{"id":29861,"date":"2019-10-31T21:32:23","date_gmt":"2019-10-31T18:32:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/dlp-sistema-devicelock-8-2-dyryavyj-shtaketnik-na-strazhe-vashej-bezopasnosti\/"},"modified":"2019-10-31T21:32:23","modified_gmt":"2019-10-31T18:32:23","slug":"dlp-sistema-devicelock-8-2-dyryavyj-shtaketnik-na-strazhe-vashej-bezopasnosti","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/dlp-sistema-devicelock-8-2-dyryavyj-shtaketnik-na-strazhe-vashej-bezopasnosti","title":{"rendered":"Sistemul DLP DeviceLock 8.2 \u2014 o barier\u0103 perforat\u0103 pentru securitatea dumneavoastr\u0103","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00cen octombrie 2017, am avut ocazia s\u0103 particip la un seminar de promovare a sistemului DLP DeviceLock, unde, pe l\u00e2ng\u0103 func\u021bionalitatea principal\u0103 de protec\u021bie \u00eempotriva scurgerilor, cum ar fi blocarea porturilor USB, analiza contextului e-mailurilor \u0219i a clipboard-ului, a fost promovat\u0103 \u0219i protec\u021bia \u00eempotriva administratorului. Modelul este simplu \u0219i elegant \u2013 un instalator vine \u00een firma mic\u0103, instaleaz\u0103 un complex de programe, blocheaz\u0103 BIOS-ul, creeaz\u0103 un cont de administrator DeviceLock \u0219i las\u0103 administratorului local doar drepturile de gestionare a Windows-ului \u0219i a altor software-uri. Chiar \u0219i \u00een cazul unei inten\u021bii necorespunz\u0103toare, acest administrator nu poate fura nimic. Dar aceasta este doar teorie...
\n<\/a><\/noindex>
\n Av\u00e2nd \u00een vedere c\u0103, \u00een cei peste 20 de ani de activitate \u00een domeniul dezvolt\u0103rii de solu\u021bii de protec\u021bie a informa\u021biilor, am constatat cu claritate c\u0103 administratorul poate face orice, mai ales av\u00e2nd acces fizic la computer, principala protec\u021bie \u00eempotriva lui pot fi exclusiv m\u0103surile organizatorice, cum ar fi raportarea strict\u0103 \u0219i protec\u021bia fizic\u0103 a calculatoarelor care con\u021bin informa\u021bii importante, mi-a venit imediat \u00een minte ideea de a verifica rezisten\u021ba produsului propus.<\/p>\n

\u00cencercarea de a face asta imediat dup\u0103 seminar a e\u0219uat; protec\u021bia \u00eempotriva \u0219tergerii serviciului principal DlService.exe a fost realizat\u0103, iar drepturile de acces \u0219i selectarea ultimei configura\u021bii func\u021bionale nu au fost uitate, ceea ce a f\u0103cut imposibil s\u0103 fie distrus ca majoritatea viru\u0219ilor, interzic\u00e2nd sistemului accesul la citire \u0219i executare. <\/p>\n

La toate \u00eentreb\u0103rile despre protec\u021bia driverelor care, f\u0103r\u0103 \u00eendoial\u0103, sunt incluse \u00een produs, reprezentantul firmei dezvoltatoare Smart Line a declarat cu \u00eencredere c\u0103 \u201etotul este la acela\u0219i nivel\u201d.<\/p>\n

A doua zi, am decis s\u0103 continui cercet\u0103rile, am desc\u0103rcat versiunea de prob\u0103. M-a surprins imediat dimensiunea pachetului, aproape 2 GB! M-am obi\u0219nuit ca software-ul de sistem, la care se face referire ca solu\u021bii de protec\u021bie a informa\u021biilor (SPI), de obicei s\u0103 aib\u0103 o dimensiune mult mai compact\u0103.<\/p>\n

Dup\u0103 instalare, m-am surprins pentru a doua oar\u0103 \u2013 dimensiunea men\u021bionat\u0103 a fi\u0219ierului executabil era de asemenea destul de mare \u2013 13 MB. M-am g\u00e2ndit imediat c\u0103, av\u00e2nd un asemenea volum, exist\u0103 lucruri de explorat. Am \u00eencercat s\u0103 substitui modulul prin \u00eenregistrare \u00eent\u00e2rziat\u0103 \u2013 \u00eenchis. Am r\u0103sfoit prin directoarele programului \u0219i am descoperit c\u0103 erau nu mai pu\u021bin de 11 drivere! Am verificat permisiunile \u2013 nu erau restric\u021bionate pentru modificare! Ei bine, toat\u0103 lumea prime\u0219te interdic\u021bii, trebuie s\u0103 restart\u0103m!<\/p>\n

Efectul este pur \u0219i simplu spectaculos - toate func\u021biile s-au oprit, serviciul nu a pornit. Ce auto-ap\u0103rare, ia \u0219i copiaz\u0103 ce vrei, fie pe flash-uri, fie prin re\u021bea. A ap\u0103rut prima problem\u0103 serioas\u0103 a sistemului - interdependen\u021ba prea mare a componentelor. Da, serviciul ar trebui s\u0103 comunice cu driverele, dar de ce ar c\u0103dea, dac\u0103 nimeni nu r\u0103spunde? \u00cen final, exist\u0103 o metod\u0103 de ocolire a protec\u021biei.<\/p>\n

Dup\u0103 ce am descoperit c\u0103 acest serviciu este at\u00e2t de delicat \u0219i sensibil, am decis s\u0103 verific dependen\u021bele sale de bibliotecile externe. Aici este \u0219i mai simplu, lista este mare, \u0219tergem pur \u0219i simplu biblioteca WinSock_II \u0219i observ\u0103m aceea\u0219i imagine - serviciul nu a pornit, sistemul este deschis.<\/p>\n

\u00cen rezultat, avem ceea ce a descris vorbitorul la seminar, un gard puternic, dar care nu \u00eenconjoar\u0103 \u00eentreaga zon\u0103 protejat\u0103 din cauza lipsei de bani, iar pe por\u021biunea neacoperit\u0103, pur \u0219i simplu, un m\u0103r\u0103cin. \u00cen acest caz, av\u00e2nd \u00een vedere arhitectura produsului software, care presupune un mediu nu \u00eenchis implicit, ci o mul\u021bime de diverse dopuri, interceptoare, analizatori de trafic, mai degrab\u0103 este un gard de pl\u0103ci, iar multe dintre acestea sunt prinse cu \u0219uruburi pe exterior \u0219i pot fi foarte u\u0219or desf\u0103cute. Problemele celor mai multe solu\u021bii de acest gen constau \u00een faptul c\u0103, \u00eentr-un volum at\u00e2t de mare de posibile bre\u0219e, exist\u0103 \u00eentotdeauna riscul de a uita ceva, de a pierde o interdependen\u021b\u0103 sau de a afecta stabilitatea implement\u00e2nd prost unul dintre interceptoare. Judec\u00e2nd dup\u0103 faptul c\u0103 vulnerabilit\u0103\u021bile prezentate \u00een acest articol sunt la suprafa\u021b\u0103, produsul con\u021bine \u0219i multe altele, al c\u0103ror c\u0103utare dureaz\u0103 cu c\u00e2teva ore mai mult.<\/p>\n

Pe pia\u021b\u0103 exist\u0103 multe exemple de implement\u0103ri corecte ale protec\u021biei \u00eempotriva deconect\u0103rii, de exemplu, solu\u021biile antivirus autohtone, unde auto-ap\u0103rarea nu poate fi ocolit\u0103 at\u00e2t de u\u0219or. Din c\u00e2te \u0219tiu, nu s-au obosit s\u0103 ob\u021bin\u0103 certificatul FSTEC.<\/p>\n

Dup\u0103 c\u00e2teva discu\u021bii cu angaja\u021bii Smart Line, au fost g\u0103site c\u00e2teva locuri similare despre care ei nici m\u0103car nu au auzit. Un exemplu este mecanismul ArrInitDll.<\/p>\n

De\u0219i nu este cel mai profund, permite \u00een multe cazuri s\u0103 evit\u0103m intrarea \u00een nucleul sistemului de operare \u0219i s\u0103 nu afect\u0103m stabilitatea acestuia. Driverele nVidia folosesc pe deplin acest mecanism pentru a ajusta adaptorul grafic la un anumit joc. <\/p>\n

Ridic\u0103 \u00eentreb\u0103ri absen\u021ba complet\u0103 a unei abord\u0103ri integrate pentru construirea unui sistem automatizat pe baza DL 8.2. Se propune s\u0103 se contureze clientului avantajele produsului, s\u0103 se verifice puterea de calcul a PC-urilor existente \u0219i servere<\/a> (analizatorii contextuali sunt destul de consumatori de resurse, iar monitoarele \u0219i nettop-urile office bazate pe Atom nu sunt potrivite \u00een acest caz) \u0219i pur \u0219i simplu s\u0103 se instaleze produsul deasupra. \u00cen acest context, termeni precum \u201erestric\u021bionarea accesului\u201d, \u201emediu software \u00eenchis\u201d nu au fost men\u021biona\u021bi la seminar. Despre criptare s-a spus c\u0103, pe l\u00e2ng\u0103 complexitate, va ridica \u00eentreb\u0103ri din partea reglementatorilor, de\u0219i \u00een realitate nu exist\u0103 probleme \u00een acest sens. \u00centreb\u0103rile despre certificare sunt respinse chiar \u0219i \u00een FSTEK din cauza presupusei lor complexit\u0103\u021bi \u0219i dureaz\u0103 prea mult. Ca specialist \u00een securitate informa\u021bional\u0103, care a participat de nenum\u0103rate ori la astfel de proceduri, pot spune c\u0103 \u00een timpul desf\u0103\u0219ur\u0103rii lor se identific\u0103 multe vulnerabilit\u0103\u021bi, similare cu cele descrise \u00een acest material, deoarece speciali\u0219tii din laboratoarele de certificare au o preg\u0103tire serioas\u0103 \u00een domeniu.<\/p>\n

\u00cen cele din urm\u0103, sistemul DLP prezentat poate efectua un set foarte limitat de func\u021bii, care asigur\u0103 efectiv securitatea informa\u021bional\u0103, gener\u00e2nd \u00een acela\u0219i timp o sarcin\u0103 computa\u021bional\u0103 serioas\u0103 \u0219i cre\u00e2nd o senza\u021bie de securitate a datelor corporative \u00een r\u00e2ndul conducerii companiei, care nu este familiarizat\u0103 cu problemele de securitate informa\u021bional\u0103.<\/p>\n

\u00cen realitate, acesta poate proteja doar datele mari de utilizatorii neprivilegia\u021bi, deoarece administratorul este capabil s\u0103 dezactiveze complet protec\u021bia, iar pentru datele nesemnificative, chiar \u0219i un manager junior de cur\u0103\u021benie ar putea s\u0103-\u0219i aduc\u0103 aminte discret de un num\u0103r de card sau un alt detaliu, arunc\u00e2nd o privire peste um\u0103rul unui coleg.
\n\u00cen plus, toate acestea sunt valabile doar \u00een cazul \u00een care angaja\u021bii nu au acces fizic la interiorul PC-ului sau m\u0103car la BIOS pentru a activa \u00eenc\u0103rcarea de pe medii externe. Atunci, chiar \u0219i BitLocker poate s\u0103 nu ajute, care este pu\u021bin probabil s\u0103 fie utilizat \u00een firmele care abia \u00eencep s\u0103 se g\u00e2ndeasc\u0103 la protejarea informa\u021biilor.<\/p>\n

Concluzia, oric\u00e2t de banal ar suna, este c\u0103 abordarea complex\u0103 a securit\u0103\u021bii informa\u021biilor trebuie s\u0103 includ\u0103 nu doar solu\u021bii software\/hardware, ci \u0219i m\u0103suri organizatorice \u0219i tehnice pentru a excluziona fotografierea sau filmarea \u0219i a \u00eempiedica accesul persoanelor neautorizate, \u201eb\u0103ie\u021bi cu o memorie fenomenal\u0103\u201d pe amplasament. Nu trebuie s\u0103 ne baz\u0103m niciodat\u0103 pe produsul miracol DL 8.2, promovat ca o solu\u021bie unic\u0103 pentru majoritatea problemelor de securitate ale \u00eentreprinderii.<\/p>\n

Sursa: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u043e\u043a\u0442\u044f\u0431\u0440\u0435 2017 \u0433\u043e\u0434\u0430 \u0434\u043e\u0432\u0435\u043b\u043e\u0441\u044c \u043f\u043e\u0431\u044b\u0432\u0430\u0442\u044c \u043d\u0430 \u0440\u0435\u043a\u043b\u0430\u043c\u043d\u043e\u043c \u0441\u0435\u043c\u0438\u043d\u0430\u0440\u0435 DLP-\u0441\u0438\u0441\u0442\u0435\u043c\u044b DeviceLock, \u0433\u0434\u0435 \u043f\u043e\u043c\u0438\u043c\u043e \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0433\u043e \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0443\u0442\u0435\u0447\u0435\u043a \u0442\u0438\u043f\u0430 \u0437\u0430\u043a\u0440\u044b\u0442\u0438\u044f USB-\u043f\u043e\u0440\u0442\u043e\u0432, \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u043d\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u043e\u0447\u0442\u044b \u0438 \u0431\u0443\u0444\u0435\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 \u0440\u0435\u043a\u043b\u0430\u043c\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c \u0437\u0430\u0449\u0438\u0442\u0430 \u043e\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430. \u041c\u043e\u0434\u0435\u043b\u044c \u043f\u0440\u043e\u0441\u0442\u0430\u044f \u0438 \u043a\u0440\u0430\u0441\u0438\u0432\u0430\u044f \u2014 \u0432 \u043c\u0430\u043b\u0435\u043d\u044c\u043a\u0443\u044e \u0444\u0438\u0440\u043c\u0443 \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0449\u0438\u043a, \u0441\u0442\u0430\u0432\u0438\u0442 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043f\u0430\u0440\u043e\u043b\u0438\u0442 \u0411\u0418\u041e\u0421, \u0441\u043e\u0437\u0434\u0430\u0435\u0442 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0441\u043a\u0443\u044e \u0443\u0447\u0435\u0442\u043a\u0443 DeviceLock, \u0430 \u043c\u0435\u0441\u0442\u043d\u043e\u043c\u0443 \u0430\u0434\u043c\u0438\u043d\u0443 \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[],"class_list":["post-29861","post","type-post","status-publish","format-standard","hentry","category-blog"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sistemul DLP DeviceLock 8.2 \u2014 un gard perforat care protejeaz\u0103 securitatea dumneavoastr\u0103 | ProHoster","description":"\u00cen octombrie 2017, am avut oportunitatea de a participa la un seminar de publicitate al sistemului DLP DeviceLock, unde, pe l\u00e2ng\u0103 func\u021bionalit\u0103\u021bile principale de protec\u021bie \u00eempotriva scurgerilor de informa\u021bii, cum ar fi \u00eenchiderea porturilor USB, analiza contextual\u0103 a e-mailurilor \u0219i a clipboard-ului, au fost promovate.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/dlp-sistema-devicelock-8-2-dyryavyj-shtaketnik-na-strazhe-vashej-bezopasnosti","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47DLP-\u0441\u0438\u0441\u0442\u0435\u043c\u0430 DeviceLock 8.2 \u2014 \u0434\u044b\u0440\u044f\u0432\u044b\u0439 \u0448\u0442\u0430\u043a\u0435\u0442\u043d\u0438\u043a \u043d\u0430 \u0441\u0442\u0440\u0430\u0436\u0435 \u0432\u0430\u0448\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 | ProHoster","og:description":"\u0412 \u043e\u043a\u0442\u044f\u0431\u0440\u0435 2017 \u0433\u043e\u0434\u0430 \u0434\u043e\u0432\u0435\u043b\u043e\u0441\u044c \u043f\u043e\u0431\u044b\u0432\u0430\u0442\u044c \u043d\u0430 \u0440\u0435\u043a\u043b\u0430\u043c\u043d\u043e\u043c \u0441\u0435\u043c\u0438\u043d\u0430\u0440\u0435 DLP-\u0441\u0438\u0441\u0442\u0435\u043c\u044b DeviceLock, \u0433\u0434\u0435 \u043f\u043e\u043c\u0438\u043c\u043e \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0433\u043e \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0443\u0442\u0435\u0447\u0435\u043a \u0442\u0438\u043f\u0430 \u0437\u0430\u043a\u0440\u044b\u0442\u0438\u044f USB-\u043f\u043e\u0440\u0442\u043e\u0432, \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u043d\u043e\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u043f\u043e\u0447\u0442\u044b \u0438 \u0431\u0443\u0444\u0435\u0440\u0430 \u043e\u0431\u043c\u0435\u043d\u0430 \u0440\u0435\u043a\u043b\u0430\u043c\u0438\u0440\u043e\u0432\u0430\u043b\u0430\u0441\u044c.","og:url":"https:\/\/prohoster.info\/ro\/blog\/dlp-sistema-devicelock-8-2-dyryavyj-shtaketnik-na-strazhe-vashej-bezopasnosti","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:32:23+00:00","article:modified_time":"2019-10-31T18:32:23+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"29861","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-02-09 16:53:14","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:47:35","updated":"2026-02-09 16:53:14","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/29861","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=29861"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/29861\/revisions"}],"predecessor-version":[{"id":158524,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/29861\/revisions\/158524"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=29861"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=29861"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=29861"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}