{"id":37173,"date":"2019-10-31T22:16:11","date_gmt":"2019-10-31T19:16:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/7-klyuchevyh-indikatorov-riska-active-directory-na-paneli-monitoringa-varonis\/"},"modified":"2019-10-31T22:16:11","modified_gmt":"2019-10-31T19:16:11","slug":"7-klyuchevyh-indikatorov-riska-active-directory-na-paneli-monitoringa-varonis","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/7-klyuchevyh-indikatorov-riska-active-directory-na-paneli-monitoringa-varonis","title":{"rendered":"7 kl\u00ed\u010dov\u00fdch indik\u00e1tor\u016f rizika Active Directory na \u0159\u00eddic\u00edm panelu Varonis","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"7
\n
\nV\u0161e, co \u00fato\u010dn\u00edk pot\u0159ebuje, je \u010das a motivace, aby pronikl do va\u0161\u00ed s\u00edt\u011b. Na\u0161\u00ed prac\u00ed je v\u0161ak zajistit, aby se mu to nepoda\u0159ilo, nebo alespo\u0148 co nejv\u00edce zt\u00ed\u017eit tuto \u00falohu. Je t\u0159eba za\u010d\u00edt s identifikac\u00ed slab\u00fdch m\u00edst v Active Directory (d\u00e1le AD), kter\u00e9 by \u00fato\u010dn\u00edk mohl vyu\u017e\u00edt k z\u00edsk\u00e1n\u00ed p\u0159\u00edstupu a pohybu po s\u00edti, ani\u017e by byl odhalen. Dnes se v \u010dl\u00e1nku pod\u00edv\u00e1me na rizikov\u00e9 indik\u00e1tory, kter\u00e9 odr\u00e1\u017eej\u00ed existuj\u00edc\u00ed zranitelnosti v kybernetick\u00e9 ochran\u011b va\u0161\u00ed organizace, na p\u0159\u00edkladu monitorovac\u00edho panelu AD Varonis.
\n<\/a><\/noindex><\/p>\n

\u00dato\u010dn\u00edci vyu\u017e\u00edvaj\u00ed ur\u010dit\u00e9 konfigurace v dom\u00e9n\u011b<\/h2>\n

\n\u00dato\u010dn\u00edci pou\u017e\u00edvaj\u00ed mnoho rafinovan\u00fdch trik\u016f a zranitelnost\u00ed, aby pronikli do firemn\u00ed s\u00edt\u011b a zv\u00fd\u0161ili sv\u00e9 privilegium. N\u011bkter\u00e9 z t\u011bchto zranitelnost\u00ed jsou konfigura\u010dn\u00edmi parametry dom\u00e9ny, kter\u00e9 lze snadno zm\u011bnit po jejich odhalen\u00ed.<\/p>\n

Monitorovac\u00ed panel AD okam\u017eit\u011b upozorn\u00ed, pokud jste (nebo va\u0161i syst\u00e9mov\u00ed administr\u00e1to\u0159i) nezm\u011bnili heslo KRBTGT minul\u00fd m\u011bs\u00edc, nebo pokud se n\u011bkdo autentizoval pomoc\u00ed vestav\u011bn\u00e9ho \u00fa\u010dtu spr\u00e1vce ve v\u00fdchoz\u00edm nastaven\u00ed (Administrator). Tyto dva \u00fa\u010dty poskytuj\u00ed neomezen\u00fd p\u0159\u00edstup k va\u0161\u00ed s\u00edti: \u00fato\u010dn\u00edci se budou sna\u017eit k nim z\u00edskat p\u0159\u00edstup, aby hladce obch\u00e1zeli jak\u00e1koliv omezen\u00ed v privileg\u00edch a opr\u00e1vn\u011bn\u00edch. A jako v\u00fdsledek \u2013 z\u00edskat p\u0159\u00edstup k jak\u00fdmkoliv dat\u016fm, kter\u00e1 je zaj\u00edmaj\u00ed.<\/p>\n

Samoz\u0159ejm\u011b, m\u016f\u017eete tyto zranitelnosti odhalit i sami: nap\u0159\u00edklad si nastavit p\u0159ipom\u00ednku v kalend\u00e1\u0159i na kontrolu nebo spustit PowerShell skript, abyste shrom\u00e1\u017edili tyto informace. <\/p>\n

Monitorovac\u00ed panel Varonis se aktualizuje automaticky <\/strong>, aby poskytl rychl\u00fd p\u0159ehled a anal\u00fdzu kl\u00ed\u010dov\u00fdch ukazatel\u016f, kter\u00e9 zd\u016fraz\u0148uj\u00ed potenci\u00e1ln\u00ed zranitelnosti, abyste mohli okam\u017eit\u011b podniknout krok k jejich odstran\u011bn\u00ed.<\/p>\n

3 kl\u00ed\u010dov\u00e9 indik\u00e1tory rizika na \u00farovni dom\u00e9ny<\/h3>\n

\nN\u00ed\u017ee je \u0159ada widget\u016f dostupn\u00fdch na monitorovac\u00edm panelu Varonis, jejich\u017e vyu\u017eit\u00ed v\u00fdrazn\u011b pos\u00edl\u00ed ochranu firemn\u00ed s\u00edt\u011b a IT infrastruktury jako celku.<\/p>\n

1. Po\u010det dom\u00e9n, u kter\u00fdch se heslo \u00fa\u010dtu Kerberos nezm\u011bnilo po dlouhou dobu <\/strong><\/p>\n

\u00da\u010det KRBTGT je speci\u00e1ln\u00ed \u00fa\u010det v AD, kter\u00fd podepisuje v\u0161echny Kerberos l\u00edstky <\/a><\/noindex>. \u00dato\u010dn\u00edci, kte\u0159\u00ed z\u00edskali p\u0159\u00edstup k \u0159adi\u010di dom\u00e9ny (DC), mohou pou\u017e\u00edt tento \u00fa\u010det k vytv\u00e1\u0159en\u00ed Golden ticket<\/a><\/noindex>, kter\u00fd jim poskytne neomezen\u00fd p\u0159\u00edstup k prakticky jak\u00e9mukoli syst\u00e9mu v podnikov\u00e9 s\u00edti. Narazili jsme na situaci, kdy po \u00fasp\u011b\u0161n\u00e9m z\u00edsk\u00e1n\u00ed Golden Ticket m\u011bl \u00fato\u010dn\u00edk p\u0159\u00edstup k s\u00edti organizace po dobu dvou let. Pokud se heslo \u00fa\u010dtu KRBTGT ve va\u0161\u00ed spole\u010dnosti nem\u011bnilo posledn\u00edch \u010dty\u0159icet dn\u00ed, widget v\u00e1s na to upozorn\u00ed. <\/p>\n

\u010cty\u0159icet dn\u00ed je v\u00edce ne\u017e dostate\u010dn\u00fd \u010das pro \u00fato\u010dn\u00edka, aby z\u00edskal p\u0159\u00edstup do s\u00edt\u011b. Nicm\u00e9n\u011b, pokud zajist\u00edte a standardizujete proces pravideln\u00e9 zm\u011bny tohoto hesla, v\u00fdrazn\u011b to zt\u00ed\u017e\u00ed \u00fato\u010dn\u00edkovi proniknut\u00ed do podnikov\u00e9 s\u00edt\u011b. <\/p>\n

\"7
\nPamatujte, \u017ee podle implementace protokolu Kerberos od spole\u010dnosti Microsoft mus\u00edte heslo<\/a><\/noindex> KRBTGT dvakr\u00e1t zm\u011bnit.<\/p>\n

D\u00e1le v\u00e1m tento AD-widget p\u0159ipomene, kdy p\u0159ijde \u010das znovu zm\u011bnit heslo KRBTGT pro v\u0161echny dom\u00e9ny ve va\u0161\u00ed s\u00edti.<\/p>\n

2. Po\u010det dom\u00e9n, ve kter\u00fdch byla ned\u00e1vno pou\u017eita vestav\u011bn\u00e1 \u00fa\u010det administr\u00e1tora (Administrator) <\/strong><\/p>\n

Podle principu minim\u00e1ln\u00edch opr\u00e1vn\u011bn\u00ed <\/a><\/noindex> \u2014 syst\u00e9mov\u00fdm administr\u00e1tor\u016fm jsou poskytnuty dva \u00fa\u010dty: prvn\u00ed je \u00fa\u010det pro ka\u017edodenn\u00ed pou\u017eit\u00ed, a druh\u00fd pro pl\u00e1novan\u00e9 administrativn\u00ed pr\u00e1ce. To znamen\u00e1, \u017ee nikdo by nem\u011bl pou\u017e\u00edvat v\u00fdchoz\u00ed \u00fa\u010det administr\u00e1tora. <\/p>\n

Vestav\u011bn\u00fd \u00fa\u010det administr\u00e1tora je \u010dasto pou\u017e\u00edv\u00e1n pro usnadn\u011bn\u00ed procesu syst\u00e9mov\u00e9ho administrace. To se m\u016f\u017ee st\u00e1t \u0161patn\u00fdm zvykem, jeho\u017e v\u00fdsledkem bude hacknut\u00ed. Pokud se ve va\u0161\u00ed organizaci toto d\u011bje, bude pro v\u00e1s obt\u00ed\u017en\u00e9 rozli\u0161it spr\u00e1vn\u00e9 pou\u017e\u00edv\u00e1n\u00ed tohoto \u00fa\u010dtu od potenci\u00e1ln\u011b \u0161kodliv\u00e9ho p\u0159\u00edstupu.<\/p>\n

\"7
\nPokud widget ukazuje n\u011bco jin\u00e9ho ne\u017e nula, znamen\u00e1 to, \u017ee n\u011bkdo nespr\u00e1vn\u011b pracuje s administrativn\u00edmi \u00fa\u010dty. V takov\u00e9m p\u0159\u00edpad\u011b je nezbytn\u00e9 p\u0159ijmout opat\u0159en\u00ed k oprav\u011b a omezen\u00ed p\u0159\u00edstupu k vestav\u011bn\u00e9mu \u00fa\u010dtu administr\u00e1tora.
\nJakmile se v\u00e1m poda\u0159\u00ed dos\u00e1hnout nulov\u00e9 hodnoty widgetu a syst\u00e9mov\u00ed administr\u00e1to\u0159i tuto \u00fa\u010detn\u00ed polo\u017eku ji\u017e nevyu\u017e\u00edvaj\u00ed pro svou pr\u00e1ci, jak\u00e9koli jeho dal\u0161\u00ed zm\u011bny budou nazna\u010dovat potenci\u00e1ln\u00ed kybernetick\u00fd \u00fatok.<\/p>\n

3. Po\u010det dom\u00e9n, ve kter\u00fdch chyb\u00ed skupina chr\u00e1n\u011bn\u00fdch u\u017eivatel\u016f (Protected Users) <\/strong><\/p>\n

Star\u0161\u00ed verze AD podporovaly slab\u00fd typ \u0161ifrov\u00e1n\u00ed \u2014 RC4. Hacke\u0159i prolomili RC4 ji\u017e p\u0159ed mnoha lety, a dnes je pro \u00fato\u010dn\u00edka prolomen\u00ed \u00fa\u010dtu, kter\u00fd st\u00e1le pou\u017e\u00edv\u00e1 RC4, velmi trivi\u00e1ln\u00ed \u00fakol. Ve verzi Active Directory, kter\u00e1 byla p\u0159edstavena ve Windows Server 2012, byla zavedena nov\u00e1 skupina u\u017eivatel\u016f nazvan\u00e1 Skupina chr\u00e1n\u011bn\u00fdch u\u017eivatel\u016f (Protected Users). Ta poskytuje dal\u0161\u00ed ochrann\u00e9 n\u00e1stroje a zabra\u0148uje autentizaci u\u017eivatel\u016f pomoc\u00ed \u0161ifrov\u00e1n\u00ed RC4.<\/p>\n

Tento widget uk\u00e1\u017ee, pokud v jak\u00e9koli dom\u00e9n\u011b organizace chyb\u00ed takov\u00e1 skupina, abyste to mohli opravit, tj. aktivovat skupinu chr\u00e1n\u011bn\u00fdch u\u017eivatel\u016f a pou\u017e\u00edt ji k ochran\u011b infrastruktury.<\/p>\n

\"7<\/p>\n

Snadn\u00e9 c\u00edle pro \u00fato\u010dn\u00edky<\/h2>\n

\n\u00da\u010dty u\u017eivatel\u016f jsou c\u00edlem \u010d\u00edslo jedna pro \u00fato\u010dn\u00edky \u2013 od prvn\u00edch pokus\u016f o vniknut\u00ed po pokra\u010duj\u00edc\u00ed eskalaci privilegi\u00ed a skr\u00fdv\u00e1n\u00ed sv\u00fdch \u010din\u016f. \u00dato\u010dn\u00edci hledaj\u00ed jednoduch\u00e9 c\u00edle ve va\u0161\u00ed s\u00edti pomoc\u00ed z\u00e1kladn\u00edch p\u0159\u00edkaz\u016f PowerShell, kter\u00e9 jsou \u010dasto obt\u00ed\u017en\u011b zjistiteln\u00e9. Odstra\u0148te z AD co nejv\u00edce takov\u00fdch snadn\u00fdch c\u00edl\u016f.<\/p>\n

\u00dato\u010dn\u00edci hledaj\u00ed u\u017eivatele s neomezenou platnost\u00ed hesel (nebo kte\u0159\u00ed hesla nepot\u0159ebuj\u00ed), technologick\u00e9 \u00fa\u010dty, kter\u00e9 jsou administr\u00e1tory, a \u00fa\u010dty, kter\u00e9 pou\u017e\u00edvaj\u00ed star\u00e9 \u0161ifrov\u00e1n\u00ed RC4. <\/p>\n

Jak\u00fdkoli z t\u011bchto \u00fa\u010dt\u016f je bu\u010f trivi\u00e1ln\u011b p\u0159\u00edstupn\u00fd, nebo obvykle nen\u00ed pod dohledem. \u00dato\u010dn\u00edci mohou tyto \u00fa\u010dty p\u0159evz\u00edt a voln\u011b se pohybovat uvnit\u0159 va\u0161\u00ed infrastruktury.<\/p>\n

Jakmile se \u00fato\u010dn\u00edci dostanou p\u0159es bezpe\u010dnostn\u00ed perimetr, pravd\u011bpodobn\u011b z\u00edskaj\u00ed p\u0159\u00edstup alespo\u0148 k jednomu \u00fa\u010dtu. Dok\u00e1\u017eete zabr\u00e1nit tomu, aby z\u00edskali p\u0159\u00edstup k citliv\u00fdm dat\u016fm, ne\u017e \u00fatok odhal\u00edte a zlikvidujete?<\/p>\n

Panel pro sledov\u00e1n\u00ed Varonis AD uk\u00e1\u017ee na zraniteln\u00e9 u\u017eivatelsk\u00e9 \u00fa\u010dty, abyste mohli probl\u00e9my vy\u0159e\u0161it p\u0159edem. \u010c\u00edm slo\u017eit\u011bj\u0161\u00ed bude proniknout do va\u0161\u00ed s\u00edt\u011b, t\u00edm v\u011bt\u0161\u00ed jsou va\u0161e \u0161ance neutralizovat \u00fato\u010dn\u00edka, ne\u017e zp\u016fsob\u00ed v\u00e1\u017en\u00e9 \u0161kody.<\/p>\n

4 kl\u00ed\u010dov\u00e9 ukazatele rizika pro u\u017eivatelsk\u00e9 \u00fa\u010dty<\/h3>\n

\nN\u00ed\u017ee jsou uvedeny p\u0159\u00edklady widget\u016f na panelu pro sledov\u00e1n\u00ed Varonis AD, kter\u00e9 ukazuj\u00ed na nejzraniteln\u011bj\u0161\u00ed u\u017eivatelsk\u00e9 \u00fa\u010dty.<\/p>\n

1. Po\u010det aktivn\u00edch u\u017eivatel\u016f s hesly, jejich\u017e platnost nikdy nevypr\u0161\u00ed <\/strong><\/p>\n

Pro jak\u00e9hokoli \u00fato\u010dn\u00edka je p\u0159\u00edstup k takov\u00e9mu \u00fa\u010dtu v\u017edy velk\u00e1 v\u00fdhra. Proto\u017ee platnost hesla nikdy nevypr\u0161\u00ed, \u00fato\u010dn\u00edk z\u00edsk\u00e1v\u00e1 trvalou oporu uvnit\u0159 s\u00edt\u011b, kterou lze pot\u00e9 vyu\u017e\u00edt k z\u00edsk\u00e1n\u00ed vy\u0161\u0161\u00edch opr\u00e1vn\u011bn\u00ed <\/a><\/noindex>nebo pohyb\u016fm uvnit\u0159 infrastruktury.
\n\u00dato\u010dn\u00edci maj\u00ed seznamy s miliony kombinac\u00ed \u201eu\u017eivatel-heslo\u201c, kter\u00e9 pou\u017e\u00edvaj\u00ed p\u0159i \u00fatoc\u00edch na z\u00e1klad\u011b p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f, a pravd\u011bpodobnost,
\n\u017ee kombinace pro u\u017eivatele s \u201ev\u011b\u010dn\u00fdm\u201c heslem je v n\u011bkter\u00e9m z t\u011bchto seznam\u016f, je v\u00fdrazn\u011b vy\u0161\u0161\u00ed ne\u017e nula.<\/p>\n

\u00da\u010dty s neomezenou platnost\u00ed hesel jsou snadno spravovateln\u00e9, ale nejsou bezpe\u010dn\u00e9. Pou\u017eijte tento widget k nalezen\u00ed v\u0161ech p\u0159\u00edstupov\u00fdch \u00fa\u010dt\u016f, kter\u00e9 maj\u00ed takov\u00e1 hesla. Zm\u011b\u0148te tuto mo\u017enost a obnovte heslo.<\/p>\n

\"7
\nJakmile hodnota tohoto widgetu klesne na nulu, v\u0161echny nov\u00e9 \u00fa\u010dty vytvo\u0159en\u00e9 s takov\u00fdm heslem se objev\u00ed na panelu.<\/p>\n

2. Po\u010det administrativn\u00edch \u00fa\u010dt\u016f se SPN <\/strong><\/p>\n

SPN (Service Principal Name) je jedine\u010dn\u00fd identifik\u00e1tor instance slu\u017eby. Tento widget zobrazuje, kolik servisn\u00edch \u00fa\u010dt\u016f m\u00e1 pln\u00e1 administr\u00e1torsk\u00e1 pr\u00e1va. Hodnota na widgetu by m\u011bla b\u00fdt nula. SPN s administr\u00e1torsk\u00fdmi pr\u00e1vami vznik\u00e1, proto\u017ee poskytnut\u00ed t\u011bchto pr\u00e1v je pohodln\u00e9 pro dodavatele softwaru a administr\u00e1tory aplikac\u00ed, ale p\u0159edstavuje to bezpe\u010dnostn\u00ed hrozbu.<\/p>\n

Poskytnut\u00ed servisn\u00edho \u00fa\u010dtu s administr\u00e1torsk\u00fdmi pr\u00e1vy umo\u017e\u0148uje \u00fato\u010dn\u00edkovi z\u00edskat pln\u00fd p\u0159\u00edstup k nevyu\u017e\u00edvan\u00e9mu \u00fa\u010dtu. To znamen\u00e1, \u017ee \u00fato\u010dn\u00edci s p\u0159\u00edstupem k SPN \u00fa\u010dt\u016fm mohou svobodn\u011b jednat uvnit\u0159 infrastruktury a vyh\u00fdbat se p\u0159itom monitorov\u00e1n\u00ed sv\u00fdch akc\u00ed. <\/p>\n

Tento probl\u00e9m lze vy\u0159e\u0161it zm\u011bnou opr\u00e1vn\u011bn\u00ed pro servisn\u00ed \u00fa\u010dty. Tyto \u00fa\u010dty by m\u011bly podl\u00e9hat principu minim\u00e1ln\u00edch opr\u00e1vn\u011bn\u00ed a m\u00edt pouze takov\u00fd p\u0159\u00edstup, kter\u00fd je skute\u010dn\u011b nezbytn\u00fd pro jejich provoz.<\/p>\n

\"7
\nS pomoc\u00ed tohoto widgetu budete moci zjistit v\u0161echny SPN, kter\u00e9 maj\u00ed administr\u00e1torsk\u00e1 pr\u00e1va, odstranit tato privilegium a d\u00e1le kontrolovat SPN, podle stejn\u00e9ho principu p\u0159\u00edstupu s minim\u00e1ln\u00edmi privilegii.<\/p>\n

Nov\u011b vznikaj\u00edc\u00ed SPN se budou zobrazoit na monitorovac\u00ed panel a vy budete moci tento proces kontrolovat.<\/p>\n

3. Po\u010det u\u017eivatel\u016f, kte\u0159\u00ed nepot\u0159ebuj\u00ed p\u0159edchoz\u00ed ov\u011b\u0159en\u00ed Kerberos. <\/strong><\/p>\n

Ide\u00e1ln\u011b Kerberos \u0161ifruje ov\u011b\u0159ovac\u00ed l\u00edstek pomoc\u00ed \u0161ifrov\u00e1n\u00ed AES-256, kter\u00e9 dosud nebylo prolomeno.<\/p>\n

Star\u0161\u00ed verze Kerberos v\u0161ak pou\u017e\u00edvaly \u0161ifrov\u00e1n\u00ed RC4, kter\u00e9 je nyn\u00ed mo\u017en\u00e9 prolomit b\u011bhem n\u011bkolika minut. Tento widget zobrazuje, kter\u00e9 u\u017eivatelsk\u00e9 \u00fa\u010dty st\u00e1le pou\u017e\u00edvaj\u00ed RC4. Microsoft i nad\u00e1le podporuje RC4 pro zp\u011btnou kompatibilitu, ale to neznamen\u00e1, \u017ee byste jej m\u011bli pou\u017e\u00edvat ve sv\u00e9m AD.<\/p>\n

\"7
\nJakmile zjist\u00edte tyto \u00fa\u010dty, je t\u0159eba zru\u0161it zatr\u017een\u00ed mo\u017enost \"nevy\u017eaduje p\u0159edchoz\u00ed autorizaci Kerberos\" v AD, aby \u00fa\u010dty pou\u017e\u00edvaly slo\u017eit\u011bj\u0161\u00ed \u0161ifrov\u00e1n\u00ed.<\/p>\n

Samostatn\u00e9 zji\u0161t\u011bn\u00ed t\u011bchto \u00fa\u010dt\u016f, bez monitorovac\u00edho panelu Varonis AD, zabere hodn\u011b \u010dasu. Ve skute\u010dnosti je v\u010das b\u00fdt informov\u00e1n o v\u0161ech \u00fa\u010dtech, kter\u00e9 byly upraveny tak, aby pou\u017e\u00edvaly \u0161ifrov\u00e1n\u00ed RC4, je\u0161t\u011b slo\u017eit\u011bj\u0161\u00ed \u00fakol.<\/p>\n

Pokud se hodnota na widgetu zm\u011bn\u00ed, m\u016f\u017ee to nazna\u010dovat protiz\u00e1konn\u00e9 jedn\u00e1n\u00ed.<\/p>\n

4. Po\u010det u\u017eivatel\u016f bez hesla. <\/strong><\/p>\n

\u00dato\u010dn\u00edci vyu\u017e\u00edvaj\u00ed z\u00e1kladn\u00ed p\u0159\u00edkazy PowerShell k dotazov\u00e1n\u00ed na atribut \u201ePASSWD_NOTREQD\u201c v vlastnostech \u00fa\u010dtu v AD. Pou\u017eit\u00ed t\u00e9to vlajky znamen\u00e1, \u017ee neexistuj\u00ed \u017e\u00e1dn\u00e9 po\u017eadavky na existenci nebo slo\u017eitost hesla.
\nJak snadn\u00e9 je ukr\u00e1st \u00fa\u010det se slab\u00fdm nebo pr\u00e1zdn\u00fdm heslem? A te\u010f si p\u0159edstavte, \u017ee jeden z t\u011bchto \u00fa\u010dt\u016f je administr\u00e1torem.<\/p>\n

\"7
\nCo se stane, pokud jeden z tis\u00edc\u016f d\u016fv\u011brn\u00fdch soubor\u016f, kter\u00e9 jsou otev\u0159en\u00e9 pro v\u0161echny, je nadch\u00e1zej\u00edc\u00ed finan\u010dn\u00ed zpr\u00e1va? <\/p>\n

Ignorov\u00e1n\u00ed povinn\u00e9 po\u017eadavku na zad\u00e1n\u00ed hesla je dal\u0161\u00edm zjednodu\u0161en\u00edm pro syst\u00e9mov\u00e9 administr\u00e1tory, kter\u00e9 se \u010dasto pou\u017e\u00edvalo v minulosti, ale dnes je to nep\u0159ijateln\u00e9 a nebezpe\u010dn\u00e9.<\/p>\n

Vy\u0159e\u0161te tento probl\u00e9m aktualizac\u00ed hesel pro takov\u00e9 \u00fa\u010dty.<\/p>\n

Sledov\u00e1n\u00ed tohoto widgetu v budoucnu v\u00e1m pom\u016f\u017ee p\u0159edej\u00edt vzniku \u00fa\u010dt\u016f bez hesla.<\/p>\n

Varonis vyrovn\u00e1v\u00e1 \u0161ance.<\/h2>\n

\nV minulosti sb\u011br a anal\u00fdza \u00fadaj\u016f zm\u00edn\u011bn\u00fdch v \u010dl\u00e1nku trvala mnoho hodin a vy\u017eadovala hlubok\u00e9 znalosti PowerShell: bezpe\u010dnostn\u00ed specialist\u00e9 museli ka\u017ed\u00fd t\u00fdden nebo m\u011bs\u00edc vy\u010dlenit zdroje na takov\u00e9 \u00fakoly. Ale ru\u010dn\u00ed shroma\u017e\u010fov\u00e1n\u00ed a zpracov\u00e1n\u00ed t\u011bchto informac\u00ed d\u00e1v\u00e1 \u00fato\u010dn\u00edk\u016fm n\u00e1skok p\u0159i pronik\u00e1n\u00ed a kr\u00e1de\u017ei dat.<\/p>\n

S Varonis <\/a><\/noindex>Str\u00e1v\u00edte jeden den nasazen\u00edm panelu pro monitorov\u00e1n\u00ed AD a dal\u0161\u00edch komponent, shrom\u00e1\u017ed\u011bn\u00edm v\u0161ech uveden\u00fdch a mnoha dal\u0161\u00edch zranitelnost\u00ed. V budoucnu se b\u011bhem pou\u017e\u00edv\u00e1n\u00ed panel automaticky aktualizuje, jak se m\u011bn\u00ed stav infrastruktury.<\/p>\n

Prov\u00e1d\u011bn\u00ed kybernetick\u00fdch \u00fatok\u016f je v\u017edy z\u00e1vodem mezi \u00fato\u010dn\u00edky a obr\u00e1nci, sna\u017een\u00edm se \u00fato\u010dn\u00edka ukr\u00e1st data d\u0159\u00edv, ne\u017e budou bezpe\u010dnostn\u00ed specialist\u00e9 schopni je zabezpe\u010dit. V\u010dasn\u00e9 odhalen\u00ed \u00fato\u010dn\u00edk\u016f a jejich neleg\u00e1ln\u00edch \u010dinnost\u00ed, spolu se silnou kybernetickou ochranou, je kl\u00ed\u010dem k zaji\u0161t\u011bn\u00ed bezpe\u010dnosti va\u0161ich dat.
\n
Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412\u0441\u0435, \u0447\u0442\u043e \u043d\u0443\u0436\u043d\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443, \u2013 \u044d\u0442\u043e \u0432\u0440\u0435\u043c\u044f \u0438 \u043c\u043e\u0442\u0438\u0432\u0430\u0446\u0438\u044f \u0434\u043b\u044f \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u044f \u0432 \u0432\u0430\u0448\u0443 \u0441\u0435\u0442\u044c. \u041d\u043e \u043d\u0430\u0448\u0430 \u0441 \u0432\u0430\u043c\u0438 \u0440\u0430\u0431\u043e\u0442\u0430 \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u043d\u0435 \u0434\u0430\u0442\u044c \u0435\u043c\u0443 \u044d\u0442\u043e\u0433\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0438\u043b\u0438, \u043f\u043e \u043a\u0440\u0430\u0439\u043d\u0435\u0439 \u043c\u0435\u0440\u0435, \u043c\u0430\u043a\u0441\u0438\u043c\u0430\u043b\u044c\u043d\u043e \u0443\u0441\u043b\u043e\u0436\u043d\u0438\u0442\u044c \u044d\u0442\u0443 \u0437\u0430\u0434\u0430\u0447\u0443. \u041d\u0443\u0436\u043d\u043e \u043d\u0430\u0447\u0430\u0442\u044c \u0441 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u0438\u044f \u0441\u043b\u0430\u0431\u044b\u0445 \u043c\u0435\u0441\u0442 \u0432 Active Directory (\u0434\u0430\u043b\u0435\u0435 \u2013 AD), \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":27872,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-37173","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd477 kl\u00ed\u010dov\u00fdch ukazatel\u016f rizika Active Directory na monitorovac\u00edm panelu Varonis | ProHoster","description":"V\u0161e, co pot\u0159ebujete.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/7-klyuchevyh-indikatorov-riska-active-directory-na-paneli-monitoringa-varonis","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd477 \u043a\u043b\u044e\u0447\u0435\u0432\u044b\u0445 \u0438\u043d\u0434\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u0440\u0438\u0441\u043a\u0430 Active Directory \u043d\u0430 \u043f\u0430\u043d\u0435\u043b\u0438 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 Varonis | ProHoster","og:description":"\u0412\u0441\u0435, \u0447\u0442\u043e \u043d\u0443\u0436\u043d\u043e.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/7-klyuchevyh-indikatorov-riska-active-directory-na-paneli-monitoringa-varonis","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:16:11+00:00","article:modified_time":"2019-10-31T19:16:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37173","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-22 06:24:26","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:46:18","updated":"2026-01-22 06:24:26","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37173","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=37173"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37173\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/27872"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=37173"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=37173"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=37173"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}