Abasebenzisi abaninzi nangakumbi bazisa zonke iziseko zabo ze-IT kwilifu loluntu. Nangona kunjalo, ukuba ulawulo lwe-anti-virus alunelanga kwisiseko somthengi, umngcipheko omkhulu we-cyber uvela. Ukuziqhelanisa kubonisa ukuba ukuya kuthi ga kwi-80% yeentsholongwane ezikhoyo zihlala ngokugqibeleleyo kwindawo ebonakalayo. Kule post siza kuthetha malunga nendlela yokukhusela izixhobo ze-IT kwifu likawonkewonke kwaye kutheni i-antiviruses yendabuko ayifanelekanga ngokupheleleyo kwezi njongo.
Ukuqala, siza kukuxelela ukuba sifike njani kumbono wokuba izixhobo eziqhelekileyo zokukhusela intsholongwane azifanelekanga kwilifu likawonkewonke kwaye ezinye iindlela zokukhusela izixhobo ziyafuneka.
Okokuqala, ababoneleli ngokubanzi babonelela ngamanyathelo ayimfuneko ukuqinisekisa ukuba iiplatifomu zabo zamafu zikhuselwe kwinqanaba eliphezulu. Umzekelo, kwi-#CloudMTS sihlalutya zonke iitrafikhi zenethiwekhi, sibeke iliso kwiinkqubo zethu zokhuseleko zelifu, kwaye siqhube iipentes rhoqo. Amacandelo elifu abelwe abathengi ngabanye kufuneka akhuselwe ngokukhuselekileyo.
Okwesibini, ukhetho lwakudala lokulwa nemingcipheko ye-cyber lubandakanya ukufaka i-antivirus kunye nezixhobo zolawulo lwe-antivirus kumatshini ngamnye obonakalayo. Nangona kunjalo, ngenani elikhulu loomatshini ababonakalayo, lo mkhuba awunakusebenza kwaye ufune inani elikhulu lezixhobo zekhompyuter, ngaloo ndlela ulayisha ngakumbi isiseko somthengi kunye nokunciphisa ukusebenza ngokubanzi kwelifu. Oku kuye kwaba yimfuneko ephambili yokukhangela iindlela ezintsha zokwakha ukhuseleko olusebenzayo lokulwa nentsholongwane koomatshini bomthengi.
Ukongeza, uninzi lwezisombululo ze-antivirus kwimarike azilungiswanga ukusombulula iingxaki zokukhusela izixhobo ze-IT kwindawo yelifu loluntu. Njengomthetho, zizisombululo ezinzima ze-EPP (i-Endpoint Protection Platforms), leyo, ngaphezu koko, ayiboneleli ngokwezifiso eziyimfuneko kwicala lomxhasi womnikezeli wefu.
Kuyacaca ukuba izisombululo ze-antivirus zemveli azifanelekanga ukusebenza efini, kuba zilayisha ngokungqongqo iziseko ezingundoqo ngexesha lohlaziyo kunye nokuskena, kwaye azinawo amanqanaba ayimfuneko olawulo olusekwe kwindima kunye noseto. Okulandelayo, siya kuhlalutya ngokweenkcukacha ukuba kutheni ilifu lifuna iindlela ezintsha zokukhusela intsholongwane.
Yintoni i-antivirus kwifu likawonkewonke ekufuneka ikwazi ukuyenza
Ke, makhe siqwalasele izinto ezithile zokusebenza kwindawo ebonakalayo:
Ukusebenza kohlaziyo kunye nokuskena ubunzima obucwangcisiweyo. Ukuba inani elibalulekileyo loomatshini benyani abasebenzisa i-antivirus yemveli baqalisa uhlaziyo ngaxeshanye, into ebizwa ngokuba βyisiphangoβ sohlaziyo iya kwenzeka efini. Amandla e-ESXi inginginya ebamba oomatshini abaninzi benyani isenokunganeli ukujongana nothotho lwemisebenzi efanayo eqhutywa ngokungagqibekanga. Ukusuka kwindawo yokujonga umnikezeli welifu, ingxaki enjalo inokukhokelela kwimithwalo eyongezelelweyo kwinani lemikhosi ye-ESXi, eya kuthi ekugqibeleni iholele ekwehleni kokusebenza kwesiseko sesiseko selifu. Oku kunokuthi, phakathi kwezinye izinto, kuchaphazele ukusebenza koomatshini benyani babanye abathengi bamafu. Imeko efanayo inokuvela xa kuqalwa ukuskena kobunzima: ukusetyenzwa ngaxeshanye yinkqubo yedisk yezicelo ezininzi ezifanayo kubasebenzisi abahlukeneyo kuya kuchaphazela kakubi ukusebenza kwelifu lonke. Ngeqondo eliphezulu lokunokwenzeka, ukuhla kwenkqubo yokugcina inkqubo kuya kubachaphazela bonke abathengi. Umthwalo onjalo ngokukhawuleza awukholisi nokuba umnikezeli okanye abathengi bakhe, njengoko bachaphazela "abamelwane" efini. Ukusuka kulo mbono, i-antivirus yendabuko inokubangela ingxaki enkulu.
Ukuvalelwa yedwa ngokukhuselekileyo. Ukuba ifayile okanye uxwebhu olunokuthi losulelwe yintsholongwane lubhaqwe kwisixokelelwano, luthunyelwa kwi-quarantine. Ewe, ifayile eyosulelekileyo inokucinywa kwangoko, kodwa oku kuhlala kungamkelekanga kwiinkampani ezininzi. Ii-antivirus zeshishini ezishishineyo ezingaqhelanga ukusebenza kwilifu lomboneleli, njengomthetho, zinendawo eqhelekileyo yokuvalelwa - zonke izinto ezosulelekileyo ziwela kuyo. Umzekelo, ezo zifunyenwe kwiikhompyuter zabasebenzisi benkampani. Abathengi bomboneleli wefu "bahlala" kumacandelo abo (okanye abaqashi). Ezi nxalenye zi-opaque kwaye zodwa: abathengi abazi malunga nomnye kwaye, ngokuqinisekileyo, ababoni ukuba abanye babamba ntoni efini. Ngokucacileyo, ukuvalelwa ngokubanzi, okuya kuthi kufikeleleke kubo bonke abasebenzisi be-antivirus efini, kunokubandakanya uxwebhu olunolwazi oluyimfihlo okanye imfihlo yorhwebo. Oku akwamkelekanga kumnikezeli kunye nabathengi bayo. Ke ngoko, kunokubakho isisombululo esinye kuphela - ukuvalelwa yedwa kumxhasi ngamnye kwicandelo lakhe, apho kungekho mnikezeli okanye abanye abathengi banokufikelela.
Iipolisi zokhuseleko lomntu ngamnye. Umxhasi ngamnye efini yinkampani eyahlukileyo, isebe le-IT libeka imigaqo-nkqubo yalo yokhuseleko. Umzekelo, abalawuli bachaza imigaqo yokuskena kunye neshedyuli yokuskena i-anti-virus. Ngokufanelekileyo, umbutho ngamnye kufuneka ube neziko lalo lokulawula ukuqwalasela imigaqo-nkqubo ye-antivirus. Kwangaxeshanye, izicwangciso ezikhankanyiweyo akufuneki zichaphazele abanye abathengi bamafu, kwaye umboneleli kufuneka akwazi ukuqinisekisa ukuba, umzekelo, uhlaziyo lwe-antivirus lwenziwa njengesiqhelo kubo bonke oomatshini benyani beklayenti.
Umbutho wamatyala kunye nelayisenisi. Imodeli yefu ibonakala ngokuguquguquka kwaye ibandakanya ukuhlawula kuphela inani lezibonelelo ze-IT ezisetyenziswe ngumthengi. Ukuba kukho imfuneko, umzekelo, ngenxa yexesha, ngoko isixa semithombo sinokunyuswa ngokukhawuleza okanye sincitshiswe - zonke zisekelwe kwiimfuno zangoku zamandla ekhompyutheni. I-antivirus yemveli ayiguquguquki kangako - njengomthetho, umxhasi uthenga ilayisenisi yonyaka ngenani elimiselweyo leeseva okanye iindawo zokusebenza. Abasebenzisi bamafu baqhawula rhoqo kwaye baqhagamshele oomatshini abongezelelweyo benyani ngokuxhomekeke kwiimfuno zabo zangoku - ngokufanelekileyo, iilayisensi ze-antivirus kufuneka zixhase imodeli efanayo.
Umbuzo wesibini ngowokuba ingaba iphepha-mvume liza kujongana ngantoni. I-antivirus yesiNtu inelayisensi ngenani leeseva okanye iindawo zokusebenza. Iilayisensi ezisekelwe kwinani loomatshini abakhuselweyo abakhuselweyo abafanelekanga ngokupheleleyo ngaphakathi kwimodeli yelifu. Umxhasi unokudala naliphi na inani loomatshini abalungeleyo kuye kwizibonelelo ezikhoyo, umzekelo, oomatshini abahlanu okanye abalishumi. Eli nani alitshintshi kubathengi abaninzi, akunakwenzeka ukuba thina, njengomboneleli, silandele utshintsho lwalo. Akukho buchule obunokwenzeka bokufumana ilayisenisi yi-CPU: abathengi bafumana iiprosesa ezibonakalayo (vCPUs), ekufuneka zisetyenziselwe ilayisensi. Ngaloo ndlela, imodeli entsha yokukhusela i-anti-virus kufuneka ibandakanye ukukwazi umthengi ukumisela inani elifunekayo le-vCPU apho aya kufumana iilayisensi zokulwa nentsholongwane.
Ukuthotyelwa komthetho. Ingongoma ebalulekileyo, ekubeni izisombululo ezisetyenzisiweyo kufuneka ziqinisekise ukuthotyelwa kweemfuno zomlawuli. Ngokomzekelo, "abahlali" belifu bahlala besebenza ngedatha yomntu. Kule meko, umboneleli kufuneka abe necandelo elihlukeneyo lelifu eliqinisekisiweyo elihambelana ngokupheleleyo neemfuno zoMthetho weDatha yoMntu. Emva koko iinkampani azidingi "ukwakha" ngokuzimeleyo yonke inkqubo yokusebenza neenkcukacha zomntu: uthenge izixhobo eziqinisekisiweyo, udibanise kwaye ulungiselele, kwaye ufumane isatifikethi. Ukukhusela i-cyber ye-ISPD yabathengi abanjalo, i-antivirus kufuneka ihambelane neemfuno zomthetho waseRashiya kwaye ibe nesatifikethi se-FSTEC.
Sijonge kwiikhrayitheriya ezinyanzelekileyo ukuba ukhuseleko lwe-antivirus kwilifu loluntu kufuneka luhlangabezane. Okulandelayo, siya kwabelana ngamava ethu ekuhlengahlengiseni isisombululo se-antivirus ukuze sisebenze kwilifu lomboneleli.
Unokwenza njani ubuhlobo phakathi kwe-antivirus kunye nelifu?
Njengoko amava ethu ebonisile, ukukhetha isisombululo esisekelwe kwinkcazo kunye namaxwebhu yinto enye, kodwa ukuyiphumeza ngokusebenza kwindawo esele isebenza kwifu ngumsebenzi ohluke ngokupheleleyo ngokubhekiselele kubunzima. Siza kukuxelela into esiyenzileyo xa sisebenza kunye nendlela esiyilungelelanise i-antivirus ukuba isebenze kwilifu likawonke-wonke lomboneleli. Umthengisi wesisombululo se-anti-virus yayinguKaspersky, iphothifoliyo yakhe ibandakanya izisombululo zokukhusela iintsholongwane kwiindawo zefu. Sahlala kwi "Kaspersky Security for Virtualization" (Agent Light).
Ibandakanya ikhonsoli enye yeKaspersky Security Centre. I-arhente yokukhanya kunye nokhuseleko koomatshini benyani (i-SVM, uKhuseleko lwe-Virtual Machine) kunye nomncedisi wokudibanisa we-KSC.
Emva kokuba sifunde ukwakhiwa kwesisombululo seKaspersky kwaye senza iimvavanyo zokuqala kunye neenjineli zabathengisi, kwavela umbuzo malunga nokudibanisa inkonzo efini. Ukuphunyezwa kokuqala kuqhutywe ngokubambisana kwindawo yefu yaseMoscow. Kwaye yiloo nto esiyibonileyo.
Ukuze kuncitshiswe itrafikhi yomnatha, kwagqitywa ukuba kubekwe i-SVM kwinginginya nganye ye-ESXi kwaye "ibophe" i-SVM kwinginginya ze-ESXi. Kulo mzekelo, ii-arhente ezikhanyayo zoomatshini abakhuselweyo abakhuselweyo bafikelela kwi-SVM yenginginya ye-ESXi ngqo abaqhuba kuyo. Umqeshi ozimeleyo wolawulo wakhethwa kwi-KSC engundoqo. Ngenxa yoko, ii-KSC ezingaphantsi zibekwe kubaqeshi bomthengi ngamnye kwaye zijongana ne-KSC ephezulu ebekwe kwicandelo lolawulo. Esi sikimu sikuvumela ukuba uzisombulule ngokukhawuleza iingxaki ezivela kubaqeshi babathengi.
Ukongeza kwimiba ngokuphakamisa amacandelo esisombululo se-anti-virus ngokwayo, sasijongene nomsebenzi wokuququzelela intsebenziswano yenethiwekhi ngokudala ii-VxLAN ezongezelelweyo. Kwaye nangona isisombululo ekuqaleni sasijoliswe kubathengi bezoshishino ngamafu abucala, ngoncedo lobunjineli be-savvy kunye nokuguquguquka kwezobuchwepheshe be-NSX Edge sakwazi ukucombulula zonke iingxaki ezinxulumene nokuhlukana kwabaqeshi kunye nelayisenisi.
Sisebenze ngokusondeleyo neenjineli zeKaspersky. Ngaloo ndlela, kwinkqubo yokuhlalutya i-architecture yesisombululo ngokubhekiselele kwintsebenziswano yenethiwekhi phakathi kwamacandelo enkqubo, kwafunyaniswa ukuba, ngaphezu kokufikelela kwii-agent zokukhanya ukuya kwi-SVM, impendulo nayo iyimfuneko - ukusuka kwi-SVM ukuya kwii-agent zokukhanya. Olu qhagamshelo lwenethiwekhi alunakwenzeka kwindawo ehlala abantu abaninzi ngenxa yokuba nokwenzeka kothungelwano olufanayo lwesetingi zoomatshini bokwenene kubaqeshi bamafu ahlukeneyo. Ngoko ke, ngesicelo sethu, oogxa bethu abasuka kumthengisi baphinde baphinda basebenzise indlela yokunxibelelana kwenethiwekhi phakathi kwe-arhente yokukhanya kunye ne-SVM malunga nokuphelisa isidingo sokunxibelelana kwenethiwekhi ukusuka kwi-SVM ukuya kwii-agent zokukhanya.
Emva kokuba isisombululo sisetyenzisiwe kwaye sivavanywe kwindawo yefu yaseMoscow, sayiphindaphinda kwezinye iindawo, kubandakanywa necandelo lefu eliqinisekisiweyo. Inkonzo ngoku ifumaneka kuzo zonke iingingqi zelizwe.
Uyilo lwesisombululo sokhuseleko lolwazi ngaphakathi kwesakhelo sendlela entsha
Iskimu esiqhelekileyo sokusebenza kwesisombululo se-antivirus kwindawo yelifu likawonkewonke simi ngolu hlobo lulandelayo:
Iskimu sokusebenza kwesisombululo se-antivirus kwindawo yelifu yoluntu #CloudMTS
Makhe sichaze iimpawu zokusebenza kwezinto ezizimeleyo zesisombululo kwilifu:
β’ Ikhonsoli enye evumela abathengi ukuba balawule inkqubo yokhuselo: qhuba iskena, lawula uhlaziyo kwaye ubeke iliso kwiindawo zokuvalelwa. Kuyenzeka ukuba uqwalasele imigaqo-nkqubo yokhuseleko lomntu ngaphakathi kwecandelo lakho.
Kufuneka kuqatshelwe ukuba nangona singumboneleli wenkonzo, asiphazamisi izicwangciso ezibekwe ngabaxhasi. Inye kuphela into esinokuyenza kukusetha kwakhona imigaqo-nkqubo yokhuseleko kwimigangatho eqhelekileyo ukuba uqwalaselo ngokutsha luyimfuneko. Umzekelo, oku kunokuba yimfuneko ukuba umxhasi ubaqinise ngempazamo okanye ababuthathaka kakhulu. Inkampani inokuhlala ifumana iziko lolawulo elinemigaqo-nkqubo engagqibekanga, enokuthi emva koko iqwalasele ngokuzimeleyo. Ububi beZiko loKhuseleko leKaspersky kukuba iqonga lifumaneka kuphela kwinkqubo yokusebenza yeMicrosoft. Nangona iiarhente ezikhaphukhaphu zinokusebenza ngazo zombini iiWindows kunye noomatshini beLinux. Nangona kunjalo, iKaspersky Lab ithembisa ukuba kungekudala iKSC iya kusebenza phantsi kweLinux OS. Omnye wemisebenzi ebalulekileyo ye-KSC kukukwazi ukulawula ukuvalelwa. Inkampani nganye yabathengi kwilifu lethu inomntu. Le ndlela iphelisa iimeko apho uxwebhu olosulelwe yintsholongwane ngempazamo luye lubonakale esidlangalaleni, njengoko kunokwenzeka kwimeko ye-antivirus yenkampani yakudala ene-quarantine jikelele.
β’ Iiarhente ezithambileyo. Njengenxalenye yemodeli entsha, i-agent ye-Kaspersky Security ekhaphukhaphu ifakwe kumatshini ngamnye obonakalayo. Oku kuphelisa isidingo sokugcina i-database ye-anti-virus kwi-VM nganye, enciphisa inani lediski elifunekayo. Inkonzo idityaniswe nesiseko selifu kwaye isebenza nge-SVM, eyandisa ukuxinana koomatshini benyani kwi-ESXi host kunye nokusebenza kwenkqubo yefu yonke. I-arhente yokukhanya yakha umgca wemisebenzi kumatshini ngamnye wenyani: khangela inkqubo yefayile, imemori, njl. Kodwa i-SVM inoxanduva lokwenza le misebenzi, esiza kuthetha ngayo kamva. I-ejenti iphinda isebenze njenge-firewall, ilawula imigaqo-nkqubo yokhuseleko, ithumela iifayile ezithintekayo ukuba zivalelwe kwaye zibeke iliso "impilo" yonke yenkqubo yokusebenza efakwe kuyo. Konke oku kunokulawulwa kusetyenziswa ikhonsoli enye esele ikhankanyiwe.
β’ Ukhuseleko loMatshini weVirtual. Yonke imisebenzi enzima yobutyebi (uhlaziyo lwedathabheyisi ye-anti-virus, izikena ezicwangcisiweyo) ziphathwa ngoomatshini abahlukeneyo boKhuseleko lweVirtual (SVM). Unoxanduva lokusebenza kwe-injini yokulwa nentsholongwane epheleleyo kunye nedathabheyisi yayo. Isiseko se-IT senkampani sinokubandakanya ii-SVM ezininzi. Le ndlela yokwandisa ukuthembeka kwenkqubo - ukuba umatshini omnye uyasilela kwaye akaphenduli imizuzwana engamashumi amathathu, ii-agent ziqala ngokuzenzekelayo ukukhangela enye.
β’ Iseva yodibaniso lwe-KSC. Elinye lamacandelo e-KSC engundoqo, enika ii-SVM zayo kwii-arhente zokukhanya ngokuhambelana ne-algorithm echazwe kwizicwangciso zayo, kwaye ilawula ukufumaneka kwee-SVMs. Ke, le modyuli yesoftware ibonelela ngomthwalo wokulinganisa kuzo zonke ii-SVM zesiseko selifu.
I-algorithm yokusebenza efini: ukunciphisa umthwalo kwisiseko
Ngokubanzi, i-algorithm ye-antivirus inokumelwa ngolu hlobo lulandelayo. Ummeli ufikelela kwifayile kumatshini wenyani kwaye ayijonge. Isiphumo sokuqinisekiswa sigcinwe kwisiseko sedatha ye-SVM yesigwebo esiqhelekileyo (esibizwa ngokuba yi-Shared Cache), ingeniso nganye echonga isampuli yefayile ekhethekileyo. Le ndlela ikuvumela ukuba uqinisekise ukuba ifayile enye ayiskenwanga amaxesha amaninzi ngokulandelelana (umzekelo, ukuba yayivulwe koomatshini abahlukeneyo). Ifayile iskena kwakhona kuphela ukuba utshintsho lwenziwe kuyo okanye iskena siqaliswe ngesandla.
Ukuphunyezwa kwesisombululo se-antivirus kwilifu lomboneleli
Umfanekiso ubonisa umzobo oqhelekileyo wokuphunyezwa kwesisombululo efini. Iziko loKhuseleko lweKaspersky oluphambili lubekwe kwindawo yolawulo yelifu, kwaye i-SVM nganye ibekwe kwinginginya nganye ye-ESXi isebenzisa iseva yohlanganiso ye-KSC (inginginya nganye ye-ESXi ine-SVM yayo edityaniswe nezicwangciso ezikhethekileyo kwi-VMware vCenter Server). Abathengi basebenza kumacandelo abo elifu, apho kukho oomatshini bokwenene abanee-arhente. Zilawulwa ngeeseva ze-KSC eziphantsi kwe-KSC engundoqo. Ukuba kuyimfuneko ukukhusela inani elincinci loomatshini benyani (ukuya kwi-5), umxhasi unokubonelelwa ngokufikelela kwi-console yenyani ye-server ye-KSC ekhethekileyo. Intsebenziswano yothungelwano phakathi kwee-KSC zabaxhasi kunye ne-KSC engundoqo, kunye nee-arhente zokukhanya kunye nee-SVMs, zenziwa kusetyenziswa i-NAT ngokusebenzisa i-EdgeGW i-router yomxhasi wenyani.
Ngokoqikelelo lwethu kunye neziphumo zovavanyo lwabalingane kumthengisi, i-Agent yokukhanya inciphisa umthwalo kwiziseko ezingundoqo zabathengi malunga ne-25% (xa kuthelekiswa nenkqubo esebenzisa i-software ye-anti-virus yendabuko). Ngokukodwa, i-antivirus esemgangathweni ye-Kaspersky Endpoint Security (KES) yendawo ebonakalayo idla phantse kabini ixesha le-CPU yeseva (2,95%) njengesisombululo esisekelwe kwi-agent-based virtualization (1,67%).
Itshathi yothelekiso lomthwalo weCPU
Imeko efanayo ibonwa ngokuphindaphindiweyo kwe-disk ukubhala ukufikelela: kwi-antivirus ye-classic yi-1011 IOPS, i-antivirus yefu yi-671 IOPS.
Igrafu yokuthelekisa izinga lokufikelela kwidisk
Inzuzo yokusebenza ikuvumela ukuba ugcine uzinzo lweziseko zophuhliso kwaye usebenzise amandla ekhompyuter ngokufanelekileyo. Ngokulungelelanisa ukusebenza kwindawo yelifu likawonkewonke, isisombululo asinciphisi ukusebenza kwefu: sijonga phakathi iifayile kunye nokukhuphela ukuhlaziywa, ukusabalalisa umthwalo. Oku kuthetha ukuba, kwelinye icala, izoyikiso ezihambelana nesiseko selifu aziyi kuphoswa, ngakolunye uhlangothi, iimfuno zezibonelelo zoomatshini benyani ziya kuncitshiswa ngomyinge we-25% xa kuthelekiswa ne-antivirus yendabuko.
Ngokumalunga nokusebenza, zombini izisombululo zifana kakhulu omnye komnye: ngezantsi itafile yokuthelekisa. Nangona kunjalo, kwilifu, njengoko iziphumo zovavanyo zingasentla zibonisa, kuselungile ukusebenzisa isisombululo seendawo ezibonakalayo.
Malunga neerhafu ngaphakathi kwesakhelo sendlela entsha. Sigqibe ekubeni sisebenzise imodeli evumela ukuba sifumane iilayisensi ngokusekelwe kwinani le-vCPU. Oku kuthetha ukuba inani leelayisenisi liyakulingana nenani lee-vCPU. Unokuvavanya i-antivirus yakho ngokushiya isicelo .
Kwinqaku elilandelayo kwizihloko zamafu, siza kuthetha malunga nokuvela kwamafu e-WAFs kwaye yintoni engcono ukukhetha: i-hardware, isofthiwe okanye ifu.
Umbhalo ulungiswe ngabasebenzi bomboneleli wefu #CloudMTS: UDenis Myagkov, umyili okhokelayo kunye no-Alexey Afanasyev, umphathi wophuhliso lokhuseleko lolwazi.
umthombo: www.habr.com