{"id":97776,"date":"2020-10-21T20:42:28","date_gmt":"2020-10-21T18:42:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/red-teaming-kompleksnaya-imitacziya-atak-metodologiya-i-instrumenty"},"modified":"2020-10-21T20:42:28","modified_gmt":"2020-10-21T18:42:28","slug":"red-teaming-kompleksnaya-imitacziya-atak-metodologiya-i-instrumenty","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/red-teaming-kompleksnaya-imitacziya-atak-metodologiya-i-instrumenty","title":{"rendered":"Red Teaming \u2014 komplexn\u00ed simulace \u00fatok\u016f. Metodologie a n\u00e1stroje","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Red Teaming \u2014 komplexn\u00ed simulace \u00fatok\u016f. Metodologie a n\u00e1stroje\" src=\"\/wp-content\/uploads\/2020\/10\/9c219b917125bd86b6d9e544417c7548.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Zdroj: Acunetix<\/i><\/p>\n<p>Red Teaming (\u00fatok \"\u010derven\u00e9ho t\u00fdmu\") je komplexn\u00ed simulace re\u00e1ln\u00fdch \u00fatok\u016f s c\u00edlem vyhodnotit kybernetickou bezpe\u010dnost syst\u00e9m\u016f. \"\u010cerven\u00fd t\u00fdm\" p\u0159edstavuje skupinu <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/penetration-testing-tools\/\">pentester\u016f <\/a><\/noindex> (specialist\u016f, kte\u0159\u00ed prov\u00e1d\u011bj\u00ed testy na proniknut\u00ed do syst\u00e9mu). Mohou to b\u00fdt jak najat\u00ed extern\u00ed odborn\u00edci, tak zam\u011bstnanci va\u0161\u00ed organizace, ale ve v\u0161ech p\u0159\u00edpadech je jejich \u00faloha stejn\u00e1 \u2014 simulovat \u010dinnosti \u00fato\u010dn\u00edk\u016f a pokou\u0161et se proniknout do va\u0161eho syst\u00e9mu.<\/p>\n<p>Krom\u011b \"\u010derven\u00fdch t\u00fdm\u016f\" existuj\u00ed v kybernetick\u00e9 bezpe\u010dnosti i dal\u0161\u00ed t\u00fdmy. Nap\u0159\u00edklad \"modr\u00fd t\u00fdm\" (Blue Team) spolupracuje s \u010derven\u00fdm a jeho \u010dinnost je zam\u011b\u0159ena na zvy\u0161ov\u00e1n\u00ed bezpe\u010dnosti infrastruktury syst\u00e9mu zevnit\u0159. \"Purpurov\u00fd t\u00fdm\" (Purple Team) je spojovac\u00edm \u010dl\u00e1nkem, kter\u00fd pom\u00e1h\u00e1 ob\u011bma ostatn\u00edm t\u00fdm\u016fm p\u0159i vytv\u00e1\u0159en\u00ed \u00fato\u010dn\u00e9 strategie a opat\u0159en\u00ed na ochranu. Nicm\u00e9n\u011b, red teaming je jednou z nejm\u00e9n\u011b pochopen\u00fdch metod \u0159\u00edzen\u00ed kybernetick\u00e9 bezpe\u010dnosti a mnoho organizac\u00ed tuto praxi st\u00e1le neochotn\u011b zav\u00e1d\u00ed.<br \/>\nV tomto \u010dl\u00e1nku podrobn\u011b vysv\u011btl\u00edme, co se skr\u00fdv\u00e1 za pojmem Red Teaming, a jak implementace praktik komplexn\u00ed simulace skute\u010dn\u00fdch \u00fatok\u016f m\u016f\u017ee pomoci zlep\u0161it bezpe\u010dnost va\u0161\u00ed organizace. C\u00edlem \u010dl\u00e1nku je uk\u00e1zat, jak m\u016f\u017ee tato metoda v\u00fdznamn\u011b zv\u00fd\u0161it bezpe\u010dnost va\u0161ich informa\u010dn\u00edch syst\u00e9m\u016f.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2> Red Teaming: p\u0159ehled<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Red Teaming \u2014 komplexn\u00ed simulace \u00fatok\u016f. Metodologie a n\u00e1stroje\" src=\"\/wp-content\/uploads\/2020\/10\/25c2fe66a5b91050c9a6c8947d6c8340.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nA\u010dkoli se dnes \"\u010derven\u00e9\" a \"modr\u00e9\" t\u00fdmy asociuj\u00ed p\u0159edev\u0161\u00edm s oblast\u00ed informa\u010dn\u00edch technologi\u00ed a kybernetickou bezpe\u010dnost\u00ed, tyto pojmy byly vynalezeny voj\u00e1ky. V z\u00e1sad\u011b jsem o t\u011bchto pojmech poprv\u00e9 sly\u0161el v arm\u00e1d\u011b. Pr\u00e1ce analytika kybernetick\u00e9 bezpe\u010dnosti v 80. letech se zna\u010dn\u011b li\u0161ila od dne\u0161ka: p\u0159\u00edstup k \u0161ifrovan\u00fdm po\u010d\u00edta\u010dov\u00fdm syst\u00e9m\u016fm byl mnohem v\u00edce omezen ne\u017e dnes.<\/p>\n<p>Jinak \u0159e\u010deno, moje prvn\u00ed zku\u0161enosti s vojensk\u00fdmi hrami \u2013 modelov\u00e1n\u00edm, simulac\u00ed a organizac\u00ed interakc\u00ed \u2013 byly velmi podobn\u00e9 dne\u0161n\u00edmu procesu komplexn\u00ed simulace \u00fatok\u016f, kter\u00fd se stal roz\u0161\u00ed\u0159en\u00fdm v oblasti kybernetick\u00e9 bezpe\u010dnosti. Stejn\u011b jako dnes se zde kladl velk\u00fd d\u016fraz na pou\u017eit\u00ed metod soci\u00e1ln\u00edho in\u017een\u00fdrstv\u00ed k p\u0159esv\u011bd\u010den\u00ed zam\u011bstnanc\u016f, aby poskytli \"nep\u0159\u00edteli\" neopr\u00e1vn\u011bn\u00fd p\u0159\u00edstup k vojensk\u00fdm syst\u00e9m\u016fm. Proto\u017ee, a\u010dkoli technick\u00e9 metody simulace \u00fatok\u016f ud\u011blaly zna\u010dn\u00fd pokrok ve srovn\u00e1n\u00ed s 80. lety, je t\u0159eba poznamenat, \u017ee mnoho z\u00e1kladn\u00edch n\u00e1stroj\u016f sout\u011b\u017en\u00edho p\u0159\u00edstupu, a zejm\u00e9na techniky soci\u00e1ln\u00edho in\u017een\u00fdrstv\u00ed, do zna\u010dn\u00e9 m\u00edry nez\u00e1vis\u00ed na platform\u011b.<\/p>\n<p>Hlavn\u00ed hodnota komplexn\u00ed simulace skute\u010dn\u00fdch \u00fatok\u016f se tak\u00e9 od 80. let nezm\u011bnila. Simulac\u00ed \u00fatoku na va\u0161e syst\u00e9my l\u00e9pe odhal\u00edte zranitelnosti a pochop\u00edte, jak mohou b\u00fdt vyu\u017eity. A zat\u00edmco d\u0159\u00edve byl red teaming vyu\u017e\u00edv\u00e1n p\u0159edev\u0161\u00edm \"b\u00edl\u00fdmi hackery\" a odborn\u00edky na kybernetickou bezpe\u010dnost, kte\u0159\u00ed hledali zranitelnosti prost\u0159ednictv\u00edm penetra\u010dn\u00edho testov\u00e1n\u00ed, dnes m\u00e1 tato metoda mnohem \u0161ir\u0161\u00ed uplatn\u011bn\u00ed v oblasti kybernetick\u00e9 bezpe\u010dnosti a byznysu.<\/p>\n<p>Kl\u00ed\u010dov\u00e9 pro red teaming je pochopen\u00ed, \u017ee ve skute\u010dnosti nem\u016f\u017eete z\u00edskat p\u0159edstavu o zabezpe\u010den\u00ed va\u0161ich syst\u00e9m\u016f, dokud nejsou napadeny. A m\u00edsto toho, abyste riskovali \u00fatok ze strany skute\u010dn\u00fdch \u00fato\u010dn\u00edk\u016f, je mnohem bezpe\u010dn\u011bj\u0161\u00ed simula\u010dn\u011b prov\u00e9st takov\u00fd \u00fatok pomoc\u00ed \"\u010derven\u00e9ho t\u00fdmu.\"<\/p>\n<h2> Red Teaming: sc\u00e9n\u00e1\u0159e pou\u017eit\u00ed<\/h2>\n<p>\nJednoduch\u00fd zp\u016fsob, jak pochopit z\u00e1klady red teamingu, je pod\u00edvat se na n\u011bkolik p\u0159\u00edklad\u016f. Zde jsou dva z nich:<\/p>\n<ul>\n<li><strong>Sc\u00e9n\u00e1\u0159 1.<\/strong> P\u0159edstavte si, \u017ee na webu pro z\u00e1kaznickou podporu byl proveden penetra\u010dn\u00ed test, a ten byl \u00fasp\u011b\u0161n\u00fd. To by mohlo nazna\u010dovat, \u017ee je v\u0161e v po\u0159\u00e1dku. Nicm\u00e9n\u011b pozd\u011bji, b\u011bhem komplexn\u00ed simulace \u00fatoku \"\u010derven\u00fd t\u00fdm\" zjist\u00ed, \u017ee a\u010dkoli samotn\u00e1 aplikace z\u00e1kaznick\u00e9 podpory je v po\u0159\u00e1dku, funkce extern\u00edho chatu nedok\u00e1\u017ee p\u0159esn\u011b identifikovat lidi, co\u017e d\u00e1v\u00e1 mo\u017enost podv\u00e9st z\u00e1stupce z\u00e1kaznick\u00e9 podpory, aby zm\u011bnili e-mailovou adresu v \u00fa\u010dtu (co\u017e umo\u017e\u0148uje nov\u00e9mu u\u017eivateli, \u00fato\u010dn\u00edkovi, z\u00edskat p\u0159\u00edstup).<\/li>\n<li><strong>Sc\u00e9n\u00e1\u0159 2. <\/strong>V r\u00e1mci prov\u00e1d\u011bn\u00ed pentestu bylo zji\u0161t\u011bno, \u017ee ve\u0161ker\u00e9 prost\u0159edky pro spr\u00e1vu VPN a vzd\u00e1len\u00fd p\u0159\u00edstup jsou zabezpe\u010deny. Nicm\u00e9n\u011b z\u00e1stupce \"\u010derven\u00e9ho t\u00fdmu\" bez probl\u00e9m\u016f proch\u00e1z\u00ed kolem recepce a odn\u00e1\u0161\u00ed laptop jednoho z zam\u011bstnanc\u016f.<\/li>\n<\/ul>\n<p>\nV obou v\u00fd\u0161e uveden\u00fdch p\u0159\u00edpadech \"\u010derven\u00fd t\u00fdm\" kontroluje nejen spolehlivost ka\u017ed\u00e9ho syst\u00e9mu jednotliv\u011b, ale i cel\u00fd syst\u00e9m jako celek na p\u0159\u00edtomnost slab\u00fdch m\u00edst.<\/p>\n<h2> Komu je ur\u010dena komplexn\u00ed simulace \u00fatok\u016f?<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Red Teaming \u2014 komplexn\u00ed simulace \u00fatok\u016f. Metodologie a n\u00e1stroje\" src=\"\/wp-content\/uploads\/2020\/10\/885c58d274c4e57dd165bf47da13e410.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJednodu\u0161e \u0159e\u010deno, t\u00e9m\u011b\u0159 ka\u017ed\u00e1 spole\u010dnost m\u016f\u017ee m\u00edt prosp\u011bch z red teamingu. Jak ukazuje, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/2019-data-risk-report\/\">v na\u0161\u00ed zpr\u00e1v\u011b o rizic\u00edch glob\u00e1ln\u00edch dat z roku 2019.<\/a><\/noindex>, znepokojuj\u00edc\u00ed mno\u017estv\u00ed organizac\u00ed \u017eije v myln\u00e9 p\u0159edstav\u011b, \u017ee maj\u00ed plnou kontrolu nad sv\u00fdmi daty. Zjistili jsme nap\u0159\u00edklad, \u017ee pr\u016fm\u011brn\u011b 22 % slo\u017eek spole\u010dnosti je p\u0159\u00edstupn\u00fdch ka\u017ed\u00e9mu zam\u011bstnanci, a \u017ee 87 % firem m\u00e1 ve sv\u00fdch syst\u00e9mech v\u00edce ne\u017e 1000 zastaral\u00fdch d\u016fv\u011brn\u00fdch soubor\u016f.<\/p>\n<p>Pokud va\u0161e spole\u010dnost nepracuje v oblasti technologi\u00ed, m\u016f\u017ee se zd\u00e1t, \u017ee red teaming v\u00e1m moc nepom\u016f\u017ee. Ale nen\u00ed tomu tak. Kybernetick\u00e1 bezpe\u010dnost toti\u017e nen\u00ed jen ochrana citliv\u00fdch informac\u00ed.<\/p>\n<p>\u00dato\u010dn\u00edci se stejnou m\u011brou sna\u017e\u00ed z\u00edskat technologie bez ohledu na obor, ve kter\u00e9m spole\u010dnost p\u016fsob\u00ed. Nap\u0159\u00edklad se mohou sna\u017eit z\u00edskat p\u0159\u00edstup k va\u0161\u00ed s\u00edti, aby prost\u0159ednictv\u00edm n\u00ed skryli sv\u00e9 \u00fatoky na jin\u00fd syst\u00e9m nebo s\u00ed\u0165 kdekoli na sv\u011bt\u011b. P\u0159i tomto typu \u00fatoku \u00fato\u010dn\u00edci necht\u011bj\u00ed va\u0161e data. Cht\u011bj\u00ed infikovat va\u0161e po\u010d\u00edta\u010de \u0161kodliv\u00fdm softwarem, aby z nich vytvo\u0159ili botnet.<\/p>\n<p>Pro mal\u00e9 firmy m\u016f\u017ee b\u00fdt obt\u00ed\u017en\u00e9 naj\u00edt zdroje k prov\u00e1d\u011bn\u00ed red teamingu. V takov\u00e9m p\u0159\u00edpad\u011b d\u00e1v\u00e1 smysl sv\u011b\u0159it tento proces extern\u00edmu dodavateli.<\/p>\n<h2> Red Teaming: doporu\u010den\u00ed<\/h2>\n<p>\nOptim\u00e1ln\u00ed \u010das pro prov\u00e1d\u011bn\u00ed red teamingu a jeho frekvence z\u00e1vis\u00ed na tom, v jak\u00e9m sektoru pracujete, a na rozvinutosti va\u0161ich prost\u0159edk\u016f pro zaji\u0161t\u011bn\u00ed kybernetick\u00e9 bezpe\u010dnosti.<\/p>\n<p>Konkr\u00e9tn\u011b byste m\u011bli automatizovat \u010dinnosti, jako je pr\u016fzkum aktiv a anal\u00fdza zranitelnost\u00ed. Va\u0161e organizace by tak\u00e9 m\u011bla kombinovat automatizovan\u00e9 technologie s lidsk\u00fdm dohledem a pravideln\u011b prov\u00e1d\u011bt komplexn\u00ed testov\u00e1n\u00ed penetrace.<br \/>\nPo dokon\u010den\u00ed n\u011bkolika obchodn\u00edch cykl\u016f testov\u00e1n\u00ed penetrace a hled\u00e1n\u00ed zranitelnost\u00ed m\u016f\u017eete p\u0159istoupit k komplexn\u00ed simulaci skute\u010dn\u00e9ho \u00fatoku. V t\u00e9to f\u00e1zi v\u00e1m red teaming p\u0159inese v\u00fdrazn\u00e9 v\u00fdhody. Nicm\u00e9n\u011b pokus o jeho proveden\u00ed p\u0159edt\u00edm, ne\u017e si upevn\u00edte z\u00e1klady kybernetick\u00e9 bezpe\u010dnosti, nep\u0159inese znateln\u00e9 v\u00fdsledky.<\/p>\n<p>T\u00fdm \u201eb\u00edl\u00fdch hacker\u016f\u201c bude pravd\u011bpodobn\u011b schopen ohrozit nep\u0159ipraven\u00fd syst\u00e9m tak rychle a snadno, \u017ee z\u00edsk\u00e1te p\u0159\u00edli\u0161 m\u00e1lo informac\u00ed pro dal\u0161\u00ed kroky. Abychom dos\u00e1hli skute\u010dn\u00e9ho efektu, m\u011bla by b\u00fdt informace z\u00edskan\u00e9 \u201e\u010derven\u00fdm t\u00fdmem\u201c porovn\u00e1na s p\u0159edchoz\u00edmi testy penetrace a hodnocen\u00edmi zranitelnosti.<\/p>\n<h2> Co je testov\u00e1n\u00ed penetrace?<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Red Teaming \u2014 komplexn\u00ed simulace \u00fatok\u016f. Metodologie a n\u00e1stroje\" src=\"\/wp-content\/uploads\/2020\/10\/e617ef8e900aac596c76e7e66673c779.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKomplexn\u00ed simulaci skute\u010dn\u00e9ho \u00fatoku (Red Teaming) \u010dasto zam\u011b\u0148uj\u00ed s <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/varonis-six-part-guide-to-penetration-testing\/\">testov\u00e1n\u00edm penetrace (pentest),<\/a><\/noindex>, ale tyto dv\u011b metody se m\u00edrn\u011b li\u0161\u00ed. P\u0159esn\u011bji \u0159e\u010deno, testov\u00e1n\u00ed penetrace je pouze jednou z metod red teamingu.<\/p>\n<p>\u00daloha pentestera <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/penetration-testing-explained-part-i-risky-business\/\">je pom\u011brn\u011b jasn\u011b definov\u00e1na.<\/a><\/noindex>Pr\u00e1ce pentester\u016f je rozd\u011blena do \u010dty\u0159 hlavn\u00edch f\u00e1z\u00ed: pl\u00e1nov\u00e1n\u00ed, shroma\u017e\u010fov\u00e1n\u00ed informac\u00ed, \u00fatok a zpr\u00e1va. Jak vid\u00edte, penteste\u0159i d\u011blaj\u00ed v\u00edc ne\u017e pouze hled\u00e1n\u00ed zranitelnost\u00ed softwaru. Sna\u017e\u00ed se postavit na m\u00edsto hacker\u016f a po proniknut\u00ed do va\u0161eho syst\u00e9mu za\u010d\u00edn\u00e1 jejich skute\u010dn\u00e1 pr\u00e1ce.<\/p>\n<p>Zjist\u00ed zranitelnosti a pot\u00e9 prov\u00e1d\u011bj\u00ed nov\u00e9 \u00fatoky na z\u00e1klad\u011b z\u00edskan\u00fdch informac\u00ed, pohybuj\u00ed se v hierarchii slo\u017eek. Pr\u00e1v\u011b t\u00edm se odborn\u00edci prov\u00e1d\u011bj\u00edc\u00ed testov\u00e1n\u00ed penetrace li\u0161\u00ed od t\u011bch, kdo jsou naj\u00edm\u00e1ni pouze k vyhled\u00e1v\u00e1n\u00ed zranitelnost\u00ed pomoc\u00ed software pro skenov\u00e1n\u00ed port\u016f nebo detekci vir\u016f. Zku\u0161en\u00fd pentester m\u016f\u017ee ur\u010dit:<\/p>\n<ul>\n<li>kam mohou hacke\u0159i zam\u011b\u0159it sv\u016fj \u00fatok;<\/li>\n<li>jak\u00fdm zp\u016fsobem budou hacke\u0159i \u00fato\u010dit; <\/li>\n<li>jak se va\u0161e ochrana bude chovat; <\/li>\n<li>jak\u00fd m\u016f\u017ee b\u00fdt rozsah naru\u0161en\u00ed. <\/li>\n<\/ul>\n<p>\nTestov\u00e1n\u00ed pr\u016fniku se zam\u011b\u0159uje na odhalen\u00ed nedostatk\u016f na \u00farovni aplikac\u00ed a s\u00edt\u00ed, stejn\u011b jako na mo\u017enosti p\u0159ekon\u00e1n\u00ed fyzick\u00fdch bezpe\u010dnostn\u00edch bari\u00e9r. Zat\u00edmco automatizovan\u00e9 testov\u00e1n\u00ed m\u016f\u017ee odhalit n\u011bkter\u00e9 probl\u00e9my kybernetick\u00e9 bezpe\u010dnosti, manu\u00e1ln\u00ed testov\u00e1n\u00ed pr\u016fniku nav\u00edc zohled\u0148uje zranitelnost podnik\u00e1n\u00ed v\u016f\u010di \u00fatok\u016fm.<\/p>\n<h2> Red Teaming vs. testov\u00e1n\u00ed pr\u016fniku<\/h2>\n<p>\nNejist\u011b, test na pr\u016fnik je d\u016fle\u017eit\u00fd, ale je to pouze jedna \u010d\u00e1st cel\u00e9ho spektra aktivit prov\u00e1d\u011bn\u00fdch p\u0159i red teaming. \u010cinnost \u201e\u010derven\u00e9ho t\u00fdmu\u201c m\u00e1 mnohem \u0161ir\u0161\u00ed c\u00edle ne\u017e penteste\u0159i, kte\u0159\u00ed obvykle pouze usiluj\u00ed o p\u0159\u00edstup k s\u00edti. V red teamingu \u010dasto pracuje v\u00edce lid\u00ed, zdroj\u016f a \u010dasu, proto\u017ee specialist\u00e9 z \u201e\u010derven\u00e9ho t\u00fdmu\u201c d\u016fkladn\u011b zkoumaj\u00ed, aby pln\u011b pochopili skute\u010dnou \u00farove\u0148 rizika a zranitelnosti v technologi\u00edch, jako\u017e i v lidsk\u00fdch a fyzick\u00fdch aktivech organizace.<\/p>\n<p>Krom\u011b toho existuj\u00ed i dal\u0161\u00ed rozd\u00edly. Red teaming se obvykle vyu\u017e\u00edv\u00e1 organizacemi s vysp\u011blej\u0161\u00edmi a rozvinut\u011bj\u0161\u00edmi opat\u0159en\u00edmi v oblasti kybernetick\u00e9 bezpe\u010dnosti (a\u010dkoliv to v praxi v\u017edy tak nen\u00ed).<\/p>\n<p>Obvykle jsou to spole\u010dnosti, kter\u00e9 ji\u017e provedly testov\u00e1n\u00ed pr\u016fniku a opravily v\u011bt\u0161inu nalezen\u00fdch zranitelnost\u00ed, a nyn\u00ed hledaj\u00ed n\u011bkoho, kdo by se pokusil znovu z\u00edskat p\u0159\u00edstup k citliv\u00fdm informac\u00edm nebo p\u0159ekonat ochranu jak\u00fdmkoliv zp\u016fsobem.<br \/>\nProto se red teaming spol\u00e9h\u00e1 na t\u00fdm odborn\u00edk\u016f na bezpe\u010dnost, zam\u011b\u0159en\u00fdch na konkr\u00e9tn\u00ed c\u00edl. Ti se zam\u011b\u0159uj\u00ed na vnit\u0159n\u00ed zranitelnosti a pou\u017e\u00edvaj\u00ed elektronick\u00e9 i fyzick\u00e9 metody soci\u00e1ln\u00edho in\u017een\u00fdrstv\u00ed v\u016f\u010di zam\u011bstnanc\u016fm organizace. Na rozd\u00edl od pentester\u016f nemaj\u00ed \u201e\u010derven\u00e9 t\u00fdmy\u201c p\u0159i sv\u00fdch \u00fatoc\u00edch sp\u011bch, cht\u011bj\u00ed se vyhnout odhalen\u00ed, jak by to ud\u011blal skute\u010dn\u00fd kyberzlo\u010dinec.<\/p>\n<h2> V\u00fdhody Red Teamingu<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Red Teaming \u2014 komplexn\u00ed simulace \u00fatok\u016f. Metodologie a n\u00e1stroje\" src=\"\/wp-content\/uploads\/2020\/10\/0c9895d155dac3fc3e996366ec96b951.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV komplexn\u00ed simulaci re\u00e1ln\u00fdch \u00fatok\u016f je mnoho v\u00fdhod, ale nejd\u016fle\u017eit\u011bj\u0161\u00ed je, \u017ee tento p\u0159\u00edstup umo\u017e\u0148uje z\u00edskat komplexn\u00ed obraz \u00farovn\u011b kybernetick\u00e9 bezpe\u010dnosti organizace. Typick\u00fd proces komplexn\u00ed simulace \u00fatoku zahrnuje penetra\u010dn\u00ed testov\u00e1n\u00ed (s\u00ed\u0165, aplikace, mobiln\u00ed telefony a dal\u0161\u00ed za\u0159\u00edzen\u00ed), soci\u00e1ln\u00ed in\u017een\u00fdrstv\u00ed (\u017eivou interakc\u00ed na m\u00edst\u011b, telefonn\u00edmi hovory, e-mailem nebo textov\u00fdmi zpr\u00e1vami a chatem) a fyzick\u00e9 vniknut\u00ed (z\u00e1mkov\u00e1 sv\u00e1\u0159en\u00ed, detekce mrtv\u00fdch z\u00f3n sledovac\u00edch kamer, obch\u00e1zen\u00ed poplachov\u00fdch syst\u00e9m\u016f). Pokud existuj\u00ed v jak\u00e9mkoli z t\u011bchto aspekt\u016f va\u0161\u00ed s\u00edt\u011b zranitelnosti, budou odhaleny.<\/p>\n<p>Jakmile jsou zranitelnosti odhaleny, mohou b\u00fdt opravena. Efektivn\u00ed procedura simulace \u00fatoku nekon\u010d\u00ed po odhalen\u00ed zranitelnost\u00ed. Jakmile jsou nedostatky zabezpe\u010den\u00ed jasn\u011b identifikov\u00e1ny, budete cht\u00edt pracovat na jejich oprav\u00e1ch a op\u011btovn\u00e9m testov\u00e1n\u00ed. Ve skute\u010dnosti skute\u010dn\u00e1 pr\u00e1ce obvykle za\u010d\u00edn\u00e1 po invazi \"\u010derven\u00e9ho t\u00fdmu\", kdy prov\u00e1d\u00edte forenzn\u00ed anal\u00fdzu \u00fatoku a sna\u017e\u00edte se sn\u00ed\u017eit odhalen\u00e9 zranitelnosti.<\/p>\n<p>Krom\u011b t\u011bchto dvou hlavn\u00edch v\u00fdhod red teaming tak\u00e9 nab\u00edz\u00ed \u0159adu dal\u0161\u00edch. Tak \"\u010derven\u00fd t\u00fdm\" m\u016f\u017ee:<\/p>\n<ul>\n<li>identifikovat rizika a zranitelnosti k \u00fatok\u016fm v kl\u00ed\u010dov\u00fdch informa\u010dn\u00edch aktivech firmy;<\/li>\n<li>modelovat metody, taktiku a postupy skute\u010dn\u00fdch \u00fato\u010dn\u00edk\u016f v prost\u0159ed\u00ed s omezen\u00fdm a kontrolovan\u00fdm rizikem; <\/li>\n<li>zhodnotit schopnost va\u0161\u00ed organizace detekovat, reagovat a p\u0159edch\u00e1zet slo\u017eit\u00fdm c\u00edlen\u00fdm hrozb\u00e1m; <\/li>\n<li>podn\u00edtit \u00fazkou spolupr\u00e1ci s odd\u011blen\u00edmi IT bezpe\u010dnosti a \"modr\u00fdmi t\u00fdmy\", aby se zajistilo v\u00fdrazn\u00e9 sn\u00ed\u017een\u00ed n\u00e1sledk\u016f a prov\u00e9st komplexn\u00ed praktick\u00e9 workshopy k v\u00fdsledk\u016fm zji\u0161t\u011bn\u00fdch zranitelnost\u00ed. <\/li>\n<\/ul>\n<p><\/p>\n<h2> Jak funguje Red Teaming? <\/h2>\n<p>\nSkv\u011bl\u00fd zp\u016fsob, jak pochopit princip fungov\u00e1n\u00ed red teamingu, je pod\u00edvat se na to, jak obvykle prob\u00edh\u00e1. B\u011b\u017en\u00fd proces komplexn\u00ed simulace \u00fatok\u016f se skl\u00e1d\u00e1 z n\u011bkolika f\u00e1z\u00ed:<\/p>\n<ul>\n<li>Organizace se domluv\u00ed s \"\u010derven\u00fdm t\u00fdmem\" (intern\u00edm nebo extern\u00edm) na c\u00edli prov\u00e1d\u011bn\u00e9ho \u00fatoku. Nap\u0159\u00edklad takov\u00fdm c\u00edlem m\u016f\u017ee b\u00fdt z\u00edsk\u00e1n\u00ed d\u016fv\u011brn\u00fdch informac\u00ed z konkr\u00e9tn\u00edho serveru.<\/li>\n<li>Pot\u00e9 \u00ab\u010derven\u00fd t\u00fdm\u00bb prov\u00e1d\u00ed pr\u016fzkum c\u00edle. V d\u016fsledku toho se vytv\u00e1\u0159\u00ed sch\u00e9ma c\u00edlov\u00fdch syst\u00e9m\u016f, v\u010detn\u011b s\u00ed\u0165ov\u00fdch slu\u017eeb, webov\u00fdch aplikac\u00ed a intern\u00edch port\u00e1l\u016f pro zam\u011bstnance.<\/li>\n<li>Po tom se v c\u00edlov\u00e9m syst\u00e9mu hledaj\u00ed zranitelnosti, kter\u00e9 se obvykle realizuj\u00ed pomoc\u00ed phishingu nebo XSS \u00fatok\u016f.<\/li>\n<li>Jakmile jsou z\u00edsk\u00e1ny tokeny pro p\u0159\u00edstup, \u00ab\u010derven\u00fd t\u00fdm\u00bb je vyu\u017e\u00edv\u00e1 k prozkoum\u00e1n\u00ed dal\u0161\u00edch zranitelnost\u00ed.<\/li>\n<li>P\u0159i zji\u0161t\u011bn\u00ed dal\u0161\u00edch zranitelnost\u00ed \u00ab\u010derven\u00fd t\u00fdm\u00bb usiluje o zv\u00fd\u0161en\u00ed sv\u00e9ho p\u0159\u00edstupov\u00e9ho opr\u00e1vn\u011bn\u00ed na po\u017eadovanou \u00farove\u0148 k dosa\u017een\u00ed c\u00edle.<\/li>\n<li>Jakmile z\u00edskaj\u00ed p\u0159\u00edstup k c\u00edlov\u00fdm dat\u016fm nebo aktivu, \u00fakol \u00fatoku je pova\u017eov\u00e1n za spln\u011bn\u00fd.<\/li>\n<\/ul>\n<p>\nVe skute\u010dnosti zku\u0161en\u00fd odborn\u00edk \u00ab\u010derven\u00e9ho t\u00fdmu\u00bb vyu\u017eije \u0161irokou \u0161k\u00e1lu r\u016fzn\u00fdch metod pro p\u0159ekon\u00e1n\u00ed ka\u017ed\u00e9ho z v\u00fd\u0161e uveden\u00fdch krok\u016f. Hlavn\u00ed \u00favaha z tohoto p\u0159\u00edkladu je, \u017ee mal\u00e9 zranitelnosti v jednotliv\u00fdch syst\u00e9mech mohou p\u0159er\u016fst v katastrof\u00e1ln\u00ed selh\u00e1n\u00ed, pokud se spoj\u00ed v \u0159et\u011bzec.<\/p>\n<h2> Co je t\u0159eba zv\u00e1\u017eit p\u0159i osloven\u00ed \u00ab\u010derven\u00e9ho t\u00fdmu\u00bb? <\/h2>\n<p>\n<img decoding=\"async\" alt=\"Red Teaming \u2014 komplexn\u00ed simulace \u00fatok\u016f. Metodologie a n\u00e1stroje\" src=\"\/wp-content\/uploads\/2020\/10\/70892885775ca71b132d6a3b4321923a.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAbychom z\u00edskali maxim\u00e1ln\u00ed n\u00e1vratnost z red teamingu, je nutn\u00e9 se pe\u010dliv\u011b p\u0159ipravit. Syst\u00e9my a procesy, kter\u00e9 ka\u017ed\u00e1 organizace pou\u017e\u00edv\u00e1, se li\u0161\u00ed a kvalitn\u00ed \u00farove\u0148 red teamingu se dosahuje, kdy\u017e je zam\u011b\u0159en na hled\u00e1n\u00ed zranitelnost\u00ed ve va\u0161ich syst\u00e9mech. Z tohoto d\u016fvodu je d\u016fle\u017eit\u00e9 vz\u00edt v \u00favahu n\u011bkolik faktor\u016f:<\/p>\n<h3>V\u011bzte, co hled\u00e1te<\/h3>\n<p>\nP\u0159edev\u0161\u00edm je d\u016fle\u017eit\u00e9 pochopit, kter\u00e9 syst\u00e9my a procesy chcete otestovat. Mo\u017en\u00e1 v\u00edte, \u017ee chcete testovat webovou aplikaci, ale nev\u00edte p\u0159esn\u011b, co to vlastn\u011b zahrnuje a kter\u00e9 dal\u0161\u00ed syst\u00e9my jsou integrov\u00e1ny s va\u0161imi webov\u00fdmi aplikacemi. Proto je d\u016fle\u017eit\u00e9, abyste dob\u0159e rozum\u011bli sv\u00fdm vlastn\u00edm syst\u00e9m\u016fm a odstranili v\u0161echny z\u0159ejm\u00e9 zranitelnosti, ne\u017e za\u010dnete komplexn\u00ed simulaci skute\u010dn\u00e9ho \u00fatoku.<\/p>\n<h3>Poznejte svou s\u00ed\u0165<\/h3>\n<p>\nToto souvis\u00ed s p\u0159edchoz\u00edm doporu\u010den\u00edm, ale v\u00edce se t\u00fdk\u00e1 technick\u00fdch charakteristik va\u0161\u00ed s\u00edt\u011b. \u010c\u00edm l\u00e9pe budete moci kvantitativn\u011b zhodnotit testovac\u00ed prost\u0159ed\u00ed, t\u00edm p\u0159esn\u011bji a konkr\u00e9tn\u011bji bude v\u00e1\u0161 \u00ab\u010derven\u00fd t\u00fdm\u00bb jednat.<\/p>\n<h3>Poznejte sv\u016fj rozpo\u010det<\/h3>\n<p>\nRed teaming m\u016f\u017ee prob\u00edhat na r\u016fzn\u00fdch \u00farovn\u00edch, ale simulace cel\u00e9ho spektra \u00fatok\u016f na va\u0161i s\u00ed\u0165, v\u010detn\u011b soci\u00e1ln\u00edho in\u017een\u00fdrstv\u00ed a fyzick\u00e9ho vniknut\u00ed, se m\u016f\u017ee uk\u00e1zat jako n\u00e1kladn\u00e1 z\u00e1le\u017eitost. Z tohoto d\u016fvodu je d\u016fle\u017eit\u00e9 pochopit, kolik m\u016f\u017eete na takovou kontrolu utratit, a odpov\u00eddaj\u00edc\u00edm zp\u016fsobem vymezit jej\u00ed rozsah.<\/p>\n<h3>Zn\u00e1te svou \u00farove\u0148 rizika<\/h3>\n<p>\nN\u011bkter\u00e9 organizace mohou tolerovat pom\u011brn\u011b vysokou \u00farove\u0148 rizika v r\u00e1mci sv\u00fdch standardn\u00edch obchodn\u00edch postup\u016f. Jin\u00fdm naopak bude muset b\u00fdt omezena \u00farove\u0148 rizika mnohem v\u00edce, zejm\u00e9na pokud firma p\u016fsob\u00ed v p\u0159\u00edsn\u011b regulovan\u00e9m odv\u011btv\u00ed. Proto je p\u0159i prov\u00e1d\u011bn\u00ed red teamingu d\u016fle\u017eit\u00e9 zam\u011b\u0159it se na rizika, kter\u00e1 skute\u010dn\u011b p\u0159edstavuj\u00ed hrozbu pro v\u00e1\u0161 podnik.<\/p>\n<h2> Red Teaming: n\u00e1stroje a taktiky<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Red Teaming \u2014 komplexn\u00ed simulace \u00fatok\u016f. Metodologie a n\u00e1stroje\" src=\"\/wp-content\/uploads\/2020\/10\/a3d807258e5254ebdd025e76076f7915.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u0159i spr\u00e1vn\u00e9 realizaci provede \u201e\u010derven\u00fd t\u00fdm\u201c rozs\u00e1hl\u00fd \u00fatok na va\u0161e s\u00edt\u011b s vyu\u017eit\u00edm v\u0161ech n\u00e1stroj\u016f a metod, kter\u00e9 pou\u017e\u00edvaj\u00ed hacke\u0159i. Mezi n\u011b pat\u0159\u00ed mimo jin\u00e9:<\/p>\n<ul>\n<li><strong>Testov\u00e1n\u00ed aplikac\u00ed na penetraci <\/strong>\u2014 c\u00edlen\u00e9 na odhalen\u00ed nedostatk\u016f na \u00farovni aplikac\u00ed, jako jsou podvody meziwebov\u00fdch \u017e\u00e1dost\u00ed, chyby p\u0159i vstupu dat, slab\u00e9 \u0159\u00edzen\u00ed relac\u00ed a mnoh\u00e9 dal\u0161\u00ed.<\/li>\n<li><strong>Testov\u00e1n\u00ed s\u00edt\u011b na penetraci <\/strong>\u2014 zam\u011b\u0159en\u00e9 na odhalen\u00ed nedostatk\u016f na \u00farovni s\u00edt\u011b a syst\u00e9mu, v\u010detn\u011b nespr\u00e1vn\u00fdch konfigurac\u00ed, zranitelnost\u00ed bezdr\u00e1tov\u00e9 s\u00edt\u011b, neopr\u00e1vn\u011bn\u00fdch slu\u017eeb a mnoha dal\u0161\u00edch. <\/li>\n<li><strong>Fyzick\u00e9 testov\u00e1n\u00ed na penetraci<\/strong> \u2014 kontrola \u00fa\u010dinnosti, jako\u017e i siln\u00fdch a slab\u00fdch str\u00e1nek fyzick\u00fdch prost\u0159edk\u016f bezpe\u010dnostn\u00ed kontroly v re\u00e1ln\u00e9m \u017eivot\u011b. <\/li>\n<li><strong>Soci\u00e1ln\u00ed in\u017een\u00fdrstv\u00ed <\/strong>\u2014 c\u00edlen\u00e9 na vyu\u017eit\u00ed slabin lid\u00ed a lidsk\u00e9 povahy, testov\u00e1n\u00ed zranitelnosti lid\u00ed v\u016f\u010di podvodu, p\u0159esv\u011bd\u010dov\u00e1n\u00ed a manipulac\u00edm pomoc\u00ed phishingu e-mailem, telefonn\u00edmi hovory a textov\u00fdmi zpr\u00e1vami, stejn\u011b jako p\u0159i fyzick\u00e9m kontaktu na m\u00edst\u011b. <\/li>\n<\/ul>\n<p>\nV\u0161e v\u00fd\u0161e zm\u00edn\u011bn\u00e9 jsou komponenty red teamingu. Jde o komplexn\u00ed v\u00edcestup\u0148ov\u00e9 modelov\u00e1n\u00ed \u00fatoku, kter\u00e9 m\u00e1 za c\u00edl ur\u010dit, jak dob\u0159e mohou va\u0161i lid\u00e9, s\u00edt\u011b, aplikace a fyzick\u00e9 prost\u0159edky bezpe\u010dnostn\u00ed kontroly odol\u00e1vat \u00fatoku skute\u010dn\u00e9ho \u00fato\u010dn\u00edka. <\/p>\n<h2>Trval\u00fd rozvoj metod Red Teaming<\/h2>\n<p>\nP\u0159\u00edroda komplexn\u00ed simulace re\u00e1ln\u00fdch \u00fatok\u016f, kdy \"\u010derven\u00e9 t\u00fdmy\" se sna\u017e\u00ed naj\u00edt nov\u00e9 zranitelnosti v bezpe\u010dnostn\u00edm syst\u00e9mu, zat\u00edmco \"modr\u00e9 t\u00fdmy\" se je sna\u017e\u00ed opravit, vede k neust\u00e1l\u00e9mu v\u00fdvoji metod t\u011bchto kontrol. Z tohoto d\u016fvodu je obt\u00ed\u017en\u00e9 sestavit aktu\u00e1ln\u00ed seznam modern\u00edch technik red teaming, jeliko\u017e rychle zastar\u00e1vaj\u00ed.<\/p>\n<p>Proto v\u011bt\u0161ina specialist\u016f prov\u00e1d\u011bj\u00edc\u00edch red teaming str\u00e1v\u00ed alespo\u0148 \u010d\u00e1st sv\u00e9ho \u010dasu studiem nov\u00fdch zranitelnost\u00ed a metod jejich vyu\u017eit\u00ed, za pou\u017eit\u00ed mnoha zdroj\u016f poskytovan\u00fdch komunitou \"\u010derven\u00fdch t\u00fdm\u016f\". Zde je n\u011bkolik nejpopul\u00e1rn\u011bj\u0161\u00edch z t\u011bchto komunit:<\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.pentesteracademy.com\/\">Pentester Academy <\/a><\/noindex>\u2014 to je placen\u00e1 slu\u017eba, kter\u00e1 nab\u00edz\u00ed online videokurzy zam\u011b\u0159en\u00e9 p\u0159edev\u0161\u00edm na penetra\u010dn\u00ed testov\u00e1n\u00ed, ale tak\u00e9 kurzy o forenzn\u00ed anal\u00fdze opera\u010dn\u00edch syst\u00e9m\u016f, soci\u00e1ln\u00edm in\u017een\u00fdrstv\u00ed a assembleru pro ochranu informac\u00ed.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.linkedin.com\/in\/vincent-yiu\/\">Vincent Yiu <\/a><\/noindex>\u2014 \"oper\u00e1tor ofenzivn\u00ed kybernetick\u00e9 bezpe\u010dnosti\", kter\u00fd pravideln\u011b vede blog o metod\u00e1ch komplexn\u00ed simulace re\u00e1ln\u00fdch \u00fatok\u016f a je dobr\u00fdm zdrojem nov\u00fdch p\u0159\u00edstup\u016f.<\/li>\n<li>Twitter je tak\u00e9 dobr\u00fdm zdrojem, pokud hled\u00e1te aktu\u00e1ln\u00ed informace o red teamingu. M\u016f\u017eete je naj\u00edt pomoc\u00ed hashtag\u016f. <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/hashtag\/redteam\">#redteam<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/hashtag\/redteaming\">#redteaming<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/DanielMiessler\">Daniel Miessler<\/a><\/noindex> \u2014 dal\u0161\u00ed zku\u0161en\u00fd odborn\u00edk na red teaming, kter\u00fd vyd\u00e1v\u00e1 zpravodaj a <noindex><a rel=\"nofollow\" href=\"https:\/\/overcast.fm\/+GrY_qF4ss\">podcast<\/a><\/noindex>, spravuje<noindex><a rel=\"nofollow\" href=\"https:\/\/danielmiessler.com\/\"> webov\u00e9 str\u00e1nky<\/a><\/noindex> a hodn\u011b p\u00ed\u0161e o modern\u00edch trendech \"\u010derven\u00fdch t\u00fdm\u016f\". Mezi jeho posledn\u00edmi \u010dl\u00e1nky jsou: <noindex><a rel=\"nofollow\" href=\"https:\/\/danielmiessler.com\/blog\/purple-team-pentests-mean-youre-failing-at-red-and-blue\/\">\"Pentest purpurov\u00e9ho t\u00fdmu znamen\u00e1, \u017ee va\u0161e \u010derven\u00e1 a modr\u00e1 t\u00fdm selhaly\"<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/danielmiessler.com\/blog\/when-vulnerability-assessments-pentesting-red-team-bug-bounties\/\">\"Odm\u011bny za nalezen\u00e9 zranitelnosti, a kdy pou\u017e\u00edt hodnocen\u00ed zranitelnost\u00ed, penetra\u010dn\u00ed test a komplexn\u00ed simulaci \u00fatoku\"<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/portswigger.net\/daily-swig\">Daily Swig<\/a><\/noindex> \u2014 to je zpravodaj o webov\u00e9 bezpe\u010dnosti, kter\u00fd sponzoruje PortSwigger Web Security. Je to dobr\u00fd zdroj pro informace o v\u00fdvoji a novink\u00e1ch v oblasti red teamingu \u2014 \u00fatoc\u00edch, \u00fanik\u00e1ch dat, exploitech, zranitelnostech webov\u00fdch aplikac\u00ed a nov\u00fdch bezpe\u010dnostn\u00edch technologi\u00edch.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/HanseSecure\">Florian Hansemann <\/a><\/noindex>\u2014 \"b\u00edl\u00fd hacker\" a odborn\u00edk na penetra\u010dn\u00ed testy, pravideln\u011b informuje o nov\u00fdch taktik\u00e1ch \"\u010derven\u00e9ho t\u00fdmu\" na sv\u00e9m <noindex><a rel=\"nofollow\" href=\"https:\/\/hansesecure.de\/blog\/\">blogu<\/a><\/noindex>.<\/li>\n<li>MWR labs \u2014 dobr\u00fd, i kdy\u017e velmi technick\u00fd zdroj novinek o red teamingu. Publikuj\u00ed u\u017eite\u010dn\u00e9 informace pro \u010derven\u00e9 t\u00fdmy. <noindex><a rel=\"nofollow\" href=\"https:\/\/labs.mwrinfosecurity.com\/tools\/\">n\u00e1stroje<\/a><\/noindex>, a jejich <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/mwrlabs\">twitterov\u00fd feed <\/a><\/noindex>obsahuje rady pro \u0159e\u0161en\u00ed probl\u00e9m\u016f, se kter\u00fdmi se setk\u00e1vaj\u00ed odborn\u00edci na bezpe\u010dnostn\u00ed testov\u00e1n\u00ed.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/Alra3ees\">Emad Shanab (Emad Shanab)<\/a><\/noindex> \u2014 pr\u00e1vn\u00edk a \u201eb\u00edl\u00fd hacker\u201c. V jeho twitterov\u00e9m feedu naleznete metody u\u017eite\u010dn\u00e9 pro \u201e\u010derven\u00e9 t\u00fdmy\u201c, jako je psan\u00ed SQL injekc\u00ed a fal\u0161ov\u00e1n\u00ed token\u016f OAuth.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/wiki\/Main_Page\">Mitreovy Advers\u00e1rn\u00ed taktiky, techniky a obecn\u00e9 znalosti<\/a><\/noindex> (ATT &amp; CK) \u2014 to je pe\u010dliv\u011b vybudovan\u00e1 znalostn\u00ed b\u00e1ze o chov\u00e1n\u00ed \u00fato\u010dn\u00edk\u016f. Sleduje f\u00e1ze \u017eivotn\u00edho cyklu \u00fato\u010dn\u00edk\u016f a platformy, na kter\u00e9 c\u00edl\u00ed.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.amazon.com\/Hacker-Playbook-Practical-Penetration-Testing-ebook\/dp\/B07CSPFYZ2\">The Hacker Playbook<\/a><\/noindex> \u2014 to je p\u0159\u00edru\u010dka pro hackery, kter\u00e1, a\u010dkoliv je pom\u011brn\u011b star\u00e1, pokr\u00fdv\u00e1 mnoho z\u00e1kladn\u00edch metod, je\u017e st\u00e1le tvo\u0159\u00ed z\u00e1klad komplexn\u00ed simulace skute\u010dn\u00fdch \u00fatok\u016f. Autor Peter Kim tak\u00e9 m\u00e1 <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/hackerplaybook?lang=en\">twitterov\u00fd feed<\/a><\/noindex>, kde nab\u00edz\u00ed rady k hackov\u00e1n\u00ed a dal\u0161\u00ed informace.<\/li>\n<li>SANS Institute \u2014 dal\u0161\u00ed v\u00fdznamn\u00fd poskytovatel v\u00fdukov\u00fdch materi\u00e1l\u016f v oblasti kybernetick\u00e9 bezpe\u010dnosti. Jejich <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/sansforensics\">twitterov\u00fd kan\u00e1l<\/a><\/noindex>, v\u011bnovan\u00fd digit\u00e1ln\u00ed kriminalistice a incidentn\u00ed reakci, obsahuje nejnov\u011bj\u0161\u00ed zpr\u00e1vy o kurzech SANS a rady odborn\u00edk\u016f z praxe.<\/li>\n<li>N\u011bkter\u00e9 z nejzaj\u00edmav\u011bj\u0161\u00edch novinek o red teamingu byly publikov\u00e1ny v <noindex><a rel=\"nofollow\" href=\"https:\/\/redteamjournal.com\/\">Red Team Journal<\/a><\/noindex>. Obsahuje \u010dl\u00e1nky zam\u011b\u0159en\u00e9 na technologie, jako je srovn\u00e1n\u00ed red teamingu s penetra\u010dn\u00edm testov\u00e1n\u00edm, stejn\u011b jako analytick\u00e9 \u010dl\u00e1nky, nap\u0159\u00edklad \u201eManifest specialisty \u010derven\u00e9ho t\u00fdmu\u201c.<\/li>\n<li>Nakonec, Awesome Red Teaming je komunita na GitHubu, kter\u00e1 nab\u00edz\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/yeyintminthuhtut\/Awesome-Red-Teaming\">velmi podrobn\u00fd seznam <\/a><\/noindex>zdroj\u016f, v\u011bnovan\u00fdch red teamingu. Zahrnuje prakticky v\u0161echny technick\u00e9 aspekty \u010dinnosti \u201e\u010derven\u00e9ho t\u00fdmu\u201c, od z\u00edsk\u00e1v\u00e1n\u00ed po\u010d\u00e1te\u010dn\u00edho p\u0159\u00edstupu, prov\u00e1d\u011bn\u00ed \u0161kodliv\u00fdch akc\u00ed a\u017e po sb\u011br a extrakci dat.<\/li>\n<\/ul>\n<p><\/p>\n<h2> Co je \u201emodr\u00fd t\u00fdm\u201c?<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Red Teaming \u2014 komplexn\u00ed simulace \u00fatok\u016f. Metodologie a n\u00e1stroje\" src=\"\/wp-content\/uploads\/2020\/10\/9400932d18d0368c694e85087d026a16.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nS t\u00edmto mno\u017estv\u00edm \u201ebarevn\u00fdch\u201c t\u00fdm\u016f m\u016f\u017ee b\u00fdt obt\u00ed\u017en\u00e9 ur\u010dit, jak\u00fd typ va\u0161e organizace pot\u0159ebuje.<\/p>\n<p>Jednou z alternativ \u201e\u010derven\u00e9mu t\u00fdmu\u201c, sp\u00ed\u0161e jin\u00e9mu typu t\u00fdmu, kter\u00fd m\u016f\u017ee b\u00fdt pou\u017e\u00edv\u00e1n ve spojen\u00ed s \u201e\u010derven\u00fdm t\u00fdmem\u201c, je \u201emodr\u00fd t\u00fdm\u201c. \u201eModr\u00fd t\u00fdm\u201c tak\u00e9 hodnot\u00ed bezpe\u010dnost s\u00edt\u011b a odhaluje jak\u00e9koli mo\u017en\u00e9 zranitelnosti infrastruktury. Jeho c\u00edlem je v\u0161ak n\u011bco jin\u00e9ho. T\u00fdmy tohoto typu jsou nezbytn\u00e9 k nalezen\u00ed zp\u016fsob\u016f ochrany, zm\u011bny a reorganizace ochrann\u00fdch mechanism\u016f, aby se reakce na incidenty stala mnohem efektivn\u011bj\u0161\u00ed.<\/p>\n<p>Stejn\u011b jako \u201e\u010derven\u00fd t\u00fdm\u201c mus\u00ed modr\u00fd t\u00fdm ovl\u00e1dat stejn\u00e9 znalosti o taktik\u00e1ch \u00fato\u010dn\u00edk\u016f, technik\u00e1ch a procesech, aby na jejich z\u00e1klad\u011b vytv\u00e1\u0159el strategie reakce. Nicm\u00e9n\u011b povinnosti \u201emodr\u00e9ho t\u00fdmu\u201c se neomezuj\u00ed pouze na ochranu p\u0159ed \u00fatoky. Pod\u00edl\u00ed se tak\u00e9 na posilov\u00e1n\u00ed cel\u00e9 bezpe\u010dnostn\u00ed infrastruktury, nap\u0159\u00edklad pou\u017e\u00edv\u00e1n\u00edm syst\u00e9mu detekce vniknut\u00ed (IDS), kter\u00fd zaji\u0161\u0165uje nep\u0159etr\u017eitou anal\u00fdzu neobvykl\u00e9 a podez\u0159el\u00e9 aktivity.<\/p>\n<p>Zde je n\u011bkolik krok\u016f, kter\u00e9 \u201emodr\u00fd t\u00fdm\u201c vykon\u00e1v\u00e1:<\/p>\n<ul>\n<li>audit bezpe\u010dnosti, zejm\u00e9na audit DNS;<\/li>\n<li>anal\u00fdza log\u016f a pam\u011bti; <\/li>\n<li>anal\u00fdza paket\u016f s\u00ed\u0165ov\u00fdch dat; <\/li>\n<li>anal\u00fdza dat o rizic\u00edch; <\/li>\n<li>anal\u00fdza digit\u00e1ln\u00ed stopy; <\/li>\n<li>zp\u011btn\u00e9 in\u017een\u00fdrstv\u00ed; <\/li>\n<li>DDoS testov\u00e1n\u00ed; <\/li>\n<li>v\u00fdvoj sc\u00e9n\u00e1\u0159\u016f realizace rizik. <\/li>\n<\/ul>\n<p><\/p>\n<h3>Rozd\u00edly mezi \u010derven\u00fdm a modr\u00fdm t\u00fdmem<\/h3>\n<p>\nB\u011b\u017en\u00e1 ot\u00e1zka pro mnoho organizac\u00ed: kter\u00fd t\u00fdm by m\u011bli pou\u017e\u00edt \u2014 \u010derven\u00fd nebo modr\u00fd. Tato ot\u00e1zka je tak\u00e9 \u010dasto prov\u00e1zena p\u0159\u00e1telskou nevra\u017eivost\u00ed mezi lidmi, kte\u0159\u00ed pracuj\u00ed \u201ena opa\u010dn\u00fdch stran\u00e1ch barik\u00e1d\u201c. Ve skute\u010dnosti v\u0161ak nem\u00e1 \u017e\u00e1dn\u00fd t\u00fdm smysl bez druh\u00e9ho. Tak\u017ee spr\u00e1vn\u00e1 odpov\u011b\u010f na tuto ot\u00e1zku je, \u017ee oba t\u00fdmy jsou d\u016fle\u017eit\u00e9.<\/p>\n<p>\u201e\u010cerven\u00fd t\u00fdm\u201c \u00fato\u010d\u00ed a pou\u017e\u00edv\u00e1 se k prov\u011b\u0159ov\u00e1n\u00ed p\u0159ipravenosti \u201emodr\u00e9ho t\u00fdmu\u201c na obranu. N\u011bkdy m\u016f\u017ee \u201e\u010derven\u00fd t\u00fdm\u201c nal\u00e9zt zranitelnosti, kter\u00e9 \u201emodr\u00fd t\u00fdm\u201c zcela p\u0159ehl\u00e9dl, a v tomto p\u0159\u00edpad\u011b by m\u011bl \u201e\u010derven\u00fd t\u00fdm\u201c uk\u00e1zat, jak tyto zranitelnosti mohou b\u00fdt opraveny.<\/p>\n<p>Pro oba t\u00fdmy je \u017eivotn\u011b d\u016fle\u017eit\u00e9 spolupracovat proti kyberzlo\u010dinc\u016fm na pos\u00edlen\u00ed informa\u010dn\u00ed bezpe\u010dnosti.<\/p>\n<p>Z tohoto d\u016fvodu ned\u00e1v\u00e1 smysl vyb\u00edrat jen jednu stranu nebo investovat pouze do jednoho typu t\u00fdmu. Je d\u016fle\u017eit\u00e9 m\u00edt na pam\u011bti, \u017ee c\u00edlem obou stran je prevenci kybernetick\u00fdch zlo\u010din\u016f.<br \/>\nJin\u00fdmi slovy, spole\u010dnosti mus\u00ed nav\u00e1zat vz\u00e1jemnou spolupr\u00e1ci obou t\u00fdm\u016f, aby zajistily komplexn\u00ed audit \u2013 se z\u00e1znamy v\u0161ech proveden\u00fdch \u00fatok\u016f a kontrol, z\u00e1pisy zji\u0161t\u011bn\u00fdch nedostatk\u016f.<\/p>\n<p>\u010cerven\u00fd t\u00fdm poskytuje informace o operac\u00edch, kter\u00e9 provedli b\u011bhem simulace \u00fatoku, zat\u00edmco modr\u00fd t\u00fdm uv\u00e1d\u00ed akce, kter\u00e9 podnikli k vypln\u011bn\u00ed mezer a odstran\u011bn\u00ed zji\u0161t\u011bn\u00fdch zranitelnost\u00ed.<\/p>\n<p>V\u00fdznam obou t\u00fdm\u016f nelze podce\u0148ovat. Bez jejich nep\u0159etr\u017eit\u00e9ho auditu bezpe\u010dnosti, prov\u00e1d\u011bn\u00ed test\u016f na penetraci a zdokonalov\u00e1n\u00ed infrastruktury by spole\u010dnosti nem\u011bly \u017e\u00e1dnou p\u0159edstavu o stavu sv\u00e9 vlastn\u00ed bezpe\u010dnosti. Minim\u00e1ln\u011b do t\u00e9 doby, ne\u017e dojde k \u00faniku dat, a stane se bolestn\u011b jasn\u00fdm, \u017ee bezpe\u010dnostn\u00ed opat\u0159en\u00ed byla nedostate\u010dn\u00e1.<\/p>\n<h3>Co je to 'fialov\u00fd t\u00fdm'?<\/h3>\n<p>\n'Fialov\u00fd t\u00fdm' vznikl jako pokus o spojen\u00ed \u010derven\u00e9ho a modr\u00e9ho t\u00fdmu. 'Fialov\u00fd t\u00fdm' je sp\u00ed\u0161e koncepc\u00ed ne\u017e samostatn\u00fdm typem t\u00fdmu. Je lep\u0161\u00ed jej pova\u017eovat za kombinaci \u010derven\u00e9ho a modr\u00e9ho t\u00fdmu. Zapoj\u00ed ob\u011b skupiny a pom\u00e1h\u00e1 jim spolupracovat.<\/p>\n<p>'Fialov\u00fd t\u00fdm' m\u016f\u017ee pomoci bezpe\u010dnostn\u00edm slu\u017eb\u00e1m zv\u00fd\u0161it efektivitu detekce zranitelnost\u00ed, hled\u00e1n\u00ed hrozeb a monitorov\u00e1n\u00ed s\u00edt\u011b t\u00edm, \u017ee p\u0159esn\u011b modeluje b\u011b\u017en\u00e9 sc\u00e9n\u00e1\u0159e hrozeb a pom\u00e1h\u00e1 vytv\u00e1\u0159et nov\u00e9 metody detekce a prevence hrozeb.<\/p>\n<p>N\u011bkter\u00e9 organizace zapojuj\u00ed 'fialov\u00fd t\u00fdm' pro jednor\u00e1zov\u00e9 c\u00edlen\u00e9 akce, kdy jsou c\u00edle bezpe\u010dnosti, term\u00edny a kl\u00ed\u010dov\u00e9 v\u00fdsledky p\u0159esn\u011b definov\u00e1ny. To zahrnuje uzn\u00e1n\u00ed nedostatk\u016f v \u00fatoku a obran\u011b, stejn\u011b jako stanoven\u00ed budouc\u00edch po\u017eadavk\u016f na \u0161kolen\u00ed a technologie.<\/p>\n<p>Alternativn\u00ed p\u0159\u00edstup, kter\u00fd v sou\u010dasnosti nab\u00edr\u00e1 na obr\u00e1tk\u00e1ch, spo\u010d\u00edv\u00e1 v tom, \u017ee 'fialov\u00fd t\u00fdm' se pova\u017euje za konceptu\u00e1ln\u00ed model, kter\u00fd funguje v cel\u00e9 organizaci, a napom\u00e1h\u00e1 budov\u00e1n\u00ed kultury kybernetick\u00e9 bezpe\u010dnosti a jej\u00edho neust\u00e1l\u00e9ho zlep\u0161ov\u00e1n\u00ed.<\/p>\n<h2> Z\u00e1v\u011br<\/h2>\n<p>\nRed Teaming, nebo komplexn\u00ed simulace \u00fatok\u016f, je siln\u00e1 metoda testov\u00e1n\u00ed zranitelnost\u00ed bezpe\u010dnostn\u00edho syst\u00e9mu organizace, ale je t\u0159eba ji pou\u017e\u00edvat opatrn\u011b. Zvl\u00e1\u0161t\u011b k jej\u00edmu prov\u00e1d\u011bn\u00ed pot\u0159ebujete m\u00edt dostate\u010dn\u011b <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/cybersecurity-tips\/\">rozvinut\u00e9 prost\u0159edky ochrany informa\u010dn\u00ed bezpe\u010dnosti<\/a><\/noindex>, jinak nemus\u00ed splnit o\u010dek\u00e1v\u00e1n\u00ed, kter\u00e1 na n\u011bj byla kladena.<br \/>\nRed Teaming m\u016f\u017ee odhalit zranitelnosti va\u0161eho syst\u00e9mu, o kter\u00fdch jste ani nev\u011bd\u011bli, a pomoci je odstranit. Pou\u017e\u00edv\u00e1n\u00edm sout\u011b\u017en\u00edho p\u0159\u00edstupu mezi modr\u00fdmi a \u010derven\u00fdmi t\u00fdmy m\u016f\u017eete simulovat chov\u00e1n\u00ed skute\u010dn\u00e9ho hackera, jako by se cht\u011bl zmocnit va\u0161ich dat nebo po\u0161kodit va\u0161e aktiva.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/524308\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: Acunetix Red Teaming (\u0430\u0442\u0430\u043a\u0430 \u00ab\u043a\u0440\u0430\u0441\u043d\u043e\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u044b\u00bb) \u2013 \u044d\u0442\u043e \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u0430\u044f \u0438\u043c\u0438\u0442\u0430\u0446\u0438\u044f \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a \u0441 \u0446\u0435\u043b\u044c\u044e \u043e\u0446\u0435\u043d\u043a\u0438 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0438\u0441\u0442\u0435\u043c. \u00ab\u041a\u0440\u0430\u0441\u043d\u0430\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u0430\u00bb \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0443 \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u043e\u0432 (\u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0449\u0438\u0445 \u0442\u0435\u0441\u0442 \u043d\u0430 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443). \u041e\u043d\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043a\u0430\u043a \u043d\u0430\u043d\u044f\u0442\u044b\u043c\u0438 \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b, \u0442\u0430\u043a \u0438 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u0430\u043c\u0438 \u0432\u0430\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u043d\u043e \u0432\u043e \u0432\u0441\u0435\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445 \u0438\u0445 \u0440\u043e\u043b\u044c \u043e\u0434\u0438\u043d\u0430\u043a\u043e\u0432\u0430 \u2014 \u0438\u043c\u0438\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":97777,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-97776","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/red-teaming-kompleksnaya-imitacziya-atak-metodologiya-i-instrumenty\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Red Teaming \u2014 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u0430\u044f \u0438\u043c\u0438\u0442\u0430\u0446\u0438\u044f \u0430\u0442\u0430\u043a. \u041c\u0435\u0442\u043e\u0434\u043e\u043b\u043e\u0433\u0438\u044f \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/red-teaming-kompleksnaya-imitacziya-atak-metodologiya-i-instrumenty\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-21T18:42:28+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-21T18:42:28+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Red Teaming \u2014 komplexn\u00ed simulace \u00fatok\u016f. Metodologie a n\u00e1stroje | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/red-teaming-kompleksnaya-imitacziya-atak-metodologiya-i-instrumenty","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Red Teaming \u2014 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u0430\u044f \u0438\u043c\u0438\u0442\u0430\u0446\u0438\u044f \u0430\u0442\u0430\u043a. \u041c\u0435\u0442\u043e\u0434\u043e\u043b\u043e\u0433\u0438\u044f \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b | ProHoster","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/red-teaming-kompleksnaya-imitacziya-atak-metodologiya-i-instrumenty","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-21T18:42:28+00:00","article:modified_time":"2020-10-21T18:42:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"97776","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:13:06","updated":"2022-09-27 23:41:29","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/97776","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=97776"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/97776\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/97777"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=97776"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=97776"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=97776"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}