{"id":97203,"date":"2020-10-16T14:42:53","date_gmt":"2020-10-16T12:42:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/kak-my-zashhishhaem-virtualnye-rabochie-stoly-klientov-ot-virusov-shpionov-i-atak"},"modified":"2020-10-16T14:42:53","modified_gmt":"2020-10-16T12:42:53","slug":"kak-my-zashhishhaem-virtualnye-rabochie-stoly-klientov-ot-virusov-shpionov-i-atak","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-my-zashhishhaem-virtualnye-rabochie-stoly-klientov-ot-virusov-shpionov-i-atak","title":{"rendered":"Jak chr\u00e1n\u00edme virtu\u00e1ln\u00ed pracovn\u00ed stoly klient\u016f p\u0159ed viry, \u0161pehy a \u00fatoky","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>V tomto roce mnoho firem sp\u011bchalo k pr\u00e1ci na d\u00e1lku. N\u011bkter\u00fdm klient\u016fm jsme <noindex><a rel=\"nofollow\" href=\"https:\/\/uni.dtln.ru\/digest\/150-virtualnyh-rabochih-mest-dlya-call-centra-za-nedelyu\">pom\u00e1hali<\/a><\/noindex> organizovat v\u00edce ne\u017e sto vzd\u00e1len\u00fdch pracovn\u00edch m\u00edst za t\u00fdden. Bylo d\u016fle\u017eit\u00e9 to ud\u011blat nejen rychle, ale i bezpe\u010dn\u011b. Na pomoc p\u0159i\u0161la technologie VDI: s jej\u00ed pomoc\u00ed je snadn\u00e9 \u0161\u00ed\u0159it bezpe\u010dnostn\u00ed politiky na v\u0161echna pracovn\u00ed m\u00edsta a chr\u00e1nit se p\u0159ed \u00faniky dat.\u00a0<\/p>\n<p>V tomto \u010dl\u00e1nku v\u00e1m uk\u00e1\u017eu, jak funguje na\u0161e slu\u017eba virtu\u00e1ln\u00edch pracovn\u00edch stol\u016f postaven\u00e1 na Citrix VDI z pohledu informa\u010dn\u00ed bezpe\u010dnosti. Uk\u00e1\u017eu, co d\u011bl\u00e1me, abychom ochr\u00e1nili klientsk\u00e9 pracovn\u00ed stoly p\u0159ed vn\u011bj\u0161\u00edmi hrozbami, jako jsou \u0161ifrovac\u00ed viry nebo c\u00edlen\u00e9 \u00fatoky.\u00a0<\/p>\n<p><img decoding=\"async\" alt=\"Jak chr\u00e1n\u00edme virtu\u00e1ln\u00ed pracovn\u00ed stoly klient\u016f p\u0159ed viry, \u0161pehy a \u00fatoky\" src=\"\/wp-content\/uploads\/2020\/10\/bd9f5c9d944abf021f1a73351b88f49b.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Jak\u00e9 bezpe\u010dnostn\u00ed \u00fakoly \u0159e\u0161\u00edme\u00a0<\/h2>\n<p>\nIdentifikovali jsme n\u011bkolik hlavn\u00edch bezpe\u010dnostn\u00edch hrozeb pro slu\u017ebu. Na jedn\u00e9 stran\u011b hroz\u00ed, \u017ee se virtu\u00e1ln\u00ed pracovn\u00ed st\u016fl nakaz\u00ed z po\u010d\u00edta\u010de u\u017eivatele. Na druh\u00e9 stran\u011b je zde nebezpe\u010d\u00ed p\u0159ej\u00edt z virtu\u00e1ln\u00edho pracovn\u00edho stolu do otev\u0159en\u00e9ho prostoru internetu a st\u00e1hnout infikovan\u00fd soubor. I kdy\u017e se to stane, nem\u011blo by to ovlivnit celou infrastrukturu. Proto jsme p\u0159i vytv\u00e1\u0159en\u00ed slu\u017eby \u0159e\u0161ili n\u011bkolik \u00fakol\u016f:\u00a0<\/p>\n<ul>\n<li>Ochrana cel\u00e9 VDI infrastruktury p\u0159ed vn\u011bj\u0161\u00edmi hrozbami.\n<\/li>\n<li>Izolace klient\u016f navz\u00e1jem.\n<\/li>\n<li>Ochrana samotn\u00fdch virtu\u00e1ln\u00edch pracovn\u00edch stol\u016f.\u00a0\n<\/li>\n<li>Bezpe\u010dn\u00e9 p\u0159ipojen\u00ed u\u017eivatel\u016f z jak\u00fdchkoli za\u0159\u00edzen\u00ed.\n<\/li>\n<\/ul>\n<p>\nJ\u00e1dr\u016fm ochrany se stal FortiGate \u2013 firewall nov\u00e9 generace od Fortinet. Kontroluje provoz VDI infrastruktury, zaji\u0161\u0165uje izolovanou infrastrukturu pro ka\u017ed\u00e9ho klienta a chr\u00e1n\u00ed p\u0159ed zranitelnostmi na stran\u011b u\u017eivatele. Jeho schopnosti jsou dostate\u010dn\u00e9 na to, aby pokryly v\u011bt\u0161inu ot\u00e1zek informa\u010dn\u00ed bezpe\u010dnosti.\u00a0<\/p>\n<p>Ale pokud m\u00e1 spole\u010dnost specifick\u00e9 po\u017eadavky na bezpe\u010dnost, nab\u00edz\u00edme dal\u0161\u00ed mo\u017enosti:\u00a0<\/p>\n<ul>\n<li>Organizujeme zabezpe\u010den\u00e9 p\u0159ipojen\u00ed pro pr\u00e1ci z dom\u00e1c\u00edch po\u010d\u00edta\u010d\u016f.\n<\/li>\n<li>Poskytujeme p\u0159\u00edstup k samostatn\u00e9 anal\u00fdze bezpe\u010dnostn\u00edch protokol\u016f.\n<\/li>\n<li>Nab\u00edz\u00edme spr\u00e1vu antivirov\u00e9 ochrany na pracovn\u00edch stolech.\n<\/li>\n<li>Chr\u00e1n\u00edme p\u0159ed zranitelnostmi \u201enult\u00e9ho dne\u201c.\u00a0\n<\/li>\n<li>Nastavujeme mnohofaktorovou autentizaci pro dodate\u010dnou ochranu p\u0159ed neopr\u00e1vn\u011bn\u00fdm p\u0159ipojen\u00edm.<\/li>\n<\/ul>\n<p>\nPodrobn\u011bji v\u00e1m \u0159eknu, jak jsme splnili tyto \u00fakoly.\u00a0<\/p>\n<h2>Jak chr\u00e1n\u00edme infrastrukturu a zaji\u0161\u0165ujeme s\u00ed\u0165ovou bezpe\u010dnost<\/h2>\n<p>\n<b>Segmentujeme s\u00ed\u0165ovou \u010d\u00e1st.<\/b> Na st\u00e1nku vy\u010dle\u0148ujeme uzav\u0159en\u00fd segment managementu pro spr\u00e1vu v\u0161ech zdroj\u016f. Segment managementu nen\u00ed p\u0159\u00edstupn\u00fd zven\u010d\u00ed: v p\u0159\u00edpad\u011b \u00fatoku na klienta se \u00fato\u010dn\u00edci do n\u011bj nemohou dostat.\u00a0<\/p>\n<p>Za ochranu odpov\u00edd\u00e1 FortiGate. Ten kombinuje funkce antiviru, firewallu a syst\u00e9mu prevence naru\u0161en\u00ed (intrusion prevention system, IPS).\u00a0<\/p>\n<p>Pro ka\u017ed\u00e9ho klienta vytv\u00e1\u0159\u00edme izolovan\u00fd s\u00ed\u0165ov\u00fd segment pro virtu\u00e1ln\u00ed pracovn\u00ed stanice. K tomu m\u00e1 FortiGate technologii virtu\u00e1ln\u00edch dom\u00e9n, nebo VDOM. Ta umo\u017e\u0148uje rozd\u011blit firewall na n\u011bkolik virtu\u00e1ln\u00edch entit a ka\u017ed\u00e9mu klientovi p\u0159id\u011blit sv\u016fj VDOM, kter\u00fd se chov\u00e1 jako samostatn\u00fd firewall. Pro segment managementu tak\u00e9 vytv\u00e1\u0159\u00edme samostatn\u00fd VDOM. <\/p>\n<p>Vypad\u00e1 to takto:<br \/>\n<img decoding=\"async\" alt=\"Jak chr\u00e1n\u00edme virtu\u00e1ln\u00ed pracovn\u00ed stoly klient\u016f p\u0159ed viry, \u0161pehy a \u00fatoky\" src=\"\/wp-content\/uploads\/2020\/10\/24d9f6fc2b50079e7d6eb60bc19429a4.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMezi klienty nen\u00ed s\u00ed\u0165ov\u00e1 propojenost: ka\u017ed\u00fd \u017eije ve sv\u00e9m VDOM a nep\u016fsob\u00ed na ostatn\u00ed. Bez t\u00e9to technologie bychom museli rozd\u011blovat klienty pravidly firewallu, co\u017e je riskantn\u00ed kv\u016fli lidsk\u00e9mu faktoru. Takov\u00e1 pravidla lze p\u0159irovnat ke dve\u0159\u00edm, kter\u00e9 je t\u0159eba neust\u00e1le zav\u00edrat. V p\u0159\u00edpad\u011b VDOM vlastn\u011b \u201edve\u0159e\u201c v\u016fbec nez\u016fst\u00e1vaj\u00ed.\u00a0<\/p>\n<p>V samostatn\u00e9m VDOM m\u00e1 klient svou adresaci a sm\u011brov\u00e1n\u00ed. Proto p\u0159ekr\u00fdv\u00e1n\u00ed rozsah\u016f nen\u00ed pro firmu probl\u00e9m. Klient si m\u016f\u017ee p\u0159i\u0159adit pot\u0159ebn\u00e9 IP adresy k virtu\u00e1ln\u00edm pracovn\u00edm stanic\u00edm. To je v\u00fdhodn\u00e9 pro velk\u00e9 firmy, kter\u00e9 maj\u00ed sv\u00e9 IP pl\u00e1ny.\u00a0<\/p>\n<p><b>\u0158e\u0161\u00edme ot\u00e1zky propojen\u00ed s firemn\u00ed s\u00edt\u00ed klienta.<\/b> Samostatn\u00fdm \u00fakolem je propojen\u00ed VDI s klientskou infrastrukturou. Pokud firma uchov\u00e1v\u00e1 firemn\u00ed syst\u00e9my v na\u0161em datov\u00e9m centru, lze jednodu\u0161e prot\u00e1hnout s\u00ed\u0165ov\u00fd kabel z jeho vybaven\u00ed do firewallu. \u010cast\u011bji se ale setk\u00e1v\u00e1me s vzd\u00e1lenou lokalitou \u2013 jin\u00fdm datov\u00fdm centrem nebo kancel\u00e1\u0159\u00ed klienta. V tomto p\u0159\u00edpad\u011b prom\u00fd\u0161l\u00edme bezpe\u010dnou v\u00fdm\u011bnu s lokalitou a budujeme site2site VPN pomoc\u00ed IPsec VPN.\u00a0<\/p>\n<p>Sch\u00e9mata se mohou li\u0161it v z\u00e1vislosti na slo\u017eitosti infrastruktury. N\u011bkde sta\u010d\u00ed p\u0159ipojit k VDI jedinou kancel\u00e1\u0159skou s\u00ed\u0165 \u2013 tam sta\u010d\u00ed statick\u00e9 sm\u011brov\u00e1n\u00ed. V velk\u00fdch spole\u010dnostech existuje mnoho s\u00edt\u00ed, kter\u00e9 se neust\u00e1le m\u011bn\u00ed; zde je pro klienta pot\u0159eba dynamick\u00e9 sm\u011brov\u00e1n\u00ed. Pou\u017e\u00edv\u00e1me r\u016fzn\u00e9 protokoly: ji\u017e jsme m\u011bli p\u0159\u00edpady s OSPF (Open Shortest Path First), GRE tunely (Generic Routing Encapsulation) a BGP (Border Gateway Protocol). FortiGate podporuje s\u00ed\u0165ov\u00e9 protokoly v jednotliv\u00fdch VDOM, ani\u017e by to m\u011blo vliv na ostatn\u00ed klienty.\u00a0<\/p>\n<p>M\u016f\u017eete tak\u00e9 vytvo\u0159it a \u0413\u041e\u0421\u0422-VPN \u2013 \u0161ifrov\u00e1n\u00ed na z\u00e1klad\u011b certifikovan\u00fdch prost\u0159edk\u016f kryptochr\u00e1n\u011bn\u00ed FSB RF. Nap\u0159\u00edklad pomoc\u00ed \u0159e\u0161en\u00ed t\u0159\u00eddy K\u04211 ve virtu\u00e1ln\u00edm prost\u0159ed\u00ed \u201e\u0421-\u0422\u0435\u0440\u0440\u0430 virtu\u00e1ln\u00ed br\u00e1na\u201c nebo P\u0410\u041a ViPNet, A\u041f\u041a\u0428 \u201eKontinent\u201c, \u201e\u0421-\u0422\u0435\u0440\u0440\u0430\u201c.<\/p>\n<p><b>Nastavujeme skupinov\u00e9 politiky.<\/b> Dohodneme se s klientem na skupinov\u00fdch politik\u00e1ch, kter\u00e9 se aplikuj\u00ed na VDI. Zde se principy nastaven\u00ed nijak neli\u0161\u00ed od nastaven\u00ed politik v kancel\u00e1\u0159i. Konfigurujeme integraci s Active Directory a delegujeme klient\u016fm spr\u00e1vu n\u011bkter\u00fdch skupinov\u00fdch politik. Spr\u00e1vci klienta mohou aplikovat politiky na objekt Computer, spravovat organiza\u010dn\u00ed jednotku v Active Directory a vytv\u00e1\u0159et u\u017eivatele.\u00a0<\/p>\n<p>Na FortiGate p\u00ed\u0161eme s\u00ed\u0165ovou bezpe\u010dnostn\u00ed politiku pro ka\u017ed\u00fd klientsk\u00fd VDOM, nastavujeme omezen\u00ed p\u0159\u00edstupu a kontrolujeme provoz. Pou\u017e\u00edv\u00e1me n\u011bkolik modul\u016f FortiGate:\u00a0<\/p>\n<ul>\n<li>modul IPS kontroluje provoz na malware a br\u00e1n\u00ed naru\u0161en\u00ed;<\/li>\n<li>antivirov\u00fd syst\u00e9m chr\u00e1n\u00ed jednotliv\u00e9 pracovn\u00ed stanice p\u0159ed \u0161kodliv\u00fdm a \u0161pehovac\u00edm softwarem;<\/li>\n<li>webov\u00fd filtr blokuje p\u0159\u00edstup k ned\u016fv\u011bryhodn\u00fdm zdroj\u016fm a web\u016fm s \u0161kodliv\u00fdm nebo nep\u0159ijateln\u00fdm obsahem;<\/li>\n<li>nastaven\u00ed firewallu mohou povolit u\u017eivatel\u016fm p\u0159\u00edstup na internet pouze na ur\u010dit\u00e9 webov\u00e9 str\u00e1nky.\u00a0<\/li>\n<\/ul>\n<p>\nN\u011bkdy chce klient s\u00e1m \u0159\u00eddit p\u0159\u00edstup zam\u011bstnanc\u016f k web\u016fm. \u010cast\u011bji s takov\u00fdm po\u017eadavkem p\u0159ich\u00e1zej\u00ed banky: bezpe\u010dnostn\u00ed slu\u017eby vy\u017eaduj\u00ed, aby kontrola p\u0159\u00edstupu z\u016fst\u00e1vala na stran\u011b spole\u010dnosti. Takov\u00e9 spole\u010dnosti samy monitoruj\u00ed provoz a pravideln\u011b m\u011bn\u00ed politiky. V tomto p\u0159\u00edpad\u011b ve\u0161ker\u00fd provoz z FortiGate obrac\u00edme sm\u011brem ke klientovi. K tomu pou\u017e\u00edv\u00e1me nakonfigurovan\u00e9 propojen\u00ed s infrastrukturou spole\u010dnosti. Pot\u00e9 klient s\u00e1m nastavuje pravidla p\u0159\u00edstupu do podnikov\u00e9 s\u00edt\u011b a na internet.\u00a0<\/p>\n<p><b>Sledujeme ud\u00e1losti na st\u00e1nku.<\/b> Spolu s FortiGate pou\u017e\u00edv\u00e1me FortiAnalyzer \u2013 kolektor log\u016f od Fortinetu. Pomoc\u00ed n\u011bj sledujeme v\u0161echny z\u00e1znamy ud\u00e1lost\u00ed na VDI na jednom m\u00edst\u011b, hled\u00e1me podez\u0159el\u00e9 aktivity a sledujeme korelace.\u00a0<\/p>\n<p>Jeden z na\u0161ich klient\u016f pou\u017e\u00edv\u00e1 produkty Fortinet ve sv\u00e9 kancel\u00e1\u0159i. Pro n\u011bj jsme nastavili export log\u016f \u2013 klient tak mohl analyzovat v\u0161echny ud\u00e1losti bezpe\u010dnosti pro kancel\u00e1\u0159sk\u00e9 stroje a virtu\u00e1ln\u00ed pracovn\u00ed plochy.<\/p>\n<h2>Jak chr\u00e1n\u00edme virtu\u00e1ln\u00ed pracovn\u00ed plochy<\/h2>\n<p>\n<b>P\u0159ed zn\u00e1m\u00fdmi hrozbami.<\/b> Pokud chce klient samostatn\u011b spravovat antivirovou ochranu, nav\u00edc instalujeme Kaspersky Security pro virtu\u00e1ln\u00ed prost\u0159ed\u00ed.\u00a0<\/p>\n<p>Toto \u0159e\u0161en\u00ed dob\u0159e funguje v cloudu. V\u0161ichni jsme zvykl\u00ed, \u017ee klasick\u00fd antivir Kaspersky je \u201et\u011b\u017ek\u00e9\u201c \u0159e\u0161en\u00ed. Na rozd\u00edl od n\u011bj, Kaspersky Security pro virtu\u00e1ln\u00ed prost\u0159ed\u00ed nezat\u011b\u017euje virtu\u00e1ln\u00ed stroje. V\u0161echny virov\u00e9 datab\u00e1ze jsou na serveru, kter\u00fd vyd\u00e1v\u00e1 verdikty pro v\u0161echny virtu\u00e1ln\u00ed stroje uzlu. Na virtu\u00e1ln\u00ed pracovn\u00ed plo\u0161e je nainstalov\u00e1n pouze lehk\u00fd agent. Ten odes\u00edl\u00e1 soubory k ov\u011b\u0159en\u00ed na server.\u00a0<\/p>\n<p>Tato architektura z\u00e1rove\u0148 zaji\u0161\u0165uje ochranu soubor\u016f, ochranu proti internetu, ochranu p\u0159ed \u00fatoky a nesni\u017euje v\u00fdkon virtu\u00e1ln\u00edch stroj\u016f. P\u0159itom m\u016f\u017ee klient s\u00e1m p\u0159id\u00e1vat v\u00fdjimky do ochrany soubor\u016f. Pom\u00e1h\u00e1me s z\u00e1kladn\u00edm nastaven\u00edm \u0159e\u0161en\u00ed. O jeho zvl\u00e1\u0161tnostech se zm\u00edn\u00edme v samostatn\u00e9m \u010dl\u00e1nku.<\/p>\n<p><b>P\u0159ed nezn\u00e1m\u00fdmi hrozbami.<\/b> K tomu p\u0159ipojujeme FortiSandbox \u2013 \u201ep\u00edse\u010dnou\u201c \u0159e\u0161en\u00ed od Fortinetu. Pou\u017e\u00edv\u00e1me ji jako filtr pro p\u0159\u00edpad, \u017ee by antivir pro\u0161el hrozbu \u201enult\u00e9ho dne\u201c. Po sta\u017een\u00ed souboru nejprve kontrolujeme jeho antivirem, a pot\u00e9 ho pos\u00edl\u00e1me do \u201ep\u00edse\u010dn\u00e9\u201c. FortiSandbox emuluje virtu\u00e1ln\u00ed stroj, spou\u0161t\u00ed soubor a sleduje jeho chov\u00e1n\u00ed: na jak\u00e9 objekty v registru se obrac\u00ed, zda odes\u00edl\u00e1 extern\u00ed po\u017eadavky a podobn\u011b. Pokud se soubor chov\u00e1 podez\u0159ele, virtu\u00e1ln\u00ed stroj v p\u00edse\u010dn\u00e9 se odstran\u00ed a \u0161kodliv\u00fd soubor se nedostane na u\u017eivatelskou VDI.\u00a0<\/p>\n<h2>Jak nastavujeme bezpe\u010dn\u00e9 p\u0159ipojen\u00ed k VDI<\/h2>\n<p>\n<b>Kontrolujeme shodu za\u0159\u00edzen\u00ed s po\u017eadavky I\u010c.<\/b> Od doby, co jsme p\u0159e\u0161li na dom\u00e1c\u00ed pr\u00e1ci, n\u00e1s klienti kontaktovali s \u017e\u00e1dostmi: zajistit bezpe\u010dnou pr\u00e1ci u\u017eivatel\u016f na jejich osobn\u00edch po\u010d\u00edta\u010d\u00edch. Ka\u017ed\u00fd odborn\u00edk na kybernetickou bezpe\u010dnost v\u00ed, \u017ee ochrana dom\u00e1c\u00edch za\u0159\u00edzen\u00ed je obt\u00ed\u017en\u00e1: nen\u00ed mo\u017en\u00e9 tam nainstalovat pot\u0159ebn\u00fd antivirus nebo pou\u017e\u00edt skupinov\u00e9 politiky, proto\u017ee se nejedn\u00e1 o kancel\u00e1\u0159sk\u00e9 vybaven\u00ed.\u00a0<\/p>\n<p>VDI se ve v\u00fdchoz\u00edm nastaven\u00ed st\u00e1v\u00e1 bezpe\u010dnou \"vrstvou\" mezi osobn\u00edm za\u0159\u00edzen\u00edm a podnikovou s\u00edt\u00ed. Pro ochranu VDI p\u0159ed \u00fatoky z u\u017eivatelsk\u00e9ho stroje zakazujeme schr\u00e1nku a br\u00e1n\u00edme p\u0159ipojen\u00ed USB. To v\u0161ak samo o sob\u011b nezaji\u0161\u0165uje bezpe\u010dnost u\u017eivatelsk\u00e9ho za\u0159\u00edzen\u00ed.\u00a0<\/p>\n<p>Probl\u00e9m \u0159e\u0161\u00edme pomoc\u00ed FortiClient. Toto je n\u00e1stroj pro ochranu koncov\u00fdch bod\u016f (endpoint protection). Zam\u011bstnanci spole\u010dnosti instaluj\u00ed FortiClient na sv\u00e9 dom\u00e1c\u00ed po\u010d\u00edta\u010de a pomoc\u00ed n\u011bj se p\u0159ipojuj\u00ed k virtu\u00e1ln\u00edmu pracovn\u00edmu stolu. FortiClient \u0159e\u0161\u00ed hned 3 \u00fakoly:\u00a0<\/p>\n<ul>\n<li>st\u00e1v\u00e1 se \"jedin\u00fdm oknem\" pro p\u0159\u00edstup u\u017eivatele;\n<\/li>\n<li>ov\u011b\u0159uje, zda je na osobn\u00edm po\u010d\u00edta\u010di nainstalov\u00e1n antivirus a zda jsou nainstalov\u00e1ny posledn\u00ed aktualizace opera\u010dn\u00edho syst\u00e9mu;\u00a0\n<\/li>\n<li>vytv\u00e1\u0159\u00ed VPN tunel pro bezpe\u010dn\u00fd p\u0159\u00edstup.\u00a0<\/li>\n<\/ul>\n<p>\nZam\u011bstnanec z\u00edsk\u00e1v\u00e1 p\u0159\u00edstup pouze v p\u0159\u00edpad\u011b, \u017ee projde kontrolou. Virtu\u00e1ln\u00ed pracovn\u00ed stoly jsou p\u0159itom nedostupn\u00e9 z internetu, co\u017e znamen\u00e1, \u017ee jsou l\u00e9pe chr\u00e1n\u011bny p\u0159ed \u00fatoky.\u00a0<\/p>\n<p>Pokud si spole\u010dnost chce sama spravovat ochranu koncov\u00fdch bod\u016f, nab\u00edz\u00edme FortiClient EMS (Endpoint Management Server). Klient si m\u016f\u017ee s\u00e1m nastavit skenov\u00e1n\u00ed pracovn\u00edch stolk\u016f a prevenci vniknut\u00ed, vytvo\u0159it b\u00edl\u00fd seznam adres.\u00a0<\/p>\n<p><b>P\u0159id\u00e1v\u00e1me faktory autentizace.<\/b> Ve v\u00fdchoz\u00edm nastaven\u00ed se u\u017eivatel\u00e9 autentizuj\u00ed p\u0159es Citrix netscaler. Tady tak\u00e9 m\u016f\u017eeme pos\u00edlit bezpe\u010dnost pomoc\u00ed v\u00edcestup\u0148ov\u00e9 autentizace zalo\u017een\u00e9 na produktech SafeNet. T\u00e9matu se budeme v\u011bnovat v\u00edce, o tom nap\u00ed\u0161eme v samostatn\u00e9m \u010dl\u00e1nku.\u00a0<\/p>\n<p>Takov\u00e9 zku\u0161enosti s r\u016fzn\u00fdmi \u0159e\u0161en\u00edmi jsme nasb\u00edrali za posledn\u00ed rok pr\u00e1ce. Slu\u017eba VDI se nastavuje zvl\u00e1\u0161\u0165 pro ka\u017ed\u00e9ho klienta, proto jsme vyb\u00edrali maxim\u00e1ln\u011b flexibiln\u00ed n\u00e1stroje. Mo\u017en\u00e1 brzy p\u0159id\u00e1me n\u011bco dal\u0161\u00edho a pod\u011bl\u00edme se o zku\u0161enosti.<\/p>\n<p>7. \u0159\u00edjna v 17:00 moji kolegov\u00e9 p\u0159ednesou informace o virtu\u00e1ln\u00edch pracovn\u00edch stolech na webin\u00e1\u0159i \"Pot\u0159ebujete VDI, nebo jak uspo\u0159\u00e1dat d\u00e1lkovou pr\u00e1ci?\" <br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/uni.dtln.ru\/courses\/oblaka\/vdi-kak-izvlech-iz-tehnologii-maksimum?utm_source=habr&amp;utm_medium=internal&amp;utm_campaign=webinar\">Registrujte se<\/a><\/noindex>, pokud chcete prodiskutovat, kdy je technologie VDI vhodn\u00e1 pro firmy a kdy je lep\u0161\u00ed pou\u017e\u00edt jin\u00e9 metody.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/dataline\/blog\/520452\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u043c\u043d\u043e\u0433\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0448\u043d\u043e \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u043b\u0438 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043a\u0443. \u041d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u043c \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u043c \u043c\u044b \u043f\u043e\u043c\u043e\u0433\u0430\u043b\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u043e\u0432\u044b\u0432\u0430\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u0435 \u0441\u043e\u0442\u043d\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0445 \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u043c\u0435\u0441\u0442 \u0437\u0430 \u043d\u0435\u0434\u0435\u043b\u044e. \u0411\u044b\u043b\u043e \u0432\u0430\u0436\u043d\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u044d\u0442\u043e \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0431\u044b\u0441\u0442\u0440\u043e, \u043d\u043e \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e. \u041d\u0430 \u043f\u043e\u043c\u043e\u0449\u044c \u043f\u0440\u0438\u0448\u043b\u0430 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u044f VDI: \u0441 \u0435\u0435 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0443\u0434\u043e\u0431\u043d\u043e \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0442\u044c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0430 \u0432\u0441\u0435 \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u043c\u0435\u0441\u0442\u0430 \u0438 \u0437\u0430\u0449\u0438\u0449\u0430\u0442\u044c\u0441\u044f \u043e\u0442 \u0443\u0442\u0435\u0447\u0435\u043a \u0434\u0430\u043d\u043d\u044b\u0445.\u00a0 \u0412 \u044d\u0442\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":97204,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-97203","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u043c\u043d\u043e\u0433\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0448\u043d\u043e \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u043b\u0438 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043a\u0443.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-my-zashhishhaem-virtualnye-rabochie-stoly-klientov-ot-virusov-shpionov-i-atak\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u043c\u044b \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u0441\u0442\u043e\u043b\u044b \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043e\u0442 \u0432\u0438\u0440\u0443\u0441\u043e\u0432, \u0448\u043f\u0438\u043e\u043d\u043e\u0432 \u0438 \u0430\u0442\u0430\u043a | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u043c\u043d\u043e\u0433\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0448\u043d\u043e \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u043b\u0438 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043a\u0443.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-my-zashhishhaem-virtualnye-rabochie-stoly-klientov-ot-virusov-shpionov-i-atak\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-16T12:42:53+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-16T12:42:53+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Jak chr\u00e1n\u00edme virtu\u00e1ln\u00ed pracovn\u00ed plochy na\u0161ich klient\u016f p\u0159ed viry, \u0161pehy a \u00fatoky | ProHoster","description":"Tento rok se mnoho spole\u010dnost\u00ed rychle p\u0159ech\u00e1zelo na pr\u00e1ci na d\u00e1lku.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-my-zashhishhaem-virtualnye-rabochie-stoly-klientov-ot-virusov-shpionov-i-atak","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u043c\u044b \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u0441\u0442\u043e\u043b\u044b \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043e\u0442 \u0432\u0438\u0440\u0443\u0441\u043e\u0432, \u0448\u043f\u0438\u043e\u043d\u043e\u0432 \u0438 \u0430\u0442\u0430\u043a | ProHoster","og:description":"\u0412 \u044d\u0442\u043e\u043c \u0433\u043e\u0434\u0443 \u043c\u043d\u043e\u0433\u0438\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0441\u043f\u0435\u0448\u043d\u043e \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u043b\u0438 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043a\u0443.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/kak-my-zashhishhaem-virtualnye-rabochie-stoly-klientov-ot-virusov-shpionov-i-atak","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-16T12:42:53+00:00","article:modified_time":"2020-10-16T12:42:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"97203","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:25:23","updated":"2022-09-28 06:23:36","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/97203","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=97203"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/97203\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/97204"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=97203"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=97203"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=97203"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}