![\"IaaS](\"\/wp-content\/uploads\/2020\/09\/d91a5d152754f82316e0027fd3447b53.jpg\")
<\/p>\n<\/p>\n
Pavar se cdo mit \u00e7far\u00eb e rrethon p\u00ebrputhjen me 152-FZ, di\u00e7ka gjithmon\u00eb mbetet jasht\u00eb korniz\u00ebs. Sot d\u00ebshirojm\u00eb t\u00eb diskutojm\u00eb nuancat q\u00eb nuk jan\u00eb gjithmon\u00eb t\u00eb qarta, me t\u00eb cilat mund t\u00eb p\u00ebrballen si kompanit\u00eb e m\u00ebdha, ashtu edhe nd\u00ebrmarrjet shum\u00eb t\u00eb vogla:<\/p>\n
nuancat e klasifikimit t\u00eb t\u00eb dh\u00ebnave personale sipas kategorive \u2014 kur nj\u00eb dyqan i vog\u00ebl n\u00eb internet mbledh t\u00eb dh\u00ebna q\u00eb p\u00ebrkasin n\u00eb nj\u00eb kategori speciale, pa e ditur k\u00ebt\u00eb;<\/p>\n<\/li>\n
ku mund t\u00eb ruhen backup-et e t\u00eb dh\u00ebnave t\u00eb mbledhura dhe t\u00eb kryhen operacione mbi to;<\/p>\n<\/li>\n
\u00e7far\u00eb e ndan certifikat\u00ebn nga konkluzioni p\u00ebr p\u00ebrputhshm\u00ebrin\u00eb, cilat dokumente duhet t\u00eb k\u00ebrkohen nga ofruesi dhe gjith\u00e7ka tjet\u00ebr e till\u00eb.<\/p>\n<\/li>\n<\/ul>\n
N\u00eb fund, do t\u00eb ndajm\u00eb me ju p\u00ebrvoj\u00ebn ton\u00eb n\u00eb kalimin e certifikimit. Le t\u00eb fillojm\u00eb!<\/p>\n
Eksperti n\u00eb k\u00ebt\u00eb artikull do t\u00eb jet\u00eb Aleksej Afanasev<\/strong>, ekspert n\u00eb \u00e7\u00ebshtjet e siguris\u00eb s\u00eb informacionit p\u00ebr ofruesit e sh\u00ebrbimeve n\u00eb re \u2018IT-GRAD\u2019 dhe #CloudMTS (b\u00ebjn\u00eb pjes\u00eb n\u00eb grupin MTS).<\/em><\/p>\n Ne shpesh p\u00ebrballemi me d\u00ebshir\u00ebn e klientit p\u00ebr t\u00eb p\u00ebrcaktuar shpejt, pa auditimin e sistemeve t\u00eb informacionit, nivelin e nevojsh\u00ebm t\u00eb mbrojtjes p\u00ebr sistemet e informacionit t\u00eb t\u00eb dh\u00ebnave personale. Disa materiale n\u00eb internet mbi k\u00ebt\u00eb tem\u00eb krijojn\u00eb nj\u00eb p\u00ebrshtypje t\u00eb gabuar se kjo \u00ebsht\u00eb nj\u00eb detyr\u00eb e thjesht\u00eb dhe se gabimi \u00ebsht\u00eb mjaft i v\u00ebshtir\u00eb p\u00ebr t'u b\u00ebr\u00eb.<\/p>\n P\u00ebr t\u00eb p\u00ebrcaktuar nivelin e mbrojtjes \u00ebsht\u00eb e nevojshme t\u00eb kuptohet se cilat t\u00eb dh\u00ebna do t\u00eb mblidhen dhe p\u00ebrpunohen nga sistemi i informacionit t\u00eb klientit. Ndonj\u00ebher\u00eb \u00ebsht\u00eb e v\u00ebshtir\u00eb t\u00eb p\u00ebrcaktohen qart\u00eb k\u00ebrkesat p\u00ebr mbrojtje dhe kategoria e t\u00eb dh\u00ebnave personale me t\u00eb cilat operon biznesi. T\u00eb nj\u00ebjtat lloje t\u00eb t\u00eb dh\u00ebnave personale mund t\u00eb vler\u00ebsohen dhe klasifikohen n\u00eb m\u00ebnyra t\u00eb ndryshme. Prandaj, n\u00eb disa raste mendimi i biznesit mund t\u00eb mos jet\u00eb n\u00eb p\u00ebrputhje me mendimin e auditorit ose madje edhe t\u00eb kontrolluesit. Le t\u00eb shqyrtojm\u00eb disa shembuj.<\/p>\n Parku i automjeteve.<\/strong> Duket si nj\u00eb form\u00eb tradicionale biznesi. Shum\u00eb parqe automjetesh funksionojn\u00eb p\u00ebr dekada, dhe pronar\u00ebt e tyre pun\u00ebsojn\u00eb individ\u00eb, persona fizik\u00eb. N\u00eb p\u00ebrgjith\u00ebsi, t\u00eb dh\u00ebnat e punonj\u00ebsve bien n\u00ebn k\u00ebrkesat e UZ-4. Megjithat\u00eb, p\u00ebr t\u00eb punuar me shofer\u00ebt, nuk mjafton vet\u00ebm t\u00eb mblidhen t\u00eb dh\u00ebnat anketuese, por duhet gjithashtu t\u00eb kryhet nj\u00eb kontroll mjek\u00ebsor n\u00eb territorin e parkut t\u00eb automjeteve para fillimit t\u00eb ndryshimit, dhe informatat e grumbulluara gjat\u00eb procesit bien menj\u00ebher\u00eb n\u00eb kategorin\u00eb e t\u00eb dh\u00ebnave mjek\u00ebsore \u2013 e cila \u00ebsht\u00eb nj\u00eb kategori speciale e t\u00eb dh\u00ebnave personale. P\u00ebr m\u00eb tep\u00ebr, parku i automjeteve mund t\u00eb k\u00ebrkoj\u00eb d\u00ebshmi q\u00eb do t\u00eb ruhen n\u00eb dosjen e shoferit. Nj\u00eb skan i till\u00eb i nj\u00eb d\u00ebshmie n\u00eb format elektronik \u2014 t\u00eb dh\u00ebna mbi gjendjen sh\u00ebndet\u00ebsore, t\u00eb dh\u00ebna personale t\u00eb kategoris\u00eb speciale. K\u00ebshtu, UZ-4 nuk mjafton m\u00eb, k\u00ebrkohet t\u00eb pakt\u00ebn UZ-3.<\/p>\n Dyqani online. <\/strong>Duket sikur emrat, email-et dhe telefonat q\u00eb mblidhen bien n\u00eb kategorin\u00eb e informacionit publik. Megjithat\u00eb, n\u00ebse klient\u00ebt tuaj ofrojn\u00eb preferenca gastronomike, p\u00ebr shembull, halal ose kosher, nj\u00eb informacion i till\u00eb mund t\u00eb konsiderohet si t\u00eb dh\u00ebna mbi p\u00ebrkat\u00ebsin\u00eb dhe besimet fetare. Prandaj, gjat\u00eb kontrollit ose zhvillimit t\u00eb aktiviteteve t\u00eb tjera kontrolluese, inspektori mund t\u00eb klasifikoj\u00eb t\u00eb dh\u00ebnat q\u00eb po mblidhen prej jush n\u00eb nj\u00eb kategori speciale t\u00eb PDb. N\u00ebse dyqani online do t\u00eb mbledh\u00eb informacion mbi at\u00eb q\u00eb preferon bler\u00ebsi, qofshin mish apo peshk, t\u00eb dh\u00ebnat mund t\u00eb klasifikohen n\u00eb kategorin\u00eb e t\u00eb dh\u00ebnave t\u00eb tjera t\u00eb PDb. A p\u00ebrve\u00e7 k\u00ebsaj, \u00e7far\u00eb duhet b\u00ebr\u00eb me vegetarian\u00ebt? Sepse kjo gjithashtu mund t\u00eb lidhet me bindjet filozofike, t\u00eb cilat jan\u00eb gjithashtu pjes\u00eb e kategoris\u00eb speciale. Por, nga ana tjet\u00ebr, mund t\u00eb jet\u00eb thjesht nj\u00eb pozicion i nj\u00eb personi q\u00eb ka eliminuar mishin nga dieta e tij. Fatkeq\u00ebsisht, nuk ka asnj\u00eb tabel\u00eb q\u00eb p\u00ebrcaktonte n\u00eb m\u00ebnyr\u00eb t\u00eb qart\u00eb kategorin\u00eb e PDb n\u00eb situata t\u00eb tilla \"t\u00eb holl\u00ebsishme\".<\/p>\n Agjencia reklamave <\/strong>n\u00ebp\u00ebrmjet ndonj\u00eb sh\u00ebrbimi cloud per\u00ebndimor p\u00ebrpunon t\u00eb dh\u00ebnat publike t\u00eb klient\u00ebve t\u00eb saj \u2014 emrat e plot\u00eb, adresat e emailit dhe numrat e telefonit. K\u00ebto t\u00eb dh\u00ebna, natyrisht, bien n\u00eb kategorin\u00eb e t\u00eb dh\u00ebnave personale. Lind pyetja: \u00ebsht\u00eb ligjore t\u00eb b\u00ebhet nj\u00eb p\u00ebrpunim i till\u00eb? A \u00ebsht\u00eb e mundur t\u00eb shuhen k\u00ebto t\u00eb dh\u00ebna pa i anonimizuar p\u00ebrtej RF, p\u00ebr shembull, ruajtja e kopjeve rezerv\u00eb n\u00eb ndonj\u00eb cloud n\u00eb t\u00eb huaj? Sigurisht, \u00ebsht\u00eb e mundur. Agjencia ka t\u00eb drejt\u00ebn t\u00eb ruaj\u00eb k\u00ebto t\u00eb dh\u00ebna edhe jasht\u00eb Rusis\u00eb, megjithat\u00eb, mbledhja e par\u00eb, sipas legjislacionit ton\u00eb, duhet t\u00eb kryhet n\u00eb territorin e RF. N\u00ebse b\u00ebni backup t\u00eb k\u00ebtij informacioni, planifikoni t\u00eb merrni ndonj\u00eb statistik\u00eb mbi t\u00eb, kryeni k\u00ebrkime ose realizoni ndonj\u00eb operacion tjet\u00ebr me ta \u2014 gjith\u00e7ka kjo mund t\u00eb b\u00ebhet edhe n\u00eb burime per\u00ebndimore. Pik\u00eb ky\u00e7e nga k\u00ebndv\u00ebshtrimi i legjislacionit \u00ebsht\u00eb vendi ku ndodh mbledhja e t\u00eb dh\u00ebnave personale. Prandaj, \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb mos ngat\u00ebrroni mbledhjen fillestare me p\u00ebrpunimin.<\/p>\n Si\u00e7 tregohet n\u00eb k\u00ebto shembuj t\u00eb shpejt\u00eb, puna me t\u00eb dh\u00ebnat personale nuk \u00ebsht\u00eb gjithmon\u00eb e qart\u00eb dhe e thjesht\u00eb. Duhet jo vet\u00ebm t\u00eb dini se po punoni me to, por edhe t\u00eb jeni n\u00eb gjendje t'i klasifikoni sakt\u00eb, t\u00eb kuptoni si funksionon informacioni i sistemeve, p\u00ebr t\u00eb p\u00ebrcaktuar sakt\u00eb nivelin e k\u00ebrkuar t\u00eb siguris\u00eb. N\u00eb disa raste, mund t\u00eb lind\u00eb pyetja se cilat t\u00eb dh\u00ebna jan\u00eb n\u00eb t\u00eb v\u00ebrtet\u00eb t\u00eb nevojshme p\u00ebr organizat\u00ebn p\u00ebr t\u00eb funksionuar. A \u00ebsht\u00eb e mundur t\u00eb hiqen t\u00eb dh\u00ebnat m\u00eb \"t\u00eb rrezikshme\" ose thjesht t\u00eb panevojshme? P\u00ebr m\u00eb tep\u00ebr, rregullatori rekomandon t\u00eb anonimizoni t\u00eb dh\u00ebnat personale atje ku \u00ebsht\u00eb e mundur. <\/p>\n Si\u00e7 ndodhi n\u00eb shembujt e m\u00ebsip\u00ebrm, ndonj\u00ebher\u00eb mund t\u00eb p\u00ebrballeni me faktin se organet kontrolluese interpretojn\u00eb t\u00eb dh\u00ebnat personale t\u00eb mbledhura ndryshe nga sa i keni vler\u00ebsuar ju.<\/p>\n Sigurisht, mund t\u00eb merrni ndihm\u00ebs auditor\u00eb ose integrator\u00eb sistemesh, por a do t\u00eb jet\u00eb \"ndihm\u00ebs\" p\u00ebrgjegj\u00ebs p\u00ebr vendimet e marra n\u00eb rast t\u00eb kontrollit? Duhet theksuar se p\u00ebrgjegj\u00ebsia gjithmon\u00eb i takon pronarit t\u00eb sistemit t\u00eb informacionit p\u00ebr t\u00eb dh\u00ebnat personale \u2013 operatorit t\u00eb t\u00eb dh\u00ebnave personale. Prandaj, kur nj\u00eb kompani kryen k\u00ebto lloje pun\u00ebsh, \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb drejtoheni te lojtar\u00eb serioz\u00eb n\u00eb tregun e k\u00ebtyre sh\u00ebrbimeve, p\u00ebr shembull, kompanit\u00eb q\u00eb kryejn\u00eb pun\u00eb certifikimi. Kompanit\u00eb certifikuese kan\u00eb p\u00ebrvoj\u00eb t\u00eb gjer\u00eb n\u00eb realizimin e k\u00ebtyre pun\u00ebve.<\/p>\n Nd\u00ebrtimi i ISPDn - nuk \u00ebsht\u00eb vet\u00ebm nj\u00eb \u00e7\u00ebshtje teknike, por n\u00eb nj\u00eb mas\u00eb t\u00eb madhe edhe ligjore. Drejtori i IT-s\u00eb ose drejtori p\u00ebr sigurin\u00eb duhet patjet\u00ebr t\u00eb konsultohet me nj\u00eb avokat. Duke marr\u00eb parasysh se n\u00eb kompani shum\u00eb shpesh nuk ka nj\u00eb specialist me profilin e nevojsh\u00ebm, ia vlen t\u00eb shikoni nga auditor\u00ebt-konsulent\u00eb. Shum\u00eb momente delikate mund t\u00eb mos jen\u00eb aspak t\u00eb dukshme.<\/p>\n Konsultimi do t\u00eb ndihmoj\u00eb t\u00eb p\u00ebrcaktoni se me cilat t\u00eb dh\u00ebna personale po merret, cilat jan\u00eb niveli i mbrojtjes q\u00eb k\u00ebrkojn\u00eb ato. P\u00ebr pasoj\u00eb, do t\u00eb merrni nj\u00eb p\u00ebrfaq\u00ebsim t\u00eb IS, q\u00eb \u00ebsht\u00eb e nevojshme t\u00eb krijoni ose t\u00eb plot\u00ebsoni me mjete mbrojt\u00ebse dhe ORD.<\/p>\n Shpesh zgjedhja p\u00ebr kompanin\u00eb \u00ebsht\u00eb midis dy mund\u00ebsive:<\/p>\n T\u00eb nd\u00ebrtoni nj\u00eb IS p\u00ebrkat\u00ebse me zgjidhjet tuaja programore dhe harduerike, ndoshta n\u00eb serverin tuaj.<\/p>\n<\/li>\n T\u00eb drejtoheni te nj\u00eb ofrues i sh\u00ebrbimeve n\u00eb cloud dhe t\u00eb zgjidhni nj\u00eb zgjidhje elastike, tashm\u00eb t\u00eb akredituar, si nj\u00eb \"server virtual\".<\/p>\n<\/li>\n<\/ol>\n Shumica e IS q\u00eb p\u00ebrpunojn\u00eb PDat p\u00ebrdorin qasjen tradicionale, e cila, nga pik\u00ebpamja e biznesit, \u00ebsht\u00eb e v\u00ebshtir\u00eb t\u00eb quhet e leht\u00eb dhe e suksesshme. Kur zgjidhni k\u00ebt\u00eb variant, duhet t\u00eb kuptoni se projekti teknik do t\u00eb p\u00ebrfshij\u00eb nj\u00eb p\u00ebrshkrim t\u00eb pajisjeve, duke p\u00ebrfshir\u00eb zgjidhjet programore dhe harduerike dhe platformat. K\u00ebshtu, do t'ju duhet t\u00eb p\u00ebrballeni me v\u00ebshtir\u00ebsit\u00eb dhe kufizimet e m\u00ebposhtme:<\/p>\n v\u00ebshtir\u00ebsia e shkall\u00ebzimit;<\/p>\n<\/li>\n koha e gjat\u00eb e realizimit t\u00eb projektit: nevojitet t\u00eb zgjidhni, blini, instaloni, konfiguroni dhe p\u00ebrshkruani sistemin;<\/p>\n<\/li>\n nj\u00eb sasi e madhe e pun\u00ebve \"t\u00eb papelqyeshme\", p\u00ebr shembull - zhvillimi i paket\u00ebs s\u00eb plot\u00eb t\u00eb dokumentacionit p\u00ebr t\u00eb gjith\u00eb ISPDn.<\/p>\n<\/li>\n<\/ul>\n P\u00ebr m\u00eb tep\u00ebr, biznesi, zakonisht, merret vet\u00ebm me nivelin e \"sip\u00ebrm\" t\u00eb IS-s\u00eb s\u00eb tij - n\u00eb aplikacionet e p\u00ebrdorura t\u00eb biznesit. Me fjal\u00eb t\u00eb tjera, stafi IT \u00ebsht\u00eb i kualifikuar n\u00eb fush\u00ebn e tij t\u00eb ngusht\u00eb. Mungon kuptimi se si funksionojn\u00eb t\u00eb gjitha \"niveli posht\u00eb\": mjetet programore dhe harduerike p\u00ebr mbrojtje, sistemet e ruajtjes, kopjimi rezerv\u00eb dhe, sigurisht, si t\u00eb konfigurohen mjetet mbrojt\u00ebse n\u00eb p\u00ebrputhje me t\u00eb gjitha k\u00ebrkesat, t\u00eb nd\u00ebrtojn\u00eb pjes\u00ebn \"harduerike\" t\u00eb konfiguracionit. \u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb kuptohet: kjo \u00ebsht\u00eb nj\u00eb sasi e madhe njohurish q\u00eb q\u00ebndrojn\u00eb p\u00ebrtej biznesit t\u00eb klient\u00ebve. Pik\u00ebrisht k\u00ebtu mund t\u00eb ndihmoj\u00eb eksperienca e ofruesit t\u00eb sh\u00ebrbimeve n\u00eb cloud, q\u00eb ofron nj\u00eb \"server virtual\" t\u00eb akredituar.<\/p>\n Nga ana tjet\u00ebr, ofruesit e cloud kan\u00eb nj\u00eb s\u00ebr\u00eb p\u00ebrpar\u00ebsish q\u00eb, pa e tepruar, jan\u00eb n\u00eb gjendje t\u00eb plot\u00ebsojn\u00eb 99% t\u00eb nevojave t\u00eb biznesit n\u00eb fush\u00ebn e mbrojtjes s\u00eb t\u00eb dh\u00ebnave personale:<\/p>\n shpenzimet kapitale transformohen n\u00eb shpenzime operacionale;<\/p>\n<\/li>\n ofruesi nga ana e tij garanton sigurin\u00eb e nevojshme dhe disponueshm\u00ebrin\u00eb n\u00eb baz\u00eb t\u00eb nj\u00eb zgjidhjeje t\u00eb verifikuar standarde;<\/p>\n<\/li>\n nuk ka nevoj\u00eb t\u00eb mbani nj\u00eb staf specialist\u00ebsh q\u00eb do t\u00eb siguroj\u00eb funksionimin e sistemit t\u00eb menaxhimit t\u00eb t\u00eb dh\u00ebnave personale n\u00eb nivel 'hardueri';<\/p>\n<\/li>\n ofruesit ofrojn\u00eb zgjidhje shum\u00eb m\u00eb fleksibile dhe elastike;<\/p>\n<\/li>\n specialist\u00ebt e ofruesit kan\u00eb t\u00eb gjitha certifikatat e nevojshme;<\/p>\n<\/li>\n compliance \u00ebsht\u00eb po aq e lart\u00eb sa kur krijoni arkitektur\u00ebn tuaj, duke marr\u00eb parasysh k\u00ebrkesat dhe rekomandimet e rregullator\u00ebve.<\/p>\n<\/li>\n<\/ul>\n Miti i vjet\u00ebr se nuk mund t\u00eb vendosen t\u00eb dh\u00ebnat personale n\u00eb cloud \u00ebsht\u00eb ende jasht\u00ebzakonisht i popullarizuar. Ai \u00ebsht\u00eb i v\u00ebrtet\u00eb vet\u00ebm pjes\u00ebrisht: t\u00eb dh\u00ebnat personale me t\u00eb v\u00ebrtet\u00eb nuk mund t\u00eb vendosen n\u00eb cloud-in e par\u00eb q\u00eb i bie n\u00eb sy.<\/em> K\u00ebrkohet p\u00ebrmbushja e disa masave teknike, p\u00ebrdorimi i zgjidhjeve t\u00eb certifikuara. N\u00ebse ofruesi p\u00ebrmbush t\u00eb gjitha k\u00ebrkesat e legjislacionit, rreziqet e lidhura me rrjedhjen e t\u00eb dh\u00ebnave personale reduktohen n\u00eb minimum. Shum\u00eb ofrues kan\u00eb nj\u00eb infrastruktur\u00eb t\u00eb ve\u00e7ant\u00eb p\u00ebr p\u00ebrpunimin e t\u00eb dh\u00ebnave personale n\u00eb p\u00ebrputhje me 152-FZ. Megjithat\u00eb, zgjidhja e ofruesit duhet t\u00eb b\u00ebhet gjithashtu me njohuri mbi disa kritere, q\u00eb ne do t'i trajtojm\u00eb m\u00eb posht\u00eb. <\/p>\n Klient\u00ebt shpesh vijn\u00eb t\u00eb na shprehin disa shqet\u00ebsime lidhur me vendosjen e t\u00eb dh\u00ebnave personale n\u00eb cloud-in e ofruesit. Le t\u00eb flasim menj\u00ebher\u00eb p\u00ebr to.<\/p>\n T\u00eb dh\u00ebnat mund t\u00eb vidhen gjat\u00eb transferimit ose migrimit<\/p>\n<\/li>\n<\/ul>\n Nuk ka arsye p\u00ebr t'u shqet\u00ebsuar \u2014 ofruesi ofron krijimin e nj\u00eb kanali t\u00eb mbrojtur p\u00ebr transferimin e t\u00eb dh\u00ebnave, t\u00eb nd\u00ebrtuar mbi zgjidhje t\u00eb certifikuara, masa t\u00eb forcuara autentifikimi p\u00ebr pal\u00ebt dhe punonj\u00ebsit. Mbetej t\u00eb zgjidhni metodat e duhura t\u00eb mbrojtjes dhe t'i implementoni ato gjat\u00eb bashk\u00ebpunimit me klientin.<\/p>\n Mund t\u00eb arrijn\u00eb maskat dhe t\u00eb p\u00ebrfundojn\u00eb\/nd\u00ebrpresin\/\u00e7montojn\u00eb serverin<\/p>\n<\/li>\n<\/ul>\n \u00cbsht\u00eb e kuptueshme p\u00ebr klient\u00ebt q\u00eb kan\u00eb frik\u00eb se proceset e tyre t\u00eb biznesit do t\u00eb vin\u00eb n\u00eb rrezik si rezultat i kontrollit t\u00eb pamjaftuesh\u00ebm mbi infrastruktur\u00ebn. Zakonisht, ata mendojn\u00eb k\u00ebshtu jan\u00eb klient\u00ebt q\u00eb pajisjet e tyre ndodhej m\u00eb par\u00eb n\u00eb servera t\u00eb vegj\u00ebl dhe jo n\u00eb qendrat e t\u00eb dh\u00ebnave t\u00eb specializuara. N\u00eb realitet, qendrat e t\u00eb dh\u00ebnave jan\u00eb pajisur me mjete moderne t\u00eb mbrojtjes fizike dhe informacionit. \u00c7do operacion n\u00eb nj\u00eb qend\u00ebr t\u00eb till\u00eb t\u00eb t\u00eb dh\u00ebnave \u00ebsht\u00eb praktikisht i pamundur t\u00eb b\u00ebhet pa baz\u00eb dhe dokumentacion t\u00eb mjaftuesh\u00ebm, dhe aktivitete t\u00eb tilla k\u00ebrkojn\u00eb ndjekjen e nj\u00eb s\u00ebr\u00eb procedurash. P\u00ebr m\u00eb tep\u00ebr,<\/p>\n Haker\u00ebt do t\u00eb vjedhin re dhe do t\u00eb grabisin t\u00eb dh\u00ebnat<\/p>\n<\/li>\n<\/ul>\n Internet dhe shtypi jan\u00eb t\u00eb mbushur me tituj mbi m\u00ebnyr\u00ebn se si nj\u00eb tjet\u00ebr re ra viktim\u00eb e kriminel\u00ebve kibernetik\u00eb, duke lejuar q\u00eb miliona regjistrime me t\u00eb dh\u00ebna personale t\u00eb derdhen n\u00eb rrjet. N\u00eb shumic\u00ebn d\u00ebrrmuese t\u00eb rasteve, vulnerabilitetet jan\u00eb zbuluar jo n\u00eb an\u00ebn e ofruesit, por n\u00eb sistemet e viktimave: fjal\u00ebkalime t\u00eb dob\u00ebta ose madje fjal\u00ebkalime t\u00eb paracaktuar, 'vrima' n\u00eb motor\u00ebt e faqeve dhe bazat e t\u00eb dh\u00ebnave, dhe neglizhenca e zakonshme e biznesit n\u00eb zgjedhjen e mjeteve mbrojt\u00ebse dhe organizimin e procedurave p\u00ebr aksesin n\u00eb t\u00eb dh\u00ebna. T\u00eb gjitha zgjidhjet e akredituara kontrollohen p\u00ebr pranin\u00eb e vulnerabiliteteve. Ne gjithashtu kryejm\u00eb rregullisht teste 'kontrolli' dhe auditime t\u00eb siguris\u00eb, si n\u00eb m\u00ebnyr\u00eb t\u00eb pavarur ashtu edhe me ndihm\u00ebn e organizatave t\u00eb jashtme. P\u00ebr ofruesin, kjo \u00ebsht\u00eb nj\u00eb \u00e7\u00ebshtje e reputacionit dhe e biznesit n\u00eb t\u00ebr\u00ebsi.<\/p>\n Ofruesi \/ punonj\u00ebsit e ofruesit do t\u00eb vjedhin t\u00eb dh\u00ebna personale p\u00ebr q\u00ebllime t\u00eb interesa.<\/p>\n<\/li>\n<\/ul>\n Ky \u00ebsht\u00eb nj\u00eb moment mjaft delikat. Nj\u00eb s\u00ebr\u00eb kompanish n\u00eb fush\u00ebn e siguris\u00eb informative \"frik\u00ebsojn\u00eb\" klient\u00ebt e tyre dhe insistojn\u00eb se \"punonj\u00ebsit e brendsh\u00ebm jan\u00eb m\u00eb t\u00eb rreziksh\u00ebm se haker\u00ebt e jasht\u00ebm\". Ndoshta, n\u00eb disa raste \u00ebsht\u00eb e v\u00ebrtet\u00eb, por biznesi nuk mund t\u00eb nd\u00ebrtohet pa besim. Her\u00eb pas here, dalin lajme se punonj\u00ebsit e vet\u00eb organizatave shkelin t\u00eb dh\u00ebnat e klient\u00ebve p\u00ebrpara keqb\u00ebr\u00ebsve, dhe siguria e brendshme shpesh organizohet shum\u00eb m\u00eb keq se ajo e jashtme. K\u00ebtu \u00ebsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb kuptohet se \u00e7do ofrues i madh \u00ebsht\u00eb shum\u00eb i interesuar p\u00ebr t\u00eb shmangur rastet negative. Veprimet e punonj\u00ebsve t\u00eb ofruesit jan\u00eb t\u00eb rregulluara mir\u00eb, rolet jan\u00eb t\u00eb ndara dhe zonat e p\u00ebrgjegj\u00ebsis\u00eb jan\u00eb t\u00eb qarta. T\u00eb gjitha proceset e biznesit jan\u00eb t\u00eb nd\u00ebrtuara n\u00eb m\u00ebnyr\u00eb q\u00eb rastet e rrjedhjes s\u00eb t\u00eb dh\u00ebnave t\u00eb jen\u00eb shum\u00eb t\u00eb pakta dhe gjithmon\u00eb t\u00eb dukshme nga sh\u00ebrbimet e brendshme, prandaj klient\u00ebt nuk kan\u00eb pse t\u00eb shqet\u00ebsohen nga kjo an\u00eb.<\/p>\n Ju paguani pak, pasi paguani sh\u00ebrbimet me t\u00eb dh\u00ebnat e biznesit tuaj.<\/p>\n<\/li>\n<\/ul>\n Nj\u00eb mit tjet\u00ebr: klienti q\u00eb qiran\u00eb infrastruktur\u00eb t\u00eb mbrojtur me nj\u00eb \u00e7mim t\u00eb k\u00ebndsh\u00ebm, n\u00eb fakt paguan p\u00ebr t\u00eb me t\u00eb dh\u00ebnat e tij \u2013 k\u00ebshtu mendojn\u00eb shpesh specialist\u00ebt, t\u00eb cil\u00ebt nuk hezitojn\u00eb t\u00eb lexojn\u00eb disa teorira konspirative para se t\u00eb flen\u00eb. S\u00eb pari, mund\u00ebsia p\u00ebr t\u00eb kryer disa operacione me t\u00eb dh\u00ebnat tuaja p\u00ebrve\u00e7 atyre q\u00eb jan\u00eb t\u00eb specifikuara n\u00eb autorizimin, n\u00eb thelb \u00ebsht\u00eb e barabart\u00eb me zero. S\u00eb dyti, nj\u00eb ofrues i arsyesh\u00ebm e vler\u00ebson marr\u00ebdh\u00ebnien me ju dhe reputacionin e tij \u2013 p\u00ebrve\u00e7 jush, ai ka shum\u00eb klient\u00eb t\u00eb tjer\u00eb. Skema m\u00eb e mundshme \u00ebsht\u00eb ajo, n\u00eb t\u00eb cil\u00ebn ofruesi do t\u00eb mbroj\u00eb me zell t\u00eb dh\u00ebnat e klient\u00ebve t\u00eb tij, mbi t\u00eb cilat mb\u00ebshtetet gjithashtu biznisi i tij.<\/p>\n Sot, tregu ofron shum\u00eb zgjidhje p\u00ebr kompanit\u00eb q\u00eb jan\u00eb operator\u00eb t\u00eb t\u00eb dh\u00ebnave personale. M\u00eb posht\u00eb sjellim nj\u00eb list\u00eb t\u00eb p\u00ebrgjithshme rekomandimesh p\u00ebr zgjedhjen e t\u00eb p\u00ebrshtatshm\u00ebs.<\/p>\n Ofruesi duhet t\u00eb jet\u00eb i gatsh\u00ebm t\u00eb n\u00ebnshkruaj\u00eb nj\u00eb marr\u00ebveshje zyrtare me p\u00ebrshkrimin e detyrave t\u00eb pal\u00ebve, SLA dhe zonat e p\u00ebrgjegj\u00ebsis\u00eb n\u00eb lidhje me p\u00ebrpunimin e t\u00eb dh\u00ebnave personale. N\u00eb fakt, midis jush dhe ofruesit, p\u00ebrve\u00e7 marr\u00ebveshjes p\u00ebr sh\u00ebrbimin, duhet t\u00eb n\u00ebnshkruhet nj\u00eb autorizim p\u00ebr p\u00ebrpunimin e t\u00eb dh\u00ebnave personale. N\u00eb \u00e7do rast, vlen t\u00eb shqyrtohen me kujdes ato. \u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb kuptohet ndarjen e zonave t\u00eb p\u00ebrgjegj\u00ebsis\u00eb midis jush dhe ofruesit.<\/p>\n<\/li>\n T\u00eb lutemi vini re se segmenti duhet t\u00eb plot\u00ebsoj\u00eb k\u00ebrkesat, pra t\u00eb ket\u00eb nj\u00eb \u00e7ertifikat\u00eb q\u00eb tregon nivelin e siguris\u00eb jo m\u00eb t\u00eb ul\u00ebt se ai q\u00eb k\u00ebrkon sistemi juaj. Ndonj\u00ebher\u00eb, ofruesit publikojn\u00eb vet\u00ebm faqen e par\u00eb t\u00eb \u00e7ertifikat\u00ebs, nga e cila nuk kuptohet shum\u00eb, ose referohen n\u00eb auditime ose n\u00eb p\u00ebrputhshm\u00ebrin\u00eb e procedurave, pa publikuar vet\u00eb \u00e7ertifikat\u00ebn (\"por a ka qen\u00eb djaloshi?\"). Vlen ta k\u00ebrkoni at\u00eb \u2014 \u00ebsht\u00eb nj\u00eb dokument publik, n\u00eb t\u00eb cilin tregohet se nga kush \u00ebsht\u00eb b\u00ebr\u00eb \u00e7ertifikimi, afati i vlefshm\u00ebris\u00eb, vendndodhja e cloud-it etj.<\/p>\n<\/li>\n Ofruesi duhet t\u00eb siguroj\u00eb informacion mbi vendndodhjen e objekteve t\u00eb tij (objeketet e mbrojtjes), q\u00eb t\u00eb mund t\u00eb kontrolloni vendosjen e t\u00eb dh\u00ebnave tuaja. T\u00eb kujtojm\u00eb se mbledhja e par\u00eb e t\u00eb dh\u00ebnave personale duhet t\u00eb kryhet n\u00eb territorin e RF, p\u00ebr pasoj\u00eb n\u00eb kontrat\u00eb\/\u00e7ertifikat\u00eb \u00ebsht\u00eb e d\u00ebshirueshme t\u00eb shihni adresat e Qendrave t\u00eb t\u00eb Dh\u00ebnave.<\/p>\n<\/li>\n Ofruesi duhet t\u00eb p\u00ebrdor\u00eb mjetet e mbrojtjes t\u00eb \u00e7ertifikuara. Natyrisht, shumica e ofruesve nuk e shpallin hapur teknologjin\u00eb e p\u00ebrdorur p\u00ebr mbrojtje dhe arkitektur\u00ebn e zgjidhjeve. Por ju si klient nuk do t\u00eb jeni t\u00eb paqart\u00eb p\u00ebr k\u00ebt\u00eb. P\u00ebr shembull, p\u00ebr t'u lidhur n\u00eb m\u00ebnyr\u00eb t\u00eb larg\u00ebt me sistemin e menaxhimit (portalin e menaxhimit) \u00ebsht\u00eb e nevojshme t\u00eb p\u00ebrdoren mjete mbrojtjeje. Ofruesi nuk do t\u00eb mund ta anashkaloj\u00eb k\u00ebt\u00eb k\u00ebrkes\u00eb dhe do t'ju ofroj\u00eb (ose do t\u00eb k\u00ebrkoj\u00eb prej jush t\u00eb p\u00ebrdorni) zgjidhje t\u00eb \u00e7ertifikuara. Merrni n\u00eb prov\u00eb burimet dhe menj\u00ebher\u00eb do t\u00eb kuptoni si funksionon gjith\u00e7ka. <\/p>\n<\/li>\n \u00cbsht\u00eb shum\u00eb e d\u00ebshirueshme q\u00eb ofruesi i cloud-it t\u00eb ofroj\u00eb sh\u00ebrbime shtes\u00eb n\u00eb fush\u00ebn e siguris\u00eb. K\u00ebto mund t\u00eb jen\u00eb sh\u00ebrbime t\u00eb ndryshme: mbrojtje nga sulmet DDoS dhe WAF, sh\u00ebrbim antivirus ose sandbox etj. T\u00eb gjitha k\u00ebto do t'ju lejojn\u00eb t\u00eb merrni mbrojtje si sh\u00ebrbim, pa u shqet\u00ebsuar p\u00ebr nd\u00ebrtimin e sistemeve t\u00eb mbrojtjes, dhe duke u p\u00ebrqendruar n\u00eb aplikacionet e biznesit.<\/p>\n<\/li>\n Ofruesi duhet t\u00eb jet\u00eb nj\u00eb licencuar nga FSTEK dhe FSB. Si rregull, nj\u00eb informacion i till\u00eb publikohet drejtp\u00ebrdrejt n\u00eb web. Sigurisht, k\u00ebrkoni k\u00ebto dokumente dhe kontrolloni n\u00ebse adresat e ofrimit t\u00eb sh\u00ebrbimeve, emri i kompanis\u00eb s\u00eb ofruesit etj. jan\u00eb t\u00eb sakta. <\/p>\n<\/li>\n<\/ul>\n Le t'i p\u00ebrmbledhim. Pune e qiradh\u00ebnies s\u00eb Infrastruktur\u00ebs do t\u00eb lejoj\u00eb t\u00eb heqim dor\u00eb nga CAPEX dhe t\u00eb l\u00ebm\u00eb n\u00eb zon\u00ebn ton\u00eb t\u00eb p\u00ebrgjegj\u00ebsis\u00eb vet\u00ebm aplikacionet e biznesit dhe t\u00eb dh\u00ebnat vet\u00eb, duke transferuar barr\u00ebn e r\u00ebnd\u00eb t\u00eb \u00e7ertifikimit t\u00eb \"hekurudhave\" dhe mjeteve softuerike-hardware te ofruesi.<\/p>\n S\u00eb fundmi, ne p\u00ebrfunduam me sukses rip\u00ebrt\u00ebritjen e infrastruktur\u00ebs \"Reja e Mbrojtur FZ-152\" p\u00ebr t'u p\u00ebrputhur me k\u00ebrkesat p\u00ebr trajtimin e t\u00eb dh\u00ebnave personale. Pun\u00ebt u kryen nga \"Qendra Komb\u00ebtare e Atestimit\".<\/p>\n Aktualisht, \"Reja e Mbrojtur FZ-152\" \u00ebsht\u00eb atestuar p\u00ebr vendosjen e sistemeve informative q\u00eb marrin pjes\u00eb n\u00eb p\u00ebrpunimin, ruajtjen ose transmetimin e t\u00eb dh\u00ebnave personale (ISPDn) sipas k\u00ebrkesave t\u00eb nivelit UZ-3.<\/p>\n Procedura e atestimit parashikon kontrollin e p\u00ebrputhshm\u00ebris\u00eb s\u00eb infrastruktur\u00ebs s\u00eb ofruesit t\u00eb cloud me nivelin e mbrojtjes. Ofruesi i sh\u00ebrbimit jep IaaS dhe nuk \u00ebsht\u00eb operator i t\u00eb dh\u00ebnave personale. Procesi parashikon vler\u00ebsimin si t\u00eb masave organizative (dokumenti, urdhra etj.), ashtu edhe t\u00eb masave teknike (konfigurimi i mjeteve t\u00eb mbrojtjes etj.).<\/p>\n Nuk mund ta quash triviale. Pavar\u00ebsisht se normat p\u00ebr programet dhe metodikat e zhvillimit t\u00eb aktiviteteve t\u00eb atestimit u shfaq\u00ebn q\u00eb n\u00eb vitin 2013, ende nuk ekzistojn\u00eb programe t\u00eb rrepta p\u00ebr objekte cloud. Qendrat e atestimit zhvillojn\u00eb k\u00ebto programe duke u bazuar n\u00eb ekspertiz\u00ebn e tyre. Me shfaqjen e teknologjive t\u00eb reja, programet b\u00ebhen m\u00eb t\u00eb nd\u00ebrlikuara dhe modernizohen, p\u00ebrkat\u00ebsisht, atestuesi duhet t\u00eb ket\u00eb p\u00ebrvoj\u00eb n\u00eb pun\u00ebn me zgjidhjet cloud dhe t\u00eb kuptoj\u00eb specifikat.<\/p>\n N\u00eb rastin ton\u00eb, objekti i mbrojtjes p\u00ebrb\u00ebhet nga dy lokacione.<\/p>\n N\u00eb Qendr\u00ebn e t\u00eb Dh\u00ebnave ndodhen burimet cloud (servers, RU, infrastruktura rrjetore, mjetet e mbrojtjes etj.). Natyrisht, nj\u00eb Qend\u00ebr virtuale e t\u00eb Dh\u00ebnave \u00ebsht\u00eb e lidhur me rrjetet publike, ndaj duhet t\u00eb p\u00ebrmbushen k\u00ebrkesa t\u00eb caktuara p\u00ebr mbrojtjen e rrjetit, p\u00ebr shembull, p\u00ebrdorimi i mureve t\u00eb mbrojtjes t\u00eb certifikuara.<\/p>\n<\/li>\n Pjesa e dyt\u00eb e objektit \u00ebsht\u00eb mjetet e menaxhimit t\u00eb cloud. K\u00ebto jan\u00eb stacione pune (ARM t\u00eb administratorit), nga t\u00eb cilat \u00ebsht\u00eb n\u00eb funksion menaxhimi i segmentit t\u00eb mbrojtur.<\/p>\n<\/li>\n<\/ul>\nNuancat e klasifikimit<\/h2>\n
Mund\u00ebsit\u00eb p\u00ebr nd\u00ebrtimin e sistemit t\u00eb informacionit p\u00ebr t\u00eb dh\u00ebnat personale<\/h2>\n
\n
\n
\n
\n
\n
\n
\n
\n
Zgjedhja e nj\u00eb ofruesi t\u00eb cloud p\u00ebr mbrojtjen e t\u00eb dh\u00ebnave personale<\/h2>\n
\n
Si kaluam n\u00ebp\u00ebr \u00e7ertifikim<\/h3>\n
\n
![\"IaaS](\"\/wp-content\/uploads\/2020\/09\/611ca4c92615fffb675864b72dcaa2f8.jpg\")
Skema strukturore \"syt\u00eb e atestuesit\"<\/p>\n![\"IaaS](\"\/wp-content\/uploads\/2020\/09\/4b0f5c72f8460c2a81068887efc8c9b1.jpg\")
Ndara n\u00eb nivelin e abstraksionit<\/p>\n