{"id":97776,"date":"2020-10-21T20:42:28","date_gmt":"2020-10-21T18:42:28","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/red-teaming-kompleksnaya-imitacziya-atak-metodologiya-i-instrumenty"},"modified":"2020-10-21T20:42:28","modified_gmt":"2020-10-21T18:42:28","slug":"red-teaming-kompleksnaya-imitacziya-atak-metodologiya-i-instrumenty","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/red-teaming-kompleksnaya-imitacziya-atak-metodologiya-i-instrumenty","title":{"rendered":"Red Teaming \u2014 komplexn\u00e1 simul\u00e1cia \u00fatokov. Metodol\u00f3gia a n\u00e1stroje","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><img decoding=\"async\" alt=\"Red Teaming \u2014 komplexn\u00e1 simul\u00e1cia \u00fatokov. Metodol\u00f3gia a n\u00e1stroje\" src=\"\/wp-content\/uploads\/2020\/10\/9c219b917125bd86b6d9e544417c7548.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Zdroj: Acunetix<\/i><\/p>\n<p>Red Teaming (\u00fatok \"\u010dervenej t\u00edmu\") je komplexn\u00e1 simul\u00e1cia skuto\u010dn\u00fdch \u00fatokov s cie\u013eom vyhodnoti\u0165 kybernetick\u00fa bezpe\u010dnos\u0165 syst\u00e9mov. \"\u010cerven\u00fd t\u00edm\" je skupina <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/penetration-testing-tools\/\">pentesterov <\/a><\/noindex> (\u0161pecialistov, ktor\u00ed vykon\u00e1vaj\u00fa testy prenikania do syst\u00e9mu). M\u00f4\u017eu to by\u0165 ako najat\u00ed odborn\u00edci, tak aj zamestnanci va\u0161ej organiz\u00e1cie, ale v ka\u017edom pr\u00edpade je ich \u00falohou imitova\u0165 \u010dinnosti \u00fato\u010dn\u00edkov a pok\u00fa\u0161a\u0165 sa prenikn\u00fa\u0165 do v\u00e1\u0161ho syst\u00e9mu.<\/p>\n<p>Ved\u013ea \u201e\u010derven\u00fdch t\u00edmov\u201c v kybernetickej bezpe\u010dnosti existuj\u00fa aj \u010fal\u0161ie skupiny. Napr\u00edklad \u201emodr\u00fd t\u00edm\u201c (Blue Team) pracuje spolu s \u010derven\u00fdm t\u00edmom, ale jeho \u010dinnos\u0165 je zameran\u00e1 na zvy\u0161ovanie bezpe\u010dnosti infra\u0161trukt\u00fary syst\u00e9mu zvn\u00fatra. \u201eFialov\u00fd t\u00edm\u201c (Purple Team) je spojovac\u00edm \u010dl\u00e1nkom, ktor\u00fd pom\u00e1ha dvom ostatn\u00fdm t\u00edmom pri v\u00fdvoji \u00fatokov\u00fdch strat\u00e9gi\u00ed a ochrann\u00fdch opatren\u00ed. Napriek tomu je red teaming jednou z najmenej pochopen\u00fdch met\u00f3d riadenia kybernetickej bezpe\u010dnosti a mnoh\u00e9 organiz\u00e1cie st\u00e1le v\u00e1haj\u00fa s jej vyu\u017eit\u00edm.<br \/>\nV tomto \u010dl\u00e1nku podrobne vysvetl\u00edme, \u010do sa skr\u00fdva za pojmom Red Teaming, a ako implement\u00e1cia prakt\u00edk komplexnej simul\u00e1cie skuto\u010dn\u00fdch \u00fatokov m\u00f4\u017ee pom\u00f4c\u0165 zlep\u0161i\u0165 bezpe\u010dnos\u0165 va\u0161ej organiz\u00e1cie. Cie\u013eom \u010dl\u00e1nku je uk\u00e1za\u0165, ako t\u00e1to met\u00f3da m\u00f4\u017ee v\u00fdrazne zv\u00fd\u0161i\u0165 bezpe\u010dnos\u0165 va\u0161ich informa\u010dn\u00fdch syst\u00e9mov.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2> Red Teaming: preh\u013ead<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Red Teaming \u2014 komplexn\u00e1 simul\u00e1cia \u00fatokov. Metodol\u00f3gia a n\u00e1stroje\" src=\"\/wp-content\/uploads\/2020\/10\/25c2fe66a5b91050c9a6c8947d6c8340.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nHoci sa dnes \"\u010derven\u00e9\" a \"modr\u00e9\" t\u00edmy prim\u00e1rne sp\u00e1jaj\u00fa so sf\u00e9rou informa\u010dn\u00fdch technol\u00f3gi\u00ed a kybernetickou bezpe\u010dnos\u0165ou, tieto pojmy boli vymyslen\u00e9 vo vojne. Vlastne, pr\u00e1ve v arm\u00e1de som sa prv\u00fdkr\u00e1t stretol s t\u00fdmito pojmami. Pr\u00e1ca analytika kybernetickej bezpe\u010dnosti v 80. rokoch bola ve\u013emi odli\u0161n\u00e1 od dne\u0161nej: pr\u00edstup k za\u0161ifrovan\u00fdm po\u010d\u00edta\u010dov\u00fdm syst\u00e9mom bol ove\u013ea obmedzenej\u0161\u00ed ne\u017e dnes.<\/p>\n<p>V ostatnom mojom prvom z\u00e1\u017eitku z vojensk\u00fdch hier \u2013 modelovania, simul\u00e1cie a organiz\u00e1cie interakcie \u2013 sa proces komplexnej simul\u00e1cie \u00fatokov, ktor\u00fd sa roz\u0161\u00edril v kybernetickej bezpe\u010dnosti, v\u00fdrazne nepodobal na dne\u0161ok. Rovnako ako dnes, aj vtedy sa kl\u00e1dol obrovsk\u00fd d\u00f4raz na pou\u017e\u00edvanie met\u00f3d soci\u00e1lneho in\u017einierstva na presved\u010denie zamestnancov, aby poskytli \"nepriatelia\" neopr\u00e1vnen\u00fd pr\u00edstup k vojensk\u00fdm syst\u00e9mom. Preto, hoci technick\u00e9 met\u00f3dy simul\u00e1cie \u00fatokov sa v\u00fdrazne zlep\u0161ili v porovnan\u00ed s 80-tymi rokmi, stoj\u00ed za zmienku, \u017ee mnoh\u00e9 zo z\u00e1kladn\u00fdch n\u00e1strojov s\u00fa\u0165a\u017en\u00e9ho pr\u00edstupu, a osobitne techniky soci\u00e1lneho in\u017einierstva, s\u00fa do zna\u010dnej miery nez\u00e1visl\u00e9 od platformy.<\/p>\n<p>Hlavn\u00e1 hodnota komplexnej simul\u00e1cie re\u00e1lnych \u00fatokov sa tie\u017e od 80-tych rokov nezmenila. Imitovan\u00edm \u00fatoku na va\u0161e syst\u00e9my je jednoduch\u0161ie odhali\u0165 zranite\u013enosti a pochopi\u0165, ako m\u00f4\u017eu by\u0165 zneu\u017eit\u00e9. A hoci predt\u00fdm sa red teaming pou\u017e\u00edval predov\u0161etk\u00fdm \"bielymi hackerami\" a odborn\u00edkmi na kybernetick\u00fa bezpe\u010dnos\u0165, ktor\u00ed h\u013eadali zranite\u013enosti prostredn\u00edctvom testovania na prenikanie, dnes m\u00e1 tento pr\u00edstup ove\u013ea \u0161ir\u0161ie uplatnenie v oblasti kybernetickej bezpe\u010dnosti a podnikania.<\/p>\n<p>K\u013e\u00fa\u010dov\u00fdm aspektom red teamingu je pochopenie toho, \u017ee v skuto\u010dnosti nem\u00f4\u017eete ma\u0165 jasn\u00fa predstavu o bezpe\u010dnosti va\u0161ich syst\u00e9mov, pokia\u013e nebud\u00fa napadnut\u00e9. A namiesto toho, aby ste sa vystavovali riziku \u00fatoku od skuto\u010dn\u00fdch \u00fato\u010dn\u00edkov, je omnoho bezpe\u010dnej\u0161ie simulova\u0165 tak\u00fd \u00fatok pomocou \"\u010dervenej t\u00edmu\".<\/p>\n<h2> Red Teaming: scen\u00e1re pou\u017eitia<\/h2>\n<p>\nJednoduch\u00fd sp\u00f4sob, ako pochopi\u0165 z\u00e1klady red teamingu, je pozrie\u0165 sa na nieko\u013eko pr\u00edkladov. Tu s\u00fa dva z nich:<\/p>\n<ul>\n<li><strong>Scen\u00e1r 1.<\/strong> Predstavte si, \u017ee na str\u00e1nku slu\u017eieb z\u00e1kazn\u00edkom bol vykonan\u00fd pen test, a testovanie prebehlo \u00faspe\u0161ne. Zdalo by sa, \u017ee to nazna\u010duje, \u017ee v\u0161etko je v poriadku. Av\u0161ak nesk\u00f4r, v d\u00f4sledku komplexnej simul\u00e1cie \u00fatoku, \"\u010derven\u00fd t\u00edm\" zist\u00ed, \u017ee aj ke\u010f samotn\u00e1 aplik\u00e1cia slu\u017eieb z\u00e1kazn\u00edkom je v poriadku, funkcia extern\u00e9ho chatu nedok\u00e1\u017ee presne identifikova\u0165 osoby, \u010do umo\u017e\u0148uje oklama\u0165 z\u00e1stupcov z\u00e1kazn\u00edckej podpory, aby zmenili e-mailov\u00fa adresu v \u00fa\u010dte (v d\u00f4sledku \u010doho nov\u00fd \u010dlovek, \u00fato\u010dn\u00edk, m\u00f4\u017ee z\u00edska\u0165 pr\u00edstup).<\/li>\n<li><strong>Scen\u00e1r 2. <\/strong>V d\u00f4sledku vykon\u00e1vania penetra\u010dn\u00fdch testov sa zistilo, \u017ee v\u0161etky prostriedky na spr\u00e1vu VPN a vzdialen\u00e9ho pr\u00edstupu s\u00fa zabezpe\u010den\u00e9. Av\u0161ak nesk\u00f4r z\u00e1stupca \u201e\u010dervenej t\u00edmu\u201c bez probl\u00e9mov prech\u00e1dza okolo registra\u010dnej pultu a odn\u00e1\u0161a notebook jedn\u00e9ho z zamestnancov.<\/li>\n<\/ul>\n<p>\nV oboch vy\u0161\u0161ie uveden\u00fdch pr\u00edpadoch \u201e\u010derven\u00fd t\u00edm\u201c kontroluje nielen spo\u013eahlivos\u0165 ka\u017ed\u00e9ho syst\u00e9mu samostatne, ale aj celkov\u00fd syst\u00e9m na pr\u00edtomnos\u0165 slab\u00fdch miest.<\/p>\n<h2> Komu je potrebn\u00e1 komplexn\u00e1 imit\u00e1cia \u00fatokov?<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Red Teaming \u2014 komplexn\u00e1 simul\u00e1cia \u00fatokov. Metodol\u00f3gia a n\u00e1stroje\" src=\"\/wp-content\/uploads\/2020\/10\/885c58d274c4e57dd165bf47da13e410.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nStru\u010dne povedan\u00e9, takmer ka\u017ed\u00e1 spolo\u010dnos\u0165 m\u00f4\u017ee profitova\u0165 z red teamingu. Ako ukazuje <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/2019-data-risk-report\/\">n\u00e1\u0161 report o rizik\u00e1ch glob\u00e1lnych d\u00e1t z roku 2019.<\/a><\/noindex>, znepokojuj\u00faco ve\u013ek\u00e9 mno\u017estvo organiz\u00e1ci\u00ed \u017eije v falo\u0161nej istote, \u017ee maj\u00fa pln\u00fa kontrolu nad svojimi \u00fadajmi. Zistili sme napr\u00edklad, \u017ee v priemere 22% prie\u010dinkov spolo\u010dnosti je pr\u00edstupn\u00fdch ka\u017ed\u00e9mu zamestnancovi a \u017ee 87% firiem m\u00e1 v svojich syst\u00e9moch viac ne\u017e 1000 zastaran\u00fdch d\u00f4vern\u00fdch s\u00faborov.<\/p>\n<p>Ak va\u0161a spolo\u010dnos\u0165 nepracuje v oblasti technol\u00f3gi\u00ed, m\u00f4\u017ee sa zda\u0165, \u017ee red teaming v\u00e1m neprinesie ve\u013ea v\u00fdhod. To v\u0161ak nie je pravda. Kybernetick\u00e1 bezpe\u010dnos\u0165 nie je len ochrana d\u00f4vern\u00fdch inform\u00e1ci\u00ed.<\/p>\n<p>\u00dato\u010dn\u00edci sa rovnako sna\u017eia z\u00edska\u0165 technol\u00f3gie bez oh\u013eadu na odvetvie spolo\u010dnosti. Napr\u00edklad m\u00f4\u017eu usilova\u0165 o pr\u00edstup k va\u0161ej sieti, aby s jej pomocou zakryli svoje \u010dinnosti pri preberan\u00ed in\u00e9ho syst\u00e9mu alebo siete na inom mieste na svete. Pri tomto type \u00fatoku va\u0161e \u00fadaje \u00fato\u010dn\u00edkom nie s\u00fa potrebn\u00e9. Chc\u00fa nakazi\u0165 va\u0161e po\u010d\u00edta\u010de \u0161kodliv\u00fdm softv\u00e9rom, aby s ich pomocou premenili v\u00e1\u0161 syst\u00e9m na botnet.<\/p>\n<p>Pre mal\u00e9 spolo\u010dnosti m\u00f4\u017ee by\u0165 \u0165a\u017ek\u00e9 n\u00e1js\u0165 prostriedky na vykon\u00e1vanie red teamingu. V takom pr\u00edpade m\u00e1 zmysel poveri\u0165 vykon\u00e1vanie tohto procesu extern\u00e9ho dod\u00e1vate\u013ea.<\/p>\n<h2> Red Teaming: odpor\u00fa\u010dania<\/h2>\n<p>\nOptim\u00e1lny \u010das na vykonanie red teamingu a jeho frekvencia z\u00e1visia od sektora, v ktorom pracujete, a od vyspelosti va\u0161ich prostriedkov zabezpe\u010denia kybernetickej bezpe\u010dnosti.<\/p>\n<p>Najm\u00e4 by ste mali automatizova\u0165 tak\u00e9 \u010dinnosti, ako je vyh\u013ead\u00e1vanie akt\u00edv a anal\u00fdza zranite\u013enost\u00ed. Va\u0161a organiz\u00e1cia by mala kombinova\u0165 automatizovan\u00e9 technol\u00f3gie s \u013eudskou kontrolou, pravidelne vykon\u00e1va\u0165 komplexn\u00e9 testy prenikania.<br \/>\nPo dokon\u010den\u00ed nieko\u013ek\u00fdch obchodn\u00fdch cyklov testovania prenikania a vyh\u013ead\u00e1vania zranite\u013enost\u00ed m\u00f4\u017eete prejs\u0165 k komplexnej simul\u00e1cii re\u00e1lneho \u00fatoku. V tejto f\u00e1ze v\u00e1m red teaming prinesie v\u00fdznamn\u00fd prospech. Av\u0161ak pokus o jeho vykonanie predt\u00fdm, ako nastav\u00edte z\u00e1klady kybernetickej bezpe\u010dnosti, neprinesie vidite\u013en\u00e9 v\u00fdsledky.<\/p>\n<p>T\u00edm \u201ebielych hackerov\u201c pravdepodobne dok\u00e1\u017ee tak r\u00fdchlo a jednoducho ohrozi\u0165 nepripraven\u00fd syst\u00e9m, \u017ee z\u00edskate pr\u00edli\u0161 m\u00e1lo inform\u00e1ci\u00ed na prijatie \u010fal\u0161\u00edch opatren\u00ed. Na dosiahnutie re\u00e1lneho efektu by mali by\u0165 inform\u00e1cie z\u00edskan\u00e9 \u201e\u010derven\u00fdm t\u00edmom\u201c porovnan\u00e9 s predch\u00e1dzaj\u00facimi testami prenikania a hodnoten\u00edm zranite\u013enost\u00ed.<\/p>\n<h2> \u010co je testovanie prenikania?<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Red Teaming \u2014 komplexn\u00e1 simul\u00e1cia \u00fatokov. Metodol\u00f3gia a n\u00e1stroje\" src=\"\/wp-content\/uploads\/2020\/10\/e617ef8e900aac596c76e7e66673c779.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKomplexn\u00fa simul\u00e1ciu re\u00e1lneho \u00fatoku (Red Teaming) \u010dasto mylia s <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/varonis-six-part-guide-to-penetration-testing\/\">testovan\u00edm prenikania (pentest),<\/a><\/noindex>ale tieto dva met\u00f3dy sa trochu l\u00ed\u0161ia. Presnej\u0161ie povedan\u00e9, testovanie prenikania je len jednou z met\u00f3d red teamingu.<\/p>\n<p>\u00daloha pentestera <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/penetration-testing-explained-part-i-risky-business\/\">je dostato\u010dne jasne definovan\u00e1.<\/a><\/noindex>Pr\u00e1ca pentesterov je rozdelen\u00e1 do \u0161tyroch hlavn\u00fdch f\u00e1z: pl\u00e1novanie, zber inform\u00e1ci\u00ed, \u00fatok a reportovanie. Ako vid\u00edte, pentesteri robia viac, ne\u017e len h\u013eadaj\u00fa zranite\u013enosti softv\u00e9ru. Sna\u017eia sa postavi\u0165 na miesto hackerov a po preniknut\u00ed do v\u00e1\u0161ho syst\u00e9mu za\u010d\u00edna ich skuto\u010dn\u00e1 pr\u00e1ca.<\/p>\n<p>Objavuj\u00fa zranite\u013enosti a potom vykon\u00e1vaj\u00fa nov\u00e9 \u00fatoky na z\u00e1klade z\u00edskan\u00fdch inform\u00e1ci\u00ed, pohybuj\u00fac sa po hierarchii prie\u010dinkov. Presne t\u00fdm sa odborn\u00edci vykon\u00e1vaj\u00faci testy prenikania l\u00ed\u0161ia od t\u00fdch, ktor\u00ed s\u00fa najat\u00ed len na vyh\u013ead\u00e1vanie zranite\u013enost\u00ed pomocou softv\u00e9ru na skenovanie portov alebo detekciu v\u00edrusov. Sk\u00fasen\u00fd pentester dok\u00e1\u017ee ur\u010di\u0165:<\/p>\n<ul>\n<li>kam m\u00f4\u017eu hackeri nasmerova\u0165 svoj \u00fatok;<\/li>\n<li>sp\u00f4sob, ak\u00fdm bud\u00fa hackeri \u00fato\u010di\u0165; <\/li>\n<li>ako sa bude spr\u00e1va\u0165 va\u0161a ochrana; <\/li>\n<li>mo\u017en\u00fd rozsah poru\u0161enia. <\/li>\n<\/ul>\n<p>\nTestovanie prenikania je zameran\u00e9 na identifik\u00e1ciu nedostatkov na \u00farovni aplik\u00e1ci\u00ed a siet\u00ed, ako aj na mo\u017enosti prekonania fyzick\u00fdch bezpe\u010dnostn\u00fdch bari\u00e9r. Zatia\u013e \u010do automatizovan\u00e9 testovanie m\u00f4\u017ee odhali\u0165 niektor\u00e9 probl\u00e9my kybernetickej bezpe\u010dnosti, manu\u00e1lne testovanie prenikania zoh\u013ead\u0148uje aj zranite\u013enos\u0165 podnikania vo\u010di \u00fatokom.<\/p>\n<h2> Red Teaming vs. testovanie prenikania<\/h2>\n<p>\nNeodmyslite\u013ene, test na prenikanie je d\u00f4le\u017eit\u00fd, ale je len jednou z mnoh\u00fdch aktiv\u00edt vykon\u00e1van\u00fdch pri red teaming. \u010cinnos\u0165 '\u010dervenej t\u00edmu' m\u00e1 ove\u013ea \u0161ir\u0161ie ciele ako pen testerov, ktor\u00ed \u010dasto len usiluj\u00fa o z\u00edskanie pr\u00edstupu do siete. V red teamingu je spravidla zapojen\u00fdch viac \u013eud\u00ed, zdrojov a \u010dasu, ke\u010f\u017ee odborn\u00edci z '\u010dervenej t\u00edmu' sa hlboko zaoberaj\u00fa, aby plne pochopili skuto\u010dn\u00fa \u00farove\u0148 rizika a zranite\u013enosti v technol\u00f3gi\u00e1ch, ako aj v \u013eudsk\u00fdch a fyzick\u00fdch akt\u00edvach organiz\u00e1cie.<\/p>\n<p>Okrem toho existuj\u00fa aj \u010fal\u0161ie rozdiely. Red teaming sa zvy\u010dajne pou\u017e\u00edva organiz\u00e1ciami s vyspel\u00fdmi a rozvinut\u00fdmi opatreniami kybernetickej bezpe\u010dnosti (aj ke\u010f to v praxi nie v\u017edy plat\u00ed).<\/p>\n<p>Zvy\u010dajne s\u00fa to spolo\u010dnosti, ktor\u00e9 u\u017e vykonali testovanie prenikania a opravili v\u00e4\u010d\u0161inu n\u00e1jden\u00fdch zranite\u013enost\u00ed, a teraz h\u013eadaj\u00fa niekoho, kto sa op\u00e4\u0165 pok\u00fasi z\u00edska\u0165 pr\u00edstup k d\u00f4vern\u00fdm inform\u00e1ci\u00e1m alebo prelomi\u0165 ochranu ak\u00fdmko\u013evek sp\u00f4sobom.<br \/>\nPr\u00e1ve preto red teaming sa spolieha na t\u00edm odborn\u00edkov na bezpe\u010dnos\u0165 s\u00fastreden\u00fdch na konkr\u00e9tny cie\u013e. Zameriavaj\u00fa sa na vn\u00fatorn\u00e9 zranite\u013enosti a pou\u017e\u00edvaj\u00fa ako elektronick\u00e9, tak aj fyzick\u00e9 met\u00f3dy soci\u00e1lneho in\u017einierstva vo\u010di zamestnancom organiz\u00e1cie. Na rozdiel od pen testerov, '\u010derven\u00e9 t\u00fdmy' sa po\u010das svojich \u00fatokov nepon\u00e1h\u013eaj\u00fa, aby sa vyhli odhaleniu, ako by to urobil skuto\u010dn\u00fd kyberzlo\u010dinec.<\/p>\n<h2> V\u00fdhody red teamingu<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Red Teaming \u2014 komplexn\u00e1 simul\u00e1cia \u00fatokov. Metodol\u00f3gia a n\u00e1stroje\" src=\"\/wp-content\/uploads\/2020\/10\/0c9895d155dac3fc3e996366ec96b951.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV komplexnej simul\u00e1cii skuto\u010dn\u00fdch \u00fatokov je mnoho v\u00fdhod, no t\u00e1 najd\u00f4le\u017eitej\u0161ia \u2014 tento pr\u00edstup umo\u017e\u0148uje z\u00edska\u0165 vy\u010derp\u00e1vaj\u00faci obraz o \u00farovni kybernetickej bezpe\u010dnosti organiz\u00e1cie. Typick\u00fd proces komplexnej simul\u00e1cie \u00fatoku bude zah\u0155\u0148a\u0165 testovanie na prenikanie (sie\u0165, aplik\u00e1cia, mobiln\u00fd telef\u00f3n a in\u00e9 zariadenia), soci\u00e1lnu in\u017einieriu (v re\u00e1lnom kontakte na mieste, prostredn\u00edctvom telefonick\u00fdch hovorov, e-mailu alebo textov\u00fdch spr\u00e1v a chatu) a fyzick\u00fa infiltr\u00e1ciu (otvorenie z\u00e1mkov, objavenie m\u0155tvych z\u00f3n kamerov\u00e9ho syst\u00e9mu, ob\u00eddenie poplachov\u00fdch syst\u00e9mov). Ak existuj\u00fa ak\u00e9ko\u013evek zranite\u013en\u00e9 miesta v ktoromko\u013evek z t\u00fdchto aspektov va\u0161ej s\u00fastavy, bud\u00fa odhalen\u00e9.<\/p>\n<p>Akon\u00e1hle s\u00fa zranite\u013enosti odhalen\u00e9, je mo\u017en\u00e9 ich opravi\u0165. Efekt\u00edvny proces simul\u00e1cie \u00fatoku sa nekon\u010d\u00ed po odhalen\u00ed zranite\u013enost\u00ed. Po tom, \u010do s\u00fa nedostatky bezpe\u010dnosti jasne identifikovan\u00e9, budete chcie\u0165 pracova\u0165 na ich oprave a op\u00e4tovnom testovan\u00ed. V skuto\u010dnosti, skuto\u010dn\u00e1 pr\u00e1ca zvy\u010dajne za\u010d\u00edna po vniknut\u00ed \"\u010dervenej t\u00edmu\", ke\u010f vykon\u00e1vate kriminalistick\u00fa anal\u00fdzu \u00fatoku a sna\u017e\u00edte sa minimalizova\u0165 odhalen\u00e9 zranite\u013enosti.<\/p>\n<p>Okrem t\u00fdchto dvoch hlavn\u00fdch v\u00fdhod red teaming pon\u00faka aj mno\u017estvo \u010fal\u0161\u00edch. Tak \"\u010derven\u00fd t\u00edm\" m\u00f4\u017ee:<\/p>\n<ul>\n<li>odhali\u0165 rizik\u00e1 a zranite\u013enosti vo\u013en\u00fdch informa\u010dn\u00fdch akt\u00edv podnikania;<\/li>\n<li>modelova\u0165 met\u00f3dy, taktiku a postupy skuto\u010dn\u00fdch \u00fato\u010dn\u00edkov v prostred\u00ed s obmedzen\u00fdm a kontrolovan\u00fdm rizikom; <\/li>\n<li>vyhodnoti\u0165 schopnos\u0165 va\u0161ej organiz\u00e1cie detegova\u0165, reagova\u0165 a predch\u00e1dza\u0165 komplexn\u00fdm cielenej\u0161\u00edm hrozb\u00e1m; <\/li>\n<li>podpori\u0165 \u00fazku spolupr\u00e1cu s oddeleniami poistenia a \"modr\u00fdmi t\u00edmami\", aby zabezpe\u010dili v\u00fdrazn\u00e9 zn\u00ed\u017eenie n\u00e1sledkov a uskuto\u010dnili komplexn\u00e9 praktick\u00e9 semin\u00e1re na z\u00e1klade odhalen\u00fdch zranite\u013enost\u00ed. <\/li>\n<\/ul>\n<p><\/p>\n<h2> Ako funguje Red Teaming? <\/h2>\n<p>\nSkvel\u00fd sp\u00f4sob, ako porozumie\u0165 princ\u00edpu fungovania red teamingu, je pozrie\u0165 sa na to, ako to zvy\u010dajne prebieha. Be\u017en\u00fd proces komplexnej simul\u00e1cie \u00fatokov pozost\u00e1va z nieko\u013ek\u00fdch krokov:<\/p>\n<ul>\n<li>Organiz\u00e1cia sa dohodne s \"\u010derven\u00fdm t\u00edmom\" (vn\u00fatorn\u00fdm alebo extern\u00fdm) na cieli uskuto\u010dnen\u00e9ho \u00fatoku. Napr\u00edklad tak\u00fdmto cie\u013eom m\u00f4\u017ee by\u0165 vy\u0165a\u017eenie d\u00f4vern\u00fdch inform\u00e1ci\u00ed z ur\u010dit\u00e9ho servera.<\/li>\n<li>Potom \"\u010derven\u00fd t\u00edm\" vykon\u00e1va prieskum cie\u013ea. V d\u00f4sledku toho sa zostavuje sch\u00e9ma cie\u013eov\u00fdch syst\u00e9mov, vr\u00e1tane sie\u0165ov\u00fdch slu\u017eieb, webov\u00fdch aplik\u00e1ci\u00ed a intern\u00fdch port\u00e1lov pre zamestnancov.<\/li>\n<li>Po tomto sa v cie\u013eovom syst\u00e9me h\u013eadaj\u00fa zranite\u013enosti, ktor\u00e9 sa zvy\u010dajne realizuj\u00fa prostredn\u00edctvom phishingu alebo XSS \u00fatokov.<\/li>\n<li>Akon\u00e1hle s\u00fa z\u00edskan\u00e9 tokeny na pr\u00edstup, \"\u010derven\u00fd t\u00edm\" ich pou\u017e\u00edva na sk\u00famanie \u010fal\u0161\u00edch zranite\u013enost\u00ed.<\/li>\n<li>Pri zisten\u00ed \u010fal\u0161\u00edch zranite\u013enost\u00ed sa \"\u010derven\u00fd t\u00edm\" bude sna\u017ei\u0165 zv\u00fd\u0161i\u0165 svoju \u00farove\u0148 pr\u00edstupu na po\u017eadovan\u00fa \u00farove\u0148 na dosiahnutie cie\u013ea.<\/li>\n<li>Ke\u010f z\u00edska pr\u00edstup k cie\u013eov\u00fdm \u00fadajom alebo akt\u00edvu, \u00faloha \u00fatoku sa pova\u017euje za splnen\u00fa.<\/li>\n<\/ul>\n<p>\nV skuto\u010dnosti sk\u00fasen\u00fd \u0161pecialista \"\u010derven\u00e9ho t\u00edmu\" pou\u017eije mno\u017estvo r\u00f4znych met\u00f3d na prechod ka\u017ed\u00fdm z uveden\u00fdch krokov. K\u013e\u00fa\u010dov\u00fdm zisten\u00edm z uveden\u00e9ho pr\u00edkladu je v\u0161ak to, \u017ee drobn\u00e9 zranite\u013enosti v jednotliv\u00fdch syst\u00e9moch m\u00f4\u017eu prer\u00e1s\u0165 do katastrofick\u00fdch zlyhan\u00ed, ak s\u00fa spojen\u00e9 do re\u0165azca.<\/p>\n<h2> \u010co by ste mali zv\u00e1\u017ei\u0165 pri kontakte s \"\u010derven\u00fdm t\u00edmom\"? <\/h2>\n<p>\n<img decoding=\"async\" alt=\"Red Teaming \u2014 komplexn\u00e1 simul\u00e1cia \u00fatokov. Metodol\u00f3gia a n\u00e1stroje\" src=\"\/wp-content\/uploads\/2020\/10\/70892885775ca71b132d6a3b4321923a.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAby ste z\u00edskali maxim\u00e1lny \u00fa\u017eitok z red teamingu, je potrebn\u00e9 starostlivo sa pripravi\u0165. Syst\u00e9my a procesy, ktor\u00e9 pou\u017e\u00edva ka\u017ed\u00e1 organiz\u00e1cia, sa l\u00ed\u0161ia a kvalitn\u00fd \u00farove\u0148 red teamingu sa dosahuje, ke\u010f je zameran\u00fd na h\u013eadanie zranite\u013enost\u00ed konkr\u00e9tne vo va\u0161ich syst\u00e9moch. Preto je d\u00f4le\u017eit\u00e9 zoh\u013eadni\u0165 nieko\u013eko faktorov:<\/p>\n<h3>Vedzte, \u010do h\u013ead\u00e1te<\/h3>\n<p>\nPredov\u0161etk\u00fdm je d\u00f4le\u017eit\u00e9 pochopi\u0165, ktor\u00e9 syst\u00e9my a procesy chcete preveri\u0165. Mo\u017eno viete, \u017ee chcete testova\u0165 webov\u00fa aplik\u00e1ciu, ale ve\u013emi dobre nerozumiete, \u010do to vlastne znamen\u00e1 a ak\u00e9 \u010fal\u0161ie syst\u00e9my s\u00fa integrovan\u00e9 s va\u0161imi webov\u00fdmi aplik\u00e1ciami. Preto je d\u00f4le\u017eit\u00e9, aby ste dobre rozumeli svojim vlastn\u00fdm syst\u00e9mom a opravili v\u0161etky jasn\u00e9 zranite\u013enosti, sk\u00f4r ne\u017e za\u010dnete komplexn\u00fa simul\u00e1ciu skuto\u010dn\u00e9ho \u00fatoku.<\/p>\n<h3>Poznajte svoju sie\u0165<\/h3>\n<p>\nToto s\u00favis\u00ed s predch\u00e1dzaj\u00facou odpor\u00fa\u010dan\u00edm, ale viac sa zameriava na technick\u00e9 vlastnosti va\u0161ej siete. \u010c\u00edm lep\u0161ie budete schopn\u00ed kvantitat\u00edvne pos\u00fadi\u0165 prostredie testovania, t\u00fdm presnej\u0161ie a konkr\u00e9tnej\u0161ie bude kona\u0165 v\u00e1\u0161 \"\u010derven\u00fd t\u00edm\".<\/p>\n<h3>Poznajte svoj rozpo\u010det<\/h3>\n<p>\nRed teaming sa m\u00f4\u017ee uskuto\u010d\u0148ova\u0165 na r\u00f4znych \u00farovniach, no imit\u00e1cia cel\u00e9ho spektra \u00fatokov na va\u0161u sie\u0165, vr\u00e1tane soci\u00e1lneho in\u017einierstva a fyzickej infiltr\u00e1cie, m\u00f4\u017ee by\u0165 n\u00e1kladn\u00e1 z\u00e1le\u017eitos\u0165. Z tohto d\u00f4vodu je d\u00f4le\u017eit\u00e9 pochopi\u0165, ko\u013eko m\u00f4\u017eete na tak\u00fato kontrolu investova\u0165 a pod\u013ea toho stanovi\u0165 jej rozsah.<\/p>\n<h3>Poznajte svoju \u00farove\u0148 rizika<\/h3>\n<p>\nNiektor\u00e9 organiz\u00e1cie m\u00f4\u017eu akceptova\u0165 pomerne vysok\u00fa \u00farove\u0148 rizika v r\u00e1mci svojich \u0161tandardn\u00fdch podnikov\u00fdch proced\u00far. In\u00fdm bude nutn\u00e9 v\u00fdrazne obmedzi\u0165 svoju \u00farove\u0148 rizika, najm\u00e4 ak spolo\u010dnos\u0165 p\u00f4sob\u00ed v silne regulovanej oblasti. Preto je pri vykon\u00e1van\u00ed red teamingu d\u00f4le\u017eit\u00e9 s\u00fastredi\u0165 sa na rizik\u00e1, ktor\u00e9 skuto\u010dne predstavuj\u00fa hrozbu pre va\u0161e podnikanie.<\/p>\n<h2> Red Teaming: n\u00e1stroje a taktiky<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Red Teaming \u2014 komplexn\u00e1 simul\u00e1cia \u00fatokov. Metodol\u00f3gia a n\u00e1stroje\" src=\"\/wp-content\/uploads\/2020\/10\/a3d807258e5254ebdd025e76076f7915.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPri spr\u00e1vnej aplik\u00e1cii \"\u010derven\u00fd t\u00edm\" vykon\u00e1 komplexn\u00fd \u00fatok na va\u0161e siete s pou\u017eit\u00edm v\u0161etk\u00fdch n\u00e1strojov a met\u00f3d, ktor\u00e9 pou\u017e\u00edva hacker. Medzi in\u00fdm sem patr\u00ed:<\/p>\n<ul>\n<li><strong>Testovanie aplik\u00e1ci\u00ed na prenikanie <\/strong>\u2014 zameran\u00e9 na identifik\u00e1ciu zranite\u013enost\u00ed na \u00farovni aplik\u00e1ci\u00ed, ako s\u00fa kr\u00ed\u017eov\u00e9 podvodn\u00e9 po\u017eiadavky, nedostatky v zad\u00e1van\u00ed \u00fadajov, slab\u00e9 riadenie rel\u00e1ci\u00ed a mnoh\u00e9 \u010fal\u0161ie.<\/li>\n<li><strong>Testovanie siete na prenikanie <\/strong>\u2014 zameran\u00e9 na identifik\u00e1ciu zranite\u013enost\u00ed na \u00farovni siete a syst\u00e9mu, vr\u00e1tane nespr\u00e1vnych konfigur\u00e1ci\u00ed, zranite\u013enost\u00ed bezdr\u00f4tovej siete, neautorizovan\u00fdch slu\u017eieb a mnoh\u00fdch \u010fal\u0161\u00edch. <\/li>\n<li><strong>Fyzick\u00e9 testovanie na prenikanie<\/strong> \u2014 kontrola efekt\u00edvnosti, ako aj siln\u00fdch a slab\u00fdch str\u00e1n fyzick\u00fdch bezpe\u010dnostn\u00fdch kontrol v re\u00e1lnom \u017eivote. <\/li>\n<li><strong>Soci\u00e1lne in\u017einierstvo <\/strong>\u2014 zameriava sa na vyu\u017e\u00edvanie slabost\u00ed \u013eud\u00ed a \u013eudskej prirodzenosti, testovanie n\u00e1chylnosti \u013eud\u00ed na podvody, presvied\u010danie a manipul\u00e1cie prostredn\u00edctvom phishingu cez e-mail, telefonick\u00e9 hovory a textov\u00e9 spr\u00e1vy, ako aj pri fyzickej interakcii na mieste. <\/li>\n<\/ul>\n<p>\nV\u0161etko, \u010do bolo uveden\u00e9, tvoria zlo\u017eky red teamingu. Ide o komplexn\u00e9 viac\u00farov\u0148ov\u00e9 modelovanie \u00fatoku, ktor\u00e9 m\u00e1 ur\u010di\u0165, ako dobre va\u0161i \u013eudia, siete, aplik\u00e1cie a fyzick\u00e9 bezpe\u010dnostn\u00e9 kontroln\u00e9 prostriedky m\u00f4\u017eu \u010deli\u0165 \u00fatoku skuto\u010dn\u00e9ho \u00fato\u010dn\u00edka. <\/p>\n<h2>Trval\u00fd rozvoj met\u00f3d Red Teaming<\/h2>\n<p>\nPovaha komplexnej simul\u00e1cie skuto\u010dn\u00fdch \u00fatokov, pri ktor\u00fdch sa \"\u010derven\u00e9 t\u00edmy\" sna\u017eia n\u00e1js\u0165 nov\u00e9 zranite\u013enosti v bezpe\u010dnostnom syst\u00e9me, zatia\u013e \u010do \"modr\u00e9 t\u00edmy\" sa sna\u017eia opravi\u0165 ich, vedie k neust\u00e1lemu v\u00fdvoju met\u00f3d t\u00fdchto kontrol. Z tohto d\u00f4vodu je \u0165a\u017ek\u00e9 zostavi\u0165 aktu\u00e1lny zoznam modern\u00fdch techn\u00edk red teaming, ke\u010f\u017ee r\u00fdchlo zastar\u00e1vaj\u00fa.<\/p>\n<p>Preto v\u00e4\u010d\u0161ina odborn\u00edkov, ktor\u00ed vykon\u00e1vaj\u00fa red teaming, str\u00e1vi aspo\u0148 \u010das\u0165 svojho \u010dasu \u0161t\u00fadiom nov\u00fdch zranite\u013enost\u00ed a met\u00f3d ich zneu\u017eitia, pri\u010dom vyu\u017e\u00edva mno\u017estvo zdrojov, ktor\u00e9 poskytuje komunita \"\u010derven\u00fdch t\u00edmov\". Tu s\u00fa najpopul\u00e1rnej\u0161ie z t\u00fdchto komun\u00edt:<\/p>\n<ul>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.pentesteracademy.com\/\">Pentester Academy <\/a><\/noindex>\u2014 je to predplatn\u00fd servis, ktor\u00fd pon\u00faka online videokurzy, venovan\u00e9 predov\u0161etk\u00fdm testovaniu prenikania, ako aj kurzy o forenzn\u00fdch vy\u0161etreniach opera\u010dn\u00fdch syst\u00e9mov, \u00faloh\u00e1ch soci\u00e1lneho in\u017einierstva a assemblerovom jazyku na ochranu inform\u00e1ci\u00ed.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.linkedin.com\/in\/vincent-yiu\/\">Vincent Yiu <\/a><\/noindex>\u2014 \"oper\u00e1tor ofenz\u00edvnej kybernetickej bezpe\u010dnosti\", ktor\u00fd pravidelne vedie blog o met\u00f3dach komplexnej simul\u00e1cie skuto\u010dn\u00fdch \u00fatokov a je dobr\u00fdm zdrojom nov\u00fdch pr\u00edstupov.<\/li>\n<li>Twitter je tie\u017e dobr\u00fdm zdrojom, ak h\u013ead\u00e1te aktu\u00e1lne inform\u00e1cie o red teamingu. M\u00f4\u017eete ich n\u00e1js\u0165 pod\u013ea hashtagov <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/hashtag\/redteam\">#redteam<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/hashtag\/redteaming\">#redteaming<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/DanielMiessler\">Daniel Miessler<\/a><\/noindex> \u2014 \u010fal\u0161\u00ed sk\u00fasen\u00fd odborn\u00edk na red teaming, ktor\u00fd vyd\u00e1va informa\u010dn\u00fd bulletin a <noindex><a rel=\"nofollow\" href=\"https:\/\/overcast.fm\/+GrY_qF4ss\">podcast<\/a><\/noindex>, vedie<noindex><a rel=\"nofollow\" href=\"https:\/\/danielmiessler.com\/\"> webov\u00fa str\u00e1nku<\/a><\/noindex> a ve\u013ea p\u00ed\u0161e o modern\u00fdch trendoch \"\u010derven\u00fdch t\u00edmov\". Medzi jeho posledn\u00e9 \u010dl\u00e1nky patr\u00ed: <noindex><a rel=\"nofollow\" href=\"https:\/\/danielmiessler.com\/blog\/purple-team-pentests-mean-youre-failing-at-red-and-blue\/\">\"Pentest purpurn\u00e9ho t\u00edmu znamen\u00e1, \u017ee va\u0161e \u010derven\u00e9 a modr\u00e9 t\u00edmy zlyhali\"<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/danielmiessler.com\/blog\/when-vulnerability-assessments-pentesting-red-team-bug-bounties\/\">\"Ceny za objaven\u00e9 zranite\u013enosti a kedy pou\u017ei\u0165 hodnotenie zranite\u013enost\u00ed, test na prenikanie a komplexn\u00fa simul\u00e1ciu \u00fatoku\"<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/portswigger.net\/daily-swig\">Daily Swig<\/a><\/noindex> \u2014 je informa\u010dn\u00fd bulletin o webovej bezpe\u010dnosti, ktor\u00fd sponzoruje PortSwigger Web Security. Je to dobr\u00fd zdroj na z\u00edskanie inform\u00e1ci\u00ed o inov\u00e1ci\u00e1ch a novink\u00e1ch v oblasti red teamingu \u2014 hackovania, \u00fanikov d\u00e1t, exploitov, zranite\u013enost\u00ed webov\u00fdch aplik\u00e1ci\u00ed a nov\u00fdch bezpe\u010dnostn\u00fdch technol\u00f3gi\u00e1ch.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/HanseSecure\">Florian Hansemann <\/a><\/noindex>\u2014 \"biely hacker\" a odborn\u00edk na testovanie prenikania, pravidelne informuje o nov\u00fdch taktik\u00e1ch \"\u010dervenej t\u00edmu\" vo svojom <noindex><a rel=\"nofollow\" href=\"https:\/\/hansesecure.de\/blog\/\">blogu<\/a><\/noindex>.<\/li>\n<li>MWR labs \u2014 dobr\u00fd, hoci extr\u00e9mne technick\u00fd zdroj noviniek o red teamingu. Publikuj\u00fa u\u017eito\u010dn\u00e9 inform\u00e1cie pre \u010derven\u00e9 t\u00edmy <noindex><a rel=\"nofollow\" href=\"https:\/\/labs.mwrinfosecurity.com\/tools\/\">n\u00e1stroje<\/a><\/noindex>, a ich <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/mwrlabs\">Twitter feed <\/a><\/noindex>contains tips for solving problems faced by security testing professionals.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/Alra3ees\">Emad Shanab<\/a><\/noindex> \u2014 a lawyer and 'white hat' hacker. His Twitter feed offers methods useful for 'red teams', such as crafting SQL injections and forging OAuth tokens.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/attack.mitre.org\/wiki\/Main_Page\">Mitreho Advers\u00e1rne Taktiky, Techniky a Be\u017en\u00e9 znalosti<\/a><\/noindex> (ATT &amp; CK) \u2014 a curated knowledge base on adversary behavior. It tracks the lifecycle phases of adversaries and the platforms they target.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/www.amazon.com\/Hacker-Playbook-Practical-Penetration-Testing-ebook\/dp\/B07CSPFYZ2\">The Hacker Playbook<\/a><\/noindex> \u2014 a hacker's guide that, while somewhat outdated, covers many fundamental methods still at the core of comprehensive real attack simulations. The author, Peter Kim, also has <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/hackerplaybook?lang=en\">Twitter feed<\/a><\/noindex>, in which he offers hacking tips and additional information.<\/li>\n<li>SANS Institute is another major provider of cybersecurity training materials. Their <noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/sansforensics\">Twitter channel<\/a><\/noindex>, dedicated to digital forensics and incident response, features the latest news on SANS courses and expert practical advice.<\/li>\n<li>Some of the most interesting new insights on red teaming have been published in <noindex><a rel=\"nofollow\" href=\"https:\/\/redteamjournal.com\/\">Red Team Journal<\/a><\/noindex>. It includes technology-focused articles such as comparisons of Red Teaming with penetration testing, as well as analytical pieces like 'The Red Team Specialist Manifesto'.<\/li>\n<li>Finally, Awesome Red Teaming is a GitHub community that offers <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/yeyintminthuhtut\/Awesome-Red-Teaming\">a very detailed list <\/a><\/noindex>of resources dedicated to Red Teaming. It covers nearly all technical aspects of 'red team' activities, from gaining initial access and executing malicious actions to data collection and extraction.<\/li>\n<\/ul>\n<p><\/p>\n<h2> 'Blue team' \u2014 what is it?<\/h2>\n<p>\n<img decoding=\"async\" alt=\"Red Teaming \u2014 komplexn\u00e1 simul\u00e1cia \u00fatokov. Metodol\u00f3gia a n\u00e1stroje\" src=\"\/wp-content\/uploads\/2020\/10\/9400932d18d0368c694e85087d026a16.jpeg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nWith so many 'colored' teams, it can be challenging to determine which type your organization needs.<\/p>\n<p>Jednou z alternat\u00edv \"\u010dervenej t\u00edmu\", presnej\u0161ie in\u00fdm typom t\u00edmu, ktor\u00fd m\u00f4\u017ee by\u0165 pou\u017eit\u00fd spolu s \"\u010derven\u00fdm t\u00edmom\", je \"modr\u00fd t\u00edm\". \"Modr\u00fd t\u00edm\" taktie\u017e hodnot\u00ed bezpe\u010dnos\u0165 siete a odha\u013euje ak\u00e9ko\u013evek mo\u017en\u00e9 zranite\u013enosti infra\u0161trukt\u00fary. Av\u0161ak m\u00e1 in\u00fd cie\u013e. T\u00edmy tohto typu s\u00fa potrebn\u00e9 na h\u013eadanie sp\u00f4sobov, ako chr\u00e1ni\u0165, meni\u0165 a reorganizova\u0165 obrann\u00e9 mechanizmy, aby sa reakcia na incidenty stala ove\u013ea efekt\u00edvnej\u0161ou.<\/p>\n<p>Rovnako ako \"\u010derven\u00fd t\u00edm\", aj modr\u00fd by mal ovl\u00e1da\u0165 rovnak\u00e9 znalosti o taktik\u00e1ch \u00fato\u010dn\u00edkov, technik\u00e1ch a postupoch, aby na ich z\u00e1klade vytv\u00e1ral strat\u00e9gie reakcie. Av\u0161ak povinnosti \"modr\u00e9ho t\u00edmu\" nie s\u00fa obmedzen\u00e9 len na obranu proti \u00fatokom. Z\u00fa\u010dast\u0148uje sa tie\u017e na posil\u0148ovan\u00ed celej infra\u0161trukt\u00fary bezpe\u010dnosti, pri\u010dom vyu\u017e\u00edva napr\u00edklad syst\u00e9m detekcie naru\u0161enia (IDS), ktor\u00fd zabezpe\u010duje nepretr\u017eit\u00fa anal\u00fdzu neobvyklej a podozrivej aktivity.<\/p>\n<p>Tu s\u00fa niektor\u00e9 z krokov, ktor\u00e9 \"modr\u00fd t\u00edm\" vykon\u00e1va:<\/p>\n<ul>\n<li>audit bezpe\u010dnosti, konkr\u00e9tne audit DNS;<\/li>\n<li>anal\u00fdza z\u00e1znamov a pam\u00e4te; <\/li>\n<li>anal\u00fdza paketov sie\u0165ov\u00fdch d\u00e1t; <\/li>\n<li>anal\u00fdza d\u00e1t o rizik\u00e1ch; <\/li>\n<li>anal\u00fdza digit\u00e1lnej stopy; <\/li>\n<li>reverzn\u00e9 in\u017einierstvo; <\/li>\n<li>DDoS testovanie; <\/li>\n<li>v\u00fdvoj scen\u00e1rov realiz\u00e1cie riz\u00edk. <\/li>\n<\/ul>\n<p><\/p>\n<h3>Rozdiely medzi \u010derven\u00fdm a modr\u00fdm t\u00edmom<\/h3>\n<p>\nRoz\u0161\u00edren\u00e1 ot\u00e1zka pre mnoh\u00e9 organiz\u00e1cie: ktor\u00fd t\u00edm by mali pou\u017e\u00edva\u0165 \u2014 \u010derven\u00fd alebo modr\u00fd. T\u00e1to ot\u00e1zka je \u010dasto sprev\u00e1dzan\u00e1 priate\u013eskou nevra\u017eivos\u0165ou medzi \u013eu\u010fmi, ktor\u00ed pracuj\u00fa \"na opa\u010dn\u00fdch stran\u00e1ch barik\u00e1dy\". V skuto\u010dnosti v\u0161ak \u017eiaden t\u00edm nem\u00e1 zmysel bez druh\u00e9ho. Tak\u017ee spr\u00e1vna odpove\u010f na t\u00fato ot\u00e1zku znie \u2014 d\u00f4le\u017eit\u00e9 s\u00fa oba t\u00edm.<\/p>\n<p>\"\u010cerven\u00fd t\u00edm\" \u00fato\u010d\u00ed a sl\u00fa\u017ei na overenie pripravenej \u00falohy \"modr\u00e9ho t\u00edmu\" na obranu. Niekedy m\u00f4\u017ee \"\u010derven\u00fd t\u00edm\" objavi\u0165 zranite\u013enosti, ktor\u00e9 \"modr\u00fd t\u00edm\" \u00faplne prehliadol, a v tomto pr\u00edpade by \"\u010derven\u00fd t\u00edm\" mal uk\u00e1za\u0165, ako m\u00f4\u017eu by\u0165 tieto zranite\u013enosti opraven\u00e9.<\/p>\n<p>Pre obe t\u00edmy je z\u00e1sadn\u00e9 spolupracova\u0165 proti kyberzlo\u010dincom na posilnen\u00ed informa\u010dnej bezpe\u010dnosti.<\/p>\n<p>Z tohto d\u00f4vodu nem\u00e1 zmysel vybera\u0165 si iba jednu stranu alebo investova\u0165 len do jedn\u00e9ho typu t\u00edmu. Je d\u00f4le\u017eit\u00e9 si uvedomi\u0165, \u017ee cie\u013eom oboch str\u00e1n je prevencia kybernetick\u00fdch zlo\u010dinov.<br \/>\nIn\u00fdmi slovami, spolo\u010dnosti musia podpori\u0165 vz\u00e1jomn\u00fa spolupr\u00e1cu oboch t\u00edmov, aby zabezpe\u010dili komplexn\u00fd audit \u2013 s protokolmi v\u0161etk\u00fdch vykonan\u00fdch \u00fatokov a kontrol, ako aj z\u00e1znamami o objaven\u00fdch anom\u00e1li\u00e1ch.<\/p>\n<p>\u010cerven\u00fd t\u00edm poskytuje inform\u00e1cie o oper\u00e1ci\u00e1ch, ktor\u00e9 vykonali po\u010das simul\u00e1cie \u00fatoku, zatia\u013e \u010do modr\u00fd t\u00edm informuje o opatreniach, ktor\u00e9 prijali na vyplnenie medzier a odstr\u00e1nenie n\u00e1jden\u00fdch zranite\u013enost\u00ed.<\/p>\n<p>D\u00f4le\u017eitos\u0165 oboch t\u00edmov nemo\u017eno podce\u0148ova\u0165. Bez ich neust\u00e1leho auditu bezpe\u010dnosti, vykon\u00e1vania testovania na prenikanie a zdokona\u013eovania infra\u0161trukt\u00fary by spolo\u010dnosti nevedeli o stave svojej vlastnej bezpe\u010dnosti. Aspo\u0148 do okamihu, kedy d\u00f4jde k \u00faniku \u00fadajov, a stane sa bolestne jasn\u00e9, \u017ee bezpe\u010dnostn\u00fdch opatren\u00ed bolo nedostato\u010dne.<\/p>\n<h3>\u010co je to \"purpurov\u00fd t\u00edm\"?<\/h3>\n<p>\n\"Purpurov\u00fd t\u00edm\" vznikol ako snaha o spojenie \u010derven\u00e9ho a modr\u00e9ho t\u00edmu. \"Purpurov\u00fd t\u00edm\" je sk\u00f4r koncept a nie samostatn\u00fd typ t\u00edmu. Je lep\u0161ie ho pova\u017eova\u0165 za kombin\u00e1ciu \u010derven\u00e9ho a modr\u00e9ho t\u00edmu. Zapojuje oba t\u00edmy a pom\u00e1ha im spolupracova\u0165.<\/p>\n<p>\"Purpurov\u00fd t\u00edm\" m\u00f4\u017ee pom\u00f4c\u0165 bezpe\u010dnostn\u00fdm slu\u017eb\u00e1m zv\u00fd\u0161i\u0165 efektivitu pri odha\u013eovan\u00ed zranite\u013enost\u00ed, vyh\u013ead\u00e1van\u00ed hrozieb a monitorovan\u00ed siete pomocou presn\u00e9ho modelovania be\u017en\u00fdch scen\u00e1rov ohrozenia a pomoci pri vytv\u00e1ran\u00ed nov\u00fdch met\u00f3d detekcie a prevencie hrozieb.<\/p>\n<p>Niektor\u00e9 organiz\u00e1cie zap\u00e1jaj\u00fa \"purpurov\u00fd t\u00edm\" na jednorazov\u00e9 cie\u013eov\u00e9 akcie, pri ktor\u00fdch s\u00fa jasne definovan\u00e9 ciele bezpe\u010dnosti, term\u00edny a k\u013e\u00fa\u010dov\u00e9 v\u00fdsledky. To zah\u0155\u0148a uznanie nedostatkov v \u00fatoku a obrane, ako aj ur\u010denie bud\u00facich po\u017eiadaviek na \u0161kolenie a technol\u00f3gie.<\/p>\n<p>Alternat\u00edvny pr\u00edstup, ktor\u00fd v s\u00fa\u010dasnosti z\u00edskava popularitu, spo\u010d\u00edva v tom, \u017ee \"purpurov\u00fd t\u00edm\" je ch\u00e1pan\u00fd ako koncep\u010dn\u00fd model, ktor\u00fd funguje v celej organiz\u00e1cii, pri\u010dom podporuje vytv\u00e1ranie kult\u00fary kybernetickej bezpe\u010dnosti a jej neust\u00e1leho zlep\u0161ovania.<\/p>\n<h2> Z\u00e1ver<\/h2>\n<p>\nRed Teaming, alebo komplexn\u00e1 simul\u00e1cia \u00fatokov \u2014 je to mocn\u00e1 met\u00f3da testovania zranite\u013enost\u00ed bezpe\u010dnostn\u00e9ho syst\u00e9mu organiz\u00e1cie, av\u0161ak je potrebn\u00e9 ju aplikova\u0165 opatrne. Najm\u00e4 pre jej aplik\u00e1ciu je potrebn\u00e9 ma\u0165 dostato\u010dne <noindex><a rel=\"nofollow\" href=\"https:\/\/www.varonis.com\/blog\/cybersecurity-tips\/\">rozvinut\u00e9 prostriedky na ochranu informa\u010dnej bezpe\u010dnosti<\/a><\/noindex>, inak nemus\u00ed splni\u0165 o\u010dak\u00e1vania, ktor\u00e9 s\u00fa na \u0148u kladen\u00e9.<br \/>\nRed Teaming m\u00f4\u017ee odhali\u0165 zranite\u013enosti v\u00e1\u0161ho syst\u00e9mu, o ktor\u00fdch ste ani len netu\u0161ili, a pom\u00f4c\u0165 ich odstr\u00e1ni\u0165. Aplikovan\u00edm s\u00fa\u0165a\u017en\u00e9ho pr\u00edstupu medzi modr\u00fdmi a \u010derven\u00fdmi t\u00edmami m\u00f4\u017eete simulova\u0165 \u010dinnosti skuto\u010dn\u00e9ho hackera, ktor\u00fd by sa mohol pok\u00fasi\u0165 ukradn\u00fa\u0165 va\u0161e d\u00e1ta alebo po\u0161kodi\u0165 va\u0161e akt\u00edva.<br \/>\n<br \/>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/varonis\/blog\/524308\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a: Acunetix Red Teaming (\u0430\u0442\u0430\u043a\u0430 \u00ab\u043a\u0440\u0430\u0441\u043d\u043e\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u044b\u00bb) \u2013 \u044d\u0442\u043e \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u0430\u044f \u0438\u043c\u0438\u0442\u0430\u0446\u0438\u044f \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0442\u0430\u043a \u0441 \u0446\u0435\u043b\u044c\u044e \u043e\u0446\u0435\u043d\u043a\u0438 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0441\u0438\u0441\u0442\u0435\u043c. \u00ab\u041a\u0440\u0430\u0441\u043d\u0430\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u0430\u00bb \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u0433\u0440\u0443\u043f\u043f\u0443 \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u043e\u0432 (\u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u043e\u0432, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0449\u0438\u0445 \u0442\u0435\u0441\u0442 \u043d\u0430 \u043f\u0440\u043e\u043d\u0438\u043a\u043d\u043e\u0432\u0435\u043d\u0438\u0435 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443). \u041e\u043d\u0438 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043a\u0430\u043a \u043d\u0430\u043d\u044f\u0442\u044b\u043c\u0438 \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b, \u0442\u0430\u043a \u0438 \u0441\u043e\u0442\u0440\u0443\u0434\u043d\u0438\u043a\u0430\u043c\u0438 \u0432\u0430\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438, \u043d\u043e \u0432\u043e \u0432\u0441\u0435\u0445 \u0441\u043b\u0443\u0447\u0430\u044f\u0445 \u0438\u0445 \u0440\u043e\u043b\u044c \u043e\u0434\u0438\u043d\u0430\u043a\u043e\u0432\u0430 \u2014 \u0438\u043c\u0438\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":97777,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-97776","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/red-teaming-kompleksnaya-imitacziya-atak-metodologiya-i-instrumenty\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Red Teaming \u2014 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u0430\u044f \u0438\u043c\u0438\u0442\u0430\u0446\u0438\u044f \u0430\u0442\u0430\u043a. \u041c\u0435\u0442\u043e\u0434\u043e\u043b\u043e\u0433\u0438\u044f \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b | ProHoster\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/red-teaming-kompleksnaya-imitacziya-atak-metodologiya-i-instrumenty\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-21T18:42:28+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-21T18:42:28+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Red Teaming \u2014 komplexn\u00e1 simul\u00e1cia \u00fatokov. Metodol\u00f3gia a n\u00e1stroje | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/red-teaming-kompleksnaya-imitacziya-atak-metodologiya-i-instrumenty","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Red Teaming \u2014 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u0430\u044f \u0438\u043c\u0438\u0442\u0430\u0446\u0438\u044f \u0430\u0442\u0430\u043a. \u041c\u0435\u0442\u043e\u0434\u043e\u043b\u043e\u0433\u0438\u044f \u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u044b | ProHoster","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/red-teaming-kompleksnaya-imitacziya-atak-metodologiya-i-instrumenty","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-21T18:42:28+00:00","article:modified_time":"2020-10-21T18:42:28+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"97776","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:13:06","updated":"2022-09-27 23:41:29","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/97776","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=97776"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/97776\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/97777"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=97776"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=97776"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=97776"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}