{"id":94321,"date":"2020-09-15T19:42:32","date_gmt":"2020-09-15T17:42:32","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/rukovodstvo-po-bezopasnosti-dns"},"modified":"2020-09-15T19:42:32","modified_gmt":"2020-09-15T17:42:32","slug":"rukovodstvo-po-bezopasnosti-dns","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/rukovodstvo-po-bezopasnosti-dns","title":{"rendered":"Pr\u00edru\u010dka na zabezpe\u010denie DNS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Pr\u00edru\u010dka na zabezpe\u010denie DNS\" src=\"\/wp-content\/uploads\/2020\/09\/e29223def3c7c13eaa45a24967d6bba0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u010ci u\u017e sa spolo\u010dnos\u0165 zaober\u00e1 \u010d\u00edmko\u013evek, bezpe\u010dnos\u0165 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/what-is-dns\/\"> DNS <\/a><\/noindex>by mala by\u0165 neoddelite\u013enou s\u00fa\u010das\u0165ou jej pl\u00e1nu zabezpe\u010denia. Slu\u017eby spracovania mien, ktor\u00e9 prev\u00e1dzaj\u00fa n\u00e1zvy sie\u0165ov\u00fdch uzlov na IP adresy, s\u00fa pou\u017e\u00edvan\u00e9 doslova v\u0161etk\u00fdmi aplik\u00e1ciami a slu\u017ebami v sieti.<\/p>\n<p><strong>Ak zlo\u010dinec z\u00edska kontrolu nad DNS organiz\u00e1cie, bude m\u00f4c\u0165 bez probl\u00e9mov:<\/strong><\/p>\n<ul>\n<li>prevzia\u0165 kontrolu nad prostriedkami, ktor\u00e9 s\u00fa verejne dostupn\u00e9<\/li>\n<li>presmerova\u0165 prich\u00e1dzaj\u00face e-maily, ako aj webov\u00e9 po\u017eiadavky a pokusy o autentifik\u00e1ciu<\/li>\n<li>vytv\u00e1ra\u0165 a overova\u0165 certifik\u00e1ty SSL\/TLS<\/li>\n<\/ul>\n<p>\n<strong>Tento sprievodca sa zaober\u00e1 bezpe\u010dnos\u0165ou DNS z dvoch poh\u013eadov:<\/strong><\/p>\n<ol>\n<li>Realizovanie trval\u00e9ho monitorovania a kontroly nad DNS<\/li>\n<li>Ako nov\u00e9 protokoly DNS, ako DNSSEC, DoH a DoT, m\u00f4\u017eu pom\u00f4c\u0165 chr\u00e1ni\u0165 integritu a d\u00f4vernos\u0165 pren\u00e1\u0161an\u00fdch DNS po\u017eiadaviek<\/li>\n<\/ol>\n<p>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2> \u010co je bezpe\u010dnos\u0165 DNS? <\/h2>\n<p>\n<img decoding=\"async\" alt=\"Pr\u00edru\u010dka na zabezpe\u010denie DNS\" src=\"\/wp-content\/uploads\/2020\/09\/6367857de248c9ee9435f8ec079600be.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3> Bezpe\u010dnos\u0165 DNS zah\u0155\u0148a dve d\u00f4le\u017eit\u00e9 s\u00fa\u010dasti:<\/h3>\n<p><\/p>\n<ol>\n<li>Zabezpe\u010denie celkovej integrity a dostupnosti slu\u017eieb DNS, ktor\u00e9 prev\u00e1dzaj\u00fa n\u00e1zvy sie\u0165ov\u00fdch uzlov na IP adresy<\/li>\n<li>Monitorovanie aktivity DNS na identifik\u00e1ciu mo\u017en\u00fdch probl\u00e9mov s bezpe\u010dnos\u0165ou v sieti<\/li>\n<\/ol>\n<h3> Pre\u010do je DNS zranite\u013en\u00e9 vo\u010di \u00fatokom? <\/h3>\n<p>\nTechnol\u00f3gia DNS bola vytvoren\u00e1 na samom za\u010diatku rozvoja internetu, dlho predt\u00fdm, ne\u017e niekto za\u010dal myslie\u0165 na sie\u0165ov\u00fa bezpe\u010dnos\u0165. DNS funguje bez autentifik\u00e1cie a \u0161ifrovania, slepo spracov\u00e1va po\u017eiadavky ka\u017ed\u00e9ho pou\u017e\u00edvate\u013ea.<\/p>\n<p>V d\u00f4sledku toho existuje mno\u017estvo sp\u00f4sobov, ako oklama\u0165 pou\u017e\u00edvate\u013ea a sfal\u0161ova\u0165 inform\u00e1cie o tom, kde sa naozaj vykon\u00e1va prevod mien na IP adresy.<\/p>\n<h2> Bezpe\u010dnos\u0165 DNS: ot\u00e1zky a komponenty<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Pr\u00edru\u010dka na zabezpe\u010denie DNS\" src=\"\/wp-content\/uploads\/2020\/09\/45d61ac4004631a2602518a3d4a51c3c.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nBezpe\u010dnos\u0165 DNS pozost\u00e1va z nieko\u013ek\u00fdch z\u00e1kladn\u00fdch <em>komponentov<\/em>, pri\u010dom ka\u017ed\u00fd z nich je potrebn\u00e9 zoh\u013eadni\u0165 pre zabezpe\u010denie komplexnej ochrany:<\/p>\n<ul>\n<li><strong>Zlep\u0161enie bezpe\u010dnosti serverov a proced\u00far spr\u00e1vy:<\/strong> zvy\u0161ujte \u00farove\u0148 zabezpe\u010denia serverov a vytvorte \u0161tandardn\u00fd vzor nasadzovania<\/li>\n<li><strong>Zlep\u0161enie protokolu:<\/strong> implementujte DNSSEC, DoT alebo DoH<\/li>\n<li><strong>Analytika a reportovanie: <\/strong>pridajte protokol DNS do syst\u00e9mu SIEM pre \u010fal\u0161\u00ed kontext pri vy\u0161etrovan\u00ed incidentov<\/li>\n<li><strong>Kybernetick\u00e1 inteligencia a detekcia hrozieb:<\/strong> prihl\u00e1ste sa na akt\u00edvny kan\u00e1l na z\u00edskavanie analytick\u00fdch \u00fadajov o hrozb\u00e1ch<\/li>\n<li><strong>Automatiz\u00e1cia: <\/strong>vytvorte \u010do najviac scen\u00e1rov na automatiz\u00e1ciu procesov<\/li>\n<\/ul>\n<p>\nVy\u0161\u0161ie uveden\u00e9 vysoko\u00farov\u0148ov\u00e9 komponenty s\u00fa len \u0161pi\u010dkou \u013eadovca bezpe\u010dnosti DNS. V nasleduj\u00facej \u010dasti sa podrobne pozrieme na konkr\u00e9tne pr\u00edpady pou\u017eitia a osved\u010den\u00e9 postupy, ktor\u00e9 by ste mali pozna\u0165.<\/p>\n<h2> \u00datoky na DNS<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Pr\u00edru\u010dka na zabezpe\u010denie DNS\" src=\"\/wp-content\/uploads\/2020\/09\/f44708ad51b13385aa5ce10629944ecc.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<ul>\n<li><strong><noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/dns-cache-poisoning\/\">podvod DNS alebo \u201eotr\u00e1venie\u201c cache<\/a><\/noindex>: <\/strong> vyu\u017eitie zranite\u013enosti syst\u00e9mu na riadenie cache DNS s cie\u013eom presmerova\u0165 pou\u017e\u00edvate\u013eov na in\u00e9 miesto<\/li>\n<li><strong><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/513160\/\">DNS tunelovanie<\/a><\/noindex>: <\/strong>najm\u00e4 sa pou\u017e\u00edva na ob\u00eddenie ochrann\u00fdch prostriedkov na vzdialen\u00e9 pripojenia<\/li>\n<li><strong>zachytenie DNS: <\/strong>presmerovanie be\u017enej prev\u00e1dzky DNS na in\u00fd cie\u013eov\u00fd DNS server zmenou registr\u00e1tora dom\u00e9ny<\/li>\n<li><strong>NXDOMAIN \u00fatok: <\/strong>vykonanie DDoS \u00fatoku na autoritat\u00edvny server DNS zaslan\u00edm neplatn\u00fdch dom\u00e9nov\u00fdch dopytov za \u00fa\u010delom z\u00edskania n\u00fatenej odpovede<\/li>\n<li><strong>fant\u00f3mov\u00e1 dom\u00e9na: <\/strong> znemo\u017e\u0148uje DNS resolveru \u010daka\u0165 na odpove\u010f od neexistuj\u00facich dom\u00e9n, \u010do vedie k zn\u00ed\u017eeniu v\u00fdkonnosti<\/li>\n<li><strong>\u00fatok na n\u00e1hodn\u00fd subdom\u00e9nu: <\/strong> napadnut\u00ed hostitelia a botnety vykon\u00e1vaj\u00fa DDoS \u00fatok na existuj\u00facu dom\u00e9nu, ale zameriavaj\u00fa svoje \u00fatoky na falo\u0161n\u00e9 subdom\u00e9ny, aby prin\u00fatili DNS server vykon\u00e1va\u0165 vyh\u013ead\u00e1vanie z\u00e1znamov a prevzia\u0165 kontrolu nad slu\u017ebou<\/li>\n<li><strong>blokovanie dom\u00e9ny: <\/strong> predstavuje odosielanie mno\u017estva spamov\u00fdch odpoved\u00ed na blokovanie zdrojov DNS servera<\/li>\n<li><strong>botnetov\u00fd \u00fatok z abonentsk\u00e9ho zariadenia: <\/strong> s\u00fahrn po\u010d\u00edta\u010dov, modemov, routerov a in\u00fdch zariaden\u00ed, ktor\u00e9 s\u00fastredia v\u00fdpo\u010dtov\u00fd v\u00fdkon na ur\u010ditej webovej str\u00e1nke, aby ju pre\u0165a\u017eili dopytmi po prev\u00e1dzke<\/li>\n<\/ul>\n<p><\/p>\n<h3> \u00datoky vyu\u017e\u00edvaj\u00face DNS<\/h3>\n<p>\n\u00datoky, ktor\u00e9 ak\u00fdmko\u013evek sp\u00f4sobom vyu\u017e\u00edvaj\u00fa DNS na napadanie in\u00fdch syst\u00e9mov (t. j. zmena z\u00e1znamov DNS nie je kone\u010dn\u00fdm cie\u013eom):<\/p>\n<ul>\n<li>Fast-Flux<\/li>\n<li>Jednoduch\u00e9 Flux siete<\/li>\n<li>Dvojit\u00e9 Flux siete<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/513160\/\">DNS tunelovanie<\/a><\/noindex> <\/li>\n<\/ul>\n<p><\/p>\n<h3> \u00datoky na DNS<\/h3>\n<p>\n\u00datoky, pri ktor\u00fdch sa zo servera DNS vracia po\u017eadovan\u00e1 IP adresa pre zlo\u010dinca:<\/p>\n<ul>\n<li>podvod DNS alebo \u201eotr\u00e1venie\u201c cache<\/li>\n<li>zachytenie DNS<\/li>\n<\/ul>\n<p><\/p>\n<h2> \u010co je to DNSSEC?<\/h2>\n<p><img decoding=\"async\" alt=\"Pr\u00edru\u010dka na zabezpe\u010denie DNS\" src=\"\/wp-content\/uploads\/2020\/09\/929b6e632135bd1b059e403e7b4ddab8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDNSSEC - moduly zabezpe\u010denia slu\u017eby dom\u00e9nov\u00fdch mien - sa pou\u017e\u00edvaj\u00fa na overenie z\u00e1znamov DNS bez potreby vedie\u0165 v\u0161eobecn\u00e9 inform\u00e1cie o ka\u017edom konkr\u00e9tnom DNS dopyte.<\/p>\n<p>DNSSEC vyu\u017e\u00edva k\u013e\u00fa\u010de digit\u00e1lneho podpisu (PKI) na potvrdenie, \u017ee v\u00fdsledky dopytu dom\u00e9nov\u00e9ho mena s\u00fa z\u00edskan\u00e9 z opr\u00e1vnen\u00e9ho zdroja.<br \/>\nImplement\u00e1cia DNSSEC nie je len najlep\u0161ou praxou v odvetv\u00ed, ale tie\u017e efekt\u00edvne pom\u00e1ha predch\u00e1dza\u0165 v\u00e4\u010d\u0161ine \u00fatokov na DNS.<\/p>\n<h4>Princ\u00edp fungovania DNSSEC<\/h4>\n<p>\nDNSSEC funguje podobne ako TLS\/HTTPS, pri\u010dom vyu\u017e\u00edva p\u00e1ry verejn\u00fdch a s\u00fakromn\u00fdch k\u013e\u00fa\u010dov na digit\u00e1lne podpisovanie z\u00e1znamov DNS. Celkov\u00fd preh\u013ead procesu:<\/p>\n<ol>\n<li>Z\u00e1znamy DNS s\u00fa podp\u00edsan\u00e9 p\u00e1rom s\u00fakromn\u00e9ho a verejn\u00e9ho k\u013e\u00fa\u010da<\/li>\n<li>Odpovede na po\u017eiadavky DNSSEC obsahuj\u00fa po\u017eadovan\u00fd z\u00e1znam, ako aj podpis a verejn\u00fd k\u013e\u00fa\u010d.<\/li>\n<li>Potom <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/pgp-encryption\/\">verejn\u00fd k\u013e\u00fa\u010d <\/a><\/noindex>sa pou\u017e\u00edva na overenie pravosti z\u00e1znamu a podpisu.<\/li>\n<\/ol>\n<h2> Bezpe\u010dnos\u0165 DNS a DNSSEC<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Pr\u00edru\u010dka na zabezpe\u010denie DNS\" src=\"\/wp-content\/uploads\/2020\/09\/3bd1d530634e82ed6d80040a1d207ff0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDNSSEC je n\u00e1stroj na overenie integrity DNS po\u017eiadaviek. Neovplyv\u0148uje d\u00f4vernos\u0165 DNS. In\u00fdmi slovami, DNSSEC v\u00e1m m\u00f4\u017ee poskytn\u00fa\u0165 istotu, \u017ee odpove\u010f na va\u0161u DNS po\u017eiadavku nie je fal\u0161ovan\u00e1, ale ak\u00fdko\u013evek \u00fato\u010dn\u00edk m\u00f4\u017ee vidie\u0165 tieto v\u00fdsledky v podobe, v akej boli zaslan\u00e9 v\u00e1m.<\/p>\n<h2> DoT \u2014 DNS cez TLS<\/h2>\n<p>\nTransport Layer Security (TLS) je kryptografick\u00fd protokol na ochranu pren\u00e1\u0161an\u00fdch inform\u00e1ci\u00ed cez sie\u0165ov\u00e9 pripojenie. Ke\u010f je medzi klientom a serverom vytvoren\u00e9 bezpe\u010dn\u00e9 pripojenie TLS, pren\u00e1\u0161an\u00e9 \u00fadaje s\u00fa \u0161ifrovan\u00e9 a \u017eiadni prostredn\u00edci ich nedok\u00e1\u017eu vidie\u0165.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/tls-vs-ssl\/\">TLS <\/a><\/noindex>\u010dasto sa pou\u017e\u00edva ako s\u00fa\u010das\u0165 HTTPS (SSL) vo va\u0161om webovom prehliada\u010di, ke\u010f\u017ee po\u017eiadavky s\u00fa posielan\u00e9 na zabezpe\u010den\u00e9 HTTP servery.<\/p>\n<p>DNS-over-TLS (DNS cez TLS, DoT) vyu\u017e\u00edva protokol TLS na \u0161ifrovanie UDP prev\u00e1dzky be\u017en\u00fdch po\u017eiadaviek DNS.<br \/>\n\u0160ifrovanie t\u00fdchto po\u017eiadaviek v \u010ditate\u013enej podobe pom\u00e1ha chr\u00e1ni\u0165 pou\u017e\u00edvate\u013eov alebo aplik\u00e1cie, ktor\u00e9 vykon\u00e1vaj\u00fa po\u017eiadavky, pred nieko\u013ek\u00fdmi \u00fatokmi.<\/p>\n<ul>\n<li><strong>MitM, alebo \u201e\u010dlovek v strede\u201c<\/strong>: bez \u0161ifrovania m\u00f4\u017ee prostredn\u00edcky syst\u00e9m, ktor\u00fd sa nach\u00e1dza medzi klientom a autoritat\u00edvnym DNS serverom, potenci\u00e1lne odosla\u0165 klientovi v reakcii na po\u017eiadavku falo\u0161n\u00e9 alebo nebezpe\u010dn\u00e9 inform\u00e1cie.<\/li>\n<li><strong>\u0160pehovanie a sledovanie<\/strong>: bez \u0161ifrovania m\u00f4\u017eu prostredn\u00edcke syst\u00e9my jednoducho zis\u0165ova\u0165, na ktor\u00e9 str\u00e1nky sa konkr\u00e9tny pou\u017e\u00edvate\u013e alebo aplik\u00e1cia odvol\u00e1va. Hoci z len DNS nie je mo\u017en\u00e9 zisti\u0165 konkr\u00e9tnu nav\u0161t\u00edven\u00fa str\u00e1nku na webe, samotn\u00e9 poznanie po\u017eadovan\u00fdch dom\u00e9n sta\u010d\u00ed na vytvorenie profilu syst\u00e9mu alebo jednotlivca.<\/li>\n<\/ul>\n<p><img decoding=\"async\" alt=\"Pr\u00edru\u010dka na zabezpe\u010denie DNS\" src=\"\/wp-content\/uploads\/2020\/09\/31bb5e540feac0302244253b1c12ed32.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nZdroj: <noindex><a rel=\"nofollow\" href=\"https:\/\/faculty.sites.uci.edu\/zhouli\/files\/2019\/11\/conext19.pdf\">University of California Irvine<\/a><\/noindex><\/p>\n<h2> DoH \u2014 DNS cez HTTPS<\/h2>\n<p>\nDNS-over-HTTPS (DNS nad HTTPS, DoH) je experiment\u00e1lny protokol, ktor\u00fd vyv\u00edjaj\u00fa spolo\u010dne Mozilla a Google. Jeho ciele s\u00fa podobn\u00e9 cie\u013eom protokolu DoT \u2014 zv\u00fd\u0161i\u0165 s\u00fakromie pou\u017e\u00edvate\u013eov na internete \u0161ifrovan\u00edm DNS dopytov a odpoved\u00ed.<\/p>\n<p>\u0160tandardn\u00e9 DNS dopyty sa pren\u00e1\u0161aj\u00fa cez UDP. Dopyty a odpovede je mo\u017en\u00e9 sledova\u0165 pomocou tak\u00fdch n\u00e1strojov, ako s\u00fa <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/how-to-use-wireshark\/\">Wireshark<\/a><\/noindex>. DoT \u0161ifruje tieto dopyty, ale st\u00e1le s\u00fa rozpoznate\u013en\u00e9 ako dos\u0165 jasn\u00e1 UDP prev\u00e1dzka v sieti.<\/p>\n<p>DoH pou\u017e\u00edva in\u00fd pr\u00edstup a pren\u00e1\u0161a za\u0161ifrovan\u00e9 dopyty na preklad n\u00e1zvov sie\u0165ov\u00fdch uzlov cez HTTPS pripojenia, ktor\u00e9 v sieti vyzeraj\u00fa ako ak\u00fdko\u013evek in\u00fd webov\u00fd dopyt.<\/p>\n<p>Toto rozl\u00ed\u0161enie m\u00e1 ve\u013emi d\u00f4le\u017eit\u00e9 d\u00f4sledky pre spr\u00e1vne slu\u017eby a bud\u00facnos\u0165 prekladu n\u00e1zvov.<\/p>\n<ol>\n<li>DNS filtrov\u00e1n\u00ed je be\u017en\u00fd sp\u00f4sob filtr\u00e1cie webovej prev\u00e1dzky na ochranu pou\u017e\u00edvate\u013eov pred phishingov\u00fdmi \u00fatokmi, str\u00e1nkami \u0161\u00edriacimi \u0161kodliv\u00e9 softv\u00e9ry alebo inou potenci\u00e1lne nebezpe\u010dnou internetovou aktivitou v podnikovej sieti. Protokol DoH obch\u00e1dza tieto filtre, potenci\u00e1lne vystavuj\u00fac pou\u017e\u00edvate\u013eov a sie\u0165 vysok\u00e9mu riziku. <\/li>\n<li>V s\u00fa\u010dasnom modeli prekladu n\u00e1zvov ka\u017ed\u00e9 zariadenie v sieti do ur\u010ditej miery z\u00edskava DNS dopyty z rovnak\u00e9ho miesta (z uveden\u00e9ho DNS servera). DoH a najm\u00e4 jeho implement\u00e1cia vo Firefox ukazuj\u00fa, \u017ee v bud\u00facnosti sa to m\u00f4\u017ee zmeni\u0165. Ka\u017ed\u00e1 aplik\u00e1cia na po\u010d\u00edta\u010di m\u00f4\u017ee z\u00edskava\u0165 \u00fadaje z r\u00f4znych zdrojov DNS, \u010do v\u00fdrazne s\u0165a\u017euje identifik\u00e1ciu a odstr\u00e1nenie probl\u00e9mov, zabezpe\u010denie a modelovanie riz\u00edk. <\/li>\n<\/ol>\n<p><img decoding=\"async\" alt=\"Pr\u00edru\u010dka na zabezpe\u010denie DNS\" src=\"\/wp-content\/uploads\/2020\/09\/46ece02ca361b133d4a6bd488b917c73.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nZdroj: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/what-is-powershell\/\">www.varonis.com\/blog\/what-is-powershell<\/a><\/noindex><\/p>\n<h3> Ak\u00fd je rozdiel medzi DNS nad TLS a DNS nad HTTPS?<\/h3>\n<p>\nZa\u010dnime s DNS nad TLS (DoT). Hlavn\u00e1 pozornos\u0165 sa tu s\u00fastre\u010fuje na to, \u017ee p\u00f4vodn\u00fd protokol DNS nie je menen\u00fd, ale jednoducho bezpe\u010dne pren\u00e1\u0161an\u00fd cez zabezpe\u010den\u00fd kan\u00e1l. DoH umiest\u0148uje DNS do form\u00e1tu HTTP pred vykonan\u00edm dopytov.<\/p>\n<h2> Upozornenia na monitorovanie DNS<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Pr\u00edru\u010dka na zabezpe\u010denie DNS\" src=\"\/wp-content\/uploads\/2020\/09\/fbbd9f320922dbd2eec180a253ba54f0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMo\u017enos\u0165 efekt\u00edvne sledova\u0165 DNS prev\u00e1dzku vo va\u0161ej sieti na pr\u00edtomnos\u0165 podozriv\u00fdch anom\u00e1li\u00ed je k\u013e\u00fa\u010dov\u00e1 pre v\u010dasn\u00e9 odhalenie naru\u0161enia. Pou\u017eitie n\u00e1stroja ako Varonis Edge v\u00e1m umo\u017en\u00ed by\u0165 informovan\u00fd o v\u0161etk\u00fdch d\u00f4le\u017eit\u00fdch ukazovate\u013eoch a vytvori\u0165 profily pre ka\u017ed\u00fd \u00fa\u010det vo va\u0161ej sieti. M\u00f4\u017eete si nastavi\u0165 generovanie upozornen\u00ed na z\u00e1klade kombin\u00e1cie akci\u00ed, ktor\u00e9 sa dej\u00fa v ur\u010dit\u00fdch \u010dasov\u00fdch intervaloch.<\/p>\n<p>Sledovanie zmien DNS, umiestnen\u00ed \u00fa\u010dtov, ako aj faktov prv\u00e9ho pou\u017eitia a pr\u00edstupu k d\u00f4vern\u00fdm \u00fadajom, ako aj aktivity mimo pracovn\u00e9ho \u010dasu \u2013 to je len nieko\u013eko ukazovate\u013eov, ktor\u00e9 je mo\u017en\u00e9 porovna\u0165 na zostavenie komplexnej\u0161ieho obrazu detekcie.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/519108\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0427\u0435\u043c \u0431\u044b \u043d\u0438 \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0430\u0441\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f, \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c DNS \u0434\u043e\u043b\u0436\u043d\u0430 \u044f\u0432\u043b\u044f\u0442\u044c\u0441\u044f \u043d\u0435\u043e\u0442\u044a\u0435\u043c\u043b\u0435\u043c\u043e\u0439 \u0447\u0430\u0441\u0442\u044c\u044e \u0435\u0435 \u043f\u043b\u0430\u043d\u0430 \u043f\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0421\u043b\u0443\u0436\u0431\u044b \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0438\u043c\u0435\u043d, \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u0438\u043c\u0435\u043d\u0430 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0437\u043b\u043e\u0432 \u0432 IP-\u0430\u0434\u0440\u0435\u0441\u0430, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0432\u0441\u0435\u043c\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c\u0438 \u0438 \u0441\u043b\u0443\u0436\u0431\u0430\u043c\u0438 \u0432 \u0441\u0435\u0442\u0438. \u0415\u0441\u043b\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u043e\u043b\u0443\u0447\u0438\u0442 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u043d\u0430\u0434 DNS \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u0442\u043e \u0441\u043c\u043e\u0436\u0435\u0442 \u0431\u0435\u0437 \u043f\u0440\u043e\u0431\u043b\u0435\u043c: \u043f\u0435\u0440\u0435\u0434\u0430\u0442\u044c \u0441\u0435\u0431\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043d\u0430\u0434 \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\u0438, \u043d\u0430\u0445\u043e\u0434\u044f\u0449\u0438\u043c\u0438\u0441\u044f \u0432 \u043e\u0431\u0449\u0435\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":94322,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-94321","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0427\u0435\u043c \u0431\u044b \u043d\u0438 \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0430\u0441\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f, \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/rukovodstvo-po-bezopasnosti-dns\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0420\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 DNS | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0427\u0435\u043c \u0431\u044b \u043d\u0438 \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0430\u0441\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f, \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/rukovodstvo-po-bezopasnosti-dns\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-09-15T17:42:32+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-09-15T17:42:32+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Pr\u00edru\u010dka k bezpe\u010dnosti DNS | ProHoster","description":"\u010ci u\u017e sa spolo\u010dnos\u0165 zaober\u00e1 \u010d\u00edmko\u013evek, bezpe\u010dnos\u0165","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/rukovodstvo-po-bezopasnosti-dns","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0420\u0443\u043a\u043e\u0432\u043e\u0434\u0441\u0442\u0432\u043e \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 DNS | ProHoster","og:description":"\u0427\u0435\u043c \u0431\u044b \u043d\u0438 \u0437\u0430\u043d\u0438\u043c\u0430\u043b\u0430\u0441\u044c \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f, \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/rukovodstvo-po-bezopasnosti-dns","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-09-15T17:42:32+00:00","article:modified_time":"2020-09-15T17:42:32+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"94321","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 11:29:29","updated":"2022-09-30 08:27:56","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/94321","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=94321"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/94321\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/94322"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=94321"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=94321"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=94321"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}