{"id":31628,"date":"2019-10-31T21:42:14","date_gmt":"2019-10-31T18:42:14","guid":{"rendered":"https:\/\/prohoster.info\/blog\/informatsionnaya-bezopasnost-apparatnyh-reshenij-usb-over-ip\/"},"modified":"2019-10-31T21:42:14","modified_gmt":"2019-10-31T18:42:14","slug":"informatsionnaya-bezopasnost-apparatnyh-reshenij-usb-over-ip","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/informatsionnaya-bezopasnost-apparatnyh-reshenij-usb-over-ip","title":{"rendered":"Informacijska sigurnost hardverskih rje\u0161enja USB over IP","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Nedavno sem delil <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/445094\/\">izku\u0161nje pri iskanju re\u0161itev za organizacijo centraliziranega dostopa do klju\u010dev elektronske za\u0161\u010dite<\/a><\/noindex> v na\u0161i organizaciji. V komentarjih so bili dvignjeni resni pomisleki glede informacijske varnosti strojnih re\u0161itev USB over IP, kar nas prav tako zelo skrbi.<\/p>\n<p>Torej, najprej se moramo dogovoriti o izhodi\u0161\u010dnih pogojih. <\/p>\n<ul>\n<li>Veliko \u0161tevilo klju\u010dev elektronske za\u0161\u010dite.<\/li>\n<li>Dostop do njih je potreben iz razli\u010dnih geografskih lokacij.<\/li>\n<li>Obravnavamo samo strojne re\u0161itve USB over IP in posku\u0161amo to re\u0161itev za\u0161\u010dititi z dodatnimi organizacijskimi in tehni\u010dnimi ukrepi (vpra\u0161anje alternativ zaenkrat ne obravnavamo).<\/li>\n<li>V okviru \u010dlanka ne bom v celoti opisoval obravnavanih modelov gro\u017eenj (veliko lahko preberete v <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/422329\/\">publication<\/a><\/noindex>), ampak se bom osredoto\u010dil na dva vidika. Iz modela izklju\u010dujemo socialno in\u017eenirstvo in nezakonita dejanja samih uporabnikov. Obravnavajmo mo\u017enosti nepoobla\u0161\u010denega dostopa do USB naprav iz katere koli od mre\u017e brez uradnih prijavnih podatkov.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Informacijska sigurnost hardverskih rje\u0161enja USB over IP\" src=\"\/wp-content\/uploads\/2019\/04\/19b201d89a6f7face278ad9e3159e388.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nZa zagotovitev varnosti dostopa do USB naprav so bili sprejeti organizacijski in tehni\u010dni ukrepi:<\/p>\n<p>1. Organizacijski varnostni ukrepi. <\/p>\n<p>Upravljen USB over IP koncentrator je name\u0161\u010den v kakovostno zaklenjen stre\u017eni\u0161ki omarici. Fizi\u010dni dostop do njega je urejen (SCD v samo prostore, video nadzor, klju\u010di in pravice dostopa so v rokah strogo omejenega kroga oseb).<\/p>\n<p>Vse USB naprave, uporabljene v organizaciji, so pogojno razdeljene v 3 skupine:<\/p>\n<ul>\n<li>Kriti\u010dne. Finan\u010dne elektronske podpise \u2013 uporabljajo se v skladu z priporo\u010dili bank (ne prek USB over IP)<\/li>\n<li>Pomembne. Elektronski podpisi za trgovske trge, storitve, EDO, poro\u010dila itd., nekaj klju\u010dev za programsko opremo \u2013 uporabljajo se z uporabo upravljanega USB over IP koncentratorja.<\/li>\n<li>Ne kriti\u010dne. Nekateri klju\u010di za programsko opremo, kamere, nekateri USB klju\u010di in diski z nekriti\u010dnimi informacijami, USB modemi \u2013 uporabljajo se z uporabo upravljanega USB over IP koncentratorja.<\/li>\n<\/ul>\n<p>\n2. Tehni\u010dni varnostni ukrepi.<\/p>\n<p>Omre\u017eni dostop do upravljanega USB over IP koncentratorja je dovoljen le znotraj izoliranega podomre\u017eja. Dostop do izoliranega podomre\u017eja je omogo\u010den: <\/p>\n<ul>\n<li>iz farme terminalskih stre\u017enikov, <\/li>\n<li>po VPN (certifikat in geslo) omejenemu \u0161tevilu ra\u010dunalnikov in prenosnikov, preko VPN pa so dodeljeni stalni naslovi,<\/li>\n<li>prek VPN tunelih, ki povezujejo regionalne pisarne.<\/li>\n<\/ul>\n<p>\nNa najbolj upravljanem USB over IP koncentratorju DistKontrolUSB so s pomo\u010djo njegovih privzetih funkcij nastavljene naslednje mo\u017enosti:<\/p>\n<ul>\n<li>Za dostop do USB naprav USB over IP koncentratorja se uporablja \u0161ifriranje (na koncentratorju je vklopljena SSL \u0161ifriranje), \u010deprav je to morda \u017ee odve\u010dno.<\/li>\n<li>Nastavljeno je 'omejitev dostopa do USB naprav po IP naslovu'. Odvisno od IP naslova, uporabniku odobritev ali zavrnitev dostopa do dolo\u010denih USB naprav.<\/li>\n<li>Nastavljeno je 'omejitev dostopa do USB priklju\u010dka po uporabni\u0161kem imenu in geslu'. Uporabnikom so dodeljena pravice za dostop do USB naprav. <\/li>\n<li>'Omejitev dostopa do USB naprave po uporabni\u0161kem imenu in geslu' smo se odlo\u010dili ne uporabiti, ker so vsi USB klju\u010dki trajno priklju\u010deni na USB over IP koncentrator in se ne premikajo med priklju\u010dki. Smiselno je, da uporabnikom omogo\u010dimo dostop do USB priklju\u010dka z napravo, ki je dolgo \u010dasa priklju\u010dena.<\/li>\n<li>Fizi\u010dno vklop in izklop USB priklju\u010dkov se izvaja:\n<ul>\n<li>Za klju\u010dke za programsko opremo in EDO \u2014 s pomo\u010djo na\u010drtovalnika nalog in dodeljenih nalog koncentratorja (nekateri klju\u010dki so programirani za vklop ob 9:00 in izklop ob 18:00, nekateri med 13:00 in 16:00);<\/li>\n<li>Za klju\u010dke za trgovalne platforme in nekatera programska oprema \u2014 s strani uporabnikov, ki imajo dovoljenje, preko spletnega vmesnika;<\/li>\n<li>Kamere, nekateri USB klju\u010dki in diski z nekriti\u010dnimi informacijami \u2014 so vedno vklopljeni.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>\n Predvidevamo, da tak\u0161na organizacija dostopa do USB naprav zagotavlja njihovo varno uporabo:<\/p>\n<ul>\n<li>iz regionalnih pisarn (pogojno NET \u0161tevilka 1 \u2026\u2026 NET \u0161tevilka N), <\/li>\n<li>za omejeno \u0161tevilo ra\u010dunalnikov in prenosnikov, ki priklju\u010dujejo USB naprave preko globalne mre\u017ee, <\/li>\n<li>za uporabnike, objavljene na terminalskih stre\u017enikih aplikacij.<\/li>\n<\/ul>\n<p>\nV pripombah bi \u017eeleli sli\u0161ati konkretne prakti\u010dne ukrepe, ki pove\u010dajo informacijsko varnost zagotavljanja globalnega dostopa do USB naprav.<br \/>\n<br \/>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/448110\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u043f\u0440\u0438 \u043f\u043e\u0438\u0441\u043a\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043b\u044e\u0447\u0430\u043c \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b \u0432 \u043d\u0430\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438. \u0412 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 \u0431\u044b\u043b\u0438 \u043f\u043e\u0434\u043d\u044f\u0442 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0439 \u0432\u043e\u043f\u0440\u043e\u0441 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u0448\u0435\u043d\u0438\u0439 USB over IP, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438 \u043d\u0430\u0441 \u0432\u0435\u0441\u044c\u043c\u0430 \u0431\u0435\u0441\u043f\u043e\u043a\u043e\u0438\u0442. \u0418\u0442\u0430\u043a, \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u0432\u0441\u0435 \u0436\u0435 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0438\u043c\u0441\u044f \u0441 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u043c\u0438 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u043c\u0438. \u0411\u043e\u043b\u044c\u0448\u043e\u0435 \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u043e \u043a\u043b\u044e\u0447\u0435\u0439 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b. \u0414\u043e\u0441\u0442\u0443\u043f \u043a \u043d\u0438\u043c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c \u0438\u0437 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u0433\u0435\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0445 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":23546,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-31628","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u043f\u0440\u0438 \u043f\u043e\u0438\u0441\u043a\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043b\u044e\u0447\u0430\u043c \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b \u0432 \u043d\u0430\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/informatsionnaya-bezopasnost-apparatnyh-reshenij-usb-over-ip\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sl_SI\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u0448\u0435\u043d\u0438\u0439 USB over IP | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u043f\u0440\u0438 \u043f\u043e\u0438\u0441\u043a\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043b\u044e\u0447\u0430\u043c \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b \u0432 \u043d\u0430\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/informatsionnaya-bezopasnost-apparatnyh-reshenij-usb-over-ip\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:42:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:42:14+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Informacijska varnost strojnih re\u0161itev USB over IP | ProHoster","description":"Nedavno sem delil izku\u0161nje pri iskanju re\u0161itve za organizacijo centraliziranega dostopa do klju\u010dev elektronske za\u0161\u010dite v na\u0161i organizaciji.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/informatsionnaya-bezopasnost-apparatnyh-reshenij-usb-over-ip","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u044b\u0445 \u0440\u0435\u0448\u0435\u043d\u0438\u0439 USB over IP | ProHoster","og:description":"\u041d\u0435\u0434\u0430\u0432\u043d\u043e \u043f\u043e\u0434\u0435\u043b\u0438\u043b\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u043f\u0440\u0438 \u043f\u043e\u0438\u0441\u043a\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0446\u0435\u043d\u0442\u0440\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u043a\u043b\u044e\u0447\u0430\u043c \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u044b \u0432 \u043d\u0430\u0448\u0435\u0439 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438.","og:url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/informatsionnaya-bezopasnost-apparatnyh-reshenij-usb-over-ip","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:42:14+00:00","article:modified_time":"2019-10-31T18:42:14+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"31628","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 07:05:21","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:13:29","updated":"2026-01-21 07:05:21","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/31628","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=31628"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/31628\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/23546"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=31628"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=31628"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=31628"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}