Enkampanini yethu, njengakwezinye izinkampani eziningi ze-IT hhayi izinkampani ze-IT, ithuba lokufinyelela kude selivele likhona isikhathi eside, futhi abasebenzi abaningi balisebenzisa ngaphandle kwesidingo. Ngokusabalala kwe-COVID-19 emhlabeni, umnyango wethu we-IT, ngesinqumo sabaphathi benkampani, waqala ukudlulisa abasebenzi ababuya ohambweni lwaphesheya baye emsebenzini okude. Yebo, saqala ukuzijwayeza ukuzihlukanisa ekhaya kusukela ekuqaleni kukaMashi, nangaphambi kokuba kube okujwayelekile. Maphakathi noMashi, isixazululo sase silinganiswe kuyo yonke inkampani, futhi ekupheleni kukaMashi sonke sacishe sashintshela kumodi entsha yomsebenzi okude wawo wonke umuntu.
Ngobuchwepheshe, ukuze sisebenzise ukufinyelela okukude kunethiwekhi, sisebenzisa i-Microsoft VPN (RRAS) - njengenye yezindima ze-Windows Server. Lapho uxhuma kunethiwekhi, izinsiza ezihlukahlukene zangaphakathi ziyatholakala kusukela kuma-sharepoints, izinsiza zokwabelana ngamafayela, izilandeleli zeziphazamisi ohlelweni lwe-CRM; kwabaningi, yilokhu kuphela abakudingayo emsebenzini wabo. Kulabo abasenezindawo zokusebenza ehhovisi, ukufinyelela kwe-RDP kulungiselelwa ngesango le-RDG.
Kungani ukhethe lesi sinqumo noma kungani kufanele ukhethe? Ngoba uma usuvele unesizinda kanye nezinye izingqalasizinda ezivela kuMicrosoft, khona-ke impendulo isobala, cishe kuzoba lula, ngokushesha futhi kushibhile kumnyango wakho we-IT ukuze uyisebenzise. Udinga nje ukwengeza izici ezimbalwa. Futhi kuzoba lula kubasebenzi ukulungisa izingxenye ze-Windows kunokulanda nokulungisa amaklayenti okufinyelela engeziwe.
Lapho sifinyelela isango le-VPN ngokwalo nangemva kwalokho, lapho sixhuma ezindaweni zokusebenza nezinsiza ezibalulekile zewebhu, sisebenzisa ukuqinisekiswa kwezinto ezimbili. Ngempela, kungaba yinqaba uma thina, njengomkhiqizi wezixazululo zokuqinisekisa izinto ezimbili, singasebenzisi imikhiqizo yethu ngokwethu. Leli izinga lethu lebhizinisi; umsebenzi ngamunye unethokheni enesitifiketi somuntu siqu, esisetshenziselwa ukufakazela ubuqiniso endaweni yokusebenzela yasehhovisi esizindeni nasezinsizeni zangaphakathi zenkampani.
Ngokwezibalo, ngaphezu kwe-80% yezehlakalo zokuphepha kolwazi zisebenzisa amagama ayimfihlo abuthakathaka noma antshontshiwe. Ngakho-ke, ukwethulwa kokuqinisekiswa kwezinto ezimbili kukhulisa kakhulu izinga lokuphepha lenkampani kanye nezinsiza zayo, kukuvumela ukuthi unciphise ubungozi bokweba noma ukuqagela kwephasiwedi cishe ku-zero, futhi uqinisekise ukuthi ukuxhumana kwenzeka nomsebenzisi osebenzayo. Uma usebenzisa ingqalasizinda ye-PKI, ukufakazela ubuqiniso bephasiwedi kungakhutshazwa ngokuphelele.
Ngokubuka kwe-UI yomsebenzisi, lolu hlelo lulula kunokufaka igama lokungena nephasiwedi. Isizathu siwukuthi iphasiwedi eyinkimbinkimbi ayisadingi ukukhunjulwa, asikho isidingo sokufaka izitika ngaphansi kwekhibhodi (ukwephula zonke izinqubomgomo zokuphepha ongazicabanga), iphasiwedi ayidingi ngisho nokushintshwa kanye njalo ezinsukwini ezingu-90 (yize lokhu isikhathi eside kubhekwa njengento engcono kakhulu, kodwa ezindaweni eziningi kusaqhutshwa). Umsebenzisi uzodinga nje ukuza nekhodi ye-PIN engeyona inkimbinkimbi futhi angalahlekelwa ithokheni. Ithokheni ngokwayo ingenziwa ngendlela yekhadi elihlakaniphile, elingaphathwa kalula esikhwameni. Amathegi e-RFID angatshalwa kuthokheni nasekhadini elihlakaniphile ukuze ufinyelele ezakhiweni zehhovisi.
I-PIN khodi isetshenziselwa ukuqinisekiswa, ukunikeza ukufinyelela olwazini olubalulekile kanye nokwenza izinguquko ze-cryptographic nokuhlola. Ukulahlekelwa ithokheni akwesabisi, ngoba akunakwenzeka ukuqagela ikhodi ye-PIN; ngemva kwemizamo embalwa, izovinjelwa. Ngesikhathi esifanayo, i-smart card chip ivikela imininingwane ebalulekile ekukhishweni, ekuhlanganiseni nokunye ukuhlaselwa.
Yini enye?
Uma isixazululo senkinga yokufinyelela kude okusuka ku-Microsoft singafaneleki ngesizathu esithile, ungaqalisa ingqalasizinda ye-PKI futhi ulungise ukuqinisekiswa kwezinto ezimbili usebenzisa amakhadi ethu ahlakaniphile kwingqalasizinda ehlukahlukene ye-VDI (Citrix Virtual Apps and Desktops, Citrix ADC, VMware I-Horizon, i-VMware Unified Gateway, i-Huawei Fusion) nezinhlelo zokuphepha zehadiwe (PaloAlto, CheckPoint, Cisco) neminye imikhiqizo.
Ezinye zezibonelo kwaxoxwa ngazo ezihlokweni zethu ezedlule.
Esihlokweni esilandelayo sizokhuluma ngokusetha i-OpenVPN ngokufakazela ubuqiniso kusetshenziswa izitifiketi ezivela ku-MSCA.
Akusona isitifiketi esisodwa
Uma ukusebenzisa ingqalasizinda ye-PKI nokuthenga amadivaysi ehadiwe esisebenzi ngasinye kubukeka kuyinkimbinkimbi kakhulu noma, isibonelo, akukho nokwenzeka kobuchwepheshe bokuxhuma ikhadi elihlakaniphile, khona-ke kunesixazululo esinamaphasiwedi esikhathi esisodwa asekelwe kuseva yethu yokuqinisekisa ye-JAS. Njengokufakazela ubuqiniso, ungasebenzisa isofthiwe (Isiqinisekisi se-Google, i-Yandex Key), ihadiwe (noma iyiphi i-RFC ehambisanayo, isibonelo, i-JaCarta WebPass). Cishe zonke izixazululo ezifanayo zisekelwa njengamakhadi/amathokheni ahlakaniphile. Siphinde sakhuluma ngezinye izibonelo zokucushwa kokuthunyelwe kwethu kwangaphambilini.
Izindlela zokuqinisekisa zingahlanganiswa, okungukuthi, nge-OTP - isibonelo, abasebenzisi beselula kuphela abangavunyelwa ukungena, futhi amakhompyutha aphathekayo/amadeskithophu akudala angagunyazwa kusetshenziswa isitifiketi kuphela esithokheni.
Ngenxa yemvelo ethile yomsebenzi wami, abangani abaningi abangebona abezobuchwepheshe basanda kungithinta mathupha ukuze bathole usizo lokusetha ukufinyelela kude. Ngakho sakwazi ukubheka kancane ukuthi ubani owayephuma kulesi simo nokuthi kanjani. Kube nezimanga ezimnandi lapho izinkampani ezingezinkulu kakhulu zisebenzisa imikhiqizo edumile, okuhlanganisa nezixazululo zokuqinisekisa izinto ezimbili. Kwakukhona futhi amacala, okumangazayo ngakolunye uhlangothi, lapho izinkampani ezinkulu kakhulu futhi ezaziwayo (hhayi i-IT) zincoma ukuthi zifake i-TeamViewer kumakhompyutha azo asehhovisi.
Esimweni samanje, ochwepheshe benkampani "Aladdin R.D." batusa ukuthatha indlela enomthwalo wemfanelo ekuxazululeni izinkinga zokufinyelela ukude kungqalasizinda yakho yebhizinisi. Kulo mcimbi, ekuqaleni kombuso wokuzihlukanisa, sethule .
Source: www.habr.com