{"id":55733,"date":"2020-01-27T00:00:00","date_gmt":"2020-01-26T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/evolyutsiya-web-application-firewall-ot-setevyh-ekranov-do-oblachnyh-sistem-zashhity-s-mashinnym-obucheniem"},"modified":"2020-02-18T14:03:52","modified_gmt":"2020-02-18T11:03:52","slug":"evolyutsiya-web-application-firewall-ot-setevyh-ekranov-do-oblachnyh-sistem-zashhity-s-mashinnym-obucheniem","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/evolyutsiya-web-application-firewall-ot-setevyh-ekranov-do-oblachnyh-sistem-zashhity-s-mashinnym-obucheniem","title":{"rendered":"Evoluce Web Application Firewall: od s\u00ed\u0165ov\u00fdch firewall\u016f po cloudov\u00e9 ochrann\u00e9 syst\u00e9my s machine learningem","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><b>V na\u0161em p\u0159edchoz\u00edm materi\u00e1lu na t\u00e9ma cloud jsme <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ru_mts\/blog\/472892\/\">psali<\/a><\/noindex>, jak chr\u00e1nit IT zdroje v ve\u0159ejn\u00e9m cloudu a pro\u010d tradi\u010dn\u00ed antivirov\u00e9 programy nejsou \u00fapln\u011b vhodn\u00e9 pro tyto \u00fa\u010dely. V tomto p\u0159\u00edsp\u011bvku budeme pokra\u010dovat v t\u00e9matu cloudov\u00e9 bezpe\u010dnosti a probereme evoluci WAF a to, co je lep\u0161\u00ed zvolit: hardware, software nebo cloud.\u00a0<\/b><\/p>\n<p><img decoding=\"async\" alt=\"Evoluce Web Application Firewall: od s\u00ed\u0165ov\u00fdch firewall\u016f po cloudov\u00e9 ochrann\u00e9 syst\u00e9my s machine learningem\" src=\"\/wp-content\/uploads\/2020\/01\/5b41836fd429c5c434c6289e583500c9.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Co je to WAF<\/h3>\n<p>\nV\u00edce ne\u017e 75 % \u00fatok\u016f hacker\u016f je zam\u011b\u0159eno na zranitelnosti webov\u00fdch aplikac\u00ed a str\u00e1nek: takov\u00e9 \u00fatoky jsou obvykle neviditeln\u00e9 pro infrastrukturu IT zabezpe\u010den\u00ed a bezpe\u010dnostn\u00ed slu\u017eby. Zranitelnosti webov\u00fdch aplikac\u00ed nesou s sebou rizika kompromitace a podvod\u016f s \u00fa\u010dty a osobn\u00edmi \u00fadaji u\u017eivatel\u016f, hesly, \u010d\u00edsly kreditn\u00edch karet. Krom\u011b toho zranitelnosti na webu slou\u017e\u00ed jako vstupn\u00ed bod pro \u00fato\u010dn\u00edky do firemn\u00ed s\u00edt\u011b.<\/p>\n<p>Web Application Firewall (WAF) p\u0159edstavuje ochrannou bari\u00e9ru, kter\u00e1 blokuje \u00fatoky na webov\u00e9 aplikace: SQL injekce, meziwebov\u00e9 skriptov\u00e1n\u00ed, vzd\u00e1len\u00e9 vykon\u00e1v\u00e1n\u00ed k\u00f3du, bruteforce a obch\u00e1zen\u00ed autorizace (auth bypass). Zahrnuje i \u00fatoky vyu\u017e\u00edvaj\u00edc\u00ed zero-day zranitelnosti. Firewally aplikac\u00ed zaji\u0161\u0165uj\u00ed ochranu t\u00edm, \u017ee monitoruj\u00ed obsah webov\u00fdch str\u00e1nek, v\u010detn\u011b HTML, DHTML a CSS, a filtruj\u00ed potenci\u00e1ln\u011b \u0161kodliv\u00e9 po\u017eadavky p\u0159es HTTP\/HTTPS.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Jak\u00e1 byla prvn\u00ed \u0159e\u0161en\u00ed?<\/h3>\n<p>\nPrvn\u00ed pokusy o vytvo\u0159en\u00ed Web Application Firewallu byly podniknuty ji\u017e na za\u010d\u00e1tku 90. let. Je zn\u00e1mo alespo\u0148 o t\u0159ech in\u017een\u00fdrech, kte\u0159\u00ed v t\u00e9to oblasti pracovali. Prvn\u00ed je profesor informatiky Gene Spafford z Purdue University. Ten popsal architekturu aplika\u010dn\u00edho firewallu s proxy a v roce 1991 ji publikoval v knize <noindex><a rel=\"nofollow\" href=\"https:\/\/www.oreilly.com\/library\/view\/practical-unix-and\/0596003234\/\">\u201eBezpe\u010dnost UNIXu v praxi\u201c<\/a><\/noindex>.<\/p>\n<p>Druh\u00fdm a t\u0159et\u00edm byli specialist\u00e9 na IT zabezpe\u010den\u00ed William Cheswick a Marcus Ranum z Bell Labs. Vyvinuli jeden z prvn\u00edch prototyp\u016f aplika\u010dn\u00edch firewall\u016f. Jeho distribuc\u00ed se zab\u00fdvala spole\u010dnost DEC \u2014 produkt byl vyd\u00e1n pod n\u00e1zvem SEAL (Secure External Access Link). <\/p>\n<p>Ale SEAL nebyl plnohodnotn\u00fdm WAF \u0159e\u0161en\u00edm. Byla to klasick\u00e1 s\u00ed\u0165ov\u00e1 firewall s roz\u0161\u00ed\u0159enou funk\u010dnost\u00ed \u2014 mo\u017enost\u00ed blokovat \u00fatoky na FTP a RSH. Z tohoto d\u016fvodu je prvn\u00edm WAF \u0159e\u0161en\u00edm dnes pova\u017eov\u00e1n produkt spole\u010dnosti Perfecto Technologies (pozd\u011bji Sanctum). V roce 1999 jej <noindex><a rel=\"nofollow\" href=\"http:\/\/www.internetnews.com\/ec-news\/article.php\/190571\/Perfecto+Technologies+Delivers+AppShield+for+EBusiness.htm\">p\u0159edstavila<\/a><\/noindex> syst\u00e9mu AppShield. V t\u00e9 dob\u011b se Perfecto Technologies zab\u00fdvaly v\u00fdvojem \u0159e\u0161en\u00ed pro kybernetickou bezpe\u010dnost pro e-commerce a c\u00edlovou skupinou jejich nov\u00e9ho produktu se staly online obchody. AppShield byl schopen analyzovat HTTP po\u017eadavky a blokovat \u00fatoky na z\u00e1klad\u011b dynamick\u00fdch politik kybernetick\u00e9 bezpe\u010dnosti.<\/p>\n<p>Zhruba ve stejn\u00e9 dob\u011b jako AppShield (v roce 2002) se objevil prvn\u00ed WAF s otev\u0159en\u00fdm zdrojov\u00fdm k\u00f3dem. Stal se j\u00edm <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/ModSecurity\">ModSecurity<\/a><\/noindex>. Byl vytv\u00e1\u0159en s c\u00edlem popularizace WAF technologi\u00ed a je dosud podporov\u00e1n IT komunitou (zde je jeho <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/SpiderLabs\/ModSecurity\">repozit\u00e1\u0159 na GitHubu<\/a><\/noindex>). ModSecurity blokuje \u00fatoky na aplikace na z\u00e1klad\u011b standardn\u00edho souboru regul\u00e1rn\u00edch v\u00fdraz\u016f (signature) \u2013 n\u00e1stroj\u016f pro kontrolu po\u017eadavk\u016f podle vzoru \u2013 <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/SpiderLabs\/owasp-modsecurity-crs\">OWASP Core Rule Set<\/a><\/noindex>.<\/p>\n<p>Nakonec se v\u00fdvoj\u00e1\u0159\u016fm poda\u0159ilo dos\u00e1hnout sv\u00e9ho c\u00edle \u2013 na trhu se za\u010daly objevovat nov\u00e9 WAF \u0159e\u0161en\u00ed, v\u010detn\u011b t\u011bch, kter\u00e1 byla postavena na b\u00e1zi ModSecurity.<\/p>\n<h3>T\u0159i generace \u2013 u\u017e historie<\/h3>\n<p>\nJe obvykl\u00e9 vymezit t\u0159i generace WAF syst\u00e9m\u016f, kter\u00e9 se vyv\u00edjely s rozvojem technologi\u00ed.<\/p>\n<p><b>Prvn\u00ed generace<\/b>. Funguje na z\u00e1klad\u011b regul\u00e1rn\u00edch v\u00fdraz\u016f (nebo gramatiky). Pat\u0159\u00ed sem ModSecurity. Dodavatel syst\u00e9mu zkoum\u00e1 typy \u00fatok\u016f na aplikace a vytv\u00e1\u0159\u00ed vzory, kter\u00e9 popisuj\u00ed legitimn\u00ed a potenci\u00e1ln\u011b \u0161kodliv\u00e9 po\u017eadavky. WAF porovn\u00e1v\u00e1 tyto seznamy a rozhoduje, co d\u011blat v konkr\u00e9tn\u00ed situaci \u2013 blokovat provoz nebo ne.<\/p>\n<p>P\u0159\u00edkladem detekce na z\u00e1klad\u011b regul\u00e1rn\u00edch v\u00fdraz\u016f je ji\u017e zm\u00edn\u011bn\u00fd projekt <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/SpiderLabs\/owasp-modsecurity-crs\">Core Rule Set<\/a><\/noindex> s otev\u0159en\u00fdm zdrojov\u00fdm k\u00f3dem. Dal\u0161\u00edm p\u0159\u00edkladem je <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/nbs-system\/naxsi\">Naxsi<\/a><\/noindex>, kter\u00fd je tak\u00e9 open-source. Syst\u00e9my s regul\u00e1rn\u00edmi v\u00fdrazy maj\u00ed \u0159adu nev\u00fdhod, zejm\u00e9na pokud jde o detekci nov\u00e9 zranitelnosti, spr\u00e1vce mus\u00ed manu\u00e1ln\u011b vytv\u00e1\u0159et dodate\u010dn\u00e1 pravidla. V p\u0159\u00edpad\u011b rozs\u00e1hl\u00e9 IT infrastruktury m\u016f\u017ee b\u00fdt pravidel n\u011bkolik tis\u00edc. Spravovat takov\u00e9 mno\u017estv\u00ed regul\u00e1rn\u00edch v\u00fdraz\u016f je pom\u011brn\u011b slo\u017eit\u00e9, nemluv\u011b o tom, \u017ee jejich kontrola m\u016f\u017ee sni\u017eovat v\u00fdkon s\u00edt\u011b.<\/p>\n<p>Regul\u00e1rn\u00ed v\u00fdrazy maj\u00ed tak\u00e9 pom\u011brn\u011b vysokou m\u00edru fale\u0161n\u011b pozitivn\u00edch v\u00fdsledk\u016f. Zn\u00e1m\u00fd lingvista Noam Chomsky navrhl klasifikaci gramatik, kterou rozd\u011blil do \u010dty\u0159 podm\u00ednek slo\u017eitosti. Podle t\u00e9to klasifikace lze regul\u00e1rn\u00edmi v\u00fdrazy popsat pouze pravidla firewallu, kter\u00e1 neumo\u017e\u0148uj\u00ed odchylky od \u0161ablony. To znamen\u00e1, \u017ee \u00fato\u010dn\u00edci mohou snadno 'oblafnout' WAF prvn\u00ed generace. Jednou z metod boje proti tomu je p\u0159id\u00e1vat do po\u017eadavk\u016f na aplikace speci\u00e1ln\u00ed znaky, kter\u00e9 nenaru\u0161uj\u00ed logiku \u0161kodliv\u00fdch dat, ale naru\u0161uj\u00ed pravidlo pro rozpozn\u00e1v\u00e1n\u00ed.<\/p>\n<p><img decoding=\"async\" alt=\"Evoluce Web Application Firewall: od s\u00ed\u0165ov\u00fdch firewall\u016f po cloudov\u00e9 ochrann\u00e9 syst\u00e9my s machine learningem\" src=\"\/wp-content\/uploads\/2020\/01\/e4ca4ddd7e6dc099c8168b02c365bdc5.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>Druh\u00e1 generace<\/b>. Aby se vy\u0159e\u0161ily probl\u00e9my spojen\u00e9 s v\u00fdkonem a p\u0159esnost\u00ed WAF, byly vyvinuty firewally aplikac\u00ed druh\u00e9 generace. Ty se obohatily o parsery, kter\u00e9 se zam\u011b\u0159uj\u00ed na identifikaci specifick\u00fdch typ\u016f \u00fatok\u016f (na HTML, JS atd.). Tyto parsery pracuj\u00ed se speci\u00e1ln\u00edmi tokeny, kter\u00e9 popisuj\u00ed po\u017eadavky (nap\u0159. prom\u011bnn\u00e1, \u0159et\u011bzec, nezn\u00e1m\u00fd, \u010d\u00edslo). Potenci\u00e1ln\u011b \u0161kodliv\u00e9 sekvence token\u016f jsou vy\u010dlen\u011bny na samostatn\u00fd seznam, kter\u00fd je pravideln\u011b kontrolov\u00e1n syst\u00e9mem WAF. Tento p\u0159\u00edstup poprv\u00e9 p\u0159edstavil na konferenci Black Hat 2012 ve form\u011b C\/C++\u00a0<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/client9\/libinjection\">knihovny libinjection<\/a><\/noindex>, kter\u00e1 umo\u017e\u0148uje detekci SQL injekc\u00ed.<\/p>\n<p>Ve srovn\u00e1n\u00ed s WAF prvn\u00ed generace mohou specializovan\u00e9 parsery pracovat rychleji. Nicm\u00e9n\u011b nevy\u0159e\u0161ily probl\u00e9my spojen\u00e9 s ru\u010dn\u00edm nastaven\u00edm syst\u00e9mu p\u0159i vzniku nov\u00fdch \u0161kodliv\u00fdch \u00fatok\u016f. <\/p>\n<p><img decoding=\"async\" alt=\"Evoluce Web Application Firewall: od s\u00ed\u0165ov\u00fdch firewall\u016f po cloudov\u00e9 ochrann\u00e9 syst\u00e9my s machine learningem\" src=\"\/wp-content\/uploads\/2020\/01\/beb4b34f64438af88c8b23ef0808f403.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<b>T\u0159et\u00ed generace<\/b>. Evoluce v logice detekce t\u0159et\u00ed generace spo\u010d\u00edv\u00e1 v pou\u017eit\u00ed metod strojov\u00e9ho u\u010den\u00ed, kter\u00e9 umo\u017e\u0148uj\u00ed co nejv\u00edce p\u0159ibl\u00ed\u017eit gramatiku detekce k re\u00e1ln\u00e9 gramatice SQL\/HTML\/JS chr\u00e1n\u011bn\u00fdch syst\u00e9m\u016f. Tato logika detekce je schopna adaptovat Turing\u016fv stroj k pokryt\u00ed rekurzivn\u011b enumerovan\u00fdch gramatik. P\u0159i\u010dem\u017e d\u0159\u00edve byla \u00faloha vytvo\u0159en\u00ed adaptivn\u00edho Turingova stroje ne\u0159e\u0161iteln\u00e1, dokud nebyly publikov\u00e1ny prvn\u00ed v\u00fdzkumy neuronov\u00fdch Turingov\u00fdch stroj\u016f.<\/p>\n<p>Strojov\u00e9 u\u010den\u00ed poskytuje jedine\u010dnou p\u0159\u00edle\u017eitost p\u0159izp\u016fsobit jakoukoli gramatiku tak, aby pokryla jak\u00fdkoli typ \u00fatoku, bez nutnosti ru\u010dn\u011b vytv\u00e1\u0159et seznamy signatur, jak to bylo po\u017eadov\u00e1no p\u0159i detekci prvn\u00ed generace, a bez v\u00fdvoje nov\u00fdch tokeniz\u00e1tor\u016f\/parser\u016f pro nov\u00e9 typy \u00fatok\u016f, jako jsou Memcached, Redis, Cassandra, SSRF, jak to vy\u017eadovala metodologie druh\u00e9 generace. <\/p>\n<p>Kombinac\u00ed v\u0161ech t\u0159\u00ed generac\u00ed logiky detekce m\u016f\u017eeme nakreslit nov\u00fd diagram, na kter\u00e9m je \u010derven\u00fdm obrysem ozna\u010dena t\u0159et\u00ed generace detekce (obr. 3). Tato generace zahrnuje jedno z \u0159e\u0161en\u00ed, kter\u00e9 implementujeme v cloudu spole\u010dn\u011b s \"Onsec\", v\u00fdvoj\u00e1\u0159em platformy adaptivn\u00ed ochrany webov\u00fdch aplikac\u00ed a API Valarm. <\/p>\n<p>Nyn\u00ed logika detekce vyu\u017e\u00edv\u00e1 zp\u011btnou vazbu z aplikace pro seberegulaci. V r\u00e1mci strojov\u00e9ho u\u010den\u00ed se tento zp\u011btnovazebn\u00ed cyklus naz\u00fdv\u00e1 \u201eposilov\u00e1n\u00ed\u201c. Obvykle existuje jeden nebo v\u00edce typ\u016f takov\u00e9ho posilov\u00e1n\u00ed:<\/p>\n<ul>\n<li>Anal\u00fdza chov\u00e1n\u00ed odpov\u011bdi aplikace (pasivn\u00ed)<\/li>\n<li>Skenov\u00e1n\u00ed\/fazzer (aktivn\u00ed)<\/li>\n<li>Soubory zpr\u00e1v\/procedury-odchyt\u00e1va\u010de\/pasti (po skute\u010dnosti)<\/li>\n<li>Ru\u010dn\u011b (ur\u010duje supervizor)<\/li>\n<\/ul>\n<p>\nV d\u016fsledku toho logika detekce t\u0159et\u00ed generace tak\u00e9 \u0159e\u0161\u00ed d\u016fle\u017eit\u00fd probl\u00e9m p\u0159esnosti. Nyn\u00ed je mo\u017en\u00e9 nejen vyhnout se fale\u0161n\u00fdm poplach\u016fm a fale\u0161n\u00fdm negativ\u016fm, ale tak\u00e9 odhalit povolen\u00e9 skute\u010dn\u011b negativn\u00ed v\u00fdsledky, jako je detekce pou\u017eit\u00ed p\u0159\u00edkazov\u00e9ho prvku SQL v ovl\u00e1dac\u00edm panelu, na\u010d\u00edt\u00e1n\u00ed \u0161ablon webov\u00fdch str\u00e1nek, AJAXov\u00e9 dotazy souvisej\u00edc\u00ed s chybami JavaScriptu a dal\u0161\u00ed.<\/p>\n<p><img decoding=\"async\" alt=\"Evoluce Web Application Firewall: od s\u00ed\u0165ov\u00fdch firewall\u016f po cloudov\u00e9 ochrann\u00e9 syst\u00e9my s machine learningem\" src=\"\/wp-content\/uploads\/2020\/01\/bf6a83883291cdd41b468dd8a197062e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Evoluce Web Application Firewall: od s\u00ed\u0165ov\u00fdch firewall\u016f po cloudov\u00e9 ochrann\u00e9 syst\u00e9my s machine learningem\" src=\"\/wp-content\/uploads\/2020\/01\/7498f6e7978855df24c4e5b41376c0f7.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"Evoluce Web Application Firewall: od s\u00ed\u0165ov\u00fdch firewall\u016f po cloudov\u00e9 ochrann\u00e9 syst\u00e9my s machine learningem\" src=\"\/wp-content\/uploads\/2020\/01\/1d811726a068994eeaaad24f0fa67783.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nD\u00e1le se pod\u00edv\u00e1me na technologick\u00e9 mo\u017enosti r\u016fzn\u00fdch variant implementace WAF. <\/p>\n<h3>Hardware, software nebo cloud \u2014 co vybrat?<\/h3>\n<p>\nJednou z variant implementace aplika\u010dn\u00edch firewal\u016f je \"hardwarov\u00e9\" \u0159e\u0161en\u00ed. Tato za\u0159\u00edzen\u00ed p\u0159edstavuj\u00ed specializovan\u00e1 po\u010d\u00edta\u010dov\u00e1 za\u0159\u00edzen\u00ed, kter\u00e1 spole\u010dnost instaluje lok\u00e1ln\u011b ve sv\u00e9m datov\u00e9m centru. Ale v tomto p\u0159\u00edpad\u011b je nutn\u00e9 zakoupit vlastn\u00ed hardware a platit integr\u00e1tor\u016fm za jeho nastaven\u00ed a lad\u011bn\u00ed (pokud nem\u00e1 spole\u010dnost vlastn\u00ed IT odd\u011blen\u00ed). P\u0159itom jak\u00e9koli za\u0159\u00edzen\u00ed se st\u00e1v\u00e1 zastaral\u00fdm a selh\u00e1v\u00e1, a tak mus\u00ed zadavatel\u00e9 po\u010d\u00edtat s rozpo\u010dtem na obnovu hardwaru.<\/p>\n<p>Dal\u0161\u00ed variantou nasazen\u00ed WAF je softwarov\u00e1 implementace. \u0158e\u0161en\u00ed se instaluje jako dopln\u011bk pro n\u011bjak\u00fd software (nap\u0159\u00edklad ModSecurity se nastavuje nad Apache) a b\u011b\u017e\u00ed na jednom serveru s n\u00edm. Obecn\u011b lze tato \u0159e\u0161en\u00ed nasadit jak na fyzick\u00e9m serveru, tak v cloudu. Jejich nev\u00fdhodou jsou omezen\u00e9 mo\u017enosti \u0161k\u00e1lovatelnosti a podpory ze strany dodavatele. <\/p>\n<p>T\u0159et\u00ed variantou je nastaven\u00ed WAF v cloudu. Takov\u00e1 \u0159e\u0161en\u00ed poskytuj\u00ed cloudov\u00ed poskytovatel\u00e9 jako slu\u017ebu na p\u0159edplatn\u00e9m. Spole\u010dnosti nemus\u00ed po\u0159izovat a nastavovat specializovan\u00fd hardware, tyto \u00fakoly p\u0159eb\u00edr\u00e1 poskytovatel slu\u017eby. D\u016fle\u017eit\u00fdm bodem je, \u017ee modern\u00ed cloudov\u00fd WAF neznamen\u00e1 migraci prost\u0159edk\u016f na platformu poskytovatele. Web m\u016f\u017ee b\u00fdt nasazen kdekoli, dokonce i on-premise.<\/p>\n<p>Pro\u010d se nyn\u00ed st\u00e1le \u010dast\u011bji d\u00edv\u00e1me sm\u011brem k cloudov\u00e9mu WAF, \u0159ekneme d\u00e1le.<\/p>\n<h3>Co m\u016f\u017ee WAF v cloudu<\/h3>\n<p>\nZ hlediska technologick\u00fdch mo\u017enost\u00ed:<\/p>\n<ul>\n<li><b>O aktualizace se star\u00e1 poskytovatel<\/b>. WAF je poskytov\u00e1n na p\u0159edplatn\u00e9m, proto se o aktu\u00e1lnost aktualizac\u00ed a licenc\u00ed star\u00e1 poskytovatel slu\u017eby. Aktualizace se t\u00fdkaj\u00ed nejen softwaru, ale i hardwaru. Poskytovatel upgraduje serverov\u00fd park a star\u00e1 se o jeho \u00fadr\u017ebu. Tak\u00e9 odpov\u00edd\u00e1 za vyva\u017eov\u00e1n\u00ed z\u00e1t\u011b\u017ee a z\u00e1lohov\u00e1n\u00ed. Pokud dojde k poru\u0161e v chodu serveru WAF, provoz je okam\u017eit\u011b p\u0159esm\u011brov\u00e1n na jin\u00fd stroj. Racion\u00e1ln\u00ed rozd\u011blen\u00ed provozu umo\u017e\u0148uje vyhnout se situac\u00edm, kdy firewall p\u0159ech\u00e1z\u00ed do re\u017eimu fail open \u2013 nezvl\u00e1d\u00e1 z\u00e1t\u011b\u017e a p\u0159est\u00e1v\u00e1 filtrovat po\u017eadavky.<\/li>\n<li><b>Virtu\u00e1ln\u00ed patching<\/b>. Virtu\u00e1ln\u00ed z\u00e1platy omezuj\u00ed p\u0159\u00edstup k kompromitovan\u00fdm \u010d\u00e1stem aplikace do doby, ne\u017e v\u00fdvoj\u00e1\u0159 uzav\u0159e zranitelnost. V\u00fdsledkem je, \u017ee z\u00e1kazn\u00edk cloudov\u00e9ho poskytovatele m\u00e1 mo\u017enost klidn\u011b po\u010dkat, a\u017e dodavatel ur\u010dit\u00e9ho softwaru zve\u0159ejn\u00ed ofici\u00e1ln\u00ed \u201ez\u00e1platy\u201c. Umo\u017enit to co nejrychleji je prioritou pro poskytovatele softwaru. Nap\u0159\u00edklad v platform\u011b \u201eValarm\u201c odpov\u00edd\u00e1 za virtu\u00e1ln\u00ed patching samostatn\u00fd programov\u00fd modul. Spr\u00e1vce m\u016f\u017ee p\u0159id\u00e1vat vlastn\u00ed regul\u00e1rn\u00ed v\u00fdrazy pro blokov\u00e1n\u00ed \u0161kodliv\u00fdch po\u017eadavk\u016f. Syst\u00e9m umo\u017e\u0148uje ozna\u010dovat n\u011bkter\u00e9 po\u017eadavky p\u0159\u00edznakem \u201eD\u016fv\u011brn\u00e1 data\u201c. V takov\u00e9m p\u0159\u00edpad\u011b se jejich parametry maskuj\u00ed a samotn\u00e9 po\u017eadavky za \u017e\u00e1dn\u00fdch okolnost\u00ed neopou\u0161t\u011bj\u00ed pracovn\u00ed z\u00f3nu firewallu.<\/li>\n<li><b>Vestav\u011bn\u00fd skener perimetru a zranitelnost\u00ed<\/b>. To umo\u017e\u0148uje samostatn\u011b ur\u010dovat s\u00ed\u0165ov\u00e9 hranice IT infrastruktury pomoc\u00ed dat DNS dotaz\u016f a protokolu WHOIS. Pot\u00e9 WAF automaticky analyzuje slu\u017eby a aplikace funguj\u00edc\u00ed uvnit\u0159 perimetru (prov\u00e1d\u00ed skenov\u00e1n\u00ed port\u016f). Firewall dok\u00e1\u017ee odhalit v\u0161echny b\u011b\u017en\u00e9 typy zranitelnost\u00ed \u2014 SQLi, XSS, XXE a dal\u0161\u00ed \u2014 a identifikovat chyby v konfiguraci softwaru, nap\u0159\u00edklad neopr\u00e1vn\u011bn\u00fd p\u0159\u00edstup k repository Git a BitBucket a anonymn\u00ed p\u0159\u00edstupy k Elasticsearch, Redis, MongoDB. <\/li>\n<li><b>\u00datoky jsou monitorov\u00e1ny zdroji cloudu<\/b>. Obvykle maj\u00ed cloudov\u00ed poskytovatel\u00e9 velk\u00e9 objemy v\u00fdpo\u010detn\u00ed s\u00edly. To umo\u017e\u0148uje anal\u00fdzu hrozeb s vysokou p\u0159esnost\u00ed a rychlost\u00ed. V cloudu se nasazuje cluster filtruj\u00edc\u00edch uzl\u016f, p\u0159es kter\u00e9 proch\u00e1z\u00ed ve\u0161ker\u00fd provoz. Tyto uzly blokuj\u00ed \u00fatoky na webov\u00e9 aplikace a pos\u00edlaj\u00ed statistiky do Centra analytiky. To pou\u017e\u00edv\u00e1 algoritmy strojov\u00e9ho u\u010den\u00ed, aby aktualizovalo blokovac\u00ed pravidla pro v\u0161echny chr\u00e1n\u011bn\u00e9 aplikace. Realizace takov\u00e9ho sch\u00e9matu je uvedena na obr\u00e1zku 4. Takto p\u0159izp\u016fsoben\u00e1 bezpe\u010dnostn\u00ed pravidla minimalizuj\u00ed po\u010det fale\u0161n\u00fdch poplach\u016f firewallu. <\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Evoluce Web Application Firewall: od s\u00ed\u0165ov\u00fdch firewall\u016f po cloudov\u00e9 ochrann\u00e9 syst\u00e9my s machine learningem\" src=\"\/wp-content\/uploads\/2020\/01\/9fe1eaea62f0a9055df88352b654bfac.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNyn\u00ed se trochu zam\u011b\u0159\u00edme na zvl\u00e1\u0161tnosti cloudov\u00fdch WAF z hlediska organiza\u010dn\u00edch aspekt\u016f a spr\u00e1vy:<\/p>\n<ul>\n<li><b>P\u0159echod k OpEx<\/b>. V p\u0159\u00edpad\u011b cloudov\u00fdch WAF bude cena implementace nulov\u00e1, proto\u017ee ve\u0161ker\u00fd hardware a licence ji\u017e byly zaplaceny poskytovatelem, \u00fahrada za slu\u017ebu se prov\u00e1d\u00ed na z\u00e1klad\u011b p\u0159edplatn\u00e9ho. <\/li>\n<li><b>R\u016fzn\u00e9 tarifn\u00ed pl\u00e1ny<\/b>. U\u017eivatel cloudov\u00e9ho servisu m\u016f\u017ee rychle p\u0159ipojit nebo odpojit dal\u0161\u00ed mo\u017enosti. Spr\u00e1va funkc\u00ed se realizuje z jedin\u00e9 \u0159\u00eddic\u00edho panelu, kter\u00fd je tak\u00e9 chr\u00e1n\u011bn. P\u0159\u00edstup k n\u011bmu je zaji\u0161t\u011bn pomoc\u00ed HTTPS, nav\u00edc je k dispozici mechanismus dvoufaktorov\u00e9 autentizace zalo\u017een\u00fd na protokolu TOTP (Time-based One-Time Password Algorithm).<\/li>\n<li><b>P\u0159ipojen\u00ed p\u0159es DNS<\/b>. M\u016f\u017eete si sami zm\u011bnit DNS a nastavit sm\u011brov\u00e1n\u00ed v s\u00edti. Pro \u0159e\u0161en\u00ed t\u011bchto \u00faloh nen\u00ed t\u0159eba zam\u011bstn\u00e1vat a \u0161kolit jednotliv\u00e9 specialisty. Obvykle v\u00e1m s nastaven\u00edm m\u016f\u017ee pomoci technick\u00e1 podpora poskytovatele.<\/li>\n<\/ul>\n<p>\nTechnologie WAF pro\u0161ly evoluc\u00ed od jednoduch\u00fdch s\u00ed\u0165ov\u00fdch firewall\u016f s empirick\u00fdmi pravidly k komplexn\u00edm ochran\u00fdm syst\u00e9m\u016fm s algoritmy strojov\u00e9ho u\u010den\u00ed. Dnes maj\u00ed aplika\u010dn\u00ed firewally \u0161irok\u00e9 spektrum funkc\u00ed, kter\u00e9 byly obt\u00ed\u017en\u011b realizovateln\u00e9 v 90. letech. V mnoha ohledech se nov\u00e1 funk\u010dnost stala mo\u017enou d\u00edky cloudov\u00fdm technologi\u00edm. WAF \u0159e\u0161en\u00ed a jejich komponenty se st\u00e1le vyv\u00edjej\u00ed. Stejn\u011b jako ostatn\u00ed oblasti IT bezpe\u010dnosti. <\/p>\n<p><i>Text p\u0159ipravil Alexandr Karpuzikov, mana\u017eer pro rozvoj produkt\u016f IT bezpe\u010dnosti cloudov\u00e9ho poskytovatele #CloudMTS.<\/i><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/ru_mts\/blog\/485220\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u043d\u0430\u0448\u0435\u043c \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0435 \u043f\u043e \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u0442\u0435\u043c\u0430\u0442\u0438\u043a\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0418\u0422-\u0440\u0435\u0441\u0443\u0440\u0441\u044b \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u043c \u043e\u0431\u043b\u0430\u043a\u0435 \u0438 \u043f\u043e\u0447\u0435\u043c\u0443 \u0442\u0440\u0430\u0434\u0438\u0446\u0438\u043e\u043d\u043d\u044b\u0435 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u044b \u043d\u0435 \u0441\u043e\u0432\u0441\u0435\u043c \u043f\u043e\u0434\u0445\u043e\u0434\u044f\u0442 \u0434\u043b\u044f \u044d\u0442\u0438\u0445 \u0446\u0435\u043b\u0435\u0439.\u00a0\u0412 \u044d\u0442\u043e\u043c \u043f\u043e\u0441\u0442\u0435 \u043c\u044b \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0438\u043c \u0442\u0435\u043c\u0443 \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438 \u043f\u043e\u0433\u043e\u0432\u043e\u0440\u0438\u043c \u043e\u0431 \u044d\u0432\u043e\u043b\u044e\u0446\u0438\u0438 WAF \u0438 \u043e \u0442\u043e\u043c, \u0447\u0442\u043e \u043b\u0443\u0447\u0448\u0435 \u0432\u044b\u0431\u0440\u0430\u0442\u044c: \u0436\u0435\u043b\u0435\u0437\u043e, \u041f\u041e \u0438\u043b\u0438 \u043e\u0431\u043b\u0430\u043a\u043e.\u00a0 \u0427\u0442\u043e \u0442\u0430\u043a\u043e\u0435 WAF \u0411\u043e\u043b\u0435\u0435 75% \u0430\u0442\u0430\u043a \u0445\u0430\u043a\u0435\u0440\u043e\u0432 \u043d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-55733","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u043d\u0430\u0448\u0435\u043c \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0435 \u043f\u043e \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u0442\u0435\u043c\u0430\u0442\u0438\u043a\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0418\u0422-\u0440\u0435\u0441\u0443\u0440\u0441\u044b \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u043c \u043e\u0431\u043b\u0430\u043a\u0435 \u0438 \u043f\u043e\u0447\u0435\u043c\u0443.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/evolyutsiya-web-application-firewall-ot-setevyh-ekranov-do-oblachnyh-sistem-zashhity-s-mashinnym-obucheniem\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u042d\u0432\u043e\u043b\u044e\u0446\u0438\u044f Web Application Firewall: \u043e\u0442 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u044d\u043a\u0440\u0430\u043d\u043e\u0432 \u0434\u043e \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0437\u0430\u0449\u0438\u0442\u044b \u0441 \u043c\u0430\u0448\u0438\u043d\u043d\u044b\u043c \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u0435\u043c | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u043d\u0430\u0448\u0435\u043c \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0435 \u043f\u043e \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u0442\u0435\u043c\u0430\u0442\u0438\u043a\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0418\u0422-\u0440\u0435\u0441\u0443\u0440\u0441\u044b \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u043c \u043e\u0431\u043b\u0430\u043a\u0435 \u0438 \u043f\u043e\u0447\u0435\u043c\u0443.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/evolyutsiya-web-application-firewall-ot-setevyh-ekranov-do-oblachnyh-sistem-zashhity-s-mashinnym-obucheniem\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-01-26T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:03:52+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Evoluce Web Application Firewall: od s\u00ed\u0165ov\u00fdch firewall\u016f k cloudov\u00fdm ochran\u00e1m se strojov\u00fdm u\u010den\u00edm | ProHoster","description":"V na\u0161em p\u0159edchoz\u00edm materi\u00e1lu o cloudech jsme hovo\u0159ili o tom, jak chr\u00e1nit IT zdroje v ve\u0159ejn\u00e9m cloudu a pro\u010d.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/evolyutsiya-web-application-firewall-ot-setevyh-ekranov-do-oblachnyh-sistem-zashhity-s-mashinnym-obucheniem","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u042d\u0432\u043e\u043b\u044e\u0446\u0438\u044f Web Application Firewall: \u043e\u0442 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u044d\u043a\u0440\u0430\u043d\u043e\u0432 \u0434\u043e \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0437\u0430\u0449\u0438\u0442\u044b \u0441 \u043c\u0430\u0448\u0438\u043d\u043d\u044b\u043c \u043e\u0431\u0443\u0447\u0435\u043d\u0438\u0435\u043c | ProHoster","og:description":"\u0412 \u043d\u0430\u0448\u0435\u043c \u043f\u0440\u043e\u0448\u043b\u043e\u043c \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0435 \u043f\u043e \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u0442\u0435\u043c\u0430\u0442\u0438\u043a\u0435 \u043c\u044b \u0440\u0430\u0441\u0441\u043a\u0430\u0437\u044b\u0432\u0430\u043b\u0438, \u043a\u0430\u043a \u0437\u0430\u0449\u0438\u0442\u0438\u0442\u044c \u0418\u0422-\u0440\u0435\u0441\u0443\u0440\u0441\u044b \u0432 \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e\u043c \u043e\u0431\u043b\u0430\u043a\u0435 \u0438 \u043f\u043e\u0447\u0435\u043c\u0443.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/evolyutsiya-web-application-firewall-ot-setevyh-ekranov-do-oblachnyh-sistem-zashhity-s-mashinnym-obucheniem","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-01-26T21:00:00+00:00","article:modified_time":"2020-02-18T11:03:52+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"55733","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 19:37:39","updated":"2022-09-28 16:21:54","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/55733","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=55733"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/55733\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=55733"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=55733"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=55733"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}