{"id":30215,"date":"2019-10-31T21:34:16","date_gmt":"2019-10-31T18:34:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/it-gigant-predstavil-servisno-opredelyaemyj-fajrvol\/"},"modified":"2019-10-31T21:34:16","modified_gmt":"2019-10-31T18:34:16","slug":"it-gigant-predstavil-servisno-opredelyaemyj-fajrvol","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/it-gigant-predstavil-servisno-opredelyaemyj-fajrvol","title":{"rendered":"IT gigant p\u0159edstavil slu\u017ebov\u011b definovan\u00fd firewall","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Najde uplatn\u011bn\u00ed v datov\u00fdch centrech a cloudu.<\/h5>\n

\n\"IT<\/a><\/noindex>
\n\/ \u0444\u043e\u0442\u043e Christiaan Colen<\/a><\/noindex> CC BY-SA<\/a><\/noindex><\/i><\/p>\n

Co je to za technologii<\/h2>\n

\nSpole\u010dnost VMware p\u0159edstavila nov\u00fd firewal, kter\u00fd chr\u00e1n\u00ed s\u00ed\u0165 na \u00farovni aplikac\u00ed.<\/p>\n

Infrastruktura modern\u00edch spole\u010dnost\u00ed je postavena na tis\u00edc\u00edch slu\u017eeb propojen\u00fdch do jedn\u00e9 s\u00edt\u011b. To roz\u0161i\u0159uje vektor potenci\u00e1ln\u00edch hackersk\u00fdch \u00fatok\u016f. Klasick\u00e9 firewally jsou schopn\u00e9 chr\u00e1nit p\u0159ed \u00fatoky zven\u010d\u00ed, nicm\u00e9n\u011b se ukazuj\u00ed<\/a><\/noindex> bezmocn\u00e9, pokud se \u00fato\u010dn\u00edk ji\u017e dostal do s\u00edt\u011b.
\n<\/a><\/noindex>
\nSpecialist\u00e9 na kybernetickou bezpe\u010dnost z Carbon Black , \u017ee pokud Google, Apple, Facebook a makl\u00e9\u0159i dat maj\u00ed povoleno prod\u00e1vat osobn\u00ed \u00fadaje klient\u016f bez jejich souhlasu, m\u011bla by m\u00edt tuto mo\u017enost i internetov\u00e1 poskytovatel\u00e9. Av\u0161ak stoj\u00ed za zm\u00ednku, \u017ee na feder\u00e1ln\u00ed \u00farovni<\/a><\/noindex>, \u017ee v 59 % p\u0159\u00edpad\u016f \u00fato\u010dn\u00edci nez\u016fst\u00e1vaj\u00ed u hacku jednoho serveru. Hledaj\u00ed zranitelnosti ve spojen\u00fdch za\u0159\u00edzen\u00edch a \u201epohybuj\u00ed se\u201c po s\u00edti, aby z\u00edskali p\u0159\u00edstup k v\u011bt\u0161\u00edmu mno\u017estv\u00ed dat.<\/p>\n

Nov\u00fd firewal pou\u017e\u00edv\u00e1 algoritmy strojov\u00e9ho u\u010den\u00ed k ur\u010den\u00ed anom\u00e1ln\u00ed aktivity v s\u00edti a v p\u0159\u00edpad\u011b nebezpe\u010d\u00ed o tom informuje administr\u00e1tora.<\/p>\n

Jak to funguje<\/h2>\n

\nFirewall se skl\u00e1d\u00e1<\/a><\/noindex> ze dvou komponent: platformy NSX a syst\u00e9mu detekce hrozeb AppDefense.<\/p>\n

Syst\u00e9m AppDefense odpov\u00edd\u00e1<\/a><\/noindex> za vytv\u00e1\u0159en\u00ed behavior\u00e1ln\u00edho modelu v\u0161ech spu\u0161t\u011bn\u00fdch aplikac\u00ed v s\u00edti. Speci\u00e1ln\u00ed algoritmy strojov\u00e9ho u\u010den\u00ed analyzuj\u00ed \u010dinnost slu\u017eeb a vytv\u00e1\u0159ej\u00ed \"b\u00edl\u00fd seznam\" prov\u00e1d\u011bn\u00fdch \u010dinnost\u00ed. K jeho sestaven\u00ed se tak\u00e9 pou\u017e\u00edvaj\u00ed informace z datab\u00e1ze VMware. Ta se formuje na z\u00e1klad\u011b telemetrie poskytovan\u00e9 z\u00e1kazn\u00edky spole\u010dnosti.<\/p>\n

Tento seznam hraje roli takzvan\u00fdch adaptivn\u00edch bezpe\u010dnostn\u00edch politik, na z\u00e1klad\u011b kter\u00fdch firewal ur\u010duje anom\u00e1lie v s\u00edti. Syst\u00e9m sleduje \u010dinnost aplikac\u00ed a p\u0159i zji\u0161t\u011bn\u00ed odchylek v jejich chov\u00e1n\u00ed pos\u00edl\u00e1 upozorn\u011bn\u00ed oper\u00e1torovi datov\u00e9ho centra. K monitorov\u00e1n\u00ed aktivity se vyu\u017e\u00edvaj\u00ed prost\u0159edky VMware vSphere, tak\u017ee nov\u00fd firewal nevy\u017eaduje instalaci specializovan\u00e9ho softwaru na ka\u017ed\u00fd host.<\/p>\n

Co se t\u00fd\u010de NSX Data Center<\/a><\/noindex>, tedy platforma pro spr\u00e1vu softwarov\u011b definovan\u00fdch s\u00edt\u00ed v datov\u00fdch centrech. Jej\u00edm \u00fakolem je spojit komponenty firewallu do jednotn\u00e9ho syst\u00e9mu a sn\u00ed\u017eit n\u00e1klady na jeho \u00fadr\u017ebu. Zejm\u00e9na syst\u00e9m umo\u017e\u0148uje \u0161\u00ed\u0159it stejn\u00e9 bezpe\u010dnostn\u00ed politiky na r\u016fzn\u00e9 cloudov\u00e9 prost\u0159ed\u00ed.<\/p>\n

Pod\u00edvat se na firewal v akci lze v videu na YouTube kan\u00e1lu VMware<\/a><\/noindex>.<\/p>\n

\"IT
\n\/ \u0444\u043e\u0442\u043e USDA<\/a><\/noindex> PD<\/i><\/p>\n

N\u00e1zory<\/h2>\n

\n\u0158e\u0161en\u00ed nen\u00ed v\u00e1z\u00e1no na architekturu a hardware c\u00edlov\u00e9ho syst\u00e9mu. Lze jej tedy nasadit na multicloudov\u00e9 infrastruktu\u0159e. Nap\u0159\u00edklad z\u00e1stupci spole\u010dnosti IlliniCloud, poskytuj\u00edc\u00ed<\/a><\/noindex> cloudov\u00e9 slu\u017eby st\u00e1tn\u00edm instituc\u00edm, \u0159\u00edkaj\u00ed, \u017ee syst\u00e9m NSX jim pom\u00e1h\u00e1 vyva\u017eovat z\u00e1t\u011b\u017e v s\u00edti a vykon\u00e1v\u00e1 funkce firewallu ve t\u0159ech geograficky vzd\u00e1len\u00fdch datech.<\/p>\n

Z\u00e1stupci IDC , \u017ee pokud Google, Apple, Facebook a makl\u00e9\u0159i dat maj\u00ed povoleno prod\u00e1vat osobn\u00ed \u00fadaje klient\u016f bez jejich souhlasu, m\u011bla by m\u00edt tuto mo\u017enost i internetov\u00e1 poskytovatel\u00e9. Av\u0161ak stoj\u00ed za zm\u00ednku, \u017ee na feder\u00e1ln\u00ed \u00farovni<\/a><\/noindex>, \u017ee po\u010det firem pracuj\u00edc\u00edch s multicloudovou infrastrukturou stabiln\u011b roste. Proto budou \u0159e\u0161en\u00ed, kter\u00e1 zjednodu\u0161uj\u00ed spr\u00e1vu a chr\u00e1n\u00ed distribuovanou infrastrukturu (jako NSX a na n\u011bm postaven\u00fd firewall), u klient\u016f na vzestupu.<\/p>\n

Mezi nev\u00fdhody nov\u00e9ho firewallu odborn\u00edci uv\u00e1d\u011bj\u00ed nutnost nasazen\u00ed softwarov\u011b definovan\u00fdch s\u00edt\u00ed. Takovou mo\u017enost nemaj\u00ed v\u0161echny firmy a datov\u00e1 centra. Nav\u00edc zat\u00edm nen\u00ed jasn\u00e9, jak servisn\u011b definovan\u00fd firewall ovlivn\u00ed v\u00fdkon slu\u017eeb a propustnost s\u00edt\u00ed.<\/p>\n

Spole\u010dnost VMware tak\u00e9 testovala sv\u016fj produkt pouze proti nejb\u011b\u017en\u011bj\u0161\u00edm typ\u016fm \u00fatok\u016f (nap\u0159\u00edklad phishingu). Nen\u00ed jasn\u00e9, jak si syst\u00e9m bude fungovat<\/a><\/noindex> vede v slo\u017eit\u011bj\u0161\u00edch p\u0159\u00edpadech, jako je \u00fatok typu process injection. Zat\u00edm nov\u00fd firewall nedok\u00e1\u017ee s\u00e1m podniknout opat\u0159en\u00ed na ochranu s\u00edt\u011b \u2013 um\u00ed pouze zas\u00edlat ozn\u00e1men\u00ed administr\u00e1torovi.<\/p>\n

Podobn\u00e1 \u0159e\u0161en\u00ed<\/h2>\n

\nVe spole\u010dnosti Palo Alto Networks a Cisco tak\u00e9 vyv\u00edjej\u00ed firewally nov\u00e9 generace, kter\u00e9 chr\u00e1n\u00ed s\u00ed\u0165ovou infrastrukturu po cel\u00e9m obvodu. Tento \u00farove\u0148 ochrany je dosa\u017eeno d\u00edky syst\u00e9m\u016fm hlubok\u00e9 anal\u00fdzy provozu, prevenci pr\u016fnik\u016f (IPS) a virtualizaci priv\u00e1tn\u00edch s\u00edt\u00ed (VPN).<\/p>\n

Prvn\u00ed spole\u010dnost vytvo\u0159il<\/a><\/noindex> platformu, kter\u00e1 zaji\u0161\u0165uje bezpe\u010dnost s\u00ed\u0165ov\u00e9ho prost\u0159ed\u00ed pomoc\u00ed n\u011bkolika specializovan\u00fdch firewall\u016f. Ka\u017ed\u00fd z nich chr\u00e1n\u00ed vyhrazen\u00e9 prost\u0159ed\u00ed \u2014 existuj\u00ed \u0159e\u0161en\u00ed pro mobiln\u00ed s\u00edt\u011b, cloud a virtu\u00e1ln\u00ed stroje.<\/p>\n

Druh\u00fd IT gigant nab\u00edz\u00ed<\/a><\/noindex> hardwarov\u00e9 a softwarov\u00e9 n\u00e1stroje, kter\u00e9 analyzuj\u00ed a filtruj\u00ed provoz na \u00farovni protokol\u016f a funkc\u00ed aplikac\u00ed. V t\u011bchto n\u00e1stroj\u00edch je mo\u017en\u00e9 nastavovat politiky zabezpe\u010den\u00ed a vyu\u017e\u00edvat integrovanou datab\u00e1zi zranitelnost\u00ed a hrozeb pro konkr\u00e9tn\u00ed aplikace.<\/p>\n

O\u010dek\u00e1v\u00e1 se, \u017ee v budoucnu v\u00edce spole\u010dnost\u00ed nab\u00eddne firewally chr\u00e1n\u00edc\u00ed s\u00edt\u011b na \u00farovni slu\u017eeb.<\/p>\n

\nO \u010dem p\u00ed\u0161eme v prvn\u00edm blogu o firemn\u00edm IaaS:<\/p>\n