{"id":37437,"date":"2019-10-31T22:17:38","date_gmt":"2019-10-31T19:17:38","guid":{"rendered":"https:\/\/prohoster.info\/blog\/flow-protokoly-kak-instrument-monitoringa-bezopasnosti-vnutrennej-seti\/"},"modified":"2019-10-31T22:17:38","modified_gmt":"2019-10-31T19:17:38","slug":"flow-protokoly-kak-instrument-monitoringa-bezopasnosti-vnutrennej-seti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/flow-protokoly-kak-instrument-monitoringa-bezopasnosti-vnutrennej-seti","title":{"rendered":"Flow protokoly jako n\u00e1stroj pro monitorov\u00e1n\u00ed bezpe\u010dnosti vnit\u0159n\u00ed s\u00edt\u011b","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Kdy\u017e se hovo\u0159\u00ed o monitorov\u00e1n\u00ed bezpe\u010dnosti intern\u00ed podnikov\u00e9 nebo ministersk\u00e9 s\u00edt\u011b, mnoho lid\u00ed si vybav\u00ed kontrolu \u00fanik\u016f informac\u00ed a zav\u00e1d\u011bn\u00ed DLP \u0159e\u0161en\u00ed. A co kdybychom se pokusili up\u0159esnit ot\u00e1zku a zeptali se, jak zjist\u00edte \u00fatoky v intern\u00ed s\u00edti? Odpov\u011bd\u00ed v\u011bt\u0161inou bude zm\u00ednka o syst\u00e9mech detekce \u00fatok\u016f (intrusion detection systems, IDS). A to, co bylo jedinou mo\u017enost\u00ed p\u0159ed 10-20 lety, se dnes st\u00e1v\u00e1 anachronismem. Existuje efektivn\u011bj\u0161\u00ed, a m\u00edsty dokonce jedin\u011b mo\u017en\u00fd zp\u016fsob monitorov\u00e1n\u00ed intern\u00ed s\u00edt\u011b \u2014 pou\u017e\u00edvat flow protokoly, kter\u00e9 byly p\u016fvodn\u011b ur\u010deny pro vyhled\u00e1v\u00e1n\u00ed s\u00ed\u0165ov\u00fdch probl\u00e9m\u016f (troubleshooting), ale \u010dasem se transformovaly na velmi zaj\u00edmav\u00fd bezpe\u010dnostn\u00ed n\u00e1stroj. O tom, jak\u00e9 flow protokoly existuj\u00ed a kter\u00e9 z nich l\u00e9pe pom\u00e1haj\u00ed odhalovat s\u00ed\u0165ov\u00e9 \u00fatoky, kde je nejlep\u0161\u00ed implementovat monitorov\u00e1n\u00ed flow, na co si d\u00e1t pozor p\u0159i nasazen\u00ed takov\u00e9ho sch\u00e9matu, a dokonce jak to v\u0161e \u201ezvednout\u201c na dom\u00e1c\u00edm vybaven\u00ed, si pov\u00edme v tomto \u010dl\u00e1nku.<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>Nebudu se zastavovat u ot\u00e1zky \u201ePro\u010d je pot\u0159eba monitorov\u00e1n\u00ed bezpe\u010dnosti intern\u00ed infrastruktury?\u201c Odpov\u011b\u010f na n\u00ed je jasn\u00e1. Ale pokud byste se cht\u011bli je\u0161t\u011b jednou ujistit, \u017ee dnes se bez toho nikam neposunete, <noindex><a rel=\"nofollow\" href=\"https:\/\/gblogs.cisco.com\/ru\/17attackvectors\/\">pod\u00edvejte se na<\/a><\/noindex> mal\u00e9 video ukazuj\u00edc\u00ed, jak lze 17 r\u016fzn\u00fdmi zp\u016fsoby proniknout do korpor\u00e1tn\u00ed s\u00edt\u011b chr\u00e1n\u011bn\u00e9 firewallem. Tak\u017ee budeme pova\u017eovat, \u017ee ch\u00e1peme, \u017ee vnit\u0159n\u00ed monitorov\u00e1n\u00ed je nezbytn\u00e9, a zb\u00fdv\u00e1 jen pochopit, jak to lze zorganizovat.<\/p>\n<p>Vybral bych t\u0159i kl\u00ed\u010dov\u00e9 zdroje dat pro monitorov\u00e1n\u00ed infrastruktury na s\u00ed\u0165ov\u00e9 \u00farovni:<\/p>\n<ul>\n<li>\u201esurov\u00fd\u201c provoz, kter\u00fd zachyt\u00e1v\u00e1m a pos\u00edl\u00e1m na anal\u00fdzu n\u011bkter\u00fdm analytick\u00fdm syst\u00e9m\u016fm,<\/li>\n<li>ud\u00e1losti ze s\u00ed\u0165ov\u00fdch za\u0159\u00edzen\u00ed, p\u0159es kter\u00e1 proch\u00e1z\u00ed provoz,<\/li>\n<li>informace o provozu z\u00edskan\u00e9 pomoc\u00ed jednoho z flow protokol\u016f.<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"Flow protokoly jako n\u00e1stroj pro monitorov\u00e1n\u00ed bezpe\u010dnosti vnit\u0159n\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/08\/09c7087593661d5b159ecc9e9ab39d16.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nZachyt\u00e1v\u00e1n\u00ed surov\u00e9ho provozu je nejpopul\u00e1rn\u011bj\u0161\u00ed variantou mezi bezpe\u010dnostn\u00edmi odborn\u00edky, proto\u017ee historicky byl prvn\u00edm metodou. B\u011b\u017en\u00e9 syst\u00e9my detekce \u00fatok\u016f (prvn\u00ed komer\u010dn\u00ed syst\u00e9m detekce \u00fatok\u016f byl NetRanger od spole\u010dnosti Wheel Group, zakoupen\u00fd v roce 1998 firmou Cisco) se pr\u00e1v\u011b zab\u00fdvaly zachyt\u00e1v\u00e1n\u00edm paket\u016f (a pozd\u011bji i relac\u00ed), ve kter\u00fdch hledaly ur\u010dit\u00e9 signatury (\u201erozhoduj\u00edc\u00ed pravidla\u201c v terminologii FSTEK), signalizuj\u00edc\u00ed \u00fatoky. Samoz\u0159ejm\u011b, \u017ee analyzovat surov\u00fd provoz lze nejen pomoc\u00ed IDS, ale tak\u00e9 s jin\u00fdmi prost\u0159edky (nap\u0159\u00edklad Wireshark, tcpdump nebo funkce NBAR2 v Cisco IOS), ale t\u011bm obvykle chyb\u00ed znalostn\u00ed datab\u00e1ze, kter\u00e1 odli\u0161uje prost\u0159edek IB od b\u011b\u017en\u00e9ho IT n\u00e1stroje.<\/p>\n<p>Tak\u017ee, syst\u00e9my detekce \u00fatok\u016f. Nejstar\u0161\u00ed a nejpopul\u00e1rn\u011bj\u0161\u00ed metoda detekce s\u00ed\u0165ov\u00fdch \u00fatok\u016f, kter\u00e1 si celkem dob\u0159e porad\u00ed se svou \u00falohou na perimetru (je jedno jak\u00e9m \u2014 firemn\u00edm, datov\u00e9m centru, segmentu atd.), ale selh\u00e1v\u00e1 v modern\u00edch s\u00ed\u0165ov\u00fdch a softwarov\u011b definovan\u00fdch prost\u0159ed\u00edch. V p\u0159\u00edpad\u011b s\u00edt\u011b postaven\u00e9 na b\u011b\u017en\u00fdch p\u0159ep\u00edna\u010d\u00edch se infrastruktura senzor\u016f detekce \u00fatok\u016f st\u00e1v\u00e1 p\u0159\u00edli\u0161 rozs\u00e1hlou \u2014 budete muset instalovat jeden senzor na ka\u017ed\u00e9 spojen\u00ed s uzlem, jeho\u017e \u00fatoky chcete monitorovat. Ka\u017ed\u00fd v\u00fdrobce by v\u00e1m samoz\u0159ejm\u011b r\u00e1d prodal stovky a tis\u00edce senzor\u016f, ale mysl\u00edm, \u017ee v\u00e1\u0161 rozpo\u010det by takov\u00e9 v\u00fddaje neunesl. Mohu \u0159\u00edci, \u017ee i v Cisco (a my jsme v\u00fdvoj\u00e1\u0159i NGIPS) jsme to nezvl\u00e1dli, a\u010dkoli si zd\u00e1lo, \u017ee ot\u00e1zka ceny by nem\u011bla st\u00e1t p\u0159ed n\u00e1mi \u2014 je to p\u0159ece na\u0161e vlastn\u00ed \u0159e\u0161en\u00ed. Nav\u00edc vyvst\u00e1v\u00e1 ot\u00e1zka, jak senzor v takov\u00e9m p\u0159\u00edpad\u011b p\u0159ipojit? Do \u0159ez\u00e1n\u00ed? A co kdy\u017e se s\u00e1m senzor porouch\u00e1? Po\u017eadovat p\u0159\u00edtomnost bypass modulu v senzoru? Pou\u017e\u00edvat rozbo\u010dova\u010de (tap)? To v\u0161e zvy\u0161uje n\u00e1klady na \u0159e\u0161en\u00ed a \u010din\u00ed je nedostupn\u00fdm pro spole\u010dnosti jak\u00e9koli velikosti.<\/p>\n<p><img decoding=\"async\" alt=\"Flow protokoly jako n\u00e1stroj pro monitorov\u00e1n\u00ed bezpe\u010dnosti vnit\u0159n\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/08\/4763c13237dbe9ffa38d62075939ffba.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u016f\u017eete zkusit \"pov\u011bsit\" senzor na SPAN\/RSPAN\/ERSPAN port a nasm\u011brovat na n\u011bj provoz z pot\u0159ebn\u00fdch port\u016f p\u0159ep\u00edna\u010de. Tato varianta \u010d\u00e1ste\u010dn\u011b \u0159e\u0161\u00ed probl\u00e9m popsan\u00fd v p\u0159edchoz\u00edm odstavci, ale vytv\u00e1\u0159\u00ed jin\u00fd - SPAN port nem\u016f\u017ee p\u0159ijmout ve\u0161ker\u00fd provoz, kter\u00fd mu bude nasm\u011brov\u00e1n - nebude m\u00edt dostate\u010dnou propustnost. Budete muset s n\u011b\u010d\u00edm ob\u011btovat. Bu\u010f n\u011bkter\u00e9 uzly nechat bez monitorov\u00e1n\u00ed (pak je t\u0159eba p\u0159edem prov\u00e9st jejich prioritizaci), nebo sm\u011b\u0159ovat ne ve\u0161ker\u00fd provoz z uzlu, ale pouze ur\u010dit\u00e9ho typu. V ka\u017ed\u00e9m p\u0159\u00edpad\u011b m\u016f\u017eeme p\u0159ehl\u00e9dnout n\u011bkter\u00e9 \u00fatoky. Krom\u011b toho m\u016f\u017ee b\u00fdt SPAN port obsazen pro jin\u00e9 pot\u0159eby. Nakonec budeme muset p\u0159ehodnotit existuj\u00edc\u00ed topologii s\u00edt\u011b a mo\u017en\u00e1 ji upravit, abychom co nejl\u00e9pe pokryli va\u0161i s\u00ed\u0165 st\u00e1vaj\u00edc\u00edm po\u010dtem senzor\u016f (a sladit to s IT).<\/p>\n<p>A co kdy\u017e va\u0161e s\u00ed\u0165 pou\u017e\u00edv\u00e1 asymetrick\u00e9 trasy? A co kdy\u017e m\u00e1te nasazenou nebo pl\u00e1nujete implementaci SDN? A co kdy\u017e pot\u0159ebujete monitorovat virtualizovan\u00e9 stroje nebo kontejnery, jejich\u017e provoz v\u016fbec nedosahuje fyzick\u00e9ho p\u0159ep\u00edna\u010de? Tyto ot\u00e1zky v\u00fdrobci tradi\u010dn\u00edch IDS nemaj\u00ed r\u00e1di, proto\u017ee nev\u011bd\u00ed, jak na n\u011b odpov\u011bd\u011bt. Mo\u017en\u00e1 v\u00e1s budou p\u0159esv\u011bd\u010dovat, \u017ee v\u0161echny tyto m\u00f3dn\u00ed technologie jsou hype a \u017ee je nepot\u0159ebujete. Mo\u017en\u00e1 budou mluvit o pot\u0159eb\u011b za\u010d\u00edt s mal\u00fdm. Nebo v\u00e1m mohou \u0159\u00edct, \u017ee pot\u0159ebujete um\u00edstit v\u00fdkonnou ma\u0161inu do centra s\u00edt\u011b a nasm\u011brovat ve\u0161ker\u00fd provoz p\u0159es vyrovn\u00e1va\u010de zat\u00ed\u017een\u00ed. A\u0165 u\u017e v\u00e1m budou nab\u00edzet jakoukoli mo\u017enost, je d\u016fle\u017eit\u00e9 si jasn\u011b uv\u011bdomit, jak dob\u0159e v\u00e1m vyhovuje. A teprve pot\u00e9 se rozhodnout o p\u0159\u00edstupu k monitorov\u00e1n\u00ed informa\u010dn\u00ed bezpe\u010dnosti s\u00ed\u0165ov\u00e9 infrastruktury. Pokud se vr\u00e1t\u00edme k zachycov\u00e1n\u00ed paket\u016f, chci \u0159\u00edct, \u017ee tato metoda z\u016fst\u00e1v\u00e1 velmi popul\u00e1rn\u00ed a d\u016fle\u017eit\u00e1, ale jej\u00edm hlavn\u00edm \u00fa\u010delem je kontrola hranic; hranice mezi va\u0161\u00ed organizac\u00ed a Internetem, hranice mezi datov\u00fdm centrem a zbyl\u00fdmi s\u00edt\u011bmi, hranice mezi \u0159\u00edzen\u00edm pr\u016fmyslov\u00fdch proces\u016f a korpor\u00e1tn\u00edm segmentem. Na t\u011bchto m\u00edstech maj\u00ed klasick\u00e9 IDS\/IPS st\u00e1le opr\u00e1vn\u011bn\u00ed na existenci a docela dob\u0159e pln\u00ed zadan\u00e9 \u00fakoly.<\/p>\n<p><img decoding=\"async\" alt=\"Flow protokoly jako n\u00e1stroj pro monitorov\u00e1n\u00ed bezpe\u010dnosti vnit\u0159n\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/08\/7a5898e0aa9e3e9275dda3e2c7b75c5c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u0159ejdeme k druh\u00e9 variant\u011b. Anal\u00fdza ud\u00e1lost\u00ed ze s\u00ed\u0165ov\u00fdch za\u0159\u00edzen\u00ed m\u016f\u017ee b\u00fdt tak\u00e9 vyu\u017eita k detekci \u00fatok\u016f, ale ne jako hlavn\u00ed mechanismus, proto\u017ee umo\u017e\u0148uje detekovat pouze malou t\u0159\u00eddu naru\u0161en\u00ed. Krom\u011b toho m\u00e1 ur\u010ditou reaktivitu \u2014 \u00fatok nejprve mus\u00ed nastat, pot\u00e9 mus\u00ed b\u00fdt zachycen s\u00ed\u0165ov\u00fdm za\u0159\u00edzen\u00edm, kter\u00e9 n\u011bjak\u00fdm zp\u016fsobem signalizuje probl\u00e9m s informa\u010dn\u00ed bezpe\u010dnost\u00ed. Existuje n\u011bkolik takov\u00fdch metod. M\u016f\u017ee to b\u00fdt syslog, RMON nebo SNMP. Posledn\u00ed dva protokoly pro s\u00ed\u0165ov\u00fd monitoring v kontextu informa\u010dn\u00ed bezpe\u010dnosti se pou\u017e\u00edvaj\u00ed pouze tehdy, pokud pot\u0159ebujeme odhalit DoS \u00fatok na samotn\u00e9 s\u00ed\u0165ov\u00e9 za\u0159\u00edzen\u00ed, proto\u017ee pomoc\u00ed RMON a SNMP m\u016f\u017eeme sledovat, nap\u0159\u00edklad, zat\u00ed\u017een\u00ed centr\u00e1ln\u00edho procesoru za\u0159\u00edzen\u00ed nebo jeho rozhran\u00ed. Je to jeden z nejlevn\u011bj\u0161\u00edch zp\u016fsob\u016f (syslog nebo SNMP m\u00e1 ka\u017ed\u00fd), ale tak\u00e9 nejm\u00e9n\u011b efektivn\u00ed ze v\u0161ech metod monitorov\u00e1n\u00ed informa\u010dn\u00ed bezpe\u010dnosti vnit\u0159n\u00ed infrastruktury \u2014 mnoh\u00e9 \u00fatoky jsou p\u0159ed n\u00edm prost\u011b skryt\u00e9. Samoz\u0159ejm\u011b na n\u011b nesm\u00edme zapom\u00ednat a anal\u00fdza syslog v\u00e1m pom\u016f\u017ee v\u010das identifikovat zm\u011bny v konfiguraci samotn\u00e9ho za\u0159\u00edzen\u00ed, jeho kompromitaci, ale detekce \u00fatok\u016f na celou s\u00ed\u0165 nen\u00ed p\u0159\u00edli\u0161 vhodn\u00e1.<\/p>\n<p>T\u0159et\u00ed mo\u017enost\u00ed je anal\u00fdza informac\u00ed o provozu, kter\u00fd proch\u00e1z\u00ed za\u0159\u00edzen\u00edm, je\u017e podporuje jeden z n\u011bkolika flow protokol\u016f. V tomto p\u0159\u00edpad\u011b, bez ohledu na protokol, infrastruktura pro pr\u00e1ci s tokem se v\u017edy skl\u00e1d\u00e1 ze t\u0159\u00ed komponent\u016f:<\/p>\n<ul>\n<li>Generov\u00e1n\u00ed nebo export flow. Tuto roli obvykle zaji\u0161\u0165uje sm\u011brova\u010d, switch nebo jin\u00e9 s\u00ed\u0165ov\u00e9 za\u0159\u00edzen\u00ed, kter\u00e9, kdy\u017e propou\u0161t\u00ed s\u00ed\u0165ov\u00fd provoz, umo\u017e\u0148uje vy\u010dlenit z n\u011bj kl\u00ed\u010dov\u00e9 parametry, kter\u00e9 jsou pot\u00e9 p\u0159ed\u00e1v\u00e1ny shroma\u017e\u010fovac\u00edmu modulu. Nap\u0159\u00edklad protokol Netflow u Cisco se podporuje nejen na sm\u011brova\u010d\u00edch a switchech, v\u010detn\u011b virtu\u00e1ln\u00edch a pr\u016fmyslov\u00fdch, ale tak\u00e9 na bezdr\u00e1tov\u00fdch controllerech, firewallech a dokonce i na serverech.<\/li>\n<li>Sb\u011br flow. Vzhledem k tomu, \u017ee v modern\u00ed s\u00edti je obvykle v\u00edce ne\u017e jedno s\u00ed\u0165ov\u00e9 za\u0159\u00edzen\u00ed, vznik\u00e1 \u00fakol shrom\u00e1\u017edit a konsolidovat toky, kter\u00fd se \u0159e\u0161\u00ed pomoc\u00ed takzvan\u00fdch kolektor\u016f, je\u017e prov\u00e1d\u00ed zpracov\u00e1n\u00ed p\u0159ijat\u00fdch tok\u016f a n\u00e1sledn\u011b je p\u0159ed\u00e1vaj\u00ed k anal\u00fdze.<\/li>\n<li>Anal\u00fdza flow. Analiz\u00e1tor se uj\u00edm\u00e1 hlavn\u00edho intelektu\u00e1ln\u00edho \u00fakolu a pou\u017e\u00edv\u00e1 r\u016fzn\u00e9 algoritmy na toky, aby vyvodil ur\u010dit\u00e9 z\u00e1v\u011bry. Nap\u0159\u00edklad v r\u00e1mci IT funkce m\u016f\u017ee tento analyz\u00e1tor odhalovat \u00fazk\u00e1 m\u00edsta v s\u00edti nebo analyzovat profil z\u00e1t\u011b\u017ee provozu pro n\u00e1slednou optimalizaci s\u00edt\u011b. A pro bezpe\u010dnost informac\u00ed m\u016f\u017ee tento analyz\u00e1tor identifikovat \u00faniky dat, \u0161\u00ed\u0159en\u00ed malwaru nebo DDoS \u00fatoky. <\/li>\n<\/ul>\n<p>Nem\u011bli bychom si myslet, \u017ee takov\u00e1 trojvrstv\u00e1 architektura je p\u0159\u00edli\u0161 slo\u017eit\u00e1 \u2014 v\u0161echny ostatn\u00ed varianty (krom\u011b mo\u017en\u00e1 syst\u00e9m\u016f s\u00ed\u0165ov\u00e9ho monitorov\u00e1n\u00ed pracuj\u00edc\u00edch se SNMP a RMON) tak\u00e9 funguj\u00ed podle n\u00ed. M\u00e1me gener\u00e1tor dat pro anal\u00fdzu, kter\u00fdm je s\u00ed\u0165ov\u00e9 za\u0159\u00edzen\u00ed nebo samostatn\u00fd senzor. M\u00e1me syst\u00e9m shroma\u017e\u010fov\u00e1n\u00ed poplachov\u00fdch sign\u00e1l\u016f a syst\u00e9m spr\u00e1vy cel\u00e9 monitorovac\u00ed infrastruktury. Posledn\u00ed dva komponenty mohou b\u00fdt integrov\u00e1ny v r\u00e1mci jednoho uzlu, ale v rozm\u011brn\u011bj\u0161\u00edch s\u00edt\u00edch jsou obvykle rozlo\u017eeny na minim\u00e1ln\u011b dvou za\u0159\u00edzen\u00edch za \u00fa\u010delem zaji\u0161t\u011bn\u00ed \u0161k\u00e1lovatelnosti a spolehlivosti.<\/p>\n<p><img decoding=\"async\" alt=\"Flow protokoly jako n\u00e1stroj pro monitorov\u00e1n\u00ed bezpe\u010dnosti vnit\u0159n\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/08\/65de74b0a7556606355f9b176ef7e19c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNa rozd\u00edl od anal\u00fdzy paket\u016f, kter\u00e1 se zakl\u00e1d\u00e1 na zkoum\u00e1n\u00ed hlavi\u010dek a obsahu ka\u017ed\u00e9ho paketu a ze kter\u00fdch se skl\u00e1daj\u00ed sezen\u00ed, anal\u00fdza tok\u016f se op\u00edr\u00e1 o shroma\u017e\u010fov\u00e1n\u00ed metadat o s\u00ed\u0165ov\u00e9m provozu. Kdy, kolik, odkud a kam, jak\u2026 to jsou ot\u00e1zky, na kter\u00e9 odpov\u00edd\u00e1 anal\u00fdza s\u00ed\u0165ov\u00e9 telemetrie pomoc\u00ed r\u016fzn\u00fdch flow protokol\u016f. P\u016fvodn\u011b byly pou\u017e\u00edv\u00e1ny k anal\u00fdze statistik a hled\u00e1n\u00ed IT probl\u00e9m\u016f v s\u00edti, ale pozd\u011bji, s rozvojem analytick\u00fdch mechanism\u016f, se staly pou\u017eiteln\u00e9 i pro tuto telemetrii a pro bezpe\u010dnostn\u00ed \u00fa\u010dely. Je t\u0159eba je\u0161t\u011b jednou zd\u016fraznit, \u017ee anal\u00fdza tok\u016f nenahrazuje a nezru\u0161\u00ed zachyt\u00e1v\u00e1n\u00ed paket\u016f. Ka\u017ed\u00e1 z t\u011bchto metod m\u00e1 svou oblast pou\u017eit\u00ed. Ale v kontextu tohoto \u010dl\u00e1nku je pr\u00e1v\u011b anal\u00fdza tok\u016f nejl\u00e9pe vhodn\u00e1 pro monitorov\u00e1n\u00ed vnit\u0159n\u00ed infrastruktury. M\u00e1te s\u00ed\u0165ov\u00e1 za\u0159\u00edzen\u00ed (a je jedno, zda pracuj\u00ed v softwarov\u011b definovan\u00e9 paradigm\u011b nebo podle statick\u00fdch pravidel), kter\u00e1 \u00fatok nelze obej\u00edt. Klasick\u00fd IDS senzor m\u016f\u017ee b\u00fdt mine, ale s\u00ed\u0165ov\u00e9 za\u0159\u00edzen\u00ed podporuj\u00edc\u00ed flow protokol nikoliv. To je v\u00fdhoda t\u00e9to metody. <\/p>\n<p>Na druhou stranu, pokud pot\u0159ebujete d\u016fkazn\u00ed materi\u00e1ly pro org\u00e1ny \u010dinn\u00e9 v trestn\u00edm \u0159\u00edzen\u00ed nebo vlastn\u00ed vy\u0161et\u0159ovac\u00ed skupinu incident\u016f, bez zachyt\u00e1v\u00e1n\u00ed paket\u016f se neobejdete \u2014 s\u00ed\u0165ov\u00e1 telemetrie nen\u00ed kopi\u00ed provozu, kterou lze pou\u017e\u00edt p\u0159i sb\u011bru d\u016fkaz\u016f; je pot\u0159ebn\u00e1 pro rychl\u00e9 odhalen\u00ed a rozhodov\u00e1n\u00ed v oblasti kybernetick\u00e9 bezpe\u010dnosti. Na druhou stranu, pomoc\u00ed anal\u00fdzy telemetrie m\u016f\u017eete \"zapsat\" pouze ten provoz, kter\u00fd se \u00fa\u010dastn\u00ed \u00fatoku (pokud by to m\u011blo b\u00fdt, Cisco a datov\u00fdmi centry se zab\u00fdv\u00e1 :-), a ne cel\u00fd s\u00ed\u0165ov\u00fd provoz. N\u00e1stroje pro anal\u00fdzu telemetrie tak dob\u0159e dopln\u00ed tradi\u010dn\u00ed mechanismy zachyt\u00e1v\u00e1n\u00ed paket\u016f t\u00edm, \u017ee umo\u017en\u00ed c\u00edlen\u00e9 zachyt\u00e1v\u00e1n\u00ed a ukl\u00e1d\u00e1n\u00ed. Jinak budete pot\u0159ebovat obrovskou infrastrukturn\u00ed kapacitu pro ukl\u00e1d\u00e1n\u00ed.<\/p>\n<p>P\u0159edstavme si s\u00ed\u0165 pracuj\u00edc\u00ed na rychlosti 250 Mbit\/s. Pokud byste cht\u011bli uchov\u00e1vat cel\u00fd tento objem, pot\u0159ebovali byste \u00falo\u017ei\u0161t\u011b o velikosti 31 MB pro jednu sekundu p\u0159enosu dat, 1,8 GB pro jednu minutu, 108 GB pro jednu hodinu a 2,6 TB pro jeden den. Pro ukl\u00e1d\u00e1n\u00ed denn\u00edch dat ze s\u00edt\u011b s propustnost\u00ed 10 Gbit\/s byste pot\u0159ebovali \u00falo\u017ei\u0161t\u011b o velikosti 108 TB. A p\u0159itom n\u011bkte\u0159\u00ed regul\u00e1to\u0159i po\u017eaduj\u00ed uchov\u00e1vat bezpe\u010dnostn\u00ed data po cel\u00e1 l\u00e9ta... Z\u00e1znam \"na vy\u017e\u00e1d\u00e1n\u00ed\", kter\u00fd v\u00e1m pom\u00e1h\u00e1 realizovat anal\u00fdza tok\u016f, pom\u00e1h\u00e1 tyto hodnoty radik\u00e1ln\u011b sn\u00ed\u017eit. Mimochodem, pokud jde o pom\u011br objemu ukl\u00e1dan\u00fdch dat s\u00ed\u0165ov\u00e9 telemetrie a celkov\u00e9ho zachycen\u00ed dat, je to p\u0159ibli\u017en\u011b 1 ku 500. Pro tyto v\u00fd\u0161e uveden\u00e9 hodnoty by ukl\u00e1d\u00e1n\u00ed pln\u00e9ho rozlo\u017een\u00ed cel\u00e9ho denn\u00edho provozu v pr\u016fm\u011bru \u010dinilo 5 a 216 GB. (M\u016f\u017eete to dokonce zapsat na b\u011b\u017enou flashku.)<\/p>\n<p>Pokud se metodika anal\u00fdzy syrov\u00fdch s\u00ed\u0165ov\u00fdch dat t\u00e9m\u011b\u0159 neli\u0161\u00ed mezi jednotliv\u00fdmi dodavateli, situace p\u0159i anal\u00fdze tok\u016f je odli\u0161n\u00e1. Existuje n\u011bkolik variant flow protokol\u016f, o jejich\u017e rozd\u00edlech je t\u0159eba v\u011bd\u011bt zejm\u00e9na v kontextu bezpe\u010dnosti. Nejpou\u017e\u00edvan\u011bj\u0161\u00ed je protokol NetFlow, vyvinut\u00fd firmou Cisco. Existuje n\u011bkolik verz\u00ed tohoto protokolu, kter\u00e9 se li\u0161\u00ed sv\u00fdmi mo\u017enostmi a objemem zaznamen\u00e1van\u00fdch informac\u00ed o provozu. Aktu\u00e1ln\u00ed verz\u00ed je dev\u00e1t\u00e1 (NetFlow v9), na jej\u00edm\u017e z\u00e1klad\u011b byl vyvinut pr\u016fmyslov\u00fd standard NetFlow v10, zn\u00e1m\u00fd tak\u00e9 jako IPFIX. Dnes v\u011bt\u0161ina s\u00ed\u0165ov\u00fdch dodavatel\u016f podporuje pr\u00e1v\u011b NetFlow nebo IPFIX ve sv\u00e9m za\u0159\u00edzen\u00ed. Existuj\u00ed v\u0161ak i r\u016fzn\u00e9 jin\u00e9 varianty flow protokol\u016f \u2014 sFlow, jFlow, cFlow, rFlow, NetStream a dal\u0161\u00ed, p\u0159i\u010dem\u017e sFlow je nejpopul\u00e1rn\u011bj\u0161\u00ed. Jeho \u010dast\u00e1 podpora dom\u00e1c\u00edmi v\u00fdrobci s\u00ed\u0165ov\u00e9ho vybaven\u00ed je zp\u016fsobena jednoduchost\u00ed implementace. Jak\u00e9 jsou kl\u00ed\u010dov\u00e9 rozd\u00edly mezi NetFlow, kter\u00fd se de facto stal standardem, a sFlow? Kl\u00ed\u010dov\u00fdch bych vyzdvihl n\u011bkolik. Zaprv\u00e9, NetFlow m\u00e1 u\u017eivatelsky konfigurovateln\u00e1 pole, na rozd\u00edl od pevn\u00fdch pol\u00ed v sFlow. A za druh\u00e9, a to je pro n\u00e1s nejd\u016fle\u017eit\u011bj\u0161\u00ed, sFlow shroma\u017e\u010fuje takzvanou samplingovou telemetrii; na rozd\u00edl od nesamplingov\u00e9 telemetrie NetFlow a IPFIX. Jak\u00fd je mezi nimi rozd\u00edl?<\/p>\n<p><img decoding=\"async\" alt=\"Flow protokoly jako n\u00e1stroj pro monitorov\u00e1n\u00ed bezpe\u010dnosti vnit\u0159n\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/08\/96782b57ccaddd731d5084c127076d49.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u0159edstavte si, \u017ee jste se rozhodli sezn\u00e1mit s knihou \u201c<noindex><a rel=\"nofollow\" href=\"http:\/\/www.ciscopress.com\/store\/security-operations-center-building-operating-and-maintaining-9780134052014\">Security Operations Center: Building, Operating, and Maintaining your SOC<\/a><\/noindex>\u201d m\u00fdch koleg\u016f \u2014 Garyho McIntyra, Josepha Munica a Nadema Al-Fardana (na odkazu si m\u016f\u017eete st\u00e1hnout \u010d\u00e1st knihy). M\u00e1te t\u0159i mo\u017enosti, jak dos\u00e1hnout c\u00edle \u2014 p\u0159e\u010d\u00edst si celou knihu, prob\u011bhnout ji o\u010dima, zastavuj\u00edc se na ka\u017ed\u00e9 10., nebo 20. str\u00e1nce, nebo se pokusit naj\u00edt shrnut\u00ed kl\u00ed\u010dov\u00fdch koncept\u016f v n\u011bjak\u00e9m blogu nebo slu\u017eb\u011b typu SmartReading. Tak\u017ee nesamplingov\u00e1 telemetrie je jako \u010dten\u00ed ka\u017ed\u00e9 \u201cstr\u00e1nky\u201d s\u00ed\u0165ov\u00e9ho provozu, tedy anal\u00fdza metadat pro ka\u017ed\u00fd paket. Samplingov\u00e1 telemetrie je selektivn\u00ed zkoum\u00e1n\u00ed provozu s nad\u011bj\u00ed, \u017ee se ve vybran\u00fdch vzorc\u00edch objev\u00ed to, co pot\u0159ebujete. V z\u00e1vislosti na rychlosti kan\u00e1lu bude samplingov\u00e1 telemetrie pos\u00edlat k anal\u00fdze ka\u017ed\u00fd 64., 200., 500., 1000., 2000. nebo dokonce 10000. paket.<\/p>\n<p><img decoding=\"async\" alt=\"Flow protokoly jako n\u00e1stroj pro monitorov\u00e1n\u00ed bezpe\u010dnosti vnit\u0159n\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/08\/28b798498a11a5e6f72ef847ea2dbaaa.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV kontextu monitorov\u00e1n\u00ed kybernetick\u00e9 bezpe\u010dnosti to znamen\u00e1, \u017ee vzorkovan\u00e1 telemetrie je dob\u0159e vhodn\u00e1 pro detekci DDoS \u00fatok\u016f, skenov\u00e1n\u00ed a \u0161\u00ed\u0159en\u00ed malwaru, ale m\u016f\u017ee minout atom\u00e1rn\u00ed nebo V\u00edcebal\u00edkov\u00e9 \u00fatoky, kter\u00e9 se nedostaly do vzorku zaslan\u00e9ho k anal\u00fdze. Nesamplovan\u00e1 telemetrie tato omezen\u00ed nem\u00e1 a s jej\u00ed pomoc\u00ed je spektrum detekovan\u00fdch \u00fatok\u016f mnohem \u0161ir\u0161\u00ed. Zde je mal\u00fd seznam ud\u00e1lost\u00ed, kter\u00e9 lze detekovat pomoc\u00ed prost\u0159edk\u016f anal\u00fdzy s\u00ed\u0165ov\u00e9 telemetrie.<\/p>\n<p><img decoding=\"async\" alt=\"Flow protokoly jako n\u00e1stroj pro monitorov\u00e1n\u00ed bezpe\u010dnosti vnit\u0159n\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/08\/be3a11d4826978d9c882074f22ee97c1.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSamoz\u0159ejm\u011b, \u017ee n\u011bjak\u00fd open source analyz\u00e1tor Netflow v\u00e1m to neumo\u017en\u00ed, proto\u017ee jeho hlavn\u00edm \u00fakolem je shroma\u017e\u010fovat telemetrii a prov\u00e1d\u011bt nad n\u00ed z\u00e1kladn\u00ed anal\u00fdzu z pohledu IT. Pro odhalen\u00ed hrozeb kybernetick\u00e9 bezpe\u010dnosti na z\u00e1klad\u011b flow je nezbytn\u00e9 vybavit analyz\u00e1tor r\u016fzn\u00fdmi enginy a algoritmy, kter\u00e9 budou na z\u00e1klad\u011b standardn\u00edch nebo u\u017eivatelsk\u00fdch pol\u00ed Netflow identifikovat probl\u00e9my v kybernetick\u00e9 bezpe\u010dnosti, obohacovat standardn\u00ed data extern\u00edmi daty z r\u016fzn\u00fdch zdroj\u016f Threat Intelligence atd.<\/p>\n<p><img decoding=\"async\" alt=\"Flow protokoly jako n\u00e1stroj pro monitorov\u00e1n\u00ed bezpe\u010dnosti vnit\u0159n\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/08\/60e876dbfbdffd160e9899f87aa6303c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nProto, pokud m\u00e1te na v\u00fdb\u011br, zvolte Netflow nebo IPFIX. Ale i kdy\u017e va\u0161e za\u0159\u00edzen\u00ed pracuje pouze s sFlow, jak u dom\u00e1c\u00edch v\u00fdrobc\u016f, i v tomto p\u0159\u00edpad\u011b z n\u011bj m\u016f\u017eete vyt\u011b\u017eit u\u017eitek v kontextu bezpe\u010dnosti. <\/p>\n<p><img decoding=\"async\" alt=\"Flow protokoly jako n\u00e1stroj pro monitorov\u00e1n\u00ed bezpe\u010dnosti vnit\u0159n\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/08\/ee75809ccde4f366ca5f5ead7beed58c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV l\u00e9t\u011b 2019 jsem prov\u00e1d\u011bl anal\u00fdzu mo\u017enost\u00ed, kter\u00e9 maj\u00ed ru\u0161t\u00ed v\u00fdrobci s\u00ed\u0165ov\u00e9ho hardwaru, a v\u0161ichni, krom\u011b NSG, Poligonu a Kraftveye, tvrdili, \u017ee podporuj\u00ed sFlow (alespo\u0148 Zelaks, Natex, Eltex, QTech, Rusteletech). <\/p>\n<p><img decoding=\"async\" alt=\"Flow protokoly jako n\u00e1stroj pro monitorov\u00e1n\u00ed bezpe\u010dnosti vnit\u0159n\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/08\/acd1ed477af59e1439d941374c596d16.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDal\u0161\u00ed ot\u00e1zka, kterou si polo\u017e\u00edte, je, kde implementovat podporu flow pro bezpe\u010dnostn\u00ed \u00fa\u010dely? Odpov\u011b\u010f na tuto ot\u00e1zku nen\u00ed zcela spr\u00e1vn\u00e1. Na modern\u00edm vybaven\u00ed je podpora flow protokol\u016f t\u00e9m\u011b\u0159 v\u017edy. Proto bych tuto ot\u00e1zku p\u0159eformuloval jinak \u2013 kde je nejefektivn\u011bj\u0161\u00ed sb\u00edrat telemetrii z pohledu bezpe\u010dnosti? Odpov\u011b\u010f je docela jasn\u00e1 \u2013 na \u00farovni p\u0159\u00edstupu, kde uvid\u00edte 100 % ve\u0161ker\u00e9ho provozu, kde budete m\u00edt podrobn\u00e9 informace o hostitel\u00edch (MAC, VLAN, ID rozhran\u00ed), kde dok\u00e1\u017eete sledovat i P2P provoz mezi hostiteli, co\u017e je kritick\u00e9 pro detekci skenov\u00e1n\u00ed a \u0161\u00ed\u0159en\u00ed \u0161kodliv\u00e9ho k\u00f3du. Na \u00farovni j\u00e1dra \u010d\u00e1st provozu prost\u011b neuvid\u00edte, a na \u00farovni perimetru uvid\u00edte maxim\u00e1ln\u011b \u010dtvrtinu cel\u00e9ho va\u0161eho s\u00ed\u0165ov\u00e9ho provozu. Pokud v\u0161ak z r\u016fzn\u00fdch d\u016fvod\u016f ve va\u0161\u00ed s\u00edti existuj\u00ed ciz\u00ed za\u0159\u00edzen\u00ed, kter\u00e1 umo\u017e\u0148uj\u00ed \u00fato\u010dn\u00edk\u016fm \u201evstupovat a vystupovat\u201c, obch\u00e1zej\u00edc\u00ed perimetr, anal\u00fdza telemetrie z n\u011bj v\u00e1m nic nep\u0159inese. Proto se pro maxim\u00e1ln\u00ed pokryt\u00ed doporu\u010duje zahrnout sb\u011br telemetrie pr\u00e1v\u011b na \u00farovni p\u0159\u00edstupu. Je t\u0159eba poznamenat, \u017ee i kdy\u017e mluv\u00edme o virtualizaci nebo kontejnerech, modern\u00ed virtu\u00e1ln\u00ed switche tak\u00e9 \u010dasto podporuj\u00ed flow, co\u017e umo\u017e\u0148uje \u0159\u00eddit provoz i tam.<\/p>\n<p>Ale kdy\u017e u\u017e jsem toto t\u00e9ma nastolil, mus\u00edm odpov\u011bd\u011bt na ot\u00e1zku, co kdy\u017e za\u0159\u00edzen\u00ed, fyzick\u00e9 nebo virtu\u00e1ln\u00ed, p\u0159esto nepodporuje flow protokoly? Nebo je jeho zapnut\u00ed zak\u00e1z\u00e1no (nap\u0159\u00edklad v pr\u016fmyslov\u00fdch segmentech pro zaji\u0161t\u011bn\u00ed spolehlivosti)? Nebo zapnut\u00ed vede k vysok\u00e9mu zat\u00ed\u017een\u00ed centr\u00e1ln\u00edho procesoru (co\u017e se st\u00e1v\u00e1 na zastaral\u00e9m vybaven\u00ed)? Pro \u0159e\u0161en\u00ed tohoto probl\u00e9mu existuj\u00ed specializovan\u00e9 virtu\u00e1ln\u00ed senzory (flow sensor), kter\u00e9 v podstat\u011b funguj\u00ed jako b\u011b\u017en\u00e9 rozbo\u010dova\u010de, kter\u00e9 propou\u0161t\u011bj\u00ed provoz a p\u0159en\u00e1\u0161ej\u00ed ho ve form\u011b flow na sb\u011brn\u00fd modul. Pravda, v tomto p\u0159\u00edpad\u011b se setk\u00e1v\u00e1me se v\u0161emi probl\u00e9my, o kter\u00fdch jsme hovo\u0159ili v\u00fd\u0161e v souvislosti s prost\u0159edky pro zachyt\u00e1v\u00e1n\u00ed paket\u016f. Mus\u00edme tedy rozum\u011bt nejen v\u00fdhod\u00e1m technologie anal\u00fdzy tok\u016f, ale tak\u00e9 jej\u00edm omezen\u00edm.<\/p>\n<p>Je\u0161t\u011b jedna v\u011bc, kterou je d\u016fle\u017eit\u00e9 m\u00edt na pam\u011bti, kdy\u017e mluv\u00edme o n\u00e1stroj\u00edch pro anal\u00fdzu tok\u016f. Pokud pro b\u011b\u017en\u00e9 n\u00e1stroje generov\u00e1n\u00ed ud\u00e1lost\u00ed bezpe\u010dnosti pou\u017e\u00edv\u00e1me metriku EPS (ud\u00e1lost\u00ed za sekundu), pak pro anal\u00fdzu telemetrie se tento ukazatel neuplat\u0148uje; nahrazuje se metrikou FPS (tok\u016f za sekundu). Stejn\u011b jako u EPS, p\u0159edem jej nelze spo\u010d\u00edtat, ale m\u016f\u017eeme odhadnout p\u0159ibli\u017en\u00fd po\u010det tok\u016f, kter\u00e9 generuje ur\u010dit\u00e9 za\u0159\u00edzen\u00ed v z\u00e1vislosti na jeho \u00fakolu. Na internetu najdete tabulky s p\u0159ibli\u017en\u00fdmi hodnotami pro r\u016fzn\u00e9 typy firemn\u00edch za\u0159\u00edzen\u00ed a podm\u00ednek, kter\u00e9 v\u00e1m umo\u017en\u00ed odhadnout, jak\u00e9 licence budete pot\u0159ebovat pro n\u00e1stroje anal\u00fdzy a jak bude jejich architektura vypadat. Je to proto, \u017ee senzor IDS m\u00e1 omezenou propustnost, kterou \u201evyt\u00e1hne\u201c, a tak\u00e9 sb\u011bra\u010d tok\u016f m\u00e1 sv\u00e1 omezen\u00ed, kter\u00e1 je t\u0159eba ch\u00e1pat. Proto v rozs\u00e1hl\u00fdch, geograficky distribuovan\u00fdch s\u00edt\u00edch je obvykle v\u00edce sb\u011bra\u010d\u016f. Kdy\u017e jsem popisoval, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/348532\/\">jak se monitoruje s\u00ed\u0165 uvnit\u0159 Cisco<\/a><\/noindex>, u\u017e jsem uv\u00e1d\u011bl \u010d\u00edslo na\u0161ich sb\u011bra\u010d\u016f \u2014 je jich 21. A to na s\u00ed\u0165 rozprost\u0159enou po p\u011bti kontinentech a obsahuj\u00edc\u00ed p\u0159ibli\u017en\u011b p\u016fl milionu aktivn\u00edch za\u0159\u00edzen\u00ed).<\/p>\n<p><img decoding=\"async\" alt=\"Flow protokoly jako n\u00e1stroj pro monitorov\u00e1n\u00ed bezpe\u010dnosti vnit\u0159n\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/08\/a5935ef7f7a3511cbf291fce59e96d71.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJako syst\u00e9m monitorov\u00e1n\u00ed Netflow pou\u017e\u00edv\u00e1me na\u0161e vlastn\u00ed \u0159e\u0161en\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/ru_ru\/products\/security\/stealthwatch\/index.html\">Cisco Stealthwatch<\/a><\/noindex>, kter\u00e9 je speci\u00e1ln\u011b zam\u011b\u0159eno na \u0159e\u0161en\u00ed bezpe\u010dnostn\u00edch \u00fakol\u016f. Obsahuje mnoho integrovan\u00fdch motor\u016f pro detekci anom\u00e1ln\u00ed, podez\u0159el\u00e9 a zcela \u0161kodliv\u00e9 aktivity, co\u017e umo\u017e\u0148uje detekci \u0161irok\u00e9ho spektra r\u016fzn\u00fdch hrozeb \u2013 od kryptominingu po \u00faniky informac\u00ed, od \u0161\u00ed\u0159en\u00ed \u0161kodliv\u00e9ho k\u00f3du po podvody. Stealthwatch, podobn\u011b jako v\u011bt\u0161ina analyz\u00e1tor\u016f toku, je postaven na trojvrstv\u00e9 architektu\u0159e (gener\u00e1tor \u2013 sb\u011bra\u010d \u2013 analyz\u00e1tor), ale je dopln\u011bn n\u011bkolika zaj\u00edmav\u00fdmi funkcemi, kter\u00e9 jsou d\u016fle\u017eit\u00e9 v kontextu prob\u00edran\u00e9 problematiky. Za prv\u00e9, integruje se s \u0159e\u0161en\u00edmi pro zachyt\u00e1v\u00e1n\u00ed paket\u016f (nap\u0159\u00edklad Cisco Security Packet Analyzer), co\u017e umo\u017e\u0148uje zaznamen\u00e1vat vybran\u00e9 s\u00ed\u0165ov\u00e9 sezen\u00ed pro n\u00e1sledn\u00e9 d\u016fkladn\u00e9 vy\u0161et\u0159ov\u00e1n\u00ed a anal\u00fdzu. Za druh\u00e9, speci\u00e1ln\u011b pro roz\u0161\u00ed\u0159en\u00ed bezpe\u010dnostn\u00edch \u00fakol\u016f jsme vyvinuli speci\u00e1ln\u00ed protokol nvzFlow, kter\u00fd umo\u017e\u0148uje \u201estreamovat\u201c \u010dinnost aplikac\u00ed na koncov\u00fdch uzlech (serverech, pracovn\u00edch stanic\u00edch atd.) do telemetrie a p\u0159ed\u00e1vat ji na sb\u011bra\u010d pro dal\u0161\u00ed anal\u00fdzu. Zat\u00edmco ve sv\u00e9 p\u016fvodn\u00ed podob\u011b Stealthwatch pracuje s jak\u00fdmkoliv protokolem toku (sFlow, rFlow, Netflow, IPFIX, cFlow, jFlow, NetStream) na s\u00ed\u0165ov\u00e9 \u00farovni, podpora nvzFlow umo\u017e\u0148uje prov\u00e1d\u011bt korelaci dat i na \u00farovni uzlu, \u010d\u00edm\u017e zvy\u0161uje efektivitu cel\u00e9ho syst\u00e9mu a zachycuje v\u00edce \u00fatok\u016f ne\u017e b\u011b\u017en\u00e9 s\u00ed\u0165ov\u00e9 analyz\u00e1tory toku.<\/p>\n<p>Je jasn\u00e9, \u017ee mluv\u00edme-li o syst\u00e9mech pro anal\u00fdzu Netflow z hlediska zabezpe\u010den\u00ed, trh nen\u00ed omezen pouze na jedno \u0159e\u0161en\u00ed od firmy Cisco. M\u016f\u017eete pou\u017e\u00edvat jak komer\u010dn\u00ed, tak bezplatn\u00e1 nebo podm\u00edn\u011bn\u011b bezplatn\u00e1 \u0159e\u0161en\u00ed. Bylo by dost zvl\u00e1\u0161tn\u00ed, kdybych v blogu Cisco uv\u00e1d\u011bl p\u0159\u00edklady \u0159e\u0161en\u00ed konkurent\u016f, proto \u0159eknu p\u00e1r slov o tom, jak m\u016f\u017ee b\u00fdt s\u00ed\u0165ov\u00e1 telemetrie analyzov\u00e1na pomoc\u00ed dvou popul\u00e1rn\u00edch, pojmenov\u00e1n\u00edm podobn\u00fdch, ale p\u0159esto r\u016fzn\u00fdch n\u00e1stroj\u016f \u2013 SiLK a ELK.<\/p>\n<p>SiLK je sada n\u00e1stroj\u016f (Syst\u00e9m pro znalosti na \u00farovni internetu) pro anal\u00fdzu provozu, kterou vyvinul americk\u00fd CERT\/CC a kter\u00e1 v kontextu dne\u0161n\u00edho \u010dl\u00e1nku podporuje Netflow (5. a 9. nejpopul\u00e1rn\u011bj\u0161\u00ed verze), IPFIX a sFlow, a pomoc\u00ed r\u016fzn\u00fdch utilit (rwfilter, rwcount, rwflowpack atd.) prov\u00e1d\u00ed r\u016fzn\u00e9 operace s s\u00ed\u0165ovou telemetri\u00ed za \u00fa\u010delem odhalen\u00ed zn\u00e1mek neopr\u00e1vn\u011bn\u00fdch \u010dinnost\u00ed. Je v\u0161ak t\u0159eba zm\u00ednit n\u011bkolik d\u016fle\u017eit\u00fdch bod\u016f. SiLK je n\u00e1stroj p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku a prov\u00e1d\u011bt operativn\u00ed anal\u00fdzu znamen\u00e1 st\u00e1le zad\u00e1vat p\u0159\u00edkazy, nap\u0159\u00edklad (odhalen\u00ed paket\u016f ICMP o velikosti v\u011bt\u0161\u00ed ne\u017e 200 bajt\u016f):<\/p>\n<p><code>rwfilter --flowtypes=all\/all --proto=1 --bytes-per-packet=200- --pass=stdout | rwrwcut --fields=sIP,dIP,iType,iCode --num-recs=15<\/code><\/p>\n<p>nen\u00ed to p\u0159\u00edli\u0161 pohodln\u00e9. M\u016f\u017eete pou\u017e\u00edt grafick\u00e9 rozhran\u00ed iSiLK, ale to v\u00e1m p\u0159\u00edli\u0161 neusnadn\u00ed \u017eivot, proto\u017ee pln\u00ed pouze funkci vizualizace, nikoli n\u00e1hrady analytika. A to je druh\u00fd bod. Na rozd\u00edl od komer\u010dn\u00edch \u0159e\u0161en\u00ed, kter\u00e1 u\u017e obsahuj\u00ed solidn\u00ed analytickou z\u00e1kladnu, algoritmy pro odhalov\u00e1n\u00ed anom\u00e1li\u00ed, odpov\u00eddaj\u00edc\u00ed workflow atd., v p\u0159\u00edpad\u011b SiLK budete muset toto v\u0161e prov\u00e9st sami, co\u017e vy\u017eaduje trochu jin\u00e9 kompetence, ne\u017e vyu\u017eit\u00ed hotov\u00fdch n\u00e1stroj\u016f. To nen\u00ed dobr\u00e9 ani \u0161patn\u00e9 \u2014 je to vlastnost t\u00e9m\u011b\u0159 ka\u017ed\u00e9ho bezplatn\u00e9ho n\u00e1stroje, kter\u00fd vych\u00e1z\u00ed z toho, \u017ee v\u00edte, co d\u011blat, a on v\u00e1m v tom pouze pom\u016f\u017ee (komer\u010dn\u00ed n\u00e1stroje jsou m\u00e9n\u011b z\u00e1visl\u00e9 na kompetenc\u00edch sv\u00fdch u\u017eivatel\u016f, p\u0159esto v\u0161ak p\u0159edpokl\u00e1daj\u00ed, \u017ee analytici rozum\u00ed alespo\u0148 z\u00e1klad\u016fm prov\u00e1d\u011bn\u00ed s\u00ed\u0165ov\u00fdch vy\u0161et\u0159ov\u00e1n\u00ed a monitoringu). Ale vra\u0165me se k SiLK. Cyklus pr\u00e1ce analytika s t\u00edmto n\u00e1strojem vypad\u00e1 takto:<\/p>\n<ul>\n<li>Formulace hypot\u00e9zy. Mus\u00edme m\u00edt jasnou p\u0159edstavu o tom, co budeme hledat v s\u00ed\u0165ov\u00e9 telemetrii, a zn\u00e1t unik\u00e1tn\u00ed atributy, podle kter\u00fdch budeme vyhled\u00e1vat ur\u010dit\u00e9 anom\u00e1lie nebo hrozby.<\/li>\n<li>Vytv\u00e1\u0159en\u00ed modelu. Po formulaci hypot\u00e9zy ji programujeme pomoc\u00ed Pythonu, shellu nebo jin\u00fdch n\u00e1stroj\u016f, kter\u00e9 nepat\u0159\u00ed do SiLK.<\/li>\n<li>Testov\u00e1n\u00ed. P\u0159ich\u00e1z\u00ed \u010das na ov\u011b\u0159en\u00ed spr\u00e1vnosti na\u0161\u00ed hypot\u00e9zy, kter\u00e1 je potvrzena nebo vyvr\u00e1cena pomoc\u00ed utilit SiLK za\u010d\u00ednaj\u00edc\u00edch na 'rw', 'set', 'bag'.<\/li>\n<li>Anal\u00fdza re\u00e1ln\u00fdch dat. V pr\u016fmyslov\u00e9m provozu SiLK n\u00e1m pom\u00e1h\u00e1 odhalovat ur\u010dit\u00e9 trendy a analytik mus\u00ed odpov\u011bd\u011bt na ot\u00e1zky jako \"Na\u0161li jsme to, co jsme o\u010dek\u00e1vali?\", \"Odpov\u00edd\u00e1 to na\u0161\u00ed hypot\u00e9ze?\", \"Jak sn\u00ed\u017eit po\u010det fale\u0161n\u00fdch poplach\u016f?\", \"Jak zlep\u0161it \u00farove\u0148 rozpozn\u00e1v\u00e1n\u00ed?\" a podobn\u011b.<\/li>\n<li>Zlep\u0161en\u00ed. V z\u00e1v\u011bre\u010dn\u00e9 f\u00e1zi vylep\u0161ujeme d\u0159\u00edve ud\u011blan\u00e9 v\u011bci \u2014 vytv\u00e1\u0159\u00edme \u0161ablony, zlep\u0161ujeme a optimalizujeme k\u00f3d, p\u0159eformulov\u00e1v\u00e1me a up\u0159es\u0148ujeme hypot\u00e9zu a dal\u0161\u00ed.<\/li>\n<\/ul>\n<p>Tento cyklus bude pou\u017eiteln\u00fd tak\u00e9 pro Cisco Stealthwatch, pouze posledn\u00ed tyto p\u011bt krok\u016f maximalizuje automatizaci, \u010d\u00edm\u017e sni\u017euje chyby analytika a zvy\u0161uje pohotovost p\u0159i detekci incident\u016f. Nap\u0159\u00edklad v SiLK m\u016f\u017eete obohatit s\u00ed\u0165ovou statistiku o extern\u00ed data o \u0161kodliv\u00fdch IP pomoc\u00ed vlastn\u00edch skript\u016f, zat\u00edmco v Cisco Stealthwatch \u2014 je to integrovan\u00e1 funkce, kter\u00e1 ihned zobrazuje varovn\u00fd sign\u00e1l, pokud se v s\u00ed\u0165ov\u00e9m provozu objev\u00ed interakce s IP adresami ze seznamu zak\u00e1zan\u00fdch.<\/p>\n<p>Pokud se pod\u00edv\u00e1te v\u00fd\u0161e na pyramid\u011b \"placenosti\" software pro anal\u00fdzu flow, pak po zcela bezplatn\u00e9m SiLK n\u00e1sleduje podm\u00edn\u011bn\u011b bezplatn\u00e9 ELK, kter\u00e9 se skl\u00e1d\u00e1 ze t\u0159\u00ed kl\u00ed\u010dov\u00fdch komponent\u016f \u2014 Elasticsearch (indexov\u00e1n\u00ed, vyhled\u00e1v\u00e1n\u00ed a anal\u00fdza dat), Logstash (vstup\/v\u00fdstup dat) a Kibana (vizualizace). Na rozd\u00edl od SiLK, kde je v\u0161echno pot\u0159eba napsat samostatn\u011b, m\u00e1 ELK ji\u017e mnoho hotov\u00fdch knihoven\/modul\u016f (\u010d\u00e1st placen\u00e9, \u010d\u00e1st ne), kter\u00e9 automatizuj\u00ed anal\u00fdzu s\u00ed\u0165ov\u00e9 telemetrie. Nap\u0159\u00edklad filtr GeoIP v Logstash umo\u017e\u0148uje p\u0159id\u011blit sledovan\u00e9 IP adresy k jejich geografick\u00e9 poloze (stealthwatch m\u00e1 tuto funkci zabudovanou).<\/p>\n<p><img decoding=\"async\" alt=\"Flow protokoly jako n\u00e1stroj pro monitorov\u00e1n\u00ed bezpe\u010dnosti vnit\u0159n\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/08\/addd9d9656f64f81d86a0cce8ee0810b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nELK m\u00e1 tak\u00e9 pom\u011brn\u011b velk\u00e9 komunitn\u00ed z\u00e1zem\u00ed, kter\u00e9 dopl\u0148uje chyb\u011bj\u00edc\u00ed komponenty pro toto monitorovac\u00ed \u0159e\u0161en\u00ed. Nap\u0159\u00edklad pro pr\u00e1ci s Netflow, IPFIX a sFlow m\u016f\u017eete vyu\u017e\u00edt modul <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/robcowart\/elastiflow\">elastiflow<\/a><\/noindex>, pokud v\u00e1m nevyhovuje Logstash Netflow Module, kter\u00fd podporuje pouze Netflow.<\/p>\n<p>P\u0159esto\u017ee ELK poskytuje lep\u0161\u00ed pohotovost p\u0159i sb\u011bru flow a vyhled\u00e1v\u00e1n\u00ed v n\u011bm, v sou\u010dasnosti postr\u00e1d\u00e1 bohatou integrovanou analytiku pro odhalov\u00e1n\u00ed anom\u00e1li\u00ed a hrozeb v s\u00ed\u0165ov\u00e9 telemetrii. Tedy, v souladu s v\u00fd\u0161e popsan\u00fdm \u017eivotn\u00edm cyklem, budete muset sami popsat modely poru\u0161en\u00ed a pot\u00e9 je pou\u017e\u00edvat v produk\u010dn\u00edm syst\u00e9mu (\u017e\u00e1dn\u00e9 integrovan\u00e9 modely tam nejsou).<\/p>\n<p><img decoding=\"async\" alt=\"Flow protokoly jako n\u00e1stroj pro monitorov\u00e1n\u00ed bezpe\u010dnosti vnit\u0159n\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/08\/6d8368f4c130c3a5770890cb6c5fe5ab.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nExistuj\u00ed samoz\u0159ejm\u011b i v\u00edce sofistikovan\u00e1 roz\u0161\u00ed\u0159en\u00ed pro ELK, kter\u00e1 ji\u017e obsahuj\u00ed n\u011bkter\u00e9 modely detekce anom\u00e1li\u00ed v s\u00ed\u0165ov\u00e9 telemetrii, ale takov\u00e1 roz\u0161\u00ed\u0159en\u00ed stoj\u00ed pen\u00edze a vyvst\u00e1v\u00e1 ot\u00e1zka, zda to za to opravdu stoj\u00ed \u2014 napsat si podobn\u00fd model s\u00e1m, koupit jeho realizaci pro sv\u00e9 monitorovac\u00ed n\u00e1stroje, nebo si po\u0159\u00eddit hotov\u00e9 \u0159e\u0161en\u00ed t\u0159\u00eddy Network Traffic Analysis.<\/p>\n<p><img decoding=\"async\" alt=\"Flow protokoly jako n\u00e1stroj pro monitorov\u00e1n\u00ed bezpe\u010dnosti vnit\u0159n\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/08\/d938ebb4271c4dfb73a1e4b6e94c91d6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nO tom, zda je lep\u0161\u00ed investovat pen\u00edze a koupit hotov\u00e9 \u0159e\u0161en\u00ed pro monitoring anom\u00e1li\u00ed a hrozeb v s\u00ed\u0165ov\u00e9 telemetrii (nap\u0159\u00edklad Cisco Stealthwatch), nebo se na to pod\u00edvat s\u00e1m a p\u0159izp\u016fsobit si pro ka\u017edou novou hrozbu ten stejn\u00fd SiLK, ELK nebo nfdump \u010di OSU Flow Tools (m\u00e1m na mysli posledn\u00ed dv\u011b), se mi nechce rozepisovat. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/348532\/\">vypr\u00e1v\u011bl<\/a><\/noindex> Ka\u017ed\u00fd si vyb\u00edr\u00e1 podle sebe a pro ka\u017ed\u00e9ho existuj\u00ed sv\u00e9 d\u016fvody vybrat jednu z obou variant. J\u00e1 jsem cht\u011bl pouze uk\u00e1zat, \u017ee s\u00ed\u0165ov\u00e1 telemetrie je velmi d\u016fle\u017eit\u00fdm n\u00e1strojem pro zaji\u0161t\u011bn\u00ed kybernetick\u00e9 bezpe\u010dnosti vlastn\u00ed vnit\u0159n\u00ed infrastruktury a nen\u00ed dobr\u00e9 ji podce\u0148ovat, abychom se nep\u0159ipojili k seznamu firem, jejich\u017e jm\u00e9na se objevuj\u00ed v m\u00e9di\u00edch s p\u0159\u00eddomky jako \u201ehacknut\u00e1\u201c, \u201eneseznamuj\u00edc\u00ed se s po\u017eadavky na IB\u201c, \u201enemysl\u00edc\u00ed na bezpe\u010dnost sv\u00fdch dat a dat sv\u00fdch klient\u016f\u201c.<\/p>\n<p><img decoding=\"async\" alt=\"Flow protokoly jako n\u00e1stroj pro monitorov\u00e1n\u00ed bezpe\u010dnosti vnit\u0159n\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/08\/de7df67df66b7abe89170c7f92fcefca.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNa z\u00e1v\u011br bych cht\u011bl shrnout kl\u00ed\u010dov\u00e9 rady, kter\u00fdmi byste se m\u011bli \u0159\u00eddit p\u0159i nastavov\u00e1n\u00ed monitorov\u00e1n\u00ed IB sv\u00e9 vnit\u0159n\u00ed infrastruktury:<\/p>\n<ol>\n<li>Nep\u0159est\u00e1vejte pouze na perimetru! Pou\u017e\u00edvejte (a vyb\u00edrejte) s\u00ed\u0165ovou infrastrukturu nejen pro p\u0159enos dat mezi bodem A a bodem B, ale tak\u00e9 pro \u0159e\u0161en\u00ed ot\u00e1zek kybernetick\u00e9 bezpe\u010dnosti.<\/li>\n<li>Prozkoumejte st\u00e1vaj\u00edc\u00ed mechanismy monitorov\u00e1n\u00ed IB ve va\u0161em s\u00ed\u0165ov\u00e9m za\u0159\u00edzen\u00ed a zapojte je.<\/li>\n<li>Pro intern\u00ed monitoring d\u00e1v\u00e1te p\u0159ednost anal\u00fdze telemetrie \u2014 ta umo\u017e\u0148uje odhalit a\u017e 80-90 % v\u0161ech s\u00ed\u0165ov\u00fdch incident\u016f IB, p\u0159i\u010dem\u017e d\u011bl\u00e1 to, co je nemo\u017en\u00e9 p\u0159i zachycen\u00ed s\u00ed\u0165ov\u00fdch paket\u016f a \u0161et\u0159\u00ed m\u00edsto pro uchov\u00e1v\u00e1n\u00ed v\u0161ech ud\u00e1lost\u00ed IB.<\/li>\n<li>Pro monitoring tok\u016f pou\u017e\u00edvejte Netflow v9 nebo IPFIX \u2013 ty poskytuj\u00ed v\u00edce informac\u00ed v kontextu bezpe\u010dnosti a umo\u017e\u0148uj\u00ed sledovat nejen IPv4, ale i IPv6, MPLS a dal\u0161\u00ed.<\/li>\n<li>Pou\u017e\u00edvejte nesemplovan\u00fd flow protokol \u2013 ten poskytuje v\u00edce informac\u00ed pro odhalov\u00e1n\u00ed hrozeb. Nap\u0159\u00edklad Netflow nebo IPFIX.<\/li>\n<li>Zkontrolujte zat\u00ed\u017een\u00ed va\u0161eho s\u00ed\u0165ov\u00e9ho vybaven\u00ed \u2013 mo\u017en\u00e1 nebude schopn\u00e9 zpracov\u00e1vat tak\u00e9 flow protokol. Pot\u00e9 zva\u017ete pou\u017eit\u00ed virtu\u00e1ln\u00edch senzor\u016f nebo za\u0159\u00edzen\u00ed pro generov\u00e1n\u00ed Netflow.<\/li>\n<li>Implementujte kontrolu p\u0159edev\u0161\u00edm na \u00farovni p\u0159\u00edstupu \u2013 to v\u00e1m umo\u017en\u00ed vid\u011bt 100 % ve\u0161ker\u00e9ho provozu.<\/li>\n<li>Pokud nem\u00e1te na v\u00fdb\u011br a pou\u017e\u00edv\u00e1te rusk\u00e9 s\u00ed\u0165ov\u00e9 vybaven\u00ed, vyberte si to, kter\u00e9 podporuje flow protokoly nebo m\u00e1 SPAN\/RSPAN porty.<\/li>\n<li>Kombinujte syst\u00e9my detekce\/prevence \u00fatok\u016f na hranic\u00edch s analyza\u010dn\u00edmi syst\u00e9my vnit\u0159n\u00edch proud\u016f (v\u010detn\u011b cloud\u016f).<\/li>\n<\/ol>\n<p><img decoding=\"async\" alt=\"Flow protokoly jako n\u00e1stroj pro monitorov\u00e1n\u00ed bezpe\u010dnosti vnit\u0159n\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/08\/c54e4b02a906f470bbfb617f48cdd216.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCo se t\u00fd\u010de posledn\u00edho doporu\u010den\u00ed, r\u00e1d bych uvedl ilustraci, kterou jsem ji\u017e jednou zmi\u0148oval. Vid\u00edte, \u017ee d\u0159\u00edve slu\u017eba kybernetick\u00e9 bezpe\u010dnosti Cisco t\u00e9m\u011b\u0159 zcela budovala sv\u016fj monitoring na z\u00e1klad\u011b syst\u00e9m\u016f detekce \u00fatok\u016f a signaturn\u00edch metod, ale nyn\u00ed na jejich pod\u00edl p\u0159ipad\u00e1 pouze 20 % incident\u016f. Dal\u0161\u00edch 20 % odpov\u00edd\u00e1 syst\u00e9m\u016fm anal\u00fdzy tok\u016f, co\u017e nazna\u010duje, \u017ee tato \u0159e\u0161en\u00ed nejsou pouh\u00fdm rozmaru, ale skute\u010dn\u00fdm n\u00e1strojem v \u010dinnosti kybernetick\u00fdch bezpe\u010dnostn\u00edch slu\u017eeb modern\u00edho podniku. O to v\u00edc, \u017ee pro jejich zaveden\u00ed m\u00e1te to nejd\u016fle\u017eit\u011bj\u0161\u00ed \u2013 s\u00ed\u0165ovou infrastrukturu, jej\u00ed\u017e investice m\u016f\u017eete nav\u00edc chr\u00e1nit t\u00edm, \u017ee na s\u00ed\u0165 p\u0159enesete i funkce monitorov\u00e1n\u00ed bezpe\u010dnosti.<\/p>\n<p><img decoding=\"async\" alt=\"Flow protokoly jako n\u00e1stroj pro monitorov\u00e1n\u00ed bezpe\u010dnosti vnit\u0159n\u00ed s\u00edt\u011b\" src=\"\/wp-content\/uploads\/2019\/08\/2166f265222c43b0b2cbbcf4091c1f8c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u00damysln\u011b jsem se nezab\u00fdval t\u00e9matem reakce na zji\u0161t\u011bn\u00e9 anom\u00e1lie nebo hrozby v s\u00ed\u0165ov\u00fdch toc\u00edch, ale mysl\u00edm, \u017ee je z\u0159ejm\u00e9, \u017ee monitoring by nem\u011bl kon\u010dit pouze odhalen\u00edm hrozby. M\u011blo by n\u00e1sledovat reakce, ide\u00e1ln\u011b v automatick\u00e9m nebo automatizovan\u00e9m re\u017eimu. Ale to je ji\u017e t\u00e9ma pro samostatn\u00fd materi\u00e1l.<\/p>\n<p>Dal\u0161\u00ed informace:<\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/products\/ios-nx-os-software\/ios-netflow\/index.html\">Popis Cisco IOS Netflow<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/community.cisco.com\/t5\/security-documents\/netflow-support-matrix\/ta-p\/3644638\">Matrix podpory Netflow v r\u016fzn\u00fdch \u0159e\u0161en\u00edch Cisco<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/dam\/en\/us\/td\/docs\/security\/stealthwatch\/netflow\/Cisco_NetFlow_Configuration.pdf\">P\u0159\u00edru\u010dka pro nastaven\u00ed Netflow na r\u016fzn\u00fdch platform\u00e1ch Cisco<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/sflow.org\">Komunita sFlow<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.ciscolive.com\/c\/dam\/r\/ciscolive\/us\/docs\/2015\/pdf\/LTRSEC-3336.pdf\">Laboratorn\u00ed pr\u00e1ce o vyu\u017eit\u00ed Stealthwatch, SiLK a ELK pro anal\u00fdzu Netflow z pohledu bezpe\u010dnosti<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/tools.netsa.cert.org\/silk\/\">Webov\u00e1 str\u00e1nka SiLK<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/tools.netsa.cert.org\/silk\/analysis-handbook.pdf\">T\u0159istastr\u00e1nkov\u00e1 p\u0159\u00edru\u010dka pro pou\u017eit\u00ed SiLK s mno\u017estv\u00edm p\u0159\u00edklad\u016f<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.elastic.co\/guide\/en\/logstash\/current\/netflow-module.html\">Modul Logstash Netflow<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/blogs.cisco.com\/security\/step-by-step-setup-of-elk-for-netflow-analytics\">Krok za krokem p\u0159\u00edru\u010dka Cisco pro anal\u00fdzu Netflow v ELK<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/307528\/\">Anal\u00fdza NetFlow v.9 Cisco ASA pomoc\u00ed Logstash (ELK)<\/a><\/noindex><\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/ru_ru\/products\/security\/stealthwatch\/index.html\">\u0158e\u0161en\u00ed Cisco Stealthwatch<\/a><\/noindex><\/li>\n<\/ul>\n<p>P. S. Pokud v\u00e1m l\u00e9pe vyhovuje sly\u0161et v\u0161echny v\u00fd\u0161e uveden\u00e9 informace, m\u016f\u017eete si prohl\u00e9dnout hodinovou prezentaci, kter\u00e1 byla z\u00e1kladem tohoto pozn\u00e1mky.<\/p>\n<p><center><div class=\"youtube-placeholder\" data-id=\"ncDRZsueETo\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/ncDRZsueETo\/hqdefault.jpg\" alt=\"P\u0159ehr\u00e1t video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/464601\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u0433\u0434\u0430 \u0440\u0435\u0447\u044c \u0437\u0430\u0445\u043e\u0434\u0438\u0442 \u043e \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0438\u043b\u0438 \u0432\u0435\u0434\u043e\u043c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0442\u043e \u0443 \u043c\u043d\u043e\u0433\u0438\u0445 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u044f \u0441 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435\u043c \u0443\u0442\u0435\u0447\u0435\u043a \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c DLP-\u0440\u0435\u0448\u0435\u043d\u0438\u0439. \u0410 \u0435\u0441\u043b\u0438 \u043f\u043e\u043f\u0440\u043e\u0431\u043e\u0432\u0430\u0442\u044c \u0443\u0442\u043e\u0447\u043d\u0438\u0442\u044c \u0432\u043e\u043f\u0440\u043e\u0441 \u0438 \u0441\u043f\u0440\u043e\u0441\u0438\u0442\u044c, \u043a\u0430\u043a \u0432\u044b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0435\u0442\u0435 \u0430\u0442\u0430\u043a\u0438 \u0432\u043e \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438, \u0442\u043e \u043e\u0442\u0432\u0435\u0442\u043e\u043c \u0431\u0443\u0434\u0435\u0442, \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u043d\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a (intrusion detection systems, IDS). \u0418 \u0442\u043e, \u0447\u0442\u043e \u0431\u044b\u043b\u043e \u0435\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":28091,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-37437","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u0433\u0434\u0430 \u0440\u0435\u0447\u044c \u0437\u0430\u0445\u043e\u0434\u0438\u0442 \u043e \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0438\u043b\u0438 \u0432\u0435\u0434\u043e\u043c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0442\u043e \u0443 \u043c\u043d\u043e\u0433\u0438\u0445 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u044f \u0441 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435\u043c \u0443\u0442\u0435\u0447\u0435\u043a \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c DLP-\u0440\u0435\u0448\u0435\u043d\u0438\u0439.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/flow-protokoly-kak-instrument-monitoringa-bezopasnosti-vnutrennej-seti\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Flow-\u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b \u043a\u0430\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u0433\u0434\u0430 \u0440\u0435\u0447\u044c \u0437\u0430\u0445\u043e\u0434\u0438\u0442 \u043e \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0438\u043b\u0438 \u0432\u0435\u0434\u043e\u043c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0442\u043e \u0443 \u043c\u043d\u043e\u0433\u0438\u0445 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u044f \u0441 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435\u043c \u0443\u0442\u0435\u0447\u0435\u043a \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c DLP-\u0440\u0435\u0448\u0435\u043d\u0438\u0439.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/flow-protokoly-kak-instrument-monitoringa-bezopasnosti-vnutrennej-seti\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:17:38+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:17:38+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Flow protokoly jako n\u00e1stroj pro monitorov\u00e1n\u00ed bezpe\u010dnosti vnit\u0159n\u00ed s\u00edt\u011b | ProHoster","description":"Kdy\u017e se hovo\u0159\u00ed o monitorov\u00e1n\u00ed bezpe\u010dnosti vnit\u0159n\u00ed firemn\u00ed nebo vl\u00e1dn\u00ed s\u00edt\u011b, mnoh\u00fdm se vybav\u00ed kontrola \u00fanik\u016f informac\u00ed a zav\u00e1d\u011bn\u00ed \u0159e\u0161en\u00ed DLP.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/flow-protokoly-kak-instrument-monitoringa-bezopasnosti-vnutrennej-seti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Flow-\u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b \u043a\u0430\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0441\u0435\u0442\u0438 | ProHoster","og:description":"\u041a\u043e\u0433\u0434\u0430 \u0440\u0435\u0447\u044c \u0437\u0430\u0445\u043e\u0434\u0438\u0442 \u043e \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0438\u043b\u0438 \u0432\u0435\u0434\u043e\u043c\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0439 \u0441\u0435\u0442\u0438, \u0442\u043e \u0443 \u043c\u043d\u043e\u0433\u0438\u0445 \u0432\u043e\u0437\u043d\u0438\u043a\u0430\u0435\u0442 \u0430\u0441\u0441\u043e\u0446\u0438\u0430\u0446\u0438\u044f \u0441 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u0435\u043c \u0443\u0442\u0435\u0447\u0435\u043a \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0438 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435\u043c DLP-\u0440\u0435\u0448\u0435\u043d\u0438\u0439.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/flow-protokoly-kak-instrument-monitoringa-bezopasnosti-vnutrennej-seti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:17:38+00:00","article:modified_time":"2019-10-31T19:17:38+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37437","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 17:49:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:26:28","updated":"2026-01-23 17:49:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37437","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=37437"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37437\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/28091"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=37437"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=37437"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=37437"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}