l ·Poor distribution of resources, with some projects overstaffed and others understaffed l ·Initiation and subsequent cancellation of illconceived projects l ·Frequent changes in the directions of projects
|
||||
- 产品开发的四种类型 #flashcard
|
||||
collapsed:: true
|
||||
- ● 全新产品 (fundamentally new products): 这类项目涉及全新的产品或生产技术，并由此进入一个新的、不熟知的市场。这种项目本质上存在更大的风险，但是，公司的长期成功可能要依赖从这种重要的项目中获得的经验。New product or production technology for new and unfamiliar markets
|
||||
|
|
@ -1650,11 +1650,11 @@
|
|||
collapsed:: true
|
||||
- **Structure** the needs into #flashcard
|
||||
collapsed:: true
|
||||
- **Must-haves** – *“I wont buy without”*
|
||||
- **Delighters** – *“What an unexpected treat”*
|
||||
- **Linear Satisfiers** – *“The more the merrier”*
|
||||
- **Neutrals** – *“No big deal”*
|
||||
- This is the *Kano* classification
|
||||
- **Must-haves** – _“I wont buy without”_
|
||||
- **Delighters** – _“What an unexpected treat”_
|
||||
- **Linear Satisfiers** – _“The more the merrier”_
|
||||
- **Neutrals** – _“No big deal”_
|
||||
- This is the _Kano_ classification
|
||||
- Consumer needs can be very **elusive**
|
||||
- **Intuitions** are often wrong
|
||||
- Establish the **relative importance** of the needs #flashcard
|
||||
|
|
@ -1739,14 +1739,11 @@
|
|||
- 2. Customer screen - An informal discussion with customers to
|
||||
explain a concept 和客户沟通
|
||||
- collapsed:: true
|
||||
3. Technical screen 在科技实现上咨询第一方和第三方的专家
|
||||
- informal technical discussions with experts
|
||||
- extensive analysis by a 3 rd party
|
||||
- collapsed:: true
|
||||
4. Final screen 最终测试
|
||||
- Involves the use of screening models and computer assessment programs
|
||||
- collapsed:: true
|
||||
5. Business analysis 看下赚不赚钱
|
||||
- preliminary marketing plans,
|
||||
- technical plans,
|
||||
- financial reviews and
|
||||
|
|
@ -1939,7 +1936,7 @@
|
|||
collapsed:: true
|
||||
- ▪ 把示意图中的每个元素都划分到相应的组件中去； 为了控制这些选择的复杂性，可以假定每个元素都形成一个独立的组件，然 后在有利的情况下不断加以合并。为了确定哪些合并是有利的，需要考虑以下因素，这些因 素反映了前文所讨论的产品架构的内涵：
|
||||
collapsed:: true
|
||||
- • ·几何集成与精确性Geometric integration and precision：把示意图中的几个单元集成到一个组件中，会使设计人员更好地 控制这几个单元的实体关系。这样，就能使出于同一组件，需要精确定位或紧密集成 的单元得到最好的设计。 l·Assigning elements to the same chunk allows a single individual or group to control the physical relationships among the elements l ·Elements requiring precise location or close geometric integration can often be best designed if they are part of the same chunk
|
||||
- • ·几何集成与精确性 Geometric integration and precision：把示意图中的几个单元集成到一个组件中，会使设计人员 <20><> 好地 控制这几个单元的实体关系。这样，就能使出于同一组件，需要精确定位或紧密集成 的单元得到最好的设计。 l·Assigning elements to the same chunk allows a single individual or group to control the physical relationships among the elements l ·Elements requiring precise location or close geometric integration can often be best designed if they are part of the same chunk
|
||||
- • ·功能共享 Function sharing： 当一个单独的实体组件可以实现产品的若干功能单元时，这些功能单元最 好集成在一起 When a single physical component can implement several functional elements of the product, these functional elements are best clustered together l For example, an integrated control panel on a car
|
||||
- • ·供应商能力 Capabilities of vendors： 一个可靠的供应商可能具有与产品开发密切相关的某种能力。为了很好 地利用这种能力，开发人员会把那些供应商有制造经验的单元集成到同一个组件中， 并交给供应商生产 ·A trusted vendor may have specific capabilities related to a project l· To best take advantage of such capabilities a team may choose to cluster those elements about which the vendor has expertise into one chunk
|
||||
- • ·设计或技术生产的相似性 Similarity of design or production technology 当两个或更多的功能单元可能用同样的设计或生产技术完 成时，将这些元素集成到同一组件中将会使设计或生产更经济 When two or more functional elements are likely to be implemented using the same design and/or production technology, then incorporating these elements into the same chunk may allow for more economical design and/or production
|
||||
|
|
@ -2127,7 +2124,7 @@
|
|||
- 什么是商业计划
|
||||
collapsed:: true
|
||||
- 你计划进入的市场\
|
||||
- 你对这个市场贡献的独特和引人注目的特点
|
||||
- 你对这个市场贡献的独特 <20><> 引人注目的特点
|
||||
collapsed:: true
|
||||
- 知识产权
|
||||
- 商业模式和财务
|
||||
|
|
@ -2185,219 +2182,6 @@
|
|||
l marketing issues
|
||||
l red tape (bureaucracy)
|
||||
- ## Topic 19
|
||||
- What is Cybersecurity?\n什么是网络安全？
|
||||
Cybersecurity is the application of technologies, processes and controls to protect systems, networks, programs, devices and data from cyber attacks
|
||||
网络安全是应用技术、程序和控制来保护系统、网络、程序、设备和数据免受网络攻击。
|
||||
It aims to reduce the risk of cyber attacks, and protect against the unauthorised exploitation of systems, networks and technologies
|
||||
它的目的是减少网络攻击的风险，并保护系统、网络和技术不被非法利用。
|
||||
Increasingly implemented through laws and regulations
|
||||
越来越多地通过法律和法规来实施
|
||||
Three distinct legal elements: information security, privacy and data protection, and cybercrime
|
||||
三个不同的法律要素：信息安全、隐私和数据保护，以及网络犯罪
|
||||
Information Security信息安全
|
||||
Seeks to protect all information assets, whether in hard copy or in digital form
|
||||
寻求保护所有的信息资产，无论是硬拷贝还是数字形式的信息。
|
||||
Information is one of the most valuable assets
|
||||
信息是最有价值的资产之一
|
||||
Good business practice
|
||||
良好的商业惯例
|
||||
Digital revolution changed how people communicate and conduct business
|
||||
数字革命改变了人们的沟通方式和业务开展方式
|
||||
Digital revolution changed how people communicate and conduct business
|
||||
数字革命改变了人们的沟通方式和业务开展方式
|
||||
Privacy and Data Protection隐私和数据保护
|
||||
Number of different, but related concepts
|
||||
不同但相关的概念的数量
|
||||
Control of personal data
|
||||
个人数据的控制
|
||||
Control = the ability to specify the collection, use, and sharing of their data
|
||||
控制=有能力指定收集、使用和分享他们的数据
|
||||
Personal information – private x publicly available
|
||||
个人信息--私人的x公开的
|
||||
Data privacy are the regulations, or policies, that governs the use of my data when shared with any entity, while data protection is the mechanism — that is, the tools and procedures — to enforce the policy and regulation, including the prevention of unauthorized access or misuse of the data that I agreed to share
|
||||
数据隐私是管理我的数据在与任何实体共享时的使用的法规或政策，而数据保护是执行政策和法规的机制，即工具和程序，包括防止未经授权访问或滥用我同意共享的数据。
|
||||
Information Security x Privacy信息安全x隐私
|
||||
Information security and privacy are closely related, but distinct concepts
|
||||
信息安全和隐私是密切相关的，但又是不同的概念
|
||||
Privacy is an individual’s right to control the use and disclosure of their own personal information
|
||||
隐私是个人控制自己的个人信息的使用和披露的权利。
|
||||
Information security is the process used to keep data private
|
||||
信息安全是用于保护数据隐私的过程
|
||||
Security is the process; privacy is the result
|
||||
安全是过程；隐私是结果
|
||||
Cybercrime网络犯罪
|
||||
Cybercrime is an act that violates the law, by using information and communication technology (ICT) to either target networks, systems, data, websites and/or technology or facilitate a crime
|
||||
网络犯罪是一种违反法律的行为，它利用信息和通信技术（ICT），以网络、系统、数据、网站和/或技术为目标，或为犯罪提供便利。
|
||||
Cybercrime knows no physical or geographic boundaries and can be conducted with less effort, greater ease, and at greater speed and scale than traditional crime
|
||||
网络犯罪不受物理或地理边界的限制，与传统犯罪相比，可以更省力、更容易、更快速、更大规模地进行。
|
||||
Drivers of Cybersecurity网络安全的驱动因素
|
||||
Legal and regulatory法律和监管
|
||||
Growing legal framework establishing safeguarding and information obligation
|
||||
建立保障和信息义务的法律框架不断增强
|
||||
Growing enforcement as a response to ineffective self-regulation
|
||||
作为对无效自律的回应，执法力度不断增强
|
||||
Commercial商业
|
||||
Growing awareness of risk, economic and legal consequences, trustworthiness of business transactions
|
||||
对风险、经济和法律后果、商业交易的可信度的认识不断提高
|
||||
Technical技术
|
||||
With technological innovation comes opportunities as well as risks
|
||||
技术创新带来了机遇，也带来了风险
|
||||
Information Security信息安全
|
||||
Information Security I
|
||||
Processes, procedures and infrastructure to preserve: – confidentiality – integrity, and – availability of information
|
||||
流程、程序和基础设施，以保持 - 信息的保密性 - 完整性，以及 - 可用性
|
||||
Information Security II
|
||||
|
||||
Confidentiality保密性
|
||||
Confidentiality I
|
||||
Confidentiality means that only people with the right permission can access and use information
|
||||
保密性是指只有获得适当许可的人才能访问和使用信息。
|
||||
Protecting information from unauthorised access at all stages of its life cycle
|
||||
保护信息在其生命周期的所有阶段免遭未经授权的访问
|
||||
Information must be created, used, stored, transmitted, and destroyed in ways that protect its confidentiality
|
||||
信息的创建、使用、存储、传输和销毁必须以保护其机密性的方式进行。
|
||||
Confidentiality II
|
||||
Ensuring confidentiality – encryption, access controls
|
||||
确保保密性 - 加密、访问控制
|
||||
Compromising confidentiality – (intentional) shoulder surfing, social engineering; (accidental) publication
|
||||
破坏保密性--（故意）肩上冲浪、社会工程；（意外）发布
|
||||
It may result in identity theft, threats to public safety
|
||||
它可能导致身份被盗，威胁到公共安全
|
||||
Example
|
||||
|
||||
Integrity
|
||||
Integrity means that information systems and their data are accurate
|
||||
完整性意味着信息系统及其数据是准确的
|
||||
Changes cannot be made to data without appropriate permissions
|
||||
没有适当的权限，不能对数据进行更改
|
||||
Ensuring integrity – controls ensuring the correct entry of information, authorization, antivirus
|
||||
确保完整性--确保信息的正确输入、授权、防病毒的控制。
|
||||
Compromising integrity – (intentional) employee or external attacks; (accidental) employee error
|
||||
破坏完整性--（故意的）雇员或外部攻击；（意外的）雇员错误
|
||||
Example
|
||||
|
||||
Authentication认证
|
||||
Specific to integrity and confidentiality considerations
|
||||
具体到完整性和保密性的考虑
|
||||
Authentication is the process of validating the identity of a registered user or process before enabling access to protected networks and systems.
|
||||
认证是在允许访问受保护的网络和系统之前验证注册用户或程序的身份的过程。
|
||||
Analogue : signatures, handwriting, in person attestation, witnesses, notary
|
||||
类比：签名、笔迹、当面证明、证人、公证
|
||||
Digital : username and password, digital signatures, fingerprints or face recognition
|
||||
数字化：用户名和密码、数字签名、指纹或面部识别
|
||||
Availability可利用性
|
||||
Availability is the security goal of making sure information systems are reliable
|
||||
可用性是确保信息系统可靠的安全目标。
|
||||
Data is accessible
|
||||
数据是可以访问的
|
||||
Individuals with proper permission can use systems and retrieve data in a dependable and timely manner
|
||||
拥有适当权限的个人可以使用系统，并以可靠和及时的方式检索数据。
|
||||
Ensuring availability – recovery plans, backup systems
|
||||
确保可用性--恢复计划、备份系统
|
||||
Compromising availability – (intentional) denial of service (DoS) attack, (accidental) outage
|
||||
破坏可用性 - （故意）拒绝服务（DoS）攻击，（意外）中断
|
||||
Example
|
||||
|
||||
Information Security信息安全
|
||||
= Mitigating risks to the trustworthiness of information of corporations and governments by the:=减轻公司和政府的信息可信度的风险，由：
|
||||
Development of strategies and制定战略和
|
||||
Implementation to technologies and procedures in order to preserve its confidentiality, integrity, and availability实施技术和程序，以保护其机密性、完整性和可用性
|
||||
Information Security Key Concepts信息安全的关键概念
|
||||
Risk management as means to justify information security laws = process of listing the all the relevant factors and taking steps to control them where possible
|
||||
风险管理是证明信息安全法的手段=列出所有相关因素并尽可能采取措施控制它们的过程。
|
||||
There are four main concepts: Vulnerabilities ,Threats ,Risks ,Safeguards
|
||||
有四个主要概念： 脆弱性、威胁、风险、保障措施
|
||||
Vulnerabilities 漏洞
|
||||
Vulnerabilities I
|
||||
= weakness or flaw in the information system that can be exploited= 信息系统中可被利用的弱点或缺陷
|
||||
Construction, design mistake建筑、设计错误
|
||||
Flaws in how internal safeguards are used/not used, based on:在如何使用/不使用内部保障措施方面存在缺陷，依据是：
|
||||
People
|
||||
Process
|
||||
Facility 设施
|
||||
Technology
|
||||
Vulnerabilities II
|
||||
People
|
||||
separation of duties principle职责分离原则
|
||||
two or more people need to split a critical task functions两个或两个以上的人需要分担一个关键任务的职能
|
||||
Process
|
||||
flaws in organization’s procedures
|
||||
missing step in a checklist /no checklist
|
||||
failure to apply hardware and software patches
|
||||
= patch is a software/code that updates a program to address security problems=补丁是一种软件/代码，用于更新程序以解决安全问题
|
||||
Vulnerabilities III
|
||||
Facility
|
||||
flaws in physical infrastructure有形基础设施的缺陷
|
||||
fences, locks, CCTV cameras围栏、门锁、闭路电视摄像机
|
||||
Technology
|
||||
design flaws设计缺陷
|
||||
unpatched applications, improperly configured equipment未打补丁的应用程序，配置不当的设备
|
||||
Successful attacks take place when vulnerability is exploited成功的攻击发生在漏洞被利用的时候
|
||||
Threats
|
||||
Threats I
|
||||
= anything that can cause harm to an information system – successful exploits of vulnerabilities=任何能对信息系统造成伤害的东西 - 成功利用漏洞的行为
|
||||
Relationship between a vulnerability and a threat脆弱性和威胁之间的关系
|
||||
An organization does not have sufficient controls to prevent an employee from deleting critical computer files (lack of controls – vulnerability). An employee could delete files by mistake (employee – source of threat) (deleting critical files – threat). If the files are deleted, successful exploit of the vulnerability has taken place. If the file is not recoverable, the incident harms the organizations and its security. Availability is compromised.
|
||||
一个组织没有足够的控制措施来防止员工删除关键的计算机文件（缺乏控制措施--漏洞）。雇员可能会错误地删除文件（雇员-威胁源）（删除关键文件-威胁）。如果文件被删除，就说明已经成功利用了该漏洞。如果文件无法恢复，该事件就会损害组织和它的安全。可用性受到影响。
|
||||
Threats II
|
||||
Human
|
||||
Internal and external, includes well-meaning employees and external attackers内部和外部，包括善意的雇员和外部攻击者
|
||||
Natural
|
||||
uncontrollable events (fire, flood)不可控制的事件（火灾、洪水）
|
||||
Technology and operational
|
||||
operate inside information systems (malicious code, hardware and software failures)在信息系统内部操作（恶意代码、硬件和软件故障）。
|
||||
Physical and environmental – lack of physical securit物理和环境--缺乏实体安全y
|
||||
Accidental or intentional意外或故意的
|
||||
Internal or external attackers内部或外部攻击者
|
||||
Threats III
|
||||
Threats to information, networks, systems have increased对信息、网络、系统的威胁已经增加
|
||||
More devices, more use, more ‘always on’更多的设备，更多的使用，更多的 "永远在线"。
|
||||
More complex networks with greater ‘attack surface’更复杂的网络，有更大的 "攻击面"。
|
||||
Bring your own device (BYOD) means that end points of corporate networks no longer in their control; more points of entry into enterprise networks自带设备（BYOD）意味着企业网络的终端不再受其控制；有更多的点进入企业网络
|
||||
More devices with IoT; smart watches possibly not connected to enterprise authentication systems更多的设备具有物联网功能；智能手表可能没有与企业认证系统相连
|
||||
Attacks have grown more sophisticated攻击已变得更加复杂
|
||||
Sony’s servers wiped after internal communications stolen, but held for months索尼的服务器在内部通信被盗后被抹去，但被扣留了几个月
|
||||
Attacks that take months to achieve goals; undetected需要数月才能实现目标的攻击；未被发现的攻击
|
||||
'Ransomware’ = threat to encrypt data unless paid赎金软件"=威胁要加密数据，除非付费
|
||||
SolarWind cyberattackSolarWind的网络攻击
|
||||
Risks
|
||||
Risks I
|
||||
|
||||
|
||||
Risks II
|
||||
|
||||
|
||||
Risks III
|
||||
|
||||
|
||||
Safeguards
|
||||
Safeguards I
|
||||
= safeguard reduces the harm posed by information security vulnerabilities or threats=保障措施减少信息安全漏洞或威胁所带来的危害
|
||||
|
||||
|
||||
Safeguards II
|
||||
|
||||
Safeguards III
|
||||
Safeguards can be put in place at all layers of the system:保障措施可以在系统的所有层级落实到位：
|
||||
|
||||
可以在系统的所有层实施安全措施 :\n在物理硬件或设备层，例如，通过物理保护服务器机房免受水淹；\n在各种软件层，例如通过安装最新的补丁；\n在网络层，例如通过使用虚拟专用网 (“VPN”)；而且，\n在用户层，确保所有人员接受适当的培训，以识别网络钓鱼电子邮件和其他形式的社会工程。
|
||||
Exercise
|
||||
|
||||
Information Security Management
|
||||
|
||||
有效评估组织的安全需求，评估和选择各种安全产品和策略 将信息分类 确定法律义务 评估漏洞、威胁和风险 保护 有许多挑战 标准的发展
|
||||
ISO/IEC
|
||||
27001
|
||||
|
||||
27001:2022信息安全管理系统 全球最著名的信息安全管理系统标准 (ISMS) 它定义了 ISMS必须满足的要求 该标准为各种规模和各种行业的公司提供了建立、实施、维护和持续改进信息安全管理系统的指导 符合 ISO/IEC 27001标准意味着一个组织或企业已经建立了一个系统来管理与公司拥有或处理的数据的安全性相关的风险
|
||||
|
||||
ISMS规范 从自上而下的角度衡量、监控和控制安全管理的方法 第 2部分定义了一个六步“流程”，本质上是 : 定义安全策略 定义 ISMS的范围 进行风险评估 管理风险 选择要实施的控制目标和控制 准备一份适用性声明
|
||||
27002
|
||||
|
||||
27002:2022信息安全、网络安全和隐私保护—信息安全控制 本文档提供了一套通用信息安全控制参考，包括实施指南 本文档旨在供以下组织使用 : 在基于 ISO/IEC27001的信息安全管理系统 (ISMS)的范围内； 根据国际公认的最佳实践实施信息安全控制； 用于制定特定于组织的信息安全管理准则 确定每项控制的目标、工作原理以及公司如何成功实施
|
||||
Summary
|
||||
|
||||
信息安全是保护信息这一宝贵资产的研究和实践\n信息安全的主要目标是保护信息的机密性、完整性和可用性 (CIA)\n关键的信息安全概念包括漏洞、威胁、风险和安全措施\n实施信息安全的法律义务和激励措施\n标准的重要性
|
||||
- LATER 概率论 (隔了一个周末)
|
||||
collapsed:: true
|
||||
SCHEDULED: <2023-06-19 Mon>
|
||||
|
|
|
|||
Loading…
Reference in a new issue