{"id":53243,"date":"2019-11-27T00:00:00","date_gmt":"2019-11-26T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/bolshe-chem-antispam-kak-vyzhat-maksimum-iz-security-email-gateway"},"modified":"2020-02-18T14:01:07","modified_gmt":"2020-02-18T11:01:07","slug":"bolshe-chem-antispam-kak-vyzhat-maksimum-iz-security-email-gateway","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/bolshe-chem-antispam-kak-vyzhat-maksimum-iz-security-email-gateway","title":{"rendered":"V\u00edce ne\u017e jen antispam: jak vyt\u011b\u017eit maximum z Security Email Gateway","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Zat\u00edmco velk\u00e9 firmy buduj\u00ed v\u00edce\u00farov\u0148ov\u00e9 obrany proti potenci\u00e1ln\u00edm vnit\u0159n\u00edm zlo\u010dinc\u016fm a hacker\u016fm, pro men\u0161\u00ed spole\u010dnosti z\u016fst\u00e1v\u00e1 bolest\u00ed hlavy phishing a spamov\u00e9 zpr\u00e1vy. Kdyby Marty McFly v\u011bd\u011bl, \u017ee v roce 2015 (a t\u00edm sp\u00ed\u0161e v roce 2020) lid\u00e9 nejen\u017ee nevynalezli hoverboardy, ale ani se nenau\u010dili \u00fapln\u011b zbavit nevy\u017e\u00e1dan\u00e9 po\u0161ty, pravd\u011bpodobn\u011b by ztratil v\u00edru v lidstvo. Co v\u00edc, spam dnes nen\u00ed jen otravn\u00fd, ale \u010dasto tak\u00e9 \u0161kodliv\u00fd. V p\u0159ibli\u017en\u011b 70 % p\u0159\u00edpad\u016f, kdy kyberzlo\u010dinci realizuj\u00ed killchain, pronikaj\u00ed do infrastruktury pomoc\u00ed malware obsa\u017een\u00e9ho v p\u0159\u00edloh\u00e1ch nebo prost\u0159ednictv\u00edm phishingov\u00fdch odkaz\u016f v e-mailech.<\/p>\n<p><img decoding=\"async\" alt=\"V\u00edce ne\u017e jen antispam: jak vyt\u011b\u017eit maximum z Security Email Gateway\" src=\"\/wp-content\/uploads\/2019\/11\/57a9c0158eed4e406fa69f07d93701d3.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nV posledn\u00ed dob\u011b je jasn\u011b patrn\u00e1 tendence k \u0161\u00ed\u0159en\u00ed soci\u00e1ln\u00edho in\u017een\u00fdrstv\u00ed jako zp\u016fsobu proniknut\u00ed do infrastruktury organizace. P\u0159i porovn\u00e1n\u00ed statistik z let 2017 a 2018 sledujeme t\u00e9m\u011b\u0159 50procentn\u00ed n\u00e1r\u016fst p\u0159\u00edpad\u016f, kdy byl malware dod\u00e1n na po\u010d\u00edta\u010de zam\u011bstnanc\u016f prost\u0159ednictv\u00edm p\u0159\u00edloh nebo phishingov\u00fdch odkaz\u016f v textu e-mailu. <\/p>\n<p>Celkov\u011b lze spektrum hrozeb, kter\u00e9 mohou b\u00fdt realizov\u00e1ny pomoc\u00ed e-mailu, rozd\u011blit do n\u011bkolika kategori\u00ed:<\/p>\n<ul>\n<li>p\u0159\u00edchoz\u00ed spam <\/li>\n<li>za\u0159azen\u00ed po\u010d\u00edta\u010d\u016f organizace do botnetu, kter\u00fd rozes\u00edl\u00e1 odchoz\u00ed spam<\/li>\n<li>\u0161kodliv\u00e9 p\u0159\u00edlohy a viry v textu zpr\u00e1vy (mal\u00e9 spole\u010dnosti \u010dasto trp\u00ed masov\u00fdmi \u00fatoky typu Petya). <\/li>\n<\/ul>\n<p>\nPro ochranu p\u0159ed v\u0161emi typy \u00fatok\u016f lze bu\u010f nasadit n\u011bkolik IDS, nebo se vydat cestou servisn\u00edho modelu. U\u017e jsme <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/solarsecurity\/blog\/465877\/\">psali<\/a><\/noindex> o Jednotn\u00e9 platform\u011b slu\u017eeb kybernetick\u00e9 bezpe\u010dnosti \u2013 j\u00e1dru ekosyst\u00e9mu \u0159\u00edzen\u00fdch slu\u017eeb kybernetick\u00e9 bezpe\u010dnosti Solar MSS. Mimo jin\u00e9 zahrnuje tak\u00e9 virtualizovanou technologii Secure Email Gateway (SEG). Obvykle si tuto slu\u017ebu p\u0159edpl\u00e1cej\u00ed mal\u00e9 spole\u010dnosti, kde byly v\u0161echny funkce IT a bezpe\u010dnosti sv\u011b\u0159eny jedn\u00e9 osob\u011b \u2013 syst\u00e9mov\u00e9mu administr\u00e1torovi. Spam je probl\u00e9m, kter\u00fd je v\u017edy na o\u010d\u00edch u\u017eivatel\u016fm a veden\u00ed, a nelze ho ignorovat. Postupem \u010dasu v\u0161ak i veden\u00ed za\u010d\u00edn\u00e1 ch\u00e1pat, \u017ee jen \u201ehodit\u201c to adminovi nen\u00ed \u0159e\u0161en\u00ed \u2013 zab\u00edr\u00e1 to p\u0159\u00edli\u0161 mnoho \u010dasu. <\/p>\n<p><img decoding=\"async\" alt=\"V\u00edce ne\u017e jen antispam: jak vyt\u011b\u017eit maximum z Security Email Gateway\" src=\"\/wp-content\/uploads\/2019\/11\/a42e94fe1d2b5ed0976d27fe1b070ea1.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h2>2 hodiny na vy\u0159izov\u00e1n\u00ed e-mail\u016f - to je dost<\/h2>\n<p>\nS touto situac\u00ed se na n\u00e1s obr\u00e1til jeden z maloobchodn\u00edk\u016f. Syst\u00e9my sledov\u00e1n\u00ed pracovn\u00ed doby ukazovaly, \u017ee jeho zam\u011bstnanci ka\u017ed\u00fd den tr\u00e1v\u00ed p\u0159ibli\u017en\u011b 25% pracovn\u00ed doby (2 hodiny!) na vy\u0159izov\u00e1n\u00ed e-mail\u016f. <\/p>\n<p>P\u0159ipojen\u00edm po\u0161tovn\u00edho serveru z\u00e1kazn\u00edka jsme nastavili instance SEG jako obousm\u011brnou br\u00e1nu pro p\u0159\u00edchoz\u00ed i odchoz\u00ed po\u0161tu. Spustili jsme filtrov\u00e1n\u00ed podle p\u0159edem nastaven\u00fdch politik. Blacklist jsme vytvo\u0159ili na z\u00e1klad\u011b anal\u00fdzy poskytnut\u00fdch dat z\u00e1kazn\u00edkem a na\u0161ich vlastn\u00edch seznam\u016f potenci\u00e1ln\u011b nebezpe\u010dn\u00fdch adres z\u00edskan\u00fdch od expert\u016f Solar JSOC v r\u00e1mci jin\u00fdch slu\u017eeb \u2014 nap\u0159\u00edklad sledov\u00e1n\u00ed incident\u016f kybernetick\u00e9 bezpe\u010dnosti. Po tomto procesu byla ve\u0161ker\u00e1 po\u0161ta doru\u010dov\u00e1na adres\u00e1t\u016fm pouze po vy\u010di\u0161t\u011bn\u00ed a r\u016fzn\u00e9 spamov\u00e9 zpr\u00e1vy o \u201eohromn\u00fdch slev\u00e1ch\u201c p\u0159estaly v masov\u00e9m m\u011b\u0159\u00edtku bombardovat po\u0161tovn\u00ed servery z\u00e1kazn\u00edka, \u010d\u00edm\u017e se uvolnilo m\u00edsto pro jin\u00e9 pot\u0159eby. <\/p>\n<p>Ale byly i situace, kdy bylo legitimn\u00ed e-mailov\u00e9 zpr\u00e1vy omylem ozna\u010deno jako spam, nap\u0159\u00edklad od ned\u016fv\u011bryhodn\u00e9ho odes\u00edlatele. V takov\u00e9m p\u0159\u00edpad\u011b jsme nechali rozhodnut\u00ed na z\u00e1kazn\u00edkovi. Mo\u017enosti, co ud\u011blat, nejsou tak rozs\u00e1hl\u00e9: bu\u010f okam\u017eit\u011b odstranit, nebo poslat do karant\u00e9ny. Zvolili jsme druhou mo\u017enost, kde takov\u00e1 ne\u017e\u00e1douc\u00ed po\u0161ta z\u016fst\u00e1v\u00e1 na samotn\u00e9m SEG. Syst\u00e9mov\u00e9mu administr\u00e1torovi jsme poskytli p\u0159\u00edstup k webov\u00e9 konzoli, kde mohl kdykoli naj\u00edt d\u016fle\u017eit\u00fd e-mail, nap\u0159\u00edklad od obchodn\u00edho partnera, a doru\u010dit ho u\u017eivateli. <\/p>\n<h2>Zbavujeme se parazit\u016f<\/h2>\n<p>\nSlu\u017eba ochrany elektronick\u00e9 po\u0161ty zahrnuje analytick\u00e9 zpr\u00e1vy, jejich\u017e c\u00edlem je sledovat zabezpe\u010den\u00ed infrastruktury a \u00fa\u010dinnost pou\u017eit\u00fdch nastaven\u00ed. Tyto zpr\u00e1vy nav\u00edc umo\u017e\u0148uj\u00ed p\u0159edpov\u011bd\u011bt trendy. Nap\u0159\u00edklad v reportu nal\u00e9z\u00e1me odpov\u00eddaj\u00edc\u00ed sekci \u201eSpam podle p\u0159\u00edjemce\u201c nebo \u201eSpam podle odes\u00edlatele\u201c a sledujeme, na kterou adresu p\u0159ich\u00e1z\u00ed nejv\u011bt\u0161\u00ed po\u010det blokovan\u00fdch zpr\u00e1v. <\/p>\n<p>P\u0159i anal\u00fdze takov\u00e9 zpr\u00e1vy se n\u00e1m zd\u00e1la podez\u0159el\u00e1 prudce vzr\u016fstaj\u00edc\u00ed celkov\u00e1 \u010d\u00edsla e-mail\u016f u jednoho z na\u0161ich z\u00e1kazn\u00edk\u016f. Jeho infrastruktura je mal\u00e1, po\u010det e-mail\u016f nen\u00ed vysok\u00fd. A najednou se po pracovn\u00ed dob\u011b t\u00e9m\u011b\u0159 zdvojn\u00e1sobilo mno\u017estv\u00ed blokovan\u00e9ho spamu. Rozhodli jsme se pod\u00edvat na v\u011bc podrobn\u011bji.<\/p>\n<p><img decoding=\"async\" alt=\"V\u00edce ne\u017e jen antispam: jak vyt\u011b\u017eit maximum z Security Email Gateway\" src=\"\/wp-content\/uploads\/2019\/11\/d59ba7406906b18634475a5ddc879c76.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVid\u00edme, \u017ee se zv\u00fd\u0161il po\u010det odchoz\u00edch e-mail\u016f a ve v\u0161ech je v poli \u201eOdes\u00edlatel\u201c uvedena adresa z dom\u00e9ny, kter\u00e1 je pr\u00e1v\u011b p\u0159ipojena k slu\u017eb\u011b ochrany e-mailu. Ale je tu jeden h\u00e1\u010dek: mezi zcela rozumn\u00fdmi, mo\u017en\u00e1 i existuj\u00edc\u00edmi, adresami se objevuj\u00ed zjevn\u011b podivn\u00e9. Pod\u00edvali jsme se na IP adresy, ze kter\u00fdch byly e-maily odes\u00edl\u00e1ny, a jak se dalo o\u010dek\u00e1vat, uk\u00e1zalo se, \u017ee nepat\u0159\u00ed do chr\u00e1n\u011bn\u00e9ho adresn\u00edho prostoru. Je z\u0159ejm\u00e9, \u017ee \u00fato\u010dn\u00edk rozes\u00edlal spam jm\u00e9nem z\u00e1kazn\u00edka. <\/p>\n<p>V tomto p\u0159\u00edpad\u011b jsme pro z\u00e1kazn\u00edka p\u0159ipravili doporu\u010den\u00ed pro spr\u00e1vn\u00e9 nastaven\u00ed DNS z\u00e1znam\u016f, konkr\u00e9tn\u011b SPF. N\u00e1\u0161 specialista doporu\u010dil vytvo\u0159it TXT z\u00e1znam, kter\u00fd obsahuje pravidlo \u201ev=spf1 mx ip:1.2.3.4\/23 -all\u201c, kter\u00e9 obsahuje vy\u010derp\u00e1vaj\u00edc\u00ed seznam adres, jim\u017e je povoleno pos\u00edlat e-maily jm\u00e9nem chr\u00e1n\u011bn\u00e9 dom\u00e9ny. <\/p>\n<p>Odkud to plyne: spam jm\u00e9nem nikomu nezn\u00e1me mal\u00e9 firmy \u2014 to je nep\u0159\u00edjemn\u00e9, ale ne kritick\u00e9. Situace je \u00fapln\u011b jin\u00e1, nap\u0159\u00edklad v bankovnictv\u00ed. Podle na\u0161ich pozorov\u00e1n\u00ed se tam \u00farove\u0148 d\u016fv\u011bry ob\u011bti v\u016f\u010di phishingov\u00e9mu e-mailu mnohon\u00e1sobn\u011b zvy\u0161uje, pokud byl odesl\u00e1n \u00fadajn\u011b z dom\u00e9ny jin\u00e9 banky nebo zn\u00e1m\u00e9ho kontrahenta. A to se net\u00fdk\u00e1 pouze bankovn\u00edch zam\u011bstnanc\u016f; v jin\u00fdch odv\u011btv\u00edch, jako je energetika, se setk\u00e1v\u00e1me s obdobn\u00fdm trendem. <\/p>\n<h2>Zab\u00edj\u00edme viry<\/h2>\n<p>\nAle spoofing nen\u00ed tak \u010dast\u00fd probl\u00e9m jako nap\u0159\u00edklad virov\u00e9 infekce. A jak se nej\u010dast\u011bji bojuje s virov\u00fdmi epidemiemi? Instaluje se antivir a douf\u00e1 se, \u017ee \u201enep\u0159\u00edtel neprojde\u201c. Ale kdyby to bylo tak jednoduch\u00e9, vzhledem k relativn\u011b n\u00edzk\u00e9 cen\u011b antivir\u016f, u\u017e by si nikdo na probl\u00e9m malware nepamatoval. Mezit\u00edm dost\u00e1v\u00e1me neust\u00e1le \u017e\u00e1dosti \u201epomozte obnovit soubory, m\u00e1me v\u0161echno za\u0161ifrovan\u00e9, pr\u00e1ce stoj\u00ed, data jsou ztracena\u201c. Neust\u00e1le opakujeme na\u0161im z\u00e1kazn\u00edk\u016fm, \u017ee ani antivir nen\u00ed z\u00e1zra\u010dn\u00fd l\u00e9k. Krom\u011b toho, \u017ee antivirov\u00e9 datab\u00e1ze se nemus\u00ed dostate\u010dn\u011b rychle aktualizovat, \u010dasto nar\u00e1\u017e\u00edme na malware, kter\u00fd dok\u00e1\u017ee obch\u00e1zet nejen antiviry, ale i sandboxy. <\/p>\n<p>Bohu\u017eel, m\u00e1lo kdo ze zam\u011bstnanc\u016f organizac\u00ed je informov\u00e1n o phishingov\u00fdch a \u0161kodliv\u00fdch e-mailech a dok\u00e1\u017ee je rozli\u0161it od b\u011b\u017en\u00e9 komunikace. V pr\u016fm\u011bru se ka\u017ed\u00fd sedm\u00fd u\u017eivatel, kter\u00fd neproch\u00e1z\u00ed pravideln\u00fdm zvy\u0161ov\u00e1n\u00edm pov\u011bdom\u00ed, st\u00e1v\u00e1 ob\u011bt\u00ed soci\u00e1ln\u00edho in\u017een\u00fdrstv\u00ed: otev\u0159e infikovan\u00fd soubor nebo ode\u0161le sv\u00e9 \u00fadaje \u00fato\u010dn\u00edk\u016fm. <\/p>\n<p>I kdy\u017e soci\u00e1ln\u00ed vektor \u00fatok\u016f obecn\u011b neust\u00e1le m\u00edrn\u011b s\u00edlil, minul\u00fd rok se tento trend stal obzvl\u00e1\u0161\u0165 v\u00fdrazn\u00fdm. Phishingov\u00e9 e-maily se st\u00e1valy \u010d\u00edm d\u00e1l v\u00edce podobn\u00fdmi klasick\u00fdm newsletter\u016fm o akc\u00edch, nadch\u00e1zej\u00edc\u00edch ud\u00e1lostech atd. M\u016f\u017eeme si vzpomenout na \u00fatok Silence na finan\u010dn\u00ed sektor \u2013 bankovn\u00ed zam\u011bstnanci dost\u00e1vali e-mail, \u00fadajn\u011b s promo k\u00f3dem na \u00fa\u010dast na popul\u00e1rn\u00ed oborov\u00e9 konferenci iFin, a procento podveden\u00fdch bylo velmi vysok\u00e9, p\u0159esto\u017ee, p\u0159ipome\u0148me, \u0161lo o bankovn\u00ed sf\u00e9ru \u2013 tu nejpokro\u010dilej\u0161\u00ed z hlediska informa\u010dn\u00ed bezpe\u010dnosti. <\/p>\n<p>P\u0159ed minul\u00fdmi V\u00e1no\u010dn\u00edmi sv\u00e1tky jsme tak\u00e9 byli sv\u011bdky n\u011bkolika dost kuri\u00f3zn\u00edch situac\u00ed, kdy zam\u011bstnanci pr\u016fmyslov\u00fdch spole\u010dnost\u00ed dostali velmi kvalitn\u00ed phishingov\u00e9 e-maily se \u201eseznamem\u201c v\u00e1no\u010dn\u00edch akc\u00ed v popul\u00e1rn\u00edch internetov\u00fdch obchodech a promo k\u00f3dy na slevy. Zam\u011bstnanci se nejen sna\u017eili p\u0159ej\u00edt na odkaz, ale i p\u0159epos\u00edlali e-mail koleg\u016fm z p\u0159\u00edbuzn\u00fdch organizac\u00ed. Proto\u017ee byl zdroj, na kter\u00fd odkaz v phishingov\u00e9m e-mailu vedl, zablokov\u00e1n, zam\u011bstnanci za\u010dali hromadn\u011b pod\u00e1vat IT slu\u017eb\u011b \u017e\u00e1dosti o poskytnut\u00ed p\u0159\u00edstupu k n\u011bmu. \u00dasp\u011bch rozes\u00edlky pravd\u011bpodobn\u011b p\u0159ed\u010dil ve\u0161ker\u00e1 o\u010dek\u00e1v\u00e1n\u00ed \u00fato\u010dn\u00edk\u016f. <\/p>\n<p>Ned\u00e1vno n\u00e1s oslovila firma, kterou \u201eza\u0161ifrovali\u201c. V\u0161echno za\u010dalo t\u00edm, \u017ee zam\u011bstnanci \u00fa\u010detn\u00edho odd\u011blen\u00ed dostali e-mail, \u00fadajn\u011b od centr\u00e1ln\u00ed banky Rusk\u00e9 federace. \u00da\u010detn\u00ed klikl na odkaz v e-mailu \u2013 a st\u00e1hl si na sv\u016fj po\u010d\u00edta\u010d miner WannaMine, kter\u00fd, jako zn\u00e1m\u00fd WannaCry, vyu\u017e\u00edval zranitelnost EternalBlue. Nejzaj\u00edmav\u011bj\u0161\u00ed je, \u017ee v\u011bt\u0161ina antivir\u016f dok\u00e1\u017ee detekovat jeho signatury u\u017e od za\u010d\u00e1tku roku 2018. Ale a\u0165 u\u017e byl antivir vypnut\u00fd, datab\u00e1ze nebyly aktualizov\u00e1ny, nebo v\u016fbec nebyl nainstalov\u00e1n, \u2013 v ka\u017ed\u00e9m p\u0159\u00edpad\u011b miner u\u017e byl na po\u010d\u00edta\u010di, a nic mu nezabr\u00e1nilo \u0161\u00ed\u0159it se d\u00e1l po s\u00edti, zat\u011b\u017euj\u00edc CPU <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/cs\/server\/\"   title=\"servery\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"1457\">servery<\/a> a RAM na 100%.<\/p>\n<p>Tento klient, pot\u00e9 co obdr\u017eel zpr\u00e1vu na\u0161\u00ed forenzn\u00ed skupiny, zjistil, \u017ee virus se k n\u011bmu p\u016fvodn\u011b dostal p\u0159es e-mail, a zah\u00e1jil pilotn\u00ed projekt zapojen\u00ed slu\u017eby pro ochranu e-mailu. Prvn\u00edm krokem, kter\u00fd jsme nastavili, byl e-mailov\u00fd antivir. Skenov\u00e1n\u00ed na \u0161kodliv\u00e9 programy prob\u00edh\u00e1 neust\u00e1le, p\u0159i\u010dem\u017e aktualizace signatur se nejprve prov\u00e1d\u011bla ka\u017edou hodinu a pot\u00e9 klient p\u0159e\u0161el na re\u017eim dvakr\u00e1t denn\u011b. <\/p>\n<p>\u00dapln\u00e1 ochrana p\u0159ed virov\u00fdmi infekcemi by m\u011bla b\u00fdt v\u00edcestup\u0148ov\u00e1. Pokud hovo\u0159\u00edme o p\u0159enosu vir\u016f prost\u0159ednictv\u00edm e-mailu, je d\u016fle\u017eit\u00e9 filtrovat takov\u00e9 zpr\u00e1vy na vstupu, \u0161kolit u\u017eivatele, aby rozpozn\u00e1vali soci\u00e1ln\u00ed in\u017een\u00fdrstv\u00ed a teprve pot\u00e9 spol\u00e9hat na antiviry a sandboxy. <\/p>\n<h2>V\u017edy na str\u00e1\u017ei<\/h2>\n<p>\nSamoz\u0159ejm\u011b netvrd\u00edme, \u017ee \u0159e\u0161en\u00ed t\u0159\u00eddy Secure Email Gateway je v\u0161el\u00e9kem. C\u00edlen\u00e9 \u00fatoky, v\u010detn\u011b phishingu, jsou extr\u00e9mn\u011b obt\u00ed\u017en\u00e9 zamezit, proto\u017ee ka\u017ed\u00fd takov\u00fd \u00fatok je \u201eu\u0161it\u00fd\u201c na m\u00edru konkr\u00e9tn\u00edmu p\u0159\u00edjemci (organizaci nebo osob\u011b). Ale pro firmu, kter\u00e1 se sna\u017e\u00ed zajistit z\u00e1kladn\u00ed \u00farove\u0148 bezpe\u010dnosti, to nen\u00ed m\u00e1lo, zvl\u00e1\u0161\u0165 s prav\u00fdm zku\u0161enost\u00ed a odbornost\u00ed nasazenou k \u00fakolu.<\/p>\n<p>Nej\u010dast\u011bji p\u0159i realizaci c\u00edlen\u00e9ho phishingu se do obsahu e-mail\u016f nezahrnuj\u00ed \u0161kodliv\u00e9 p\u0159\u00edlohy, jinak by takov\u00fd e-mail byl ihned zablokov\u00e1n syst\u00e9mem anti-spamu na cest\u011b k p\u0159\u00edjemci. M\u00edsto toho se do textu e-mailu zahrnuj\u00ed odkazy na p\u0159edem p\u0159ipraven\u00e9 webov\u00e9 zdroje, a pak u\u017e sta\u010d\u00ed m\u00e1lo. U\u017eivatel klikne na odkaz a pot\u00e9, po n\u011bkolika p\u0159esm\u011brov\u00e1n\u00edch, se b\u011bhem n\u011bkolika sekund ocitne na posledn\u00ed str\u00e1nce \u0159et\u011bzce, jej\u00edm\u017e otev\u0159en\u00edm se na jeho po\u010d\u00edta\u010d st\u00e1hne \u0161kodliv\u00fd software. <\/p>\n<p>Dokonce je\u0161t\u011b rafinovan\u011bj\u0161\u00ed: v okam\u017eiku p\u0159ijet\u00ed e-mailu m\u016f\u017ee b\u00fdt odkaz ne\u0161kodn\u00fd a teprve po uplynut\u00ed ur\u010dit\u00e9 doby, kdy u\u017e byl proskenov\u00e1n a p\u0159ijat, za\u010dne p\u0159esm\u011brov\u00e1vat na \u0161kodliv\u00fd obsah. Bohu\u017eel, odborn\u00edci Solar JSOC, i p\u0159esto \u017ee maj\u00ed pot\u0159ebn\u00e9 kompetence, nebudou schopni nastavit e-mailov\u00fd br\u00e1nu tak, aby \u201evid\u011bla\u201c \u0161kodliv\u00fd software skrze cel\u00fd \u0159et\u011bzec (i kdy\u017e jako ochranu lze pou\u017e\u00edt automatickou v\u00fdm\u011bnu v\u0161ech odkaz\u016f v e-mailech na SEG, aby ten skenoval odkaz nejen v okam\u017eiku doru\u010den\u00ed e-mailu, ale p\u0159i ka\u017ed\u00e9m kliknut\u00ed). <\/p>\n<p>Mezit\u00edm pom\u00e1h\u00e1 agregace n\u011bkolika typ\u016f odbornost\u00ed, v\u010detn\u011b \u00fadaj\u016f z\u00edskan\u00fdch na\u0161\u00edm JSOC CERT a OSINT, vy\u0159e\u0161it i typickou p\u0159esm\u011brov\u00e1n\u00ed. To umo\u017e\u0148uje vytv\u00e1\u0159et roz\u0161\u00ed\u0159en\u00e9 \u010dern\u00e9 seznamy, na jejich\u017e z\u00e1klad\u011b bude blokov\u00e1n i e-mail s v\u00edcen\u00e1sobn\u00fdm p\u0159esm\u011brov\u00e1n\u00edm. <\/p>\n<p>Pou\u017eit\u00ed SEG je jen mal\u00fd cihli\u010dka ve zdi, kterou chce ka\u017ed\u00e1 organizace postavit pro ochranu sv\u00fdch aktiv. Ale i tento \u010dl\u00e1nek je t\u0159eba spr\u00e1vn\u011b zav\u00e9st do celkov\u00e9ho obrazu, proto\u017ee i SEG lze p\u0159i spr\u00e1vn\u00e9m nastaven\u00ed ud\u011blat plnohodnotn\u00fdm ochrann\u00fdm prost\u0159edkem. <\/p>\n<p><i>Ksenia Sadunina, konzultantka odd\u011blen\u00ed odborn\u00e9ho presales produkt\u016f a slu\u017eeb Solar JSOC<\/i><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/solarsecurity\/blog\/477362\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u043e\u043a\u0430 \u0431\u043e\u043b\u044c\u0448\u043e\u0439 Enterprise \u0432\u044b\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u0442 \u044d\u0448\u0435\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0440\u0435\u0434\u0443\u0442\u044b \u043e\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0438 \u0445\u0430\u043a\u0435\u0440\u043e\u0432, \u0434\u043b\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u043f\u043e\u043f\u0440\u043e\u0449\u0435 \u0433\u043e\u043b\u043e\u0432\u043d\u043e\u0439 \u0431\u043e\u043b\u044c\u044e \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u0438 \u0441\u043f\u0430\u043c-\u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438. \u0415\u0441\u043b\u0438 \u0431\u044b \u041c\u0430\u0440\u0442\u0438 \u041c\u0430\u043a\u0444\u043b\u0430\u0439 \u0437\u043d\u0430\u043b, \u0447\u0442\u043e \u0432 2015 \u0433\u043e\u0434\u0443 (\u0430 \u0443\u0436 \u0442\u0435\u043c \u0431\u043e\u043b\u0435\u0435 \u0432 2020) \u043b\u044e\u0434\u0438 \u043d\u0435 \u0442\u043e \u0447\u0442\u043e \u043d\u0435 \u0438\u0437\u043e\u0431\u0440\u0435\u0442\u0443\u0442 \u0445\u043e\u0432\u0435\u0440\u0431\u043e\u0440\u0434\u044b, \u043d\u043e \u0434\u0430\u0436\u0435 \u043d\u0435 \u043d\u0430\u0443\u0447\u0430\u0442\u0441\u044f \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0438\u0437\u0431\u0430\u0432\u043b\u044f\u0442\u044c\u0441\u044f \u043e\u0442 \u043d\u0435\u0436\u0435\u043b\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u044b, \u043e\u043d \u0431\u044b, \u043d\u0430\u0432\u0435\u0440\u043d\u043e\u0435, [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-53243","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u043e\u043a\u0430 \u0431\u043e\u043b\u044c\u0448\u043e\u0439 Enterprise \u0432\u044b\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u0442 \u044d\u0448\u0435\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0440\u0435\u0434\u0443\u0442\u044b \u043e\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0438 \u0445\u0430\u043a\u0435\u0440\u043e\u0432, \u0434\u043b\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u043f\u043e\u043f\u0440\u043e\u0449\u0435 \u0433\u043e\u043b\u043e\u0432\u043d\u043e\u0439 \u0431\u043e\u043b\u044c\u044e \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u0438 \u0441\u043f\u0430\u043c-\u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/bolshe-chem-antispam-kak-vyzhat-maksimum-iz-security-email-gateway\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0411\u043e\u043b\u044c\u0448\u0435 \u0447\u0435\u043c \u0430\u043d\u0442\u0438\u0441\u043f\u0430\u043c: \u043a\u0430\u043a \u0432\u044b\u0436\u0430\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0443\u043c \u0438\u0437 Security Email Gateway | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u043e\u043a\u0430 \u0431\u043e\u043b\u044c\u0448\u043e\u0439 Enterprise \u0432\u044b\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u0442 \u044d\u0448\u0435\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0440\u0435\u0434\u0443\u0442\u044b \u043e\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0438 \u0445\u0430\u043a\u0435\u0440\u043e\u0432, \u0434\u043b\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u043f\u043e\u043f\u0440\u043e\u0449\u0435 \u0433\u043e\u043b\u043e\u0432\u043d\u043e\u0439 \u0431\u043e\u043b\u044c\u044e \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u0438 \u0441\u043f\u0430\u043c-\u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/bolshe-chem-antispam-kak-vyzhat-maksimum-iz-security-email-gateway\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-11-26T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:01:07+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47V\u00edce ne\u017e jen antispam: jak vyt\u011b\u017eit maximum z Security Email Gateway | ProHoster","description":"Zat\u00edmco velk\u00e9 podniky buduj\u00ed v\u00edcestup\u0148ov\u00e9 pevnosti proti potenci\u00e1ln\u00edm vnit\u0159n\u00edm zlod\u011bj\u016fm a hacker\u016fm, mal\u00fdm firm\u00e1m zb\u00fdv\u00e1 probl\u00e9mem phishing a spamov\u00e9 zpr\u00e1vy.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/bolshe-chem-antispam-kak-vyzhat-maksimum-iz-security-email-gateway","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0411\u043e\u043b\u044c\u0448\u0435 \u0447\u0435\u043c \u0430\u043d\u0442\u0438\u0441\u043f\u0430\u043c: \u043a\u0430\u043a \u0432\u044b\u0436\u0430\u0442\u044c \u043c\u0430\u043a\u0441\u0438\u043c\u0443\u043c \u0438\u0437 Security Email Gateway | ProHoster","og:description":"\u041f\u043e\u043a\u0430 \u0431\u043e\u043b\u044c\u0448\u043e\u0439 Enterprise \u0432\u044b\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u0442 \u044d\u0448\u0435\u043b\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0440\u0435\u0434\u0443\u0442\u044b \u043e\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0438 \u0445\u0430\u043a\u0435\u0440\u043e\u0432, \u0434\u043b\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439 \u043f\u043e\u043f\u0440\u043e\u0449\u0435 \u0433\u043e\u043b\u043e\u0432\u043d\u043e\u0439 \u0431\u043e\u043b\u044c\u044e \u043e\u0441\u0442\u0430\u044e\u0442\u0441\u044f \u0444\u0438\u0448\u0438\u043d\u0433\u043e\u0432\u044b\u0435 \u0438 \u0441\u043f\u0430\u043c-\u0440\u0430\u0441\u0441\u044b\u043b\u043a\u0438.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/bolshe-chem-antispam-kak-vyzhat-maksimum-iz-security-email-gateway","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-26T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:07+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53243","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 18:03:28","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:28:50","updated":"2026-02-09 18:03:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/53243","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=53243"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/53243\/revisions"}],"predecessor-version":[{"id":158701,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/53243\/revisions\/158701"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=53243"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=53243"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=53243"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}