{"id":8574,"date":"2023-11-03T14:17:30","date_gmt":"2023-11-03T13:17:30","guid":{"rendered":"https:\/\/www.idstory.com\/?p=8574"},"modified":"2023-11-03T14:29:05","modified_gmt":"2023-11-03T13:29:05","slug":"kyberneticka-bezpecnost-nejdriv-si-udelejte-poradek-v-uctech","status":"publish","type":"post","link":"https:\/\/www.idstory.com\/cs\/kyberneticka-bezpecnost-nejdriv-si-udelejte-poradek-v-uctech\/","title":{"rendered":"Kybernetick\u00e1 bezpe\u010dnost? Nejd\u0159\u00edv si ud\u011blejte po\u0159\u00e1dek v \u00fa\u010dtech"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"8574\" class=\"elementor elementor-8574\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-7b1fbe73 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"7b1fbe73\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-25b11e8c\" data-id=\"25b11e8c\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-5c8e8d38 elementor-widget elementor-widget-text-editor\" data-id=\"5c8e8d38\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\tPo\u010det kybernetick\u00fdch \u00fatok\u016f v\u016f\u010di organizac\u00edm se rok od roku zvy\u0161uje. M\u011bn\u00ed se tak\u00e9 zp\u016fsob a c\u00edl \u00fatoku, od kr\u00e1de\u017e\u00ed dat jsme se postupem \u010dasu dostali k aktu\u00e1ln\u011b nejv\u011bt\u0161\u00ed hrozb\u011b ransomware \u00fatok\u016f. Jde o \u00fatok veden\u00fd s c\u00edlem za\u0161ifrovat data a vyd\u00edrat majitele syst\u00e9m\u016f o nemalou \u010d\u00e1stku pro jejich obnovu. Zd\u00e1 se, \u017ee ka\u017ed\u00fd \u0159e\u0161\u00ed t\u00e9ma \u201cKybernetick\u00e1 bezpe\u010dnost\u201d, ale v\u00edte, kam p\u0159esn\u011b maj\u00ed p\u0159\u00edstup va\u0161i zam\u011bstnanci a jak\u00e9 dal\u0161\u00ed typy \u00fa\u010dt\u016f ve va\u0161\u00ed organizaci pou\u017e\u00edv\u00e1te a kdo je jejich vlastn\u00edk? Pokud ne, jak se chcete \u00fatoku efektivn\u011b p\u0159edch\u00e1zet?\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t<div class=\"elementor-element elementor-element-3ef05fc e-flex e-con-boxed e-con e-parent\" data-id=\"3ef05fc\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-4fbd581 elementor-widget elementor-widget-text-editor\" data-id=\"4fbd581\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t\t\t\t\t\t<p>Jak je ale mo\u017en\u00e9, \u017ee \u00fatoky jsou tak \u00fasp\u011b\u0161n\u00e9? Vzpome\u0148me na ned\u00e1vn\u00e9 \u00fatoky na \u010desk\u00e9 nemocnice, kter\u00e9 vy\u0159adily z provozu kl\u00ed\u010dov\u00e9 IT syst\u00e9my a cel\u00e1 odd\u011blen\u00ed nemohla pracovat, pacienti byli p\u0159ev\u00e1\u017eeni do jin\u00fdch nemocnic. V tomto \u010dl\u00e1nku se nebudeme zab\u00fdvat ochranou p\u0159ed \u00fatokem jako takov\u00fdm, ale pod\u00edv\u00e1me se hloub\u011bji a\u017e k samotn\u00fdm princip\u016fm spr\u00e1vy \u00fa\u010dt\u016f. Aby toti\u017e mohl z\u00e1\u0161kodn\u00edk nap\u00e1chat \u0161kodu, mus\u00ed vyu\u017e\u00edt n\u011bjak\u00e9 zranitelnosti a jednou z nich je ne\u0159\u00edzen\u00e1 spr\u00e1va p\u0159\u00edstup\u016f do IT syst\u00e9m\u016f!<\/p>\n<p>Ruku na srdce, kolik z n\u00e1s m\u00e1 ve sv\u00e9 firm\u011b perfektn\u00ed p\u0159ehled o tom, kdo a kam m\u00e1 p\u0159\u00edstup? Kolik vlastn\u011b m\u00e1me ve firm\u011b vydan\u00fdch vzd\u00e1len\u00fdch p\u0159\u00edstup\u016f (VPN, RDP, ssh, apod\u2026) pro zam\u011bstnance a kolik extern\u00edch dodavatel\u016f vlastn\u011b pou\u017e\u00edv\u00e1 vzd\u00e1lenou plochu? Jak \u010dasto se recertifikuj\u00ed p\u0159id\u011blen\u00e1 opr\u00e1vn\u011bn\u00ed a kdo je povolil a na jak dlouho? Ne\u0159\u00edd\u00ed si to n\u00e1hodou IT samo n\u011bjakou setrva\u010dnost\u00ed zab\u011bhnut\u00fdch proces\u016f? I tohle je kybernetick\u00e1 bezpe\u010dnost!<\/p>\n<p>P\u0159edstavme si, \u017ee jsme opravdu pod \u00fatokem. \u00dato\u010dn\u00edk kompromitoval n\u011bjak\u00fd \u00fa\u010det na\u0161eho administr\u00e1tora. Kam v\u0161ude se te\u010f m\u016f\u017ee dostat? Dok\u00e1\u017eeme ho odst\u0159ihnout, ani\u017e bychom zastavili b\u011bh firmy a zp\u016fsobili provozn\u00ed ztr\u00e1ty? V takov\u00fdch chv\u00edl\u00edch m\u016f\u017ee j\u00edt o minuty, kter\u00e9 ve v\u00fdsledku u\u0161et\u0159\u00ed i miliony.<\/p>\n<p>S po\u0159\u00e1dkem v p\u0159\u00edstupech do syst\u00e9mu v\u00e1m pom\u016f\u017ee identity management software (IdM), jako je \u010desk\u00fd n\u00e1stroj IdStory.<\/p>\n<h2>Jak pom\u016f\u017ee IdM narovnat \u00fa\u010dty?<\/h2>\n<p>Identity manager m\u00e1 n\u011bkolik z\u00e1kladn\u00edch princip\u016f, kter\u00e9 udr\u017e\u00ed va\u0161e p\u0159\u00edstupy v perfektn\u00ed kondici<\/p>\n<ul>\n<li><strong>centr\u00e1ln\u00ed spr\u00e1va<\/strong>&nbsp;a p\u0159ehled o v\u0161ech \u00fa\u010dtech v organizaci<\/li>\n<li>jednozna\u010dn\u00e1&nbsp;<strong>odpov\u011bdnost<\/strong>&nbsp;za p\u0159id\u011blen\u00ed p\u0159\u00edstupu<\/li>\n<li><strong>auditovatelnost<\/strong>&nbsp;v\u0161ech spravovan\u00fdch \u00fa\u010dt\u016f<\/li>\n<li><strong>automatizace<\/strong>&nbsp;\u2013 tvorba a odmaz\u00e1v\u00e1n\u00ed p\u0159\u00edstup\u016f na z\u00e1klad\u011b jasn\u011b definovan\u00fdch pravidel<\/li>\n<\/ul>\n<p><a href=\"https:\/\/blog.bcvsolutions.eu\/wp-content\/uploads\/2017\/06\/IDM.png\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" class=\"aligncenter wp-image-7721 size-full jetpack-lazy-image jetpack-lazy-image--handled\" src=\"https:\/\/blog.bcvsolutions.eu\/wp-content\/uploads\/2017\/06\/IDM.png\" sizes=\"(max-width: 819px) 100vw, 819px\" srcset=\"https:\/\/blog.bcvsolutions.eu\/wp-content\/uploads\/2017\/06\/IDM.png 819w, https:\/\/blog.bcvsolutions.eu\/wp-content\/uploads\/2017\/06\/IDM-100x64.png 100w, https:\/\/blog.bcvsolutions.eu\/wp-content\/uploads\/2017\/06\/IDM-300x193.png 300w, https:\/\/blog.bcvsolutions.eu\/wp-content\/uploads\/2017\/06\/IDM-768x495.png 768w\" alt=\"centr\u00e1ln\u00ed spr\u00e1va identit\" width=\"819\" height=\"528\" data-lazy-loaded=\"1\"><\/a><\/p>\n<p>V\u00edce se do\u010dtete ve \u010dl\u00e1nku&nbsp;<a href=\"https:\/\/www.idstory.com\/cs\/co-je-to-identity-management\/\">Co je to Identity Management<\/a>.<\/p>\n<h2>Na jak\u00e9 \u00fa\u010dty se \u010dasto zapom\u00edn\u00e1?<\/h2>\n<p>Pokud \u0159e\u0161\u00edme spr\u00e1vu p\u0159\u00edstup\u016f, pak ka\u017ed\u00e9ho napadnou \u00fa\u010dty zam\u011bstnanc\u016f. Ano, m\u00edt p\u0159ehled o \u00fa\u010dtech zam\u011bstnance je z\u00e1klad pro kvalitn\u00ed identity management. Av\u0161ak krom\u011b b\u011b\u017en\u00fdch \u00fa\u010dt\u016f m\u00e1me tak\u00e9 takov\u00e9, na kter\u00e9 se \u010dasto zapom\u00edn\u00e1, a p\u0159esto jsou zaj\u00edmav\u00e9. Mnohdy pro \u00fato\u010dn\u00edky je\u0161t\u011b daleko zaj\u00edmav\u011bj\u0161\u00ed ne\u017e \u00fa\u010det \u0159adov\u00e9ho zam\u011bstnance.<\/p>\n<h3>\u00da\u010dty externist\u016f<\/h3>\n<p>Nejen zam\u011bstnanci vykon\u00e1vaj\u00ed pr\u00e1ci v r\u00e1mci firemn\u00edch IT syst\u00e9m\u016f. Velmi po\u010detnou skupinou u\u017eivatel\u016f jsou externist\u00e9, mezi kter\u00e9 po\u010d\u00edt\u00e1me<\/p>\n<ul>\n<li>extern\u00ed dodavatele \u2013 z\u0159\u00eddka b\u00fdvaj\u00ed centr\u00e1ln\u011b evidov\u00e1ni<\/li>\n<li>st\u00e1\u017eisty \u2013 n\u011bkdy jsou evidov\u00e1n\u00ed v person\u00e1ln\u00edm syst\u00e9mu<\/li>\n<li>kontraktory \u2013 \u010dasto nejsou evidov\u00e1n\u00ed v person\u00e1ln\u00edm syst\u00e9mu<\/li>\n<li>\u00fa\u010dty partnersk\u00fdch spole\u010dnost\u00ed \u2013 podobn\u011b jako extern\u00ed dodavatel\u00e9<\/li>\n<li>a dal\u0161\u00ed<\/li>\n<\/ul>\n<p>Nejen, \u017ee externist\u00e9 b\u00fdvaj\u00ed z\u0159\u00eddkakdy evidov\u00e1n\u00ed na jednom m\u00edst\u011b, zapom\u00edn\u00e1 se hlavn\u011b na jejich v\u010dasn\u00e9 ukon\u010dov\u00e1n\u00ed a revizi jejich p\u0159\u00edstup\u016f. Vzd\u00e1len\u00e9 p\u0159\u00edstupy, kter\u00e9 \u010dasto pou\u017e\u00edvaj\u00ed, jsou vyd\u00e1v\u00e1ny na dlouhou dobu, n\u011bkdy neomezen\u011b. Jednou z nejhor\u0161\u00edch praktik spr\u00e1vy \u00fa\u010dt\u016f externist\u016f je vyd\u00e1v\u00e1n\u00ed sd\u00edlen\u00fdch p\u0159\u00edstupov\u00fdch \u00fa\u010dt\u016f \u2013 nap\u0159\u00edklad jeden \u00fa\u010det pro celou partnerskou firmu. P\u0159i p\u0159\u00edpadn\u00fdch probl\u00e9mech pak nen\u00ed v\u016fbec z\u0159ejm\u00e9, kdo a kdy p\u0159\u00edpadn\u00fd z\u00e1sah provedl.<\/p>\n<h3>Vzd\u00e1len\u00e9 p\u0159\u00edstupy<\/h3>\n<p>Speci\u00e1ln\u00ed typ \u00fa\u010dt\u016f, kter\u00fd vyu\u017e\u00edvaj\u00ed jak intern\u00ed zam\u011bstnanci, tak externist\u00e9, jsou vzd\u00e1len\u00e9 p\u0159\u00edstupy. Evidence vzd\u00e1len\u00fdch p\u0159\u00edstup\u016f a jejich pe\u010dliv\u00e1 spr\u00e1va by m\u011bla b\u00fdt jedn\u00edm ze z\u00e1klad\u016f identity managementu. Stanice, ze kter\u00fdch se do intern\u00ed s\u00edt\u011b vzd\u00e1len\u011b p\u0159istupuje jsou toti\u017e m\u00e1lokdy spravov\u00e1ny danou firmou, je tedy pot\u0159eba se k nim chovat nanejv\u00fd\u0161 ned\u016fv\u011b\u0159iv\u011b a p\u0159i p\u0159\u00edpadn\u00e9 kompromitaci b\u00fdt schopni je rychle zablokovat.<\/p>\n<h3>Privilegovan\u00e9 \u00fa\u010dty<\/h3>\n<p>Sem m\u016f\u017eeme po\u010d\u00edtat \u00fa\u010dty s vy\u0161\u0161\u00edmi privilegii, ne\u017e maj\u00ed b\u011b\u017en\u00ed u\u017eivatel\u00e9. \u010casto jde o \u00fa\u010dty, pod jejich\u017e pr\u00e1vy b\u011b\u017e\u00ed n\u011bjak\u00e9 IT slu\u017eby v organizaci nebo \u00fa\u010dty pro administraci n\u011bjak\u00e9ho syst\u00e9mu.<\/p>\n<p>Spr\u00e1vu speci\u00e1ln\u00edch \u00fa\u010dt\u016f m\u016f\u017ee v z\u00e1kladu zabezpe\u010dit identity management \u2013 udr\u017e\u00ed p\u0159ehled o tom, kdo a kdy ho zalo\u017eil a jak\u00e9 m\u00e1 nap\u0159\u00edklad skupiny v dom\u00e9n\u011b AD a kdo je vlastn\u00edk (fyzick\u00e1 osoba) dan\u00e9ho \u00fa\u010dtu. Pokud dan\u00fd vlastn\u00edk odejde, IdM vyzve opr\u00e1vn\u011bn\u00e9 osoby k nastaven\u00fd nov\u00fdch vlastn\u00edk\u016f tak, aby v organizaci nez\u016fst\u00e1valy speci\u00e1ln\u00ed \u00fa\u010dty mimo evidenci. Privilegovan\u00e9 \u00fa\u010dty<\/p>\n<p>Pro real time \u0159\u00edzen\u00ed p\u0159\u00edstupu k privilegovan\u00fdm \u00fa\u010dt\u016fm, jako je mo\u017enost do\u010dasn\u011b pod \u00fa\u010dtem pracovat, pak \u0159e\u0161\u00ed specializovan\u00fd software PAM (privileged access management).<\/p>\n<h3>Do\u010dasn\u00e9 a testovac\u00ed \u00fa\u010dty<\/h3>\n<p>Zn\u00e1m\u00fd bonmot \u0159\u00edk\u00e1, \u017ee \u201cz\u00e1kladn\u00ed jednotkou do\u010dasnosti je 1 furt\u201d. A to bohu\u017eel \u010dasto plat\u00ed i o \u00fa\u010dtech, kter\u00e9 n\u011bkdo vytvo\u0159il jen k n\u011bjak\u00e9mu kr\u00e1tkodob\u00e9mu pou\u017eit\u00ed nebo jen pot\u0159eboval n\u011bco rychle otestovat a zapomn\u011bl po sob\u011b uklidit. Toto \u201csmet\u00ed\u201d nejen znep\u0159ehled\u0148uje spr\u00e1vu \u00fa\u010dt\u016f, ale \u010dasto nen\u00ed ani zn\u00e1m jejich majitel a \u00fa\u010del. P\u0159i kompromitaci pak v\u016fbec nen\u00ed jednoduch\u00e9 ur\u010dit rozsah nap\u00e1chan\u00fdch \u0161kod.<\/p>\n<h2>Shrnut\u00ed<\/h2>\n<p>V tomto \u010dl\u00e1nku jsme si na p\u0159\u00edkladech uk\u00e1zali, jak\u00e9 typy \u00fa\u010dt\u016f se v organizac\u00edch vyskytuj\u00ed a pro\u010d je dobr\u00e9 se jimi zab\u00fdvat s ohledem na t\u00e9ma kybernetick\u00e1 bezpe\u010dnost. Ne\u0159\u00edzen\u00ed p\u0159\u00edstup\u016f nejen\u017ee znep\u0159\u00edjem\u0148uje pr\u00e1ci IT pracovn\u00edk\u016fm, ale m\u016f\u017ee p\u0159edstavovat pom\u011brn\u011b nemalou bezpe\u010dnostn\u00ed hrozbu.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Po\u010det kybernetick\u00fdch \u00fatok\u016f v\u016f\u010di organizac\u00edm se rok od roku zvy\u0161uje. M\u011bn\u00ed se tak\u00e9 zp\u016fsob a c\u00edl \u00fatoku, od kr\u00e1de\u017e\u00ed dat jsme se postupem \u010dasu dostali k aktu\u00e1ln\u011b nejv\u011bt\u0161\u00ed hrozb\u011b ransomware \u00fatok\u016f. Jde o \u00fatok veden\u00fd s c\u00edlem za\u0161ifrovat data a vyd\u00edrat majitele syst\u00e9m\u016f o nemalou \u010d\u00e1stku pro jejich obnovu. Zd\u00e1 se, \u017ee ka\u017ed\u00fd \u0159e\u0161\u00ed t\u00e9ma \u201cKybernetick\u00e1 bezpe\u010dnost\u201d, ale v\u00edte, kam p\u0159esn\u011b maj\u00ed p\u0159\u00edstup va\u0161i zam\u011bstnanci a jak\u00e9 dal\u0161\u00ed typy \u00fa\u010dt\u016f ve va\u0161\u00ed organizaci pou\u017e\u00edv\u00e1te a kdo je jejich vlastn\u00edk? Pokud ne, jak se chcete \u00fatoku efektivn\u011b p\u0159edch\u00e1zet?<\/p>\n","protected":false},"author":6,"featured_media":8582,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"elementor_theme","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[32],"tags":[],"class_list":["post-8574","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-identity-manager"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/posts\/8574","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/comments?post=8574"}],"version-history":[{"count":0,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/posts\/8574\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/media\/8582"}],"wp:attachment":[{"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/media?parent=8574"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/categories?post=8574"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.idstory.com\/cs\/wp-json\/wp\/v2\/tags?post=8574"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}