{"id":32370,"date":"2019-10-31T21:46:38","date_gmt":"2019-10-31T18:46:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/sinhronizirovannaya-bezopasnost-v-sophos-central\/"},"modified":"2019-10-31T21:46:38","modified_gmt":"2019-10-31T18:46:38","slug":"sinhronizirovannaya-bezopasnost-v-sophos-central","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/sinhronizirovannaya-bezopasnost-v-sophos-central","title":{"rendered":"Synchronizovan\u00e1 bezpe\u010dnost v Sophos Central","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Synchronizovan\u00e1 bezpe\u010dnost v Sophos Central\" src=\"\/wp-content\/uploads\/2019\/04\/9d0e5f8349ff2034a71b0f2aacaba5c7.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nPro zaji\u0161t\u011bn\u00ed vysok\u00e9 \u00fa\u010dinnosti bezpe\u010dnostn\u00edch prost\u0159edk\u016f m\u00e1 d\u016fle\u017eitou roli propojen\u00ed jej\u00edch komponent\u016f. Umo\u017e\u0148uje p\u0159ehradit nejen vn\u011bj\u0161\u00ed, ale i vnit\u0159n\u00ed hrozby. P\u0159i n\u00e1vrhu s\u00ed\u0165ov\u00e9 infrastruktury m\u00e1 ka\u017ed\u00e9 bezpe\u010dnostn\u00ed opat\u0159en\u00ed, a\u0165 u\u017e je to antivirov\u00fd program nebo firewall, kl\u00ed\u010dov\u00fd v\u00fdznam, aby fungovala nejen v r\u00e1mci sv\u00e9 kategorie (Endpoint security nebo NGFW), ale tak\u00e9 aby m\u011bla mo\u017enost vz\u00e1jemn\u011b spolupracovat v boji proti hrozb\u00e1m.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Trochu teorie<\/h2>\n<p>\nNen\u00ed p\u0159ekvapen\u00edm, \u017ee sou\u010dasn\u00ed kyberzlo\u010dinci se stali obratn\u011bj\u0161\u00edmi. K \u0161\u00ed\u0159en\u00ed \u0161kodliv\u00e9ho softwaru pou\u017e\u00edvaj\u00ed celou \u0159adu s\u00ed\u0165ov\u00fdch technologi\u00ed:<br \/>\n<img decoding=\"async\" alt=\"Synchronizovan\u00e1 bezpe\u010dnost v Sophos Central\" src=\"\/wp-content\/uploads\/2019\/04\/53a274ad70bc616ea2bafa0b5dbe509b.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nPhishingov\u00e9 e-maily vedou k tomu, \u017ee \u0161kodliv\u00fd software \"p\u0159ekro\u010d\u00ed pr\u00e1h\" va\u0161\u00ed s\u00edt\u011b pomoc\u00ed zn\u00e1m\u00fdch \u00fatok\u016f nebo \"\u00fatok\u016f nult\u00e9ho dne\" s n\u00e1sledn\u00fdm zv\u00fd\u0161en\u00edm privilegi\u00ed, nebo horizont\u00e1ln\u00edho pohybu po s\u00edti (lateral movement). P\u0159\u00edtomnost jednoho infikovan\u00e9ho za\u0159\u00edzen\u00ed m\u016f\u017ee znamenat, \u017ee je va\u0161e s\u00ed\u0165 zneu\u017e\u00edv\u00e1na pro osobn\u00ed prosp\u011bch \u00fato\u010dn\u00edka. <\/p>\n<p>V n\u011bkter\u00fdch p\u0159\u00edpadech, kdy je t\u0159eba zajistit interakci komponent\u016f IB, nelze p\u0159i auditu bezpe\u010dnosti informac\u00ed aktu\u00e1ln\u00edho stavu syst\u00e9mu popsat prost\u0159ednictv\u00edm jedin\u00e9 souvisl\u00e9 sady opat\u0159en\u00ed. Ve v\u011bt\u0161in\u011b p\u0159\u00edpad\u016f mnoh\u00e1 technick\u00e1 \u0159e\u0161en\u00ed zam\u011b\u0159en\u00e1 na protiopat\u0159en\u00ed ur\u010dit\u00e9mu typu hrozby nepo\u010d\u00edtaj\u00ed s integrac\u00ed s dal\u0161\u00edmi technick\u00fdmi \u0159e\u0161en\u00edmi. Nap\u0159\u00edklad produkty pro ochranu koncov\u00fdch za\u0159\u00edzen\u00ed pou\u017e\u00edvaj\u00ed signaturn\u00ed a behavior\u00e1ln\u00ed anal\u00fdzu k ur\u010den\u00ed, zda je soubor infikov\u00e1n \u010di nikoli. K zastaven\u00ed \u0161kodliv\u00e9ho provozu pou\u017e\u00edvaj\u00ed firewally jin\u00e9 technologie, mezi kter\u00e9 pat\u0159\u00ed webov\u00e1 filtrace, IPS, sandbox atd. P\u0159esto v mnoha organizac\u00edch tyto komponenty zabezpe\u010den\u00ed informac\u00ed nejsou spojeny a pracuj\u00ed izolovan\u011b.<\/p>\n<h2>Trend v implementaci technologie Heartbeat<\/h2>\n<p>\nNov\u00fd p\u0159\u00edstup k zaji\u0161t\u011bn\u00ed kybernetick\u00e9 bezpe\u010dnosti zahrnuje ochranu na ka\u017ed\u00e9 \u00farovni, p\u0159i\u010dem\u017e \u0159e\u0161en\u00ed pou\u017e\u00edvan\u00e1 na ka\u017ed\u00e9 z nich jsou navz\u00e1jem propojena a maj\u00ed mo\u017enost sd\u00edlet informace. To vede ke vzniku syst\u00e9mu Sunchronized Security (SynSec). SynSec p\u0159edstavuje proces zaji\u0161t\u011bn\u00ed informa\u010dn\u00ed bezpe\u010dnosti jako jedn\u00e9 jednotn\u00e9 soustavy. V tomto p\u0159\u00edpad\u011b je ka\u017ed\u00fd komponent zaji\u0161t\u011bn\u00ed informa\u010dn\u00ed bezpe\u010dnosti propojen s ostatn\u00edmi v re\u00e1ln\u00e9m \u010dase. Nap\u0159\u00edklad \u0159e\u0161en\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/www.sophos.com\/en-us\/products\/sophos-central.aspx?id=00130000019KE2V\">Sophos Central<\/a><\/noindex> je realizov\u00e1no na tomto principu.<\/p>\n<p><img decoding=\"async\" alt=\"Synchronizovan\u00e1 bezpe\u010dnost v Sophos Central\" src=\"\/wp-content\/uploads\/2019\/04\/f8a937ea7de8f977a0eab9a040db0216.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nTechnologie Security Heartbeat zaji\u0161\u0165uje spojen\u00ed mezi komponenty zabezpe\u010den\u00ed, co\u017e umo\u017e\u0148uje jejich spole\u010dn\u00e9 fungov\u00e1n\u00ed a monitorov\u00e1n\u00ed. V <noindex><a rel=\"nofollow\" href=\"https:\/\/www.sophos.com\/en-us\/products\/next-gen-firewall.aspx?id=00130000019KE2V\">Sophos Central<\/a><\/noindex> jsou integrov\u00e1na \u0159e\u0161en\u00ed n\u00e1sleduj\u00edc\u00edch t\u0159\u00edd:<\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.sophos.com\/en-us\/products\/endpoint-antivirus.aspx?id=00130000019KE2V\">Endpoint Protection<\/a><\/noindex> \u2014 klasick\u00fd signaturn\u00ed antivir;<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.sophos.com\/en-us\/products\/server-security.aspx?id=00130000019KE2V\">Server Protection<\/a><\/noindex> \u2014 specializovan\u00fd antivir pro servery;<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.sophos.com\/en-us\/products\/intercept-x.aspx?id=00130000019KE2V\">Intercept-X<\/a><\/noindex> \u2013 antivir nov\u00e9 generace (bez signatur a s technologiemi um\u011bl\u00e9 inteligence);<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.sophos.com\/en-us\/products\/next-gen-firewall.aspx?id=00130000019KE2V\">Sophos XG Firewall<\/a><\/noindex> \u2014 Next-Generation Firewall;<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.sophos.com\/en-us\/products\/mobile-control.aspx?id=00130000019KE2V\">Mobility Management (EMM)<\/a><\/noindex> \u2014 spr\u00e1va mobiln\u00edch za\u0159\u00edzen\u00ed a kontrola p\u0159\u00edstupu k firemn\u00edm e-mail\u016fm a soubor\u016fm;<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.sophos.com\/en-us\/products\/safeguard-encryption.aspx?id=00130000019KE2V\">Data Protection (Encryption)<\/a><\/noindex>;<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.sophos.com\/en-us\/products\/secure-wifi.aspx?id=00130000019KE2V\">Secure Wi-Fi<\/a><\/noindex> \u2014 p\u0159\u00edstupov\u00e9 body \u0159\u00edzen\u00e9 jak z cloudu, tak lok\u00e1ln\u011b p\u0159es Sophos UTM \/ Sophos XG;<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.sophos.com\/en-us\/products\/secure-web-gateway.aspx?id=00130000019KE2V\">Web Security<\/a><\/noindex> \u2014 klasick\u00e9 \u0159e\u0161en\u00ed pro filtraci webov\u00e9ho provozu;<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.sophos.com\/en-us\/products\/sophos-email.aspx?id=00130000019KE2V\">E-mail Security<\/a><\/noindex> \u2014 cloudov\u00e9\/lok\u00e1ln\u00ed antispamov\u00e9\/antivirov\u00e9 \u0159e\u0161en\u00ed;<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.sophos.com\/en-us\/products\/phish-threat.aspx?id=00130000019KE2V\">Phish Threat<\/a><\/noindex> \u2014 zvy\u0161ov\u00e1n\u00ed pov\u011bdom\u00ed zam\u011bstnanc\u016f, prov\u00e1d\u011bn\u00ed testovac\u00edch phishingov\u00fdch kampan\u00ed;<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.sophos.com\/en-us\/products\/cloud-optix.aspx?id=00130000019KE2V\">Cloud Optix<\/a><\/noindex> \u2014 audit cloudov\u00fdch infrastruktur.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Synchronizovan\u00e1 bezpe\u010dnost v Sophos Central\" src=\"\/wp-content\/uploads\/2019\/04\/b1a60a0d471c250a48c36cde17a4de5f.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nNen\u00ed t\u011b\u017ek\u00e9 si pov\u0161imnout, \u017ee Sophos Central podporuje dostate\u010dn\u011b \u0161irokou \u0161k\u00e1lu \u0159e\u0161en\u00ed v oblasti informa\u010dn\u00ed bezpe\u010dnosti. V Sophos Central je koncept SynSec zalo\u017een na t\u0159ech d\u016fle\u017eit\u00fdch principech: detekce, anal\u00fdza a reakce. Pro podrobn\u011bj\u0161\u00ed popis se zastav\u00edme u ka\u017ed\u00e9ho z nich.<\/p>\n<h2>Koncepty SynSec<\/h2>\n<p>\n<b>DETEKCE<\/b> (odhalen\u00ed nezn\u00e1m\u00fdch hrozeb)<br \/>\nProdukty Sophos \u0159\u00edzen\u00e9 Sophos Central automaticky sd\u00edlej\u00ed informace mezi sebou za \u00fa\u010delem identifikace rizik a nezn\u00e1m\u00fdch hrozeb, co\u017e zahrnuje:<\/p>\n<ul>\n<li>anal\u00fdzu s\u00ed\u0165ov\u00e9ho provozu s mo\u017enost\u00ed identifikace aplikac\u00ed s vysok\u00fdm rizikem a \u0161kodliv\u00e9ho provozu;<\/li>\n<li>odhalov\u00e1n\u00ed u\u017eivatel\u016f s vysokou skupinou rizika prost\u0159ednictv\u00edm korela\u010dn\u00ed anal\u00fdzy jejich chov\u00e1n\u00ed v s\u00edti.<\/li>\n<\/ul>\n<p>\n<b>ANAL\u00ddZA<\/b> (okam\u017eit\u00e1 a intuitivn\u00ed)<br \/>\nAnal\u00fdza incident\u016f v re\u00e1ln\u00e9m \u010dase poskytuje okam\u017eit\u00fd p\u0159ehled o aktu\u00e1ln\u00ed situaci v syst\u00e9mu.<\/p>\n<ul>\n<li>zobrazen\u00ed kompletn\u00edho \u0159et\u011bzce ud\u00e1lost\u00ed, kter\u00e9 vedly k incidentu, v\u010detn\u011b v\u0161ech soubor\u016f, registr\u016f, URL adres atd.<\/li>\n<\/ul>\n<p>\n<b>REAKCE<\/b> (automatick\u00e1 reakce na incidenty)<br \/>\nNastaven\u00ed bezpe\u010dnostn\u00edch politik umo\u017e\u0148uje automaticky reagovat na infekce a incidenty b\u011bhem n\u011bkolika sekund. To je zaji\u0161t\u011bno:<\/p>\n<ul>\n<li>okam\u017eitou izolac\u00ed naka\u017een\u00fdch za\u0159\u00edzen\u00ed a zastaven\u00edm \u00fatoku v re\u00e1ln\u00e9m \u010dase (i v r\u00e1mci jedn\u00e9 s\u00edt\u011b \/ vys\u00edlac\u00ed dom\u00e9ny);<\/li>\n<li>omezen\u00edm p\u0159\u00edstupu k s\u00ed\u0165ov\u00fdm zdroj\u016fm spole\u010dnosti pro za\u0159\u00edzen\u00ed, kter\u00e1 nespl\u0148uj\u00ed politiky;<\/li>\n<li>vzd\u00e1len\u00fdm spu\u0161t\u011bn\u00edm skenov\u00e1n\u00ed za\u0159\u00edzen\u00ed p\u0159i zji\u0161t\u011bn\u00ed odchoz\u00edho spamu.<\/li>\n<\/ul>\n<p>\nProbrali jsme hlavn\u00ed principy ochrany, na kter\u00fdch je zalo\u017eena \u010dinnost Sophos Central. Nyn\u00ed se p\u0159esu\u0148me k popisu toho, jak technologie SynSec funguje v praxi.<\/p>\n<h2>Od teorie k praxi<\/h2>\n<p>\nNejprve si objasn\u00edme, jak se navazuje interakce za\u0159\u00edzen\u00ed podle principu SynSec pomoc\u00ed technologie Heartbeat. Prvn\u00edm krokem je registrace Sophos XG v Sophos Central. V tomto kroku z\u00edsk\u00e1v\u00e1 certifik\u00e1t pro sebeidentifikaci, IP adresu a port, p\u0159es kter\u00fd budou koncov\u00e1 za\u0159\u00edzen\u00ed s n\u00edm komunikovat pomoc\u00ed technologie Heartbeat, a tak\u00e9 seznam ID koncov\u00fdch za\u0159\u00edzen\u00ed spravovan\u00fdch prost\u0159ednictv\u00edm Sophos Central a jejich klientsk\u00fdch certifik\u00e1t\u016f. <\/p>\n<p>Netrv\u00e1 dlouho, ne\u017e po registraci Sophos XG, Sophos Central p\u0159ed\u00e1 koncov\u00fdm za\u0159\u00edzen\u00edm informace pro iniciaci interakce pomoc\u00ed technologie Heartbeat:<\/p>\n<ul>\n<li>seznam certifika\u010dn\u00edch center, kter\u00e1 se pou\u017e\u00edvaj\u00ed k vyd\u00e1v\u00e1n\u00ed certifik\u00e1t\u016f Sophos XG;<\/li>\n<li>seznam ID za\u0159\u00edzen\u00ed, kter\u00e1 jsou registrov\u00e1na v Sophos XG;<\/li>\n<li>IP adresu a port pro interakci pomoc\u00ed technologie Heartbeat.<\/li>\n<\/ul>\n<p>\nTyto informace se ukl\u00e1daj\u00ed v po\u010d\u00edta\u010di na n\u00e1sleduj\u00edc\u00ed cest\u011b: %ProgramData%SophosHearbeatConfigHeartbeat.xml a pravideln\u011b se aktualizuj\u00ed.<\/p>\n<p>Komunikace pomoc\u00ed technologie Heartbeat prob\u00edh\u00e1 prost\u0159ednictv\u00edm zas\u00edl\u00e1n\u00ed zpr\u00e1v z koncov\u00e9ho za\u0159\u00edzen\u00ed na magickou IP adresu 52.5.76.173:8347 a zp\u011bt. B\u011bhem anal\u00fdzy bylo zji\u0161t\u011bno, \u017ee pakety jsou odes\u00edl\u00e1ny v intervalech 15 sekund, jak bylo uvedeno dodavatelem. Je t\u0159eba poznamenat, \u017ee zpr\u00e1vy Heartbeat zpracov\u00e1v\u00e1 p\u0159\u00edmo XG Firewall \u2014 p\u0159eru\u0161uje pakety a sleduje stav koncov\u00e9ho za\u0159\u00edzen\u00ed. Pokud byste provedli zachycen\u00ed paket\u016f na hostiteli, pak by pohyb dat vypadal jako komunikace s extern\u00ed IP adresou, i kdy\u017e ve skute\u010dnosti koncov\u00fd bod komunikuje p\u0159\u00edmo s XG firewallem.<\/p>\n<p><img decoding=\"async\" alt=\"Synchronizovan\u00e1 bezpe\u010dnost v Sophos Central\" src=\"\/wp-content\/uploads\/2019\/04\/76bb24f252a90919a9737be3e7cb4c87.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>P\u0159edpokl\u00e1dejme, \u017ee se na po\u010d\u00edta\u010d dostal \u0161kodliv\u00fd software. Sophos Endpoint tuto hrozbu odhal\u00ed nebo p\u0159estaneme dost\u00e1vat Heartbeat z tohoto syst\u00e9mu. Infikovan\u00e9 za\u0159\u00edzen\u00ed automaticky zas\u00edl\u00e1 informace o n\u00e1kaze, co\u017e vyvol\u00e1v\u00e1 automatickou \u0159et\u011bzec akc\u00ed. XG Firewall okam\u017eit\u011b izoluje po\u010d\u00edta\u010d, \u010d\u00edm\u017e zabr\u00e1n\u00ed \u0161\u00ed\u0159en\u00ed \u00fatoku a interakci s C&amp;C servery.<\/p>\n<p>Sophos Endpoint automaticky odstra\u0148uje \u0161kodliv\u00fd software. Po jeho odstran\u011bn\u00ed se koncov\u00e9 za\u0159\u00edzen\u00ed synchronizuje se Sophos Central, pot\u00e9 XG Firewall obnov\u00ed p\u0159\u00edstup k s\u00edti. Anal\u00fdza p\u0159\u00ed\u010din (Root Cause Analysis - RCA nebo EDR - Endpoint Detection and Response) poskytuje podrobn\u00fd p\u0159ehled o tom, co se stalo.<\/p>\n<p><img decoding=\"async\" alt=\"Synchronizovan\u00e1 bezpe\u010dnost v Sophos Central\" src=\"\/wp-content\/uploads\/2019\/04\/77a0f06389830d530c491ad6d9d22cbf.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nPokud p\u0159edpokl\u00e1d\u00e1me, \u017ee p\u0159\u00edstup k firemn\u00edm zdroj\u016fm je zaji\u0161\u0165ov\u00e1n prost\u0159ednictv\u00edm mobiln\u00edch za\u0159\u00edzen\u00ed a tablet\u016f, je mo\u017en\u00e9 v tomto p\u0159\u00edpad\u011b zajistit SynSec?<\/p>\n<p>Pro tento sc\u00e9n\u00e1\u0159 je v Sophos Central podporov\u00e1na <noindex><a rel=\"nofollow\" href=\"https:\/\/www.sophos.com\/en-us\/products\/mobile-control.aspx?id=00130000019KE2V\">Sophos Mobile<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/www.sophos.com\/en-us\/products\/secure-wifi.aspx?id=00130000019KE2V\">Sophos Wireless<\/a><\/noindex>. P\u0159edpokl\u00e1dejme, \u017ee u\u017eivatel se pokou\u0161\u00ed poru\u0161it bezpe\u010dnostn\u00ed politiku na mobiln\u00edm za\u0159\u00edzen\u00ed chr\u00e1n\u011bn\u00e9m pomoc\u00ed Sophos Mobile. Sophos Mobile zjist\u00ed poru\u0161en\u00ed bezpe\u010dnostn\u00ed politiky a zas\u00edl\u00e1 ozn\u00e1men\u00ed ostatn\u00edm komponent\u016fm syst\u00e9mu, co\u017e vyvol\u00e1v\u00e1 p\u0159edem nastavenou reakci na incident. Pokud je v Sophos Mobile nastavena politika \"zak\u00e1zat p\u0159ipojen\u00ed k s\u00edti\", pak Sophos Wireless omez\u00ed p\u0159\u00edstup do s\u00edt\u011b pro toto za\u0159\u00edzen\u00ed. Na panelu n\u00e1stroj\u016f Sophos Central v z\u00e1lo\u017ece Sophos Wireless se zobraz\u00ed ozn\u00e1men\u00ed, \u017ee za\u0159\u00edzen\u00ed bylo infikov\u00e1no. Kdy\u017e se u\u017eivatel pokus\u00ed p\u0159ipojit k s\u00edti, na obrazovce se objev\u00ed ozn\u00e1men\u00ed, kter\u00e9 informuje, \u017ee p\u0159\u00edstup k internetu je omezen.<\/p>\n<p><img decoding=\"async\" alt=\"Synchronizovan\u00e1 bezpe\u010dnost v Sophos Central\" src=\"\/wp-content\/uploads\/2019\/04\/2a49fb10fb5e0ec0082d8772cc2b5194.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<img decoding=\"async\" alt=\"Synchronizovan\u00e1 bezpe\u010dnost v Sophos Central\" src=\"\/wp-content\/uploads\/2019\/04\/84acd97f5b39f9d52070bb48ae58ce94.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nKoncov\u00fd bod m\u00e1 n\u011bkolik stav\u016f Heartbeat: \u010derven\u00fd, \u017elut\u00fd a zelen\u00fd.<br \/>\n\u010cerven\u00fd stav nast\u00e1v\u00e1 v n\u00e1sleduj\u00edc\u00edch p\u0159\u00edpadech:<\/p>\n<ul>\n<li>byl detekov\u00e1n aktivn\u00ed malware;<\/li>\n<li>byla zji\u0161t\u011bna snaha o spu\u0161t\u011bn\u00ed malwaru;<\/li>\n<li>byl detekov\u00e1n \u0161kodliv\u00fd s\u00ed\u0165ov\u00fd provoz;<\/li>\n<li>malware nebyl odstran\u011bn.<\/li>\n<\/ul>\n<p>\n\u017dlut\u00fd stav znamen\u00e1, \u017ee na koncov\u00e9m bodu byl detekov\u00e1n neaktivn\u00ed malware nebo potenci\u00e1ln\u011b ne\u017e\u00e1douc\u00ed program (PUP). Zelen\u00fd stav sv\u011bd\u010d\u00ed o tom, \u017ee nebyly zji\u0161t\u011bny \u017e\u00e1dn\u00e9 z v\u00fd\u0161e uveden\u00fdch probl\u00e9m\u016f. <\/p>\n<p>Po p\u0159ezkoum\u00e1n\u00ed n\u011bkter\u00fdch klasick\u00fdch sc\u00e9n\u00e1\u0159\u016f interakce chr\u00e1n\u011bn\u00fdch za\u0159\u00edzen\u00ed se Sophos Central p\u0159ejdeme k popisu grafick\u00e9ho rozhran\u00ed \u0159e\u0161en\u00ed a prozkoum\u00e1n\u00ed z\u00e1kladn\u00edch nastaven\u00ed a podporovan\u00fdch funkc\u00ed.<\/p>\n<h2>Grafick\u00e9 rozhran\u00ed<\/h2>\n<p>\nNa \u0159\u00eddic\u00edm panelu se zobrazuj\u00ed posledn\u00ed ozn\u00e1men\u00ed. Tak\u00e9 ve form\u011b diagram\u016f je prezentov\u00e1no shrnut\u00ed r\u016fzn\u00fdch komponent ochrany. V tomto p\u0159\u00edpad\u011b jsou zobrazeny souhrnn\u00e9 \u00fadaje o ochran\u011b osobn\u00edch po\u010d\u00edta\u010d\u016f. Na tomto panelu je tak\u00e9 k dispozici souhrnn\u00e1 informace o pokusech o p\u0159\u00edstup na nebezpe\u010dn\u00e9 zdroje a zdroje s nep\u0159ijateln\u00fdm obsahem, statistika anal\u00fdzy e-mail\u016f. <\/p>\n<p><img decoding=\"async\" alt=\"Synchronizovan\u00e1 bezpe\u010dnost v Sophos Central\" src=\"\/wp-content\/uploads\/2019\/04\/c4733e335c2bfce1daa69b90d09b7900.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nSophos Central podporuje zobrazov\u00e1n\u00ed ozn\u00e1men\u00ed podle d\u016fle\u017eitosti, co\u017e u\u017eivateli zabr\u00e1n\u00ed minout kritick\u00e1 upozorn\u011bn\u00ed bezpe\u010dnostn\u00edho syst\u00e9mu. Krom\u011b stru\u010dn\u00e9ho zobrazen\u00ed souhrnn\u00e9 informace o stavu ochrany Sophos Central podporuje protokolov\u00e1n\u00ed ud\u00e1lost\u00ed, integraci se SIEM syst\u00e9my. Sophos Central je pro mnoho spole\u010dnost\u00ed platformou jak pro intern\u00ed SOC, tak pro poskytov\u00e1n\u00ed slu\u017eeb sv\u00fdm z\u00e1kazn\u00edk\u016fm \u2014 MSSP.<\/p>\n<p>Jednou z d\u016fle\u017eit\u00fdch funkc\u00ed je podpora aktualiza\u010dn\u00edho cache pro koncov\u00e9 klienty. To \u0161et\u0159\u00ed \u0161\u00ed\u0159ku p\u00e1sma extern\u00edho provozu, proto\u017ee v tomto p\u0159\u00edpad\u011b se aktualizace stahuj\u00ed pouze jednou na jeden z koncov\u00fdch klient\u016f, a ostatn\u00ed za\u0159\u00edzen\u00ed je stahuj\u00ed od n\u011bj. Krom\u011b t\u00e9to mo\u017enosti m\u016f\u017ee vybran\u00fd endpoint p\u0159ed\u00e1vat zpr\u00e1vy o bezpe\u010dnostn\u00edch politik\u00e1ch a informa\u010dn\u00ed reporty do cloudu Sophos. Tato funkce bude u\u017eite\u010dn\u00e1, pokud existuj\u00ed koncov\u00e1 za\u0159\u00edzen\u00ed, kter\u00e1 nemaj\u00ed p\u0159\u00edm\u00fd p\u0159\u00edstup k internetu, ale vy\u017eaduj\u00ed ochranu. V Sophos Central je k dispozici mo\u017enost (ochrana proti manipulaci), kter\u00e1 zakazuje m\u011bnit nastaven\u00ed ochrany po\u010d\u00edta\u010de nebo odstra\u0148ovat endpoint-agenta.<\/p>\n<p>Jednou z komponent ochrany koncov\u00fdch bod\u016f je antivir nov\u00e9 generace (NGAV) \u2014 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.sophos.com\/en-us\/products\/intercept-x.aspx?id=00130000019KE2V\">Intercept X<\/a><\/noindex>. Pomoc\u00ed technologi\u00ed hlubok\u00e9ho strojov\u00e9ho u\u010den\u00ed je antivir schopn\u00fd detekovat d\u0159\u00edve nezn\u00e1m\u00e9 hrozby bez pou\u017eit\u00ed podpis\u016f. P\u0159esnost detekce je srovnateln\u00e1 s podpisov\u00fdmi analogy, ale na rozd\u00edl od nich poskytuje proaktivn\u00ed ochranu, co\u017e zabra\u0148uje \u00fatok\u016fm \u201enulov\u00e9ho dne\u201c. Intercept X m\u016f\u017ee pracovat paraleln\u011b s podpisov\u00fdmi antiviry jin\u00fdch v\u00fdrobc\u016f.<\/p>\n<p>V tomto \u010dl\u00e1nku jsme stru\u010dn\u011b p\u0159edstavili koncept SynSec, kter\u00fd je implementov\u00e1n v Sophos Central, a tak\u00e9 n\u011bkter\u00e9 mo\u017enosti tohoto \u0159e\u0161en\u00ed. O tom, jak funguj\u00ed jednotliv\u00e9 komponenty ochrany integrovan\u00e9 do Sophos Central, se budeme bavit v n\u00e1sleduj\u00edc\u00edch \u010dl\u00e1nc\u00edch. Z\u00edskat demo verzi \u0159e\u0161en\u00ed m\u016f\u017eete <noindex><a rel=\"nofollow\" href=\"https:\/\/secure2.sophos.com\/en-us\/products\/sophos-central\/free-trial.aspx?id=00130000019KE2V\">zde<\/a><\/noindex>.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/fgts\/blog\/449438\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0414\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0431\u043e\u043b\u044c\u0448\u0443\u044e \u0440\u043e\u043b\u044c \u0438\u0433\u0440\u0430\u0435\u0442 \u0441\u0432\u044f\u0437\u044c \u0435\u0435 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432. \u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u0435\u0440\u0435\u043a\u0440\u044b\u0442\u044c \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0432\u043d\u0435\u0448\u043d\u0438\u0435, \u043d\u043e \u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 \u0443\u0433\u0440\u043e\u0437\u044b. \u041f\u0440\u0438 \u043f\u0440\u043e\u0435\u043a\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0438 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0432\u0430\u0436\u043d\u043e\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0438\u043c\u0435\u0435\u0442 \u043a\u0430\u0436\u0434\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0437\u0430\u0449\u0438\u0442\u044b, \u0431\u0443\u0434\u044c \u044d\u0442\u043e \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441 \u0438\u043b\u0438 firewall, \u0447\u0442\u043e\u0431\u044b \u043e\u043d\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043b\u0438 \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u0441\u0432\u043e\u0435\u0433\u043e \u043a\u043b\u0430\u0441\u0441\u0430 (Endpoint security \u0438\u043b\u0438 NGFW), \u043d\u043e \u0438 \u043e\u0431\u043b\u0430\u0434\u0430\u043b\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":24184,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-32370","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0414\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/sinhronizirovannaya-bezopasnost-v-sophos-central\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0421\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0432 Sophos Central | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0414\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/sinhronizirovannaya-bezopasnost-v-sophos-central\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:46:38+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:46:38+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Synchronizovan\u00e1 bezpe\u010dnost v Sophos Central | ProHoster","description":"Pro zaji\u0161t\u011bn\u00ed vysok\u00e9 \u00fa\u010dinnosti.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/sinhronizirovannaya-bezopasnost-v-sophos-central","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0432 Sophos Central | ProHoster","og:description":"\u0414\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0432\u044b\u0441\u043e\u043a\u043e\u0439 \u044d\u0444\u0444\u0435\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/sinhronizirovannaya-bezopasnost-v-sophos-central","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:46:38+00:00","article:modified_time":"2019-10-31T18:46:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"32370","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 10:32:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:00:22","updated":"2026-01-21 10:32:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/32370","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=32370"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/32370\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/24184"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=32370"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=32370"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=32370"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}