{"id":31057,"date":"2019-10-31T21:39:12","date_gmt":"2019-10-31T18:39:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya\/"},"modified":"2019-10-31T21:39:12","modified_gmt":"2019-10-31T18:39:12","slug":"kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya","title":{"rendered":"Kuidas v\u00f5tta v\u00f5rgu infrastruktuur enda kontrolli alla. Kolmas peat\u00fckk. V\u00f5rgujulgeolek. Teine osa","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i>See artikkel on neljas osa artiklite seeriast 'Kuidas v\u00f5tta oma v\u00f5rgu infrastruktuuri kontrolli alla'. K\u00f5igi seeria artiklite sisu ja lingid leiate <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/447008\/\">siit<\/a><\/noindex><\/i>.<\/p>\n<p>V <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">esimeses osas<\/a><\/noindex> selles peat\u00fckis k\u00e4sitlesime m\u00f5ningaid andmekeskuse v\u00f5rgu turvalisuse aspekte. See osa keskendub 'Internet Access' sektorile. <\/p>\n<p><img decoding=\"async\" alt=\"Kuidas v\u00f5tta v\u00f5rgu infrastruktuur enda kontrolli alla. Kolmas peat\u00fckk. V\u00f5rgujulgeolek. Teine osa\" src=\"\/wp-content\/uploads\/2019\/04\/10b33f9b02e3a7562d9e7cf023cbc197.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h1>Internet access<\/h1>\n<p>\nTurvalisuse teema on kindlasti \u00fcks keerulisemaid teemasid andmeside maailmas. Nagu varasemateski osa, ei pretendeeri ma s\u00fcgavusele ja t\u00e4ielikkusele, kuid k\u00e4sitlen siin \u00fcsna lihtsaid, kuid minu arvates olulisi k\u00fcsimusi, millele antud vastused aitavad t\u00f5sta teie v\u00f5rgu kaitsetaset.<\/p>\n<p>Selle sektori auditi k\u00e4igus p\u00f6\u00f6rake t\u00e4helepanu j\u00e4rgmistele aspektidele:<\/p>\n<ul>\n<li>disain<\/li>\n<li>BGP seaded <\/li>\n<li>DOS\/DDOS kaitse<\/li>\n<li>liikluse filtreerimine tulem\u00fc\u00fcris<\/li>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Disain<\/h3>\n<p>\nDisaini n\u00e4itena soovitan ettev\u00f5tte v\u00f5rgu jaoks <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/dam\/en\/us\/solutions\/collateral\/enterprise\/design-zone-security\/safe-architecture-guide-pin-secure-internet-edge.pdf\">juhend<\/a><\/noindex> Cisco poolt, raamistikus <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/solutions\/enterprise\/design-zone-security\/landing_safe.html#~tab-architecture\">SAFE mudel<\/a><\/noindex>.<\/p>\n<p>Loomulikult v\u00f5ib m\u00f5ne teise tootja lahendus teile tunduda atraktiivsem (vt. <noindex><a rel=\"nofollow\" href=\"https:\/\/researchcenter.paloaltonetworks.com\/2018\/10\/palo-alto-networks-seven-time-gartner-magic-quadrant-leader\/\">Gartneri kvadrant 2018<\/a><\/noindex>), kuid kuigi ma ei kutsu teid \u00fcles j\u00e4rgima seda disaini \u00fcksikasju, pean siiski kasulikuks m\u00f5ista selle aluseks olevaid p\u00f5him\u00f5tteid ja ideid.<\/p>\n<blockquote><p><b>M\u00e4rkus<\/b><\/p>\n<p>SAFE segmendis on \u00abRemote Access\u00bb osa \u00abInternet Access'ist\u00bb. Kuid sel korral k\u00e4sitleme seda eraldi.<\/p><\/blockquote>\n<p>Selle segmendi standardvarustus ettev\u00f5tte (enterprise network) jaoks sisaldab <\/p>\n<ul>\n<li>piirimar\u0161rutajad (border routers)<\/li>\n<li>tulem\u00fc\u00fcrid<\/li>\n<\/ul>\n<p><\/p>\n<blockquote><p><b>M\u00e4rkus 1<\/b><\/p>\n<p>K\u00e4esolevas artiklite ts\u00fcklis, kui ma r\u00e4\u00e4gin tulem\u00fc\u00fcridest, m\u00f5istan ma sellega <noindex><a rel=\"nofollow\" href=\"https:\/\/en.wikipedia.org\/wiki\/Next-generation_firewall\">NGFW<\/a><\/noindex>.<\/p><\/blockquote>\n<blockquote><p><b>M\u00e4rkus 2<\/b><\/p>\n<p>J\u00e4tan k\u00f5rvale L2\/L1 v\u00f5i L2 \u00fcle L3 lahenduste arutamise, mis on vajalikud L1\/L2 \u00fchenduvuse tagamiseks, ja piirdun ainult L3 ja \u00fcle selle tasemega seotud k\u00fcsimustega. Osaliselt on L1\/L2 k\u00fcsimusi k\u00e4sitletud peat\u00fckis &#171;<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/434750\/\">Puhastamine ja dokumenteerimine<\/a><\/noindex>&#171;.<\/p><\/blockquote>\n<p> Kui te ei leia selle segmendi tulem\u00fc\u00fcri, siis \u00e4rge kiirustage j\u00e4relduste tegemisega.<\/p>\n<p>Alustame nagu <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">eelmisel osal<\/a><\/noindex>, k\u00fcsimusest, kas tulem\u00fc\u00fcri kasutamine on teie jaoks selles segmendis vajalik?<\/p>\n<p>V\u00f5in \u00f6elda, et see tundub olevat k\u00f5ige \u00f5igustatud koht tulem\u00fc\u00fcride kasutamiseks ja keerukate liiklusfiltreerimise algoritmide rakendamiseks. Osas 1 <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">mainisime 4 tegurit, mis v\u00f5ivad tulem\u00fc\u00fcride kasutamist andmekeskuse segmendis t\u00f5kestada. Siin ei ole need aga enam nii olulised.<\/a><\/noindex> N\u00e4ide 1.<\/p>\n<blockquote><p>N\u00e4ide 1. <b>Viivitus<\/b><\/p>\n<p>Internetis ei ole m\u00f5tet r\u00e4\u00e4kida isegi 1 millisekundi viivitustest. Seet\u00f5ttu ei saa viivitus selle valdkonna osas olla tegur, mis piirab tulem\u00fc\u00fcri kasutamist.<\/p><\/blockquote>\n<blockquote><p>N\u00e4ide 2. <b>Tootlikkus<\/b><\/p>\n<p>M\u00f5nel juhul v\u00f5ib see tegur ikkagi olla oluline. Seet\u00f5ttu peate v\u00f5ib-olla osa liiklust (n\u00e4iteks koormuse tasakaalustajate liiklus) suunama tulem\u00fc\u00fcrist m\u00f6\u00f6da.<\/p><\/blockquote>\n<blockquote><p>N\u00e4ide 3. <b>Usaldusv\u00e4\u00e4rsus<\/b><\/p>\n<p>Seda tegurit tuleb endiselt arvesse v\u00f5tta, kuid arvestades interneti ebakindlust, ei ole selle t\u00e4htsus antud valdkonnas nii suur kui andmekeskuses. <\/p>\n<p>Oletame, et teie teenus t\u00f6\u00f6tab http\/https pinnal (l\u00fchikeste seanssidega). Sellisel juhul saate kasutada kahte s\u00f5ltumatut seadet (ilma HA-ta) ja juhuks, kui \u00fchel neist tekivad marsruutimise probleemid, suunata kogu liiklus teisele. <\/p>\n<p>V\u00f5i v\u00f5ite kasutada tulem\u00fc\u00fcre l\u00e4bipaistvas re\u017eiimis ja kui need peaksid rikki minema, suunata liiklus probleemi lahendamise ajaks m\u00f6\u00f6da tulem\u00fc\u00fcre.<\/p><\/blockquote>\n<p> Seet\u00f5ttu v\u00f5ib just see <b>hind<\/b> olla see tegur, mis sunnib teid loobuma tulem\u00fc\u00fcride rakendamisest selles valdkonnas.<\/p>\n<blockquote><p><b>Oluline!<\/b><\/p>\n<p>On the one hand, it might be tempting to combine this firewall with the data center firewall (using one firewall for these segments). The solution is theoretically possible, but it\u2019s important to understand that since the 'Internet Access' firewall is essentially at the forefront of your defense and is dealing with at least some portion of malicious traffic, there is, of course, an increased risk that this firewall could be compromised. In other words, using the same devices in both of these segments will significantly reduce the availability of your data center segment.<\/p><\/blockquote>\n<p> As always, it\u2019s important to understand that depending on the service the company provides, the design of this segment can vary significantly. You can choose different approaches based on the requirements. <\/p>\n<blockquote><p><b>N\u00e4ide<\/b><\/p>\n<p>If you are a content provider with a CDN network (see, for example, <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/users\/ramax\/posts\/\">a series of articles<\/a><\/noindex>), you may not want to create infrastructure with dozens, or even hundreds, of points of presence using separate devices for traffic routing and filtering. This would be expensive and may simply be excessive. <\/p>\n<p>BGP jaoks ei ole teil tingimata vaja p\u00fchendatud ruutereid, v\u00f5ite kasutada avatud l\u00e4htekoodiga t\u00f6\u00f6riistu, n\u00e4iteks <noindex><a rel=\"nofollow\" href=\"https:\/\/www.quagga.net\">Quagga<\/a><\/noindex>. Seet\u00f5ttu v\u00f5ib-olla on k\u00f5ik, mida vajate, server v\u00f5i mitu serverit, l\u00fcliti ja BGP.<\/p>\n<p>Sel juhul v\u00f5ivad teie server v\u00f5i mitmed serverid toimida mitte ainult CDN-serverina, vaid ka ruuteri rollis. Muidugi on siin veel palju detaile (n\u00e4iteks, kuidas tagada koormuse tasandamine), kuid see on teostatav ning seda l\u00e4henemist oleme edukalt rakendanud \u00fche meie partneri jaoks.<\/p>\n<p>Teil v\u00f5ivad olla mitu andmekeskust t\u00e4ieliku kaitsega (tulekahjus\u00fc\u00fctajad, DDoS-i kaitseteenused, mida pakuvad teie interneti pakkujad) ja k\u00fcmneid v\u00f5i sadu \"lihtsustatud\" kohaloleku punkte, vaid L2 l\u00fclitite ja serveritega.<\/p>\n<p>Aga kuidas on kaitse antud juhul?<\/p>\n<p>Vaatame n\u00e4iteks viimasel ajal populaarsust kogunud <noindex>DNS Amplification DDoS r\u00fcnnakut<\/noindex>. Selle oht seisneb selles, et genereeritakse suur hulk liiklust, mis lihtsalt \"t\u00e4pib\" 100% k\u00f5ik teie \u00fclest\u00f5usud. <\/p>\n<p>Mida me meie disaini puhul n\u00e4eme.<\/p>\n<ul>\n<li>kui kasutate AnyCast'i, siis jaotatakse liiklus teie kohalolekupunktide vahel. Kui teie kogurbalanss on terabittides, siis see iseenesest kaitseb teid \"\u00fclevoolu\" eest, kuigi viimasel ajal on olnud mitmeid terabittide suurusi pahatahtliku liiklusega r\u00fcnnakuid.<\/li>\n<li>kui m\u00f5ni uplink ikkagi \"t\u00fckib\", siis lihtsalt eemaldage see koht teenusest (l\u00f5petage prefiksi kuulutamine).<\/li>\n<li>v\u00f5ite samuti suurendada liikluse osakaalu, mis tuleb teie \"t\u00e4ist\u00f6\u00f6v\u00f5imega\" (ja seet\u00f5ttu kaitstud) andmekeskustest, selle kaudu eemaldades suure osa pahatahtlikust liiklusest kaitsmata kohalolekupunktidest.<\/li>\n<\/ul>\n<p>\nJa veel \u00fcks t\u00e4helepanek selle n\u00e4ite juurde. Kui edastate piisavalt liiklust IX-ide kaudu, siis see v\u00e4hendab ka teie haavatavust taolistele r\u00fcnnakutele.<\/p><\/blockquote>\n<h3>BGP seadistamine<\/h3>\n<p>\nSiin on kaks teemat.<\/p>\n<ul>\n<li>\u00dchenduvus<\/li>\n<li>BGP seadistamine<\/li>\n<\/ul>\n<p>\nKonnektiivsusest oleme juba natuke r\u00e4\u00e4kinud. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">mainisime 4 tegurit, mis v\u00f5ivad tulem\u00fc\u00fcride kasutamist andmekeskuse segmendis t\u00f5kestada. Siin ei ole need aga enam nii olulised.<\/a><\/noindex>. Oluline on, et liiklus teie klientidele liiguks optimaalsel teel. Kuigi optimaalsus ei t\u00e4henda alati ainult viivitust, on madal viivitus sageli peamine n\u00e4itaja optimaalsuse osas. M\u00f5nes ettev\u00f5ttes on see olulisem, teistes v\u00e4hem. K\u00f5ik s\u00f5ltub teenusest, mida pakute.<\/p>\n<blockquote><p><b>N\u00e4ide 1<\/b><\/p>\n<p>Kui olete b\u00f6rs ja teie klientide jaoks on olulised ajaintervallid, mis on v\u00e4hem kui millisekund, siis on selge, et ei saa r\u00e4\u00e4kida \u00fcldse internetist.<\/p><\/blockquote>\n<blockquote><p><b>N\u00e4ide 2<\/b><\/p>\n<p>Kui olete m\u00e4nguettev\u00f5te ja teile on olulised k\u00fcmned millisekundid, siis on \u00fchenduvus kindlasti teie jaoks v\u00e4ga oluline.<\/p><\/blockquote>\n<blockquote><p><b>N\u00e4ide 3<\/b><\/p>\n<p>Samuti tuleb m\u00f5ista, et TCP protokolli omaduste t\u00f5ttu s\u00f5ltub andmeedastuskiirus \u00fche TCP seansi raames ka RTT-st (Round Trip Time). CDN-v\u00f5rgud on loodud ka selle probleemi lahendamiseks, tuues sisu edastamise serverid l\u00e4hemale sisu tarbijale.<\/p><\/blockquote>\n<p> \u00dchenduvuse uurimine on eraldi huvitav teema, mis v\u00e4\u00e4rib eraldi artiklit v\u00f5i artiklite seeriat ning n\u00f5uab head arusaamist, kuidas internet on 'konstrukteeritud'.<\/p>\n<p>Kasulikud ressursid:<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/ripe.net\">ripe.net<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/bgp.he.net\">bgp.he.net<\/a><\/noindex><\/p>\n<blockquote><p><b>N\u00e4ide<\/b><\/p>\n<p>Toon vaid \u00fche v\u00e4ikese n\u00e4ite.<\/p>\n<p>Oletame, et teie andmekeskus asub Moskvasse ja teil on ainult \u00fcks \u00fclekande\u00fchendus \u2013 Rostelecom (AS12389). Sellisel juhul (\u00fcksik \u00fchendus) ei ole BGP vajalik ning avalike aadressidena kasutate t\u00f5en\u00e4oliselt Rostelecomi aadressipooli. <\/p>\n<p>Oletame, et pakute mingit teenust ning teil on piisavalt kliente Ukrainast, kes kurdavad suurte viivituste \u00fcle. Uurimise k\u00e4igus selgitate, et osade nende IP-aadressid asuvad vahemikus 37.52.0.0\/21. <\/p>\n<p>Traceroute'i teostades n\u00e4ete, et liiklus l\u00e4heb l\u00e4bi AS1299 (Telia), ning ping'i teostades saate keskmiseks RTT-ks 70\u201380 millisekundit. Seda saate n\u00e4ha ka <noindex><a rel=\"nofollow\" href=\"http:\/\/lg.ip.rt.ru\">Rostelecomi looking glass'il.<\/a><\/noindex>.<\/p>\n<p>Whois utiliidiga (ripe.net-i lehek\u00fcljel v\u00f5i kohaliku utiliidi abil) saate h\u00f5lpsasti m\u00e4\u00e4rata, et plokk 37.52.0.0\/21 kuulub AS6849 (Ukrtelecom).<\/p>\n<p>Seej\u00e4rel, kui minge lehele <noindex><a rel=\"nofollow\" href=\"https:\/\/bgp.he.net\">bgp.he.net<\/a><\/noindex> n\u00e4ete, et AS6849-l pole suhteid AS12389-ga (nad ei ole \u00fcksteise kliendid ega \u00fclekanded ning neil pole ka peer'ingut). Kuid kui vaatate <noindex><a rel=\"nofollow\" href=\"https:\/\/bgp.he.net\/AS6849#_peers\">AS6849 peer'ide nimekirja,<\/a><\/noindex> n\u00e4ete n\u00e4iteks AS29226 (Mastertel) ja AS31133 (Megafon). <\/p>\n<p>Leides nende teenusepakkujate looking glass'id, saate v\u00f5rrelda teed ja RTT-d. N\u00e4iteks Masterteli puhul on RTT umbes 30 millisekundit. <\/p>\n<p>Nii et, kui 80 ja 30 millisekundi vahe on teie teenuse jaoks oluline, siis peaksite v\u00f5ib-olla m\u00f5tlema \u00fchenduvusele, saama RIPE'lt oma AS-i numbri, oma aadresside basseini ning lisama t\u00e4iendavad uplinkid ja\/v\u00f5i looma IX-ides kohaloleku punkte.<\/p><\/blockquote>\n<p>\nBGP kasutamisel mitte ainult ei paranda te \u00fchenduvust, vaid ka reserveerite oma interneti\u00fchenduse.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.ssi.gouv.fr\/uploads\/2016\/03\/bgp-configuration-best-practices.pdf\">See dokument<\/a><\/noindex> sisaldab soovitusi BGP seadistamiseks. Kuigi need soovitused on v\u00e4lja t\u00f6\u00f6tatud teenuse pakkujate parimate praktikate p\u00f5hjal, on need ikkagi (kui teie BGP seadistused ei ole liiga elemetaarsed) kindlasti kasulikud ja peaksid tegelikult olema osa tugevdamisest, millest me r\u00e4\u00e4kisime. <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">esimeses osas<\/a><\/noindex>.<\/p>\n<h3>DOS\/DDOS kaitse<\/h3>\n<p>\nPraegu on DOS\/DDOS r\u00fcnnakud saanud paljude ettev\u00f5tete igap\u00e4evaseks reaalsuseks. Tegelikult r\u00fcnnatakse teid mingil kujul \u00fcsna sageli. See, et te seda praegu ei m\u00e4rka, viitab vaid sellele, et suunatud r\u00fcnnak pole veel teie vastu toimunud, ja need kaitsevahendid, mida te kasutate, isegi ilma teadmiseta (n\u00e4iteks erinevad operatsioonis\u00fcsteemide sisseehitatud kaitsed), on piisavad, et teenuse halvenemine teie ja teie klientide jaoks oleks v\u00f5imalikult v\u00e4he m\u00e4rgatav.<\/p>\n<p>On olemas veebiallikaid, mis p\u00f5hinevad seadmete logidel, ja mis reaalajas joonistavad r\u00fcnnakute ilusaid kaarte.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.csoonline.com\/article\/3217944\/security\/8-top-cyber-attack-maps-and-how-to-use-them.html\">Siit<\/a><\/noindex> nendele on v\u00f5imalik leida linke.<\/p>\n<p>Minu lemmik <noindex><a rel=\"nofollow\" href=\"https:\/\/threatmap.checkpoint.com\/ThreatPortal\/livemap.html\">kaart<\/a><\/noindex> CheckPointilt.<\/p>\n<p>DDOS\/DOS kaitse on tavaliselt kihiline. Selle p\u00f5hjuse m\u00f5istmiseks on oluline teada, millised DOS\/DDOS r\u00fcnnakute t\u00fc\u00fcbid eksisteerivad (vt n\u00e4iteks, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.csoonline.com\/article\/3222095\/network-security\/ddos-explained-how-denial-of-service-attacks-are-evolving.html\">siit <\/a><\/noindex> v\u00f5i <noindex><a rel=\"nofollow\" href=\"https:\/\/blog.thousandeyes.com\/three-types-ddos-attacks\/\">siit<\/a><\/noindex>)<\/p>\n<p>See t\u00e4hendab, et meil on kolm t\u00fc\u00fcpi r\u00fcnnakuid:<\/p>\n<ul>\n<li>volumetrilised r\u00fcnnakud<\/li>\n<li>protokolli r\u00fcnnakud<\/li>\n<li>rakenduse r\u00fcnnakud<\/li>\n<\/ul>\n<p>\nKui te saate viimaste kahe t\u00fc\u00fcbi r\u00fcnnakute eest ise kaitsta, kasutades n\u00e4iteks tulem\u00fc\u00fcre, siis te ei suuda kaitsta ennast r\u00fcnnakute eest, mis on suunatud teie uplink'idele (kui teie internetikanalite kogumaht ei ole t\u00fchjak\u00e4igul terabittides, veel parem, k\u00fcmnetes terabittides).<\/p>\n<p>Seet\u00f5ttu on esimene kaitseliin kaitse \u00abvolumetriliste\u00bb r\u00fcnnakute eest, ja selle kaitse peab tagama teie teenusepakkuja v\u00f5i teenusepakkujad. Kui te pole seda veel m\u00f5istnud, siis praegu teil lihtsalt vedanud.<\/p>\n<blockquote><p><b>N\u00e4ide<\/b><\/p>\n<p>Oletame, et teil on mitu uplinki, kuid ainult \u00fcks teenusepakkuja suudab teile seda kaitset pakkuda. Aga kui kogu liiklus l\u00e4heb l\u00e4bi \u00fche teenusepakkuja, siis kust j\u00e4\u00e4b meeldetuletus, millest me varem l\u00fchidalt r\u00e4\u00e4kisime?<\/p>\n<p>R\u00fcnnaku ajal peate selle juures osaliselt ohverdama \u00fchenduvuse. Kuid<\/p>\n<ul>\n<li>see kehtib ainult r\u00fcnnaku ajal. R\u00fcnnaku korral saate k\u00e4sitsi v\u00f5i automaatselt BGP-d \u00fcmber seadistada, nii et liiklus l\u00e4heks ainult l\u00e4bi teenusepakkuja, kes annab teile \u00abvarju\u00bb. R\u00fcnnaku l\u00f5ppedes saate suunamise tagasi algsesse seisundisse.<\/li>\n<li>Ei ole vajalik kogu liiklust t\u00f5lkida. Kui n\u00e4iteks n\u00e4ete, et m\u00f5nedest uplinkidest v\u00f5i peer'idest r\u00fcnnakuid ei tule (v\u00f5i liiklus ei ole m\u00e4rkimisv\u00e4\u00e4rne), saate j\u00e4tkata prefixide reklaamimist konkurentsiv\u00f5imeliste atribuutidega nende BGP naabrite suunal.<\/li>\n<\/ul>\n<\/blockquote>\n<p>\n\u00abProtokollir\u00fcnnakute\u00bb ja \u00abrakendusr\u00fcnnakute\u00bb kaitse v\u00f5ite samuti usaldada partneritele.<br \/>\nSiin on <noindex><a rel=\"nofollow\" href=\"https:\/\/geekflare.com\/ddos-protection-service\/\">siit<\/a><\/noindex> v\u00f5ite lugeda head uuringut (<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/company\/hosting-cafe\/blog\/324848\/\">t\u00f5lge<\/a><\/noindex>). T\u00f5si, artikkel on kaheaastane, kuid see annab teile \u00fclevaate l\u00e4henemistest, kuidas saate DDOS r\u00fcnnakute eest kaitsta.<\/p>\n<p>P\u00f5him\u00f5tteliselt v\u00f5ite sellega piirduda, usaldades kogu oma kaitse out-source'ile. Sellel lahendusel on plussid, kuid on ka ilmselge miinus. Asi on selles, et see v\u00f5ib (taas s\u00f5ltuvalt sellest, millega teie ettev\u00f5te tegeleb) t\u00e4hendada \u00e4ri elluj\u00e4\u00e4mist. Ja selliseid asju kolmandatele organisatsioonidele usaldada...<\/p>\n<p>Seega vaatame, kuidas korraldada teist ja kolmandat kaitseliini (kaitse t\u00e4iendamiseks teenusepakkuja poolt).<\/p>\n<p>Nii et teine kaitseliin on filtratsioon ja liikluse piirajad (policers) teie v\u00f5rku sisenemisel. <\/p>\n<blockquote><p><b>N\u00e4ide 1<\/b><\/p>\n<p>Oletame, et olete DDoS-i eest kaitstud m\u00f5ne teenusepakkuja kaudu. Oletame, et see teenusepakkuja kasutab liikluse filtreerimiseks Arbori ning filtreerimist oma v\u00f5rgu piiridel. <\/p>\n<p>Arbori \u201en\u00e4itus\u201d on piiratud, ja teenusepakkuja ei saa loomulikult pidevalt suunata kogu oma partnerite liiklust l\u00e4bi filtreerimisseadmete, kes on tellinud sellise teenuse. Seega tavatingimustes liiklust ei filtreerita.<\/p>\n<p>Oletame, et toimub SYN flood r\u00fcnne. Isegi kui olete tellinud teenuse, mille korral r\u00fcnne aeg-ajalt liiklus automaatselt filtreerimisele suunatakse, ei toimu see kohe. \u00dche minuti v\u00f5i rohkemate minutite jooksul olete endiselt r\u00fcnnaku all. See v\u00f5ib p\u00f5hjustada teie seadmete rikke v\u00f5i teenuse halvenemist. Sel juhul piiratud liiklus piirmarsruutimise kaudu, kuigi see t\u00e4hendab, et m\u00f5ned TCP sessioonid ei saa selle aja jooksul luua, p\u00e4\u00e4stab teie infrastruktuuri suurematest probleemidest.<\/p><\/blockquote>\n<blockquote><p><b>N\u00e4ide 2<\/b><\/p>\n<p>Anomaalne suur hulk SYN-pakette ei pruugi olla mitte ainult SYN flooding r\u00fcnnaku tagaj\u00e4rg. Oletame, et pakute teenust, kus teil v\u00f5ib olla korraga umbes 100 000 TCP-\u00fchendust (\u00fches andmekeskuses).<\/p>\n<p>Oletame, et \u00fche teie peamise teenusepakkuja l\u00fchiajalise probleemi t\u00f5ttu katkestati pooled sessioonidest. Kui teie rakendus on \u00fcles ehitatud nii, et see \u201eei m\u00f5tle kaua\u201d, vaid kohe (v\u00f5i m\u00f5ne \u00fchetaolise ajavahemiku jooksul k\u00f5igi sessioonide vahel) \u00fcritab \u00fchendust taastada, siis saate umbes samal ajal v\u00e4hemalt 50 000 SYN-paketti. <\/p>\n<p>Kui nende sessioonide peal peab n\u00e4iteks toimuma SSL\/TLS handshake, mis eeldab sertifikaatide vahetamist, siis ressursi ammendamise seisukohalt teie koormuse tasakaalustajale on see palju t\u00f5husam \u201eDDoS\u201d kui lihtne SYN flooding. Tundub, et koormuse tasakaalustajad peaksid selliseid olukordi haldama, kuid... kahjuks oleme sellise probleemiga silmitsi seisnud.<\/p>\n<p>Ja loomulikult p\u00e4\u00e4stab policer piiri marsruuteris teie seadmed ka sel juhul.<\/p><\/blockquote>\n<p>Kolmas kaitsetase DDOS\/DOS r\u00fcnnakute vastu on teie tulem\u00fc\u00fcri seaded.<\/p>\n<p>Siin saate peatada nii teise kui ka kolmanda t\u00fc\u00fcbi r\u00fcnnakud. \u00dcldiselt on k\u00f5ik, mis j\u00f5uab tulem\u00fc\u00fcri, filtreeritav siin. <\/p>\n<blockquote><p><b>N\u00f5uanne<\/b><\/p>\n<p>P\u00fc\u00fcdke anda tulem\u00fc\u00fcrile v\u00f5imalikult v\u00e4he t\u00f6\u00f6d, filtreerides esimeses kahes kaitseliinis v\u00f5imalikult palju. Ja siin on p\u00f5hjus.<\/p>\n<p>Kas olete kunagi kogenud, et juhuslikult genereerides liiklust, et kontrollida, kui vastupidav on teie serverite operatsioonis\u00fcsteem DDOS r\u00fcnnakute suhtes, olete \"tapnud\" oma tulem\u00fc\u00fcri, laadides seda 100 protsendi ulatuses tavalise intensiivsusega liiklusega? Kui ei, siis v\u00f5ib-olla lihtsalt sellep\u00e4rast, et te pole proovinud?<\/p>\n<p>\u00dcldiselt on tulem\u00fc\u00fcr, nagu ma juba \u00fctlesin, keeruline asi. See t\u00f6\u00f6tab h\u00e4sti tuntud haavatavustega ja testitud lahendustega, kuid kui saadate midagi ebatavalist, lihtsalt m\u00f5ne jama v\u00f5i vale p\u00e4isega pakettide, siis on teil m\u00f5ningane, mitte just v\u00e4ike (minu kogemuse kohaselt) t\u00f5en\u00e4osus segadusse ajada isegi tipptasemel seadmeid. Seet\u00f5ttu laske 2. etapis tavaliste ACL-ide (L3\/L4 tasemel) abil teie v\u00f5rku ainult seda liikumist, mis t\u00f5eliselt sinna sobib.<\/p><\/blockquote>\n<h3>Tulem\u00fc\u00fcri liikluse filtreerimine<\/h3>\n<p>\nJ\u00e4tkame juttu tulem\u00fc\u00fcrist. Tuleb aru saada, et DOS\/DDOS r\u00fcnnakud on vaid \u00fcks veebir\u00fcnnakute vorm. <\/p>\n<p>Lisaks DOS\/DDOS kaitsele v\u00f5ime veel omada midagi j\u00e4rgmise v\u00f5imaluste loetelu sarnast:<\/p>\n<ul>\n<li>rakenduse tulem\u00fc\u00fcr<\/li>\n<li>ohtude ennetamine (viirusevastane, nuhkvara ja haavatavus)<\/li>\n<li>URL-i filtreerimine<\/li>\n<li>andmete filtreerimine (sisu filtreerimine)<\/li>\n<li>failide blokeerimine (failit\u00fc\u00fcpide blokeerimine)<\/li>\n<\/ul>\n<p>\nTeie otsustada, mida sellest nimekirjast vajate.<\/p>\n<p><i>J\u00e4tkub<\/i><br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/436230\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u0412 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u044d\u0442\u043e\u0439 \u0433\u043b\u0430\u0432\u044b \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0438 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0430\u0441\u043f\u0435\u043a\u0442\u044b \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430 \u00abData Center\u00bb. \u042d\u0442\u0430 \u0447\u0430\u0441\u0442\u044c \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u0430 \u00abInternet Access\u00bb \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0443. Internet access \u0422\u0435\u043c\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u0441\u043e\u043c\u043d\u0435\u043d\u043d\u043e \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u0445 \u0442\u0435\u043c [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23032,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31057","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u0412 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u044d\u0442\u043e\u0439 \u0433\u043b\u0430\u0432\u044b \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0438 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0430\u0441\u043f\u0435\u043a\u0442\u044b \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430 \u00abData Center\u00bb. \u042d\u0442\u0430 \u0447\u0430\u0441\u0442\u044c \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u0430 \u00abInternet Access\u00bb \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0443. Internet access \u0422\u0435\u043c\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u0441\u043e\u043c\u043d\u0435\u043d\u043d\u043e \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u0445 \u0442\u0435\u043c\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u0432\u0442\u043e\u0440\u0430\u044f | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u0412 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u044d\u0442\u043e\u0439 \u0433\u043b\u0430\u0432\u044b \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0438 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0430\u0441\u043f\u0435\u043a\u0442\u044b \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430 \u00abData Center\u00bb. \u042d\u0442\u0430 \u0447\u0430\u0441\u0442\u044c \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u0430 \u00abInternet Access\u00bb \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0443. Internet access \u0422\u0435\u043c\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u0441\u043e\u043c\u043d\u0435\u043d\u043d\u043e \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u0445 \u0442\u0435\u043c\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:39:12+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:39:12+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Kuidas v\u00f5tta v\u00f5rgu infrastruktuuri enda kontrolli alla. Kolmas peat\u00fckk. V\u00f5rguturvalisus. Teine osa | ProHoster","description":"See artikkel on neljas osa artiklite sarjast \"Kuidas v\u00f5tta v\u00f5rku infrastruktuuri enda kontrolli alla\". K\u00f5iki sarja artikleid ja linke saab leida siit. Esimeses osas k\u00e4sitlesime m\u00f5ned aspektid andmekeskuse v\u00f5rgu turvalisusest. See osa keskendub Interneti-juurdep\u00e4\u00e4su segmendile. Interneti juurdep\u00e4\u00e4s on kindlasti \u00fcks k\u00f5ige keerulisemaid teemasid turvalisuse vallas.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u0432\u0442\u043e\u0440\u0430\u044f | ProHoster","og:description":"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0447\u0435\u0442\u0432\u0435\u0440\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u0412 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u044d\u0442\u043e\u0439 \u0433\u043b\u0430\u0432\u044b \u043c\u044b \u0440\u0430\u0441\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0438 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0430\u0441\u043f\u0435\u043a\u0442\u044b \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430 \u00abData Center\u00bb. \u042d\u0442\u0430 \u0447\u0430\u0441\u0442\u044c \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u0430 \u00abInternet Access\u00bb \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0443. Internet access \u0422\u0435\u043c\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043d\u0435\u0441\u043e\u043c\u043d\u0435\u043d\u043d\u043e \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u0445 \u0442\u0435\u043c","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-vtoraya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:39:12+00:00","article:modified_time":"2019-10-31T18:39:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31057","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 04:19:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:24:14","updated":"2026-01-21 04:19:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/31057","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=31057"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/31057\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/23032"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=31057"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=31057"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=31057"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}