{"id":90854,"date":"2020-08-07T01:42:11","date_gmt":"2020-08-06T23:42:11","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/3-check-point-sandblast-agent-management-platform-politika-threat-prevention"},"modified":"2020-08-07T01:42:11","modified_gmt":"2020-08-06T23:42:11","slug":"3-check-point-sandblast-agent-management-platform-politika-threat-prevention","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/3-check-point-sandblast-agent-management-platform-politika-threat-prevention","title":{"rendered":"3. Platforma de gestionare Check Point SandBlast Agent. Politica de prevenire a amenin\u021b\u0103rilor.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"3. Platforma de gestionare Check Point SandBlast Agent. Politica de prevenire a amenin\u021b\u0103rilor.\" src=\"\/wp-content\/uploads\/2020\/08\/47e6b1a7815bb76935e1a31f0cb83772.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nBine a\u021bi venit la al treilea articol din ciclul despre noua consol\u0103 cloud de management pentru protec\u021bia calculatoarelor personale \u2014 Check Point SandBlast Agent Management Platform. Amintesc c\u0103 \u00een <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/511768\/\">articolul nostru ini\u021bial<\/a><\/noindex> am fost introdusi \u00een portalul Infinity Portal \u0219i am creat un serviciu cloud pentru gestionarea agen\u021bilor Endpoint Management Service. \u00cen <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/512614\/\">articolul doi<\/a><\/noindex> am studiat interfa\u021ba consolei web de management \u0219i am instalat un agent cu politica standard pe un computer personal. Ast\u0103zi, vom analiza con\u021binutul politicii standard de securitate Threat Prevention \u0219i vom testa eficacitatea acesteia \u00eempotriva atacurilor populare.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Politica standard Threat Prevention: descriere<\/h2>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/nz\/u6\/8g\/nzu68gxim5rr7iibz1wyquwrede.png\"><img decoding=\"async\" alt=\"3. Platforma de gestionare Check Point SandBlast Agent. Politica de prevenire a amenin\u021b\u0103rilor.\" src=\"\/wp-content\/uploads\/2020\/08\/ef02bf7e83c46edc063e71d5f3c0e7e1.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>\u00cen imaginea de mai sus este prezentat\u0103 regula standard a politicii Threat Prevention, care, \u00een mod implicit, se aplic\u0103 \u00eentregii organiza\u021bii (tuturor agen\u021bilor instala\u021bi) \u0219i include trei grupuri logice de componente de protec\u021bie: Web &amp; Files Protection, Behavioral Protection \u0219i Analysis &amp; Remediation. S\u0103 analiz\u0103m mai detaliat fiecare grup.<\/p>\n<h3>Web &amp; Files Protection<\/h3>\n<p><\/p>\n<p>                        <b class=\"spoiler_title\">Filtrarea URL-urilor<\/b><br \/>\n                        URL Filtering permite controlul accesului utilizatorilor la resursele web, pentru care sunt utilizate 5 categorii prestabilite de site-uri. Fiecare dintre cele 5 categorii con\u021bine mai multe subcategorii specifice, ceea ce permite personalizarea, de exemplu, blocarea accesului la subcategoria Games \u0219i permiterea accesului la subcategoria Instant Messaging, care apar\u021bin acelea\u0219i categorii Productivity Loss. Adresele URL care se \u00eencadreaz\u0103 \u00een subcategorii specifice sunt definite de compania Check Point. Se poate verifica categoria la care se \u00eencadreaz\u0103 un URL specific sau se poate solicita o redefinire a categoriei pe un resurs\u0103 special\u0103. <noindex><a rel=\"nofollow\" href=\"https:\/\/urlcat.checkpoint.com\/urlcat\/main.htm\">URL Categorization<\/a><\/noindex>.<br \/>\nCa ac\u021biune, se poate configura Prevent, Detect sau Off. De asemenea, la alegerea ac\u021biunii Detect se adaug\u0103 automat o setare care le permite utilizatorilor s\u0103 treac\u0103 peste avertizarea URL Filtering \u0219i s\u0103 acceseze resursa dorit\u0103. \u00cen cazul ac\u021biunii Prevent, aceast\u0103 setare poate fi scoas\u0103 \u0219i utilizatorul nu va avea acces la site-ul interzis. O modalitate convenabil\u0103 de a controla resursele interzise este configurarea unei Block List, \u00een care se pot specifica domenii, adrese IP sau \u00eenc\u0103rca un fi\u0219ier \u00een format .csv cu lista domeniilor care trebuie blocate.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/kg\/lu\/lo\/kglulo9f-hiyxv7ydcj4zdxxjxy.png\"><img decoding=\"async\" alt=\"3. Platforma de gestionare Check Point SandBlast Agent. Politica de prevenire a amenin\u021b\u0103rilor.\" src=\"\/wp-content\/uploads\/2020\/08\/098f6e80aaa9ac5ddab0db2e4fe5e256.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>\u00cen politica standard pentru filtrarea URL-urilor este setat\u0103 ac\u021biunea Detect \u0219i a fost aleas\u0103 o categorie \u2014 Security, pentru care se va efectua detectarea evenimentelor. Aceast\u0103 categorie include diverse anonimizatoare, site-uri cu nivel de risc Critic\/\u00cenalt\/Mediu, site-uri de phishing, spam \u0219i multe altele. \u00cen plus, utilizatorii vor putea totu\u0219i s\u0103 acceseze resursa datorit\u0103 set\u0103rii \u201eAllow user to dismiss the URL Filtering alert and access the website.\u201d<\/p>\n<p>                        <b class=\"spoiler_title\">Desc\u0103rcare (web) Protec\u021bie<\/b><br \/>\n                        Emulation &amp; Extraction permite emularea fi\u0219ierelor desc\u0103rcate \u00een sandbox-ul cloud Check Point \u0219i cur\u0103\u021barea documentelor \u201e\u00een timp real\u201d, elimin\u00e2nd con\u021binutul poten\u021bial d\u0103un\u0103tor sau convertind documentul \u00een PDF. Exist\u0103 trei moduri de func\u021bionare:<\/p>\n<ul>\n<li><i>Prevenire<\/i> \u2014 permite ob\u021binerea unei copii a documentului cur\u0103\u021bat \u00eenainte de verdictul final al emul\u0103rii sau a\u0219teptarea finaliz\u0103rii emul\u0103rii pentru a desc\u0103rca direct fi\u0219ierul original;<\/li>\n<\/ul>\n<p><\/p>\n<ul>\n<li><i>Detectare<\/i> \u2014 realizeaz\u0103 emularea \u00een fundal, f\u0103r\u0103 a \u00eempiedica utilizatorul s\u0103 ob\u021bin\u0103 fi\u0219ierul original, indiferent de verdict;<\/li>\n<\/ul>\n<p><\/p>\n<ul>\n<li><i>Dezactivat<\/i> \u2014 orice fi\u0219iere sunt permise pentru desc\u0103rcare f\u0103r\u0103 a trece prin emulare \u0219i cur\u0103\u021barea componentelor poten\u021bial d\u0103un\u0103toare.<\/li>\n<\/ul>\n<p>\nDe asemenea, exist\u0103 op\u021biunea de a selecta ac\u021biunea pentru fi\u0219ierele care nu sunt acceptate de c\u0103tre instrumentele de emulare \u0219i cur\u0103\u021bare Check Point \u2014 se poate permite sau interzice desc\u0103rcarea tuturor fi\u0219ierelor nesus\u021binute.<\/p>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/hu\/m0\/a4\/hum0a4qxlidupf5fhldhtbjnqro.png\"><img decoding=\"async\" alt=\"3. Platforma de gestionare Check Point SandBlast Agent. Politica de prevenire a amenin\u021b\u0103rilor.\" src=\"\/wp-content\/uploads\/2020\/08\/5333f91625d3230651025309a7a4182d.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>\u00cen politica standard pentru Download Protection este setat\u0103 ac\u021biunea Prevenire cu posibilitatea de a ob\u021bine o copie cur\u0103\u021bat\u0103 de con\u021binut poten\u021bial d\u0103un\u0103tor a documentului original, precum \u0219i permiterea desc\u0103rc\u0103rii fi\u0219ierelor care nu sunt acceptate de c\u0103tre instrumentele de emulare \u0219i cur\u0103\u021bare.<\/p>\n<p>                        <b class=\"spoiler_title\">Protec\u021bia Credentialelor<\/b><br \/>\n                        Componenta Protec\u021bia Credentialelor protejeaz\u0103 datele utilizatorilor \u0219i include 2 componente: Zero Phishing \u0219i Protec\u021bia parolelor. <i>Zero Phishing<\/i> protejeaz\u0103 utilizatorii de accesul la resursele de phishing, iar <i>Protec\u021bia parolelor<\/i> informeaz\u0103 utilizatorul despre utilizarea inacceptabil\u0103 a datelor de autentificare corporate \u00een afara domeniului protejat. Zero Phishing poate fi setat pe Prevent, Detect sau Off. Atunci c\u00e2nd ac\u021biunea Prevent este activat\u0103, utilizatorii au op\u021biunea de a ignora avertismentul privind o posibil\u0103 resurs\u0103 de phishing \u0219i de a accesa resursa, sau de a interzice aceast\u0103 op\u021biune \u0219i de a bloca accesul \u00een permanen\u021b\u0103. C\u00e2nd se ac\u021bioneaz\u0103 \u00een modul Detect, utilizatorii au \u00eentotdeauna op\u021biunea de a ignora avertismentul \u0219i de a accesa resursa. Protec\u021bia prin parol\u0103 permite selectarea domeniilor protejate pentru care se va efectua verificarea parolilor, precum \u0219i una dintre cele trei ac\u021biuni: Detect &amp; Alert (avertiz\u00e2nd utilizatorul), Detect sau Off.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/7c\/xn\/lv\/7cxnlvruw7jmk6g71emd-zi3qag.png\"><img decoding=\"async\" alt=\"3. Platforma de gestionare Check Point SandBlast Agent. Politica de prevenire a amenin\u021b\u0103rilor.\" src=\"\/wp-content\/uploads\/2020\/08\/068e4ca4d7a89ff74d48a71c6079025a.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Politica standard pentru Protec\u021bia Datelor de Autentificare prevede Prevent pentru orice resurse de phishing, interzic\u00e2nd utilizatorilor accesul la un site poten\u021bial d\u0103un\u0103tor. De asemenea, este inclus\u0103 protec\u021bia \u00eempotriva utiliz\u0103rii parolelor corporate, \u00eens\u0103 f\u0103r\u0103 domeniile specificate, aceast\u0103 func\u021bie nu va func\u021biona.<\/p>\n<p>                        <b class=\"spoiler_title\">Protec\u021bia Fi\u0219ierelor<\/b><br \/>\n                        Protec\u021bia Fi\u0219ierelor este responsabil\u0103 pentru securizarea fi\u0219ierelor stocate pe ma\u0219ina utilizatorului \u0219i include dou\u0103 componente: Anti-Malware \u0219i Emularea Amenin\u021b\u0103rilor la Fi\u0219iere. <i>Anti-Malware<\/i> reprezint\u0103 un instrument care efectueaz\u0103 periodic scan\u0103ri ale tuturor fi\u0219ierelor utilizatorilor \u0219i ale sistemului folosind analiza semn\u0103turilor. \u00cen set\u0103rile acestui component, se pot configura parametrii scan\u0103rii regulate sau a timpului aleatoriu de executare a scan\u0103rii, perioada de actualizare a semn\u0103turilor, precum \u0219i op\u021biunea pentru utilizatori de a anula scanarea programat\u0103. <i>Emularea Amenin\u021b\u0103rilor la Fi\u0219iere<\/i> permete emularea fi\u0219ierelor stocate pe ma\u0219ina utilizatorului \u00een sandbox-ul cloud Check Point, \u00eens\u0103 aceast\u0103 func\u021bie de securitate func\u021bioneaz\u0103 doar \u00een modul Detect.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/yv\/5-\/ns\/yv5-nsf5xe8vjjjoaslhu8aaofo.png\"><img decoding=\"async\" alt=\"3. Platforma de gestionare Check Point SandBlast Agent. Politica de prevenire a amenin\u021b\u0103rilor.\" src=\"\/wp-content\/uploads\/2020\/08\/b347fd5a4a3e3732dec20efa5d7a766a.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>\u00cen politica standard pentru Protec\u021bia Fi\u0219ierelor este inclus\u0103 protec\u021bia prin Anti-Malware \u0219i detectarea fi\u0219ierelor r\u0103u inten\u021bionate prin Emularea Amenin\u021b\u0103rilor la Fi\u0219iere. Scanarea regulat\u0103 se efectueaz\u0103 lunar, iar semn\u0103turile pe ma\u0219ina utilizatorului sunt actualizate la fiecare 4 ore. De asemenea, este activat\u0103 op\u021biunea pentru utilizatori de a anula scanarea programat\u0103, dar nu mai t\u00e2rziu de 30 de zile de la ultima scanare reu\u0219it\u0103.<\/p>\n<h3>Protec\u021bia Comportamental\u0103<\/h3>\n<p><\/p>\n<p>                        <b class=\"spoiler_title\">Anti-Bot, Behavioral Guard &amp; Anti-Ransomware, Anti-Exploit<\/b><br \/>\n                        Grupul de componente de protec\u021bie Behavioral Protection include trei p\u0103r\u021bi: Anti-Bot, Behavioral Guard &amp; Anti-Ransomware \u0219i Anti-Exploit. <i>Anti-Bot<\/i> permite monitorizarea \u0219i blocarea conexiunilor C&amp;C printr-o baz\u0103 de date Check Point ThreatCloud care este actualizat\u0103 constant. <i>Behavioral Guard &amp; Anti-Ransomware<\/i> monitorizeaz\u0103 continuu activitatea (fi\u0219iere, procese, interac\u021biuni de re\u021bea) pe ma\u0219ina utilizatorului \u0219i permite prevenirea atacurilor de tip ransomware \u00een etapele ini\u021biale. De asemenea, aceast\u0103 component\u0103 de protec\u021bie permite recuperarea fi\u0219ierelor care au fost criptate de malware. Fi\u0219ierele sunt recuperate \u00een directoarele lor originale sau se poate specifica o cale specific\u0103 unde vor fi stocate toate fi\u0219ierele recuperate. <i>Anti-Exploit<\/i> permet detectarea atacurilor de tip zero-day. Toate componentele Behavioral Protection suport\u0103 trei moduri de operare: Prevent, Detect \u0219i Off.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/cj\/we\/hw\/cjwehwnasdhxnxtjrcaed-6x0mc.png\"><img decoding=\"async\" alt=\"3. Platforma de gestionare Check Point SandBlast Agent. Politica de prevenire a amenin\u021b\u0103rilor.\" src=\"\/wp-content\/uploads\/2020\/08\/e46e6617b6930a9b74ffb5dd752d27e4.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Politica standard pentru Behavioral Protection prevede Prevent pentru componentele Anti-Bot \u0219i Behavioral Guard &amp; Anti-Ransomware, cu recuperarea fi\u0219ierelor criptate \u00een directoarele lor originale. Componenta Anti-Exploit este dezactivat\u0103 \u0219i nu este utilizat\u0103.<\/p>\n<h3>Analiz\u0103 &amp; Remediere<\/h3>\n<p><\/p>\n<p>                        <b class=\"spoiler_title\">Analiza automat\u0103 a atacurilor (Forensics), Remediere &amp; R\u0103spuns<\/b><br \/>\n                        Pentru analiza \u0219i investigarea incidentelor de securitate sunt disponibile dou\u0103 componente de securitate: Analiza automat\u0103 a atacurilor (Forensics) \u0219i Remediere &amp; R\u0103spuns. <i>Analiza automat\u0103 a atacurilor (Forensics)<\/i> permite generarea de rapoarte privind rezultatele respingerii atacurilor cu o descriere detaliat\u0103 \u2014 inclusiv examinarea procesului de execu\u021bie a malware-ului pe ma\u0219ina utilizatorului. De asemenea, exist\u0103 op\u021biunea de a utiliza func\u021bia Threat Hunting, care permite efectuarea de c\u0103ut\u0103ri proactive pentru anomalii \u0219i comportamente poten\u021bial d\u0103un\u0103toare folosind filtre predefinite sau create. <i>Remediere &amp; R\u0103spuns<\/i> permite configurarea parametrilor de recuperare \u0219i carantinare a fi\u0219ierelor dup\u0103 un atac: este reglat\u0103 interac\u021biunea utilizatorilor cu fi\u0219ierele \u00een carantin\u0103, iar utilizatorul are op\u021biunea de a stoca fi\u0219iere \u00een carantin\u0103 \u00eentr-un director specificat de administrator.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/yv\/g6\/_5\/yvg6_5q9htpuow09drvc9twvin0.png\"><img decoding=\"async\" alt=\"3. Platforma de gestionare Check Point SandBlast Agent. Politica de prevenire a amenin\u021b\u0103rilor.\" src=\"\/wp-content\/uploads\/2020\/08\/054dd15ef97b9f018c09dac6168363a2.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>\u00cen politica standard de Analiz\u0103 &amp; Remediere este inclus\u0103 protec\u021bia, care const\u0103 \u00een ac\u021biuni automate pentru recuperare (\u00eencheierea proceselor, recuperarea fi\u0219ierelor etc.), precum \u0219i op\u021biunea activ\u0103 de trimitere a fi\u0219ierelor \u00een carantin\u0103, utilizatorii av\u00e2nd doar dreptul de a \u0219terge fi\u0219ierele din carantin\u0103.<\/p>\n<h2>Politica standard de Prevenire a Amenin\u021b\u0103rilor: testare<\/h2>\n<p><\/p>\n<h4>Check Point CheckMe Endpoint<\/h4>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/zv\/cy\/xm\/zvcyxmbkz7okn3e93d2skndecvk.png\"><img decoding=\"async\" alt=\"3. Platforma de gestionare Check Point SandBlast Agent. Politica de prevenire a amenin\u021b\u0103rilor.\" src=\"\/wp-content\/uploads\/2020\/08\/edeedd847643ab7ac6cb374287601a7f.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Cea mai rapid\u0103 \u0219i simpl\u0103 metod\u0103 de a verifica securitatea unei ma\u0219ini de utilizator \u00eempotriva celor mai populare tipuri de atacuri este s\u0103 efectuezi un test folosind resursa <noindex><a rel=\"nofollow\" href=\"https:\/\/pages.checkpoint.com\/checkme-instant-security-check.html\">Check Point CheckMe<\/a><\/noindex>, care realizeaz\u0103 o serie de atacuri tipice din diverse categorii \u0219i permite ob\u021binerea unui raport la finalul test\u0103rii. \u00cen acest caz, a fost utilizat\u0103 varianta de testare Endpoint, prin care pe computer se descarc\u0103 \u0219i se lanseaz\u0103 un fi\u0219ier executabil, iar apoi \u00eencepe procesul de verificare.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/zr\/rl\/9y\/zrrl9yjxowxgkrywqwipy8ac0dq.png\"><img decoding=\"async\" alt=\"3. Platforma de gestionare Check Point SandBlast Agent. Politica de prevenire a amenin\u021b\u0103rilor.\" src=\"\/wp-content\/uploads\/2020\/08\/698d916e730a65d937abd49929545a64.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>\u00cen timpul verific\u0103rii securit\u0103\u021bii computerului de lucru, SandBlast Agent semnaleaz\u0103 atacurile identificate \u0219i respinse pe computerul utilizatorului, de exemplu: blade-ul Anti-Bot raporteaz\u0103 despre descoperirea unei infec\u021bii, blade-ul Anti-Malware a descoperit \u0219i a eliminat fi\u0219ierul mali\u021bios CP_AM.exe, iar blade-ul Threat Emulation, \u00een urma emul\u0103rii, a stabilit c\u0103 fi\u0219ierul CP_ZD.exe este mali\u021bios.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/dh\/xi\/3-\/dhxi3-jlwqijhtxwwbxac-zrtj4.gif\"><img decoding=\"async\" alt=\"3. Platforma de gestionare Check Point SandBlast Agent. Politica de prevenire a amenin\u021b\u0103rilor.\" src=\"\/wp-content\/uploads\/2020\/08\/1a4af1b0066af56d4163d3e6b2ca8441.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>\u00cen urma test\u0103rii cu ajutorul CheckMe Endpoint, avem urm\u0103torul rezultat: din cele 6 categorii de atacuri, politica standard de prevenire a amenin\u021b\u0103rilor nu a reu\u0219it s\u0103 fac\u0103 fa\u021b\u0103 doar la o categorie \u2014 Browser Exploit. Acest lucru se explic\u0103 prin faptul c\u0103 politica standard de prevenire a amenin\u021b\u0103rilor nu include blade-ul Anti-Exploit. Merit\u0103 men\u021bionat c\u0103, f\u0103r\u0103 instalarea SandBlast Agent, computerul utilizatorului a trecut testul doar la categoria Ransomware.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/h3\/76\/zc\/h376zclkuvjxwxc2unwvcnejwem.png\"><img decoding=\"async\" alt=\"3. Platforma de gestionare Check Point SandBlast Agent. Politica de prevenire a amenin\u021b\u0103rilor.\" src=\"\/wp-content\/uploads\/2020\/08\/66a08b2b436df273344a00aafabb1f50.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h4>KnowBe4 RanSim<\/h4>\n<p>\nPentru testarea func\u021bion\u0103rii blade-ului Anti-Ransomware se poate utiliza o solu\u021bie gratuit\u0103 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.knowbe4.com\/ransomware-simulator\">KnowBe4 RanSim<\/a><\/noindex>, care ruleaz\u0103 o serie de teste pe ma\u0219ina utilizatorului: 18 scenarii de infectare cu ransomware \u0219i 1 scenariu de infectare cu cryptominer. Merit\u0103 men\u021bionat c\u0103 prezen\u021ba \u00een politica standard a multor blade-uri (Threat Emulation, Anti-Malware, Behavioral Guard) care ac\u021bioneaz\u0103 \u00een modul Prevent nu permite o rulare corect\u0103 a acestui test. Cu toate acestea, chiar \u0219i la un nivel de securitate redus (Threat Emulation \u00een modul Off), testul blade-ului Anti-Ransomware arat\u0103 rezultate bune: 18 din 19 teste au fost trecute cu succes (1 nu a fost ini\u021biat).<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/7y\/l_\/nq\/7yl_nqjgbol5kav2pgyu4ta-fr4.png\"><img decoding=\"async\" alt=\"3. Platforma de gestionare Check Point SandBlast Agent. Politica de prevenire a amenin\u021b\u0103rilor.\" src=\"\/wp-content\/uploads\/2020\/08\/99622aa0c54d086efeaac3c2661a028e.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h4>Fi\u0219iere \u0219i documente mali\u021bioase<\/h4>\n<p>\nUn aspect semnificativ este verificarea func\u021bion\u0103rii diferitelor blade-uri ale politicii standard de prevenire a amenin\u021b\u0103rilor folosind fi\u0219iere mali\u021bioase de formate populare, \u00eenc\u0103rcate pe ma\u0219ina utilizatorului. \u00cen acest test au fost implicate 66 de fi\u0219iere \u00een formatele PDF, DOC, DOCX, EXE, XLS, XLSX, CAB, RTF. Rezultatele testului au ar\u0103tat c\u0103 SandBlast Agent a reu\u0219it s\u0103 blocheze 64 de fi\u0219iere mali\u021bioase din 66. Fi\u0219ierele infectate au fost eliminate dup\u0103 desc\u0103rcare, fie cur\u0103\u021bate de con\u021binutul mali\u021bios prin Threat Extraction \u0219i primite de utilizator.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/dx\/g_\/az\/dxg_az4i9fvox2mbgdhhpoqzuae.png\"><img decoding=\"async\" alt=\"3. Platforma de gestionare Check Point SandBlast Agent. Politica de prevenire a amenin\u021b\u0103rilor.\" src=\"\/wp-content\/uploads\/2020\/08\/751ea1224ee20e1a98c53ae747b98b65.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Recomand\u0103ri pentru \u00eembun\u0103t\u0103\u021birea politicii de prevenire a amenin\u021b\u0103rilor<\/h3>\n<p><\/p>\n<h4>1. Filtrarea URL-urilor<\/h4>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/ff\/03\/w2\/ff03w26_9avqezjhb-fflbmmdca.png\"><img decoding=\"async\" alt=\"3. Platforma de gestionare Check Point SandBlast Agent. Politica de prevenire a amenin\u021b\u0103rilor.\" src=\"\/wp-content\/uploads\/2020\/08\/9cd69ad2a8a1c034693960b567ea0a46.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Primul lucru care trebuie corectat \u00een politica standard pentru a spori nivelul de securitate al ma\u0219inii clientului este s\u0103 se schimbe blade-ul Filtrare URL \u00een Prevenire \u0219i s\u0103 se indice categoriile corespunz\u0103toare pentru blocare. \u00cen cazul nostru, au fost alese toate categoriile, cu excep\u021bia celor de Utilizare General\u0103, deoarece acestea includ majoritatea resurselor la care trebuie limitat accesul utilizatorilor la locul de munc\u0103. De asemenea, pentru astfel de site-uri, este recomandat s\u0103 se elimine posibilitatea utilizatorilor de a s\u0103ri peste fereastra de avertizare, debif\u00e2nd op\u021biunea \u201ePermite utilizatorului s\u0103 \u00eenchid\u0103 alerta de filtrare URL \u0219i s\u0103 acceseze site-ul\u201d.<\/p>\n<h4>2. Protec\u021bia desc\u0103rc\u0103rilor<\/h4>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/pj\/kt\/cz\/pjktczvmqy02s3oxr4vjhpvzvvk.png\"><img decoding=\"async\" alt=\"3. Platforma de gestionare Check Point SandBlast Agent. Politica de prevenire a amenin\u021b\u0103rilor.\" src=\"\/wp-content\/uploads\/2020\/08\/7aab7f03a4bb2422e79cdb46b163df09.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>Al doilea parametru pe care ar trebui s\u0103 ne concentr\u0103m este posibilitatea utilizatorilor de a desc\u0103rca fi\u0219iere care nu sunt acceptate de emulatorul Check Point. Dat fiind c\u0103 \u00een aceast\u0103 sec\u021biune discut\u0103m despre \u00eembun\u0103t\u0103\u021biri ale politicii standard de prevenire a amenin\u021b\u0103rilor din perspectiva securit\u0103\u021bii, cea mai bun\u0103 op\u021biune ar fi interzicerea desc\u0103rc\u0103rii fi\u0219ierelor neacceptate.<\/p>\n<h4>3. Protec\u021bia fi\u0219ierelor<\/h4>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/it\/ci\/4y\/itci4yn2eoqkfvkdhw8muzwf68m.png\"><img decoding=\"async\" alt=\"3. Platforma de gestionare Check Point SandBlast Agent. Politica de prevenire a amenin\u021b\u0103rilor.\" src=\"\/wp-content\/uploads\/2020\/08\/99cb509f48ff618a6f853f37e56cb8e2.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>De asemenea, este important s\u0103 ne concentr\u0103m pe set\u0103rile de protec\u021bie a fi\u0219ierelor \u2014 \u00een special asupra parametrilor de scanare periodic\u0103 \u0219i a posibilit\u0103\u021bii de a am\u00e2na scanarea for\u021bat\u0103. \u00cen acest caz, este necesar s\u0103 se ia \u00een considerare timpul de lucru al utilizatorului, iar o op\u021biune bun\u0103 din punct de vedere al securit\u0103\u021bii \u0219i performan\u021bei este configurarea unei scan\u0103ri for\u021bate zilnice, iar ora este aleas\u0103 aleatoriu (\u00eentre 00:00 \u0219i 8:00), iar utilizatorul poate am\u00e2na scanarea maxim o s\u0103pt\u0103m\u00e2n\u0103.<\/p>\n<h4>4. Anti-Exploit<\/h4>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/6e\/mx\/kv\/6emxkv4yzkzkqu546ep-iratzr8.png\"><img decoding=\"async\" alt=\"3. Platforma de gestionare Check Point SandBlast Agent. Politica de prevenire a amenin\u021b\u0103rilor.\" src=\"\/wp-content\/uploads\/2020\/08\/b4ba3964fcc5572d479eefe50abf0e31.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<p>O dezavantaj semnificativ al politicii standard de prevenire a amenin\u021b\u0103rilor este blade-ul Anti-Exploit dezactivat. Se recomand\u0103 activarea acestui blade cu ac\u021biunea Prevent, pentru a proteja sta\u021bia de lucru \u00eempotriva atacurilor care utilizeaz\u0103 exploitable. Cu aceast\u0103 corectare, testul CheckMe se finalizeaz\u0103 cu succes, f\u0103r\u0103 a detecta vulnerabilit\u0103\u021bi pe ma\u0219ina utilizatorului.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habrastorage.org\/webt\/cq\/ys\/ri\/cqysrifvsbfda0sowlprohzzxpg.png\"><img decoding=\"async\" alt=\"3. Platforma de gestionare Check Point SandBlast Agent. Politica de prevenire a amenin\u021b\u0103rilor.\" src=\"\/wp-content\/uploads\/2020\/08\/521e2edcd642977369f92eded813c435.jpeg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h3>Concluzie<\/h3>\n<p>\n\u00cen concluzie: \u00een acest articol am explorat componentele politicii standard de prevenire a amenin\u021b\u0103rilor, am testat aceast\u0103 politic\u0103 prin diferite metode \u0219i instrumente, precum \u0219i am descris recomand\u0103ri pentru \u00eembun\u0103t\u0103\u021birea set\u0103rilor politicii standard pentru a cre\u0219te nivelul de securitate al ma\u0219inii utilizatorului. \u00cen urm\u0103torul articol al ciclului, vom trece la studierea politicii de protec\u021bie a datelor \u0219i vom explora set\u0103rile Global Policy Settings.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/358508\/\">O selec\u021bie mare de materiale despre Check Point de la TS Solution<\/a><\/noindex>. Pentru a nu pierde urm\u0103toarele publica\u021bii pe tema SandBlast Agent Management Platform \u2014 urm\u0103ri\u021bi actualiz\u0103rile pe re\u021belele noastre sociale (<noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/tssolution\">Telegram<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.facebook.com\/groups\/tssolution.info\/\">Facebook<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/vk.com\/ts_solution\">VK<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/tssolution.ru\/blog\">Blogul TS Solution<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/zen.yandex.ru\/id\/5c7d2162fa818600ae386a52\">Yandex.Zen<\/a><\/noindex>).<br \/>\n<br \/>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/tssolution\/blog\/513254\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0414\u043e\u0431\u0440\u043e \u043f\u043e\u0436\u0430\u043b\u043e\u0432\u0430\u0442\u044c \u043d\u0430 \u0442\u0440\u0435\u0442\u044c\u044e \u0441\u0442\u0430\u0442\u044c\u044e \u0446\u0438\u043a\u043b\u0430 \u043e \u043d\u043e\u0432\u043e\u0439 \u043e\u0431\u043b\u0430\u0447\u043d\u043e\u0439 \u043a\u043e\u043d\u0441\u043e\u043b\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043f\u0435\u0440\u0441\u043e\u043d\u0430\u043b\u044c\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 \u2014 Check Point SandBlast Agent Management Platform. \u041d\u0430\u043f\u043e\u043c\u043d\u044e, \u0447\u0442\u043e \u0432 \u043f\u0435\u0440\u0432\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u043f\u043e\u0437\u043d\u0430\u043a\u043e\u043c\u0438\u043b\u0438\u0441\u044c \u0441 \u043f\u043e\u0440\u0442\u0430\u043b\u043e\u043c Infinity Portal \u0438 \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0439 \u0441\u0435\u0440\u0432\u0438\u0441 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u0433\u0435\u043d\u0442\u0430\u043c\u0438 Endpoint Management Service. \u0412\u043e \u0432\u0442\u043e\u0440\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0435 \u043c\u044b \u0438\u0437\u0443\u0447\u0438\u043b\u0438 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 \u0432\u0435\u0431-\u043a\u043e\u043d\u0441\u043e\u043b\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b\u0438 \u0430\u0433\u0435\u043d\u0442\u0430 \u0441\u043e \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u043e\u0439 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u043e\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":90855,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-90854","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/3-check-point-sandblast-agent-management-platform-politika-threat-prevention\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd473. Check Point SandBlast Agent Management Platform. \u041f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 Threat Prevention | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/3-check-point-sandblast-agent-management-platform-politika-threat-prevention\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-06T23:42:11+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-06T23:42:11+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd473. Check Point SandBlast Agent Management Platform. Politica de prevenire a amenin\u021b\u0103rilor | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/3-check-point-sandblast-agent-management-platform-politika-threat-prevention","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd473. Check Point SandBlast Agent Management Platform. \u041f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 Threat Prevention | ProHoster","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/3-check-point-sandblast-agent-management-platform-politika-threat-prevention","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-06T23:42:11+00:00","article:modified_time":"2020-08-06T23:42:11+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"90854","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:40:04","updated":"2022-10-01 09:33:59","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/90854","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=90854"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/90854\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/90855"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=90854"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=90854"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=90854"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}