{"id":31058,"date":"2019-10-31T21:39:12","date_gmt":"2019-10-31T18:39:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya\/"},"modified":"2019-10-31T21:39:12","modified_gmt":"2019-10-31T18:39:12","slug":"kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya","title":{"rendered":"Ako prevzia\u0165 kontrolu nad sie\u0165ovou infra\u0161trukt\u00farou. Kapitola tretia. Bezpe\u010dnos\u0165 siete. \u010cas\u0165 prv\u00e1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i>Tento \u010dl\u00e1nok je tret\u00ed v cykle \u010dl\u00e1nkov \u00abAko prevzia\u0165 kontrolu nad sie\u0165ovou infra\u0161trukt\u00farou\u00bb. Obsah v\u0161etk\u00fdch \u010dl\u00e1nkov v cykle a odkazy n\u00e1jdete <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/447008\/\">tu<\/a><\/noindex><\/i>.<\/p>\n<p><img decoding=\"async\" alt=\"Ako prevzia\u0165 kontrolu nad sie\u0165ovou infra\u0161trukt\u00farou. Kapitola tretia. Bezpe\u010dnos\u0165 siete. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2019\/04\/cdf33cc6797d26df8fef5533f2570c47.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNed\u00e1va zmysel hovori\u0165 o \u00faplnom odstr\u00e1nen\u00ed bezpe\u010dnostn\u00fdch riz\u00edk. V princ\u00edpe ich nem\u00f4\u017eeme zn\u00ed\u017ei\u0165 na nulu. Taktie\u017e je potrebn\u00e9 ch\u00e1pa\u0165, \u017ee snaha o zv\u00fd\u0161enie bezpe\u010dnosti na\u0161ich siet\u00ed zdra\u017euje na\u0161e rie\u0161enia. Je potrebn\u00e9 n\u00e1js\u0165 rozumn\u00fd kompromis medzi cenou, zlo\u017eitosti a bezpe\u010dnos\u0165ou v s\u00favislosti s va\u0161ou sie\u0165ou. <\/p>\n<p>Iste, dizajn zabezpe\u010denia je organicky integrovan\u00fd do celkovej architekt\u00fary a pou\u017e\u00edvan\u00e9 bezpe\u010dnostn\u00e9 rie\u0161enia ovplyv\u0148uj\u00fa \u0161k\u00e1lovate\u013enos\u0165, spo\u013eahlivos\u0165, spravovate\u013enos\u0165... sie\u0165ovej infra\u0161trukt\u00fary, \u010do treba taktie\u017e zoh\u013eadni\u0165.<\/p>\n<p>Ale pripom\u00ednam, \u017ee moment\u00e1lne nehovor\u00edme o vytv\u00e1ran\u00ed siete. V s\u00falade s na\u0161imi <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/post\/433614\/\">po\u010diato\u010dn\u00fdmi podmienkami<\/a><\/noindex> u\u017e m\u00e1me vybran\u00fd dizajn, zvolen\u00e9 zariadenia a vytvoren\u00fa infra\u0161trukt\u00faru, a v tomto \u0161t\u00e1diu sa mus\u00edme, ak to je mo\u017en\u00e9, prisp\u00f4sobi\u0165 a nach\u00e1dza\u0165 rie\u0161enia v kontexte predt\u00fdm zvolen\u00e9ho pr\u00edstupu.<\/p>\n<p>Na\u0161ou \u00falohou teraz je identifikova\u0165 rizik\u00e1 spojen\u00e9 s bezpe\u010dnos\u0165ou na \u00farovni siete a zn\u00ed\u017ei\u0165 ich na rozumn\u00fa \u00farove\u0148. <noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h1>Audity sie\u0165ovej bezpe\u010dnosti<\/h1>\n<p>\nAk m\u00e1te vo svojej organiz\u00e1cii implementovan\u00e9 procesy ISO 27k, potom by audit bezpe\u010dnosti a zmeny siete mali by\u0165 organicky za\u010dlenen\u00e9 do celkov\u00fdch procesov tohto pr\u00edstupu. Ale tieto normy sa predsa net\u00fdkaj\u00fa konkr\u00e9tnych rie\u0161en\u00ed, nie konfigur\u00e1cie ani dizajnu... Neexistuj\u00fa jednozna\u010dn\u00e9 rady, neexistuj\u00fa normy presne ur\u010den\u00e9 na to, ak\u00e1 by mala by\u0165 va\u0161a sie\u0165, v tom spo\u010d\u00edva zlo\u017eitosti a kr\u00e1sa tejto \u00falohy.<\/p>\n<p>Vyzdvihol by som nieko\u013eko mo\u017en\u00fdch auditov bezpe\u010dnosti siete:<\/p>\n<ul>\n<li>audit konfigur\u00e1cie zariaden\u00ed (hardenovanie)<\/li>\n<li>audit bezpe\u010dnostn\u00e9ho dizajnu<\/li>\n<li>audit pr\u00edstupov<\/li>\n<li>audit procesov<\/li>\n<\/ul>\n<p><\/p>\n<h1>Audit konfigur\u00e1cie zariadenia (hardening)<\/h1>\n<p>\nZd\u00e1 sa, \u017ee v v\u00e4\u010d\u0161ine pr\u00edpadov je to najlep\u0161ia v\u00fdchodiskov\u00e1 poz\u00edcia pre audit a zlep\u0161enie bezpe\u010dnosti va\u0161ej siete. IMHO to je dobr\u00e1 demonstr\u00e1cia Pareto z\u00e1kona (20 % \u00fasilia prin\u00e1\u0161a 80 % v\u00fdsledku, zatia\u013e \u010do zvy\u0161n\u00fdch 80 % \u00fasilia prin\u00e1\u0161a iba 20 % v\u00fdsledku). <\/p>\n<p>Podstatou je, \u017ee zvy\u010dajne m\u00e1me odpor\u00fa\u010dania od dod\u00e1vate\u013eov t\u00fdkaj\u00face sa \u00abnajlep\u0161\u00edch prakt\u00edk\u00bb v oblasti bezpe\u010dnosti pri konfigur\u00e1cii zariaden\u00ed. Tomu sa hovor\u00ed \u201chardening\u201d.<\/p>\n<p>\u010casto sa tie\u017e stret\u00e1vame s dotazn\u00edkom (alebo ho m\u00f4\u017eeme vyrobi\u0165 sami) na z\u00e1klade t\u00fdchto odpor\u00fa\u010dan\u00ed, ktor\u00fd v\u00e1m pom\u00f4\u017ee ur\u010di\u0165, do akej miery konfigur\u00e1cia v\u00e1\u0161ho hardv\u00e9ru zodpoved\u00e1 t\u00fdmto \u201ebest practices\u201c a na z\u00e1klade v\u00fdsledku vykona\u0165 zmeny vo va\u0161ej sieti. To v\u00e1m umo\u017en\u00ed pomerne jednoducho, v podstate bez n\u00e1kladov, podstatne zn\u00ed\u017ei\u0165 bezpe\u010dnostn\u00e9 rizik\u00e1.<\/p>\n<blockquote><p>Nieko\u013eko pr\u00edkladov pre niektor\u00e9 opera\u010dn\u00e9 syst\u00e9my Cisco.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/ip\/access-lists\/13608-21.html\">Zabezpe\u010denie konfigur\u00e1cie Cisco IOS<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.cisco.com\/security\/center\/resources\/increase_security_ios_xr_devices.html\">Zabezpe\u010denie konfigur\u00e1cie Cisco IOS-XR<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/tools.cisco.com\/security\/center\/resources\/securing_nx_os.html\">Zabezpe\u010denie konfigur\u00e1cie Cisco NX-OS<\/a><\/noindex><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/solutions\/Enterprise\/Security\/Baseline_Security\/securebasebook\/appendxD.html\">Zoznam z\u00e1kladn\u00e9ho zabezpe\u010denia Cisco<\/a><\/noindex><\/p>\n<p>Na z\u00e1klade t\u00fdchto dokumentov m\u00f4\u017ee by\u0165 vytvoren\u00fd zoznam po\u017eiadaviek na konfigur\u00e1ciu pre ka\u017ed\u00fd typ vybavenia. Napr\u00edklad pre Cisco N7K VDC by tieto po\u017eiadavky mohli vyzera\u0165 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.dropbox.com\/s\/hnat6yriyptigzb\/7k_hard.xlsx?dl=0\">tak<\/a><\/noindex>.<\/p><\/blockquote>\n<p>\nT\u00fdmto sp\u00f4sobom m\u00f4\u017eu by\u0165 vytvoren\u00e9 konfigura\u010dn\u00e9 s\u00fabory pre r\u00f4zne typy akt\u00edvneho vybavenia va\u0161ej sie\u0165ovej infra\u0161trukt\u00fary. N\u00e1sledne, ru\u010dne alebo s pou\u017eit\u00edm automatiz\u00e1cie, m\u00f4\u017eete tieto konfigura\u010dn\u00e9 s\u00fabory \u201enahr\u00e1va\u0165\u201c. Ako automatizova\u0165 tento proces bude podrobne pop\u00edsan\u00e9 v \u010fal\u0161ej s\u00e9rii \u010dl\u00e1nkov venovan\u00fdch orchestr\u00e1cii a automatiz\u00e1cii.<\/p>\n<h1>Audit n\u00e1vrhu zabezpe\u010denia<\/h1>\n<p>\nZvy\u010dajne sa v podnikovom (enterprise) sieti v takej alebo onakej podobe nach\u00e1dzaj\u00fa nasleduj\u00face segmenty: <\/p>\n<ul>\n<li>DC (Verejn\u00e9 slu\u017eby DMZ a intranetov\u00fd d\u00e1tov\u00fd center)<\/li>\n<li>Pr\u00edstup na internet<\/li>\n<li>VPN s dia\u013ekov\u00fdm pr\u00edstupom<\/li>\n<li>WAN okraj<\/li>\n<li>Pobo\u010dka<\/li>\n<li>Campus (Kancel\u00e1ria)<\/li>\n<li>Jadro<\/li>\n<\/ul>\n<p>\nN\u00e1zvy s\u00fa prevzat\u00e9 z <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/solutions\/Enterprise\/Security\/SAFE_RG\/SAFE_rg\/chap1.html\">Cisco SAFE<\/a><\/noindex> modelu, ale nie je nutn\u00e9 sa striktne viaza\u0165 na tieto n\u00e1zvy a tento model. Predsa len je d\u00f4le\u017eit\u00e9 hovori\u0165 o podstate a neuviaza\u0165 sa vo form\u00e1lnostiach.<\/p>\n<p>Pre ka\u017ed\u00fd z t\u00fdchto segmentov bud\u00fa po\u017eiadavky na \u00farove\u0148 zabezpe\u010denia, rizik\u00e1 a zodpovedaj\u00face rie\u0161enia odli\u0161n\u00e9.<\/p>\n<p>Presk\u00famame ka\u017ed\u00fd z nich samostatne z poh\u013eadu probl\u00e9mov, s ktor\u00fdmi sa m\u00f4\u017eete stretn\u00fa\u0165 z h\u013eadiska n\u00e1vrhu zabezpe\u010denia. Samozrejme, op\u00e4\u0165 sa opakujem, \u017ee t\u00e1to \u010dl\u00e1nok nijako neprezentuje \u00faplnos\u0165, ktor\u00fa by bolo v tejto naozaj hlbokej a mnohostrann\u00e9 t\u00e9me \u0165a\u017ek\u00e9 dosiahnu\u0165 (ak v\u00f4bec mo\u017en\u00e9), ale odr\u00e1\u017ea moje osobn\u00e9 sk\u00fasenosti.<\/p>\n<p>Neexistuje dokonal\u00e9 rie\u0161enie (aspo\u0148 nie teraz). V\u017edy je to kompromis. Ale je d\u00f4le\u017eit\u00e9, aby rozhodnutie o aplik\u00e1cii tohto \u010di on\u00e9ho pr\u00edstupu bolo uroben\u00e9 vedome, s porozumen\u00edm v\u00fdhod a nev\u00fdhod.<\/p>\n<h2>D\u00e1tov\u00e9 centrum<\/h2>\n<p>\nNajkritickej\u0161\u00ed z h\u013eadiska zabezpe\u010denia segment.<br \/>\nA, ako zvy\u010dajne, ani tu neexistuje univerz\u00e1lne rie\u0161enie. V\u0161etko silne z\u00e1vis\u00ed od po\u017eiadaviek na sie\u0165. <\/p>\n<h3>Je potrebn\u00fd firewall, alebo nie?<\/h3>\n<p>\nNa prv\u00fd poh\u013ead sa odpove\u010f zd\u00e1 by\u0165 jasn\u00e1, no nie je to celkom jednozna\u010dn\u00e9, ako by sa mohlo zda\u0165. A na v\u00e1\u0161 v\u00fdber m\u00f4\u017ee vpl\u00fdva\u0165 nielen<b> cena<\/b>. <\/p>\n<blockquote><p>Pr\u00edklad 1. <b>oneskorenia.<\/b><\/p>\n<p>Ak je n\u00edzke oneskorenie medzi niektor\u00fdmi segmentmi siete z\u00e1sadnou po\u017eiadavkou, \u010do je napr\u00edklad pravdiv\u00e9 pre burzy, potom medzi t\u00fdmito segmentmi nebudeme m\u00f4c\u0165 pou\u017ei\u0165 firewally. \u0164a\u017eko sa nach\u00e1dzaj\u00fa \u0161t\u00fadie o oneskoreni\u00e1ch v firewaloch, ale len niektor\u00e9 modely prep\u00edna\u010dov m\u00f4\u017eu poskytn\u00fa\u0165 oneskorenia menej ako alebo na \u00farovni 1 \u03bcs, tak\u017ee si mysl\u00edm, \u017ee ak s\u00fa pre v\u00e1s mikrosekundy d\u00f4le\u017eit\u00e9, tak firewally nie s\u00fa pre v\u00e1s.<\/p><\/blockquote>\n<blockquote><p>Pr\u00edklad 2. <b>V\u00fdkon.<\/b><\/p>\n<p>Priepustnos\u0165 najlep\u0161\u00edch L3 prep\u00edna\u010dov je zvy\u010dajne porovnate\u013ene vy\u0161\u0161ia ako priepustnos\u0165 najv\u00fdkonnej\u0161\u00edch firewallow. Preto v pr\u00edpade vysoko intenz\u00edvneho prenosu d\u00e1t, v\u00e1m pravdepodobne bude tie\u017e treba pusti\u0165 tento prenos obch\u00e1dzaj\u00fac firewally.<\/p><\/blockquote>\n<p><\/p>\n<blockquote><p>Pr\u00edklad 3. <b>Spo\u013eahlivos\u0165.<\/b><\/p>\n<p>Firewally, najm\u00e4 modern\u00e9 NGFW (Next-Generation FW) \u2013 s\u00fa zlo\u017eit\u00fdmi zariadeniami. S\u00fa ove\u013ea zlo\u017eitej\u0161ie ako L3\/L2 prep\u00edna\u010de. Poskytuj\u00fa mno\u017estvo slu\u017eieb a mo\u017enost\u00ed konfigur\u00e1cie, preto nie je prekvapen\u00edm, \u017ee ich spo\u013eahlivos\u0165 je v\u00fdrazne ni\u017e\u0161ia. Ak je kontinuita slu\u017eby kritick\u00e1 pre sie\u0165, potom mo\u017eno budete musie\u0165 zvoli\u0165, \u010do prinesie lep\u0161iu dostupnos\u0165 \u2013 ochranu pomocou firewalla alebo jednoduchos\u0165 siete postavenej na prep\u00edna\u010doch (alebo r\u00f4znych fabrik\u00e1ch) s pou\u017eit\u00edm be\u017en\u00fdch ACL.<\/p><\/blockquote>\n<p> V pr\u00edpade vy\u0161\u0161ie uveden\u00fdch pr\u00edkladov v\u00e1m pravdepodobne (ako obvykle) bude treba n\u00e1js\u0165 kompromis. Pozrite sa na nasleduj\u00face rie\u0161enia: <\/p>\n<ul>\n<li>ak ste sa rozhodli nepou\u017e\u00edva\u0165 firewally vo vn\u00fatri d\u00e1tov\u00e9ho centra, je potrebn\u00e9 premyslie\u0165, ako maxim\u00e1lne obmedzi\u0165 pr\u00edstupy na perif\u00e9rii. Napr\u00edklad, m\u00f4\u017eete otvori\u0165 iba potrebn\u00e9 porty z internetu (pre klientsk\u00fa prev\u00e1dzku) a administrat\u00edvne pr\u00edstupy do d\u00e1tov\u00e9ho centra len z jump hostov. Na jump hostoch vykon\u00e1va\u0165 v\u0161etku potrebn\u00fa kontrolu (autentifik\u00e1cia\/autoriza\u010dn\u00fd proces, antiv\u00edrus, logovanie, \u2026)<\/li>\n<li>m\u00f4\u017eete vyu\u017ei\u0165 logick\u00e9 rozdelenie siete d\u00e1tov\u00e9ho centra na segmenty, podobne ako v sch\u00e9me op\u00edsanej v PSEFABRIC <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/nihole\/PSEFABRIC\/wiki\/p002-design\">pr\u00edklad p002<\/a><\/noindex>Pri tom mus\u00ed by\u0165 smerovanie nastaven\u00e9 tak, aby citliv\u00fd alebo vysoko intenz\u00edvny prenos d\u00e1t prebiehal \"vn\u00fatri\" jedn\u00e9ho segmentu (v pr\u00edpade p002, VRF) a neprech\u00e1dzal cez firewall. Prenos d\u00e1t medzi r\u00f4znymi segmentmi bude na\u010falej prebieha\u0165 cez firewall. Je tie\u017e mo\u017en\u00e9 pou\u017ei\u0165 route leaking medzi VRF, aby sa predi\u0161lo presmerovaniu prenosu d\u00e1t cez firewall.<\/li>\n<li>Taktie\u017e je mo\u017en\u00e9 pou\u017ei\u0165 firewall v transparentnom re\u017eime a iba pre tie VLAN, kde tieto faktory (oneskorenie\/vykonnos\u0165) nie s\u00fa rozhoduj\u00face. Mus\u00edte si v\u0161ak d\u00f4kladne presk\u00fama\u0165 obmedzenia spojen\u00e9 s pou\u017e\u00edvan\u00edm tohto re\u017eimu pre ka\u017ed\u00e9ho dod\u00e1vate\u013ea.<\/li>\n<li>M\u00f4\u017eete zv\u00e1\u017ei\u0165 zavedenie architekt\u00fary service chain. To umo\u017en\u00ed pren\u00e1\u0161a\u0165 cez firewall iba nevyhnutn\u00fd prenos d\u00e1t. Teoreticky to vyzer\u00e1 dobre, ale nikdy som nevidel toto rie\u0161enie v praxi. Testovali sme service chain pre Cisco ACI\/Juniper SRX\/F5 LTM asi pred 3 rokmi, ale v tom \u010dase sa n\u00e1m to rie\u0161enie zdalo \"nedostato\u010dn\u00e9\".<\/li>\n<\/ul>\n<p><\/p>\n<h3>\u00darove\u0148 ochrany<\/h3>\n<p>\nTeraz je potrebn\u00e9 odpoveda\u0165 na ot\u00e1zku, ak\u00e9 n\u00e1stroje chcete pou\u017ei\u0165 na filtrovanie prenosu d\u00e1t. Tu je nieko\u013eko mo\u017enost\u00ed, ktor\u00e9 s\u00fa zvy\u010dajne pr\u00edtomn\u00e9 v NGFW (napr\u00edklad, <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.paloaltonetworks.com\/pan-os\/8-0\/pan-os-admin\/policy\/security-profiles.html\">tu<\/a><\/noindex>):<\/p>\n<ul>\n<li>stateful firewalling (pod\u013ea predvolen\u00e9ho nastavenia)<\/li>\n<li>aplika\u010dn\u00e9 firewalling<\/li>\n<li>prevencia hrozieb (antiv\u00edrus, anti-spyware a zranite\u013enosti)<\/li>\n<li>URL filtrovanie<\/li>\n<li>filtrovanie d\u00e1t (filtrovanie obsahu)<\/li>\n<li>blokovanie s\u00faborov (blokovanie typov s\u00faborov)<\/li>\n<li>ochrana pred dos<\/li>\n<\/ul>\n<p>\nA tie\u017e nie je v\u0161etko jednozna\u010dn\u00e9. Zdalo by sa, \u017ee \u010d\u00edm vy\u0161\u0161ia \u00farove\u0148 ochrany, t\u00fdm lep\u0161ie. Ale mus\u00edte tie\u017e zoh\u013eadni\u0165, \u017ee<\/p>\n<ul>\n<li>\u010d\u00edm viac z uveden\u00fdch funkci\u00ed firewallu pou\u017eijete, t\u00fdm prirodzenej\u0161ie to bude drah\u0161ie (licencie, dodato\u010dn\u00e9 moduly).<\/li>\n<li>Pou\u017eitie niektor\u00fdch algoritmov m\u00f4\u017ee v\u00fdrazne zn\u00ed\u017ei\u0165 priepustnos\u0165 firewallu a tie\u017e zv\u00fd\u0161i\u0165 oneskorenia, pozri napr\u00edklad <noindex><a rel=\"nofollow\" href=\"https:\/\/www.paloaltonetworks.com\/products\/secure-the-network\/next-generation-firewall\/pa-7000-series\">tu<\/a><\/noindex><\/li>\n<li>ako ka\u017ed\u00e9 komplexn\u00e9 rie\u0161enie, pou\u017e\u00edvanie zlo\u017eit\u00fdch met\u00f3d ochrany m\u00f4\u017ee zn\u00ed\u017ei\u0165 spo\u013eahlivos\u0165 v\u00e1\u0161ho rie\u0161enia, napr\u00edklad pri pou\u017eit\u00ed application firewalling som sa stretol so zablokovan\u00edm niektor\u00fdch \u0161tandardne funguj\u00facich aplik\u00e1ci\u00ed (dns, smb).<\/li>\n<\/ul>\n<p>\nAkoby ste mali n\u00e1js\u0165 optim\u00e1lne rie\u0161enie pre va\u0161u sie\u0165.<\/p>\n<p>Nie je mo\u017en\u00e9 jednozna\u010dne odpoveda\u0165 na ot\u00e1zku, ak\u00e9 funkcie ochrany m\u00f4\u017eu by\u0165 potrebn\u00e9. Po prv\u00e9, preto\u017ee to samozrejme z\u00e1vis\u00ed od d\u00e1t, ktor\u00e9 pren\u00e1\u0161ate alebo uchov\u00e1vate a sna\u017e\u00edte sa ochr\u00e1ni\u0165. Po druh\u00e9, v skuto\u010dnosti, \u010dasto je v\u00fdber ochrann\u00fdch prostriedkov ot\u00e1zkou viery a d\u00f4very k dod\u00e1vate\u013eovi. Nepozn\u00e1te algoritmy, neviete, ak\u00e9 s\u00fa efekt\u00edvne a nem\u00f4\u017eete ich plne otestova\u0165. <\/p>\n<p>Preto v kritick\u00fdch segmentoch m\u00f4\u017ee by\u0165 dobr\u00fdm rie\u0161en\u00edm vyu\u017eitie pon\u00fak od r\u00f4znych spolo\u010dnost\u00ed. Napr\u00edklad, m\u00f4\u017eete zapn\u00fa\u0165 antiv\u00edrus na firewalle, ale aj vyu\u017ei\u0165 antiv\u00edrusov\u00fa ochranu (od in\u00e9ho v\u00fdrobcu) lok\u00e1lne na hostite\u013esk\u00fdch serveroch.<\/p>\n<h3>Segment\u00e1cia<\/h3>\n<p>\nIde o logick\u00fa segment\u00e1ciu siete d\u00e1tov\u00e9ho centra. Napr\u00edklad, rozdelenie na VLAN a podsiete je tie\u017e logick\u00e1 segment\u00e1cia, ale t\u00fa nebudeme zva\u017eova\u0165 vzh\u013eadom na jej zjavnos\u0165. Zauj\u00edmav\u00e1 je segment\u00e1cia s oh\u013eadom na tak\u00e9 entity ako s\u00fa z\u00f3ny zabezpe\u010denia FW, VRF (a ich analogy u r\u00f4znych dod\u00e1vate\u013eov), logick\u00e9 zariadenia (PA VSYS, Cisco N7K VDC, Cisco ACI Tenant, \u2026), \u2026<\/p>\n<blockquote><p>Pr\u00edklad takej logickej segment\u00e1cie a moment\u00e1lne \u017eiadan\u00e9ho dizajnu d\u00e1tov\u00e9ho centra je uveden\u00fd v <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/nihole\/PSEFABRIC\/wiki\/p002-design\">p002 projektu PSEFABRIC<\/a><\/noindex>.<\/p><\/blockquote>\n<p> Definovan\u00edm logick\u00fdch \u010dast\u00ed va\u0161ej siete m\u00f4\u017eete \u010falej op\u00edsa\u0165, ako sa pohybuje prev\u00e1dzka medzi r\u00f4znymi segmentmi, na ktor\u00fdch zariadeniach sa bude vykon\u00e1va\u0165 filtrovanie a ak\u00fdmi prostriedkami.<\/p>\n<p>Ak vo va\u0161ej sieti ch\u00fdba jasn\u00e9 logick\u00e9 rozdelenie a nie s\u00fa formalizovan\u00e9 pravidl\u00e1 pre aplik\u00e1ciu bezpe\u010dnostn\u00fdch polit\u00edk na r\u00f4zne pr\u00fady d\u00e1t (flow), znamen\u00e1 to, \u017ee pri otvoren\u00ed ur\u010dit\u00e9ho pr\u00edstupu ste n\u00faten\u00ed rie\u0161i\u0165 t\u00fato \u00falohu, a s ve\u013ekou pravdepodobnos\u0165ou ju budete rie\u0161i\u0165 zaka\u017ed\u00fdm inak. <\/p>\n<p>\u010casto je segment\u00e1cia zalo\u017een\u00e1 len na z\u00f3nach zabezpe\u010denia FW. Potom je potrebn\u00e9 odpoveda\u0165 na nasleduj\u00face ot\u00e1zky:<\/p>\n<ul>\n<li>ak\u00fa z\u00f3nu zabezpe\u010denia potrebujete<\/li>\n<li>ak\u00fa \u00farove\u0148 ochrany chcete aplikova\u0165 na ka\u017ed\u00fa z t\u00fdchto z\u00f3n <\/li>\n<li>\u010di bude povolen\u00fd intra-zone prev\u00e1dzka ako predvolen\u00e9 <\/li>\n<li>ak nie, ak\u00e9 politiky filtrovania prev\u00e1dzky bud\u00fa aplikovan\u00e9 vo vn\u00fatri ka\u017edej z\u00f3n<\/li>\n<li>ak\u00e9 politiky filtrovania prev\u00e1dzky bud\u00fa aplikovan\u00e9 pre ka\u017ed\u00fd p\u00e1r z\u00f3n (source\/destination)<\/li>\n<\/ul>\n<p><\/p>\n<h3>TCAM<\/h3>\n<p>\n\u010casto sa stret\u00e1vame s probl\u00e9mom nedostato\u010dn\u00e9ho TCAM (Ternary Content Addressable Memory), ako pre smerovanie, tak pre pr\u00edstupy. IMHO, je to jedna z najd\u00f4le\u017eitej\u0161\u00edch ot\u00e1zok pri v\u00fdbere hardv\u00e9ru, tak\u017ee je potrebn\u00e9 t\u00fato ot\u00e1zku bra\u0165 s n\u00e1le\u017eitou v\u00e1\u017enos\u0165ou.<\/p>\n<blockquote><p>Pr\u00edklad 1. Forwarding Table TCAM.<\/p>\n<p>Pozrime sa na <noindex>Palo Alto 7k<\/noindex> firewall.<br \/>\nVid\u00edme, \u017ee ve\u013ekos\u0165 IPv4 forwarding table* = 32K<br \/>\nPri\u010dom toto mno\u017estvo routov je spolo\u010dn\u00e9 pre v\u0161etky VSYS-y.<\/p>\n<p>Predpokladajme, \u017ee pod\u013ea v\u00e1\u0161ho dizajnu ste sa rozhodli pou\u017ei\u0165 4 VSYS-y.<br \/>\nKa\u017ed\u00fd z t\u00fdchto VSYS-ov je pripojen\u00fd k dvom PE MPLS cloudom cez BGP, ktor\u00fd pou\u017e\u00edvate ako BB. Takto si 4 VSYS-y navz\u00e1jom vymie\u0148aj\u00fa v\u0161etky \u0161pecifick\u00e9 trasy a maj\u00fa forwarding table s pribli\u017ene rovnak\u00fdmi sadami tr\u00e1s (ale s r\u00f4znymi NH). Ke\u010f\u017ee ka\u017ed\u00fd VSYS m\u00e1 2 BGP rel\u00e1cie (s rovnak\u00fdmi nastaveniami), ka\u017ed\u00e1 trasa prijat\u00e1 cez MPLS m\u00e1 2 NH a, samozrejme, 2 FIB z\u00e1znamy v Forwarding Tabu\u013eke. Ak predpoklad\u00e1me, \u017ee to je jedin\u00e9 firewall v d\u00e1tovom centre a mus\u00ed pozna\u0165 v\u0161etky trasy, znamen\u00e1 to, \u017ee celkov\u00fd po\u010det tr\u00e1s v na\u0161om d\u00e1tovom centre nem\u00f4\u017ee by\u0165 v\u00e4\u010d\u0161\u00ed ako 32K\/(4 * 2) = 4K. <\/p>\n<p>Ak predpoklad\u00e1me, \u017ee m\u00e1me 2 d\u00e1tov\u00e9 centr\u00e1 (s rovnak\u00fdm dizajnom) a chceme pou\u017e\u00edva\u0165 VLAN-y \u201eroz\u0165ahovan\u00e9\u201c medzi d\u00e1tov\u00fdmi centrami (napr\u00edklad pre vMotion), mus\u00edme na vyrie\u0161enie probl\u00e9mu s routovan\u00edm pou\u017ei\u0165 hostite\u013esk\u00e9 trasy. To v\u0161ak znamen\u00e1, \u017ee pre 2 d\u00e1tov\u00e9 centr\u00e1 budeme ma\u0165 maxim\u00e1lne 4096 mo\u017en\u00fdch hostite\u013eov a to samozrejme nemus\u00ed by\u0165 dostato\u010dn\u00e9.<\/p><\/blockquote>\n<blockquote><p>Pr\u00edklad 2. ACL TCAM.<\/p>\n<p>Ak pl\u00e1nujete filtrova\u0165 prenosy na L3 prep\u00edna\u010doch (alebo in\u00fdch rie\u0161eniach pou\u017e\u00edvaj\u00facich L3 prep\u00edna\u010de, napr\u00edklad Cisco ACI), pri v\u00fdbere hardv\u00e9ru by ste mali venova\u0165 pozornos\u0165 ACL TCAM.<\/p>\n<p>Predpokladajme, \u017ee chcete kontrolova\u0165 pr\u00edstupy na SVI rozhran\u00ed Cisco Catalyst 4500. Potom, ako je vidie\u0165 z <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/switches\/catalyst-4000-series-switches\/66978-tcam-cat-4500.html\">tohto \u010dl\u00e1nku<\/a><\/noindex>, pre kontrolu odch\u00e1dzaj\u00faceho (rovnako ako aj prich\u00e1dzaj\u00faceho) prenosu na rozhraniach m\u00f4\u017eete pou\u017ei\u0165 len 4096 riadkov TCAM. \u010co pri pou\u017eit\u00ed TCAM3 poskytne pribli\u017ene 4000 ACE (riadkov ACL).<\/p><\/blockquote>\n<p> V pr\u00edpade, \u017ee ste sa stretli s probl\u00e9mom nedostato\u010dn\u00e9ho TCAM-u, je najprv potrebn\u00e9 zv\u00e1\u017ei\u0165 mo\u017enos\u0165 optimaliz\u00e1cie. Tak\u017ee v pr\u00edpade probl\u00e9mu s ve\u013ekos\u0165ou Forwarding Tabu\u013eky by ste mali zv\u00e1\u017ei\u0165 mo\u017enos\u0165 agreg\u00e1cie tr\u00e1s. V pr\u00edpade probl\u00e9mu s ve\u013ekos\u0165ou TCAM pre pr\u00edstupy \u2014 audit pr\u00edstupov, odstr\u00e1nenie zastaran\u00fdch a prekr\u00fdvaj\u00facich sa z\u00e1znamov a, ak sa mo\u017eno, prehodnotenie postupu otv\u00e1rania pr\u00edstupov (bude podrobne presk\u00faman\u00e9 v kapitole venovanej auditu pr\u00edstupov).<\/p>\n<h3>Vysok\u00e1 dostupnos\u0165<\/h3>\n<p>\nOt\u00e1zka znie, \u010di pou\u017ei\u0165 HA pre firewally alebo nain\u0161talova\u0165 \u201eparalelne\u201c dve nez\u00e1visl\u00e9 krabice a v pr\u00edpade zlyhania jednej z nich routova\u0165 prenos cez druh\u00fa?<\/p>\n<p>Na prv\u00fd poh\u013ead sa odpove\u010f jav\u00ed ako jasn\u00e1 \u2013 pou\u017e\u00edva\u0165 HA. D\u00f4vod, pre\u010do sa t\u00e1to ot\u00e1zka objavuje, spo\u010d\u00edva v tom, \u017ee, \u017eia\u013e, teoretick\u00e9 a reklamn\u00e9 99 a nieko\u013eko deviatok za desatinnou \u010diarkou dostupnosti sa v praxi ukazuj\u00fa ako ove\u013ea menej optimistick\u00e9. HA je logicky dostato\u010dne zlo\u017eit\u00e1 z\u00e1le\u017eitos\u0165 a na r\u00f4znom hardv\u00e9ri, ako aj s r\u00f4znymi dod\u00e1vate\u013emi (bez v\u00fdnimiek) sme zaznamenali probl\u00e9my, chyby a v\u00fdpadky slu\u017eby.<\/p>\n<p>Pri pou\u017e\u00edvan\u00ed HA z\u00edskate mo\u017enos\u0165 vyp\u00edna\u0165 jednotliv\u00e9 uzly a prech\u00e1dza\u0165 medzi nimi bez v\u00fdpadku slu\u017eby, \u010do je d\u00f4le\u017eit\u00e9 napr\u00edklad pri upgrade, ale aj tak existuje dos\u0165 vysok\u00e1 pravdepodobnos\u0165, \u017ee sa v\u00e1m poru\u010dia oba uzly s\u00fa\u010dasne, ako aj to, \u017ee \u010fal\u0161\u00ed upgrade prebehne nie tak hladko, ako s\u013eubuje dod\u00e1vate\u013e (tomuto probl\u00e9mu sa m\u00f4\u017eete vyhn\u00fa\u0165, ak m\u00e1te mo\u017enos\u0165 otestova\u0165 upgrade na laborat\u00f3rnom zariaden\u00ed).<\/p>\n<p>Ak nepou\u017e\u00edvate HA, z h\u013eadiska dvojitej poruchy s\u00fa va\u0161e rizik\u00e1 v\u00fdrazne ni\u017e\u0161ie (ke\u010f\u017ee m\u00e1te 2 nez\u00e1visl\u00e9 firewally), ale preto\u017ee rel\u00e1cie nie s\u00fa synchronizovan\u00e9, zaka\u017ed\u00fdm, ke\u010f d\u00f4jde k prechodu medzi t\u00fdmito firewally, pr\u00eddete o \u010das\u0165 prev\u00e1dzky. Samozrejme, m\u00f4\u017eete pou\u017ei\u0165 stateless firewalling, ale v takom pr\u00edpade zmysel pou\u017e\u00edvania firewallu do zna\u010dnej miery zanik\u00e1.<\/p>\n<p>Preto, ak ste v v\u00fdsledku auditu zistili osamoten\u00e9 firewally a uva\u017eujete o zv\u00fd\u0161en\u00ed spo\u013eahlivosti va\u0161ej siete, HA je samozrejme jedn\u00fdm z doporu\u010den\u00fdch rie\u0161en\u00ed, ale mus\u00edte zv\u00e1\u017ei\u0165 aj nev\u00fdhody spojen\u00e9 s t\u00fdmto pr\u00edstupom a mo\u017eno pr\u00e1ve pre va\u0161u sie\u0165 bude vhodnej\u0161ie in\u00e9 rie\u0161enie.<\/p>\n<h3>Pohodlie v spr\u00e1ve (managability)<\/h3>\n<p>\nV podstate HA zah\u0155\u0148a aj spravovate\u013enos\u0165. Namiesto konfigur\u00e1cie 2 zariaden\u00ed osobitne a rie\u0161enia probl\u00e9mu synchroniz\u00e1cie konfigur\u00e1ci\u00ed, ich spravujete do zna\u010dnej miery, akoby ste mali jedno zariadenie. <\/p>\n<p>Ale mo\u017eno m\u00e1te ve\u013ea d\u00e1tov\u00fdch centier a ve\u013ea firewallov, potom sa t\u00e1to ot\u00e1zka dost\u00e1va na nov\u00fa \u00farove\u0148. A nejde len o konfigur\u00e1ciu, ale aj o<\/p>\n<ul>\n<li>z\u00e1lohovanie konfigur\u00e1ci\u00ed<\/li>\n<li>aktualiz\u00e1cie<\/li>\n<li>upgrady<\/li>\n<li>monitorovanie<\/li>\n<li>logovanie<\/li>\n<\/ul>\n<p>\nA to v\u0161etko m\u00f4\u017eu vyrie\u0161i\u0165 centralizovan\u00e9 syst\u00e9my riadenia. <\/p>\n<blockquote><p>Napr\u00edklad, ak pou\u017e\u00edvate firewally Palo Alto, tak <noindex><a rel=\"nofollow\" href=\"https:\/\/www.paloaltonetworks.com\/products\/management\/panorama\">Panorama<\/a><\/noindex> je tak\u00fdmto rie\u0161en\u00edm.\n<\/p><\/blockquote>\n<p>\n<i>Pokra\u010dovanie nasleduje.<\/i><br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u041d\u0435\u0442 \u0441\u043c\u044b\u0441\u043b\u0430 \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u044c \u043e \u043f\u043e\u043b\u043d\u043e\u043c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 security \u0440\u0438\u0441\u043a\u043e\u0432. \u041c\u044b \u0432 \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u0435 \u043d\u0435 \u043c\u043e\u0436\u0435\u043c \u0441\u043d\u0438\u0437\u0438\u0442\u044c \u0438\u0445 \u0434\u043e \u043d\u0443\u043b\u044f. \u0422\u0430\u043a\u0436\u0435 \u043d\u0443\u0436\u043d\u043e \u043f\u043e\u043d\u0438\u043c\u0430\u0442\u044c, \u0447\u0442\u043e \u043f\u0440\u0438 \u0441\u0442\u0440\u0435\u043c\u043b\u0435\u043d\u0438\u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0441\u0435\u0442\u044c \u0431\u043e\u043b\u0435\u0435 \u0438 \u0431\u043e\u043b\u0435\u0435 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0448\u0438 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23033,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31058","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u043f\u0435\u0440\u0432\u0430\u044f | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:39:12+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:39:12+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47How to Take Control of Your Network Infrastructure. Chapter Three. Network Security. Part One | ProHoster","description":"This article is the third in the series 'How to Take Control of Your Network Infrastructure.'","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u043f\u0435\u0440\u0432\u0430\u044f | ProHoster","og:description":"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0442\u0440\u0435\u0442\u044c\u0435\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-pervaya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:39:12+00:00","article:modified_time":"2019-10-31T18:39:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31058","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 04:20:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:24:14","updated":"2026-01-21 04:20:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31058","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=31058"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31058\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/23033"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=31058"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=31058"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=31058"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}