{"id":96242,"date":"2020-10-09T19:42:33","date_gmt":"2020-10-09T17:42:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza"},"modified":"2020-10-09T19:42:33","modified_gmt":"2020-10-09T17:42:33","slug":"dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza","title":{"rendered":"Hap\u00ebsira si nj\u00eb mjet sigurie \u2013 2, ose si t\u00eb kap\u00ebsh APT \u00abn\u00eb gjallje\u00bb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>(p\u00ebr iden\u00eb e titullit faleminderit Sergey G. Brester <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/users\/sebres\/\" class=\"user_link\">sebres<\/a><\/noindex>)<\/p>\n<p>T\u00eb nderuar, q\u00ebllimi i k\u00ebtij artikulli \u00ebsht\u00eb d\u00ebshira p\u00ebr t\u00eb ndar\u00eb p\u00ebrvoj\u00ebn e nj\u00eb viti testues n\u00eb p\u00ebrdorimin e nj\u00eb klase t\u00eb re t\u00eb zgjidhjeve IDS t\u00eb bazuara n\u00eb teknologjit\u00eb Deception. <\/p>\n<p><img decoding=\"async\" alt=\"Hap\u00ebsira si nj\u00eb mjet sigurie \u2013 2, ose si t\u00eb kap\u00ebsh APT \u00abn\u00eb gjallje\u00bb\" src=\"\/wp-content\/uploads\/2020\/10\/f641b6735cf846d12a0081c7709662e7.png\" style=\"display:block;margin: 0 auto;\" \/><noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<p>P\u00ebr t\u00eb ruajtur koherenc\u00ebn logjike t\u00eb materialit, e konsideroj t\u00eb arsyeshme t\u00eb filloj me supozimet. Pra, problematika:<\/p>\n<ol>\n<li>Sulmet e orientuara \u2013 lloji m\u00eb i rreziksh\u00ebm i sulmeve, megjith\u00ebse n\u00eb numrin e p\u00ebrgjithsh\u00ebm t\u00eb k\u00ebrc\u00ebnimeve, pesha e tyre \u00ebsht\u00eb e vog\u00ebl. <\/li>\n<li>Nuk \u00ebsht\u00eb shpikur ende ndonj\u00eb mjet efektiv garantuar p\u00ebr mbrojtjen e perimetrave (ose nj\u00eb kompleks t\u00eb till\u00eb mjetesh). <\/li>\n<li>N\u00eb p\u00ebrgjith\u00ebsi, sulmet e orientuara kalojn\u00eb n\u00eb disa etapa. Kalimi i perimetrave \u00ebsht\u00eb vet\u00ebm nj\u00eb nga etapat fillestare, e cila (mund t\u00eb m\u00eb godisni me gure) nuk sjell shum\u00eb d\u00ebme p\u00ebr \u2018viktim\u00ebn\u2019, n\u00ebse kjo nuk \u00ebsht\u00eb, sigurisht, nj\u00eb sulm DEoS (Shkat\u00ebrrimi i sh\u00ebrbimit) (kriptuesit e t\u00eb dh\u00ebnave etj.). E v\u00ebrteta e v\u00ebshtir\u00eb fillon m\u00eb von\u00eb, kur asetet e kapura fillojn\u00eb t\u00eb p\u00ebrdoren p\u00ebr pivotim dhe zhvillimin e sulmit \u201cn\u00eb thell\u00ebsi\u201d, dhe ne nuk e kemi v\u00ebn\u00eb re. <\/li>\n<li>Duke fillojm\u00eb t\u00eb p\u00ebrballemi me humbje t\u00eb v\u00ebrteta kur sulmuesit arrijn\u00eb t\u00eb prekin objektivat e sulmit (server\u00ebt e aplikacioneve, DBMS, depozita t\u00eb dh\u00ebnash, repository, element\u00eb t\u00eb infrastruktur\u00ebs kritike), \u00ebsht\u00eb logjike q\u00eb nj\u00eb nga detyrat e sh\u00ebrbimit t\u00eb siguris\u00eb \u00ebsht\u00eb nd\u00ebrprerja e sulmeve p\u00ebrpara se t\u00eb ndodh\u00eb ky ngjarje e pak\u00ebndshme. Por p\u00ebr t\u00eb nd\u00ebrprer\u00eb di\u00e7ka, \u00ebsht\u00eb e nevojshme q\u00eb fillimisht t\u00eb dihet p\u00ebr t\u00eb. Sa m\u00eb her\u00ebt q\u00eb t\u00eb jepet informacioni, aq m\u00eb mir\u00eb. <\/li>\n<li>Prandaj, p\u00ebr menaxhimin e suksessh\u00ebm t\u00eb rreziqeve (dmth, uljen e d\u00ebmit nga sulmet e drejtuara) \u00ebsht\u00eb kritike q\u00eb t\u00eb kemi mjete q\u00eb do t\u00eb sigurojn\u00eb TTD (koha p\u00ebr t\u00eb zbuluar \u2013 koha nga momenti i hyrjes deri n\u00eb momentin e zbulimit t\u00eb sulmit). N\u00eb var\u00ebsi t\u00eb sektorit dhe rajonit, ky periudh p\u00ebr mesatarisht \u00ebsht\u00eb 99 dit\u00eb n\u00eb SHBA, 106 dit\u00eb n\u00eb rajonin EMEA, 172 dit\u00eb n\u00eb rajonin APAC (M-Trends 2017, Nj\u00eb Pamje nga Vija e Par\u00eb, Mandiant). <\/li>\n<li>\u00c7far\u00eb ofron tregu?\n<ul>\n<li>\u00abSandbox\u00bb . Nj\u00eb kontroll preventiv tjet\u00ebr, i cili \u00ebsht\u00eb i larg\u00ebt nga ideali. Ekzistojn\u00eb shum\u00eb teknika efektive t\u00eb zbulimit dhe kalimit t\u00eb sandboxeve ose zgjidhjeve t\u00eb whitelisting. Djemt\u00eb nga \u00aban\u00ebs e err\u00ebt\u00bb k\u00ebtu t\u00eb pakt\u00ebn jan\u00eb nj\u00eb hap p\u00ebrpara. \n<\/li>\n<li>UEBA (sistemet e profilit t\u00eb sjelljes dhe zbulimit t\u00eb devijimeve) \u2013 n\u00eb teori mund t\u00eb jet\u00eb shum\u00eb efektiv. Por, sipas mendimit tim, kjo \u00ebsht\u00eb di\u00e7ka q\u00eb ndoshta do t\u00eb ndodh\u00eb n\u00eb nj\u00eb t\u00eb ardhme t\u00eb larg\u00ebt. N\u00eb praktik\u00eb, aktualisht \u00ebsht\u00eb shum\u00eb e shtrenjt\u00eb, t\u00eb paq\u00ebndrueshme dhe k\u00ebrkon nj\u00eb infrastruktur\u00eb IT dhe sigurie informacioni shum\u00eb t\u00eb pjekur dhe stabile, ku t\u00eb gjitha mjetet q\u00eb do t\u00eb gjeneronin t\u00eb dh\u00ebna p\u00ebr analiz\u00ebn e sjelljes jan\u00eb tashm\u00eb n\u00eb vend.\n<\/li>\n<li>SIEM \u2013 \u00ebsht\u00eb nj\u00eb mjet i mir\u00eb p\u00ebr hetimet, por nuk ka aft\u00ebsin\u00eb t\u00eb shoh\u00eb dhe t\u00eb tregoj\u00eb di\u00e7ka t\u00eb re, origjinale n\u00eb koh\u00eb, sepse rregullat e korrelacionit jan\u00eb thjesht t\u00eb nj\u00ebjtat n\u00ebnshkrime. <\/li>\n<\/ul>\n<p>\n <\/li>\n<li>Si rezultat, ka nj\u00eb nevoj\u00eb p\u00ebr nj\u00eb mjet t\u00eb till\u00eb q\u00eb:\n<ul>\n<li>t\u00eb punoj\u00eb me sukses n\u00eb kushte t\u00eb nj\u00eb perimetri t\u00eb komprometuar tashm\u00eb,\n<\/li>\n<li>t\u00eb zbuloj\u00eb sulme t\u00eb suksesshme n\u00eb nj\u00eb m\u00ebnyr\u00eb t\u00eb af\u00ebrt me koh\u00ebn reale, pa marr\u00eb parasysh mjetet dhe dob\u00ebsit\u00eb q\u00eb p\u00ebrdoren,<\/li>\n<li>t\u00eb mos varet nga n\u00ebnshkrimet\/rregullat\/scenar\u00ebt\/politikat\/profili dhe gj\u00ebra t\u00eb tjera statike,<\/li>\n<li>t\u00eb mos k\u00ebrkoj\u00eb ekzistenc\u00ebn e grupeve t\u00eb m\u00ebdha t\u00eb t\u00eb dh\u00ebnave dhe burimeve t\u00eb tyre p\u00ebr analiz\u00eb,<\/li>\n<li>do t\u00eb lejonte t\u00eb p\u00ebrcaktonte sulmet jo si nj\u00eb rrezik-shkallim si rezultat i pun\u00ebs s\u00eb \u00abmatematik\u00ebs m\u00eb t\u00eb mir\u00eb n\u00eb bot\u00eb, e patentuar dhe p\u00ebr k\u00ebt\u00eb arsye e mbyllur\u00bb, e cila k\u00ebrkon hetime t\u00eb m\u00ebtejshme, por praktikisht si nj\u00eb ngjarje binar \u2013 \u00abPo, jemi sulmuar\u00bb ose \u00abJo, gjith\u00e7ka \u00ebsht\u00eb n\u00eb rregull\u00bb.<\/li>\n<li>ishte universale, efikase n\u00eb shkall\u00eb dhe realisht e implementueshme n\u00eb \u00e7do ambient heterogjen, pavar\u00ebsisht nga topologjia fizike dhe logjike e rrjetit q\u00eb p\u00ebrdoret.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p>\nP\u00ebr rolin e nj\u00eb instrumenti t\u00eb till\u00eb tani pretendojn\u00eb, t\u00eb ashtuquajturat zgjidhje mashtruese. K\u00ebto jan\u00eb zgjidhje q\u00eb bazohen n\u00eb konceptin e vjet\u00ebr t\u00eb honeypots, por me nj\u00eb nivel krejt\u00ebsisht t\u00eb ri t\u00eb implementimit. Kjo tem\u00eb tani \u00ebsht\u00eb pa dyshim n\u00eb rritje.<\/p>\n<p>Sipas rezultateve <noindex><a rel=\"nofollow\" href=\"https:\/\/www.gartner.com\/newsroom\/id\/3744917\">Samiti mbi Sigurin\u00eb dhe Menaxhimin e Rreziqeve Gartner 2017<\/a><\/noindex> Zgjidhjet mashtruese jan\u00eb n\u00eb TOP-3 strategjive dhe mjeteve q\u00eb rekomandohen p\u00ebr t'u aplikuar. <\/p>\n<p>Sipas raportit <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tag-cyber.com\/Annual\/2017\/\">Raporti vjetor mbi Sigurin\u00eb Kibernetike TAG 2017<\/a><\/noindex> Mashtrimi \u00ebsht\u00eb nj\u00eb nga drejtimet kryesore t\u00eb zhvillimit t\u00eb zgjidhjeve IDS (Sistemet e P\u00ebrcaktimit t\u00eb Sulmeve).<\/p>\n<p>Nj\u00eb seksion i t\u00eb fundit <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cisco.com\/c\/en\/us\/products\/security\/security-reports.html\">raporti i Cisco mbi gjendjen e siguris\u00eb IT<\/a><\/noindex>, e cila \u00ebsht\u00eb e nd\u00ebrtuar mbi t\u00eb dh\u00ebnat e nj\u00eb nga lider\u00ebt e k\u00ebtij tregu, TrapX Security (Izrael), zgjidhja e t\u00eb cilit tashm\u00eb funksionon p\u00ebr nj\u00eb vit n\u00eb zon\u00ebn ton\u00eb t\u00eb testimit. <\/p>\n<p>TrapX Deception Grid lejon nd\u00ebrtimin dhe operimin e IDS t\u00eb shp\u00ebrndara masivisht n\u00eb m\u00ebnyr\u00eb qendrore, pa rritur ngarkes\u00ebn licencuese dhe k\u00ebrkesat p\u00ebr burime harduerike. N\u00eb fakt, TrapX \u00ebsht\u00eb nj\u00eb nd\u00ebrtues q\u00eb lejon krijimin e nj\u00eb mekanizmi t\u00eb madh p\u00ebr zbuluar sulmet n\u00eb shkall\u00ebn e t\u00eb gjith\u00eb sip\u00ebrmarrjes, nj\u00eb lloj \"alarmit\" t\u00eb shp\u00ebrndar\u00eb n\u00eb rrjet. <\/p>\n<h3>Struktura e Zgjidhjes<\/h3>\n<p>\nN\u00eb laboratorin ton\u00eb, ne vazhdimisht studiojm\u00eb dhe testojm\u00eb novitete t\u00eb ndryshme n\u00eb fush\u00ebn e sigurimit IT. Aktualisht, k\u00ebtu jan\u00eb t\u00eb vendosura rreth 50 server\u00eb virtual\u00eb t\u00eb ndrysh\u00ebm, duke p\u00ebrfshir\u00eb komponent\u00ebt e TrapX Deception Grid.<\/p>\n<p><img decoding=\"async\" alt=\"Hap\u00ebsira si nj\u00eb mjet sigurie \u2013 2, ose si t\u00eb kap\u00ebsh APT \u00abn\u00eb gjallje\u00bb\" src=\"\/wp-content\/uploads\/2020\/10\/9c9c21101020c1005edc938a3a7ca393.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nK\u00ebshtu q\u00eb, nga lart posht\u00eb:<\/p>\n<ol>\n<li>TSOC (TrapX Security Operation Console) \u2013 truri i sistemit. Kjo \u00ebsht\u00eb konsol\u00eb qendrore e menaxhimit, me an\u00eb t\u00eb s\u00eb cil\u00ebs b\u00ebhet konfigurimi, vendosja e zgjidhjes dhe t\u00eb gjitha pun\u00ebt e p\u00ebrditshme. Duke qen\u00eb nj\u00eb sh\u00ebrbim web, ajo mund t\u00eb vendoset kudo \u2013 n\u00eb perimet\u00ebr, n\u00eb cloud ose te ofruesi MSSP. <\/li>\n<li>TrapX Appliance (TSA) \u2013 nj\u00eb server virtual n\u00eb t\u00eb cilin ne lidhim me ndihm\u00ebn e portit trunk ato n\u00ebndiet q\u00eb d\u00ebshirojm\u00eb t\u00eb mbulojm\u00eb me monitorim. Gjithashtu, k\u00ebtu n\u00eb t\u00eb v\u00ebrtet\u00eb \u00abjetojn\u00eb\u00bb t\u00eb gjith\u00eb sensor\u00ebt tan\u00eb rrjet\u00eb.\n<p>N\u00eb laboratorin ton\u00eb \u00ebsht\u00eb instaluar nj\u00eb TSA (mwsapp1), por n\u00eb t\u00eb v\u00ebrtet\u00eb mund t\u00eb ket\u00eb shum\u00eb. Kjo mund t\u00eb jet\u00eb e nevojshme n\u00eb rrjete t\u00eb m\u00ebdha, ku midis segmenteve nuk ka lidhshm\u00ebri L2 (nj\u00eb shembull tipik \u00ebsht\u00eb \u00abHolding-u dhe filialet e tij\u00bb ose \u00abKryeqendra e bank\u00ebs dhe deg\u00ebt\u00bb), ose n\u00ebse rrjeti ka segmente t\u00eb izoluar, p\u00ebr shembull, ASUTP. N\u00eb secil\u00ebn nga k\u00ebto filial\u00eb\/segmente mund t\u00eb instaloni TSA t\u00eb vetin dhe ta lidhni me nj\u00eb TSOC t\u00eb vetme, ku t\u00eb gjitha informacionet do t\u00eb p\u00ebrpunohen n\u00eb m\u00ebnyr\u00eb t\u00eb centralizuar. Kjo arkitektur\u00eb lejon nd\u00ebrtimin e sistemeve t\u00eb shp\u00ebrndara t\u00eb monitorimit pa pasur nevoj\u00eb p\u00ebr ri-organizim radikal t\u00eb rrjetit apo p\u00ebr t\u00eb shkelur segmentimin ekzistues.<\/p>\n<p>Po ashtu, n\u00eb TSA ne mund t\u00eb d\u00ebrgojm\u00eb nj\u00eb kopje t\u00eb trafikut t\u00eb dal\u00ebs p\u00ebrmes TAP\/SPAN. N\u00eb rast t\u00eb zbulimit t\u00eb lidhjeve me botnet t\u00eb njohura, server\u00eb komandimi, ose seanca TOR, ne do t\u00eb marrim gjithashtu nj\u00eb rezultat n\u00eb konsol\u00eb. Kjo menaxhohet nga Sensor Intelligence t\u00eb Rrjetit (NIS). N\u00eb ambientin ton\u00eb, kjo funksionalitet \u00ebsht\u00eb realizuar n\u00eb nd\u00ebrprer\u00ebsin e rrjetit, prandaj k\u00ebtu nuk e p\u00ebrdor\u00ebm at\u00eb. <\/li>\n<li>Application Traps (Full OS) \u2013 jan\u00eb hanipot tradicionale t\u00eb bazuara n\u00eb server\u00ebt Windows. Nuk nevojiten shum\u00eb, pasi detyra kryesore e k\u00ebtyre server\u00ebve \u00ebsht\u00eb t\u00eb ofrojn\u00eb sh\u00ebrbime IT p\u00ebr nivelin tjet\u00ebr t\u00eb sensor\u00ebve ose t\u00eb zbulojn\u00eb sulmet ndaj aplikacioneve t\u00eb biznesit q\u00eb mund t\u00eb implementohen n\u00eb ambientin Windows. Ne n\u00eb laboratorin ton\u00eb kemi instaluar nj\u00eb t\u00eb till\u00eb (FOS01).\n<p><img decoding=\"async\" alt=\"Hap\u00ebsira si nj\u00eb mjet sigurie \u2013 2, ose si t\u00eb kap\u00ebsh APT \u00abn\u00eb gjallje\u00bb\" src=\"\/wp-content\/uploads\/2020\/10\/8de44215efff4a49f3b773da10185a73.png\" style=\"display:block;margin: 0 auto;\" \/>\n<\/li>\n<li>Emulated traps \u2013 komponenti kryesor i zgjidhjes, i cili na lejon t\u00eb krijojm\u00eb me nj\u00eb makin\u00eb virtuale nj\u00eb fush\u00eb shum\u00eb t\u00eb dendur t\u00eb \u00abminave\u00bb p\u00ebr atacuesit dhe t\u00eb ngopim rrjetin e nd\u00ebrmarrjes, t\u00eb gjith\u00eb VLAN-et e tij, me sensor\u00ebt tan\u00eb. Atacuesi e sheh nj\u00eb sensor t\u00eb till\u00eb, ose nj\u00eb host fantazm\u00eb, si nj\u00eb PC ose server Windows t\u00eb v\u00ebrtet\u00eb, server Linux ose nj\u00eb pajisje tjet\u00ebr, q\u00eb ne vendosim t'ia tregojm\u00eb.\n<p><img decoding=\"async\" alt=\"Hap\u00ebsira si nj\u00eb mjet sigurie \u2013 2, ose si t\u00eb kap\u00ebsh APT \u00abn\u00eb gjallje\u00bb\" src=\"\/wp-content\/uploads\/2020\/10\/306c21046c5baadd591b66cdfe153ec2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebr t\u00eb sh\u00ebrbyer p\u00ebr t\u00eb mir\u00ebn dhe p\u00ebr kuriozitet, ne kemi vendosur \"nj\u00eb \u00e7ift p\u00ebr \u00e7do krijes\u00eb\" \u2014 PC dhe server\u00eb Windows t\u00eb versioneve t\u00eb ndryshme, server\u00eb Linux, nj\u00eb ATM me Windows embedded, SWIFT Web Access, nj\u00eb printer rrjet, nj\u00eb switch Cisco, nj\u00eb kamer\u00eb IP Axis, nj\u00eb MacBook, nj\u00eb pajisje PLC dhe madje nj\u00eb llamp\u00eb t\u00eb men\u00e7ur. N\u00eb total \u2014 13 host. N\u00eb p\u00ebrgjith\u00ebsi, ofruesi rekomandon p\u00ebrdorimin e k\u00ebtyre sensor\u00ebve n\u00eb nj\u00eb num\u00ebr minimal prej 10% t\u00eb numrit t\u00eb hosteve t\u00eb v\u00ebrtet\u00eb. Kufiri i sip\u00ebrm \u00ebsht\u00eb hap\u00ebsira adresuese e disponueshme. <\/p>\n<p>Nj\u00eb aspekt shum\u00eb i r\u00ebnd\u00ebsish\u00ebm \u00ebsht\u00eb se \u00e7do host i till\u00eb \u2013 nuk \u00ebsht\u00eb nj\u00eb makin\u00eb virtuale e plot\u00eb, q\u00eb k\u00ebrkon burime dhe licenca. Ky \u00ebsht\u00eb nj\u00eb \"mashtres\u00eb\", nj\u00eb emulim, nj\u00eb proces n\u00eb TSA, i cili ka nj\u00eb grup parametrash dhe nj\u00eb adres\u00eb IP. Prandaj, me nj\u00eb TSA ne mund t\u00eb mbushim rrjetin me qindra nga k\u00ebto hoste fantazm\u00eb, t\u00eb cilat do t\u00eb funksionojn\u00eb si sensor\u00eb n\u00eb sistemin e alarmit. N\u00eb fakt, kjo teknologji mund\u00ebson shkall\u00ebzimin ekonomikisht efektiv t\u00eb konceptit t\u00eb \"honeypots\" n\u00eb shkall\u00ebn e \u00e7do nd\u00ebrmarrjeje t\u00eb madhe t\u00eb shp\u00ebrndar\u00eb. <\/p>\n<p>K\u00ebta hote jan\u00eb t\u00ebrheq\u00ebs nga perspektiva e sulmuesve, pasi p\u00ebrmbajn\u00eb dob\u00ebsi dhe duken relativisht si objekte t\u00eb lehta. Sulmuesi sheh sh\u00ebrbimet n\u00eb k\u00ebto hote dhe mund t\u00eb nd\u00ebrveproj\u00eb me to, t'i sulmoj\u00eb ato, duke p\u00ebrdorur mjete dhe protokolle standarde (smb\/wmi\/ssh\/telnet\/web\/dnp\/bonjour\/Modbus etj.). Por nuk \u00ebsht\u00eb e mundur t\u00eb p\u00ebrdoren k\u00ebta hote p\u00ebr zhvillimin e sulmit ose p\u00ebr t\u00eb p\u00ebrparuar kodin e tij.\n<\/li>\n<li>Kombinimi i k\u00ebtyre dy teknologjive (FullOS dhe grackat e emuluara) lejon arritjen e nj\u00eb probabiliteti statistik q\u00eb sulmuesi do t\u00eb p\u00ebrballet me ndonj\u00eb element t\u00eb rrjetit ton\u00eb t\u00eb sinjalizimit, her\u00ebt a von\u00eb. Por si t\u00eb b\u00ebjm\u00eb q\u00eb ky probabilitet t\u00eb jet\u00eb af\u00ebr 100%?\n<p>N\u00eb luft\u00eb hyjn\u00eb ashtuquajturat tilla tokena (Deception tokens). Fal\u00eb tyre, ne mund t\u00eb p\u00ebrfshijm\u00eb n\u00eb sistemin ton\u00eb t\u00eb shp\u00ebrndar\u00eb IDS t\u00eb gjitha PC-t\u00eb dhe server\u00ebt e disponuesh\u00ebm n\u00eb kompani. Tokenat vendosen n\u00eb PC reale t\u00eb p\u00ebrdoruesve. \u00cbsht\u00eb e r\u00ebnd\u00ebsishme t\u00eb kuptojm\u00eb se tokenat nuk jan\u00eb agjent\u00eb q\u00eb konsumojn\u00eb resurse dhe mund t\u00eb shkaktojn\u00eb konflikt. Tokenat jan\u00eb element\u00eb informativ\u00eb pasiv\u00eb, nj\u00eb lloj 'th\u00ebngjilli' p\u00ebr pal\u00ebn sulmuese, q\u00eb e \u00e7on at\u00eb n\u00eb nj\u00eb kurth. P\u00ebr shembull, disqet e lidhura n\u00eb rrjet, shenjat n\u00eb admin\u00ebt e rrem\u00eb t\u00eb uebit n\u00eb shfletues, dhe fjal\u00ebkalimet e ruajtura p\u00ebr to, seancat e ruajtura ssh\/rdp\/winscp, kurthet tona me komentet n\u00eb skedar\u00ebt hosts, fjal\u00ebkalimet e ruajtura n\u00eb kujtes\u00eb, kredencialet e p\u00ebrdoruesve q\u00eb nuk ekzistojn\u00eb, skedar\u00ebt e zyr\u00ebs, hapja e t\u00eb cilave do t\u00eb aktivizoj\u00eb sistemin, dhe shum\u00eb t\u00eb tjera. K\u00ebshtu, ne e vendosim sulmuesin n\u00eb nj\u00eb mjedis t\u00eb deformuar, t\u00eb mbushur me ato vektore sulmi q\u00eb n\u00eb t\u00eb v\u00ebrtet\u00eb nuk paraqesin k\u00ebrc\u00ebnim p\u00ebr ne, p\u00ebrkundrazi, p\u00ebr m\u00eb tep\u00ebr. Dhe ai nuk ka mund\u00ebsi t\u00eb p\u00ebrcaktoj\u00eb se ku \u00ebsht\u00eb informacioni i v\u00ebrtet\u00eb dhe ku \u00ebsht\u00eb i rrem\u00eb. N\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb, ne jo vet\u00ebm q\u00eb sigurojm\u00eb identifikimin e shpejt\u00eb t\u00eb sulmit, por gjithashtu e ngadal\u00ebsojm\u00eb ndjesh\u00ebm at\u00eb. <\/li>\n<\/ol>\n<p>\n<img decoding=\"async\" alt=\"Hap\u00ebsira si nj\u00eb mjet sigurie \u2013 2, ose si t\u00eb kap\u00ebsh APT \u00abn\u00eb gjallje\u00bb\" src=\"\/wp-content\/uploads\/2020\/10\/812409dca0c8bc991c7e9812f16d77cf.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Shembulli i krijimit t\u00eb nj\u00eb gracke rrjeti dhe konfigurimin e token\u00ebve. Nd\u00ebrfaqja miq\u00ebsore dhe pa asnj\u00eb redaktim manual t\u00eb konfigurimeve, skripteve, etj.<\/i><\/p>\n<p>N\u00eb ambientin ton\u00eb ne kemi konfiguruar dhe vendosur nj\u00eb s\u00ebr\u00eb t\u00eb till\u00ebsh token\u00ebsh n\u00eb FOS01 n\u00ebn menaxhimin e Windows Server 2012R2 dhe n\u00eb nj\u00eb PC testues me Windows 7. N\u00eb k\u00ebto makineri \u00ebsht\u00eb aktivizuar RDP dhe ne her\u00eb pas here i \u2018nxjerrim\u2019 n\u00eb DMZ, ku jan\u00eb vendosur gjithashtu disa nga sensor\u00ebt tan\u00eb (gracka t\u00eb emuluara). K\u00ebshtu, ne marrim nj\u00eb fluks t\u00eb vazhduesh\u00ebm incidentesh, k\u00ebshtu t\u00eb themi, n\u00eb m\u00ebnyr\u00eb natyrale. <\/p>\n<p>Pra, statistika e shkurt\u00ebr p\u00ebr vitin:<\/p>\n<p>56,208 \u2013 incidente t\u00eb regjistruara,<br \/>\n2,912 \u2013 hoste burimesh sulmesh t\u00eb zbuluara. <\/p>\n<p><img decoding=\"async\" alt=\"Hap\u00ebsira si nj\u00eb mjet sigurie \u2013 2, ose si t\u00eb kap\u00ebsh APT \u00abn\u00eb gjallje\u00bb\" src=\"\/wp-content\/uploads\/2020\/10\/0b2404084a997ba5fe4ad33303501612.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Hart\u00eb interaktive dhe klikueshme e sulmeve<\/i><\/p>\n<p>N\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, zgjidhja nuk krijon ndonj\u00eb mega-log ose nj\u00eb rrjedh\u00eb ngjarjesh, n\u00eb t\u00eb cilat duhet t\u00eb punosh p\u00ebr nj\u00eb koh\u00eb t\u00eb gjat\u00eb. N\u00eb vend t\u00eb k\u00ebsaj, zgjidhja klasifikon vet\u00eb ngjarjet sipas llojeve t\u00eb tyre dhe i lejon ekipit t\u00eb siguris\u00eb t\u00eb fokusohet fillimisht n\u00eb ato m\u00eb t\u00eb rrezikshme \u2013 kur pala sulmuese p\u00ebrpiqet t\u00eb ngrej\u00eb sesione menaxhuese (interaksioni) ose kur n\u00eb trafikun ton\u00eb shfaqen payload-e binar (infeksioni). <\/p>\n<p><img decoding=\"async\" alt=\"Hap\u00ebsira si nj\u00eb mjet sigurie \u2013 2, ose si t\u00eb kap\u00ebsh APT \u00abn\u00eb gjallje\u00bb\" src=\"\/wp-content\/uploads\/2020\/10\/d0ad109bae7dc0fb80182d43be713d4e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nT\u00eb gjitha informacionet mbi ngjarjet jan\u00eb lexueshme dhe, sipas mendimit tim, paraqiten n\u00eb nj\u00eb format t\u00eb leht\u00eb p\u00ebr t'u kuptuar edhe p\u00ebr p\u00ebrdoruesit me njohuri bazike n\u00eb fush\u00ebn e siguris\u00eb informatike. <\/p>\n<p>Shumica e incidenteve t\u00eb dokumentuara jan\u00eb p\u00ebrpjekje p\u00ebr skanimin e hosteve tan\u00eb ose lidhje t\u00eb izoluara. <\/p>\n<p><img decoding=\"async\" alt=\"Hap\u00ebsira si nj\u00eb mjet sigurie \u2013 2, ose si t\u00eb kap\u00ebsh APT \u00abn\u00eb gjallje\u00bb\" src=\"\/wp-content\/uploads\/2020\/10\/ea87b3592b2d3727815050b9fd1f708e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nOse p\u00ebrpjekje p\u00ebr t\u00eb p\u00ebrmbytur fjal\u00ebkalimet p\u00ebr RDP.<\/p>\n<p><img decoding=\"async\" alt=\"Hap\u00ebsira si nj\u00eb mjet sigurie \u2013 2, ose si t\u00eb kap\u00ebsh APT \u00abn\u00eb gjallje\u00bb\" src=\"\/wp-content\/uploads\/2020\/10\/645b5984d1ffaf31758fb23e9a23c9eb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMegjithat\u00eb, kan\u00eb ndodhur edhe raste m\u00eb interesante, ve\u00e7an\u00ebrisht kur sulmuesit arrit\u00ebn t\u00eb gjenin fjal\u00ebkalimin p\u00ebr RDP dhe t\u00eb fitonin akses n\u00eb rrjetin lokal. <\/p>\n<p><img decoding=\"async\" alt=\"Hap\u00ebsira si nj\u00eb mjet sigurie \u2013 2, ose si t\u00eb kap\u00ebsh APT \u00abn\u00eb gjallje\u00bb\" src=\"\/wp-content\/uploads\/2020\/10\/3cde5beadaa306d32c382f66bd67ec33.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSulmuesi p\u00ebrpiqet t\u00eb ekzekutoj\u00eb kodin me an\u00eb t\u00eb psexec.<\/p>\n<p><img decoding=\"async\" alt=\"Hap\u00ebsira si nj\u00eb mjet sigurie \u2013 2, ose si t\u00eb kap\u00ebsh APT \u00abn\u00eb gjallje\u00bb\" src=\"\/wp-content\/uploads\/2020\/10\/1356ef44f3581b37c3163ce454fecf14.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSulmuesi gjeti nj\u00eb sesion t\u00eb ruajtur, i cili e \u00e7oi n\u00eb nj\u00eb kurth n\u00eb form\u00ebn e nj\u00eb serveri Linux. Menj\u00ebher\u00eb pas lidhjes, me nj\u00eb grup komandash t\u00eb para t\u00eb p\u00ebrgatitura, ai u p\u00ebrpoq t\u00eb shkat\u00ebrronte t\u00eb gjith\u00eb skedar\u00ebt e log\u00ebve dhe variablat p\u00ebrkat\u00ebse t\u00eb sistemit.<\/p>\n<p><img decoding=\"async\" alt=\"Hap\u00ebsira si nj\u00eb mjet sigurie \u2013 2, ose si t\u00eb kap\u00ebsh APT \u00abn\u00eb gjallje\u00bb\" src=\"\/wp-content\/uploads\/2020\/10\/6d8994cd3bb2268e45540e5bbcdc74a4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSulmuesi p\u00ebrpiqet t\u00eb kryej\u00eb nj\u00eb injeksion SQL n\u00eb kurthin q\u00eb imiton SWIFT Web Access.<\/p>\n<p>P\u00ebrve\u00e7 k\u00ebtyre sulmeve 'natyrale', ne kemi kryer dhe disa teste t\u00eb tjera t\u00eb veta. Nj\u00eb nga m\u00eb ilustrueset \u00ebsht\u00eb testimi i koh\u00ebs s\u00eb zbulimit t\u00eb nj\u00eb krimbi rrjeti. P\u00ebr k\u00ebt\u00eb ne p\u00ebrdor\u00ebm nj\u00eb mjet nga GuardiCore, i quajtur <noindex><a rel=\"nofollow\" href=\"http:\/\/www.guardicore.com\/infectionmonkey\/\">Infection Monkey<\/a><\/noindex>. Ky \u00ebsht\u00eb nj\u00eb virus rrjeti q\u00eb mund t\u00eb kap\u00eb Windows dhe Linux, por pa ndonj\u00eb ngarkes\u00eb 't\u00eb dobishme'. <br \/>\nNe kemi ngritur nj\u00eb qend\u00ebr lokale komandimi, ku n\u00eb nj\u00eb nga makinat kemi nisur ekzemplarin e par\u00eb t\u00eb virusit dhe kemi marr\u00eb njoftimin e par\u00eb n\u00eb konsol\u00ebn TrapX p\u00ebr m\u00eb pak se nj\u00eb minut\u00eb e gjysm\u00eb. TTD 90 sekonda n\u00eb krahasim me 106 dit\u00eb n\u00eb mesataren... <\/p>\n<p>Fal\u00eb mund\u00ebsis\u00eb s\u00eb integrimit me klasat e tjera t\u00eb zgjidhjeve, ne mund t\u00eb kalojm\u00eb nga detektimi i shpejt\u00eb i k\u00ebrc\u00ebnimeve n\u00eb reagimin automatik ndaj tyre. <\/p>\n<p>P\u00ebr shembull, integrimi me sistemet NAC (Kontrolli i Qasjes n\u00eb Rrjet) ose me CarbonBlack do t\u00eb lejoj\u00eb q\u00eb PC-t\u00eb e komprometuar t\u00eb \u00e7ohen automatikisht nga rrjeti. <\/p>\n<p><img decoding=\"async\" alt=\"Hap\u00ebsira si nj\u00eb mjet sigurie \u2013 2, ose si t\u00eb kap\u00ebsh APT \u00abn\u00eb gjallje\u00bb\" src=\"\/wp-content\/uploads\/2020\/10\/4364d6374b57e5741e33f8981b4cb0ad.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIntegrimi me rrethe r\u00ebr\u00eb lejon q\u00eb skedar\u00ebt q\u00eb marrin pjes\u00eb n\u00eb sulm t\u00eb d\u00ebrgohen automatikisht p\u00ebr analiz\u00eb. <\/p>\n<p><img decoding=\"async\" alt=\"Hap\u00ebsira si nj\u00eb mjet sigurie \u2013 2, ose si t\u00eb kap\u00ebsh APT \u00abn\u00eb gjallje\u00bb\" src=\"\/wp-content\/uploads\/2020\/10\/c66b8051d0dbd31c1215329d1b55930b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Integrimi me McAfee<\/h3>\n<p>\nPo ashtu, zgjidhja ka nj\u00eb sistem t\u00eb sajin t\u00eb integruar t\u00eb korrelacionit t\u00eb ngjarjeve.<\/p>\n<p><img decoding=\"async\" alt=\"Hap\u00ebsira si nj\u00eb mjet sigurie \u2013 2, ose si t\u00eb kap\u00ebsh APT \u00abn\u00eb gjallje\u00bb\" src=\"\/wp-content\/uploads\/2020\/10\/d4030212690f3ee1f1a641c49bc90960.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPor ne nuk ishim t\u00eb k\u00ebnaqur me mund\u00ebsit\u00eb e tij, prandaj e integrojm\u00eb me HP ArcSight.<\/p>\n<p><img decoding=\"async\" alt=\"Hap\u00ebsira si nj\u00eb mjet sigurie \u2013 2, ose si t\u00eb kap\u00ebsh APT \u00abn\u00eb gjallje\u00bb\" src=\"\/wp-content\/uploads\/2020\/10\/f08d607c5b4abf8dc354f65ed2591ebc.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nT\u00eb p\u00ebrballosh k\u00ebrc\u00ebnimet e zbuluara 'me gjith\u00eb bot\u00ebn' ndihmon sistemi i integruar i biletave.<\/p>\n<p><img decoding=\"async\" alt=\"Hap\u00ebsira si nj\u00eb mjet sigurie \u2013 2, ose si t\u00eb kap\u00ebsh APT \u00abn\u00eb gjallje\u00bb\" src=\"\/wp-content\/uploads\/2020\/10\/0e78fa59b2f2b114fa9bdf572f37ea96.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDuke zgjidhja \"nga fillimi\" \u00ebsht\u00eb zhvilluar p\u00ebr nevojat e institucioneve shtet\u00ebrore dhe sektorit t\u00eb madh korporativ, aty \u00ebsht\u00eb zbatuar natyrisht nj\u00eb model aksesin rolet, integrimi me AD, nj\u00eb sistem i zhvilluar raportimi dhe trigger\u00ebsh (njoftimeve t\u00eb ngjarjeve), orkestrimi p\u00ebr struktura t\u00eb m\u00ebdha mbajt\u00ebse ose ofrues t\u00eb MSSP. <\/p>\n<h3>N\u00eb vend t\u00eb nj\u00eb p\u00ebrmbledhjeje<\/h3>\n<p>\nN\u00ebse ekziston nj\u00eb sistem monitorimi t\u00eb till\u00eb, i cili, figurativisht, na mbulon prapa, at\u00ebher\u00eb komprometimi i perimeterit sapo ka filluar. E r\u00ebnd\u00ebsishmja \u00ebsht\u00eb se krijohet nj\u00eb mund\u00ebsi e v\u00ebrtet\u00eb p\u00ebr t\u00eb luftuar kund\u00ebr incidenteve t\u00eb siguris\u00eb dhe jo p\u00ebr t\u00eb u marr\u00eb me pasojat e tyre.<br \/>\n<br \/>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/softline\/blog\/413893\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>(\u0437\u0430 \u0438\u0434\u0435\u044e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0441\u043f\u0430\u0441\u0438\u0431\u043e Sergey G. Brester sebres) \u041a\u043e\u043b\u043b\u0435\u0433\u0438, \u0446\u0435\u043b\u044c\u044e \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u0433\u043e\u0434\u0438\u0447\u043d\u043e\u0439 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u043e\u0432\u043e\u0433\u043e \u043a\u043b\u0430\u0441\u0441\u0430 IDS-\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Deception-\u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439. \u0427\u0442\u043e\u0431\u044b \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0441\u0432\u044f\u0437\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430, \u0441\u0447\u0438\u0442\u0430\u044e \u043d\u0443\u0436\u043d\u044b\u043c \u043d\u0430\u0447\u0430\u0442\u044c \u0441 \u043f\u0440\u0435\u0434\u043f\u043e\u0441\u044b\u043b\u043e\u043a. \u0418\u0442\u0430\u043a, \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0442\u0438\u043a\u0430: \u041d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u2013 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u044b\u0439 \u0432\u0438\u0434 \u0430\u0442\u0430\u043a, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0432 \u043e\u0431\u0449\u0435\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0435 \u0443\u0433\u0440\u043e\u0437 \u0438\u0445 \u0443\u0434\u0435\u043b\u044c\u043d\u044b\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":96243,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-96242","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"(\u0437\u0430 \u0438\u0434\u0435\u044e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0441\u043f\u0430\u0441\u0438\u0431\u043e Sergey G. Brester sebres) \u041a\u043e\u043b\u043b\u0435\u0433\u0438, \u0446\u0435\u043b\u044c\u044e \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u0433\u043e\u0434\u0438\u0447\u043d\u043e\u0439 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u043e\u0432\u043e\u0433\u043e \u043a\u043b\u0430\u0441\u0441\u0430 IDS-\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Deception-\u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439. \u0427\u0442\u043e\u0431\u044b \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0441\u0432\u044f\u0437\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430, \u0441\u0447\u0438\u0442\u0430\u044e \u043d\u0443\u0436\u043d\u044b\u043c \u043d\u0430\u0447\u0430\u0442\u044c \u0441 \u043f\u0440\u0435\u0434\u043f\u043e\u0441\u044b\u043b\u043e\u043a. \u0418\u0442\u0430\u043a, \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0442\u0438\u043a\u0430: \u041d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u2013 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u044b\u0439 \u0432\u0438\u0434 \u0430\u0442\u0430\u043a, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0432 \u043e\u0431\u0449\u0435\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0435 \u0443\u0433\u0440\u043e\u0437 \u0438\u0445 \u0443\u0434\u0435\u043b\u044c\u043d\u044b\u0439\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0414\u044b\u0440\u0430 \u043a\u0430\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u2013 2, \u0438\u043b\u0438 \u043a\u0430\u043a \u043b\u043e\u0432\u0438\u0442\u044c APT \u00ab\u043d\u0430 \u0436\u0438\u0432\u0446\u0430\u00bb | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"(\u0437\u0430 \u0438\u0434\u0435\u044e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0441\u043f\u0430\u0441\u0438\u0431\u043e Sergey G. Brester sebres) \u041a\u043e\u043b\u043b\u0435\u0433\u0438, \u0446\u0435\u043b\u044c\u044e \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u0433\u043e\u0434\u0438\u0447\u043d\u043e\u0439 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u043e\u0432\u043e\u0433\u043e \u043a\u043b\u0430\u0441\u0441\u0430 IDS-\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Deception-\u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439. \u0427\u0442\u043e\u0431\u044b \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0441\u0432\u044f\u0437\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430, \u0441\u0447\u0438\u0442\u0430\u044e \u043d\u0443\u0436\u043d\u044b\u043c \u043d\u0430\u0447\u0430\u0442\u044c \u0441 \u043f\u0440\u0435\u0434\u043f\u043e\u0441\u044b\u043b\u043e\u043a. \u0418\u0442\u0430\u043a, \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0442\u0438\u043a\u0430: \u041d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u2013 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u044b\u0439 \u0432\u0438\u0434 \u0430\u0442\u0430\u043a, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0432 \u043e\u0431\u0449\u0435\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0435 \u0443\u0433\u0440\u043e\u0437 \u0438\u0445 \u0443\u0434\u0435\u043b\u044c\u043d\u044b\u0439\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-10-09T17:42:33+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-10-09T17:42:33+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Gropa si nj\u00eb instrument sigurie \u2013 2, ose si t\u00eb kapim APT \u00abn\u00eb gjallje\u00bb | ProHoster","description":"(p\u00ebr iden\u00eb e titullit faleminderit Sergey G. Brester sebres) Koleg\u00eb, q\u00ebllimi i k\u00ebtij artikulli \u00ebsht\u00eb d\u00ebshira p\u00ebr t\u00eb ndar\u00eb p\u00ebrvoj\u00ebn e nj\u00eb viti t\u00eb testimit t\u00eb eksperimentit t\u00eb nj\u00eb klase t\u00eb re t\u00eb zgjidhjeve IDS t\u00eb bazuara n\u00eb teknologjit\u00eb Deception. P\u00ebr t\u00eb ruajtur koherenc\u00ebn logjike t\u00eb materialit, e kam t\u00eb nevojshme t\u00eb filloj me parakushtet. Pra, problematika: Sulmet e drejtuara \u2013 lloji m\u00eb i rreziksh\u00ebm i sulmeve, megjith\u00ebse p\u00ebrqindja e tyre n\u00eb totalin e k\u00ebrc\u00ebnimeve \u00ebsht\u00eb e ul\u00ebt.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0414\u044b\u0440\u0430 \u043a\u0430\u043a \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u2013 2, \u0438\u043b\u0438 \u043a\u0430\u043a \u043b\u043e\u0432\u0438\u0442\u044c APT \u00ab\u043d\u0430 \u0436\u0438\u0432\u0446\u0430\u00bb | ProHoster","og:description":"(\u0437\u0430 \u0438\u0434\u0435\u044e \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u0430 \u0441\u043f\u0430\u0441\u0438\u0431\u043e Sergey G. Brester sebres) \u041a\u043e\u043b\u043b\u0435\u0433\u0438, \u0446\u0435\u043b\u044c\u044e \u0434\u0430\u043d\u043d\u043e\u0439 \u0441\u0442\u0430\u0442\u044c\u0438 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0436\u0435\u043b\u0430\u043d\u0438\u0435 \u043f\u043e\u0434\u0435\u043b\u0438\u0442\u044c\u0441\u044f \u043e\u043f\u044b\u0442\u043e\u043c \u0433\u043e\u0434\u0438\u0447\u043d\u043e\u0439 \u0442\u0435\u0441\u0442\u043e\u0432\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u043d\u043e\u0432\u043e\u0433\u043e \u043a\u043b\u0430\u0441\u0441\u0430 IDS-\u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 Deception-\u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0439. \u0427\u0442\u043e\u0431\u044b \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0441\u0432\u044f\u0437\u043d\u043e\u0441\u0442\u044c \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u0438\u044f \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0430, \u0441\u0447\u0438\u0442\u0430\u044e \u043d\u0443\u0436\u043d\u044b\u043c \u043d\u0430\u0447\u0430\u0442\u044c \u0441 \u043f\u0440\u0435\u0434\u043f\u043e\u0441\u044b\u043b\u043e\u043a. \u0418\u0442\u0430\u043a, \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0442\u0438\u043a\u0430: \u041d\u0430\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0430\u0442\u0430\u043a\u0438 \u2013 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u044b\u0439 \u0432\u0438\u0434 \u0430\u0442\u0430\u043a, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u0432 \u043e\u0431\u0449\u0435\u043c \u043a\u043e\u043b\u0438\u0447\u0435\u0441\u0442\u0432\u0435 \u0443\u0433\u0440\u043e\u0437 \u0438\u0445 \u0443\u0434\u0435\u043b\u044c\u043d\u044b\u0439","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/dyra-kak-instrument-bezopasnosti-2-ili-kak-lovit-apt-na-zhivcza","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-10-09T17:42:33+00:00","article:modified_time":"2020-10-09T17:42:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"96242","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 10:47:24","updated":"2022-10-03 07:10:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/96242","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=96242"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/96242\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/96243"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=96242"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=96242"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=96242"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}