{"id":31628,"date":"2019-10-31T21:42:14","date_gmt":"2019-10-31T18:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/informatsionnaya-bezopasnost-apparatnyh-reshenij-usb-over-ip\/"},"modified":"2019-10-31T21:42:14","modified_gmt":"2019-10-31T18:42:14","slug":"informatsionnaya-bezopasnost-apparatnyh-reshenij-usb-over-ip","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/informatsionnaya-bezopasnost-apparatnyh-reshenij-usb-over-ip","title":{"rendered":"Informationssikkerhed for hardwarel\u00f8sninger USB over IP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>For nylig delte jeg <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/445094\/\">min erfaring med at finde en l\u00f8sning til at organisere centraliseret adgang til elektroniske beskyttelsesn\u00f8gler<\/a><\/noindex> i vores organisation. I kommentarerne blev et alvorligt sp\u00f8rgsm\u00e5l om informationssikkerhed ved hardwarel\u00f8sninger til USB over IP rejst, som ogs\u00e5 bekymrer os.<\/p>\n<p>S\u00e5 lad os f\u00f8rst definere udgangspunktet. <\/p>\n<ul>\n<li>Et stort antal elektroniske beskyttelsesn\u00f8gler.<\/li>\n<li>Adgang til dem er n\u00f8dvendig fra forskellige geografiske steder.<\/li>\n<li>Vi overvejer kun hardwarel\u00f8sninger til USB over IP og fors\u00f8ger at sikre denne l\u00f8sning ved at tr\u00e6ffe yderligere organisatoriske og tekniske foranstaltninger (alternativer overvejes ikke).<\/li>\n<li>I denne artikel vil jeg ikke gennemg\u00e5 alle de trusler, vi ser p\u00e5 (meget kan ses i <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/422329\/\">publikation<\/a><\/noindex>), men jeg vil kort fokusere p\u00e5 to punkter. Vi udelukker social engineering og ulovlige handlinger fra brugernes side. Vi overvejer mulighederne for uautoriseret adgang til USB-enheder fra netv\u00e6rk uden at have de normale adgangsoplysninger.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Informationssikkerhed for hardwarel\u00f8sninger USB over IP\" src=\"\/wp-content\/uploads\/2019\/04\/19b201d89a6f7face278ad9e3159e388.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nFor at sikre adgangssikkerheden til USB-enheder er der truffet organisatoriske og tekniske foranstaltninger:<\/p>\n<p>1. Organisatoriske sikkerhedsforanstaltninger. <\/p>\n<p>En styret USB over IP-hub er installeret i et serverrum, som kan l\u00e5ses med en n\u00f8gle. Den fysiske adgang til det er ordnet (adgangskontrol til selve rummet, videooverv\u00e5gning, n\u00f8gler og adgangsretter er begr\u00e6nset til en strikt gruppe personer).<\/p>\n<p>Alle USB-enheder, der bruges i organisationen, er groft opdelt i 3 grupper:<\/p>\n<ul>\n<li>Kritiske. Finansielle digitale signaturer \u2013 bruges i overensstemmelse med bankens anbefalinger (ikke via USB over IP)<\/li>\n<li>Vigtige. Digitale signaturer til markedspladser, tjenester, elektronisk dokumenth\u00e5ndtering, rapportering osv., en r\u00e6kke n\u00f8gler til software \u2013 bruges med en styret USB over IP-hub.<\/li>\n<li>Ikke kritiske. En r\u00e6kke n\u00f8gler til software, kameraer, nogle USB-stik og diske med ikke-kritisk information, USB-modemer \u2013 bruges med en styret USB over IP-hub.<\/li>\n<\/ul>\n<p>\n2. Tekniske sikkerhedsforanstaltninger.<\/p>\n<p>Netv\u00e6rksadgang til den styrede USB over IP-hub gives kun inde i et isoleret subnet. Adgang til det isolerede subnet gives: <\/p>\n<ul>\n<li>fra terminalserverfarmene, <\/li>\n<li>via VPN (certifikat og adgangskode) til et begr\u00e6nset antal computere og b\u00e6rbare computere, der tildeles faste adresser via VPN,<\/li>\n<li>via VPN-tunneler, der forbinder regionskontorerne.<\/li>\n<\/ul>\n<p>\nP\u00e5 den fuldt styrede USB over IP-hub DistKontrolUSB er funktionerne konfigureret ved hj\u00e6lp af dens indbyggede v\u00e6rkt\u00f8jer:<\/p>\n<ul>\n<li>For at f\u00e5 adgang til USB-enhederne via USB over IP-hubben er der anvendt kryptering (kryptering SSL er aktiveret p\u00e5 hubben), selvom det m\u00e5ske allerede er un\u00f8dvendigt.<\/li>\n<li>Der er konfigureret \"adgangsbegr\u00e6nsning til USB-enheder efter IP-adresse\". Afh\u00e6ngigt af IP-adressen f\u00e5r brugeren enten adgang til de tildelte USB-enheder eller ej.<\/li>\n<li>Der er konfigureret \"adgangsbegr\u00e6nsning til USB-porten efter login og password\". Brugerne har derfor f\u00e5et tildelt rettigheder til adgang til USB-enheder. <\/li>\n<li>\"Adgangsbegr\u00e6nsning til USB-enheden efter login og password\" blev besluttet ikke at anvende, da alle USB-n\u00f8gler er permanent tilsluttet USB over IP-hubben og ikke flyttes fra port til port. Det giver mere mening for os at give brugerne adgang til USB-porten med en enhed, der er installeret i l\u00e6ngere tid.<\/li>\n<li>Den fysiske t\u00e6nding og slukning af USB-porte sker:\n<ul>\n<li>For software-n\u00f8gler og EDC \u2014 ved hj\u00e6lp af opgaveplanl\u00e6ggeren og tildelte opgaver p\u00e5 hubben (et udvalg af n\u00f8gler blev programmeret til at t\u00e6nde kl. 9.00 og slukke kl. 18.00, og nogle fra 13.00 til 16.00);<\/li>\n<li>For n\u00f8gler fra handelsplatforme og en r\u00e6kke software \u2013 godkendt af brugerne gennem WEB-gr\u00e6nsefladen;<\/li>\n<li>Kameraer, en r\u00e6kke USB-sticks og diske med ikke-kritisk information \u2013 er altid t\u00e6ndt.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>\n Vi antager, at en s\u00e5dan organisering af adgangen til USB-enheder sikrer deres sikre brug:<\/p>\n<ul>\n<li>fra regionskontorerne (betegnet NET nr. 1 \u2026\u2026 NET nr. N), <\/li>\n<li>for et begr\u00e6nset antal computere og b\u00e6rbare computere, der tilslutter USB-enheder gennem det globale netv\u00e6rk, <\/li>\n<li>for brugere, der er offentliggjort p\u00e5 de terminalservere, der k\u00f8rer applikationer.<\/li>\n<\/ul>\n<p>\nI kommentarerne vil vi gerne h\u00f8re konkrete praktiske tiltag, der \u00f8ger informationssikkerheden ved at give global adgang til USB-enheder.<br \/>\n<br \/>Kilde: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/448110\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u043f\u0440\u0438 \u043f\u043e\u0438\u0441\u043a\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043b\u044e\u0447\u0430\u043c \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b \u0432 \u043d\u0430\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \u0412 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 \u0431\u044b\u043b\u0438 \u043f\u043e\u0434\u043d\u044f\u0442 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0439 \u0432\u043e\u043f\u0440\u043e\u0441 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u0448\u0435\u043d\u0438\u0439 USB over IP, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438 \u043d\u0430\u0441 \u0432\u0435\u0441\u044c\u043c\u0430 \u0431\u0435\u0441\u043f\u043e\u043a\u043e\u0438\u0442. \u0418\u0442\u0430\u043a, \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u0432\u0441\u0435 \u0436\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u043c\u0441\u044f \u0441 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u043c\u0438. \u0411\u043e\u043b\u044c\u0448\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043a\u043b\u044e\u0447\u0435\u0439 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b. \u0414\u043e\u0441\u0442\u0443\u043f \u043a \u043d\u0438\u043c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c \u0438\u0437 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0433\u0435\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23546,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31628","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u043f\u0440\u0438 \u043f\u043e\u0438\u0441\u043a\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043b\u044e\u0447\u0430\u043c \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b \u0432 \u043d\u0430\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/informatsionnaya-bezopasnost-apparatnyh-reshenij-usb-over-ip\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u0448\u0435\u043d\u0438\u0439 USB over IP | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u043f\u0440\u0438 \u043f\u043e\u0438\u0441\u043a\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043b\u044e\u0447\u0430\u043c \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b \u0432 \u043d\u0430\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/informatsionnaya-bezopasnost-apparatnyh-reshenij-usb-over-ip\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:42:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:42:14+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Informationssikkerhed for hardwarel\u00f8sninger USB over IP | ProHoster","description":"For nylig delte jeg erfaringer med at finde l\u00f8sninger til at organisere centraliseret adgang til elektroniske beskyttelsesn\u00f8gler i vores organisation.","canonical_url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/informatsionnaya-bezopasnost-apparatnyh-reshenij-usb-over-ip","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u0448\u0435\u043d\u0438\u0439 USB over IP | ProHoster","og:description":"\u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u043f\u0440\u0438 \u043f\u043e\u0438\u0441\u043a\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043b\u044e\u0447\u0430\u043c \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b \u0432 \u043d\u0430\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/da\/blog\/administrirovanie\/informatsionnaya-bezopasnost-apparatnyh-reshenij-usb-over-ip","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:42:14+00:00","article:modified_time":"2019-10-31T18:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31628","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 07:05:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:13:29","updated":"2026-01-21 07:05:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/31628","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=31628"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/31628\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/23546"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=31628"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=31628"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=31628"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}