{"id":81884,"date":"2020-05-17T13:42:18","date_gmt":"2020-05-17T11:42:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity"},"modified":"2020-05-17T13:42:18","modified_gmt":"2020-05-17T11:42:18","slug":"bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","title":{"rendered":"Securitate \u0219i SGBD: ce trebuie s\u0103 re\u021bine\u021bi atunci c\u00e2nd alege\u021bi mijloacele de protec\u021bie","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<h1><img decoding=\"async\" alt=\"Securitate \u0219i SGBD: ce trebuie s\u0103 re\u021bine\u021bi atunci c\u00e2nd alege\u021bi mijloacele de protec\u021bie\" src=\"\/wp-content\/uploads\/2020\/05\/ac49253838e36336af127d71394139d8.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/h1>\n<p>\nM\u0103 numesc Denis Ro\u0219cov, sunt \u0219eful dezvolt\u0103rii software la compania \u201eGazinformservis\u201d, \u00een echipa de produs. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.gaz-is.ru\/produkty\/inform-sistemy\/subd-jatoba.html\">Jatoba<\/a><\/noindex>. Legisla\u021bia \u0219i normele corporative impun anumite cerin\u021be pentru securitatea stoc\u0103rii datelor. Nimeni nu \u00ee\u0219i dore\u0219te ca ter\u021be p\u0103r\u021bi s\u0103 aib\u0103 acces la informa\u021bii confiden\u021biale, a\u0219a c\u0103 pentru orice proiect sunt importante urm\u0103toarele \u00eentreb\u0103ri: identificarea \u0219i autentificarea, gestionarea accesului la date, asigurarea integrit\u0103\u021bii informa\u021biilor \u00een sistem, \u00eenregistrarea evenimentelor de securitate. Prin urmare, vreau s\u0103 \u00eemp\u0103rt\u0103\u0219esc c\u00e2teva aspecte interesante legate de securitatea SGBD-ului. <br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nArticolul a fost preg\u0103tit pe baza unei prezent\u0103ri la <noindex><a rel=\"nofollow\" href=\"https:\/\/corp.mail.ru\/ru\/press\/events\/databases-1\/\">@Databases Meetup,<\/a><\/noindex> organizat\u0103 <noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/\">Solu\u021bii Cloud Mail.ru<\/a><\/noindex>. Dac\u0103 nu dori\u021bi s\u0103 citi\u021bi, pute\u021bi viziona:<\/p>\n<p><center><div class=\"youtube-placeholder\" data-id=\"n-54j9FHaMU\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/n-54j9FHaMU\/hqdefault.jpg\" alt=\"Reda\u021bi video\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><br \/>\nArticolul va con\u021bine trei p\u0103r\u021bi:<\/p>\n<ul>\n<li>Cum s\u0103 protejezi conexiunile.<\/li>\n<li>Ce este auditul ac\u021biunilor \u0219i cum s\u0103 \u00eenregistrezi ce se \u00eent\u00e2mpl\u0103 din partea bazei de date \u0219i a conexiunii la aceasta.<\/li>\n<li>Cum s\u0103 protejezi datele din baza de date \u00een sine \u0219i ce tehnologii exist\u0103 pentru aceasta.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Securitate \u0219i SGBD: ce trebuie s\u0103 re\u021bine\u021bi atunci c\u00e2nd alege\u021bi mijloacele de protec\u021bie\" src=\"\/wp-content\/uploads\/2020\/05\/fbdca7f4a925b9ceb78de06c6e245b23.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Cele trei componente ale securit\u0103\u021bii SGBD-ului: protec\u021bia conexiunilor, auditul ac\u021biunilor \u0219i protec\u021bia datelor.<\/i><\/p>\n<h2>Protec\u021bia conexiunilor<\/h2>\n<p>\nConectarea la baza de date se poate face at\u00e2t direct, c\u00e2t \u0219i indirect prin aplica\u021bii web. De obicei, utilizatorul din partea afacerii, adic\u0103 persoana care lucreaz\u0103 cu SGBD-ul, interac\u021bioneaz\u0103 cu acesta nu direct.<\/p>\n<p>\u00cenainte de a discuta despre protec\u021bia conexiunilor, trebuie s\u0103 r\u0103spundem la \u00eentreb\u0103ri importante, de la care depinde cum vor fi structurate m\u0103surile de securitate:<\/p>\n<ul>\n<li>este echivalent un utilizator de afaceri cu un utilizator al SGBD-ului;<\/li>\n<li>accesul la datele SGBD-ului este asigurat doar prin API-ul pe care \u00eel controlezi, sau exist\u0103 acces direct la tabele;<\/li>\n<li>SGBD-ul este izolat \u00eentr-un segment protejat, cine \u0219i cum interac\u021bioneaz\u0103 cu acesta;<\/li>\n<li>se folose\u0219te pooling\/proxy \u0219i straturi intermediare care pot modifica informa\u021biile despre cum este structurat conectarea \u0219i cine utilizeaz\u0103 baza de date.<\/li>\n<\/ul>\n<p>\nAcum s\u0103 vedem ce instrumente pot fi aplicate pentru protec\u021bia conexiunilor:<\/p>\n<ol>\n<li>Utiliza\u021bi solu\u021bii de tip firewall pentru baze de date. Un strat suplimentar de protec\u021bie, cel pu\u021bin, va cre\u0219te transparen\u021ba a ceea ce se \u00eent\u00e2mpl\u0103 \u00een SGBD, la maximum \u2014 ve\u021bi putea oferi o protec\u021bie suplimentar\u0103 a datelor.<\/li>\n<li>Utiliza\u021bi politicile de parol\u0103. Aplicarea acestora depinde de modul \u00een care este construit\u0103 arhitectura dumneavoastr\u0103. \u00cen orice caz, o singur\u0103 parol\u0103 \u00een fi\u0219ierul de configurare al aplica\u021biei web, care se conecteaz\u0103 la baza de date, nu este suficient\u0103 pentru protec\u021bie. Exist\u0103 o serie de instrumente pentru baze de date care permit controlul asupra faptului c\u0103 utilizatorul \u0219i parola necesit\u0103 actualizare.\n<p>Pute\u021bi citi mai multe despre func\u021biile de evaluare a utilizatorilor <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.cloud.oracle.com\/en-us\/iaas\/data-safe\/doc\/user-assessment-reports.html\">aici<\/a><\/noindex>, de asemenea, pute\u021bi afla despre MS SQL Vulnerability Assessment <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.microsoft.com\/en-us\/sql\/relational-databases\/security\/sql-vulnerability-assessment?view=sql-server-ver15\">aici<\/a><\/noindex>.\u00a0<\/li>\n<li>\u00cembog\u0103\u021bi\u021bi contextul sesiunii cu informa\u021biile necesare. Dac\u0103 sesiunea nu este transparent\u0103, nu \u00een\u021belege\u021bi cine lucreaz\u0103 \u00een cadrul acesteia \u00een baza de date; pute\u021bi completa informa\u021biile despre cine, ce \u0219i de ce face, \u00een cadrul opera\u021biunii efectuate. Aceste informa\u021bii pot fi v\u0103zute \u00een audit.<\/li>\n<li>Configura\u021bi SSL dac\u0103 nu ave\u021bi o separare a re\u021belei database de utilizatorii finali, nu este \u00eentr-un VLAN separat. \u00cen astfel de cazuri, este esen\u021bial s\u0103 proteja\u021bi canalul \u00eentre consumator \u0219i baza de date \u00eens\u0103\u0219i. Exist\u0103 instrumente de protec\u021bie, inclusiv \u00eentre cele open source.<\/li>\n<\/ol>\n<p><\/p>\n<h3>Cum va afecta aceasta performan\u021ba bazei de date?<\/h3>\n<p>\nS\u0103 ne uit\u0103m la exemplul PostgreSQL pentru a observa cum SSL influen\u021beaz\u0103 \u00eenc\u0103rcarea CPU, cre\u0219terea timpurilor de reac\u021bie \u0219i sc\u0103derea TPS, pentru a verifica dac\u0103 nu se vor consuma prea multe resurse atunci c\u00e2nd este activat.<\/p>\n<p>\u00cenc\u0103rc\u0103m PostgreSQL folosind pgbench - acesta este un program simplu pentru rularea testelor de performan\u021b\u0103. Acesta execut\u0103 repetat o secven\u021b\u0103 de comenzi, posibil \u00een sesiuni paralele ale bazei de date, \u0219i apoi calculeaz\u0103 viteza medie a tranzac\u021biilor.<\/p>\n<p><strong>Test 1 f\u0103r\u0103 SSL \u0219i cu utilizarea SSL<\/strong> \u2014 conexiunea este stabilit\u0103 la fiecare tranzac\u021bie:<\/p>\n<pre><code class=\"plaintext\">pgbench.exe --connect -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres sslmode=require\nsslrootcert=rootCA.crt sslcert=client.crt sslkey=client.key\"<\/code><\/pre>\n<p>\n<strong>vs<\/strong><\/p>\n<pre><code class=\"plaintext\">pgbench.exe --connect -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres\"<\/code><\/pre>\n<p>\n<strong>Test 2 f\u0103r\u0103 SSL \u0219i cu utilizarea SSL<\/strong> \u2014 toate tranzac\u021biile sunt efectuate \u00eentr-o singur\u0103 conexiune:<\/p>\n<pre><code class=\"plaintext\">pgbench.exe -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres sslmode=require\nsslrootcert=rootCA.crt sslcert=client.crt sslkey=client.key\"<\/code><\/pre>\n<p>\n<strong>vs<\/strong><\/p>\n<pre><code class=\"plaintext\">pgbench.exe -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres\"<\/code><\/pre>\n<p>\n<strong>Alte set\u0103ri<\/strong>:<\/p>\n<pre><code class=\"plaintext\">factori de scalare: 1\nmod de interogare: simplu\nnum\u0103r de clien\u021bi: 10\nnum\u0103r de fire: 1\nnum\u0103r de tranzac\u021bii per client: 5000\nnum\u0103r de tranzac\u021bii efectiv procesate: 50000\/50000<\/code><\/pre>\n<p>\n<strong>Rezultatele test\u0103rii<\/strong>:<\/p>\n<p>\u00a0<br \/>\n<strong>F\u0102R\u0102 SSL<\/strong><br \/>\n<strong>SSL<\/strong><\/p>\n<p><strong>Conexiunea este stabilit\u0103 la fiecare tranzac\u021bie<\/strong><\/p>\n<p>latency medie<br \/>\n171.915 ms<br \/>\n187.695 ms<\/p>\n<p>tps inclusiv stabilirea conexiunilor<br \/>\n58.168112<br \/>\n53.278062<\/p>\n<p>tps excluz\u00e2nd stabilirea conexiunilor<br \/>\n64.084546<br \/>\n58.725846<\/p>\n<p>CPU<br \/>\n24%<br \/>\n28%<\/p>\n<p><strong>Toate tranzac\u021biile sunt efectuate \u00eentr-o singur\u0103 conexiune<\/strong><\/p>\n<p>latency medie<br \/>\n6.722 ms<br \/>\n6.342 ms<\/p>\n<p>tps inclusiv stabilirea conexiunilor<br \/>\n1587.657278<br \/>\n1576.792883<\/p>\n<p>tps excluz\u00e2nd stabilirea conexiunilor<br \/>\n1588.380574<br \/>\n1577.694766<\/p>\n<p>CPU<br \/>\n17%<br \/>\n21%<\/p>\n<p>\n\u00cen cazul unor sarcini mici, influen\u021ba SSL este comparabil\u0103 cu eroarea de m\u0103surare. Dac\u0103 volumul de date transmise este foarte mare, situa\u021bia poate fi diferit\u0103. Dac\u0103 stabilim o conexiune pentru fiecare tranzac\u021bie (ceea ce se \u00eent\u00e2mpl\u0103 rar, de obicei conexiunea este partajat\u0103 \u00eentre utilizatori), ave\u021bi un num\u0103r mare de conect\u0103ri\/deconect\u0103ri, influen\u021ba poate fi pu\u021bin mai mare. Asta \u00eenseamn\u0103 c\u0103 exist\u0103 riscuri de sc\u0103dere a performan\u021bei, \u00eens\u0103 diferen\u021ba nu este at\u00e2t de mare \u00eenc\u00e2t s\u0103 nu se foloseasc\u0103 protec\u021bia.<\/p>\n<p>Re\u021bine\u021bi c\u0103 exist\u0103 o diferen\u021b\u0103 semnificativ\u0103 atunci c\u00e2nd compar\u0103m modurile de operare: \u00een cadrul unei sesiuni lucra\u021bi sau \u00een sesiuni diferite. Acest lucru este evident: resurse sunt consumate pentru crearea fiec\u0103rei conexiuni.<\/p>\n<p>Am avut un caz \u00een care am conectat Zabbix \u00een modul trust, adic\u0103 nu am verificat md5, nu a fost necesar\u0103 autentificarea. Apoi clientul a solicitat activarea modului de autentificare md5. Acesta a generat o mare sarcin\u0103 pe CPU, iar performan\u021ba a sc\u0103zut. Am c\u0103utat solu\u021bii de optimizare. Una dintre posibilele solu\u021bii ale problemei este implementarea unei restric\u021bii de re\u021bea, crearea unor VLAN-uri separate pentru SGBD, ad\u0103ugarea de set\u0103ri pentru a \u00een\u021belege cine \u0219i de unde se conecteaz\u0103 \u0219i eliminarea autentific\u0103rii. De asemenea, se pot optimiza set\u0103rile de autentificare pentru a reduce costurile \u00een activarea autentific\u0103rii, dar \u00een general utilizarea diverselor metode de autentificare influen\u021beaz\u0103 performan\u021ba \u0219i necesit\u0103 s\u0103 \u021binem cont de ace\u0219ti factori \u00een proiectarea puterii de calcul a serverelor (hardware) pentru SGBD.<\/p>\n<p>Concluzie: \u00een unele solu\u021bii, chiar \u0219i nuan\u021bele minore \u00een autentificare pot influen\u021ba semnificativ proiectul \u0219i este r\u0103u c\u00e2nd acest lucru devine evident doar \u00een timpul implement\u0103rii \u00een produc\u021bie.<\/p>\n<h2>Auditoriatul ac\u021biunilor<\/h2>\n<p>\nAuditoriatul nu poate fi doar pentru SGBD. Auditoriatul este ob\u021binerea de informa\u021bii despre ceea ce se \u00eent\u00e2mpl\u0103 \u00een diferite segmente. Acesta poate fi \u0219i un firewall de baz\u0103 de date, \u0219i sistemul de operare pe care se construie\u0219te SGBD-ul.<\/p>\n<p>\u00cen SGBD-urile comerciale de nivel Enterprise, auditoriatul este bine implementat, \u00een open source \u2013 nu \u00eentotdeauna. Iat\u0103 ce exist\u0103 \u00een PostgreSQL:<\/p>\n<ul>\n<li>logul implicit \u2013 logare \u00eencorporat\u0103;<\/li>\n<li>extensii: pgaudit \u2013 dac\u0103 v\u0103 lipsesc func\u021biile de logare implicite, pute\u021bi utiliza set\u0103ri separate care rezolv\u0103 parte din probleme.<\/li>\n<\/ul>\n<p>\n<b>Complemet la raport \u00een video:<\/b><\/p>\n<p>\u00cenregistrarea de baz\u0103 a operatorilor poate fi asigurat\u0103 printr-un instrument standard de \u00eenregistrare cu log_statement = all.<\/p>\n<p>Aceasta este acceptabil\u0103 pentru monitorizare \u0219i alte utiliz\u0103ri, dar nu ofer\u0103 nivelul de detaliere de care are nevoie de obicei un audit.<\/p>\n<p>Nu este suficient s\u0103 ai o list\u0103 cu toate opera\u021biunile efectuate asupra bazei de date.<\/p>\n<p>De asemenea, ar trebui s\u0103 existe posibilitatea de a g\u0103si afirma\u021biile specifice care sunt de interes pentru auditor.<\/p>\n<p>Instrumentul standard de \u00eenregistrare arat\u0103 ceea ce a solicitat utilizatorul, \u00een timp ce pgAudit se concentreaz\u0103 pe detaliile a ceea ce s-a \u00eent\u00e2mplat atunci c\u00e2nd baza de date a executat cererea.<\/p>\n<p>De exemplu, auditorul ar putea dori s\u0103 se asigure c\u0103 o tabel\u0103 specific\u0103 a fost creat\u0103 \u00eentr-o fereastr\u0103 de \u00eentre\u021binere documentat\u0103.<\/p>\n<p>Aceasta poate p\u0103rea o sarcin\u0103 simpl\u0103 pentru un audit de baz\u0103 \u0219i grep, dar ce se \u00eent\u00e2mpl\u0103 dac\u0103 prime\u0219ti ceva asem\u0103n\u0103tor (intentionally confuz) exemplului:<\/p>\n<p>DO $$<br \/>\nBEGIN<br \/>\n EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)';<br \/>\nEND $$;<\/p>\n<p>\u00cenregistrarea standard \u00ee\u021bi va oferi aceasta:<\/p>\n<p>LOG: statement: DO $$<br \/>\nBEGIN<br \/>\n EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)';<br \/>\nEND $$;<\/p>\n<p>Pare c\u0103 pentru a g\u0103si tabela de interes ar putea fi necesare cuno\u0219tin\u021be de cod \u00een cazurile \u00een care tabelele sunt create dinamic.<\/p>\n<p>Acest lucru nu este ideal, deoarece ar fi preferabil s\u0103 cau\u021bi pur \u0219i simplu dup\u0103 numele tabelei.<\/p>\n<p>Aici pgAudit va fi util.<\/p>\n<p>Pentru aceea\u0219i intrare, acesta va genera urm\u0103toarea ie\u0219ire \u00een jurnal:<\/p>\n<p>AUDIT: SESSION,33,1,FUNCTION,DO,,,\u00abDO $$<br \/>\nBEGIN<br \/>\n EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)';<br \/>\nEND $$;\"<br \/>\nAUDIT: SESSION,33,2,DDL,CREATE TABLE,TABLE,public.important_table,CREATE TABLE important_table (id INT)<\/p>\n<p>Se \u00eenregistreaz\u0103 nu doar blocul DO, ci \u0219i textul complet CREATE TABLE cu tipul de operator, tipul de obiect \u0219i numele complet, ceea ce faciliteaz\u0103 c\u0103utarea.<\/p>\n<p>\u00cenregistr\u00e2nd operatorii SELECT \u0219i DML, pgAudit poate fi configurat pentru a \u00eenregistra o intrare separat\u0103 pentru fiecare rela\u021bie la care se face referire \u00een operator.<\/p>\n<p>Nu este necesar\u0103 analiza sintaxei pentru a g\u0103si to\u021bi operatorii care se refer\u0103 la o tabel\u0103 specific\u0103 (<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/pgaudit\/pgaudit\/blob\/master\/README.md\">*<\/a><\/noindex>)\u00bb.<\/p>\n<h3>Cum va afecta aceasta performan\u021ba bazei de date?<\/h3>\n<p>\nS\u0103 facem teste cu activarea auditului complet \u0219i s\u0103 vedem ce se va \u00eent\u00e2mpla cu performan\u021ba PostgreSQL. Vom activa logarea maxim\u0103 a bazei de date pentru toate parametrii.<\/p>\n<p>\u00cen fi\u0219ierul de configurare nu schimb\u0103m aproape nimic, din ce este important \u2013 activ\u0103m modul debug5 pentru a ob\u021bine cele mai multe informa\u021bii.<\/p>\n<p>postgresql.conf<\/p>\n<p>log_destination = 'stderr'<br \/>\nlogging_collector = on<br \/>\nlog_truncate_on_rotation = on<br \/>\nlog_rotation_age = 1d<br \/>\nlog_rotation_size = 10MB<br \/>\nlog_min_messages = <strong>debug5<\/strong><br \/>\nlog_min_error_statement = <strong>debug5<\/strong><br \/>\nlog_min_duration_statement = 0<br \/>\ndebug_print_parse = on<br \/>\ndebug_print_rewritten = on<br \/>\ndebug_print_plan = on<br \/>\ndebug_pretty_print = on<br \/>\nlog_checkpoints = on<br \/>\nlog_connections = on<br \/>\nlog_disconnections = on<br \/>\nlog_duration = on<br \/>\nlog_hostname = on<br \/>\nlog_lock_waits = on<br \/>\nlog_replication_commands = on<br \/>\nlog_temp_files = 0<br \/>\nlog_timezone = 'Europe\/Moscow'<\/p>\n<p>\nPe baza SGBD PostgreSQL cu parametrii 1 CPU, 2,8 GHz, 2 GB RAM, 40 GB HDD, se efectueaz\u0103 trei teste de stres folosind comenzile:<\/p>\n<pre><code class=\"plaintext\">$ pgbench -p 3389 -U postgres -i -s 150 benchmark\n$ pgbench -p 3389 -U postgres -c 50 -j 2 -P 60 -T 600 benchmark\n$ pgbench -p 3389 -U postgres -c 150 -j 2 -P 60 -T 600 benchmark<\/code><\/pre>\n<p>\n<strong>Rezultatele test\u0103rii:<\/strong><\/p>\n<p><strong>F\u0103r\u0103 logare<\/strong><br \/>\n<strong>Cu logare<\/strong><\/p>\n<p>Timpul total de umplere a bazei de date<br \/>\n43,74 sec<br \/>\n53,23 sec<\/p>\n<p>RAM<br \/>\n24%<br \/>\n40%<\/p>\n<p>CPU<br \/>\n72%<br \/>\n91%<\/p>\n<p><strong>Test 1 (50 conexiuni)<\/strong><\/p>\n<p>Num\u0103rul de tranzac\u021bii \u00een 10 minute<br \/>\n74169<br \/>\n32445<\/p>\n<p>Tranzac\u021bii\/sec<br \/>\n123<br \/>\n54<\/p>\n<p>\u00cent\u00e2rzierea medie<br \/>\n405 ms<br \/>\n925 ms<\/p>\n<p><strong>Test 2 (150 conexiuni la 100 posibile)<\/strong><\/p>\n<p>Num\u0103rul de tranzac\u021bii \u00een 10 minute<br \/>\n81727<br \/>\n31429<\/p>\n<p>Tranzac\u021bii\/sec<br \/>\n136<br \/>\n52<\/p>\n<p>\u00cent\u00e2rzierea medie<br \/>\n550 ms<br \/>\n1432 ms<\/p>\n<p><strong>Despre dimensiuni<\/strong><\/p>\n<p>Dimensiunea bazei de date<br \/>\n2251 MB<br \/>\n2262 MB<\/p>\n<p>Dimensiunea jurnalelor bazei de date<br \/>\n0 MB<br \/>\n4587 MB<\/p>\n<p>\n\u00cen concluzie: auditarea complet\u0103 nu este foarte bun\u0103. Volumul de date provenit din audit va fi echivalent cu cel din baza de date \u00eens\u0103\u0219i, sau chiar mai mare. Un asemenea volum de logare generat \u00een timpul utiliz\u0103rii SGBD-ului este o problem\u0103 obi\u0219nuit\u0103 \u00een produc\u021bie.<\/p>\n<p>S\u0103 ne uit\u0103m la alte parametrii:<\/p>\n<ul>\n<li>Viteza nu se schimb\u0103 semnificativ: f\u0103r\u0103 logare \u2014 43,74 sec, cu logare \u2014 53,23 sec.<\/li>\n<li>Performan\u021ba RAM \u0219i CPU va c\u0103dea, deoarece este necesar s\u0103 se genereze un fi\u0219ier cu audit. Aceasta se observ\u0103 \u0219i \u00een produc\u021bie.<\/li>\n<\/ul>\n<p>\nPe m\u0103sur\u0103 ce num\u0103rul de conexiuni cre\u0219te, desigur, parametrii se vor deteriora u\u0219or.<\/p>\n<p>\u00cen corpora\u021bii, auditul este \u0219i mai complicat:<\/p>\n<ul>\n<li>sunt multe date;<\/li>\n<li>auditul este necesar nu doar prin syslog \u00een SIEM, ci \u0219i \u00een fi\u0219iere: \u00een caz c\u0103 syslog se defecteaz\u0103, trebuie s\u0103 existe un fi\u0219ier aproape de baz\u0103 \u00een care s\u0103 fie stocate datele;<\/li>\n<li>pentru audit este nevoie de un raft aparte pentru a nu afecta I\/O-ul discurilor, deoarece ocup\u0103 mult spa\u021biu;<\/li>\n<li>se \u00eent\u00e2mpl\u0103 ca angaja\u021bii de securitate a informa\u021biei s\u0103 necesite norme GOST, cer\u00e2nd identificarea conform acestor standarde.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Restric\u021bionarea accesului la date<\/h2>\n<p>\nS\u0103 vedem tehnologiile utilizate pentru protejarea datelor \u0219i accesul la ele \u00een SGBD comerciale \u0219i open source.<\/p>\n<p>Ce poate fi utilizat \u00een general:<\/p>\n<ol>\n<li>Criptarea \u0219i obfuscarea procedurilor \u0219i func\u021biilor (Wrapping) \u2014 adic\u0103 instrumente \u0219i utilitare separate care transform\u0103 codul citibil \u00een cod ilizibil. Cu toate acestea, ulterior nu mai poate fi modificat sau refactorizat \u00eenapoi. Aceast\u0103 abordare este uneori necesar\u0103 cel pu\u021bin la nivelul SGBD-ului \u2014 logica restric\u021biilor de licen\u021b\u0103 sau logica autoriz\u0103rii este criptat\u0103 exact la nivelul procedurilor \u0219i func\u021biilor.<\/li>\n<li>Restric\u021bia vizibilit\u0103\u021bii datelor pe r\u00e2nduri (RLS) este atunci c\u00e2nd utilizatori diferi\u021bi v\u0103d aceea\u0219i tabel\u0103, dar cu un con\u021binut diferit de r\u00e2nduri, adic\u0103 unor persoane nu li se pot afi\u0219a anumite informa\u021bii la nivel de r\u00e2nd.<\/li>\n<li>Editarea datelor afi\u0219ate (Masking) se refer\u0103 la situa\u021bia \u00een care utilizatorii dintr-o coloan\u0103 a tabelei v\u0103d fie datele, fie doar asteriscuri, adic\u0103 unele informa\u021bii vor fi ascunse pentru anumi\u021bi utilizatori. Tehnologia determin\u0103 ce utilizatorilor le este afi\u0219at pe baza nivelului de acces.<\/li>\n<li>Restric\u021bionarea accesului Security DBA\/Application DBA\/DBA se refer\u0103, mai degrab\u0103, la limitarea accesului la baza de date, adic\u0103 angaja\u021bii de securitate pot fi separa\u021bi de administratorii bazei de date \u0219i de administratorii aplica\u021biilor. \u00cen open source, aceste tehnologii sunt rare, dar sunt suficient de comune \u00een bazele de date comerciale. Ele sunt necesare atunci c\u00e2nd exist\u0103 mul\u021bi utilizatori cu acces la serverele \u00een sine.<\/li>\n<li>Restric\u021bia accesului la fi\u0219iere la nivelul sistemului de fi\u0219iere. Se pot acorda drepturi, privilegii de acces la directoare, astfel \u00eenc\u00e2t fiecare administrator s\u0103 aib\u0103 acces doar la datele necesare.<\/li>\n<li>Accesul mandatar \u0219i cur\u0103\u021barea memoriei sunt tehnologii care sunt utilizate rar.<\/li>\n<li>Criptarea end-to-end a bazei de date se refer\u0103 la criptarea pe partea clientului cu gestionarea cheilor pe partea serverului.<\/li>\n<li>Criptarea datelor. De exemplu, criptarea pe coloan\u0103 este atunci c\u00e2nd folosi\u021bi un mecanism care cripteaz\u0103 o coloan\u0103 separat\u0103 a bazei de date.<\/li>\n<\/ol>\n<p><\/p>\n<h3>Cum afecteaz\u0103 asta performan\u021ba bazei de date?<\/h3>\n<p>\nS\u0103 ne uit\u0103m la exemplul cript\u0103rii pe coloan\u0103 \u00een PostgreSQL. Acolo exist\u0103 modulul pgcrypto, care permite stocarea unor c\u00e2mpuri selectate \u00een format criptat. Acest lucru este util atunci c\u00e2nd doar anumite date au valoare. Pentru a citi c\u00e2mpurile criptate, clientul trimite cheia de decriptare, serverul decripteaz\u0103 datele \u0219i le returneaz\u0103 clientului. F\u0103r\u0103 cheie, nimeni nu va putea accesa datele dumneavoastr\u0103.<\/p>\n<p><strong>S\u0103 facem un test cu pgcrypto<\/strong>. Vom crea o tabel\u0103 cu date criptate \u0219i cu date normale. Mai jos sunt comenzile pentru crearea tabelelor; \u00een prima linie se afl\u0103 o comand\u0103 util\u0103 \u2013 crearea extensiei cu \u00eenregistrarea bazei de date:<\/p>\n<pre><code class=\"plaintext\">CREATE EXTENSION pgcrypto;\nCREATE TABLE t1 (id integer, text1 text, text2 text);\nCREATE TABLE t2 (id integer, text1 bytea, text2 bytea);\nINSERT INTO t1 (id, text1, text2)\nVALUES (generate_series(1,10000000), generate_series(1,10000000)::text, generate_series(1,10000000)::text);\nINSERT INTO t2 (id, text1, text2) VALUES (\ngenerate_series(1,10000000),\nencrypt(cast(generate_series(1,10000000) AS text)::bytea, 'key'::bytea, 'bf'),\nencrypt(cast(generate_series(1,10000000) AS text)::bytea, 'key'::bytea, 'bf'));<\/code><\/pre>\n<p>\nApoi vom \u00eencerca s\u0103 facem o selec\u021bie de date din fiecare tabel \u0219i s\u0103 analiz\u0103m timpii de executare.<\/p>\n<p><strong>Selec\u021bia din tabel f\u0103r\u0103 func\u021bia de criptare<\/strong>:<\/p>\n<pre><code class=\"plaintext\">psql -c \"timing\" -c \"select * from t1 limit 1000;\" \"host=192.168.220.129 dbname=taskdb\nuser=postgres sslmode=disable\" &gt; 1.txt<\/code><\/pre>\n<p>\nCronometrul este pornit.<\/p>\n<p>\u00a0\u00a0id | text1 | text2<br \/>\n------+------+-+------<br \/>\n 1 | 1 \u00a0 \u00a0 | 1<br \/>\n 2 | 2 \u00a0 \u00a0 | 2<br \/>\n 3 | 3 \u00a0 \u00a0 | 3<br \/>\n\u2026<br \/>\n997 | 997 \u00a0 | 997<br \/>\n998 | 998 \u00a0 | 998<br \/>\n999 | 999 \u00a0 | 999<br \/>\n1000 | 1000\u00a0 | 1000<br \/>\n(1000 de r\u00e2nduri)<\/p>\n<p>Timp: 1,386 ms<\/p>\n<p><strong>Selec\u021bia din tabel cu func\u021bia de criptare:<\/strong><\/p>\n<pre><code class=\"plaintext\">psql -c \"timing\" -c \"select id, decrypt(text1, 'key'::bytea, 'bf'),\ndecrypt(text2, 'key'::bytea, 'bf') from t2 limit 1000;\"\n\"host=192.168.220.129 dbname=taskdb user=postgres sslmode=disable\" &gt; 2.txt<\/code><\/pre>\n<p>\nCronometrul este pornit.<\/p>\n<p>\u00a0\u00a0id | decrypt | decrypt<br \/>\n------+----------+------<br \/>\n 1 | x31 | x31<br \/>\n 2 | x32 | x32<br \/>\n 3 | x33 | x33<br \/>\n\u2026<br \/>\n999 | x393939 | x393939<br \/>\n1000 | x31303030 | x31303030<br \/>\n(1000 de r\u00e2nduri)<\/p>\n<p>Timp: 50,203 ms<\/p>\n<p><strong>Rezultatele test\u0103rii<\/strong>:<\/p>\n<p>\u00a0<br \/>\n<strong>F\u0103r\u0103 criptare<\/strong><br \/>\n<strong>Pgcrypto (decrypt)<\/strong><\/p>\n<p>Selec\u021bia 1000 de r\u00e2nduri<br \/>\n1,386 ms<br \/>\n50,203 ms<\/p>\n<p>CPU<br \/>\n15%<br \/>\n35%<\/p>\n<p>RAM<br \/>\n\u00a0<br \/>\n+5%<\/p>\n<p>\nCriptarea afecteaz\u0103 semnificativ performan\u021ba. Se observ\u0103 c\u0103 timpul a crescut, deoarece opera\u021biile de decriptare a datelor criptate (iar decriptarea este de obicei \u00eenvelit\u0103 \u00een logica dumneavoastr\u0103) necesit\u0103 resurse semnificative. Astfel, ideea de a cripta toate coloanele care con\u021bin date este predispus\u0103 la o sc\u0103dere a performan\u021bei.<\/p>\n<p>\u00cen acela\u0219i timp, criptarea nu este o panacee care s\u0103 rezolve toate problemele. Datele decriptate \u0219i cheia de decriptare se afl\u0103 pe server \u00een timpul decript\u0103rii \u0219i transmiterii datelor. Prin urmare, cheile pot fi interceptate de cei care au acces complet la serverul de baze de date, de exemplu, de un administrator de sistem.<\/p>\n<p>C\u00e2nd pentru \u00eentreaga coloan\u0103 to\u021bi utilizatorii au o singur\u0103 cheie (chiar dac\u0103 nu pentru to\u021bi, ci pentru clien\u021bi dintr-un set restr\u00e2ns), aceasta nu este \u00eentotdeauna benefic\u0103 \u0219i corect\u0103. Din acest motiv s-au \u00eenceput implement\u0103rile de criptare end-to-end; \u00een SGBD-uri au fost explorate op\u021biuni de criptare a datelor din partea clientului \u0219i serverului, fiind dezvoltate acele solu\u021bii de tip key-vault \u2014 produse separate care asigur\u0103 gestionarea cheilor din partea SGBD-ului.<\/p>\n<p><img decoding=\"async\" alt=\"Securitate \u0219i SGBD: ce trebuie s\u0103 re\u021bine\u021bi atunci c\u00e2nd alege\u021bi mijloacele de protec\u021bie\" src=\"\/wp-content\/uploads\/2020\/05\/cbaa7b9579a65963518ba3cec6114842.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/docs.mongodb.com\/manual\/core\/security-client-side-encryption\/\"><i>Un exemplu de criptare \u00een MongoDB<\/i><\/a><\/noindex><\/p>\n<h2>Mijloace de securitate \u00een SGBD-uri comerciale \u0219i open source<\/h2>\n<p><\/p>\n<p><strong>Functions<\/strong><br \/>\n<strong>Tip<\/strong><br \/>\n<strong>Politica de Parole<\/strong><br \/>\n<strong>Audit<\/strong><br \/>\n<strong>Protec\u021bia codului surs\u0103 al procedurilor \u0219i func\u021biilor<\/strong><br \/>\n<strong>RLS<\/strong><br \/>\n<strong>Criptare<\/strong><\/p>\n<p><strong>Oracle<\/strong><br \/>\nComercial<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p><strong>MsSql<\/strong><br \/>\nComercial<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.gaz-is.ru\/produkty\/inform-sistemy\/subd-jatoba.html\"><strong>Jatoba<\/strong><\/a><\/noindex><br \/>\nComercial<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\nextensii<\/p>\n<p><strong>PostgreSQL<\/strong><br \/>\nGratuit<br \/>\nextensii<br \/>\nextensii<br \/>\n\u2014<br \/>\n+<br \/>\nextensii<\/p>\n<p><strong>MongoDb<\/strong><br \/>\nGratuit<br \/>\n\u2014<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<br \/>\nDisponibil \u00een MongoDB Enterprise doar<\/p>\n<p>\nTabelul nu este deloc complet, dar situa\u021bia este aceasta: \u00een produsele comerciale problemele de securitate au fost rezolvate de mult, \u00een open source, de regul\u0103, pentru securitate se folosesc diverse extensii, lipsesc multe func\u021bii, uneori trebuie s\u0103 se adauge ceva. De exemplu, politicile de parole \u2014 \u00een PostgreSQL exist\u0103 multe extensii diferite.<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/postgres\/postgres\/tree\/master\/contrib\/passwordcheck\">1<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ykrysko\/passwordcheck\">2<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/michaelpq\/pg_plugins\/tree\/master\/passwordcheck_extra\">3<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/devrimgunduz\/passwordcheck_cracklib\">4<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/asio\/password\">5<\/a><\/noindex>), care implementeaz\u0103 politici de parole, dar toate nevoile sectorului corporativ autohton, dup\u0103 p\u0103rerea mea, niciuna nu le acoper\u0103.<\/p>\n<p><strong>Ce s\u0103 faci dac\u0103 nu g\u0103se\u0219ti ceea ce ai nevoie?<\/strong>? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u0443\u044e \u0421\u0423\u0411\u0414, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a.<\/p>\n<p>Atunci po\u021bi folosi solu\u021bii externe care func\u021bioneaz\u0103 cu diferite SGBD-uri, de exemplu, \u201eCrypto DB\u201d sau \u201eGarda DB\u201d. Dac\u0103 este vorba despre solu\u021bii din sectorul autohton, acolo cunosc mai bine standardele GOST dec\u00e2t \u00een open source.<\/p>\n<p>A doua variant\u0103 este s\u0103 scrii tu \u00eensu\u021bi ceea ce ai nevoie, implement\u00e2nd la nivel de proceduri accesul la date \u0219i criptarea \u00een aplica\u021bie. Totu\u0219i, cu GOST va fi mai complicat. Dar \u00een general, po\u021bi ascunde datele a\u0219a cum trebuie, le po\u021bi stoca \u00een SGBD, apoi le po\u021bi extrage \u0219i decripta a\u0219a cum este necesar, chiar la nivelul aplica\u021biei. \u00cen acela\u0219i timp, g\u00e2nde\u0219te-te cum vei proteja aceste algoritmi la nivel de aplica\u021bie. Dup\u0103 p\u0103rerea noastr\u0103, acest lucru ar trebui s\u0103 se \u00eent\u00e2mple la nivel de SGBD, deoarece a\u0219a va func\u021biona mai repede.<\/p>\n<p>Aceast\u0103 prezentare a avut loc pentru prima dat\u0103 la <noindex><a rel=\"nofollow\" href=\"https:\/\/corp.mail.ru\/ru\/press\/events\/databases-1\/\">@Databases Meetup<\/a><\/noindex> de la Mail.ru Cloud Solutions. Vezi<noindex><a rel=\"nofollow\" href=\"https:\/\/www.youtube.com\/redirect?q=https%3A%2F%2Fbit.ly%2F2U57FAd&amp;redir_token=XNWSBN1AKQA2sjhdReDAv6VnkOV8MTU4OTAxNjMwMEAxNTg4OTI5OTAw&amp;v=wigSv2_zWBU&amp;event=video_description\"> video <\/a><\/noindex>alte prezent\u0103ri \u0219i aboneaz\u0103-te la anun\u021burile evenimentelor \u00een Telegram <noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/k8s_mail\">\u00cen jurul Kubernetes \u00een Mail.ru Group<\/a><\/noindex>.<\/p>\n<p><strong>What else to read on the topic<\/strong>:<\/p>\n<ol>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/472694\/\">Mai mult dec\u00e2t Ceph: stocarea de blocuri a cloud-ului MCS<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/blog\/kakuyu-bazu-dannyh-vybrat-dlya-proekta-chtoby-ne-oshibitsya\">Cum s\u0103 alegi o baz\u0103 de date pentru proiect, astfel \u00eenc\u00e2t s\u0103 nu trebuiasc\u0103 s\u0103 alegi din nou?<\/a><\/noindex>.<\/li>\n<\/ol>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/500708\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441 \u0420\u043e\u0436\u043a\u043e\u0432, \u044f \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u041f\u041e \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u00ab\u0413\u0430\u0437\u0438\u043d\u0444\u043e\u0440\u043c\u0441\u0435\u0440\u0432\u0438\u0441\u00bb, \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430 Jatoba. \u0417\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e \u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u043d\u043e\u0440\u043c\u044b \u043d\u0430\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445. \u041d\u0438\u043a\u0442\u043e \u043d\u0435 \u0445\u043e\u0447\u0435\u0442, \u0447\u0442\u043e\u0431\u044b \u0442\u0440\u0435\u0442\u044c\u0438 \u043b\u0438\u0446\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0432\u0430\u0436\u043d\u044b \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0432\u043e\u043f\u0440\u043e\u0441\u044b: \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f, \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430\u043c\u0438 \u043a \u0434\u0430\u043d\u043d\u044b\u043c, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":81885,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-81884","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438 \u0421\u0423\u0411\u0414: \u043e \u0447\u0451\u043c \u043d\u0430\u0434\u043e \u043f\u043e\u043c\u043d\u0438\u0442\u044c, \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u044f \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-17T11:42:18+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-17T11:42:18+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Securitate \u0219i SGBD: despre ce trebuie s\u0103 \u021binem cont c\u00e2nd alegem solu\u021biile de protec\u021bie | ProHoster","description":"M\u0103 numesc Denis.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438 \u0421\u0423\u0411\u0414: \u043e \u0447\u0451\u043c \u043d\u0430\u0434\u043e \u043f\u043e\u043c\u043d\u0438\u0442\u044c, \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u044f \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b | ProHoster","og:description":"\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-17T11:42:18+00:00","article:modified_time":"2020-05-17T11:42:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"81884","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:48:24","updated":"2022-10-05 02:01:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/81884","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=81884"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/81884\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/81885"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=81884"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=81884"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=81884"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}