{"id":31395,"date":"2019-10-31T21:41:01","date_gmt":"2019-10-31T18:41:01","guid":{"rendered":"https:\/\/prohoster.info\/blog\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya\/"},"modified":"2019-10-31T21:41:01","modified_gmt":"2019-10-31T18:41:01","slug":"kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya","title":{"rendered":"Ako z\u00edska\u0165 kontrolu nad sie\u0165ovou infra\u0161trukt\u00farou. Kapitola tretia. Sie\u0165ov\u00e1 bezpe\u010dnos\u0165. \u010cas\u0165 tretia","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i>Tento \u010dl\u00e1nok je piaty v s\u00e9rii \u010dl\u00e1nkov \u201eAko z\u00edska\u0165 kontrolu nad sie\u0165ovou infra\u0161trukt\u00farou\u201c. Obsah v\u0161etk\u00fdch \u010dl\u00e1nkov s\u00e9rie a odkazy n\u00e1jdete <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/447008\/\">tu<\/a><\/noindex><\/i>.<\/p>\n<p>T\u00e1to \u010das\u0165 bude venovan\u00e1 segmentom Campus (Office) &amp; Remote access VPN. <\/p>\n<p><img decoding=\"async\" alt=\"Ako z\u00edska\u0165 kontrolu nad sie\u0165ovou infra\u0161trukt\u00farou. Kapitola tretia. Sie\u0165ov\u00e1 bezpe\u010dnos\u0165. \u010cas\u0165 tretia\" src=\"\/wp-content\/uploads\/2019\/04\/c20ea5e670105b5bf9b655a97b82f62f.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nM\u00f4\u017ee sa zda\u0165, \u017ee dizajn kancel\u00e1rskej siete je jednoduch\u00fd. <\/p>\n<p>Naozaj, vezmeme L2\/L3 prep\u00edna\u010de, spoj\u00edme ich medzi sebou. Potom vykon\u00e1me z\u00e1kladn\u00e9 nastavenie VLAN, predvolen\u00fdch br\u00e1n, nastav\u00edme jednoduch\u00e9 routovanie, pripoj\u00edme WiFi kontrol\u00e9ry, pr\u00edstupov\u00e9 body, nain\u0161talujeme a nastav\u00edme ASA pre vzdialen\u00fd pr\u00edstup a te\u0161\u00edme sa, \u017ee v\u0161etko funguje. V z\u00e1sade, ako som u\u017e p\u00edsal v jednej z predch\u00e1dzaj\u00facich <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/434750\/\">\u010dl\u00e1nkov<\/a><\/noindex> t\u00fdchto \u010dl\u00e1nkov, navrhn\u00fa\u0165 a nastavi\u0165 kancel\u00e1rsku sie\u0165, aby \u201enejako fungovala\u201c, m\u00f4\u017ee takmer ka\u017ed\u00fd \u0161tudent, ktor\u00fd absolvoval (a zvl\u00e1dol) dva semestry kurzu telekomunik\u00e1ci\u00ed.<\/p>\n<p>Ale \u010d\u00edm viac sa dozviete, t\u00fdm menej jednoduch\u00e1 sa t\u00e1to \u00faloha za\u010dne zda\u0165. Osobne sa mi t\u00e1to t\u00e9ma, t\u00e9ma dizajnu kancel\u00e1rskej siete, v\u00f4bec nezd\u00e1 jednoduch\u00e1 a v tomto \u010dl\u00e1nku sa pok\u00fasim vysvetli\u0165, pre\u010do.<\/p>\n<p>Ak to zhrniem, je potrebn\u00e9 zoh\u013eadni\u0165 pomerne ve\u013ea faktorov. Tieto faktory sa \u010dasto navz\u00e1jom protire\u010dia a je potrebn\u00e9 h\u013eada\u0165 rozumn\u00fd kompromis. <br \/>\nT\u00e1to neistota je z\u00e1kladnou obtia\u017enos\u0165ou. Hovoriac o bezpe\u010dnosti, m\u00e1me trojuholn\u00edk s tromi vrcholmi: bezpe\u010dnos\u0165, pohodlie pre zamestnancov, cena rie\u0161enia. <br \/>\nA zaka\u017ed\u00fdm mus\u00edme h\u013eada\u0165 kompromis medzi t\u00fdmito tromi.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Architekt\u00fara<\/h2>\n<p>\nAko pr\u00edklad architekt\u00fary pre tieto dva segmenty odpor\u00fa\u010dam, ako aj v predch\u00e1dzaj\u00facich \u010dl\u00e1nkoch, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/solutions\/Enterprise\/Security\/SAFE_RG\/SAFE_rg\/chap1.html\">Cisco SAFE<\/a><\/noindex> model: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/solutions\/Enterprise\/Security\/SAFE_RG\/SAFE_rg\/chap5.html#wpxref51616\">Enterprise Campus<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/td\/docs\/solutions\/Enterprise\/Security\/SAFE_RG\/SAFE_rg\/chap6.html#wpxref74611\">Enterprise Internet Edge<\/a><\/noindex>.<\/p>\n<p>Toto s\u00fa trochu zastaran\u00e9 dokumenty. Uv\u00e1dzam ich tu, preto\u017ee principi\u00e1lne sch\u00e9my a pr\u00edstup sa nezmenili, ale toto vyjadrenie sa mi p\u00e1\u010di viac ako v <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/solutions\/enterprise\/design-zone-security\/landing_safe.html#~tab-architecture\">novej dokument\u00e1cii<\/a><\/noindex>.<\/p>\n<p>Aj ke\u010f v\u00e1s nenab\u00e1dam, aby ste pou\u017e\u00edvali pr\u00e1ve Cisco rie\u0161enia, st\u00e1le pova\u017eujem za u\u017eito\u010dn\u00e9 d\u00f4kladne presk\u00fama\u0165 tento dizajn. <\/p>\n<p>Tento \u010dl\u00e1nok, ako obvykle, nijako nepretv\u00e1ra cel\u00fd obsah a je sk\u00f4r doplnkom k t\u00fdmto inform\u00e1ci\u00e1m. <\/p>\n<p>Na konci \u010dl\u00e1nku analyzujeme dizajn Cisco SAFE pre kancel\u00e1riu z poh\u013eadu hierarchi\u00ed, ktor\u00e9 s\u00fa tu uveden\u00e9.<\/p>\n<h2>V\u0161eobecn\u00e9 princ\u00edpy<\/h2>\n<p>\nDizajn kancel\u00e1rskej siete, samozrejme, mus\u00ed sp\u013a\u0148a\u0165 v\u0161eobecn\u00e9 po\u017eiadavky, ktor\u00e9 boli presk\u00faman\u00e9 <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/434750\/\">tu<\/a><\/noindex> v kapitole \u201eKrit\u00e9ri\u00e1 hodnotenia kvality dizajnu\u201c. Okrem ceny a bezpe\u010dnosti, ktor\u00e9 chceme prediskutova\u0165 v tomto \u010dl\u00e1nku, zost\u00e1vaj\u00fa e\u0161te tri krit\u00e9ri\u00e1, ktor\u00e9 mus\u00edme zoh\u013eadni\u0165 pri n\u00e1vrhu (alebo pri vykon\u00e1van\u00ed zmien):<\/p>\n<ul>\n<li>\u0161k\u00e1lovate\u013enos\u0165 (scalability)<\/li>\n<li>pohodlie v spr\u00e1ve (managability)<\/li>\n<li>dostupnos\u0165 (availability)<\/li>\n<\/ul>\n<p>\nMnoh\u00e9 z toho, \u010do bolo prediskutovan\u00e9 pre <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">d\u00e1tov\u00fdch centier<\/a><\/noindex> je tie\u017e platn\u00e9 pre kancel\u00e1riu. <\/p>\n<p>Ale kancel\u00e1rsky segment m\u00e1 svoj vlastn\u00fd aspekt, ktor\u00fd je z poh\u013eadu bezpe\u010dnosti kritick\u00fd. Podstatou tohto aspektu je to, \u017ee tento segment je zriaden\u00fd na poskytovanie sie\u0165ov\u00fdch slu\u017eieb zamestnancom (aj partnerom a hos\u0165om) spolo\u010dnosti a, v d\u00f4sledku toho, na najvy\u0161\u0161ej \u00farovni zv\u00e1\u017eenia probl\u00e9mu m\u00e1me dve \u00falohy:<\/p>\n<ul>\n<li>ochr\u00e1ni\u0165 zdroje spolo\u010dnosti pred \u0161kodliv\u00fdmi \u010dinnos\u0165ami, ktor\u00e9 m\u00f4\u017eu vych\u00e1dza\u0165 od zamestnancov (hos\u0165ov, partnerov) a od softv\u00e9ru, ktor\u00fd pou\u017e\u00edvaj\u00fa. Sem patr\u00ed aj ochrana proti neopr\u00e1vnen\u00e9mu pripojeniu do siete. <\/li>\n<li>ochr\u00e1ni\u0165 syst\u00e9my a d\u00e1ta samotn\u00fdch pou\u017e\u00edvate\u013eov<\/li>\n<\/ul>\n<p>\nA to je len jedna strana probl\u00e9mu (presnej\u0161ie jedna vrcholov\u00e1 strana trojuholn\u00edka). Na druhej strane je pohodlie pou\u017e\u00edvate\u013ea a cena pou\u017e\u00edvan\u00fdch rie\u0161en\u00ed.<\/p>\n<p>Po\u010fme za\u010da\u0165 presk\u00faman\u00edm toho, \u010do pou\u017e\u00edvate\u013e o\u010dak\u00e1va od modernej kancel\u00e1rskej siete. <\/p>\n<h2>Pohodlie<\/h2>\n<p>\nTakto pod\u013ea m\u00f4jho n\u00e1zoru vyzeraj\u00fa \u201esie\u0165ov\u00e9 pohodlia\u201c pre pou\u017e\u00edvate\u013ea kancel\u00e1rie:<\/p>\n<ul>\n<li>Mobilita<\/li>\n<li>Mo\u017enos\u0165 pou\u017e\u00edva\u0165 cel\u00fd rozsah obvykl\u00fdch zariaden\u00ed a opera\u010dn\u00fdch syst\u00e9mov<\/li>\n<li>Jednoduch\u00fd pr\u00edstup ku v\u0161etk\u00fdm potrebn\u00fdm zdrojom spolo\u010dnosti <\/li>\n<li>Dostupnos\u0165 internetov\u00fdch zdrojov, vr\u00e1tane r\u00f4znych cloudov\u00fdch slu\u017eieb<\/li>\n<li>\u201eR\u00fdchla pr\u00e1ca\u201c siete<\/li>\n<\/ul>\n<p>\nToto v\u0161etko plat\u00ed ako pre zamestnancov, tak aj pre host\u00ed (alebo partnerov), a to je u\u017e \u00faloha in\u017einierov spolo\u010dnosti na z\u00e1klade autoriz\u00e1cie rozl\u00ed\u0161i\u0165 pr\u00edstupy pre r\u00f4zne skupiny pou\u017e\u00edvate\u013eov.<\/p>\n<p>Po\u010fme sa pozrie\u0165 podrobnej\u0161ie na ka\u017ed\u00fd z t\u00fdchto aspektov.<\/p>\n<h3>Mobilita<\/h3>\n<p>\nHovor\u00edme o mo\u017enosti pracova\u0165 a pou\u017e\u00edva\u0165 v\u0161etky potrebn\u00e9 zdroje spolo\u010dnosti z ak\u00e9hoko\u013evek miesta na svete (samozrejme, kde je internet dostupn\u00fd).<\/p>\n<p>Toto plat\u00ed aj pre kancel\u00e1riu. Je pohodln\u00e9, ke\u010f z ktorejko\u013evek \u010dasti kancel\u00e1rie m\u00f4\u017eete pokra\u010dova\u0165 v pr\u00e1ci, napr\u00edklad prij\u00edma\u0165 e-maily, komunikova\u0165 v firemn\u00fdch messenger\u00e1ch, by\u0165 dostupn\u00fd na videohovore, ... Takto m\u00e1te jednu stranu mo\u017enos\u0165 rie\u0161i\u0165 niektor\u00e9 z\u00e1le\u017eitosti cez '\u017eiv\u00fa' komunik\u00e1ciu (napr\u00edklad sa z\u00fa\u010dastni\u0165 na sch\u00f4dzkach), a na druhej strane by\u0165 v\u017edy online, ma\u0165 preh\u013ead a r\u00fdchlo rie\u0161i\u0165 niektor\u00e9 urgentn\u00e9 prioritn\u00e9 \u00falohy. Je to ve\u013emi pohodln\u00e9 a naozaj zlep\u0161uje kvalitu komunik\u00e1cie.<\/p>\n<p>To sa dosahuje spr\u00e1vnym dizajnom WiFi siete.<\/p>\n<blockquote><p><b>Pozn\u00e1mka<\/b><\/p>\n<p>Tu sa zvy\u010dajne objavuje ot\u00e1zka, \u010di sta\u010d\u00ed pou\u017e\u00edva\u0165 len WiFi? Znamen\u00e1 to, \u017ee sa m\u00f4\u017eeme vzda\u0165 pou\u017e\u00edvania Ethernet portov v kancel\u00e1rii? Ak ide len o pou\u017e\u00edvate\u013eov, a nie o servery, ktor\u00e9 je rozumn\u00e9 pripoji\u0165 oby\u010dajn\u00fdm Ethernet portom, tak vo v\u0161eobecnosti odpove\u010f znie \u00e1no, sta\u010d\u00ed sa obmedzi\u0165 iba na WiFi. Ale s\u00fa tu nuansy.<\/p>\n<p>Existuj\u00fa d\u00f4le\u017eit\u00e9 skupiny pou\u017e\u00edvate\u013eov, ku ktor\u00fdm je potrebn\u00e9 pristupova\u0165 osobitne. To s\u00fa samozrejme spr\u00e1vcovia. V z\u00e1sade, WiFi pripojenie je menej spo\u013eahliv\u00e9 (z h\u013eadiska straty d\u00e1t) a menej r\u00fdchle ako oby\u010dajn\u00fd Ethernet port. To m\u00f4\u017ee by\u0165 podstatn\u00e9 pre spr\u00e1vcov. Navy\u0161e, syst\u00e9mov\u00ed administr\u00e1tori m\u00f4\u017eu ma\u0165 napr\u00edklad svoju vyhraden\u00fa Ethernet sie\u0165 pre out-of-band pripojenie.<\/p>\n<p>Mo\u017eno vo va\u0161ej spolo\u010dnosti existuj\u00fa aj in\u00e9 skupiny\/oddelenia, pre ktor\u00e9 s\u00fa tieto faktory rovnako d\u00f4le\u017eit\u00e9.<\/p>\n<p>Je tu e\u0161te jeden d\u00f4le\u017eit\u00fd aspekt \u2013 telefonovanie. Mo\u017eno z nejak\u00fdch d\u00f4vodov nechcete pou\u017e\u00edva\u0165 bezdr\u00f4tov\u00fd VoIP a chcete pou\u017e\u00edva\u0165 IP telef\u00f3ny s oby\u010dajn\u00fdm Ethernet pripojen\u00edm. <\/p>\n<p>Vo v\u0161eobecnosti, v t\u00fdch spolo\u010dnostiach, v ktor\u00fdch som pracoval, bola obvykle mo\u017enos\u0165 ako WiFi pripojenia, tak aj Ethernet portu.<\/p><\/blockquote>\n<p>\nR\u00e1d by som, aby mobilita nebola obmedzen\u00e1 len na kancel\u00e1riu.<\/p>\n<p>Na zabezpe\u010denie mo\u017enosti pr\u00e1ce z domu (alebo z ak\u00e9hoko\u013evek in\u00e9ho miesta s pr\u00edstupom na internet) sa pou\u017e\u00edva VPN pripojenie. Pri tom je \u017eiaduce, aby zamestnanci nec\u00edtili rozdiel medzi pr\u00e1cou z domu a pr\u00e1cou na dia\u013eku, \u010do predpoklad\u00e1 pr\u00edtomnos\u0165 rovnak\u00fdch pr\u00edstupov. Ako to usporiada\u0165, budeme diskutova\u0165 nesk\u00f4r v kapitole 'Jednotn\u00fd centralizovan\u00fd syst\u00e9m autentifik\u00e1cie a autoriz\u00e1cie'.<\/p>\n<blockquote><p><b>Pozn\u00e1mka<\/b><\/p>\n<p>Pravdepodobne nebudete schopn\u00ed poskytn\u00fa\u0165 rovnak\u00fa kvalitu slu\u017eieb pre vzdialen\u00fa pr\u00e1cu, ak\u00fa m\u00e1te v kancel\u00e1rii. Predpokladajme, \u017ee ako VPN br\u00e1nu pou\u017e\u00edvate Cisco ASA 5520. V s\u00falade s <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/products\/security\/asa-5500-series-next-generation-firewalls\/data_sheet_c78-345385.html\">technick\u00fdm listom<\/a><\/noindex> to zariadenie je schopn\u00e9 obsl\u00fa\u017ei\u0165 iba 225 Mbit VPN prev\u00e1dzky. To znamen\u00e1, \u017ee z h\u013eadiska priepustnosti sa pripojenie cez VPN v\u00fdrazne l\u00ed\u0161i od pr\u00e1ce z kancel\u00e1rie. Ak s\u00fa z nejak\u00fdch d\u00f4vodov oneskorenia, straty, jitter (napr\u00edklad ak chcete pou\u017e\u00edva\u0165 kancel\u00e1rsku IP telef\u00f3niu) v\u00fdznamn\u00e9 pre va\u0161e sie\u0165ov\u00e9 slu\u017eby, takisto nedosiahnete rovnak\u00fa kvalitu ako keby ste boli v kancel\u00e1rii. Preto, ke\u010f hovor\u00edme o mobilite, mus\u00edme ma\u0165 na pam\u00e4ti mo\u017en\u00e9 obmedzenia.<\/p><\/blockquote>\n<p><\/p>\n<h3>Jednoduch\u00fd pr\u00edstup ku v\u0161etk\u00fdm zdrojom spolo\u010dnosti<\/h3>\n<p>\nT\u00fato \u00falohu je potrebn\u00e9 rie\u0161i\u0165 spolo\u010dne s in\u00fdmi technick\u00fdmi oddeleniami.<br \/>\nIde\u00e1lna situ\u00e1cia je, ke\u010f sa pou\u017e\u00edvate\u013e mus\u00ed autentifikova\u0165 len raz, a potom z\u00edska pr\u00edstupy ku v\u0161etk\u00fdm potrebn\u00fdm zdrojom.<br \/>\nPoskytovanie jednoduch\u00e9ho pr\u00edstupu bez ohrozenia bezpe\u010dnosti m\u00f4\u017ee v\u00fdrazne zv\u00fd\u0161i\u0165 efektivitu pr\u00e1ce a zn\u00ed\u017ei\u0165 \u00farove\u0148 stresu va\u0161ich kolegov.<\/p>\n<blockquote><p><b>Pozn\u00e1mka 1<\/b><\/p>\n<p>Pohodlie pr\u00edstupu nie je len o tom, ko\u013ekokr\u00e1t mus\u00edte zada\u0165 heslo. Ak, pod\u013ea va\u0161ej bezpe\u010dnostnej politiky, mus\u00edte pred pripojen\u00edm z kancel\u00e1rie do d\u00e1tov\u00e9ho centra najprv pripoji\u0165 VPN br\u00e1nu a pri tom str\u00e1cate pr\u00edstupy k kancel\u00e1rskym zdrojom, je to tie\u017e ve\u013emi a ve\u013emi nepr\u00edjemn\u00e9.\n<\/p><\/blockquote>\n<blockquote><p><b>Pozn\u00e1mka 2<\/b><\/p>\n<p>Existuj\u00fa slu\u017eby (napr\u00edklad pr\u00edstup k sie\u0165ov\u00e9mu vybaveniu), kde zvy\u010dajne m\u00e1me svoje vlastn\u00e9 dedikovan\u00e9 AAA servery a je normou, ke\u010f sa v takomto pr\u00edpade mus\u00edme autentifikova\u0165 nieko\u013ekokr\u00e1t.\n<\/p><\/blockquote>\n<p><\/p>\n<h3>Dostupnos\u0165 internetov\u00fdch zdrojov<\/h3>\n<p>\nInternet nie je len o z\u00e1bave, ale tie\u017e o s\u00fabore slu\u017eieb, ktor\u00e9 m\u00f4\u017eu by\u0165 ve\u013emi u\u017eito\u010dn\u00e9 pre pr\u00e1cu. Existuj\u00fa aj \u010disto psychologick\u00e9 faktory. Modern\u00fd \u010dlovek je cez internet spojen\u00fd s in\u00fdmi \u013eu\u010fmi mnoh\u00fdmi virtu\u00e1lnymi nitkami a pod\u013ea m\u0148a nen\u00ed ni\u010d zl\u00e9 na tom, ak si t\u00fato v\u00e4zbu zachov\u00e1 aj po\u010das pr\u00e1ce.<\/p>\n<p>Z h\u013eadiska straty \u010dasu nie je ni\u010d stra\u0161n\u00e9, ak m\u00e1 zamestnanec napr\u00edklad spusten\u00fd Skype a v pr\u00edpade potreby venuje 5 min\u00fat komunik\u00e1cii s bl\u00edzkou osobou.<\/p>\n<p>Znamen\u00e1 to, \u017ee internet by mal by\u0165 v\u017edy pr\u00edstupn\u00fd, znamen\u00e1 to, \u017ee zamestnanci m\u00f4\u017eu ma\u0165 pr\u00edstup ku v\u0161etk\u00fdm zdrojom bez ak\u00e9hoko\u013evek doh\u013eadu?<\/p>\n<p>Nie, neznamen\u00e1. \u00darove\u0148 otvorenosti internetu sa m\u00f4\u017ee l\u00ed\u0161i\u0165 medzi r\u00f4znymi spolo\u010dnos\u0165ami \u2013 od \u00faplnej uzavretosti po \u00fapln\u00fa otvorenos\u0165. Sp\u00f4soby kontroly pr\u00edstupu k \u00fadajom preberieme nesk\u00f4r v sekci\u00e1ch zameran\u00fdch na bezpe\u010dnostn\u00e9 opatrenia. <\/p>\n<h3>Mo\u017enos\u0165 vyu\u017e\u00edva\u0165 cel\u00fd reperto\u00e1r zn\u00e1mych zariaden\u00ed<\/h3>\n<p>\nJe pohodln\u00e9, ke\u010f napr\u00edklad m\u00f4\u017eete pokra\u010dova\u0165 v pou\u017e\u00edvan\u00ed v\u0161etk\u00fdch zn\u00e1mych komunika\u010dn\u00fdch prostriedkov aj na pracovisku. Technicky to nie je zlo\u017eit\u00e1 \u00faloha. Potrebujete iba WiFi a hos\u0165uj\u00facu VLAN.<\/p>\n<p>Tie\u017e je dobr\u00e9 ma\u0165 mo\u017enos\u0165 pou\u017e\u00edva\u0165 ten opera\u010dn\u00fd syst\u00e9m, ktor\u00fd pozn\u00e1te. Ale pod\u013ea mojich pozorovan\u00ed, zvy\u010dajne je to povolen\u00e9 iba mana\u017e\u00e9rom, administr\u00e1torom a v\u00fdvoj\u00e1rom. <\/p>\n<blockquote><p><b>Pr\u00edklad<\/b><\/p>\n<p>Samozrejme, je mo\u017en\u00e9 zvoli\u0165 aj cestu obmedzen\u00ed, zak\u00e1za\u0165 vzdialen\u00fd pr\u00edstup, zak\u00e1za\u0165 pripojenie z mobiln\u00fdch zariaden\u00ed, obmedzi\u0165 pr\u00edstup len na statick\u00e9 Ethernet pripojenia, obmedzi\u0165 pr\u00edstup na internet, povinne odobera\u0165 mobiln\u00e9 telef\u00f3ny a zariadenia pri vstupe... a niektor\u00e9 organiz\u00e1cie s vy\u0161\u0161\u00edmi bezpe\u010dnostn\u00fdmi po\u017eiadavkami sa touto cestou naozaj vyberaj\u00fa, a mo\u017eno v niektor\u00fdch pr\u00edpadoch je to aj od\u00f4vodnen\u00e9, ale... s\u00fahlas\u00edte, \u017ee to vyzer\u00e1 ako snaha zastavi\u0165 pokrok v konkr\u00e9tnej organiz\u00e1cii. Samozrejme, bolo by dobr\u00e9 skombinova\u0165 mo\u017enosti, ktor\u00e9 modern\u00e9 technol\u00f3gie pon\u00fakaj\u00fa, s dostato\u010dnou \u00farov\u0148ou bezpe\u010dnosti.<\/p><\/blockquote>\n<p><\/p>\n<h3>\u201eR\u00fdchla pr\u00e1ca\u201c siete<\/h3>\n<p>\nR\u00fdchlos\u0165 prenosu d\u00e1t technicky z\u00e1vis\u00ed od mnoh\u00fdch faktorov. A r\u00fdchlos\u0165 v\u00e1\u0161ho pripojenia zvy\u010dajne nie je t\u00fdm najd\u00f4le\u017eitej\u0161\u00edm. Nie v\u017edy s\u00fa pomal\u00e9 v\u00fdkony aplik\u00e1ci\u00ed spojen\u00e9 so sie\u0165ov\u00fdmi probl\u00e9mami, ale teraz n\u00e1s zauj\u00edma len sie\u0165ov\u00e1 \u010das\u0165. Naj\u010dastej\u0161\u00edm probl\u00e9mom \u201aspomalenia\u2018 v lok\u00e1lnej sieti je strata paketov. K tomu obvykle doch\u00e1dza pri efektoch \u201a\u00fazkeho hrdla\u2018 alebo pri probl\u00e9moch na \u00farovni L1 (OSI). Menej \u010dasto, pri niektor\u00fdch n\u00e1vrhoch, (napr\u00edklad, ke\u010f v subnets ako predvolen\u00e9 br\u00e1ny vystupuje firewall a teda cel\u00fd traffic prech\u00e1dza cez neho), v\u00fdkon hardv\u00e9ru nemus\u00ed by\u0165 dostato\u010dn\u00fd. <\/p>\n<p>Pri v\u00fdbere hardv\u00e9ru a architekt\u00fary je potrebn\u00e9 zoh\u013eadni\u0165 r\u00fdchlosti koncov\u00fdch portov, trunkov a v\u00fdkon hardv\u00e9ru.<\/p>\n<blockquote><p><b>Pr\u00edklad<\/b><\/p>\n<p>Predpokladajme, \u017ee na pr\u00edstupov\u00e9 prep\u00edna\u010de pou\u017e\u00edvate prep\u00edna\u010de s 1 gigabitov\u00fdmi portami. Medzi sebou s\u00fa prepojen\u00e9 prostredn\u00edctvom Etherchannel 2 x 10 gigabitov. Ako predvolen\u00fa br\u00e1nu pou\u017e\u00edvate firewall s gigabitov\u00fdmi portami, na pripojenie ktor\u00e9ho k L2 sieti kancel\u00e1rie pou\u017e\u00edvate 2 gigabitov\u00e9 porty zl\u00fa\u010den\u00e9 v Etherchannel. <\/p>\n<p>T\u00e1to architekt\u00fara je pomerne v\u00fdhodn\u00e1 z h\u013eadiska funk\u010dnosti, ke\u010f\u017ee cel\u00fd prev\u00e1dzkov\u00fd tok prech\u00e1dza cez firewall, a m\u00f4\u017eete pohodlne spravova\u0165 pr\u00edstupov\u00e9 politiky a aplikova\u0165 zlo\u017eit\u00e9 algoritmy na kontrolu prev\u00e1dzky a prevenciu potenci\u00e1lnych \u00fatokov (pozri ni\u017e\u0161ie), ale z h\u013eadiska priepustnosti a v\u00fdkonu m\u00e1 tento dizajn ur\u010dit\u00e9 potenci\u00e1lne probl\u00e9my. Napr\u00edklad 2 hostitelia s r\u00fdchlos\u0165ou portu 1 gigabit m\u00f4\u017eu \u00faplne vy\u0165a\u017ei\u0165 2 gigabitov\u00e9 pripojenie k firewallu, \u010do m\u00f4\u017ee vies\u0165 k degrad\u00e1cii slu\u017eieb pre cel\u00fa kancel\u00e1rsku segment\u00e1ciu.<\/p><\/blockquote>\n<p>\nPozreli sme sa na jednu vrcholov\u00fa \u010das\u0165 trojuholn\u00edka, teraz sa pozrime, ak\u00fdmi prostriedkami m\u00f4\u017eeme zabezpe\u010di\u0165 bezpe\u010dnos\u0165.<\/p>\n<h2>Prostriedky ochrany<\/h2>\n<p>\nSamozrejme, na\u0161\u00edm \u017eelan\u00edm (presnej\u0161ie, \u017eelan\u00edm n\u00e1\u0161ho vedenia) je dosiahnu\u0165 nemo\u017en\u00e9, a to poskytn\u00fa\u0165 maxim\u00e1lne pohodlie pri maxim\u00e1lnej ochrane a minim\u00e1lnej cene.<\/p>\n<p>Pozrime sa, ak\u00e9 met\u00f3dy m\u00e1me na zabezpe\u010denie ochrany.<\/p>\n<p>Pre kancel\u00e1riu by som vyzdvihol nasleduj\u00face:<\/p>\n<ul>\n<li>pr\u00edstup zalo\u017een\u00fd na zero trust v dizajne<\/li>\n<li>vysok\u00e1 \u00farove\u0148 ochrany <\/li>\n<li>vidite\u013enos\u0165 siete<\/li>\n<li>jednotn\u00fd centralizovan\u00fd syst\u00e9m autentifik\u00e1cie a autoriz\u00e1cie<\/li>\n<li>kontrola hostite\u013ea (host checking) <\/li>\n<\/ul>\n<p>\n\u010ealej sa podrobnej\u0161ie pozrieme na ka\u017ed\u00fd z t\u00fdchto aspektov.<\/p>\n<h3>Zero Trust<\/h3>\n<p>\nIT svet sa men\u00ed ve\u013emi r\u00fdchlo. Doslova za posledn\u00fdch 10 rokov vznik nov\u00fdch technol\u00f3gi\u00ed a produktov viedol k v\u00e1\u017enemu prehodnoteniu bezpe\u010dnostn\u00fdch konceptov. E\u0161te pred desiatimi rokmi sme z h\u013eadiska bezpe\u010dnosti segmentovali sie\u0165 na d\u00f4veryhodn\u00e9, DMZ a ned\u00f4veryhodn\u00e9 oblasti a pou\u017e\u00edval sa takzvan\u00fd \"ochrana na per\u00edmetri\", kde boli dve obrann\u00e9 l\u00ednie: ned\u00f4veryhodn\u00e9 -&gt; DMZ a DMZ -&gt; d\u00f4veryhodn\u00e9. Ochrana bola zvy\u010dajne obmedzen\u00e1 na pr\u00edstupov\u00e9 zoznamy zalo\u017een\u00e9 na hlavi\u010dk\u00e1ch L3\/L4 (OSI) (IP, TCP\/UDP porty, TCP flagy). V\u0161etko, \u010do sa t\u00fdkalo vy\u0161\u0161\u00edch \u00farovn\u00ed, vr\u00e1tane L7, sa zverilo opera\u010dn\u00e9mu syst\u00e9mu a produktom zabezpe\u010denia nain\u0161talovan\u00fdm na koncov\u00fdch hos\u0165och.<\/p>\n<p>Teraz sa situ\u00e1cia z\u00e1sadne zmenila. Modern\u00fd koncept <noindex><a rel=\"nofollow\" href=\"https:\/\/doubleoctopus.com\/security-wiki\/network-architecture\/zero-trust\/\">zero trust<\/a><\/noindex> vych\u00e1dza z toho, \u017ee u\u017e nie je mo\u017en\u00e9 pova\u017eova\u0165 intern\u00e9 syst\u00e9my, teda tie, ktor\u00e9 sa nach\u00e1dzaj\u00fa v r\u00e1mci per\u00edmetra, za d\u00f4veryhodn\u00e9, a samotn\u00fd koncept per\u00edmetra sa stal rozmazan\u00fdm.<br \/>\nOkrem pripojenia na internet m\u00e1me tie\u017e<\/p>\n<ul>\n<li>remote access VPN pou\u017e\u00edvate\u013eov<\/li>\n<li>r\u00f4zne osobn\u00e9 zariadenia, prinesen\u00e9 notebooky, pripojen\u00e9 cez kancel\u00e1rske WiFi<\/li>\n<li>in\u00e9 (branch) kancel\u00e1rie<\/li>\n<li>integr\u00e1ciu s cloudovou infra\u0161trukt\u00farou <\/li>\n<\/ul>\n<p>\nAko vyzer\u00e1 Zero Trust pr\u00edstup v praxi?<\/p>\n<p>Ide\u00e1lne by mal by\u0165 povolen\u00fd iba ten prechod, ktor\u00fd je potrebn\u00fd a, ak u\u017e hovor\u00edme o ide\u00e1le, kontrola by mala prebieha\u0165 nielen na \u00farovni L3\/L4, ale aj na \u00farovni aplik\u00e1cie. <\/p>\n<p>Ak napr\u00edklad m\u00e1te mo\u017enos\u0165 necha\u0165 cel\u00fd prenos prejs\u0165 cez firewall, m\u00f4\u017eete sa pok\u00fasi\u0165 pribl\u00ed\u017ei\u0165 k ide\u00e1lu. Ale tak\u00fd pr\u00edstup m\u00f4\u017ee v\u00fdrazne zn\u00ed\u017ei\u0165 celkov\u00fa prenosov\u00fa kapacitu va\u0161ej siete a navy\u0161e filtr\u00e1cia na \u00farovni aplik\u00e1cie nefunguje v\u017edy dobre.<\/p>\n<p>Pri kontrole prechodu na smerova\u010di alebo L3 prep\u00edna\u010di (pou\u017eitie \u0161tandardn\u00fdch ACL) sa stret\u00e1vate s in\u00fdmi probl\u00e9mami:<\/p>\n<ul>\n<li>je to len L3\/L4 filtr\u00e1cia. Ni\u010d nezabr\u00e1ni \u00fato\u010dn\u00edkovi pou\u017ei\u0165 povolen\u00e9 porty (napr\u00edklad TCP 80) pre svoju aplik\u00e1ciu (nie http)<\/li>\n<li>komplexn\u00e9 spravovanie ACL (\u0165a\u017eko analyzovate\u013en\u00e9 ACL)<\/li>\n<li>to nie je stateful firewall, teda mus\u00edte v\u00fdslovne povoli\u0165 reverzn\u00fd prenos<\/li>\n<li>v pr\u00edpade prep\u00edna\u010dov ste zvy\u010dajne dos\u0165 pr\u00edsne obmedzen\u00ed ve\u013ekos\u0165ou TCAM, \u010do m\u00f4\u017ee r\u00fdchlo sta\u0165 probl\u00e9mom pri pou\u017eit\u00ed pr\u00edstupu \u201epovoli\u0165 len to, \u010do je potrebn\u00e9\u201c<\/li>\n<\/ul>\n<p><\/p>\n<blockquote><p><b>Pozn\u00e1mka<\/b><\/p>\n<p>Pokia\u013e ide o reverzn\u00fd prenos, mus\u00edme pam\u00e4ta\u0165, \u017ee m\u00e1me nasleduj\u00facu mo\u017enos\u0165 (Cisco) <\/p>\n<p>permit tcp any any established<\/p>\n<p>Ale treba rozumie\u0165, \u017ee tento riadok je ekvivalentom dvoch riadkov:<br \/>\npermit tcp any any ack<br \/>\npermit tcp any any rst<\/p>\n<p>\u010co znamen\u00e1, \u017ee aj ke\u010f nebol p\u00f4vodn\u00fd TCP segment so SYN flagom (t.j. TCP rel\u00e1cia sa ani neza\u010dala nadv\u00e4zova\u0165), tento ACL prepust\u00ed paket s flagom ACK, \u010do m\u00f4\u017ee zneu\u017eite\u013e zneu\u017e\u00edva\u0165 na prenos \u00fadajov.<\/p>\n<p>To znamen\u00e1, \u017ee tento riadok nijako neprev\u00e1dza v\u00e1\u0161 router alebo L3 prep\u00edna\u010d na statefull firewall.<\/p><\/blockquote>\n<p><\/p>\n<h3>Vysok\u00e1 \u00farove\u0148 ochrany<\/h3>\n<p>\nV <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/435138\/\">\u010dl\u00e1nku<\/a><\/noindex> v sekcii venovanej d\u00e1tov\u00fdm centr\u00e1m sme sa zaoberali nasleduj\u00facimi sp\u00f4sobmi ochrany.<\/p>\n<ul>\n<li>stateful firewalling (pod\u013ea predvolen\u00e9ho nastavenia)<\/li>\n<li>ddos\/dos ochrana<\/li>\n<li>aplika\u010dn\u00e9 firewalling<\/li>\n<li>prevencia hrozieb (antiv\u00edrus, anti-spyware a zranite\u013enosti)<\/li>\n<li>URL filtrovanie<\/li>\n<li>filtrovanie d\u00e1t (filtrovanie obsahu)<\/li>\n<li>blokovanie s\u00faborov (blokovanie typov s\u00faborov)<\/li>\n<\/ul>\n<p>\nV pr\u00edpade kancel\u00e1rie je situ\u00e1cia podobn\u00e1, ale priority s\u00fa trochu in\u00e9. Dostupnos\u0165 kancel\u00e1rie (availability) zvy\u010dajne nie je tak kritick\u00e1, ako v pr\u00edpade d\u00e1tov\u00e9ho centra, zatia\u013e \u010do pravdepodobnos\u0165 \"vn\u00fatorn\u00e9ho\" \u0161kodliv\u00e9ho prenosu je nieko\u013ekon\u00e1sobne vy\u0161\u0161ia. <br \/>\nPreto sa nasleduj\u00face met\u00f3dy ochrany pre tento segment st\u00e1vaj\u00fa kritick\u00fdmi:<\/p>\n<ul>\n<li>aplika\u010dn\u00e9 firewalling<\/li>\n<li>prevencia hrozieb (antiv\u00edrus, anti-spyware a zranite\u013enosti)<\/li>\n<li>URL filtrovanie<\/li>\n<li>filtrovanie d\u00e1t (filtrovanie obsahu)<\/li>\n<li>blokovanie s\u00faborov (blokovanie typov s\u00faborov)<\/li>\n<\/ul>\n<p>\nHoci v\u0161etky tieto met\u00f3dy ochrany, okrem aplika\u010dn\u00e9ho firewallingu, sa tradi\u010dne rie\u0161ili a na\u010falej rie\u0161ia na koncov\u00fdch hostite\u013eoch (napr\u00edklad in\u0161tal\u00e1ciou antiv\u00edrusov\u00e9ho softv\u00e9ru) a pomocou proxy, modern\u00e9 NGFW poskytuj\u00fa aj tieto slu\u017eby. <\/p>\n<p>V\u00fdrobcovia bezpe\u010dnostn\u00e9ho vybavenia sa sna\u017eia vytv\u00e1ra\u0165 komplexn\u00fa ochranu, preto sa okrem ochrany na lok\u00e1lnej krabici pon\u00fakaj\u00fa aj r\u00f4zne cloudov\u00e9 technol\u00f3gie a klientsk\u00fd softv\u00e9r pre hostite\u013eov (end point protection\/EPP). Tak napr\u00edklad z <noindex><a rel=\"nofollow\" href=\"https:\/\/www.fairline.com.tw\/data\/editor\/files\/01%20%20Gartner%20-%20Magic%20Quad%20-%20Endpoint%20Protection%20Platforms%201-2018.pdf\">Magick\u00e9ho Kvadrantu Gartnera (Gartner Magic Quadrant) za rok 2018<\/a><\/noindex> vid\u00edme, \u017ee Palo Alto a Cisco maj\u00fa svoje EPP (PA: Traps, Cisco: AMP), ale nie s\u00fa rozhodne l\u00eddrami.<\/p>\n<p>Zaradenie t\u00fdchto ochr\u00e1n (zvy\u010dajne pomocou n\u00e1kupu licenci\u00ed) na firewalle ur\u010dite nie je povinn\u00e9 (m\u00f4\u017eete \u00eds\u0165 tradi\u010dnou cestou), ale prin\u00e1\u0161a niektor\u00e9 v\u00fdhody:<\/p>\n<ul>\n<li>v tomto pr\u00edpade sa objavuje jedin\u00e9 miesto aplik\u00e1cie met\u00f3d ochrany, \u010do zlep\u0161uje visibility (pozri nasleduj\u00facu t\u00e9mu). <\/li>\n<li>ak sa vo va\u0161ej sieti nach\u00e1dza nezaisten\u00e9 zariadenie, st\u00e1le patr\u00ed pod \"z\u00e1\u0161titu\" ochrany firewalla.<\/li>\n<li> Pou\u017eit\u00edm ochrany na firewallu spolu s ochranou na koncov\u00fdch hostoch zvy\u0161ujeme pravdepodobnos\u0165 odhalenia \u0161kodliv\u00e9ho provozu. Napr\u00edklad pou\u017e\u00edvanie prevencie hrozieb na lok\u00e1lnych hostoch a na firewalle zvy\u0161uje pravdepodobnos\u0165 odhalenia (za predpokladu, \u017ee na t\u00fdchto rie\u0161eniach s\u00fa zalo\u017een\u00e9 r\u00f4zne softv\u00e9rov\u00e9 produkty).<\/li>\n<\/ul>\n<blockquote><p><b>Pozn\u00e1mka<\/b><\/p>\n<p>Ak napr\u00edklad ako antiv\u00edrus pou\u017e\u00edvate Kaspersky rovnako na firewalle ako aj na koncov\u00fdch hostoch, nie je prekvapuj\u00face, \u017ee to ve\u013emi nezv\u00fd\u0161i va\u0161e \u0161ance na zabr\u00e1nenie v\u00edrusov\u00e9mu \u00fatoku vo va\u0161ej sieti.<\/p><\/blockquote>\n<p><\/p>\n<h3>Vidite\u013enos\u0165 siete<\/h3>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/blog.gigamon.com\/2017\/11\/01\/what-is-network-visibility\/\">Hlavn\u00e1 my\u0161lienka<\/a><\/noindex> je jednoduch\u00e1 \u2013 \"vidie\u0165\", \u010do sa deje vo va\u0161ej sieti, a to ako v re\u00e1lnom \u010dase, tak aj historick\u00e9 \u00fadaje. <\/p>\n<p>Rozdelil by som t\u00fato \"vidite\u013enos\u0165\" do dvoch skup\u00edn:<\/p>\n<p><b>Prv\u00e1 skupina:<\/b> to, \u010do v\u00e1m obvykle poskytuje v\u00e1\u0161 monitorovac\u00ed syst\u00e9m.<\/p>\n<ul>\n<li>vy\u0165a\u017eenos\u0165 zariadenia<\/li>\n<li>vy\u0165a\u017eenos\u0165 kan\u00e1lov<\/li>\n<li>vyu\u017eitie pam\u00e4te<\/li>\n<li>vyu\u017eitie diskov<\/li>\n<li>zmena smerovacej tabu\u013eky <\/li>\n<li>stav liniek<\/li>\n<li>dostupnos\u0165 zariaden\u00ed (alebo hostite\u013eov)<\/li>\n<li>\u2026<\/li>\n<\/ul>\n<p><b>Druh\u00e1 skupina: <\/b>inform\u00e1cie s\u00favisiace s bezpe\u010dnos\u0165ou.<\/p>\n<ul>\n<li>r\u00f4zne \u0161tatistiky (napr\u00edklad pod\u013ea aplik\u00e1ci\u00ed, pod\u013ea n\u00e1v\u0161tevnosti URL, ak\u00e9 druhy \u00fadajov sa s\u0165ahovali, \u00fadaje o pou\u017e\u00edvate\u013eoch)<\/li>\n<li>\u010do bolo zablokovan\u00e9 bezpe\u010dnostn\u00fdmi politikami a ak\u00fd bol d\u00f4vod, konkr\u00e9tne\n<ul>\n<li>zak\u00e1zan\u00e1 aplik\u00e1cia<\/li>\n<li>zak\u00e1zan\u00e9 na z\u00e1klade ip\/protokolu\/portu\/flagov\/z\u00f3n<\/li>\n<li>prevencia hrozieb<\/li>\n<li>filterovanie URL<\/li>\n<li>filterovanie \u00fadajov<\/li>\n<li>blokovanie s\u00faborov<\/li>\n<li>\u2026<\/li>\n<\/ul>\n<\/li>\n<li>\u0161tatistiky o \u00fatokoch DOS\/DDOS<\/li>\n<li>ne\u00faspe\u0161n\u00e9 pokusy o identifik\u00e1ciu a autentifik\u00e1ciu<\/li>\n<li>\u0161tatistiky o v\u0161etk\u00fdch vy\u0161\u0161ie uveden\u00fdch udalostiach poru\u0161enia bezpe\u010dnostn\u00fdch polit\u00edk<\/li>\n<li>\u2026<\/li>\n<\/ul>\n<p>\nV tejto kapitole, venovanej bezpe\u010dnosti, n\u00e1s zauj\u00edma pr\u00e1ve druh\u00e1 \u010das\u0165.<\/p>\n<p>Niektor\u00e9 modern\u00e9 firewally (z mojej praxe Palo Alto) poskytuj\u00fa dobr\u00fa \u00farove\u0148 vidite\u013enosti. Ale samozrejme, prev\u00e1dzka, ktor\u00e1 v\u00e1s zauj\u00edma, mus\u00ed \u00eds\u0165 cez tento firewall (v takom pr\u00edpade m\u00e1te mo\u017enos\u0165 blokovania prev\u00e1dzky) alebo by\u0165 zrkadlen\u00e1 na firewall (pou\u017e\u00edva sa len na monitorovanie a anal\u00fdzu), a mus\u00edte ma\u0165 licencie, ktor\u00e9 v\u00e1m umo\u017enia zapn\u00fa\u0165 v\u0161etky tieto slu\u017eby.<\/p>\n<p>Existuje, samozrejme, aj alternat\u00edvna cesta, vlastne tradi\u010dn\u00e1 cesta, napr\u00edklad,<\/p>\n<ul>\n<li>\u0161tatistiky o rel\u00e1ci\u00e1ch sa daj\u00fa zhroma\u017e\u010fova\u0165 cez netflow a potom pou\u017ei\u0165 \u0161peci\u00e1lne n\u00e1stroje na anal\u00fdzu inform\u00e1ci\u00ed a vizualiz\u00e1ciu \u00fadajov.<\/li>\n<li>prevencia hrozieb \u2013 \u0161peci\u00e1lne programy (anti-virus, anti-spyware, firewall) na koncov\u00fdch hostoch.<\/li>\n<li>Filtr\u00e1cia URL, filtr\u00e1cia d\u00e1t, blokovanie s\u00faborov \u2013 na proxy<\/li>\n<li>rovnako je mo\u017en\u00e9 analyzova\u0165 tcpdump napr\u00edklad pomocou <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/cisco\/blog\/268207\/\">snort<\/a><\/noindex><\/li>\n<\/ul>\n<p>\nTieto dva pr\u00edstupy je mo\u017en\u00e9 skombinova\u0165, doplni\u0165 ch\u00fdbaj\u00face funkcie alebo ich duplici\u0165 na zv\u00fd\u0161enie pravdepodobnosti detekcie \u00fatoku.<\/p>\n<p>Ak\u00fd pr\u00edstup zvoli\u0165?<br \/>\nSilne z\u00e1vis\u00ed od kvalifik\u00e1cie a preferenci\u00ed v\u00e1\u0161ho t\u00edmu.<br \/>\nVo oboch pr\u00edstupoch s\u00fa v\u00fdhody a nev\u00fdhody.<\/p>\n<h3>Jednotn\u00fd centralizovan\u00fd syst\u00e9m autentifik\u00e1cie a autoriz\u00e1cie<br \/>\n<\/h3>\n<p>\nPri dobr\u00e9m dizajne mobilita, o ktorej sme hovorili v tomto \u010dl\u00e1nku, predpoklad\u00e1, \u017ee m\u00e1te rovnak\u00e9 pr\u00edstupy, pracuj\u00fac z kancel\u00e1rie, doma, z letiska, z kaviarne alebo z akejko\u013evek inej lokality (s obmedzeniami, ktor\u00e9 sme predt\u00fdm prediskutovali). Zdalo by sa, \u017ee ak\u00fd je probl\u00e9m? <br \/>\nAby sme lep\u0161ie pochopili zlo\u017eitosti tejto \u00falohy, pozrime sa na typick\u00fd dizajn.<\/p>\n<blockquote><p><b>Pr\u00edklad<\/b><\/p>\n<ul>\n<li>Rozdelili ste v\u0161etk\u00fdch zamestnancov do skup\u00edn. Rozhodli ste sa poskytova\u0165 pr\u00edstupy pod\u013ea skup\u00edn<\/li>\n<li>V r\u00e1mci kancel\u00e1rie kontrolujete pr\u00edstupy na kancel\u00e1rskom firewallu<\/li>\n<li>Prev\u00e1dzku z kancel\u00e1rie do d\u00e1tov\u00e9ho centra kontrolujete na firewalle d\u00e1tov\u00e9ho centra<\/li>\n<li>Ako VPN br\u00e1nu pou\u017e\u00edvate Cisco ASA a na kontrolu prev\u00e1dzky prich\u00e1dzaj\u00facej do va\u0161ej siete od pridelen\u00fdch klientov pou\u017e\u00edvate lok\u00e1lne (na ASA) ACL<\/li>\n<\/ul>\n<p>\nTeraz predpokladajme, \u017ee v\u00e1s po\u017eiadaj\u00fa o pr\u00eddavn\u00fd pr\u00edstup pre konkr\u00e9tneho zamestnanca. Pri tom v\u00e1s \u017eiadaj\u00fa o pridanie pr\u00edstupu iba jemu a nikomu in\u00e9mu z jeho skupiny.<\/p>\n<p>Aby sme to dosiahli, mus\u00edme vytvori\u0165 samostatn\u00fa skupinu pre tohto zamestnanca, teda<\/p>\n<ul>\n<li>na ASA vytvori\u0165 samostatn\u00fd IP pool pre tohto zamestnanca<\/li>\n<li>prida\u0165 nov\u00fa ACL na ASA a priradi\u0165 ju tomuto vzdialen\u00e9mu klientovi<\/li>\n<li>vytvori\u0165 nov\u00e9 bezpe\u010dnostn\u00e9 politiky na kancel\u00e1rskom a d\u00e1tovom center firewalle<\/li>\n<\/ul>\n<p>\nJe to v poriadku, ak ide o zriedkav\u00fa udalos\u0165. Ale v mojej praxi bola situ\u00e1cia, ke\u010f zamestnanci sa zap\u00e1jali do r\u00f4znych projektov a t\u00e1to \u0161k\u00e1la projektov sa pre niektor\u00fdch z nich menila pomerne \u010dasto, a nebolo to len 1-2 osoby, ale desa\u0165. Samozrejme, tu bolo potrebn\u00e9 nie\u010do zmeni\u0165.<\/p>\n<p>Toto bolo vyrie\u0161en\u00e9 nasleduj\u00facim sp\u00f4sobom.<\/p>\n<p>Rozhodli sme sa, \u017ee jedin\u00fdm zdrojom pravdy, ktor\u00fd ur\u010d\u00ed v\u0161etky mo\u017en\u00e9 pr\u00edstupy zamestnanca, bude LDAP. Vytvorili sme v\u0161etky mo\u017en\u00e9 skupiny, ktor\u00e9 ur\u010duj\u00fa sady pr\u00edstupov a ka\u017ed\u00e9ho u\u017e\u00edvate\u013ea sme prira\u010fovali k jednej alebo viacer\u00fdm skupin\u00e1m. <\/p>\n<p>Tak\u017ee, napr\u00edklad, predpokladajme, \u017ee existovali skupiny <\/p>\n<ul>\n<li>hostia (pr\u00edstup na internet)<\/li>\n<li>be\u017en\u00fd pr\u00edstup (pr\u00edstupy k spolo\u010dn\u00fdm zdrojom: e-mail, znalostn\u00e1 b\u00e1za, \u2026)<\/li>\n<li>\u00fa\u010detnictvo<\/li>\n<li>projekt 1<\/li>\n<li>projekt 2<\/li>\n<li>spr\u00e1vca datab\u00e1zy<\/li>\n<li>spr\u00e1vca syst\u00e9mu Linux<\/li>\n<li>\u2026<\/li>\n<\/ul>\n<p>\nA ak bol niekto z pracovn\u00edkov zapojen\u00fd do projektu 1 aj do projektu 2 a potreboval pr\u00edstupy potrebn\u00e9 na pr\u00e1cu v t\u00fdchto projektoch, bol tento pracovn\u00edk priraden\u00fd k zodpovedaj\u00facim skupin\u00e1m:<\/p>\n<ul>\n<li>n\u00e1v\u0161tevn\u00edk <\/li>\n<li>be\u017en\u00fd pr\u00edstup<\/li>\n<li>projekt 1<\/li>\n<li>projekt 2<\/li>\n<\/ul>\n<p>\nAko premeni\u0165 tieto inform\u00e1cie na pr\u00edstupy v sie\u0165ovom vybaven\u00ed? <\/p>\n<p>Cisco ASA Dynamic Access Policy (DAP) (pozri <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/support\/docs\/security\/asa-5500-x-series-next-generation-firewalls\/108000-dap-deploy-guide.html\">www.cisco.com\/c\/en\/us\/support\/docs\/security\/asa-5500-x-series-next-generation-firewalls\/108000-dap-deploy-guide.html<\/a><\/noindex>) rie\u0161enie je presne pre t\u00fato \u00falohu.<\/p>\n<p>Stru\u010dne povedan\u00e9, pri identifik\u00e1cii\/autentifik\u00e1cii ASA z\u00edskava z LDAP s\u00fabor skup\u00edn, ktor\u00e9 zodpovedaj\u00fa dan\u00e9mu u\u017e\u00edvate\u013eovi a \"zhroma\u017e\u010fuje\" z nieko\u013ek\u00fdch lok\u00e1lnych ACL (ka\u017ed\u00fd zodpoved\u00e1 skupine) dynamick\u00fd ACL so v\u0161etk\u00fdmi potrebn\u00fdmi pr\u00edstupmi, \u010do plne vyhovuje na\u0161im po\u017eiadavk\u00e1m.<\/p>\n<p>Ale to je iba pre pripojenia VPN. Aby bola situ\u00e1cia rovnak\u00e1 pre pracovn\u00edkov pripojen\u00fdch cez VPN aj pre t\u00fdch, ktor\u00ed s\u00fa v kancel\u00e1rii, bol vykonan\u00fd nasleduj\u00faci krok. <\/p>\n<p>Pri pripojen\u00ed z kancel\u00e1rie sa pou\u017e\u00edvatelia pomocou protokolu 802.1x dostali bu\u010f do hos\u0165ovsk\u00e9ho VLAN (pre host\u00ed), alebo do VLAN s be\u017en\u00fdmi pr\u00edstupmi (pre zamestnancov spolo\u010dnosti). Potom, pre z\u00edskanie \u0161pecifick\u00fdch pr\u00edstupov (napr\u00edklad k projektom v d\u00e1tovom centre) sa museli zamestnanci pripoji\u0165 cez VPN.<\/p>\n<p>Na pripojenie z kancel\u00e1rie a z domu sa pou\u017e\u00edvali r\u00f4zne tunelov\u00e9 skupiny na ASA. Je to potrebn\u00e9 na to, aby pripojenia z kancel\u00e1rie smerovali na spolo\u010dn\u00e9 zdroje (pou\u017e\u00edvan\u00e9 v\u0161etk\u00fdmi zamestnancami, ako s\u00fa e-mail, s\u00faborov\u00e9 servery, syst\u00e9m tiketov, DNS, ...) nie cez ASA, ale cez lok\u00e1lnu sie\u0165. T\u00fdmto sp\u00f4sobom sme neza\u0165a\u017eovali ASA nadbyto\u010dn\u00fdm prenosom, vr\u00e1tane vysoko intenz\u00edvneho.<\/p>\n<p>T\u00fdmto sp\u00f4sobom bola \u00faloha vyrie\u0161en\u00e1. <br \/>\nZ\u00edskali sme <\/p>\n<ul>\n<li>rovnak\u00fd s\u00fabor pr\u00edstupov, ako pre pripojenia z kancel\u00e1rie, tak aj pre vzdialen\u00e9 pripojenie<\/li>\n<li>absenciu degrad\u00e1cie slu\u017eby pri pr\u00e1ci z kancel\u00e1rie, s\u00favisiacej s prenosom vysokoin\u00adtenz\u00edvneho prenosu cez ASA<\/li>\n<\/ul>\n<p>\nAk\u00e1 je \u010fal\u0161ia v\u00fdhoda tohoto pr\u00edstupu?<br \/>\nV administr\u00e1cii pr\u00edstupov. Pr\u00edstupy sa \u013eahko menia, na jednom mieste.<br \/>\nNapr\u00edklad, ak zamestnanec opustil spolo\u010dnos\u0165, jednoducho ho odstr\u00e1nite z LDAP a automaticky strat\u00ed v\u0161etky pr\u00edstupy.\n<\/p><\/blockquote>\n<p><\/p>\n<h3>Kontrola hostite\u013ea (host checking)<\/h3>\n<p>\nPri mo\u017enosti dia\u013ekov\u00e9ho pripojenia sa n\u00e1m zvy\u0161uje riziko, \u017ee do siete sa dostane nielen zamestnanec spolo\u010dnosti, ale aj cel\u00fd \u0161kodliv\u00fd softv\u00e9r, ktor\u00fd m\u00f4\u017ee by\u0165 pr\u00edtomn\u00fd na jeho po\u010d\u00edta\u010di (napr\u00edklad na dom\u00e1com) a navy\u0161e, prostredn\u00edctvom tohto softv\u00e9ru, m\u00f4\u017eeme otvori\u0165 pr\u00edstup do na\u0161ej siete \u00fato\u010dn\u00edkovi, ktor\u00fd vyu\u017e\u00edva tento hostite\u013e ako proxy.<\/p>\n<p>Je rozumn\u00e9 pre hostite\u013ea pripojen\u00e9ho dia\u013ekovo uplatni\u0165 tie ist\u00e9 bezpe\u010dnostn\u00e9 po\u017eiadavky, ako pre hostite\u013ea nach\u00e1dzaj\u00faceho sa v kancel\u00e1rii.<\/p>\n<p>To zah\u0155\u0148a aj \"spr\u00e1vnu\" verziu opera\u010dn\u00e9ho syst\u00e9mu, anti-v\u00edrus, anti-spyware a firewall softv\u00e9r a aktualiz\u00e1cie. Zvy\u010dajne je t\u00e1to mo\u017enos\u0165 dostupn\u00e1 na VPN br\u00e1ne (pre ASA pozri, napr\u00edklad, <noindex><a rel=\"nofollow\" href=\"https:\/\/community.cisco.com\/t5\/security-documents\/how-to-configure-anyconnect-host-scan\/ta-p\/3118732\">tu<\/a><\/noindex>).<\/p>\n<p>Je tie\u017e rozumn\u00e9 aplikova\u0165 tie ist\u00e9 met\u00f3dy anal\u00fdzy a blokovania prev\u00e1dzky (pozri \"Vysok\u00fa \u00farove\u0148 ochrany\"), ktor\u00e9 s\u00fa v s\u00falade s va\u0161ou bezpe\u010dnostnou politikou aplikovan\u00e9 na kancel\u00e1rsku prev\u00e1dzku. <\/p>\n<p>Je rozumn\u00e9 vych\u00e1dza\u0165 z predpokladu, \u017ee teraz va\u0161a kancel\u00e1rska sie\u0165 nie je obmedzen\u00e1 na kancel\u00e1rsku budovu a hostite\u013eov, ktor\u00ed sa v nej nach\u00e1dzaj\u00fa.<\/p>\n<blockquote><p><b>Pr\u00edklad<\/b><\/p>\n<p>Dobr\u00fd pr\u00edstup je vybavi\u0165 ka\u017ed\u00e9ho zamestnanca, ktor\u00fd potrebuje dia\u013ekov\u00fd pr\u00edstup, dobr\u00fdm, pohodln\u00fdm notebookom a vy\u017eadova\u0165 pracova\u0165, ako v kancel\u00e1rii, tak aj z domu, len s n\u00edm.<\/p>\n<p>To nielen zvy\u0161uje \u00farove\u0148 bezpe\u010dnosti va\u0161ej siete, ale je to aj naozaj pohodln\u00e9 a zamestnanci to zvy\u010dajne vn\u00edmaj\u00fa pozit\u00edvne (ak je to naozaj dobr\u00fd a pohodln\u00fd notebook).<\/p><\/blockquote>\n<p><\/p>\n<h2>O pocite miery a rovnov\u00e1he<\/h2>\n<p>\nV z\u00e1sade ide o rozhovor o tretej vrchole n\u00e1\u0161ho trojuholn\u00edka \u2014 o cene.<br \/>\nPo\u010fme si uvies\u0165 hypotetick\u00fd pr\u00edklad.<\/p>\n<blockquote><p><b>Pr\u00edklad<\/b><\/p>\n<p>M\u00e1te kancel\u00e1riu pre 200 \u013eud\u00ed. Rozhodli ste sa, \u017ee ju sprav\u00edte maxim\u00e1lne pohodlnou a maxim\u00e1lne bezpe\u010dnou.<\/p>\n<p>Preto ste sa rozhodli, \u017ee v\u0161etku prev\u00e1dzku budete p\u00fa\u0161\u0165a\u0165 cez firewall a t\u00fdm p\u00e1dom pre v\u0161etky podsiete kancel\u00e1rie je firewall predvolen\u00e9 br\u00e1na. Okrem bezpe\u010dnostn\u00e9ho softv\u00e9ru nain\u0161talovan\u00e9ho na ka\u017edom koncovom hostite\u013eovi (anti-v\u00edrus, anti-spyware a firewall softv\u00e9r), ste sa tie\u017e rozhodli uplatni\u0165 v\u0161etky mo\u017en\u00e9 met\u00f3dy ochrany na firewalle.<\/p>\n<p>Pre zabezpe\u010denie vysokej r\u00fdchlosti pripojenia (v\u0161etko pre pohodlie) ste si ako pr\u00edstupov\u00e9 prep\u00edna\u010de vybrali prep\u00edna\u010de s 10-gigabitov\u00fdmi pr\u00edstupov\u00fdmi portami, ako firewall-y \u2014 vysoko v\u00fdkonn\u00e9 NGFW firewally, napr\u00edklad Palo Alto s\u00e9rie 7K (s 40-gigabitov\u00fdmi portami), samozrejme so v\u0161etk\u00fdmi zapnut\u00fdmi licenciami a, samozrejme, High Availability p\u00e1r.<\/p>\n<p>Samozrejme, na pr\u00e1cu s touto l\u00edniou zariaden\u00ed potrebujeme aspo\u0148 nieko\u013ek\u00fdch vysoko kvalifikovan\u00fdch bezpe\u010dnostn\u00fdch in\u017einierov.<\/p>\n<p>Ka\u017ed\u00e9mu zamestnancovi ste sa rozhodli poskytn\u00fa\u0165 dobr\u00fd laptop.<\/p>\n<p>Celkovo to predstavuje pribli\u017ene 10 mili\u00f3nov dol\u00e1rov na implement\u00e1ciu, stovky tis\u00edc dol\u00e1rov (mysl\u00edm, \u017ee bli\u017e\u0161ie k mili\u00f3nu) na ro\u010dn\u00fa podporu a mzdy in\u017einierov.<\/p>\n<p>Kancel\u00e1ria, 200 \u013eud\u00ed\u2026<br \/>\nJe to pohodln\u00e9? Ur\u010dite, \u00e1no. <\/p>\n<p>Prich\u00e1dzate s t\u00fdmto n\u00e1vrhom k v\u00e1\u0161mu vedeniu\u2026<br \/>\nMo\u017eno na svete existuje nejak\u00e9 mno\u017estvo spolo\u010dnost\u00ed, pre ktor\u00e9 je to prijate\u013en\u00e9 a spr\u00e1vne rie\u0161enie. Ak ste zamestnancom tejto spolo\u010dnosti \u2014 gratulujem, ale vo v\u00e4\u010d\u0161ine pr\u00edpadov som si ist\u00fd, \u017ee va\u0161e zru\u010dnosti nebud\u00fa ocenen\u00e9 veden\u00edm.<\/p><\/blockquote>\n<p>\nJe tento pr\u00edklad prehnan\u00fd? Nasleduj\u00faca kapitola d\u00e1 odpove\u010f na t\u00fato ot\u00e1zku.<\/p>\n<p>Ak vo va\u0161ej sieti nevid\u00edte nie\u010do z vy\u0161\u0161ie uveden\u00e9ho, tak je to norm\u00e1lne.<br \/>\nPre ka\u017ed\u00fd konkr\u00e9tny pr\u00edpad mus\u00edte n\u00e1js\u0165 rozumn\u00fd kompromis medzi pohodl\u00edm, cenou a bezpe\u010dnos\u0165ou. \u010casto ani nie je potrebn\u00e9 ma\u0165 NGFW vo va\u0161ej kancel\u00e1rii, ani L7 ochranu na firewalle. Sta\u010d\u00ed zabezpe\u010di\u0165 dobr\u00fa \u00farove\u0148 visibility a notifik\u00e1ci\u00ed, a to m\u00f4\u017ee by\u0165 dosiahnut\u00e9 pomocou open source produktov, napr\u00edklad. \u00c1no, va\u0161a reakcia na \u00fatok nebude okam\u017eit\u00e1, ale d\u00f4le\u017eit\u00e9 je, \u017ee ho uvid\u00edte, a pri spr\u00e1vnych procesoch vo va\u0161om oddelen\u00ed ho dok\u00e1\u017eete r\u00fdchlo neutralizova\u0165.<\/p>\n<p>A pripom\u00ednam, \u017ee v zam\u00fd\u0161\u013eanom cykle t\u00fdchto \u010dl\u00e1nkov sa nezap\u00e1jate do projektovania siete, len sa sna\u017e\u00edte zlep\u0161i\u0165 to, \u010do ste dostali.<\/p>\n<h2>Anal\u00fdza SAFE architekt\u00fary kancel\u00e1rie<\/h2>\n<p>\nV\u0161imnite si tento \u010derven\u00fd \u0161tvorec, ktor\u00fdm som vyzna\u010dil miesto na sch\u00e9me z <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/dam\/en\/us\/solutions\/collateral\/enterprise\/design-zone-security\/safe-architecture-guide-secure-campus.pdf\">SAFE Secure Campus Architecture Guide<\/a><\/noindex>, ktor\u00e9 by som tu chcel prediskutova\u0165.<\/p>\n<p><img decoding=\"async\" alt=\"Ako z\u00edska\u0165 kontrolu nad sie\u0165ovou infra\u0161trukt\u00farou. Kapitola tretia. Sie\u0165ov\u00e1 bezpe\u010dnos\u0165. \u010cas\u0165 tretia\" src=\"\/wp-content\/uploads\/2019\/04\/617b6561b6ebb17d4f015251abcadf9b.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJe to jedno z k\u013e\u00fa\u010dov\u00fdch miest architekt\u00fary a jedna z najd\u00f4le\u017eitej\u0161\u00edch nejasnost\u00ed.<\/p>\n<blockquote><p><b>Pozn\u00e1mka<\/b><\/p>\n<p>Nikdy som nenastavoval a nerobil s FirePower (z l\u00ednie firewallov Cisco \u2014 len s ASA), preto ho budem pova\u017eova\u0165 za ak\u00fdko\u013evek in\u00fd firewall, napr\u00edklad ako Juniper SRX alebo Palo Alto, predpokladaj\u00fac, \u017ee m\u00e1 tie ist\u00e9 mo\u017enosti.<\/p><\/blockquote>\n<p>\nZ be\u017en\u00fdch konfigur\u00e1ci\u00ed vid\u00edm len 4 mo\u017en\u00e9 varianty pou\u017eitia firewallu pri takomto pripojen\u00ed:<\/p>\n<ul>\n<li>predvolen\u00e9 br\u00e1ny pre ka\u017ed\u00fa podsiet s\u00fa prep\u00edna\u010de, pri\u010dom firewall je v transparentnom re\u017eime (to znamen\u00e1, \u017ee cel\u00fd prenos ide cez neho, ale nevytv\u00e1ra L3 skok)<\/li>\n<li>Predvolen\u00fd br\u00e1na pre ka\u017ed\u00fa podsie\u0165 s\u00fa sub-rozhrania firewallu (alebo SVI rozhrania), prep\u00edna\u010d hr\u00e1 \u00falohu L2<\/li>\n<li>Na prep\u00edna\u010di sa pou\u017e\u00edvaj\u00fa r\u00f4zne VRF a prev\u00e1dzka medzi VRF prech\u00e1dza cez firewall, zatia\u013e \u010do prev\u00e1dzka v r\u00e1mci jedn\u00e9ho VRF je kontrolovan\u00e1 ACL na prep\u00edna\u010di<\/li>\n<li>Cel\u00e1 prev\u00e1dzka sa zrkadl\u00ed na firewallu na anal\u00fdzu a monitorovanie, prev\u00e1dzka cez neho nejde<\/li>\n<\/ul>\n<p><\/p>\n<blockquote><p><b>Pozn\u00e1mka 1<\/b><\/p>\n<p>Mo\u017en\u00e9 s\u00fa kombin\u00e1cie t\u00fdchto mo\u017enost\u00ed, ale pre jednoduchos\u0165 ich nebudeme zva\u017eova\u0165.<\/p><\/blockquote>\n<blockquote><p><b>Pozn\u00e1mka 2<\/b><\/p>\n<p>E\u0161te je mo\u017enos\u0165 vyu\u017eitia PBR (architekt\u00fara service chain), ale zatia\u013e je to, hoci to pova\u017eujem za vizu\u00e1lne atrakt\u00edvne rie\u0161enie, sk\u00f4r exotika, tak\u017ee sa n\u00edm tu nezaober\u00e1m.<\/p><\/blockquote>\n<p>\nZ opisu tokov v dokumente vid\u00edme, \u017ee prev\u00e1dzka prech\u00e1dza cez firewall, to znamen\u00e1, \u017ee pod\u013ea designu Cisco vypad\u00e1va \u0161tvrt\u00e1 mo\u017enos\u0165.<\/p>\n<p>Po\u010fme najprv presk\u00fama\u0165 prv\u00e9 dve mo\u017enosti.<br \/>\nPri t\u00fdchto mo\u017enostiach prech\u00e1dza cel\u00e1 prev\u00e1dzka cez firewall.<\/p>\n<p>Teraz sa pozrime <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/products\/collateral\/security\/firepower-ngfw\/data_sheet-c78-736661.html\">technick\u00fdm listom<\/a><\/noindex>, pozrime <noindex><a rel=\"nofollow\" href=\"https:\/\/itprice.com\">Cisco GPL<\/a><\/noindex> a vid\u00edme, \u017ee ak chceme dosiahnu\u0165 celkov\u00fa priepustnos\u0165 pre na\u0161u kancel\u00e1riu aspo\u0148 okolo 10 - 20 gigabitov, mus\u00edme zak\u00fapi\u0165 verziu 4K.<\/p>\n<blockquote><p><b>Pozn\u00e1mka<\/b><\/p>\n<p>Ke\u010f hovor\u00edm o celkovej priepustnosti, m\u00e1m na mysli prev\u00e1dzku medzi podsie\u0165ami (a nie v r\u00e1mci jedn\u00e9ho VLANu).<\/p><\/blockquote>\n<p>\nZ GPL vid\u00edme, \u017ee cena za HA Bundle s Threat Defense sa l\u00ed\u0161i v z\u00e1vislosti od modelu (4110 - 4150) a pohybuje sa od ~0,5 - 2,5 mili\u00f3na dol\u00e1rov.<\/p>\n<p>To znamen\u00e1, \u017ee n\u00e1\u0161 dizajn za\u010d\u00edna pripom\u00edna\u0165 predch\u00e1dzaj\u00faci pr\u00edklad.<\/p>\n<p>Znamen\u00e1 to, \u017ee tento dizajn je nespr\u00e1vny?<br \/>\nNie, nie je. Cisco v\u00e1m poskytuje maxim\u00e1lnu mo\u017en\u00fa ochranu na z\u00e1klade produktovej l\u00ednie, ktor\u00fa m\u00e1. Ale to neznamen\u00e1, \u017ee je to pre v\u00e1s 'must-do'. <\/p>\n<p>V podstate je to be\u017en\u00e1 ot\u00e1zka, ktor\u00e1 sa vyskytuje pri n\u00e1vrhu kancel\u00e1rie alebo d\u00e1tov\u00e9ho centra, a znamen\u00e1 to len, \u017ee je potrebn\u00e9 h\u013eada\u0165 kompromis. <\/p>\n<p>Napr\u00edklad nemus\u00edte p\u00fa\u0161\u0165a\u0165 v\u0161etku prev\u00e1dzku cez firewall, a v tomto pr\u00edpade sa mi tretia mo\u017enos\u0165 zd\u00e1 celkom atrakt\u00edvna, alebo (pozri predch\u00e1dzaj\u00facu sekciu), mo\u017eno nepotrebujete 'Threat Defense' alebo dokonca nepotrebujete firewall v tomto segmente siete, a sta\u010d\u00ed v\u00e1m pas\u00edvny monitoring s pou\u017eit\u00edm platen\u00fdch (nie drah\u00fdch) alebo open source rie\u0161en\u00ed, alebo firewall potrebujete, ale od in\u00e9ho dod\u00e1vate\u013ea.<\/p>\n<p>Zvy\u010dajne je tu v\u017edy t\u00e1to neistota a nie je jednozna\u010dn\u00e1 odpove\u010f na to, ak\u00e9 rie\u0161enie je pre v\u00e1s najlep\u0161ie.<br \/>\nV tom spo\u010d\u00edva zlo\u017eitosti a kr\u00e1sa tejto \u00falohy.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/447610\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u044f\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb. \u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0441\u0442\u0430\u0442\u0435\u0439 \u0446\u0438\u043a\u043b\u0430 \u0438 \u0441\u0441\u044b\u043b\u043a\u0438 \u043c\u043e\u0436\u043d\u043e \u043d\u0430\u0439\u0442\u0438 \u0437\u0434\u0435\u0441\u044c. \u042d\u0442\u0430 \u0447\u0430\u0441\u0442\u044c \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u0441\u0432\u044f\u0449\u0435\u043d\u0430 Campus (Office) &amp; Remote access VPN \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0430\u043c. \u041c\u043e\u0436\u0435\u0442 \u043f\u043e\u043a\u0430\u0437\u0430\u0442\u044c\u0441\u044f, \u0447\u0442\u043e \u0434\u0438\u0437\u0430\u0439\u043d \u043e\u0444\u0438\u0441\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u2013 \u044d\u0442\u043e \u043f\u0440\u043e\u0441\u0442\u043e. \u0414\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e, \u0431\u0435\u0440\u0435\u043c L2\/L3 \u043a\u043e\u043c\u043c\u0443\u0442\u0430\u0442\u043e\u0440\u044b, \u0441\u043e\u0435\u0434\u0438\u043d\u044f\u0435\u043c \u0438\u0445 \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439. \u0414\u0430\u043b\u0435\u0435, \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u043c \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u0430\u0440\u043d\u0443\u044e \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0443 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23359,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31395","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u044f\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u0442\u0440\u0435\u0442\u044c\u044f | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u044f\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:41:01+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:41:01+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Ako prevzia\u0165 kontrolu nad sie\u0165ovou infra\u0161trukt\u00farou. Kapitola tretia. Sie\u0165ov\u00e1 bezpe\u010dnos\u0165. \u010cas\u0165 tretia | ProHoster","description":"Tento \u010dl\u00e1nok je piaty v cykle \u010dl\u00e1nkov \u201eAko prevzia\u0165 kontrolu nad sie\u0165ovou infra\u0161trukt\u00farou\u201c.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c. \u0413\u043b\u0430\u0432\u0430 \u0442\u0440\u0435\u0442\u044c\u044f. \u0421\u0435\u0442\u0435\u0432\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c. \u0427\u0430\u0441\u0442\u044c \u0442\u0440\u0435\u0442\u044c\u044f | ProHoster","og:description":"\u042d\u0442\u0430 \u0441\u0442\u0430\u0442\u044c\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u044f\u0442\u043e\u0439 \u0432 \u0446\u0438\u043a\u043b\u0435 \u0441\u0442\u0430\u0442\u0435\u0439 \u00ab\u041a\u0430\u043a \u0432\u0437\u044f\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u00bb.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/kak-vzyat-setevuyu-infrastrukturu-pod-svoj-kontrol-glava-tretya-setevaya-bezopasnost-chast-tretya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:41:01+00:00","article:modified_time":"2019-10-31T18:41:01+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31395","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 05:58:22","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:17:26","updated":"2026-01-21 05:58:22","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31395","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=31395"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/31395\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/23359"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=31395"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=31395"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=31395"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}