{"id":96260,"date":"2020-10-09T19:42:45","date_gmt":"2020-10-09T17:42:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/honeypot-vs-deception-na-primere-xello"},"modified":"2020-10-09T19:42:45","modified_gmt":"2020-10-09T17:42:45","slug":"honeypot-vs-deception-na-primere-xello","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/honeypot-vs-deception-na-primere-xello","title":{"rendered":"Honeypot un Deception, izmantojot Xello piem\u0113ru","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Honeypot<\/p>\n

Habr\u0101 jau ir vair\u0101kas zi\u0146as par Honeypot un Deception tehnolo\u0123ij\u0101m (1 raksts<\/a><\/noindex>, 2 raksts<\/a><\/noindex>). Tom\u0113r joproj\u0101m sastopam nesapratni par at\u0161\u0137ir\u012bbu starp \u0161iem aizsardz\u012bbas r\u012bku veidiem. T\u0101p\u0113c m\u016bsu kol\u0113\u0123i no Xello Deception<\/a><\/noindex> (pirmais Krievij\u0101 izstr\u0101d\u0101t\u0101ja Deception platformas<\/a><\/noindex>) nol\u0113ma s\u012bk\u0101k aprakst\u012bt \u0161o risin\u0101jumu at\u0161\u0137ir\u012bbas, priek\u0161roc\u012bbas un arhitekt\u016bras \u012bpatn\u012bbas.<\/p>\n

Izp\u0113t\u012bsim, kas tad ir «hanipoti» un «desep\u0161eni»:<\/h2>\n

«Kr\u0101p\u0161anas tehnolo\u0123ijas» (angl., Deception technology) tirg\u016b par\u0101d\u012bj\u0101s sal\u012bdzino\u0161i nesen. Tom\u0113r da\u017ei speci\u0101listi joproj\u0101m uzskata, ka Security Deception ir vienk\u0101r\u0161i att\u012bst\u012bt\u0101ka «hanipota» (angl., honeypot) versija. <\/p>\n

\u0160aj\u0101 rakst\u0101 m\u0113s cent\u012bsimies apgaismot gan l\u012bdz\u012bbas, gan pamatat\u0161\u0137ir\u012bbas starp \u0161iem diviem risin\u0101jumiem. Pirmaj\u0101 da\u013c\u0101 m\u0113s past\u0101st\u012bsim par \u00abkaanipotu\u00bb, k\u0101 att\u012bst\u012bj\u0101s \u0161\u012b tehnolo\u0123ija un k\u0101das ir t\u0101s priek\u0161roc\u012bbas un tr\u016bkumi. Otraj\u0101 da\u013c\u0101 s\u012bk\u0101k apskat\u012bsim izplat\u012btu maldino\u0161o m\u0113r\u0137u infrastrukt\u016bru (angl., Distributed Deception Platform \u2014 DDP) darb\u012bbas principus. <\/p>\n

Pamatprincipa, uz kura balst\u0101s honeypoti, ir izveidot slazdus hakeriem. Ar\u012b pa\u0161\u0101s pirmaj\u0101s Deception risin\u0101jumos tika izmantots l\u012bdz\u012bgs princips. Tom\u0113r m\u016bsdienu DDP iev\u0113rojami p\u0101rsp\u0113j k\u00e4\u00e4nipotus gan funkcionalit\u0101tes, gan efektivit\u0101tes zi\u0146\u0101. Deception platformas ietver: slazdus (angl., decoys, traps), vilin\u0101jumus (angl., lures), lietojumprogrammas, datus, datub\u0101zes, Active Directory. M\u016bsdienu DDP var nodro\u0161in\u0101t pla\u0161as iesp\u0113jas draudu atkl\u0101\u0161an\u0101, uzbrukumu anal\u012bz\u0113 un automatiz\u0113tu atbildes r\u012bc\u012bbu. <\/p>\n

T\u0101d\u0113j\u0101di Deception ir tehniskas IT infrastrukt\u016bras imit\u0113\u0161anas un hakeru maldin\u0101\u0161anas metodes. Rezult\u0101t\u0101 \u0161\u0101das platformas \u013cauj p\u0101rtraukt uzbrukumus pirms ir nodar\u012bti b\u016btiski zaud\u0113jumi uz\u0146\u0113muma akt\u012bviem. Kaanipoti, protams, nav ar tik pla\u0161u funkcionalit\u0101ti un autom\u0101tiz\u0101cijas l\u012bmeni, t\u0101p\u0113c to izmanto\u0161ana prasa liel\u0101ku darbinieku kvalifik\u0101ciju dro\u0161\u012bbas departamentos.<\/p>\n

1. Honeypots, Honeynets un Sandboxing: kas tas ir un k\u0101 to pielieto<\/h2>\n

Pirmo reizi termins «honeypots» tika lietots 1989. gad\u0101 Kliforda Stolla gr\u0101mat\u0101 «The Cuckoo\u2019s Egg», kur\u0101 aprakst\u012bti notikumi saist\u012bb\u0101 ar hakeru izseko\u0161anu Nacion\u0101laj\u0101 Berklija laboratorij\u0101 (ASV). Praks\u0113 \u0161\u012b ideja tika \u012bstenota 1999. gad\u0101 Lensu Spitsneru (Lance Spitzner), inform\u0101cijas dro\u0161\u012bbas speci\u0101listu no uz\u0146\u0113muma Sun Microsystems, kur\u0161 izveidoja p\u0113t\u012bjumu projektu «Honeynet Project». Pirmie hanipoti bija \u013coti resursu pras\u012bgi, sare\u017e\u0123\u012bti iestat\u0101mi un apkalpojami. <\/p>\n

Apskat\u012bsim s\u012bk\u0101k, kas ir honeypots <\/strong>un honeynets<\/strong>. Honeypots ir atsevi\u0161\u0137i \u0441\u0435\u0440\u0432\u0435\u0440i, kuru uzdevums ir pievilin\u0101t uzbruc\u0113jus, lai vi\u0146i m\u0113\u0123in\u0101tu ieiet uz\u0146\u0113muma t\u012bkl\u0101 un zagt v\u0113rt\u012bgus datus, k\u0101 ar\u012b papla\u0161in\u0101t t\u012bkla darb\u012bbas spektru. Honeypot (kas burtiski tulkojas k\u0101 \"medus mucas\") ir \u012bpa\u0161s serveris ar da\u017e\u0101du t\u012bkla pakalpojumu un protokolu komplektu, piem\u0113ram, HTTP, FTP u.c. (skat\u012bt att\u0113lu 1).<\/p>\n

\"Honeypot<\/p>\n

Ja apvienojam vair\u0101kus honeypots <\/strong>t\u012bklos, m\u0113s ieg\u016bstam efekt\u012bv\u0101ku sist\u0113mu honeynet<\/strong>, kas ir uz\u0146\u0113muma korporat\u012bv\u0101 t\u012bkla emul\u0101cija (web serveris, failu serveris u.c. t\u012bkla komponenti). \u0160\u0101ds risin\u0101jums \u013cauj izprast uzbruc\u0113ju r\u012bc\u012bbas strat\u0113\u0123iju un ievest vi\u0146us maldos. Tipisks honeynet parasti darbojas l\u012bdztekus darba t\u012bklam un ir piln\u012bgi neatkar\u012bgs no t\u0101. \u0160\u0101du \"t\u012bklu\" var public\u0113t internet\u0101 pa atsevi\u0161\u0137u kan\u0101lu, un tam var pie\u0161\u0137irt atsevi\u0161\u0137u IP adresu diapazonu (skat\u012bt att\u0113lu 2).<\/p>\n

\"Honeypot<\/p>\n

Honeynet izmanto\u0161anas j\u0113ga ir par\u0101d\u012bt hakerim, ka vi\u0146\u0161 it k\u0101 ir iek\u013cuvis uz\u0146\u0113muma korporat\u012bvaj\u0101 t\u012bkl\u0101, bet paties\u012bb\u0101 uzbruc\u0113js atrodas \"izol\u0113t\u0101 vid\u0113\" un tiek r\u016bp\u012bgi uzraudz\u012bts kiberdro\u0161\u012bbas speci\u0101listu (skat\u012bt att\u0113lu 3).<\/p>\n

\"Honeypot<\/p>\n

Te j\u0101piebilst ar\u012b par t\u0101du r\u012bku k\u0101 \"p\u0113tniec\u012bbas vide<\/strong>\" (angl., sandbox<\/strong>), kas \u013cauj uzbruc\u0113jiem instal\u0113t un palaist \u013caunpr\u0101t\u012bgas programmas izol\u0113t\u0101 vid\u0113, kur IT speci\u0101listi var izsekot vi\u0146u darb\u012bb\u0101m ar m\u0113r\u0137i identific\u0113t potenci\u0101los riskus un veikt nepiecie\u0161amos pretpas\u0101kumus. M\u016bsdien\u0101s parasti sandboxing tiek \u012bstenots atsevi\u0161\u0137\u0101s virtu\u0101l\u0101s ma\u0161\u012bn\u0101s virtu\u0101laj\u0101 host\u0101. Tom\u0113r j\u0101atz\u012bm\u0113, ka sandboxing r\u0101da tikai to, k\u0101 uzvedas b\u012bstamas un \u013caunpr\u0101t\u012bgas programmas, bet honeynet pal\u012bdz speci\u0101listiem analiz\u0113t \"b\u012bstamo dal\u012bbnieku\" uzved\u012bbu. <\/p>\n

Ac\u012bmredzam\u0101 honeynet izmanto\u0161ana ir t\u0101, ka t\u0101s maldina p\u0101rk\u0101p\u0113jus, izt\u0113r\u0113jot vi\u0146u sp\u0113kus, resursus un laiku. Rezult\u0101t\u0101 vi\u0146i nevis uzbr\u016bk re\u0101l\u0101m m\u0113r\u0137iem, bet gan mald\u012bgiem, un var p\u0101rtraukt uzbrukumu t\u012bklam, nekas nenotiekot. Visbie\u017e\u0101k honeynet tehnolo\u0123ijas tiek izmantotas vald\u012bbas iest\u0101d\u0113s un liel\u0101s korpor\u0101cij\u0101s, finan\u0161u organiz\u0101cij\u0101s, jo tie\u0161i \u0161\u012bs strukt\u016bras ir m\u0113r\u0137i lieliem kiberuzbrukumiem. Ta\u010du mazo un vid\u0113jo uz\u0146\u0113mumu (MVU) nepiecie\u0161amas efekt\u012bvas r\u012bkos incidentu nov\u0113r\u0161anai, bet honeynets MVU sektor\u0101 nav tik viegli izmantot kvalific\u0113tu speci\u0101listu tr\u016bkuma d\u0113\u013c \u0161\u0101da sare\u017e\u0123\u012bta darba veik\u0161anai.<\/p>\n

Honeypot un honeynets risin\u0101jumu ierobe\u017eojumi<\/u><\/strong><\/p>\n

K\u0101p\u0113c honeypots un honeynets nav lab\u0101kie risin\u0101jumi c\u012b\u0146ai pret uzbrukumiem m\u016bsdien\u0101s? J\u0101atz\u012bm\u0113, ka uzbrukumi k\u013c\u016bst arvien pla\u0161\u0101ki, tehniski sare\u017e\u0123\u012bt\u0101ki un sp\u0113j nodar\u012bt nopietnu kait\u0113jumu organiz\u0101cijas IT infrastrukt\u016brai, un kiberdeliktu noziedz\u012bba ir sasniegusi pavisam jaunu l\u012bmeni, kas ir augsti organiz\u0113ti \u0113nu biznesi ar visiem nepiecie\u0161amajiem resursiem. Tam j\u0101pievieno \"cilv\u0113ka faktors\" (programmat\u016bras un apr\u012bkojuma konfigur\u0101cijas k\u013c\u016bdas, iek\u0161\u0113jie darbinieki utt.), t\u0101p\u0113c \u0161obr\u012bd tikai tehnolo\u0123iju izmanto\u0161ana uzbrukumu nov\u0113r\u0161anai nav pietiekama. <\/p>\n

Zem\u0101k ir uzskait\u012bti galvenie honeypot (honeynets) ierobe\u017eojumi un tr\u016bkumi:<\/p>\n

    \n
  1. \n

    \"Honeypots\" s\u0101kotn\u0113ji tika izstr\u0101d\u0101ti, lai noteiktu draudus, kas atrodas \u0101rpus korporat\u012bv\u0101 t\u012bkla, un ir paredz\u0113ti vair\u0101k anal\u012bzei uzbruc\u0113ju uzved\u012bbai, nevis \u0101trai rea\u0123\u0113\u0161anai uz draudiem. <\/p>\n<\/li>\n

  2. \n

    Parasti uzbruc\u0113ji jau ir iem\u0101c\u012bju\u0161ies atpaz\u012bt emul\u0113t\u0101s sist\u0113mas un izvair\u012bties no honeypots. <\/p>\n<\/li>\n

  3. \n

    Honeynets (honeypots) ir \u0101rk\u0101rt\u012bgi zems interaktivit\u0101tes un mijiedarb\u012bbas l\u012bmenis ar cit\u0101m dro\u0161\u012bbas sist\u0113m\u0101m, t\u0101p\u0113c, izmantojot honeypots, ir gr\u016bti ieg\u016bt detaliz\u0113tu inform\u0101ciju par uzbrukumiem un uzbruc\u0113jiem, un l\u012bdz ar to ar\u012b efekt\u012bvi un \u0101tri rea\u0123\u0113t uz incidentiem. Turkl\u0101t kiberdro\u0161\u012bbas speci\u0101listi sa\u0146em lielu skaitu viltus br\u012bdin\u0101jumu par draudiem. <\/p>\n<\/li>\n

  4. \n

    Da\u017ereiz hakeri var izmantot kompromit\u0113tu honeypot k\u0101 pirmo punktu, lai turpin\u0101tu uzbrukumu organiz\u0101cijas t\u012bklam. <\/p>\n<\/li>\n

  5. \n

    Bie\u017ei rodas probl\u0113mas ar honeypot'iem, augstu operat\u012bvo slodzi un \u0161o sist\u0113mu konfigur\u0113\u0161anu (t\u0101m ir nepiecie\u0161ami augsti kvalific\u0113ti speci\u0101listi, t\u0101m nav \u0113rta vad\u012bbas saskarne u.tml.). Past\u0101v lielas gr\u016bt\u012bbas izplat\u012bt honeypot'us specializ\u0113t\u0101s vid\u0113s, piem\u0113ram, IoT, POS, m\u0101ko\u0146u sist\u0113m\u0101s u.tml.<\/p>\n<\/li>\n<\/ol>\n

    2. Deception tehnolo\u0123ija: priek\u0161roc\u012bbas un pamatprincipi<\/h2>\n

    Izp\u0113tot visas honeypot'iem rakstur\u012bg\u0101s priek\u0161roc\u012bbas un tr\u016bkumus, non\u0101kam pie secin\u0101juma, ka nepiecie\u0161ams piln\u012bgi jauns pieejas modelis incidentu p\u0101rvald\u012bb\u0101 kiberdro\u0161\u012bb\u0101, lai izstr\u0101d\u0101tu \u0101tru un adekv\u0101tu atbildi uz uzbruc\u0113ju darb\u012bb\u0101m. Un \u0161\u0101ds risin\u0101jums ir tehnolo\u0123ijas. Kiberdarbin\u0101\u0161anas (Security deception)<\/strong>. <\/p>\n

    Terminolo\u0123ija «Cyber deception», «Security deception», «Deception technology», «Distributed Deception Platform» (DDP) ir sal\u012bdzino\u0161i jauna un radusies ne tik sen. Faktiski visi \u0161ie termini noz\u012bm\u0113 \u00abkr\u0101p\u0161anas tehnolo\u0123iju\u00bb vai \u00abIT infrastrukt\u016bras imit\u0101cijas un maldin\u0101\u0161anas tehniku izmanto\u0161anu pretiniekiem\u00bb. Vienk\u0101r\u0161\u0101kie Deception risin\u0101jumi ir ideju att\u012bst\u012bba no honeypots, tikai tehnolo\u0123iski progres\u012bv\u0101k\u0101 l\u012bmen\u012b, kas paredz liel\u0101ku draudu atkl\u0101\u0161anas un rea\u0123\u0113\u0161anas automatiz\u0101ciju. Tom\u0113r tirg\u016b jau ir nopietni DDP klasei pieskait\u0101mi risin\u0101jumi, kas nodro\u0161ina vienk\u0101r\u0161u izvieto\u0161anu un m\u0113rogojam\u012bbu, k\u0101 ar\u012b satur nopietnu \u00ablazdu\u00bb un \u00abvilin\u0101jumu\u00bb arsen\u0101lu uzbruc\u0113jiem. Piem\u0113ram, Deception \u013cauj emul\u0113t t\u0101das IT infrastrukt\u016bras vien\u012bbas k\u0101 datu b\u0101zes, darba stacijas, mar\u0161rut\u0113t\u0101jus, sl\u0113d\u017eus, bankom\u0101tus, serverus un SCADA, medic\u012bnas iek\u0101rtas un IoT. <\/p>\n

    K\u0101 darbojas «Distributed Deception Platform»? P\u0113c DDP izvieto\u0161anas organiz\u0101cijas IT infrastrukt\u016bra tiks veidota it k\u0101 no diviem sl\u0101\u0146iem: pirmais sl\u0101nis ir uz\u0146\u0113muma re\u0101l\u0101 infrastrukt\u016bra, bet otrais sl\u0101nis ir \u00abemul\u0113ta\u00bb vide, kas sast\u0101v no lamat\u0101m (angl., decoys, traps) un vilin\u0101jumiem (angl., lures), kas izvietoti uz \u012bst\u0101m fizisk\u0101m t\u012bkla ier\u012bc\u0113m (skat. att. 4).<\/p>\n

    \"Honeypot<\/p>\n

    Piem\u0113ram, kibernoziegumnieks var atkl\u0101t viltus datu b\u0101zes ar \u201ekonfidenci\u0101liem dokumentiem\u201d, viltus piek\u013cuves datus apgalvotajiem \u201eprivili\u0123\u0113tajiem lietot\u0101jiem\u201d \u2014 viss tas ir maldino\u0161as m\u0113r\u0137i, kas var interes\u0113t p\u0101rk\u0101p\u0113jus, novirzot vi\u0146u uzman\u012bbu no patiesajiem uz\u0146\u0113muma inform\u0101cijas akt\u012bviem (skat\u012bt att. 5).<\/p>\n

    \"Honeypot<\/p>\n

    DDP ir jaunums dro\u0161\u012bbas produktu tirg\u016b, \u0161\u012bm risin\u0101jumiem ir tikai da\u017ei gadi, un pagaid\u0101m tos var at\u013cauties tikai korporat\u012bvais sektors. Ta\u010du mazais un vid\u0113jais bizness dr\u012bzum\u0101 var\u0113s izmantot Deception, iznom\u0101jot DDP no specializ\u0113tiem pakalpojumu sniedz\u0113jiem k\u0101 \u201epakalpojumu\u201d. \u0160\u0101ds variants ir pat izdev\u012bg\u0101ks, jo nav nepiecie\u0161ami savi augsti kvalific\u0113ti speci\u0101listi.<\/p>\n

    Zem\u0101k ir uzskait\u012btas Deception tehnolo\u0123ijas galven\u0101s priek\u0161roc\u012bbas:<\/p>\n