{"id":37831,"date":"2019-10-31T22:20:00","date_gmt":"2019-10-31T19:20:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-kazaki-gicsp-sertifikat-poluchali\/"},"modified":"2019-10-31T22:20:00","modified_gmt":"2019-10-31T19:20:00","slug":"kak-kazaki-gicsp-sertifikat-poluchali","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/kak-kazaki-gicsp-sertifikat-poluchali","title":{"rendered":"Jak koz\u00e1ci GICSP certifik\u00e1t z\u00edskali","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Ahoj v\u0161ichni! Na obl\u00edben\u00e9m port\u00e1lu bylo mnoho r\u016fzn\u00fdch \u010dl\u00e1nk\u016f o certifikac\u00edch v oblasti kybernetick\u00e9 bezpe\u010dnosti, a tak se nechci uch\u00e1zet o originalitu a jedine\u010dnost obsahu, ale p\u0159esto bych se r\u00e1d pod\u011blil o svou zku\u0161enost s z\u00edsk\u00e1n\u00edm certifikace GIAC (Global Information Assurance Company) v oblasti pr\u016fmyslov\u00e9 kybernetick\u00e9 bezpe\u010dnosti. Od doby, kdy se objevily takov\u00e9 d\u011bsiv\u00e9 term\u00edny jako Stuxnet<\/a><\/noindex>, Duqu<\/a><\/noindex>, Shamoon, Triton, postupn\u011b vznikal trh poskytov\u00e1n\u00ed slu\u017eeb specialist\u016f, kte\u0159\u00ed jsou \u010d\u00e1ste\u010dn\u011b IT, ale tak\u00e9 dok\u00e1\u017eou restartovat PLC s p\u0159episov\u00e1n\u00edm konfigurace na sch\u00e9matech a p\u0159itom zastavit tov\u00e1rnu. <\/p>\n

<\/a><\/noindex><\/p>\n

Tak tedy p\u0159i\u0161lo na sv\u011bt pojmenov\u00e1n\u00ed IT&OT (Informa\u010dn\u00ed technologie & Provozn\u00ed technologie). <\/p>\n

<\/p>\n

U\u017e to hned vedlo, (je jasn\u00e9, \u017ee nen\u00ed mo\u017en\u00e9 povolovat pr\u00e1ci nekvalifikovan\u00fdm pracovn\u00edk\u016fm) k pot\u0159eb\u011b certifikovat specialisty v oblasti, kter\u00e1 se t\u00fdk\u00e1 zabezpe\u010den\u00ed \u0159\u00edd\u00edc\u00edch syst\u00e9m\u016f, pr\u016fmyslov\u00fdch syst\u00e9m\u016f \u2013 kter\u00fdch se evidentn\u011b v na\u0161em \u017eivot\u011b stalo velmi mnoho, od automatick\u00e9ho ventilu na p\u0159\u00edvod vody v dom\u00e1cnosti a\u017e po syst\u00e9my \u0159\u00edzen\u00ed letadel (vzpom\u00edn\u00e1me na skv\u011bl\u00fd \u010dl\u00e1nek o vy\u0161et\u0159ov\u00e1n\u00ed probl\u00e9m\u016f Boeing<\/a><\/noindex>). A dokonce, jak se neo\u010dek\u00e1van\u011b uk\u00e1zalo \u2013 i slo\u017eit\u00fdch l\u00e9ka\u0159sk\u00fdch p\u0159\u00edstroj\u016f. <\/p>\n

<\/p>\n

Kr\u00e1tk\u00e1 \u00favaha, jak jsem se dostal k pot\u0159eb\u011b z\u00edskat certifikaci (m\u016f\u017eete p\u0159esko\u010dit): Po \u00fasp\u011b\u0161n\u00e9m absolvov\u00e1n\u00ed na konci nult\u00fdch let na fakult\u011b ochrany informac\u00ed jsem s hrd\u011b vzty\u010denou hlavou vkro\u010dil do \u0159ad pracovn\u00edk\u016f KIP, pracuj\u00edc\u00ed jako technik bezpe\u010dnostn\u00edch syst\u00e9m\u016f. Na podniku mi bylo \u0159e\u010deno, \u017ee to je kybernetick\u00e1 bezpe\u010dnost :) Tak za\u010dala m\u00e1 kari\u00e9ra v oboru \u0159\u00edd\u00edc\u00edch syst\u00e9m\u016f s diplomem bakal\u00e1\u0159e v oboru kybernetick\u00e9 bezpe\u010dnosti. Po \u0161esti letech, kdy\u017e jsem se stal vedouc\u00edm odd\u011blen\u00ed syst\u00e9m\u016f SCADA, jsem ode\u0161el pracovat jako konzultant pro bezpe\u010dnost pr\u016fmyslov\u00fdch \u0159\u00eddic\u00edch syst\u00e9m\u016f do zahrani\u010dn\u00ed spole\u010dnosti specializuj\u00edc\u00ed se na software a za\u0159\u00edzen\u00ed. A pr\u00e1v\u011b zde se objevila pot\u0159eba b\u00fdt certifikovan\u00fdm specialistou na kybernetickou bezpe\u010dnost. <\/p>\n

<\/p>\n

GIAC<\/a><\/noindex> je v\u00fdvoj SANS<\/a><\/noindex> organizace, kter\u00e1 se zab\u00fdv\u00e1 po\u0159\u00e1d\u00e1n\u00edm \u0161kolen\u00ed a certifikac\u00ed specialist\u016f v oblasti informa\u010dn\u00ed bezpe\u010dnosti. Reputace certifik\u00e1tu od GIAC je mezi specialisty a objednavateli na trz\u00edch EMEA, USA a Asie Pacifiku velmi vysok\u00e1. U n\u00e1s, na post-sov\u011btsk\u00e9m prostoru a v zem\u00edch SNS, takov\u00fd certifik\u00e1t mohou vy\u017eadovat pouze zahrani\u010dn\u00ed spole\u010dnosti, kter\u00e9 maj\u00ed podnik\u00e1n\u00ed v na\u0161ich zem\u00edch, mezin\u00e1rodn\u00ed a konzulta\u010dn\u00ed agentury. Osobn\u011b jsem se nikdy nesetkal se \u017e\u00e1dost\u00ed o takovou certifikaci od dom\u00e1c\u00edch spole\u010dnost\u00ed. V\u0161ichni v\u011bt\u0161inou \u017e\u00e1daj\u00ed CISSP. To je m\u016fj subjektivn\u00ed n\u00e1zor, a pokud se n\u011bkdo pod\u011bl\u00ed o sv\u00e9 zku\u0161enosti v koment\u00e1\u0159\u00edch \u2013 r\u00e1d se dozv\u00edm.<\/p>\n

<\/p>\n

V SANS je dost r\u016fzn\u00fdch sm\u011br\u016f (podle m\u00e9ho n\u00e1zoru, v posledn\u00ed dob\u011b kluci p\u0159\u00edli\u0161 roz\u0161\u00ed\u0159ili jejich mno\u017estv\u00ed), ale jsou zde i velmi zaj\u00edmav\u00e9 praktick\u00e9 kurzy. Zvl\u00e1\u0161\u0165 se mi l\u00edbil NetWars<\/a><\/noindex>. Ale p\u0159\u00edb\u011bh p\u016fjde o kurzu ICS410: ICS\/SCADA Security Essentials <\/a><\/noindex> a certifik\u00e1tu s n\u00e1zvem: Global Industrial Cyber Security Professional (GICSP)<\/a><\/noindex>.<\/p>\n

<\/p>\n

Z v\u0161ech nab\u00edzen\u00fdch certifikac\u00ed SANS v oblasti pr\u016fmyslov\u00e9 kybernetick\u00e9 bezpe\u010dnosti je tato nejuniverz\u00e1ln\u011bj\u0161\u00ed. Proto\u017ee druh\u00e1 se vztahuje v\u00edce k syst\u00e9m\u016fm Power Grid, kter\u00fdm se na z\u00e1pad\u011b v\u011bnuje zvl\u00e1\u0161tn\u00ed pozornost a pat\u0159\u00ed do samostatn\u00e9 t\u0159\u00eddy syst\u00e9m\u016f. A t\u0159et\u00ed (v dob\u011b m\u00e9 certifikace) se vztahovala na Incident Response.
\nKurz nestoj\u00ed m\u00e1lo, ale poskytuje dost rozs\u00e1hl\u00e9 znalosti o IT&OT. Zvl\u00e1\u0161\u0165 bude u\u017eite\u010dn\u00fd t\u011bm kamar\u00e1d\u016fm, kte\u0159\u00ed se rozhodli zm\u011bnit svou oblast, nap\u0159\u00edklad z IT bezpe\u010dnosti v bankovn\u00edm sektoru na pr\u016fmyslovou kybernetickou bezpe\u010dnost. Proto\u017ee u\u017e jsem m\u011bl background v oblasti A\u0421\u0423\u0422\u041f, K\u0418P a Operational Technology, pro m\u011b nebylo v tomto kurzu nic z\u00e1sadn\u011b nov\u00e9ho nebo \u017eivotn\u011b d\u016fle\u017eit\u00e9ho.<\/p>\n

<\/p>\n

Kurz se skl\u00e1d\u00e1 z 50 % teorie a 50 % praxe. Z praktick\u00e9 \u010d\u00e1sti byl nejzaj\u00edmav\u011bj\u0161\u00ed contest \u2013 NetWars. Po dobu dvou dn\u016f, po hlavn\u00edm kurzu, byli v\u0161ichni studenti ze v\u0161ech t\u0159\u00edd rozd\u011bleni do t\u00fdm\u016f a plnili \u00fakoly na z\u00edsk\u00e1n\u00ed p\u0159\u00edstupov\u00fdch pr\u00e1v, vyta\u017een\u00ed pot\u0159ebn\u00fdch informac\u00ed, z\u00edsk\u00e1n\u00ed p\u0159\u00edstupu do s\u00edt\u011b, mno\u017estv\u00ed \u00fakol\u016f spojen\u00fdch s prolomen\u00edm hash\u016f, pr\u00e1ce s Wiresharkem a r\u016fzn\u00e9 dal\u0161\u00ed z\u00e1le\u017eitosti. <\/p>\n

<\/p>\n

Materi\u00e1l kurzu m\u00e1 stru\u010dn\u00fd p\u0159ehled ve form\u011b knih, kter\u00e9 pak z\u00edsk\u00e1te do trval\u00e9ho u\u017e\u00edv\u00e1n\u00ed. Mimochodem, tyto knihy si m\u016f\u017eete vz\u00edt s sebou na zkou\u0161ku, proto\u017ee form\u00e1t je Open Book, ale moc v\u00e1m tam nepomohou, proto\u017ee na zkou\u0161ku m\u00e1te 3 hodiny, 115 ot\u00e1zek a jazyk zkou\u0161ky je angli\u010dtina. B\u011bhem v\u0161ech 3 hodin si m\u016f\u017eete vz\u00edt pauzu na 15 minut. Ale pamatujte, \u017ee pokud si ud\u011bl\u00e1te pauzu na 15 minut a vr\u00e1t\u00edte se k test\u016fm za 5 minut, vlastn\u011b ztr\u00e1c\u00edte zbyl\u00fdch 10 minut, proto\u017ee v\u00edc \u010dasu v programu testov\u00e1n\u00ed zastavit nelze. M\u016f\u017eete vynechat a\u017e 15 ot\u00e1zek, kter\u00e9 se pak objev\u00ed na konci. <\/p>\n

<\/p>\n

Osobn\u011b nedoporu\u010duji nechat a\u017e na pozd\u011bji mnoho ot\u00e1zek, proto\u017ee \u010das ve 3 hodin\u00e1ch je opravdu m\u00e1lo a kdy\u017e na konci vyvstane je\u0161t\u011b nevy\u0159e\u0161en\u00e9 ot\u00e1zky, je velk\u00e1 pravd\u011bpodobnost, \u017ee to nestihnete. J\u00e1 jsem si \u201ena pozd\u011bji\u201c nechal jen t\u0159i ot\u00e1zky, kter\u00e9 byly pro m\u011b opravdu t\u011b\u017ek\u00e9, proto\u017ee se t\u00fdkaly znalosti standardu NIST 800.82 a NERC. Psychologicky takov\u00e9 ot\u00e1zky \u201ena pozd\u011bji\u201c p\u016fsob\u00ed nervov\u011b na konci \u2014 kdy\u017e je v\u00e1\u0161 mozek unaven\u00fd, chcete na toaletu a \u010dasom\u00edra na obrazovce jakoby zrychluje geometrickou \u0159adou. <\/p>\n

<\/p>\n

Obecn\u011b plat\u00ed, \u017ee k \u00fasp\u011b\u0161n\u00e9mu slo\u017een\u00ed testu mus\u00edte z\u00edskat 71 % spr\u00e1vn\u00fdch odpov\u011bd\u00ed. P\u0159ed kon\u00e1n\u00edm zkou\u0161ky budete m\u00edt mo\u017enost tr\u00e9novat na re\u00e1ln\u00fdch testech \u2013 proto\u017ee v cen\u011b jsou zahrnuty 2 tr\u00e9ninkov\u00e9 testy se 115 ot\u00e1zkami a podm\u00ednkami, kter\u00e9 jsou podobn\u00e9 skute\u010dn\u00e9 zkou\u0161ce.<\/p>\n

<\/p>\n

Doporu\u010duji ud\u011blat zkou\u0161ku m\u011bs\u00edc po absolvov\u00e1n\u00ed \u0161kolen\u00ed, p\u0159i\u010dem\u017e tento m\u011bs\u00edc v\u011bnujte systematick\u00e9mu samostudiu ot\u00e1zek, ve kter\u00fdch se c\u00edt\u00edte nejist\u011b. Bylo by skv\u011bl\u00e9, kdybyste si vzali ti\u0161t\u011bn\u00e9 materi\u00e1ly z kurzu, kter\u00e9 vypadaj\u00ed jako stru\u010dn\u00e9 pozn\u00e1mky k jednotliv\u00fdm t\u00e9mat\u016fm \u2013 a c\u00edlen\u011b hledali informace k t\u00e9mat\u016fm, kter\u00e9 se v t\u011bchto knih\u00e1ch nach\u00e1zej\u00ed. Rozd\u011blte si m\u011bs\u00edc na dv\u011b \u010d\u00e1sti, p\u0159i\u010dem\u017e provedete zku\u0161ebn\u00ed testy a z\u00edsk\u00e1te p\u0159ehled o tom, v jak\u00fdch ot\u00e1zk\u00e1ch jste siln\u00ed a kde je t\u0159eba se zlep\u0161it. <\/p>\n

<\/p>\n

Cht\u011bl bych vyzdvihnout n\u00e1sleduj\u00edc\u00ed hlavn\u00ed oblasti, z nich\u017e se skl\u00e1d\u00e1 samotn\u00e1 zkou\u0161ka (ne v\u00fdukov\u00fd kurz, proto\u017ee ten pokr\u00fdv\u00e1 mnohem \u0161ir\u0161\u00ed t\u00e9mata):<\/p>\n

<\/p>\n

    \n
  1. Fyzick\u00e1 bezpe\u010dnost: stejn\u011b jako u jin\u00fdch certifika\u010dn\u00edch zkou\u0161ek, i t\u00e9to problematice je v GICSP v\u011bnov\u00e1na zna\u010dn\u00e1 pozornost. Objevuj\u00ed se ot\u00e1zky t\u00fdkaj\u00edc\u00ed se r\u016fzn\u00fdch druh\u016f fyzick\u00fdch z\u00e1mk\u016f na dve\u0159\u00edch, popisuj\u00ed se situace s pad\u011bl\u00e1n\u00edm elektronick\u00fdch pr\u016fkaz\u016f, kde je pot\u0159eba poskytnout odpov\u011b\u010f k jednozna\u010dn\u00e9 identifikaci probl\u00e9mu. Lze nal\u00e9zt ot\u00e1zky p\u0159\u00edmo souvisej\u00edc\u00ed s bezpe\u010dnost\u00ed technologie (procesu) v z\u00e1vislosti na p\u0159edm\u011btu \u2013 procesy v oblasti ropy a plynu, jadern\u00e9 elektr\u00e1rny nebo elektrick\u00e9 s\u00edt\u011b. Nap\u0159\u00edklad se m\u016f\u017ee objevit ot\u00e1zka: Jak\u00fd typ fyzick\u00e9 bezpe\u010dnostn\u00ed kontroly p\u0159edstavuje situace, kdy alarm p\u0159ich\u00e1z\u00ed ze senzoru teploty p\u00e1ry na HMI? Nebo ot\u00e1zka: Jak\u00e1 situace (ud\u00e1lost) by vedla k proveden\u00ed anal\u00fdzy videoz\u00e1znam\u016f z kamer monitorovac\u00edho syst\u00e9mu perimetrick\u00e9 bezpe\u010dnosti objektu?\n

    V procentu\u00e1ln\u00edm vyj\u00e1d\u0159en\u00ed bych uvedl, \u017ee po\u010det ot\u00e1zek t\u00fdkaj\u00edc\u00edch se t\u00e9to oblasti na m\u00e9m zkou\u0161ce a v p\u0159\u00edpravn\u00fdch testech nep\u0159es\u00e1hl 5%.<\/li>\n

  2. Dal\u0161\u00ed a jednou z nejmasov\u011bj\u0161\u00edch kategori\u00ed ot\u00e1zek jsou ot\u00e1zky t\u00fdkaj\u00edc\u00ed se AIS, PLC, SCADA: zde bude nutn\u00e9 systematicky p\u0159istoupit k studiu materi\u00e1l\u016f o tom, jak funguj\u00ed \u0159\u00eddic\u00ed syst\u00e9my technologick\u00fdch proces\u016f, po\u010d\u00ednaje senzory a kon\u010de servery, kde b\u011b\u017e\u00ed samotn\u00fd aplika\u010dn\u00ed software. Odpov\u00eddaj\u00edc\u00ed mno\u017estv\u00ed ot\u00e1zek se bude vztahovat na r\u016fzn\u00e9 typy pr\u016fmyslov\u00fdch komunika\u010dn\u00edch protokol\u016f (ModBus, RTU, Profibus, HART apod.). Budou ot\u00e1zky o tom, \u010d\u00edm se RTU li\u0161\u00ed od PLC, jak chr\u00e1nit data v PLC p\u0159ed modifikac\u00ed \u00fato\u010dn\u00edkem, v jak\u00fdch oblastech pam\u011bti PLC se ukl\u00e1daj\u00ed data a kde se nach\u00e1z\u00ed samotn\u00e1 logika (program napsan\u00fd program\u00e1torem AIS). Nap\u0159\u00edklad m\u016f\u017ee b\u00fdt ot\u00e1zka tohoto typu: Jak\u00fdm zp\u016fsobem lze detekovat \u00fatok mezi PLC a HMI, kter\u00e9 pracuj\u00ed podle protokolu ModBus?\n

    Objev\u00ed se ot\u00e1zky o rozd\u00edlech mezi syst\u00e9my SCADA a DCS. Velk\u00e9 mno\u017estv\u00ed ot\u00e1zek o pravidlech segmentace s\u00edt\u00ed AIS na \u00farovni L1, L2 od \u00farovn\u011b L3 (podrobn\u011bji pop\u00ed\u0161u v sekci s ot\u00e1zkami o s\u00edti). Situativn\u00ed ot\u00e1zky v t\u00e9to oblasti budou tak\u00e9 velmi r\u016fznorod\u00e9 \u2013 popisuj\u00ed situaci v dispe\u010dersk\u00e9m centru a je t\u0159eba vybrat akce, kter\u00e9 by m\u011bly b\u00fdt provedeny oper\u00e1torem procesu nebo dispe\u010derem.<\/p>\n

    Tato sekce je obecn\u011b nejv\u00edce specifick\u00e1 a \u00fazkoprofilov\u00e1. Bude vy\u017eadovat dobr\u00e9 znalosti:
    \n \u2014 \u0159\u00edzen\u00ed automatizace a \u0159\u00edzen\u00ed proces\u016f, ter\u00e9nn\u00ed \u010d\u00e1st (senzory, typy p\u0159ipojen\u00ed za\u0159\u00edzen\u00ed, fyzick\u00e9 vlastnosti senzor\u016f, PLC, RTU);
    \n \u2014 syst\u00e9my protipo\u017e\u00e1rn\u00ed ochrany (ESD \u2013 emergency shutdown system) proces\u016f a objekt\u016f (mimochodem, na Habr je skv\u011bl\u00e1 s\u00e9rie \u010dl\u00e1nk\u016f na toto t\u00e9ma od     Vladimir_Sklyar<\/a><\/noindex>)
    \n \u2014 z\u00e1kladn\u00ed porozum\u011bn\u00ed fyzik\u00e1ln\u00edm proces\u016fm, kter\u00e9 prob\u00edhaj\u00ed nap\u0159\u00edklad v rafinaci ropy, v\u00fdrob\u011b elektrick\u00e9 energie, potrub\u00edch atd.;
    \n \u2014 porozum\u011bn\u00ed architektur\u00e1m DCS a SCADA syst\u00e9m\u016f;
    \nR\u00e1d bych zd\u016fraznil, \u017ee ot\u00e1zky tohoto typu se mohou objevit a\u017e u 25 % ze v\u0161ech 115 ot\u00e1zek zkou\u0161ky. <\/li>\n

  3. S\u00ed\u0165ov\u00e9 technologie a s\u00ed\u0165ov\u00e1 bezpe\u010dnost: Mysl\u00edm, \u017ee mno\u017estv\u00ed ot\u00e1zek na toto t\u00e9ma bude na prvn\u00edm m\u00edst\u011b v zkou\u0161ce. O\u010dek\u00e1vejte t\u00e9m\u011b\u0159 cokoliv \u2013 model OSI, na jak\u00fdch \u00farovn\u00edch funguje ur\u010dit\u00fd protokol, spoustu ot\u00e1zek ohledn\u011b segmentace s\u00edt\u011b, situativn\u00ed ot\u00e1zky o s\u00ed\u0165ov\u00fdch \u00fatoc\u00edch, p\u0159\u00edklady log\u016f p\u0159ipojen\u00ed s n\u00e1vrhem ur\u010dit typ \u00fatoku, p\u0159\u00edklady konfigurac\u00ed switch\u016f s n\u00e1vrhem ur\u010dit zranitelnou konfiguraci, ot\u00e1zky ohledn\u011b zranitelnost\u00ed s\u00ed\u0165ov\u00fdch protokol\u016f, ot\u00e1zky t\u00fdkaj\u00edc\u00ed se specifik s\u00edt\u00ed pr\u016fmyslov\u00fdch komunika\u010dn\u00edch protokol\u016f. Zvl\u00e1\u0161tn\u00ed pozornost v\u011bnuj\u00ed ModBus. Struktura s\u00ed\u0165ov\u00fdch paket\u016f t\u00e9ho\u017e ModBus v z\u00e1vislosti na jeho variant\u011b a podporovan\u00fdch verz\u00edch za\u0159\u00edzen\u00ed. Velk\u00e1 pozornost je v\u011bnov\u00e1na \u00fatok\u016fm na bezdr\u00e1tov\u00e9 s\u00edt\u011b \u2013 ZigBee, Wireless HART, ot\u00e1zky ohledn\u011b s\u00ed\u0165ov\u00e9 bezpe\u010dnosti cel\u00e9 rodiny 802.1x. Budou ot\u00e1zky ohledn\u011b pravidel um\u00edst\u011bn\u00ed r\u016fzn\u00fdch server\u016f v s\u00edti \u0159\u00edzen\u00ed podnikov\u00fdch proces\u016f (zde je pot\u0159eba p\u0159e\u010d\u00edst normu IEC-62443 a pochopit principy etalonov\u00fdch model\u016f s\u00edt\u00ed \u0159\u00edzen\u00ed podnikov\u00fdch proces\u016f). Setk\u00e1te se s ot\u00e1zkami podle Poudurovy modelu.<\/li>\n
  4. Kategorie ot\u00e1zek, kter\u00e9 se t\u00fdkaj\u00ed v\u00fdlu\u010dn\u011b funk\u010dn\u00edch rys\u016f provozu syst\u00e9m\u016f p\u0159enosu elektrick\u00e9 energie a syst\u00e9m\u016f informa\u010dn\u00ed bezpe\u010dnosti pro n\u011b. V USA se tato kategorie syst\u00e9m\u016f \u0159\u00edzen\u00ed technologick\u00fdch proces\u016f naz\u00fdv\u00e1 Power Grid a m\u00e1 samostatnou roli. Pro tento \u00fa\u010del jsou dokonce vyd\u00e1v\u00e1ny zvl\u00e1\u0161tn\u00ed standardy (NIST 800.82), kter\u00e9 reguluj\u00ed p\u0159\u00edstup k vytv\u00e1\u0159en\u00ed syst\u00e9m\u016f informa\u010dn\u00ed bezpe\u010dnosti pro tento sektor. V na\u0161ich zem\u00edch je tento sektor v\u011bt\u0161inou omezen na syst\u00e9my A\u0421KUE (opravte m\u011b, pokud n\u011bkdo narazil na v\u00e1\u017en\u011bj\u0161\u00ed p\u0159\u00edstup k monitorov\u00e1n\u00ed syst\u00e9m\u016f distribuce a dod\u00e1vky elektrick\u00e9 energie). Na zkou\u0161ce se setk\u00e1te s dost specifick\u00fdmi ot\u00e1zkami t\u00fdkaj\u00edc\u00edmi se Power Grid. V\u011bt\u0161inou to byly use-cases pro ur\u010ditou situaci, kter\u00e1 se odehr\u00e1vala na elektr\u00e1rn\u011b, ale mohou b\u00fdt tak\u00e9 ot\u00e1zky t\u00fdkaj\u00edc\u00ed se za\u0159\u00edzen\u00ed, kter\u00e9 se pou\u017e\u00edvaj\u00ed pr\u00e1v\u011b v Power Grid. Budou ot\u00e1zky zam\u011b\u0159en\u00e9 na znalost sekc\u00ed NIST pro tuto kategorii syst\u00e9m\u016f.<\/li>\n
  5. Ot\u00e1zky t\u00fdkaj\u00edc\u00ed se znalosti standard\u016f: NIST 800-82, NERC, IEC62443. Mysl\u00edm, \u017ee zde bez zvl\u00e1\u0161tn\u00edch koment\u00e1\u0159\u016f \u2013 je t\u0159eba se orientovat v sekc\u00edch standard\u016f, kdo za co odpov\u00edd\u00e1 a jak\u00e1 doporu\u010den\u00ed obsahuj\u00ed. Objevuj\u00ed se konkr\u00e9tn\u00ed ot\u00e1zky, nap\u0159\u00edklad o frekvenci kontroly funk\u010dnosti syst\u00e9mu, frekvenci aktualizace procedur atd. V procentu\u00e1ln\u00edm vyj\u00e1d\u0159en\u00ed m\u016f\u017ee b\u00fdt takov\u00fdch ot\u00e1zek a\u017e 15% z celkov\u00e9ho po\u010dtu ot\u00e1zek. Ale jak to vyjde. Nap\u0159\u00edklad v dvou zku\u0161ebn\u00edch testech jsem narazil jen na p\u00e1r takov\u00fdch ot\u00e1zek. Ale na zkou\u0161ce jich bylo opravdu hodn\u011b.<\/li>\n
  6. A posledn\u00ed kategori\u00ed ot\u00e1zek jsou r\u016fzn\u00e9 use-cases a situativn\u00ed ot\u00e1zky. <\/li>\n<\/ol>\n

    <\/p>\n

    Celkov\u011b, samotn\u00fd tr\u00e9nink, krom\u011b pravd\u011bpodobn\u011b CTF NetWars, pro m\u011b nebyl p\u0159\u00edli\u0161 informativn\u00ed z hlediska z\u00edsk\u00e1n\u00ed potenci\u00e1ln\u011b nov\u00fdch znalost\u00ed. Sp\u00ed\u0161e byly z\u00edsk\u00e1ny hlub\u0161\u00ed detaily n\u011bkter\u00fdch t\u00e9mat, zejm\u00e9na v oblasti organizace a ochrany radiov\u00fdch s\u00edt\u00ed, kter\u00e9 se pou\u017e\u00edvaj\u00ed pro p\u0159enos technologick\u00fdch informac\u00ed, a tak\u00e9 l\u00e9pe uspo\u0159\u00e1dan\u00fd materi\u00e1l o struktu\u0159e zahrani\u010dn\u00edch standard\u016f v\u011bnovan\u00fdch t\u00e9to problematice. Proto pro in\u017een\u00fdry a specialisty, kte\u0159\u00ed maj\u00ed dostate\u010dn\u00e9 znalosti a zku\u0161enosti s A\u0421\u0423\u0422\u041f\/K\u0418\u041f nebo pr\u016fmyslov\u00fdmi s\u00edt\u011bmi, se vyplat\u00ed zv\u00e1\u017eit mo\u017enost u\u0161et\u0159it na tr\u00e9ninku (a to m\u00e1 smysl), p\u0159ipravit se sami a rovnou j\u00edt skl\u00e1dat certifika\u010dn\u00ed zkou\u0161ku, kter\u00e1 mimochodem stoj\u00ed 700 USD. V p\u0159\u00edpad\u011b ne\u00fasp\u011bchu bude t\u0159eba zaplatit znovu. Certifika\u010dn\u00edch center, kter\u00e1 v\u00e1s p\u0159ijmou na zkou\u0161ku, je dostatek, hlavn\u011b je pot\u0159eba v\u010das podat p\u0159ihl\u00e1\u0161ku. Obecn\u011b doporu\u010duji hned stanovit datum zkou\u0161ky, proto\u017ee jinak ji budete neust\u00e1le odkl\u00e1dat a nahrazovat proces p\u0159\u00edpravy jin\u00fdmi \u017eivotn\u011b a m\u00e9n\u011b d\u016fle\u017eit\u00fdmi z\u00e1le\u017eitostmi. A s konkr\u00e9tn\u00edm datem jako term\u00ednem budete m\u00edt osobn\u00ed motivaci.<\/p>\n

    Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442! \u041d\u0430 \u0432\u0441\u0435\u043c\u0438 \u043b\u044e\u0431\u0438\u043c\u043e\u043c \u043f\u043e\u0440\u0442\u0430\u043b\u0435 \u0431\u044b\u043b\u043e \u043c\u043d\u043e\u0433\u043e \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u043f\u043e \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0418\u0411, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043f\u0440\u0435\u0442\u0435\u043d\u0434\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0438 \u043d\u0435\u043f\u043e\u0432\u0442\u043e\u0440\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0430 \u043d\u0435 \u0441\u043e\u0431\u0438\u0440\u0430\u044e\u0441\u044c, \u043d\u043e \u0432\u0441\u0435 \u0436\u0435 \u043e\u0447\u0435\u043d\u044c \u0445\u043e\u0442\u0435\u043b \u0431\u044b \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u0441\u0432\u043e\u0438\u043c \u043e\u043f\u044b\u0442\u043e\u043c \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f GIAC (Global Information Assurance Company) \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0439 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0421\u043e \u0432\u0440\u0435\u043c\u0435\u043d \u043f\u043e\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0442\u0430\u043a\u0438\u0445 \u0441\u0442\u0440\u0430\u0448\u043d\u044b\u0445 \u0441\u043b\u043e\u0432 \u043a\u0430\u043a Stuxnet, Duqu, Shamoon, Triton, […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37831","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Jak z\u00edskali kazaci certifik\u00e1t GICSP | ProHoster","description":"Ahoj v\u0161ichni!","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/kak-kazaki-gicsp-sertifikat-poluchali","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u043a\u0430\u0437\u0430\u043a\u0438 GICSP \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u043f\u043e\u043b\u0443\u0447\u0430\u043b\u0438 | ProHoster","og:description":"\u0412\u0441\u0435\u043c \u043f\u0440\u0438\u0432\u0435\u0442!","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/kak-kazaki-gicsp-sertifikat-poluchali","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:20:00+00:00","article:modified_time":"2019-10-31T19:20:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37831","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 19:26:35","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:20:22","updated":"2026-01-23 19:26:35","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37831","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=37831"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/37831\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=37831"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=37831"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=37831"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}