{"id":81884,"date":"2020-05-17T13:42:18","date_gmt":"2020-05-17T11:42:18","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity"},"modified":"2020-05-17T13:42:18","modified_gmt":"2020-05-17T11:42:18","slug":"bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","title":{"rendered":"Siguria dhe DBMS: \u00e7far\u00eb duhet t\u00eb mbani parasysh kur zgjidhni mjete mbrojt\u00ebse","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<h1><img decoding=\"async\" alt=\"Siguria dhe DBMS: \u00e7far\u00eb duhet t\u00eb mbani parasysh kur zgjidhni mjete mbrojt\u00ebse\" src=\"\/wp-content\/uploads\/2020\/05\/ac49253838e36336af127d71394139d8.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/h1>\n<p>\nUn\u00eb quhem Denis Rojkov, jam drejtori i zhvillimit t\u00eb softuerit n\u00eb kompanin\u00eb \u00abGazinformservis\u00bb, n\u00eb ekipin e produktit <noindex><a rel=\"nofollow\" href=\"https:\/\/www.gaz-is.ru\/produkty\/inform-sistemy\/subd-jatoba.html\">Jatoba<\/a><\/noindex>. Legjislacioni dhe normat korporative v\u00ebn\u00eb k\u00ebrkesa t\u00eb ve\u00e7anta p\u00ebr sigurin\u00eb e ruajtjes s\u00eb t\u00eb dh\u00ebnave. Askush nuk d\u00ebshiron q\u00eb pal\u00ebt e treta t\u00eb ken\u00eb qasje n\u00eb informatat konfidenciale, prandaj p\u00ebr \u00e7do projekt jan\u00eb t\u00eb r\u00ebnd\u00ebsishme pyetje t\u00eb tilla: identifikimi dhe autentikimi, menaxhimi i qasjeve n\u00eb t\u00eb dh\u00ebna, sigurimi i integritetit t\u00eb informacionit n\u00eb sistem, regjistrimi i ngjarjeve t\u00eb siguris\u00eb. Prandaj d\u00ebshiroj t\u00eb flas p\u00ebr disa momente interesante q\u00eb kan\u00eb t\u00eb b\u00ebjn\u00eb me sigurin\u00eb e DBMS. <br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nArtikulli \u00ebsht\u00eb p\u00ebrgatitur sipas nj\u00eb prezantimi n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/corp.mail.ru\/ru\/press\/events\/databases-1\/\">@Databases Meetup,<\/a><\/noindex> t\u00eb organizuar <noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/\">Mail.ru Cloud Solutions<\/a><\/noindex>. N\u00ebse nuk d\u00ebshironi t\u00eb lexoni, mund t\u00eb shihni:<\/p>\n<p><center><div class=\"youtube-placeholder\" data-id=\"n-54j9FHaMU\" onclick=\"loadVideo(this)\">\r\n        <img decoding=\"async\" src=\"https:\/\/img.youtube.com\/vi\/n-54j9FHaMU\/hqdefault.jpg\" alt=\"Luaj videon\" loading=\"lazy\" width=\"480\" height=\"360\" style=\"width:100%;height:auto;\">\r\n        <div class=\"play-button\"><\/div>\r\n    <\/div><\/center><br \/>\nArtikulli do t\u00eb ket\u00eb tri pjes\u00eb:<\/p>\n<ul>\n<li>Si t\u00eb mbrohen lidhjet.<\/li>\n<li>\u00c7far\u00eb \u00ebsht\u00eb auditi i veprimeve dhe si t\u00eb regjistrohet se \u00e7far\u00eb ndodh nga ana e baz\u00ebs s\u00eb t\u00eb dh\u00ebnave dhe lidhjes me t\u00eb.<\/li>\n<li>Si t\u00eb mbrohen t\u00eb dh\u00ebnat n\u00eb vet\u00eb baz\u00ebn e t\u00eb dh\u00ebnave dhe \u00e7far\u00eb teknologjish p\u00ebrdoren p\u00ebr k\u00ebt\u00eb.<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"Siguria dhe DBMS: \u00e7far\u00eb duhet t\u00eb mbani parasysh kur zgjidhni mjete mbrojt\u00ebse\" src=\"\/wp-content\/uploads\/2020\/05\/fbdca7f4a925b9ceb78de06c6e245b23.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Tre componente t\u00eb siguris\u00eb s\u00eb DBMS: mbrojtja e lidhjeve, auditimi i veprimeve dhe mbrojtja e t\u00eb dh\u00ebnave<\/i><\/p>\n<h2>Mbrojtja e lidhjeve<\/h2>\n<p>\nMund t\u00eb lidheni me baz\u00ebn e t\u00eb dh\u00ebnave si direkt, ashtu edhe n\u00eb m\u00ebnyr\u00eb indirekte p\u00ebrmes aplikacioneve web. Rregullisht, p\u00ebrdoruesi nga business, dmth, personi q\u00eb punon me DBMS, nd\u00ebrvepron me t\u00eb jo drejtp\u00ebrdrejt.<\/p>\n<p>Para se t\u00eb flasim p\u00ebr mbrojtjen e lidhjeve, duhet t\u00eb p\u00ebrgjigjemi n\u00eb pyetje t\u00eb r\u00ebnd\u00ebsishme, nga t\u00eb cilat varet se si do t\u00eb organizohen masat e siguris\u00eb:<\/p>\n<ul>\n<li>\u00ebsht\u00eb ekuivalent nj\u00eb p\u00ebrdorues biznesi me nj\u00eb p\u00ebrdorues t\u00eb DBMS;<\/li>\n<li>a sigurohet qasja n\u00eb t\u00eb dh\u00ebnat e DBMS vet\u00ebm p\u00ebrmes API-s\u00eb q\u00eb ju kontrolloni, apo ka qasje direkt n\u00eb tabelat;<\/li>\n<li>a \u00ebsht\u00eb DBMS e ndar\u00eb n\u00eb nj\u00eb segment t\u00eb ve\u00e7ant\u00eb t\u00eb mbrojtur, kush dhe si nd\u00ebrvepron me t\u00eb;<\/li>\n<li>a p\u00ebrdoren pooling\/proxy dhe shtresa nd\u00ebrmjet\u00ebse q\u00eb mund t\u00eb ndryshojn\u00eb informacionin se si \u00ebsht\u00eb krijuar lidhja dhe kush e p\u00ebrdor baz\u00ebn e t\u00eb dh\u00ebnave.<\/li>\n<\/ul>\n<p>\nTani le t\u00eb shohim cilat mjete mund t\u00eb aplikohen p\u00ebr mbrojtjen e lidhjeve:<\/p>\n<ol>\n<li>P\u00ebrdorni zgjidhje t\u00eb klas\u00ebs database firewall. Nj\u00eb shtes\u00eb mbrojt\u00ebse do t\u00eb rris\u00eb p\u00ebrshtatshm\u00ebrin\u00eb e asaj q\u00eb ndodh n\u00eb DBMS, p\u00ebr maksimum do t\u00eb jeni n\u00eb gjendje t\u00eb siguroni mbrojtje t\u00eb m\u00ebtejshme p\u00ebr t\u00eb dh\u00ebnat.<\/li>\n<li>P\u00ebrdorni politikat e fjal\u00ebkalimeve. Aplikimi i tyre varet nga si \u00ebsht\u00eb nd\u00ebrtuar arkitektura juaj. Megjithat\u00eb, nj\u00eb fjal\u00ebkalim n\u00eb skedarin e konfigurimit t\u00eb aplikacionit web q\u00eb lidhet me DBMS nuk \u00ebsht\u00eb i mjaftuesh\u00ebm p\u00ebr mbrojtje. Ka nj\u00eb s\u00ebr\u00eb mjetesh DBMS q\u00eb lejojn\u00eb t\u00eb kontrolloni q\u00eb p\u00ebrdoruesi dhe fjal\u00ebkalimi k\u00ebrkojn\u00eb p\u00ebrdit\u00ebsim.\n<p>Lexoni m\u00eb shum\u00eb rreth funksioneve t\u00eb vler\u00ebsimit t\u00eb p\u00ebrdoruesve. <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.cloud.oracle.com\/en-us\/iaas\/data-safe\/doc\/user-assessment-reports.html\">k\u00ebtu<\/a><\/noindex>, ashtu si\u00e7 mund t\u00eb m\u00ebsoni p\u00ebr MS SQL Vulnerability Assessment. <noindex><a rel=\"nofollow\" href=\"https:\/\/docs.microsoft.com\/en-us\/sql\/relational-databases\/security\/sql-vulnerability-assessment?view=sql-server-ver15\">k\u00ebtu<\/a><\/noindex>.\u00a0<\/li>\n<li>Pasuroni kontekstin e seanc\u00ebs me informacionin e nevojsh\u00ebm. N\u00ebse sesioni \u00ebsht\u00eb i pandri\u00e7uar, nuk kuptoni kush po punon brenda DBMS, mund t\u00eb plot\u00ebsoni informacionin mbi at\u00eb se kush, \u00e7far\u00eb dhe pse b\u00ebn at\u00eb q\u00eb po b\u00ebhet n\u00eb kuad\u00ebr t\u00eb operacionit t\u00eb ekzekutuar. Ky informacion mund t\u00eb shihet n\u00eb audit.<\/li>\n<li>Konfiguroni SSL n\u00ebse nuk keni nj\u00eb ndarje rrjetesh t\u00eb DBMS nga p\u00ebrdoruesit p\u00ebrfundimtar\u00eb, n\u00ebse ajo nuk \u00ebsht\u00eb n\u00eb nj\u00eb VLAN t\u00eb ve\u00e7ant\u00eb. N\u00eb raste t\u00eb tilla, \u00ebsht\u00eb e domosdoshme t\u00eb mbrohet kanali midis konsumatorit dhe vet\u00eb DBMS. Ka gjithashtu mjete mbrojtjeje mes tyre dhe open source.<\/li>\n<\/ol>\n<p><\/p>\n<h3>Si do t\u00eb ndikoj\u00eb kjo n\u00eb performanc\u00ebn e DBMS?<\/h3>\n<p>\nT\u00eb shohim nj\u00eb shembull me PostgreSQL, si SSL ndikon n\u00eb ngarkes\u00ebn e CPU, rritjen e koh\u00ebve t\u00eb p\u00ebrgjigjes dhe zvog\u00eblimin e TPS, a do t\u00eb humbas\u00eb shum\u00eb burime n\u00ebse e aktivizojm\u00eb.<\/p>\n<p>Ngarkojm\u00eb PostgreSQL, duke p\u00ebrdorur pgbench \u2014 \u00ebsht\u00eb nj\u00eb program i thjesht\u00eb p\u00ebr t\u00eb ekzekutuar teste performanc\u00eb. Ai ekzekuton nj\u00eb sekuenc\u00eb komandash t\u00eb nj\u00ebjta shum\u00eb her\u00eb, ndoshta n\u00eb seanca paralele t\u00eb baz\u00ebs s\u00eb t\u00eb dh\u00ebnave, dhe m\u00eb pas llogarit shpejt\u00ebsin\u00eb mesatare t\u00eb transaksioneve.<\/p>\n<p><strong>Testi 1 pa SSL dhe me p\u00ebrdorimin e SSL.<\/strong> \u2014 lidhja krijohet me \u00e7do transaksion:<\/p>\n<pre><code class=\"plaintext\">pgbench.exe --connect -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres sslmode=require sslrootcert=rootCA.crt sslcert=client.crt sslkey=client.key\"<\/code><\/pre>\n<p>\n<strong>vs<\/strong><\/p>\n<pre><code class=\"plaintext\">pgbench.exe --connect -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres\"<\/code><\/pre>\n<p>\n<strong>Testi 2 pa SSL dhe me p\u00ebrdorimin e SSL.<\/strong> \u2014 t\u00eb gjitha transaksionet ekzekutohen n\u00eb nj\u00eb lidhje:<\/p>\n<pre><code class=\"plaintext\">pgbench.exe -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres sslmode=require sslrootcert=rootCA.crt sslcert=client.crt sslkey=client.key\"<\/code><\/pre>\n<p>\n<strong>vs<\/strong><\/p>\n<pre><code class=\"plaintext\">pgbench.exe -c 10 -t 5000 \"host=192.168.220.129 dbname=taskdb user=postgres\"<\/code><\/pre>\n<p>\n<strong>Cil\u00ebsimet e tjera<\/strong>:<\/p>\n<pre><code class=\"plaintext\">faktori i shkall\u00ebs: 1\nmodi i k\u00ebrkimeve: i thjesht\u00eb\nnumri i klient\u00ebve: 10\nnumri iThreads: 1\nnumri i transaksioneve p\u00ebr klient: 5000\nnumri i transaksioneve q\u00eb u p\u00ebrpunuan n\u00eb t\u00eb v\u00ebrtet\u00eb: 50000\/50000<\/code><\/pre>\n<p>\n<strong>Rezultatet e testimit<\/strong>:<\/p>\n<p>\u00a0<br \/>\n<strong>NUK KA SSL<\/strong><br \/>\n<strong>SSL<\/strong><\/p>\n<p><strong>Lidhja krijohet me \u00e7do transaksion.<\/strong><\/p>\n<p>mesatarja e vones\u00ebs<br \/>\n171.915 ms<br \/>\n187.695 ms<\/p>\n<p>tps duke p\u00ebrfshir\u00eb krijimin e lidhjeve<br \/>\n58.168112<br \/>\n53.278062<\/p>\n<p>tps duke p\u00ebrjashtuar krijimin e lidhjeve<br \/>\n64.084546<br \/>\n58.725846<\/p>\n<p>CPU<br \/>\n24%<br \/>\n28%<\/p>\n<p><strong>T\u00eb gjitha transaksionet ekzekutohen n\u00eb nj\u00eb lidhje.<\/strong><\/p>\n<p>mesatarja e vones\u00ebs<br \/>\n6.722 ms<br \/>\n6.342 ms<\/p>\n<p>tps duke p\u00ebrfshir\u00eb krijimin e lidhjeve.<br \/>\n1587.657278<br \/>\n1576.792883<\/p>\n<p>tps duke p\u00ebrjashtuar krijimin e lidhjeve<br \/>\n1588.380574<br \/>\n1577.694766<\/p>\n<p>CPU<br \/>\n17%<br \/>\n21%<\/p>\n<p>\nMe ndikime t\u00eb vogla, efekti i SSL \u00ebsht\u00eb i ngjash\u00ebm me gabimin e matjes. N\u00ebse volumi i t\u00eb dh\u00ebnave q\u00eb transmetohet \u00ebsht\u00eb shum\u00eb i madh, situata mund t\u00eb jet\u00eb ndryshe. N\u00ebse ne krijojm\u00eb nj\u00eb lidhje p\u00ebr \u00e7do transaksion (kjo ndodh rrall\u00eb, zakonisht lidhjet ndahen midis p\u00ebrdoruesve), ju keni nj\u00eb num\u00ebr t\u00eb madh lidhjesh\/\u00e7lirimesh, efekti mund t\u00eb jet\u00eb pak m\u00eb i madh. Kjo do t\u00eb thot\u00eb se rreziqet p\u00ebr reduktimin e performanc\u00ebs mund t\u00eb jen\u00eb, megjithat\u00eb, diferenca nuk \u00ebsht\u00eb aq e madhe sa p\u00ebr t\u00eb mos p\u00ebrdorur mbrojtjen.<\/p>\n<p>Vini re \u2014 ka nj\u00eb ndryshim t\u00eb madh n\u00ebse krahasoni modelet e pun\u00ebs: brenda nj\u00eb seance jeni duke punuar ose n\u00eb m\u00ebnyra t\u00eb ndryshme. Kjo \u00ebsht\u00eb e qart\u00eb: krijimi i \u00e7do lidhjeje k\u00ebrkon burime.<\/p>\n<p>Kishim nj\u00eb rast kur u lidh\u00ebm me Zabbix n\u00eb modalitetin trust, dmth nuk e verifikonim md5, nuk kishte nevoj\u00eb p\u00ebr autentikim. M\u00eb pas, klienti k\u00ebrkoi t\u00eb aktivizohej modaliteti i autentikimit md5. Kjo shkaktoi nj\u00eb ngarkes\u00eb t\u00eb madhe n\u00eb CPU, performanca ra. Filluam t\u00eb k\u00ebrkojm\u00eb m\u00ebnyra optimizimi. Nj\u00eb nga zgjidhjet e mundshme p\u00ebr k\u00ebt\u00eb problem \u00ebsht\u00eb t\u00eb realizojm\u00eb kufizime rrjeti, t\u00eb krijojm\u00eb VLAN t\u00eb ve\u00e7ant\u00eb p\u00ebr DBMS, t\u00eb shtojm\u00eb konfigurime p\u00ebr t\u00eb qart\u00eb se kush dhe nga ku lidhet dhe t\u00eb heqim autentikimin. Gjithashtu, mund t\u00eb optimizojm\u00eb konfigurimet e autentikimit p\u00ebr t\u00eb reduktuar kostot kur aktivizohet autentikimi, por n\u00eb p\u00ebrgjith\u00ebsi p\u00ebrdorimi i metodave t\u00eb ndryshme t\u00eb autentikimit ndikon n\u00eb performanc\u00eb dhe k\u00ebrkon q\u00eb t\u00eb merren parasysh k\u00ebta faktor\u00eb gjat\u00eb projektimit t\u00eb kapaciteve p\u00ebrpunuese t\u00eb server\u00ebve (harduerit) p\u00ebr DBMS.<\/p>\n<p>P\u00ebrfundim: n\u00eb disa zgjidhje, edhe nuanca t\u00eb vogla n\u00eb autentikim mund t\u00eb ken\u00eb ndikim t\u00eb madh n\u00eb projekt dhe \u00ebsht\u00eb keq kur kjo kuptohet vet\u00ebm gjat\u00eb zbatimit n\u00eb prodhim.<\/p>\n<h2>Auditi i veprimeve<\/h2>\n<p>\nAuditi mund t\u00eb mos jet\u00eb vet\u00ebm i DBMS. Auditi \u00ebsht\u00eb marrja e informacionit p\u00ebr at\u00eb q\u00eb ndodh n\u00eb segmente t\u00eb ndryshme. Kjo mund t\u00eb jet\u00eb edhe nj\u00eb firewall database, edhe sistemi operativ n\u00eb t\u00eb cilin nd\u00ebrtohet DBMS.<\/p>\n<p>N\u00eb DBMS komerciale t\u00eb nivelit Enterprise, auditi \u00ebsht\u00eb n\u00eb rregull, n\u00eb open source \u2014 jo gjithmon\u00eb. K\u00ebtu \u00ebsht\u00eb \u00e7far\u00eb ka n\u00eb PostgreSQL:<\/p>\n<ul>\n<li>default log \u2014 regjistrim i integruar;<\/li>\n<li>extensions: pgaudit \u2014 n\u00ebse ju mungon regjistrimi standard, mund t\u00eb p\u00ebrdorni konfigurime t\u00eb ve\u00e7anta q\u00eb zgjidhin disa nga problematikat.<\/li>\n<\/ul>\n<p>\n<b>Shtes\u00eb p\u00ebr raportin n\u00eb video:<\/b><\/p>\n<p>\"Regjistrimi bazik i operator\u00ebve mund t\u00eb sigurohet me nj\u00eb mjet standard regjistrimi me log_statement = all.<\/p>\n<p>Kjo \u00ebsht\u00eb e pranueshme p\u00ebr monitorim dhe p\u00ebrdorime t\u00eb tjera, por nuk siguron nivelin e detajeve q\u00eb zakonisht k\u00ebrkohet p\u00ebr auditimin.<\/p>\n<p>Nuk mjafton t\u00eb kesh nj\u00eb list\u00eb t\u00eb gjitha operacioneve t\u00eb kryera me baz\u00ebn e t\u00eb dh\u00ebnave.<\/p>\n<p>Po ashtu, duhet t\u00eb ket\u00eb mund\u00ebsin\u00eb p\u00ebr t\u00eb gjetur deklaratat specifike q\u00eb jan\u00eb t\u00eb r\u00ebnd\u00ebsishme p\u00ebr auditorin.<\/p>\n<p>Mjeti standard i regjistrimit tregon ato q\u00eb ka k\u00ebrkuar p\u00ebrdoruesi, nd\u00ebrsa pgAudit p\u00ebrqendrohet n\u00eb detaje t\u00eb asaj q\u00eb ndodhi kur baza e t\u00eb dh\u00ebnave ekzekutoi k\u00ebrkes\u00ebn.<\/p>\n<p>P\u00ebr shembull, auditorit mund t'i duhet t\u00eb sigurohet q\u00eb nj\u00eb tabel\u00eb specifike u krijua brenda nj\u00eb periudhe t\u00eb dokumentuar mir\u00ebmbajtjeje.<\/p>\n<p>Kjo mund t\u00eb duket si nj\u00eb detyr\u00eb e thjesht\u00eb p\u00ebr auditim bazik dhe grep, por \u00e7far\u00eb ndodh n\u00ebse ju paraqitet di\u00e7ka si ky shembull (q\u00ebllimisht i ngat\u00ebrruar):<\/p>\n<p>DO $$<br \/>\nFILLON<br \/>\n EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)';<br \/>\nMERR FUND $$;<\/p>\n<p>Regjistrimi standard do t'ju jap\u00eb k\u00ebt\u00eb:<\/p>\n<p>LOG: statement: DO $$<br \/>\nFILLON<br \/>\n EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)';<br \/>\nMERR FUND $$;<\/p>\n<p>Duket se p\u00ebr t\u00eb gjetur tabel\u00ebn e interesit, mund t\u00eb nevojitet njohuri p\u00ebr kodin n\u00eb rastet kur tabelat krijohen dinamikisht.<\/p>\n<p>Kjo nuk \u00ebsht\u00eb ideale, pasi do t\u00eb ishte m\u00eb e preferuar q\u00eb thjesht t\u00eb k\u00ebrkohej sipas emrit t\u00eb tabel\u00ebs.<\/p>\n<p>K\u00ebtu do t'i vlej\u00eb pgAudit.<\/p>\n<p>P\u00ebr t\u00eb nj\u00ebjtin hyrje, ai do t\u00eb jap\u00eb k\u00ebt\u00eb dalje n\u00eb regjist\u00ebr:<\/p>\n<p>AUDIT: SESSION,33,1,FUNCTION,DO,,,\"DO $$<br \/>\nFILLON<br \/>\n EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)';<br \/>\nEND $$;\"<br \/>\nAUDIT: SESSION,33,2,DDL,CREATE TABLE,TABLE,public.important_table,CREATE TABLE important_table (id INT)<\/p>\n<p>Jo vet\u00ebm blloku DO regjistrohet, por gjithashtu teksti i plot\u00eb CREATE TABLE me llojin e operatorit, llojin e objektit dhe emrin e plot\u00eb, duke e b\u00ebr\u00eb m\u00eb t\u00eb leht\u00eb k\u00ebrkimin.<\/p>\n<p>Kur regjistrohen operator\u00ebt SELECT dhe DML, pgAudit mund t\u00eb konfigurohet p\u00ebr t\u00eb regjistruar nj\u00eb hyrje t\u00eb ve\u00e7ant\u00eb p\u00ebr \u00e7do marr\u00ebdh\u00ebnie q\u00eb referohet n\u00eb operator.<\/p>\n<p>Nuk k\u00ebrkohet analiz\u00eb sintaksore p\u00ebr t\u00eb gjetur t\u00eb gjitha operator\u00ebt q\u00eb prekin nj\u00eb tabel\u00eb specifike (<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/pgaudit\/pgaudit\/blob\/master\/README.md\">*<\/a><\/noindex>)\u00bb.<\/p>\n<h3>Si do t\u00eb ndikoj\u00eb kjo n\u00eb performanc\u00ebn e DBMS?<\/h3>\n<p>\nLe t\u00eb b\u00ebjm\u00eb teste duke p\u00ebrfshir\u00eb auditimin e plot\u00eb dhe t\u00eb shohim \u00e7far\u00eb ndodh me performanc\u00ebn e PostgreSQL. Le t\u00eb aktivizojm\u00eb regjistrimin maksimal t\u00eb DB p\u00ebr t\u00eb gjitha parametrat.<\/p>\n<p>N\u00eb dosjen e konfigurimit, pothuajse nuk ndryshojm\u00eb asgj\u00eb, nga t\u00eb r\u00ebnd\u00ebsishmet \u2013 aktivizojm\u00eb modin debug5 p\u00ebr t\u00eb marr\u00eb maksimumin e informacionit.<\/p>\n<p>postgresql.conf<\/p>\n<p>log_destination = 'stderr'<br \/>\nlogging_collector = on<br \/>\nlog_truncate_on_rotation = on<br \/>\nlog_rotation_age = 1d<br \/>\nlog_rotation_size = 10MB<br \/>\nlog_min_messages = <strong>debug5<\/strong><br \/>\nlog_min_error_statement = <strong>debug5<\/strong><br \/>\nlog_min_duration_statement = 0<br \/>\ndebug_print_parse = on<br \/>\ndebug_print_rewritten = on<br \/>\ndebug_print_plan = on<br \/>\ndebug_pretty_print = on<br \/>\nlog_checkpoints = on<br \/>\nlog_connections = on<br \/>\nlog_disconnections = on<br \/>\nlog_duration = on<br \/>\nlog_hostname = on<br \/>\nlog_lock_waits = on<br \/>\nlog_replication_commands = on<br \/>\nlog_temp_files = 0<br \/>\nlog_timezone = 'Europe\/Moscow'<\/p>\n<p>\nN\u00eb DBMS PostgreSQL me parametrat 1 CPU, 2.8 GHz, 2 GB RAM, 40 GB HDD, b\u00ebjm\u00eb tre teste stresi, duke p\u00ebrdorur komandat:<\/p>\n<pre><code class=\"plaintext\">$ pgbench -p 3389 -U postgres -i -s 150 benchmark\n$ pgbench -p 3389 -U postgres -c 50 -j 2 -P 60 -T 600 benchmark\n$ pgbench -p 3389 -U postgres -c 150 -j 2 -P 60 -T 600 benchmark<\/code><\/pre>\n<p>\n<strong>Rezultatet e testeve:<\/strong><\/p>\n<p><strong>Pa regjistrim<\/strong><br \/>\n<strong>Me regjistrim<\/strong><\/p>\n<p>Koha finale p\u00ebr mbushjen e DB<br \/>\n43.74 sekond\u00eb<br \/>\n53.23 sekond\u00eb<\/p>\n<p>RAM<br \/>\n24%<br \/>\n40%<\/p>\n<p>CPU<br \/>\n72%<br \/>\n91%<\/p>\n<p><strong>Testi 1 (50 lidhje)<\/strong><\/p>\n<p>Numri i transaksioneve p\u00ebr 10 minuta<br \/>\n74169<br \/>\n32445<\/p>\n<p>Transaksione\/s<br \/>\n123<br \/>\n54<\/p>\n<p>Vonesa mesatare<br \/>\n405 ms<br \/>\n925 ms<\/p>\n<p><strong>Testi 2 (150 lidhje me 100 t\u00eb mundshme)<\/strong><\/p>\n<p>Numri i transaksioneve p\u00ebr 10 minuta<br \/>\n81727<br \/>\n31429<\/p>\n<p>Transaksione\/s<br \/>\n136<br \/>\n52<\/p>\n<p>Vonesa mesatare<br \/>\n550 ms<br \/>\n1432 ms<\/p>\n<p><strong>Rreth madh\u00ebsive<\/strong><\/p>\n<p>Madh\u00ebsia e DB<br \/>\n2251 MB<br \/>\n2262 MB<\/p>\n<p>Madh\u00ebsia e regjistrimeve t\u00eb DB<br \/>\n0 MB<br \/>\n4587 MB<\/p>\n<p>\nN\u00eb p\u00ebrfundim: auditimi i plot\u00eb nuk \u00ebsht\u00eb shum\u00eb m\u00eb i mir\u00eb. T\u00eb dh\u00ebnat nga auditi do t\u00eb jen\u00eb sa t\u00eb dh\u00ebnat vet\u00eb n\u00eb databaz\u00eb, ndoshta dhe m\u00eb shum\u00eb. Ky volum regjistrimi q\u00eb krijohet gjat\u00eb pun\u00ebs me DBMS \u00ebsht\u00eb nj\u00eb problem i zakonsh\u00ebm n\u00eb prodhim.<\/p>\n<p>Shikojm\u00eb parametrat e tjer\u00eb:<\/p>\n<ul>\n<li>Shpejt\u00ebsia nuk ndryshon shum\u00eb: pa regjistrim \u2014 43.74 sek, me regjistrim \u2014 53.23 sek.<\/li>\n<li>Performanca p\u00ebr RAM dhe CPU do t\u00eb ulet, pasi \u00ebsht\u00eb e nevojshme t\u00eb formohet nj\u00eb skedar me auditin. Kjo \u00ebsht\u00eb gjithashtu e dukshme n\u00eb prodhim.<\/li>\n<\/ul>\n<p>\nMe rritjen e numrit t\u00eb lidhjeve, natyrisht, treguesit do t\u00eb p\u00ebrkeq\u00ebsohen pak.<\/p>\n<p>N\u00eb korporata me audit \u00ebsht\u00eb edhe m\u00eb e v\u00ebshtir\u00eb:<\/p>\n<ul>\n<li>t\u00eb dh\u00ebna shum\u00eb;<\/li>\n<li>auditimi nuk \u00ebsht\u00eb i nevojsh\u00ebm vet\u00ebm n\u00ebp\u00ebrmjet syslog n\u00eb SIEM, por edhe n\u00eb skedar\u00ebt: ndoshta ndodh di\u00e7ka me syslog, duhet t\u00eb ket\u00eb nj\u00eb skedar af\u00ebr databaz\u00ebs ku ruhen t\u00eb dh\u00ebnat;<\/li>\n<li>p\u00ebr auditimin nevojitet nj\u00eb raft i ve\u00e7ant\u00eb, q\u00eb t\u00eb mos d\u00ebshtojn\u00eb disqet nga I\/O, pasi z\u00eb shum\u00eb hap\u00ebsir\u00eb;<\/li>\n<li>ndodhi q\u00eb punonj\u00ebsit e siguris\u00eb k\u00ebrkojn\u00eb gjithmon\u00eb standarde, k\u00ebrkojn\u00eb identifikimin sipas standardeve.<\/li>\n<\/ul>\n<p><\/p>\n<h2>Kufizimi i aksesit n\u00eb t\u00eb dh\u00ebna<\/h2>\n<p>\nT\u00eb shohim teknologjit\u00eb q\u00eb p\u00ebrdorin p\u00ebr mbrojtjen e t\u00eb dh\u00ebnave dhe aksesin n\u00eb to n\u00eb DBMS komerciale dhe open source.<\/p>\n<p>\u00c7far\u00eb mund t\u00eb p\u00ebrdorim n\u00eb p\u00ebrgjith\u00ebsi:<\/p>\n<ol>\n<li>Kriptimi dhe obfuscimi i procedurave dhe funksioneve (Wrapping) - pra, vegla dhe utilitete t\u00eb ve\u00e7anta, t\u00eb cilat b\u00ebjn\u00eb q\u00eb kodi i lexuesh\u00ebm t\u00eb b\u00ebhet i paduksh\u00ebm. Megjithat\u00eb, pastaj nuk mund t\u00eb ndryshohet dhe as t\u00eb ristrukturohet p\u00ebrs\u00ebri. Ky qasje \u00ebsht\u00eb ndonj\u00ebher\u00eb e nevojshme t\u00eb pakt\u00ebn n\u00eb an\u00ebn e DBMS - logjika e kufizimeve t\u00eb licenc\u00ebs ose logjika e autorizimit kriptohet sakt\u00ebsisht n\u00eb nivelin e procedur\u00ebs dhe funksionit.<\/li>\n<li>Kufizimi i dukshm\u00ebris\u00eb s\u00eb t\u00eb dh\u00ebnave sipas rreshtave (RLS) \u00ebsht\u00eb kur p\u00ebrdorues t\u00eb ndrysh\u00ebm shohin nj\u00eb tabel\u00eb, por p\u00ebrb\u00ebrja e rreshtave ndahet, dmth disa njer\u00ebzve nuk u lejohet t\u00eb shohin di\u00e7ka n\u00eb nivel rreshti.<\/li>\n<li>Redaktimi i t\u00eb dh\u00ebnave t\u00eb dukshme (Masking) \u00ebsht\u00eb kur p\u00ebrdoruesit n\u00eb nj\u00eb kolon\u00eb t\u00eb tabel\u00ebs shohin ose t\u00eb dh\u00ebnat ose vet\u00ebm yje, dmth p\u00ebr disa p\u00ebrdorues informatat do t\u00eb jen\u00eb t\u00eb mbyllura. Teknologjia p\u00ebrcakton se cilit p\u00ebrdorues \u00e7far\u00eb t'i tregoj\u00eb me marr\u00eb parasysh nivelin e aksesit.<\/li>\n<li>P\u00ebrjashtimi i aksesit Security DBA\/Application DBA\/DBA \u00ebsht\u00eb m\u00eb shum\u00eb p\u00ebr kufizimin e aksesit n\u00eb vet\u00eb DBMS-n\u00eb, dmth punonj\u00ebsit e siguris\u00eb mund t\u00eb ndahen nga administruesit e database dhe administruesit e aplikacioneve. N\u00eb burim t\u00eb hapur ka pak teknologji t\u00eb tilla, por n\u00eb DBMS-t\u00eb komerciale ka shum\u00eb. Ato jan\u00eb t\u00eb nevojshme kur ka shum\u00eb p\u00ebrdorues me akses n\u00eb vet\u00eb server\u00ebt.<\/li>\n<li>Kufizimi i aksesit n\u00eb skedar\u00eb n\u00eb nivelin e sistemit t\u00eb skedar\u00ebve. Mund t\u00eb jepen t\u00eb drejta, privilegje t\u00eb aksesit n\u00eb katalog\u00eb, n\u00eb m\u00ebnyr\u00eb q\u00eb \u00e7do administrator t\u00eb merrte akses vet\u00ebm n\u00eb t\u00eb dh\u00ebnat e nevojshme.<\/li>\n<li>Aksesi i mandatuar dhe pastrimi i memories jan\u00eb teknologji q\u00eb p\u00ebrdoren rrall\u00eb.<\/li>\n<li>Kriptimi prov\u00eb-deri-n\u00eb-deri n\u00eb vet\u00eb DBMS-n\u00eb \u00ebsht\u00eb kriptimi nga pala e klientit me menaxhimin e \u00e7el\u00ebsave n\u00eb an\u00ebn e serverit.<\/li>\n<li>Kriptimi i t\u00eb dh\u00ebnave. P\u00ebr shembull, kriptimi kolonial - kur p\u00ebrdorni nj\u00eb mekaniz\u00ebm q\u00eb kripton nj\u00eb kolon\u00eb t\u00eb vetme t\u00eb baz\u00ebs.<\/li>\n<\/ol>\n<p><\/p>\n<h3>Si ndikon kjo n\u00eb performanc\u00ebn e DBMS-s\u00eb?<\/h3>\n<p>\nLe t\u00eb shikojm\u00eb shembullin e kriptimit kolonial n\u00eb PostgreSQL. Atje ka modulin pgcrypto, ai lejon ruajtjen e fushave t\u00eb zgjedhura n\u00eb format t\u00eb koduar. Kjo \u00ebsht\u00eb e dobishme kur vet\u00ebm disa t\u00eb dh\u00ebna kan\u00eb vler\u00eb. P\u00ebr t\u00eb lexuar fushat e koduara, klienti transferon \u00e7el\u00ebsin dekryptues, serveri dekrypton t\u00eb dh\u00ebnat dhe i dor\u00ebzon ato klientit. Pa \u00e7el\u00ebsin, askush nuk mund t\u00eb b\u00ebj\u00eb asgj\u00eb me t\u00eb dh\u00ebnat tuaja.<\/p>\n<p><strong>Le t\u00eb b\u00ebjm\u00eb nj\u00eb test me pgcrypto.<\/strong>. Ta krijojm\u00eb nj\u00eb tabel\u00eb me t\u00eb dh\u00ebna t\u00eb kriptuara dhe me t\u00eb dh\u00ebna t\u00eb zakonshme. M\u00eb posht\u00eb jan\u00eb komandat p\u00ebr t\u00eb krijuar tabelat, n\u00eb rreshtin e par\u00eb \u00ebsht\u00eb nj\u00eb komand\u00eb e dobishme - krijimi i zgjerimit me regjistrimin e DBMS-s\u00eb:<\/p>\n<pre><code class=\"plaintext\">CREATE EXTENSION pgcrypto;\nCREATE TABLE t1 (id integer, text1 text, text2 text);\nCREATE TABLE t2 (id integer, text1 bytea, text2 bytea);\nINSERT INTO t1 (id, text1, text2)\nVALUES (generate_series(1,10000000), generate_series(1,10000000)::text, generate_series(1,10000000)::text);\nINSERT INTO t2 (id, text1, text2) VALUES (\ngenerate_series(1,10000000),\nencrypt(cast(generate_series(1,10000000) AS text)::bytea, 'key'::bytea, 'bf'),\nencrypt(cast(generate_series(1,10000000) AS text)::bytea, 'key'::bytea, 'bf'));<\/code><\/pre>\n<p>\nM\u00eb pas, do t\u00eb p\u00ebrpiqemi t\u00eb b\u00ebjm\u00eb nj\u00eb p\u00ebrzgjedhje t\u00eb dh\u00ebnash nga secila tabel\u00eb dhe do t\u00eb shohim koha e ekzekutimit.<\/p>\n<p><strong>P\u00ebrzgjedhja nga tabela pa funksionin e enkriptimit<\/strong>:<\/p>\n<pre><code class=\"plaintext\">psql -c \"timing\" -c \"select * from t1 limit 1000;\" \"host=192.168.220.129 dbname=taskdb user=postgres sslmode=disable\" &gt; 1.txt<\/code><\/pre>\n<p>\nNum\u00ebruesi \u00ebsht\u00eb aktivizuar.<\/p>\n<p>\u00a0\u00a0id | text1 | text2<br \/>\n------+------+-+------<br \/>\n 1 | 1 \u00a0 \u00a0 | 1<br \/>\n 2 | 2 \u00a0 \u00a0 | 2<br \/>\n 3 | 3 \u00a0 \u00a0 | 3<br \/>\n\u2026<br \/>\n997 | 997 \u00a0 | 997<br \/>\n998 | 998 \u00a0 | 998<br \/>\n999 | 999 \u00a0 | 999<br \/>\n1000 | 1000\u00a0 | 1000<br \/>\n(1000 rreshta)<\/p>\n<p>Koha: 1,386 ms<\/p>\n<p><strong>P\u00ebrzgjedhja nga tabela me funksionin e enkriptimit:<\/strong><\/p>\n<pre><code class=\"plaintext\">psql -c \"timing\" -c \"select id, decrypt(text1, 'key'::bytea, 'bf'), decrypt(text2, 'key'::bytea, 'bf') from t2 limit 1000;\" \"host=192.168.220.129 dbname=taskdb user=postgres sslmode=disable\" &gt; 2.txt<\/code><\/pre>\n<p>\nNum\u00ebruesi \u00ebsht\u00eb aktivizuar.<\/p>\n<p>\u00a0\u00a0id | decrypt | decrypt<br \/>\n------+--------+--------<br \/>\n 1 | x31 | x31<br \/>\n 2 | x32 | x32<br \/>\n 3 | x33 | x33<br \/>\n\u2026<br \/>\n999 | x393939 | x393939<br \/>\n1000 | x31303030 | x31303030<br \/>\n(1000 rreshta)<\/p>\n<p>Koha: 50,203 ms<\/p>\n<p><strong>Rezultatet e testimit<\/strong>:<\/p>\n<p>\u00a0<br \/>\n<strong>Pa enkriptim<\/strong><br \/>\n<strong>Pgcrypto (\u00e7decrypt)<\/strong><\/p>\n<p>P\u00ebrzgjedhja e 1000 rreshtave<br \/>\n1,386 ms<br \/>\n50,203 ms<\/p>\n<p>CPU<br \/>\n15%<br \/>\n35%<\/p>\n<p>RAM<br \/>\n\u00a0<br \/>\n+5%<\/p>\n<p>\nEnkriptimi ndikon ndjesh\u00ebm n\u00eb performanc\u00ebn. \u00cbsht\u00eb e dukshme se koha \u00ebsht\u00eb rritur, sepse operacionet e dekryptimit t\u00eb t\u00eb dh\u00ebnave t\u00eb enkriptura (dhe dekryptimi zakonisht \u00ebsht\u00eb i mb\u00ebshtjell\u00eb n\u00eb logjik\u00ebn tuaj) k\u00ebrkojn\u00eb burime t\u00eb konsiderueshme. Pra, ideja p\u00ebr t\u00eb enkriptuar t\u00eb gjitha kolonat q\u00eb p\u00ebrmbajn\u00eb disa t\u00eb dh\u00ebna sjell me vete ulje t\u00eb performanc\u00ebs.<\/p>\n<p>P\u00ebrve\u00e7 k\u00ebsaj, enkriptimi nuk \u00ebsht\u00eb nj\u00eb plumb argjendi q\u00eb zgjith \u00e7do problem. T\u00eb dh\u00ebnat e dekryptuara dhe \u00e7el\u00ebsi i dekryptimit gjat\u00eb procesit t\u00eb dekryptimit dhe transmetimit t\u00eb t\u00eb dh\u00ebnave ndodhen n\u00eb server. Prandaj, \u00e7el\u00ebsat mund t\u00eb kapen nga ata q\u00eb kan\u00eb qasje t\u00eb plot\u00eb n\u00eb serverin e baz\u00ebs s\u00eb t\u00eb dh\u00ebnave, si administrator\u00ebt e sistemit.<\/p>\n<p>Kur ka nj\u00eb \u00e7el\u00ebs p\u00ebr t\u00eb gjith\u00eb kolon\u00ebn p\u00ebr t\u00eb gjith\u00eb p\u00ebrdoruesit (edhe n\u00ebse jo p\u00ebr t\u00eb gjith\u00eb, por p\u00ebr nj\u00eb grup t\u00eb kufizuar klient\u00ebsh), kjo nuk \u00ebsht\u00eb gjithmon\u00eb mir\u00eb dhe e drejt\u00eb. Pik\u00ebrisht p\u00ebr k\u00ebt\u00eb filluan t\u00eb b\u00ebjn\u00eb enkriptimin end-to-end, n\u00eb DBM filluan t\u00eb shqyrtojn\u00eb mund\u00ebsit\u00eb e enkriptimit t\u00eb dh\u00ebnave nga ana e klientit dhe serverit, u shfaq\u00ebn ato depozita key-vault \u2014 produkte t\u00eb ve\u00e7anta q\u00eb ofrojn\u00eb menaxhimin e \u00e7el\u00ebsave nga ana e DBM.<\/p>\n<p><img decoding=\"async\" alt=\"Siguria dhe DBMS: \u00e7far\u00eb duhet t\u00eb mbani parasysh kur zgjidhni mjete mbrojt\u00ebse\" src=\"\/wp-content\/uploads\/2020\/05\/cbaa7b9579a65963518ba3cec6114842.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/docs.mongodb.com\/manual\/core\/security-client-side-encryption\/\"><i>Shembuj t\u00eb till\u00eb t\u00eb enkriptimit n\u00eb MongoDB<\/i><\/a><\/noindex><\/p>\n<h2>Mjetet e siguris\u00eb n\u00eb DBM komerciale dhe open source<\/h2>\n<p><\/p>\n<p><strong>Funksionet<\/strong><br \/>\n<strong>Lloji<\/strong><br \/>\n<strong>Politika e Fjal\u00ebkalimit<\/strong><br \/>\n<strong>Auditimi<\/strong><br \/>\n<strong>Mbrojtja e kodit burimor t\u00eb procedurave dhe funksioneve<\/strong><br \/>\n<strong>RLS<\/strong><br \/>\n<strong>Enkriptimi<\/strong><\/p>\n<p><strong>Oracle<\/strong><br \/>\nKomerciale<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p><strong>MsSql<\/strong><br \/>\nKomerciale<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/www.gaz-is.ru\/produkty\/inform-sistemy\/subd-jatoba.html\"><strong>Jatoba<\/strong><\/a><\/noindex><br \/>\nKomerciale<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\n+<br \/>\nzgjerime<\/p>\n<p><strong>PostgreSQL<\/strong><br \/>\nFal\u00eb<br \/>\nzgjerime<br \/>\nzgjerime<br \/>\n\u2014<br \/>\n+<br \/>\nzgjerime<\/p>\n<p><strong>MongoDb<\/strong><br \/>\nFal\u00eb<br \/>\n\u2014<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<br \/>\nE disponueshme vet\u00ebm n\u00eb MongoDB Enterprise<\/p>\n<p>\nTabela nuk \u00ebsht\u00eb aspak e plot\u00eb, por situata \u00ebsht\u00eb kjo: n\u00eb produktet komerciale, problemet e siguris\u00eb jan\u00eb zgjidhur prej koh\u00ebsh, n\u00eb open source, zakonisht p\u00ebr sigurin\u00eb p\u00ebrdorin disa shtesa, shum\u00eb funksione mungojn\u00eb, ndonj\u00ebher\u00eb duhet t\u00eb shkruash di\u00e7ka. P\u00ebr shembull, politikat e fjal\u00ebkalimeve \u2014 n\u00eb PostgreSQL ka shum\u00eb zgjerime t\u00eb ndryshme<noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/postgres\/postgres\/tree\/master\/contrib\/passwordcheck\">1<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ykrysko\/passwordcheck\">2<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/michaelpq\/pg_plugins\/tree\/master\/passwordcheck_extra\">3<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/devrimgunduz\/passwordcheck_cracklib\">4<\/a><\/noindex>, <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/asio\/password\">5<\/a><\/noindex>), t\u00eb cilat zbatojn\u00eb politika passwordi, por t\u00eb gjitha nevojat e segmentit t\u00eb brendsh\u00ebm korporativ, sipas mendimit tim, asnj\u00eb nuk e mbulon.<\/p>\n<p><strong>\u00c7far\u00eb t\u00eb b\u00ebni, n\u00ebse nuk ka gj\u00ebkundi at\u00eb q\u00eb nevojitet<\/strong>? \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0445\u043e\u0447\u0435\u0442\u0441\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u0443\u044e \u0421\u0423\u0411\u0414, \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u043d\u0435\u0442 \u0444\u0443\u043d\u043a\u0446\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a.<\/p>\n<p>At\u00ebher\u00eb mund t\u00eb p\u00ebrdorni zgjidhje t\u00eb pal\u00ebve t\u00eb treta, t\u00eb cilat funksionojn\u00eb me DBMS t\u00eb ndryshme, p\u00ebr shembull, \"Kripto DB\" ose \"Garda DB\". N\u00ebse flasim p\u00ebr zgjidhje nga segmenti i brendsh\u00ebm, atje din\u00eb m\u00eb mir\u00eb p\u00ebr GOST-t\u00eb sesa n\u00eb open source.<\/p>\n<p>Opsioni i dyt\u00eb \u2014 t\u00eb shkruani vet\u00eb at\u00eb q\u00eb nevojitet, t\u00eb realizoni n\u00eb nivelin e procedurave qasje n\u00eb t\u00eb dh\u00ebna dhe enkriptimin n\u00eb aplikacion. E v\u00ebrteta, me GOST-in do t\u00eb jet\u00eb m\u00eb e v\u00ebshtir\u00eb. Por n\u00eb p\u00ebrgjith\u00ebsi \u2014 mund t\u00eb fshihni t\u00eb dh\u00ebnat, ashtu si\u00e7 duhet, t\u2019i vendosni n\u00eb DBMS, pastaj t\u2019i merrni dhe t\u2019i dekoloni si duhet, drejtp\u00ebrdrejt n\u00eb nivelin e aplikacionit. N\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, mendoni se si do t\u2019i mbroni k\u00ebto algoritme n\u00eb aplikacion. Sipas mendimit ton\u00eb, kjo duhet t\u00eb b\u00ebhet n\u00eb nivelin e DBMS, sepse k\u00ebshtu do t\u00eb punoj\u00eb m\u00eb shpejt.<\/p>\n<p>Ky raport u paraqit p\u00ebr her\u00eb t\u00eb par\u00eb n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/corp.mail.ru\/ru\/press\/events\/databases-1\/\">@Databases Meetup<\/a><\/noindex> nga Mail.ru Cloud Solutions. Shikoni<noindex><a rel=\"nofollow\" href=\"https:\/\/www.youtube.com\/redirect?q=https%3A%2F%2Fbit.ly%2F2U57FAd&amp;redir_token=XNWSBN1AKQA2sjhdReDAv6VnkOV8MTU4OTAxNjMwMEAxNTg4OTI5OTAw&amp;v=wigSv2_zWBU&amp;event=video_description\"> video <\/a><\/noindex>prezentime t\u00eb tjera dhe abonohuni n\u00eb njoftimet e ngjarjeve n\u00eb Telegram <noindex><a rel=\"nofollow\" href=\"https:\/\/t.me\/k8s_mail\">Rreth Kubernetes n\u00eb Mail.ru Group<\/a><\/noindex>.<\/p>\n<p><strong>\u00c7far\u00eb tjet\u00ebr t\u00eb lexoni mbi k\u00ebt\u00eb tem\u00eb<\/strong>:<\/p>\n<ol>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/472694\/\">M\u00eb shum\u00eb se Ceph: ruajtja bllok e cloud-it MCS<\/a><\/noindex>.<\/li>\n<li><noindex><a rel=\"nofollow\" href=\"https:\/\/mcs.mail.ru\/blog\/kakuyu-bazu-dannyh-vybrat-dlya-proekta-chtoby-ne-oshibitsya\">Si t\u00eb zgjidhni nj\u00eb baz\u00eb t\u00eb dh\u00ebnash p\u00ebr projektin, q\u00eb t\u00eb mos zgjidhni p\u00ebrs\u00ebri<\/a><\/noindex>.<\/li>\n<\/ol>\n<p>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/mailru\/blog\/500708\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441 \u0420\u043e\u0436\u043a\u043e\u0432, \u044f \u0440\u0443\u043a\u043e\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u041f\u041e \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u00ab\u0413\u0430\u0437\u0438\u043d\u0444\u043e\u0440\u043c\u0441\u0435\u0440\u0432\u0438\u0441\u00bb, \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430 Jatoba. \u0417\u0430\u043a\u043e\u043d\u043e\u0434\u0430\u0442\u0435\u043b\u044c\u0441\u0442\u0432\u043e \u0438 \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u043d\u043e\u0440\u043c\u044b \u043d\u0430\u043a\u043b\u0430\u0434\u044b\u0432\u0430\u044e\u0442 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f \u043a \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u0430\u043d\u043d\u044b\u0445. \u041d\u0438\u043a\u0442\u043e \u043d\u0435 \u0445\u043e\u0447\u0435\u0442, \u0447\u0442\u043e\u0431\u044b \u0442\u0440\u0435\u0442\u044c\u0438 \u043b\u0438\u0446\u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0434\u043b\u044f \u043b\u044e\u0431\u043e\u0433\u043e \u043f\u0440\u043e\u0435\u043a\u0442\u0430 \u0432\u0430\u0436\u043d\u044b \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0432\u043e\u043f\u0440\u043e\u0441\u044b: \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f, \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430\u043c\u0438 \u043a \u0434\u0430\u043d\u043d\u044b\u043c, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":81885,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-81884","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438 \u0421\u0423\u0411\u0414: \u043e \u0447\u0451\u043c \u043d\u0430\u0434\u043e \u043f\u043e\u043c\u043d\u0438\u0442\u044c, \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u044f \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-05-17T11:42:18+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-05-17T11:42:18+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Siguria dhe DBMS: p\u00ebr \u00e7far\u00eb duhet t\u00eb kujdeseni, kur zgjidhni mjetet mbrojt\u00ebse | ProHoster","description":"M\u00eb quajn\u00eb Denis.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438 \u0421\u0423\u0411\u0414: \u043e \u0447\u0451\u043c \u043d\u0430\u0434\u043e \u043f\u043e\u043c\u043d\u0438\u0442\u044c, \u043f\u043e\u0434\u0431\u0438\u0440\u0430\u044f \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b | ProHoster","og:description":"\u041c\u0435\u043d\u044f \u0437\u043e\u0432\u0443\u0442 \u0414\u0435\u043d\u0438\u0441.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/bezopasnost-i-subd-o-chyom-nado-pomnit-podbiraya-sredstva-zashhity","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-05-17T11:42:18+00:00","article:modified_time":"2020-05-17T11:42:18+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"81884","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 15:48:24","updated":"2022-10-05 02:01:28","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/81884","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=81884"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/81884\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/81885"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=81884"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=81884"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=81884"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}