{"id":33885,"date":"2019-10-31T21:55:12","date_gmt":"2019-10-31T18:55:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/tak-chto-zhe-budet-s-autentifikatsiej-i-parolyami-vtoraya-chast-otcheta-javelin-sostoyanie-strogoj-autentifikatsii\/"},"modified":"2019-10-31T21:55:12","modified_gmt":"2019-10-31T18:55:12","slug":"tak-chto-zhe-budet-s-autentifikatsiej-i-parolyami-vtoraya-chast-otcheta-javelin-sostoyanie-strogoj-autentifikatsii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/tak-chto-zhe-budet-s-autentifikatsiej-i-parolyami-vtoraya-chast-otcheta-javelin-sostoyanie-strogoj-autentifikatsii","title":{"rendered":"Co tedy bude s autentizac\u00ed a hesly? Druh\u00e1 \u010d\u00e1st zpr\u00e1vy Javelin \u201eStav p\u0159\u00edsn\u00e9 autentizace\u201c","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Co
\n
\nNed\u00e1vno vydala v\u00fdzkumn\u00e1 spole\u010dnost \u201eJavelin Strategy & Research\u201c zpr\u00e1vu \u201eStav siln\u00e9 autentizace 2019\u201c. Jejich auto\u0159i shrom\u00e1\u017edili informace o tom, jak\u00e9 metody autentizace se pou\u017e\u00edvaj\u00ed v podnikov\u00e9 sf\u00e9\u0159e a u\u017eivatelsk\u00fdch aplikac\u00edch, a tak\u00e9 u\u010dinili zaj\u00edmav\u00e9 z\u00e1v\u011bry o budoucnosti siln\u00e9 autentizace.<\/p>\n

P\u0159eklad prvn\u00ed \u010d\u00e1sti s z\u00e1v\u011bry autor\u016f zpr\u00e1vy, kterou u\u017e jsme publikovali na Habr<\/a><\/noindex>. A nyn\u00ed v\u00e1m p\u0159in\u00e1\u0161\u00edme druhou \u010d\u00e1st - s \u00fadaji a grafy.
\n<\/a><\/noindex>
\nOd p\u0159ekladatele<\/b><\/p>\n

Nehci zcela kop\u00edrovat cel\u00fd stejnojmenn\u00fd blok z prvn\u00ed \u010d\u00e1sti, ale jeden odstavec p\u0159ece jen zopakuji.<\/p>\n

V\u0161echny \u010d\u00edsla a fakta uveden\u00e1 bez jak\u00fdchkoli zm\u011bn, a pokud s nimi nesouhlas\u00edte, je lep\u0161\u00ed se h\u00e1dat ne s p\u0159ekladatelem, ale s autory zpr\u00e1vy. A moje koment\u00e1\u0159e (p\u0159edstaven\u00e9 jako citace, a v textu ozna\u010den\u00e9 kurz\u00edvou<\/i>) jsou m\u00fdm hodnot\u00edc\u00edm n\u00e1zorem a o ka\u017ed\u00e9m z nich r\u00e1d budu diskutovat (stejn\u011b jako o kvalit\u011b p\u0159ekladu). <\/p><\/blockquote>\n

<\/p>\n

U\u017eivatelsk\u00e1 autentizace<\/h2>\n

\nOd roku 2017 vzrostlo pou\u017eit\u00ed siln\u00e9 autentizace v u\u017eivatelsk\u00fdch aplikac\u00edch v\u00fdrazn\u011b, p\u0159edev\u0161\u00edm d\u00edky dostupnosti kryptografick\u00fdch metod autentizace na mobiln\u00edch za\u0159\u00edzen\u00edch, i kdy\u017e jen o m\u00e1lo men\u0161\u00ed procento spole\u010dnost\u00ed pou\u017e\u00edv\u00e1 silnou autentizaci pro webov\u00e9 aplikace.<\/p>\n

Celkov\u011b vzrostl pod\u00edl spole\u010dnost\u00ed vyu\u017e\u00edvaj\u00edc\u00edch silnou autentizaci ve sv\u00e9m podnik\u00e1n\u00ed trojn\u00e1sobn\u011b z 5 % v roce 2017 na 16 % v roce 2018 (obr\u00e1zek 3).<\/p>\n

\"Co
\nMo\u017enosti pou\u017eit\u00ed siln\u00e9 autentizace pro webov\u00e9 aplikace jsou st\u00e1le omezen\u00e9 (proto\u017ee pouze \u00fapln\u011b nov\u00e9 verze n\u011bkter\u00fdch prohl\u00ed\u017ee\u010d\u016f podporuj\u00ed interakci s kryptografick\u00fdmi tokeny, nicm\u00e9n\u011b tento probl\u00e9m lze vy\u0159e\u0161it instalac\u00ed dodate\u010dn\u00e9ho softwaru, jako je RUTOKEN PLUGIN<\/a><\/noindex><\/i>), proto mnoho spole\u010dnost\u00ed pou\u017e\u00edv\u00e1 alternativn\u00ed metody pro online autentizaci, jako jsou mobiln\u00ed aplikace generuj\u00edc\u00ed jednor\u00e1zov\u00e1 hesla.<\/p>\n

Hardwarov\u00e9 kryptografick\u00e9 kl\u00ed\u010de (tady se jedn\u00e1 pouze o kl\u00ed\u010de spl\u0148uj\u00edc\u00ed standardy FIDO<\/i>), jako ty, kter\u00e9 nab\u00edzej\u00ed Google, Feitian, One Span a Yubico, mohou b\u00fdt pou\u017eity pro silnou autentizaci bez instalace dodate\u010dn\u00e9ho softwaru na stoln\u00edch po\u010d\u00edta\u010d\u00edch a notebooc\u00edch (proto\u017ee v\u011bt\u0161ina prohl\u00ed\u017ee\u010d\u016f ji\u017e podporuje standard WebAuthn od FIDO<\/i>), ale pouze 3 % spole\u010dnost\u00ed tuto mo\u017enost vyu\u017e\u00edv\u00e1 pro p\u0159ihl\u00e1\u0161en\u00ed sv\u00fdch u\u017eivatel\u016f.<\/p>\n

Srovn\u00e1n\u00ed kryptografick\u00fdch token\u016f (jako nap\u0159\u00edklad RUTOKEN ECP PKI<\/a><\/noindex>) a tajn\u00fdch kl\u00ed\u010d\u016f, kter\u00e9 pracuj\u00ed podle standard\u016f FIDO, p\u0159esahuje nejen r\u00e1mec t\u00e9to zpr\u00e1vy, ale tak\u00e9 m\u00e9 koment\u00e1\u0159e k n\u00ed. Pokud bych to m\u011bl zcela stru\u010dn\u011b shrnout, oba typy token\u016f pou\u017e\u00edvaj\u00ed podobn\u00e9 algoritmy a principy fungov\u00e1n\u00ed. Tokeny FIDO jsou v sou\u010dasnosti l\u00e9pe podporov\u00e1ny v\u00fdrobci prohl\u00ed\u017ee\u010d\u016f, p\u0159i\u010dem\u017e situace se brzy zm\u011bn\u00ed, proto\u017ee st\u00e1le v\u00edce prohl\u00ed\u017ee\u010d\u016f za\u010dne podporovat Web USB API<\/a><\/noindex>. Na druhou stranu klasick\u00e9 kryptografick\u00e9 tokeny jsou chr\u00e1n\u011bny PIN k\u00f3dem, mohou podepisovat elektronick\u00e9 dokumenty a pou\u017e\u00edvat se pro dvoufaktorovou autentifikaci ve Windows (jak\u00e9koli verzi), Linuxu a Mac OS X, maj\u00ed API pro r\u016fzn\u00e9 programovac\u00ed jazyky, kter\u00e9 umo\u017e\u0148uj\u00ed implementaci 2FA a EP v desktopov\u00fdch, mobiln\u00edch a webov\u00fdch aplikac\u00edch; a tokeny vyr\u00e1b\u011bn\u00e9 v Rusku podporuj\u00ed rusk\u00e9 algoritmy GOST. V ka\u017ed\u00e9m p\u0159\u00edpad\u011b je kryptografick\u00fd token, bez ohledu na to, podle jak\u00e9ho standardu je vytvo\u0159en, nejspolehliv\u011bj\u0161\u00edm a nejpohodln\u011bj\u0161\u00edm zp\u016fsobem autentifikace.<\/p><\/blockquote>\n

\n\"Co
\n\"Co
\n\"Co<\/p>\n

Krom\u011b bezpe\u010dnosti: dal\u0161\u00ed v\u00fdhody p\u0159\u00edsn\u00e9 autentifikace<\/h3>\n

\nNen\u00ed p\u0159ekvapen\u00edm, \u017ee pou\u017e\u00edv\u00e1n\u00ed p\u0159\u00edsn\u00e9 autentifikace \u00fazce souvis\u00ed s d\u016fle\u017eitost\u00ed \u00fadaj\u016f, kter\u00e9 uchov\u00e1v\u00e1 podnik. S nejv\u011bt\u0161\u00edm pr\u00e1vn\u00edm a regula\u010dn\u00edm tlakem \u010del\u00ed firmy, kter\u00e9 uchov\u00e1vaj\u00ed citliv\u00e9 osobn\u00ed informace (Personally Identifiable Information \u2013 PII), jako jsou \u010d\u00edsla soci\u00e1ln\u00edho zabezpe\u010den\u00ed nebo osobn\u00ed zdravotn\u00ed informace (Personal Health Information \u2013 PHI). Takov\u00e9to firmy jsou nejagresivn\u011bj\u0161\u00edmi zast\u00e1nci p\u0159\u00edsn\u00e9 autentifikace. Tlak na podniky nar\u016fst\u00e1 o\u010dek\u00e1v\u00e1n\u00edmi z\u00e1kazn\u00edk\u016f, kte\u0159\u00ed cht\u011bj\u00ed v\u011bd\u011bt, \u017ee organizace, kter\u00fdm sv\u011b\u0159uj\u00ed sv\u00e9 nejcitliv\u011bj\u0161\u00ed \u00fadaje, pou\u017e\u00edvaj\u00ed spolehliv\u00e9 metody autentifikace. Organizace zpracov\u00e1vaj\u00edc\u00ed citliv\u00e9 PII nebo PHI pou\u017e\u00edvaj\u00ed p\u0159\u00edsnou autentifikaci v\u00edce ne\u017e dvakr\u00e1t \u010dast\u011bji ne\u017e organizace, kter\u00e9 uchov\u00e1vaj\u00ed pouze kontaktn\u00ed informace u\u017eivatel\u016f (obr\u00e1zek 7).<\/p>\n

\"Co
\n
\nBohu\u017eel, spole\u010dnosti zat\u00edm necht\u011bj\u00ed zav\u00e1d\u011bt spolehliv\u00e9 metody autentifikace. T\u00e9m\u011b\u0159 t\u0159etina osob odpov\u011bdn\u00fdch za obchodn\u00ed rozhodnut\u00ed pova\u017euje hesla za nej\u00fa\u010dinn\u011bj\u0161\u00ed metodu autentifikace ze v\u0161ech uveden\u00fdch na obr\u00e1zku 9, a 43% pova\u017euje hesla za nejjednodu\u0161\u0161\u00ed metodu autentifikace.<\/p>\n

\"Co
\n<\/p>\n

Tento diagram n\u00e1m dokazuje, \u017ee v\u00fdvoj\u00e1\u0159i podnikov\u00fdch aplikac\u00ed po cel\u00e9m sv\u011bt\u011b jsou si podobn\u00ed\u2026 Nevid\u00ed v\u00fdnosy v implementaci pokro\u010dil\u00fdch mechanism\u016f ochrany p\u0159\u00edstupu k \u00fa\u010dt\u016fm a sd\u00edlej\u00ed stejn\u00e9 iluze. A jen \u010diny regul\u00e1tor\u016f mohou situaci zm\u011bnit. <\/p>\n

Nemluvme o heslech. Ale \u010demu je t\u0159eba v\u011b\u0159it, abychom si mysleli, \u017ee kontroln\u00ed ot\u00e1zky jsou bezpe\u010dn\u011bj\u0161\u00ed ne\u017e kryptografick\u00e9 tokeny? \u00da\u010dinnost kontroln\u00edch ot\u00e1zek, kter\u00e9 lze snadno p\u0159izp\u016fsobit, byla ocen\u011bna na 15 %, zat\u00edmco neprolomiteln\u00e9 tokeny pouze na 10. Aspo\u0148 si pustili film \u201aIluzionista\u2018, tam, i kdy\u017e v alegorick\u00e9 form\u011b, bylo uk\u00e1z\u00e1no, jak snadno kouzeln\u00edci vyl\u00e1kali od podnikatele-podvodn\u00edka v\u0161echny pot\u0159ebn\u00e9 odpov\u011bdi a nechali ho bez pen\u011bz.<\/p>\n

A je\u0161t\u011b jeden fakt, kter\u00fd hodn\u011b vypov\u00edd\u00e1 o kvalifikaci t\u011bch, kdo odpov\u00eddaj\u00ed za bezpe\u010dnostn\u00ed mechanismy v u\u017eivatelsk\u00fdch aplikac\u00edch. V jejich ch\u00e1p\u00e1n\u00ed je proces zad\u00e1v\u00e1n\u00ed hesla jednodu\u0161\u0161\u00ed operac\u00ed ne\u017e autentizace pomoc\u00ed kryptografick\u00e9ho tokenu. A\u010dkoli by se mohlo zd\u00e1t, \u017ee co m\u016f\u017ee b\u00fdt jednodu\u0161\u0161\u00ed ne\u017e p\u0159ipojit token do USB portu a zadat jednoduch\u00fd PIN. <\/p><\/blockquote>\n

\nJe d\u016fle\u017eit\u00e9 zd\u016fraznit, \u017ee zaveden\u00ed p\u0159\u00edsn\u00e9 autentizace umo\u017e\u0148uje podnik\u016fm ji\u017e v\u00edce nemus\u00ed p\u0159em\u00fd\u0161let o metod\u00e1ch autentizace a pravidlech, kter\u00e9 jsou nezbytn\u00e9 k zablokov\u00e1n\u00ed podvodn\u00fdch sch\u00e9mat, co\u017e uspokojuje skute\u010dn\u00e9 pot\u0159eby jejich z\u00e1kazn\u00edk\u016f.<\/p>\n

Zat\u00edmco dodr\u017eov\u00e1n\u00ed regula\u010dn\u00edch po\u017eadavk\u016f je rozumnou prioritou jak pro podniky, kter\u00e9 pou\u017e\u00edvaj\u00ed p\u0159\u00edsnou autentizaci, tak pro ty, kter\u00e9 ji nepou\u017e\u00edvaj\u00ed, spole\u010dnosti, kter\u00e9 ji\u017e pou\u017e\u00edvaj\u00ed p\u0159\u00edsnou autentizaci, mnohem \u010dast\u011bji \u0159\u00edkaj\u00ed, \u017ee zv\u00fd\u0161en\u00ed loajality z\u00e1kazn\u00edk\u016f je nejd\u016fle\u017eit\u011bj\u0161\u00edm ukazatelem, kter\u00fd zohled\u0148uj\u00ed p\u0159i hodnocen\u00ed metody autentizace. (18 % proti 12 %) (obr. 10).<\/p>\n

\"Co<\/p>\n

Podnikov\u00e1 autentizace<\/h2>\n

\nOd roku 2017 roste implementace siln\u00e9 autentizace ve firm\u00e1ch, av\u0161ak je to pon\u011bkud skromn\u011bj\u0161\u00ed ne\u017e u spot\u0159ebitelsk\u00fdch aplikac\u00ed. Pod\u00edl podnik\u016f, kter\u00e9 pou\u017e\u00edvaj\u00ed silnou autentizaci, vzrostl ze 7 % v roce 2017 na 12 % v roce 2018. Na rozd\u00edl od u\u017eivatelsk\u00fdch aplikac\u00ed je v korpor\u00e1tn\u00edm prost\u0159ed\u00ed pou\u017eit\u00ed bezheslov\u00fdch metod autentizace v webov\u00fdch aplikac\u00edch pon\u011bkud b\u011b\u017en\u011bj\u0161\u00ed ne\u017e na mobiln\u00edch za\u0159\u00edzen\u00edch. P\u0159ibli\u017en\u011b polovina podnik\u016f uv\u00e1d\u00ed, \u017ee pro autentizaci sv\u00fdch u\u017eivatel\u016f p\u0159i p\u0159ihl\u00e1\u0161en\u00ed pou\u017e\u00edvaj\u00ed pouze u\u017eivatelsk\u00e1 jm\u00e9na a hesla, p\u0159i\u010dem\u017e ka\u017ed\u00fd p\u00e1t\u00fd (22 %) se tak\u00e9 spol\u00e9h\u00e1 v\u00fdhradn\u011b na hesla pro sekund\u00e1rn\u00ed autentizaci p\u0159i p\u0159\u00edstupu k obzvl\u00e1\u0161\u0165 d\u016fle\u017eit\u00fdm dat\u016fm.to znamen\u00e1, \u017ee se u\u017eivatel nejprve p\u0159ihl\u00e1s\u00ed do aplikace pomoc\u00ed jednodu\u0161\u0161\u00ed metody autentizace, a pokud si p\u0159eje z\u00edskat p\u0159\u00edstup k kritick\u00fdm dat\u016fm, provede dal\u0161\u00ed autentiza\u010dn\u00ed proces, obvykle s pou\u017eit\u00edm spolehliv\u011bj\u0161\u00ed metody.<\/i>).<\/p>\n

\"Co<\/p>\n

Je t\u0159eba si uv\u011bdomit, \u017ee zpr\u00e1va nezohled\u0148uje pou\u017e\u00edv\u00e1n\u00ed kryptografick\u00fdch token\u016f pro dvoufaktorovou autentizaci v opera\u010dn\u00edch syst\u00e9mech Windows, Linux a Mac OS X. A to je v sou\u010dasn\u00e9 dob\u011b nej\u010dast\u011bj\u0161\u00ed pou\u017eit\u00ed 2FA. (Bohu\u017eel, tokeny vytvo\u0159en\u00e9 podle standard\u016f FIDO dok\u00e1\u017eou realizovat 2FA pouze pro Windows 10).<\/p>\n

A proto\u017ee ochrana p\u0159\u00edstupu k pracovn\u00edmu PC a dom\u00e9n\u011b je d\u016fle\u017eit\u00fdm prvkem ochrany podnikov\u00fdch dat, roste i po\u010det implementac\u00ed dvoufaktorov\u00e9 autentizace. <\/p>\n

P\u0159i\u010dem\u017e pokud pro zaveden\u00ed 2FA v online a mobiln\u00edch aplikac\u00edch je pot\u0159eba soubor opat\u0159en\u00ed, kter\u00e9 zahrnuje \u00fapravy t\u011bchto aplikac\u00ed, pak pro zaveden\u00ed 2FA ve Windows sta\u010d\u00ed jen nastavit PKI (nap\u0159\u00edklad na z\u00e1klad\u011b Microsoft Certification Server) a autentiza\u010dn\u00ed politiky v AD.<\/p><\/blockquote>\n

\nDal\u0161\u00edmi dv\u011bma nejb\u011b\u017en\u011bj\u0161\u00edmi metodami autentizace u\u017eivatel\u016f p\u0159i p\u0159ihl\u00e1\u0161en\u00ed do syst\u00e9mu jsou jednor\u00e1zov\u00e1 hesla poskytovan\u00e1 prost\u0159ednictv\u00edm samostatn\u00e9 aplikace (13 % podnik\u016f) a jednor\u00e1zov\u00e1 hesla doru\u010dovan\u00e1 pomoc\u00ed SMS (12 %). A\u010dkoli je procento pou\u017eit\u00ed obou metod docela podobn\u00e9, OTP SMS se nej\u010dast\u011bji pou\u017e\u00edv\u00e1 pro zv\u00fd\u0161en\u00ed \u00farovn\u011b autorizace (v 24 % firem). (Obr\u00e1zek 12).<\/p>\n

\"Co
\n
\nR\u016fst vyu\u017e\u00edv\u00e1n\u00ed siln\u00e9 autentifikace ve firm\u011b lze pravd\u011bpodobn\u011b vysv\u011btlit rostouc\u00ed dostupnost\u00ed implementac\u00ed kryptografick\u00fdch metod autentifikace na platform\u00e1ch pro spr\u00e1vu identity podniku (jin\u00fdmi slovy \u2013 korpor\u00e1tn\u00ed syst\u00e9my SSO a IAM se nau\u010dily pou\u017e\u00edvat tokeny). <\/p>\n

P\u0159i mobiln\u00ed autentifikaci zam\u011bstnanc\u016f a dodavatel\u016f firmy v\u011bt\u0161inou spol\u00e9haj\u00ed na hesla v\u00edce ne\u017e p\u0159i autentifikaci v spot\u0159ebitelsk\u00fdch aplikac\u00edch. O n\u011bco v\u00edce ne\u017e polovina (53%) podnik\u016f pou\u017e\u00edv\u00e1 hesla p\u0159i autentifikaci p\u0159\u00edstupu u\u017eivatel\u016f k firemn\u00edm dat\u016fm p\u0159es mobiln\u00ed za\u0159\u00edzen\u00ed (obr\u00e1zek 13).<\/p>\n

Pokud jde o mobiln\u00ed za\u0159\u00edzen\u00ed, mohlo by se zd\u00e1t, \u017ee biometrie m\u00e1 obrovskou s\u00edlu, kdyby nebylo mnoha p\u0159\u00edpad\u016f fal\u0161ov\u00e1n\u00ed otisk\u016f prst\u016f, hlas\u016f, obli\u010dej\u016f a dokonce i duhovek. Jeden dotaz ve vyhled\u00e1va\u010di uk\u00e1\u017ee, \u017ee spolehliv\u00fd zp\u016fsob biometrick\u00e9 autentifikace zkr\u00e1tka neexistuje. Opravu p\u0159esn\u00e9 senzory sice existuj\u00ed, ale jsou velmi drah\u00e9 a velk\u00e9 \u2014 a do smartphon\u016f se neinstaluj\u00ed.<\/p>\n

Proto jedinou funk\u010dn\u00ed metodou 2FA na mobiln\u00edch za\u0159\u00edzen\u00edch je pou\u017eit\u00ed kryptografick\u00fdch token\u016f, kter\u00e9 se p\u0159ipojuj\u00ed k chytr\u00e9mu telefonu p\u0159es rozhran\u00ed NFC, Bluetooth a USB Type-C.<\/p><\/blockquote>\n

\n\"Co
\n
\nOchrana finan\u010dn\u00edch \u00fadaj\u016f spole\u010dnosti je hlavn\u00edm d\u016fvodem investic do bezheslov\u00e9 autentifikace (44%) s nejrychlej\u0161\u00edm r\u016fstem od roku 2017 (n\u00e1r\u016fst o osm procentn\u00edch bod\u016f). N\u00e1sleduje ochrana du\u0161evn\u00edho vlastnictv\u00ed (40%) a personalistick\u00fdch (HR) dat (39%). A nen\u00ed divu \u2013 nejen\u017ee je hodnota spojen\u00e1 s t\u011bmito typy dat \u0161iroce uzn\u00e1v\u00e1na, ale pracuje s nimi tak\u00e9 relativn\u011b mal\u00e9 mno\u017estv\u00ed zam\u011bstnanc\u016f. To znamen\u00e1, \u017ee n\u00e1klady na zaveden\u00ed nejsou tak vysok\u00e9 a nau\u010dit pracovat s komplikovan\u011bj\u0161\u00edm autentifika\u010dn\u00edm syst\u00e9mem je pot\u0159eba pouze n\u011bkolik lid\u00ed. Naopak typy dat a za\u0159\u00edzen\u00ed, ke kter\u00fdm se obvykle obrac\u00ed v\u011bt\u0161ina zam\u011bstnanc\u016f firmy, jsou st\u00e1le chr\u00e1n\u011bny v\u00fdhradn\u011b hesly. Dokumenty zam\u011bstnanc\u016f, pracovn\u00ed stanice a firemn\u00ed port\u00e1ly e-mailu jsou oblastmi s nejv\u011bt\u0161\u00edm rizikem, proto\u017ee pouze \u010dtvrtina podnik\u016f chr\u00e1n\u00ed tyto aktiva pomoc\u00ed bezheslov\u00e9 autentifikace (Obr\u00e1zek 14).<\/p>\n

\"Co<\/p>\n

Korpor\u00e1tn\u00ed e-mail je obecn\u011b velmi nebezpe\u010dn\u00fd a \"d\u00edrav\u00fd\" n\u00e1stroj, jeho\u017e potenci\u00e1ln\u00ed nebezpe\u010dnost je v\u011bt\u0161inou IT \u0159editeli podce\u0148ov\u00e1na. Denn\u011b zam\u011bstnanci obdr\u017e\u00ed des\u00edtky e-mail\u016f, tak\u017ee pro\u010d by mezi nimi nem\u011bl b\u00fdt alespo\u0148 jeden phishingov\u00fd (tj. podvodn\u00fd). Tento e-mail bude navr\u017een ve stylu e-mail\u016f spole\u010dnosti, tak\u017ee zam\u011bstnanec bez obav klikne na odkaz v tomto e-mailu. A pak m\u016f\u017ee nastat cokoliv, nap\u0159\u00edklad sta\u017een\u00ed viru na napaden\u00fd stroj nebo \u00fanik hesel (v\u010detn\u011b metodou soci\u00e1ln\u00edho in\u017een\u00fdrstv\u00ed skrze zad\u00e1n\u00ed do podvodn\u00e9ho autentifika\u010dn\u00edho formul\u00e1\u0159e, kter\u00fd vytv\u00e1\u0159\u00ed \u00fato\u010dn\u00edk).<\/p>\n

Aby se podobn\u00e9 v\u011bci nest\u00e1valy, m\u011bly by b\u00fdt e-maily podepisov\u00e1ny. Pak bude okam\u017eit\u011b jasn\u00e9, kter\u00fd e-mail vytvo\u0159il legitimn\u00ed zam\u011bstnanec a kter\u00fd \u00fato\u010dn\u00edk. V Outlooku\/Exchange se nap\u0159\u00edklad elektronick\u00fd podpis na z\u00e1klad\u011b kryptografick\u00fdch token\u016f zap\u00edn\u00e1 pom\u011brn\u011b rychle a jednodu\u0161e a m\u016f\u017ee b\u00fdt pou\u017eit spole\u010dn\u011b s dvoufaktorovou autentifikac\u00ed v po\u010d\u00edta\u010d\u00edch a dom\u00e9n\u00e1ch Windows.<\/p><\/blockquote>\n

\nMezi t\u011bmi vedouc\u00edmi, kte\u0159\u00ed se spol\u00e9haj\u00ed v\u00fdhradn\u011b na autentifikaci pomoc\u00ed hesla uvnit\u0159 podniku, dv\u011b t\u0159etiny (66%) to d\u011blaj\u00ed, proto\u017ee v\u011b\u0159\u00ed, \u017ee hesla poskytuj\u00ed dostate\u010dnou bezpe\u010dnost pro typ informac\u00ed, kter\u00e9 jejich spole\u010dnost mus\u00ed chr\u00e1nit (obr\u00e1zek 15).<\/p>\n

Ale metody p\u0159\u00edsn\u00e9 autentifikace se st\u00e1vaj\u00ed st\u00e1le b\u011b\u017en\u011bj\u0161\u00edmi. V mnoha ohledech d\u00edky jejich zvy\u0161uj\u00edc\u00ed se dostupnosti. \u010c\u00edm d\u00e1l v\u00edce syst\u00e9m\u016f spr\u00e1vy identit a p\u0159\u00edstupu (IAM), prohl\u00ed\u017ee\u010d\u016f a opera\u010dn\u00edch syst\u00e9m\u016f podporuje autentifikaci pomoc\u00ed kryptografick\u00fdch token\u016f. <\/p>\n

P\u0159\u00edsn\u00e1 autentifikace m\u00e1 tak\u00e9 dal\u0161\u00ed v\u00fdhodu. Proto\u017ee se heslo ji\u017e nepou\u017e\u00edv\u00e1 (bylo nahrazeno jednoduch\u00fdm PIN k\u00f3dem), nejsou ani \u017e\u00e1dosti od zam\u011bstnanc\u016f o v\u00fdm\u011bnu zapomenut\u00e9ho hesla. To zase sni\u017euje z\u00e1t\u011b\u017e na IT odd\u011blen\u00ed podniku.<\/p>\n

\"Co<\/p>\n

\n

Z\u00e1v\u011bry a shrnut\u00ed<\/h4>\n

<\/p>\n

    \n
  1. Vedouc\u00ed pracovn\u00edci \u010dasto nemaj\u00ed pot\u0159ebn\u00e9 znalosti k posouzen\u00ed skute\u010dn\u00e9 <\/b>efektivity r\u016fzn\u00fdch mo\u017enost\u00ed autentifikace. Jsou zvykl\u00ed d\u016fv\u011b\u0159ovat takov\u00fdm zastaral\u00fdm <\/b>zp\u016fsob\u016fm ochrany, jako jsou hesla a tajn\u00e9 ot\u00e1zky, prost\u011b proto, \u017ee \"d\u0159\u00edve to fungovalo\". <\/li>\n
  2. U\u017eivatel\u00e9 maj\u00ed tyto znalosti je\u0161t\u011b v men\u0161\u00ed m\u00ed\u0159e<\/b>, pro n\u011b je hlavn\u00ed \u2013 jednoduchost a pohodl\u00ed<\/b>. Zat\u00edmco nemaj\u00ed motivaci vyb\u00edrat si bezpe\u010dn\u011bj\u0161\u00ed \u0159e\u0161en\u00ed<\/b>.<\/li>\n
  3. V\u00fdvoj\u00e1\u0159i u\u017eivatelsk\u00fdch aplikac\u00ed \u010dasto nemaj\u00ed d\u016fvod<\/b>, aby implementovali dvoufaktorovou autentizaci m\u00edsto heslov\u00e9. Konkurence v \u00farovni ochrany u\u017eivatelsk\u00fdch aplikac\u00ed chyb\u00ed<\/b>.<\/li>\n
  4. Ve\u0161ker\u00e1 odpov\u011bdnost za hacknut\u00ed je p\u0159enesena na u\u017eivatele<\/b>. Pokud jsem zavolal jednor\u00e1zov\u00e9 heslo zlo\u010dinci \u2013 jsem vinen<\/b>. Pokud bylo va\u0161e heslo zachyceno nebo odhaleno \u2013 jsem vinen<\/b>. Pokud jsem nepo\u017eadoval po v\u00fdvoj\u00e1\u0159i, aby v produktu pou\u017e\u00edval spolehliv\u00e9 metody autentizace \u2013 jsem vinen<\/b>.<\/li>\n
  5. Spr\u00e1vn\u00fd <\/b>regul\u00e1tor by m\u011bl p\u0159edev\u0161\u00edm<\/b> po\u017eadovat od spole\u010dnost\u00ed implementaci \u0159e\u0161en\u00ed, kter\u00e9 blokuj\u00ed <\/b>\u00faniky dat (zejm\u00e9na dvoufaktorov\u00e1 autentizace), a ne trestat za ji\u017e prob\u011bhl\u00e9<\/b> \u00faniky dat.<\/li>\n
  6. N\u011bkte\u0159\u00ed v\u00fdvoj\u00e1\u0159i softwaru se sna\u017e\u00ed prodat spot\u0159ebitel\u016fm star\u00e1 a nijak zvl\u00e1\u0161\u0165 spolehliv\u00e1<\/b> \u0159e\u0161en\u00ed v kr\u00e1sn\u00e9m obalu<\/b> \u00abinovativn\u00edho\u00bb produktu. Nap\u0159\u00edklad autentizace spojen\u00edm s konkr\u00e9tn\u00edm smartphonem nebo pou\u017eit\u00ed biometrije. Jak ukazuje zpr\u00e1va, \u201e opravdu spolehliv\u00fdm<\/b> m\u016f\u017ee b\u00fdt pouze \u0159e\u0161en\u00ed zalo\u017een\u00e9 na p\u0159\u00edsn\u00e9 autentizaci, tedy na kryptografick\u00fdch toc\u00edch.<\/li>\n
  7. Stejn\u00fd<\/b> kryptografick\u00fd token lze pou\u017e\u00edt pro celou \u0159adu \u00fakol\u016f<\/b>: pro p\u0159\u00edsnou autentizaci<\/b> v opera\u010dn\u00edm syst\u00e9mu podniku, v korpor\u00e1tn\u00ed a u\u017eivatelsk\u00e9 aplikaci, pro elektronick\u00fd podpis<\/b> finan\u010dn\u00edch transakc\u00ed (d\u016fle\u017eit\u00e9 pro bankovn\u00ed aplikace), dokumenty a elektronickou po\u0161tu.<\/li>\n<\/ol>\n<\/blockquote>\n

    Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u041d\u0435\u0434\u0430\u0432\u043d\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u00abJavelin Strategy & Research\u00bb \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0442\u0447\u0451\u0442 \u00abThe State of Strong Authentication 2019\u00bb. \u0415\u0433\u043e \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u0438 \u0441\u043e\u0431\u0440\u0430\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0442\u043e\u043c \u043a\u0430\u043a\u0438\u0435 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0432 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435 \u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u0434\u0435\u043b\u0430\u043b\u0438 \u043b\u044e\u0431\u043e\u043f\u044b\u0442\u043d\u044b\u0435 \u0432\u044b\u0432\u043e\u0434\u044b \u043e \u0431\u0443\u0434\u0443\u0449\u0435\u043c \u0441\u0442\u0440\u043e\u0433\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u041f\u0435\u0440\u0435\u0432\u043e\u0434 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u0441 \u0432\u044b\u0432\u043e\u0434\u0430\u043c\u0438 \u0430\u0432\u0442\u043e\u0440\u043e\u0432 \u043e\u0442\u0447\u0435\u0442\u0430, \u043c\u044b \u0443\u0436\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u0430 \u0425\u0430\u0431\u0440\u0435. \u0410 \u0441\u0435\u0439\u0447\u0430\u0441 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":25549,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-33885","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Co se tedy stane s autentizac\u00ed a hesly? Druh\u00e1 \u010d\u00e1st zpr\u00e1vy Javelin \u201eStav p\u0159\u00edsn\u00e9 autentizace\u201c | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/tak-chto-zhe-budet-s-autentifikatsiej-i-parolyami-vtoraya-chast-otcheta-javelin-sostoyanie-strogoj-autentifikatsii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0422\u0430\u043a \u0447\u0442\u043e \u0436\u0435 \u0431\u0443\u0434\u0435\u0442 \u0441 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u0438 \u043f\u0430\u0440\u043e\u043b\u044f\u043c\u0438? \u0412\u0442\u043e\u0440\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u043e\u0442\u0447\u0435\u0442\u0430 Javelin \u00ab\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0441\u0442\u0440\u043e\u0433\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438\u00bb | ProHoster","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/tak-chto-zhe-budet-s-autentifikatsiej-i-parolyami-vtoraya-chast-otcheta-javelin-sostoyanie-strogoj-autentifikatsii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:55:12+00:00","article:modified_time":"2019-10-31T18:55:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33885","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 17:06:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:31:23","updated":"2026-01-21 17:06:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/33885","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=33885"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/33885\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/25549"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=33885"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=33885"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=33885"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}