{"id":86707,"date":"2020-06-28T19:42:19","date_gmt":"2020-06-28T17:42:19","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/mobilnye-antivirusy-ne-rabotayut"},"modified":"2020-06-28T19:42:19","modified_gmt":"2020-06-28T17:42:19","slug":"mobilnye-antivirusy-ne-rabotayut","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/mobilnye-antivirusy-ne-rabotayut","title":{"rendered":"Mobiln\u00ed antiviry nefunguj\u00ed","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Mobiln\u00ed
\nTL;DR<\/b> Pokud na va\u0161ich firemn\u00edch mobiln\u00edch za\u0159\u00edzen\u00edch pot\u0159ebujete antivirus, znamen\u00e1 to, \u017ee d\u011bl\u00e1te n\u011bco \u0161patn\u011b a antivirus v\u00e1m nepom\u016f\u017ee.<\/p>\n

Tento p\u0159\u00edsp\u011bvek je v\u00fdsledkem v\u00e1\u0161niv\u00fdch debat na t\u00e9ma, zda je antivirus na firemn\u00edm mobiln\u00edm telefonu pot\u0159ebn\u00fd, v jak\u00fdch p\u0159\u00edpadech funguje a kdy je k ni\u010demu. V \u010dl\u00e1nku jsou rozebr\u00e1ny modely hrozeb, proti kter\u00fdm by m\u011bl antivirus teoreticky chr\u00e1nit.<\/p>\n

Prodejc\u016fm antivir\u016f se \u010dasto poda\u0159\u00ed p\u0159esv\u011bd\u010dit firemn\u00ed z\u00e1kazn\u00edky, \u017ee antivirus zna\u010dn\u011b zv\u00fd\u0161\u00ed jejich bezpe\u010dnost, ale ve v\u011bt\u0161in\u011b p\u0159\u00edpad\u016f je to iluzorn\u00ed ochrana, kv\u016fli kter\u00e9 kles\u00e1 ostra\u017eitost jak u\u017eivatel\u016f, tak administr\u00e1tor\u016f.
\n<\/a><\/noindex><\/p>\n

Spr\u00e1vn\u00e1 firemn\u00ed infrastruktura<\/h2>\n

\nKdy\u017e m\u00e1 spole\u010dnost des\u00edtky nebo dokonce tis\u00edce zam\u011bstnanc\u016f, nen\u00ed mo\u017en\u00e9 nastavovat ka\u017ed\u00e9 u\u017eivatelsk\u00e9 za\u0159\u00edzen\u00ed ru\u010dn\u011b. Nastaven\u00ed se ka\u017ed\u00fd den mohou m\u011bnit, p\u0159ich\u00e1zej\u00ed nov\u00ed zam\u011bstnanci, jejich mobiln\u00ed telefony a notebooky se rozbij\u00ed nebo ztrat\u00ed. A nakonec by ve\u0161ker\u00e1 pr\u00e1ce administr\u00e1tor\u016f spo\u010d\u00edvala v denn\u00edm nastavov\u00e1n\u00ed nov\u00fdch konfigurac\u00ed na za\u0159\u00edzen\u00edch zam\u011bstnanc\u016f. <\/p>\n

Na desktopov\u00fdch po\u010d\u00edta\u010d\u00edch se tento probl\u00e9m za\u010dal \u0159e\u0161it d\u00e1vno. Ve sv\u011bt\u011b Windows se obvykle takov\u00e9 \u0159\u00edzen\u00ed prov\u00e1d\u00ed pomoc\u00ed Active Directory, centralizovan\u00fdch syst\u00e9m\u016f autentizace (Single Sign In) atd. Ale nyn\u00ed maj\u00ed v\u0161ichni zam\u011bstnanci k po\u010d\u00edta\u010d\u016fm p\u0159id\u00e1ny smartphony, na kter\u00fdch prob\u00edh\u00e1 podstatn\u00e1 \u010d\u00e1st pracovn\u00edch proces\u016f a uchov\u00e1vaj\u00ed se d\u016fle\u017eit\u00e1 data. Microsoft se pokou\u0161el spojit sv\u00e9 telefony na Windows Phone do jedn\u00e9 ekosyst\u00e9my s Windows, ale tato my\u0161lenka zem\u0159ela spolu s ofici\u00e1ln\u00ed smrt\u00ed Windows Phone. Proto v podnikatelsk\u00e9m prost\u0159ed\u00ed je v ka\u017ed\u00e9m p\u0159\u00edpad\u011b t\u0159eba vyb\u00edrat mezi Androidem a iOS.<\/p>\n

V sou\u010dasn\u00e9m firemn\u00edm prost\u0159ed\u00ed, pro spr\u00e1vu za\u0159\u00edzen\u00ed zam\u011bstnanc\u016f, je trendy koncept UEM (Unified Endpoint Management). Je to centralizovan\u00fd syst\u00e9m pro spr\u00e1vu mobiln\u00edch za\u0159\u00edzen\u00ed a desktopov\u00fdch po\u010d\u00edta\u010d\u016f.
\n\"Mobiln\u00ed
\nCentralizovan\u00e9 \u0159\u00edzen\u00ed u\u017eivatelsk\u00fdch za\u0159\u00edzen\u00ed (Unified Endpoint Management)<\/p>\n

Administr\u00e1tor syst\u00e9mu UEM m\u016f\u017ee stanovit r\u016fzn\u00e9 politiky pro u\u017eivatelsk\u00e1 za\u0159\u00edzen\u00ed. Nap\u0159\u00edklad povolit u\u017eivateli v\u011bt\u0161\u00ed nebo men\u0161\u00ed kontrolu nad za\u0159\u00edzen\u00edm, instalaci aplikac\u00ed z extern\u00edch zdroj\u016f atd. <\/p>\n

Co m\u016f\u017ee UEM d\u011blat: <\/b><\/p>\n

Spravovat v\u0161echna nastaven\u00ed<\/b> \u2014 administr\u00e1tor m\u016f\u017ee u\u017eivateli zcela zak\u00e1zat m\u011bnit nastaven\u00ed na za\u0159\u00edzen\u00ed a m\u011bnit je vzd\u00e1len\u011b. <\/p>\n

Kontrolovat software na za\u0159\u00edzen\u00ed<\/b> \u2014 povolit instalaci program\u016f na za\u0159\u00edzen\u00ed a automaticky instalovat programy bez v\u011bdom\u00ed u\u017eivatele. Administr\u00e1tor m\u016f\u017ee tak\u00e9 zak\u00e1zat nebo povolit instalaci program\u016f z obchodu s aplikacemi nebo z ned\u016fv\u011bryhodn\u00fdch zdroj\u016f (z APK soubor\u016f v p\u0159\u00edpad\u011b Androidu).<\/p>\n

Vzd\u00e1len\u00e9 blokov\u00e1n\u00ed<\/b> \u2014 v p\u0159\u00edpad\u011b, \u017ee je telefon ztracen, m\u016f\u017ee administr\u00e1tor za\u0159\u00edzen\u00ed zablokovat nebo vymazat data. N\u011bkter\u00e9 syst\u00e9my tak\u00e9 umo\u017e\u0148uj\u00ed nastavit automatick\u00e9 vymaz\u00e1n\u00ed dat, pokud telefon nebyl v kontaktu se serverem d\u00e9le ne\u017e N hodin, aby se vylou\u010dila mo\u017enost pokus\u016f o offline hackov\u00e1n\u00ed, kdy \u00fato\u010dn\u00edci stihli vyjmout SIM kartu je\u0161t\u011b p\u0159ed t\u00edm, ne\u017e byla serverem zasl\u00e1na p\u0159\u00edkaz k vymaz\u00e1n\u00ed dat. <\/p>\n

Sb\u011br statistik<\/b> \u2014 sledovat aktivitu u\u017eivatele, dobu pou\u017e\u00edv\u00e1n\u00ed aplikac\u00ed, polohu, \u00farove\u0148 nabit\u00ed baterie atd.<\/p>\n

Jak\u00e9 existuj\u00ed UEM<\/h2>\n

\nExistuj\u00ed dva z\u00e1sadn\u011b odli\u0161n\u00e9 p\u0159\u00edstupy pro centralizovan\u00e9 \u0159\u00edzen\u00ed smartphon\u016f zam\u011bstnanc\u016f: v jednom p\u0159\u00edpad\u011b spole\u010dnost nakupuje pro zam\u011bstnance za\u0159\u00edzen\u00ed od jedn\u00e9 v\u00fdrobce a obvykle vybere syst\u00e9m \u0159\u00edzen\u00ed od stejn\u00e9ho dodavatele. V druh\u00e9m p\u0159\u00edpad\u011b zam\u011bstnanci pou\u017e\u00edvaj\u00ed sv\u00e9 osobn\u00ed za\u0159\u00edzen\u00ed k pr\u00e1ci, a zde za\u010d\u00edn\u00e1 zoo opera\u010dn\u00edch syst\u00e9m\u016f, verz\u00ed a platforem.<\/p>\n

BYOD<\/b> (Bring your own device, P\u0159ines si sv\u00e9 za\u0159\u00edzen\u00ed) \u2014 koncept, ve kter\u00e9m zam\u011bstnanci pou\u017e\u00edvaj\u00ed k pr\u00e1ci sv\u00e1 osobn\u00ed za\u0159\u00edzen\u00ed a \u00fa\u010dty. N\u011bkter\u00e9 syst\u00e9my centralizovan\u00e9ho \u0159\u00edzen\u00ed umo\u017e\u0148uj\u00ed p\u0159idat druh\u00fd pracovn\u00ed \u00fa\u010det a zcela odd\u011blit data na osobn\u00ed a pracovn\u00ed. <\/p>\n

\"Mobiln\u00ed
\n
\nApple Business Manager <\/a><\/noindex> \u2014 nativn\u00ed syst\u00e9m centralizovan\u00e9ho \u0159\u00edzen\u00ed od Apple. Um\u00ed spravovat pouze za\u0159\u00edzen\u00ed Apple, po\u010d\u00edta\u010de s macOS a telefony na iOS. Podporuje BYOD, vytv\u00e1\u0159\u00ed druh\u00e9 izolovan\u00e9 prost\u0159ed\u00ed s jin\u00fdm \u00fa\u010dtem iCloud.<\/p>\n

\"Mobiln\u00ed
\n
\nGoogle Cloud Endpoint Management<\/a><\/noindex> \u2014 umo\u017e\u0148uje spravovat telefony na Androidu a Apple iOS, stejn\u011b jako stoln\u00ed po\u010d\u00edta\u010de na Windows 10. Podporuje BYOD.<\/p>\n

\"Mobiln\u00ed
\nSamsung Knox UEM<\/a><\/noindex> \u2014 podporuje pouze mobiln\u00ed za\u0159\u00edzen\u00ed Samsung. P\u0159i\u010dem\u017e ihned je mo\u017en\u00e9 vyu\u017e\u00edt pouze Samsung Mobile Management<\/a><\/noindex>.<\/p>\n

Ve skute\u010dnosti existuje mnohem v\u00edce poskytovatel\u016f UEM, ale nebudeme je v\u0161echny zkoumat v tomto \u010dl\u00e1nku. Hlavn\u00ed je m\u00edt na pam\u011bti, \u017ee takov\u00e9 syst\u00e9my ji\u017e existuj\u00ed a umo\u017e\u0148uj\u00ed administr\u00e1torovi adekv\u00e1tn\u011b konfigurovat u\u017eivatelsk\u00e1 za\u0159\u00edzen\u00ed podle st\u00e1vaj\u00edc\u00edho modelu hrozeb. <\/p>\n

Model hrozeb<\/h2>\n

\nNe\u017e za\u010dneme vyb\u00edrat ochrann\u00e9 n\u00e1stroje, je t\u0159eba pochopit, p\u0159ed \u010d\u00edm se chr\u00e1n\u00edme, co m\u016f\u017ee b\u00fdt v na\u0161em konkr\u00e9tn\u00edm p\u0159\u00edpad\u011b nejhor\u0161\u00ed. A\u017e na to, \u017ee na\u0161e t\u011blo je snadno zraniteln\u00e9 nejen pro kulku, ale i pro vidlici se h\u0159eb\u00edkem, ale p\u0159ece si p\u0159ece nenos\u00edme nepr\u016fst\u0159elnou vestu, kdy\u017e vych\u00e1z\u00edme z domu. Proto na\u0161e model hrozeb nezahrnuje riziko, \u017ee n\u00e1s n\u011bkdo post\u0159el\u00ed na cest\u011b do pr\u00e1ce, i kdy\u017e statisticky to nen\u00ed a\u017e tak nepravd\u011bpodobn\u00e9. Z\u00e1rove\u0148 v ur\u010dit\u00fdch podm\u00ednk\u00e1ch no\u0161en\u00ed nepr\u016fst\u0159eln\u00e9 vesty d\u00e1v\u00e1 smysl. <\/p>\n

V r\u016fzn\u00fdch firm\u00e1ch se modely hrozeb li\u0161\u00ed. Vezm\u011bme si nap\u0159\u00edklad smartphone kur\u00fdra, kter\u00fd veze z\u00e1silku k z\u00e1kazn\u00edkovi. Na jeho smartphonu je pouze adresa aktu\u00e1ln\u00ed dod\u00e1vky a trasa na map\u011b. Nejsmutn\u011bj\u0161\u00ed, co se m\u016f\u017ee s jeho daty st\u00e1t, je \u00fanik adresy dod\u00e1vky z\u00e1silky. <\/p>\n

A te\u010f smartphone \u00fa\u010detn\u00edho. Ten m\u00e1 p\u0159\u00edstup do firemn\u00ed s\u00edt\u011b p\u0159es VPN, m\u00e1 nainstalovanou aplikaci firemn\u00ed banky a uchov\u00e1v\u00e1 dokumenty s cenn\u00fdmi informacemi. Je z\u0159ejm\u00e9, \u017ee hodnota dat na t\u011bchto dvou za\u0159\u00edzen\u00edch se v\u00fdrazn\u011b li\u0161\u00ed a m\u011bla by b\u00fdt chr\u00e1n\u011bna r\u016fzn\u00fdmi zp\u016fsoby. <\/p>\n

Zachr\u00e1n\u00ed n\u00e1s antivirov\u00fd program?<\/h2>\n

\nBohu\u017eel, za marketingov\u00fdmi slogany se ztr\u00e1c\u00ed skute\u010dn\u00fd smysl \u00faloh, kter\u00e9 antivirov\u00fd program na mobiln\u00edm za\u0159\u00edzen\u00ed pln\u00ed. Pokus\u00edme se podrobn\u011bji rozebrat, co antivirov\u00fd program na telefonu d\u011bl\u00e1. <\/p>\n

Auditing bezpe\u010dnosti<\/b><\/p>\n

V\u011bt\u0161ina modern\u00edch mobiln\u00edch antivirov\u00fdch program\u016f prov\u00e1d\u00ed audit bezpe\u010dnostn\u00edch nastaven\u00ed za\u0159\u00edzen\u00ed. N\u011bkdy se tento audit naz\u00fdv\u00e1 \"kontrola reputace za\u0159\u00edzen\u00ed\". Antivirov\u00e9 programy pova\u017euj\u00ed za\u0159\u00edzen\u00ed za bezpe\u010dn\u00e9, pokud jsou spln\u011bny \u010dty\u0159i podm\u00ednky:<\/p>\n