{"id":94450,"date":"2020-09-17T07:42:44","date_gmt":"2020-09-17T05:42:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/iaas-152-fz-itak-vam-nuzhna-bezopasnost"},"modified":"2020-09-17T07:42:44","modified_gmt":"2020-09-17T05:42:44","slug":"iaas-152-fz-itak-vam-nuzhna-bezopasnost","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/iaas-152-fz-itak-vam-nuzhna-bezopasnost","title":{"rendered":"IaaS 152-FZ: deci, ave\u021bi nevoie de securitate","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"IaaS 152-FZ: deci, ave\u021bi nevoie de securitate\" src=\"\/wp-content\/uploads\/2020\/09\/d91a5d152754f82316e0027fd3447b53.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/p>\n<p>Indiferent de c\u00e2te mituri \u0219i legende sunt dezv\u0103luite \u00een jurul conformit\u0103\u021bii cu Legea 152-FZ, ceva r\u0103m\u00e2ne \u00eentotdeauna neclar. Ast\u0103zi dorim s\u0103 discut\u0103m nuan\u021bele care nu sunt \u00eentotdeauna evidente, cu care se pot confrunta at\u00e2t companiile mari, c\u00e2t \u0219i \u00eentreprinderile mici:<\/p>\n<ul>\n<li>\n<p>subtilit\u0103\u021bile clasific\u0103rii PDn pe categorii \u2014 atunci c\u00e2nd un mic magazin online colecteaz\u0103 date care apar\u021bin unei categorii speciale, f\u0103r\u0103 a fi con\u0219tient de acest lucru;<\/p>\n<\/li>\n<li>\n<p>unde pot fi stocate copiile de rezerv\u0103 ale PDn colectate \u0219i realizate opera\u021biuni asupra acestora;<\/p>\n<\/li>\n<li>\n<p>cu ce se deosebeste un certificat de conformitate de o concluzie de conformitate, ce documente trebuie solicitate de la furnizor \u0219i tot a\u0219a mai departe.<\/p>\n<\/li>\n<\/ul>\n<p>La final, ne vom \u00eemp\u0103rt\u0103\u0219i propria experien\u021b\u0103 \u00een procesul de certificare. S\u0103 \u00eencepem!<\/p>\n<p><em>Expertul din articolul de ast\u0103zi va fi<strong> Alexei Afanasiev<\/strong>, specialist \u00een problemele de securitate a informa\u021biei pentru furnizorii de cloud \u201eIT-GRAD\u201d \u0219i #CloudMTS (fac parte din grupul MTS).<\/em><\/p>\n<h2>Subtilit\u0103\u021bile clasific\u0103rii<\/h2>\n<p>Adesea ne \u00eent\u00e2lnim cu dorin\u021ba clientului de a determina rapid, f\u0103r\u0103 un audit al IS, nivelul necesar de protec\u021bie pentru ISPDn. Unele materiale de pe internet pe aceast\u0103 tem\u0103 creeaz\u0103 o impresie fals\u0103 c\u0103 aceasta este o sarcin\u0103 simpl\u0103 \u0219i c\u0103 este destul de greu s\u0103 faci o gre\u0219eal\u0103.<\/p>\n<p>Pentru a determina UZ, trebuie s\u0103 \u00een\u021belegem ce date vor fi colectate \u0219i procesate de IS-ul clientului. Uneori, este greu de definit cerin\u021bele de protec\u021bie \u0219i categoria de PDn cu care opereaz\u0103 afacerea. Acelea\u0219i tipuri de date personale pot fi evaluate \u0219i clasificate \u00een moduri foarte diferite. De aceea, \u00een unele cazuri, opinia afacerii poate diferi de opinia auditorului sau chiar a inspectorului. S\u0103 examin\u0103m c\u00e2teva exemple.<\/p>\n<p><strong>Parc auto.<\/strong> Pare s\u0103 fie un tip de afacere destul de tradi\u021bional. Multe parcuri auto func\u021bioneaz\u0103 de zeci de ani, iar proprietarii lor angajeaz\u0103 PFA, persoane fizice. De regul\u0103, datele angaja\u021bilor se \u00eencadreaz\u0103 \u00een cerin\u021bele UZ-4. Cu toate acestea, pentru a lucra cu \u0219oferii, nu este suficient s\u0103 colecta\u021bi doar datele de contact, ci trebuie s\u0103 efectua\u021bi \u0219i un control medical pe teritoriul parc\u0103rii auto \u00eenainte de a \u00eencepe turele, iar informa\u021biile colectate \u00een acest proces intr\u0103 imediat \u00een categoria datelor medicale \u2013 adic\u0103 date personale dintr-o categorie special\u0103. \u00cen plus, parcarea auto poate solicita adeverin\u021be care vor fi apoi p\u0103strate \u00een dosarul \u0219oferului. O copie electronic\u0103 a acestei adeverin\u021be con\u021bine informa\u021bii despre starea de s\u0103n\u0103tate, date personale dintr-o categorie special\u0103. Prin urmare, UZ-4 nu va fi suficient, este necesar cel pu\u021bin UZ-3.<\/p>\n<p><strong>Magazin online. <\/strong>Pare c\u0103 numele, email-urile \u0219i telefoanele colectate se \u00eencadreaz\u0103 \u00een categoria publicului larg. Cu toate acestea, dac\u0103 clien\u021bii dvs. indic\u0103 preferin\u021be gastronomice, cum ar fi halal sau ko\u0219er, astfel de informa\u021bii pot fi considerate date despre apartenen\u021ba religioas\u0103 \u0219i convingerile lor. Prin urmare, \u00een timpul unei verific\u0103ri sau al altor ac\u021biuni de control, verificatorul ar putea \u00eencadra datele colectate de dvs. \u00een categoria special\u0103 a datelor cu caracter personal. Dac\u0103 magazinul online ar colecta informa\u021bii despre preferin\u021bele consumatorului \u00een ceea ce prive\u0219te carnea sau pe\u0219tele, datele ar putea fi incluse \u00een categoria altor date cu caracter personal. Apropo, ce ar trebui s\u0103 facem cu vegetarienii? Aceasta poate fi considerat\u0103 \u0219i o convingere filosofic\u0103, care de asemenea se \u00eencadreaz\u0103 \u00een categoria special\u0103. Pe de alt\u0103 parte, ar putea fi pur \u0219i simplu o pozi\u021bie a unei persoane care a exclus carnea din dieta sa. Din p\u0103cate, nu exist\u0103 nicio tabel\u0103 care s\u0103 defineasc\u0103 \u00een mod clar categoria de date personale \u00een astfel de situa\u021bii \u201efine\u201d.<\/p>\n<p><strong>Agen\u021bie de publicitate <\/strong>prin orice serviciu de cloud occidental, proceseaz\u0103 datele publice ale clien\u021bilor s\u0103i \u2013 nume, adrese de email \u0219i telefoane. Aceste date de fi\u0219ier fac parte, desigur, din datele cu caracter personal. Se pune \u00eentrebarea: este legal\u0103 aceast\u0103 procesare? Este posibil s\u0103 transfera\u021bi astfel de date f\u0103r\u0103 a le anonimiza \u00een afara Rusiei, de exemplu, stoc\u00e2nd backup-uri \u00een unele clouduri externe? Sigur c\u0103 da. Agen\u021bia are dreptul de a stoca aceste date \u0219i \u00een afara Rusiei, \u00eens\u0103 colectarea ini\u021bial\u0103, conform legisla\u021biei noastre, trebuie efectuat\u0103 pe teritoriul Rusiei. Dac\u0103 face\u021bi backup la astfel de informa\u021bii, analiza\u021bi statistici pe baza lor, efectua\u021bi studii sau efectua\u021bi alte opera\u021bii cu acestea \u2013 toate acestea pot fi realizate \u0219i pe resurse occidentale. Punctul crucial din perspectiva legisla\u021biei este locul \u00een care se face colectarea datelor personale. De aceea, este important s\u0103 nu confunda\u021bi colectarea ini\u021bial\u0103 \u0219i procesarea.<\/p>\n<p>A\u0219a cum rezult\u0103 din aceste exemple scurte, lucrul cu datele personale nu este \u00eentotdeauna clar \u0219i simplu. Nu este suficient doar s\u0103 \u0219ti\u021bi c\u0103 lucra\u021bi cu ele, trebuie s\u0103 \u0219ti\u021bi cum s\u0103 le clasifica\u021bi corect, s\u0103 \u00een\u021belege\u021bi cum func\u021bioneaz\u0103 sistemele informa\u021bionale pentru a determina corect nivelul de protec\u021bie necesar. \u00cen unele cazuri, se poate pune \u00eentrebarea care este volumul de date personale cu adev\u0103rat necesar pentru organizare. Este posibil s\u0103 renun\u021ba\u021bi la cele mai \u201eserioase\u201d sau pur \u0219i simplu inutile date? \u00cen plus, autorit\u0103\u021bile recomand\u0103 anonimizarea datelor personale acolo unde este posibil.&nbsp;<\/p>\n<p>A\u0219a cum este cazul \u00een exemplele de mai sus, uneori se poate \u00eent\u00e2mpla ca organele de control s\u0103 interpreteze datele personale colectate \u00eentr-un mod diferit de modul \u00een care le-a\u021bi evaluat dvs. \u00een\u0219iv\u0103.<\/p>\n<p>Bine\u00een\u021beles, pute\u021bi apela ajutorul unui auditor sau integrator de sisteme, dar va fi \u201easistentul\u201d responsabil pentru deciziile luate \u00een cazul unui control? Este important de men\u021bionat c\u0103 responsabilitatea revine \u00eentotdeauna operatorului de date personale. De aceea, atunci c\u00e2nd o companie desf\u0103\u0219oar\u0103 astfel de activit\u0103\u021bi, este esen\u021bial s\u0103 se adreseze unor juc\u0103tori serio\u0219i pe pia\u021ba acestor servicii, de exemplu, companii care realizeaz\u0103 lucr\u0103ri de certificare. Companiile de certificare au o vast\u0103 experien\u021b\u0103 \u00een desf\u0103\u0219urarea acestor tipuri de activit\u0103\u021bi.<\/p>\n<h2>Op\u021biuni pentru construirea sistemelor informa\u021bionale de date personale<\/h2>\n<p>Construirea unui ITPD nu este doar o problem\u0103 tehnic\u0103, ci \u0219i \u00een mare m\u0103sur\u0103 o chestiune juridic\u0103. Directorul IT sau directorul de securitate ar trebui s\u0103 consulte cu siguran\u021b\u0103 un avocat. Deoarece \u00een companie nu \u00eentotdeauna exist\u0103 un specialist cu profilul dorit, merit\u0103 s\u0103 ne orient\u0103m spre auditori-consultan\u021bi. Multe aspecte delicate pot s\u0103 nu fie deloc evidente.<\/p>\n<p>Consultarea va permite s\u0103 determina\u021bi cu ce date personale ave\u021bi de-a face, ce nivel de protec\u021bie le este necesar. Prin urmare, ve\u021bi ob\u021bine o imagine despre IS-ul pe care trebuie s\u0103-l crea\u021bi sau s\u0103-l completa\u021bi cu m\u0103suri de protec\u021bie \u0219i ORD.<\/p>\n<p>Adesea, alegerea pentru companie const\u0103 \u00een dou\u0103 op\u021biuni:<\/p>\n<ol>\n<li>\n<p>Construirea unui IS corespunz\u0103tor pe solu\u021biile sale software-hardware, posibil \u00een server room-ul propriu.<\/p>\n<\/li>\n<li>\n<p>Apelarea la un furnizor de cloud \u0219i alegerea unei solu\u021bii elastice, deja atestate, precum o 'server room virtual\u0103'.<\/p>\n<\/li>\n<\/ol>\n<p>Majoritatea IS-urilor care proceseaz\u0103 PDat folose\u0219te o abordare tradi\u021bional\u0103, care, din punct de vedere al afacerii, este greu de numit u\u0219oar\u0103 \u0219i reu\u0219it\u0103. Atunci c\u00e2nd alege\u021bi aceast\u0103 op\u021biune, este necesar s\u0103 \u00een\u021belege\u021bi c\u0103 proiectul tehnic va include descrierea echipamentului, inclusiv solu\u021biile software-hardware \u0219i platformele. Asta \u00eenseamn\u0103 c\u0103 va trebui s\u0103 v\u0103 confrunta\u021bi cu urm\u0103toarele dificult\u0103\u021bi \u0219i limit\u0103ri:<\/p>\n<ul>\n<li>\n<p>dificultate \u00een scalare;<\/p>\n<\/li>\n<li>\n<p>timp lung de implementare a proiectului: este necesar s\u0103 alege\u021bi, s\u0103 achizi\u021biona\u021bi, s\u0103 instala\u021bi, s\u0103 configura\u021bi \u0219i s\u0103 descrie\u021bi sistemul;<\/p>\n<\/li>\n<li>\n<p>o mul\u021bime de munc\u0103 'pe h\u00e2rtie', de exemplu - elaborarea unui pachet complet de documenta\u021bie pentru \u00eentregul ITPD.<\/p>\n<\/li>\n<\/ul>\n<p>\u00cen plus, afacerea, de regul\u0103, \u00een\u021belege doar nivelul 'superior' al IS-ului s\u0103u - aplica\u021biile de afaceri utilizate. Cu alte cuvinte, personalul IT este calificat \u00een domeniul s\u0103u specific. Lipsa \u00een\u021belegerii modului \u00een care func\u021bioneaz\u0103 toate 'nivelurile inferioare': mijloacele de protec\u021bie software-hardware, sistemele de stocare, backup-ul \u0219i, bine\u00een\u021beles, cum s\u0103 configura\u021bi mijloacele de protec\u021bie respect\u00e2nd toate cerin\u021bele, s\u0103 construi\u021bi partea 'hardware' a configura\u021biei. Este important s\u0103 \u00een\u021belege\u021bi: este un volum uria\u0219 de cuno\u0219tin\u021be care dep\u0103\u0219e\u0219te afacerea clientului. Aici poate fi util\u0103 experien\u021ba furnizorului de cloud, care ofer\u0103 o 'server room virtual\u0103' atestat\u0103.<\/p>\n<p>\u00cen schimb, furnizorii de cloud au o serie de avantaje care, f\u0103r\u0103 \u00eendoial\u0103, pot acoperi 99% din nevoile afacerilor \u00een domeniul protec\u021biei datelor personale:<\/p>\n<ul>\n<li>\n<p>costurile de capital se transform\u0103 \u00een costuri opera\u021bionale;<\/p>\n<\/li>\n<li>\n<p>furnizorul, la r\u00e2ndul s\u0103u, garanteaz\u0103 asigurarea unui nivel necesar de securitate \u0219i disponibilitate pe baza unei solu\u021bii standard verificate;<\/p>\n<\/li>\n<li>\n<p>nu este necesar s\u0103 angajezi o echip\u0103 de speciali\u0219ti care s\u0103 asigure func\u021bionarea ISPDn la nivel de 'hardware';<\/p>\n<\/li>\n<li>\n<p>furnizorii ofer\u0103 solu\u021bii mult mai flexibile \u0219i elastice;<\/p>\n<\/li>\n<li>\n<p>speciali\u0219tii furnizorului au toate certificatele necesare;<\/p>\n<\/li>\n<li>\n<p>conformitatea nu este mai mic\u0103 dec\u00e2t \u00een cazul construirii unei arhitecturi proprii, av\u00e2nd \u00een vedere cerin\u021bele \u0219i recomand\u0103rile autorit\u0103\u021bilor de reglementare.<\/p>\n<\/li>\n<\/ul>\n<p>Vechea mitologie conform c\u0103reia datele personale nu pot fi stocate \u00een cloud este \u00eenc\u0103 extrem de popular\u0103. Este adev\u0103rat doar par\u021bial: datele personale nu pot fi stocate <em>\u00een orice cloud la \u00eent\u00e2mplare.<\/em> Este necesar\u0103 respectarea unor m\u0103suri tehnice, aplicarea unor solu\u021bii certificate. Dac\u0103 furnizorul respect\u0103 toate cerin\u021bele legale, riscurile asociate cu scurgerile de date personale sunt reduse la minimum. Multe dintre furnizori au o infrastructur\u0103 separat\u0103 pentru procesarea datelor personale conform 152-FZ. Totu\u0219i, alegerea furnizorului trebuie s\u0103 fie f\u0103cut\u0103 av\u00e2nd \u00een vedere anumite criterii, pe care le vom aborda mai jos.&nbsp;<\/p>\n<p>Clien\u021bii vin adesea la noi cu anumite temeri legate de stocarea datelor personale \u00een cloud-ul furnizorului. Haide\u021bi s\u0103 le discut\u0103m imediat.<\/p>\n<ul>\n<li>\n<p>Datele pot fi furate \u00een timpul transferului sau migra\u021biei<\/p>\n<\/li>\n<\/ul>\n<p>Nu trebuie s\u0103 te temi de acest lucru - furnizorul ofer\u0103 clientului crearea unui canal de transfer de date securizat, construit pe solu\u021bii certificate, m\u0103suri de autentificare \u00eent\u0103rite pentru parteneri \u0219i angaja\u021bi. R\u0103m\u00e2ne doar s\u0103 alegi metodele adecvate de protec\u021bie \u0219i s\u0103 le implementezi \u00een cadrul colabor\u0103rii cu clientul.<\/p>\n<ul>\n<li>\n<p>Vor veni masca\u021bii \u0219i vor duce\/\u00eembolica\/oprinde serverul<\/p>\n<\/li>\n<\/ul>\n<p>Este destul de u\u0219or de \u00een\u021beles de ce clien\u021bii se tem c\u0103 procesele lor de afaceri vor fi afectate din cauza controlului insuficient asupra infrastructurii. De obicei, acest lucru este g\u00e2ndit de clien\u021bii ale c\u0103ror echipamente erau anterior amplasate \u00een servere mici, nu \u00een centre de date specializate. \u00cen realitate, centrele de date sunt echipate cu cele mai moderne mijloace de protec\u021bie at\u00e2t fizic\u0103, c\u00e2t \u0219i informa\u021bional\u0103. Orice opera\u021biune \u00eentr-un astfel de centru de date este practic imposibil de realizat f\u0103r\u0103 motive \u0219i documenta\u021bie suficient\u0103, iar aceste activit\u0103\u021bi necesit\u0103 respectarea unei serii de proceduri. \u00cen plus, \u201escoaterea\u201d serverului dumneavoastr\u0103 din centru poate afecta al\u021bi clien\u021bi ai furnizorului, \u0219i acest lucru nu este dorit de nimeni. Mai mult, nimeni nu va putea indica cu degetul exact \u201eserverul dumneavoastr\u0103\u201d virtual, a\u0219a c\u0103, dac\u0103 cineva dore\u0219te s\u0103-l fure sau s\u0103 organizeze o opera\u021biune de mascat, va trebui mai \u00eent\u00e2i s\u0103 se confrunte cu o mul\u021bime de proceduri birocratice. \u00cen acest timp, este foarte probabil s\u0103 reu\u0219i\u021bi s\u0103 migra\u021bi de c\u00e2teva ori pe o alt\u0103 platform\u0103.<\/p>\n<ul>\n<li>\n<p>Hackeri vor sparge norul \u0219i vor fura datele<\/p>\n<\/li>\n<\/ul>\n<p>Internetul \u0219i presa tip\u0103rit\u0103 sunt pline de titluri despre cum un alt nor a c\u0103zut victim\u0103 criminalilor cibernetici, iar milioane de \u00eenregistr\u0103ri cu date personale au fost scurse pe internet. \u00cen majoritatea cazurilor, vulnerabilit\u0103\u021bile nu au fost descoperite de partea furnizorului, ci \u00een sistemele informa\u021bionale ale victimelor: parole slabe sau complet implicite, \u201eg\u0103uri\u201d \u00een motoarele site-urilor \u0219i baze de date, neglijen\u021ba banal\u0103 a afacerilor \u00een alegerea mijloacelor de protec\u021bie \u0219i organizarea procedurilor de acces la date. Toate solu\u021biile certificate sunt verificate pentru vulnerabilit\u0103\u021bi. De asemenea, noi efectuam periodic \u201eteste\u201d de penetrare \u0219i audite de securitate at\u00e2t independent, c\u00e2t \u0219i cu ajutorul organiza\u021biilor externe. Pentru furnizor, aceasta este o chestiune de reputa\u021bie \u0219i de afacere \u00een general.<\/p>\n<ul>\n<li>\n<p>Furnizorul\/angaja\u021bii furnizorului vor fura datele personale \u00een scopuri egoiste<\/p>\n<\/li>\n<\/ul>\n<p>Aceasta este o chestiune destul de delicat\u0103. O serie de companii din domeniul securit\u0103\u021bii informa\u021biilor \u00ee\u0219i \u201e\u00eengrozesc\u201d clien\u021bii \u0219i insist\u0103 asupra ideii c\u0103 \u201eangaja\u021bii interni sunt mai periculo\u0219i dec\u00e2t hackerii externi\u201d. Poate c\u0103 \u00een unele cazuri este adev\u0103rat, dar afacerea nu poate fi construit\u0103 f\u0103r\u0103 \u00eencredere. Din c\u00e2nd \u00een c\u00e2nd, apar \u0219tiri c\u0103 proprii angaja\u021bi ai organiza\u021biilor v\u00e2nd datele clien\u021bilor unor r\u0103uf\u0103c\u0103tori, iar securitatea intern\u0103 este adesea organizat\u0103 mult mai slab dec\u00e2t cea extern\u0103. Este important s\u0103 \u00een\u021belegem c\u0103 orice furnizor mare nu este deloc interesat de cazurile negative. Ac\u021biunile angaja\u021bilor furnizorului sunt bine reglementate, iar rolurile \u0219i zonele de responsabilitate sunt clar definite. Toate procesele de afaceri sunt structurate astfel \u00eenc\u00e2t cazurile de scurgere a datelor sunt extrem de pu\u021bin probabile \u0219i sunt \u00eentotdeauna observate de serviciile interne, a\u0219a c\u0103 clien\u021bii nu trebuie s\u0103-\u0219i fac\u0103 griji \u00een aceast\u0103 privin\u021b\u0103.<\/p>\n<ul>\n<li>\n<p>Pl\u0103ti\u021bi pu\u021bin, deoarece pl\u0103ti\u021bi serviciile cu datele afacerii dumneavoastr\u0103.<\/p>\n<\/li>\n<\/ul>\n<p>\u00cenc\u0103 un mit: clientul care \u00eenchiriaz\u0103 o infrastructur\u0103 protejat\u0103 la un pre\u021b convenabil, de fapt, pl\u0103te\u0219te pentru aceasta cu datele sale \u2013 a\u0219a cred adesea speciali\u0219tii care nu se sfiesc s\u0103 citeasc\u0103 c\u00e2teva teorii ale conspira\u021biei \u00eenainte de culcare. \u00cen primul r\u00e2nd, posibilitatea de a efectua opera\u021biuni cu datele dumneavoastr\u0103, \u00een afar\u0103 de cele specificate \u00een contract, este practic zero. \u00cen al doilea r\u00e2nd, un furnizor responsabil \u00ee\u0219i apreciaz\u0103 rela\u021biile cu clien\u021bii \u0219i reputa\u021bia \u2013 pe l\u00e2ng\u0103 dumneavoastr\u0103, el are \u0219i mul\u021bi al\u021bi clien\u021bi. Este mai probabil scenariul invers, \u00een care furnizorul va ap\u0103ra cu str\u0103\u0219nicie datele clien\u021bilor s\u0103i, pe care depinde, printre altele, \u0219i afacerea sa.<\/p>\n<h2>Alegerea unui furnizor de cloud pentru procesarea datelor cu caracter personal<\/h2>\n<p>\u00cen prezent, pia\u021ba ofer\u0103 numeroase solu\u021bii pentru companiile care sunt operatori de date cu caracter personal. Mai jos, oferim o list\u0103 general\u0103 de recomand\u0103ri pentru alegerea celui mai potrivit.<\/p>\n<ul>\n<li>\n<p>Furnizorul trebuie s\u0103 fie preg\u0103tit s\u0103 \u00eencheie un contract oficial care s\u0103 descrie responsabilit\u0103\u021bile p\u0103r\u021bilor, SLA-ul \u0219i zonele de responsabilitate \u00een contextul proces\u0103rii datelor cu caracter personal. De fapt, \u00eentre dumneavoastr\u0103 \u0219i furnizor, \u00een afar\u0103 de contractul de servicii, ar trebui s\u0103 fie semnat \u0219i un mandat pentru procesarea datelor cu caracter personal. \u00cen orice caz, merit\u0103 s\u0103 le studia\u021bi cu aten\u021bie. Este important s\u0103 \u00een\u021belege\u021bi delimitarea responsabilit\u0103\u021bilor \u00eentre dumneavoastr\u0103 \u0219i furnizor.<\/p>\n<\/li>\n<li>\n<p>Re\u021bine\u021bi c\u0103 segmentul trebuie s\u0103 corespund\u0103 cerin\u021belor, adic\u0103 s\u0103 aib\u0103 un certificat care s\u0103 indice un nivel de securitate de cel pu\u021bin c\u00e2t este necesar pentru sistemul dumneavoastr\u0103 informa\u021bional. Se \u00eent\u00e2mpl\u0103 ca furnizorii s\u0103 publice doar prima pagin\u0103 a certificatului, din care nu se \u00een\u021belege prea multe, sau s\u0103 fac\u0103 referire la audit sau la proceduri de conformitate, f\u0103r\u0103 a publica efectiv certificatul (\u201ea fost b\u0103iatul?\u201d). Merit\u0103 s\u0103-l solicita\u021bi - este un document public \u00een care se indic\u0103 cine a efectuat certificarea, perioada de valabilitate, loca\u021bia norului etc.<\/p>\n<\/li>\n<li>\n<p>Furnizorul trebuie s\u0103 ofere informa\u021bii despre loca\u021bia infrastructurii sale (obiectele de protec\u021bie), pentru a putea controla amplasarea datelor dumneavoastr\u0103. S\u0103 ne amintim c\u0103 colectarea ini\u021bial\u0103 a datelor personale trebuie s\u0103 se efectueze pe teritoriul Federa\u021biei Ruse, prin urmare, \u00een contract\/certificat ar trebui s\u0103 fie vizibile adresele centrelor de date.<\/p>\n<\/li>\n<li>\n<p>Furnizorul trebuie s\u0103 utilizeze produse de protec\u021bie certificate. Desigur, majoritatea furnizorilor nu public\u0103 informa\u021bii despre solu\u021biile tehnice de protec\u021bie utilizate \u0219i arhitectura acestora. Dar ca \u0219i client, nu ve\u021bi putea s\u0103 nu \u0219ti\u021bi despre acest lucru. De exemplu, pentru conectarea la sistemul de management (portalul de gestionare) trebuie s\u0103 folosi\u021bi solu\u021bii de protec\u021bie. Furnizorul nu va putea sa evite aceast\u0103 cerin\u021b\u0103 \u0219i v\u0103 va oferi (sau va solicita s\u0103 utiliza\u021bi) solu\u021bii certificate. Testa\u021bi resursele \u0219i ve\u021bi \u00een\u021belege imediat cum \u0219i ce este organizat.&nbsp;<\/p>\n<\/li>\n<li>\n<p>Este extrem de recomandat ca furnizorul de servicii cloud s\u0103 ofere servicii suplimentare \u00een domeniul securit\u0103\u021bii informa\u021biei. Acestea pot fi diverse servicii: protec\u021bie \u00eempotriva atacurilor DDoS \u0219i WAF, serviciu antivirus sau sandbox etc. Toate acestea v\u0103 vor permite s\u0103 ob\u021bine\u021bi protec\u021bie ca serviciu, f\u0103r\u0103 a v\u0103 distrage aten\u021bia de la construirea sistemelor de protec\u021bie, \u0219i s\u0103 v\u0103 ocupa\u021bi de aplica\u021biile de afaceri.<\/p>\n<\/li>\n<li>\n<p>Furnizorul trebuie s\u0103 fie autorizat de FSTEC \u0219i FSB. De regul\u0103, astfel de informa\u021bii sunt publicate direct pe site. Asigura\u021bi-v\u0103 c\u0103 solicita\u021bi aceste documente \u0219i verifica\u021bi dac\u0103 adresele serviciilor, denumirea companiei furnizorului etc. sunt corecte.&nbsp;<\/p>\n<\/li>\n<\/ul>\n<p>S\u0103 rezum\u0103m. \u00cenchirierea infrastructurii va permite renun\u021barea la CAPEX \u0219i p\u0103strarea \u00een zona dumneavoastr\u0103 de responsabilitate doar a aplica\u021biilor de afaceri \u0219i a datelor, iar greul atest\u0103rii \u201ehardului\u201d \u0219i a resurselor software se va transfera furnizorului.<\/p>\n<h3>Cum am trecut examenul de certificare<\/h3>\n<p>Recent, we successfully passed the re-certification of the infrastructure of the \"Protected Cloud FZ-152\" for compliance with the requirements for working with personal data. The work was conducted by the \"National Certification Center.\"<\/p>\n<p>Currently, the \"Protected Cloud FZ-152\" is certified for hosting information systems that are involved in the processing, storage, or transmission of personal data (ISPDn) in accordance with the requirements of level UZ-3.<\/p>\n<p>The certification procedure involves checking the compliance of the cloud provider's infrastructure with the required protection level. The provider itself offers IaaS services and is not a personal data operator. The process assesses both organizational (documentation, orders, etc.) and technical measures (configuration of protection means, etc.).<\/p>\n<p>It cannot be called trivial. Despite the fact that the GOST for programs and methods for conducting certification events appeared back in 2013, there are still no strict programs for cloud objects. Certification centers develop these programs based on their own expertise. With the emergence of new technologies, the programs become more complex and modernized, accordingly, the certifier must have experience working with cloud solutions and understand the specifics.<\/p>\n<p>In our case, the object of protection consists of two locations.<\/p>\n<ul>\n<li>\n<p>The cloud resources (servers, storage systems, network infrastructure, protection means, etc.) are located directly in the data center. Undoubtedly, such a virtual data center is connected to public networks, and certain requirements for firewalling must be met, for example, the use of certified firewalls.<\/p>\n<\/li>\n<li>\n<p>The second part of the object is the cloud management tools. These are the workstations (administrator's workplace) from which the protected segment is managed.<\/p>\n<\/li>\n<\/ul>\n<p>The locations are connected through <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/vpn\/\"   title=\"VPN\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"131\">VPN<\/a>-channel, built on SKZI.<\/p>\n<p>Since virtualization technologies create conditions for the emergence of threats, we also use additional certified protection means.<\/p>\n<p><img decoding=\"async\" alt=\"IaaS 152-FZ: deci, ave\u021bi nevoie de securitate\" src=\"\/wp-content\/uploads\/2020\/09\/611ca4c92615fffb675864b72dcaa2f8.jpg\" style=\"display:block;margin: 0 auto;\" \/>Structural scheme \"through the eyes of the certifier\"<\/p>\n<p>Dac\u0103 clientul are nevoie de certificarea sistemului s\u0103u de gestionare a datelor cu caracter personal, dup\u0103 \u00eenchirierea IaaS, va trebui doar s\u0103 evalueze sistemul informa\u021bional, care dep\u0103\u0219e\u0219te nivelul unui data center virtual. Aceast\u0103 procedur\u0103 implic\u0103 verificarea infrastructurii \u0219i a software-ului utilizat. Deoarece pentru toate problemele legate de infrastructur\u0103 pute\u021bi face referire la certificatul furnizorului, va trebui doar s\u0103 efectua\u021bi lucr\u0103ri cu software-ul.<\/p>\n<p><img decoding=\"async\" alt=\"IaaS 152-FZ: deci, ave\u021bi nevoie de securitate\" src=\"\/wp-content\/uploads\/2020\/09\/4b0f5c72f8460c2a81068887efc8c9b1.jpg\" style=\"display:block;margin: 0 auto;\" \/>\u00cemp\u0103r\u021birea la nivel de abstractizare<\/p>\n<p>\u00cen concluzie, v\u0103 prezent\u0103m o scurt\u0103 list\u0103 de verificare pentru companiile care deja lucreaz\u0103 cu datele cu caracter personal sau care doar planific\u0103 s\u0103 o fac\u0103. A\u0219adar, cum s\u0103 gestiona\u021bi \u0219i s\u0103 evita\u021bi capcanele.<\/p>\n<ol>\n<li>\n<p>Pentru audit \u0219i dezvoltarea modelelor de amenin\u021bare \u0219i a infractorilor, invita\u021bi un consultant experimentat din r\u00e2ndul laboratoarelor de certificare, care v\u0103 poate ajuta s\u0103 dezvolta\u021bi documentele necesare \u0219i s\u0103 v\u0103 duc\u0103 deja la etapa solu\u021biilor tehnice.<\/p>\n<\/li>\n<li>\n<p>\u00cen etapa de alegere a furnizorului de cloud, fi\u021bi aten\u021bi la existen\u021ba certificatului. Este un avantaj dac\u0103 compania l-a publicat \u00een mod deschis pe site-ul s\u0103u. Furnizorul trebuie s\u0103 fie licen\u021biat de FSTEC \u0219i FSB, iar serviciul oferit de acesta s\u0103 fie certificat.<\/p>\n<\/li>\n<li>\n<p>Asigura\u021bi-v\u0103 c\u0103 ve\u021bi avea un contract oficial \u00eencheiat \u0219i un mandat semnat pentru procesarea datelor cu caracter personal. Pe baza acestui lucru, ve\u021bi putea efectua at\u00e2t verificarea conformit\u0103\u021bii, c\u00e2t \u0219i certificarea sistemului de gestionare a datelor cu caracter personal. Dac\u0103 aceste lucr\u0103ri \u00een etapa proiectului tehnic \u0219i a elabor\u0103rii documenta\u021biei tehnice vi se par cople\u0219itoare, merit\u0103 s\u0103 apela\u021bi la companii de consultan\u021b\u0103 externe din r\u00e2ndul laboratoarelor de certificare.<\/p>\n<\/li>\n<\/ol>\n<p>Dac\u0103 ave\u021bi \u00eentreb\u0103ri legate de procesarea datelor cu caracter personal, pe 18 septembrie, \u00een aceast\u0103 vineri, vom fi bucuro\u0219i s\u0103 v\u0103 \u00eent\u00e2mpin\u0103m la webinar <noindex><a rel=\"nofollow\" href=\"https:\/\/event.it-grad.ru\/certification?utm_source=habr&amp;utm_medium=article&amp;utm_campaign=anons18092020\"><u>\u201eParticularit\u0103\u021bile construirii cloud-urilor certificate\u201d<\/u><\/a><\/noindex>.<\/p>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/it-grad\/blog\/519276\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u043a\u043e\u043b\u044c\u043a\u043e \u0431\u044b \u043d\u0438 \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u043b\u0438 \u043c\u0438\u0444\u044b \u0438 \u043b\u0435\u0433\u0435\u043d\u0434\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u043e \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0435 152-\u0424\u0417, \u0447\u0442\u043e-\u0442\u043e \u0432\u0441\u0435\u0433\u0434\u0430 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0437\u0430 \u043a\u0430\u0434\u0440\u043e\u043c. \u0421\u0435\u0433\u043e\u0434\u043d\u044f \u043c\u044b \u0445\u043e\u0442\u0438\u043c \u043e\u0431\u0441\u0443\u0434\u0438\u0442\u044c \u043d\u0435 \u0432\u0441\u0435\u0433\u0434\u0430 \u043e\u0447\u0435\u0432\u0438\u0434\u043d\u044b\u0435 \u043d\u044e\u0430\u043d\u0441\u044b, \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438 \u043c\u043e\u0433\u0443\u0442 \u0441\u0442\u043e\u043b\u043a\u043d\u0443\u0442\u044c\u0441\u044f \u043a\u0430\u043a \u043a\u0440\u0443\u043f\u043d\u044b\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0442\u0430\u043a \u0438 \u0441\u043e\u0432\u0441\u0435\u043c \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0438\u0435 \u043f\u0440\u0435\u0434\u043f\u0440\u0438\u044f\u0442\u0438\u044f: \u0442\u043e\u043d\u043a\u043e\u0441\u0442\u0438 \u043a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u041f\u0414\u043d \u043f\u043e \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u044f\u043c \u2014 \u043a\u043e\u0433\u0434\u0430 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d \u0441\u043e\u0431\u0438\u0440\u0430\u0435\u0442 \u0434\u0430\u043d\u043d\u044b\u0435, \u043e\u0442\u043d\u043e\u0441\u044f\u0449\u0438\u0435\u0441\u044f \u043a \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u043a\u0430\u0442\u0435\u0433\u043e\u0440\u0438\u0438, \u0434\u0430\u0436\u0435 \u043d\u0435 \u0437\u043d\u0430\u044f \u043e\u0431 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":94451,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-94450","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u043a\u043e\u043b\u044c\u043a\u043e \u0431\u044b \u043d\u0438 \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u043b\u0438 \u043c\u0438\u0444\u044b \u0438 \u043b\u0435\u0433\u0435\u043d\u0434\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/iaas-152-fz-itak-vam-nuzhna-bezopasnost\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47IaaS 152-\u0424\u0417: \u0438\u0442\u0430\u043a, \u0432\u0430\u043c \u043d\u0443\u0436\u043d\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u043a\u043e\u043b\u044c\u043a\u043e \u0431\u044b \u043d\u0438 \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u043b\u0438 \u043c\u0438\u0444\u044b \u0438 \u043b\u0435\u0433\u0435\u043d\u0434\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/iaas-152-fz-itak-vam-nuzhna-bezopasnost\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-09-17T05:42:44+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-09-17T05:42:44+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47IaaS 152-FZ: a\u0219adar, ave\u021bi nevoie de securitate | ProHoster","description":"Indiferent c\u00e2t de multe mituri \u0219i legende sunt discutate.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/iaas-152-fz-itak-vam-nuzhna-bezopasnost","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47IaaS 152-\u0424\u0417: \u0438\u0442\u0430\u043a, \u0432\u0430\u043c \u043d\u0443\u0436\u043d\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c | ProHoster","og:description":"\u0421\u043a\u043e\u043b\u044c\u043a\u043e \u0431\u044b \u043d\u0438 \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u043b\u0438 \u043c\u0438\u0444\u044b \u0438 \u043b\u0435\u0433\u0435\u043d\u0434\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u043c\u0438.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/iaas-152-fz-itak-vam-nuzhna-bezopasnost","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-17T05:42:44+00:00","article:modified_time":"2020-09-17T05:42:44+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94450","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:26:28","updated":"2026-02-04 14:42:07","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/94450","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=94450"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/94450\/revisions"}],"predecessor-version":[{"id":156760,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/94450\/revisions\/156760"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/94451"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=94450"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=94450"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=94450"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}