Khawube nomfanekiso-ngqondweni wale meko. Intsasa ebandayo ka-Oktobha, iziko loyilo kwiziko lengingqi lomnye wemimandla yaseRashiya. Umntu osuka kwisebe le-HR uya kwelinye lamaphepha ezithuba kwiwebhusayithi yeli ziko, athunyelwe kwiintsuku ezimbalwa ezidlulileyo, kwaye wabona ifoto yekati apho. Intsasa iyeka ukukruqula...
Kweli nqaku, uPavel Suprunyuk, intloko yobuchwephesha yophicotho-zincwadi kunye nesebe lokubonisana kwiQela-IB, uthetha ngendawo yokuhlaselwa kwe-sociotechnical kwiiprojekthi ezivavanya ukhuseleko olusebenzayo, zeziphi iindlela ezingaqhelekanga ezinokuthatha, kunye nendlela yokukhusela ukuhlaselwa okunjalo. Umbhali ucacisa ukuba inqaku liyimeko yokuhlaziya, nangona kunjalo, ukuba kukho nawuphi na umba onomdla kubafundi, iingcali zeQela-IB ziya kuphendula ngokukhawuleza imibuzo kwizimvo.
Icandelo 1. Kutheni inzulu kangaka?
Masibuyele kwikati yethu. Emva kwexesha elithile, isebe le-HR liyayicima ifoto (imifanekiso eqingqiweyo apha nangezantsi iphinde yacocwa ngokuyinxenye ukuze ingavezi amagama okwenene), kodwa ibuyisela ngenkani, iphinde icinywe, kwaye oku kwenzeka izihlandlo ezininzi. Isebe le-HR liyaqonda ukuba ikati ineenjongo ezinzulu kakhulu, ayifuni ukuhamba, kwaye icela uncedo kumdwelisi wewebhu - umntu owenze isayithi kwaye uyayiqonda, kwaye ngoku uyayilawula. Umdwebi wenkqubo uya kwindawo, kwakhona ukucima ikati ekruqulayo, ufumanisa ukuba ithunyelwe egameni lesebe le-HR ngokwayo, emva koko yenza ukucinga ukuba igama eliyimfihlo lesebe le-HR liye lavuza kwezinye ii-hooligans ze-intanethi, kwaye ziyayitshintsha. Ikati ayibonakali kwakhona.
Kwenzeka ntoni kanye kanye? Ngokunxulumene neqela leenkampani ezibandakanya iziko, iingcali zeQela-IB zenze uvavanyo lokungena kwifomathi ekufutshane neRed Teaming (ngamanye amazwi, oku kukuxelisa uhlaselo olujoliswe kuyo kwinkampani yakho usebenzisa ezona ndlela ziphezulu kunye nezixhobo ezivela kwi-Red Teaming. arsenal yamaqela hacker). Sathetha ngokweenkcukacha malunga ne-Red Teaming . Kubalulekile ukwazi ukuba xa uqhuba uvavanyo olunjalo, uluhlu olubanzi kakhulu lokuhlaselwa kwangaphambili lunokusetyenziswa, kubandakanywa nobunjineli bezentlalo. Kucacile ukuba ukubekwa kwekati ngokwayo kwakungeyona njongo yokugqibela yento eyenzekayo. Kwaye kwakukho oku kulandelayo:
- Iwebhusayithi yeziko yasingathwa kwiseva ngaphakathi kuthungelwano lweziko ngokwalo, kwaye hayi kwiiseva zomntu wesithathu;
- Ukuvuza kwi-akhawunti yesebe le-HR kufunyenwe (ifayile ye-imeyile yelog yingcambu yesayithi). Kwakungenakwenzeka ukulawula isayithi ngale akhawunti, kodwa kwakunokwenzeka ukuhlela amaphepha emisebenzi;
- Ngokutshintsha amaphepha, ungabeka izikripthi zakho kwiJavaScript. Ngokuqhelekileyo benza amaphepha asebenzisanayo, kodwa kule meko, izikripthi ezifanayo zinokuba kwisikhangeli sondwendwe oko kwahlula isebe le-HR kumdwelisi weprogram, kunye nomdwelisi weprogram kwindwendwe elula - isazisi seseshoni kwisayithi. Ikati yayiyi-trigger yokuhlaselwa kunye nomfanekiso wokutsala umdla. Kwiwebhusayithi ye-HTML yolwimi lokumakisha, kubonakala ngathi: ukuba umfanekiso wakho ulayishiwe, iJavaScript sele yenziwe kwaye i-ID yakho yeseshoni, kunye nedatha malunga nesiphequluli sakho kunye nedilesi ye-IP, sele ibiwe.
- Nge-ID yeseshoni yomlawuli obiweyo, kuya kwenzeka ukuba ufumane ufikelelo olupheleleyo kwindawo, ukusingatha amaphepha aphunyeziweyo kwi-PHP, kwaye ngoko ke ufumane ukufikelela kwinkqubo yokusebenza ye-server, kwaye emva koko kwinethiwekhi yendawo ngokwayo, eyayiyinjongo ebalulekileyo ephakathi. iprojekthi.
Uhlaselo luphumelele ngokuyinxenye: i-ID yeseshoni yomlawuli yabiwa, kodwa yayibotshelelwe kwidilesi ye-IP. Asikwazanga ukuyijikeleza le nto; asikwazanga ukuphakamisa amalungelo ethu esayithi kumalungelo olawulo, kodwa siye sayiphucula imeko yethu. Isiphumo sokugqibela safunyanwa ekugqibeleni kwelinye icandelo le-perimeter yenethiwekhi.
Icandelo 2. Ndikubhalela - yintoni enye? Ndiphinde ndifowune ndimane ndihlala apha eofisini yakho, ndiwisa iiflash drives.
Okwenzekileyo kwimeko yekati ngumzekelo wobunjineli bezentlalo, nangona kungekhona iklasikhi. Enyanisweni, kwakukho iziganeko ezininzi kweli bali: kwakukho ikati, kunye neziko, kunye nesebe labasebenzi, kunye nomdwebi wenkqubo, kodwa kwakukho nee-imeyile ezinemibuzo ecacisayo ekucingelwa ukuba "abaviwa" babhalela isebe labasebenzi ngokwabo kunye nobuqu. kumdwelisi wenkqubo ukuze ubaxhokonxe ukuba baye kwiphepha lesiza.
Ukuthetha ngeeleta. I-imeyile eqhelekileyo, mhlawumbi isithuthi esiphambili sokwenza ubunjineli bezentlalo, ayilahlekanga ukubaluleka kwayo amashumi eminyaka kwaye ngamanye amaxesha ikhokelela kwiziphumo ezingaqhelekanga.
Sidla ngokubalisa eli bali lilandelayo kwiziganeko zethu, njengoko lityhila kakhulu.
Ngokuqhelekileyo, ngokusekelwe kwiziphumo zeeprojekthi zobunjineli bezentlalo, siqulunqa izibalo, njengoko siyazi, ziyinto eyomileyo kwaye enesithukuthezi. Iipesenti ezininzi zabamkeli bavule isincamatheliso kwileta, abaninzi balandela ikhonkco, kodwa aba bathathu bafake igama labo lomsebenzisi kunye negama lokugqitha. Kwiprojekthi enye, sifumene ngaphezu kwe-100% yamagama ayimfihlo afakiweyo - oko kukuthi, ngaphezulu kwaphuma kunokuba sikuthumele.
Yenzeka ngolu hlobo: kwathunyelwa ileta yokurhwaphiliza, ekucingelwa ukuba ivela kwi-CISO yequmrhu likarhulumente, ifuna "ukuvavanya ngokukhawuleza utshintsho kwinkonzo yeposi." Le leta yafikelela kwintloko yesebe elikhulu elijongene nenkxaso yobugcisa. Umphathi wayekhuthele kakhulu ekuphumezeni imiyalelo evela kumagunya aphezulu yaye wayidlulisela kubo bonke abangaphantsi kwabo. Iziko lonxibelelwano ngokwalo liye lajika lalikhulu kakhulu. Ngokubanzi, iimeko apho umntu athumele phambili ii-imeyile βezinika umdlaβ zokukhohlisa koogxa bakhe kwaye nabo babhaqwe yinto eqhelekileyo. Kithina, le yeyona ngxelo ilungileyo kumgangatho wokubhala ileta.
Kamva bafumanisa ngathi (ileta yathathwa kwibhokisi yeposi elalanisayo):
Impumelelo yolu hlaselo yabangelwa kukuba ukuthunyelwa kweposi kuxhaphaze inani lokusilela kobugcisa kwinkqubo yeposi yomthengi. Yacwangciswa ngendlela yokuba kube nokwenzeka ukuthumela naziphi na iileta egameni lakhe nawuphi na umthumeli wombutho ngokwawo ngaphandle kogunyaziso, nakwi-Intanethi. Oko kukuthi, unokuzenza i-CISO, okanye intloko yenkxaso yobugcisa, okanye omnye umntu. Ngaphezu koko, i-mail interface, ukujonga iileta ezivela kwi-domain "yayo", ifake ngononophelo ifoto evela kwincwadi yeedilesi, eyongeza indalo kumthumeli.
Enyanisweni, uhlaselo olunjalo asiyoteknoloji intsonkothileyo; lusetyenziso oluyimpumelelo lwesiphene esisisiseko kwiisetingi zeposi. Ihlaziywa rhoqo kwi-IT ekhethekileyo kunye nezixhobo zokhuseleko lolwazi, kodwa nangona kunjalo, kusekho iinkampani ezinakho konke oku. Ekubeni kungekho mntu utyekele ekujongeni ngokucokisekileyo iiheader zenkonzo ye-SMTP mail protocol, ileta idla ngokujongiwa βingoziβ kusetyenziswa ii-iyikhoni zesilumkiso kujongano lweposi, ezingasoloko zibonisa umfanekiso uphela.
Okubangela umdla kukuba, ubuthathaka obufanayo bukwasebenza kwelinye icala: umhlaseli angathumela i-imeyile egameni lenkampani yakho kumamkeli weqela lesithathu. Umzekelo, unokuxoka kwi-invoyisi yentlawulo eqhelekileyo egameni lakho, ebonisa ezinye iinkcukacha endaweni yeyakho. Ngaphandle kwemiba echasene nobuqhophololo kunye nokuphuma kwemali, le yeyona ndlela ilula yokuba imali ngobunjineli bezentlalo.
Ukongeza ekubiweni kwamagama ayimfihlo ngokusebenzisa i-phishing, uhlaselo lwakudala lwentlalontle luthumela izincamatheliso ezinokufezekiswa. Ukuba olu tyalo-mali loyisa onke amanyathelo okhuseleko, apho iinkampani zanamhlanje zihlala zineninzi, umjelo wokufikelela kude uya kwenziwa kwikhompyuter yexhoba. Ukubonisa iziphumo zohlaselo, ulawulo olukude olunesiphumo lunokuphuhliswa ukufikelela kulwazi oluyimfihlo olubalulekileyo. Kuyaphawuleka ukuba uninzi lohlaselo olusetyenziswa ngamajelo eendaba ukoyikisa wonke umntu luqala kanye ngolu hlobo.
Kwisebe lethu lophicotho-zincwadi, ukonwabela, sibala iinkcukacha-manani eziqikelelwayo: lithini ixabiso lilonke lee-asethi zeenkampani esiye safumana kuzo ufikelelo kuMlawuli weDomain, ikakhulu ngobuqhetseba kunye nokuthumela okuncamatheleyo okusebenzayo? Kulo nyaka ifikelele malunga ne-150 yeebhiliyoni zee-euro.
Kucacile ukuba ukuthumela ii-imeyile ezivuselelayo kunye nokuthumela iifoto zeekati kwiiwebhusayithi akuzona kuphela iindlela zobunjineli bezentlalo. Kule mizekelo sizame ukubonisa iindidi zeendlela zokuhlasela kunye neziphumo zazo. Ukongeza kwiileta, umhlaseli onokuthi afowunele ukufumana ulwazi oluyimfuneko, ukusasaza imidiya (umzekelo, ii-flash drives) kunye neefayile eziphunyeziweyo kwiofisi yenkampani ekujoliswe kuyo, ukufumana umsebenzi njengomfundi, ukufumana ukufikelela ngokomzimba kwinethiwekhi yendawo. phantsi komfanekiso wesifakeli sekhamera yeCCTV. Zonke ezi, ngendlela, ziyimizekelo kwiiprojekthi zethu ezigqitywe ngempumelelo.
Icandelo 3. Imfundiso ikukukhanya, kanti abangenakwazi bona bubumnyama
Umbuzo onengqiqo uvela: kulungile, kulungile, kukho ubunjineli bezentlalo, kubonakala kuyingozi, kodwa iinkampani kufuneka zenze ntoni ngayo yonke le nto? UCaptain Obvious uza kuhlangula: kufuneka uzikhusele, kwaye ngendlela ebanzi. Inxalenye ethile yokhuseleko iya kujoliswa kumanyathelo okhuseleko asele ekudala, njengeendlela zobugcisa zokhuseleko lolwazi, ukubeka iliso, umbutho kunye nenkxaso yezomthetho yeenkqubo, kodwa eyona nxalenye iphambili, ngokoluvo lwethu, kufuneka iqondiswe ekusebenzeni ngqo nabasebenzi njengabasebenzi. ikhonkco elibuthathaka. Emva kwakho konke, kungakhathaliseki ukuba uqinisa kangakanani iteknoloji okanye ubhala imimiselo enzima, kuya kuhlala kukho umsebenzisi oza kufumanisa indlela entsha yokuphula yonke into. Ngaphezu koko, akukho migaqo okanye iteknoloji iya kugcina i-flight yobuchule bomsebenzisi, ngakumbi ukuba ukhuthazwa ngumhlaseli ofanelekileyo.
Okokuqala, kubalulekile ukuqeqesha umsebenzisi: chaza ukuba nakwimisebenzi yakhe yesiqhelo, iimeko ezinxulumene nobunjineli bezentlalo zinokuvela. Kubathengi bethu sihlala siqhuba kwi-digital hygiene - isiganeko esifundisa izakhono ezisisiseko ukulwa nokuhlaselwa ngokubanzi.
Ndingongeza ukuba elinye lawona manyathelo okhuseleko angcono ayizukuba kukucengceleza imithetho yokhuseleko lolwazi konke konke, kodwa kukuvavanya imeko ngendlela evaleleke kancinci:
- Ngubani umthetheleli wam?
- Sivela phi isiphakamiso okanye isicelo sakhe (oku akuzange kwenzeke ngaphambili, kwaye ngoku sele kubonakala)?
- Yintoni engaqhelekanga kwesi sicelo?
Kwanohlobo olungaqhelekanga lwefonti yoonobumba okanye isimbo sokuthetha esingaqhelekanga kumthumeli sinokubangela ukuba kubekho ityathanga lamathandabuzo eliya kuphelisa uhlaselo. Imiyalelo emiselweyo nayo iyafuneka, kodwa isebenza ngokwahlukileyo kwaye ayinakucacisa zonke iimeko ezinokwenzeka. Umzekelo, abalawuli bokhuseleko lolwazi babhala kubo ukuba awukwazi ukufaka igama eliyimfihlo kwimithombo yomntu wesithathu. Kuthekani ukuba "eyakho", "yeshishini" isixhobo sothungelwano sicela igama eliyimfihlo? Umsebenzisi ucinga: "Inkampani yethu sele ineenkonzo ezilishumi elinambini ezineakhawunti enye, kutheni ungenayo enye?" Oku kukhokelela komnye umgaqo: inkqubo yomsebenzi owenziwe kakuhle ichaphazela ngokuthe ngqo ukhuseleko: ukuba isebe elingummelwane lingacela ulwazi kuwe kuphela ngokubhaliweyo kwaye kuphela ngomphathi wakho, umntu "ovela kwiqabane elithembekileyo lenkampani" ngokuqinisekileyo akayi kuba. ukukwazi ukuyicela ngefowuni - oku kuwe kuya kuba bubudenge. Kuya kufuneka ulumke ngakumbi ukuba umntu odibana naye ufuna ukwenza yonke into ngoku, okanye "ASAP", njengoko kusefashonini ukubhala. Kwanasemsebenzini oqhelekileyo, le meko kaninzi ayinampilo, kwaye xa ujongene nokuhlaselwa okunokwenzeka, kuyimbangela enamandla. Akukho xesha lokuchaza, sebenzisa ifayile yam!
Siqaphela ukuba abasebenzisi basoloko bejolise kubo njengeentsomi zohlaselo lwentlalo-ntle ngezihloko ezinxulumene nemali ngendlela enye okanye enye: izithembiso zokunyuselwa, izinto ezikhethwayo, izipho, kunye nolwazi olunokuthiwa yintlebendwane yasekhaya kunye nobuqhetseba. Ngamanye amazwi, i-banal "izono ezibulalayo" ziyasebenza: ukunxanelwa inzuzo, ukubawa kunye nomdla ogqithiseleyo.
Uqeqesho olulungileyo kufuneka lusoloko lubandakanya ukuziqhelanisa. Apha kulapho iingcali zovavanyo lokungena zinokuza kunceda. Umbuzo olandelayo ngulo: yintoni kwaye siya kuvavanya njani? Thina kwiQela le-IB sicebisa le ndlela ilandelayo: ngoko nangoko khetha ugxininiso lovavanyo: mhlawumbi uvavanye ukulungela ukuhlaselwa kwabasebenzisi kuphela, okanye ujonge ukhuseleko lwenkampani iyonke. Kwaye uvavanye usebenzisa iindlela zobunjineli bezentlalo, ukulinganisa uhlaselo lokwenyani - oko kukuthi, i-phishing efanayo, ukuthumela amaxwebhu aphunyeziweyo, iifowuni kunye nobunye ubuchule.
Kwimeko yokuqala, uhlaselo lulungiselelwe ngokucophelela kunye nabameli bomthengi, ngokukodwa kunye ne-IT kunye neengcali zokhuseleko lolwazi. Iintsomi, izixhobo kunye neendlela zokuhlasela ziyahambelana. Umthengi ngokwakhe unikezela ngamaqela ekugxilwe kuwo kunye noluhlu lwabasebenzisi bokuhlaselwa, okubandakanya bonke abafowunelwa abayimfuneko. Okungafaniyo kudalwe kumanyathelo okhuseleko, ekubeni imiyalezo kunye nemithwalo ephunyezwayo kufuneka ifikelele kummkeli, kuba kwiprojekthi enjalo kuphela iimpendulo zabantu zinomdla. Ngokuzikhethela, unokubandakanya abamakishi kuhlaselo, apho umsebenzisi unokuqikelela ukuba luhlaselo - umzekelo, unokwenza iimpazamo ezimbalwa zopelo kwimiyalezo okanye ushiye ukungachaneki ekukopeni isitayile senkampani. Ekupheleni kweprojekthi, "izibalo ezomileyo" ezifanayo zifunyenwe: ngawaphi amaqela agxininisekileyo aphendule kwiimeko kunye nokuba kungakanani na.
Kwimeko yesibini, ukuhlaselwa kuqhutyelwa ngolwazi lokuqala lwe-zero, usebenzisa indlela "yebhokisi elimnyama". Siqokelela ngokuzimeleyo ulwazi malunga nenkampani, abasebenzi bayo, i-perimeter yenethiwekhi, senze iintsomi zokuhlasela, khetha iindlela, sijonge amanyathelo okhuseleko anokusetyenziswa kwinkampani ekujoliswe kuyo, izixhobo zokulungelelanisa, kunye nokudala iimeko. Iingcali zethu zisebenzisa zombini iindlela zobukrelekrele bomthombo ovulekileyo (OSINT) kunye nemveliso yeQela-IB - Intelligence yeTreat, inkqubo ethi, xa ilungiselela ukukhwabanisa, isebenze njenge-aggregator yolwazi malunga nenkampani ixesha elide, kuquka nolwazi oluhleliweyo. Ngokuqinisekileyo, ukwenzela ukuba ukuhlaselwa kungabi yinto emangalisayo, iinkcukacha zayo nazo zivunyelwene kunye nomthengi. Ijika ibe luvavanyo lokungena olupheleleyo, kodwa luya kusekelwa kubunjineli bentlalontle. Inketho enengqiqo kulo mzekelo kukuphuhlisa uhlaselo ngaphakathi kwenethiwekhi, ukufikelela ekufumaneni amalungelo aphezulu kwiinkqubo zangaphakathi. Ngendlela, ngendlela efanayo sisebenzisa uhlaselo lwe-sociotechnical kwi , kwaye kwezinye iimvavanyo zokungena. Ngenxa yoko, umthengi uya kufumana umbono ozimeleyo obanzi wokhuseleko lwabo ngokuchasene nohlobo oluthile lohlaselo lwe-sociotechnical, kunye nokubonakaliswa kokusebenza (okanye, ngokuchaseneyo, ukungasebenzi) komgca owenziweyo wokukhusela kwizoyikiso zangaphandle.
Sincoma ukuqhuba olu qeqesho ubuncinane kabini ngonyaka. Okokuqala, kuyo nayiphi na inkampani kukho utshintsho lwabasebenzi kwaye amava angaphambili ayalityalwa ngokuthe ngcembe ngabasebenzi. Okwesibini, iindlela kunye nobuchule bokuhlaselwa zihlala zitshintsha kwaye oku kukhokelela kwisidingo sokulungelelanisa iinkqubo zokhuseleko kunye nezixhobo zokukhusela.
Ukuba sithetha ngamanyathelo obugcisa okukhusela kuhlaselo, oku kulandelayo kunceda kakhulu:
- Ubukho bokunyanzeliswa kwezinto ezimbini kwiinkonzo ezipapashwe kwi-Intanethi. Ukukhupha ezo nkonzo ngo-2019 ngaphandle kwenkqubo yokuSayina olunye, ngaphandle kokhuseleko kumandla angenamsebenzi angenamsebenzi kwaye ngaphandle kobungqina bezinto ezimbini kwinkampani yamakhulu aliqela abantu kufana nomnxeba ovulekileyo othi "ndophule." Ukukhuselwa ngokufanelekileyo kuya kwenza ukusetyenziswa ngokukhawuleza kweephasiwedi ezibiweyo akunakwenzeka kwaye kuya kunika ixesha lokuphelisa imiphumo yokuhlaselwa kwe-phishing.
- Ukulawula ukufikelela kulawulo, ukunciphisa amalungelo omsebenzisi kwiinkqubo, kunye nokulandela izikhokelo zokucwangciswa kwemveliso ekhuselekileyo ekhutshwa ngumenzi omkhulu ngamnye. Ezi zihlala zilula ngokwendalo, kodwa zisebenza kakhulu kwaye zinzima ukuphumeza imilinganiselo, apho wonke umntu, ukuya kwinqanaba elithile okanye kwelinye, ayihoywa ngenxa yesantya. Kwaye ezinye ziyimfuneko kangangokuba ngaphandle kwazo akukho ndlela yokukhusela iya kusindisa.
- Umgca wokucoca we-imeyile owakhiwe kakuhle. I-Antispam, ukuskena okupheleleyo kwezinamathiselo kwikhowudi enobungozi, kubandakanywa novavanyo oluguqukayo ngeebhokisi zesanti. Uhlaselo olulungiselelwe kakuhle luthetha ukuba i-attachment ephunyeziweyo ayiyi kubonwa ngezixhobo ze-antivirus. Ibhokisi yesanti, ngokuchaseneyo, iya kuvavanya yonke into ngokwayo, isebenzisa iifayile ngendlela efanayo njengoko umntu ezisebenzisa. Ngenxa yoko, icandelo elinobungozi elinokwenzeka liya kutyhilwa ngotshintsho olwenziwe ngaphakathi kwebhokisi yesanti.
- Iindlela zokukhusela ekuhlaselweni okujoliswe kuzo. Njengoko sele kuphawuliwe, izixhobo ze-antivirus zakudala aziyi kubona iifayile ezinobungozi xa kuhlaselo olulungiselelwe kakuhle. Iimveliso eziphambili kakhulu kufuneka zibeke iliso ngokuzenzekelayo ukugcwala kweziganeko ezenzeka kwinethiwekhi - zombini kwinqanaba lomninimzi ngamnye kunye nakwizinga lokuhamba ngaphakathi kwenethiwekhi. Kwimeko yohlaselo, amatyathanga aneempawu ezibalaseleyo abonakala enokulandelelwa kwaye amiswe ukuba ubeke iliso eligxile kwiziganeko zolu hlobo.
Inqaku lokuqala kwimagazini "Ukhuseleko loLwazi / uKhuseleko loLwazi" #6, 2019.
umthombo: www.habr.com