{"id":31627,"date":"2019-10-31T21:42:14","date_gmt":"2019-10-31T18:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/informatsionnaya-bezopasnost-bankovskih-beznalichnyh-platezhej-chast-8-tipovye-modeli-ugroz\/"},"modified":"2019-10-31T21:42:14","modified_gmt":"2019-10-31T18:42:14","slug":"informatsionnaya-bezopasnost-bankovskih-beznalichnyh-platezhej-chast-8-tipovye-modeli-ugroz","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/informatsionnaya-bezopasnost-bankovskih-beznalichnyh-platezhej-chast-8-tipovye-modeli-ugroz","title":{"rendered":"Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 8 \u2013 Typov\u00e9 modely hrozeb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/\"><img decoding=\"async\" alt=\"Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 8 \u2013 Typov\u00e9 modely hrozeb\" src=\"\/wp-content\/uploads\/2019\/04\/acac26db4761c25a5215f37ef9e8cb5b.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#ABOUT\">O \u010dem je v\u00fdzkum<\/a><\/noindex><\/p>\n<p><b class=\"spoiler_title\">Odkazy na dal\u0161\u00ed \u010d\u00e1sti v\u00fdzkumu<\/b><\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/344740\/\">Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 1 \u2013 Ekonomick\u00e9 z\u00e1klady.<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/345194\/\">Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 2 \u2013 Typick\u00e1 IT infrastruktura banky.<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/350852\/\">Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 3 \u2013 Tvorba po\u017eadavk\u016f na ochrann\u00fd syst\u00e9m.<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/351326\/\">Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 4 \u2013 P\u0159ehled standard\u016f modelov\u00e1n\u00ed hrozeb.<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/413703\/\">Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 5 \u2013 100+ tematick\u00fdch odkaz\u016f na bankovn\u00ed hacky.<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/419027\/\">Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 6 \u2013 Anal\u00fdza bankovn\u00edch zlo\u010din\u016f.<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/421161\/\">Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 7 \u2013 Z\u00e1kladn\u00ed model hrozeb.<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/\">Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 8 \u2013 Typov\u00e9 modely hrozeb <\/a><\/noindex>(<b>Jste zde<\/b>)<\/li>\n<\/ul>\n<p>Tento \u010dl\u00e1nek uzav\u00edr\u00e1 cyklus publikac\u00ed v\u011bnovan\u00fdch zaji\u0161t\u011bn\u00ed informa\u010dn\u00ed bezpe\u010dnosti bankovn\u00edch bezhotovostn\u00edch plateb. Zde se zam\u011b\u0159\u00edme na typick\u00e9 modely hrozeb, na kter\u00e9 se odkazovalo v <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/421161\/\">z\u00e1kladn\u00edm modelu<\/a><\/noindex>:<\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUNC\">Typick\u00fd model hrozeb. S\u00ed\u0165ov\u00e9 p\u0159ipojen\u00ed<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUIS\">Typick\u00fd model hrozeb. Informa\u010dn\u00ed syst\u00e9m vybudovan\u00fd na architektu\u0159e klient-server<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUSRD\">Typick\u00fd model hrozeb. Syst\u00e9m \u0159\u00edzen\u00ed p\u0159\u00edstupu<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUMI\">Typick\u00fd model hrozeb. Integra\u010dn\u00ed modul<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUSKZI\">Typick\u00fd model hrozeb. Syst\u00e9m kryptografick\u00e9 ochrany informac\u00ed.<\/a><\/noindex><\/li>\n<\/ul>\n<p><\/p>\n<blockquote><p><b>HABRO-WARNING !!!<\/b> V\u00e1\u017een\u00ed \u010dten\u00e1\u0159i, toto nen\u00ed z\u00e1bavn\u00fd p\u0159\u00edsp\u011bvek. <br \/>\nSkryt\u00e9 pod katem v\u00edce ne\u017e 40 stran materi\u00e1l\u016f maj\u00ed za c\u00edl <b>pomoci p\u0159i pr\u00e1ci nebo studiu<\/b> lid\u00ed specializuj\u00edc\u00edch se na bankovnictv\u00ed nebo zabezpe\u010den\u00ed informa\u010dn\u00ed bezpe\u010dnosti. Tyto materi\u00e1ly jsou kone\u010dn\u00fdm produktem v\u00fdzkumu a jsou naps\u00e1ny such\u00fdm ofici\u00e1ln\u00edm stylem. V podstat\u011b se jedn\u00e1 o \u0161ablony pro intern\u00ed dokumenty v oblasti IB. <\/p>\n<p>A tradi\u010dn\u011b \u2013 <b>\u201epou\u017eit\u00ed informac\u00ed z \u010dl\u00e1nku k neleg\u00e1ln\u00edm \u00fa\u010del\u016fm je trestn\u00e9 podle z\u00e1kona\u201c<\/b>. Produktivn\u00ed \u010dten\u00ed!\n<\/p><\/blockquote>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nInformace pro \u010dten\u00e1\u0159e, kte\u0159\u00ed se s v\u00fdzkumem seznamuj\u00ed po\u010d\u00ednaje touto publikac\u00ed.<br \/>\n<noindex><a rel=\"nofollow\" name=\"ABOUT\"><\/a><\/noindex><\/p>\n<blockquote>\n<h2>O \u010dem je v\u00fdzkum<\/h2>\n<p>\n\u010ctete pr\u016fvodce pro specialistu odpov\u011bdn\u00e9ho za zaji\u0161t\u011bn\u00ed informa\u010dn\u00ed bezpe\u010dnosti plateb v bance. <\/p>\n<p><b>Logika v\u00fdkladu<\/b><\/p>\n<p>Na za\u010d\u00e1tku se <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/344740\/\">\u010d\u00e1sti 1<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/345194\/\">d\u00edlu 2<\/a><\/noindex> p\u0159edstavuje objekt ochrany. Pot\u00e9 v <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/350852\/\">\u010d\u00e1sti 3<\/a><\/noindex> popisuje, jak vybudovat syst\u00e9m ochrany, a hovo\u0159\u00ed o pot\u0159eb\u011b vytv\u00e1\u0159en\u00ed modelu hrozeb. V <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/351326\/\">\u010d\u00e1sti 4<\/a><\/noindex> se pojedn\u00e1v\u00e1 o tom, jak\u00e9 modely hrozeb existuj\u00ed a jak se vytv\u00e1\u0159ej\u00ed. V <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/413703\/\">\u010d\u00e1sti 5<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/419027\/\">\u010d\u00e1sti 6<\/a><\/noindex> je uvedena anal\u00fdza skute\u010dn\u00fdch \u00fatok\u016f. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/421161\/\">\u010c\u00e1st 7<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/\">\u010d\u00e1st 8<\/a><\/noindex> obsahuj\u00ed popis modelu hrozeb, kter\u00fd byl vybudov\u00e1n s ohledem na informace ze v\u0161ech p\u0159edchoz\u00edch \u010d\u00e1st\u00ed.<\/p><\/blockquote>\n<p>\n<noindex><a rel=\"nofollow\" name=\"TMUNC\"><\/a><\/noindex><\/p>\n<h2>TYPICK\u00dd MODEL HROZEB. S\u00ed\u0165ov\u00e9 p\u0159ipojen\u00ed<\/h2>\n<p><\/p>\n<h3>Objekt ochrany, pro kter\u00fd se pou\u017e\u00edv\u00e1 model hrozeb (scope)<\/h3>\n<p>\nObjektem ochrany jsou data, kter\u00e1 jsou p\u0159en\u00e1\u0161ena prost\u0159ednictv\u00edm s\u00ed\u0165ov\u00e9ho p\u0159ipojen\u00ed, funguj\u00edc\u00edho v datov\u00fdch s\u00edt\u00edch postaven\u00fdch na z\u00e1klad\u011b protokolu TCP\/IP.<\/p>\n<p><b>Architektura<\/b><\/p>\n<p><img decoding=\"async\" alt=\"Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 8 \u2013 Typov\u00e9 modely hrozeb\" src=\"\/wp-content\/uploads\/2019\/04\/7fec6dc479280db22a581595ae7fc493.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPopis prvk\u016f architektury:<\/p>\n<ul>\n<li><i>\"Koncov\u00e9 uzly\"<\/i> \u2014 uzly, kter\u00e9 si vym\u011b\u0148uj\u00ed chr\u00e1n\u011bn\u00e9 informace.<\/li>\n<li><i>\"Mezilehl\u00e9 uzly\"<\/i> \u2014 prvky datov\u00e9 s\u00edt\u011b: sm\u011brova\u010de, p\u0159ep\u00edna\u010de, servery p\u0159\u00edstupu, proxy servery a dal\u0161\u00ed za\u0159\u00edzen\u00ed, skrze kter\u00e9 se p\u0159en\u00e1\u0161\u00ed provoz s\u00ed\u0165ov\u00e9ho p\u0159ipojen\u00ed. Obecn\u011b m\u016f\u017ee s\u00ed\u0165ov\u00e9 p\u0159ipojen\u00ed fungovat bez mezilehl\u00fdch uzl\u016f (p\u0159\u00edmo mezi koncov\u00fdmi uzly).<\/li>\n<\/ul>\n<p><\/p>\n<h3>Hrozby bezpe\u010dnosti na vy\u0161\u0161\u00ed \u00farovni<\/h3>\n<p>\n<b>Dekonstrukce<\/b><\/p>\n<p>H1. Neopr\u00e1vn\u011bn\u00fd p\u0159\u00edstup k p\u0159en\u00e1\u0161en\u00fdm dat\u016fm.<br \/>\nH2. Neopr\u00e1vn\u011bn\u00e1 modifikace p\u0159en\u00e1\u0161en\u00fdch dat.<br \/>\nH3. Poru\u0161en\u00ed autorsk\u00e9ho pr\u00e1va p\u0159en\u00e1\u0161en\u00fdch dat.<br \/>\n<noindex><a rel=\"nofollow\" name=\"TMUNCU1\"><\/a><\/noindex><\/p>\n<h3>H1. Neopr\u00e1vn\u011bn\u00fd p\u0159\u00edstup k p\u0159en\u00e1\u0161en\u00fdm dat\u016fm<\/h3>\n<p>\n<b>Dekonstrukce<\/b><br \/>\nU1.1. , prov\u00e1d\u011bn\u00e9 na koncov\u00fdch nebo mezilehl\u00fdch uzlech:<br \/>\nU1.1.1.  \u010dten\u00edm dat b\u011bhem jejich um\u00edst\u011bn\u00ed v pam\u011b\u0165ov\u00fdch za\u0159\u00edzen\u00edch uzlu:<br \/>\nU1.1.1.1.  v opera\u010dn\u00ed pam\u011bti.<br \/>\n<i>Vysv\u011btlivky k H1.1.1.1.<\/i><br \/>\nNap\u0159\u00edklad b\u011bhem zpracov\u00e1n\u00ed dat s\u00ed\u0165ov\u00fdm z\u00e1sobn\u00edkem uzlu.<\/p>\n<p>U1.1.1.2.  v nem\u011bnn\u00e9 pam\u011bti.<br \/>\n<i>Vysv\u011btlivky k H1.1.1.2.<\/i><br \/>\nNap\u0159\u00edklad p\u0159i ukl\u00e1d\u00e1n\u00ed p\u0159en\u00e1\u0161en\u00fdch dat do cache, do do\u010dasn\u00fdch soubor\u016f nebo swapov\u00fdch soubor\u016f.<\/p>\n<p>U1.2. , prov\u00e1d\u011bn\u00e9 na extern\u00edch uzlech datov\u00e9 s\u00edt\u011b:<br \/>\nU1.2.1.  metodou zachycov\u00e1n\u00ed v\u0161ech paket\u016f, kter\u00e9 proch\u00e1zej\u00ed s\u00ed\u0165ov\u00fdm rozhran\u00edm uzlu:<br \/>\n<i>Vysv\u011btlivky k H1.2.1.<\/i><br \/>\nZachycen\u00ed v\u0161ech paket\u016f se prov\u00e1d\u00ed p\u0159epnut\u00edm s\u00ed\u0165ov\u00e9 karty do promiscuous re\u017eimu (promiscuous mode pro dr\u00e1tov\u00e9 adapt\u00e9ry nebo do monitorovac\u00edho re\u017eimu pro Wi-Fi adapt\u00e9ry).<\/p>\n<p>U1.2.2.  prov\u00e1d\u011bn\u00edm \u00fatok\u016f typu \u201e\u010dlov\u011bk uprost\u0159ed (MiTM)\u201c, ale bez \u00fapravy p\u0159en\u00e1\u0161en\u00fdch dat (krom\u011b provozn\u00edch dat s\u00ed\u0165ov\u00fdch protokol\u016f).<br \/>\nH1.2.2.1. Odkaz: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUNCU2\">\u00abTypov\u00fd model hrozeb. S\u00ed\u0165ov\u00e9 p\u0159ipojen\u00ed. U2. Neautorizovan\u00e1 modifikace p\u0159en\u00e1\u0161en\u00fdch dat\u00bb<\/a><\/noindex>.<\/p>\n<p>U1.3. , prov\u00e1d\u011bn\u00e9 kv\u016fli \u00faniku informac\u00ed technick\u00fdmi kan\u00e1ly (\u0422\u041a\u0423\u0418) z fyzick\u00fdch uzl\u016f nebo spojov\u00fdch linek.<\/p>\n<p>U1.4. , prov\u00e1d\u011bn\u00e9 instalacemi speci\u00e1ln\u00edch technick\u00fdch prost\u0159edk\u016f (\u0421\u0422\u0421) na koncov\u00fdch nebo mezilehl\u00fdch uzlech, ur\u010den\u00fdch pro tajn\u00e9 shroma\u017e\u010fov\u00e1n\u00ed informac\u00ed.<br \/>\n<noindex><a rel=\"nofollow\" name=\"TMUNCU2\"><\/a><\/noindex><\/p>\n<h3>U2. Neautorizovan\u00e1 modifikace p\u0159en\u00e1\u0161en\u00fdch dat<\/h3>\n<p>\n<b>Dekonstrukce<\/b><br \/>\nU2.1. , prov\u00e1d\u011bn\u00e1 na koncov\u00fdch nebo mezilehl\u00fdch uzlech:<br \/>\nU2.1.1.  \u010dten\u00edm a prov\u00e1d\u011bn\u00edm zm\u011bn v datech b\u011bhem jejich um\u00edst\u011bn\u00ed v pam\u011b\u0165ov\u00fdch za\u0159\u00edzen\u00edch uzl\u016f:<br \/>\nU2.1.1.1.  v opera\u010dn\u00ed pam\u011bti:<br \/>\nU2.1.1.2.  v nem\u011bnn\u00e9 pam\u011bti:<\/p>\n<p>U2.2. , prov\u00e1d\u011bn\u00e1 na extern\u00edch uzlech datov\u00e9 s\u00edt\u011b:<br \/>\nU2.2.1.  prov\u00e1d\u011bn\u00edm \u00fatok\u016f typu \u201e\u010dlov\u011bk uprost\u0159ed (MiTM)\u201c a p\u0159esm\u011brov\u00e1n\u00edm provozu na uzel \u00fato\u010dn\u00edka:<br \/>\nU2.2.1.1. Fyzick\u00e9 p\u0159ipojen\u00ed za\u0159\u00edzen\u00ed \u00fato\u010dn\u00edk\u016f do p\u0159eru\u0161en\u00ed s\u00ed\u0165ov\u00e9ho spojen\u00ed.<br \/>\nU2.2.1.2. Prov\u00e1d\u011bn\u00ed \u00fatok\u016f na s\u00ed\u0165ov\u00e9 protokoly:<br \/>\nU2.2.1.2.1.  spr\u00e1vy virtu\u00e1ln\u00edch lok\u00e1ln\u00edch s\u00edt\u00ed (VLAN):<br \/>\nU2.2.1.2.1.1. <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/VLAN_hopping\">VLAN hopping<\/a><\/noindex>.<br \/>\nU2.2.1.2.1.2. Neautorizovan\u00e1 modifikace nastaven\u00ed VLAN na p\u0159ep\u00edna\u010d\u00edch nebo sm\u011brova\u010d\u00edch.<br \/>\nU2.2.1.2.2.  sm\u011brov\u00e1n\u00ed provozu:<br \/>\nU2.2.1.2.2.1. Neautorizovan\u00e1 modifikace tabulek statick\u00e9ho sm\u011brov\u00e1n\u00ed sm\u011brova\u010d\u016f.<br \/>\nU2.2.1.2.2.2. Annoncov\u00e1n\u00ed fal\u0161ovan\u00fdch tras \u00fato\u010dn\u00edky prost\u0159ednictv\u00edm protokol\u016f dynamick\u00e9ho sm\u011brov\u00e1n\u00ed.<br \/>\nU2.2.1.2.3.  automatick\u00e9 konfigurace:<br \/>\nU2.2.1.2.3.1. <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Rogue_DHCP\">Rogue DHCP<\/a><\/noindex>.<br \/>\nU2.2.1.2.3.2. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.securitylab.ru\/analytics\/379619.php\">Rogue WPAD<\/a><\/noindex>.<br \/>\nU2.2.1.2.4.  adresov\u00e1n\u00ed a p\u0159ekladu jmen:<br \/>\nU2.2.1.2.4.1. <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/ARP-spoofing\">ARP spoofing<\/a><\/noindex>.<br \/>\nU2.2.1.2.4.2. <noindex><a rel=\"nofollow\" href=\"https:\/\/ru.wikipedia.org\/wiki\/DNS_spoofing\">DNS spoofing<\/a><\/noindex>.<br \/>\nU2.2.1.2.4.3. Prov\u00e1d\u011bn\u00ed neautorizovan\u00fdch zm\u011bn v m\u00edstn\u00edch souborech jmen uzl\u016f (hosts, lmhosts atd.)<br \/>\n<noindex><a rel=\"nofollow\" name=\"TMUNCU3\"><\/a><\/noindex><\/p>\n<h3>U3. Poru\u0161en\u00ed autorstv\u00ed p\u0159en\u00e1\u0161en\u00fdch dat<\/h3>\n<p>\n<b>Dekonstrukce<\/b><br \/>\nU3.1. Neutralizace mechanism\u016f ur\u010den\u00ed autorstv\u00ed informac\u00ed prost\u0159ednictv\u00edm uveden\u00ed fal\u0161ovan\u00fdch \u00fadaj\u016f o autorovi nebo zdroji dat:<br \/>\nU3.1.1. Zm\u011bna \u00fadaj\u016f o autorovi obsa\u017een\u00fdch v p\u0159en\u00e1\u0161en\u00fdch informac\u00edch.<br \/>\nU3.1.1.1. Neutralizace kryptografick\u00e9 ochrany integrity a autorstv\u00ed p\u0159en\u00e1\u0161en\u00fdch dat:<br \/>\nU3.1.1.1.1. Odkaz: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUSKZIU4\">\u00abTypov\u00fd model hrozeb. Syst\u00e9m kryptografick\u00e9 ochrany informac\u00ed.<br \/>\nU4. Vytvo\u0159en\u00ed elektronick\u00e9ho podpisu legitimn\u00edho podpisuj\u00edc\u00edho na fal\u0161ovan\u00fdch \u00fadaj\u00edch\u00bb<\/a><\/noindex>.<br \/>\nU3.1.1.2. Neutralizace ochrany autorsk\u00fdch pr\u00e1v p\u0159en\u00e1\u0161en\u00fdch dat, realizovan\u00e9 pomoc\u00ed jednor\u00e1zov\u00fdch k\u00f3d\u016f potvrzen\u00ed:<br \/>\nU3.1.1.2.1. <noindex>SIM swap<\/noindex>.<\/p>\n<p>U3.1.2. Zm\u011bna \u00fadaj\u016f o zdroji p\u0159en\u00e1\u0161en\u00fdch informac\u00ed:<br \/>\nU3.1.2.1. <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/IP_address_spoofing\">IP spoofing<\/a><\/noindex>.<br \/>\nU3.1.2.2. <noindex><a rel=\"nofollow\" href=\"http:\/\/xgu.ru\/wiki\/MAC-spoofing\">MAC spoofing<\/a><\/noindex>.<\/p>\n<p>\n<noindex><a rel=\"nofollow\" name=\"TMUIS\"><\/a><\/noindex><\/p>\n<h2>TYPOV\u00dd MODEL HROZEB. INFORMA\u010cN\u00cd SYST\u00c9M, POSTAVEN\u00dd NA Z\u00c1KLAD\u011a ARCHITEKTURY KLIENT-SERVER<\/h2>\n<p><\/p>\n<h3>Objekt ochrany, pro kter\u00fd se pou\u017e\u00edv\u00e1 model hrozeb (scope)<\/h3>\n<p>\nOchrann\u00fdm objektem je informa\u010dn\u00ed syst\u00e9m, kter\u00fd je postaven na z\u00e1klad\u011b architektury klient-server.<\/p>\n<p><b>Architektura<\/b><br \/>\n<img decoding=\"async\" alt=\"Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 8 \u2013 Typov\u00e9 modely hrozeb\" src=\"\/wp-content\/uploads\/2019\/04\/f18c9c6c1e3d5372932d8c2a331284cf.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPopis prvk\u016f architektury:<\/p>\n<ul>\n<li><i>\u201eKlient\u201c<\/i> \u2013 za\u0159\u00edzen\u00ed, na kter\u00e9m funguje klientsk\u00e1 \u010d\u00e1st informa\u010dn\u00edho syst\u00e9mu.<\/li>\n<li><i>\u201eServer\u201c<\/i> \u2013 za\u0159\u00edzen\u00ed, na kter\u00e9m funguje serverov\u00e1 \u010d\u00e1st informa\u010dn\u00edho syst\u00e9mu.<\/li>\n<li><i>\u201e\u00dalo\u017ei\u0161t\u011b dat\u201c<\/i> \u2013 \u010d\u00e1st serverov\u00e9 infrastruktury informa\u010dn\u00edho syst\u00e9mu ur\u010den\u00e1 k ukl\u00e1d\u00e1n\u00ed dat zpracov\u00e1van\u00fdch informa\u010dn\u00edm syst\u00e9mem.<\/li>\n<li><i>\u201eS\u00ed\u0165ov\u00e9 spojen\u00ed\u201c<\/i> \u2013 kan\u00e1l v\u00fdm\u011bny informac\u00ed mezi Klientem a Serverem, proch\u00e1zej\u00edc\u00ed s\u00edt\u00ed p\u0159enosu dat. Podrobn\u011bj\u0161\u00ed popis modelu prvku je uveden v <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUNC\">\u201eTypov\u00e9m modelu hrozeb. S\u00ed\u0165ov\u00e9 spojen\u00ed\u201c<\/a><\/noindex>.<\/li>\n<\/ul>\n<p>\n<b>Omezen\u00ed<\/b><br \/>\nP\u0159i modelov\u00e1n\u00ed objektu byla stanovena n\u00e1sleduj\u00edc\u00ed omezen\u00ed:<\/p>\n<ol>\n<li>U\u017eivatel interaguje s informa\u010dn\u00edm syst\u00e9mem v r\u00e1mci kone\u010dn\u00fdch \u010dasov\u00fdch interval\u016f naz\u00fdvan\u00fdch sezen\u00ed.<\/li>\n<li>Na za\u010d\u00e1tku ka\u017ed\u00e9ho sezen\u00ed prob\u00edh\u00e1 identifikace, autentizace a autorizace u\u017eivatele.<\/li>\n<li>V\u0161echny chr\u00e1n\u011bn\u00e9 informace jsou ulo\u017eeny na serverov\u00e9 \u010d\u00e1sti informa\u010dn\u00edho syst\u00e9mu.<\/li>\n<\/ol>\n<p><\/p>\n<h3>Hrozby bezpe\u010dnosti na vy\u0161\u0161\u00ed \u00farovni<\/h3>\n<p>\n<b>Dekonstrukce<\/b><br \/>\nU1. Prov\u00e1d\u011bn\u00ed nez\u00e1konn\u00fdch akc\u00ed \u00fato\u010dn\u00edky na jm\u00e9no legitimn\u00edho u\u017eivatele.<br \/>\nU2. Neautorizovan\u00e1 modifikace chr\u00e1n\u011bn\u00fdch informac\u00ed b\u011bhem jejich zpracov\u00e1n\u00ed serverovou \u010d\u00e1st\u00ed informa\u010dn\u00edho syst\u00e9mu.<br \/>\n<noindex><a rel=\"nofollow\" name=\"TMUISU1\"><\/a><\/noindex><\/p>\n<h3>U1. Prov\u00e1d\u011bn\u00ed nez\u00e1konn\u00fdch akc\u00ed \u00fato\u010dn\u00edky na jm\u00e9no legitimn\u00edho u\u017eivatele<\/h3>\n<p>\n<b>Vysv\u011btlen\u00ed<\/b><br \/>\nObvykle se ve informa\u010dn\u00edch syst\u00e9mech vztahuj\u00ed akce k prov\u00e1d\u011bj\u00edc\u00edmu u\u017eivateli pomoc\u00ed:<\/p>\n<ol>\n<li>protokol\u016f pr\u00e1ce syst\u00e9mu (logs). <\/li>\n<li>speci\u00e1ln\u00edch atribut\u016f objekt\u016f dat, kter\u00e9 obsahuj\u00ed informace o u\u017eivateli, kter\u00fd je vytvo\u0159il nebo zm\u011bnil.<\/li>\n<\/ol>\n<p>\nVe vztahu k sezen\u00ed m\u016f\u017ee b\u00fdt tato hrozba dekomponov\u00e1na na:<\/p>\n<ol>\n<li>proveden\u00e9 v r\u00e1mci u\u017eivatelsk\u00e9 relace.<\/li>\n<li>proveden\u00e9 mimo u\u017eivatelskou relaci.<\/li>\n<\/ol>\n<p>\nSezen\u00ed u\u017eivatele m\u016f\u017ee b\u00fdt zah\u00e1jeno:<\/p>\n<ol>\n<li>Samotn\u00fdm u\u017eivatelem.<\/li>\n<li>\u00dato\u010dn\u00edky.<\/li>\n<\/ol>\n<p>\nV t\u00e9to f\u00e1zi bude mezilater\u00e1ln\u00ed dekompozice t\u00e9to hrozby vypadat n\u00e1sledovn\u011b:<br \/>\nU1.1. Neopr\u00e1vn\u011bn\u00e9 akce byly provedeny v r\u00e1mci relace u\u017eivatele:<br \/>\nU1.1.1. , nainstalovan\u00e9 napaden\u00fdm u\u017eivatelsk\u00fdm \u00fa\u010dtem.<br \/>\nU1.1.2. , nainstalovan\u00e9 \u00fato\u010dn\u00edky.<br \/>\nU1.2. Neopr\u00e1vn\u011bn\u00e9 akce byly provedeny mimo relaci u\u017eivatele.<\/p>\n<p>Z pohledu objekt\u016f informa\u010dn\u00ed infrastruktury, na kter\u00e9 mohou \u00fato\u010dn\u00edci c\u00edlit, bude dekompozice mezilater\u00e1ln\u00edch hrozeb vypadat n\u00e1sledovn\u011b:<\/p>\n<p>Prvky<br \/>\nDekompozice hrozeb<\/p>\n<p><b>U1.1.1.<\/b><br \/>\n<b>U1.1.2.<\/b><br \/>\n<b>U1.2.<\/b><\/p>\n<p>Z\u00e1kazn\u00edk<br \/>\nU1.1.1.1.<br \/>\nU1.1.2.1.<\/p>\n<p>S\u00ed\u0165ov\u00e9 spojen\u00ed<br \/>\nU1.1.1.2.<\/p>\n<p>Server<\/p>\n<p>U1.2.1.<\/p>\n<p>\n<b>Dekonstrukce<\/b><br \/>\nU1.1. Neopr\u00e1vn\u011bn\u00e9 akce byly provedeny v r\u00e1mci relace u\u017eivatele:<br \/>\nU1.1.1. , nainstalovan\u00e9 napaden\u00fdm u\u017eivatelsk\u00fdm \u00fa\u010dtem:<br \/>\nU1.1.1.1. \u00dato\u010dn\u00edci jednali samostatn\u011b z Klienta:<br \/>\nU1.1.1.1.1 \u00dato\u010dn\u00edci vyu\u017eili standardn\u00ed prost\u0159edky pro p\u0159\u00edstup k informa\u010dn\u00edmu syst\u00e9mu:<br \/>\nU1.1.1.1.1.1. \u00dato\u010dn\u00edci pou\u017eili fyzick\u00e1 vstupn\u00ed a v\u00fdstupn\u00ed za\u0159\u00edzen\u00ed Klienta (kl\u00e1vesnice, my\u0161, monitor nebo dotykov\u00e1 obrazovka mobiln\u00edho za\u0159\u00edzen\u00ed):<br \/>\nU1.1.1.1.1.1.1. \u00dato\u010dn\u00edci jednali v \u010dasov\u00fdch obdob\u00edch, kdy byla relace aktivn\u00ed, vstupn\u00ed a v\u00fdstupn\u00ed prost\u0159edky byly k dispozici a u\u017eivatel nebyl p\u0159\u00edtomen.<br \/>\nU1.1.1.1.1.2. \u00dato\u010dn\u00edci pou\u017eili prost\u0159edky pro vzd\u00e1lenou spr\u00e1vu (standardn\u00ed nebo poskytnut\u00e9 \u0161kodliv\u00fdm k\u00f3dem) k ovl\u00e1dnut\u00ed Klienta:<br \/>\nU1.1.1.1.1.2.1. \u00dato\u010dn\u00edci jednali v \u010dasov\u00fdch obdob\u00edch, kdy byla relace aktivn\u00ed, vstupn\u00ed a v\u00fdstupn\u00ed prost\u0159edky byly k dispozici a u\u017eivatel nebyl p\u0159\u00edtomen.<br \/>\nU1.1.1.1.1.2.2. \u00dato\u010dn\u00edci pou\u017eili prost\u0159edky pro vzd\u00e1lenou spr\u00e1vu, jejich\u017e \u010dinnost byla pro napaden\u00e9ho u\u017eivatele nepozorovateln\u00e1.<br \/>\nU1.1.1.2. \u00dato\u010dn\u00edci podvrhli data v s\u00ed\u0165ov\u00e9m spojen\u00ed mezi Klientem a Serverem, modifikuj\u00edc je tak, aby byla vn\u00edm\u00e1na jako akce legitimn\u00edho u\u017eivatele:<br \/>\nU1.1.1.2.1. Odkaz: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUNCU2\">\u00abTypov\u00fd model hrozeb. S\u00ed\u0165ov\u00e9 p\u0159ipojen\u00ed. U2. Neautorizovan\u00e1 modifikace p\u0159en\u00e1\u0161en\u00fdch dat\u00bb<\/a><\/noindex>.<br \/>\nU1.1.1.3. \u00dato\u010dn\u00edci donutili u\u017eivatele k proveden\u00ed po\u017eadovan\u00fdch akc\u00ed pomoc\u00ed metod soci\u00e1ln\u00edho in\u017een\u00fdrstv\u00ed.<\/p>\n<p>U1.1.2  nainstalovan\u00e9 \u00fato\u010dn\u00edky:<br \/>\nU1.1.2.1. \u00dato\u010dn\u00edci jedn\u00e1ni z Klienta (<b>A<\/b>):<br \/>\nU1.1.2.1.1. \u00dato\u010dn\u00edci neutralizovali syst\u00e9m p\u0159\u00edstupu k informa\u010dn\u00edmu syst\u00e9mu:<br \/>\nU1.1.2.1.1.1. Odkaz: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUSRDU1\">\u201eTypov\u00fd model hrozeb. Syst\u00e9m \u0159\u00edzen\u00ed p\u0159\u00edstupu. U1. Neautorizovan\u00e9 nav\u00e1z\u00e1n\u00ed relace jm\u00e9nem opr\u00e1vn\u011bn\u00e9ho u\u017eivatele\u201c<\/a><\/noindex>. <br \/>\nU1.1.2.1.2. \u00dato\u010dn\u00edci pou\u017eili standardn\u00ed n\u00e1stroje pro p\u0159\u00edstup k informa\u010dn\u00edmu syst\u00e9mu<br \/>\nU1.1.2.2. \u00dato\u010dn\u00edci jednali z jin\u00fdch uzl\u016f datov\u00e9 s\u00edt\u011b, ze kter\u00fdch je mo\u017en\u00e9 nav\u00e1zat s\u00ed\u0165ov\u00e9 spojen\u00ed se serverem (<b>A<\/b>):<br \/>\nU1.1.2.2.1. \u00dato\u010dn\u00edci neutralizovali syst\u00e9m \u0159\u00edzen\u00ed p\u0159\u00edstupu informa\u010dn\u00edho syst\u00e9mu:<br \/>\nU1.1.2.2.1.1. Odkaz: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUSRDU1\">\u201eTypov\u00fd model hrozeb. Syst\u00e9m \u0159\u00edzen\u00ed p\u0159\u00edstupu. U1. Neautorizovan\u00e9 nav\u00e1z\u00e1n\u00ed relace jm\u00e9nem opr\u00e1vn\u011bn\u00e9ho u\u017eivatele\u201c<\/a><\/noindex>. <br \/>\nU1.1.2.2.2. \u00dato\u010dn\u00edci pou\u017eili nestandardn\u00ed prost\u0159edky pro p\u0159\u00edstup k informa\u010dn\u00edmu syst\u00e9mu.<br \/>\n<i>Vysv\u011btlen\u00ed U1.1.2.2.2.<\/i><br \/>\n\u00dato\u010dn\u00edci mohli nainstalovat standardn\u00edho klienta informa\u010dn\u00edho syst\u00e9mu na extern\u00ed uzel nebo pou\u017e\u00edt nestandardn\u00ed software, kter\u00fd realizuje standardn\u00ed protokoly v\u00fdm\u011bny mezi klientem a serverem.<\/p>\n<p>U1.2 Neautorizovan\u00e9 akce provedeny mimo relaci u\u017eivatele.<br \/>\nU1.2.1 \u00dato\u010dn\u00edci provedli neautorizovan\u00e9 akce a pot\u00e9 u\u010dinili neautorizovan\u00e9 zm\u011bny v protokolech \u010dinnosti informa\u010dn\u00edho syst\u00e9mu nebo ve speci\u00e1ln\u00edch atribut\u016f datov\u00fdch objekt\u016f, ozna\u010duj\u00edc\u00ed, \u017ee vykonan\u00e9 akce provedl opr\u00e1vn\u011bn\u00fd u\u017eivatel.<br \/>\n<noindex><a rel=\"nofollow\" name=\"TMUISU2\"><\/a><\/noindex><\/p>\n<h3>U2. Neautorizovan\u00e1 modifikace chr\u00e1n\u011bn\u00fdch informac\u00ed b\u011bhem zpracov\u00e1n\u00ed jejich serverovou \u010d\u00e1st\u00ed informa\u010dn\u00edho syst\u00e9mu<\/h3>\n<p>\n<b>Dekonstrukce<\/b><br \/>\nU2.1. \u00dato\u010dn\u00edci modifikuj\u00ed chr\u00e1n\u011bn\u00e9 informace pomoc\u00ed standardn\u00edch prost\u0159edk\u016f informa\u010dn\u00edho syst\u00e9mu a d\u011blaj\u00ed to jm\u00e9nem opr\u00e1vn\u011bn\u00e9ho u\u017eivatele.<br \/>\nU2.1.1. Odkaz: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUISU1\">\u201eTypov\u00fd model hrozeb. Informa\u010dn\u00ed syst\u00e9m postaven\u00fd na architektu\u0159e klient-server. U1. Prov\u00e1d\u011bn\u00ed neautorizovan\u00fdch akc\u00ed \u00fato\u010dn\u00edky jm\u00e9nem opr\u00e1vn\u011bn\u00e9ho u\u017eivatele\u201c<\/a><\/noindex>.<\/p>\n<p>U2.2. \u00dato\u010dn\u00edci modifikuj\u00ed chr\u00e1n\u011bn\u00e9 informace pomoc\u00ed mechanism\u016f p\u0159\u00edstupu k dat\u016fm, kter\u00e9 nejsou standardn\u011b zahrnuty v re\u017eimu fungov\u00e1n\u00ed informa\u010dn\u00edho syst\u00e9mu.<br \/>\nU2.2.1. \u00dato\u010dn\u00edci modifikuj\u00ed soubory obsahuj\u00edc\u00ed chr\u00e1n\u011bn\u00e9 informace:<br \/>\nU2.2.1.1. , pou\u017e\u00edvaj\u00edc\u00ed mechanizmy pr\u00e1ce se soubory poskytovan\u00e9 opera\u010dn\u00edm syst\u00e9mem.<br \/>\nU2.2.1.2.  prov\u00e1d\u011bn\u00edm obnovy soubor\u016f z neopr\u00e1vn\u011bn\u011b upraven\u00e9 z\u00e1lohy.<\/p>\n<p>U2.2.2. \u00dato\u010dn\u00edci modifikuj\u00ed chr\u00e1n\u011bn\u00e9 informace ulo\u017een\u00e9 v datab\u00e1zi (<b>A<\/b>):<br \/>\nU2.2.2.1. \u00dato\u010dn\u00edci neutralizuj\u00ed p\u0159\u00edstupov\u00fd kontroln\u00ed syst\u00e9m datab\u00e1zov\u00e9ho serveru:<br \/>\nU2.2.2.1.1. Odkaz: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUSRDU1\">\u201eTypov\u00fd model hrozeb. Syst\u00e9m \u0159\u00edzen\u00ed p\u0159\u00edstupu. U1. Neautorizovan\u00e9 nav\u00e1z\u00e1n\u00ed relace jm\u00e9nem opr\u00e1vn\u011bn\u00e9ho u\u017eivatele\u201c<\/a><\/noindex>.<br \/>\nU2.2.2.2. \u00dato\u010dn\u00edci modifikuj\u00ed informace pomoc\u00ed standardn\u00edch rozhran\u00ed datab\u00e1zov\u00e9ho serveru pro p\u0159\u00edstup k dat\u016fm.<\/p>\n<p>U2.3. \u00dato\u010dn\u00edci modifikuj\u00ed chr\u00e1n\u011bn\u00e9 informace prost\u0159ednictv\u00edm neopr\u00e1vn\u011bn\u00e9 zm\u011bny algoritm\u016f fungov\u00e1n\u00ed zpracov\u00e1vaj\u00edc\u00edho softwaru.<br \/>\nU2.3.1. Zm\u011bn\u00e1m podl\u00e9h\u00e1 zdrojov\u00fd k\u00f3d softwaru.<br \/>\nU2.3.1. Zm\u011bn\u00e1m podl\u00e9h\u00e1 strojov\u00fd k\u00f3d softwaru.<\/p>\n<p>U2.4. \u00dato\u010dn\u00edci modifikuj\u00ed chr\u00e1n\u011bn\u00e9 informace pomoc\u00ed zranitelnost\u00ed v software informa\u010dn\u00edho syst\u00e9mu.<\/p>\n<p>U2.5. \u00dato\u010dn\u00edci modifikuj\u00ed chr\u00e1n\u011bn\u00e9 informace b\u011bhem jej\u00edho p\u0159enosu mezi komponenty serverov\u00e9 \u010d\u00e1sti informa\u010dn\u00edho syst\u00e9mu (nap\u0159\u00edklad mezi serverem datab\u00e1z\u00ed a aplika\u010dn\u00edm serverem):<br \/>\nU2.5.1. Odkaz: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUNCU2\">\u00abTypov\u00fd model hrozeb. S\u00ed\u0165ov\u00e9 p\u0159ipojen\u00ed. U2. Neautorizovan\u00e1 modifikace p\u0159en\u00e1\u0161en\u00fdch dat\u00bb<\/a><\/noindex>.<\/p>\n<p>\n<noindex><a rel=\"nofollow\" name=\"TMUSRD\"><\/a><\/noindex><\/p>\n<h2>TYPOV\u00dd MODEL HROZEB. SYST\u00c9M ROZLI\u0160OV\u00c1N\u00cd P\u0158\u00cdSTUPU<\/h2>\n<p><\/p>\n<h3>Objekt ochrany, pro kter\u00fd se pou\u017e\u00edv\u00e1 model hrozeb (scope)<\/h3>\n<p>\nObjekt ochrany, pro kter\u00fd je tento model hrozeb aplikov\u00e1n, odpov\u00edd\u00e1 objektu ochrany v modelu hrozeb: \u201eTypov\u00fd model hrozeb. Informa\u010dn\u00ed syst\u00e9m postaven\u00fd na architektu\u0159e klient-server\u201c.<\/p>\n<p>Pod syst\u00e9mem rozli\u0161ov\u00e1n\u00ed p\u0159\u00edstupu u\u017eivatel\u016f v tomto modelu hrozeb se rozum\u00ed komponent informa\u010dn\u00edho syst\u00e9mu, kter\u00fd realizuje funkce:<\/p>\n<ol>\n<li>Identifikace u\u017eivatel\u016f.<\/li>\n<li>Autentizace u\u017eivatel\u016f.<\/li>\n<li>Autorizace u\u017eivatel\u016f.<\/li>\n<li>Protokolov\u00e1n\u00ed akc\u00ed u\u017eivatel\u016f.<\/li>\n<\/ol>\n<p><\/p>\n<h3>Hrozby bezpe\u010dnosti na vy\u0161\u0161\u00ed \u00farovni<\/h3>\n<p>\n<b>Dekonstrukce<\/b><br \/>\nU1. Neopr\u00e1vn\u011bn\u00e9 ustanoven\u00ed relace na jm\u00e9no leg\u00e1ln\u00edho u\u017eivatele. <br \/>\nU2. Neopr\u00e1vn\u011bn\u00e9 zv\u00fd\u0161en\u00ed privilegi\u00ed u\u017eivatele v informa\u010dn\u00edm syst\u00e9mu.<br \/>\n<noindex><a rel=\"nofollow\" name=\"TMUSRDU1\"><\/a><\/noindex> <\/p>\n<h3>U1. Neopr\u00e1vn\u011bn\u00e9 ustanoven\u00ed relace na jm\u00e9no leg\u00e1ln\u00edho u\u017eivatele <\/h3>\n<p>\n<b>Vysv\u011btlen\u00ed<\/b><br \/>\nDekompozice t\u00e9to hrozby bude obecn\u011b z\u00e1viset na pou\u017eit\u00e9m typu syst\u00e9m\u016f identifikace a autentizace u\u017eivatel\u016f. <\/p>\n<p>V tomto modelu bude zva\u017eov\u00e1n pouze syst\u00e9m identifikace a autentizace u\u017eivatel\u016f, kter\u00fd pou\u017e\u00edv\u00e1 textov\u00fd login a heslo. P\u0159edpokl\u00e1d\u00e1me, \u017ee login u\u017eivatele je ve\u0159ejn\u011b p\u0159\u00edstupn\u00e1 informace, zn\u00e1m\u00e1 \u00fato\u010dn\u00edk\u016fm.<\/p>\n<p><b>Dekonstrukce<\/b><br \/>\nU1.1.  d\u00edky zneu\u017eit\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f:<br \/>\nU1.1.1. \u00dato\u010dn\u00edci kompromitovali p\u0159ihla\u0161ovac\u00ed \u00fadaje u\u017eivatele b\u011bhem jejich ukl\u00e1d\u00e1n\u00ed.<br \/>\n<i>Vysv\u011btlen\u00ed U1.1.1.<\/i><br \/>\nNap\u0159\u00edklad p\u0159ihla\u0161ovac\u00ed \u00fadaje mohly b\u00fdt naps\u00e1ny na n\u00e1lepce, p\u0159ilepen\u00e9 k monitoru.<\/p>\n<p>U1.1.2. U\u017eivatel n\u00e1hodou nebo \u00famysln\u011b p\u0159edal p\u0159ihla\u0161ovac\u00ed \u00fadaje \u00fato\u010dn\u00edk\u016fm.<br \/>\nU1.1.2.1. U\u017eivatel nahlas vy\u0159kl sv\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje p\u0159i zad\u00e1v\u00e1n\u00ed.<br \/>\nU1.1.2.2. U\u017eivatel \u00famysln\u011b p\u0159edal sv\u00e9 p\u0159ihla\u0161ovac\u00ed \u00fadaje:<br \/>\nU1.1.2.2.1.  koleg\u016fm v pr\u00e1ci.<br \/>\n<i>Objasn\u011bn\u00ed U1.1.2.2.1.<\/i><br \/>\nNap\u0159\u00edklad, aby je mohli pou\u017e\u00edt k zaji\u0161t\u011bn\u00ed n\u00e1hrady v dob\u011b nemoci.<\/p>\n<p>U1.1.2.2.2. &lt;...&gt; pro kontrahenty zam\u011bstnavatele, kte\u0159\u00ed vykon\u00e1vaj\u00ed pr\u00e1ce na objektech informa\u010dn\u00ed infrastruktury.<br \/>\nU1.1.2.2.3. &lt;...&gt; t\u0159et\u00edm stran\u00e1m.<br \/>\n<i>Objasn\u011bn\u00ed U1.1.2.2.3.<\/i><br \/>\nJednou, ale ne jedinou variantou tohoto ohro\u017een\u00ed je pou\u017eit\u00ed metod soci\u00e1ln\u00edho in\u017een\u00fdrstv\u00ed ze strany \u00fato\u010dn\u00edk\u016f.<\/p>\n<p>U1.1.3. \u00dato\u010dn\u00edci uh\u00e1dli p\u0159ihla\u0161ovac\u00ed \u00fadaje metodou brute-force:<br \/>\nU1.1.3.1. &lt;...&gt; pomoc\u00ed standardn\u00edch p\u0159\u00edstupov\u00fdch mechanism\u016f.<br \/>\nU1.1.3.2. &lt;...&gt; podle d\u0159\u00edve zachycen\u00fdch k\u00f3d\u016f (nap\u0159\u00edklad hash\u016f hesel) pro uchov\u00e1v\u00e1n\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f.<\/p>\n<p>U1.1.4. \u00dato\u010dn\u00edci pou\u017eili \u0161kodliv\u00fd k\u00f3d k zachycen\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f u\u017eivatele.<\/p>\n<p>U1.1.5. \u00dato\u010dn\u00edci extrahovali p\u0159ihla\u0161ovac\u00ed \u00fadaje z s\u00ed\u0165ov\u00e9ho spojen\u00ed mezi Klientem a Serverem:<br \/>\nU1.1.5.1. Odkaz: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUNCU1\">\u201eTypov\u00fd model ohro\u017een\u00ed. S\u00ed\u0165ov\u00e9 spojen\u00ed. U1. Neopr\u00e1vn\u011bn\u00e9 sezn\u00e1men\u00ed s p\u0159en\u00e1\u0161en\u00fdmi daty\u201c<\/a><\/noindex>.<\/p>\n<p>U1.1.6. \u00dato\u010dn\u00edci extrahovali p\u0159ihla\u0161ovac\u00ed \u00fadaje z z\u00e1znam\u016f monitorovac\u00edch syst\u00e9m\u016f:<br \/>\nU1.1.6.1. &lt;...&gt; syst\u00e9m\u016f videodohledu (pokud byly b\u011bhem \u010dinnosti zaznamen\u00e1v\u00e1ny stisky kl\u00e1ves na kl\u00e1vesnici).<br \/>\nU1.1.6.2. &lt;...&gt; syst\u00e9m\u016f kontroly \u010dinnost\u00ed zam\u011bstnanc\u016f u po\u010d\u00edta\u010de. <br \/>\n<i>Objasn\u011bn\u00ed U1.1.6.2.<\/i><br \/>\nP\u0159\u00edkladem takov\u00e9ho syst\u00e9mu je \u2014 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.staffcop.ru\">StuffCop<\/a><\/noindex>.<\/p>\n<p>U1.1.7. \u00dato\u010dn\u00edci kompromitovali p\u0159ihla\u0161ovac\u00ed \u00fadaje u\u017eivatele kv\u016fli nedostatk\u016fm v procesu jejich p\u0159enosu.<br \/>\n<i>Objasn\u011bn\u00ed U1.1.7.<\/i><br \/>\nNap\u0159\u00edklad, p\u0159enos hesel v otev\u0159en\u00e9m form\u00e1tu e-mailem.<\/p>\n<p>U1.1.8. \u00dato\u010dn\u00edci se dozv\u011bd\u011bli p\u0159ihla\u0161ovac\u00ed \u00fadaje sledov\u00e1n\u00edm pracovn\u00edho sezen\u00ed u\u017eivatele pomoc\u00ed syst\u00e9m\u016f vzd\u00e1len\u00e9 spr\u00e1vy.<\/p>\n<p>U1.1.9. \u00dato\u010dn\u00edci z\u00edskali p\u0159ihla\u0161ovac\u00ed \u00fadaje v d\u016fsledku jejich \u00faniku technick\u00fdmi kan\u00e1ly (TKUI):<br \/>\nU1.1.9.1. \u00dato\u010dn\u00edci pozorovali, jak u\u017eivatel zad\u00e1v\u00e1 p\u0159ihla\u0161ovac\u00ed \u00fadaje na kl\u00e1vesnici:<br \/>\nU1.1.9.1.1 \u00dato\u010dn\u00edci byli v bezprost\u0159edn\u00ed bl\u00edzkosti u\u017eivatele a vid\u011bli, jak se p\u0159ihla\u0161ovac\u00ed \u00fadaje zad\u00e1vaj\u00ed. <br \/>\n<i>Objasn\u011bn\u00ed U1.1.9.1.1.<\/i><br \/>\nMezi takov\u00e9 p\u0159\u00edpady pat\u0159\u00ed jedn\u00e1n\u00ed koleg\u016f v pr\u00e1ci nebo situace, kdy je kl\u00e1vesnice u\u017eivatele viditeln\u00e1 n\u00e1v\u0161t\u011bvn\u00edk\u016fm organizace.<\/p>\n<p>\u00da1.1.9.1.2 \u00dato\u010dn\u00edci pou\u017eili dal\u0161\u00ed technick\u00e9 prost\u0159edky, jako je dalekohled nebo bezpilotn\u00ed l\u00e9taj\u00edc\u00ed apar\u00e1t, a vid\u011bli zad\u00e1v\u00e1n\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f skrz okno. <br \/>\n\u00da1.1.9.2. \u00dato\u010dn\u00edci z\u00edskali p\u0159ihla\u0161ovac\u00ed \u00fadaje z nahr\u00e1vek r\u00e1diov\u00e9ho spojen\u00ed mezi kl\u00e1vesnic\u00ed a syst\u00e9movou jednotkou po\u010d\u00edta\u010de v p\u0159\u00edpad\u011b, \u017ee byly p\u0159ipojeny p\u0159es r\u00e1diov\u00e9 rozhran\u00ed (nap\u0159. Bluetooth).<br \/>\n\u00da1.1.9.3. \u00dato\u010dn\u00edci provedli odposlech p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f d\u00edky jejich \u00faniku skrze kan\u00e1l vedlej\u0161\u00edch elektromagnetick\u00fdch emis\u00ed a indukc\u00ed (P\u00c9M).<br \/>\n<i>Vysv\u011btlen\u00ed \u00da1.1.9.3.<\/i><br \/>\nP\u0159\u00edklady \u00fatoku <noindex><a rel=\"nofollow\" href=\"https:\/\/www.youtube.com\/watch?v=tMSglPLIDYU\">tady<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cl.cam.ac.uk\/~mgk25\/pet2004-fpd.pdf\">tady<\/a><\/noindex>. <\/p>\n<p>\u00da1.1.9.4. \u00dato\u010dn\u00edk provedl odposlech zad\u00e1v\u00e1n\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f z kl\u00e1vesnice pomoc\u00ed speci\u00e1ln\u00edch technick\u00fdch prost\u0159edk\u016f (STP), ur\u010den\u00fdch pro tajn\u00e9 sn\u00edm\u00e1n\u00ed informac\u00ed.<br \/>\n<i>Vysv\u011btlen\u00ed \u00da1.1.9.4.<\/i><br \/>\nP\u0159\u00edklady <noindex>za\u0159\u00edzen\u00ed<\/noindex>. <\/p>\n<p>\u00da1.1.9.5. \u00dato\u010dn\u00edci provedli odposlech zad\u00e1v\u00e1n\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f z kl\u00e1vesnice d\u00edky <br \/>\nanal\u00fdze Wi-Fi sign\u00e1lu, modifikovan\u00e9ho procesem stisknut\u00ed kl\u00e1ves u\u017eivateli.<br \/>\n<i>Vysv\u011btlen\u00ed \u00da1.1.9.5.<\/i><br \/>\nP\u0159\u00edklad <noindex><a rel=\"nofollow\" href=\"https:\/\/threatpost.com\/keystroke-recognition-uses-wi-fi-signals-to-snoop\/120135\/\">\u00fatok\u016fm<\/a><\/noindex>.<\/p>\n<p>\u00da1.1.9.6. \u00dato\u010dn\u00edci provedli odposlech zad\u00e1v\u00e1n\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f z kl\u00e1vesnice d\u00edky anal\u00fdze zvuk\u016f stisknut\u00ed kl\u00e1ves.<br \/>\n<i>Vysv\u011btlen\u00ed \u00da1.1.9.6.<\/i><br \/>\nP\u0159\u00edklad <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/398545\/\">\u00fatok\u016fm<\/a><\/noindex>.<\/p>\n<p>\u00da1.1.9.7. \u00dato\u010dn\u00edci provedli odposlech zad\u00e1v\u00e1n\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f z kl\u00e1vesnice mobiln\u00edho za\u0159\u00edzen\u00ed d\u00edky anal\u00fdze \u00fadaj\u016f z akcelerometru.<br \/>\n<i>Vysv\u011btlen\u00ed \u00da1.1.9.7.<\/i><br \/>\nP\u0159\u00edklad <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/126806\/\">\u00fatok\u016fm<\/a><\/noindex>.<\/p>\n<p>U1.1.10. &lt;...&gt;, p\u0159edt\u00edm ulo\u017een\u00e9 u Klienta.<br \/>\n<i>Vysv\u011btlen\u00ed \u00da1.1.10.<\/i><br \/>\nNap\u0159\u00edklad u\u017eivatel mohl v prohl\u00ed\u017ee\u010di ulo\u017eit p\u0159ihla\u0161ovac\u00ed jm\u00e9no a heslo pro p\u0159\u00edstup na ur\u010ditou webovou str\u00e1nku.<\/p>\n<p>\u00da1.1.11. \u00dato\u010dn\u00edci zkompromitovali p\u0159ihla\u0161ovac\u00ed \u00fadaje kv\u016fli nedostatk\u016fm v procesu odn\u011bt\u00ed p\u0159\u00edstup\u016f u\u017eivatel\u016f.<br \/>\n<i>Vysv\u011btlen\u00ed \u00da1.1.11.<\/i><br \/>\nNap\u0159\u00edklad po odchodu u\u017eivatele z pr\u00e1ce jeho \u00fa\u010dty z\u016fstaly nezablokovan\u00e9.<\/p>\n<p>U1.2. &lt;...&gt; prost\u0159ednictv\u00edm vyu\u017e\u00edv\u00e1n\u00ed zranitelnost\u00ed v syst\u00e9mu \u0159\u00edzen\u00ed p\u0159\u00edstupu.<br \/>\n<noindex><a rel=\"nofollow\" name=\"TMUSRDU2\"><\/a><\/noindex> <\/p>\n<h3>\u00da2. Neopr\u00e1vn\u011bn\u00e9 zv\u00fd\u0161en\u00ed opr\u00e1vn\u011bn\u00ed u\u017eivatele v informa\u010dn\u00edm syst\u00e9mu.<\/h3>\n<p>\n<b>Dekonstrukce<\/b><br \/>\nU2.1 &lt;...&gt; prov\u00e1d\u011bn\u00edm neopr\u00e1vn\u011bn\u00fdch zm\u011bn v datech obsahuj\u00edc\u00edch informace o u\u017eivatelsk\u00fdch opr\u00e1vn\u011bn\u00edch.<\/p>\n<p>U2.2 &lt;...&gt; prost\u0159ednictv\u00edm vyu\u017e\u00edv\u00e1n\u00ed zranitelnost\u00ed v syst\u00e9mu \u0159\u00edzen\u00ed p\u0159\u00edstupu.<\/p>\n<p>U2.3. &lt;...&gt; v d\u016fsledku nedostatk\u016f v procesu \u0159\u00edzen\u00ed p\u0159\u00edstupu u\u017eivatel\u016f.<br \/>\n<i>Vysv\u011btlen\u00ed U2.3.<\/i><br \/>\nP\u0159\u00edklad 1. U\u017eivatel m\u011bl p\u0159\u00edstup, kter\u00fd byl v\u011bt\u0161\u00ed, ne\u017e jak\u00fd pot\u0159eboval pro sv\u00e9 pracovn\u00ed povinnosti.<br \/>\nP\u0159\u00edklad 2. Po p\u0159eveden\u00ed u\u017eivatele na jinou pozici nebyla d\u0159\u00edve poskytnut\u00e1 pr\u00e1va p\u0159\u00edstupu odvol\u00e1na.<\/p>\n<p>\n<noindex><a rel=\"nofollow\" name=\"TMUMI\"><\/a><\/noindex><\/p>\n<h2>TYPOV\u00dd MODEL HROZEB. INTEGRA\u010cN\u00cd MODUL<\/h2>\n<p><\/p>\n<h3>Objekt ochrany, pro kter\u00fd se pou\u017e\u00edv\u00e1 model hrozeb (scope)<\/h3>\n<p>\nIntegra\u010dn\u00ed modul je soubor objekt\u016f informa\u010dn\u00ed infrastruktury ur\u010den\u00fd k uspo\u0159\u00e1d\u00e1n\u00ed v\u00fdm\u011bny informac\u00ed mezi informa\u010dn\u00edmi syst\u00e9my.<\/p>\n<p>Vzhledem k tomu, \u017ee v korpor\u00e1tn\u00edch s\u00edt\u00edch nen\u00ed v\u017edy mo\u017en\u00e9 jednozna\u010dn\u011b odd\u011blit jeden informa\u010dn\u00ed syst\u00e9m od druh\u00e9ho, integra\u010dn\u00ed modul lze ch\u00e1pat tak\u00e9 jako spojovac\u00ed \u010dl\u00e1nek mezi komponenty uvnit\u0159 jednoho informa\u010dn\u00edho syst\u00e9mu.<\/p>\n<p><b>Architektura<\/b><br \/>\nZjednodu\u0161en\u00fd diagram integra\u010dn\u00edho modulu vypad\u00e1 takto:<\/p>\n<p><img decoding=\"async\" alt=\"Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 8 \u2013 Typov\u00e9 modely hrozeb\" src=\"\/wp-content\/uploads\/2019\/04\/6b91d59698b761a14aef7f1c4fbec325.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPopis prvk\u016f architektury:<\/p>\n<ul>\n<li><i>\u00abServer v\u00fdm\u011bny (\u0421\u041e)\u00bb<\/i> \u2013 uzel \/ slu\u017eba \/ komponenta informa\u010dn\u00edho syst\u00e9mu, kter\u00e1 vykon\u00e1v\u00e1 funkci v\u00fdm\u011bny dat s jin\u00fdm informa\u010dn\u00edm syst\u00e9mem.<\/li>\n<li><i>\u00abZprost\u0159edkovatel\u00bb<\/i> \u2013 uzel \/ slu\u017eba, ur\u010den\u00e1 k organizaci interakce mezi informa\u010dn\u00edmi syst\u00e9my, ale nepat\u0159\u00edc\u00ed do jejich struktury. <br \/>\nP\u0159\u00edklady <i>\u00abZprost\u0159edkovatel\u016f\u00bb<\/i> mohou b\u00fdt slu\u017eby elektronick\u00e9 po\u0161ty, podnikov\u00e9 servisn\u00ed sb\u011brnice (enterprise service bus \/ architektura SoA), extern\u00ed souborov\u00e9 servery atd. V obecn\u00e9m p\u0159\u00edpad\u011b integra\u010dn\u00ed modul nemus\u00ed obsahovat \u00abZprost\u0159edkovatele\u00bb.<\/li>\n<li><i>\u00abSW pro zpracov\u00e1n\u00ed dat\u00bb<\/i> \u2013 soubor program\u016f, kter\u00e9 realizuj\u00ed protokoly pro v\u00fdm\u011bnu dat a transformaci form\u00e1t\u016f. <br \/>\nNap\u0159\u00edklad p\u0159evod dat z form\u00e1tu UFEBS do form\u00e1tu ABS, zm\u011bna stav\u016f zpr\u00e1v b\u011bhem p\u0159enosu atd.<\/li>\n<li><i>\u201eS\u00ed\u0165ov\u00e9 spojen\u00ed\u201c<\/i> odpov\u00edd\u00e1 objektu popsan\u00e9mu v typov\u00e9m modelu hrozeb \u00abS\u00ed\u0165ov\u00e9 spojen\u00ed\u00bb. N\u011bkter\u00e1 s\u00ed\u0165ov\u00e1 spojen\u00ed z t\u011bch, kter\u00e9 jsou uvedeny na v\u00fd\u0161e uveden\u00e9m diagramu, nemus\u00ed existovat.<\/li>\n<\/ul>\n<p><b>P\u0159\u00edklady integra\u010dn\u00edch modul\u016f<\/b><\/p>\n<p><i>Diagram 1. Integrace ABS a ARM KBR prost\u0159ednictv\u00edm extern\u00edho souborov\u00e9ho serveru<\/i><\/p>\n<p>Pro prov\u00e1d\u011bn\u00ed plateb opr\u00e1vn\u011bn\u00fd pracovn\u00edk banky exportuje z A\u0411C elektronick\u00e9 platebn\u00ed dokumenty a ukl\u00e1d\u00e1 je do souboru (vlastn\u00edho form\u00e1tu, nap\u0159\u00edklad SQL dump) na s\u00ed\u0165ov\u00e9 slo\u017ece (&#8230;SHARE) souborov\u00e9ho serveru. Tento soubor je pot\u00e9 pomoc\u00ed konvertuj\u00edc\u00edho skriptu p\u0159eveden na sadu soubor\u016f ve form\u00e1tu \u0423\u0424\u042d\u0411\u0421, kter\u00e9 n\u00e1sledn\u011b \u010dte A\u0420\u041c K\u0411\u0420. <br \/>\nPot\u00e9 opr\u00e1vn\u011bn\u00fd pracovn\u00edk \u2014 u\u017eivatel ARM KBR \u2014 za\u0161ifruje a podep\u00ed\u0161e obdr\u017een\u00fd soubor a ode\u0161le jej do platebn\u00edho syst\u00e9mu Centr\u00e1ln\u00ed banky Ruska.<\/p>\n<p>P\u0159i p\u0159\u00edjmu plateb od Centr\u00e1ln\u00ed banky Ruska ARM KBR provede jejich de\u0161ifrov\u00e1n\u00ed a kontrolu elektronick\u00e9ho podpisu, pot\u00e9 je ulo\u017e\u00ed jako sadu soubor\u016f ve form\u00e1tu UFBSC na souborov\u00fd server. P\u0159ed importem platebn\u00edch dokument\u016f do ABS jsou p\u0159evedeny pomoc\u00ed konverzn\u00edho skriptu z form\u00e1tu UFBSC do form\u00e1tu ABS. <\/p>\n<p>P\u0159edpokl\u00e1dejme, \u017ee v t\u00e9to sch\u00e9matu funguje ABS na jednom fyzick\u00e9m serveru, ARM KBR b\u011b\u017e\u00ed na vyhrazen\u00e9m po\u010d\u00edta\u010di a konverzn\u00ed skript pracuje na souborov\u00e9m serveru.<\/p>\n<p><img decoding=\"async\" alt=\"Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 8 \u2013 Typov\u00e9 modely hrozeb\" src=\"\/wp-content\/uploads\/2019\/04\/bef53aaa1deaee5adeca620204345642.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSoulad objekt\u016f uveden\u00e9 sch\u00e9matu s prvky modelu integra\u010dn\u00edho modulu:<br \/>\n<i>\u201eServery v\u00fdm\u011bny ze strany ABS\u201c<\/i> \u2013 server ABS.<br \/>\n<i>\u201eServery v\u00fdm\u011bny ze strany ARM KBR\u201c<\/i> \u2013 po\u010d\u00edta\u010d ARM KBR.<br \/>\n<i>\u00abZprost\u0159edkovatel\u00bb<\/i> \u2013 extern\u00ed souborov\u00fd server.<br \/>\n<i>\u00abSW pro zpracov\u00e1n\u00ed dat\u00bb<\/i> \u2013 konverzn\u00ed skript.<\/p>\n<p><i>Sch\u00e9ma 2. Integrace ABS a ARM KBR p\u0159i um\u00edst\u011bn\u00ed sd\u00edlen\u00e9 s\u00ed\u0165ov\u00e9 slo\u017eky s platbami na ARM KBR<\/i><\/p>\n<p>V\u0161e podobn\u011b jako ve sch\u00e9matu 1, ale samostatn\u00fd souborov\u00fd server nen\u00ed pou\u017eit, m\u00edsto toho je s\u00ed\u0165ov\u00e1 slo\u017eka (&#8230;SHARE) s elektronick\u00fdmi platebn\u00edmi dokumenty um\u00edst\u011bna na po\u010d\u00edta\u010di s A\u0420\u041c K\u0411\u0420. Konvertuj\u00edc\u00ed skript tak\u00e9 pracuje na A\u0420\u041c K\u0411\u0420.<\/p>\n<p><img decoding=\"async\" alt=\"Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 8 \u2013 Typov\u00e9 modely hrozeb\" src=\"\/wp-content\/uploads\/2019\/04\/7d3ecde6d78b2c45e1249236c7da925b.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSoulad objekt\u016f uveden\u00e9 sch\u00e9matu s prvky modelu integra\u010dn\u00edho modulu:<br \/>\nStejn\u011b jako ve Sch\u00e9matu 1, ale <i>\u00abZprost\u0159edkovatel\u00bb<\/i> nen\u00ed pou\u017e\u00edv\u00e1n.<\/p>\n<p><i>Sch\u00e9ma 3. Integrace ABS a ARM KBR-N p\u0159es IBM WebSphere MQ a proveden\u00ed podpisu elektronick\u00fdch dokument\u016f \u201ena stran\u011b ABS\u201c<\/i><\/p>\n<p>ABS b\u011b\u017e\u00ed na platform\u011b, kter\u00e1 nen\u00ed podporov\u00e1na SKZI SKAD Signatura. Podpis odchoz\u00edch elektronick\u00fdch dokument\u016f se prov\u00e1d\u00ed na speci\u00e1ln\u00edm serveru elektronick\u00e9ho podpisu (Server EP). Tento sam\u00fd server kontroluje elektronick\u00fd podpis u p\u0159\u00edchoz\u00edch dokument\u016f od Centr\u00e1ln\u00ed banky Ruska.<\/p>\n<p>ABS nahr\u00e1v\u00e1 na Server EP soubor s platebn\u00edmi dokumenty ve vlastn\u00edm form\u00e1tu.<br \/>\nServer EP pomoc\u00ed konverzn\u00edho skriptu p\u0159ev\u00e1d\u00ed soubor na elektronick\u00e9 zpr\u00e1vy ve form\u00e1tu UFBSC, pot\u00e9 jsou elektronick\u00e9 zpr\u00e1vy podeps\u00e1ny a odesl\u00e1ny na IBM WebSphere MQ.<\/p>\n<p>ARM KBR-N se obrac\u00ed na IBM WebSphere MQ a z\u00edsk\u00e1v\u00e1 odtud podepsan\u00e9 platebn\u00ed zpr\u00e1vy, pot\u00e9 opr\u00e1vn\u011bn\u00fd pracovn\u00edk \u2014 u\u017eivatel ARM KBR \u2014 je za\u0161ifruje a ode\u0161le do platebn\u00edho syst\u00e9mu Centr\u00e1ln\u00ed banky Ruska.<\/p>\n<p>P\u0159i p\u0159ij\u00edm\u00e1n\u00ed plateb od Banky Ruska AR\u041c KBR-N je dek\u00f3duje a kontroluje elektronick\u00fd podpis. \u00dasp\u011b\u0161n\u011b zpracovan\u00e9 platby ve form\u011b de\u0161ifrovan\u00fdch a podepsan\u00fdch elektronick\u00fdch zpr\u00e1v form\u00e1tu UFEB budou p\u0159ed\u00e1ny do IBM WebSphere MQ, odkud je obdr\u017e\u00ed Server EP.<\/p>\n<p>Server EP kontroluje elektronick\u00fd podpis p\u0159ijat\u00fdch plateb a ukl\u00e1d\u00e1 je do souboru form\u00e1tu ABS. Pot\u00e9 opr\u00e1vn\u011bn\u00fd pracovn\u00edk \u2014 u\u017eivatel ABS \u2014 nahraje z\u00edskan\u00fd soubor do ABS v p\u0159edepsan\u00e9m po\u0159ad\u00ed.<\/p>\n<p><img decoding=\"async\" alt=\"Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 8 \u2013 Typov\u00e9 modely hrozeb\" src=\"\/wp-content\/uploads\/2019\/04\/b1bd9c224b18dc84cca5f8bdc7d69713.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSoulad objekt\u016f uveden\u00e9 sch\u00e9matu s prvky modelu integra\u010dn\u00edho modulu:<br \/>\n<i>\u201eServer v\u00fdm\u011bny ze strany ABS\u201c<\/i> \u2013 server ABS.<br \/>\n<i>\u201eServer v\u00fdm\u011bny ze strany AR\u041c KBR\u201c<\/i> \u2014 po\u010d\u00edta\u010d AR\u041c KBR.<br \/>\n<i>\u00abZprost\u0159edkovatel\u00bb<\/i> \u2013 Server EP a IBM WebSphere MQ.<br \/>\n<i>\u00abSW pro zpracov\u00e1n\u00ed dat\u00bb<\/i> \u2013 skript-konvertor, SKZI SKAD Podpis na Serveru EP.<\/p>\n<p><i>Sch\u00e9ma 4. Integrace Serveru DBO a ABS p\u0159es API poskytovan\u00e9 vyhrazen\u00fdm serverem v\u00fdm\u011bny<\/i><\/p>\n<p>Budeme p\u0159edpokl\u00e1dat, \u017ee v bance je pou\u017e\u00edv\u00e1no n\u011bkolik syst\u00e9m\u016f vzd\u00e1len\u00e9ho bankovnictv\u00ed (DBO): <\/p>\n<ul>\n<li>\u201eInternet Klient-Bank\u201c pro fyzick\u00e9 osoby (IKB FL);<\/li>\n<li>\u201eInternet Klient-Bank\u201c pro pr\u00e1vnick\u00e9 osoby (IKB J\u041b). <\/li>\n<\/ul>\n<p>\nZa \u00fa\u010delem zaji\u0161t\u011bn\u00ed informa\u010dn\u00ed bezpe\u010dnosti je ve\u0161ker\u00e1 interakce ABS se syst\u00e9my DBO realizov\u00e1na prost\u0159ednictv\u00edm vyhrazen\u00e9ho serveru v\u00fdm\u011bny, kter\u00fd pracuje v r\u00e1mci informa\u010dn\u00edho syst\u00e9mu \u201eABS\u201c.<\/p>\n<p>Nyn\u00ed se pod\u00edv\u00e1me na proces interakce syst\u00e9mu DBO IKB J\u041b s ABS.<br \/>\nServer DBO, kter\u00fd od klienta obdr\u017eel \u0159\u00e1dn\u011b ov\u011b\u0159en\u00fd platebn\u00ed p\u0159\u00edkaz, mus\u00ed na jeho z\u00e1klad\u011b vytvo\u0159it odpov\u00eddaj\u00edc\u00ed dokument v ABS. K tomu pomoc\u00ed API p\u0159ed\u00e1v\u00e1 informace na server v\u00fdm\u011bny, kter\u00fd pot\u00e9 vkl\u00e1d\u00e1 data do ABS. <\/p>\n<p>P\u0159i zm\u011bn\u011b z\u016fstatk\u016f na \u00fa\u010dtu klienta ABS vytv\u00e1\u0159\u00ed elektronick\u00e1 ozn\u00e1men\u00ed, kter\u00e1 pomoc\u00ed serveru v\u00fdm\u011bny p\u0159ed\u00e1v\u00e1 na server DBO.<\/p>\n<p><img decoding=\"async\" alt=\"Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 8 \u2013 Typov\u00e9 modely hrozeb\" src=\"\/wp-content\/uploads\/2019\/04\/63f88ad151996e7ddaa883349a6d8e22.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSoulad objekt\u016f uveden\u00e9 sch\u00e9matu s prvky modelu integra\u010dn\u00edho modulu:<br \/>\n<i>\u201eServer v\u00fdm\u011bny ze strany DBO\u201c<\/i> \u2013 server DBO IKB J\u041b.<br \/>\n<i>\u201eServer v\u00fdm\u011bny ze strany ABS\u201c<\/i> \u2013 server v\u00fdm\u011bny.<br \/>\n<i>\u00abZprost\u0159edkovatel\u00bb<\/i> \u2013 nen\u00ed p\u0159\u00edtomno.<br \/>\n<i>\u00abSW pro zpracov\u00e1n\u00ed dat\u00bb<\/i> \u2013 komponenty Serveru DBO odpov\u011bdn\u00e9 za vyu\u017e\u00edv\u00e1n\u00ed API serveru v\u00fdm\u011bny, komponenty serveru v\u00fdm\u011bny odpov\u011bdn\u00e9 za vyu\u017e\u00edv\u00e1n\u00ed API ABS.<\/p>\n<h3>Hrozby bezpe\u010dnosti na vy\u0161\u0161\u00ed \u00farovni<\/h3>\n<p>\n<b>Dekonstrukce<\/b><br \/>\nU1. Vniknut\u00ed \u00fato\u010dn\u00edky fale\u0161n\u00fdch informac\u00ed prost\u0159ednictv\u00edm integra\u010dn\u00edho modulu. <br \/>\n<noindex><a rel=\"nofollow\" name=\"TMUMIU1\"><\/a><\/noindex><\/p>\n<h3>U1. Vniknut\u00ed \u00fato\u010dn\u00edky fale\u0161n\u00fdch informac\u00ed prost\u0159ednictv\u00edm integra\u010dn\u00edho modulu <\/h3>\n<p><b>Dekonstrukce<\/b><br \/>\nU1.1. Neautorizovan\u00e1 modifikace legitimn\u00edch dat b\u011bhem jejich p\u0159enosu skrze s\u00ed\u0165ov\u00e1 spojen\u00ed:<br \/>\nU1.1.1 Odkaz: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUNCU2\">\u00abTypov\u00fd model hrozeb. S\u00ed\u0165ov\u00e9 p\u0159ipojen\u00ed. U2. Neautorizovan\u00e1 modifikace p\u0159en\u00e1\u0161en\u00fdch dat\u00bb<\/a><\/noindex>.<\/p>\n<p>U1.2. P\u0159enos fale\u0161n\u00fdch dat po komunika\u010dn\u00edch kan\u00e1lech jm\u00e9nem legitimn\u00edho \u00fa\u010dastn\u00edka v\u00fdm\u011bny:<br \/>\nU1.1.2 Odkaz: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUNCU3\">\u00abTypov\u00fd model hrozeb. S\u00ed\u0165ov\u00e9 spojen\u00ed. U3. Poru\u0161en\u00ed autorsk\u00fdch pr\u00e1v p\u0159en\u00e1\u0161en\u00fdch dat\u00bb<\/a><\/noindex>.<\/p>\n<p>U1.3. Neopr\u00e1vn\u011bn\u00e1 modifikace legitimn\u00edch dat p\u0159i jejich zpracov\u00e1n\u00ed na serverech v\u00fdm\u011bny nebo zprost\u0159edkovatel\u00edch:<br \/>\nU1.3.1. Odkaz: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUISU2\">\u00abTypov\u00fd model hrozeb. Informa\u010dn\u00ed syst\u00e9m postaven\u00fd na architektu\u0159e klient-server. U2. Neopr\u00e1vn\u011bn\u00e1 modifikace chr\u00e1n\u011bn\u00fdch informac\u00ed b\u011bhem jejich zpracov\u00e1n\u00ed serverovou \u010d\u00e1st\u00ed informa\u010dn\u00edho syst\u00e9mu\u00bb<\/a><\/noindex>.<\/p>\n<p>U1.4. Vytvo\u0159en\u00ed na serverech v\u00fdm\u011bny nebo zprost\u0159edkovatel\u00edch podvodn\u00fdch dat jm\u00e9nem legitimn\u00edho \u00fa\u010dastn\u00edka v\u00fdm\u011bny:<br \/>\nU1.4.1. Odkaz: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUISU1\">\u00abTypov\u00fd model hrozeb. Informa\u010dn\u00ed syst\u00e9m postaven\u00fd na architektu\u0159e klient-server. U1. Prov\u00e1d\u011bn\u00ed neautorizovan\u00fdch akc\u00ed \u00fato\u010dn\u00edky jm\u00e9nem legitimn\u00edho u\u017eivatele\u00bb.<\/a><\/noindex><\/p>\n<p>U1.5. Neopr\u00e1vn\u011bn\u00e1 modifikace dat p\u0159i jejich zpracov\u00e1n\u00ed pomoc\u00ed softwaru pro zpracov\u00e1n\u00ed dat:<br \/>\nU1.5.1. &lt;...&gt; v d\u016fsledku neopr\u00e1vn\u011bn\u00fdch zm\u011bn \u00fato\u010dn\u00edky v nastaven\u00ed (konfiguraci) softwaru pro zpracov\u00e1n\u00ed dat.<br \/>\nU1.5.2. &lt;...&gt; v d\u016fsledku neopr\u00e1vn\u011bn\u00fdch zm\u011bn \u00fato\u010dn\u00edky v spustiteln\u00fdch souborech softwaru pro zpracov\u00e1n\u00ed dat.<br \/>\nU1.5.3. &lt;...&gt; v d\u016fsledku interaktivn\u00edho ovl\u00e1d\u00e1n\u00ed prac\u00ed softwaru pro zpracov\u00e1n\u00ed dat \u00fato\u010dn\u00edky.<\/p>\n<p>\n<noindex><a rel=\"nofollow\" name=\"TMUSKZI\"><\/a><\/noindex><\/p>\n<h2>TYPOV\u00dd MODEL HROZEB. SYST\u00c9M KRYPTOGRAFICK\u00c9 OCHRANY INFORMAC\u00cd<\/h2>\n<p><\/p>\n<h3>Objekt ochrany, pro kter\u00fd se pou\u017e\u00edv\u00e1 model hrozeb (scope)<\/h3>\n<p>\nObjektem ochrany je syst\u00e9m kryptografick\u00e9 ochrany informac\u00ed, kter\u00fd se pou\u017e\u00edv\u00e1 k zaji\u0161t\u011bn\u00ed bezpe\u010dnosti informa\u010dn\u00edho syst\u00e9mu.<\/p>\n<p><b>Architektura<\/b><br \/>\nZ\u00e1kladem jak\u00e9hokoli informa\u010dn\u00edho syst\u00e9mu je aplika\u010dn\u00ed software (SW), kter\u00fd realizuje jeho c\u00edlovou funkcionalitu. <\/p>\n<p>Kryptografick\u00e1 ochrana se obvykle realizuje vol\u00e1n\u00edm kryptografick\u00fdch primitiv z obchodn\u00ed logiky aplika\u010dn\u00edho SW, kter\u00e9 jsou um\u00edst\u011bny ve specializovan\u00fdch knihovn\u00e1ch \u2013 kryptoj\u00e1drech.<\/p>\n<p>Kryptografick\u00e1 primitiva zahrnuj\u00ed n\u00edzko\u00farov\u0148ov\u00e9 kryptografick\u00e9 funkce, jako nap\u0159\u00edklad:<\/p>\n<ul>\n<li>\u0161ifrovat \/ de\u0161ifrovat blok dat;<\/li>\n<li>vytvo\u0159it \/ ov\u011b\u0159it elektronick\u00fd podpis bloku dat;<\/li>\n<li>vypo\u010d\u00edtat hash funkci bloku dat;<\/li>\n<li>vytvo\u0159it \/ nahr\u00e1t \/ exportovat kl\u00ed\u010dov\u00e9 informace;<\/li>\n<li>atd.<\/li>\n<\/ul>\n<p>\nObchodn\u00ed logika aplika\u010dn\u00edho SW s pomoc\u00ed kryptografick\u00fdch primitiv realizuje vy\u0161\u0161\u00ed \u00farov\u0148ovou funkcionalitu:<\/p>\n<ul>\n<li>\u0161ifrovat soubor na z\u00e1klad\u011b kl\u00ed\u010d\u016f vybran\u00fdch p\u0159\u00edjemc\u016f;<\/li>\n<li>nastavit zabezpe\u010den\u00e9 s\u00ed\u0165ov\u00e9 p\u0159ipojen\u00ed;<\/li>\n<li>informovat o v\u00fdsledc\u00edch kontroly elektronick\u00e9ho podpisu;<\/li>\n<li>atd.<\/li>\n<\/ul>\n<p>\nInterakce obchodn\u00ed logiky a kryptoj\u00e1dra m\u016f\u017ee prob\u00edhat:<\/p>\n<ul>\n<li>p\u0159\u00edmo, prost\u0159ednictv\u00edm vyvol\u00e1n\u00ed kryptografick\u00fdch primitiv obchodn\u00ed logikou z dynamick\u00fdch knihoven kryptoj\u00e1dra (.DLL \u2013 pro Windows, .SO \u2013 pro Linux);<\/li>\n<li>nep\u0159\u00edmo, prost\u0159ednictv\u00edm kryptografick\u00fdch rozhran\u00ed \u2013 wrapper\u016f, nap\u0159\u00edklad MS Crypto API, Java Cryptography Architecture, PKCS#11 atd. V tomto p\u0159\u00edpad\u011b obchodn\u00ed logika vol\u00e1 kryptointerface, kter\u00e9 pak p\u0159elo\u017e\u00ed vol\u00e1n\u00ed na p\u0159\u00edslu\u0161n\u00e9 kryptoj\u00e1dro, kter\u00e9 se v takov\u00e9m p\u0159\u00edpad\u011b naz\u00fdv\u00e1 kryptopro poskytovatelem. Pou\u017eit\u00ed kryptografick\u00fdch rozhran\u00ed umo\u017e\u0148uje aplika\u010dn\u00edmu softwaru abstrahovat se od konkr\u00e9tn\u00edch kryptografick\u00fdch algoritm\u016f a b\u00fdt flexibiln\u011bj\u0161\u00ed.<\/li>\n<\/ul>\n<p>\nLze vy\u010dlenit dv\u011b typov\u00e9 sch\u00e9mata organizace kryptoj\u00e1dra:<\/p>\n<p><i>Sch\u00e9ma 1 \u2013 Monolitick\u00e9 kryptoj\u00e1dro<\/i><br \/>\n<img decoding=\"async\" alt=\"Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 8 \u2013 Typov\u00e9 modely hrozeb\" src=\"\/wp-content\/uploads\/2019\/04\/e5186d11e4e0e9ad9361f3935228bc30.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<i>Sch\u00e9ma 2 \u2013 Rozd\u011blen\u00e9 kryptoj\u00e1dro<\/i><br \/>\n<img decoding=\"async\" alt=\"Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 8 \u2013 Typov\u00e9 modely hrozeb\" src=\"\/wp-content\/uploads\/2019\/04\/9953d524fbee78d7e4eb917e9d56a38f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nElementy v uveden\u00fdch sch\u00e9matech mohou b\u00fdt jak jednotliv\u00fdmi moduly softwaru, kter\u00e9 pracuj\u00ed na jednom po\u010d\u00edta\u010di, tak s\u00ed\u0165ov\u00fdmi slu\u017ebami, kter\u00e9 interaguj\u00ed v r\u00e1mci v\u00fdpo\u010detn\u00ed s\u00edt\u011b.<\/p>\n<p>P\u0159i pou\u017eit\u00ed syst\u00e9m\u016f zalo\u017een\u00fdch na sch\u00e9matu 1 pracuj\u00ed aplika\u010dn\u00ed software a kryptoj\u00e1dro v r\u00e1mci jedn\u00e9 provozn\u00ed prost\u0159ed\u00ed kryptografick\u00e9ho prost\u0159edku (SFK), nap\u0159\u00edklad na stejn\u00e9m po\u010d\u00edta\u010di, pod \u0159\u00edzen\u00edm stejn\u00e9ho opera\u010dn\u00edho syst\u00e9mu. U\u017eivatel syst\u00e9mu m\u00e1 obvykle mo\u017enost spou\u0161t\u011bt v r\u00e1mci t\u00e9to provozn\u00ed prost\u0159ed\u00ed i dal\u0161\u00ed programy, v\u010detn\u011b takov\u00fdch, kter\u00e9 obsahuj\u00ed \u0161kodliv\u00fd k\u00f3d. V takov\u00fdch podm\u00ednk\u00e1ch existuje v\u00e1\u017en\u00e9 riziko \u00faniku uzav\u0159en\u00fdch kryptografick\u00fdch kl\u00ed\u010d\u016f.<\/p>\n<p>Pro minimalizaci rizika se pou\u017e\u00edv\u00e1 sch\u00e9ma 2, p\u0159i kter\u00e9m se kryptoj\u00e1dro d\u011bl\u00ed na dv\u011b \u010d\u00e1sti:<\/p>\n<ol>\n<li>Prvn\u00ed \u010d\u00e1st spolu s aplika\u010dn\u00edm softwarem pracuje v ned\u016fv\u011bryhodn\u00e9m prost\u0159ed\u00ed, kde existuje riziko naka\u017een\u00ed \u0161kodliv\u00fdm k\u00f3dem. Budeme tuto \u010d\u00e1st naz\u00fdvat \u2013 \u201eprogramovou \u010d\u00e1st\u00ed\u201c.<\/li>\n<li>Druh\u00e1 \u010d\u00e1st pracuje v d\u016fv\u011bryhodn\u00e9m prost\u0159ed\u00ed na dedikovan\u00e9m za\u0159\u00edzen\u00ed, kter\u00e9 obsahuje \u00falo\u017ei\u0161t\u011b uzav\u0159en\u00fdch kl\u00ed\u010d\u016f. D\u00e1le budeme tuto \u010d\u00e1st naz\u00fdvat \u2013 \u201ehardwarovou \u010d\u00e1st\u00ed\u201c.<\/li>\n<\/ol>\n<p>\nRozd\u011blen\u00ed kryptoj\u00e1dra na softwarovou a hardwarovou \u010d\u00e1st je velmi relativn\u00ed. Na trhu existuj\u00ed syst\u00e9my, kter\u00e9 jsou postaveny na principu se separovan\u00fdm kryptoj\u00e1drem, ale \"hardwarov\u00e1\" \u010d\u00e1st je prezentov\u00e1na ve form\u011b obrazu virtu\u00e1ln\u00ed stroje \u2014 virtual HSM (<noindex><a rel=\"nofollow\" href=\"https:\/\/www.unboundtech.com\/product\/unbound-key-control\/\">p\u0159\u00edklad<\/a><\/noindex>).<\/p>\n<p>Interakce obou \u010d\u00e1st\u00ed kryptoj\u00e1dra prob\u00edh\u00e1 tak, \u017ee uzav\u0159en\u00e9 kryptografick\u00e9 kl\u00ed\u010de nikdy nejsou p\u0159ed\u00e1v\u00e1ny do softwarov\u00e9 \u010d\u00e1sti a t\u00edm p\u00e1dem nemohou b\u00fdt ukradeny pomoc\u00ed malwaru.<\/p>\n<p>Rozhran\u00ed pro interakci (API) a sada kryptografick\u00fdch primitiv, kter\u00e9 kryptoj\u00e1dro poskytuje aplika\u010dn\u00edmu softwaru, jsou v obou p\u0159\u00edpadech shodn\u00e9. Rozd\u00edl spo\u010d\u00edv\u00e1 v zp\u016fsobu jejich implementace.<\/p>\n<p>P\u0159i pou\u017eit\u00ed sch\u00e9matu se separovan\u00fdm kryptoj\u00e1drem je interakce softwarov\u00e9 a hardwarov\u00e9 \u010d\u00e1sti prov\u00e1d\u011bna podle n\u00e1sleduj\u00edc\u00edho principu:<\/p>\n<ol>\n<li>Kryptografick\u00e9 primitivy, kter\u00e9 nevy\u017eaduj\u00ed pou\u017eit\u00ed uzav\u0159en\u00e9ho kl\u00ed\u010de (nap\u0159\u00edklad v\u00fdpo\u010det hashov\u00e9 funkce, ov\u011b\u0159en\u00ed elektronick\u00e9ho podpisu atd.), jsou vykon\u00e1v\u00e1ny softwarovou \u010d\u00e1st\u00ed.<\/li>\n<li>Kryptografick\u00e9 primitivy, kter\u00e9 pou\u017e\u00edvaj\u00ed uzav\u0159en\u00fd kl\u00ed\u010d (vytv\u00e1\u0159en\u00ed elektronick\u00e9ho podpisu, de\u0161ifrov\u00e1n\u00ed dat atd.), jsou vykon\u00e1v\u00e1ny hardwarovou \u010d\u00e1st\u00ed.<\/li>\n<\/ol>\n<p>\nPro ilustrov\u00e1n\u00ed pr\u00e1ce separovan\u00e9ho kryptoj\u00e1dra pou\u017eijeme p\u0159\u00edklad vytv\u00e1\u0159en\u00ed elektronick\u00e9ho podpisu:<\/p>\n<ol>\n<li>Softwarov\u00e1 \u010d\u00e1st vypo\u010d\u00edt\u00e1 hashovou funkci podepisovan\u00fdch dat a p\u0159es v\u00fdm\u011bnn\u00fd kan\u00e1l mezi kryptoj\u00e1dry p\u0159ed\u00e1 tuto hodnotu hardwarov\u00e9 \u010d\u00e1sti.<\/li>\n<li>Hardwarov\u00e1 \u010d\u00e1st, vyu\u017e\u00edvaj\u00edc\u00ed uzav\u0159en\u00fd kl\u00ed\u010d a hash, vytvo\u0159\u00ed hodnotu elektronick\u00e9ho podpisu a p\u0159es v\u00fdm\u011bnn\u00fd kan\u00e1l ji p\u0159ed\u00e1 do softwarov\u00e9 \u010d\u00e1sti.<\/li>\n<li>Softwarov\u00e1 \u010d\u00e1st vr\u00e1t\u00ed obdr\u017eenou hodnotu do aplika\u010dn\u00edho softwaru.<\/li>\n<\/ol>\n<p>\n<b>Specifika ov\u011b\u0159ov\u00e1n\u00ed spr\u00e1vnosti elektronick\u00e9ho podpisu<\/b><\/p>\n<p>Kdy\u017e p\u0159ij\u00edmaj\u00edc\u00ed strana obdr\u017e\u00ed data podepsan\u00e1 elektronick\u00fdm podpisem, mus\u00ed prov\u00e9st n\u011bkolik f\u00e1z\u00ed ov\u011b\u0159en\u00ed. Kladn\u00fd v\u00fdsledek ov\u011b\u0159en\u00ed elektronick\u00e9ho podpisu je dosa\u017een pouze p\u0159i \u00fasp\u011b\u0161n\u00e9m spln\u011bn\u00ed v\u0161ech f\u00e1z\u00ed ov\u011b\u0159en\u00ed.<\/p>\n<p><i>F\u00e1ze 1. Kontrola integrity dat a autorstv\u00ed dat.<\/i><\/p>\n<p><u>Obsah f\u00e1ze.<\/u> Kontrola elektronick\u00e9ho podpisu dat se prov\u00e1d\u00ed podle p\u0159\u00edslu\u0161n\u00e9ho kryptografick\u00e9ho algoritmu. \u00dasp\u011b\u0161n\u00e9 dokon\u010den\u00ed t\u00e9to f\u00e1ze ukazuje, \u017ee data nebyla zm\u011bn\u011bna od doby jejich podeps\u00e1n\u00ed a \u017ee podpis byl vytvo\u0159en soukrom\u00fdm kl\u00ed\u010dem odpov\u00eddaj\u00edc\u00edm ve\u0159ejn\u00e9mu kl\u00ed\u010di pro kontrolu elektronick\u00e9ho podpisu.<br \/>\n<u>M\u00edsto prov\u00e1d\u011bn\u00ed f\u00e1ze:<\/u> krypto j\u00e1dro.<\/p>\n<p><i>F\u00e1ze 2. Kontrola d\u016fv\u011bry k ve\u0159ejn\u00e9mu kl\u00ed\u010di signat\u00e1\u0159e a kontrola platnosti soukrom\u00e9ho kl\u00ed\u010de elektronick\u00e9ho podpisu.<\/i><br \/>\n<u>Obsah f\u00e1ze.<\/u> F\u00e1ze se skl\u00e1d\u00e1 ze dvou podf\u00e1z\u00ed. V prvn\u00ed se ur\u010duje, zda byl ve\u0159ejn\u00fd kl\u00ed\u010d pro kontrolu elektronick\u00e9ho podpisu d\u016fv\u011bryhodn\u00fd v okam\u017eiku podeps\u00e1n\u00ed dat. Ve druh\u00e9 se ur\u010duje, zda byl soukrom\u00fd kl\u00ed\u010d elektronick\u00e9ho podpisu platn\u00fd v dob\u011b podeps\u00e1n\u00ed dat. Obecn\u011b mohou m\u00edt platnosti t\u011bchto kl\u00ed\u010d\u016f r\u016fznou dobu (nap\u0159\u00edklad pro kvalifikovan\u00e9 certifik\u00e1ty kl\u00ed\u010d\u016f pro kontrolu elektronick\u00e9ho podpisu). Zp\u016fsoby ur\u010den\u00ed d\u016fv\u011bry k ve\u0159ejn\u00e9mu kl\u00ed\u010di signat\u00e1\u0159e se stanovuj\u00ed pravidly elektronick\u00e9ho dokumentov\u00e9ho ob\u011bhu p\u0159ijat\u00fdmi zainteresovan\u00fdmi stranami.<br \/>\n<u>M\u00edsto prov\u00e1d\u011bn\u00ed f\u00e1ze:<\/u> aplikovan\u00e1 SW \/ krypto j\u00e1dro.<\/p>\n<p><i>F\u00e1ze 3. Kontrola opr\u00e1vn\u011bn\u00ed signat\u00e1\u0159e.<\/i><br \/>\n<u>Obsah f\u00e1ze.<\/u> V souladu se stanoven\u00fdmi pravidly elektronick\u00e9ho dokumentov\u00e9ho ob\u011bhu se kontroluje, zda m\u011bl signat\u00e1\u0159 pr\u00e1vo ov\u011b\u0159it chr\u00e1n\u011bn\u00e1 data. Nap\u0159\u00edklad si vezm\u011bme situaci poru\u0161en\u00ed opr\u00e1vn\u011bn\u00ed. P\u0159edstavme si organizaci, kde maj\u00ed v\u0161ichni zam\u011bstnanci elektronick\u00fd podpis. Do intern\u00edho syst\u00e9mu elektronick\u00e9ho dokumentov\u00e9ho ob\u011bhu p\u0159ijde p\u0159\u00edkaz vedouc\u00edho, ale je podeps\u00e1n elektronick\u00fdm podpisem skladov\u00e9ho mistra. Takov\u00fd dokument tedy nem\u016f\u017ee b\u00fdt pova\u017eov\u00e1n za legitimn\u00ed.<br \/>\n<u>M\u00edsto prov\u00e1d\u011bn\u00ed f\u00e1ze:<\/u> aplikovan\u00e1 SW.<\/p>\n<p><b>P\u0159edpoklady p\u0159ijat\u00e9 p\u0159i popisu objektu ochrany.<\/b><\/p>\n<ol>\n<li>Kan\u00e1ly p\u0159enosu informac\u00ed, s v\u00fdjimkou kan\u00e1l\u016f pro v\u00fdm\u011bnu kl\u00ed\u010d\u016f, proch\u00e1zej\u00ed aplikovan\u00fdm SW, API a krypto j\u00e1drem.<\/li>\n<li>Informace o d\u016fv\u011b\u0159e k ve\u0159ejn\u00fdm kl\u00ed\u010d\u016fm a\/nebo certifik\u00e1t\u016fm, stejn\u011b jako informace o opr\u00e1vn\u011bn\u00edch vlastn\u00edk\u016f ve\u0159ejn\u00fdch kl\u00ed\u010d\u016f, se ukl\u00e1daj\u00ed do \u00falo\u017ei\u0161t\u011b ve\u0159ejn\u00fdch kl\u00ed\u010d\u016f.<\/li>\n<li>Aplikovan\u00fd SW pracuje s \u00falo\u017ei\u0161t\u011bm ve\u0159ejn\u00fdch kl\u00ed\u010d\u016f p\u0159es krypto j\u00e1dro.<\/li>\n<\/ol>\n<p><\/p>\n<h3>P\u0159\u00edklad informa\u010dn\u00edho syst\u00e9mu chr\u00e1n\u011bn\u00e9ho pomoc\u00ed SKZI.<\/h3>\n<p>\nPro ilustraci d\u0159\u00edve uveden\u00fdch sch\u00e9mat uva\u017eujme hypotetick\u00fd informa\u010dn\u00ed syst\u00e9m a vyzdvihneme v n\u011bm v\u0161echny strukturovan\u00e9 prvky. <\/p>\n<p><b>Popis informa\u010dn\u00edho syst\u00e9mu<\/b><\/p>\n<p><img decoding=\"async\" alt=\"Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 8 \u2013 Typov\u00e9 modely hrozeb\" src=\"\/wp-content\/uploads\/2019\/04\/74f3e2fd669ed97f50253fbb4b348f6f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDv\u011b organizace se rozhodly zav\u00e9st mezi sebou pr\u00e1vn\u011b z\u00e1vazn\u00fd elektronick\u00fd ob\u011bh dokument\u016f (EBD). K tomu uzav\u0159ely dohodu, v n\u00ed\u017e bylo uvedeno, \u017ee dokumenty budou p\u0159ed\u00e1v\u00e1ny prost\u0159ednictv\u00edm e-mailu a mus\u00ed b\u00fdt za\u0161ifrov\u00e1ny a podeps\u00e1ny kvalifikovan\u00fdm elektronick\u00fdm podpisem. Jako prost\u0159edky pro vytv\u00e1\u0159en\u00ed a zpracov\u00e1n\u00ed dokument\u016f maj\u00ed b\u00fdt pou\u017eity kancel\u00e1\u0159sk\u00e9 programy z bal\u00edku Microsoft Office 2016, a jako prost\u0159edky kryptografick\u00e9 ochrany \u2014 SZT KryptoPRO a SW \u0161ifrov\u00e1n\u00ed KryptoARM.<\/p>\n<p><b>Popis infrastruktury organizace 1<\/b><\/p>\n<p>Organizace 1 se rozhodla nainstalovat SZT KryptoPRO a SW KryptoARM na u\u017eivatelsk\u00e9 pracovi\u0161t\u011b \u2014 fyzick\u00fd po\u010d\u00edta\u010d. Kl\u00ed\u010de pro \u0161ifrov\u00e1n\u00ed a elektronick\u00fd podpis budou ulo\u017eeny na kl\u00ed\u010dov\u00e9m nosi\u010di ruToken, funguj\u00edc\u00edm v re\u017eimu vyj\u00edmateln\u00e9ho kl\u00ed\u010de. U\u017eivatel bude lokalizovan\u011b p\u0159ipravovat elektronick\u00e9 dokumenty na sv\u00e9m po\u010d\u00edta\u010di, pot\u00e9 je za\u0161ifruje, podep\u00ed\u0161e a ode\u0161le pomoc\u00ed lok\u00e1ln\u011b nainstalovan\u00e9ho po\u0161tovn\u00edho klienta.<\/p>\n<p><b>Popis infrastruktury organizace 2<\/b><\/p>\n<p>Organizace 2 se rozhodla p\u0159esunout funkce \u0161ifrov\u00e1n\u00ed a elektronick\u00e9ho podpisu na vyhrazenou virtu\u00e1ln\u00ed stroj. V\u0161echny kryptografick\u00e9 operace budou prov\u00e1d\u011bny automaticky. <\/p>\n<p>Pro tuto \u00fa\u010del byla na dedikovan\u00e9 virtu\u00e1ln\u00ed ma\u0161in\u011b z\u0159\u00edzena dv\u011b s\u00ed\u0165ov\u00e9 slo\u017eky: \u201e&lt;...In&gt;\u201c, \u201e&lt;...Out&gt;\u201c. Do s\u00ed\u0165ov\u00e9 slo\u017eky \u201e&lt;...In&gt;\u201c budou automaticky um\u00eds\u0165ov\u00e1ny obdr\u017een\u00e9 soubory od kontrahenta ve \u010diteln\u00e9 podob\u011b. Tyto soubory budou de\u0161ifrov\u00e1ny a na nich bude ov\u011b\u0159en elektronick\u00fd podpis.<\/p>\n<p>Do slo\u017eky &#171;&#8230;Out&#187; u\u017eivatel um\u00edst\u00ed soubory, kter\u00e9 je pot\u0159eba za\u0161ifrovat, podepsat a odeslat kontrahentovi. Soubory p\u0159iprav\u00ed u\u017eivatel na sv\u00e9m A\u0420\u041c.<br \/>\nPro prov\u00e1d\u011bn\u00ed funkc\u00ed \u0161ifrov\u00e1n\u00ed a elektronick\u00e9ho podpisu je na virtu\u00e1ln\u00ed stroj nainstalov\u00e1n SZT KryptoPRO, SW KryptoARM a po\u0161tovn\u00ed klient. Automatizovan\u00e9 \u0159\u00edzen\u00ed v\u0161ech prvk\u016f virtu\u00e1ln\u00edho stroje bude zaji\u0161t\u011bno pomoc\u00ed skript\u016f vyvinut\u00fdch syst\u00e9mov\u00fdmi administr\u00e1tory. Pr\u00e1ce skript\u016f je protokolov\u00e1na do soubor\u016f protokol\u016f (logs).<\/p>\n<p>Kryptografick\u00e9 kl\u00ed\u010de elektronick\u00e9ho podpisu budou um\u00edst\u011bny na tokenu s nevyj\u00edmateln\u00fdm kl\u00ed\u010dem JaCarta \u0413\u041e\u0421\u0422, kter\u00fd u\u017eivatel p\u0159ipoj\u00ed k vlastn\u00edmu po\u010d\u00edta\u010di.<\/p>\n<p>Token bude p\u0159enesen na virtu\u00e1ln\u00ed stroj pomoc\u00ed specializovan\u00fdch softwarov\u00fdch prost\u0159edk\u016f USB-over-IP nainstalovan\u00fdch na u\u017eivatelsk\u00e9m pracovn\u00edm m\u00edst\u011b a na virtu\u00e1ln\u00edm stroji.<\/p>\n<p>Syst\u00e9mov\u00e9 hodiny na u\u017eivatelsk\u00e9m pracovn\u00edm m\u00edst\u011b v organizaci 1 budou nastavov\u00e1ny ru\u010dn\u011b. Syst\u00e9mov\u00e9 hodiny specializovan\u00e9ho virtu\u00e1ln\u00edho stroje v organizaci 2 budou synchronizov\u00e1ny se syst\u00e9mov\u00fdmi hodinami hypervizoru, kter\u00e9 budou tak\u00e9 synchronizov\u00e1ny p\u0159es Internet s ve\u0159ejn\u00fdmi \u010dasov\u00fdmi servery.<\/p>\n<p><b>Identifikace struktur\u00e1ln\u00edch prvk\u016f SKZ\u0418<\/b><br \/>\nNa z\u00e1klad\u011b v\u00fd\u0161e uveden\u00e9ho popisu IT infrastruktury identifikujeme struktury SKZ\u0418 a zap\u00ed\u0161eme je do tabulky.<\/p>\n<p><i>Tabulka \u2014 Shoda prvk\u016f modelu SKZ\u0418 s prvky informa\u010dn\u00edch syst\u00e9m\u016f<\/i> <\/p>\n<p><b>N\u00e1zev prvku<\/b><br \/>\n<b>Organizace 1<\/b><br \/>\n<b>Organizace 2<\/b><\/p>\n<p>Aplika\u010dn\u00ed software<br \/>\nSoftware CryptoARM<br \/>\nSoftware CryptoARM<\/p>\n<p>Programov\u00e1 \u010d\u00e1st kryptoprocesoru<br \/>\nSKZ\u0418 CryptoPRO CSP<br \/>\nSKZ\u0418 CryptoPRO CSP<\/p>\n<p>Hardwarov\u00e1 \u010d\u00e1st kryptoprocesoru<br \/>\nchyb\u00ed<br \/>\nJaCarta \u0413\u041e\u0421\u0422<\/p>\n<p>API<br \/>\nMS CryptoAPI<br \/>\nMS CryptoAPI<\/p>\n<p>\u00dalo\u017ei\u0161t\u011b ve\u0159ejn\u00fdch kl\u00ed\u010d\u016f<br \/>\nU\u017eivatelsk\u00e9 pracovn\u00ed m\u00edsto:<br \/>\n \u2014 pevn\u00fd disk;<br \/>\n \u2014 standardn\u00ed \u00falo\u017ei\u0161t\u011b certifik\u00e1t\u016f Windows.<br \/>\nHypervizor:<br \/>\n \u2014 pevn\u00fd disk.<\/p>\n<p>Virtu\u00e1ln\u00ed stroj:<br \/>\n \u2014 pevn\u00fd disk;<br \/>\n \u2014 standardn\u00ed \u00falo\u017ei\u0161t\u011b certifik\u00e1t\u016f Windows.<\/p>\n<p>\u00dalo\u017ei\u0161t\u011b soukrom\u00fdch kl\u00ed\u010d\u016f<br \/>\nKl\u00ed\u010dov\u00fd nosi\u010d ruToken pracuj\u00edc\u00ed v re\u017eimu vyj\u00edmateln\u00e9ho kl\u00ed\u010de<br \/>\nKl\u00ed\u010dov\u00fd nosi\u010d JaCarta \u0413\u041e\u0421\u0422 pracuj\u00edc\u00ed v re\u017eimu nevyj\u00edmateln\u00e9ho kl\u00ed\u010de<\/p>\n<p>Kan\u00e1l pro v\u00fdm\u011bnu ve\u0159ejn\u00fdch kl\u00ed\u010d\u016f<br \/>\nU\u017eivatelsk\u00e9 pracovn\u00ed m\u00edsto:<br \/>\n \u2014 opera\u010dn\u00ed pam\u011b\u0165.<\/p>\n<p>Hypervizor:<br \/>\n \u2014 opera\u010dn\u00ed pam\u011b\u0165.<\/p>\n<p>Virtu\u00e1ln\u00ed stroj:<br \/>\n \u2014 opera\u010dn\u00ed pam\u011b\u0165.<\/p>\n<p>Kan\u00e1l pro v\u00fdm\u011bnu soukrom\u00fdch kl\u00ed\u010d\u016f<br \/>\nU\u017eivatelsk\u00e9 pracovn\u00ed m\u00edsto:<br \/>\n \u2014 USB sb\u011brnice;<br \/>\n \u2014 opera\u010dn\u00ed pam\u011b\u0165.<br \/>\nchyb\u00ed<\/p>\n<p>Kan\u00e1l mezi kryptoprocesory<br \/>\nneexistuje (nen\u00ed hardwarov\u00e1 \u010d\u00e1st kryptoprocesoru)<br \/>\nU\u017eivatelsk\u00e9 pracovn\u00ed m\u00edsto:<br \/>\n \u2014 USB sb\u011brnice;<br \/>\n \u2014 opera\u010dn\u00ed pam\u011b\u0165;<br \/>\n \u2014 softwarov\u00fd modul USB-over-IP;<br \/>\n \u2014 s\u00ed\u0165ov\u00e9 rozhran\u00ed.<\/p>\n<p>Korpor\u00e1tn\u00ed s\u00ed\u0165 organizace 2.<\/p>\n<p>Hypervizor:<br \/>\n \u2014 opera\u010dn\u00ed pam\u011b\u0165;<br \/>\n \u2014 s\u00ed\u0165ov\u00e9 rozhran\u00ed.<\/p>\n<p>Virtu\u00e1ln\u00ed stroj:<br \/>\n \u2014 s\u00ed\u0165ov\u00e9 rozhran\u00ed;<br \/>\n \u2014 opera\u010dn\u00ed pam\u011b\u0165;<br \/>\n \u2014 softwarov\u00fd modul USB-over-IP.<\/p>\n<p>Kan\u00e1l pro v\u00fdm\u011bnu ve\u0159ejn\u00fdch dat<br \/>\nU\u017eivatelsk\u00e9 pracovn\u00ed m\u00edsto:<br \/>\n \u2014 vstupn\u011b-v\u00fdstupn\u00ed prost\u0159edky;<br \/>\n \u2014 opera\u010dn\u00ed pam\u011b\u0165;<br \/>\n \u2014 pevn\u00fd disk.<br \/>\nU\u017eivatelsk\u00e9 pracovn\u00ed m\u00edsto:<br \/>\n \u2014 vstupn\u011b-v\u00fdstupn\u00ed prost\u0159edky;<br \/>\n \u2014 opera\u010dn\u00ed pam\u011b\u0165;<br \/>\n \u2014 pevn\u00fd disk;<br \/>\n \u2014 s\u00ed\u0165ov\u00e9 rozhran\u00ed.<\/p>\n<p>Korpor\u00e1tn\u00ed s\u00ed\u0165 organizace 2.<\/p>\n<p>Hypervizor:<br \/>\n \u2014 s\u00ed\u0165ov\u00e9 rozhran\u00ed; <br \/>\n \u2014 opera\u010dn\u00ed pam\u011b\u0165;<br \/>\n \u2014 pevn\u00fd disk.<\/p>\n<p>Virtu\u00e1ln\u00ed stroj: <br \/>\n \u2014 s\u00ed\u0165ov\u00e9 rozhran\u00ed; <br \/>\n \u2014 opera\u010dn\u00ed pam\u011b\u0165;<br \/>\n \u2014 pevn\u00fd disk.<\/p>\n<p>Kan\u00e1l pro v\u00fdm\u011bnu chr\u00e1n\u011bn\u00fdch dat<br \/>\nInternet.<\/p>\n<p>Korpor\u00e1tn\u00ed s\u00ed\u0165 organizace 1.<\/p>\n<p>U\u017eivatelsk\u00e9 pracovn\u00ed m\u00edsto:<br \/>\n \u2014 pevn\u00fd disk;<br \/>\n \u2014 opera\u010dn\u00ed pam\u011b\u0165;<br \/>\n \u2014 s\u00ed\u0165ov\u00e9 rozhran\u00ed.<\/p>\n<p>Internet.<\/p>\n<p>Korpor\u00e1tn\u00ed s\u00ed\u0165 organizace 2.<\/p>\n<p>Hypervizor:<br \/>\n \u2014 s\u00ed\u0165ov\u00e9 rozhran\u00ed; <br \/>\n \u2014 opera\u010dn\u00ed pam\u011b\u0165;<br \/>\n \u2014 pevn\u00fd disk.<\/p>\n<p>Virtu\u00e1ln\u00ed stroj: <br \/>\n \u2014 s\u00ed\u0165ov\u00e9 rozhran\u00ed; <br \/>\n \u2014 opera\u010dn\u00ed pam\u011b\u0165;<br \/>\n \u2014 pevn\u00fd disk.<\/p>\n<p>Kan\u00e1l pro p\u0159enos \u010dasu<br \/>\nU\u017eivatelsk\u00e9 pracovn\u00ed m\u00edsto:<br \/>\n \u2014 vstupn\u011b-v\u00fdstupn\u00ed prost\u0159edky;<br \/>\n \u2014 opera\u010dn\u00ed pam\u011b\u0165;<br \/>\n \u2014 syst\u00e9mov\u00fd \u010dasova\u010d.<\/p>\n<p>Internet. <br \/>\nKorpor\u00e1tn\u00ed s\u00ed\u0165 organizace 2,<\/p>\n<p>Hypervizor:<br \/>\n \u2014 s\u00ed\u0165ov\u00e9 rozhran\u00ed;<br \/>\n \u2014 opera\u010dn\u00ed pam\u011b\u0165;<br \/>\n \u2014 syst\u00e9mov\u00fd \u010dasova\u010d.<\/p>\n<p>Virtu\u00e1ln\u00ed stroj:<br \/>\n \u2014 opera\u010dn\u00ed pam\u011b\u0165;<br \/>\n \u2014 syst\u00e9mov\u00fd \u010dasova\u010d.<\/p>\n<p>Kan\u00e1l pro p\u0159enos \u0159\u00eddic\u00edch p\u0159\u00edkaz\u016f<br \/>\nU\u017eivatelsk\u00e9 pracovn\u00ed m\u00edsto:<br \/>\n \u2014 vstupn\u011b-v\u00fdstupn\u00ed prost\u0159edky;<br \/>\n \u2014 opera\u010dn\u00ed pam\u011b\u0165.<\/p>\n<p>(Grafick\u00e9 u\u017eivatelsk\u00e9 rozhran\u00ed softwaru CryptoARM)<\/p>\n<p>Virtu\u00e1ln\u00ed stroj:<br \/>\n \u2014 opera\u010dn\u00ed pam\u011b\u0165;<br \/>\n \u2014 pevn\u00fd disk.<\/p>\n<p>(Automatiza\u010dn\u00ed skripty)<\/p>\n<p>Kan\u00e1l pro p\u0159\u00edjem v\u00fdsledk\u016f pr\u00e1ce<br \/>\nU\u017eivatelsk\u00e9 pracovn\u00ed m\u00edsto:<br \/>\n \u2014 vstupn\u011b-v\u00fdstupn\u00ed prost\u0159edky;<br \/>\n \u2014 opera\u010dn\u00ed pam\u011b\u0165.<\/p>\n<p>(Grafick\u00e9 u\u017eivatelsk\u00e9 rozhran\u00ed softwaru CryptoARM)<\/p>\n<p>Virtu\u00e1ln\u00ed stroj:<br \/>\n \u2014 opera\u010dn\u00ed pam\u011b\u0165;<br \/>\n \u2014 pevn\u00fd disk.<\/p>\n<p>(Soubory protokol\u016f pr\u00e1ce automatiza\u010dn\u00edch skript\u016f)<\/p>\n<p><\/p>\n<h3>Hrozby bezpe\u010dnosti na vy\u0161\u0161\u00ed \u00farovni<\/h3>\n<p>\n<b>Vysv\u011btlen\u00ed<\/b><\/p>\n<p>P\u0159edpoklady p\u0159ijat\u00e9 p\u0159i dekompozici hrozeb:<\/p>\n<ol>\n<li>Pou\u017e\u00edvaj\u00ed se odoln\u00e9 kryptografick\u00e9 algoritmy.<\/li>\n<li>Kryptografick\u00e9 algoritmy se pou\u017e\u00edvaj\u00ed bezpe\u010dn\u00fdm zp\u016fsobem ve spr\u00e1vn\u00fdch provozn\u00edch re\u017eimech (nap\u0159\u00edklad, <noindex><a rel=\"nofollow\" href=\"http:\/\/cryptowiki.net\/index.php?title=Electronic_Code_Book\">ECB<\/a><\/noindex> nen\u00ed pou\u017eita pro \u0161ifrov\u00e1n\u00ed velk\u00e9ho objemu dat, zohled\u0148uje se p\u0159ijateln\u00e1 z\u00e1t\u011b\u017e na kl\u00ed\u010d atd.).<\/li>\n<li>\u00dato\u010dn\u00edk\u016fm jsou zn\u00e1my v\u0161echny pou\u017e\u00edvan\u00e9 algoritmy, protokoly a ve\u0159ejn\u00e9 kl\u00ed\u010de.<\/li>\n<li>\u00dato\u010dn\u00edk\u016fm jsou dostupn\u00e1 k p\u0159e\u010dten\u00ed v\u0161echna za\u0161ifrovan\u00e1 data.<\/li>\n<li>\u00dato\u010dn\u00edci jsou schopni reprodukovat jak\u00e9koli softwarov\u00e9 prvky v syst\u00e9mu.<\/li>\n<\/ol>\n<p>\n<b>Dekonstrukce<\/b><\/p>\n<p>U1. Kompromitace uzav\u0159en\u00fdch kryptografick\u00fdch kl\u00ed\u010d\u016f.<br \/>\nU2. \u0160ifrov\u00e1n\u00ed podvr\u017een\u00fdch dat jm\u00e9nem legitimn\u00edho odes\u00edlatele.<br \/>\nU3. De\u0161ifrov\u00e1n\u00ed za\u0161ifrovan\u00fdch dat osobami, kter\u00e9 nejsou legitimn\u00edmi p\u0159\u00edjemci dat (\u00fato\u010dn\u00edky).<br \/>\nU4. Vytvo\u0159en\u00ed elektronick\u00e9ho podpisu legitimn\u00edho podpisov\u00e9ho z\u00e1stupce pod podvr\u017een\u00fdmi daty.<br \/>\nU5. Z\u00edsk\u00e1n\u00ed pozitivn\u00edho v\u00fdsledku kontroly elektronick\u00e9ho podpisu podvr\u017een\u00fdch dat.<br \/>\nU6. Chybn\u00e9 p\u0159ijet\u00ed elektronick\u00fdch dokument\u016f k realizaci v d\u016fsledku probl\u00e9m\u016f v organizaci elektronick\u00e9ho ob\u011bhu dokument\u016f.<br \/>\nU7. Neautorizovan\u00fd p\u0159\u00edstup k chr\u00e1n\u011bn\u00fdm dat\u016fm b\u011bhem jejich zpracov\u00e1n\u00ed SKZI.<br \/>\n<noindex><a rel=\"nofollow\" name=\"TMUSKZIU1\"><\/a><\/noindex><\/p>\n<h3>U1. Kompromitace uzav\u0159en\u00fdch kryptografick\u00fdch kl\u00ed\u010d\u016f<\/h3>\n<p>\nU1.1. Z\u00edsk\u00e1n\u00ed uzav\u0159en\u00e9ho kl\u00ed\u010de ze skladu uzav\u0159en\u00fdch kl\u00ed\u010d\u016f.<\/p>\n<p>U1.2. Z\u00edsk\u00e1n\u00ed uzav\u0159en\u00e9ho kl\u00ed\u010de z objekt\u016f prost\u0159ed\u00ed fungov\u00e1n\u00ed kryptografick\u00e9ho prost\u0159edku, ve kter\u00fdch m\u016f\u017ee do\u010dasn\u011b b\u00fdt.<br \/>\n<i>Vysv\u011btlen\u00ed U1.2.<\/i><\/p>\n<p>Mezi objekty, ve kter\u00fdch m\u016f\u017ee do\u010dasn\u011b b\u00fdt uzav\u0159en\u00fd kl\u00ed\u010d, budou pat\u0159it:<\/p>\n<ol>\n<li>operativn\u00ed pam\u011b\u0165, <\/li>\n<li>do\u010dasn\u00e9 soubory, <\/li>\n<li>swapovac\u00ed soubory, <\/li>\n<li>hiberna\u010dn\u00ed soubory, <\/li>\n<li>soubory snapshot\u016f \u201ehork\u00e9ho\u201c stavu virtu\u00e1ln\u00edch stroj\u016f, v\u010detn\u011b soubor\u016f obsahu operativn\u00ed pam\u011bti virtu\u00e1ln\u00edch stroj\u016f, kter\u00e9 byly pozastaveny.<\/li>\n<\/ol>\n<p>\nU1.2.1. Extrakce uzav\u0159en\u00fdch kl\u00ed\u010d\u016f z b\u011b\u017e\u00edc\u00ed operativn\u00ed pam\u011bti pomoc\u00ed zmrazen\u00ed modul\u016f RAM, jejich extrakce a n\u00e1sledn\u00e9 \u010dten\u00ed dat (freeze attack).<br \/>\n<i>Vysv\u011btlen\u00ed U1.2.1.<\/i><br \/>\nP\u0159\u00edklad <noindex><a rel=\"nofollow\" href=\"https:\/\/www.securitylab.ru\/analytics\/452899.php\">\u00fatok\u016fm<\/a><\/noindex>. <\/p>\n<p>U1.3. Z\u00edsk\u00e1n\u00ed uzav\u0159en\u00e9ho kl\u00ed\u010de z kan\u00e1lu v\u00fdm\u011bny uzav\u0159en\u00fdch kl\u00ed\u010d\u016f.<br \/>\n<i>Vysv\u011btlen\u00ed U1.3.<\/i><br \/>\nP\u0159\u00edklad realizace t\u00e9to hrozby bude uveden <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUSKZIA3\">n\u00ed\u017ee<\/a><\/noindex>.<\/p>\n<p>U1.4. Neautorizovan\u00e1 modifikace kryptoj\u00e1dra, v d\u016fsledku kter\u00e9 se uzav\u0159en\u00e9 kl\u00ed\u010de stanou zn\u00e1m\u00fdmi \u00fato\u010dn\u00edk\u016fm.<\/p>\n<p>U1.5. Kompromitace soukrom\u00e9ho kl\u00ed\u010de v d\u016fsledku pou\u017eit\u00ed technick\u00fdch kan\u00e1l\u016f \u00faniku informac\u00ed (TKUI).<br \/>\n<i>Vysv\u011btlen\u00ed U1.5.<\/i><br \/>\nP\u0159\u00edklad <noindex><a rel=\"nofollow\" href=\"https:\/\/www.usenix.org\/system\/files\/conference\/usenixsecurity18\/sec18-alam.pdf\">\u00fatok\u016fm<\/a><\/noindex>. <\/p>\n<p>U1.6. Kompromitace soukrom\u00e9ho kl\u00ed\u010de v d\u016fsledku pou\u017eit\u00ed speci\u00e1ln\u00edch technick\u00fdch prost\u0159edk\u016f (STS), ur\u010den\u00fdch pro tajn\u00e9 sn\u00edm\u00e1n\u00ed informac\u00ed (\"hmyz\").<\/p>\n<p>U1.7. Kompromitace soukrom\u00fdch kl\u00ed\u010d\u016f b\u011bhem jejich uchov\u00e1v\u00e1n\u00ed mimo SKZI.<br \/>\n<i>Vysv\u011btlen\u00ed U1.7.<\/i><br \/>\nNap\u0159\u00edklad u\u017eivatel uchov\u00e1v\u00e1 sv\u00e9 kl\u00ed\u010dov\u00e9 nosi\u010de v z\u00e1suvce pracovn\u00edho stolu, odkud mohou b\u00fdt snadno vyta\u017eeny \u00fato\u010dn\u00edky.<br \/>\n<noindex><a rel=\"nofollow\" name=\"TMUSKZIU2\"><\/a><\/noindex><\/p>\n<h3>U2. \u0160ifrov\u00e1n\u00ed fale\u0161n\u00fdch dat jm\u00e9nem legitimn\u00edho odes\u00edlatele<\/h3>\n<p>\n<b>Vysv\u011btlen\u00ed<\/b><br \/>\nToto nebezpe\u010d\u00ed je zva\u017eov\u00e1no pouze pro sch\u00e9mata \u0161ifrov\u00e1n\u00ed dat s autentizac\u00ed odes\u00edlatele. P\u0159\u00edklady takov\u00fdch sch\u00e9mat jsou uvedeny v doporu\u010den\u00edch pro standardizaci. <noindex><a rel=\"nofollow\" href=\"https:\/\/tc26.ru\/standarts\/rekomendatsii-po-standartizatsii\/r-1323565-1-004-2017-informatsionnaya-tekhnologiya-kriptograficheskaya-zashchita-informatsii-skhemy-vyrabotki-obshchego-klyucha-s-autentifikatsiey-na-osnove-otkrytogo-klyucha.html\">R 1323565.1.004-2017 \"Informa\u010dn\u00ed technologie. Krypto\u00adgrafick\u00e1 ochrana informac\u00ed. Sch\u00e9mata generov\u00e1n\u00ed spole\u010dn\u00e9ho kl\u00ed\u010de s autentizac\u00ed na z\u00e1klad\u011b ve\u0159ejn\u00e9ho kl\u00ed\u010de\".<\/a><\/noindex>. Pro ostatn\u00ed kryptografick\u00e9 sch\u00e9mata toto nebezpe\u010d\u00ed neexistuje, proto\u017ee \u0161ifrov\u00e1n\u00ed prob\u00edh\u00e1 na ve\u0159ejn\u00fdch kl\u00ed\u010d\u00edch p\u0159\u00edjemce, kter\u00e9 jsou obecn\u011b zn\u00e1m\u00e9 \u00fato\u010dn\u00edk\u016fm.<\/p>\n<p><b>Dekonstrukce<\/b><br \/>\nU2.1. Kompromitace soukrom\u00e9ho kl\u00ed\u010de odes\u00edlatele:<br \/>\nU2.1.1. Odkaz: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUSKZIU1\">\"Typov\u00fd model hrozeb. Syst\u00e9m kryptografick\u00e9 ochrany informac\u00ed. U1. Kompromitace soukrom\u00fdch kryptografick\u00fdch kl\u00ed\u010d\u016f\".<\/a><\/noindex>.<\/p>\n<p>U2.2. Z\u00e1m\u011bna vstupn\u00edch dat v kan\u00e1lu v\u00fdm\u011bny ve\u0159ejn\u00fdch dat.<br \/>\n<i>Pozn\u00e1mky U2.2.<\/i><br \/>\nP\u0159\u00edklady realizace tohoto nebezpe\u010d\u00ed jsou uvedeny n\u00ed\u017ee. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUSKZIA1\">tady<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUSKZIA2\">tady<\/a><\/noindex>.<br \/>\n<noindex><a rel=\"nofollow\" name=\"TMUSKZIU3\"><\/a><\/noindex><\/p>\n<h3>U3. De\u0161ifrov\u00e1n\u00ed za\u0161ifrovan\u00fdch dat osobami, kter\u00e9 nejsou legitimn\u00edmi p\u0159\u00edjemci dat (\u00fato\u010dn\u00edky).<\/h3>\n<p>\n<b>Dekonstrukce<\/b><br \/>\nU3.1. Kompromitace soukrom\u00fdch kl\u00ed\u010d\u016f p\u0159\u00edjemce za\u0161ifrovan\u00fdch dat. <br \/>\nU3.1.1 Odkaz: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUSKZIU1\">\"Typov\u00fd model hrozeb. Syst\u00e9m kryptografick\u00e9 ochrany informac\u00ed. U1. Kompromitace soukrom\u00fdch kryptografick\u00fdch kl\u00ed\u010d\u016f\".<\/a><\/noindex>.<\/p>\n<p>U3.2. Z\u00e1m\u011bna za\u0161ifrovan\u00fdch dat v kan\u00e1lu v\u00fdm\u011bny chr\u00e1n\u011bn\u00fdch dat.<br \/>\n<noindex><a rel=\"nofollow\" name=\"TMUSKZIU4\"><\/a><\/noindex><\/p>\n<h3>U4. Vytv\u00e1\u0159en\u00ed elektronick\u00e9ho podpisu legitimn\u00edho signat\u00e1\u0159e na fale\u0161n\u00fdch datech.<br \/>\n<\/h3>\n<p>\n<b>Dekonstrukce<\/b><br \/>\nU4.1. Kompromitace soukrom\u00fdch kl\u00ed\u010d\u016f elektronick\u00e9ho podpisu legitimn\u00edho signat\u00e1\u0159e. <br \/>\nU4.1.1 Odkaz: <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUSKZIU1\">\"Typov\u00fd model hrozeb. Syst\u00e9m kryptografick\u00e9 ochrany informac\u00ed. U1. Kompromitace soukrom\u00fdch kryptografick\u00fdch kl\u00ed\u010d\u016f\".<\/a><\/noindex>.<\/p>\n<p>U4.2. Z\u00e1m\u011bna podepisovan\u00fdch dat v kan\u00e1lu v\u00fdm\u011bny ve\u0159ejn\u00fdch dat.<br \/>\n<i>Pozn\u00e1mka U4.2.<\/i><br \/>\nP\u0159\u00edklady realizace tohoto nebezpe\u010d\u00ed jsou uvedeny n\u00ed\u017ee. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUSKZIA1\">tady<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUSKZIA2\">tady<\/a><\/noindex>.<br \/>\n<noindex><a rel=\"nofollow\" name=\"TMUSKZIU5\"><\/a><\/noindex><\/p>\n<h3>U5. Z\u00edsk\u00e1n\u00ed pozitivn\u00edho v\u00fdsledku kontroly elektronick\u00e9ho podpisu fale\u0161n\u00fdch dat.<\/h3>\n<p>\n<b>Dekonstrukce<\/b><br \/>\nU5.1. \u00dato\u010dn\u00edci zachyt\u00e1vaj\u00ed v kan\u00e1lu p\u0159enosu v\u00fdsledk\u016f zpr\u00e1vu o negativn\u00edm v\u00fdsledku ov\u011b\u0159en\u00ed elektronick\u00e9ho podpisu a nahrazuj\u00ed ji zpr\u00e1vou s pozitivn\u00edm v\u00fdsledkem.<\/p>\n<p>U5.2. \u00dato\u010dn\u00edci prov\u00e1d\u011bj\u00ed \u00fatok na d\u016fv\u011bru v certifik\u00e1ty podpisu (<b>SCEN\u00c1\u0158 \u2014 v\u0161echny prvky jsou povinn\u00e9<\/b>):<br \/>\nU5.2.1. \u00dato\u010dn\u00edci generuj\u00ed ve\u0159ejn\u00fd a soukrom\u00fd kl\u00ed\u010d elektronick\u00e9ho podpisu. Pokud jsou v syst\u00e9mu pou\u017eity certifik\u00e1ty kl\u00ed\u010d\u016f elektronick\u00e9ho podpisu, generuj\u00ed certifik\u00e1t elektronick\u00e9ho podpisu co nejv\u00edce podobn\u00fd certifik\u00e1tu p\u0159edpokl\u00e1dan\u00e9ho odes\u00edlatele dat, jeho\u017e zpr\u00e1vu cht\u011bj\u00ed fal\u0161ovat.<br \/>\nU5.2.2. \u00dato\u010dn\u00edci prov\u00e1d\u011bj\u00ed neopr\u00e1vn\u011bn\u00e9 zm\u011bny v \u00falo\u017ei\u0161ti ve\u0159ejn\u00fdch kl\u00ed\u010d\u016f, p\u0159i\u010dem\u017e generovan\u00e9mu ve\u0159ejn\u00e9mu kl\u00ed\u010di p\u0159i\u0159azuj\u00ed po\u017eadovanou \u00farove\u0148 d\u016fv\u011bry a opr\u00e1vn\u011bn\u00ed.<br \/>\nU5.2.3. \u00dato\u010dn\u00edci podepisuj\u00ed fale\u0161n\u00e1 data d\u0159\u00edve vytvo\u0159en\u00fdm kl\u00ed\u010dem elektronick\u00e9ho podpisu a vkl\u00e1daj\u00ed je do kan\u00e1lu v\u00fdm\u011bny zabezpe\u010den\u00fdch dat.<\/p>\n<p>U5.3. \u00dato\u010dn\u00edci prov\u00e1d\u011bj\u00ed \u00fatok pomoc\u00ed expired elektronick\u00fdch podpis\u016f leg\u00e1ln\u00edho podepisovatele (<b>SCEN\u00c1\u0158 \u2014 v\u0161echny prvky jsou povinn\u00e9<\/b>):<br \/>\nU5.3.1. \u00dato\u010dn\u00edci kompromituj\u00ed vypr\u0161en\u00e9 (v tuto chv\u00edli neplatn\u00e9) soukrom\u00e9 kl\u00ed\u010de elektronick\u00e9ho podpisu legitimn\u00edho odes\u00edlatele.<br \/>\nU5.3.2. \u00dato\u010dn\u00edci nahrazuj\u00ed \u010das v kan\u00e1lu p\u0159enosu \u010dasu na \u010das, kdy byly kompromitovan\u00e9 kl\u00ed\u010de je\u0161t\u011b platn\u00e9.<br \/>\nU5.3.3. \u00dato\u010dn\u00edci podepisuj\u00ed fale\u0161n\u00e1 data d\u0159\u00edve kompromitovan\u00fdm kl\u00ed\u010dem elektronick\u00e9ho podpisu a vkl\u00e1daj\u00ed je do kan\u00e1lu v\u00fdm\u011bny zabezpe\u010den\u00fdch dat.<\/p>\n<p>U5.4. \u00dato\u010dn\u00edci prov\u00e1d\u011bj\u00ed \u00fatok pomoc\u00ed kompromitovan\u00fdch kl\u00ed\u010d\u016f elektronick\u00e9ho podpisu leg\u00e1ln\u00edho podepisovatele (<b>SCEN\u00c1\u0158 \u2014 v\u0161echny prvky jsou povinn\u00e9<\/b>):<br \/>\nU5.4.1. \u00dato\u010dn\u00edci vytv\u00e1\u0159ej\u00ed kopii \u00falo\u017ei\u0161t\u011b ve\u0159ejn\u00fdch kl\u00ed\u010d\u016f.<br \/>\nU5.4.2. \u00dato\u010dn\u00edci kompromituj\u00ed soukrom\u00e9 kl\u00ed\u010de jednoho z leg\u00e1ln\u00edch odes\u00edlatel\u016f. Ten si v\u0161imne kompromitace, odvol\u00e1 kl\u00ed\u010de, informace o odvol\u00e1n\u00ed kl\u00ed\u010de jsou um\u00edst\u011bny v \u00falo\u017ei\u0161ti ve\u0159ejn\u00fdch kl\u00ed\u010d\u016f.<br \/>\nU5.4.3. \u00dato\u010dn\u00edci nahrazuj\u00ed \u00falo\u017ei\u0161t\u011b ve\u0159ejn\u00fdch kl\u00ed\u010d\u016f d\u0159\u00edve zkop\u00edrovan\u00fdm.<br \/>\nU5.4.4. \u00dato\u010dn\u00edci podepisuj\u00ed fale\u0161n\u00e1 data d\u0159\u00edve kompromitovan\u00fdm kl\u00ed\u010dem elektronick\u00e9ho podpisu a vkl\u00e1daj\u00ed je do kan\u00e1lu v\u00fdm\u011bny zabezpe\u010den\u00fdch dat.<\/p>\n<p>U5.5. &lt;&#8230;&gt; v d\u016fsledku chyb p\u0159i implementaci 2. a 3. f\u00e1ze ov\u011b\u0159ov\u00e1n\u00ed elektronick\u00e9ho podpisu:<br \/>\n<i>Vysv\u011btlen\u00ed U5.5.<\/i><br \/>\nP\u0159\u00edklad realizace t\u00e9to hrozby je uveden <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/422329\/#TMUSKZIA4\">n\u00ed\u017ee<\/a><\/noindex>.<\/p>\n<p>U5.5.1. Ov\u011b\u0159en\u00ed d\u016fv\u011bryhodnosti certifik\u00e1tu kl\u00ed\u010de elektronick\u00e9ho podpisu pouze na z\u00e1klad\u011b d\u016fv\u011bry k certifik\u00e1tu, kter\u00fdm byl podeps\u00e1n, bez kontrol CRL nebo OCSP.<br \/>\n<i>Vysv\u011btlen\u00ed U5.5.1.<\/i><br \/>\nP\u0159\u00edklad implementace <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/332730\/\">hrozby<\/a><\/noindex>. <\/p>\n<p>U5.5.2. P\u0159i vytv\u00e1\u0159en\u00ed \u0159et\u011bzce d\u016fv\u011bry k certifik\u00e1tu nejsou analyzov\u00e1ny pravomoci vyd\u00e1vaj\u00edc\u00edch certifik\u00e1t\u016f<br \/>\n<i>Vysv\u011btlen\u00ed U5.5.2.<\/i><br \/>\nP\u0159\u00edklad \u00fatoku na certifik\u00e1ty SSL\/TLS. <br \/>\n\u00dato\u010dn\u00edci zakoupili legitimn\u00ed certifik\u00e1t pro sv\u016fj e-mail. Pot\u00e9 vytvo\u0159ili podvodn\u00fd certifik\u00e1t webu a podepsali ho sv\u00fdm certifik\u00e1tem. Pokud nebude provedena kontrola pravomoc\u00ed, pak p\u0159i kontrole \u0159et\u011bzce d\u016fv\u011bry bude pova\u017eov\u00e1n za spr\u00e1vn\u00fd a podle toho bude tak\u00e9 podvodn\u00fd certifik\u00e1t v po\u0159\u00e1dku.<\/p>\n<p>U5.5.3. P\u0159i vytv\u00e1\u0159en\u00ed \u0159et\u011bzce d\u016fv\u011bry k certifik\u00e1tu se neov\u011b\u0159uj\u00ed mezilehl\u00e9 certifik\u00e1ty na odvol\u00e1n\u00ed.<\/p>\n<p>U5.5.4. Aktualizace CRL prob\u00edh\u00e1 m\u00e9n\u011b \u010dasto, ne\u017e je je vyd\u00e1v\u00e1 certifika\u010dn\u00ed autorita.<\/p>\n<p>U5.5.5. Rozhodnut\u00ed o d\u016fv\u011b\u0159e k elektronick\u00e9mu podpisu je p\u0159ijato d\u0159\u00edve, ne\u017e je obdr\u017eena odpov\u011b\u010f OCSP o stavu certifik\u00e1tu, zaslan\u00e1 na \u017e\u00e1dost podanou po \u010dase vytvo\u0159en\u00ed podpisu nebo d\u0159\u00edve, ne\u017e je obdr\u017eena n\u00e1sleduj\u00edc\u00ed CRL po vytvo\u0159en\u00ed podpisu. <br \/>\n<i>Vysv\u011btlen\u00ed U5.5.5.<\/i><br \/>\nV p\u0159edpisech v\u011bt\u0161iny CA je \u010das odvol\u00e1n\u00ed certifik\u00e1tu pova\u017eov\u00e1n za \u010das vyd\u00e1n\u00ed nejbli\u017e\u0161\u00ed CRL, kter\u00e1 obsahuje informace o odvol\u00e1n\u00ed certifik\u00e1tu.<\/p>\n<p>U5.5.6. P\u0159i p\u0159\u00edjmu podepsan\u00fdch dat se neov\u011b\u0159uje p\u0159\u00edslu\u0161nost certifik\u00e1tu odes\u00edlateli. <br \/>\n<i>Vysv\u011btlen\u00ed U5.5.6.<\/i><br \/>\nP\u0159\u00edklad \u00fatoku. Ve vztahu k SSL certifik\u00e1t\u016fm: nem\u016f\u017ee b\u00fdt kontrolov\u00e1na shoda adresy volan\u00e9ho serveru s hodnotou pole CN v certifik\u00e1tu.<br \/>\nP\u0159\u00edklad \u00fatoku. \u00dato\u010dn\u00edci kompromitovali kl\u00ed\u010de elektronick\u00e9ho podpisu jednoho z \u00fa\u010dastn\u00edk\u016f platebn\u00edho syst\u00e9mu. Pot\u00e9 hackli s\u00ed\u0165 jin\u00e9ho \u00fa\u010dastn\u00edka a jeho jm\u00e9nem zaslali na vy\u00fa\u010dtovac\u00ed server platebn\u00edho syst\u00e9mu platebn\u00ed dokumenty podepsan\u00e9 kompromitovan\u00fdmi kl\u00ed\u010di. Pokud server analyzuje pouze d\u016fv\u011bru a neov\u011b\u0159uje shodu, pak budou podvodn\u00e9 dokumenty pova\u017eov\u00e1ny za legitimn\u00ed.<br \/>\n<noindex><a rel=\"nofollow\" name=\"TMUSKZIU6\"><\/a><\/noindex><\/p>\n<h3>U6. Chybn\u00e9 p\u0159ijet\u00ed elektronick\u00fdch dokument\u016f k realizaci v d\u016fsledku probl\u00e9m\u016f v organizaci elektronick\u00e9ho ob\u011bhu dokument\u016f.<\/h3>\n<p>\n<b>Dekonstrukce<\/b><br \/>\nU6.1. P\u0159ij\u00edmaj\u00edc\u00ed strana neodhaluje duplicity obdr\u017een\u00fdch dokument\u016f.<br \/>\n<i>Vysv\u011btlen\u00ed U6.1.<\/i><br \/>\nP\u0159\u00edklad \u00fatoku. \u00dato\u010dn\u00edci mohou zachytit dokument, kter\u00fd je zas\u00edl\u00e1n p\u0159\u00edjemci, i kdy\u017e je kryptograficky chr\u00e1n\u011bn, a pot\u00e9 ho opakovan\u011b poslat do kan\u00e1lu pro p\u0159enos chr\u00e1n\u011bn\u00fdch dat. Pokud p\u0159\u00edjemce nezjist\u00ed duplicity, budou v\u0161echny obdr\u017een\u00e9 dokumenty pova\u017eov\u00e1ny a zpracov\u00e1v\u00e1ny jako r\u016fzn\u00e9 dokumenty.<br \/>\n<noindex><a rel=\"nofollow\" name=\"TMUSKZIU7\"><\/a><\/noindex><\/p>\n<h3>U7. Nepovoleno sezn\u00e1men\u00ed s chr\u00e1n\u011bn\u00fdmi daty b\u011bhem jejich zpracov\u00e1n\u00ed CKZ <\/h3>\n<p>\n<b>Dekonstrukce<\/b><\/p>\n<p>U7.1. &lt;&#8230;&gt; v d\u016fsledku \u00faniku informac\u00ed skrze extern\u00ed kan\u00e1ly (side channel attack).<br \/>\n<i>Vysv\u011btlen\u00ed U7.1.<\/i><br \/>\nP\u0159\u00edklad <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cs.tau.ac.il\/~tromer\/synesthesia\/synesthesia.pdf\">\u00fatok\u016fm<\/a><\/noindex>. <\/p>\n<p>U7.2. &lt;&#8230;&gt; v d\u016fsledku zne\u0161kodn\u011bn\u00ed ochrany proti neopr\u00e1vn\u011bn\u00e9mu p\u0159\u00edstupu k informac\u00edm zpracov\u00e1van\u00fdm na S\u041a\u0417\u0418:<br \/>\nU7.2.1. Vyu\u017e\u00edv\u00e1n\u00ed CKZ s poru\u0161en\u00edm po\u017eadavk\u016f uveden\u00fdch v dokumentaci k CKZ.<\/p>\n<p>U7.2.2. &lt;&#8230;&gt;, proveden\u00e9 v d\u016fsledku p\u0159\u00edtomnosti zranitelnost\u00ed v:<br \/>\nU7.2.2.1. &lt;&#8230;&gt; prost\u0159edc\u00edch ochrany proti neopr\u00e1vn\u011bn\u00e9mu p\u0159\u00edstupu.<br \/>\nU7.2.2.2. &lt;&#8230;&gt; samotn\u00e9m S\u041a\u0417\u0418.<br \/>\nU7.2.2.3. &lt;&#8230;&gt; prost\u0159ed\u00ed fungov\u00e1n\u00ed kryptom\u011bny.<\/p>\n<h3>P\u0159\u00edklady \u00fatok\u016f<\/h3>\n<p>\nN\u00ed\u017ee uveden\u00e9 sc\u00e9n\u00e1\u0159e nutn\u011b obsahuj\u00ed chyby v organizaci informa\u010dn\u00ed bezpe\u010dnosti a slou\u017e\u00ed pouze k ilustraci mo\u017en\u00fdch \u00fatok\u016f.<br \/>\n<noindex><a rel=\"nofollow\" name=\"TMUSKZIA1\"><\/a><\/noindex><\/p>\n<h4>Sc\u00e9n\u00e1\u0159 1. P\u0159\u00edklad realizace hrozeb U2.2 a U4.2.<\/h4>\n<p>\n<b>Popis objektu<\/b><br \/>\n<img decoding=\"async\" alt=\"Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 8 \u2013 Typov\u00e9 modely hrozeb\" src=\"\/wp-content\/uploads\/2019\/04\/77d51167720552df4eb9c2bafbce6765.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSW APM KBR a CKZ SKAD Signatura je nainstalov\u00e1na na fyzick\u00e9m po\u010d\u00edta\u010di, kter\u00fd nen\u00ed p\u0159ipojen k v\u00fdpo\u010detn\u00ed s\u00edti. Jako kl\u00ed\u010dov\u00fd nosi\u010d se pou\u017e\u00edv\u00e1 FKN vdToken v re\u017eimu pr\u00e1ce s nevyj\u00edmateln\u00fdm kl\u00ed\u010dem.<\/p>\n<p>Regulace prov\u00e1d\u011bn\u00ed v\u00fdpo\u010dt\u016f p\u0159edpokl\u00e1d\u00e1, \u017ee specialist\u00e9 na v\u00fdpo\u010dty stahuj\u00ed elektronick\u00e9 zpr\u00e1vy v otev\u0159en\u00e9 podob\u011b (sch\u00e9ma star\u00e9ho APM KBR) z speci\u00e1ln\u00edho chr\u00e1n\u011bn\u00e9ho souborov\u00e9ho serveru na sv\u00e9m pracovn\u00edm po\u010d\u00edta\u010di, pot\u00e9 je zaznamen\u00e1vaj\u00ed na p\u0159enosn\u00e9m USB flash disku a p\u0159en\u00e1\u0161ej\u00ed na APM KBR, kde je \u0161ifruj\u00ed a podepisuj\u00ed. Pot\u00e9 odborn\u00edk p\u0159en\u00e1\u0161\u00ed na p\u0159enosn\u00fd nosi\u010d chr\u00e1n\u011bn\u00e9 elektronick\u00e9 zpr\u00e1vy a pot\u00e9 je p\u0159es sv\u016fj pracovn\u00ed po\u010d\u00edta\u010d zapisuje na souborov\u00fd server, odkud se dost\u00e1vaj\u00ed na UTA a d\u00e1le do platebn\u00edho syst\u00e9mu Banky Ruska.<\/p>\n<p>V tomto p\u0159\u00edpad\u011b budou kan\u00e1ly pro v\u00fdm\u011bnu otev\u0159en\u00fdch a chr\u00e1n\u011bn\u00fdch dat zahrnovat: souborov\u00fd server, pracovn\u00ed po\u010d\u00edta\u010d specialisty a p\u0159enosn\u00fd nosi\u010d.<\/p>\n<p><b>\u00datok<\/b><br \/>\n\u00dato\u010dn\u00edci nainstaluj\u00ed na pracovn\u00ed po\u010d\u00edta\u010d specialisty syst\u00e9m vzd\u00e1len\u00e9ho ovl\u00e1d\u00e1n\u00ed a v moment\u011b, kdy se zapisuj\u00ed na p\u0159enositeln\u00fd m\u00e9dium platebn\u00ed p\u0159\u00edkazy (elektronick\u00e9 zpr\u00e1vy), v otev\u0159en\u00e9m form\u00e1tu zam\u011bn\u00ed obsah jednoho z nich. Specialista p\u0159esune platebn\u00ed p\u0159\u00edkazy na A\u0420\u041c \u041a\u0411\u0420, podep\u00ed\u0161e je a za\u0161ifruje, ani\u017e by si v\u0161iml t\u00e9to v\u00fdm\u011bny (nap\u0159\u00edklad kv\u016fli velk\u00e9mu po\u010dtu platebn\u00edch p\u0159\u00edkaz\u016f v d\u00e1vce, \u00fanav\u011b atd.). Pot\u00e9 fiktivn\u00ed platebn\u00ed p\u0159\u00edkaz, proch\u00e1zej\u00edc\u00ed technologick\u00fdm \u0159et\u011bzcem, skon\u010d\u00ed v platebn\u00edm syst\u00e9mu Banky Ruska.<br \/>\n<noindex><a rel=\"nofollow\" name=\"TMUSKZIA2\"><\/a><\/noindex><\/p>\n<h4>Sc\u00e9n\u00e1\u0159 2. P\u0159\u00edklad realizace hrozeb U2.2 a U4.2.<\/h4>\n<p>\n<b>Popis objektu<\/b><br \/>\n<img decoding=\"async\" alt=\"Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 8 \u2013 Typov\u00e9 modely hrozeb\" src=\"\/wp-content\/uploads\/2019\/04\/b4489290d665b359323ec6b58dde1139.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPo\u010d\u00edta\u010d s nainstalovan\u00fdmi A\u0420\u041c \u041a\u0411\u0420, SKAD Signatura a p\u0159ipojen\u00fdm kl\u00ed\u010dov\u00fdm m\u00e9diem FKN vdToken funguje v vymezen\u00e9m prostoru bez p\u0159\u00edstupu ze strany person\u00e1lu.<br \/>\nSpecialista na platby se p\u0159ipojuje k A\u0420\u041c \u041a\u0411\u0420 v re\u017eimu vzd\u00e1len\u00e9ho p\u0159\u00edstupu pomoc\u00ed protokolu RDP.<\/p>\n<p><b>\u00datok<\/b><br \/>\n\u00dato\u010dn\u00edci zachycuj\u00ed p\u0159ihla\u0161ovac\u00ed \u00fadaje, pomoc\u00ed kter\u00fdch se specialist\u00e9 na platby p\u0159ipojuj\u00ed a pracuj\u00ed s A\u0420\u041c \u041a\u0411\u0420 (nap\u0159\u00edklad pomoc\u00ed \u0161kodliv\u00e9ho k\u00f3du na jeho po\u010d\u00edta\u010di). Pot\u00e9 se p\u0159ipoj\u00ed jeho jm\u00e9nem a ode\u0161lou do platebn\u00edho syst\u00e9mu Banky Ruska fale\u0161n\u00fd platebn\u00ed p\u0159\u00edkaz.<br \/>\n<noindex><a rel=\"nofollow\" name=\"TMUSKZIA3\"><\/a><\/noindex><\/p>\n<h4>Sc\u00e9n\u00e1\u0159 3. P\u0159\u00edklad realizace hrozby U1.3. <\/h4>\n<p>\n<b>Popis objektu<\/b><br \/>\n<img decoding=\"async\" alt=\"Informa\u010dn\u00ed bezpe\u010dnost bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 8 \u2013 Typov\u00e9 modely hrozeb\" src=\"\/wp-content\/uploads\/2019\/04\/988a97dd75247780556d388566d771f0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nZva\u017eme jednu z hypotetick\u00fdch variant realizace integra\u010dn\u00edch modul\u016f \"ABS-\u041a\u0411\u0420\" pro novou sch\u00e9ma (\u0410\u0420\u041c \u041a\u0411\u0420-\u041d), p\u0159i kter\u00e9 se elektronick\u00fd podpis odchoz\u00edch dokument\u016f prov\u00e1d\u00ed na stran\u011b ABS. P\u0159edpokl\u00e1d\u00e1me, \u017ee ABS funguje na b\u00e1zi opera\u010dn\u00edho syst\u00e9mu, kter\u00fd nen\u00ed podporov\u00e1n SKZI SKAD Signatura, a proto byl kryptografick\u00fd funk\u010dn\u00ed aspekt p\u0159enesen na samostatnou virtu\u00e1ln\u00ed stroj \u2014 integra\u010dn\u00ed modul \"ABS-\u041a\u0411\u0420\".<br \/>\nJako kl\u00ed\u010dov\u00e9 m\u00e9dium se pou\u017e\u00edv\u00e1 b\u011b\u017en\u00fd USB-token, kter\u00fd funguje v re\u017eimu odn\u00edmateln\u00e9ho kl\u00ed\u010de. P\u0159i p\u0159ipojen\u00ed kl\u00ed\u010dov\u00e9ho m\u00e9dia k hypervizoru se uk\u00e1zalo, \u017ee v syst\u00e9mu nejsou voln\u00e9 USB porty, a proto bylo rozhodnuto p\u0159ipojit USB-token prost\u0159ednictv\u00edm s\u00ed\u0165ov\u00e9ho USB hubu a na virtu\u00e1ln\u00ed stroj nainstalovat klienta USB-over-IP, kter\u00fd bude realizovat spojen\u00ed s hubem.<\/p>\n<p><b>\u00datok<\/b><br \/>\n\u00dato\u010dn\u00edci zachytili soukrom\u00fd kl\u00ed\u010d elektronick\u00e9ho podpisu z komunika\u010dn\u00edho kan\u00e1lu mezi USB hubem a hypervizorem (data byla p\u0159ed\u00e1v\u00e1na v ne\u0161ifrovan\u00e9 podob\u011b). S t\u00edmto soukrom\u00fdm kl\u00ed\u010dem vytvo\u0159ili \u00fato\u010dn\u00edci fale\u0161n\u00fd platebn\u00ed p\u0159\u00edkaz, podepsali ho elektronick\u00fdm podpisem a poslali k realizaci do APM KBR-N.<br \/>\n<noindex><a rel=\"nofollow\" name=\"TMUSKZIA4\"><\/a><\/noindex><\/p>\n<h4>Sc\u00e9n\u00e1\u0159 4. P\u0159\u00edklad realizace hrozeb U5.5.<\/h4>\n<p>\n<b>Popis objektu<\/b><br \/>\nZva\u017eme stejnou sch\u00e9mu jako v p\u0159edchoz\u00edm sc\u00e9n\u00e1\u0159i. P\u0159edpokl\u00e1dejme, \u017ee elektronick\u00e9 zpr\u00e1vy p\u0159ich\u00e1zej\u00edc\u00ed z A\u0420\u041c K\u0411\u0420-N p\u0159ich\u00e1zej\u00ed do slo\u017eky &#8230;SHAREIn, zat\u00edmco ty, kter\u00e9 jsou odes\u00edl\u00e1ny do A\u0420\u041c K\u0411\u0420-N a d\u00e1le do platebn\u00edho syst\u00e9mu Banky Ruska, \u2013 do &#8230;SHAREout.<br \/>\nTak\u00e9 p\u0159edpokl\u00e1dejme, \u017ee p\u0159i implementaci modulu integrace se seznamy odvolan\u00fdch certifik\u00e1t\u016f aktualizuj\u00ed pouze p\u0159i op\u011btovn\u00e9m vyd\u00e1n\u00ed kryptografick\u00fdch kl\u00ed\u010d\u016f, a tak\u00e9 to, \u017ee elektronick\u00e9 zpr\u00e1vy, kter\u00e9 vstoupily do slo\u017eky &#8230;SHAREIn, se kontroluj\u00ed pouze z hlediska integrity a d\u016fv\u011bry v otev\u0159en\u00fd kl\u00ed\u010d elektronick\u00e9ho podpisu.<\/p>\n<p><b>\u00datok<\/b><\/p>\n<p>\u00dato\u010dn\u00edci, kte\u0159\u00ed vyu\u017eili ukraden\u00e9 kl\u00ed\u010de z p\u0159edchoz\u00edho sc\u00e9n\u00e1\u0159e, podepsali fale\u0161n\u00fd platebn\u00ed p\u0159\u00edkaz obsahuj\u00edc\u00ed \u00fadaje o p\u0159evodu pen\u011bz na \u00fa\u010det klienta-podvodn\u00edka a vlo\u017eili jej do kan\u00e1lu pro v\u00fdm\u011bnu chr\u00e1n\u011bn\u00fdch dat. Jeliko\u017e nen\u00ed prov\u00e1d\u011bna kontrola, \u017ee platebn\u00ed p\u0159\u00edkaz byl podeps\u00e1n skute\u010dn\u011b Bankou Ruska, je akceptov\u00e1n k realizaci.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/422329\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e \u0447\u0435\u043c \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u0435 \u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0434\u0440\u0443\u0433\u0438\u0435 \u0447\u0430\u0441\u0442\u0438 \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u043d\u0438\u044f \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0431\u0430\u043d\u043a\u043e\u0432\u0441\u043a\u0438\u0445 \u0431\u0435\u0437\u043d\u0430\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439. \u0427\u0430\u0441\u0442\u044c 1 \u2014 \u042d\u043a\u043e\u043d\u043e\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043e\u0441\u043d\u043e\u0432\u044b. \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0431\u0430\u043d\u043a\u043e\u0432\u0441\u043a\u0438\u0445 \u0431\u0435\u0437\u043d\u0430\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439. \u0427\u0430\u0441\u0442\u044c 2 \u2014 \u0422\u0438\u043f\u043e\u0432\u0430\u044f IT-\u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 \u0431\u0430\u043d\u043a\u0430. \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0431\u0430\u043d\u043a\u043e\u0432\u0441\u043a\u0438\u0445 \u0431\u0435\u0437\u043d\u0430\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439. \u0427\u0430\u0441\u0442\u044c 3 \u2014 \u0424\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u0439 \u043a \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0437\u0430\u0449\u0438\u0442\u044b. \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0431\u0430\u043d\u043a\u043e\u0432\u0441\u043a\u0438\u0445 \u0431\u0435\u0437\u043d\u0430\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439. \u0427\u0430\u0441\u0442\u044c 4 \u2014 \u041e\u0431\u0437\u043e\u0440 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043e\u0432 \u043c\u043e\u0434\u0435\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u0433\u0440\u043e\u0437. \u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23545,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31627","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/informatsionnaya-bezopasnost-bankovskih-beznalichnyh-platezhej-chast-8-tipovye-modeli-ugroz\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0431\u0430\u043d\u043a\u043e\u0432\u0441\u043a\u0438\u0445 \u0431\u0435\u0437\u043d\u0430\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439. \u0427\u0430\u0441\u0442\u044c 8 \u2014 \u0422\u0438\u043f\u043e\u0432\u044b\u0435 \u043c\u043e\u0434\u0435\u043b\u0438 \u0443\u0433\u0440\u043e\u0437 | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/informatsionnaya-bezopasnost-bankovskih-beznalichnyh-platezhej-chast-8-tipovye-modeli-ugroz\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:42:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:42:14+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Bezpe\u010dnost informac\u00ed bankovn\u00edch bezhotovostn\u00edch plateb. \u010c\u00e1st 8 \u2014 Typov\u00e9 modely hrozeb | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/informatsionnaya-bezopasnost-bankovskih-beznalichnyh-platezhej-chast-8-tipovye-modeli-ugroz","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0431\u0430\u043d\u043a\u043e\u0432\u0441\u043a\u0438\u0445 \u0431\u0435\u0437\u043d\u0430\u043b\u0438\u0447\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0435\u0436\u0435\u0439. \u0427\u0430\u0441\u0442\u044c 8 \u2014 \u0422\u0438\u043f\u043e\u0432\u044b\u0435 \u043c\u043e\u0434\u0435\u043b\u0438 \u0443\u0433\u0440\u043e\u0437 | ProHoster","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/informatsionnaya-bezopasnost-bankovskih-beznalichnyh-platezhej-chast-8-tipovye-modeli-ugroz","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:42:14+00:00","article:modified_time":"2019-10-31T18:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31627","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 07:04:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:13:29","updated":"2026-01-21 07:04:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31627","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=31627"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/31627\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/23545"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=31627"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=31627"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=31627"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}