Abasebenzisi abaningi ngokwengeziwe baletha yonke ingqalasizinda yabo ye-IT efwini lomphakathi. Kodwa-ke, uma ukulawulwa kwe-anti-virus kunganele kwingqalasizinda yekhasimende, kuphakama izingozi ezinkulu ze-cyber. Ukuzijwayeza kubonisa ukuthi kufika ku-80% wamagciwane akhona aphila ngokuphelele endaweni ebonakalayo. Kulokhu okuthunyelwe sizokhuluma ngendlela yokuvikela izinsiza ze-IT efwini lomphakathi nokuthi kungani ama-antivirus endabuko engafaneleki ngokuphelele kulezi zinhloso.
Okokuqala, sizokutshela ukuthi sifike kanjani emcabangweni wokuthi amathuluzi ajwayelekile okuvikela amagciwane awafanele ifu lomphakathi nokuthi ziyadingeka ezinye izindlela zokuvikela izinsiza.
Okokuqala, abahlinzeki ngokuvamile bahlinzeka ngezinyathelo ezidingekayo zokuqinisekisa ukuthi amapulatifomu abo efu avikelekile ezingeni eliphezulu. Isibonelo, ku-#CloudMTS sihlaziya yonke ithrafikhi yenethiwekhi, siqaphe amalogi wezinhlelo zethu zokuphepha zamafu, futhi senza njalo amaphenethi. Amasegimenti wamafu anikezwe amaklayenti ngamanye kumele avikelwe ngokuphephile.
Okwesibili, inketho yakudala yokulwa nezingozi ze-cyber ihlanganisa ukufaka isivikeli magciwane kanye namathuluzi okulawula amagciwane emshinini ngamunye obonakalayo. Kodwa-ke, ngenani elikhulu lemishini ebonakalayo, lo mkhuba ungase ungasebenzi futhi udinge amanani abalulekile wezinsiza zekhompyutha, ngaleyo ndlela ulayishe ingqalasizinda yekhasimende futhi wehlise ukusebenza okuphelele kwefu. Lokhu sekuyisidingo esibalulekile sokufuna izindlela ezintsha zokwakha isivikelo esisebenzayo sokulwa namagciwane emishinini ebonakalayo yamakhasimende.
Ngaphezu kwalokho, izixazululo eziningi ze-antivirus emakethe azishintshwa ukuze kuxazululwe izinkinga zokuvikela izinsiza ze-IT endaweni yamafu yomphakathi. Njengomthetho, ziyizixazululo ze-EPP ezisindayo (Endpoint Protection Platforms), okuthi, ngaphezu kwalokho, zingahlinzeki ngokwezifiso ezidingekayo ohlangothini lweklayenti lomhlinzeki wamafu.
Kuba sobala ukuthi izixazululo ze-antivirus zendabuko azifanele ukusebenza efwini, ngoba zilayisha ngokujulile ingqalasizinda ebonakalayo ngesikhathi sokubuyekezwa nokuskena, futhi azinawo amazinga adingekayo okuphatha okusekelwe endimeni nezilungiselelo. Okulandelayo, sizohlaziya ngokuningiliziwe ukuthi kungani ifu lidinga izindlela ezintsha zokuvikela i-anti-virus.
Yini i-antivirus esefini lomphakathi okufanele ikwazi ukuyenza
Ngakho-ke, ake sinake imininingwane yokusebenza endaweni ebonakalayo:
Ukusebenza kahle kwezibuyekezo kanye nokuskena kwenqwaba okuhleliwe. Uma inombolo ebalulekile yemishini ebonakalayo esebenzisa isivikeli magciwane sendabuko iqala isibuyekezo ngesikhathi esifanayo, lokho okubizwa ngokuthi "isivunguvungu" sezibuyekezo kuzokwenzeka emafini. Amandla osokhaya we-ESXi esingethe imishini embalwa ebonakalayo angase anganeli ukuphatha inqwaba yemisebenzi efanayo esebenza ngokuzenzakalelayo. Ngokombono womhlinzeki wamafu, inkinga enjalo ingaholela emithwalweni eyengeziwe enanini labasingathi be-ESXi, okuzogcina kuholele ekwehleni kokusebenza kwengqalasizinda ebonakalayo yamafu. Lokhu kungase, phakathi kwezinye izinto, kuthinte ukusebenza kwemishini ebonakalayo yamanye amaklayenti amafu. Isimo esifanayo singase siphakame lapho kwethulwa ukuskena kwenqwaba: ukucutshungulwa kanyekanye ngohlelo lwediski yezicelo eziningi ezifanayo ezivela kubasebenzisi abahlukene kuzothinta kabi ukusebenza kwefu lonke. Ngezinga eliphezulu lamathuba, ukwehla ekusebenzeni kwesistimu yesitoreji kuzothinta wonke amaklayenti. Imithwalo enjalo esheshayo ayimjabulisi umhlinzeki noma amakhasimende akhe, njengoba ithinta "omakhelwane" efwini. Kusukela kulo mbono, i-antivirus yendabuko ingadala inkinga enkulu.
Ukuvalelwa yedwa okuphephile. Uma ifayela noma idokhumenti okungenzeka ukuthi itheleleke ngegciwane itholwa ohlelweni, ithunyelwa ukuvalelwa. Yiqiniso, ifayela elinegciwane lingasuswa ngokushesha, kodwa lokhu ngokuvamile akumukeleki ezinkampanini eziningi. Ama-antivirus ebhizinisi ezinkampani angashintshwanga ukuze asebenze efwini lomhlinzeki, njengomthetho, anendawo evamile yokuhlukaniswa - zonke izinto ezingenwe yileli gciwane ziwela kuyo. Isibonelo, lezo ezitholakala kumakhompyutha abasebenzisi benkampani. Amaklayenti omhlinzeki wamafu "ahlala" ngezigaba zawo (noma abaqashi). Lezi zingxenye zi-opaque futhi zihlukanisiwe: amaklayenti akazi ngomunye nomunye futhi, vele, awaboni ukuthi abanye babamba ini efwini. Ngokusobala, ukuvalelwa okuvamile, okuzofinyelelwa yibo bonke abasebenzisi bokuvikela amagciwane efwini, kungase kuhlanganise idokhumenti equkethe ulwazi oluyimfihlo noma imfihlo yokuhweba. Lokhu akwamukelekile kumhlinzeki nakumakhasimende akhe. Ngakho-ke, kungaba nesixazululo esisodwa kuphela - ukuhlukaniswa komuntu siqu kweklayenti ngalinye esigabeni salo, lapho umhlinzeki noma amanye amaklayenti engenakho ukufinyelela.
Izinqubomgomo zokuvikela ngazinye. Iklayenti ngalinye efwini yinkampani ehlukile, umnyango wayo we-IT ubeka izinqubomgomo zawo zokuphepha. Isibonelo, abalawuli bachaza imithetho yokuskena futhi bahlele ukuskena okulwa namagciwane. Ngokufanelekile, inhlangano ngayinye kufanele ibe nesikhungo sayo sokulawula ukuze ilungiselele izinqubomgomo zokulwa namagciwane. Ngesikhathi esifanayo, izilungiselelo ezicacisiwe akufanele zithinte amanye amaklayenti amafu, futhi umhlinzeki kufanele akwazi ukuqinisekisa ukuthi, isibonelo, ukubuyekezwa kwe-antivirus kwenziwa njengokujwayelekile kuyo yonke imishini ebonakalayo yeklayenti.
Inhlangano yokukhokhisa kanye namalayisensi. Imodeli yamafu ibonakala ngokuguquguquka futhi ihilela ukukhokhela kuphela inani lezinsiza ze-IT ezisetshenziswe ikhasimende. Uma kunesidingo, isibonelo, ngenxa yenkathi yonyaka, khona-ke inani lezinsiza lingakhuphuka ngokushesha noma lincishiswe - konke ngokusekelwe ezidingweni zamanje zamandla wekhompyutha. I-antivirus yendabuko ayiguquguquki kangako - njengomthetho, iklayenti lithenga ilayisense unyaka ngenani elinqunywe kusengaphambili lamaseva noma iziteshi zokusebenza. Abasebenzisi bamafu njalo banqamula futhi baxhume imishini eyengeziwe ebonakalayo kuye ngezidingo zabo zamanje - ngokufanelekile, amalayisense okuvikela amagciwane kufanele asekele imodeli efanayo.
Umbuzo wesibili ngowokuthi ilayisensi izohlanganisa ini. I-antivirus evamile inikezwe ilayisense ngenani lamaseva noma iziteshi zokusebenza. Amalayisense asuselwe enanini lemishini ebonakalayo evikelwe awafaneleki ngokuphelele ngaphakathi kwemodeli yefu. Iklayenti lingakha noma iyiphi inombolo yemishini ebonakalayo elula kuye kusuka ezinsizeni ezitholakalayo, isibonelo, imishini emihlanu noma eyishumi. Le nombolo ayishintshi kumakhasimende amaningi; akunakwenzeka ngathi, njengomhlinzeki, ukulandelela izinguquko zayo. Awekho amathuba obuchwepheshe okunikeza ilayisense nge-CPU: amaklayenti athola ama-virtual processors (vCPUs), okufanele asetshenziselwe ukunikeza ilayisense. Ngakho-ke, imodeli entsha yokuvikela i-anti-virus kufanele ifake ikhono lekhasimende lokunquma inombolo edingekayo yama-vCPU lapho lizothola khona amalayisense okuvimbela amagciwane.
Ukuhambisana nomthetho. Iphuzu elibalulekile, njengoba izixazululo ezisetshenzisiwe kufanele ziqinisekise ukuhambisana nezidingo zomlawuli. Isibonelo, "izakhamuzi" zamafu zivame ukusebenza nedatha yomuntu siqu. Kulokhu, umhlinzeki kufanele abe nesegimenti yefu eqinisekisiwe ehambisana ngokugcwele nezidingo zoMthetho Wedatha yomuntu siqu. Khona-ke izinkampani azidingi "ukwakha" ngokuzimela lonke uhlelo lokusebenza nedatha yomuntu siqu: ukuthenga imishini eqinisekisiwe, ukuxhuma nokuyilungisa, bese uthola isitifiketi. Ukuvikela i-cyber ye-ISPD yamakhasimende anjalo, i-antivirus kufanele futhi ihambisane nezidingo zomthetho waseRussia futhi ibe nesitifiketi se-FSTEC.
Sibheke imibandela eyisibopho okufanele ukuvikelwa kwe-antivirus efwini lomphakathi kuhlangabezane nayo. Okulandelayo, sizokwabelana ngolwazi lwethu lokushintsha isixazululo se-antivirus ukuze sisebenze efwini lomhlinzeki.
Ungabenza kanjani ubungane phakathi kwe-antivirus nefu?
Njengoba okuhlangenwe nakho kwethu kubonisile, ukukhetha isixazululo esisekelwe encazelweni nakumadokhumenti kuyinto eyodwa, kodwa ukusisebenzisa ngokusebenza endaweni yamafu esivele sisebenza kuwumsebenzi ohluke ngokuphelele ngokwemibandela eyinkimbinkimbi. Sizokutshela ukuthi senzeni sisebenza nokuthi siyiguqule kanjani i-antivirus ukuthi isebenze kumafu omphakathi womhlinzeki. Umthengisi wesixazululo se-anti-virus kwakunguKaspersky, iphothifoliyo yakhe ehlanganisa izixazululo zokuvikela amagciwane ezindaweni zamafu. Sazinza ku- "Kaspersky Security for Virtualization" (I-Ejenti Yokukhanya).
Kuhlanganisa ikhonsoli eyodwa yeKaspersky Security Center. I-ejenti ekhanyayo nemishini yokuvikeleka ebonakalayo (i-SVM, Umshini Obonakalayo Wokuphepha) kanye neseva yokuhlanganisa ye-KSC.
Ngemuva kokuthi sifunde ukwakhiwa kwesisombululo se-Kaspersky futhi senze izivivinyo zokuqala kanye nonjiniyela bomthengisi, kwaphakama umbuzo mayelana nokuhlanganisa isevisi efwini. Ukuqaliswa kokuqala kwenziwa ngokuhlanganyela endaweni yamafu yaseMoscow. Futhi yilokho esakubona.
Ukuze kuncishiswe ithrafikhi yenethiwekhi, kunqunywe ukuthi kubekwe i-SVM kumsingathi ngamunye we-ESXi futhi "bophe" i-SVM kubasingathi be-ESXi. Kulokhu, ama-ejenti alula emishini ebonakalayo evikelwe afinyelela i-SVM yomsingathi we-ESXi asebenza kuyo. Isiqashi esihlukile sokuphatha sikhethelwe i-KSC eyinhloko. Ngenxa yalokho, ama-KSC angaphansi atholakala kubaqashi beklayenti ngalinye futhi akhuluma ne-KSC ephakeme etholakala engxenyeni yabaphathi. Lolu hlelo lukuvumela ukuthi uxazulule ngokushesha izinkinga ezivela kubaqashi bamakhasimende.
Ngaphezu kwezinkinga zokukhulisa izingxenye zesixazululo sokulwa namagciwane ngokwaso, sasibhekene nomsebenzi wokuhlela ukusebenzisana kwenethiwekhi ngokudala ama-VxLAN engeziwe. Futhi nakuba isixazululo ekuqaleni sasihloselwe amakhasimende ebhizinisi anamafu angasese, ngosizo lwe-savvy yobunjiniyela kanye nokuguquguquka kwezobuchwepheshe be-NSX Edge sakwazi ukuxazulula zonke izinkinga ezihlobene nokuhlukaniswa kwabaqashi kanye nokunikezwa kwamalayisensi.
Sisebenze eduze nonjiniyela baseKaspersky. Ngakho-ke, ohlelweni lokuhlaziya ukwakhiwa kwesisombululo mayelana nokusebenzisana kwenethiwekhi phakathi kwezingxenye zesistimu, kwatholakala ukuthi, ngaphezu kokufinyelela kusuka kuma-ejenti okukhanya kuya ku-SVM, impendulo nayo iyadingeka - kusuka ku-SVM kuya kuma-ejenti okukhanya. Lokhu kuxhumana kwenethiwekhi akwenzeki endaweni enabantu abaningi ngenxa yamathuba ezilungiselelo zenethiwekhi ezifanayo zemishini ebonakalayo kubaqashi abahlukahlukene bamafu. Ngakho-ke, ngesicelo sethu, ozakwethu abavela kumthengisi baphinde balungisa indlela yokusebenzisana kwenethiwekhi phakathi kwe-ejenti yokukhanya ne-SVM mayelana nokuqeda isidingo sokuxhuma kwenethiwekhi kusuka ku-SVM kuya kuma-ejenti okukhanya.
Ngemuva kokuthi isisombululo sisetshenziswe futhi sahlolwa endaweni yamafu yaseMoscow, saphinda saphinda kwezinye izingosi, okuhlanganisa ingxenye yamafu eqinisekisiwe. Isevisi isiyatholakala kuzo zonke izifunda zezwe.
Ukwakhiwa kwesixazululo sokuphepha kolwazi ngaphakathi kohlaka lwendlela entsha
Uhlelo olujwayelekile lokusebenza lwesixazululo se-antivirus endaweni yamafu yomphakathi lumi kanje:
Uhlelo lokusebenza lwesixazululo se-antivirus endaweni yamafu yomphakathi #CloudMTS
Ake sichaze izici zokusebenza kwezakhi ngazinye zesixazululo efwini:
β’ Ikhonsoli eyodwa evumela amaklayenti ukuthi aphathe isistimu yokuvikela: sebenzisa izikena, lawula izibuyekezo nokuqapha izindawo zokuvalelwa. Kungenzeka ukuthi ulungiselele izinqubomgomo zokuphepha ngazinye ngaphakathi kwesegimenti yakho.
Kufanele kuqashelwe ukuthi nakuba singabahlinzeki besevisi, asiphazamisi izilungiselelo ezibekwe amaklayenti. Okuwukuphela kwento esingayenza ukusetha kabusha izinqubomgomo zokuphepha zibe kwezijwayelekile uma ukulungiswa kabusha kuyadingeka. Isibonelo, lokhu kungase kudingeke uma iklayenti liwaqinise ngephutha noma elenza buthaka kakhulu. Inkampani ingahlala ithola isikhungo sokulawula esinezinqubomgomo ezizenzakalelayo, engase izilungise ngokuzimela. Ububi beKaspersky Security Center ukuthi ipulatifomu okwamanje itholakala kuphela ohlelweni olusebenzayo lweMicrosoft. Yize ama-ejenti angasindi angasebenza ngayo yomibili imishini yeWindows ne-Linux. Kodwa-ke, iKaspersky Lab ithembisa ukuthi maduze nje i-KSC izosebenza ngaphansi kwe-Linux OS. Omunye wemisebenzi ebalulekile ye-KSC yikhono lokuphatha ukuhlukaniswa. Inkampani ngayinye yeklayenti efwini lethu ineyomuntu siqu. Le ndlela iqeda izimo lapho idokhumenti etheleleke ngegciwane ivele ibonakale esidlangalaleni, njengoba kungenzeka esimeni se-antivirus yakudala yenkampani evalelwa yedwa.
β’ Ama-ejenti athambile. Njengengxenye yemodeli entsha, i-ejenti ye-Kaspersky Security engasindi ifakwe emshinini ngamunye obonakalayo. Lokhu kuqeda isidingo sokugcina isizindalwazi se-anti-virus ku-VM ngayinye, okunciphisa inani lesikhala sediski esidingekayo. Isevisi ihlanganiswe nengqalasizinda yamafu futhi isebenza nge-SVM, okwandisa ukuminyana kwemishini ebonakalayo kumsingathi we-ESXi kanye nokusebenza kwalo lonke uhlelo lwamafu. I-ejenti yokukhanya yakha ulayini wemisebenzi yomshini ngamunye obonakalayo: hlola uhlelo lwefayela, inkumbulo, njll. Kodwa i-SVM inesibopho sokwenza le misebenzi, esizokhuluma ngayo kamuva. I-ejenti iphinde isebenze njenge-firewall, ilawula izinqubomgomo zokuphepha, ithumela amafayela anegciwane ukuze ihlukaniswe futhi igade "impilo" yonke yesistimu yokusebenza efakwe kuyo. Konke lokhu kungaphathwa kusetshenziswa ikhonsoli eyodwa eshiwo kakade.
β’ Umshini Obonakalayo Wokuvikela. Yonke imisebenzi edinga izinsiza (izibuyekezo zesizindalwazi sokulwa namagciwane, izikena ezihleliwe) isingathwa umshini ohlukile Wokuvikela Obonakalayo (SVM). Unesibopho sokusebenza kwenjini egcwele anti-virus kanye nemininingwane yayo. Ingqalasizinda ye-IT yenkampani ingase ihlanganise ama-SVM ambalwa. Le ndlela ikhulisa ukwethembeka kwesistimu - uma umshini owodwa wehluleka futhi ungaphenduli imizuzwana engamashumi amathathu, ama-agent aqala ngokuzenzakalelayo ukufuna omunye.
β’ Iseva yokuhlanganisa ye-KSC. Enye yezingxenye ze-KSC eyinhloko, enikeza ama-SVM ayo kubasebenzeli abakhanyayo ngokuvumelana ne-algorithm ecaciswe kuzilungiselelo zayo, futhi ilawula ukutholakala kwama-SVM. Ngakho-ke, le moduli yesofthiwe inikeza ukulinganisa komthwalo kuwo wonke ama-SVM engqalasizinda yamafu.
I-algorithm yokusebenza emafini: ukunciphisa umthwalo engqalasizinda
Ngokuvamile, i-algorithm ye-antivirus ingamelwa kanje. I-ejenti ifinyelela ifayela emshinini we-virtual futhi iyalihlola. Umphumela wokuqinisekisa ugcinwa kusizindalwazi esivamile sesinqumo se-SVM (esibizwa ngokuthi Inqolobane Ehlanganyelwe), okufakiwe ngakunye okukhomba isampula lefayela elihlukile. Le ndlela ikuvumela ukuthi uqinisekise ukuthi ifayela elifanayo aliskenwa izikhathi ezimbalwa zilandelana (isibonelo, uma livulwe emishinini ehlukene ebonakalayo). Ifayela liskenwa kabusha kuphela uma izinguquko zenziwe kulo noma ukuskena kuqalwe mathupha.
Ukwenziwa kwesixazululo se-antivirus efwini lomhlinzeki
Isithombe sibonisa umdwebo ojwayelekile wokusetshenziswa kwesixazululo emafini. Isikhungo Sokuphepha seKaspersky esiyinhloko sitshalwe endaweni yokulawula yefu, futhi i-SVM ngayinye isetshenziswa kumsingathi ngamunye we-ESXi kusetshenziswa iseva yokuhlanganisa ye-KSC (umsingathi ngamunye we-ESXi une-SVM yakhe enamathiselwe nezilungiselelo ezikhethekile ku-VMware vCenter Server). Amaklayenti asebenza ezingxenyeni zawo zamafu, lapho kutholakala khona imishini ebonakalayo enabenzeli. Aphathwa ngamaseva e-KSC ngamanye angaphansi kwe-KSC eyinhloko. Uma kudingekile ukuvikela inombolo encane yemishini ebonakalayo (kufika ku-5), iklayenti linganikezwa ngokufinyelela kukhonsoli ebonakalayo yeseva ye-KSC ekhethekile. Ukusebenzisana kwenethiwekhi phakathi kwama-KSC weklayenti kanye ne-KSC eyinhloko, kanye nama-ejenti okukhanya nama-SVM, kwenziwa kusetshenziswa i-NAT ngamarutha abonakalayo eklayenti e-EdgeGW.
Ngokwezilinganiso zethu kanye nemiphumela yokuhlolwa kozakwethu kumthengisi, I-Light Agent inciphisa umthwalo engqalasizinda ebonakalayo yamakhasimende cishe ngo-25% (uma iqhathaniswa nesistimu esebenzisa isofthiwe evamile yokulwa namagciwane). Ikakhulukazi, i-antivirus ejwayelekile ye-Kaspersky Endpoint Security (KES) yendawo ebonakalayo idla cishe kabili isikhathi se-CPU yeseva (2,95%) njengesixazululo se-agent-based virtualization solution (1,67%).
Ishadi lokuqhathanisa lokulayisha kwe-CPU
Isimo esifanayo sibonwa ngokuvama kokufinyelela kokubhala kwediski: ku-antivirus yakudala yi-1011 IOPS, ye-antivirus yamafu yi-671 IOPS.
Igrafu yokuqhathanisa izinga lokufinyelela kwediski
Inzuzo yokusebenza ikuvumela ukuthi ugcine uzinzo lwengqalasizinda futhi usebenzise amandla ekhompuyutha ngendlela efanele. Ngokuzivumelanisa nokusebenza endaweni yamafu omphakathi, isixazululo asinciphisi ukusebenza kwamafu: sihlola ngokuyinhloko amafayela futhi silande izibuyekezo, sisabalalisa umthwalo. Lokhu kusho ukuthi, ngakolunye uhlangothi, izinsongo eziphathelene nengqalasizinda yamafu ngeke ziphuthelwe, ngakolunye uhlangothi, izidingo zensiza zemishini ebonakalayo zizoncishiswa ngesilinganiso sama-25% uma kuqhathaniswa ne-antivirus yendabuko.
Mayelana nokusebenza, zombili izixazululo zifana kakhulu komunye nomunye: ngezansi kunethebula lokuqhathanisa. Kodwa-ke, emafini, njengoba imiphumela yokuhlolwa engenhla ibonisa, kusalungile ukusebenzisa isixazululo sezindawo ezibonakalayo.
Mayelana nezintela ngaphakathi kohlaka lwendlela entsha. Sinqume ukusebenzisa imodeli esivumela ukuthi sithole amalayisense ngokususelwe kunombolo yama-vCPU. Lokhu kusho ukuthi inani lamalayisensi lizolingana nenani lama-vCPU. Ungahlola i-antivirus yakho ngokushiya isicelo .
Esihlokweni esilandelayo ngezihloko zamafu, sizokhuluma ngokuvela kwamafu we-WAFs nokuthi yini engcono ukukhetha: i-hardware, isofthiwe noma ifu.
Umbhalo ulungiswe ngabasebenzi bomhlinzeki wamafu #CloudMTS: U-Denis Myagkov, umdwebi wezakhiwo oholayo kanye no-Alexey Afanasyev, umphathi wokuthuthukiswa komkhiqizo wokuphepha kolwazi.
Source: www.habr.com