{"id":94321,"date":"2020-09-15T19:42:32","date_gmt":"2020-09-15T17:42:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/rukovodstvo-po-bezopasnosti-dns"},"modified":"2020-09-15T19:42:32","modified_gmt":"2020-09-15T17:42:32","slug":"rukovodstvo-po-bezopasnosti-dns","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/rukovodstvo-po-bezopasnosti-dns","title":{"rendered":"DNS biztons\u00e1gi \u00fatmutat\u00f3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"DNS biztons\u00e1gi \u00fatmutat\u00f3\" src=\"\/wp-content\/uploads\/2020\/09\/e29223def3c7c13eaa45a24967d6bba0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nB\u00e1rmi legyen is a v\u00e1llalat tev\u00e9kenys\u00e9ge, a biztons\u00e1gnak <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/what-is-dns\/\"> DNS <\/a><\/noindex>nem szabad elt\u00e9rnie a biztons\u00e1gi terv\u00e9nek alapjait\u00f3l. Az n\u00e9vford\u00edt\u00f3 szolg\u00e1ltat\u00e1sok, amelyek a h\u00e1l\u00f3zati csom\u00f3pontok neveit IP-c\u00edmekk\u00e9 alak\u00edtj\u00e1k, gyakorlatilag minden h\u00e1l\u00f3zati alkalmaz\u00e1sban \u00e9s szolg\u00e1ltat\u00e1sban haszn\u00e1latosak.<\/p>\n<p><strong>Ha egy kiberb\u0171n\u00f6z\u0151 megszerzi az szervezet DNS-ellen\u0151rz\u00e9s\u00e9t, akkor probl\u00e9mamentesen k\u00e9pes lesz:<\/strong><\/p>\n<ul>\n<li>\u00e1tvenni az ir\u00e1ny\u00edt\u00e1st a nyilv\u00e1nosan el\u00e9rhet\u0151 er\u0151forr\u00e1sok felett<\/li>\n<li>\u00e1tir\u00e1ny\u00edtani a bej\u00f6v\u0151 e-maileket, valamint a webes k\u00e9r\u00e9seket \u00e9s a hiteles\u00edt\u00e9si pr\u00f3b\u00e1lkoz\u00e1sokat<\/li>\n<li>tan\u00fas\u00edtv\u00e1nyokat l\u00e9trehozni \u00e9s \u00e9rv\u00e9nyes\u00edteni SSL\/TLS<\/li>\n<\/ul>\n<p>\n<strong>Ez az \u00fatmutat\u00f3 a DNS biztons\u00e1g\u00e1t k\u00e9t szempontb\u00f3l vizsg\u00e1lja:<\/strong><\/p>\n<ol>\n<li>Folyamatos DNS-monitoring \u00e9s -ellen\u0151rz\u00e9s v\u00e9gezni<\/li>\n<li>Hogyan seg\u00edthetnek az \u00faj DNS protokollok, mint a DNSSEC, DOH \u00e9s DoT, a DNS-k\u00e9r\u00e9s k\u00f6zben a teljess\u00e9g \u00e9s a titoktart\u00e1s meg\u0151rz\u00e9s\u00e9ben<\/li>\n<\/ol>\n<p>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2> Mi az a DNS biztons\u00e1g? <\/h2>\n<p>\n<img decoding=\"async\" alt=\"DNS biztons\u00e1gi \u00fatmutat\u00f3\" src=\"\/wp-content\/uploads\/2020\/09\/6367857de248c9ee9435f8ec079600be.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3> A DNS biztons\u00e1g\u00e1nak k\u00e9t fontos \u00f6sszetev\u0151je van:<\/h3>\n<p><\/p>\n<ol>\n<li>A DNS-szolg\u00e1ltat\u00e1sok \u00e1ltal a h\u00e1l\u00f3zati csom\u00f3pontok neveib\u0151l IP-c\u00edmekk\u00e9 t\u00f6rt\u00e9n\u0151 \u00e1talak\u00edt\u00e1s \u00f6sszess\u00e9g\u00e9nek \u00e9s el\u00e9rhet\u0151s\u00e9g\u00e9nek biztos\u00edt\u00e1sa<\/li>\n<li>A DNS aktivit\u00e1s\u00e1nak figyelemmel k\u00eds\u00e9r\u00e9se a biztons\u00e1gi probl\u00e9m\u00e1k azonos\u00edt\u00e1s\u00e1ra a h\u00e1l\u00f3zat\u00e1ban<\/li>\n<\/ol>\n<h3> Mi\u00e9rt sebezhet\u0151 a DNS a t\u00e1mad\u00e1sokkal szemben? <\/h3>\n<p>\nA DNS technol\u00f3gi\u00e1t az internet fejl\u0151d\u00e9s\u00e9nek hajnal\u00e1n alak\u00edtott\u00e1k ki, j\u00f3val azel\u0151tt, hogy b\u00e1rki is elkezdett volna gondolkodni a h\u00e1l\u00f3zati biztons\u00e1gon. A DNS hiteles\u00edt\u00e9s \u00e9s titkos\u00edt\u00e1s n\u00e9lk\u00fcl m\u0171k\u00f6dik, vakon kezelve b\u00e1rmilyen felhaszn\u00e1l\u00f3 k\u00e9r\u00e9s\u00e9t.<\/p>\n<p>Ennek k\u00f6vetkezt\u00e9ben sz\u00e1mos m\u00f3dja van a felhaszn\u00e1l\u00f3k megt\u00e9veszt\u00e9s\u00e9nek \u00e9s annak hamis\u00edt\u00e1s\u00e1nak, hogy hol t\u00f6rt\u00e9nik val\u00f3j\u00e1ban a nevek IP-c\u00edmekk\u00e9 val\u00f3 \u00e1talak\u00edt\u00e1sa.<\/p>\n<h2> DNS biztons\u00e1g: k\u00e9rd\u00e9sek \u00e9s \u00f6sszetev\u0151k<\/h2>\n<p>\n<img decoding=\"async\" alt=\"DNS biztons\u00e1gi \u00fatmutat\u00f3\" src=\"\/wp-content\/uploads\/2020\/09\/45d61ac4004631a2602518a3d4a51c3c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nA DNS biztons\u00e1g\u00e1nak alapj\u00e1t t\u00f6bb f\u0151elem k\u00e9pezi, <em>melyek mindegyik\u00e9t figyelembe kell venni a teljes k\u00f6r\u0171 v\u00e9delem biztos\u00edt\u00e1sa \u00e9rdek\u00e9ben:<\/em>A szerverek \u00e9s az ir\u00e1ny\u00edt\u00e1si elj\u00e1r\u00e1sok biztons\u00e1g\u00e1nak meger\u0151s\u00edt\u00e9se:<\/p>\n<ul>\n<li><strong>n\u00f6velje a szerverek v\u00e9delm\u00e9t \u00e9s hozzon l\u00e9tre egy szabv\u00e1nyos \u00fczembehelyez\u00e9si sablont<\/strong> A protokoll fejleszt\u00e9se:<\/li>\n<li><strong>val\u00f3s\u00edtson meg DNSSEC, DoT vagy DoH-t<\/strong> Elemz\u00e9s \u00e9s jelent\u00e9s:<\/li>\n<li><strong>adjon hozz\u00e1 DNS esem\u00e9nynapl\u00f3t a SIEM rendszerhez, hogy tov\u00e1bbi \u00f6sszef\u00fcgg\u00e9seket biztos\u00edtson az incidensek kivizsg\u00e1l\u00e1s\u00e1hoz <\/strong>Kiberintelligencia \u00e9s fenyeget\u00e9s\u00e9szlel\u00e9s:<\/li>\n<li><strong>iratkozzon fel egy akt\u00edv fenyeget\u00e9sadatok szolg\u00e1ltat\u00e1s\u00e1ra<\/strong> Automatiz\u00e1l\u00e1s:<\/li>\n<li><strong>Automatiz\u00e1l\u00e1s: <\/strong>Hozza l\u00e9tre a lehet\u0151 legt\u00f6bb forgat\u00f3k\u00f6nyvet a folyamatok automatiz\u00e1l\u00e1s\u00e1hoz.<\/li>\n<\/ul>\n<p>\nA fent eml\u00edtett magas szint\u0171 komponensek csup\u00e1n a DNS biztons\u00e1g\u00e1nak j\u00e9ghegy cs\u00facs\u00e1t jelentik. A k\u00f6vetkez\u0151 r\u00e9szben r\u00e9szletesebben \u00e1ttekintj\u00fck a konkr\u00e9t felhaszn\u00e1l\u00e1si eseteket \u00e9s legjobb gyakorlatokat, amelyeket ismernie kell.<\/p>\n<h2> DNS t\u00e1mad\u00e1sok<\/h2>\n<p>\n<img decoding=\"async\" alt=\"DNS biztons\u00e1gi \u00fatmutat\u00f3\" src=\"\/wp-content\/uploads\/2020\/09\/f44708ad51b13385aa5ce10629944ecc.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<ul>\n<li><strong><noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/dns-cache-poisoning\/\">DNS hamis\u00edt\u00e1s vagy \"gyomirt\u00e1s\" a cache-ben<\/a><\/noindex>: <\/strong> A rendszer s\u00e9r\u00fcl\u00e9kenys\u00e9g\u00e9nek kihaszn\u00e1l\u00e1sa a DNS cache kezel\u00e9se \u00e9rdek\u00e9ben, hogy a felhaszn\u00e1l\u00f3kat \u00e1thelyezze egy m\u00e1sik helyre.<\/li>\n<li><strong><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/513160\/\">DNS alag\u00fatoz\u00e1s<\/a><\/noindex>: <\/strong>Els\u0151sorban a t\u00e1voli kapcsolatok v\u00e9delm\u00e9nek megker\u00fcl\u00e9s\u00e9re haszn\u00e1lj\u00e1k.<\/li>\n<li><strong>DNS lehallgat\u00e1s: <\/strong>A szok\u00e1sos DNS forgalom \u00e1tir\u00e1ny\u00edt\u00e1sa egy m\u00e1sik c\u00e9l DNS szerverhez a domain regisztr\u00e1l\u00f3 megv\u00e1ltoztat\u00e1s\u00e1val.<\/li>\n<li><strong>NXDOMAIN t\u00e1mad\u00e1s: <\/strong>DDoS t\u00e1mad\u00e1s v\u00e9grehajt\u00e1sa egy megb\u00edzhat\u00f3 DNS szerver ellen, helytelen domain k\u00e9r\u00e9sek k\u00fcld\u00e9s\u00e9vel a k\u00f6telez\u0151 v\u00e1laszok megszerz\u00e9s\u00e9hez.<\/li>\n<li><strong>Fantomszolg\u00e1ltat\u00e1s: <\/strong> A DNS felold\u00f3 k\u00e9nyszer\u00edti a v\u00e1laszra a nem l\u00e9tez\u0151 domainek eset\u00e9n, ami teljes\u00edtm\u00e9nycs\u00f6kken\u00e9shez vezet.<\/li>\n<li><strong>V\u00e9letlenszer\u0171 aldomain t\u00e1mad\u00e1s: <\/strong> A felt\u00f6rt hosztok \u00e9s botnetek DDoS t\u00e1mad\u00e1st ind\u00edtanak egy m\u0171k\u00f6d\u0151 domain ellen, de a figyelmet hamis aldomainokra \u00f6sszpontos\u00edtj\u00e1k, hogy k\u00e9nyszer\u00edts\u00e9k a DNS szervert a rekordok keres\u00e9s\u00e9re \u00e9s \u00e1tvegy\u00e9k a szolg\u00e1ltat\u00e1s ir\u00e1ny\u00edt\u00e1s\u00e1t.<\/li>\n<li><strong>Domain blokkol\u00e1s: <\/strong> \u00c1tfog\u00f3 spam v\u00e1laszok k\u00fcld\u00e9se a DNS szerver er\u0151forr\u00e1sainak blokkol\u00e1s\u00e1ra.<\/li>\n<li><strong>Botnet t\u00e1mad\u00e1s el\u0151fizet\u0151i eszk\u00f6z\u00f6kr\u0151l: <\/strong> Sz\u00e1m\u00edt\u00f3g\u00e9pek, modemek, routerek \u00e9s egy\u00e9b eszk\u00f6z\u00f6k \u00f6sszess\u00e9ge, melyek a sz\u00e1m\u00edt\u00e1si teljes\u00edtm\u00e9nyt egy meghat\u00e1rozott weboldalra \u00f6sszpontos\u00edtj\u00e1k, hogy t\u00falterhelj\u00e9k a forgalom k\u00e9r\u00e9seivel.<\/li>\n<\/ul>\n<p><\/p>\n<h3> DNS-alap\u00fa t\u00e1mad\u00e1sok<\/h3>\n<p>\nOlyan t\u00e1mad\u00e1sok, amelyek valamilyen m\u00f3don a DNS-t felhaszn\u00e1lva t\u00e1madj\u00e1k meg m\u00e1s rendszereket (pl. a DNS rekordok megv\u00e1ltoztat\u00e1sa nem v\u00e9gs\u0151 c\u00e9l):<\/p>\n<ul>\n<li>Gyors fluxus<\/li>\n<li>Egys\u00e9ges Flux h\u00e1l\u00f3zatok<\/li>\n<li>Kett\u0151s Flux h\u00e1l\u00f3zatok<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/513160\/\">DNS alag\u00fatoz\u00e1s<\/a><\/noindex> <\/li>\n<\/ul>\n<p><\/p>\n<h3> DNS t\u00e1mad\u00e1sok<\/h3>\n<p>\nOlyan t\u00e1mad\u00e1sok, amelyek eredm\u00e9nyek\u00e9nt a DNS szerver visszaadja a t\u00e1mad\u00f3 \u00e1ltal k\u00edv\u00e1nt IP-c\u00edmet:<\/p>\n<ul>\n<li>DNS hamis\u00edt\u00e1s vagy \"gyomirt\u00e1s\" a cache-ben<\/li>\n<li>DNS lehallgat\u00e1s<\/li>\n<\/ul>\n<p><\/p>\n<h2> Mi az a DNSSEC?<\/h2>\n<p><img decoding=\"async\" alt=\"DNS biztons\u00e1gi \u00fatmutat\u00f3\" src=\"\/wp-content\/uploads\/2020\/09\/929b6e632135bd1b059e403e7b4ddab8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nA DNSSEC, a domain n\u00e9v szolg\u00e1ltat\u00e1s biztons\u00e1gi moduljai, a DNS rekordok ellen\u0151rz\u00e9s\u00e9re szolg\u00e1lnak an\u00e9lk\u00fcl, hogy tudnia kellene az \u00f6sszes r\u00e9szletes inform\u00e1ci\u00f3t minden egyes DNS k\u00e9r\u00e9shez.<\/p>\n<p>A DNSSEC digit\u00e1lis al\u00e1\u00edr\u00e1sok kulcsait (PKI) haszn\u00e1lja a domain n\u00e9v k\u00e9r\u00e9s\u00e9nek eredm\u00e9nyeinek el\u00e9rhet\u0151s\u00e9g\u00e9t\u0151l val\u00f3 meger\u0151s\u00edt\u00e9shez.<br \/>\nA DNSSEC implement\u00e1l\u00e1sa nemcsak a legjobb ipar\u00e1gi gyakorlat, hanem hat\u00e9konyan seg\u00edt elker\u00fclni a DNS t\u00e1mad\u00e1sok t\u00f6bbs\u00e9g\u00e9t is.<\/p>\n<h4>A DNSSEC m\u0171k\u00f6d\u00e9s\u00e9nek elve<\/h4>\n<p>\nA DNSSEC hasonl\u00f3an m\u0171k\u00f6dik, mint a TLS\/HTTPS, nyilv\u00e1nos \u00e9s titkos kulcsp\u00e1rokat haszn\u00e1lva a DNS rekordok digit\u00e1lis al\u00e1\u00edr\u00e1s\u00e1hoz. A folyamat \u00e1ltal\u00e1nos \u00e1ttekint\u00e9se:<\/p>\n<ol>\n<li>A DNS rekordokat egy titkos \u00e9s egy nyilv\u00e1nos kulcsp\u00e1r \u00edrja al\u00e1.<\/li>\n<li>A DNSSEC-rekordok tartalmazz\u00e1k a k\u00e9rt rekordot, valamint az al\u00e1\u00edr\u00e1st \u00e9s a nyilv\u00e1nos kulcsot.<\/li>\n<li>Ezut\u00e1n <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/pgp-encryption\/\">a nyilv\u00e1nos kulcs <\/a><\/noindex>a rekord \u00e9s az al\u00e1\u00edr\u00e1s hiteles\u00edt\u00e9s\u00e9nek ellen\u0151rz\u00e9s\u00e9re haszn\u00e1latos.<\/li>\n<\/ol>\n<h2> A DNS biztons\u00e1ga \u00e9s a DNSSEC<\/h2>\n<p>\n<img decoding=\"async\" alt=\"DNS biztons\u00e1gi \u00fatmutat\u00f3\" src=\"\/wp-content\/uploads\/2020\/09\/3bd1d530634e82ed6d80040a1d207ff0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nA DNSSEC egy eszk\u00f6z a DNS-k\u00e9r\u00e9sek integrit\u00e1s\u00e1nak ellen\u0151rz\u00e9s\u00e9re. Nem hat a DNS adatv\u00e9delemre. M\u00e1s szavakkal, a DNSSEC meger\u0151s\u00edt\u00e9st adhat arr\u00f3l, hogy a DNS-k\u00e9r\u00e9sre kapott v\u00e1lasz nem hamis\u00edtv\u00e1ny, de b\u00e1rmely rosszindulat\u00fa f\u00e9l l\u00e1thatja ezeket az eredm\u00e9nyeket abban a form\u00e1ban, ahogy \u00d6n\u00f6knek \u00e1tadt\u00e1k \u0151ket.<\/p>\n<h2> DoT \u2013 DNS TLS-en kereszt\u00fcl<\/h2>\n<p>\nA Transport Layer Security (Transport Layer Security \u2013 TLS) egy titkos\u00edt\u00e1si protokoll, amely v\u00e9di a h\u00e1l\u00f3zati kapcsolaton \u00e1tadott inform\u00e1ci\u00f3t. Amint a kliens \u00e9s a szerver k\u00f6z\u00f6tt l\u00e9trej\u00f6n egy biztons\u00e1gos TLS kapcsolat, a tov\u00e1bb\u00edtott adatok titkos\u00edtva lesznek, \u00e9s semmilyen k\u00f6zvet\u00edt\u0151 nem l\u00e1thatja azokat.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/tls-vs-ssl\/\">TLS <\/a><\/noindex>Leggyakrabban HTTPS (SSL) r\u00e9szek\u00e9nt haszn\u00e1lj\u00e1k a webb\u00f6ng\u00e9sz\u0151ben, mivel a lek\u00e9rdez\u00e9sek titkos\u00edtott HTTP-szerverekre k\u00fcldet\u00e9sre ker\u00fclnek.<\/p>\n<p>A DNS-over-TLS (DoT) a TLS protokollt haszn\u00e1lja a hagyom\u00e1nyos DNS-lek\u00e9rdez\u00e9sek UDP-forgalm\u00e1nak titkos\u00edt\u00e1s\u00e1ra.<br \/>\nEzeknek a lek\u00e9rdez\u00e9seknek a titkos\u00edt\u00e1sa sz\u00f6veges form\u00e1ban seg\u00edt megv\u00e9deni a felhaszn\u00e1l\u00f3kat vagy alkalmaz\u00e1sokat a k\u00fcl\u00f6nb\u00f6z\u0151 t\u00e1mad\u00e1sokt\u00f3l.<\/p>\n<ul>\n<li><strong>MitM, azaz \"ember a k\u00f6z\u00e9ppontban\"<\/strong>: titkos\u00edt\u00e1s n\u00e9lk\u00fcl a k\u00f6ztes rendszer, amely a kliens \u00e9s az autorit\u00e1s DNS-szerver k\u00f6z\u00f6tt helyezkedik el, potenci\u00e1lisan hamis vagy vesz\u00e9lyes inform\u00e1ci\u00f3t eljuttathat a klienshez a lek\u00e9rdez\u00e9sre adott v\u00e1laszban.<\/li>\n<li><strong>K\u00e9mked\u00e9s \u00e9s nyomk\u00f6vet\u00e9s<\/strong>: titkos\u00edt\u00e1s n\u00e9lk\u00fcli lek\u00e9rdez\u00e9sek eset\u00e9n a k\u00f6ztes rendszerek k\u00f6nnyen l\u00e1thatj\u00e1k, hogy a konkr\u00e9t felhaszn\u00e1l\u00f3 vagy alkalmaz\u00e1s milyen weboldalakra l\u00e9p r\u00e1. B\u00e1r a csup\u00e1n DNS-b\u0151l nem lehet megtudni a l\u00e1togatott weboldal konkr\u00e9t pontos oldal\u00e1t, a lek\u00e9rt domainek egyszer\u0171 ismerete elegend\u0151 lehet egy rendszer vagy egyedi szem\u00e9ly profilj\u00e1nak kialak\u00edt\u00e1s\u00e1hoz.<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"DNS biztons\u00e1gi \u00fatmutat\u00f3\" src=\"\/wp-content\/uploads\/2020\/09\/31bb5e540feac0302244253b1c12ed32.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nForr\u00e1s: <noindex><a rel=\"nofollow\" href=\"https:\/\/faculty.sites.uci.edu\/zhouli\/files\/2019\/11\/conext19.pdf\">Kaliforniai Egyetem, Irvine<\/a><\/noindex><\/p>\n<h2> DoH \u2013 DNS HTTPS-en kereszt\u00fcl<\/h2>\n<p>\nA DNS-over-HTTPS (DNS HTTPS-en, DoH) egy k\u00eds\u00e9rleti protokoll, amelyet egy\u00fcttm\u0171k\u00f6dve a Mozilla \u00e9s a Google n\u00e9pszer\u0171s\u00edtenek. C\u00e9ljai hasonl\u00f3ak a DoT protokollhoz - az emberek online adatv\u00e9delm\u00e9nek fokoz\u00e1sa a DNS-k\u00e9r\u00e9sek \u00e9s v\u00e1laszok titkos\u00edt\u00e1s\u00e1val.<\/p>\n<p>A norm\u00e1l DNS-k\u00e9r\u00e9sek UDP-n kereszt\u00fcl ker\u00fclnek tov\u00e1bb\u00edt\u00e1sra. A k\u00e9r\u00e9seket \u00e9s v\u00e1laszokat olyan eszk\u00f6z\u00f6kkel lehet nyomon k\u00f6vetni, mint <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/how-to-use-wireshark\/\">Wireshark<\/a><\/noindex>. A DoT titkos\u00edtja ezeket a k\u00e9r\u00e9seket, de a h\u00e1l\u00f3zatban tov\u00e1bbra is meglehet\u0151sen megk\u00fcl\u00f6nb\u00f6ztethet\u0151 UDP-forgalomk\u00e9nt azonos\u00edthat\u00f3k.<\/p>\n<p>A DoH m\u00e1s megk\u00f6zel\u00edt\u00e9st alkalmaz, \u00e9s titkos\u00edtott k\u00e9r\u00e9seket k\u00fcld a h\u00e1l\u00f3zati csom\u00f3pontok neveinek felold\u00e1sa \u00e9rdek\u00e9ben HTTPS-kapcsolaton kereszt\u00fcl, amelyek a h\u00e1l\u00f3zaton b\u00e1rmilyen m\u00e1s webes k\u00e9r\u00e9sk\u00e9nt n\u00e9znek ki.<\/p>\n<p>Ez a k\u00fcl\u00f6nbs\u00e9g nagyon fontos k\u00f6vetkezm\u00e9nyekkel j\u00e1r a rendszergazd\u00e1k \u00e9s a j\u00f6v\u0151beli n\u00e9vfelold\u00e1s szempontj\u00e1b\u00f3l.<\/p>\n<ol>\n<li>A DNS-sz\u0171r\u00e9s elterjedt m\u00f3dja a webforgalom sz\u0171r\u00e9s\u00e9nek a felhaszn\u00e1l\u00f3k v\u00e9delme \u00e9rdek\u00e9ben a phishing t\u00e1mad\u00e1sok, a rosszindulat\u00fa programokat terjeszt\u0151 webhelyek vagy m\u00e1s potenci\u00e1lisan vesz\u00e9lyes internetes tev\u00e9kenys\u00e9gek ellen a v\u00e1llalati h\u00e1l\u00f3zatban. A DoH protokoll megker\u00fcli ezeket a sz\u0171r\u0151ket, potenci\u00e1lisan nagyobb kock\u00e1zatnak kit\u00e9ve a felhaszn\u00e1l\u00f3kat \u00e9s a h\u00e1l\u00f3zatot. <\/li>\n<li>A jelenlegi n\u00e9vfelold\u00e1si modellben minden eszk\u00f6z a h\u00e1l\u00f3zaton egy \u00e9s ugyanazon helyr\u0151l (a megadott DNS-kiszolg\u00e1l\u00f3r\u00f3l) kap DNS-k\u00e9r\u00e9seket. A DoH \u00e9s k\u00fcl\u00f6n\u00f6sen a Firefox \u00e1ltal k\u00edn\u00e1lt megval\u00f3s\u00edt\u00e1sa azt mutatja, hogy ez a j\u00f6v\u0151ben megv\u00e1ltozhat. Minden alkalmaz\u00e1s a sz\u00e1m\u00edt\u00f3g\u00e9pen k\u00fcl\u00f6nb\u00f6z\u0151 DNS-forr\u00e1sokb\u00f3l szerezheti be az adatokat, ami jelent\u0151sen megnehez\u00edti a probl\u00e9m\u00e1k felder\u00edt\u00e9s\u00e9t, a biztons\u00e1g biztos\u00edt\u00e1s\u00e1t \u00e9s a kock\u00e1zatok modellez\u00e9s\u00e9t. <\/li>\n<\/ol>\n<p><img decoding=\"async\" alt=\"DNS biztons\u00e1gi \u00fatmutat\u00f3\" src=\"\/wp-content\/uploads\/2020\/09\/46ece02ca361b133d4a6bd488b917c73.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nForr\u00e1s: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/what-is-powershell\/\">www.varonis.com\/blog\/what-is-powershell<\/a><\/noindex><\/p>\n<h3> Mi a k\u00fcl\u00f6nbs\u00e9g a DNS TLS-en \u00e9s a DNS HTTPS-en k\u00f6z\u00f6tt?<\/h3>\n<p>\nKezdj\u00fck a DNS TLS-en (DoT). Itt a hangs\u00faly azon van, hogy az eredeti DNS-protokoll nem v\u00e1ltozik meg, csup\u00e1n biztons\u00e1gosan tov\u00e1bb\u00edtj\u00e1k egy v\u00e9dett csatorn\u00e1n. A DoH azonban a DNS-t HTTP form\u00e1tumba helyezi a k\u00e9r\u00e9sek v\u00e9grehajt\u00e1sa el\u0151tt.<\/p>\n<h2> DNS-monitoring \u00e9rtes\u00edt\u00e9sek<\/h2>\n<p>\n<img decoding=\"async\" alt=\"DNS biztons\u00e1gi \u00fatmutat\u00f3\" src=\"\/wp-content\/uploads\/2020\/09\/fbbd9f320922dbd2eec180a253ba54f0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nA DNS traffic monitoring capability in your network for suspicious anomalies is crucial for early intrusion detection. Using a tool like Varonis Edge will keep you updated on all key indicators and allow you to create profiles for each account in your network. You can set up alert generation based on a combination of actions occurring over a specific period.<\/p>\n<p>Monitoring changes in DNS, account locations, as well as first-use facts and access to sensitive data, along with out-of-hours activity\u2014these are just a few indicators that can be matched to create a more comprehensive detection picture.<br \/>\n<br \/>Forr\u00e1s: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/519108\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0427\u0435\u043c \u0431\u044b \u043d\u0438 \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0430\u0441\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f, \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c DNS \u0434\u043e\u043b\u0436\u043d\u0430 \u044f\u0432\u043b\u044f\u0442\u044c\u0441\u044f \u043d\u0435\u043e\u0442\u044a\u0435\u043c\u043b\u0435\u043c\u043e\u0439 \u0447\u0430\u0441\u0442\u044c\u044e \u0435\u0435 \u043f\u043b\u0430\u043d\u0430 \u043f\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0421\u043b\u0443\u0436\u0431\u044b \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0438\u043c\u0435\u043d, \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u0438\u043c\u0435\u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0437\u043b\u043e\u0432 \u0432 IP-\u0430\u0434\u0440\u0435\u0441\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0432\u0441\u0435\u043c\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438 \u0438 \u0441\u043b\u0443\u0436\u0431\u0430\u043c\u0438 \u0432 \u0441\u0435\u0442\u0438. \u0415\u0441\u043b\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u043b\u0443\u0447\u0438\u0442 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 DNS \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u0442\u043e \u0441\u043c\u043e\u0436\u0435\u0442 \u0431\u0435\u0437 \u043f\u0440\u043e\u0431\u043b\u0435\u043c: \u043f\u0435\u0440\u0435\u0434\u0430\u0442\u044c \u0441\u0435\u0431\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430\u0434 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438, \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0438\u043c\u0438\u0441\u044f \u0432 \u043e\u0431\u0449\u0435\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":94322,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-94321","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0427\u0435\u043c \u0431\u044b \u043d\u0438 \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0430\u0441\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f, \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/rukovodstvo-po-bezopasnosti-dns\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"hu_HU\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 DNS | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0427\u0435\u043c \u0431\u044b \u043d\u0438 \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0430\u0441\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f, \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/rukovodstvo-po-bezopasnosti-dns\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-09-15T17:42:32+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-09-15T17:42:32+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47DNS Security Guide | ProHoster","description":"B\u00e1rmi legyen is a v\u00e1llalat tev\u00e9kenys\u00e9ge, a biztons\u00e1gnak","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/rukovodstvo-po-bezopasnosti-dns","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 DNS | ProHoster","og:description":"\u0427\u0435\u043c \u0431\u044b \u043d\u0438 \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0430\u0441\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f, \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c","og:url":"https:\/\/prohoster.info\/hu\/blog\/administrirovanie\/rukovodstvo-po-bezopasnosti-dns","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-15T17:42:32+00:00","article:modified_time":"2020-09-15T17:42:32+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94321","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:29:29","updated":"2022-09-30 08:27:56","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/94321","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=94321"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/94321\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media\/94322"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=94321"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=94321"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=94321"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}