{"id":33885,"date":"2019-10-31T21:55:12","date_gmt":"2019-10-31T18:55:12","guid":{"rendered":"https:\/\/prohoster.info\/blog\/tak-chto-zhe-budet-s-autentifikatsiej-i-parolyami-vtoraya-chast-otcheta-javelin-sostoyanie-strogoj-autentifikatsii\/"},"modified":"2019-10-31T21:55:12","modified_gmt":"2019-10-31T18:55:12","slug":"tak-chto-zhe-budet-s-autentifikatsiej-i-parolyami-vtoraya-chast-otcheta-javelin-sostoyanie-strogoj-autentifikatsii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/tak-chto-zhe-budet-s-autentifikatsiej-i-parolyami-vtoraya-chast-otcheta-javelin-sostoyanie-strogoj-autentifikatsii","title":{"rendered":"\u010co sa teda stane s autentifik\u00e1ciou a heslami? Druh\u00e1 \u010das\u0165 spr\u00e1vy Javelin \u201eStav pr\u00edsnej autentifik\u00e1cie\u201c","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"\u010co
\n
\nNed\u00e1vno v\u00fdskumn\u00e1 spolo\u010dnos\u0165 \u00abJavelin Strategy & Research\u00bb zverejnila spr\u00e1vu \u00abThe State of Strong Authentication 2019\u00bb. Jej autori zhroma\u017edili inform\u00e1cie o tom, ak\u00e9 met\u00f3dy autentifik\u00e1cie sa pou\u017e\u00edvaj\u00fa v korpor\u00e1tnom prostred\u00ed a pou\u017e\u00edvate\u013esk\u00fdch aplik\u00e1ci\u00e1ch, a tie\u017e urobili zauj\u00edmav\u00e9 zistenia o bud\u00facnosti silnej autentifik\u00e1cie.<\/p>\n

Preklad prvej \u010dasti so z\u00e1vermi autorov spr\u00e1vy sme u\u017e publikovali na Habre<\/a><\/noindex>. A teraz v\u00e1m predstavujeme druh\u00fa \u010das\u0165 \u2014 s \u00fadajmi a grafikami.
\n<\/a><\/noindex>
\nOd prekladate\u013ea<\/b><\/p>\n

Nebudem \u00faplne kop\u00edrova\u0165 cel\u00fd rovnomenn\u00fd blok z prvej \u010dasti, ale jeden odsek predsa len zopakujem.<\/p>\n

V\u0161etky \u010d\u00edsla a fakty s\u00fa uveden\u00e9 bez najmen\u0161\u00edch zmien, a ak s nimi nes\u00fahlas\u00edte, je lep\u0161ie sa h\u00e1da\u0165 nie s prekladate\u013eom, ale s autormi spr\u00e1vy. Moje koment\u00e1re (ktor\u00e9 s\u00fa zarovnan\u00e9 ako cit\u00e1ty a v texte ozna\u010den\u00e9 kurz\u00edvou<\/i>) s\u00fa m\u00f4jmi hodnoteniami a o ka\u017edom z nich budem r\u00e1d diskutova\u0165 (ako aj o kvalite prekladu). <\/p><\/blockquote>\n

<\/p>\n

Pou\u017e\u00edvate\u013esk\u00e1 autentifik\u00e1cia<\/h2>\n

\nOd roku 2017 sa pou\u017e\u00edvanie silnej autentifik\u00e1cie v pou\u017e\u00edvate\u013esk\u00fdch aplik\u00e1ci\u00e1ch prudko zv\u00fd\u0161ilo, predov\u0161etk\u00fdm v\u010faka dostupnosti kryptografick\u00fdch met\u00f3d autentifik\u00e1cie na mobiln\u00fdch zariadeniach, aj ke\u010f len o nie\u010do men\u0161ie percento spolo\u010dnost\u00ed pou\u017e\u00edva siln\u00fa autentifik\u00e1ciu pre internetov\u00e9 aplik\u00e1cie.<\/p>\n

Celkovo sa percento spolo\u010dnost\u00ed, ktor\u00e9 pou\u017e\u00edvaj\u00fa siln\u00fa autentifik\u00e1ciu vo svojom podnikan\u00ed, zv\u00fd\u0161ilo trikr\u00e1t z 5 % v roku 2017 na 16 % v roku 2018 (obr\u00e1zok 3).<\/p>\n

\"\u010co
\nMo\u017enosti vyu\u017eitia silnej autentifik\u00e1cie pre webov\u00e9 aplik\u00e1cie s\u00fa st\u00e1le obmedzen\u00e9 (preto\u017ee len \u00faplne nov\u00e9 verzie niektor\u00fdch prehliada\u010dov podporuj\u00fa interakciu s kryptografick\u00fdmi tokenmi, av\u0161ak tento probl\u00e9m sa rie\u0161i in\u0161talovan\u00edm dodato\u010dn\u00e9ho softv\u00e9ru, ako je Routoken Plugin<\/a><\/noindex><\/i>), preto mnoh\u00e9 spolo\u010dnosti pou\u017e\u00edvaj\u00fa alternat\u00edvne met\u00f3dy online autentifik\u00e1cie, ako s\u00fa aplik\u00e1cie pre mobiln\u00e9 zariadenia, ktor\u00e9 generuj\u00fa jednorazov\u00e9 hesl\u00e1.<\/p>\n

Hardv\u00e9rov\u00e9 kryptografick\u00e9 k\u013e\u00fa\u010de (tu sa m\u00e1 na mysli len sp\u013a\u0148aj\u00face \u0161tandardy FIDO<\/i>), ako s\u00fa tie, ktor\u00e9 pon\u00fakaj\u00fa Google, Feitian, One Span a Yubico, m\u00f4\u017eu by\u0165 pou\u017eit\u00e9 na siln\u00fa autentifik\u00e1ciu bez in\u0161tal\u00e1cie dodato\u010dn\u00e9ho softv\u00e9ru na stoln\u00fdch po\u010d\u00edta\u010doch a prenosn\u00fdch po\u010d\u00edta\u010doch (preto\u017ee v\u00e4\u010d\u0161ina prehliada\u010dov u\u017e podporuje \u0161tandard WebAuthn od FIDO<\/i>), ale len 3 % spolo\u010dnost\u00ed vyu\u017e\u00edva t\u00fato mo\u017enos\u0165 na prihl\u00e1senie svojich pou\u017e\u00edvate\u013eov.<\/p>\n

Porovnanie kryptografick\u00fdch tokenov (ako napr\u00edklad RUTOKEN ECDSA PKI<\/a><\/noindex>) a tajn\u00fdch k\u013e\u00fa\u010dov pracuj\u00facich pod\u013ea \u0161tandardov FIDO presahuje nielen r\u00e1mec tejto spr\u00e1vy, ale aj moje koment\u00e1re k nej. Ak to m\u00e1m zhrn\u00fa\u0165, oba typy tokenov pou\u017e\u00edvaj\u00fa podobn\u00e9 algoritmy a princ\u00edpy fungovania. Tokeny FIDO s\u00fa v s\u00fa\u010dasnosti lep\u0161ie podporovan\u00e9 v\u00fdrobcami prehliada\u010dov, pri\u010dom situ\u00e1cia sa \u010doskoro zmen\u00ed, ke\u010f \u010doraz viac prehliada\u010dov za\u010dne podporova\u0165 Web USB API<\/a><\/noindex>. Zato klasick\u00e9 kryptografick\u00e9 tokeny s\u00fa chr\u00e1nen\u00e9 PIN k\u00f3dom, m\u00f4\u017eu podpisova\u0165 elektronick\u00e9 dokumenty a pou\u017e\u00edva\u0165 sa na dvojfaktorov\u00fa autentifik\u00e1ciu vo Windows (ak\u00e1ko\u013evek verzia), Linuxe a Mac OS X. Maj\u00fa API pre r\u00f4zne programovacie jazyky, ktor\u00e9 umo\u017e\u0148uje implementova\u0165 2FA a ECD v desktopov\u00fdch, mobiln\u00fdch a webov\u00fdch aplik\u00e1ci\u00e1ch, pri\u010dom tokeny vyroben\u00e9 v Rusku podporuj\u00fa rusk\u00e9 algoritmy GOST. V ka\u017edom pr\u00edpade, kryptografick\u00fd token, bez oh\u013eadu na to, pod\u013ea ak\u00e9ho \u0161tandardu bol vytvoren\u00fd, je najspo\u013eahlivej\u0161ou a najpohodlnej\u0161ou met\u00f3dou autentifik\u00e1cie.<\/p><\/blockquote>\n

\n\"\u010co
\n\"\u010co
\n\"\u010co<\/p>\n

Okrem bezpe\u010dnosti: \u010fal\u0161ie v\u00fdhody pr\u00edsnej autentifik\u00e1cie<\/h3>\n

\nNie je prekvapen\u00edm, \u017ee uplatnenie pr\u00edsnej autentifik\u00e1cie \u00fazko s\u00favis\u00ed s d\u00f4le\u017eitos\u0165ou \u00fadajov, ktor\u00e9 s\u00fa v podnikoch ulo\u017een\u00e9. S najvy\u0161\u0161\u00edm pr\u00e1vnym a regula\u010dn\u00fdm tlakom sa stret\u00e1vaj\u00fa spolo\u010dnosti, ktor\u00e9 uchov\u00e1vaj\u00fa d\u00f4vern\u00e9 osobn\u00e9 \u00fadaje (Personally Identifiable Information \u2013 PII), ako s\u00fa \u010d\u00edsla soci\u00e1lneho zabezpe\u010denia alebo osobn\u00e9 zdravotn\u00e9 inform\u00e1cie (Personal Health Information \u2013 PHI). Pr\u00e1ve tak\u00e9to spolo\u010dnosti s\u00fa najagres\u00edvnej\u0161\u00edmi z\u00e1stancami pr\u00edsnej autentifik\u00e1cie. Tlak na podniky sa zvy\u0161uje o\u010dak\u00e1vaniami z\u00e1kazn\u00edkov, ktor\u00ed chc\u00fa vedie\u0165, \u017ee organiz\u00e1cie, ktor\u00fdm d\u00f4veruj\u00fa svoje najd\u00f4vernej\u0161ie \u00fadaje, pou\u017e\u00edvaj\u00fa spo\u013eahliv\u00e9 met\u00f3dy autentifik\u00e1cie. Organiz\u00e1cie, ktor\u00e9 spracov\u00e1vaj\u00fa citliv\u00e9 PII alebo PHI, pou\u017e\u00edvaj\u00fa pr\u00edsnu autentifik\u00e1ciu viac ako dvakr\u00e1t \u010dastej\u0161ie ako organiz\u00e1cie, ktor\u00e9 uchov\u00e1vaj\u00fa iba kontaktn\u00e9 inform\u00e1cie pou\u017e\u00edvate\u013eov (obr\u00e1zok 7).<\/p>\n

\"\u010co
\n
\nNapokon firmy zatia\u013e nechc\u00fa zav\u00e1dza\u0165 spo\u013eahliv\u00e9 met\u00f3dy autentifik\u00e1cie. Takmer tretina rozhoduj\u00facich os\u00f4b v podnikan\u00ed pova\u017euje hesl\u00e1 za najefekt\u00edvnej\u0161iu met\u00f3du autentifik\u00e1cie zo v\u0161etk\u00fdch uveden\u00fdch na obr\u00e1zku 9, pri\u010dom 43 % pova\u017euje hesl\u00e1 za najjednoduch\u0161iu met\u00f3du autentifik\u00e1cie.<\/p>\n

\"\u010co
\n<\/p>\n

Tento diagram n\u00e1m dokazuje, \u017ee v\u00fdvoj\u00e1ri podnikov\u00fdch aplik\u00e1ci\u00ed po celom svete s\u00fa si podobn\u00ed... Nevidia profit v implement\u00e1cii pokro\u010dil\u00fdch mechanizmov ochrany pr\u00edstupu k \u00fa\u010dtom a zdie\u013eaj\u00fa rovnak\u00e9 omyly. Iba opatrenia regul\u00e1torov m\u00f4\u017eu zmeni\u0165 situ\u00e1ciu. <\/p>\n

Nech\u00e1me von z hry hesl\u00e1. Ale v \u010do sa treba veri\u0165, aby sme pova\u017eovali, \u017ee kontroln\u00e9 ot\u00e1zky s\u00fa bezpe\u010dnej\u0161ie ne\u017e kryptografick\u00e9 tokeny? Efektivita kontroln\u00fdch ot\u00e1zok, ktor\u00e9 s\u00fa jednoducho uh\u00e1dnute\u013en\u00e9, bola odhadnut\u00e1 na 15 %, zatia\u013e \u010do nezlomenite\u013en\u00e9 tokeny iba na 10. Aspo\u0148 si pozrite film \u201eIl\u00fazia podvodu\u201c, tam s\u00edce v alegorickej forme, ale ukazuje sa, ako \u013eahko iluzionisti vymanili od podvodn\u00edka v\u0161etky potrebn\u00e9 odpovede a nechali ho bez pe\u0148az\u00ed.<\/p>\n

A jeden fakt, ktor\u00fd ve\u013ea hovor\u00ed o kvalifik\u00e1cii t\u00fdch, ktor\u00ed zodpovedaj\u00fa za bezpe\u010dnostn\u00e9 mechanizmy v pou\u017e\u00edvate\u013esk\u00fdch aplik\u00e1ci\u00e1ch. V ich ch\u00e1pan\u00ed je proces zad\u00e1vania hesla jednoduch\u0161ou oper\u00e1ciou ne\u017e autentifik\u00e1cia pomocou kryptografick\u00e9ho tokenu. Hoci sa m\u00f4\u017ee zda\u0165, \u017ee \u010do m\u00f4\u017ee by\u0165 jednoduch\u0161ie, ne\u017e pripojenie tokenu do USB portu a zadanie jednoduch\u00e9ho PIN k\u00f3du. <\/p><\/blockquote>\n

\nJe d\u00f4le\u017eit\u00e9 poznamena\u0165, \u017ee zavedenie pr\u00edsnej autentifik\u00e1cie umo\u017e\u0148uje firm\u00e1m u\u017e nemyslie\u0165 na met\u00f3dy autentifik\u00e1cie a pravidl\u00e1 pr\u00e1ce potrebn\u00e9 na zablokovanie podvodn\u00fdch sch\u00e9m, a to k uspokojeniu skuto\u010dn\u00fdch potrieb svojich klientov.<\/p>\n

Zatia\u013e \u010do dodr\u017eiavanie regula\u010dn\u00fdch po\u017eiadaviek je rozumnou prioritou ako pre podniky, ktor\u00e9 pou\u017e\u00edvaj\u00fa pr\u00edsnu autentifik\u00e1ciu, tak aj pre t\u00fdch, ktor\u00ed ju nepou\u017e\u00edvaj\u00fa, firmy, ktor\u00e9 u\u017e zaviedli pr\u00edsnu autentifik\u00e1ciu, s ove\u013ea v\u00e4\u010d\u0161ou pravdepodobnos\u0165ou povedia, \u017ee zv\u00fd\u0161enie lojalnosti klientov je najd\u00f4le\u017eitej\u0161\u00edm ukazovate\u013eom, ktor\u00fd zoh\u013ead\u0148uj\u00fa pri hodnoten\u00ed met\u00f3dy autentifik\u00e1cie. (18 % oproti 12 %) (obr\u00e1zok 10).<\/p>\n

\"\u010co<\/p>\n

Korpor\u00e1tna autentifik\u00e1cia<\/h2>\n

\nOd roku 2017 sa zav\u00e1dzanie pr\u00edsnej autentifik\u00e1cie vo firm\u00e1ch zvy\u0161uje, ale je to o nie\u010do skromnej\u0161ie ne\u017e pri spotrebite\u013esk\u00fdch aplik\u00e1ci\u00e1ch. Podiel firiem, ktor\u00e9 pou\u017e\u00edvaj\u00fa pr\u00edsnu autentifik\u00e1ciu, vzr\u00e1stol zo 7 % v roku 2017 na 12 % v roku 2018. Na rozdiel od pou\u017e\u00edvate\u013esk\u00fdch aplik\u00e1ci\u00ed je v podnikate\u013eskom prostred\u00ed pou\u017e\u00edvanie met\u00f3d autentifik\u00e1cie bez hesla v webov\u00fdch aplik\u00e1ci\u00e1ch mierne roz\u0161\u00edrenej\u0161ie ako na mobiln\u00fdch zariadeniach. Pribli\u017ene polovica firiem hl\u00e1si, \u017ee na autentifik\u00e1ciu svojich pou\u017e\u00edvate\u013eov pri prihl\u00e1sen\u00ed do syst\u00e9mu pou\u017e\u00edva iba pou\u017e\u00edvate\u013esk\u00e9 men\u00e1 a hesl\u00e1, pri\u010dom ka\u017ed\u00fd piaty (22 %) sa spolieha v\u00fdlu\u010dne na hesl\u00e1 pre druh\u00fa autentifik\u00e1ciu pri pr\u00edstupe k mimoriadne d\u00f4le\u017eit\u00fdm \u00fadajom (to znamen\u00e1, \u017ee pou\u017e\u00edvate\u013e sa najprv prihl\u00e1si do aplik\u00e1cie pomocou jednoduch\u0161ej met\u00f3dy autentifik\u00e1cie, a ak chce z\u00edska\u0165 pr\u00edstup k kritick\u00fdm \u00fadajom, vykon\u00e1 e\u0161te jeden autentifika\u010dn\u00fd proces, a to zvy\u010dajne pomocou spo\u013eahlivej\u0161ej met\u00f3dy.<\/i>).<\/p>\n

\"\u010co<\/p>\n

Je potrebn\u00e9 ch\u00e1pa\u0165, \u017ee v spr\u00e1ve nie s\u00fa zoh\u013eadnen\u00e9 pou\u017eitia kryptografick\u00fdch tokenov pre dvojfaktorov\u00fa autentifik\u00e1ciu v opera\u010dn\u00fdch syst\u00e9moch Windows, Linux a Mac OS X. A to je v s\u00fa\u010dasnosti najroz\u0161\u00edrenej\u0161ie vyu\u017eitie 2FA. (Bohu\u017eia\u013e, tokeny vytvoren\u00e9 pod\u013ea \u0161tandardov FIDO dok\u00e1\u017eu realizova\u0165 2FA iba pre Windows 10).<\/p>\n

A ke\u010f\u017ee ochrana prihl\u00e1senia na pracovn\u00fd po\u010d\u00edta\u010d a dom\u00e9nu je d\u00f4le\u017eit\u00fdm prvkom ochrany firemn\u00fdch \u00fadajov, po\u010dty zaveden\u00ed dvojfaktorovej autentifik\u00e1cie neust\u00e1le rast\u00fa. <\/p>\n

Nasleduj\u00facimi dvoma najbe\u017enej\u0161\u00edmi met\u00f3dami autentifik\u00e1cie pou\u017e\u00edvate\u013eov pri prihl\u00e1sen\u00ed do syst\u00e9mu s\u00fa jednorazov\u00e9 hesl\u00e1, ktor\u00e9 s\u00fa poskytovan\u00e9 prostredn\u00edctvom samostatnej aplik\u00e1cie (13 % firiem), a jednorazov\u00e9 hesl\u00e1 zasielan\u00e9 prostredn\u00edctvom SMS (12 %). Napriek tomu, \u017ee percento vyu\u017e\u00edvania oboch met\u00f3d je ve\u013emi podobn\u00e9, OTP SMS sa naj\u010dastej\u0161ie pou\u017e\u00edva na zv\u00fd\u0161enie \u00farovne autoriz\u00e1cie (v 24 % spolo\u010dnost\u00ed). (Obr\u00e1zok 12).<\/p><\/blockquote>\n

\nNasleduj\u00facimi dvoma najbe\u017enej\u0161\u00edmi met\u00f3dami autentifik\u00e1cie pou\u017e\u00edvate\u013eov pri prihl\u00e1sen\u00ed do syst\u00e9mu s\u00fa jednorazov\u00e9 hesl\u00e1, ktor\u00e9 s\u00fa poskytovan\u00e9 prostredn\u00edctvom samostatnej aplik\u00e1cie (13 % firiem), a jednorazov\u00e9 hesl\u00e1 zasielan\u00e9 prostredn\u00edctvom SMS (12 %). Napriek tomu, \u017ee percento vyu\u017e\u00edvania oboch met\u00f3d je ve\u013emi podobn\u00e9, OTP SMS sa naj\u010dastej\u0161ie pou\u017e\u00edva na zv\u00fd\u0161enie \u00farovne autoriz\u00e1cie (v 24 % spolo\u010dnost\u00ed). (Obr\u00e1zok 12).<\/p>\n

\"\u010co
\n
\nN\u00e1rast pou\u017e\u00edvania pr\u00edsnej autentifik\u00e1cie v podnikoch mo\u017eno pravdepodobne vysvetli\u0165 zv\u00fd\u0161enou dostupnos\u0165ou implement\u00e1ci\u00ed kryptografick\u00fdch met\u00f3d autentifik\u00e1cie na platform\u00e1ch na spr\u00e1vu ident\u00edt podnikov (jednoducho povedan\u00e9 \u2013 firemn\u00e9 syst\u00e9my SSO a IAM sa nau\u010dili pou\u017e\u00edva\u0165 tokeny). <\/p>\n

Pre mobiln\u00fa autentifik\u00e1ciu zamestnancov a dod\u00e1vate\u013eov sa podniky ove\u013ea viac spoliehaj\u00fa na hesl\u00e1, ne\u017e pri autentifik\u00e1cii v spotrebite\u013esk\u00fdch aplik\u00e1ci\u00e1ch. O nie\u010do viac ako polovica (53%) podnikov pou\u017e\u00edva hesl\u00e1 pri autentifik\u00e1cii pr\u00edstupu pou\u017e\u00edvate\u013eov k firemn\u00fdm \u00fadajom prostredn\u00edctvom mobiln\u00e9ho zariadenia (obr. 13).<\/p>\n

V pr\u00edpade mobiln\u00fdch zariaden\u00ed by sa dalo veri\u0165 vo ve\u013ek\u00fa silu biometrie, keby neexistovalo mno\u017estvo pr\u00edpadov sfal\u0161ovania odtla\u010dkov prstov, hlasov, tv\u00e1r\u00ed a dokonca d\u00fahoviek. Jeden dopyt v vyh\u013ead\u00e1va\u010di uk\u00e1\u017ee, \u017ee spo\u013eahliv\u00fd sp\u00f4sob biometrickej autentifik\u00e1cie jednoducho neexistuje. Skuto\u010dne presn\u00e9 sn\u00edma\u010de samozrejme existuj\u00fa, ale s\u00fa ve\u013emi drah\u00e9 a ve\u013ek\u00e9 \u2014 a nezapadaj\u00fa do smartf\u00f3nov.<\/p>\n

Preto je jedinou funguj\u00facou met\u00f3dou 2FA v mobiln\u00fdch zariadeniach pou\u017e\u00edvanie kryptografick\u00fdch tokenov, ktor\u00e9 sa prip\u00e1jaj\u00fa k smartf\u00f3nu prostredn\u00edctvom rozhran\u00ed NFC, Bluetooth a USB Type-C.<\/p><\/blockquote>\n

\n\"\u010co
\n
\nOchrana finan\u010dn\u00fdch \u00fadajov spolo\u010dnosti je hlavnou pr\u00ed\u010dinou invest\u00edci\u00ed do bezheslovej autentifik\u00e1cie (44%) s najr\u00fdchlej\u0161\u00edm rastom od roku 2017 (n\u00e1rast o osem percentu\u00e1lnych bodov). Nasleduje ochrana du\u0161evn\u00e9ho vlastn\u00edctva (40%) a person\u00e1lnych (HR) \u00fadajov (39%). A nie je divu \u2014 nielen\u017ee je hodnota spojen\u00e1 s t\u00fdmito typmi \u00fadajov \u0161iroko uzn\u00e1van\u00e1, ale s nimi pracuje aj relat\u00edvne mal\u00e9 mno\u017estvo zamestnancov. To znamen\u00e1, \u017ee n\u00e1klady na implement\u00e1ciu nie s\u00fa tak\u00e9 vysok\u00e9 a nau\u010di\u0165 pracova\u0165 s n\u00e1ro\u010dnej\u0161\u00edm syst\u00e9mom autentifik\u00e1cie potrebuje iba nieko\u013eko \u013eud\u00ed. Naopak, typy \u00fadajov a zariaden\u00ed, ku ktor\u00fdm sa v\u00e4\u010d\u0161ina zamestnancov podniku obvykle obracia, s\u00fa na\u010falej chr\u00e1nen\u00e9 v\u00fdlu\u010dne heslami. Zamestnaneck\u00e9 dokumenty, pracovn\u00e9 stanice a firemn\u00e9 port\u00e1ly elektronickej po\u0161ty s\u00fa oblasti s najvy\u0161\u0161\u00edm rizikom, preto\u017ee iba \u0161tvrtina podnikov chr\u00e1ni tieto akt\u00edva pomocou bezheslovej autentifik\u00e1cie (obr. 14).<\/p>\n

\"\u010co<\/p>\n

Vo v\u0161eobecnosti je firemn\u00e1 elektronick\u00e1 po\u0161ta ve\u013emi nebezpe\u010dn\u00e1 a \"derav\u00e1\" z\u00e1le\u017eitos\u0165, pri\u010dom potenci\u00e1lnu hrozbu jej v\u00e4\u010d\u0161ina IT riadite\u013eov podce\u0148uje. Zamestnanci denne dost\u00e1vaj\u00fa desiatky emailov, tak\u017ee pre\u010do sa medzi nimi nem\u00f4\u017ee objavi\u0165 aspo\u0148 jedna phishingov\u00e1 spr\u00e1va (teda podvodn\u00e1). Tento email bude navrhnut\u00fd v \u0161t\u00fdle spr\u00e1v spolo\u010dnosti, a preto zamestnanec bez ob\u00e1v klikne na odkaz v \u0148om. A potom sa m\u00f4\u017ee sta\u0165 \u010doko\u013evek, napr\u00edklad s\u0165ahovanie v\u00edrusu do infikovan\u00e9ho zariadenia alebo odcudzenie hesiel (vr\u00e1tane met\u00f3d soci\u00e1lneho in\u017einierstva, cez zadan\u00ed \u00fadajov do falo\u0161n\u00e9ho autentifika\u010dn\u00e9ho formul\u00e1ra vytvoren\u00e9ho p\u00e1chate\u013eom).<\/p>\n

Aby sa tak\u00e9to veci nest\u00e1vali, elektronick\u00e9 spr\u00e1vy by mali by\u0165 podp\u00edsan\u00e9. Potom bude okam\u017eite jasn\u00e9, ktor\u00fd email vytvoril leg\u00e1lny zamestnanec a ktor\u00fd \u00fato\u010dn\u00edk. V Outlook \/ Exchange je elektronick\u00fd podpis zalo\u017een\u00fd na kryptografick\u00fdch tokenech zap\u00ednan\u00fd dos\u0165 r\u00fdchlo a jednoducho a m\u00f4\u017ee by\u0165 pou\u017eit\u00fd spolo\u010dne s dvojfaktorovou autentifik\u00e1ciou na po\u010d\u00edta\u010doch a dom\u00e9nach Windows.<\/p><\/blockquote>\n

\nMedzi t\u00fdmi mana\u017e\u00e9rmi, ktor\u00ed sa spoliehaj\u00fa v\u00fdlu\u010dne na autentifik\u00e1ciu pomocou hesla v r\u00e1mci podniku, dve tretiny (66%) to rob\u00ed preto, \u017ee si myslia, \u017ee hesl\u00e1 poskytuj\u00fa dostato\u010dn\u00fa bezpe\u010dnos\u0165 pre typ inform\u00e1ci\u00ed, ktor\u00e9 mus\u00ed ich spolo\u010dnos\u0165 chr\u00e1ni\u0165 (obr\u00e1zok 15).<\/p>\n

Ale met\u00f3dy pr\u00edsnej autentifik\u00e1cie sa st\u00e1vaj\u00fa \u010doraz be\u017enej\u0161\u00edmi. Najm\u00e4 kv\u00f4li tomu, \u017ee sa st\u00e1vaj\u00fa dostupnej\u0161\u00edmi. \u010coraz viac syst\u00e9mov riadenia ident\u00edt a pr\u00edstupu (IAM), prehliada\u010dov a opera\u010dn\u00fdch syst\u00e9mov podporuje autentifik\u00e1ciu pomocou kryptografick\u00fdch tokenech. <\/p>\n

Pr\u00edsna autentifik\u00e1cia m\u00e1 aj \u010fal\u0161iu v\u00fdhodu. Ke\u010f\u017ee sa u\u017e heslo nepou\u017e\u00edva (nahraden\u00e9 jednoduch\u00fdm PIN k\u00f3dom), nie s\u00fa \u017eiadne po\u017eiadavky od zamestnancov na zmenu zabudnut\u00e9ho hesla. To na opl\u00e1tku zni\u017euje z\u00e1\u0165a\u017e na IT oddelenie podniku.<\/p>\n

\"\u010co<\/p>\n

\n

Zhrnutia a z\u00e1very<\/h4>\n

<\/p>\n

    \n
  1. Riaditelia \u010dasto nemaj\u00fa potrebn\u00e9 znalosti na pos\u00fadenie skuto\u010dnej <\/b>efekt\u00edvnosti r\u00f4znych mo\u017enost\u00ed autentifik\u00e1cie. S\u00fa zvyknut\u00ed veri\u0165 tak\u00fdm zastaral\u00fdm <\/b>met\u00f3dam ochrany ako s\u00fa hesl\u00e1 a tajn\u00e9 ot\u00e1zky len preto, \u017ee \"to predt\u00fdm fungovalo\". <\/li>\n
  2. Pou\u017e\u00edvatelia tieto znalosti maj\u00fa e\u0161te v men\u0161ej miere<\/b>, pre nich je najd\u00f4le\u017eitej\u0161ie \u2013 jednoduchos\u0165 a pohodlie<\/b>. Dovtedy nemaj\u00fa p\u00e1dne d\u00f4vody vybra\u0165 si bezpe\u010dnej\u0161ie rie\u0161enia<\/b>.<\/li>\n
  3. V\u00fdvoj\u00e1ri pou\u017e\u00edvate\u013esk\u00fdch aplik\u00e1ci\u00ed \u010dasto nemaj\u00fa d\u00f4vody<\/b>, aby zav\u00e1dzal dvojfaktorov\u00fa autentifik\u00e1ciu namiesto heslovej. Konkurencia na \u00farovni zabezpe\u010denia v pou\u017e\u00edvate\u013esk\u00fdch aplik\u00e1ci\u00e1ch neexistuje<\/b>.<\/li>\n
  4. Cel\u00e1 zodpovednos\u0165 za hackovanie je prenesen\u00e1 na pou\u017e\u00edvate\u013ea<\/b>. Povedal jednorazov\u00e9 heslo \u00fato\u010dn\u00edkovi \u2013 si na vine<\/b>. Tvoje heslo bolo zachyten\u00e9 alebo odpozorovan\u00e9 \u2013 si na vine<\/b>. Nevy\u017eiadal si od v\u00fdvoj\u00e1ra, aby v produkte pou\u017e\u00edval spo\u013eahliv\u00e9 met\u00f3dy autentifik\u00e1cie \u2013 si na vine<\/b>.<\/li>\n
  5. Spr\u00e1vny <\/b>regul\u00e1tor by mal najprv<\/b> po\u017eadova\u0165 od spolo\u010dnost\u00ed zav\u00e1dzanie rie\u0161en\u00ed, ktor\u00e9 blokuj\u00fa <\/b>\u00faniky d\u00e1t (najm\u00e4 dvojfaktorov\u00fa autentifik\u00e1ciu), a nie tresta\u0165 za u\u017e sa uskuto\u010dnen\u00e9<\/b> \u00faniky d\u00e1t.<\/li>\n
  6. Niektor\u00ed v\u00fdvoj\u00e1ri softv\u00e9ru sa sna\u017eia pred\u00e1va\u0165 spotrebite\u013eom star\u00e9 a nie ve\u013emi spo\u013eahliv\u00e9<\/b> rie\u0161enia v peknom obale<\/b> \u201einovat\u00edvneho\u201c produktu. Napr\u00edklad autentifik\u00e1cia spojen\u00edm s konkr\u00e9tnym smartf\u00f3nom alebo pou\u017eit\u00edm biometrie. Ako je uveden\u00e9 v spr\u00e1ve, naozaj spo\u013eahliv\u00e9 m\u00f4\u017ee by\u0165 iba rie\u0161enie zalo\u017een\u00e9 na pr\u00edsnej autentifik\u00e1cii, teda na kryptografick\u00fdch tokenoch.<\/b> Rovnak\u00fd<\/li>\n
  7. kryptografick\u00fd token sa m\u00f4\u017ee pou\u017ei\u0165 na<\/b> cel\u00fa \u0161k\u00e1lu \u00faloh : na<\/b>pr\u00edsnu autentifik\u00e1ciu v opera\u010dnom syst\u00e9me podniku, v firemnej a pou\u017e\u00edvate\u013eskej aplik\u00e1cii, pre<\/b> elektronick\u00fd podpis finan\u010dn\u00fdch transakci\u00ed (d\u00f4le\u017eit\u00e9 pre bankov\u00e9 aplik\u00e1cie), dokumentov a e-mailov.<\/b> Matryoshka C. Viacvrstvov\u00fd syst\u00e9m programovacieho jazyka<\/li>\n<\/ol>\n<\/blockquote>\n

    Zdroj: habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

    \u041d\u0435\u0434\u0430\u0432\u043d\u043e \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f \u00abJavelin Strategy & Research\u00bb \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0430 \u043e\u0442\u0447\u0451\u0442 \u00abThe State of Strong Authentication 2019\u00bb. \u0415\u0433\u043e \u0441\u043e\u0437\u0434\u0430\u0442\u0435\u043b\u0438 \u0441\u043e\u0431\u0440\u0430\u043b\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u0442\u043e\u043c \u043a\u0430\u043a\u0438\u0435 \u0441\u043f\u043e\u0441\u043e\u0431\u044b \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0432 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0441\u0440\u0435\u0434\u0435 \u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0438\u0445 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u0445, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0441\u0434\u0435\u043b\u0430\u043b\u0438 \u043b\u044e\u0431\u043e\u043f\u044b\u0442\u043d\u044b\u0435 \u0432\u044b\u0432\u043e\u0434\u044b \u043e \u0431\u0443\u0434\u0443\u0449\u0435\u043c \u0441\u0442\u0440\u043e\u0433\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438. \u041f\u0435\u0440\u0435\u0432\u043e\u0434 \u043f\u0435\u0440\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u0438 \u0441 \u0432\u044b\u0432\u043e\u0434\u0430\u043c\u0438 \u0430\u0432\u0442\u043e\u0440\u043e\u0432 \u043e\u0442\u0447\u0435\u0442\u0430, \u043c\u044b \u0443\u0436\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b\u0438 \u043d\u0430 \u0425\u0430\u0431\u0440\u0435. \u0410 \u0441\u0435\u0439\u0447\u0430\u0441 \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":25549,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-33885","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47\u010co teda bude s autentifik\u00e1ciou a heslami? Druh\u00e1 \u010das\u0165 spr\u00e1vy Javelin \u201eStav pr\u00edsnej autentifik\u00e1cie\u201c | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/tak-chto-zhe-budet-s-autentifikatsiej-i-parolyami-vtoraya-chast-otcheta-javelin-sostoyanie-strogoj-autentifikatsii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0422\u0430\u043a \u0447\u0442\u043e \u0436\u0435 \u0431\u0443\u0434\u0435\u0442 \u0441 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u0438 \u043f\u0430\u0440\u043e\u043b\u044f\u043c\u0438? \u0412\u0442\u043e\u0440\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u043e\u0442\u0447\u0435\u0442\u0430 Javelin \u00ab\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0441\u0442\u0440\u043e\u0433\u043e\u0439 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438\u00bb | ProHoster","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/tak-chto-zhe-budet-s-autentifikatsiej-i-parolyami-vtoraya-chast-otcheta-javelin-sostoyanie-strogoj-autentifikatsii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:55:12+00:00","article:modified_time":"2019-10-31T18:55:12+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"33885","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 17:06:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 02:31:23","updated":"2026-01-21 17:06:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/33885","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=33885"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/33885\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/25549"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=33885"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=33885"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=33885"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}