Nyob zoo, cov nyeem ntawm Habr! Qhov no yog lub tuam txhab kev lag luam blog . Peb yog ib qho kev sib koom ua ke thiab feem ntau tshwj xeeb hauv IT infrastructure kev ruaj ntseg daws teeb meem (, thiab machine data analysis systems (). Peb yuav pib peb cov blog nrog cov lus qhia luv luv rau Check Point technologies.
Peb tau xav ntev ntev txog seb nws puas tsim nyog sau tsab xov xwm no, vim tias ... tsis muaj dab tsi tshiab nyob rau hauv nws uas nrhiav tsis tau hauv Internet. Txawm li cas los xij, txawm tias muaj ntau cov ntaub ntawv, thaum ua haujlwm nrog cov neeg siv khoom thiab cov neeg koom tes, peb feem ntau hnov ββββcov lus nug tib yam. Yog li ntawd, nws tau txiav txim siab los sau qee yam kev taw qhia rau lub ntiaj teb ntawm Check Point technologies thiab nthuav tawm cov ntsiab lus ntawm cov qauv tsim ntawm lawv cov kev daws teeb meem. Thiab tag nrho cov no yog nyob rau hauv lub moj khaum ntawm ib tug "me" ncej, ib tug ceev kev mus ncig ua si, yog li hais. Ntxiv mus, peb yuav sim tsis txhob nkag mus rau hauv kev lag luam kev lag luam, vim tias ... Peb tsis yog tus neeg muag khoom, tab sis tsuas yog ib qho kev sib koom ua ke (txawm tias peb nyiam Check Point) thiab tsuas yog saib cov ntsiab lus tseem ceeb yam tsis tau muab piv rau lwm cov tuam txhab lag luam (xws li Palo Alto, Cisco, Fortinet, thiab lwm yam). Cov kab lus tau dhau los ua qhov ntev heev, tab sis nws npog feem ntau ntawm cov lus nug ntawm theem ntawm kev paub nrog Check Point. Yog koj txaus siab ces zoo siab tos txais tus miv...
UTM/NGFW
Thaum pib sib tham txog Check Point, thawj qhov chaw pib yog nrog kev piav qhia ntawm UTM thiab NGFW yog dab tsi thiab lawv txawv li cas. Peb yuav ua qhov no kom meej meej kom cov ntawv tshaj tawm tsis dhau mus ntev (tej zaum yav tom ntej peb yuav xav txog qhov teeb meem no me ntsis ntxiv)
UTM - Unified hem kev tswj hwm
Hauv luv luv, lub ntsiab lus ntawm UTM yog kev sib sau ua ke ntawm ntau cov cuab yeej kev ruaj ntseg hauv ib qho kev daws teeb meem. Cov. txhua yam nyob rau hauv ib lub thawv los yog ib yam ntawm tag nrho cov inclusive. Dab tsi yog txhais los ntawm "ntau yam tshuaj"? Qhov kev xaiv tshaj plaws yog: Firewall, IPS, Proxy (URL filtering), streaming Antivirus, Anti-Spam, VPN thiab lwm yam. Tag nrho cov no tau ua ke hauv ib qho kev daws teeb meem UTM, uas yooj yim dua ntawm kev sib koom ua ke, teeb tsa, kev tswj hwm thiab kev saib xyuas, thiab qhov no ua rau muaj txiaj ntsig zoo rau tag nrho kev ruaj ntseg ntawm lub network. Thaum UTM cov kev daws teeb meem thawj zaug tshwm sim, lawv tau txiav txim siab tshwj xeeb rau cov tuam txhab me, vim tias ... UTMs tsis tuaj yeem tswj cov tsheb khiav ntau. Qhov no yog rau ob qho laj thawj:
- Packet processing method. Thawj cov qauv ntawm UTM cov kev daws teeb meem tau ua cov pob ntawv ua ntu zus, txhua "module". Piv txwv li: thawj lub pob ntawv tau ua tiav los ntawm firewall, tom qab ntawd IPS, tom qab ntawd nws raug tshuaj xyuas los ntawm Anti-Virus, thiab lwm yam. Lawm, xws li ib tug mechanism qhia txog kev ncua sij hawm loj nyob rau hauv kev khiav tsheb thiab heev noj cov kev pab cuam system (processor, nco).
- Kho vajtse tsis muaj zog. Raws li tau hais los saum no, kev ua tiav ntawm cov pob khoom siv tau zoo heev thiab cov khoom siv ntawm lub sijhawm ntawd (1995-2005) tsuas yog tsis tuaj yeem tiv nrog cov tsheb loj.
Tab sis kev vam meej tsis nyob twj ywm. Txij thaum ntawd los, lub peev xwm kho vajtse tau nce ntxiv, thiab cov txheej txheem ntim tau hloov pauv (nws yuav tsum lees paub tias tsis yog txhua tus neeg muag khoom muaj nws) thiab pib tso cai yuav luag txhua qhov kev tshuaj ntsuam xyuas hauv ntau lub modules ib zaug (ME, IPS, AntiVirus, thiab lwm yam). Niaj hnub nimno UTM cov kev daws teeb meem tuaj yeem "qhuav" kaum thiab ntau pua ntawm gigabits hauv kev tshuaj xyuas sib sib zog nqus, uas ua rau nws tuaj yeem siv rau hauv ntu ntawm cov lag luam loj lossis txawm tias cov chaw zov me nyuam.
Hauv qab no yog lub npe nrov Gartner Magic Quadrant rau UTM cov kev daws teeb meem rau lub Yim Hli 2016:
Kuv yuav tsis tawm tswv yim ntau ntawm daim duab no, kuv tsuas yog hais tias cov thawj coj nyob rau sab xis sab xis.
NGFW - Next Generation Firewall
Lub npe hais rau nws tus kheej - tiam tom ntej firewall. Lub tswv yim no tshwm sim ntau tom qab UTM. Lub tswv yim tseem ceeb ntawm NGFW yog qhov sib sib zog nqus pob ntawv txheeb xyuas (DPI) siv cov IPS built-in thiab nkag mus rau kev tswj ntawm qib kev thov (Application Control). Hauv qhov no, IPS yog qhov tseeb uas xav tau los txheeb xyuas qhov no lossis daim ntawv thov ntawd hauv pob ntawv ntws, uas tso cai rau koj tso cai lossis tsis lees paub. Piv txwv: Peb tuaj yeem tso cai rau Skype ua haujlwm, tab sis txwv tsis pub hloov cov ntaub ntawv. Peb tuaj yeem txwv tsis pub siv Torrent lossis RDP. Cov ntawv thov hauv web kuj tau txais kev txhawb nqa: Koj tuaj yeem tso cai nkag mus rau VK.com, tab sis txwv tsis pub ua si, lus lossis saib yeeb yaj kiab. Qhov tseem ceeb, qhov zoo ntawm NGFW nyob ntawm seb muaj pes tsawg daim ntawv thov nws tuaj yeem ntes tau. Ntau tus ntseeg hais tias qhov tshwm sim ntawm NGFW lub tswv yim yog ib qho kev lag luam uas muaj kev sib tw tawm tsam qhov teeb meem uas lub tuam txhab Palo Alto pib nws txoj kev loj hlob sai.
Gartner Magic Quadrant rau NGFW rau lub Tsib Hlis 2016:
UTM vs NGFW
Ib lo lus nug ntau heev yog, qhov twg zoo dua? Tsis muaj lus teb meej ntawm no thiab ua tsis tau. Tshwj xeeb yog xav txog qhov tseeb tias yuav luag txhua qhov kev daws teeb meem niaj hnub UTM muaj NGFW kev ua haujlwm thiab feem ntau NGFWs muaj cov haujlwm muaj nyob rau hauv UTM (Antivirus, VPN, Anti-Bot, thiab lwm yam). Raws li ib txwm muaj, "Dab ntxwg nyoog yog nyob rau hauv cov ntsiab lus," yog li ua ntej ntawm txhua yam koj yuav tsum tau txiav txim siab yam koj xav tau tshwj xeeb thiab txiav txim siab ntawm koj cov peev nyiaj. Raws li cov kev txiav txim siab no, ntau txoj kev xaiv tuaj yeem xaiv. Thiab txhua yam yuav tsum tau kuaj tsis meej, tsis txhob ntseeg cov khoom lag luam.
Peb, nyob rau hauv lem, nyob rau hauv lub moj khaum ntawm ob peb tsab xov xwm, yuav sim qhia txog Check Point, yuav ua li cas koj yuav tau sim nws thiab dab tsi, hauv paus ntsiab lus, koj yuav tau sim (yuav luag tag nrho cov functionality).
Peb Cheeb Tsam Chaw
Thaum ua haujlwm nrog Check Point, koj yuav ntsib peb yam khoom ntawm cov khoom no:
- Security Gateway (SG) - lub rooj vag kev ruaj ntseg nws tus kheej, uas feem ntau yog ntsia ntawm lub network perimeter thiab ua lub luag haujlwm ntawm firewall, streaming antivirus, antibot, IPS, thiab lwm yam.
- Kev Tswj Xyuas Kev Ruaj Ntseg (SMS) - rooj vag tswj server. Yuav luag txhua qhov chaw ntawm lub rooj vag (SG) tau ua tiav siv cov server no. SMS kuj tseem tuaj yeem ua tus Log Server thiab ua haujlwm nrog cov txheej xwm tsim thiab kev sib raug zoo - Cov Txheej Txheem Ntse (zoo ib yam li SIEM rau Check Point), tab sis ntxiv rau tom qab ntawd. SMS yog siv rau kev tswj hwm ntawm ntau lub rooj vag (tus naj npawb ntawm lub rooj vag nyob ntawm tus qauv SMS lossis daim ntawv tso cai), tab sis koj yuav tsum siv nws txawm tias koj tsuas muaj ib lub rooj vag xwb. Nws yuav tsum raug sau tseg ntawm no tias Check Point yog ib qho ntawm thawj zaug siv cov kev tswj hwm hauv nruab nrab, uas tau lees paub tias yog "tus qauv kub" raws li Gartner cov ntaub ntawv tau ntau xyoo ua ke. Tseem muaj qhov tso dag: "Yog tias Cisco muaj kev tswj hwm ib txwm muaj, ces Check Point yuav tsis tshwm sim."
- Ntse Console - tus neeg siv khoom console rau kev txuas mus rau kev tswj hwm server (SMS). Feem ntau ntsia rau ntawm tus thawj tswj lub computer. Txhua qhov kev hloov pauv ntawm kev tswj hwm server yog ua los ntawm lub console no, thiab tom qab ntawd koj tuaj yeem siv cov kev teeb tsa rau lub rooj vag kev nyab xeeb (Nruab Txoj Cai).
Check Point Operating System
Hais txog Check Point operating system, peb tuaj yeem rov qab tau peb zaug ib zaug: IPSO, SPLAT thiab GAIA.
- IPSO - operating system ntawm Ipsilon Networks, uas koom nrog Nokia. Xyoo 2009, Check Point tau yuav qhov kev lag luam no. Tsis loj hlob lawm.
- SPLAT - Txheeb Point tus kheej txoj kev loj hlob, raws li RedHat ntsiav. Tsis loj hlob lawm.
- Gaia - Kev khiav hauj lwm tam sim no los ntawm Check Point, uas tshwm sim los ntawm kev sib koom ua ke ntawm IPSO thiab SPLAT, suav nrog txhua qhov zoo tshaj plaws. Nws tshwm sim nyob rau hauv 2012 thiab txuas ntxiv mus ua kom nquag plias.
Hais txog Gaia, nws yuav tsum tau hais tias tam sim no qhov feem ntau version yog R77.30. Txog tam sim no, R80 version tau tshwm sim, uas txawv ntawm qhov dhau los (ob qho tib si ntawm kev ua haujlwm thiab kev tswj hwm). Peb yuav mob siab rau ib qho kev tshaj tawm cais rau lub ntsiab lus ntawm lawv qhov sib txawv. Lwm qhov tseem ceeb yog tias tam sim no tsuas yog version R77.10 muaj daim ntawv pov thawj FSTEC, thiab version R77.30 tau lees paub.
Kev xaiv ua tiav (Check Point Appliance, Virtual tshuab, OpenServer)
Tsis muaj ib yam dab tsi xav tsis thoob ntawm no, zoo li ntau tus neeg muag khoom, Check Point muaj ntau yam khoom xaiv:
- tshuab siv - hardware thiab software device, i.e. nws tus kheej "khoom hlau". Muaj ntau cov qauv sib txawv hauv kev ua haujlwm, kev ua haujlwm thiab kev tsim qauv (muaj kev xaiv rau kev lag luam tes hauj lwm).
- Virtual Tshuab - Tshawb xyuas Point virtual tshuab nrog Gaia OS. Hypervisors ESXi, Hyper-V, KVM tau txais kev txhawb nqa. Daim ntawv tso cai los ntawm tus naj npawb ntawm processor cores.
- OpenServer - txhim kho Gaia ncaj qha rau ntawm lub server ua lub luag haujlwm tseem ceeb (lub npe hu ua "Bare hlau"). Tsuas yog qee yam khoom siv txhawb nqa. Muaj cov lus pom zoo rau cov khoom siv no uas yuav tsum tau ua raws, txwv tsis pub muaj teeb meem nrog cov tsav tsheb thiab cov cuab yeej siv cuab yeej cuab tam yuav tshwm sim. kev txhawb nqa yuav tsis kam muab kev pabcuam rau koj.
Cov kev xaiv rau kev siv (Distributed lossis Standalone)
Qhov siab dua me ntsis peb twb tau tham txog dab tsi lub rooj vag (SG) thiab kev tswj hwm server (SMS) yog dab tsi. Tam sim no cia peb tham txog cov kev xaiv rau lawv qhov kev siv. Muaj ob txoj hauv kev tseem ceeb:
- Standalone (SG + SMS) - ib qho kev xaiv thaum ob lub qhov rooj thiab cov neeg rau zaub mov tswj tau teeb tsa hauv ib lub cuab yeej (lossis tshuab virtual).
Qhov kev xaiv no yog tsim nyog thaum koj tsuas muaj ib lub rooj vag uas yog me ntsis loaded nrog cov neeg siv tsheb. Qhov kev xaiv no yog kev lag luam tshaj plaws, vim tias ... tsis tas yuav mus yuav tus tswj server (SMS). Txawm li cas los xij, yog tias lub rooj vag hnyav hnyav, koj tuaj yeem xaus nrog "slow" tswj system. Yog li ntawd, ua ntej xaiv qhov kev daws teeb meem Standalone, nws yog qhov zoo tshaj los sab laj lossis txawm tias sim qhov kev xaiv no. - Faib - tus neeg rau zaub mov tswj tau nruab ib leeg los ntawm lub rooj vag.
Qhov kev xaiv zoo tshaj plaws ntawm kev yooj yim thiab kev ua haujlwm. Siv thaum tsim nyog los tswj ntau lub rooj vag ib zaug, piv txwv li hauv nruab nrab thiab ceg ntoo. Nyob rau hauv cov ntaub ntawv no, koj yuav tsum tau yuav ib tug tswj server (SMS), uas kuj yuav ua tau nyob rau hauv daim ntawv ntawm cov khoom siv los yog lub tshuab virtual.
Raws li kuv tau hais saum toj no, Check Point muaj nws tus kheej SIEM system - Smart Event. Koj tuaj yeem siv nws tsuas yog thaum Distributed installation.
Kev khiav hauj lwm hom (Bridge, Routed)
Kev Ruaj Ntseg Gateway (SG) tuaj yeem ua haujlwm hauv ob hom tseem ceeb:
- Tav - qhov kev xaiv tshaj plaws. Nyob rau hauv cov ntaub ntawv no, lub rooj vag yog siv raws li ib tug L3 ntaus ntawv thiab txoj kev tsheb los ntawm nws tus kheej, i.e. Check Point yog lub rooj vag qub rau lub network tiv thaiv.
- choj - hom pob tshab. Nyob rau hauv cov ntaub ntawv no, lub rooj vag yog ntsia raws li ib txwm "choj" thiab hla mus los ntawm lub thib ob theem (OSI). Qhov kev xaiv no feem ntau yog siv thaum tsis muaj qhov ua tau (lossis muaj siab) los hloov cov txheej txheem uas twb muaj lawm. Koj xyaum tsis tas yuav hloov lub network topology thiab tsis tas yuav xav txog kev hloov IP chaw nyob.
Kuv xav kom nco ntsoov tias hauv Choj hom muaj qee qhov kev txwv ntawm kev ua haujlwm, yog li peb, ua tus koom ua ke, qhia txhua tus neeg siv khoom siv Routed hom, tau kawg, yog tias ua tau.
Check Point Software Blades
Peb tau yuav luag txog lub ntsiab lus tseem ceeb tshaj plaws ntawm Check Point, uas ua rau cov lus nug feem ntau ntawm cov neeg siv khoom. Cov "software blades" no yog dab tsi? Cov hniav xa mus rau qee qhov Check Point ua haujlwm.
Cov haujlwm no tuaj yeem qhib lossis kaw nyob ntawm koj qhov kev xav tau. Nyob rau tib lub sijhawm, muaj cov hniav uas tau qhib tshwj xeeb rau ntawm lub rooj vag (Network Security) thiab tsuas yog nyob rau ntawm kev tswj xyuas server. Cov duab hauv qab no qhia cov piv txwv rau ob qhov xwm txheej:
1) Rau Network Security (gateway functionality)
Cia peb piav luv luv, vim ... txhua tus hniav tsim nyog nws cov lus.
- Firewall - firewall functionality;
- IPSec VPN - tsim lub network ntiag tug virtual;
- Mobile Access - tej thaj chaw deb nkag los ntawm mobile pab kiag li lawm;
- IPS - kev tiv thaiv kev nkag mus;
- Anti-Bot - tiv thaiv botnet networks;
- AntiVirus - streaming antivirus;
- AntiSpam & Email Security - kev tiv thaiv ntawm tuam txhab email;
- Kev Paub Txog Tus Kheej - kev koom ua ke nrog Active Directory kev pabcuam;
- Kev soj ntsuam - saib xyuas yuav luag txhua qhov rooj nkag tsis tau (load, bandwidth, VPN xwm txheej, thiab lwm yam)
- Application Control - daim ntawv thov qib firewall (NGFW functionality);
- URL Lim - Kev ruaj ntseg Web (+ proxy functionality);
- Kev Tiv Thaiv Cov Ntaub Ntawv Loss - tiv thaiv cov ntaub ntawv xau (DLP);
- Threat Emulation - sandbox technology (SandBox);
- Threat Extraction - ntaub ntawv tu tshuab;
- QoS - kev lag luam ua ntej.
Nyob rau hauv ob peb tsab xov xwm peb yuav saib cov ncauj lus kom ntxaws ntawm Kev Nyuaj Siab Emulation thiab hem Extraction hniav, kuv paub tseeb tias nws yuav nthuav.
2) Rau Kev Tswj Xyuas (tswj server functionality)
- Network Policy Management - centralized txoj cai tswj;
- Endpoint Policy Management - centralized tswj ntawm Check Point cov neeg sawv cev (yog, Check Point tsim cov kev daws teeb meem tsis yog rau kev tiv thaiv network nkaus xwb, tab sis kuj rau kev tiv thaiv workstations (PCs) thiab smartphones);
- Logging & Status - centralized sau thiab ua cov cav;
- Management Portal - tswj kev ruaj ntseg los ntawm browser;
- Workflow - tswj kev hloov pauv txoj cai, tshawb xyuas cov kev hloov pauv, thiab lwm yam;
- User Directory - kev koom ua ke nrog LDAP;
- Kev npaj - automation ntawm kev tswj lub rooj vag;
- Smart Reporter - qhia txog qhov system;
- Ntse Event - tsom xam thiab sib txheeb ntawm cov xwm txheej (SIEM);
- Ua raws li - cia li kuaj xyuas cov chaw thiab ua cov lus pom zoo.
Peb yuav tsis xav txog cov teeb meem ntawm daim ntawv tso cai kom ntxaws tam sim no, yog li tsis txhob ua rau cov kab lus tsis meej thiab tsis ua rau tus nyeem ntawv tsis meej pem. Feem ntau peb yuav tshaj tawm qhov no hauv ib qho kev tshaj tawm cais.
Cov qauv ntawm cov hniav tso cai rau koj siv tsuas yog cov haujlwm uas koj xav tau tiag tiag, uas cuam tshuam rau cov peev nyiaj ntawm kev daws teeb meem thiab kev ua haujlwm tag nrho ntawm cov cuab yeej. Nws yog qhov laj thawj uas cov hniav ntau dua koj qhib, cov tsheb tsawg dua koj tuaj yeem "tsav dhau". Tias yog vim li cas cov lus hauv qab no tau txuas nrog rau txhua tus qauv Check Point (peb coj tus yam ntxwv ntawm 5400 qauv ua piv txwv):
Raws li koj tuaj yeem pom, muaj ob pawg ntawm kev sim ntawm no: ntawm kev sib xyaw ua ke thiab ntawm kev tsheb tiag tiag - sib xyaw. Feem ntau hais lus, Check Point tsuas yog yuam kom tshaj tawm cov kev sim hluavtaws, vim tias ... Qee tus neeg muag khoom siv cov kev ntsuam xyuas no raws li cov qauv ntsuas, yam tsis tau tshuaj xyuas qhov ua tau zoo ntawm lawv cov kev daws teeb meem ntawm kev khiav tsheb tiag tiag (lossis txhob txwm zais cov ntaub ntawv no vim lawv qhov tsis zoo).
Hauv txhua hom kev xeem, koj tuaj yeem pom ntau yam kev xaiv:
- kuaj tsuas yog rau Firewall;
- Firewall + IPS test;
- Firewall + IPS + NGFW (Application control) test;
- kuaj Firewall + Daim Ntawv Thov Tswj + URL Lim + IPS + Antivirus + Anti-Bot + SandBlast (sandbox)
Ua tib zoo saib cov kev txwv no thaum xaiv koj cov kev daws teeb meem, lossis tiv tauj .
Kuv xav tias qhov no yog qhov uas peb tuaj yeem ua tiav cov lus taw qhia ntawm Check Point technologies. Tom ntej no, peb yuav saib seb koj tuaj yeem kuaj Check Point thiab yuav ua li cas nrog cov ntaub ntawv niaj hnub kev nyab xeeb kev hem thawj (cov kab mob, phishing, ransomware, xoom-hnub).
PS Lub ntsiab lus tseem ceeb. Txawm hais tias nws txawv teb chaws (Israeli) keeb kwm, cov kev daws teeb meem tau lees paub nyob rau hauv Lavxias Federation los ntawm cov cai tswj hwm, uas tau txais kev cai lij choj nws muaj nyob hauv tsoomfwv cov tsev kawm ntawv (hais lus los ntawm ).
Tsuas yog cov neeg siv sau npe tuaj yeem koom nrog hauv daim ntawv ntsuam xyuas. thov.
Dab tsi UTM / NGFW cov cuab yeej koj siv?
-
Kuaj Cov Lus
-
Cisco Firepower
-
fortnite
-
Palo Alto
-
Sophos
-
Dell SonicWALL
-
Huawei
-
SaibGuard
-
Juniper
-
UserGate
-
Traffic inspector
-
Rubicon
-
Ideco
-
Kev daws teeb meem OpenSource
-
Lwm yam
134 cov neeg siv pov npav. 78 cov neeg siv txwv tsis pub siv.
Tau qhov twg los: www.hab.com