{"id":29957,"date":"2019-10-31T21:32:53","date_gmt":"2019-10-31T18:32:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/skanirovanie-na-uyazvimosti-i-bezopasnaya-razrabotka-chast-1\/"},"modified":"2019-10-31T21:32:53","modified_gmt":"2019-10-31T18:32:53","slug":"skanirovanie-na-uyazvimosti-i-bezopasnaya-razrabotka-chast-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/skanirovanie-na-uyazvimosti-i-bezopasnaya-razrabotka-chast-1","title":{"rendered":"Skenovanie na zranite\u013enosti a bezpe\u010dn\u00fd v\u00fdvoj. \u010cas\u0165 1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Skenovanie
\n
\nV r\u00e1mci profesion\u00e1lnej \u010dinnosti sa v\u00fdvoj\u00e1ri, pentesteri a bezpe\u010dnostn\u00ed experti stret\u00e1vaj\u00fa s procesmi ako je spr\u00e1va zranite\u013enost\u00ed (VM) a (bezpe\u010dn\u00fd) SDLC.
\nPod t\u00fdmito pojmami sa skr\u00fdvaj\u00fa r\u00f4zne s\u00fabory prakt\u00edk a n\u00e1strojov, ktor\u00e9 s\u00fa navz\u00e1jom prepojen\u00e9, hoci ich pou\u017e\u00edvatelia sa l\u00ed\u0161ia.<\/p>\n

Technick\u00fd pokrok zatia\u013e nedosiahol \u00farove\u0148, aby mohol jeden n\u00e1stroj nahradi\u0165 \u010dloveka pri anal\u00fdze bezpe\u010dnosti infra\u0161trukt\u00fary a softv\u00e9ru.
\nZauj\u00edmav\u00e9 je pochopi\u0165, pre\u010do je to tak a s ak\u00fdmi probl\u00e9mami sa mus\u00edme vyrovn\u00e1va\u0165.
\n<\/a><\/noindex><\/p>\n

Procesy<\/h2>\n

\nProces spr\u00e1vy zranite\u013enost\u00ed (\u2018vulnerability management\u2019) je ur\u010den\u00fd na nepretr\u017eit\u00e9 sledovanie bezpe\u010dnosti infra\u0161trukt\u00fary a spr\u00e1vy opr\u00e1v.
\nProces bezpe\u010dn\u00e9ho SDLC (\u2018secure SDLC\u2019) je ur\u010den\u00fd na podporu bezpe\u010dnosti aplik\u00e1cie po\u010das v\u00fdvoja a prev\u00e1dzky.<\/p>\n

S\u00favisiacou s\u00fa\u010das\u0165ou t\u00fdchto procesov je proces hodnotenia zranite\u013enost\u00ed \u2014 skenovanie na zranite\u013enosti.
\nHlavn\u00fd rozdiel v skenovan\u00ed v r\u00e1mci VM a SDLC spo\u010d\u00edva v tom, \u017ee v prvom pr\u00edpade je cie\u013eom odhali\u0165 zn\u00e1me zranite\u013enosti v externom softv\u00e9ri alebo v konfigur\u00e1cii. Napr\u00edklad zastaran\u00fa verziu Windows alebo predvolen\u00fa komunitn\u00fa re\u0165azec pre SNMP.
\nV druhom pr\u00edpade je cie\u013eom zisti\u0165 zranite\u013enosti nielen v extern\u00fdch komponentoch (z\u00e1vislostiach), ale predov\u0161etk\u00fdm v k\u00f3de nov\u00e9ho produktu.<\/p>\n

To vytv\u00e1ra rozdiely v n\u00e1strojoch a pr\u00edstupoch. Pod\u013ea m\u00f4jho n\u00e1zoru je \u00faloha h\u013eadania nov\u00fdch zranite\u013enost\u00ed v aplik\u00e1cii podstatne zauj\u00edmavej\u0161ia, preto\u017ee sa nezredukuje len na odtla\u010dok verz\u00ed, zhroma\u017e\u010fovanie bannerov, sk\u00fa\u0161anie hesiel a podobne.
\nNa kvalitn\u00e9 automatizovan\u00e9 skenovanie zranite\u013enost\u00ed aplik\u00e1ci\u00ed s\u00fa potrebn\u00e9 algoritmy, ktor\u00e9 zoh\u013ead\u0148uj\u00fa semantiku aplik\u00e1cie, jej \u00fa\u010del a \u0161pecifick\u00e9 hrozby.<\/p>\n

Infrastruktur\u00e1lny skener je \u010dasto mo\u017en\u00e9 nahradi\u0165 \u010dasova\u010dom, ako povedal avleonov<\/a><\/noindex>. Zmyslom je, \u017ee \u010disto \u0161tatisticky m\u00f4\u017eete pova\u017eova\u0165 va\u0161u infra\u0161trukt\u00faru za zranite\u013en\u00fa, ak ste ju neaktualizovali, povedzme, mesiac.<\/p>\n

N\u00e1stroje<\/h2>\n

\nSkenovanie, rovnako ako anal\u00fdza bezpe\u010dnosti, m\u00f4\u017ee by\u0165 vykon\u00e1van\u00e9 ako \u010diernou skrinkou, tak aj bielou skrinkou.<\/p>\n

\u010cierna skrinka<\/h4>\n

\nPri blackbox skenovan\u00ed mus\u00ed n\u00e1stroj vedie\u0165 pracova\u0165 so slu\u017ebou cez tie ist\u00e9 rozhrania, cez ktor\u00e9 s \u0148ou pracuj\u00fa pou\u017e\u00edvatelia.<\/p>\n

Skenery infra\u0161trukt\u00fary (Tenable Nessus, Qualys, MaxPatrol, Rapid7 Nexpose at\u010f.) h\u013eadaj\u00fa otvoren\u00e9 sie\u0165ov\u00e9 porty, zbieraj\u00fa \u201ebannerov\u00e9\u201c hl\u00e1senia, ur\u010duj\u00fa verzie nain\u0161talovan\u00e9ho softv\u00e9ru a h\u013eadaj\u00fa v svojej datab\u00e1ze znalost\u00ed inform\u00e1cie o zranite\u013enostiach v t\u00fdchto verzi\u00e1ch. Taktie\u017e sa sna\u017eia odhali\u0165 chyby konfigur\u00e1cie, ako s\u00fa predvolen\u00e9 hesl\u00e1 alebo otvoren\u00fd pr\u00edstup k d\u00e1tam, slab\u00e9 SSL \u0161ifrovanie at\u010f.<\/p>\n

Skenery webov\u00fdch aplik\u00e1ci\u00ed (Acunetix WVS, Netsparker, Burp Suite, OWASP ZAP at\u010f.) dok\u00e1\u017eu taktie\u017e ur\u010di\u0165 zn\u00e1me komponenty a ich verzie (napr\u00edklad CMS, frameworky, JS kni\u017enice). Hlavn\u00e9 kroky skenera s\u00fa crawl a fuzzing.
\nPo\u010das crawlingu skener zbiera inform\u00e1cie o existuj\u00facich rozhraniach aplik\u00e1cie a HTTP parametroch. Po\u010das fuzzingu s\u00fa do v\u0161etk\u00fdch zisten\u00fdch parametrov vlo\u017een\u00e9 mutovan\u00e9 alebo generovan\u00e9 d\u00e1ta s cie\u013eom vyvola\u0165 chybu a odhali\u0165 zranite\u013enos\u0165.<\/p>\n

Tak\u00e9to skenery aplik\u00e1ci\u00ed patr\u00ed do tried DAST a IAST \u2014 teda Dynamic a Interactive Application Security Testing.<\/p>\n

Biely box<\/h4>\n

\nPri whitebox-skenerovan\u00ed je rozdielov viac.
\nV r\u00e1mci procesu VM skenerom (Vulners, Incsecurity Couch, Vuls, Tenable Nessus at\u010f.) sa \u010dasto poskytuje pr\u00edstup k syst\u00e9mom prostredn\u00edctvom autentifikovan\u00e9ho skenovania. Takto m\u00f4\u017ee skener na\u010d\u00edta\u0165 nain\u0161talovan\u00e9 verzie bal\u00edkov a konfigura\u010dn\u00e9 parametre priamo zo syst\u00e9mu, bez toho aby ich h\u00e1dal pod\u013ea bannerov sie\u0165ov\u00fdch slu\u017eieb.
\nSkenovanie je presnej\u0161ie a \u00faplnej\u0161ie.<\/p>\n

\u010co sa t\u00fdka whitebox-skenerovania (CheckMarx, HP Fortify, Coverity, RIPS, FindSecBugs at\u010f.) aplik\u00e1ci\u00ed, spravidla ide o statick\u00fa anal\u00fdzu k\u00f3du a vyu\u017eitie pr\u00edslu\u0161n\u00fdch n\u00e1strojov triedy SAST \u2014 Static Application Security Testing.<\/p>\n

Probl\u00e9my<\/h2>\n

\nVyskytuje sa mno\u017estvo probl\u00e9mov so skenovan\u00edm! S v\u00e4\u010d\u0161inou z nich sa stret\u00e1vam osobne v r\u00e1mci poskytovania slu\u017eieb pre budovanie procesov skenovania a bezpe\u010dn\u00e9ho v\u00fdvoja, ako aj pri vykon\u00e1van\u00ed pr\u00e1c na anal\u00fdze zabezpe\u010denia.<\/p>\n

Vypichnem tri hlavn\u00e9 skupiny probl\u00e9mov, ktor\u00e9 sa potvrdzuj\u00fa aj v rozhovoroch s in\u017einiermi a ved\u00facimi oddelen\u00ed IT bezpe\u010dnosti v r\u00f4znych spolo\u010dnostiach.<\/p>\n

Probl\u00e9my so skenovan\u00edm webov\u00fdch aplik\u00e1ci\u00ed<\/h4>\n

<\/p>\n

    \n
  1. N\u00e1ro\u010dnos\u0165 implement\u00e1cie.<\/b> Skenery je potrebn\u00e9 rozlo\u017ei\u0165, konfigurova\u0165 a prisp\u00f4sobi\u0165 ka\u017ed\u00e9mu jednotliv\u00e9mu aplik\u00e1ci\u00ed, vy\u010dleni\u0165 testovacie prostredie pre skeny a implementova\u0165 do procesu CI\/CD, aby boli \u00fa\u010dinn\u00e9. Inak to bude zbyto\u010dn\u00e1 form\u00e1lna proced\u00fara, ktor\u00e1 vyprodukuje len falo\u0161n\u00e9 poplachy.<\/li>\n
  2. Trvanie skenovania.<\/b> Skenery sa aj v roku 2019 \u0165a\u017eko vyrovn\u00e1vaj\u00fa s deduplik\u00e1ciou rozhran\u00ed a m\u00f4\u017eu dni skenova\u0165 tis\u00edc str\u00e1nok s desiatimi parametrami na ka\u017edej, pova\u017euj\u00fac ich za r\u00f4zne, hoci za ne zodpoved\u00e1 ten ist\u00fd k\u00f3d. Rozhodnutie o nasaden\u00ed na produkciu v r\u00e1mci v\u00fdvojov\u00e9ho cyklu je potrebn\u00e9 prija\u0165 r\u00fdchlo.<\/li>\n
  3. Scudn\u00e9 odpor\u00fa\u010dania.<\/b> Skenery poskytuj\u00fa dos\u0165 v\u0161eobecn\u00e9 odpor\u00fa\u010dania, a nie v\u017edy m\u00f4\u017ee v\u00fdvoj\u00e1r r\u00fdchlo pochopi\u0165, ako zn\u00ed\u017ei\u0165 \u00farove\u0148 rizika, a \u010do je najd\u00f4le\u017eitej\u0161ie, \u010di to treba robi\u0165 pr\u00e1ve teraz, alebo to m\u00f4\u017ee po\u010dka\u0165.<\/li>\n
  4. Destrukt\u00edvny dopad na aplik\u00e1ciu.<\/b> Skenery m\u00f4\u017eu vykona\u0165 DoS \u00fatok na aplik\u00e1ciu a tie\u017e m\u00f4\u017eu vytvori\u0165 ve\u013ek\u00e9 mno\u017estvo ent\u00edt alebo zmeni\u0165 existuj\u00face (napr\u00edklad vytvori\u0165 desiatky tis\u00edc koment\u00e1rov na blogu), tak\u017ee by ste nemali bezhlavo sp\u00fa\u0161\u0165a\u0165 skenovanie v produkcii.<\/li>\n
  5. N\u00edzka kvalita detekcie zranite\u013enost\u00ed.<\/b> Skenery zvy\u010dajne pou\u017e\u00edvaj\u00fa pevn\u00fd s\u00fabor u\u017eito\u010dn\u00fdch za\u0165a\u017een\u00ed (\u201epayloads\u201c) a m\u00f4\u017eu \u013eahko vynecha\u0165 zranite\u013enos\u0165, ktor\u00e1 nezapad\u00e1 do zn\u00e1meho scen\u00e1ra spr\u00e1vania aplik\u00e1cie.<\/li>\n
  6. Nepochopenie funkci\u00ed aplik\u00e1cie skenerom.<\/b> Skenery samy o sebe nevedia, \u010do je to \u201einternetov\u00e9 bankovn\u00edctvo\u201c, \u201eplatba\u201c, \u201ekoment\u00e1r\u201c. Pre nich existuj\u00fa iba odkazy a parametre, tak\u017ee obrovsk\u00fd bal\u00edk mo\u017en\u00fdch zranite\u013enost\u00ed obchodnej logiky zost\u00e1va \u00faplne nekryt\u00e9; nebud\u00fa vedie\u0165, ako dvakr\u00e1t za\u0165a\u017ei\u0165 alebo nevedia pozrie\u0165 cudz\u00ed \u00fadaje pod\u013ea ID, alebo ako naf\u00faknu\u0165 zostatok cez zaokr\u00fah\u013eovanie.<\/li>\n
  7. Nepochopenie s\u00e9mantiky str\u00e1nok skenerom.<\/b> Skenery nevedia \u010d\u00edta\u0165 FAQ, nevedia rozpozna\u0165 CAPTCHA, samy o sebe nepochopia, ako sa zaregistrova\u0165, a \u017ee je potrebn\u00e9 sa n\u00e1sledne prihl\u00e1si\u0165 znova, \u017ee sa nem\u00f4\u017ee klikn\u00fa\u0165 na \u201eodhl\u00e1si\u0165\u201c a ako je potrebn\u00e9 podpisova\u0165 po\u017eiadavky pri zmene hodn\u00f4t parametrov. V d\u00f4sledku toho m\u00f4\u017ee by\u0165 ve\u013ek\u00e1 \u010das\u0165 aplik\u00e1cie celkom nezmapovan\u00e1.<\/li>\n<\/ol>\n

    Probl\u00e9my so skenovan\u00edm zdrojov\u00e9ho k\u00f3du.<\/h4>\n

    <\/p>\n

      \n
    1. Falo\u0161n\u00e9 poplachy.<\/b> Statick\u00e1 anal\u00fdza je zlo\u017eit\u00e1 \u00faloha, pri ktorej je potrebn\u00e9 prist\u00fapi\u0165 k mnoh\u00fdm kompromisom. \u010casto je nutn\u00e9 obetova\u0165 presnos\u0165, a dokonca aj drah\u00e9 podnikov\u00e9 skenery produkuj\u00fa obrovsk\u00e9 mno\u017estvo falo\u0161n\u00fdch pozit\u00edv.<\/li>\n
    2. N\u00e1ro\u010dnos\u0165 implement\u00e1cie.<\/b> Na zv\u00fd\u0161enie presnosti a \u00faplnosti statickej anal\u00fdzy je potrebn\u00e9 vypracova\u0165 pravidl\u00e1 skenovania, a p\u00edsanie t\u00fdchto pravidiel m\u00f4\u017ee by\u0165 pr\u00edli\u0161 pracn\u00e9. Niekedy je jednoduch\u0161ie n\u00e1js\u0165 v\u0161etky miesta v k\u00f3de s nejakou chybou a opravi\u0165 ich, ne\u017e nap\u00edsa\u0165 pravidlo na detekciu tak\u00fdchto pr\u00edpadov.<\/li>\n
    3. Nedostatok podpory z\u00e1vislost\u00ed.<\/b> Ve\u013ek\u00e9 projekty z\u00e1visia od mno\u017estva kni\u017en\u00edc a r\u00e1mcov, ktor\u00e9 roz\u0161\u00edruj\u00fa mo\u017enosti programovacieho jazyka. Ak v datab\u00e1ze znalost\u00ed skenera nie je inform\u00e1cia o nebezpe\u010dn\u00fdch miestach (\u201esinks\u201c) v t\u00fdchto r\u00e1mcoch, stane sa to slep\u00fdm miestom a skener jednoducho nebude rozumie\u0165 k\u00f3du.<\/li>\n
    4. Trvanie skenovania.<\/b> H\u013eadanie zranite\u013enost\u00ed v k\u00f3de je zlo\u017eit\u00e1 \u00faloha aj z poh\u013eadu algoritmov. Preto sa proces m\u00f4\u017ee pred\u013a\u017ei\u0165 a vy\u017eadova\u0165 pritom zna\u010dn\u00e9 v\u00fdpo\u010dtov\u00e9 zdroje.<\/li>\n
    5. N\u00edzka pokrytie.<\/b> Napriek spotrebe zdrojov a d\u013a\u017eke skenovania, v\u00fdvoj\u00e1ri SAST n\u00e1strojov st\u00e1le musia prist\u00fapi\u0165 k kompromisom a neanalyzuj\u00fa v\u0161etky stavy, v ktor\u00fdch sa program m\u00f4\u017ee nach\u00e1dza\u0165.<\/li>\n
    6. Reprodukovate\u013enos\u0165 n\u00e1lezov.<\/b> Uvedenie konkr\u00e9tneho riadku a z\u00e1sobn\u00edka volan\u00ed, ktor\u00e9 ved\u00fa k zranite\u013enosti, je skvel\u00e9, ale v skuto\u010dnosti skener \u010dasto neposkytuje dostatok inform\u00e1ci\u00ed na overenie pr\u00edtomnosti zranite\u013enosti zvonka. Ve\u010f nedostatok m\u00f4\u017ee by\u0165 aj v m\u0155tvom k\u00f3de, ktor\u00fd nie je pre \u00fato\u010dn\u00edka pr\u00edstupn\u00fd.<\/li>\n<\/ol>\n

      Probl\u00e9my so skenovan\u00edm infra\u0161trukt\u00fary.<\/h4>\n

      <\/p>\n

        \n
      1. Nedostato\u010dn\u00e1 inventariz\u00e1cia.<\/b> Vo ve\u013ek\u00fdch infra\u0161trukt\u00farach, najm\u00e4 geograficky rozdelen\u00fdch, je \u010dasto naj\u0165a\u017e\u0161ie pochopi\u0165, ktor\u00e9 hostite\u013esk\u00e9 po\u010d\u00edta\u010de je potrebn\u00e9 skenova\u0165. In\u00fdmi slovami, \u00faloha skenovania je \u00fazko spojen\u00e1 s \u00falohou spr\u00e1vy akt\u00edv.<\/li>\n
      2. Nedostato\u010dn\u00e1 prioriz\u00e1cia.<\/b> Sie\u0165ov\u00e9 skenery \u010dasto produkuj\u00fa ve\u013ea v\u00fdsledkov s nedostatkami, ktor\u00e9 nie s\u00fa v praxi vykonate\u013en\u00e9, ale form\u00e1lne je ich rizikov\u00e1 \u00farove\u0148 vysok\u00e1. Spotrebite\u013e dost\u00e1va spr\u00e1vu, ktor\u00e1 je \u0165a\u017eko interpretovate\u013en\u00e1, a nie je jasn\u00e9, \u010do je potrebn\u00e9 opravi\u0165 ako prv\u00e9.<\/li>\n
      3. Scudn\u00e9 odpor\u00fa\u010dania.<\/b> V datab\u00e1zach znalost\u00ed skenerov \u010dasto existuj\u00fa iba ve\u013emi v\u0161eobecn\u00e9 inform\u00e1cie o zranite\u013enosti a sp\u00f4soboch jej opravy, tak\u017ee administr\u00e1tori sa bud\u00fa musie\u0165 vyzbroji\u0165 Googlom. Situ\u00e1cia je o nie\u010do lep\u0161ia s whitebox skenerami, ktor\u00e9 dok\u00e1\u017eu poskytn\u00fa\u0165 konkr\u00e9tny pr\u00edkaz na opravu.<\/li>\n
      4. Ru\u010dn\u00e1 pr\u00e1ca.<\/b> V infra\u0161trukt\u00farach m\u00f4\u017ee by\u0165 ve\u013ea uzlov, a teda potenci\u00e1lne ve\u013ea nedostatkov, ktor\u00fdch spr\u00e1vy je potrebn\u00e9 rozobera\u0165 a analyzova\u0165 ru\u010dne pri ka\u017edej iter\u00e1cii.<\/li>\n
      5. Zl\u00e9 pokrytie.<\/b> Kvalita skenovania infra\u0161trukt\u00fary priamo z\u00e1vis\u00ed od objemu datab\u00e1zy znalost\u00ed o zranite\u013enostiach a verzi\u00e1ch softv\u00e9ru. Pri tom, sa ukazuje,<\/a><\/noindex>, dokonca aj u l\u00eddrov trhu datab\u00e1za znalost\u00ed nie je v\u0161adepr\u00edtomn\u00e1, a v datab\u00e1zach bezplatn\u00fdch rie\u0161en\u00ed existuje mno\u017estvo inform\u00e1ci\u00ed, ktor\u00e9 l\u00eddri nemaj\u00fa.<\/li>\n
      6. Probl\u00e9my s patchingom.<\/b> Naj\u010dastej\u0161ie je patching zranite\u013enost\u00ed v infra\u0161trukt\u00fare aktualiz\u00e1ciou bal\u00ed\u010dka alebo zmenou konfigura\u010dn\u00e9ho s\u00faboru. Ve\u013ek\u00fd probl\u00e9m tu spo\u010d\u00edva v tom, \u017ee syst\u00e9m, najm\u00e4 legacy, sa m\u00f4\u017ee pri aktualiz\u00e1cii spr\u00e1va\u0165 nepredv\u00eddate\u013ene. V podstate bude potrebn\u00e9 vykona\u0165 integra\u010dn\u00e9 testy na \u017eivej infra\u0161trukt\u00fare v produkcii.<\/li>\n<\/ol>\n

        Pr\u00edstupy.<\/h2>\n

        \n\u010co robi\u0165?
        \nO podrobnostiach pr\u00edkladov a o tom, ako bojova\u0165 s mnoh\u00fdmi z uveden\u00fdch probl\u00e9mov, sa podel\u00edm v nasleduj\u00facich \u010dastiach, ale zatia\u013e uvediem hlavn\u00e9 smery, v ktor\u00fdch sa d\u00e1 pracova\u0165:<\/p>\n

          \n
        1. Agr\u00e9g\u00e1cia r\u00f4znych n\u00e1strojov na skenovanie.<\/b> Pri spr\u00e1vnom pou\u017eit\u00ed viacer\u00fdch skenerov je mo\u017en\u00e9 dosiahnu\u0165 v\u00fdznamn\u00e9 zv\u00fd\u0161enie datab\u00e1zy znalost\u00ed a kvality detekcie. M\u00f4\u017eete n\u00e1js\u0165 dokonca viac zranite\u013enost\u00ed, ne\u017e s\u00fa\u010det v\u0161etk\u00fdch skenerov, spusten\u00fdch samostatne, pri\u010dom m\u00f4\u017eete presnej\u0161ie hodnoti\u0165 \u00farove\u0148 rizika a poskytova\u0165 viac odpor\u00fa\u010dan\u00ed.<\/li>\n
        2. Integr\u00e1cia SAST a DAST.<\/b> M\u00f4\u017eete zv\u00fd\u0161i\u0165 pokrytie DAST a presnos\u0165 SAST pomocou v\u00fdmeny inform\u00e1ci\u00ed medzi nimi. Z p\u00f4vodn\u00fdch zdrojov m\u00f4\u017eete z\u00edska\u0165 inform\u00e1cie o existuj\u00facich routach, a pomocou DAST m\u00f4\u017eete overi\u0165, \u010di je zranite\u013enos\u0165 vidite\u013en\u00e1 zvonka.<\/li>\n
        3. Strojov\u00e9 u\u010denie\u2122.<\/b> V roku 2015 som rozpr\u00e1val<\/a><\/noindex> (a e\u0161te<\/a><\/noindex>) hovoril o aplik\u00e1cii \u0161tatistiky na to, aby skenerom poskytol intuit\u00edvne h\u013eadanie hackerov a ur\u00fdchlil ich. To ur\u010dite predstavuje podnet na rozvoj automatizovanej anal\u00fdzy bezpe\u010dnosti v bud\u00facnosti.<\/li>\n
        4. Integr\u00e1cia IAST s automatizovan\u00fdmi testami a OpenAPI.<\/b> V r\u00e1mci CI\/CD-pipeline je mo\u017en\u00e9 vytvori\u0165 proces skenovania na z\u00e1klade n\u00e1strojov, ktor\u00e9 funguj\u00fa ako HTTP proxy, a funk\u010dn\u00fdch testov, ktor\u00e9 pracuj\u00fa na HTTP. Testy a zmluvy OpenAPI\/Swagger poskytn\u00fa skeneru ch\u00fdbaj\u00face inform\u00e1cie o tokov \u00fadajov a umo\u017enia skenovanie aplik\u00e1cie v r\u00f4znych stavoch.<\/li>\n
        5. Spr\u00e1vna konfigur\u00e1cia.<\/b> Pre ka\u017ed\u00fa aplik\u00e1ciu a infra\u0161trukt\u00faru je potrebn\u00e9 vytvori\u0165 vhodn\u00fd profil skenovania, ktor\u00fd zoh\u013ead\u0148uje po\u010det a charakter rozhran\u00ed, pou\u017eit\u00e9 technol\u00f3gie.<\/li>\n
        6. Prisp\u00f4sobenie skenerov.<\/b> \u010casto nie je mo\u017en\u00e9 skenova\u0165 aplik\u00e1ciu bez \u00faprav skeneru. Pr\u00edklad - platobn\u00e1 br\u00e1na, kde mus\u00ed by\u0165 ka\u017ed\u00fd po\u017eiadavok podp\u00edsan\u00fd. Bez nap\u00edsania konektora k protokolu br\u00e1ny bud\u00fa skenery bezmy\u0161lienkovito posiela\u0165 po\u017eiadavky s nespr\u00e1vnym podpisom. Taktie\u017e je potrebn\u00e9 p\u00edsa\u0165 \u0161pecializovan\u00e9 skenery na konkr\u00e9tne typy nedostatkov, ako s\u00fa Nedostato\u010dn\u00e9 priame odkazy na objekty<\/a><\/noindex><\/li>\n
        7. Rizikov\u00fd mana\u017ement.<\/b> Pou\u017eitie r\u00f4znych skenerov a integr\u00e1cia s extern\u00fdmi syst\u00e9mami, ako s\u00fa spr\u00e1va majetku a spr\u00e1va hrozieb, umo\u017en\u00ed pri hodnoten\u00ed \u00farovne rizika vyu\u017ei\u0165 mno\u017estvo parametrov, tak\u017ee vedenie z\u00edska adekv\u00e1tny obraz o aktu\u00e1lnom stave bezpe\u010dnosti v\u00fdvoja alebo infra\u0161trukt\u00fary.<\/li>\n<\/ol>\n

          Bu\u010fte v strehu a po\u010fme naru\u0161i\u0165 skenovanie zranite\u013enost\u00ed!
          \n
          Zdroj:           habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

          \u0412 \u0440\u0430\u043c\u043a\u0430\u0445 \u043f\u0440\u043e\u0444\u0435\u0441\u0441\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0439 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c, \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430\u043c, \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0441\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0441 \u0442\u0430\u043a\u0438\u043c\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c\u0438, \u043a\u0430\u043a Vulnerability Management (VM), (Secure) SDLC. \u041f\u043e\u0434 \u044d\u0442\u0438\u043c\u0438 \u0441\u043b\u043e\u0432\u043e\u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u044f\u043c\u0438 \u0441\u043a\u0440\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u043d\u0430\u0431\u043e\u0440\u044b \u043f\u0440\u0430\u043a\u0442\u0438\u043a \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0435\u0440\u0435\u043f\u043b\u0435\u0442\u0435\u043d\u044b \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439, \u0445\u043e\u0442\u044f \u0438\u0445 \u043f\u043e\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043b\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u0430\u044e\u0442\u0441\u044f. \u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043f\u0440\u043e\u0433\u0440\u0435\u0441\u0441 \u043f\u043e\u043a\u0430 \u043d\u0435 \u0434\u043e\u0448\u0451\u043b \u0434\u043e \u0442\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0434\u043d\u0438\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u043c \u0437\u0430\u043c\u0435\u043d\u0438\u0442\u044c \u0447\u0435\u043b\u043e\u0432\u0435\u043a\u0430 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u041f\u041e. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-29957","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Skenovanie na zranite\u013enosti a bezpe\u010dn\u00fd v\u00fdvoj. \u010cas\u0165 1 | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/skanirovanie-na-uyazvimosti-i-bezopasnaya-razrabotka-chast-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0430. \u0427\u0430\u0441\u0442\u044c 1 | ProHoster","og:url":"https:\/\/prohoster.info\/sk\/blog\/skanirovanie-na-uyazvimosti-i-bezopasnaya-razrabotka-chast-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:32:53+00:00","article:modified_time":"2019-10-31T18:32:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"29957","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-20 23:11:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:45:24","updated":"2026-01-20 23:11:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/29957","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=29957"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/29957\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=29957"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=29957"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=29957"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}