{"id":38686,"date":"2019-10-31T22:25:18","date_gmt":"2019-10-31T19:25:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/alternativa-tsentru-sertifikatsii-ot-microsoft\/"},"modified":"2019-10-31T22:25:18","modified_gmt":"2019-10-31T19:25:18","slug":"alternativa-tsentru-sertifikatsii-ot-microsoft","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/alternativa-tsentru-sertifikatsii-ot-microsoft","title":{"rendered":"Alternativ\u00eb ndaj qendr\u00ebs s\u00eb certifikimit t\u00eb Microsoft","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

K\u00ebtyre p\u00ebrdoruesve nuk mund t'u besohet. N\u00eb shumic\u00ebn e rasteve, ata jan\u00eb t\u00eb len\u00eb dhe zgjedhin komoditetin mbi sigurin\u00eb. Sipas statistikave, 21% e tyre sh\u00ebnojn\u00eb n\u00eb let\u00ebr fjal\u00ebkalimet p\u00ebr llogarit\u00eb e tyre t\u00eb pun\u00ebs, nd\u00ebrsa 50% p\u00ebrdorin t\u00eb nj\u00ebjtat fjal\u00ebkalime p\u00ebr sh\u00ebrbimet profesionale dhe personale.<\/p>\n

Mjedisi gjithashtu \u00ebsht\u00eb armiq\u00ebsor. 74% e organizatave lejojn\u00eb t\u00eb sjellin pajisje personale n\u00eb pun\u00eb dhe t'i lidhin ato me rrjetin korporativ. 94% e p\u00ebrdoruesve nuk mund t\u00eb dallojn\u00eb nj\u00eb email t\u00eb v\u00ebrtet\u00eb nga ai phishing, dhe 11% kan\u00eb klikuar mbi lidhjet e d\u00ebrguara.<\/p>\n

T\u00eb gjitha k\u00ebto probleme zgjidhen nga infrastruktura korporative e \u00e7el\u00ebsve publik\u00eb (PKI), e cila siguron enkriptim dhe autentifikim p\u00ebr email, duke z\u00ebvend\u00ebsuar fjal\u00ebkalimet me certifikata digjitale. Kjo infrastruktur\u00eb mund t\u00eb ngrit\u00ebt n\u00eb Windows Server. Sipas p\u00ebrshkrimit t\u00eb Microsoftit<\/a><\/noindex>, sh\u00ebrbimi Active Directory Certificate Services (AD CS) \u00ebsht\u00eb nj\u00eb server q\u00eb lejon krijimin e PKI n\u00eb organizat\u00ebn tuaj dhe p\u00ebrdorimin e kriptografis\u00eb me \u00e7el\u00ebsa publik\u00eb, certifikatave digjitale dhe n\u00ebnshkrimeve digjitale.<\/p>\n

Por zgjidhja e Microsoftit \u00ebsht\u00eb mjaft e shtrenjt\u00eb.
\n<\/a><\/noindex><\/p>\n

Kostoja totale e pron\u00ebsis\u00eb p\u00ebr nj\u00eb qend\u00ebr private certifikimi nga Microsoft<\/h1>\n

\n\"Alternativ\u00eb
\nKrahasimi i kostos s\u00eb pron\u00ebsis\u00eb mes Microsoft CA dhe GlobalSign AEG. Burimi<\/a><\/noindex><\/i><\/p>\n

N\u00eb shum\u00eb situata, \u00ebsht\u00eb m\u00eb e p\u00ebrshtatshme dhe m\u00eb e lira t\u00eb krijosh nj\u00eb qend\u00ebr private certifikimi t\u00eb ngjashme, por me menaxhim t\u00eb jasht\u00ebm. Kjo \u00ebsht\u00eb ajo q\u00eb zgjidh GlobalSign Auto Enrollment Gateway (AEG). Nga kostoja totale e pron\u00ebsis\u00eb p\u00ebrjashtohen menj\u00ebher\u00eb disa rreshta shpenzimesh (blerja e pajisjeve, shpenzimet p\u00ebr mb\u00ebshtetje, trajnimi i personelit etj.). Kursimi mund t\u00eb tejkaloj\u00eb 50% t\u00eb kostos totale t\u00eb pron\u00ebsis\u00eb.<\/a><\/noindex>.<\/p>\n

\u00c7far\u00eb \u00ebsht\u00eb AEG<\/h1>\n

\n\"Alternativ\u00eb
\n
\nAuto Enrollment Gateway<\/a><\/noindex> (AEG) \u00ebsht\u00eb nj\u00eb sh\u00ebrbim software q\u00eb vepron si nj\u00eb kalim midis sh\u00ebrbimeve t\u00eb certifikatave SaaS GlobalSign dhe mjedisit korporativ Windows.<\/p>\n

AEG integrohet me Active Directory, duke lejuar organizatat t\u00eb automatizojn\u00eb regjistrimin, p\u00ebrgatitjen dhe menaxhimin e certifikatave digjitale GlobalSign n\u00eb mjedisin Windows. Duke z\u00ebvend\u00ebsuar qendrat e brendshme t\u00eb certifikimit me sh\u00ebrbimet GlobalSign, bizneset rrisin sigurin\u00eb dhe ulin shpenzimet e menaxhimit t\u00eb nj\u00eb qendre t\u00eb brendshme t\u00eb certifikimit t\u00eb shtrenjt\u00eb dhe t\u00eb komplikuar nga Microsoft.<\/p>\n

Sh\u00ebrbimet e certifikimit GlobalSign SaaS jan\u00eb nj\u00eb alternativ\u00eb m\u00eb e besueshme krahasuar me certifikatat e dob\u00ebta dhe t\u00eb pahumbura n\u00eb infrastruktur\u00ebn e tyre. Eliminimi i nevoj\u00ebs p\u00ebr menaxhimin e nj\u00eb qendre t\u00eb brendshme q\u00eb k\u00ebrkon burime ul koston totale t\u00eb pron\u00ebsis\u00eb s\u00eb PKI, si dhe rrezikun e d\u00ebshtimeve t\u00eb sistemit.<\/p>\n

Mb\u00ebshtetja e protokolleve SCEP dhe ACME zgjeron mund\u00ebsit\u00eb e mb\u00ebshtetjes jasht\u00eb Windows, duke p\u00ebrfshir\u00eb l\u00ebshimin automatizuar t\u00eb certifikatave p\u00ebr server\u00ebt Linux, pajisjet mobile, rrjetin dhe pajisje t\u00eb tjera, si dhe kompjuter\u00ebt Apple OSX, t\u00eb regjistruar n\u00eb Active Directory.<\/p>\n

Siguria e p\u00ebrmir\u00ebsuar<\/h3>\n

\nP\u00ebrve\u00e7 kursimit t\u00eb buxhetit, menaxhimi i jasht\u00ebm i PKI rrit sigurin\u00eb e sistemit. Si\u00e7 v\u00ebren nj\u00eb studim i Aberdeen Group, certifikatat po b\u00ebhen gjithnj\u00eb e m\u00eb shum\u00eb nj\u00eb objektiv p\u00ebr sulmuesit: ata po shfryt\u00ebzojn\u00eb me sukses dob\u00ebsi t\u00eb njohura, si certifikatat e vet\u00eb-n\u00ebnshkruara t\u00eb pa sigurta, enkriptimin e dob\u00ebt dhe mekanizmat e komplikuar t\u00eb t\u00ebrheqjes. P\u00ebr m\u00eb tep\u00ebr, sulmuesit kan\u00eb zot\u00ebruar eksploitime m\u00eb t\u00eb komplikuara, si l\u00ebshimi mashtrues i certifikatave nga CA t\u00eb besuara dhe falsifikimi i certifikatave p\u00ebr n\u00ebnshkrimin e kodit.<\/p>\n

\u00abShumica e bizneseve nuk e menaxhojn\u00eb mjaft aktivisht rrezikun q\u00eb lidhet me k\u00ebto sulme dhe nuk jan\u00eb t\u00eb gatshme t\u00eb reagojn\u00eb shpejt ndaj kompromentimeve, \u2014 shkroi<\/a><\/noindex> Derek E. Brink, n\u00ebn president dhe shkenc\u00ebtar i siguris\u00eb IT n\u00eb Aberdeen Group. \u2014 Duke i ofruar bizneseve mund\u00ebsin\u00eb p\u00ebr t\u00eb deleguar aspektet operative t\u00eb menaxhimit t\u00eb certifikatave n\u00eb duar ekspert\u00ebsh, duke ruajtur n\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb kontrollin korporativ mbi politikat grupore n\u00eb Active Directory, GlobalSign synon t\u00eb siguroj\u00eb rritjen e ardhshme t\u00eb p\u00ebrdorimit t\u00eb certifikatave, duke zgjidhur \u00e7\u00ebshtje praktike t\u00eb siguris\u00eb dhe besimit n\u00eb nj\u00eb model t\u00eb efektsh\u00ebm dhe ekonomik t\u00eb implementimit\u00bb.<\/p>\n

Si funksionon AEG<\/h1>\n

\n\"Alternativ\u00eb
\n
\nNj\u00eb sistem tipik me AEG p\u00ebrfshin kat\u00ebr komponente ky\u00e7e p\u00ebr t\u00eb garantuar q\u00eb certifikatat e duhura t\u00eb transferohen n\u00eb pik\u00ebprerjet e duhura:<\/p>\n

    \n
  1. Softueri AEG n\u00eb serverin Windows.\n<\/li>\n
  2. Server\u00ebt Active Directory ose kontrollet e domain-it, t\u00eb cilat lejojn\u00eb administrator\u00ebt t\u00eb menaxhojn\u00eb dhe ruajn\u00eb informacionin mbi burimet.\n<\/li>\n
  3. Pikat p\u00ebrfundimtare: p\u00ebrdoruesit, pajisjet, server\u00ebt dhe stacionet e pun\u00ebs \u2014 praktikisht \u00e7do objekt q\u00eb \u00ebsht\u00eb 'konsumator' i certifikatave dixhitale.\n<\/li>\n
  4. Qendra e certifikimit GlobalSign ose GCC, e cila \u00ebsht\u00eb n\u00eb maj\u00eb t\u00eb nj\u00eb platforme t\u00eb besueshme t\u00eb l\u00ebshimit t\u00eb certifikatave dhe menaxhimit. K\u00ebtu gjenerohen certifikatate.<\/li>\n<\/ol>\n

    \nTre nga kat\u00ebr komponent\u00ebt e treguar ndodhen n\u00eb ambientin lokal t\u00eb klientit, nd\u00ebrsa i kat\u00ebrti \u00ebsht\u00eb n\u00eb re.<\/p>\n

    Fillimi, piketat e fundit konfigurohen paraprakisht p\u00ebrmes politikave grupore: p\u00ebr shembull, verifikimi i certifikatave p\u00ebr autentikimin e p\u00ebrdoruesve, k\u00ebrkesa S\/MIME p\u00ebr certifikat\u00ebn, etj. \u2014 p\u00ebr lidhjen e m\u00ebvonshme me serverin AEG. Lidhja ndodh n\u00eb m\u00ebnyr\u00eb t\u00eb sigurt p\u00ebrmes HTTPS.<\/p>\n

    Serveri AEG d\u00ebrgon nj\u00eb k\u00ebrkes\u00eb n\u00eb Active Directory p\u00ebrmes LDAP, p\u00ebr t\u00eb marr\u00eb nj\u00eb list\u00eb t\u00eb modele t\u00eb certifikatave p\u00ebr k\u00ebto piketa dhe d\u00ebrgon k\u00ebtij list\u00eb klient\u00ebve s\u00eb bashku me lokacionin e qendres s\u00eb certifikimit. Pas marrjes s\u00eb k\u00ebtyre rregullave, piketat e fundit lidhen p\u00ebrs\u00ebri me serverin AEG, k\u00ebt\u00eb her\u00eb p\u00ebr t\u00eb k\u00ebrkuar certifikat\u00ebn reale. AEG, nga ana e tij, krijon nj\u00eb thirrje API me parametrat e caktuar dhe e d\u00ebrgon at\u00eb n\u00eb Qendr\u00ebn e Certifikimit GlobalSign ose GCC p\u00ebr p\u00ebrpunim.<\/p>\n

    N\u00eb fund, pjesa serverike e GCC p\u00ebrpunon k\u00ebrkesat, zakonisht brenda disa sekondave, dhe d\u00ebrgon p\u00ebrgjigjen API bashk\u00eb me certifikat\u00ebn, e cila do t\u00eb vendoset sipas k\u00ebrkes\u00ebs n\u00eb piketat e fundit.<\/p>\n

    I gjith\u00eb procesi zgjat disa sekonda dhe mund t\u00eb automatizohet plot\u00ebsisht duke konfiguruar piketat p\u00ebr t\u00eb marr\u00eb automatikisht certifikatat p\u00ebrmes politikave grupore.<\/p>\n

    Karakteristikat unike t\u00eb AEG<\/h4>\n

    <\/p>\n