{"id":37446,"date":"2019-10-31T22:17:39","date_gmt":"2019-10-31T19:17:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/ne-skanirovaniem-edinym-ili-kak-postroit-protsess-upravleniya-uyazvimostyami-za-9-shagov\/"},"modified":"2019-10-31T22:17:39","modified_gmt":"2019-10-31T19:17:39","slug":"ne-skanirovaniem-edinym-ili-kak-postroit-protsess-upravleniya-uyazvimostyami-za-9-shagov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/ne-skanirovaniem-edinym-ili-kak-postroit-protsess-upravleniya-uyazvimostyami-za-9-shagov","title":{"rendered":"Nen\u00ed to jen o skenov\u00e1n\u00ed, aneb jak vybudovat proces spr\u00e1vy zranitelnost\u00ed v 9 kroc\u00edch","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>4. \u010dervence jsme po\u0159\u00e1dali velk\u00fd <noindex><a rel=\"nofollow\" href=\"https:\/\/uni.dtln.ru\/courses\/universitety-dataline-v-moskve\/upravlenie-uyazvimostyami-standarty-realnost-instrumenty\">semin\u00e1\u0159 o \u0159\u00edzen\u00ed zranitelnost\u00ed<\/a><\/noindex>. Dnes zve\u0159ej\u0148ujeme p\u0159epis vystoupen\u00ed Andreje Novikova z Qualys. \u0158ekne n\u00e1m, jak\u00e9 kroky je t\u0159eba podstoupit pro vybudov\u00e1n\u00ed pracovn\u00edho procesu \u0159\u00edzen\u00ed zranitelnost\u00ed. Spoiler: k skenov\u00e1n\u00ed se dostaneme a\u017e ke st\u0159edn\u00ed cest\u011b.<\/p>\n<p><center><div class=\"youtube-placeholder\" data-id=\"rGXwDWhYWTg\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/rGXwDWhYWTg\/hqdefault.jpg\" alt=\"P\u0159ehr\u00e1t video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Krok \u010d. 1: Ur\u010dete \u00farove\u0148 zralosti proces\u016f \u0159\u00edzen\u00ed zranitelnost\u00ed<\/h3>\n<p>\nNa za\u010d\u00e1tku je d\u016fle\u017eit\u00e9 pochopit, na jak\u00e9 \u00farovni se va\u0161e organizace nach\u00e1z\u00ed z hlediska zralosti proces\u016f \u0159\u00edzen\u00ed zranitelnost\u00ed. Teprve pot\u00e9 m\u016f\u017eete pochopit, kter\u00fdm sm\u011brem se vydat a jak\u00e9 kroky je t\u0159eba podniknout. P\u0159ed t\u00edm, ne\u017e se pust\u00edte do skenov\u00e1n\u00ed a dal\u0161\u00edch aktivit, mus\u00ed organizace vykonat vnit\u0159n\u00ed pr\u00e1ci a zjistit, jak jsou sou\u010dasn\u00e9 procesy nastaveny z pohledu IT a z pohledu informa\u010dn\u00ed bezpe\u010dnosti.<\/p>\n<p>Sna\u017ete se odpov\u011bd\u011bt na z\u00e1kladn\u00ed ot\u00e1zky:<\/p>\n<ul>\n<li>m\u00e1te procesy pro inventarizaci a klasifikaci aktiv;\u00a0<\/li>\n<li>jak \u010dasto je skenov\u00e1na IT infrastruktura a je cel\u00e1 infrastruktura pokryta, vid\u00edte celkov\u00fd obraz;<\/li>\n<li>monitoruj\u00ed se va\u0161e IT zdroje;<\/li>\n<li>jsou do va\u0161ich proces\u016f implementov\u00e1ny n\u011bjak\u00e9 KPI a jak zjist\u00edte, \u017ee jsou spln\u011bny;<\/li>\n<li>jsou v\u0161echny tyto procesy zdokumentov\u00e1ny.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Nen\u00ed to jen o skenov\u00e1n\u00ed, aneb jak vybudovat proces spr\u00e1vy zranitelnost\u00ed v 9 kroc\u00edch\" src=\"\/wp-content\/uploads\/2019\/08\/8bfd0539c7e0e360fa2a45cc1d7bd9ac.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Krok \u010d. 2: Zajist\u011bte \u00fapln\u00e9 pokryt\u00ed infrastruktury <\/h3>\n<p>\nNem\u016f\u017eete chr\u00e1nit to, co nezn\u00e1te. Pokud nem\u00e1te \u00fapln\u00fd obraz toho, z \u010deho se va\u0161e IT infrastruktura skl\u00e1d\u00e1, nebudete schopni ji chr\u00e1nit. Modern\u00ed infrastruktura je slo\u017eit\u00e1 a st\u00e1le se m\u011bn\u00ed kvantitativn\u011b i kvalitativn\u011b. <br \/>\nNyn\u00ed je IT infrastruktura zalo\u017eena nejen na tradi\u010dn\u00edm technologick\u00e9m stacku (pracovn\u00ed stanice, <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/server\/\"   title=\"servery\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"1841\">servery<\/a>, virtu\u00e1ln\u00ed stroje), ale i na relativn\u011b nov\u00fdch \u2013 kontejnerech, mikroslu\u017eb\u00e1ch. Odd\u011blen\u00ed informa\u010dn\u00ed bezpe\u010dnosti se jim sna\u017e\u00ed vyhnout, proto\u017ee s nimi velmi obt\u00ed\u017en\u011b pracuje pomoc\u00ed st\u00e1vaj\u00edc\u00edch n\u00e1stroj\u016f, kter\u00e9 se p\u0159ev\u00e1\u017en\u011b skl\u00e1daj\u00ed z skener\u016f. Probl\u00e9m je v tom, \u017ee \u017e\u00e1dn\u00fd skener nem\u016f\u017ee pokr\u00fdt celou infrastrukturu. Aby se skener dostal k jak\u00e9mukoli uzlu v infrastruktu\u0159e, mus\u00ed se shodovat n\u011bkolik faktor\u016f. Aktivum mus\u00ed b\u00fdt uvnit\u0159 perimetru organizace v dob\u011b skenov\u00e1n\u00ed. Skener mus\u00ed m\u00edt s\u00ed\u0165ov\u00fd p\u0159\u00edstup k aktiv\u016fm, jejich \u00fa\u010dt\u016fm, aby shrom\u00e1\u017edil \u00fapln\u00e9 informace.<\/p>\n<p>Podle na\u0161ich statistik, pokud jde o st\u0159edn\u00ed nebo velk\u00e9 organizace, p\u0159ibli\u017en\u011b 15\u201320 % infrastruktury nen\u00ed skenerem zachyceno z r\u016fzn\u00fdch d\u016fvod\u016f: aktivum opustilo hranice perimetru nebo se nikdy neobjev\u00ed v kancel\u00e1\u0159i. Nap\u0159\u00edklad notebook zam\u011bstnance, kter\u00fd pracuje na d\u00e1lku, ale m\u00e1 p\u0159\u00edstup k firemn\u00ed s\u00edti, nebo aktivum, kter\u00e9 se nach\u00e1z\u00ed ve ve\u0159ejn\u00fdch cloudov\u00fdch slu\u017eb\u00e1ch typu Amazon. A skener pravd\u011bpodobn\u011b o t\u011bchto aktivech nebude v\u011bd\u011bt, proto\u017ee jsou mimo jeho dosah.<\/p>\n<p>Aby bylo mo\u017en\u00e9 pokr\u00fdt celou infrastrukturu, je t\u0159eba pou\u017e\u00edvat nejenom skenery, ale cel\u00fd soubor senzor\u016f, v\u010detn\u011b technologi\u00ed pasivn\u00edho odposlouch\u00e1v\u00e1n\u00ed provozu pro odhalov\u00e1n\u00ed nov\u00fdch za\u0159\u00edzen\u00ed ve va\u0161\u00ed infrastruktu\u0159e, agentn\u00ed metodu sb\u011bru dat, kter\u00e1 umo\u017e\u0148uje z\u00edsk\u00e1vat informace \u2013 shroma\u017e\u010fovat data online, bez nutnosti skenov\u00e1n\u00ed, bez zad\u00e1v\u00e1n\u00ed p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f.<\/p>\n<p><img decoding=\"async\" alt=\"Nen\u00ed to jen o skenov\u00e1n\u00ed, aneb jak vybudovat proces spr\u00e1vy zranitelnost\u00ed v 9 kroc\u00edch\" src=\"\/wp-content\/uploads\/2019\/08\/8eb24a33955ba1f6a8f295001b4e413f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Krok \u010d. 3: Prove\u010fte kategorizaci aktiv<\/h3>\n<p>\nNe v\u0161echna aktiva jsou stejn\u011b cenn\u00e1. Ur\u010dit, kter\u00e1 aktiva jsou d\u016fle\u017eit\u00e1, a kter\u00e1 ne, je va\u0161\u00edm \u00fakolem. \u017d\u00e1dn\u00fd n\u00e1stroj, ten stejn\u00fd skener, to za v\u00e1s neud\u011bl\u00e1. Ide\u00e1ln\u011b by se m\u011bli specialist\u00e9 na informa\u010dn\u00ed bezpe\u010dnost, IT a byznys spole\u010dn\u011b pod\u00edvat na infrastrukturu, aby identifikovali podnikatelsky kritick\u00e9 syst\u00e9my. Pro n\u011b stanovuj\u00ed akceptovateln\u00e9 metriky t\u00fdkaj\u00edc\u00ed se dostupnosti, integrity, d\u016fv\u011brnosti, RTO\/RPO a podobn\u011b.<\/p>\n<p>To pom\u016f\u017ee ur\u010dit priority v procesu \u0159\u00edzen\u00ed zranitelnost\u00ed. Kdy\u017e va\u0161i specialist\u00e9 dostanou informace o zranitelnostech, nebude to prost\u011b seznam s tis\u00edci zranitelnostmi nap\u0159\u00ed\u010d celou infrastrukturou, ale granularizovan\u00e9 informace s ohledem na kriti\u010dnost syst\u00e9m\u016f.<\/p>\n<p><img decoding=\"async\" alt=\"Nen\u00ed to jen o skenov\u00e1n\u00ed, aneb jak vybudovat proces spr\u00e1vy zranitelnost\u00ed v 9 kroc\u00edch\" src=\"\/wp-content\/uploads\/2019\/08\/8c5fc2ea7a0c6f0df26be14c07bb7a9c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Krok \u010d. 4: Prove\u010fte hodnocen\u00ed infrastruktury<\/h3>\n<p>\nA teprve ve \u010dtvrt\u00e9m kroku p\u0159istupujeme k hodnocen\u00ed infrastruktury z hlediska zranitelnost\u00ed. V t\u00e9to f\u00e1zi doporu\u010dujeme zam\u011b\u0159it se nejen na zranitelnosti v softwaru, ale tak\u00e9 na chyby v konfigurac\u00edch, kter\u00e9 mohou b\u00fdt rovn\u011b\u017e zranitelnostmi. Zde doporu\u010dujeme agentn\u00ed metodu sb\u011bru informac\u00ed. Skenery lze a m\u011bly by se pou\u017e\u00edvat k hodnocen\u00ed bezpe\u010dnosti perimetru. Pokud pou\u017e\u00edv\u00e1te zdroje od poskytovatel\u016f cloudov\u00fdch slu\u017eeb, je pot\u0159eba tak\u00e9 shrom\u00e1\u017edit informace o aktivech a konfigurac\u00edch. Zvl\u00e1\u0161tn\u00ed pozornost v\u011bnujte anal\u00fdze zranitelnost\u00ed v infrastruktur\u00e1ch s vyu\u017eit\u00edm kontejner\u016f Docker.<\/p>\n<p><img decoding=\"async\" alt=\"Nen\u00ed to jen o skenov\u00e1n\u00ed, aneb jak vybudovat proces spr\u00e1vy zranitelnost\u00ed v 9 kroc\u00edch\" src=\"\/wp-content\/uploads\/2019\/08\/3aa4a3a6aca611af6e49ef5aa2360ea0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Krok \u010d. 5: Nastavte reporty<\/h3>\n<p>\nTo je jeden z d\u016fle\u017eit\u00fdch prvk\u016f v procesu \u0159\u00edzen\u00ed zranitelnost\u00ed. <br \/>\nPrvn\u00ed bod: nikdo nebude pracovat s v\u00edcestr\u00e1nkov\u00fdmi zpr\u00e1vami s chaotick\u00fdm seznamem zranitelnost\u00ed a popisem jejich odstran\u011bn\u00ed. Je prvo\u0159ad\u00e9 komunikovat s kolegy a zjistit, co by m\u011blo b\u00fdt ve zpr\u00e1v\u011b a jak je pro n\u011b pohodln\u011bj\u0161\u00ed z\u00edsk\u00e1vat data. Nap\u0159\u00edklad n\u011bkter\u00e9mu adminovi nemus\u00ed b\u00fdt pot\u0159eba podrobn\u00fd popis zranitelnosti, ale sta\u010d\u00ed mu informace o z\u00e1plat\u011b a odkaz na ni. Jin\u00e9mu specialistovi z\u00e1le\u017e\u00ed pouze na zranitelnostech nalezen\u00fdch v s\u00ed\u0165ov\u00e9 infrastruktu\u0159e.<\/p>\n<p>Druh\u00fd bod: pod reporty ch\u00e1pu nejen pap\u00edrov\u00e9 zpr\u00e1vy. To je zastaral\u00fd form\u00e1t z\u00edsk\u00e1v\u00e1n\u00ed informac\u00ed a statick\u00fd p\u0159\u00edb\u011bh. \u010clov\u011bk obdr\u017e\u00ed zpr\u00e1vu a nem\u016f\u017ee nijak ovlivnit, jak budou data v t\u00e9to zpr\u00e1v\u011b prezentov\u00e1na. Aby z\u00edskal zpr\u00e1vu ve spr\u00e1vn\u00e9m form\u00e1tu, mus\u00ed IT specialista kontaktovat specialistu na informa\u010dn\u00ed bezpe\u010dnost a po\u017e\u00e1dat ho, aby zpr\u00e1vu p\u0159epracoval. \u010cas b\u011b\u017e\u00ed, objevuj\u00ed se nov\u00e9 zranitelnosti. M\u00edsto toho, aby si \u00fa\u0159ady p\u0159ed\u00e1valy zpr\u00e1vy z odd\u011blen\u00ed do odd\u011blen\u00ed, by m\u011bli m\u00edt specialist\u00e9 obou sm\u011br\u016f mo\u017enost sledovat data online a vid\u011bt stejn\u00fd obraz. Proto ve sv\u00e9 platform\u011b pou\u017e\u00edv\u00e1me dynamick\u00e9 zpr\u00e1vy ve form\u011b p\u0159izp\u016fsobiteln\u00fdch dashboard\u016f. <\/p>\n<p><img decoding=\"async\" alt=\"Nen\u00ed to jen o skenov\u00e1n\u00ed, aneb jak vybudovat proces spr\u00e1vy zranitelnost\u00ed v 9 kroc\u00edch\" src=\"\/wp-content\/uploads\/2019\/08\/1ec7434339d2162d172e10cdc77afc6a.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Krok \u010d. 6: Prioritizujte<\/h3>\n<p>\nZde lze d\u011blat n\u00e1sleduj\u00edc\u00ed:<\/p>\n<p>1. Vytvo\u0159en\u00ed repozit\u00e1\u0159e se zlat\u00fdmi obrazy syst\u00e9m\u016f. Pracujte se zlat\u00fdmi obrazy, pravideln\u011b je kontrolujte na zranitelnosti a spr\u00e1vnost konfigurace. Toho lze dos\u00e1hnout pomoc\u00ed agent\u016f, kte\u0159\u00ed automaticky oznamuj\u00ed nov\u00e9 aktivum a poskytuj\u00ed informace o jeho zranitelnostech. <\/p>\n<p>2. Zam\u011b\u0159te se na ty aktiva, kter\u00e1 jsou kritick\u00e1 pro podnik\u00e1n\u00ed. Neexistuje \u017e\u00e1dn\u00e1 organizace na sv\u011bt\u011b, kter\u00e1 by mohla odstranit zranitelnosti najednou. Proces odstra\u0148ov\u00e1n\u00ed zranitelnost\u00ed je dlouh\u00fd a dokonce i \u00fanavn\u00fd. <\/p>\n<p>3. Z\u00fa\u017een\u00ed \u00fato\u010dn\u00e9 plochy. O\u010dist\u011bte svou infrastrukturu od nepot\u0159ebn\u00e9ho softwaru, slu\u017eeb a uzav\u0159ete zbyte\u010dn\u00e9 porty. Ned\u00e1vno jsme m\u011bli p\u0159\u00edpad jedn\u00e9 firmy, kter\u00e1 m\u011bla na 40 tis\u00edc\u00edch za\u0159\u00edzen\u00edch nalezeno kolem 100 tis\u00edc zranitelnost\u00ed spojen\u00fdch se starou verz\u00ed prohl\u00ed\u017ee\u010de Mozilla. Jak se pozd\u011bji uk\u00e1zalo, Mozilla byla implementov\u00e1na do zlat\u00e9ho obrazu p\u0159ed mnoha lety, nikdo ji nepou\u017e\u00edv\u00e1, ale je zdrojem velk\u00e9ho mno\u017estv\u00ed zranitelnost\u00ed. Kdy\u017e jsme prohl\u00ed\u017ee\u010d odstranili z po\u010d\u00edta\u010d\u016f (dokonce byl na n\u011bkter\u00fdch serverech), tyto des\u00edtky tis\u00edc zranitelnost\u00ed zmizely.<\/p>\n<p>4. \u0158a\u010fte zranitelnosti podle datab\u00e1ze hrozeb (threat intelligence). Zohledn\u011bte nejen kriti\u010dnost zranitelnosti, ale i p\u0159\u00edtomnost ve\u0159ejn\u00e9ho exploit, malware, z\u00e1platy, a extern\u00edho p\u0159\u00edstupu k syst\u00e9mu se zranitelnost\u00ed. Hodno\u0165te dopad t\u00e9to zranitelnosti na kritick\u00e9 obchodn\u00ed syst\u00e9my: m\u016f\u017ee v\u00e9st ke ztr\u00e1t\u011b dat, v\u00fdpadk\u016fm a podobn\u011b.<\/p>\n<p><img decoding=\"async\" alt=\"Nen\u00ed to jen o skenov\u00e1n\u00ed, aneb jak vybudovat proces spr\u00e1vy zranitelnost\u00ed v 9 kroc\u00edch\" src=\"\/wp-content\/uploads\/2019\/08\/8335bdbd2055437c756055a1788500bc.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Krok \u010d. 7: Zm\u011b\u0159te KPI<\/h3>\n<p>\nNeskenujte, abyste skenovali. Pokud se s nalezen\u00fdmi zranitelnostmi nic ned\u011bje, st\u00e1v\u00e1 se to skenov\u00e1n\u00ed zbyte\u010dnou operac\u00ed. Aby pr\u00e1ce se zranitelnostmi nebyla form\u00e1ln\u00ed z\u00e1le\u017eitost\u00ed, promyslete, jak budete hodnotit jej\u00ed v\u00fdsledky. Bezpe\u010dnostn\u00ed a IT odd\u011blen\u00ed by se m\u011bly dohodnout, jak bude pr\u00e1ce na odstra\u0148ov\u00e1n\u00ed zranitelnost\u00ed organizov\u00e1na, jak \u010dasto budou skenov\u00e1n\u00ed, instalace z\u00e1plat atd. prob\u00edhat.<br \/>\nNa sn\u00edmku vid\u00edte p\u0159\u00edklady mo\u017en\u00fdch KPI. Existuje i roz\u0161\u00ed\u0159en\u00fd seznam, kter\u00fd doporu\u010dujeme na\u0161im klient\u016fm. Pokud budete m\u00edt z\u00e1jem, ozv\u011bte se, r\u00e1d se s v\u00e1mi o tuto informaci pod\u011bl\u00edm.<\/p>\n<p><img decoding=\"async\" alt=\"Nen\u00ed to jen o skenov\u00e1n\u00ed, aneb jak vybudovat proces spr\u00e1vy zranitelnost\u00ed v 9 kroc\u00edch\" src=\"\/wp-content\/uploads\/2019\/08\/3ff48f666b1c4f82546467a8514092f9.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Krok \u010d. 8: Automatizujte<\/h3>\n<p>\nJe\u0161t\u011b jednou se vr\u00e1t\u00edm ke skenov\u00e1n\u00ed. V Qualys v\u011b\u0159\u00edme, \u017ee skenov\u00e1n\u00ed je to nejm\u00e9n\u011b d\u016fle\u017eit\u00e9, co m\u016f\u017ee b\u00fdt dnes v procesu spr\u00e1vy zranitelnost\u00ed, a \u017ee je t\u0159eba ho co nejv\u00edce automatizovat, aby prob\u00edhalo bez \u00fa\u010dasti odborn\u00edka na bezpe\u010dnost. Dnes existuje mnoho n\u00e1stroj\u016f, kter\u00e9 to umo\u017e\u0148uj\u00ed. Sta\u010d\u00ed, aby m\u011bly otev\u0159en\u00e9 API a pot\u0159ebn\u00fd po\u010det konektor\u016f.<\/p>\n<p>P\u0159\u00edklad, kter\u00fd r\u00e1d uv\u00e1d\u00edm, je DevOps. Pokud do n\u011bj za\u0159ad\u00edte skener zranitelnost\u00ed, m\u016f\u017eete na DevOps jednodu\u0161e zapomenout. Se star\u00fdmi technologiemi, jakou je klasick\u00fd skener, v\u00e1s do t\u011bchto proces\u016f jednodu\u0161e nepust\u00ed. V\u00fdvoj\u00e1\u0159i nebudou \u010dekat, dokud neskenerujete a neodevzd\u00e1te jim mnohastr\u00e1nkovou nepohodlnou zpr\u00e1vu. V\u00fdvoj\u00e1\u0159i o\u010dek\u00e1vaj\u00ed, \u017ee informace o zranitelnostech se dostanou do jejich syst\u00e9m\u016f pro sestavov\u00e1n\u00ed k\u00f3du ve form\u011b informac\u00ed o chyb\u00e1ch. Bezpe\u010dnost mus\u00ed b\u00fdt bezprobl\u00e9mov\u011b integrov\u00e1na do t\u011bchto proces\u016f a m\u011bla by b\u00fdt pouhou funkc\u00ed, kter\u00e1 je automaticky vyvol\u00e1v\u00e1na syst\u00e9mem, kter\u00fd pou\u017e\u00edvaj\u00ed va\u0161i v\u00fdvoj\u00e1\u0159i.<\/p>\n<p><img decoding=\"async\" alt=\"Nen\u00ed to jen o skenov\u00e1n\u00ed, aneb jak vybudovat proces spr\u00e1vy zranitelnost\u00ed v 9 kroc\u00edch\" src=\"\/wp-content\/uploads\/2019\/08\/82c15607c1c7b177e407181e19f17c0b.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Krok \u010d. 9: Soust\u0159e\u010fte se na to podstatn\u00e9<\/h3>\n<p>\nSoust\u0159e\u010fte se na to, co p\u0159in\u00e1\u0161\u00ed skute\u010dn\u00fd prosp\u011bch va\u0161\u00ed spole\u010dnosti. Skenov\u00e1n\u00ed m\u016f\u017ee b\u00fdt automatizov\u00e1no, zpr\u00e1vy mohou b\u00fdt tak\u00e9 automaticky rozes\u00edl\u00e1ny. <br \/>\nSoust\u0159e\u010fte se na zlep\u0161ov\u00e1n\u00ed proces\u016f, aby byly flexibiln\u011bj\u0161\u00ed a pohodln\u011bj\u0161\u00ed pro v\u0161echny \u00fa\u010dastn\u00edky. Zam\u011b\u0159te se na to, aby byla bezpe\u010dnost zakotvena ve v\u0161ech smlouv\u00e1ch s va\u0161imi partnery, kte\u0159\u00ed pro v\u00e1s nap\u0159\u00edklad vyv\u00edjej\u00ed webov\u00e9 aplikace.<\/p>\n<p>Pokud pot\u0159ebujete podrobn\u011bj\u0161\u00ed informace o tom, jak ve va\u0161\u00ed spole\u010dnosti vybudovat proces \u0159\u00edzen\u00ed zranitelnost\u00ed, obra\u0165te se na m\u011b a m\u00e9 kolegy. R\u00e1d pomohu.<\/p>\n<p><img decoding=\"async\" alt=\"Nen\u00ed to jen o skenov\u00e1n\u00ed, aneb jak vybudovat proces spr\u00e1vy zranitelnost\u00ed v 9 kroc\u00edch\" src=\"\/wp-content\/uploads\/2019\/08\/5a75c5f5b8569d5857a37464cae4af89.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/dataline\/blog\/464643\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>4 \u0438\u044e\u043b\u044f \u043c\u044b \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u0438 \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0441\u0435\u043c\u0438\u043d\u0430\u0440 \u043f\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u043c \u0440\u0430\u0441\u0448\u0438\u0444\u0440\u043e\u0432\u043a\u0443 \u0432\u044b\u0441\u0442\u0443\u043f\u043b\u0435\u043d\u0438\u044f \u0410\u043d\u0434\u0440\u0435\u044f \u041d\u043e\u0432\u0438\u043a\u043e\u0432\u0430 \u0438\u0437 Qualys. \u041e\u043d \u0440\u0430\u0441\u0441\u043a\u0430\u0436\u0435\u0442, \u043a\u0430\u043a\u0438\u0435 \u044d\u0442\u0430\u043f\u044b \u043d\u0443\u0436\u043d\u043e \u043f\u0440\u043e\u0439\u0442\u0438, \u0447\u0442\u043e\u0431\u044b \u0432\u044b\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u0440\u0430\u0431\u043e\u0447\u0438\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438. \u0421\u043f\u043e\u0439\u043b\u0435\u0440: \u0434\u043e \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043c\u044b \u0434\u043e\u0431\u0435\u0440\u0435\u043c\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043a \u0441\u0435\u0440\u0435\u0434\u0438\u043d\u0435 \u043f\u0443\u0442\u0438. \u0428\u0430\u0433 \u2116 1: \u041e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u0442\u0435 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0437\u0440\u0435\u043b\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u043e\u0432 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0412 \u0441\u0430\u043c\u043e\u043c \u043d\u0430\u0447\u0430\u043b\u0435 \u043d\u0443\u0436\u043d\u043e \u043f\u043e\u043d\u044f\u0442\u044c, \u043d\u0430 \u043a\u0430\u043a\u043e\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":28098,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-37446","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"4 \u0438\u044e\u043b\u044f \u043c\u044b \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u0438 \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0441\u0435\u043c\u0438\u043d\u0430\u0440 \u043f\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044e.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/ne-skanirovaniem-edinym-ili-kak-postroit-protsess-upravleniya-uyazvimostyami-za-9-shagov\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041d\u0435 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0435\u0434\u0438\u043d\u044b\u043c, \u0438\u043b\u0438 \u043a\u0430\u043a \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0437\u0430 9 \u0448\u0430\u0433\u043e\u0432 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"4 \u0438\u044e\u043b\u044f \u043c\u044b \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u0438 \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0441\u0435\u043c\u0438\u043d\u0430\u0440 \u043f\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044e.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/ne-skanirovaniem-edinym-ili-kak-postroit-protsess-upravleniya-uyazvimostyami-za-9-shagov\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:17:39+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:17:39+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Nejen skenov\u00e1n\u00edm, neboli jak vybudovat proces \u0159\u00edzen\u00ed zranitelnost\u00ed ve 9 kroc\u00edch | ProHoster","description":"4. \u010dervence jsme uspo\u0159\u00e1dali velk\u00fd semin\u00e1\u0159 o \u0159\u00edzen\u00ed.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/ne-skanirovaniem-edinym-ili-kak-postroit-protsess-upravleniya-uyazvimostyami-za-9-shagov","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041d\u0435 \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0435\u0434\u0438\u043d\u044b\u043c, \u0438\u043b\u0438 \u043a\u0430\u043a \u043f\u043e\u0441\u0442\u0440\u043e\u0438\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0437\u0430 9 \u0448\u0430\u0433\u043e\u0432 | ProHoster","og:description":"4 \u0438\u044e\u043b\u044f \u043c\u044b \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u043b\u0438 \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0441\u0435\u043c\u0438\u043d\u0430\u0440 \u043f\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044e.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/ne-skanirovaniem-edinym-ili-kak-postroit-protsess-upravleniya-uyazvimostyami-za-9-shagov","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:17:39+00:00","article:modified_time":"2019-10-31T19:17:39+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37446","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 17:59:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:26:28","updated":"2026-02-09 17:59:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37446","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=37446"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37446\/revisions"}],"predecessor-version":[{"id":159085,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37446\/revisions\/159085"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/28098"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=37446"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=37446"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=37446"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}