1. CheckFlow - wikiwiki a manuahi ka loiloi piha ʻana o nā kaʻa pūnaewele kūloko me ka hoʻohana ʻana iā Flowmon

Welina mai i kā mākou papa mini e hiki mai ana. I kēia manawa e kamaʻilio mākou e pili ana i kā mākou lawelawe hou - Hōʻalo. He aha ia? ʻO kaʻoiaʻiʻo, he inoa kūʻai wale kēia no ka loiloi manuahi o ka ʻoihana pūnaewele (ma loko a ma waho). Hoʻokō ʻia ka loiloi me ka hoʻohana ʻana i kahi mea hana kupanaha e like me Flowmon, hiki i kekahi hui ke hoʻohana, me ka uku ʻole, no nā lā 30. Akā, ke hōʻoiaʻiʻo nei au iā ʻoe ma hope o nā hola mua o ka hoʻāʻo ʻana, e hoʻomaka ʻoe e loaʻa ka ʻike waiwai e pili ana i kāu pūnaewele. Eia kekahi, e waiwai kēia ʻike e like me no nā luna hoʻoponopono pūnaewele, a no na kiai. ʻAe, e kūkākūkā kākou i ke ʻano o kēia ʻike a me ke ʻano o kona waiwai (Ma ka hopena o ka ʻatikala, e like me ka mea maʻamau, aia kahi aʻo wikiō).

Ma ʻaneʻi, e hoʻokaʻawale iki kāua. Manaʻo wau he nui ka poʻe e noʻonoʻo nei: "Pehea ka ʻokoʻa o kēia Check Point Security CheckUP? ʻIke paha kā mākou poʻe kākau inoa i kēia mea (ua hoʻoikaika nui mākou i kēia) :) Mai wikiwiki i ka hoʻoholo ʻana, i ka holomua o ka haʻawina e hāʻule nā ​​​​mea āpau.

He aha ka mea hiki i ka luna hoʻoponopono pūnaewele ke nānā me ka hoʻohana ʻana i kēia loiloi:

• ʻIkepili kaʻahele pūnaewele - pehea e hoʻouka ʻia ai nā kahawai, he aha nā protocol i hoʻohana ʻia, nā kikowaena a i ʻole nā ​​​​mea hoʻohana e ʻai i ka nui o nā kaʻa.
• ʻO nā lohi a me nā poho o ka pūnaewele - ka manawa pane maʻamau o kāu mau lawelawe, ka loaʻa ʻana o nā poho ma kāu mau ala āpau (ka hiki ke loaʻa kahi bottleneck).
• ʻIkepili kaʻahele mea hoʻohana - ka nānā 'ana i nā mea hoʻohana. Ka nui o nā kaʻa, nā noi i hoʻohana ʻia, nā pilikia i ka hana ʻana me nā lawelawe ʻoihana.
• Ka loiloi hana noi - ka ʻike ʻana i ke kumu o nā pilikia i ka hana ʻana o nā noi hui (nā lohi o ka pūnaewele, ka manawa pane o nā lawelawe, nā ʻikepili, nā noi).
• Nānā SLA - ʻike a hōʻike i nā lohi koʻikoʻi a me nā poho i ka wā e hoʻohana ai i kāu mau noi pūnaewele lehulehu e pili ana i ke kaʻa maoli.
• Huli i nā anomali pūnaewele - Ka hoʻopunipuni DNS/DHCP, nā puka lou, nā kikowaena DHCP wahaheʻe, nā kaʻa DNS/SMTP anomalous a me nā mea hou aku.
• Nā pilikia me nā hoʻonohonoho - ka ʻike ʻana o ka mea hoʻohana pono ʻole a i ʻole ka lawelawe kikowaena, e hōʻike ana i nā hoʻonohonoho hewa ʻole o nā hoʻololi a i ʻole nā ​​​​pale ahi.
• Hōʻike piha - kahi hōʻike kikoʻī e pili ana i ke kūlana o kāu ʻōnaehana IT, e ʻae iā ʻoe e hoʻolālā i ka hana a kūʻai paha i nā mea hana hou.

He aha ka mea e hiki ai i kahi loea palekana ʻike ke nānā:

• ʻO ka hana viral - ʻike i ka huakaʻi viral i loko o ka pūnaewele, me ka malware ʻike ʻole (0-lā) e pili ana i ka nānā ʻana i ka ʻano.
• Ka hoolaha ana o ransomware - ka hiki ke ʻike i ka ransomware, ʻoiai ʻo ia e laha ana ma waena o nā kamepiula pili me ka haʻalele ʻole i kāna ʻāpana.
• Hana Kūʻē - nā kaʻa like ʻole o nā mea hoʻohana, nā kikowaena, nā noi, ICMP/DNS tunneling. Ka ʻike ʻana i nā mea hoʻoweliweli maoli a i ʻole nā ​​​​mea hoʻoweliweli.
• Hoʻouka kaua pūnaewele - ka nānā ʻana i ke awa, ka hoʻouka kaua ikaika, DoS, DDoS, traffic interception (MITM).
• Leak ʻikepili hui - ka ʻike ʻana i ka hoʻoiho ʻana (a i ʻole ka hoʻouka ʻana) o nā ʻikepili hui mai nā kikowaena faila ʻoihana.
• Nā mea ʻae ʻole - ka ʻike ʻana i nā mea pono ʻole i pili i ka ʻoihana hui (e hoʻoholo ana i ka mea hana a me ka ʻōnaehana hana).
• Nā noi makemake ʻole - ka hoʻohana ʻana i nā noi i pāpā ʻia i loko o ka pūnaewele (Bittorent, TeamViewer, VPN, Anonymizers, etc.).
• Nā Cryptominers a me nā Botnets - ke nānā ʻana i ka pūnaewele no nā mea maʻi e pili ana i nā kikowaena C&C i ʻike ʻia.

Hōʻike

Ma muli o nā hopena loiloi, hiki iā ʻoe ke ʻike i nā ʻikepili āpau ma nā dashboards Flowmon a i ʻole nā ​​​​hōʻike PDF. Aia ma lalo kekahi mau laʻana.

ʻIkepili kaʻahele maʻamau

ʻO ka papa kuhikuhi maʻamau

Hana Kūʻē

ʻIke ʻia nā mea hana

ʻO ka papahana hoʻokolohua maʻamau

Hōʻikeʻike #1 - hoʻokahi keʻena

ʻO ka hiʻohiʻona koʻikoʻi hiki iā ʻoe ke nānā i nā kaʻa waho a me loko i ʻike ʻole ʻia e nā mea pale perimeter network (NGFW, IPS, DPI, etc.).

Hōʻikeʻike #2 - kekahi mau keʻena

Haʻawina wikiō

Hōʻuluʻulu

ʻO ka loiloi CheckFlow kahi manawa kūpono loa no nā luna IT/IS:

1. E ʻike i nā pilikia o kēia manawa a me nā pilikia i kāu ʻenehana IT;
2. ʻIke i nā pilikia me ka palekana ʻike a me ka maikaʻi o nā hana palekana e kū nei;
3. E ʻike i ka pilikia nui i ka hana ʻana i nā noi ʻoihana (ʻāpana pūnaewele, ʻāpana kikowaena, lako polokalamu) a me nā mea e hoʻoponopono ai;
4. Hoʻemi nui i ka manawa e hoʻoponopono i nā pilikia i ka ʻōnaehana IT;
5. E hōʻoiaʻiʻo i ka pono e hoʻonui i nā kahawai, ka mana kikowaena a i ʻole ke kūʻai hou aku i nā lako pale.

Manaʻo wau e heluhelu i kā mākou ʻatikala mua - 9 mau pilikia pūnaewele maʻamau i hiki ke ʻike ʻia me ka hoʻohana ʻana i ka nānā ʻana NetFlow (e hoʻohana ana iā Flowmon ma ke ʻano he laʻana).
Inā hoihoi ʻoe i kēia kumuhana, e hoʻomau ʻoe (Telegram, Facebook, VK, TS Solution Blog, Yandex.Zen).

Hiki i nā mea hoʻohana i hoʻopaʻa inoa ʻia ke komo i ka noiʻi. Eʻe, e 'oluʻolu.

Ke hoʻohana nei ʻoe i nā mea loiloi NetFlow/sFlow/jFlow/IPFIX?

• 55,6%ʻAe5

• 11,1%ʻAʻole, akā manaʻo wau e hoʻohana 1

• 33,3%ʻAʻole3

9 mea hoʻohana i koho. 1 mea hoʻohana i hōʻole.

Source: www.habr.com