{"id":96260,"date":"2020-10-09T19:42:45","date_gmt":"2020-10-09T17:42:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/honeypot-vs-deception-na-primere-xello"},"modified":"2020-10-09T19:42:45","modified_gmt":"2020-10-09T17:42:45","slug":"honeypot-vs-deception-na-primere-xello","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/honeypot-vs-deception-na-primere-xello","title":{"rendered":"Honeypot vs Deception n\u00eb shembullin e Xello","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Honeypot<\/p>\n

N\u00eb Habr ka disa artikuj mbi teknologjit\u00eb Honeypot dhe Deception (1 artikull<\/a><\/noindex>, 2 artikuj<\/a><\/noindex>). Megjithat\u00eb, ne ende p\u00ebrballemi me keqkuptime mbi dallimin midis k\u00ebtyre kategorive t\u00eb mjeteve t\u00eb mbrojtjes. P\u00ebr k\u00ebt\u00eb, koleg\u00ebt tan\u00eb nga Xello Deception<\/a><\/noindex> (prodhuesi i par\u00eb vendas i platform\u00ebs Deception<\/a><\/noindex>) vendos\u00ebn t\u00eb p\u00ebrshkruajn\u00eb detajet, p\u00ebrpar\u00ebsit\u00eb dhe karakteristikat arkitektonike t\u00eb k\u00ebtyre zgjidhjeve.<\/p>\n

T\u00eb kuptojm\u00eb se \u00e7far\u00eb jan\u00eb «honeypots» dhe «deception»:<\/h2>\n

«Teknologjit\u00eb e mashtrimeve» (angl., Deception technology) kan\u00eb dal\u00eb n\u00eb tregun e sistemeve t\u00eb siguris\u00eb informacionit relativisht koh\u00ebt e fundit. Megjithat\u00eb, disa specialist\u00eb ende e konsiderojn\u00eb Security Deception si thjesht nj\u00eb version m\u00eb t\u00eb avancuar t\u00eb «honeypots» (angl., honeypot). <\/p>\n

N\u00eb k\u00ebt\u00eb artikull do t\u00eb p\u00ebrpiqemi t\u00eb ilustrojm\u00eb si ngjashm\u00ebrin\u00eb ashtu edhe dallimet thelb\u00ebsore t\u00eb k\u00ebtyre dy zgjidhjeve. N\u00eb pjes\u00ebn e par\u00eb, do t\u00eb flasim p\u00ebr \"hanipotin\", si \u00ebsht\u00eb zhvilluar kjo teknologji dhe cilat jan\u00eb p\u00ebrpar\u00ebsit\u00eb dhe disavantazhet e saj. N\u00eb pjes\u00ebn e dyt\u00eb, do t\u00eb ndalemi m\u00eb gjer\u00ebsisht n\u00eb parimet e funksionimit t\u00eb platformave p\u00ebr krijimin e infrastruktur\u00ebs s\u00eb shp\u00ebrndar\u00eb t\u00eb objektivave t\u00eb falsifikuara (angl., Distributed Deception Platform \u2014 DDP). <\/p>\n

Parimi themelor q\u00eb q\u00ebndron pas honeypot-\u00ebve \u00ebsht\u00eb krijimi i grackave p\u00ebr haker\u00ebt. Po k\u00ebt\u00eb parim jan\u00eb zhvilluar edhe zgjidhjet e para Deception. Por, DDP-t\u00eb moderne tejkalojn\u00eb n\u00eb m\u00ebnyr\u00eb t\u00eb konsiderueshme hane-pots, si n\u00eb funksionalitetin e tyre ashtu edhe n\u00eb efikasitet. Platformat Deception p\u00ebrfshijn\u00eb: gracka (angl., decoys, traps), joshje (angl., lures), aplikacione, t\u00eb dh\u00ebna, baza t\u00eb dh\u00ebnash, Active Directory. DDP-t\u00eb moderne ofrojn\u00eb mund\u00ebsi t\u00eb gjera p\u00ebr zbulimin e k\u00ebrc\u00ebnimeve, analizimin e sulmeve dhe automatizimin e veprimeve reaguese. <\/p>\n

K\u00ebshtu, Deception paraqesin teknika p\u00ebr imitim t\u00eb infrastruktur\u00ebs IT t\u00eb nd\u00ebrmarrjes dhe p\u00ebr t\u00eb \u00e7uar haker\u00ebt n\u00eb masht\u00ebrim. Si pasoj\u00eb, k\u00ebto platforma lejojn\u00eb ndalimin e sulmeve para se t\u00eb shkaktojn\u00eb d\u00ebm t\u00eb r\u00ebnd\u00ebsish\u00ebm p\u00ebr asetet e kompanis\u00eb. Honeypot-\u00ebt, sigurisht, nuk kan\u00eb nj\u00eb funksionalitet aq t\u00eb gjer\u00eb dhe nj\u00eb nivel t\u00eb till\u00eb automatizimi, prandaj p\u00ebrdorimi i tyre k\u00ebrkon kualifikim m\u00eb t\u00eb lart\u00eb nga stafi i departamenteve t\u00eb siguris\u00eb kibernetike.<\/p>\n

1. Honeypots, Honeynets dhe Sandboxing: \u00e7far\u00eb jan\u00eb dhe si aplikohen<\/h2>\n

P\u00ebr her\u00eb t\u00eb par\u00eb, termi «honeypots» u p\u00ebrdor n\u00eb 1989 n\u00eb librin e Clifford Stollit «The Cuckoo\u2019s Egg», n\u00eb t\u00eb cilin p\u00ebrshkruhen ngjarjet rreth ndjekjes s\u00eb nj\u00eb hakeri n\u00eb Laboratorin Komb\u00ebtar t\u00eb Berkley (SHBA). N\u00eb praktik\u00eb, kjo ide u realizua n\u00eb vitin 1999 nga Lance Spitzner, specialist i siguris\u00eb n\u00eb kompani Sun Microsystems, i cili themeloi projektin k\u00ebrkimor «Honeynet Project». Honeypots e para ishin shum\u00eb k\u00ebrkuese p\u00ebr burime, t\u00eb komplikuara p\u00ebr t'u konfiguruar dhe mbajtur. <\/p>\n

Le t\u00eb shqyrtojm\u00eb m\u00eb n\u00eb detaje se \u00e7far\u00eb jan\u00eb honeypots <\/strong>dhe honeynets<\/strong>. Honeypot\u00ebt \u2014 jan\u00eb hoste t\u00eb ve\u00e7anta, t\u00eb cilat kan\u00eb si q\u00ebllim t\u00eb t\u00ebrheqin sulmuesit q\u00eb t\u00eb kryejn\u00eb dep\u00ebrtim n\u00eb rrjetin e kompanis\u00eb dhe t\u00eb p\u00ebrpiqen t\u00eb vjedhin t\u00eb dh\u00ebna t\u00eb \u00e7muara, si dhe t\u00eb zgjasin zon\u00ebn e veprimit t\u00eb rrjetit. Honeypoti (i p\u00ebrkthyer doslovno si \u00abbarrel me mjalt\u00eb\u00bb) paraqet nj\u00eb server t\u00eb ve\u00e7ant\u00eb me nj\u00eb grup sh\u00ebrbimesh dhe protokollesh t\u00eb ndryshme rrjeti, si HTTP, FTP etj. (shih fig. 1).<\/p>\n

\"Honeypot<\/p>\n

N\u00ebse bashkojm\u00eb disa honeypots <\/strong>n\u00eb nj\u00eb rrjet, do t\u00eb marrim nj\u00eb sistem m\u00eb efikas honeynet<\/strong>, q\u00eb p\u00ebrfaq\u00ebson nj\u00eb emulim t\u00eb rrjetit t\u00eb Korporat\u00ebs (server web, server skedar\u00ebsh, dhe komponent\u00eb t\u00eb tjer\u00eb t\u00eb rrjetit). Ky zgjidhje lejon t\u00eb kuptoni strategjin\u00eb e veprimeve t\u00eb aktor\u00ebve t\u00eb k\u00ebqij dhe t'i \u00e7oni ata n\u00eb nj\u00eb stek\u00eb e gabuar. Nj\u00eb honeynet tipik zakonisht punon paralelisht me rrjetin e pun\u00ebs dhe \u00ebsht\u00eb plot\u00ebsisht e pavarur nga ai. Kjo \"rrjet\" mund t\u00eb publikohet n\u00eb Internet p\u00ebrmes nj\u00eb kanali t\u00eb ve\u00e7ant\u00eb, dhe gjithashtu mund t\u00eb rezervoni nj\u00eb gam\u00eb t\u00eb ve\u00e7ant\u00eb IP-sh adresash (shih figura 2).<\/p>\n

\"Honeypot<\/p>\n

Kuptimi i p\u00ebrdorimit t\u00eb honeynet \u00ebsht\u00eb t\u00eb tregoni hakerit se ai p\u00ebr nj\u00eb moment ka hyr\u00eb n\u00eb rrjetin korporativ t\u00eb organizat\u00ebs, nd\u00ebrkoh\u00eb q\u00eb n\u00eb t\u00eb v\u00ebrtet\u00eb ai ndodhet n\u00eb nj\u00eb \"mjedis t\u00eb izoluar\" dhe n\u00ebn v\u00ebzhgimin e ngusht\u00eb t\u00eb specialist\u00ebve t\u00eb siguris\u00eb informative (shih figura 3).<\/p>\n

\"Honeypot<\/p>\n

K\u00ebtu gjithashtu duhet t\u00eb p\u00ebrmendet nj\u00eb mjet i till\u00eb si \"sandbox<\/strong>\" (anglisht, sandbox<\/strong>), e cila u lejon sulmuesit t\u00eb instalojn\u00eb dhe t\u00eb nisin programe malinj n\u00eb nj\u00eb mjedis t\u00eb izoluar, ku specialist\u00ebt e IT-s\u00eb mund t\u00eb ndjekin veprimet e tyre me q\u00ebllim identifikimin e rreziqeve t\u00eb mundshme dhe marrjen e masave t\u00eb nevojshme. Aktualisht, zakonisht sandboxing implementohet n\u00eb makina virtuale t\u00eb dedikuara n\u00eb nj\u00eb host virtual. Megjithat\u00eb, duhet theksuar se sandboxing tregon vet\u00ebm se si veprojn\u00eb programet e rrezikshme dhe malinje, nd\u00ebrsa honeynet ndihmon specialistin t\u00eb analizoj\u00eb sjelljen e 'lojtar\u00ebve t\u00eb rreziksh\u00ebm'. <\/p>\n

P\u00ebrfitimi i qart\u00eb i honeynets \u00ebsht\u00eb se ata i \u00e7oroditin shkel\u00ebsit, duke i shp\u00ebrdoruar forcat, burimet dhe koh\u00ebn e tyre. Si rezultat, n\u00eb vend t\u00eb q\u00ebllimeve reale, ata sulmojn\u00eb t\u00eb falsifikuara dhe mund t\u00eb nd\u00ebrpresin sulmin n\u00eb rrjet, duke mos arritur asgj\u00eb. Teknologjit\u00eb honeynets p\u00ebrdoren m\u00eb s\u00eb shumti n\u00eb institucione qeveritare dhe n\u00eb korporata t\u00eb m\u00ebdha, si dhe n\u00eb organizata financiare, pasi k\u00ebto struktura jan\u00eb shpesh objektiva p\u00ebr sulme t\u00eb m\u00ebdha kibernetike. Megjithat\u00eb, nd\u00ebrmarrjet e vogla dhe t\u00eb mesme (SMB) gjithashtu kan\u00eb nevoj\u00eb p\u00ebr mjete efektive p\u00ebr t\u00eb parandaluar incidentet e siguris\u00eb s\u00eb informacionit, por p\u00ebrdorimi i honeynets n\u00eb sektorin SMB nuk \u00ebsht\u00eb aq i leht\u00eb p\u00ebr shkak t\u00eb munges\u00ebs s\u00eb personelit t\u00eb kualifikuar p\u00ebr nj\u00eb pun\u00eb kaq t\u00eb komplikuar.<\/p>\n

Kufizimet e zgjidhjeve Honeypots dhe Honeynets<\/u><\/strong><\/p>\n

Pse honeypots dhe honeynets nuk jan\u00eb zgjidhjet m\u00eb t\u00eb mira p\u00ebr t\u00eb kund\u00ebrshtuar sulmet sot? Duhet t\u00eb theksohet se sulmet po b\u00ebhen gjithnj\u00eb e m\u00eb t\u00eb m\u00ebdha, teknikisht m\u00eb t\u00eb komplikuara dhe n\u00eb gjendje t\u00eb shkaktojn\u00eb d\u00ebme t\u00eb konsiderueshme n\u00eb infrastruktur\u00ebn IT t\u00eb organizat\u00ebs, nd\u00ebrsa krimi kibernetik ka hyr\u00eb n\u00eb nj\u00eb nivel krejt tjet\u00ebr dhe p\u00ebrb\u00ebn struktura biznesi t\u00eb organizuara mir\u00eb, t\u00eb armatosura me t\u00eb gjitha burimet e nevojshme. K\u00ebsaj i shtohet edhe \"faktori njeri\" (gabimet n\u00eb konfigurimin e softuerit dhe pajisjeve, veprimet e insider\u00ebve, etj.), prandaj p\u00ebrdorimi i vet\u00ebm t\u00eb teknologjive p\u00ebr t\u00eb parandaluar sulmet p\u00ebr momentin nuk mjafton m\u00eb. <\/p>\n

M\u00eb posht\u00eb jan\u00eb p\u00ebrmendur kufizimet dhe mang\u00ebsit\u00eb kryesore t\u00eb honeypots (honeynets):<\/p>\n

    \n
  1. \n

    \"Honeypots\" jan\u00eb krijuar fillimisht p\u00ebr t\u00eb zbuluar k\u00ebrc\u00ebnimet q\u00eb ndodhin jasht\u00eb rrjetit korporativ, jan\u00eb m\u00eb s\u00eb shumti p\u00ebr analizimin e sjelljes s\u00eb sulmuesve dhe nuk jan\u00eb t\u00eb dizajnuar p\u00ebr t\u00eb reaguar shpejt ndaj k\u00ebrc\u00ebnimeve. <\/p>\n<\/li>\n

  2. \n

    Sulmuesit, zakonisht, tashm\u00eb kan\u00eb m\u00ebsuar t\u00eb identifikojn\u00eb sistemet e emuluara dhe t\u00eb shmangin honeypots. <\/p>\n<\/li>\n

  3. \n

    Honeynets (honeypots) kan\u00eb nj\u00eb nivel shum\u00eb t\u00eb ul\u00ebt interaktiviteti dhe nd\u00ebrveprimi me sistemet e tjera t\u00eb siguris\u00eb, duke e b\u00ebr\u00eb t\u00eb v\u00ebshtir\u00eb q\u00eb, duke p\u00ebrdorur honeypot, t\u00eb merret nj\u00eb informacion i gjer\u00eb mbi sulmet dhe sulmuesit, duke mos u mund\u00ebsuar k\u00ebshtu p\u00ebrgjigje efikase dhe t\u00eb shpejt\u00eb ndaj incidenteve t\u00eb siguris\u00eb informuese. P\u00ebr m\u00eb tep\u00ebr, specialist\u00ebt e siguris\u00eb informuese marrin nj\u00eb sasi t\u00eb madhe alarmesh t\u00eb rreme p\u00ebr k\u00ebrc\u00ebnime. <\/p>\n<\/li>\n

  4. \n

    N\u00eb disa raste, haker\u00ebt mund t\u00eb p\u00ebrdorin nj\u00eb honeypot t\u00eb komprometuar si nj\u00eb pik\u00eb fillestare p\u00ebr t\u00eb vazhduar sulmin n\u00eb rrjetin e organizat\u00ebs. <\/p>\n<\/li>\n

  5. \n

    Shpesh ndodhin probleme me skalueshm\u00ebrin\u00eb e honeypot\u00ebve, ngarkes\u00ebn e lart\u00eb operacionale dhe konfigurimin e k\u00ebtyre sistemeve (ato k\u00ebrkojn\u00eb specialist\u00eb t\u00eb kualifikuar, nuk kan\u00eb nj\u00eb nd\u00ebrfaqe menaxhimi t\u00eb leht\u00eb etj.). Ka v\u00ebshtir\u00ebsi t\u00eb m\u00ebdha n\u00eb vendosjen e honeypot-\u00ebve n\u00eb ambiente t\u00eb specializuara, si\u00e7 jan\u00eb IoT, POS, sisteme n\u00eb re etj.<\/p>\n<\/li>\n<\/ol>\n

    2. Teknologjia e mashtrimit: p\u00ebrfitimet dhe prinsipet kryesore t\u00eb pun\u00ebs<\/h2>\n

    Pas studimit t\u00eb t\u00eb gjitha p\u00ebrpar\u00ebsive dhe disavantazheve t\u00eb honeypot-\u00ebve, arrijm\u00eb n\u00eb p\u00ebrfundimin se nevojitet nj\u00eb qasje krejt\u00ebsisht e re n\u00eb reagimin ndaj incidenteve t\u00eb siguris\u00eb kibernetike, me q\u00ebllim q\u00eb t\u00eb zhvillohet nj\u00eb p\u00ebrgjigje e shpejt\u00eb dhe e duhur ndaj veprimeve t\u00eb sulmuesve. Nj\u00eb zgjidhje e till\u00eb jan\u00eb teknologjit\u00eb Mashtrimi kibernetik (Mashtrimi p\u00ebr siguri)<\/strong>. <\/p>\n

    Terminologjia «Cyber deception», «Security deception», «Deception technology», «Distributed Deception Platform» (DDP) \u00ebsht\u00eb relativisht e re dhe ka dal\u00eb s\u00eb fundmi. N\u00eb fakt, t\u00eb gjith\u00eb k\u00ebta terma n\u00ebnkuptojn\u00eb p\u00ebrdorimin e «teknologjive t\u00eb mashtrimeve» ose «teknikave t\u00eb imitim t\u00eb infrastruktur\u00ebs IT dhe dezinformimin e sulmuesve». Zgjidhjet m\u00eb t\u00eb thjeshta t\u00eb Deception jan\u00eb zhvillimi i ideve t\u00eb honeypots, por n\u00eb nj\u00eb nivel m\u00eb teknologjikisht t\u00eb avancuar, i cili parashikon nj\u00eb automatizim m\u00eb t\u00eb madh t\u00eb zbulimit t\u00eb k\u00ebrc\u00ebnimeve dhe reagimin ndaj tyre. Megjithat\u00eb, n\u00eb treg tashm\u00eb ka zgjidhje serioze t\u00eb klas\u00ebs DDP, t\u00eb cilat sigurojn\u00eb leht\u00ebsi n\u00eb implementim dhe shkall\u00ebzim, si dhe disponojn\u00eb nj\u00eb arsenale t\u00eb r\u00ebnd\u00ebsishme t\u00eb «kapjeve» dhe «prerjes» p\u00ebr sulmuesit. Shembuj, Deception lejon t\u00eb emuloj\u00eb objekte t\u00eb tilla t\u00eb infrastruktur\u00ebs IT si baza t\u00eb dh\u00ebnash, stacione pune, ruter\u00eb, switch, ATM, server\u00eb dhe SCADA, pajisje mjek\u00ebsore dhe IoT. <\/p>\n

    Si funksionon «Distributed Deception Platform»? Pas implementimit t\u00eb DDP, infrastruktura IT e organizat\u00ebs do t\u00eb nd\u00ebrtohet si dy shtresa: shtresa e par\u00eb \u00ebsht\u00eb infrastruktura reale e kompanis\u00eb, nd\u00ebrsa e dyta \u00ebsht\u00eb nj\u00eb mjedis «emuluar», i p\u00ebrb\u00ebr\u00eb nga kapje (angl., decoys, traps) dhe kurthe (angl., lures), t\u00eb cilat jan\u00eb vendosur n\u00eb pajisje fizike reale t\u00eb rrjetit (shih figura 4).<\/p>\n

    \"Honeypot<\/p>\n

    P\u00ebr shembull, nj\u00eb hacker mund t\u00eb gjej\u00eb baza t\u00eb gabuara t\u00eb dh\u00ebnash me 'dokumente konfidenciale', kredenciale t\u00eb rreme t\u00eb ashtuquajtur\u00ebve 'p\u00ebrdorues t\u00eb privilegjuar' \u2014 t\u00eb gjitha k\u00ebto jan\u00eb q\u00ebllime t\u00eb rreme, t\u00eb cilat mund t\u00eb t\u00ebrheqin v\u00ebmendjen e shkel\u00ebsve, duke i zgjedhur ata nga asetet e v\u00ebrteta informative t\u00eb kompanis\u00eb (shih fig. 5).<\/p>\n

    \"Honeypot<\/p>\n

    DDP \u00ebsht\u00eb nj\u00eb risi n\u00eb tregun e produkteve t\u00eb siguris\u00eb kibernetike, k\u00ebto zgjidhje jan\u00eb disa vjet t\u00eb vjetra dhe deri tani mund t\u00eb p\u00ebrballohen vet\u00ebm nga sektori korporativ. Por biznisi i vog\u00ebl dhe i mes\u00ebm do t\u00eb ndihmoj\u00eb s\u00eb shpejti t\u00eb p\u00ebrfitoj\u00eb nga Deception, duke e marr\u00eb DDP nga ofrues t\u00eb specializuar, si nj\u00eb 'sh\u00ebrbim'. Ky variant \u00ebsht\u00eb madje m\u00eb i p\u00ebrshtatsh\u00ebm, pasi nuk ka nevoj\u00eb p\u00ebr punonj\u00ebs t\u00eb kualifikuar t\u00eb lart\u00eb.<\/p>\n

    M\u00eb posht\u00eb jan\u00eb p\u00ebrfitimet kryesore t\u00eb teknologjis\u00eb Deception:<\/p>\n