{"id":81884,"date":"2020-05-17T13:42:18","date_gmt":"2020-05-17T11:42:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity"},"modified":"2020-05-17T13:42:18","modified_gmt":"2020-05-17T11:42:18","slug":"bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","title":{"rendered":"Andmete turvalisus ja andmebaasid: mida silmas pidada kaitsevahendeid valides","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<h1><img decoding=\"async\" alt=\"Andmete turvalisus ja andmebaasid: mida silmas pidada kaitsevahendeid valides\" src=\"\/wp-content\/uploads\/2020\/05\/ac49253838e36336af127d71394139d8.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/h1>\n<p>\nMinu nimi on Denis R\u00f5\u017ekov, olen tarkvaraarenduse juht ettev\u00f5ttes \u00abGazinformservice\u00bb, toote meeskonnas. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.gaz-is.ru\/produkty\/inform-sistemy\/subd-jatoba.html\">Jatoba<\/a><\/noindex>Seadusandlus ja korporatiivsed normid dikteerivad teatud n\u00f5udmisi andmete turvalisusele. Keegi ei soovi, et kolmandad isikud p\u00e4\u00e4seksid ligi konfidentsiaalsele teabele, seega on iga projekti puhul olulised j\u00e4rgmised k\u00fcsimused: identifitseerimine ja autentimine, juurdep\u00e4\u00e4suhaldus, andmete terviklikkuse tagamine s\u00fcsteemis, turvas\u00fcndmuste registreerimine. Seet\u00f5ttu soovin r\u00e4\u00e4kida m\u00f5ningatest huvitavatest detailidest, mis puudutavad andmebaaside turvalisust. <br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nArtikkel on koostatud ettekande p\u00f5hjal <noindex><a rel=\"nofollow\" href=\"https:\/\/corp.mail.ru\/ru\/press\/events\/databases-1\/\">@Databases Meetup,<\/a><\/noindex> mille korraldas <noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/\">Mail.ru Cloud Solutions<\/a><\/noindex>. Kui te ei soovi lugeda, siis v\u00f5ite vaadata:<\/p>\n<p><center><div class=\"youtube-placeholder\" data-id=\"n-54j9FHaMU\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/n-54j9FHaMU\/hqdefault.jpg\" alt=\"Vaata videot\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><br \/>\nArtiklis on kolm osa:<\/p>\n<ul>\n<li>Kuidas kaitsta \u00fchendusi.<\/li>\n<li>Mis on tegevuste audit ja kuidas fikseerida, mis toimub andmebaasi ja sellele \u00fchenduse poolelt.<\/li>\n<li>Kuidas kaitsta andmeid andmebaasis ja millised tehnoloogiad selleks on olemas.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Andmete turvalisus ja andmebaasid: mida silmas pidada kaitsevahendeid valides\" src=\"\/wp-content\/uploads\/2020\/05\/fbdca7f4a925b9ceb78de06c6e245b23.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Kolm andmebaaside turvalisuse komponenti: \u00fchenduste kaitse, tegevuste audit ja andmete kaitsmine.<\/i><\/p>\n<h2>\u00dchenduste kaitse<\/h2>\n<p>\nAndmebaasi \u00fchendamine on v\u00f5imalik nii otse kui ka veebi rakenduste kaudu. \u00dcldiselt suhtleb \u00e4rikasutaja, see t\u00e4hendab inimene, kes t\u00f6\u00f6tab andmebaasihalduss\u00fcsteemiga (AHS), selle otseselt.<\/p>\n<p>Enne \u00fchenduste kaitsmisest r\u00e4\u00e4kimist tuleb vastata olulistele k\u00fcsimustele, mis m\u00f5jutavad, kuidas turvameetmed paika pannakse:<\/p>\n<ul>\n<li>kas \u00fcks \u00e4rikasutaja on ekvivalentne \u00fche andmebaasi kasutajaga;<\/li>\n<li>kas juurdep\u00e4\u00e4s andmebaasi andmetele on tagatud ainult API kaudu, mida te kontrollite, v\u00f5i on otsene juurdep\u00e4\u00e4s tabelitele;<\/li>\n<li>kas andmebaas on eraldatud kaitstud segmenti ning kes ja kuidas sellega suhtleb;<\/li>\n<li>kas kasutatakse andmebaasi \u00fchenduste haldamist\/puhverdamist ja vahekihte, mis v\u00f5ivad muuta teavet selle kohta, kuidas \u00fchendus on loodud ja kes kasutab andmebaasi.<\/li>\n<\/ul>\n<p>\nN\u00fc\u00fcd vaatame, milliseid t\u00f6\u00f6riistu saab kasutada \u00fchenduste kaitsmiseks:<\/p>\n<ol>\n<li>Kasutage andmebaasi tulem\u00fc\u00fcrilahendusi. Lisa kaitse kiht t\u00f5stab v\u00e4hemalt l\u00e4bipaistvust selles, mis andmebaasis toimub, ja maksimaalselt v\u00f5imaldab teil tagada t\u00e4iendava andmekaitse.<\/li>\n<li>Kasutage paroolipoliitikaid. Nende rakendamine s\u00f5ltub teie arhitektuuri \u00fclesehitusest. Igatahes ei piisa veebirakenduse konfigureerimisfailis olevast \u00fchest paroolist, mis \u00fchendub andmebaasihalduss\u00fcsteemiga. On mitmeid andmebaasihaldust\u00f6\u00f6riistu, mis v\u00f5imaldavad kontrollida, et kasutaja ja parool vajavad uuendamist.\n<p>Lisainfot kasutajate hindamise funktsioonide kohta leiate siit <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.cloud.oracle.com\/en-us\/iaas\/data-safe\/doc\/user-assessment-reports.html\">siit<\/a><\/noindex>, samuti saate teada MS SQL Vulnerability Assessment'i kohta <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.microsoft.com\/en-us\/sql\/relational-databases\/security\/sql-vulnerability-assessment?view=sql-server-ver15\">siin<\/a><\/noindex>.\u00a0<\/li>\n<li>Rikkastage seansi konteksti vajaliku teabega. Kui seanss on l\u00e4bipaistmatu ja te ei m\u00f5ista, kes andmebaasihalduss\u00fcsteemis t\u00f6\u00f6tab, on v\u00f5imalik, et olemasoleva toimingu raames t\u00e4iendate teavet selle kohta, kes, mida ja miks teeb. Seda teavet on v\u00f5imalik n\u00e4ha auditites.<\/li>\n<li>Konfigureerige SSL, kui teil pole andmebaasi ja l\u00f5ppkasutajate vahel v\u00f5rgu eraldatust, see ei ole eraldi VLAN-is. Sellistel juhtudel on vajalik kaitsta kanaleid tarbija ja andmebaasihalduss\u00fcsteemi vahel. Kaitsemeetmeid on saadaval ka avatud l\u00e4htekoodiga lahendustes.<\/li>\n<\/ol>\n<p><\/p>\n<h3>Kuidas see m\u00f5jutab andmebaasi j\u00f5udlust?<\/h3>\n<p>\nVaata n\u00e4ite p\u00f5hjal PostgreSQL-st, kuidas SSL m\u00f5jutab CPU koormust, ajakulu suurenemist ja TPS-i v\u00e4henemist \u2013 kas selle lubamine ei kuluta liiga palju ressursse.<\/p>\n<p>Laadime PostgreSQL-d pgbench'i abil \u2013 see on lihtne programm j\u00f5udluse testimiseks. See kordab \u00fche k\u00e4su j\u00e4rjestust, v\u00f5imalusel paralleelsetes andmebaaside seanssides, ja seej\u00e4rel arvutab keskmise tehingute m\u00e4\u00e4ra.<\/p>\n<p><strong>Test 1 ilma SSL-i ja SSL-iga<\/strong> \u2013 \u00fchendus luuakse iga tehingu korral:<\/p>\n<pre><code class=\"plaintext\">pgbench.exe --connect -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres sslmode=require\nsslrootcert=rootCA.crt sslcert=client.crt sslkey=client.key\"<\/code><\/pre>\n<p>\n<strong>vs<\/strong><\/p>\n<pre><code class=\"plaintext\">pgbench.exe --connect -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres\"<\/code><\/pre>\n<p>\n<strong>Test 2 ilma SSL-i ja SSL-iga<\/strong> \u2013 k\u00f5ik tehingud t\u00e4idetakse \u00fches \u00fchenduses:<\/p>\n<pre><code class=\"plaintext\">pgbench.exe -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres sslmode=require\nsslrootcert=rootCA.crt sslcert=client.crt sslkey=client.key\"<\/code><\/pre>\n<p>\n<strong>vs<\/strong><\/p>\n<pre><code class=\"plaintext\">pgbench.exe -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres\"<\/code><\/pre>\n<p>\n<strong>\u00dclej\u00e4\u00e4nud seaded<\/strong>:<\/p>\n<pre><code class=\"plaintext\">skaalama: 1\nk\u00fcsimuse re\u017eiim: lihtne\nklientide arv: 10\nniidit\u00f6\u00f6tluste arv: 1\nklientide kohta tehingute arv: 5000\ntehingute arv, mis tegelikult t\u00f6\u00f6tati \u00fcles: 50000\/50000<\/code><\/pre>\n<p>\n<strong>Testimise tulemused<\/strong>:<\/p>\n<p>\u00a0<br \/>\n<strong>ILMA SSL-ita<\/strong><br \/>\n<strong>SSL<\/strong><\/p>\n<p><strong>\u00dchendus loodakse iga tehingu puhul<\/strong><\/p>\n<p>latentsuse keskmine<br \/>\n171.915 ms<br \/>\n187.695 ms<\/p>\n<p>tps sealhulgas \u00fchenduste loomine<br \/>\n58.168112<br \/>\n53.278062<\/p>\n<p>tps ilma \u00fchenduste loomise arvesse v\u00f5tmata<br \/>\n64.084546<br \/>\n58.725846<\/p>\n<p>CPU<br \/>\n24%<br \/>\n28%<\/p>\n<p><strong>K\u00f5ik tehingud toimub \u00fches seoses<\/strong><\/p>\n<p>latentsuse keskmine<br \/>\n6.722 ms<br \/>\n6.342 ms<\/p>\n<p>tps, sealhulgas \u00fchenduste loomine<br \/>\n1587.657278<br \/>\n1576.792883<\/p>\n<p>tps ilma \u00fchenduste loomise arvesse v\u00f5tmata<br \/>\n1588.380574<br \/>\n1577.694766<\/p>\n<p>CPU<br \/>\n17%<br \/>\n21%<\/p>\n<p>\nMugavate koormuste korral on SSL-i m\u00f5ju v\u00f5rreldav m\u00f5\u00f5tmisvigadega. Kui edastatavate andmete maht on v\u00e4ga suur, v\u00f5ib olukord olla erinev. Kui me loome iga tehingu puhul \u00fche \u00fchenduse (see on haruldane, tavaliselt jagavad \u00fchendust kasutajad), on teil suur hulk \u00fchendumisi\/l\u00e4htestamisi, m\u00f5ju v\u00f5ib olla veidi suurem. Seega v\u00f5ib esineda j\u00f5udluse v\u00e4henemise riske, kuid erinevus ei ole piisavalt suur, et kaitset mitte kasutada.<\/p>\n<p>Pange t\u00e4hele, et suurem erinevus on, kui v\u00f5rrelda t\u00f6\u00f6re\u017eiime: \u00fches sessioonis t\u00f6\u00f6tades v\u00f5i erinevates. See on arusaadav: iga \u00fchenduse loomine n\u00f5uab ressursse.<\/p>\n<p>Meil oli juhtum, kus \u00fchendasime Zabbixi trust-re\u017eiimis, mis t\u00e4hendab, et md5-d ei kontrollitud, n\u00f6 autentimist ei olnud vaja. Siis palus klient aktiveerida md5-autentimise re\u017eiimi. See t\u00f5i kaasa suure koormuse CPU-le ning j\u00f5udlus langes. Hakkasime otsima optimeerimisv\u00f5imalusi. \u00dcks v\u00f5imalik lahendus probleemile on rakendada v\u00f5rgu piiranguid, luua andmebaasi jaoks eraldi VLAN-e, lisada seadeid, et oleks selge, kes, kust ja kuidas \u00fchendub, ning eemaldada autentimine. Samuti v\u00f5ib optimeerida autentimise seadistusi, et v\u00e4hendada kulusid autentimise aktiveerimisel, kuid erinevate autentimismeetodite kasutamine m\u00f5jutab \u00fcldiselt j\u00f5udlust ning tuleb arvestada neid tegureid serverite (raudi) arvutusv\u00f5imsuse projekteerimisel.<\/p>\n<p>Kokkuv\u00f5te: mitmetes lahendustes v\u00f5ivad isegi v\u00e4iksed n\u00fcansid autentimises projekti tugevalt m\u00f5jutada ning halb on, kui see selgub alles tootmises rakendamisel.<\/p>\n<h2>Tegevuste audit<\/h2>\n<p>\nAudit v\u00f5ib h\u00f5lmata mitte ainult andmebaase. Audit t\u00e4hendab teabe saamist selle kohta, mis toimub erinevates segmentides. See v\u00f5ib olla nii andmebaasi tulem\u00fc\u00fcr kui ka operatsioonis\u00fcsteem, millel andmebaas p\u00f5hineb.<\/p>\n<p>Kommertslike ettev\u00f5tte taseme andmebaaside audit on hea, avatud l\u00e4htekoodiga - mitte alati. Siin on, mis on PostgreSQL-is:<\/p>\n<ul>\n<li>default log - sisseehitatud logimine;<\/li>\n<li>laiendused: pgaudit - kui vaikimisi logimine ei ole piisav, saate kasutada eriseadeid, mis lahendavad osa \u00fclesannetest.<\/li>\n<\/ul>\n<p>\n<b>T\u00e4itmine video ettekandele:<\/b><\/p>\n<p>\u201eOperaatorite p\u00f5hiregistreerimist saab tagada standardse logimisvahendi kaudu, seadistades log_statement = all.<\/p>\n<p>See sobib j\u00e4lgimiseks ja muuks kasutamiseks, kuid ei taga tavaliselt auditi jaoks vajalikku detailsuse taset.<\/p>\n<p>Pole piisav, et omada nimekirja k\u00f5igist andmebaasiga tehtud toimingutest.<\/p>\n<p>Peab olema ka v\u00f5imalus leida konkreetseid v\u00e4iteid, mis on auditi jaoks huvitavad.<\/p>\n<p>Standardne logimisvahend n\u00e4itab seda, mida kasutaja soovis, samas kui pgAudit keskendub detailidele, mis toimusid, kui andmebaas tegi p\u00e4ringu.<\/p>\n<p>N\u00e4iteks v\u00f5ib audiitor soovida veenduda, et konkreetne tabel loodi dokumenteeritud hooldust\u00f6\u00f6s.<\/p>\n<p>See v\u00f5ib tunduda lihtsa \u00fclesandena p\u00f5hjauditiks ja grepiks, kuid mis juhtub, kui kohtate midagi sellist (tahtlikult keerulist) n\u00e4idet:<\/p>\n<p>DO $$<br \/>\nBEGIN<br \/>\n EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)';<br \/>\nEND $$;<\/p>\n<p>Standardne logimine annab teile j\u00e4rgmise:<\/p>\n<p>LOG: statement: DO $$<br \/>\nBEGIN<br \/>\n EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)';<br \/>\nEND $$;<\/p>\n<p>Tundub, et huvipakkuva tabeli leidmiseks v\u00f5ib olla vajalik m\u00f5ningane teadmiste p\u00f5hjalik analoog, kui tabelid luuakse d\u00fcnaamiliselt.<\/p>\n<p>See ei ole ideaalne, kuna oleks parem lihtsalt otsida tabeli nime j\u00e4rgi.<\/p>\n<p>Siinkohal on pgAudit kasulik.<\/p>\n<p>Sama sisendi korral andis ta selle v\u00e4ljundi logis:<\/p>\n<p>AUDIT: SESSION,33,1,FUNCTION,DO,,,\u00abDO $$<br \/>\nBEGIN<br \/>\n EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)';<br \/>\nEND $$;\"<br \/>\nAUDIT: SESSION,33,2,DDL,CREATE TABLE,TABLE,public.important_table,CREATE TABLE important_table (id INT)<\/p>\n<p>Logitakse mitte ainult DO plokk, vaid ka t\u00e4isteksti CREATE TABLE koos operaatori t\u00fc\u00fcbi, objekti t\u00fc\u00fcbiga ja t\u00e4isnimega, mis lihtsustab otsimist.<\/p>\n<p>SELECT ja DML operaatorite logimise korral saab pgAudit seadistada, et registreerida eraldi kirje iga suhte kohta, millele viidatakse operaatoris.<\/p>\n<p>S\u00fcntaksianal\u00fc\u00fcsi pole vajalik, et leida k\u00f5ik operaatorid, mis puudutavad konkreetset tabelit,<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/pgaudit\/pgaudit\/blob\/master\/README.md\">*<\/a><\/noindex>)\u00bb.<\/p>\n<h3>Kuidas see m\u00f5jutab andmebaasi j\u00f5udlust?<\/h3>\n<p>\nTehke testid, l\u00fclitades sisse t\u00e4ieliku auditi, ja vaatame, kuidas see m\u00f5jutab PostgreSQLi j\u00f5udlust. L\u00fclitame sisse maksimaalse andmebaasi logimise k\u00f5igi parameetrite kohaselt.<\/p>\n<p>Konfiguratsioonifailis muudame peaaegu mitte midagi, oluline on \u2013 l\u00fclitame sisse debug5 re\u017eiimi, et saada maksimaalset teavet.<\/p>\n<p>postgresql.conf<\/p>\n<p>log_destination = 'stderr'<br \/>\nlogging_collector = on<br \/>\nlog_truncate_on_rotation = on<br \/>\nlog_rotation_age = 1d<br \/>\nlog_rotation_size = 10MB<br \/>\nlog_min_messages = <strong>debug5<\/strong><br \/>\nlog_min_error_statement = <strong>debug5<\/strong><br \/>\nlog_min_duration_statement = 0<br \/>\ndebug_print_parse = on<br \/>\ndebug_print_rewritten = on<br \/>\ndebug_print_plan = on<br \/>\ndebug_pretty_print = on<br \/>\nlog_checkpoints = on<br \/>\nlog_connections = on<br \/>\nlog_disconnections = on<br \/>\nlog_duration = on<br \/>\nlog_hostname = on<br \/>\nlog_lock_waits = on<br \/>\nlog_replication_commands = on<br \/>\nlog_temp_files = 0<br \/>\nlog_timezone = 'Europe\/Moscow'<\/p>\n<p>\nTeostame kolme koormustesti PostgreSQL andmebaasis, mille parameetrid on 1 CPU, 2,8 GHz, 2 GB RAM ja 40 GB HDD, kasutades j\u00e4rgmisi k\u00e4sku:<\/p>\n<pre><code class=\"plaintext\">$ pgbench -p 3389 -U postgres -i -s 150 benchmark\n$ pgbench -p 3389 -U postgres -c 50 -j 2 -P 60 -T 600 benchmark\n$ pgbench -p 3389 -U postgres -c 150 -j 2 -P 60 -T 600 benchmark<\/code><\/pre>\n<p>\n<strong>Testimise tulemused:<\/strong><\/p>\n<p><strong>Ilma logimiseta<\/strong><br \/>\n<strong>Logimisega<\/strong><\/p>\n<p>Andmebaasi t\u00e4itmise l\u00f5pptulemus<br \/>\n43,74 sek<br \/>\n53,23 sek<\/p>\n<p>RAM<br \/>\n24%<br \/>\n40%<\/p>\n<p>CPU<br \/>\n72%<br \/>\n91%<\/p>\n<p><strong>Test 1 (50 \u00fchendust)<\/strong><\/p>\n<p>Tehingute arv 10 minuti jooksul<br \/>\n74169<br \/>\n32445<\/p>\n<p>Tehingud\/sek<br \/>\n123<br \/>\n54<\/p>\n<p>Keskmine latentsus<br \/>\n405 ms<br \/>\n925 ms<\/p>\n<p><strong>Test 2 (150 \u00fchendust 100 v\u00f5imaliku puhul)<\/strong><\/p>\n<p>Tehingute arv 10 minuti jooksul<br \/>\n81727<br \/>\n31429<\/p>\n<p>Tehingud\/sek<br \/>\n136<br \/>\n52<\/p>\n<p>Keskmine latentsus<br \/>\n550 ms<br \/>\n1432 ms<\/p>\n<p><strong>M\u00f5\u00f5tmed<\/strong><\/p>\n<p>Andmebaasi suurus<br \/>\n2251 MB<br \/>\n2262 MB<\/p>\n<p>Andmebaasi logide suurus<br \/>\n0 MB<br \/>\n4587 MB<\/p>\n<p>\nKokkuv\u00f5ttes: t\u00e4ielik auditi l\u00e4biviimine ei ole v\u00e4ga hea. Auditi andmete maht v\u00f5ib olla sama suur kui andmebaasi enda andmete maht v\u00f5i isegi suurem. Selline logimise maht, mida andmebaasi haldamise s\u00fcsteem genereerib, on toote arenduses t\u00fc\u00fcpiline probleem.<\/p>\n<p>Vaatame teisi parameetreid:<\/p>\n<ul>\n<li>Kiirus ei muutu oluliselt: ilma logita \u2014 43,74 sekundit, logiga \u2014 53,23 sekundit.<\/li>\n<li>J\u00f5udlus RAM-i ja CPU osas halveneb, kuna tuleb genereerida auditi fail. See on tootmises ka silmatorkav.<\/li>\n<\/ul>\n<p>\n\u00dchenduste arvu suurenemise korral halvenevad tulemused loomulikult veidi.<\/p>\n<p>Suurettev\u00f5tetes on auditi tegemine veelgi keerulisem:<\/p>\n<ul>\n<li>andmeid on palju;<\/li>\n<li>auditi l\u00e4biviimine ei tohi piirduda ainult syslogiga SIEM-is, vaid peab olema ka failides: \u00e4kki juhtub syslogiga midagi, peab olema andmebaasi l\u00e4hedal fail, kuhu andmed salvestatakse;<\/li>\n<li>audiitoriks on vajalik eraldi ketas, et mitte p\u00f5rgu I\/O-diskide peal, kuna see v\u00f5tab palju ruumi;<\/li>\n<li>juhtub, et infotehnoloogia t\u00f6\u00f6tajad n\u00f5uavad alati standardeid, nad n\u00f5uavad riiklikku identifitseerimist.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Juurdep\u00e4\u00e4su piiramine andmetele<\/h2>\n<p>\nVaatame tehnoloogiaid, mida kasutatakse andmete kaitsmiseks ja neile juurdep\u00e4\u00e4suks kaubanduslikes andmebaasides ja avatud l\u00e4htekoodiga lahendustes.<\/p>\n<p>Mida \u00fcldiselt kasutada:<\/p>\n<ol>\n<li>Andmete kr\u00fcpteerimine ja funktsioonide obfuskeerimine (Wrapping) \u2014 see t\u00e4hendab, et eraldi t\u00f6\u00f6riistad ja utiliidid muudavad loetava koodi loetamatuks. T\u00f5si, hiljem ei saa seda muuta ega tagasi refaktoreerida. Selline l\u00e4henemine on m\u00f5nikord vajalik v\u00e4hemalt andmebaasi poolel \u2014 litsentsipiirangute v\u00f5i autoriseerimise loogika kr\u00fcpteeritakse just protseduuride ja funktsioonide tasemel.<\/li>\n<li>Andmete n\u00e4htavuse piiramine ridade kaupa (RLS) \u2014 see on siis, kui erinevad kasutajad n\u00e4evad \u00fchte tabelit, kuid erinevat ridade koosseisu, st m\u00f5nele ei saa midagi n\u00e4idata ridade tasemel.<\/li>\n<li>Kuvatud andmete redigeerimine (Masking) \u2014 see on siis, kui kasutajad n\u00e4evad \u00fches tabeli veerus kas andmeid v\u00f5i ainult t\u00e4rne, st teatud kasutajate jaoks on teave suletud. Tehnoloogia m\u00e4\u00e4rab, millist teavet n\u00e4idata, s\u00f5ltuvalt juurdep\u00e4\u00e4sutasemest.<\/li>\n<li>Juhtimise, Security DBA\/Application DBA\/DBA - see t\u00e4hendab peamiselt juurdep\u00e4\u00e4su piiramist andmebaasi enda juurde. Seega on infos\u00fcsteemide t\u00f6\u00f6tajad eraldatud andmebaasi- ja rakenduseadministraatoritest. Avatud l\u00e4htekoodiga tehnoloogiaid on selles osas v\u00e4he, kuid kaubanduslikes andmebaasides leidub neid piisavalt. Need on vajalikud, kui palju kasutajaid p\u00e4\u00e4seb juurde serveritele.<\/li>\n<li>Failis\u00fcsteemi tasemel juurdep\u00e4\u00e4su piiramine. Saame anda \u00f5igusi ja juurdep\u00e4\u00e4su privileege kataloogides, et iga administraator p\u00e4\u00e4seks ligi ainult vajalikele andmetele.<\/li>\n<li>Volitatud juurdep\u00e4\u00e4s ja m\u00e4lu puhastamine - neid tehnoloogiaid kasutatakse harva.<\/li>\n<li>L\u00f5pp-otsas kr\u00fcpteerimine otse andmebaasis - see on kliendi poolel toimuv kr\u00fcpteerimine, mille v\u00f5tmehaldus on serveripoolne.<\/li>\n<li>Andmete kr\u00fcpteerimine. N\u00e4iteks veeru kr\u00fcpteerimine - kui kasutate mehhanismi, mis kr\u00fcpteerib eraldi andmebaasi veeru.<\/li>\n<\/ol>\n<p><\/p>\n<h3>Kuidas see m\u00f5jutab andmebaasi j\u00f5udlust?<\/h3>\n<p>\nVaatame PostgreSQL veergude kr\u00fcpteerimise n\u00e4idet. Seal on moodul pgcrypto, mis v\u00f5imaldab salvestada valitud v\u00e4ljad kr\u00fcpteeritud kujul. See on kasulik, kui v\u00e4\u00e4rtuslikud on ainult m\u00f5ned andmed. Kr\u00fcpteeritud v\u00e4ljade lugemiseks edastab klient dekodeerimisv\u00f5tme, server dekodeerib andmed ja edastab need kliendile. Ilma v\u00f5tmeta ei saa keegi teie andmetega midagi teha.<\/p>\n<p><strong>Teeme katse pgcrypto'ga<\/strong>. Loome tabeli kr\u00fcpteeritud andmetega ja tavaliste andmetega. Allpool on k\u00e4sud tabelite loomiseks; esimeses reas on kasulik k\u00e4sk \u2013 pikenduse loomine koos andmebaasi registreerimisega:<\/p>\n<pre><code class=\"plaintext\">CREATE EXTENSION pgcrypto;\nCREATE TABLE t1 (id integer, text1 text, text2 text);\nCREATE TABLE t2 (id integer, text1 bytea, text2 bytea);\nINSERT INTO t1 (id, text1, text2)\nVALUES (generate_series(1,10000000), generate_series(1,10000000)::text, generate_series(1,10000000)::text);\nINSERT INTO t2 (id, text1, text2) VALUES (\ngenerate_series(1,10000000),\nencrypt(cast(generate_series(1,10000000) AS text)::bytea, 'key'::bytea, 'bf'),\nencrypt(cast(generate_series(1,10000000) AS text)::bytea, 'key'::bytea, 'bf'));<\/code><\/pre>\n<p>\nEdasi proovime teha igast tabelist andmete valiku ja vaatame t\u00e4itmise aega.<\/p>\n<p><strong>Valik tabelist ilma kr\u00fcpteerimise funktsioonita<\/strong>:<\/p>\n<pre><code class=\"plaintext\">psql -c \"timing\" -c \"select * from t1 limit 1000;\" \"host=192.168.220.129 dbname=taskdb\nuser=postgres sslmode=disable\" &gt; 1.txt<\/code><\/pre>\n<p>\nAjastamine on k\u00e4ivitatud.<\/p>\n<p>\u00a0\u00a0id | tekst1 | tekst2<br \/>\n------+------+-+------<br \/>\n 1 | 1 \u00a0 \u00a0 | 1<br \/>\n 2 | 2 \u00a0 \u00a0 | 2<br \/>\n 3 | 3 \u00a0 \u00a0 | 3<br \/>\n\u2026<br \/>\n997 | 997 \u00a0 | 997<br \/>\n998 | 998 \u00a0 | 998<br \/>\n999 | 999 \u00a0 | 999<br \/>\n1000 | 1000\u00a0 | 1000<br \/>\n(1000 rida)<\/p>\n<p>Aeg: 1,386 ms<\/p>\n<p><strong>Andmete valik kr\u00fcptimise funktsiooni abil:<\/strong><\/p>\n<pre><code class=\"plaintext\">psql -c \"timing\" -c \"select id, decrypt(text1, 'key'::bytea, 'bf'),\ndecrypt(text2, 'key'::bytea, 'bf') from t2 limit 1000;\"\n\"host=192.168.220.129 dbname=taskdb user=postgres sslmode=disable\" &gt; 2.txt<\/code><\/pre>\n<p>\nAjastamine on k\u00e4ivitatud.<\/p>\n<p>\u00a0\u00a0id | decrypt | decrypt<br \/>\n------+--------+------<br \/>\n 1 | x31 | x31<br \/>\n 2 | x32 | x32<br \/>\n 3 | x33 | x33<br \/>\n\u2026<br \/>\n999 | x393939 | x393939<br \/>\n1000 | x31303030 | x31303030<br \/>\n(1000 rida)<\/p>\n<p>Aeg: 50,203 ms<\/p>\n<p><strong>Testimise tulemused<\/strong>:<\/p>\n<p>\u00a0<br \/>\n<strong>Ilma kr\u00fcptimiseta<\/strong><br \/>\n<strong>Pgcrypto (dekr\u00fcpteerimine)<\/strong><\/p>\n<p>Valik 1000 rida<br \/>\n1,386 ms<br \/>\n50,203 ms<\/p>\n<p>CPU<br \/>\n15%<br \/>\n35%<\/p>\n<p>RAM<br \/>\n\u00a0<br \/>\n+5%<\/p>\n<p>\nKr\u00fcptimine m\u00f5jutab oluliselt j\u00f5udlust. N\u00e4ha on, et ajastus on suurenenud, kuna kr\u00fcptitud andmete dekr\u00fcpteerimise operatsioonid (ja dekr\u00fcpteerimine on tavaliselt veel teie loogikasse m\u00e4hitud) n\u00f5uavad m\u00e4rkimisv\u00e4\u00e4rseid ressursse. Seega, idee kr\u00fcpteerida k\u00f5ik veerud, mis sisaldavad mingeid andmeid, toob kaasa j\u00f5udluse languse.<\/p>\n<p>Sellegipoolest ei ole kr\u00fcptimine h\u00f5bedane kuuli, mis lahendab k\u00f5ik probleemid. Dekr\u00fcpteeritud andmed ja dekr\u00fcpteerimise v\u00f5ti asuvad dekr\u00fcpteerimise ja andmete edastamise protsessis serveris. Seega v\u00f5ivad v\u00f5tmed olla kinni p\u00fc\u00fctud inimeselt, kellel on t\u00e4ielik juurdep\u00e4\u00e4s andmebaasi serverile, n\u00e4iteks s\u00fcsteemiadministraatorilt.<\/p>\n<p>Kui kogu veeru jaoks on k\u00f5ikide kasutajate jaoks \u00fcks v\u00f5ti (isegi kui mitte k\u00f5ikidele, vaid piiratud hulga klientidele), siis see ei ole alati hea ja \u00f5ige. Just seet\u00f5ttu hakati juurutama l\u00f5pp-to-l\u00f5pp kr\u00fcptimist, andmebaasides hakati kaaluma andmete kr\u00fcptimise v\u00f5imalusi kliendi ja serveri poolel ning ilmusid need samad key-vault salvestused \u2013 eraldi tooted, mis tagavad v\u00f5tmete haldamise andmebaasi poolel.<\/p>\n<p><img decoding=\"async\" alt=\"Andmete turvalisus ja andmebaasid: mida silmas pidada kaitsevahendeid valides\" src=\"\/wp-content\/uploads\/2020\/05\/cbaa7b9579a65963518ba3cec6114842.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/docs.mongodb.com\/manual\/core\/security-client-side-encryption\/\"><i>Selle kr\u00fcptimise n\u00e4ide MongoDB-s<\/i><\/a><\/noindex><\/p>\n<h2>Turvavahendid kommerts- ja avatud l\u00e4htekoodiga andmebaasides<\/h2>\n<p><\/p>\n<p><strong>Funktsioonid<\/strong><br \/>\n<strong>T\u00fc\u00fcp<\/strong><br \/>\n<strong>Parooli poliitika<\/strong><br \/>\n<strong>Audit<\/strong><br \/>\n<strong>Protseduuride ja funktsioonide l\u00e4htekoodi kaitse<\/strong><br \/>\n<strong>RLS<\/strong><br \/>\n<strong>Kr\u00fcptimine<\/strong><\/p>\n<p><strong>Oracle<\/strong><br \/>\nKommerts<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p><strong>MsSql<\/strong><br \/>\nKommerts<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.gaz-is.ru\/produkty\/inform-sistemy\/subd-jatoba.html\"><strong>Jatoba<\/strong><\/a><\/noindex><br \/>\nKommerts<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\nliidendid<\/p>\n<p><strong>PostgreSQL<\/strong><br \/>\nTasuta<br \/>\nliidendid<br \/>\nliidendid<br \/>\n&#8212;<br \/>\n+<br \/>\nliidendid<\/p>\n<p><strong>MongoDb<\/strong><br \/>\nTasuta<br \/>\n&#8212;<br \/>\n+<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\nSaadaval ainult MongoDB Enterprise'is<\/p>\n<p>\nTabel ei ole sugugi t\u00e4ielik, kuid olukord on selline: kommertstooteid on pikka aega turvafaile lahendatud, avatud l\u00e4htekoodi puhul kasutatakse reeglina mingisuguseid lisandeid, paljudest funktsioonidest j\u00e4\u00e4b puudu, vahel tuleb midagi juurde kirjutada. N\u00e4iteks paroolipoliitikad - PostgreSQL-is on palju erinevaid laiendusi (<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/postgres\/postgres\/tree\/master\/contrib\/passwordcheck\">1<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ykrysko\/passwordcheck\">2<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/michaelpq\/pg_plugins\/tree\/master\/passwordcheck_extra\">3<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/devrimgunduz\/passwordcheck_cracklib\">4<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/asio\/password\">5<\/a><\/noindex>), mis rakendavad paroolipoliitikaid, kuid k\u00f5ikide kohalike ettev\u00f5tlussektori vajaduste katmine, minu arvates, ei kata \u00fckski neist.<\/p>\n<p><strong>Mis teha, kui vajalikku kohta pole<\/strong>? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u0443\u044e \u0421\u0423\u0411\u0414, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a.<\/p>\n<p>Siis saab kasutada kolmanda osapoole lahendusi, mis t\u00f6\u00f6tavad erinevate andmebaasidega, n\u00e4iteks \"Krypto DB\" v\u00f5i \"Garda DB\". Kohalike lahenduste puhul tuntakse GOST-e paremini kui avatud l\u00e4htekoodiga variantides.<\/p>\n<p>Teine variant on ise kirjutada vajalikud lahendused, rakendada andmete juurdep\u00e4\u00e4su ja kr\u00fcpteerimise protseduure rakenduses. T\u00f5si, GOST-iga on keerulisem, kuid \u00fcldiselt on v\u00f5imalik andmeid varjata ja salvestada andmebaasi ning hiljem neid \u00f5igesti dekr\u00fcpteerida otse rakenduse tasandil. Samuti m\u00f5elge, kuidas kavatsete neid algoritme rakenduses kaitsta. Meie arvates tuleks seda teha andmebaasi tasemel, kuna nii t\u00f6\u00f6tab see kiiremini.<\/p>\n<p>See ettekannet k\u00f5las esmakordselt <noindex><a rel=\"nofollow\" href=\"https:\/\/corp.mail.ru\/ru\/press\/events\/databases-1\/\">@Databases Meetup<\/a><\/noindex> Mail.ru Cloud Solutions esitlus. Vaadake<noindex><a rel=\"nofollow\" href=\"https:\/\/www.youtube.com\/redirect?q=https%3A%2F%2Fbit.ly%2F2U57FAd&amp;redir_token=XNWSBN1AKQA2sjhdReDAv6VnkOV8MTU4OTAxNjMwMEAxNTg4OTI5OTAw&amp;v=wigSv2_zWBU&amp;event=video_description\"> video <\/a><\/noindex>teisi ettekandeid ja tellige \u00fcrituste teateid Telegramis <noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/k8s_mail\">Kubernetesest Mail.ru Grupis<\/a><\/noindex>.<\/p>\n<p><strong>Mida veel teemast lugeda<\/strong>:<\/p>\n<ol>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/472694\/\">Rohkem kui Ceph: MCS-i pilve blokeeringu salvestus<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/blog\/kakuyu-bazu-dannyh-vybrat-dlya-proekta-chtoby-ne-oshibitsya\">Kuidas valida andmebaasi projekti jaoks, et seda hiljem uuesti mitte valida<\/a><\/noindex>.<\/li>\n<\/ol>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/500708\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441 \u0420\u043e\u0436\u043a\u043e\u0432, \u044f \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u041f\u041e \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u00ab\u0413\u0430\u0437\u0438\u043d\u0444\u043e\u0440\u043c\u0441\u0435\u0440\u0432\u0438\u0441\u00bb, \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430 Jatoba. \u0417\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e \u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u043d\u043e\u0440\u043c\u044b \u043d\u0430\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445. \u041d\u0438\u043a\u0442\u043e \u043d\u0435 \u0445\u043e\u0447\u0435\u0442, \u0447\u0442\u043e\u0431\u044b \u0442\u0440\u0435\u0442\u044c\u0438 \u043b\u0438\u0446\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0432\u0430\u0436\u043d\u044b \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0432\u043e\u043f\u0440\u043e\u0441\u044b: \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f, \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430\u043c\u0438 \u043a \u0434\u0430\u043d\u043d\u044b\u043c, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":81885,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-81884","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441 \u0420\u043e\u0436\u043a\u043e\u0432, \u044f \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u041f\u041e \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u00ab\u0413\u0430\u0437\u0438\u043d\u0444\u043e\u0440\u043c\u0441\u0435\u0440\u0432\u0438\u0441\u00bb, \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430 Jatoba. \u0417\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e \u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u043d\u043e\u0440\u043c\u044b \u043d\u0430\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445. \u041d\u0438\u043a\u0442\u043e \u043d\u0435 \u0445\u043e\u0447\u0435\u0442, \u0447\u0442\u043e\u0431\u044b \u0442\u0440\u0435\u0442\u044c\u0438 \u043b\u0438\u0446\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0432\u0430\u0436\u043d\u044b \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0432\u043e\u043f\u0440\u043e\u0441\u044b: \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f, \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430\u043c\u0438 \u043a \u0434\u0430\u043d\u043d\u044b\u043c, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438 \u0421\u0423\u0411\u0414: \u043e \u0447\u0451\u043c \u043d\u0430\u0434\u043e \u043f\u043e\u043c\u043d\u0438\u0442\u044c, \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u044f \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441 \u0420\u043e\u0436\u043a\u043e\u0432, \u044f \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u041f\u041e \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u00ab\u0413\u0430\u0437\u0438\u043d\u0444\u043e\u0440\u043c\u0441\u0435\u0440\u0432\u0438\u0441\u00bb, \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430 Jatoba. \u0417\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e \u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u043d\u043e\u0440\u043c\u044b \u043d\u0430\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445. \u041d\u0438\u043a\u0442\u043e \u043d\u0435 \u0445\u043e\u0447\u0435\u0442, \u0447\u0442\u043e\u0431\u044b \u0442\u0440\u0435\u0442\u044c\u0438 \u043b\u0438\u0446\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0432\u0430\u0436\u043d\u044b \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0432\u043e\u043f\u0440\u043e\u0441\u044b: \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f, \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430\u043c\u0438 \u043a \u0434\u0430\u043d\u043d\u044b\u043c, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-17T11:42:18+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-17T11:42:18+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Turvalisus ja DBMS: mida silmas pidada kaitsevahendeid valides | ProHoster","description":"Minu nimi on Denis Ro\u017ekov, ma olen tarkvaraarenduse juht ettev\u00f5ttes \u201eGazinformservice\u201c, Jatoba toote meeskonnas. \u00d5igusaktid ja ettev\u00f5tte norme seavad teatud n\u00f5udmised andmete s\u00e4ilitamise ohutusele. Keegi ei soovi, et kolmandad isikud p\u00e4\u00e4seksid ligi konfidentsiaalsele teabele, seega on iga projekti puhul olulised j\u00e4rgmised k\u00fcsimused: tuvastamine ja autentimine, juurdep\u00e4\u00e4su haldamine andmetele, teabe terviklikkuse tagamine.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438 \u0421\u0423\u0411\u0414: \u043e \u0447\u0451\u043c \u043d\u0430\u0434\u043e \u043f\u043e\u043c\u043d\u0438\u0442\u044c, \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u044f \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b | ProHoster","og:description":"\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441 \u0420\u043e\u0436\u043a\u043e\u0432, \u044f \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u041f\u041e \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u00ab\u0413\u0430\u0437\u0438\u043d\u0444\u043e\u0440\u043c\u0441\u0435\u0440\u0432\u0438\u0441\u00bb, \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430 Jatoba. \u0417\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e \u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u043d\u043e\u0440\u043c\u044b \u043d\u0430\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445. \u041d\u0438\u043a\u0442\u043e \u043d\u0435 \u0445\u043e\u0447\u0435\u0442, \u0447\u0442\u043e\u0431\u044b \u0442\u0440\u0435\u0442\u044c\u0438 \u043b\u0438\u0446\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0432\u0430\u0436\u043d\u044b \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0432\u043e\u043f\u0440\u043e\u0441\u044b: \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f, \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430\u043c\u0438 \u043a \u0434\u0430\u043d\u043d\u044b\u043c, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432","og:url":"https:\/\/prohoster.info\/et\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-17T11:42:18+00:00","article:modified_time":"2020-05-17T11:42:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"81884","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:48:24","updated":"2022-10-05 02:01:28"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/81884","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=81884"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/81884\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/81885"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=81884"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=81884"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=81884"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}