{"id":35754,"date":"2019-10-31T22:06:09","date_gmt":"2019-10-31T19:06:09","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-ya-stal-uyazvimym-skaniruem-it-infrastrukturu-s-pomoshhyu-qualys\/"},"modified":"2019-10-31T22:06:09","modified_gmt":"2019-10-31T19:06:09","slug":"kak-ya-stal-uyazvimym-skaniruem-it-infrastrukturu-s-pomoshhyu-qualys","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-ya-stal-uyazvimym-skaniruem-it-infrastrukturu-s-pomoshhyu-qualys","title":{"rendered":"Jak jsem se stal zraniteln\u00fdm: skenov\u00e1n\u00ed IT infrastruktury pomoc\u00ed Qualys","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ahoj v\u0161ichni!<\/p>\n

Dnes chci mluvit o cloudov\u00e9m \u0159e\u0161en\u00ed pro vyhled\u00e1v\u00e1n\u00ed a anal\u00fdzu zranitelnost\u00ed Qualys Vulnerability Management, na kter\u00e9m je postaven jedno z na\u0161ich slu\u017eeb<\/a><\/noindex>.<\/p>\n

N\u00ed\u017ee uk\u00e1\u017eu, jak je samotn\u00e9 skenov\u00e1n\u00ed organizov\u00e1no a jak\u00e9 informace o zranitelnostech lze zjistit na z\u00e1klad\u011b v\u00fdsledk\u016f.<\/p>\n

\"Jak
\n<\/a><\/noindex><\/p>\n

Co lze skenovat<\/h3>\n

\nExtern\u00ed slu\u017eby. <\/b>Pro skenov\u00e1n\u00ed slu\u017eeb, kter\u00e9 maj\u00ed p\u0159\u00edstup na internet, n\u00e1m klient poskytuje jejich IP adresy a p\u0159ihla\u0161ovac\u00ed \u00fadaje (pokud je pot\u0159eba skenov\u00e1n\u00ed s autentizac\u00ed). Skenujeme slu\u017eby pomoc\u00ed cloudu Qualys a na z\u00e1klad\u011b v\u00fdsledk\u016f zas\u00edl\u00e1me zpr\u00e1vu.<\/p>\n

\"Jak
\n
\nIntern\u00ed slu\u017eby.<\/b> V tomto p\u0159\u00edpad\u011b skener hled\u00e1 zranitelnosti na intern\u00edch serverech a v s\u00ed\u0165ov\u00e9 infrastruktu\u0159e. Pomoc\u00ed takov\u00e9ho skenov\u00e1n\u00ed lze prov\u00e9st inventarizaci verz\u00ed opera\u010dn\u00edch syst\u00e9m\u016f, aplikac\u00ed, otev\u0159en\u00fdch port\u016f a slu\u017eeb, kter\u00e9 se za nimi nach\u00e1zej\u00ed. <\/p>\n

Pro skenov\u00e1n\u00ed uvnit\u0159 infrastruktury klienta se instaluje skener Qualys. Cloud Qualys zde pln\u00ed funkci centra p\u0159\u00edkaz\u016f pro tento skener. <\/p>\n

Krom\u011b intern\u00edho serveru s Qualys mohou b\u00fdt na objekty skenov\u00e1n\u00ed nainstalov\u00e1ny agenty (Cloud Agent). Ti sb\u00edraj\u00ed informace o syst\u00e9mu lok\u00e1ln\u011b, t\u00e9m\u011b\u0159 nezat\u011b\u017euj\u00ed s\u00ed\u0165 a hostitele, na kter\u00fdch pracuj\u00ed. Z\u00edskan\u00e9 informace jsou odes\u00edl\u00e1ny do cloudu.<\/p>\n

\"Jak
\n
\nZde jsou t\u0159i d\u016fle\u017eit\u00e9 body: autentizace a v\u00fdb\u011br objekt\u016f pro skenov\u00e1n\u00ed.<\/p>\n

    \n
  1. Pou\u017eit\u00ed autentizace<\/b>. N\u011bkte\u0159\u00ed klienti \u017e\u00e1daj\u00ed o proveden\u00ed skenov\u00e1n\u00ed blackbox, zejm\u00e9na pro extern\u00ed slu\u017eby: p\u0159ed\u00e1vaj\u00ed n\u00e1m rozsah IP adres bez uveden\u00ed syst\u00e9mu a \u0159\u00edkaj\u00ed \u201ebu\u010fte jako hacker\u201c. Ale hacke\u0159i z\u0159\u00eddka jednaj\u00ed naslepo. Kdy\u017e dojde na \u00fatok (ne na pr\u016fzkum), v\u011bd\u00ed, co hackuj\u00ed.\u00a0\n

    Naslepo m\u016f\u017ee Qualys narazit na klamn\u00e9 bannery a skenovat je m\u00edsto c\u00edlov\u00e9ho syst\u00e9mu. A tak\u00e9 bez pochopen\u00ed toho, co p\u0159esn\u011b bude skenov\u00e1no, je snadn\u00e9 ud\u011blat chybu v nastaven\u00ed skeneru a \u201ep\u0159ilo\u017eit\u201c kontrolovan\u00fd servis.\u00a0<\/p>\n

    Skenov\u00e1n\u00ed p\u0159inese v\u00edce u\u017eitku, pokud se prov\u00e1d\u011bj\u00ed kontroly s autentizac\u00ed p\u0159ed skenovan\u00fdmi syst\u00e9my (whitebox). Tak skener bude ch\u00e1pat, kam p\u0159i\u0161el, a vy dostanete \u00fapln\u00e9 \u00fadaje o zranitelnostech c\u00edlov\u00e9ho syst\u00e9mu.<\/p>\n

    \"Jak
    \nQualys m\u00e1 mnoho mo\u017enost\u00ed pro autentizaci.<\/i><\/li>\n

  2. Skupinovat aktiva<\/b>. Pokud spust\u00edte skenov\u00e1n\u00ed najednou a bez rozli\u0161en\u00ed, bude to trvat dlouho a vytv\u00e1\u0159et dal\u0161\u00ed z\u00e1t\u011b\u017e na syst\u00e9my. Hostitele a slu\u017eby by bylo lep\u0161\u00ed seskupit do skupin podle d\u016fle\u017eitosti, um\u00edst\u011bn\u00ed, verze OS, kriti\u010dnosti infrastruktury a dal\u0161\u00edch znak\u016f (v Qualys se naz\u00fdvaj\u00ed Asset Groups a Asset Tags) a p\u0159i skenov\u00e1n\u00ed vyb\u00edrat konkr\u00e9tn\u00ed skupinu.<\/li>\n
  3. Vyberte technick\u00e9 okno pro skenov\u00e1n\u00ed.<\/b> I kdy\u017e jste v\u0161echno pl\u00e1novali a p\u0159ipravovali se, skenov\u00e1n\u00ed vytv\u00e1\u0159\u00ed dodate\u010dn\u00e9 zat\u00ed\u017een\u00ed syst\u00e9mu. Nen\u00ed nutn\u00e9, aby to zp\u016fsobilo degradaci slu\u017eby, ale je lep\u0161\u00ed vybrat ur\u010ditou dobu, jako pro z\u00e1lohov\u00e1n\u00ed nebo nasazen\u00ed aktualizac\u00ed.<\/li>\n<\/ol>\n

    <\/p>\n

    Co lze zjistit z report\u016f?<\/h3>\n

    \nNa z\u00e1klad\u011b skenov\u00e1n\u00ed klient z\u00edsk\u00e1 zpr\u00e1vu, kter\u00e1 bude obsahovat nejen seznam v\u0161ech nalezen\u00fdch zranitelnost\u00ed, ale tak\u00e9 z\u00e1kladn\u00ed doporu\u010den\u00ed k jejich odstran\u011bn\u00ed: aktualizace, patche atd. U Qualys je hodn\u011b report\u016f: existuj\u00ed v\u00fdchoz\u00ed \u0161ablony a m\u016f\u017eete vytv\u00e1\u0159et sv\u00e9 vlastn\u00ed. Aby se v cel\u00e9 t\u00e9 rozmanitosti neztratili, je lep\u0161\u00ed si nejd\u0159\u00edve ujasnit n\u00e1sleduj\u00edc\u00ed body:\u00a0<\/p>\n