{"id":52993,"date":"2019-11-21T00:00:00","date_gmt":"2019-11-20T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/funktsional-sovremennyh-sistem-zashhity-prilozhenij-waf-dolzhen-byt-gorazdo-shire-spiska-uyazvimostej-iz-owasp-top-10"},"modified":"2020-02-18T14:00:49","modified_gmt":"2020-02-18T11:00:49","slug":"funktsional-sovremennyh-sistem-zashhity-prilozhenij-waf-dolzhen-byt-gorazdo-shire-spiska-uyazvimostej-iz-owasp-top-10","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/funktsional-sovremennyh-sistem-zashhity-prilozhenij-waf-dolzhen-byt-gorazdo-shire-spiska-uyazvimostej-iz-owasp-top-10","title":{"rendered":"Funksionaliteti i sistemeve moderne t\u00eb mbrojtjes s\u00eb aplikacioneve (WAF) duhet t\u00eb jet\u00eb shum\u00eb m\u00eb i gjer\u00eb se lista e dob\u00ebsive nga OWASP Top 10","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<h4>Rikthim<\/h4>\n<p>\nShkalla, p\u00ebrb\u00ebrja dhe struktura e k\u00ebrc\u00ebnimeve kibernetike p\u00ebr aplikacionet po evolucionojn\u00eb shpejt. P\u00ebr shum\u00eb vite, p\u00ebrdoruesit kan\u00eb marr\u00eb qasje n\u00eb aplikacionet web p\u00ebrmes internetit duke p\u00ebrdorur shfletues popullor\u00eb. N\u00eb \u00e7do moment, ishte e nevojshme t\u00eb mbaheshin 2-5 shfletues web, dhe grupi i standardeve p\u00ebr zhvillimin dhe testimin e aplikacioneve web ishte mjaft i kufizuar. P\u00ebr shembull, pothuajse t\u00eb gjitha bazat e t\u00eb dh\u00ebnave ishin nd\u00ebrtuar duke p\u00ebrdorur SQL. Fatkeq\u00ebsisht, pak pas k\u00ebsaj, haker\u00ebt m\u00ebsuan t\u00eb p\u00ebrdorin aplikacionet web p\u00ebr t\u00eb vjedhur, fshir\u00eb ose modifikuar t\u00eb dh\u00ebna. Ata fituan qasje t\u00eb paligjshme dhe abuzuan me mund\u00ebsit\u00eb e aplikacioneve duke p\u00ebrdorur teknika t\u00eb ndryshme, duke p\u00ebrfshir\u00eb mashtrimin e p\u00ebrdoruesve t\u00eb aplikacioneve, injektimin dhe ekzekutimin e kodit nga distanca. Shpejt, n\u00eb treg u shfaq\u00ebn mjete komerciale p\u00ebr mbrojtjen e aplikacioneve web, t\u00eb quajtura Web Application Firewalls (WAF), dhe shoq\u00ebria reagoi duke krijuar nj\u00eb projekt t\u00eb hapur p\u00ebr sigurimin e aplikacioneve web, Open Web Application Security Project (OWASP), me q\u00ebllim t\u00eb p\u00ebrcaktimit dhe mbajtjes s\u00eb standardeve dhe metodologjive p\u00ebr zhvillimin e aplikacioneve t\u00eb sigurta.<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h4>Mbrojtje e Baz\u00ebs s\u00eb Aplikacioneve<\/h4>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/radware.pro\/downloads\/OWASP_Top_10-2017-ru.pdf\">Lista OWASP Top 10<\/a><\/noindex> \u00ebsht\u00eb nj\u00eb pik\u00ebnisje p\u00ebr sigurimin e aplikacioneve dhe p\u00ebrmban nj\u00eb list\u00eb t\u00eb k\u00ebrc\u00ebnimeve m\u00eb t\u00eb rrezikshme dhe konfigurimeve t\u00eb gabuara q\u00eb mund t\u00eb \u00e7ojn\u00eb n\u00eb dob\u00ebsi t\u00eb aplikacioneve, si dhe taktika p\u00ebr zbules\u00ebn dhe reflektimin e sulmeve. OWASP Top 10 \u00ebsht\u00eb nj\u00eb pik\u00ebreference e njohur n\u00eb industrin\u00eb e kibernetik\u00ebs p\u00ebr aplikacione n\u00eb mbar\u00eb bot\u00ebn dhe p\u00ebrcakton nj\u00eb list\u00eb baz\u00eb t\u00eb aft\u00ebsive q\u00eb duhet t\u00eb ket\u00eb nj\u00eb sistem mbrojt\u00ebs t\u00eb aplikacioneve web (WAF). <\/p>\n<p>P\u00ebr m\u00eb tep\u00ebr, funksionaliteti i WAF duhet t\u00eb marr\u00eb parasysh sulmet e tjera t\u00eb zakonshme ndaj aplikacioneve web, duke p\u00ebrfshir\u00eb falsifikimin e k\u00ebrkesave nd\u00ebrsite (CSRF), klikimin e mashtrimeve (Clickjacking), scrapingun e webit (web scraping) dhe p\u00ebrfshirjen e skedar\u00ebve (RFI\/LFI).<\/p>\n<h4>K\u00ebrc\u00ebnimet dhe sfidat e sigurimit t\u00eb aplikacioneve moderne<\/h4>\n<p>\nSot dit\u00ebve, jo t\u00eb gjitha aplikacionet jan\u00eb t\u00eb zhvilluar n\u00eb form\u00ebn rrjetore. Ka aplikacione cloud, aplikacione mobile, API, dhe n\u00eb arkitektur\u00ebn e fundit, funksione programore individuale. T\u00eb gjitha k\u00ebto lloje aplikacionesh duhet t\u00eb sinkronizohen dhe kontrollohen, sepse ato krijojn\u00eb, ndryshojn\u00eb dhe procesojn\u00eb t\u00eb dh\u00ebnat tona. Me shfaqjen e teknologjive dhe paradigmat e reja, lindin sfida dhe detyra t\u00eb reja n\u00eb t\u00eb gjitha fazat e ciklit t\u00eb jet\u00ebs s\u00eb aplikacioneve. Kjo p\u00ebrfshin integrimin e zhvillimit dhe operacioneve (DevOps), konteiner\u00ebt, Internetin e Gj\u00ebrave (IoT), mjetet me burim t\u00eb hapur, API dhe t\u00eb tjera. <\/p>\n<p>Vendosja e shp\u00ebrndar\u00eb e aplikacioneve dhe larmia e teknologjive krijon detyra komplekse dhe t\u00eb nd\u00ebrlidhura jo vet\u00ebm p\u00ebr specialist\u00ebt e siguris\u00eb s\u00eb informacionit, por edhe p\u00ebr prodhuesit e zgjidhjeve t\u00eb sigurimeve, t\u00eb cil\u00ebt nuk mund t\u00eb mb\u00ebshteten m\u00eb n\u00eb nj\u00eb qasje t\u00eb unifikuar. Mjetet e mbrojtjes s\u00eb aplikacioneve duhet t\u00eb marrin parasysh specifikat e biznesit t\u00eb tyre p\u00ebr t\u00eb parandaluar aktivizimet e gabuara dhe ndikimin n\u00eb cil\u00ebsin\u00eb e sh\u00ebrbimeve p\u00ebr p\u00ebrdoruesit. <\/p>\n<p>Q\u00ebllimi final i haker\u00ebve zakonisht \u00ebsht\u00eb ose vjedhja e t\u00eb dh\u00ebnave, ose shkelja e disponueshm\u00ebris\u00eb s\u00eb sh\u00ebrbimeve. Keqb\u00ebr\u00ebsit gjithashtu p\u00ebrfitojn\u00eb gjat\u00eb evolucionit teknologjik. S\u00eb pari, zhvillimi i teknologjive t\u00eb reja krijon m\u00eb shum\u00eb mund\u00ebsi p\u00ebr vrima dhe dob\u00ebsi. N\u00eb t\u00eb dyt\u00eb, n\u00eb arsenalin e tyre ka m\u00eb shum\u00eb mjete dhe njohuri p\u00ebr t\u00eb anashkaluar mjetet tradicionale t\u00eb mbrojtjes. Kjo rrit shum\u00eb t\u00eb ashtuquajtur\u00ebn 'sip\u00ebrfaqe sulmi' dhe ekspozimin e organizatave ndaj rreziqeve t\u00eb reja. Politikat e siguris\u00eb duhet t\u00eb ndryshojn\u00eb vazhdimisht n\u00eb p\u00ebrputhje me ndryshimet n\u00eb teknologji dhe aplikacione. <\/p>\n<p>Prandaj, aplikacionet duhet t\u00eb mbrohen nga nj\u00eb larmi gjithnj\u00eb e m\u00eb t\u00eb madhe metodash dhe burimesh sulmi, dhe pasqyrimi i sulmeve automatike duhet t\u00eb realizohet n\u00eb koh\u00eb reale mbi baza t\u00eb vendimeve t\u00eb informuara. Si rezultat, rriten kostot operacionale dhe puna manuale p\u00ebrball\u00eb pozicioneve t\u00eb dob\u00ebsuara n\u00eb siguri. <\/p>\n<h4>Detyra Nr. 1: Menaxhimi i bot\u00ebve<\/h4>\n<p>\nM\u00eb shum\u00eb se 60% e trafikut n\u00eb internet gjenerohet nga bot\u00ebt, gjysma e t\u00eb cilit i p\u00ebrket trafik\u00ebve 't\u00eb keq' (sipas t\u00eb dh\u00ebnave <noindex><a rel=\"nofollow\" href=\"https:\/\/radware.pro\/catalog\/2018-2019-radware-global-application-network-security-report\/\">t\u00eb raportit p\u00ebr sigurin\u00eb Radware<\/a><\/noindex>). Organizatat investojn\u00eb n\u00eb rritjen e kapacitetit t\u00eb rrjetit, duke sh\u00ebrbyer n\u00eb thelb ngarkes\u00ebn fiktive. Diferencimi i sakt\u00eb midis trafikut real t\u00eb p\u00ebrdoruesve dhe trafikut t\u00eb robot\u00ebve, si dhe midis robot\u00ebve \u201ct\u00eb mir\u00eb\u201d (p.sh., robot\u00ebt e k\u00ebrkimit dhe sh\u00ebrbimet e krahasimit t\u00eb \u00e7mimeve) dhe robot\u00ebve \u201ct\u00eb k\u00ebqij\u201d mund t\u00eb rezultoj\u00eb n\u00eb kursime t\u00eb konsiderueshme dhe p\u00ebrmir\u00ebsim t\u00eb cil\u00ebsis\u00eb s\u00eb sh\u00ebrbimeve p\u00ebr p\u00ebrdoruesit. <\/p>\n<p>Robot\u00ebt nuk jan\u00eb t\u00eb gatsh\u00ebm ta leht\u00ebsojn\u00eb k\u00ebt\u00eb detyr\u00eb, dhe ata mund t\u00eb imitojn\u00eb sjelljen e p\u00ebrdoruesve t\u00eb v\u00ebrtet\u00eb, duke kaluar CAPTCHA-n\u00eb dhe pengesa t\u00eb tjera. M\u00eb tej, n\u00eb rastin e sulmeve q\u00eb p\u00ebrdorin IP adresa dinamike, mbrojtja e bazuar n\u00eb filtrimin e IP adrese b\u00ebhet e pamundur. Shpesh, mjetet p\u00ebr zhvillim me burim t\u00eb hapur (p.sh., Phantom JS), t\u00eb cilat mund t\u00eb ekzekutojn\u00eb JavaScript-in e klientit, p\u00ebrdoren p\u00ebr t\u00eb realizuar sulme brute force, sulme me akredito t\u00eb mbushura (credential stuffing), sulme DDoS dhe sulme automatike me robot\u00eb. <\/p>\n<p>P\u00ebr nj\u00eb menaxhim t\u00eb efektsh\u00ebm t\u00eb trafikut t\u00eb robot\u00ebve nevojitet identifikimi unik i burimit t\u00eb tij (si nj\u00eb gisht ndihm\u00ebse). Pasi n\u00eb rastin e nj\u00eb sulmi me robot\u00eb ndodhin shum\u00eb regjistrime, ai gisht ndihm\u00ebse mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb zbuluar aktivitetin e dyshimt\u00eb dhe p\u00ebr t\u00eb atribuar pik\u00ebzime t\u00eb cilat aplikacioni i mbrojtjes do t\u00eb p\u00ebrdor\u00eb p\u00ebr t\u00eb marr\u00eb nj\u00eb vendim t\u00eb informuar \u2013 t\u00eb bllokoj\u00eb\/lejoj\u00eb \u2013 me nj\u00eb norm\u00eb minimale t\u00eb rezultateve pozitive t\u00eb falsifikuara. <\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/radware.pro\/catalog\/2018-2019-radware-global-application-network-security-report\/\"><img decoding=\"async\" alt=\"Funksionaliteti i sistemeve moderne t\u00eb mbrojtjes s\u00eb aplikacioneve (WAF) duhet t\u00eb jet\u00eb shum\u00eb m\u00eb i gjer\u00eb se lista e dob\u00ebsive nga OWASP Top 10\" src=\"\/wp-content\/uploads\/2019\/11\/54764c31a86863be4e6f4ed16ff4b65c.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h4>Detyra Nr. 2: Mbrojtja e API<\/h4>\n<p>\nShum\u00eb aplikacione mblidhen informacione dhe t\u00eb dh\u00ebna nga sh\u00ebrbimet me t\u00eb cilat bashk\u00ebveprojn\u00eb p\u00ebrmes API. Kur transmetojn\u00eb t\u00eb dh\u00ebna t\u00eb ndjeshme p\u00ebrmes API, m\u00eb shum\u00eb se 50% e organizatave nuk realizojn\u00eb as verifikimin, as mbrojtjen e API-ve p\u00ebr t\u00eb zbuluar sulmet kibernetike. <\/p>\n<p>Shembuj t\u00eb p\u00ebrdorimit t\u00eb API:<\/p>\n<ul>\n<li>Integrimi i Internetit t\u00eb Gj\u00ebrave (IoT)<\/li>\n<li>Nd\u00ebrveprimi midis makinave<\/li>\n<li>Mjediset pa server <\/li>\n<li>Aplikacionet mobile<\/li>\n<li>Aplikacione t\u00eb menaxhuara nga ngjarjet<\/li>\n<\/ul>\n<p>\nVulnerabilitetet e API-ve jan\u00eb t\u00eb ngjashme me vulnerabilitetet e aplikacioneve dhe p\u00ebrfshijn\u00eb injeksione, sulme n\u00eb protokolle, manipulim parametrash, ridrejtime dhe sulme nga bota e bllokimeve. Gateway-t e API-ve t\u00eb dedikuar lejojn\u00eb t\u00eb sigurohet p\u00ebrputhshm\u00ebria e sh\u00ebrbimeve t\u00eb aplikacioneve q\u00eb nd\u00ebrveprojn\u00eb p\u00ebrmes API-ve. Megjithat\u00eb, ato nuk ofrojn\u00eb sigurin\u00eb e plot\u00eb t\u00eb aplikacioneve, si\u00e7 e b\u00ebn WAF me mjetet e nevojshme t\u00eb siguris\u00eb, si p\u00ebrpunimi i headers HTTP, lista e kontrollit t\u00eb aksesit Layer 7 (ACL), p\u00ebrpunimi dhe verifikimi i ngarkes\u00ebs JSON\/XML, si dhe mbrojtja nga t\u00eb gjitha vulnerabilitetet nga lista OWASP Top 10. Kjo arrihet p\u00ebrmes inspektimit t\u00eb \u00e7elzave t\u00eb API-ve duke p\u00ebrdorur modele pozitive dhe negative. <\/p>\n<h4>Detyra Nr.3: Refuzimi i sh\u00ebrbimit<\/h4>\n<p>\nVektori i vjet\u00ebr i sulmeve \u2014 refuzimi i sh\u00ebrbimit (DoS) \u2014 vazhdon t\u00eb provohet se \u00ebsht\u00eb efektiv n\u00eb sulmet ndaj aplikacioneve. Kriminel\u00ebt kan\u00eb n\u00eb dispozicion nj\u00eb grup t\u00eb t\u00ebr\u00eb teknikash t\u00eb suksesshme p\u00ebr t\u00eb nd\u00ebrprer\u00eb operimin e sh\u00ebrbimeve t\u00eb aplikacioneve, duke p\u00ebrfshir\u00eb p\u00ebrmbytjet HTTP ose HTTPS, sulmet me energji t\u00eb ul\u00ebt dhe t\u00eb ngadalta (\u2018low-and-slow\u2019, si\u00e7 jan\u00eb SlowLoris, LOIC, Torshammer), sulmet me adresa IP dinamik\u00eb, mbipopullimin e memorie, sulmet bruteforce dhe shum\u00eb t\u00eb tjera. Me zhvillimin e Internetit t\u00eb Gj\u00ebrave dhe shfaqjen e botnet\u00ebve IoT, sulmet ndaj aplikacioneve jan\u00eb b\u00ebr\u00eb drejtimi kryesor i sulmeve DDoS. Shumica e WAF-eve me monitorim t\u00eb gjendjes s\u00eb lidhjeve mund t\u00eb p\u00ebrballojn\u00eb vet\u00ebm nj\u00eb volum t\u00eb kufizuar ngarkese. Sidoqoft\u00eb, ato mund t\u00eb inspektojn\u00eb rrjedhat e trafikut HTTP\/S dhe t\u00eb eliminojn\u00eb trafikun e sulmit dhe lidhjet e d\u00ebmshme. Pasi t\u00eb zbulohet nj\u00eb sulm, nuk ka asnj\u00eb kuptim t\u00eb lejohet p\u00ebrs\u00ebri ky trafik. Duke qen\u00eb se kapaciteti i WAF p\u00ebr t\u00eb reflektuar sulmet \u00ebsht\u00eb i kufizuar, nevojitet nj\u00eb zgjidhje shtes\u00eb n\u00eb perimetrin e rrjetit p\u00ebr t\u00eb bllokuar automatikisht paketat e <\/p>\n<p><img decoding=\"async\" alt=\"Funksionaliteti i sistemeve moderne t\u00eb mbrojtjes s\u00eb aplikacioneve (WAF) duhet t\u00eb jet\u00eb shum\u00eb m\u00eb i gjer\u00eb se lista e dob\u00ebsive nga OWASP Top 10\" src=\"\/wp-content\/uploads\/2019\/11\/0891b6ac8b043b813a831fc8bede5122.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Fig 1. Organizimi i mbrojtjes komplekse t\u00eb rrjetit dhe aplikacioneve n\u00eb shembullin e zgjidhjeve Radware<\/i><\/p>\n<h4>Detyra Nr.4: Mbrojtja e vazhdueshme<\/h4>\n<p>\nAplikacionet shpesh p\u00ebrballen me ndryshime. Metodologjit\u00eb e zhvillimit dhe zbatimit, si vazhdim\u00ebsia e p\u00ebrdit\u00ebsimeve, do t\u00eb thot\u00eb se modifikimet realizohen pa nd\u00ebrhyrjen dhe kontrollin e njeriut. N\u00eb k\u00ebto kushte dinamike, \u00ebsht\u00eb e v\u00ebshtir\u00eb t\u00eb mbahen politika sigurie funksionale pa pasur nj\u00eb num\u00ebr t\u00eb lart\u00eb rastesht t\u00eb rrem\u00eb. Aplikacionet mobile p\u00ebrdit\u00ebsohen shum\u00eb m\u00eb shpesh se aplikacionet web. Aplikacionet e pal\u00ebve t\u00eb treta mund t\u00eb ndryshojn\u00eb pa dijenin\u00eb tuaj. Disa organizata p\u00ebrpiqen t\u00eb fitojn\u00eb m\u00eb shum\u00eb kontroll dhe vizualizim p\u00ebr t\u00eb q\u00ebndruar n\u00eb dijeni t\u00eb rreziqeve potenciale. Megjithat\u00eb, kjo nuk \u00ebsht\u00eb gjithmon\u00eb e arritshme, dhe mbrojtja e besueshme e aplikacioneve duhet t\u00eb shfryt\u00ebzoj\u00eb mund\u00ebsit\u00eb e m\u00ebsimit t\u00eb makinerive p\u00ebr t\u00eb marr\u00eb dhe paraqitur vizualisht burimet e disponueshme, p\u00ebr t\u00eb analizuar k\u00ebrc\u00ebnimet potenciale, si dhe p\u00ebr t\u00eb krijuar dhe optimizuar politikat e siguris\u00eb n\u00eb rast modifikimi t\u00eb aplikacioneve.<\/p>\n<h4>P\u00ebrfundimet<\/h4>\n<p>\nMe kalimin e koh\u00ebs, aplikacionet po luajn\u00eb nj\u00eb rol gjithnj\u00eb e m\u00eb t\u00eb r\u00ebnd\u00ebsish\u00ebm n\u00eb jet\u00ebn e p\u00ebrditshme, duke u b\u00ebr\u00eb nj\u00eb objektiv kryesor p\u00ebr hakerat. Shansi potencial p\u00ebr sulmuesit dhe humbjet e mundshme p\u00ebr biznesin jan\u00eb t\u00eb m\u00ebdha. Kompleksiteti i detyr\u00ebs p\u00ebr sigurimin e aplikacioneve nuk mund t\u00eb mbivler\u00ebsohet, duke marr\u00eb parasysh numrin dhe variacionet e aplikacioneve dhe k\u00ebrc\u00ebnimeve. <\/p>\n<p>Faleminderit, jemi n\u00eb nj\u00eb moment kur inteligjenca artificiale mund t\u00eb na ndihmoj\u00eb. Algoritmet e bazuara n\u00eb m\u00ebsimin e makinerive ofrojn\u00eb mbrojtje adaptuese n\u00eb koh\u00eb reale kund\u00ebr k\u00ebrc\u00ebnimeve kibernetike m\u00eb t\u00eb avancuara q\u00eb drejtohen ndaj aplikacioneve. Ato gjithashtu p\u00ebrdit\u00ebsojn\u00eb automatikisht politikat e siguris\u00eb p\u00ebr t\u00eb mbrojtur aplikacionet web, mobile dhe n\u00eb cloud \u2014 si dhe API \u2014 pa rastesht t\u00eb rrem\u00eb.<\/p>\n<p>\u00cbsht\u00eb e v\u00ebshtir\u00eb t\u00eb parashikosh me sakt\u00ebsi se si do t\u00eb duket brezi i ri i k\u00ebrc\u00ebnimeve kibernetike p\u00ebr aplikacionet (ndoshta gjithashtu t\u00eb bazuara n\u00eb m\u00ebsimin e makinerive). Por organizatat me siguri mund t\u00eb nd\u00ebrmarrin hapa p\u00ebr t\u00eb mbrojtur t\u00eb dh\u00ebnat e klient\u00ebve, pron\u00ebn intelektuale dhe p\u00ebr t\u00eb garantuar disponueshm\u00ebrin\u00eb e sh\u00ebrbimeve me p\u00ebrfitime t\u00eb m\u00ebdha p\u00ebr biznesin.<\/p>\n<p>Praktikat dhe metodat efektive p\u00ebr sigurimin e aplikacioneve, llojet kryesore dhe vektor\u00ebt e sulmeve, zonat e rrezikut dhe boshll\u00ebqet n\u00eb mbrojtjen kibernetike t\u00eb aplikacioneve n\u00eb internet, si dhe p\u00ebrvoja dhe praktikat m\u00eb t\u00eb mira bot\u00ebrore jan\u00eb paraqitur n\u00eb studimin dhe raportin e Radware \"<noindex><a rel=\"nofollow\" href=\"https:\/\/radware.pro\/catalog\/web_application_security_digitally_connected_world_2019\/\">Siguria e Aplikacioneve n\u00eb Internet n\u00eb nj\u00eb Bot\u00eb t\u00eb Konektuar Digjitalisht<\/a><\/noindex>\u201d.<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/476490\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0420\u0435\u0442\u0440\u043e\u0441\u043f\u0435\u043a\u0442\u0438\u0432\u0430 \u041c\u0430\u0441\u0448\u0442\u0430\u0431, \u0441\u043e\u0441\u0442\u0430\u0432 \u0438 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 \u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0431\u044b\u0441\u0442\u0440\u043e \u044d\u0432\u043e\u043b\u044e\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u044e\u0442. \u0414\u043e\u043b\u0433\u0438\u0435 \u0433\u043e\u0434\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u0435\u0431-\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432. \u0412 \u043a\u0430\u0436\u0434\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u0431\u044b\u043b\u043e \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c 2-5 \u0432\u0435\u0431-\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432, \u0438 \u043d\u0430\u0431\u043e\u0440 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043e\u0432 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0438 \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0431\u044b\u043b \u0432 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e\u0439 \u0441\u0442\u0435\u043f\u0435\u043d\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043f\u043e\u0447\u0442\u0438 \u0432\u0441\u0435 \u0431\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445 \u0431\u044b\u043b\u0438 \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u044b \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c SQL. \u041a [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-52993","post","type-post","status-publish","format-standard","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0435\u0442\u0440\u043e\u0441\u043f\u0435\u043a\u0442\u0438\u0432\u0430 \u041c\u0430\u0441\u0448\u0442\u0430\u0431, \u0441\u043e\u0441\u0442\u0430\u0432 \u0438 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 \u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0431\u044b\u0441\u0442\u0440\u043e \u044d\u0432\u043e\u043b\u044e\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u044e\u0442. \u0414\u043e\u043b\u0433\u0438\u0435 \u0433\u043e\u0434\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u0435\u0431-\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/funktsional-sovremennyh-sistem-zashhity-prilozhenij-waf-dolzhen-byt-gorazdo-shire-spiska-uyazvimostej-iz-owasp-top-10\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0424\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 (WAF) \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c \u0433\u043e\u0440\u0430\u0437\u0434\u043e \u0448\u0438\u0440\u0435 \u0441\u043f\u0438\u0441\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u0437 OWASP \u0422\u043e\u043f 10 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0420\u0435\u0442\u0440\u043e\u0441\u043f\u0435\u043a\u0442\u0438\u0432\u0430 \u041c\u0430\u0441\u0448\u0442\u0430\u0431, \u0441\u043e\u0441\u0442\u0430\u0432 \u0438 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 \u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0431\u044b\u0441\u0442\u0440\u043e \u044d\u0432\u043e\u043b\u044e\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u044e\u0442. \u0414\u043e\u043b\u0433\u0438\u0435 \u0433\u043e\u0434\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u0435\u0431-\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/funktsional-sovremennyh-sistem-zashhity-prilozhenij-waf-dolzhen-byt-gorazdo-shire-spiska-uyazvimostej-iz-owasp-top-10\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-11-20T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:00:49+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Funksionaliteti i sistemeve moderne t\u00eb mbrojtjes s\u00eb aplikacioneve (WAF) duhet t\u00eb jet\u00eb shum\u00eb m\u00eb i gjer\u00eb se lista e vulnerabiliteteve nga OWASP Top 10 | ProHoster","description":"Retrospektiv\u00eb Masat, p\u00ebrb\u00ebrja dhe struktura e k\u00ebrc\u00ebnimeve kibernetike p\u00ebr aplikacionet po evoluojn\u00eb shpejt. M\u00eb shum\u00eb se nj\u00eb dekad\u00eb, p\u00ebrdoruesit kan\u00eb pasur qasje n\u00eb aplikacionet web n\u00ebp\u00ebrmjet internetit me an\u00eb t\u00eb shfletuesve m\u00eb t\u00eb njohur.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/funktsional-sovremennyh-sistem-zashhity-prilozhenij-waf-dolzhen-byt-gorazdo-shire-spiska-uyazvimostej-iz-owasp-top-10","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0424\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u0437\u0430\u0449\u0438\u0442\u044b \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 (WAF) \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c \u0433\u043e\u0440\u0430\u0437\u0434\u043e \u0448\u0438\u0440\u0435 \u0441\u043f\u0438\u0441\u043a\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438\u0437 OWASP \u0422\u043e\u043f 10 | ProHoster","og:description":"\u0420\u0435\u0442\u0440\u043e\u0441\u043f\u0435\u043a\u0442\u0438\u0432\u0430 \u041c\u0430\u0441\u0448\u0442\u0430\u0431, \u0441\u043e\u0441\u0442\u0430\u0432 \u0438 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430 \u043a\u0438\u0431\u0435\u0440\u0443\u0433\u0440\u043e\u0437 \u0434\u043b\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0439 \u0431\u044b\u0441\u0442\u0440\u043e \u044d\u0432\u043e\u043b\u044e\u0446\u0438\u043e\u043d\u0438\u0440\u0443\u044e\u0442. \u0414\u043e\u043b\u0433\u0438\u0435 \u0433\u043e\u0434\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043f\u043e\u043b\u0443\u0447\u0430\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u0435\u0431-\u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f\u043c \u0447\u0435\u0440\u0435\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u044b\u0445 \u0432\u0435\u0431-\u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/funktsional-sovremennyh-sistem-zashhity-prilozhenij-waf-dolzhen-byt-gorazdo-shire-spiska-uyazvimostej-iz-owasp-top-10","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-11-20T21:00:00+00:00","article:modified_time":"2020-02-18T11:00:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"52993","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 05:40:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:33:28","updated":"2026-01-24 05:40:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/52993","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=52993"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/52993\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=52993"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=52993"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=52993"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}