{"id":31004,"date":"2019-10-31T21:38:50","date_gmt":"2019-10-31T18:38:50","guid":{"rendered":"https:\/\/prohoster.info\/blog\/testirovanie-pokazhet-kak-podgotovitsya-k-vnedreniyu-cisco-ise-i-ponyat-kakie-fichi-sistemy-vam-nuzhny\/"},"modified":"2019-10-31T21:38:50","modified_gmt":"2019-10-31T18:38:50","slug":"testirovanie-pokazhet-kak-podgotovitsya-k-vnedreniyu-cisco-ise-i-ponyat-kakie-fichi-sistemy-vam-nuzhny","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/testirovanie-pokazhet-kak-podgotovitsya-k-vnedreniyu-cisco-ise-i-ponyat-kakie-fichi-sistemy-vam-nuzhny","title":{"rendered":"Testov\u00e1n\u00ed uk\u00e1\u017ee: jak se p\u0159ipravit na implementaci Cisco ISE a pochopit, jak\u00e9 funkce syst\u00e9mu pot\u0159ebujete.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Testov\u00e1n\u00ed
\n
\nJak \u010dasto spont\u00e1nn\u011b n\u011bco koup\u00edte po skv\u011bl\u00e9m reklamn\u00edm z\u00e1sahu, a pak to \u017e\u00e1dan\u00e9 zbo\u017e\u00ed le\u017e\u00ed v polici, skladu nebo gar\u00e1\u017ei a\u017e do dal\u0161\u00edho \u00faklidu nebo st\u011bhov\u00e1n\u00ed? V\u00fdsledkem je zklam\u00e1n\u00ed z neodpov\u00eddaj\u00edc\u00edch o\u010dek\u00e1v\u00e1n\u00ed a zbyte\u010dn\u011b utracen\u00fdch pen\u011bz. Je daleko hor\u0161\u00ed, kdy\u017e se n\u011bco podobn\u00e9ho stane v podnik\u00e1n\u00ed. Velmi \u010dasto jsou marketingov\u00e9 triky tak dobr\u00e9, \u017ee spole\u010dnosti zakoup\u00ed drah\u00e9 \u0159e\u0161en\u00ed, ani\u017e by vid\u011bly celkov\u00fd obraz jeho vyu\u017eit\u00ed. Mezit\u00edm zku\u0161ebn\u00ed testov\u00e1n\u00ed syst\u00e9mu pom\u00e1h\u00e1 pochopit, jak p\u0159ipravit infrastrukturu na integraci, jak\u00e9 funkce a v jak\u00e9m rozsahu je t\u0159eba zav\u00e9st. Tak se d\u00e1 p\u0159edej\u00edt velk\u00e9mu mno\u017estv\u00ed probl\u00e9m\u016f zp\u016fsoben\u00fdch volbou produktu \u201enaslepo\u201c. Krom\u011b toho zaveden\u00ed po spr\u00e1vn\u00e9m \u201epilotov\u00e1n\u00ed\u201c p\u0159inese in\u017een\u00fdr\u016fm mnohem m\u00e9n\u011b rozru\u0161en\u00fdch nervov\u00fdch bun\u011bk a \u0161ediv\u00fdch vlas\u016f. Poj\u010fme se pod\u00edvat na to, pro\u010d je pilotn\u00ed testov\u00e1n\u00ed tak d\u016fle\u017eit\u00e9 pro \u00fasp\u011b\u0161n\u00fd projekt, na p\u0159\u00edkladu popul\u00e1rn\u00edho n\u00e1stroje pro kontrolu p\u0159\u00edstupu k podnikov\u00e9 s\u00edti \u2013 Cisco ISE. Prozkoum\u00e1me jak typick\u00e9, tak zcela netradi\u010dn\u00ed varianty pou\u017eit\u00ed \u0159e\u0161en\u00ed, kter\u00e9 se v na\u0161\u00ed praxi vyskytovaly.
\n<\/a><\/noindex><\/p>\n

Cisco ISE \u2013 \u201eRadius server na steroidech\u201c<\/h2>\n

\nCisco Identity Services Engine (ISE) je platforma pro vytv\u00e1\u0159en\u00ed syst\u00e9mu kontroly p\u0159\u00edstupu k lok\u00e1ln\u00ed v\u00fdpo\u010detn\u00ed s\u00edti organizace. V odborn\u00e9 komunit\u011b byl produkt d\u00edky sv\u00fdm vlastnostem p\u0159ezd\u00edv\u00e1n \u201eRadius serverem na steroidech\u201c. Pro\u010d? V podstat\u011b je \u0159e\u0161en\u00ed Radius serverem, k n\u011bmu\u017e bylo p\u0159id\u00e1no obrovsk\u00e9 mno\u017estv\u00ed dal\u0161\u00edch slu\u017eeb a \u201evychyt\u00e1vek\u201c, kter\u00e9 umo\u017e\u0148uj\u00ed z\u00edsk\u00e1vat velk\u00fd objem kontextov\u00fdch informac\u00ed a aplikovat z\u00edskan\u00fd soubor dat v pravidlech p\u0159\u00edstupu.<\/p>\n

Stejn\u011b jako ka\u017ed\u00fd jin\u00fd Radius server, Cisco ISE \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u0441 \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0443\u0440\u043e\u0432\u043d\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e\u0431\u043e \u0432\u0441\u0435\u0445 \u043f\u043e\u043f\u044b\u0442\u043a\u0430\u0445 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f \u043a \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0438 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u0438\u043b\u0438 \u043d\u0435 \u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0432 \u041b\u0412\u0421. \u041e\u0434\u043d\u0430\u043a\u043e \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0444\u0438\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u043f\u043e\u0441\u0447\u0435\u0440\u0438\u043d\u0433\u0430, \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0441 \u0434\u0440\u0443\u0433\u0438\u043c\u0438 \u0418\u0411-\u0440\u0435\u0448\u0435\u043d\u0438\u044f\u043c\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0443\u0441\u043b\u043e\u0436\u043d\u0438\u0442\u044c \u043b\u043e\u0433\u0438\u043a\u0443 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u0438 \u0442\u0435\u043c \u0441\u0430\u043c\u044b\u043c \u0440\u0435\u0448\u0430\u0442\u044c \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u0442\u0440\u0443\u0434\u043d\u044b\u0435 \u0438 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0435 \u0437\u0430\u0434\u0430\u0447\u0438.<\/p>\n

\"Testov\u00e1n\u00ed
\n<\/p>\n

Zav\u00e1d\u011bt nelze, pilotovat: pro\u010d je testov\u00e1n\u00ed pot\u0159ebn\u00e9?<\/h2>\n

\nHodnota pilotn\u00edho testov\u00e1n\u00ed spo\u010d\u00edv\u00e1 v p\u0159edveden\u00ed v\u0161ech mo\u017enost\u00ed syst\u00e9mu v konkr\u00e9tn\u00ed infrastruktu\u0159e konkr\u00e9tn\u00ed organizace. Jsem p\u0159esv\u011bd\u010den, \u017ee pilotov\u00e1n\u00ed Cisco ISE p\u0159ed implementac\u00ed je u\u017eite\u010dn\u00e9 pro v\u0161echny \u00fa\u010dastn\u00edky projektu, a zde je pro\u010d. <\/p>\n

Integrator\u016fm to poskytuje jasnou p\u0159edstavu o o\u010dek\u00e1v\u00e1n\u00edch z\u00e1kazn\u00edka a pom\u00e1h\u00e1 formulovat adekv\u00e1tn\u00ed technickou specifikaci, kter\u00e1 obsahuje mnohem v\u011bt\u0161\u00ed mno\u017estv\u00ed detail\u016f ne\u017e b\u011b\u017en\u00e1 fr\u00e1ze \u201eud\u011blejte to tak, aby to fungovalo\u201c. \u201ePilot\u201c n\u00e1m umo\u017e\u0148uje proc\u00edtit v\u0161echny obt\u00ed\u017ee z\u00e1kazn\u00edka, pochopit, jak\u00e9 \u00fakoly jsou pro n\u011bj prioritn\u00ed a kter\u00e9 tedy m\u00e9n\u011b podstatn\u00e9. Pro n\u00e1s je to skv\u011bl\u00e1 p\u0159\u00edle\u017eitost p\u0159edem zjistit, jak\u00fd hardware organizace pou\u017e\u00edv\u00e1, jak bude implementace prob\u00edhat, na jak\u00fdch m\u00edstech, kde se nach\u00e1z\u00ed a tak d\u00e1le. <\/p>\n

Z\u00e1kazn\u00edci b\u011bhem pilotn\u00edho testov\u00e1n\u00ed vid\u00ed skute\u010dn\u00fd syst\u00e9m v akci, seznamuj\u00ed se s jeho rozhran\u00edm, mohou zkontrolovat, zda je kompatibiln\u00ed s jejich st\u00e1vaj\u00edc\u00edm \u201ehardwarov\u00fdm\u201c vybaven\u00edm a z\u00edskat celkov\u00fd pohled na to, jak bude \u0159e\u0161en\u00ed fungovat po pln\u00e9 implementaci. \u201ePilot\u201c je ten okam\u017eik, kdy je mo\u017en\u00e9 identifikovat v\u0161echny \u201e\u00faskal\u00ed\u201c, se kter\u00fdmi se zcela jist\u011b setkaj\u00ed p\u0159i integraci, a rozhodnout, kolik licenc\u00ed je pot\u0159eba zakoupit.
\nCo se m\u016f\u017ee \u201evyno\u0159it\u201c b\u011bhem \u201epilota\u201c<\/p>\n

Tak\u017ee jak spr\u00e1vn\u011b p\u0159ipravit implementaci Cisco ISE? Na z\u00e1klad\u011b na\u0161ich zku\u0161enost\u00ed jsme identifikovali 4 hlavn\u00ed body, kter\u00e9 je d\u016fle\u017eit\u00e9 zv\u00e1\u017eit p\u0159i pilotn\u00edm testov\u00e1n\u00ed syst\u00e9mu.<\/p>\n

Form\u00e1t<\/h2>\n

\nNejprve je nutn\u00e9 rozhodnout, v jak\u00e9m form\u00e1tu bude syst\u00e9m realizov\u00e1n: fyzick\u00e9m nebo virtu\u00e1ln\u00edm appliance. Ob\u011b varianty maj\u00ed sv\u00e9 v\u00fdhody a nev\u00fdhody. Nap\u0159\u00edklad silnou str\u00e1nkou fyzick\u00e9ho appliance je p\u0159edv\u00eddateln\u00fd v\u00fdkon, av\u0161ak nelze zapomenout, \u017ee tato za\u0159\u00edzen\u00ed \u010dasem zastar\u00e1vaj\u00ed. Virtu\u00e1ln\u00ed appliances jsou m\u00e9n\u011b p\u0159edv\u00eddateln\u00e9, proto\u017ee z\u00e1vis\u00ed na vybaven\u00ed, na kter\u00e9m je vybudov\u00e1no prost\u0159ed\u00ed virtualizace, ale maj\u00ed z\u00e1sadn\u00ed v\u00fdhodu: p\u0159i dostupnosti podpory je lze v\u017edy aktualizovat na nejnov\u011bj\u0161\u00ed verzi. <\/p>\n

Je va\u0161e s\u00ed\u0165ov\u00e9 vybaven\u00ed kompatibiln\u00ed s Cisco ISE?<\/h2>\n

\nSamoz\u0159ejm\u011b by bylo ide\u00e1ln\u00ed p\u0159ipojit k syst\u00e9mu ve\u0161ker\u00e9 vybaven\u00ed najednou. Nicm\u00e9n\u011b to nen\u00ed v\u017edy mo\u017en\u00e9, proto\u017ee mnoh\u00e9 organizace st\u00e1le pou\u017e\u00edvaj\u00ed ne\u0159\u00edzen\u00e9 switche nebo switche, kter\u00e9 nepodporuj\u00ed n\u011bkter\u00e9 technologie, na nich\u017e funguje Cisco ISE. A to se net\u00fdk\u00e1 pouze switch\u016f, ale tak\u00e9 bezdr\u00e1tov\u00fdch kontroler\u016f. VPN<\/a>-koncentr\u00e1tor\u016f a ve\u0161ker\u00e9ho dal\u0161\u00edho za\u0159\u00edzen\u00ed, ke kter\u00e9mu se p\u0159ipojuj\u00ed u\u017eivatel\u00e9. V m\u00e9 praxi byly p\u0159\u00edpady, kdy po demonstraci syst\u00e9mu pro \u00fapln\u00e9 nasazen\u00ed z\u00e1kazn\u00edk vym\u011bnil prakticky cel\u00fd park p\u0159\u00edstupov\u00fdch switch\u016f za modern\u00ed za\u0159\u00edzen\u00ed Cisco. Abychom se vyhnuli nep\u0159\u00edjemn\u00fdm p\u0159ekvapen\u00edm, je dobr\u00e9 p\u0159edem zjistit pod\u00edl nepodporovan\u00e9ho za\u0159\u00edzen\u00ed. <\/p>\n

Jsou v\u0161echna va\u0161e za\u0159\u00edzen\u00ed standardn\u00ed?<\/h2>\n

\nV ka\u017ed\u00e9 s\u00edti se nach\u00e1zej\u00ed standardn\u00ed za\u0159\u00edzen\u00ed, u kter\u00fdch by nem\u011bly nastat probl\u00e9my s p\u0159ipojen\u00edm: pracovn\u00ed stanice, IP telefony, Wi-Fi p\u0159\u00edstupov\u00e9 body, kamery a tak d\u00e1le. Ale tak\u00e9 se m\u016f\u017ee st\u00e1t, \u017ee do LAN je pot\u0159eba p\u0159ipojit nestandardn\u00ed za\u0159\u00edzen\u00ed, nap\u0159\u00edklad p\u0159evodn\u00edky sign\u00e1l\u016f z RS232\/Ethernet, rozhran\u00ed zdroj\u016f nep\u0159eru\u0161iteln\u00e9ho nap\u00e1jen\u00ed, r\u016fzn\u00e1 technologick\u00e1 za\u0159\u00edzen\u00ed atd. Je d\u016fle\u017eit\u00e9 tento seznam za\u0159\u00edzen\u00ed ur\u010dit p\u0159edem, aby bylo jasn\u00e9, jak technicky budou fungovat s Cisco ISE b\u011bhem f\u00e1ze implementace.<\/p>\n

Konstruktivn\u00ed dialog s IT specialisty<\/h2>\n

\n\u010casto jsou objednavateli Cisco ISE odd\u011blen\u00ed pro bezpe\u010dnost, p\u0159i\u010dem\u017e za nastaven\u00ed p\u0159\u00edstupov\u00fdch switch\u016f a Active Directory obvykle odpov\u00eddaj\u00ed IT odd\u011blen\u00ed. Proto produktivn\u00ed spolupr\u00e1ce bezpe\u010dnostn\u00edch specialist\u016f a IT odborn\u00edk\u016f je jednou z hlavn\u00edch podm\u00ednek pro bezprobl\u00e9movou implementaci syst\u00e9mu. Pokud posledn\u00ed zm\u011bn\u00ed pohled na integraci \"na odpor\", je dobr\u00e9 vysv\u011btlit, jak bude \u0159e\u0161en\u00ed u\u017eite\u010dn\u00e9 pro IT odd\u011blen\u00ed.<\/p>\n

Top-5 p\u0159\u00edpad\u016f pou\u017eit\u00ed Cisco ISE<\/h2>\n

\nNa z\u00e1klad\u011b na\u0161ich zku\u0161enost\u00ed je pot\u0159ebn\u00e1 funk\u010dnost syst\u00e9mu tak\u00e9 ur\u010dena b\u011bhem pilotn\u00edho testov\u00e1n\u00ed. N\u00ed\u017ee jsou uvedeny n\u011bkter\u00e9 z nejpopul\u00e1rn\u011bj\u0161\u00edch a m\u00e9n\u011b roz\u0161\u00ed\u0159en\u00fdch p\u0159\u00edpad\u016f pou\u017eit\u00ed tohoto \u0159e\u0161en\u00ed. <\/p>\n

Bezpe\u010dn\u00fd p\u0159\u00edstup do LAN p\u0159es kabel s EAP-TLS<\/h4>\n

\nJak ukazuj\u00ed v\u00fdsledky v\u00fdzkum\u016f na\u0161ich penetra\u010dn\u00edch tester\u016f, \u00fato\u010dn\u00edci \u010dasto pronikaj\u00ed do s\u00edt\u011b spole\u010dnost\u00ed prost\u0159ednictv\u00edm b\u011b\u017en\u00fdch z\u00e1suvek, ke kter\u00fdm jsou p\u0159ipojeny tisk\u00e1rny, telefony, IP kamery, Wi-Fi p\u0159\u00edstupov\u00e9 body a dal\u0161\u00ed nep\u0159enosn\u00e1 s\u00ed\u0165ov\u00e1 za\u0159\u00edzen\u00ed. Proto i kdy\u017e je p\u0159\u00edstup do s\u00edt\u011b realizov\u00e1n na z\u00e1klad\u011b technologie dot1x, av\u0161ak s pou\u017eit\u00edm alternativn\u00edch protokol\u016f bez certifik\u00e1t\u016f pro ov\u011b\u0159en\u00ed u\u017eivatel\u016f, je vysok\u00e1 pravd\u011bpodobnost \u00fasp\u011b\u0161n\u00e9ho \u00fatoku p\u0159esm\u011brov\u00e1n\u00edm relace a bruteforce hesel. V p\u0159\u00edpad\u011b Cisco ISE bude mnohem t\u011b\u017e\u0161\u00ed p\u0159elst\u00edt certifik\u00e1t \u2014 \u00fato\u010dn\u00edci budou pot\u0159ebovat mnohem v\u011bt\u0161\u00ed v\u00fdpo\u010detn\u00ed kapacity, tak\u017ee tento p\u0159\u00edpad je velmi efektivn\u00ed.<\/p>\n

Bezdr\u00e1tov\u00fd p\u0159\u00edstup Dual-SSID <\/h4>\n

\nPodstata tohoto sc\u00e9n\u00e1\u0159e spo\u010d\u00edv\u00e1 v pou\u017eit\u00ed dvou identifik\u00e1tor\u016f s\u00edt\u011b (SSID). Jeden z nich lze podm\u00edn\u011bn\u011b nazvat \u201ehostovsk\u00fdm\u201c. Skrze n\u011bj se mohou do bezdr\u00e1tov\u00e9 s\u00edt\u011b p\u0159ipojit jak host\u00e9, tak zam\u011bstnanci spole\u010dnosti. Ti budou p\u0159i pokusu o p\u0159ipojen\u00ed p\u0159esm\u011brov\u00e1ni na speci\u00e1ln\u00ed port\u00e1l, kde prob\u00edh\u00e1 provisioning. To znamen\u00e1, \u017ee u\u017eivateli je vyd\u00e1n certifik\u00e1t a jeho osobn\u00ed za\u0159\u00edzen\u00ed je nastaveno pro automatick\u00e9 p\u0159ipojen\u00ed k druh\u00e9mu SSID, kde se ji\u017e pou\u017e\u00edv\u00e1 EAP-TLS se v\u0161emi v\u00fdhodami prvn\u00edho p\u0159\u00edpadu.<\/p>\n

Obch\u00e1zen\u00ed MAC autentizace a profilov\u00e1n\u00ed<\/h4>\n

\nDal\u0161\u00ed popul\u00e1rn\u00ed p\u0159\u00edpad spo\u010d\u00edv\u00e1 v automatick\u00e9m ur\u010dov\u00e1n\u00ed typu p\u0159ipojen\u00e9ho za\u0159\u00edzen\u00ed a aplikaci spr\u00e1vn\u00fdch omezen\u00ed. \u010c\u00edm je to zaj\u00edmav\u00e9? FAKTem je, \u017ee dosud existuje pom\u011brn\u011b mnoho za\u0159\u00edzen\u00ed, kter\u00e1 nepodporuj\u00ed autentizaci podle protokolu 802.1X. Proto je nutn\u00e9 takov\u00e1 za\u0159\u00edzen\u00ed pou\u0161t\u011bt do s\u00edt\u011b dle MAC adresy, kterou je docela snadn\u00e9 pad\u011blat. Zde p\u0159ich\u00e1z\u00ed na pomoc Cisco ISE: s pomoc\u00ed syst\u00e9mu lze vid\u011bt, jak se za\u0159\u00edzen\u00ed chov\u00e1 v s\u00edti, vytvo\u0159it jeho profil a p\u0159i\u0159adit mu skupinu jin\u00fdch za\u0159\u00edzen\u00ed, nap\u0159\u00edklad IP telefon a pracovn\u00ed stanici. P\u0159i pokusu \u00fato\u010dn\u00edka prov\u00e9st spoofing MAC adresy a p\u0159ipojit se do s\u00edt\u011b syst\u00e9m zjist\u00ed, \u017ee se profil za\u0159\u00edzen\u00ed zm\u011bnil, za\u010dne signalizovat podez\u0159el\u00e9 chov\u00e1n\u00ed a nedovol\u00ed podez\u0159el\u00e9mu u\u017eivateli p\u0159\u00edstup do s\u00edt\u011b. <\/p>\n

EAP-Chaining <\/h4>\n

\nTechnologie EAP-Chaining znamen\u00e1 sekven\u010dn\u00ed autentizaci pracovn\u00edho PC a u\u017eivatelsk\u00e9ho \u00fa\u010dtu. Tento p\u0159\u00edpad se \u0161iroce roz\u0161\u00ed\u0159il, proto\u017ee v mnoha firm\u00e1ch st\u00e1le nen\u00ed v\u00edt\u00e1no p\u0159ipojen\u00ed osobn\u00edch za\u0159\u00edzen\u00ed zam\u011bstnanc\u016f k firemn\u00ed LAN. Pou\u017eit\u00edm tohoto p\u0159\u00edstupu k autentizaci je mo\u017en\u00e9 ov\u011b\u0159it, zda konkr\u00e9tn\u00ed pracovn\u00ed stanice je \u010dlenem dom\u00e9ny, a v p\u0159\u00edpad\u011b z\u00e1porn\u00e9ho v\u00fdsledku u\u017eivatel bu\u010f do s\u00edt\u011b nevstoup\u00ed, nebo se p\u0159ihl\u00e1s\u00ed, ale s ur\u010dit\u00fdmi omezen\u00edmi.<\/p>\n

Posturizace <\/h4>\n

\nV tomto p\u0159\u00edpad\u011b se jedn\u00e1 o hodnocen\u00ed souladu softwarov\u00e9ho vybaven\u00ed pracovn\u00ed stanice s po\u017eadavky informa\u010dn\u00ed bezpe\u010dnosti. Pomoc\u00ed t\u00e9to technologie lze ov\u011b\u0159it, zda je software na pracovn\u00ed stanici aktualizovan\u00fd, zda jsou na n\u00ed nainstalov\u00e1ny ochrann\u00e9 prost\u0159edky, zda je nastaven hostuj\u00edc\u00ed firewall atd. Zaj\u00edmav\u00e9 je, \u017ee tato technologie tak\u00e9 umo\u017e\u0148uje \u0159e\u0161it dal\u0161\u00ed \u00fakoly nesouvisej\u00edc\u00ed s bezpe\u010dnost\u00ed, nap\u0159\u00edklad ov\u011b\u0159it p\u0159\u00edtomnost nezbytn\u00fdch soubor\u016f nebo instalaci syst\u00e9mov\u00e9ho softwaru.<\/p>\n

M\u00e9n\u011b \u010dast\u00e9 jsou tak\u00e9 sc\u00e9n\u00e1\u0159e pou\u017eit\u00ed Cisco ISE, jako je kontrola p\u0159\u00edstupu s neaktivn\u00ed dom\u00e9novou autentizac\u00ed (Passive ID), mikroskalov\u00e1n\u00ed zalo\u017een\u00e9 na SGT a filtrov\u00e1n\u00ed, stejn\u011b jako integrace se syst\u00e9my spr\u00e1vy mobiln\u00edch za\u0159\u00edzen\u00ed (MDM) a skenery zranitelnost\u00ed (Vulnerability Scanner). <\/p>\n

Nekonven\u010dn\u00ed projekty: k \u010demu dal\u0161\u00edmu m\u016f\u017ee b\u00fdt Cisco ISE u\u017eite\u010dn\u00e9, nebo 3 vz\u00e1cn\u00e9 p\u0159\u00edpady z na\u0161\u00ed praxe<\/p>\n

Kontrola p\u0159\u00edstupu k server\u016fm na b\u00e1zi Linuxu<\/h2>\n

\nJednou jsme \u0159e\u0161ili pom\u011brn\u011b netradi\u010dn\u00ed p\u0159\u00edpad pro jednoho z klient\u016f, u kter\u00e9ho byla ji\u017e nasazena soustava Cisco ISE: pot\u0159ebovali jsme naj\u00edt zp\u016fsob, jak kontrolovat akce u\u017eivatel\u016f (v\u011bt\u0161inou to byli administr\u00e1to\u0159i) na serverech s nainstalovan\u00fdm opera\u010dn\u00edm syst\u00e9mem Linux. P\u0159i hled\u00e1n\u00ed odpov\u011bdi n\u00e1s napadlo vyu\u017e\u00edt voln\u00fd software PAM Radius Module, kter\u00fd umo\u017e\u0148uje p\u0159ihl\u00e1\u0161en\u00ed na servery b\u011b\u017e\u00edc\u00ed na Linuxu s autentifikac\u00ed na extern\u00edm radiusov\u00e9m serveru. V tomto ohledu by v\u0161e bylo v po\u0159\u00e1dku, kdyby nebylo jedno \u201eale\u201c: radiusov\u00fd server p\u0159i odes\u00edl\u00e1n\u00ed odpov\u011bdi na autentiza\u010dn\u00ed dotaz vrac\u00ed pouze n\u00e1zev \u00fa\u010dtu a v\u00fdsledek \u2013 assess accepted nebo assess rejected. Mezit\u00edm pro autorizaci v Linuxu je pot\u0159eba p\u0159i\u0159adit alespo\u0148 jeden dal\u0161\u00ed parametr \u2013 home directory, aby se u\u017eivatel dostal alespo\u0148 n\u011bkam. Nena\u0161li jsme zp\u016fsob, jak to vr\u00e1tit jako radiusov\u00fd atribut, a tak jsme napsali speci\u00e1ln\u00ed skript pro vzd\u00e1len\u00e9 vytv\u00e1\u0159en\u00ed \u00fa\u010dt\u016f na hostitel\u00edch v poloautomatick\u00e9m re\u017eimu. Tato \u00faloha byla zcela provediteln\u00e1, proto\u017ee jsme se zab\u00fdvali \u00fa\u010dty administr\u00e1tor\u016f, jejich\u017e po\u010det nebyl tak velk\u00fd. D\u00e1le se u\u017eivatel\u00e9 p\u0159ihla\u0161ovali na po\u017eadovan\u00e9 za\u0159\u00edzen\u00ed, po \u010dem\u017e dostali pot\u0159ebn\u00fd p\u0159\u00edstup. Vznik\u00e1 opr\u00e1vn\u011bn\u00e1 ot\u00e1zka: je skute\u010dn\u011b nutn\u00e9 pou\u017e\u00edvat v takov\u00fdch p\u0159\u00edpadech pr\u00e1v\u011b Cisco ISE? Ve skute\u010dnosti ne \u2013 hod\u00ed se jak\u00fdkoliv radiusov\u00fd server, ale proto\u017ee klient ji\u017e tuto soustavu m\u011bl, p\u0159idali jsme k n\u00ed jen novou funkci.<\/p>\n

Inventarizace \u201ehardwaru\u201c a softwaru v LAN<\/h2>\n

\nJednou jsme pracovali na projektu dod\u00e1vky Cisco ISE jednomu z\u00e1kazn\u00edkovi bez p\u0159edchoz\u00edho \u201epilotn\u00edho\u201c testov\u00e1n\u00ed. Nebyly jasn\u00e9 po\u017eadavky na \u0159e\u0161en\u00ed a nav\u00edc jsme m\u011bli co do \u010din\u011bn\u00ed s plochou, nesegmentovanou s\u00edt\u00ed, co\u017e n\u00e1m \u00fakol zna\u010dn\u011b zkomplikovalo. B\u011bhem projektu jsme nastavili v\u0161echny mo\u017en\u00e9 metody profilov\u00e1n\u00ed, kter\u00e9 s\u00ed\u0165 podporovala: NetFlow, DHCP, SNMP, integraci s AD atd. Nakonec byl nastaven p\u0159\u00edstup podle MAR s mo\u017enost\u00ed p\u0159ipojit se k s\u00edti i p\u0159i ne\u00fasp\u011b\u0161n\u00e9 autentizaci. To znamen\u00e1, \u017ee i kdy\u017e autentizace nebyla \u00fasp\u011b\u0161n\u00e1, syst\u00e9m u\u017eivatele do s\u00edt\u011b p\u0159esto pustil, shrom\u00e1\u017edil informace o n\u011bm a zapsal je do datab\u00e1ze ISE. Tento monitoring s\u00edt\u011b b\u011bhem n\u011bkolika t\u00fddn\u016f n\u00e1m pomohl vy\u010dlenit p\u0159ipojen\u00e9 syst\u00e9my a anonymn\u00ed za\u0159\u00edzen\u00ed a vypracovat p\u0159\u00edstup k jejich segmentaci. Pot\u00e9 jsme nav\u00edc nastavili pos\u00edl\u00e1n\u00ed pro instalaci agenta na pracovn\u00ed stanice za \u00fa\u010delem shroma\u017e\u010fov\u00e1n\u00ed informac\u00ed o nainstalovan\u00e9m softwaru. A co z toho vy\u0161lo? Poda\u0159ilo se n\u00e1m segmentovat s\u00ed\u0165 a ur\u010dit seznam softwaru, kter\u00fd bylo t\u0159eba odstranit z pracovn\u00edch stanic. Nechci tajit, \u017ee dal\u0161\u00ed \u00fakoly ohledn\u011b rozd\u011blen\u00ed u\u017eivatel\u016f do dom\u00e9nov\u00fdch skupin a omezen\u00ed p\u0159\u00edstupov\u00fdch pr\u00e1v n\u00e1m zabraly pom\u011brn\u011b hodn\u011b \u010dasu, ale takto jsme z\u00edskali kompletn\u00ed obraz toho, jak\u00e9 \u201ehardwarov\u00e9\u201c vybaven\u00ed m\u011bl z\u00e1kazn\u00edk v s\u00edti. Mimochodem, d\u00edky dobr\u00e9 pr\u00e1ci profilov\u00e1n\u00ed \u201eout of the box\u201c to nebylo slo\u017eit\u00e9. Kde profilov\u00e1n\u00ed nepomohlo, pod\u00edvali jsme se na to sami, kdy\u017e jsme identifikovali port p\u0159ep\u00edna\u010de, ke kter\u00e9mu bylo za\u0159\u00edzen\u00ed p\u0159ipojeno. <\/p>\n

Vzd\u00e1len\u00e1 instalace softwaru na pracovn\u00ed stanice<\/h2>\n

\nTento p\u0159\u00edpad je jedn\u00edm z nejpodivn\u011bj\u0161\u00edch v m\u00e9 praxi. Jednou se na n\u00e1s obr\u00e1til z\u00e1kazn\u00edk s vol\u00e1n\u00edm o pomoc - p\u0159i zav\u00e1d\u011bn\u00ed Cisco ISE se n\u011bco pokazilo, v\u0161echno se rozbilo a nikdo se ji\u017e nemohl dostat do s\u00edt\u011b. Za\u010dali jsme to zkoumat a zjistili jsme n\u00e1sleduj\u00edc\u00ed. Ve spole\u010dnosti bylo 2000 po\u010d\u00edta\u010d\u016f, jejich\u017e spr\u00e1vu z d\u016fvodu absence dom\u00e9nov\u00e9ho kontrol\u00e9ru prov\u00e1d\u011bli pod \u00fa\u010dtem spr\u00e1vce. Za \u00fa\u010delem sledov\u00e1n\u00ed nasadili v organizaci Cisco ISE. Bylo t\u0159eba n\u011bjak\u00fdm zp\u016fsobem zjistit, zda je na st\u00e1vaj\u00edc\u00edch PC nainstalov\u00e1n antivir, zda byla aktualizov\u00e1na softwarov\u00e1 prost\u0159ed\u00ed atd. A jeliko\u017e s\u00ed\u0165ov\u00e9 za\u0159\u00edzen\u00ed do syst\u00e9mu zav\u00e1d\u011bli IT administr\u00e1to\u0159i, bylo logick\u00e9, \u017ee k n\u011bmu m\u011bli p\u0159\u00edstup. Pod\u00edvali se, jak to funguje, a po proveden\u00ed sledov\u00e1n\u00ed sv\u00fdch PC, p\u0159i\u0161li na to, jak vzd\u00e1len\u011b instalovat software na pracovn\u00ed stanice zam\u011bstnanc\u016f bez osobn\u00edch n\u00e1v\u0161t\u011bv. Jen si p\u0159edstavte, kolik krok\u016f takto lze u\u0161et\u0159it za den! Administr\u00e1to\u0159i provedli n\u011bkolik kontrol na u\u017eivatelsk\u00e9m rozhran\u00ed na p\u0159\u00edtomnost ur\u010dit\u00e9ho souboru v adres\u00e1\u0159i C:Program Files, a p\u0159i jeho absenci se spustila automatick\u00e1 remediace s p\u0159esm\u011brov\u00e1n\u00edm na odkaz vedouc\u00ed do souborov\u00e9ho \u00falo\u017ei\u0161t\u011b na instala\u010dn\u00ed soubor .exe. To umo\u017enilo b\u011b\u017en\u00fdm u\u017eivatel\u016fm p\u0159\u00edstup na sd\u00edlenou slo\u017eku a z n\u00ed st\u00e1hnout pot\u0159ebn\u00fd software. Bohu\u017eel, administr\u00e1tor \u0161patn\u011b znal syst\u00e9m ISE a po\u0161kodil mechanismy sledov\u00e1n\u00ed - nespr\u00e1vn\u011b napsal politiku, co\u017e vedlo k probl\u00e9mu, k jeho\u017e \u0159e\u0161en\u00ed jsme byli p\u0159izv\u00e1ni. Osobn\u011b jsem up\u0159\u00edmn\u011b p\u0159ekvapen tak kreativn\u00edm p\u0159\u00edstupem, nebo\u0165 by bylo mnohem levn\u011bj\u0161\u00ed a m\u00e9n\u011b n\u00e1ro\u010dn\u00e9 vytvo\u0159it dom\u00e9nov\u00fd kontrol\u00e9r. Ale jako d\u016fkaz konceptu to fungovalo.<\/p>\n

V\u00edce o technick\u00fdch nuanc\u00edch, kter\u00e9 se objevuj\u00ed p\u0159i zav\u00e1d\u011bn\u00ed Cisco ISE, si p\u0159e\u010dt\u011bte v \u010dl\u00e1nku m\u00e9ho kolegy. \u201ePraktick\u00e1 zku\u0161enost s zav\u00e1d\u011bn\u00edm Cisco ISE. Pohled in\u017een\u00fdra\u201c<\/a><\/noindex>.<\/p>\n

Artem Bobrikov, projektov\u00fd in\u017een\u00fdr Centra informa\u010dn\u00ed bezpe\u010dnosti spole\u010dnosti \u201eInfosystemy Jet\u201c<\/i><\/p>\n

Pozn\u00e1mka na z\u00e1v\u011br<\/b>:
\nI kdy\u017e tento p\u0159\u00edsp\u011bvek pojedn\u00e1v\u00e1 o syst\u00e9mu Cisco ISE, popsan\u00e1 problematika je aktu\u00e1ln\u00ed pro celou t\u0159\u00eddu \u0159e\u0161en\u00ed NAC. Nen\u00ed podstatn\u00e9, jak\u00e9 \u0159e\u0161en\u00ed od dodavatele se pl\u00e1nuje zav\u00e9st - v\u011bt\u0161ina uveden\u00e9ho z\u016fstane pou\u017eiteln\u00e1.
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u041a\u0430\u043a \u0447\u0430\u0441\u0442\u043e \u0432\u044b \u043f\u043e\u043a\u0443\u043f\u0430\u0435\u0442\u0435 \u0447\u0442\u043e-\u0442\u043e \u0441\u043f\u043e\u043d\u0442\u0430\u043d\u043d\u043e, \u043f\u043e\u0434\u0434\u0430\u0432\u0448\u0438\u0441\u044c \u043a\u0440\u0443\u0442\u043e\u0439 \u0440\u0435\u043a\u043b\u0430\u043c\u0435, \u0430 \u043f\u043e\u0442\u043e\u043c \u044d\u0442\u0430 \u0438\u0437\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u043e \u0436\u0435\u043b\u0430\u043d\u043d\u0430\u044f \u0432\u0435\u0449\u044c \u043f\u044b\u043b\u0438\u0442\u0441\u044f \u0432 \u0448\u043a\u0430\u0444\u0443, \u043a\u043b\u0430\u0434\u043e\u0432\u043a\u0435 \u0438\u043b\u0438 \u0433\u0430\u0440\u0430\u0436\u0435 \u0434\u043e \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u043e\u0439 \u0433\u0435\u043d\u0435\u0440\u0430\u043b\u044c\u043d\u043e\u0439 \u0443\u0431\u043e\u0440\u043a\u0438 \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0435\u0437\u0434\u0430? \u041a\u0430\u043a \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442 \u2014 \u0440\u0430\u0437\u043e\u0447\u0430\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0438\u0437-\u0437\u0430 \u043d\u0435\u043e\u043f\u0440\u0430\u0432\u0434\u0430\u043d\u043d\u044b\u0445 \u043e\u0436\u0438\u0434\u0430\u043d\u0438\u0439 \u0438 \u0432\u043f\u0443\u0441\u0442\u0443\u044e \u043f\u043e\u0442\u0440\u0430\u0447\u0435\u043d\u043d\u044b\u0445 \u0434\u0435\u043d\u0435\u0433. \u0413\u043e\u0440\u0430\u0437\u0434\u043e \u0445\u0443\u0436\u0435, \u043a\u043e\u0433\u0434\u0430 \u043f\u043e\u0434\u043e\u0431\u043d\u043e\u0435 \u0441\u043b\u0443\u0447\u0430\u0435\u0442\u0441\u044f \u0441 \u0431\u0438\u0437\u043d\u0435\u0441\u043e\u043c. \u041e\u0447\u0435\u043d\u044c \u0447\u0430\u0441\u0442\u043e \u043c\u0430\u0440\u043a\u0435\u0442\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u0442\u0440\u044e\u043a\u0438 \u0431\u044b\u0432\u0430\u044e\u0442 \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043a\u043e \u0445\u043e\u0440\u043e\u0448\u0438, \u0447\u0442\u043e \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u043f\u0440\u0438\u043e\u0431\u0440\u0435\u0442\u0430\u044e\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":22980,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31004","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Testov\u00e1n\u00ed uk\u00e1\u017ee: jak se p\u0159ipravit na zaveden\u00ed Cisco ISE a pochopit, kter\u00e9 funkce syst\u00e9mu pot\u0159ebujete | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/testirovanie-pokazhet-kak-podgotovitsya-k-vnedreniyu-cisco-ise-i-ponyat-kakie-fichi-sistemy-vam-nuzhny","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0422\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u043a\u0430\u0436\u0435\u0442: \u043a\u0430\u043a \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u043a \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044e Cisco ISE \u0438 \u043f\u043e\u043d\u044f\u0442\u044c, \u043a\u0430\u043a\u0438\u0435 \u0444\u0438\u0447\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u0430\u043c \u043d\u0443\u0436\u043d\u044b | ProHoster","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/testirovanie-pokazhet-kak-podgotovitsya-k-vnedreniyu-cisco-ise-i-ponyat-kakie-fichi-sistemy-vam-nuzhny","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:38:50+00:00","article:modified_time":"2019-10-31T18:38:50+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31004","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-04 14:48:23","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 13:02:36","updated":"2026-02-04 14:48:23","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31004","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=31004"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31004\/revisions"}],"predecessor-version":[{"id":156658,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31004\/revisions\/156658"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/22980"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=31004"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=31004"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=31004"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}