{"id":94321,"date":"2020-09-15T19:42:32","date_gmt":"2020-09-15T17:42:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/rukovodstvo-po-bezopasnosti-dns"},"modified":"2020-09-15T19:42:32","modified_gmt":"2020-09-15T17:42:32","slug":"rukovodstvo-po-bezopasnosti-dns","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/rukovodstvo-po-bezopasnosti-dns","title":{"rendered":"P\u0159\u00edru\u010dka pro zabezpe\u010den\u00ed DNS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"P\u0159\u00edru\u010dka pro zabezpe\u010den\u00ed DNS\" src=\"\/wp-content\/uploads\/2020\/09\/e29223def3c7c13eaa45a24967d6bba0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nBezpe\u010dnost by m\u011bla b\u00fdt ned\u00edlnou sou\u010d\u00e1st\u00ed pl\u00e1nu spole\u010dnosti na zaji\u0161t\u011bn\u00ed bezpe\u010dnosti. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/what-is-dns\/\"> . Vytvo\u0159te A-z\u00e1znam blog a ur\u010dete pro n\u011bj n\u011bjakou fiktivn\u00ed IP (to je ofici\u00e1ln\u00ed <\/a><\/noindex>Slu\u017eby zpracov\u00e1n\u00ed n\u00e1zv\u016f, kter\u00e9 p\u0159etv\u00e1\u0159ej\u00ed n\u00e1zvy s\u00ed\u0165ov\u00fdch uzl\u016f na IP adresy, pou\u017e\u00edvaj\u00ed doslova v\u0161echny aplikace a slu\u017eby v s\u00edti.<\/p>\n<p><strong>Pokud hacker z\u00edsk\u00e1 kontrolu nad DNS organizace, m\u016f\u017ee bez probl\u00e9m\u016f:<\/strong><\/p>\n<ul>\n<li>p\u0159edat si spr\u00e1vu nad ve\u0159ejn\u011b dostupn\u00fdmi zdroji<\/li>\n<li>p\u0159esm\u011brovat p\u0159\u00edchoz\u00ed e-maily, stejn\u011b jako webov\u00e9 dotazy a pokusy o autentizaci<\/li>\n<li>vytv\u00e1\u0159et a potvrzovat certifik\u00e1ty SSL\/TLS<\/li>\n<\/ul>\n<p>\n<strong>Tento pr\u016fvodce zkoum\u00e1 bezpe\u010dnost DNS z obou stran:<\/strong><\/p>\n<ol>\n<li>Prov\u00e1d\u011bn\u00ed neust\u00e1l\u00e9ho monitorov\u00e1n\u00ed a kontroly nad DNS<\/li>\n<li>Jak nov\u00e9 protokoly DNS, jako jsou DNSSEC, DOH a DoT, mohou pomoci chr\u00e1nit integritu a d\u016fv\u011brnost p\u0159en\u00e1\u0161en\u00fdch DNS dotaz\u016f<\/li>\n<\/ol>\n<p>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2> Co je to bezpe\u010dnost DNS? <\/h2>\n<p>\n<img decoding=\"async\" alt=\"P\u0159\u00edru\u010dka pro zabezpe\u010den\u00ed DNS\" src=\"\/wp-content\/uploads\/2020\/09\/6367857de248c9ee9435f8ec079600be.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3> Bezpe\u010dnost DNS zahrnuje dv\u011b d\u016fle\u017eit\u00e9 sou\u010d\u00e1sti:<\/h3>\n<p><\/p>\n<ol>\n<li>Zaji\u0161t\u011bn\u00ed celkov\u00e9 integrity a dostupnosti slu\u017eeb DNS, kter\u00e9 p\u0159ev\u00e1d\u011bj\u00ed n\u00e1zvy s\u00ed\u0165ov\u00fdch uzl\u016f na IP adresy<\/li>\n<li>Monitorov\u00e1n\u00ed aktivity DNS k odhalen\u00ed mo\u017en\u00fdch bezpe\u010dnostn\u00edch probl\u00e9m\u016f kdekoli ve va\u0161\u00ed s\u00edti<\/li>\n<\/ol>\n<h3> Pro\u010d je DNS n\u00e1chyln\u00e1 k \u00fatok\u016fm? <\/h3>\n<p>\nTechnologie DNS byla vytvo\u0159ena na po\u010d\u00e1tku v\u00fdvoje internetu, dlouho p\u0159edt\u00edm, ne\u017e n\u011bkdo za\u010dal uva\u017eovat o s\u00ed\u0165ov\u00e9 bezpe\u010dnosti. DNS funguje bez autentizace a \u0161ifrov\u00e1n\u00ed, slep\u011b zpracov\u00e1v\u00e1 dotazy jak\u00e9hokoli u\u017eivatele.<\/p>\n<p>V d\u016fsledku toho existuje mnoho zp\u016fsob\u016f, jak podv\u00e9st u\u017eivatele a fal\u0161ovat informace o tom, kde se ve skute\u010dnosti prov\u00e1d\u00ed p\u0159evod n\u00e1zv\u016f na IP adresy.<\/p>\n<h2> Bezpe\u010dnost DNS: ot\u00e1zky a sou\u010d\u00e1sti<\/h2>\n<p>\n<img decoding=\"async\" alt=\"P\u0159\u00edru\u010dka pro zabezpe\u010den\u00ed DNS\" src=\"\/wp-content\/uploads\/2020\/09\/45d61ac4004631a2602518a3d4a51c3c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nBezpe\u010dnost DNS se skl\u00e1d\u00e1 z n\u011bkolika hlavn\u00edch <em>komponenty<\/em>, p\u0159i\u010dem\u017e ka\u017ed\u00fd z nich je t\u0159eba vz\u00edt v \u00favahu k zaji\u0161t\u011bn\u00ed komplexn\u00ed ochrany:<\/p>\n<ul>\n<li><strong>Zes\u00edlen\u00ed bezpe\u010dnosti server\u016f a proces\u016f spr\u00e1vy:<\/strong> zvy\u0161te \u00farove\u0148 zabezpe\u010den\u00ed server\u016f a vytvo\u0159te standardn\u00ed \u0161ablonu pro uv\u00e1d\u011bn\u00ed do provozu<\/li>\n<li><strong>Vylep\u0161en\u00ed protokolu:<\/strong> implementujte DNSSEC, DoT nebo DoH<\/li>\n<li><strong>Analytika a reportov\u00e1n\u00ed: <\/strong>p\u0159idejte protokol ud\u00e1lost\u00ed DNS do SIEM syst\u00e9mu pro dal\u0161\u00ed kontext p\u0159i vy\u0161et\u0159ov\u00e1n\u00ed incident\u016f<\/li>\n<li><strong>Kybernetick\u00e1 rozv\u011bdka a detekce hrozeb:<\/strong> p\u0159ihlaste se k aktivn\u00edmu kan\u00e1lu pro z\u00edsk\u00e1v\u00e1n\u00ed analytick\u00fdch dat o hrozb\u00e1ch<\/li>\n<li><strong>Automatizace: <\/strong>vytvo\u0159te co nejv\u00edce sc\u00e9n\u00e1\u0159\u016f pro automatizaci proces\u016f<\/li>\n<\/ul>\n<p>\nV\u0161echny zm\u00edn\u011bn\u00e9 komponenty na vysok\u00e9 \u00farovni jsou pouze vrcholem ledovce v oblasti zabezpe\u010den\u00ed DNS. V n\u00e1sleduj\u00edc\u00ed \u010d\u00e1sti podrobn\u011b prozkoum\u00e1me konkr\u00e9tn\u00ed p\u0159\u00edpady pou\u017eit\u00ed a osv\u011bd\u010den\u00e9 postupy, kter\u00e9 pot\u0159ebujete zn\u00e1t.<\/p>\n<h2> \u00datoky na DNS<\/h2>\n<p>\n<img decoding=\"async\" alt=\"P\u0159\u00edru\u010dka pro zabezpe\u010den\u00ed DNS\" src=\"\/wp-content\/uploads\/2020\/09\/f44708ad51b13385aa5ce10629944ecc.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<ul>\n<li><strong><noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/dns-cache-poisoning\/\">DNS spoofing nebo \"otravov\u00e1n\u00ed\" cache<\/a><\/noindex>: <\/strong> vyu\u017eit\u00ed zranitelnosti syst\u00e9mu k manipulaci s DNS cache za \u00fa\u010delem p\u0159esm\u011brov\u00e1n\u00ed u\u017eivatel\u016f na jin\u00e9 m\u00edsto<\/li>\n<li><strong><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/513160\/\">DNS tunelov\u00e1n\u00ed<\/a><\/noindex>: <\/strong>se p\u0159ev\u00e1\u017en\u011b pou\u017e\u00edv\u00e1 k obch\u00e1zen\u00ed bezpe\u010dnostn\u00edch opat\u0159en\u00ed pro vzd\u00e1len\u00fd p\u0159\u00edstup<\/li>\n<li><strong>DNS hijacking: <\/strong>p\u0159esm\u011brov\u00e1n\u00ed standardn\u00edho DNS provozu na jin\u00fd c\u00edlov\u00fd DNS server zm\u011bnou registr\u00e1tora dom\u00e9ny<\/li>\n<li><strong>NXDOMAIN \u00fatok: <\/strong>prov\u00e1d\u011bn\u00ed DDoS \u00fatoku na autoritativn\u00ed DNS server zas\u00edl\u00e1n\u00edm neplatn\u00fdch dom\u00e9nov\u00fdch dotaz\u016f pro vynucen\u00ed odpov\u011bdi<\/li>\n<li><strong>fantomov\u00e1 dom\u00e9na: <\/strong> p\u0159inut\u00ed DNS resolver \u010dekat na odpov\u011b\u010f od neexistuj\u00edc\u00edch dom\u00e9n, co\u017e sni\u017euje v\u00fdkonnost<\/li>\n<li><strong>\u00fatok na n\u00e1hodn\u00fd subdom\u00e9nu: <\/strong> napaden\u00e9 hosty a botnety prov\u00e1d\u011bj\u00ed DDoS \u00fatok na existuj\u00edc\u00ed dom\u00e9nu, ale zam\u011b\u0159uj\u00ed se na fale\u0161n\u00e9 subdom\u00e9ny, aby p\u0159inutili DNS server prov\u00e1d\u011bt vyhled\u00e1v\u00e1n\u00ed z\u00e1znam\u016f a p\u0159evz\u00edt kontrolu nad slu\u017ebou<\/li>\n<li><strong>blokov\u00e1n\u00ed dom\u00e9ny: <\/strong> p\u0159edstavuje zas\u00edl\u00e1n\u00ed mnoha spammov\u00fdch odpov\u011bd\u00ed k blokov\u00e1n\u00ed prost\u0159edk\u016f DNS serveru<\/li>\n<li><strong>botnetov\u00fd \u00fatok z koncov\u00fdch za\u0159\u00edzen\u00ed: <\/strong> skupina po\u010d\u00edta\u010d\u016f, modem\u016f, router\u016f a dal\u0161\u00edch za\u0159\u00edzen\u00ed, kter\u00e1 koncentruj\u00ed v\u00fdpo\u010detn\u00ed v\u00fdkon na konkr\u00e9tn\u00ed webov\u00e9 str\u00e1nce a p\u0159et\u011b\u017euj\u00ed ji po\u017eadavky na provoz<\/li>\n<\/ul>\n<p><\/p>\n<h3> \u00datoky vyu\u017e\u00edvaj\u00edc\u00ed DNS<\/h3>\n<p>\n\u00datoky, kter\u00e9 jak\u00fdmkoliv zp\u016fsobem vyu\u017e\u00edvaj\u00ed DNS k napaden\u00ed jin\u00fdch syst\u00e9m\u016f (tj. zm\u011bna DNS z\u00e1znam\u016f nen\u00ed kone\u010dn\u00fdm c\u00edlem):<\/p>\n<ul>\n<li>Fast-Flux<\/li>\n<li>Jednoduch\u00e9 Flux s\u00edt\u011b<\/li>\n<li>Dvojit\u00e9 Flux s\u00edt\u011b<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/513160\/\">DNS tunelov\u00e1n\u00ed<\/a><\/noindex> <\/li>\n<\/ul>\n<p><\/p>\n<h3> \u00datoky na DNS<\/h3>\n<p>\n\u00datoky, p\u0159i nich\u017e se ze serveru DNS vr\u00e1t\u00ed po\u017eadovan\u00e1 IP adresa \u00fato\u010dn\u00edka:<\/p>\n<ul>\n<li>DNS spoofing nebo \"otravov\u00e1n\u00ed\" cache<\/li>\n<li>DNS hijacking<\/li>\n<\/ul>\n<p><\/p>\n<h2> Co je to DNSSEC?<\/h2>\n<p><img decoding=\"async\" alt=\"P\u0159\u00edru\u010dka pro zabezpe\u010den\u00ed DNS\" src=\"\/wp-content\/uploads\/2020\/09\/929b6e632135bd1b059e403e7b4ddab8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDNSSEC \u2013 moduly zabezpe\u010den\u00ed slu\u017eby DNS \u2013 se pou\u017e\u00edvaj\u00ed k ov\u011b\u0159ov\u00e1n\u00ed z\u00e1znam\u016f DNS bez nutnosti zn\u00e1t ve\u0159ejn\u00e9 informace o ka\u017ed\u00e9m konkr\u00e9tn\u00edm DNS dotazu.<\/p>\n<p>DNSSEC pou\u017e\u00edv\u00e1 kl\u00ed\u010de digit\u00e1ln\u00edho podpisu (PKI) k potvrzen\u00ed, \u017ee v\u00fdsledky dotazu dom\u00e9nov\u00e9ho jm\u00e9na poch\u00e1zej\u00ed z povolen\u00e9ho zdroje.<br \/>\nImplementace DNSSEC nen\u00ed pouze nejlep\u0161\u00ed prax\u00ed v oboru, ale tak\u00e9 efektivn\u011b pom\u00e1h\u00e1 p\u0159edej\u00edt v\u011bt\u0161in\u011b \u00fatok\u016f na DNS.<\/p>\n<h4>Princip fungov\u00e1n\u00ed DNSSEC<\/h4>\n<p>\nDNSSEC funguje podobn\u011b jako TLS\/HTTPS, pou\u017e\u00edv\u00e1 dvojice ve\u0159ejn\u00e9ho a soukrom\u00e9ho kl\u00ed\u010de k digit\u00e1ln\u00edmu podepisov\u00e1n\u00ed z\u00e1znam\u016f DNS. Obecn\u00fd p\u0159ehled procesu:<\/p>\n<ol>\n<li>Z\u00e1znamy DNS jsou podepisov\u00e1ny dvojic\u00ed ve\u0159ejn\u00e9ho a soukrom\u00e9ho kl\u00ed\u010de<\/li>\n<li>Odpov\u011bdi na dotazy DNSSEC obsahuj\u00ed po\u017eadovan\u00fd z\u00e1znam, jako\u017e i podpis a ve\u0159ejn\u00fd kl\u00ed\u010d<\/li>\n<li>D\u00e1le <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/pgp-encryption\/\">ve\u0159ejn\u00fd kl\u00ed\u010d <\/a><\/noindex>se pou\u017e\u00edv\u00e1 k ov\u011b\u0159en\u00ed platnosti z\u00e1znamu a podpisu<\/li>\n<\/ol>\n<h2> Bezpe\u010dnost DNS a DNSSEC<\/h2>\n<p>\n<img decoding=\"async\" alt=\"P\u0159\u00edru\u010dka pro zabezpe\u010den\u00ed DNS\" src=\"\/wp-content\/uploads\/2020\/09\/3bd1d530634e82ed6d80040a1d207ff0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDNSSEC je n\u00e1stroj pro ov\u011b\u0159ov\u00e1n\u00ed integrity DNS dotaz\u016f. Neovliv\u0148uje v\u0161ak soukrom\u00ed DNS. Jin\u00fdmi slovy, DNSSEC v\u00e1m m\u016f\u017ee poskytnout jistotu, \u017ee odpov\u011b\u010f na v\u00e1\u0161 DNS dotaz nen\u00ed podvr\u017een\u00e1, ale jak\u00fdkoli \u00fato\u010dn\u00edk m\u016f\u017ee tyto v\u00fdsledky vid\u011bt v takov\u00e9 podob\u011b, v jak\u00e9 byly v\u00e1m p\u0159ed\u00e1ny.<\/p>\n<h2> DoT \u2014 DNS p\u0159es TLS<\/h2>\n<p>\nTransport Layer Security (bezpe\u010dnost na \u00farovni p\u0159enosu, TLS) je kryptografick\u00fd protokol pro ochranu p\u0159en\u00e1\u0161en\u00fdch informac\u00ed p\u0159es s\u00ed\u0165ov\u00e9 spojen\u00ed. Jakmile je mezi klientem a serverem vytvo\u0159eno zabezpe\u010den\u00e9 TLS spojen\u00ed, p\u0159en\u00e1\u0161en\u00e1 data jsou \u0161ifrov\u00e1na a \u017e\u00e1dn\u00ed zprost\u0159edkovatel\u00e9 je nebudou moci vid\u011bt.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/tls-vs-ssl\/\">TLS <\/a><\/noindex>se nej\u010dast\u011bji pou\u017e\u00edv\u00e1 jako sou\u010d\u00e1st HTTPS (SSL) ve va\u0161em webov\u00e9m prohl\u00ed\u017ee\u010di, nebo\u0165 dotazy jsou odes\u00edl\u00e1ny na zabezpe\u010den\u00e9 HTTP servery.<\/p>\n<p>DNS-over-TLS (DNS p\u0159es TLS, DoT) pou\u017e\u00edv\u00e1 protokol TLS k \u0161ifrov\u00e1n\u00ed UDP provozu b\u011b\u017en\u00fdch DNS dotaz\u016f.<br \/>\n\u0160ifrov\u00e1n\u00ed t\u011bchto dotaz\u016f v textov\u00e9m form\u00e1tu pom\u00e1h\u00e1 chr\u00e1nit u\u017eivatele nebo aplikace, kter\u00e9 prov\u00e1d\u011bj\u00ed dotazy, p\u0159ed n\u011bkolika \u00fatoky.<\/p>\n<ul>\n<li><strong>MitM, nebo \"\u010dlov\u011bk uprost\u0159ed\"<\/strong>: bez \u0161ifrov\u00e1n\u00ed m\u016f\u017ee mezi\u010dl\u00e1nek, kter\u00fd se nach\u00e1z\u00ed mezi klientem a autoritativn\u00edm DNS serverem, potenci\u00e1ln\u011b odeslat klientovi v odpov\u011bdi na dotaz fale\u0161n\u00e9 nebo nebezpe\u010dn\u00e9 informace.<\/li>\n<li><strong>\u0160pehov\u00e1n\u00ed a sledov\u00e1n\u00ed<\/strong>: bez \u0161ifrov\u00e1n\u00ed dotaz\u016f maj\u00ed mezi\u010dl\u00e1nky snadnou mo\u017enost prohl\u00ed\u017eet, na jak\u00e9 str\u00e1nky konkr\u00e9tn\u00ed u\u017eivatel nebo aplikace p\u0159istupuje. I kdy\u017e z pouh\u00e9ho DNS nebude mo\u017en\u00e9 zjistit konkr\u00e9tn\u00ed nav\u0161t\u00edvenou str\u00e1nku na webu, z\u00e1kladn\u00ed znalost dotazovan\u00fdch dom\u00e9n sta\u010d\u00ed k vytvo\u0159en\u00ed profilu syst\u00e9mu nebo jednotlivce.<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"P\u0159\u00edru\u010dka pro zabezpe\u010den\u00ed DNS\" src=\"\/wp-content\/uploads\/2020\/09\/31bb5e540feac0302244253b1c12ed32.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nZdroj: <noindex><a rel=\"nofollow\" href=\"https:\/\/faculty.sites.uci.edu\/zhouli\/files\/2019\/11\/conext19.pdf\">University of California Irvine<\/a><\/noindex><\/p>\n<h2> DoH \u2014 DNS p\u0159es HTTPS<\/h2>\n<p>\nDNS-over-HTTPS (DNS p\u0159es HTTPS, DoH) je experiment\u00e1ln\u00ed protokol, kter\u00fd spole\u010dn\u011b propaguj\u00ed Mozilla a Google. Jeho c\u00edle jsou podobn\u00e9 jako u protokolu DoT \u2014 pos\u00edlen\u00ed soukrom\u00ed u\u017eivatel\u016f na internetu \u0161ifrov\u00e1n\u00edm DNS dotaz\u016f a odpov\u011bd\u00ed.<\/p>\n<p>Standardn\u00ed DNS dotazy jsou p\u0159en\u00e1\u0161eny p\u0159es UDP. Dotazy a odpov\u011bdi lze sledovat pomoc\u00ed n\u00e1stroj\u016f, jako jsou <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/how-to-use-wireshark\/\">Wireshark<\/a><\/noindex>. DoT tyto dotazy \u0161ifruje, ale p\u0159esto jsou st\u00e1le identifikovateln\u00e9 jako pom\u011brn\u011b jasn\u00fd UDP provoz v s\u00edti.<\/p>\n<p>DoH pou\u017e\u00edv\u00e1 jin\u00fd p\u0159\u00edstup a p\u0159en\u00e1\u0161\u00ed za\u0161ifrovan\u00e9 dotazy na p\u0159evod n\u00e1zv\u016f s\u00ed\u0165ov\u00fdch uzl\u016f p\u0159es HTTPS spojen\u00ed, kter\u00e1 vypadaj\u00ed v s\u00edti jako jak\u00fdkoli jin\u00fd webov\u00fd dotaz.<\/p>\n<p>Toto rozli\u0161en\u00ed m\u00e1 velmi d\u016fsledky jak pro syst\u00e9mov\u00e9 administr\u00e1tory, tak pro budoucnost p\u0159evodu n\u00e1zv\u016f.<\/p>\n<ol>\n<li>DNS filtrov\u00e1n\u00ed je b\u011b\u017en\u00fd zp\u016fsob filtrov\u00e1n\u00ed webov\u00e9ho provozu pro ochranu u\u017eivatel\u016f p\u0159ed phishingov\u00fdmi \u00fatoky, webov\u00fdmi str\u00e1nkami \u0161\u00ed\u0159\u00edc\u00edmi malware nebo jinou potenci\u00e1ln\u011b nebezpe\u010dnou internetovou aktivitou v korpor\u00e1tn\u00ed s\u00edti. Protokol DoH obch\u00e1z\u00ed tyto filtry, \u010d\u00edm\u017e potenci\u00e1ln\u011b vystavuje u\u017eivatele a s\u00ed\u0165 vy\u0161\u0161\u00edmu riziku. <\/li>\n<li>V sou\u010dasn\u00e9m modelu p\u0159evodu n\u00e1zv\u016f ka\u017ed\u00e9 za\u0159\u00edzen\u00ed v s\u00edti z\u00edsk\u00e1v\u00e1 DNS dotazy do ur\u010dit\u00e9 m\u00edry z jednoho a t\u00e9ho\u017e m\u00edsta (ur\u010den\u00e9ho DNS serveru). DoH a zejm\u00e9na jeho implementace ve Firefoxu ukazuj\u00ed, \u017ee se to v budoucnu m\u016f\u017ee zm\u011bnit. Ka\u017ed\u00e1 aplikace na po\u010d\u00edta\u010di m\u016f\u017ee z\u00edsk\u00e1vat \u00fadaje z r\u016fzn\u00fdch DNS zdroj\u016f, co\u017e zna\u010dn\u011b komplikuje hled\u00e1n\u00ed a odstra\u0148ov\u00e1n\u00ed probl\u00e9m\u016f, zaji\u0161t\u011bn\u00ed bezpe\u010dnosti a modelov\u00e1n\u00ed rizik. <\/li>\n<\/ol>\n<p><img decoding=\"async\" alt=\"P\u0159\u00edru\u010dka pro zabezpe\u010den\u00ed DNS\" src=\"\/wp-content\/uploads\/2020\/09\/46ece02ca361b133d4a6bd488b917c73.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nZdroj: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/what-is-powershell\/\">www.varonis.com\/blog\/what-is-powershell<\/a><\/noindex><\/p>\n<h3> Jak\u00fd je rozd\u00edl mezi DNS p\u0159es TLS a DNS p\u0159es HTTPS?<\/h3>\n<p>\nZa\u010dneme s DNS p\u0159es TLS (DoT). Hlavn\u00ed d\u016fraz zde spo\u010d\u00edv\u00e1 v tom, \u017ee p\u016fvodn\u00ed protokol DNS nen\u00ed m\u011bn\u011bn, ale je jednodu\u0161e bezpe\u010dn\u011b p\u0159en\u00e1\u0161en p\u0159es zabezpe\u010den\u00fd kan\u00e1l. DoH pak umis\u0165uje DNS do form\u00e1tu HTTP p\u0159ed proveden\u00edm dotaz\u016f.<\/p>\n<h2> Upozorn\u011bn\u00ed na monitoring DNS<\/h2>\n<p>\n<img decoding=\"async\" alt=\"P\u0159\u00edru\u010dka pro zabezpe\u010den\u00ed DNS\" src=\"\/wp-content\/uploads\/2020\/09\/fbbd9f320922dbd2eec180a253ba54f0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nEfektivn\u00ed sledov\u00e1n\u00ed DNS provozu ve va\u0161\u00ed s\u00edti s c\u00edlem odhalit podez\u0159el\u00e9 anom\u00e1lie je kl\u00ed\u010dov\u00e9 pro v\u010dasn\u00e9 odhalen\u00ed hacknut\u00ed. Pou\u017eit\u00ed n\u00e1stroje, jako je Varonis Edge, v\u00e1m umo\u017en\u00ed b\u00fdt informovan\u00ed o v\u0161ech d\u016fle\u017eit\u00fdch ukazatel\u00edch a vytv\u00e1\u0159et profily pro ka\u017ed\u00fd \u00fa\u010det ve va\u0161\u00ed s\u00edti. M\u016f\u017eete nastavit generov\u00e1n\u00ed upozorn\u011bn\u00ed na z\u00e1klad\u011b kombinac\u00ed ud\u00e1lost\u00ed, kter\u00e9 se odehr\u00e1ly v ur\u010dit\u00e9m \u010dasov\u00e9m obdob\u00ed.<\/p>\n<p>Sledov\u00e1n\u00ed zm\u011bn DNS, um\u00edst\u011bn\u00ed \u00fa\u010dtu a tak\u00e9 fakt\u016f prvn\u00edho pou\u017eit\u00ed a p\u0159\u00edstupu k citliv\u00fdm \u00fadaj\u016fm, stejn\u011b jako \u010dinnosti mimo pracovn\u00ed dobu \u2013 to jsou jen n\u011bkter\u00e9 ukazatele, kter\u00e9 lze porovnat pro vytvo\u0159en\u00ed podrobn\u011bj\u0161\u00edho obrazu detekce.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/519108\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0427\u0435\u043c \u0431\u044b \u043d\u0438 \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0430\u0441\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f, \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c DNS \u0434\u043e\u043b\u0436\u043d\u0430 \u044f\u0432\u043b\u044f\u0442\u044c\u0441\u044f \u043d\u0435\u043e\u0442\u044a\u0435\u043c\u043b\u0435\u043c\u043e\u0439 \u0447\u0430\u0441\u0442\u044c\u044e \u0435\u0435 \u043f\u043b\u0430\u043d\u0430 \u043f\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0421\u043b\u0443\u0436\u0431\u044b \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0438\u043c\u0435\u043d, \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u0438\u043c\u0435\u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0437\u043b\u043e\u0432 \u0432 IP-\u0430\u0434\u0440\u0435\u0441\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0432\u0441\u0435\u043c\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438 \u0438 \u0441\u043b\u0443\u0436\u0431\u0430\u043c\u0438 \u0432 \u0441\u0435\u0442\u0438. \u0415\u0441\u043b\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u043b\u0443\u0447\u0438\u0442 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 DNS \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u0442\u043e \u0441\u043c\u043e\u0436\u0435\u0442 \u0431\u0435\u0437 \u043f\u0440\u043e\u0431\u043b\u0435\u043c: \u043f\u0435\u0440\u0435\u0434\u0430\u0442\u044c \u0441\u0435\u0431\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430\u0434 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438, \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0438\u043c\u0438\u0441\u044f \u0432 \u043e\u0431\u0449\u0435\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":94322,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-94321","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0427\u0435\u043c \u0431\u044b \u043d\u0438 \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0430\u0441\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f, \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/rukovodstvo-po-bezopasnosti-dns\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 DNS | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0427\u0435\u043c \u0431\u044b \u043d\u0438 \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0430\u0441\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f, \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/rukovodstvo-po-bezopasnosti-dns\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-09-15T17:42:32+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-09-15T17:42:32+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47P\u0159\u00edru\u010dka pro zabezpe\u010den\u00ed DNS | ProHoster","description":"Bezpe\u010dnost by m\u011bla b\u00fdt ned\u00edlnou sou\u010d\u00e1st\u00ed pl\u00e1nu spole\u010dnosti na zaji\u0161t\u011bn\u00ed bezpe\u010dnosti.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/rukovodstvo-po-bezopasnosti-dns","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 DNS | ProHoster","og:description":"\u0427\u0435\u043c \u0431\u044b \u043d\u0438 \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0430\u0441\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f, \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/rukovodstvo-po-bezopasnosti-dns","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-15T17:42:32+00:00","article:modified_time":"2020-09-15T17:42:32+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94321","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:29:29","updated":"2022-09-30 08:27:56","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/94321","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=94321"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/94321\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/94322"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=94321"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=94321"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=94321"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}