{"id":96260,"date":"2020-10-09T19:42:45","date_gmt":"2020-10-09T17:42:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/honeypot-vs-deception-na-primere-xello"},"modified":"2020-10-09T19:42:45","modified_gmt":"2020-10-09T17:42:45","slug":"honeypot-vs-deception-na-primere-xello","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/honeypot-vs-deception-na-primere-xello","title":{"rendered":"Honeypot kundrejt Deception n\u00eb shembullin e Xello","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Honeypot<\/p>\n

N\u00eb Habr tashm\u00eb ka disa artikuj p\u00ebr teknologjit\u00eb Honeypot dhe Deception (artikulli 1<\/a><\/noindex>, artikulli 2<\/a><\/noindex>). Megjithat\u00eb, ende hasim keqkuptim lidhur me dallimin mes k\u00ebtyre klasave t\u00eb mjeteve mbrojt\u00ebse. P\u00ebr k\u00ebt\u00eb arsye, koleg\u00ebt tan\u00eb nga Xello Deception<\/a><\/noindex> (zhvilluesi i par\u00eb rus i platform\u00ebs Deception<\/a><\/noindex>) vendos\u00ebn t\u00eb p\u00ebrshkruajn\u00eb n\u00eb detaje dallimet, p\u00ebrpar\u00ebsit\u00eb dhe ve\u00e7orit\u00eb arkitekturore t\u00eb k\u00ebtyre zgjidhjeve.<\/p>\n

T\u00eb kuptojm\u00eb se \u00e7far\u00eb jan\u00eb \"honeypots\" dhe \"deception technology\":<\/h2>\n

\"Teknologjit\u00eb e mashtrimit\" (angl., Deception technology) u shfaq\u00ebn n\u00eb tregun e sistemeve t\u00eb siguris\u00eb informacionit relativisht koh\u00ebt e fundit. Megjithat\u00eb, disa specialist\u00eb ende e konsiderojn\u00eb Security Deception thjesht si \"honeypots\" m\u00eb t\u00eb avancuara (angl., honeypot). <\/p>\n

N\u00eb k\u00ebt\u00eb artikull do t\u00eb p\u00ebrpiqemi t\u00eb shpjegojm\u00eb si ngjashm\u00ebrit\u00eb, ashtu edhe dallimet themelore mes k\u00ebtyre dy zgjidhjeve. N\u00eb pjes\u00ebn e par\u00eb do t\u00eb flasim p\u00ebr \u201choneypot\u201d-in, si \u00ebsht\u00eb zhvilluar kjo teknologji dhe cilat jan\u00eb avantazhet dhe mang\u00ebsit\u00eb e saj. Nd\u00ebrsa n\u00eb pjes\u00ebn e dyt\u00eb do t\u00eb ndalemi holl\u00ebsisht te parimet e funksionimit t\u00eb platformave p\u00ebr krijimin e infrastruktur\u00ebs s\u00eb shp\u00ebrndar\u00eb t\u00eb objektivave t\u00eb rrem\u00eb (angl., Distributed Deception Platform \u2014 DDP). <\/p>\n

Parimi baz\u00eb mbi t\u00eb cilin mb\u00ebshteten honeypots \u00ebsht\u00eb krijimi i kurtheve p\u00ebr haker\u00ebt. Mbi t\u00eb nj\u00ebjtin parim u zhvilluan edhe zgjidhjet e para Deception. Por DDP-t\u00eb moderne i tejkalojn\u00eb ndjesh\u00ebm honeypot-et, si p\u00ebr nga funksionaliteti, ashtu edhe p\u00ebr nga efektiviteti. Platformat Deception p\u00ebrfshijn\u00eb: kurthe (angl., decoys, traps), joshje (angl., lures), aplikacione, t\u00eb dh\u00ebna, baza t\u00eb t\u00eb dh\u00ebnave, Active Directory. DDP-t\u00eb moderne mund t\u00eb ofrojn\u00eb mund\u00ebsi t\u00eb gjera p\u00ebr zbulimin e k\u00ebrc\u00ebnimeve, analiz\u00ebn e sulmeve dhe automatizimin e veprimeve t\u00eb reagimit. <\/p>\n

K\u00ebshtu, Deception p\u00ebrfaq\u00ebson teknika p\u00ebr imitimin e infrastruktur\u00ebs IT t\u00eb nj\u00eb nd\u00ebrmarrjeje dhe \u00e7orientimin e haker\u00ebve. Si rezultat, platforma t\u00eb tilla b\u00ebjn\u00eb t\u00eb mundur ndalimin e sulmeve p\u00ebrpara se t\u2019u shkaktohet d\u00ebm i konsideruesh\u00ebm aseteve t\u00eb kompanis\u00eb. Honeypot-et, sigurisht, nuk e kan\u00eb k\u00ebt\u00eb gam\u00eb kaq t\u00eb gjer\u00eb funksionesh dhe k\u00ebt\u00eb nivel automatizimi, ndaj p\u00ebrdorimi i tyre k\u00ebrkon kualifikim m\u00eb t\u00eb lart\u00eb nga punonj\u00ebsit e departamenteve t\u00eb siguris\u00eb s\u00eb informacionit.<\/p>\n

1. Honeypots, Honeynets dhe Sandboxing: \u00e7far\u00eb jan\u00eb dhe si p\u00ebrdoren<\/h2>\n

P\u00ebr her\u00eb t\u00eb par\u00eb, termi \"honeypots\" u p\u00ebrdor n\u00eb vitin 1989 n\u00eb librin e Clifford Stollit \"The Cuckoo\u2019s Egg\", i cili p\u00ebrshkruan ngjarjet e ndjekjes s\u00eb nj\u00eb hakera n\u00eb Laboratorin Komb\u00ebtar Lawrence Berkeley (SHBA). N\u00eb praktik\u00eb, kjo ide u realizua n\u00eb vitin 1999 nga Lance Spitzner, nj\u00eb specialist i siguris\u00eb n\u00eb kompanin\u00eb Sun Microsystems, i cili themeloi projektin hulumtues \"Honeynet Project\". Honeypots e para ishin shum\u00eb burim-pesh\u00eb, t\u00eb komplikuara n\u00eb konfigurim dhe mir\u00ebmbajtje. <\/p>\n

Le t\u00eb shqyrtojm\u00eb m\u00eb n\u00eb detaje \u00e7far\u00eb jan\u00eb honeypots <\/strong>dhe honeynets<\/strong>. Honeypots jan\u00eb hoste t\u00eb ve\u00e7anta, q\u00ebllimi i t\u00eb cilave \u00ebsht\u00eb t\u00eb t\u00ebrheqin keqb\u00ebr\u00ebsit p\u00ebr t\u00eb dep\u00ebrtuar n\u00eb rrjetin e kompanis\u00eb, p\u00ebr t\u00eb tentuar vjedhjen e t\u00eb dh\u00ebnave me vler\u00eb, si edhe p\u00ebr t\u00eb zgjeruar zon\u00ebn e veprimit t\u00eb rrjetit. Honeypot (i p\u00ebrkthyer fjal\u00eb p\u00ebr fjal\u00eb si \u00abfu\u00e7i me mjalt\u00eb\u00bb) \u00ebsht\u00eb nj\u00eb server i posa\u00e7\u00ebm me nj\u00eb grup sh\u00ebrbimesh dhe protokollesh t\u00eb ndryshme rrjeti, si HTTP, FTP etj. (shih fig. 1).<\/p>\n

\"Honeypot<\/p>\n

N\u00ebse bashkojm\u00eb disa honeypots <\/strong>n\u00eb nj\u00eb rrjet, at\u00ebher\u00eb marrim nj\u00eb sistem m\u00eb efikas honeynet<\/strong>, i cili paraqet nj\u00eb emulim t\u00eb rrjetit korporativ t\u00eb kompanis\u00eb (server web, server skedar\u00ebsh dhe komponent\u00eb t\u00eb tjer\u00eb t\u00eb rrjetit). Nj\u00eb zgjidhje e till\u00eb b\u00ebn t\u00eb mundur t\u00eb kuptohet strategjia e veprimit t\u00eb keqb\u00ebr\u00ebsve dhe t\u2019i \u00e7orientoj\u00eb ata. Nj\u00eb honeynet tipik, si rregull, funksionon paralelisht me rrjetin prodhues dhe plot\u00ebsisht i pavarur prej tij. Kjo \u00abrrjet\u00eb\u00bb mund t\u00eb publikohet n\u00eb internet p\u00ebrmes nj\u00eb kanali t\u00eb ve\u00e7ant\u00eb; p\u00ebr t\u00eb mund t\u00eb caktohet edhe nj\u00eb gam\u00eb m\u00eb vete e adresave IP (shih fig. 2).<\/p>\n

\"Honeypot<\/p>\n

Q\u00ebllimi i p\u00ebrdorimit t\u00eb honeynet \u00ebsht\u00eb t\u2019i krijoj\u00eb hakerit p\u00ebrshtypjen se ka dep\u00ebrtuar n\u00eb rrjetin korporativ t\u00eb organizat\u00ebs, nd\u00ebrsa n\u00eb t\u00eb v\u00ebrtet\u00eb keqb\u00ebr\u00ebsi ndodhet n\u00eb nj\u00eb \u00abmjedis t\u00eb izoluar\u00bb dhe n\u00ebn mbik\u00ebqyrjen e af\u00ebrt t\u00eb specialist\u00ebve t\u00eb siguris\u00eb s\u00eb informacionit (shih fig. 3).<\/p>\n

\"Honeypot<\/p>\n

K\u00ebtu duhet p\u00ebrmendur gjithashtu edhe nj\u00eb mjet i till\u00eb si \u00absandbox<\/strong>\u00bb (angl., sandbox<\/strong>), i cili u lejon keqb\u00ebr\u00ebsve t\u00eb instalojn\u00eb dhe t\u00eb ekzekutojn\u00eb programe keqdash\u00ebse n\u00eb nj\u00eb mjedis t\u00eb izoluar, ku specialist\u00ebt IT mund t\u00eb monitorojn\u00eb veprimet e tyre p\u00ebr t\u00eb identifikuar rreziqet e mundshme dhe p\u00ebr t\u00eb nd\u00ebrmarr\u00eb kund\u00ebrmasa t\u00eb nevojshme. Aktualisht, sandboxing zakonisht zbatohet n\u00eb makina virtuale t\u00eb dedikuara mbi nj\u00eb host virtual. Megjithat\u00eb, duhet theksuar se sandboxing tregon vet\u00ebm se si sillen programet e rrezikshme dhe keqdash\u00ebse, nd\u00ebrsa honeynet i ndihmon specialistit t\u00eb analizoj\u00eb sjelljen e \u00abaktor\u00ebve t\u00eb rreziksh\u00ebm\u00bb. <\/p>\n

P\u00ebrfitimi i duksh\u00ebm i honeynets \u00ebsht\u00eb se ato i mashtrojn\u00eb sulmuesit, duke u shp\u00ebrdoruar p\u00ebrpjekjet, burimet dhe koh\u00ebn. Si rezultat, n\u00eb vend t\u00eb objektivave reale, ata sulmojn\u00eb objektiva t\u00eb rrem\u00eb dhe mund ta nd\u00ebrpresin sulmin ndaj rrjetit pa arritur asgj\u00eb. M\u00eb s\u00eb shpeshti, teknologjit\u00eb honeynets p\u00ebrdoren n\u00eb institucionet qeveritare dhe korporatat e m\u00ebdha, si edhe n\u00eb organizatat financiare, pasi pik\u00ebrisht k\u00ebto struktura b\u00ebhen objektiv i sulmeve t\u00eb m\u00ebdha kibernetike. Megjithat\u00eb, edhe bizneset e vogla dhe t\u00eb mesme (SMB) kan\u00eb nevoj\u00eb p\u00ebr mjete efektive p\u00ebr parandalimin e incidenteve t\u00eb siguris\u00eb s\u00eb informacionit, por p\u00ebrdorimi i honeynets n\u00eb sektorin SMB nuk \u00ebsht\u00eb aq i thjesht\u00eb p\u00ebr shkak t\u00eb munges\u00ebs s\u00eb specialist\u00ebve t\u00eb kualifikuar p\u00ebr nj\u00eb pun\u00eb kaq komplekse.<\/p>\n

Kufizimet e zgjidhjeve Honeypots dhe Honeynets<\/u><\/strong><\/p>\n

Pse, pra, honeypots dhe honeynets nuk jan\u00eb zgjidhjet m\u00eb t\u00eb mira p\u00ebr mbrojtje ndaj sulmeve sot? Duhet theksuar se sulmet po b\u00ebhen gjithnj\u00eb e m\u00eb t\u00eb m\u00ebdha n\u00eb shkall\u00eb, m\u00eb komplekse nga ana teknike dhe t\u00eb afta t\u00eb shkaktojn\u00eb d\u00ebme serioze ndaj infrastruktur\u00ebs IT t\u00eb organizat\u00ebs, nd\u00ebrsa krimi kibernetik ka kaluar n\u00eb nj\u00eb nivel krejt tjet\u00ebr dhe p\u00ebrfaq\u00ebson struktura t\u00eb mir\u00eborganizuara biznesi n\u00eb hije, t\u00eb pajisura me t\u00eb gjitha burimet e nevojshme. K\u00ebsaj i shtohet edhe \u201cfaktori njer\u00ebzor\u201d (gabime n\u00eb konfigurimin e softuerit dhe pajisjeve, veprimet e personave t\u00eb brendsh\u00ebm etj.), prandaj p\u00ebrdorimi vet\u00ebm i teknologjive p\u00ebr parandalimin e sulmeve aktualisht nuk mjafton m\u00eb. <\/p>\n

M\u00eb posht\u00eb po rendisim kufizimet dhe mang\u00ebsit\u00eb kryesore t\u00eb honeypots (honeynets):<\/p>\n

    \n
  1. \n

    \u201cHoneypots\u201d u zhvilluan fillimisht p\u00ebr t\u00eb identifikuar k\u00ebrc\u00ebnimet q\u00eb ndodhen jasht\u00eb rrjetit korporativ; ato jan\u00eb t\u00eb destinuara m\u00eb shum\u00eb p\u00ebr analizimin e sjelljes s\u00eb keqb\u00ebr\u00ebsve dhe nuk jan\u00eb nd\u00ebrtuar p\u00ebr reagim t\u00eb shpejt\u00eb ndaj k\u00ebrc\u00ebnimeve. <\/p>\n<\/li>\n

  2. \n

    Si rregull, keqb\u00ebr\u00ebsit tashm\u00eb kan\u00eb m\u00ebsuar t\u00eb njohin sistemet e emuluara dhe t\u2019i shmangin honeypots. <\/p>\n<\/li>\n

  3. \n

    Honeynets (honeypots) kan\u00eb nj\u00eb nivel jasht\u00ebzakonisht t\u00eb ul\u00ebt interaktiviteti dhe nd\u00ebrveprimi me sistemet e tjera t\u00eb siguris\u00eb, prandaj duke p\u00ebrdorur honeypots \u00ebsht\u00eb e v\u00ebshtir\u00eb t\u00eb merret informacion i detajuar p\u00ebr sulmet dhe sulmuesit, e rrjedhimisht t\u00eb reagohet shpejt dhe n\u00eb m\u00ebnyr\u00eb efektive ndaj incidenteve t\u00eb siguris\u00eb s\u00eb informacionit. P\u00ebr m\u00eb tep\u00ebr, specialist\u00ebt e siguris\u00eb s\u00eb informacionit marrin nj\u00eb num\u00ebr t\u00eb madh alarmesh t\u00eb rreme p\u00ebr k\u00ebrc\u00ebnime. <\/p>\n<\/li>\n

  4. \n

    N\u00eb disa raste, haker\u00ebt mund t\u00eb p\u00ebrdorin nj\u00eb honeypot t\u00eb komprometuar si pik\u00ebnisje p\u00ebr t\u00eb vazhduar sulmin ndaj rrjetit t\u00eb organizat\u00ebs. <\/p>\n<\/li>\n

  5. \n

    Shpesh shfaqen probleme me shkall\u00ebzueshm\u00ebrin\u00eb e honeypot-eve, ngarkes\u00ebn e lart\u00eb operative dhe konfigurimin e k\u00ebtyre sistemeve (ato k\u00ebrkojn\u00eb specialist\u00eb me kualifikim t\u00eb lart\u00eb, nuk kan\u00eb nj\u00eb nd\u00ebrfaqe t\u00eb p\u00ebrshtatshme administrimi etj.). Ka gjithashtu v\u00ebshtir\u00ebsi t\u00eb m\u00ebdha n\u00eb vendosjen e honeypots n\u00eb mjedise t\u00eb specializuara, si IoT, POS, sistemet cloud etj.<\/p>\n<\/li>\n<\/ol>\n

    2. Deception technology: p\u00ebrpar\u00ebsit\u00eb dhe parimet baz\u00eb t\u00eb funksionimit<\/h2>\n

    Duke analizuar t\u00eb gjitha avantazhet dhe disavantazhet e honeypots, arrijm\u00eb n\u00eb p\u00ebrfundimin se nevojitet nj\u00eb qasje krejt\u00ebsisht e re p\u00ebr reagimin ndaj incidenteve t\u00eb siguris\u00eb s\u00eb informacionit, me q\u00ebllim ofrimin e nj\u00eb p\u00ebrgjigjeje t\u00eb shpejt\u00eb dhe t\u00eb p\u00ebrshtatshme ndaj veprimeve t\u00eb sulmuesve. Dhe nj\u00eb zgjidhje e till\u00eb \u00ebsht\u00eb teknologjia \u0421yber deception (Security deception)<\/strong>. <\/p>\n

    Terminologjia \"Cyber deception\", \"Security deception\", \"Deception technology\", \"Distributed Deception Platform\" (DDP) \u00ebsht\u00eb relativisht e re dhe ka filluar t\u00eb shfaqet koh\u00ebt e fundit. Faktikisht, t\u00eb gjith\u00eb k\u00ebta terma p\u00ebrshkruajn\u00eb p\u00ebrdorimin e \"teknologjive t\u00eb mashtrimit\" ose \"teknikave t\u00eb imitim t\u00eb infrastruktur\u00ebs IT dhe dezinformatave ndaj keqb\u00ebr\u00ebsve\". Zgjidhjet m\u00eb t\u00eb thjeshta t\u00eb Deception jan\u00eb zhvillimi i ideve t\u00eb honeypots, vet\u00ebm n\u00eb nj\u00eb nivel m\u00eb teknologjikisht t\u00eb avancuar q\u00eb parashikon nj\u00eb automatizim m\u00eb t\u00eb madh t\u00eb zbularjes dhe reagimit ndaj k\u00ebrc\u00ebnimeve. Megjithat\u00eb, n\u00eb treg tashm\u00eb ekzistojn\u00eb zgjidhje serioze t\u00eb klas\u00ebs DDP q\u00eb parashikojn\u00eb leht\u00ebsin\u00eb e implementimit dhe zgjerimit, si dhe disponojn\u00eb nj\u00eb arsenal t\u00eb konsideruesh\u00ebm \"kurthe\" dhe \"mashtrues\" p\u00ebr sulmuesit. P\u00ebr shembull, Deception lejon q\u00eb t\u00eb emulohen objekte t\u00eb tilla t\u00eb infrastruktur\u00ebs IT si databaza, stacione punuese, ruter\u00eb, switch, ATM, server\u00eb dhe SCADA, pajisje mjek\u00ebsore dhe IoT. <\/p>\n

    Si funksionon \"Distributed Deception Platform\"? Pasi t\u00eb implementohet DDP, infrastruktura IT e organizat\u00ebs do t\u00eb krijohet sikur nga dy shtresa: shtresa e par\u00eb \u00ebsht\u00eb infrastruktura reale e kompanis\u00eb, nd\u00ebrsa e dyta \u00ebsht\u00eb mjedisi \"emuluar\", i p\u00ebrb\u00ebr\u00eb nga kurthe (angl., decoys, traps) dhe mashtrues (angl., lures) q\u00eb jan\u00eb t\u00eb pozicionuara n\u00eb pajisje fizike reale t\u00eb rrjetit (shih. fig. 4).<\/p>\n

    \"Honeypot<\/p>\n

    P\u00ebr shembull, nj\u00eb keqb\u00ebr\u00ebs mund t\u00eb zbuloj\u00eb baza t\u00eb dh\u00ebnash t\u00eb rreme me \u00abdokumente konfidenciale\u00bb, kredenciale t\u00eb rreme t\u00eb gjoja \u00abp\u00ebrdoruesve t\u00eb privilegjuar\u00bb \u2014 t\u00eb gjitha k\u00ebto jan\u00eb objektiva t\u00eb rreme q\u00eb mund t\u00eb zgjojn\u00eb interesin e sulmuesve, duke ua larguar v\u00ebmendjen nga asetet reale t\u00eb informacionit t\u00eb kompanis\u00eb (shih fig. 5).<\/p>\n

    \"Honeypot<\/p>\n

    DDP \u00ebsht\u00eb nj\u00eb risi n\u00eb tregun e produkteve t\u00eb siguris\u00eb s\u00eb informacionit; k\u00ebto zgjidhje ekzistojn\u00eb prej vet\u00ebm pak vitesh dhe aktualisht mund t\u2019i p\u00ebrballoj\u00eb vet\u00ebm sektori korporativ. Por s\u00eb shpejti edhe bizneset e vogla dhe t\u00eb mesme do t\u00eb mund t\u00eb p\u00ebrfitojn\u00eb nga Deception, duke marr\u00eb DDP me qira nga ofrues t\u00eb specializuar, \u00absi sh\u00ebrbim\u00bb. Ky opsion \u00ebsht\u00eb madje m\u00eb i p\u00ebrshtatsh\u00ebm, pasi nuk ka nevoj\u00eb p\u00ebr staf t\u00eb brendsh\u00ebm me kualifikim t\u00eb lart\u00eb.<\/p>\n

    M\u00eb posht\u00eb paraqiten p\u00ebrpar\u00ebsit\u00eb kryesore t\u00eb teknologjis\u00eb Deception:<\/p>\n