{"id":2189,"date":"2014-07-29T09:00:49","date_gmt":"2014-07-29T07:00:49","guid":{"rendered":"http:\/\/preventista.sk\/info\/?p=2189"},"modified":"2014-07-21T13:32:15","modified_gmt":"2014-07-21T11:32:15","slug":"spustite-siet-3-systemy-detekcie-a-prevencie-prieniku","status":"publish","type":"post","link":"https:\/\/preventista.sk\/info\/spustite-siet-3-systemy-detekcie-a-prevencie-prieniku\/","title":{"rendered":"\u201eSpustite sie\u0165! 3\u201c \u2013 Syst\u00e9my detekcie a prevencie prieniku"},"content":{"rendered":"<p>Spolo\u010dne s\u00a0ka\u017edodenn\u00fdm v\u00fdvojom nov\u00fdch sie\u0165ov\u00fdch technol\u00f3gi\u00ed vstupuj\u00fa do hry tie\u017e nov\u00e9 hrozby, ktor\u00e9 sa sna\u017eia tieto technol\u00f3gie po\u0161kodi\u0165. Dynamick\u00e1 povaha sie\u0165ov\u00fdch \u00fatokov si vy\u017eaduje dynamick\u00fa obranu hne\u010f na nieko\u013ek\u00fdch miestach.<\/p>\n<p>Syst\u00e9my pre spr\u00e1vu siete \u010dasto kr\u00e1t disponuj\u00fa mo\u017enos\u0165ou monitorovania sie\u0165ovej prev\u00e1dzky a\u00a0pod\u00e1vaj\u00fa tie\u017e jednotn\u00fd poh\u013ead do internej sie\u0165ovej infra\u0161trukt\u00fary, \u010do poskytuje sie\u0165ov\u00fdm administr\u00e1torom a\u00a0bezpe\u010dnostn\u00fdm technikom siln\u00fa zbra\u0148 v\u00a0boji proti z\u00e1\u0161kodn\u00edkom, ktor\u00fd chc\u00fa ich sie\u0165 po\u0161kodi\u0165.<\/p>\n<p>Pokia\u013e chc\u00fa v\u00a0dne\u0161nej dobe spr\u00e1vcovia siet\u00ed zabezpe\u010di\u0165 ich infra\u0161trukt\u00faru, mali by spoji\u0165 tzv. Defense-in-depth \/ Obranu do h\u013abky \/ a\u00a0osved\u010den\u00e9 postupy pri zabezpe\u010dovan\u00ed siete.<\/p>\n<h1><\/h1>\n<p>&nbsp;<\/p>\n<h1><strong>IDS a\u00a0IPS n\u00e1stroje<\/strong><\/h1>\n<h6><em>IPS (Intrusion Prevention Systems) \u2013 syst\u00e9my prevencie prieniku<br \/>\n<\/em><em>IDS (Intrusion Detection \u00a0Systems) \u2013 syst\u00e9my detekcie prieniku<\/em><\/h6>\n<hr \/>\n<h6><\/h6>\n<p>Syst\u00e9my detekcie prieniku a\u00a0syst\u00e9my prevencie prieniku (IDS\/IPS) s\u00fa zariadenia, ktor\u00e9 dok\u00e1\u017eu odhali\u0165 naru\u0161enie bezpe\u010dnosti sie\u0165ovej infra\u0161trukt\u00fary a\u00a0to tak, \u017ee monitoruj\u00fa aktivity sie\u0165ov\u00fdch zariaden\u00ed alebo opera\u010dn\u00fdch syst\u00e9mov. Pokia\u013e sa vyskytne anom\u00e1lia pri behu syst\u00e9mu, IPS vykon\u00e1 potrebn\u00e9 kroky k\u00a0navr\u00e1teniu syst\u00e9mu do \u0161tandardn\u00e9ho stavu.<\/p>\n<p>Naru\u0161enie bezpe\u010dnosti obvykle prich\u00e1dza vo forme \u0161kodliv\u00fdch vstupov do cie\u013eovej aplik\u00e1cie alebo slu\u017eby (be\u017eiacej napr. na servery). \u00dato\u010dn\u00edk m\u00f4\u017ee takto z\u00edska\u0165 nie len pr\u00edstup do aplik\u00e1cie, ale tie\u017e kontrolu nad pracovnou stanicou alebo serverom. Po \u00faspe\u0161nom \u00fatoku na zranite\u013en\u00e9 miesta aplik\u00e1cie m\u00f4\u017ee \u00fato\u010dn\u00edk vypn\u00fa\u0165 slu\u017eby ktor\u00e9 dan\u00e1 aplik\u00e1cia poskytuje. \u00dato\u010dn\u00edci v\u0161ak \u010dasto kr\u00e1t nap\u00e1daj\u00fa syst\u00e9my preto, aby z\u00edskali pr\u00edstup k\u00a0pr\u00e1vam a\u00a0opr\u00e1vneniam ktor\u00e9 s\u00fa pre dan\u00fa aplik\u00e1ciu v\u00a0syst\u00e9me implicitne potrebn\u00e9.<\/p>\n<p>&nbsp;<\/p>\n<h2><strong>Ako pracuje IPS?<\/strong><\/h2>\n<hr \/>\n<h2><\/h2>\n<p><strong>IPS<\/strong> b\u00fdva \u010dasto kr\u00e1t zariadenie, ktor\u00e9 je v\u00a0sie\u0165ovej infra\u0161trukt\u00fare zaraden\u00e9 hne\u010f za firewall a\u00a0poskytuje tak doplnkov\u00fd stupe\u0148 ochrany pred vstupom \u0161kodliv\u00fdch d\u00e1t a\u00a0spr\u00e1v do syst\u00e9mu. Syst\u00e9my <strong>IDS<\/strong> s\u00fa syst\u00e9my pas\u00edvne, \u010do znamen\u00e1, \u017ee len na\u010d\u00favaj\u00fa sie\u0165ovej komunik\u00e1cii a\u00a0pokia\u013e sa vyskytne probl\u00e9m, alarmuj\u00fa administr\u00e1tora, tam v\u0161ak ich \u00faloha kon\u010d\u00ed. Syst\u00e9m IPS je naopak raden\u00fd priamo medzi odosielate\u013ea a\u00a0prij\u00edmate\u013ea sie\u0165ovej komunik\u00e1cie a\u00a0dok\u00e1\u017ee tak priamo a\u00a0akt\u00edvne skenova\u0165 tak\u00fato komunik\u00e1ciu, a\u00a0pokia\u013e sa vyskytne nejak\u00e1 anom\u00e1lia, ktor\u00e1 m\u00f4\u017ee by\u0165 vyhodnoten\u00e1 ako naru\u0161enie bezpe\u010dnosti, IPS za\u010dne kona\u0165.<\/p>\n<p>&nbsp;<\/p>\n<p>Medzi \u010dinnosti ktor\u00e9 IPS vykon\u00e1va pri odhalen\u00ed \u0161kodlivej komunik\u00e1cie patr\u00ed:<\/p>\n<ul>\n<li>Upozornenie spr\u00e1vcu na v\u00fdskyt bezpe\u010dnostn\u00e9ho probl\u00e9mu<\/li>\n<li>Zahodenie \u0161kodliv\u00fdch (resp. podozriv\u00fdch) packetov<\/li>\n<li>Blokovanie komunik\u00e1cie z\u00a0danej IP adresy odosielate\u013ea<\/li>\n<li>Resetovanie \/ obnovenie spojenia<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>Ke\u010f\u017ee IPS je zariadenie raden\u00e9 priamo do sie\u0165ovej komunik\u00e1cie a\u00a0svoju \u010dinnos\u0165 vykon\u00e1va v\u00a0re\u00e1lnom \u010dase, mus\u00ed pracova\u0165 r\u00fdchlo a\u00a0efekt\u00edvne, aby zbyto\u010dne neza\u0165a\u017eoval sie\u0165 a\u00a0nezni\u017eoval tak jej v\u00fdkon. IPS mus\u00ed by\u0165 tie\u017e schopn\u00e9 rozl\u00ed\u0161i\u0165, \u010di sa skuto\u010dne jedn\u00e1 o\u00a0\u0161kodliv\u00fa komunik\u00e1ciu, aby sa predi\u0161lo probl\u00e9mom pri komunik\u00e1cii sp\u00f4soben\u00fdmi pr\u00e1ve \u010dinnos\u0165ami ktor\u00e9 vykon\u00e1va IPS pri detekcii nechcenej komunik\u00e1cie.<\/p>\n<h2><\/h2>\n<p>&nbsp;<\/p>\n<h2><strong>Detek\u010dn\u00e9 mechanizmy<\/strong><\/h2>\n<hr \/>\n<h2><\/h2>\n<p>IPS vyu\u017e\u00edva mnoho met\u00f3d pre vyh\u013ead\u00e1vanie \u00fatokov na zranite\u013en\u00e9 miesta syst\u00e9mu. Spome\u0148me tie mechanizmy, ktor\u00e9 s\u00fa v\u00a0IPS\/IDS syst\u00e9moch pou\u017e\u00edvan\u00e9 naj\u010dastej\u0161ie.<\/p>\n<h3><strong>Porovn\u00e1vanie vzoriek (signature based) <\/strong><\/h3>\n<p>Detek\u010dn\u00fd mechanizmus je zalo\u017een\u00fd na vyh\u013ead\u00e1van\u00ed fixn\u00fdch sekvenci\u00ed znakov v\u00a0pakete ktor\u00e9 s\u00fa typick\u00e9 pre niektor\u00e9 druhy sie\u0165ov\u00fdch \u00fatokov. Ako u\u017e samotn\u00fd n\u00e1zov detek\u010dn\u00e9ho mechanizmu nazna\u010duje, jedn\u00e1 sa o zna\u010dne nepru\u017en\u00fa, av\u0161ak jednoduch\u00fdm sp\u00f4sobom pou\u017eite\u013en\u00fa met\u00f3du. Syst\u00e9m IPS m\u00e1 v\u00a0tomto pr\u00edpade svoj vlastn\u00fd slovn\u00edk \u201ezna\u010diek\u201c, ktor\u00fd si postupne automaticky dop\u013a\u0148a. IPS monitoruje sie\u0165ov\u00fd tok a\u00a0pokia\u013e n\u00e1jde v\u00a0komunik\u00e1cii zna\u010dku, ktor\u00e1 je zhodn\u00e1 s\u00a0tou v\u00a0slovn\u00edku, vykon\u00e1 ur\u010dit\u00fa pr\u00edslu\u0161n\u00fa oper\u00e1ciu<\/p>\n<p>V mnoh\u00fdch pr\u00edpadoch je vzorka porovnate\u013en\u00e1 len vtedy, ak je podozriv\u00fd paket priraden\u00fd konkr\u00e9tnej slu\u017ebe, pr\u00edpadne (pri po\u017eiadavke na vy\u0161\u0161iu presnos\u0165 detekcie) je paket cielen\u00fd na konkr\u00e9tny port, alebo prich\u00e1dzaj\u00faci z konkr\u00e9tneho zdrojov\u00e9ho portu. To umo\u017e\u0148uje zn\u00ed\u017ei\u0165 po\u010det vykonan\u00fdch kontrol nad ka\u017ed\u00fdm paketom, ale zvy\u0161uje to n\u00e1ro\u010dnos\u0165 detekcie pri protokoloch, ktor\u00e9 sa neodkazuj\u00fa na zn\u00e1me porty (napr. Tr\u00f3jske kone a nimi vyvolan\u00e9 toky \u00fadajov, ktor\u00e9 si aplik\u00e1cie zvy\u010dajne sami pres\u00favaj\u00fa pod\u013ea potreby).<\/p>\n<p>\u0160trukt\u00fara mechanizmu porovn\u00e1vania vzoriek je pribli\u017ene nasledovn\u00e1:<\/p>\n<p><span style=\"color: #3366ff;\"><em>Ak je TCP paket typu IPv4, cie\u013eov\u00fd port je 2222 a \u00fadaje obsahuj\u00fa re\u0165azec znakov \u201cpqr\u201d spust\u00ed sa reakcia.<\/em><\/span><\/p>\n<p>Tento pr\u00edklad detek\u010dn\u00e9ho mechanizmu zalo\u017een\u00e9ho na porovn\u00e1van\u00ed vzoriek je samozrejme ve\u013emi zjednodu\u0161en\u00fd. V skuto\u010dnosti sa do vzorky vklad\u00e1 i \u0161pecifick\u00fd \u0161tartovac\u00ed a ukon\u010dovac\u00ed bod pre detekciu v r\u00e1mci paketu, pr\u00edpadne s\u00fa \u0161pecifikovan\u00e9 TCP pr\u00edznaky pre pakety na ktor\u00e9 m\u00e1 by\u0165 bran\u00fd oh\u013ead.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>V\u00fdhody: <\/strong><\/p>\n<ul>\n<li>T\u00e1to technika je ve\u013emi jednoduchou, a\u017e primit\u00edvnou cestou pre detekciu prienikov.<\/li>\n<li>Umo\u017e\u0148uje priamu korel\u00e1ciu exploitov pod\u013ea ve\u013emi \u0161pecifickej vzorky.<\/li>\n<li>Spo\u013eahlivej\u0161ie hl\u00e1si presne \u0161pecifikovan\u00fa vzorku.<\/li>\n<li>Je aplikovate\u013en\u00e1 naprie\u010d v\u0161etk\u00fdmi protokolmi.<\/li>\n<\/ul>\n<p><strong>Nev\u00fdhody: <\/strong><\/p>\n<ul>\n<li>T\u00e1to met\u00f3da m\u00f4\u017ee vies\u0165 k vy\u0161\u0161iemu mno\u017estvu falo\u0161n\u00fdch hl\u00e1sen\u00ed, ktor\u00e9 nie s\u00fa toto\u017en\u00e9 s hl\u00e1seniami, ktor\u00e9 boli o\u010dak\u00e1van\u00e9 v opise signat\u00far.<\/li>\n<li>Ak\u00e9ko\u013evek modifik\u00e1cie \u00fatoku m\u00f4\u017eu vies\u0165 k opomenutiu detekcie incidentu\u00a0 (false negative).<\/li>\n<li>M\u00f4\u017ee vy\u017eadova\u0165 nieko\u013eko r\u00f4znych signat\u00far pre obsluhu toho ist\u00e9ho typu ohrozenia. R\u00f4zne n\u00e1stroje \u00fatoku generuj\u00fa potrebu mnohorak\u00fdch signat\u00far.<\/li>\n<li>Je zvy\u010dajne limitovan\u00e1 na detekciu jednoduch\u00e9ho paketu a z toho d\u00f4vodu nepodporuje dostato\u010dn\u00fdm sp\u00f4sobom detekciu incidentov v pr\u00fade \u00fadajov (napr. v protokole HTTP). Tento scen\u00e1r nepriamo podporuje jednoduch\u00e9 pou\u017eitie tzv. \u201evyh\u00fdbac\u00edch\u201c (evasion) techn\u00edk \u00fatokov.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h3><strong>Anal\u00fdza odch\u00fdlok (anomaly based) <\/strong><\/h3>\n<p>Met\u00f3da \u0161tatistickej anal\u00fdzy odch\u00fdlok je zalo\u017een\u00e1 na vyh\u013ead\u00e1van\u00ed takej sie\u0165ovej prev\u00e1dzky, ktor\u00e1 je odli\u0161n\u00e1 od prev\u00e1dzky ozna\u010denej za \u201enorm\u00e1lnu\u201c. Pri <strong>tomto mechanizme <\/strong>detekcii, je najprv vytvoren\u00fd obraz norm\u00e1lneho prev\u00e1dzkov\u00e9ho stavu siete a\u00a0ten je potom periodicky porovn\u00e1van\u00fd s\u00a0aktu\u00e1lnym stavom siete. IPS takto dok\u00e1\u017ee detekova\u0165 anom\u00e1lie v\u00a0sie\u0165ovej komunik\u00e1cii a\u00a0vykona\u0165 pr\u00edslu\u0161n\u00e9 opatrenia pre ochr\u00e1nenie syst\u00e9mu. Najv\u00e4\u010d\u0161\u00edm probl\u00e9mom tejto metodiky je prvotn\u00e1 defin\u00edcia \u201enorm\u00e1lnej\u201c prev\u00e1dzky.<\/p>\n<p>Niektor\u00e9 syst\u00e9my maj\u00fa pevne stanoven\u00e9 defin\u00edcie norm\u00e1lu a na z\u00e1klade toho m\u00f4\u017eu by\u0165 hodnoten\u00e9 heuristick\u00fdmi met\u00f3dami. Niektor\u00e9 syst\u00e9my s\u00fa vybudovan\u00e9 tak, aby sa po implement\u00e1cii postupne dostali do norm\u00e1lu, pri\u010dom ich v\u00fdhodou je, \u017ee s\u00fa schopn\u00e9 eliminova\u0165 mo\u017enos\u0165 nevhodnej klasifik\u00e1cie abnorm\u00e1lneho spr\u00e1vania za norm\u00e1lne.<\/p>\n<p>Ak je vzorka sledovanej prev\u00e1dzky pova\u017eovan\u00e1\u00a0 za norm\u00e1lnu, syst\u00e9m mus\u00ed rozhodn\u00fa\u0165, ak\u00fdm sp\u00f4sobom rozl\u00ed\u0161i\u0165\u00a0 medzi povolen\u00fdmi odch\u00fdlkami a odch\u00fdlkami ktor\u00e9 nie s\u00fa povolen\u00e9, alebo ktor\u00e9 m\u00f4\u017eu predstavova\u0165 prebiehaj\u00faci \u00fatok. Aplik\u00e1cie v tejto oblasti s\u00fa preva\u017ene akademick\u00e9, i ke\u010f existuje aj nieko\u013eko komer\u010dn\u00fdch produktov, ktor\u00e9 pou\u017e\u00edvaj\u00fa met\u00f3du anal\u00fdzy odch\u00fdlok.<\/p>\n<p>Podkateg\u00f3riou tohoto typu detekcie s\u00fa <strong>met\u00f3dy zalo\u017een\u00e9 na detekcii profilov (profile-based analysis)<\/strong>. Tieto syst\u00e9my maj\u00fa hl\u00e1senia zalo\u017een\u00e9 na zmen\u00e1ch sp\u00f4sobu ak\u00fdm prebieha interakcia pou\u017e\u00edvate\u013eov a siete. Druhy tejto interakcie sp\u00f4sobuj\u00fa mnoh\u00e9 podobn\u00e9 limit\u00e1cie a na z\u00e1klade t\u00fdchto zmien je mo\u017en\u00e9 odvodi\u0165 a definova\u0165 jednotliv\u00e9 profily.<\/p>\n<p>Zauj\u00edmav\u00e9 fakty m\u00f4\u017eu by\u0165 odvoden\u00e9 z trendov\u00fdch \u00fadajov, pri\u010dom tieto s\u00fa schopn\u00e9 odhali\u0165 prebiehaj\u00faci\u00a0 \u00fatok na z\u00e1klade uveden\u00e9ho algoritmu.<\/p>\n<p>Inform\u00e1cie, ktor\u00e9 tieto syst\u00e9my poskytuj\u00fa s\u00fa v\u0161ak vo v\u0161eobecnosti ve\u013emi ne\u0161pecifick\u00e9 a ak maj\u00fa by\u0165 uveden\u00e9 do spr\u00e1vneho kontextu, je nutn\u00e9 v\u017edy ich \u010fal\u0161ie do\u0161etrenie.<\/p>\n<p>V niektor\u00fdch pr\u00edpadoch s\u00fa hranice medzi jednotliv\u00fdmi metodikami rozostret\u00e9, preto\u017ee mnoh\u00e9 prostriedky pre dek\u00f3dovanie protokolov upozor\u0148uj\u00fa pou\u017e\u00edvate\u013ea na pr\u00edtomnos\u0165 poru\u0161enia pravidiel protokolu, ktor\u00e9 nemusia priamo s\u00favisie\u0165 s konkr\u00e9tnym typom \u00fatoku, av\u0161ak sa zdaj\u00fa by\u0165 \u201eneobvykl\u00e9\u201c (napr. detekcia mo\u017en\u00e9ho prete\u010denia z\u00e1sobn\u00edka). V takomto pr\u00edpade detek\u010dn\u00e9 prostriedky udr\u017euj\u00fa datab\u00e1zu atrib\u00fatov syst\u00e9mu pre detekciu anom\u00e1li\u00ed.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>V\u00fdhody: <\/strong><\/p>\n<ul>\n<li>Ak je t\u00e1to met\u00f3da spr\u00e1vne implementovan\u00e1, dok\u00e1\u017ee detegova\u0165 nezn\u00e1me typy \u00fatokov.<\/li>\n<li>Vy\u017eaduje si minim\u00e1lne n\u00e1klady, preto\u017ee nemusia by\u0165 vyv\u00edjan\u00e9\u00a0 nov\u00e9 typy signat\u00far.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p><strong>Nev\u00fdhody: <\/strong><\/p>\n<ul>\n<li>Vo v\u0161eobecnosti tieto syst\u00e9my nie s\u00fa schopn\u00e9 extrahova\u0165 a poskytn\u00fa\u0165 pre \u010fal\u0161iu anal\u00fdzu \u201e\u00fato\u010dn\u00e9\u201c \u00fadaje v akomko\u013evek rozl\u00ed\u0161en\u00ed.<\/li>\n<li>Met\u00f3da je ve\u013emi z\u00e1visl\u00e1 od prostredia, v r\u00e1mci ktor\u00e9ho je prev\u00e1dzka ozna\u010den\u00e1 za norm\u00e1lnu.<\/li>\n<\/ul>\n<h3><\/h3>\n<h3><\/h3>\n<p>&nbsp;<\/p>\n<h3><strong>Dek\u00f3dovanie protokolov <\/strong><\/h3>\n<p>Algoritmus dek\u00f3dovania protokolov je v mnoh\u00fdch oh\u013eadoch inteligentnej\u0161\u00edm roz\u0161\u00edren\u00edm stavov\u00e9ho porovn\u00e1vania vzoriek.<\/p>\n<p>T\u00e1to trieda signat\u00far je implementovan\u00e1 pomocou detekcie protokolu. Akon\u00e1hle je identifikovan\u00fd protokol, IDS vyh\u013ead\u00e1 pr\u00edpadn\u00e9 priestupky vo\u010di pravidl\u00e1m, ktor\u00e9 s\u00fa definovan\u00e9 v konkr\u00e9tnom RFC.<\/p>\n<p>V niektor\u00fdch pr\u00edpadoch s\u00fa tieto poru\u0161enia pravidiel n\u00e1jden\u00e9 pomocou porovn\u00e1vania vzoriek priamo v r\u00e1mci \u0161pecifick\u00e9ho po\u013ea protokolu, ale niektor\u00e9 si vy\u017eaduj\u00fa pokro\u010dilej\u0161ie techniky ktor\u00e9 opisuj\u00fa premenn\u00e9 spolu s\u00a0 d\u013a\u017ekou\u00a0 po\u013ea, pr\u00edpadne i s po\u010dtom argumentov.<\/p>\n<p>Je potrebn\u00e9 si uvedomi\u0165, \u017ee porovn\u00e1vanie vzoriek a dek\u00f3dovanie protokolov sa navz\u00e1jom nevylu\u010duj\u00fa.<\/p>\n<p>Pre ilustr\u00e1ciu met\u00f3dy je mo\u017en\u00e9 op\u00e4\u0165 pou\u017ei\u0165 pr\u00edklad \u201epqr\u201c \u00fatoku:<\/p>\n<p><span style=\"color: #3366ff;\">N<em>ech z\u00e1kladn\u00fdm protokolom ktor\u00fd je pri \u00fatoku pou\u017eit\u00fd bude fikt\u00edvny BGS protokol a z\u00e1rove\u0148 je predpokladan\u00e1 pr\u00edtomnos\u0165 nepovolen\u00e9ho argumentu \u201cpqr\u201c v poli \u201eType\u201c, protokolu BGS. Pre skomplikovanie pr\u00edpadu je e\u0161te mo\u017en\u00e9 uva\u017eova\u0165, \u017ee po\u013eu \u201eType\u201c predch\u00e1dza pole \u201eBGS Options\u201c s premenlivou d\u013a\u017ekou.\u00a0 Re\u00e1lnymi hodnotami m\u00f4\u017eu by\u0165 napr\u00edklad \u201eopqrs\u201c alebo \u201epqrst\u201c.<\/em><\/span><\/p>\n<p><span style=\"color: #3366ff;\"><em>Pou\u017eitie be\u017en\u00e9ho algoritmu porovn\u00e1vania vzoriek povedie k vygenerovaniu falo\u0161n\u00e9ho hl\u00e1senia, preto\u017ee v\u0161etky hodnoty obsahuj\u00fa sledovan\u00fa vzorku. Navy\u0161e \u2013 vzh\u013eadom na to, \u017ee d\u013a\u017eka po\u013ea m\u00f4\u017ee by\u0165 r\u00f4zna, nie je mo\u017en\u00e9 obmedzi\u0165 falo\u0161n\u00e9 hl\u00e1senia limit\u00e1ciou za\u010diatku a konca sledovanej vzorky.<\/em><\/span><\/p>\n<p><span style=\"color: #3366ff;\"><em>Jedin\u00fdm sp\u00f4sobom, ako sa uisti\u0165, \u017ee re\u0165azec \u201cpqr\u201c bol odovzdan\u00fd prostredn\u00edctvom argumentu BGS \u201eType\u201c je \u00fapln\u00e9 dek\u00f3dovanie protokolu.<\/em><\/span><\/p>\n<p>&nbsp;<\/p>\n<p><strong>V\u00fdhody: <\/strong><\/p>\n<ul>\n<li>Ak je pou\u017eit\u00fd protokol zn\u00e1my, met\u00f3da minimalizuje pravdepodobnos\u0165 falo\u0161ne pozit\u00edvnych hl\u00e1sen\u00ed.<\/li>\n<li>Umo\u017e\u0148uje priamu korel\u00e1ciu exploitov pod\u013ea \u0161pecifickej vzorky.<\/li>\n<li>Umo\u017e\u0148uje zachytenie r\u00f4znych variantov exploitu vzh\u013eadom na svoju rozsiahlos\u0165 a v\u0161eobecnos\u0165.<\/li>\n<li>Spo\u013eahlivo hl\u00e1si poru\u0161enie definovan\u00fdch pravidiel protokolov.<\/li>\n<\/ul>\n<p><strong>Nev\u00fdhody: <\/strong><\/p>\n<ul>\n<li>M\u00f4\u017ee vies\u0165 k vysok\u00e9mu mno\u017estvu falo\u0161ne pozit\u00edvnych hl\u00e1sen\u00ed, pokia\u013e je RFC nejednozna\u010dn\u00e9 a umo\u017e\u0148uje v\u00fdvoj\u00e1rom ur\u010dit\u00fa vo\u013enos\u0165 pri\u00a0 interpret\u00e1cii a implement\u00e1cii met\u00f3dy. Tieto poru\u0161enia pravidiel protokolu s\u00fa ve\u013emi \u010dast\u00e9.<\/li>\n<li>Pre spr\u00e1vnu implement\u00e1ciu parsera si t\u00e1to met\u00f3da vy\u017eaduje dlh\u0161\u00ed \u010das v\u00fdvoja.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>K\u013e\u00fa\u010dov\u00fdm predpokladom efekt\u00edvnej \u010dinnosti IDS\/IPS je z\u00edskanie relevantn\u00fdch inform\u00e1ci\u00ed zo zdrojov rozmiestnen\u00fdch v monitorovanom prostred\u00ed. N\u00e1vrh architekt\u00fary IDS\/IPS je teda z\u00e1visl\u00fd predov\u0161etk\u00fdm na spr\u00e1vnom vyzna\u010den\u00ed sledovanej sie\u0165ovej prev\u00e1dzky.<\/p>\n<p>Touto \u010das\u0165ou seri\u00e1lu o\u00a0sie\u0165ovej bezpe\u010dnosti sme chceli poskytn\u00fa\u0165 poh\u013ead na syst\u00e9my prevencie a\u00a0detekciu prieniku, ktor\u00e9 pom\u00e1haj\u00fa chr\u00e1ni\u0165 intern\u00e9 siete ka\u017edej v\u00e4\u010d\u0161ej spolo\u010dnosti. Sie\u0165ov\u00e9 technol\u00f3gie a\u00a0bezpe\u010dnos\u0165 je skuto\u010dne rozsiahla t\u00e9ma, tak\u017ee \u010fal\u0161ia \u010das\u0165 \u201eSpustite sie\u0165\u201c v\u00a0porad\u00ed u\u017e 4. pr\u00edde \u010doskoro.<\/p>\n<p>&nbsp;<\/p>\n<p>Prv\u00e1 \u010das\u0165: \u00a0\u00a0<a href=\"https:\/\/preventista.sk\/info\/spustite-siet-bezpecnost-a-ine-pojmy\/\" target=\"_blank\">&#8222;Spustite sie\u0165!&#8220; &#8211; bezpe\u010dnos\u0165 a in\u00e9 pojmy<\/a><\/p>\n<p>Druh\u00e1 \u010das\u0165: <a href=\"https:\/\/preventista.sk\/info\/spustite-siet-2-ked-sa-vam-sluzba-odoprie\/\" target=\"_blank\"><span style=\"text-decoration: underline;\">&#8222;Spustite sie\u0165!&#8220; &#8211; ke\u010f sa v\u00e1m slu\u017eba odoprie<\/span><\/a><\/p>\n<p>&nbsp;<\/p>\n<p><strong>Tom\u00e1\u0161 Paulus<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p>Zdroje:<\/p>\n<p>http:\/\/www.networkcomputing.com\/careers-and-certifications\/next-generation-firewalls-101\/a\/d-id\/1234097<\/p>\n<p>https:\/\/www.paloaltonetworks.com\/resources\/learning-center\/what-is-an-intrusion-prevention-system-ips.html<\/p>\n<p>http:\/\/www.fedtechmagazine.com\/article\/2013\/09\/6-network-security-tools-every-agency-needs<\/p>\n<p>http:\/\/searchnetworking.techtarget.com\/definition\/network-access-control<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Spolo\u010dne s\u00a0ka\u017edodenn\u00fdm v\u00fdvojom nov\u00fdch sie\u0165ov\u00fdch technol\u00f3gi\u00ed vstupuj\u00fa do hry tie\u017e nov\u00e9 hrozby, ktor\u00e9 sa sna\u017eia tieto technol\u00f3gie po\u0161kodi\u0165. Dynamick\u00e1 povaha sie\u0165ov\u00fdch \u00fatokov si vy\u017eaduje dynamick\u00fa obranu hne\u010f na nieko\u013ek\u00fdch miestach. Syst\u00e9my pre spr\u00e1vu siete \u010dasto kr\u00e1t disponuj\u00fa mo\u017enos\u0165ou monitorovania sie\u0165ovej prev\u00e1dzky a\u00a0pod\u00e1vaj\u00fa tie\u017e jednotn\u00fd poh\u013ead do internej sie\u0165ovej infra\u0161trukt\u00fary, \u010do poskytuje sie\u0165ov\u00fdm administr\u00e1torom a\u00a0bezpe\u010dnostn\u00fdm technikom [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":2193,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-2189","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-itbezp"],"aioseo_notices":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2014\/07\/spustite-siet-3-cover.jpg?fit=700%2C400&ssl=1","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":1724,"url":"https:\/\/preventista.sk\/info\/spustite-siet-bezpecnost-a-ine-pojmy\/","url_meta":{"origin":2189,"position":0},"title":"&#8222;Spustite sie\u0165!&#8220; &#8211; bezpe\u010dnos\u0165 a in\u00e9 pojmy","author":"T.Paulus","date":"2. janu\u00e1ra 2014","format":false,"excerpt":"Sie\u0165ov\u00e1 bezpe\u010dnos\u0165 \u00a0v skratke Sie\u0165ov\u00e1 bezpe\u010dnos\u0165 je jedn\u00fdm z\u00a0mnoh\u00fdch odborov informatiky. T\u00fdka sa zabezpe\u010denia sieti a\u00a0sie\u0165ov\u00fdch zariaden\u00ed. Zaober\u00e1 sa tie\u017e prevenciou a\u00a0kontrolou neopr\u00e1vnen\u00e9ho pr\u00edstupu alebo prevenciou odcudzenia d\u00e1t. Rie\u0161i tie\u017e napr\u00edklad poskytovanie nepretr\u017eitej slu\u017eby pre opr\u00e1vnen\u00fdch u\u017e\u00edvate\u013eov \u2013 s\u00a0\u010d\u00edm s\u00favis\u00ed aj zabezpe\u010denie proti r\u00f4znym sie\u0165ov\u00fdm \u00fatokom. A\u00a0pr\u00e1ve t\u00fdmi sa bude\u2026","rel":"","context":"V &quot;Bezpe\u010dnos\u0165&quot;","block_context":{"text":"Bezpe\u010dnos\u0165","link":"https:\/\/preventista.sk\/info\/category\/itbezp\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2014\/01\/Networking.jpg?fit=1000%2C999&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2014\/01\/Networking.jpg?fit=1000%2C999&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2014\/01\/Networking.jpg?fit=1000%2C999&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2014\/01\/Networking.jpg?fit=1000%2C999&ssl=1&resize=700%2C400 2x"},"classes":[]},{"id":775,"url":"https:\/\/preventista.sk\/info\/bezpecna-siet-wi-fi\/","url_meta":{"origin":2189,"position":1},"title":"Bezpe\u010dn\u00e1 sie\u0165 Wi-Fi","author":"T.Paulus","date":"31. j\u00fala 2013","format":false,"excerpt":"Je va\u0161a dom\u00e1ca bezdr\u00f4tov\u00e1 sie\u0165 bezpe\u010dn\u00e1? V\u00a0dne\u0161nej dobe plnej smartf\u00f3nov, tabletov a\u00a0kadejak\u00fdch in\u00fdch \u2013ov si u\u017e nedok\u00e1\u017eeme predstavi\u0165 \u017eivot bez pripojenia na internet. \u010casy, kedy ste museli na pripojenie \u010daka\u0165 5 min\u00fat a\u00a0popri tom ste po\u010d\u00favali kr\u00e1snu symf\u00f3niu zvukov V\u00e1\u0161ho modemu s\u00fa u\u017e d\u00e1vno za nami. Vo v\u00e4\u010d\u0161ine pr\u00edpadov je\u2026","rel":"","context":"V &quot;Bezpe\u010dnos\u0165&quot;","block_context":{"text":"Bezpe\u010dnos\u0165","link":"https:\/\/preventista.sk\/info\/category\/itbezp\/"},"img":{"alt_text":"bezpecna-wifi","src":"https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2013\/07\/bezpecna-wifi.jpg?fit=700%2C400&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2013\/07\/bezpecna-wifi.jpg?fit=700%2C400&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2013\/07\/bezpecna-wifi.jpg?fit=700%2C400&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2013\/07\/bezpecna-wifi.jpg?fit=700%2C400&ssl=1&resize=700%2C400 2x"},"classes":[]},{"id":2143,"url":"https:\/\/preventista.sk\/info\/spustite-siet-2-ked-sa-vam-sluzba-odoprie\/","url_meta":{"origin":2189,"position":2},"title":"&#8222;Spustite sie\u0165! 2&#8220; &#8211; Ke\u010f sa v\u00e1m slu\u017eba odoprie","author":"T.Paulus","date":"18. j\u00fala 2014","format":false,"excerpt":"\u00a0 \"Spustite sie\u0165! 2\" -\u00a0Ke\u010f sa v\u00e1m slu\u017eba odoprie Prv\u00e1 \u010das\u0165 n\u00e1m stru\u010dne pribl\u00ed\u017eila problematiku sie\u0165ovej bezpe\u010dnosti a\u00a0s\u00a0\u0148ou s\u00favisiace \u00fatoky na 3 z\u00e1kladn\u00e9 piliere bezpe\u010dnosti \u2013 d\u00f4vernos\u0165, integrita, dostupnos\u0165. Nasleduj\u00faci \u010dl\u00e1nok n\u00e1m podrobne pribl\u00ed\u017ei \u00fatok vo\u010di dostupnosti\u00a0 (DoS, resp. DDoS) a\u00a0tie\u017e sp\u00f4soby ako sa pred t\u00fdmito \u00fatokmi chr\u00e1ni\u0165. \u00a0 DoS\u2026","rel":"","context":"V &quot;Bezpe\u010dnos\u0165&quot;","block_context":{"text":"Bezpe\u010dnos\u0165","link":"https:\/\/preventista.sk\/info\/category\/itbezp\/"},"img":{"alt_text":"DoS","src":"https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2014\/07\/DDoS1.jpg?fit=700%2C300&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2014\/07\/DDoS1.jpg?fit=700%2C300&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2014\/07\/DDoS1.jpg?fit=700%2C300&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2014\/07\/DDoS1.jpg?fit=700%2C300&ssl=1&resize=700%2C400 2x"},"classes":[]},{"id":2583,"url":"https:\/\/preventista.sk\/info\/bezpecne-hranice-cast-1-co-je-to-penetracny-test\/","url_meta":{"origin":2189,"position":3},"title":"Bezpe\u010dn\u00e9 hranice  \u010cas\u0165 1: \u010co je to penetra\u010dn\u00fd test","author":"I. Makatura","date":"16. febru\u00e1ra 2015","format":false,"excerpt":"V\u00fdraz \u201eperimeter\u201c v\u00a0matematike znamen\u00e1 celkov\u00fa d\u013a\u017eku vonkaj\u0161ieho obvodu dvojrozmern\u00e9ho objektu. V\u00a0prenesenom zmysle sa tento v\u00fdraz pou\u017e\u00edva ako \u201ehranica\u201c, teda priestor, ktor\u00fd sa nach\u00e1dza na vonkaj\u0161ej strane hranice vymedzen\u00e9ho objektu. V\u00a0informa\u010dnej bezpe\u010dnosti sa pod pojmom \u201eperimeter\u201c rozumie vonkaj\u0161\u00ed, cudz\u00ed priestor, mimo predmetn\u00e9ho virtu\u00e1lneho prostredia. Naj\u010dastej\u0161ie sa v\u00a0tomto kontexte jedn\u00e1 o\u00a0sie\u0165ov\u00fd perimeter,\u2026","rel":"","context":"V &quot;Bezpe\u010dnos\u0165&quot;","block_context":{"text":"Bezpe\u010dnos\u0165","link":"https:\/\/preventista.sk\/info\/category\/itbezp\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2015\/02\/hranice-1.jpg?fit=700%2C400&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2015\/02\/hranice-1.jpg?fit=700%2C400&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2015\/02\/hranice-1.jpg?fit=700%2C400&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2015\/02\/hranice-1.jpg?fit=700%2C400&ssl=1&resize=700%2C400 2x"},"classes":[]},{"id":2593,"url":"https:\/\/preventista.sk\/info\/bezpecne-hranice-cast-2-penetracne-testy-v-praxi\/","url_meta":{"origin":2189,"position":4},"title":"Bezpe\u010dn\u00e9 hranice  \u010cas\u0165 2: Penetra\u010dn\u00e9 testy v praxi","author":"I. Makatura","date":"17. febru\u00e1ra 2015","format":false,"excerpt":"V\u00a0prvej \u010dasti \u010dl\u00e1nku som op\u00edsal z\u00e1kladn\u00fd pr\u00edstup ku penetra\u010dn\u00e9mu testovaniu a\u00a0rozdelenie typov penetra\u010dn\u00fdch testov. Ako je v\u0161ak penetra\u010dn\u00e9 testovanie vykon\u00e1van\u00e9 v\u00a0praxi? Je jasn\u00e9, \u017ee ak m\u00e1 by\u0165 po\u010d\u00edta\u010dov\u00fa sie\u0165 podroben\u00e1 simul\u00e1cii re\u00e1lneho bezpe\u010dnostn\u00e9ho \u00fatoku, je bezpodmiene\u010dne nutn\u00e9 zapodieva\u0165 sa podrobnou pr\u00edpravou a pl\u00e1novan\u00edm \u010dinnost\u00ed. A\u00a0ak m\u00e1 poctiv\u00fd pentest posl\u00fa\u017ei\u0165 dobrej\u2026","rel":"","context":"V &quot;Bezpe\u010dnos\u0165&quot;","block_context":{"text":"Bezpe\u010dnos\u0165","link":"https:\/\/preventista.sk\/info\/category\/itbezp\/"},"img":{"alt_text":"bezpe\u010dne hranice pic","src":"https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2015\/02\/hranice2.jpg?fit=700%2C400&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2015\/02\/hranice2.jpg?fit=700%2C400&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2015\/02\/hranice2.jpg?fit=700%2C400&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2015\/02\/hranice2.jpg?fit=700%2C400&ssl=1&resize=700%2C400 2x"},"classes":[]},{"id":3406,"url":"https:\/\/preventista.sk\/info\/co-je-to-kyberneticka-bezpecnost\/","url_meta":{"origin":2189,"position":5},"title":"\u010co je to kybernetick\u00e1 bezpe\u010dnos\u0165?","author":"I. Makatura","date":"3. marca 2017","format":false,"excerpt":"\u00a0 Dnes u\u017e zrejme nikto nepochybuje o\u00a0tom, \u017ee \u013eudia s\u00fa na inform\u00e1ci\u00e1ch z\u00e1visl\u00ed. A\u00a0nie je to len z\u00e1vislos\u0165 v\u00a0zmysle poh\u013eadov, neust\u00e1le sklonen\u00fdch ku mobiln\u00fdm telef\u00f3nom. Ve\u010f z\u00e1vislos\u0165 na inform\u00e1ci\u00e1ch sa t\u00fdka u\u017e aj mnoh\u00fdch hospod\u00e1rskych odvetv\u00ed a\u00a0spr\u00e1vy vec\u00ed verejn\u00fdch. Inform\u00e1ci\u00ed je viac, ne\u017e kedyko\u013evek predt\u00fdm, inform\u00e1cie s\u00fa sprac\u00favan\u00e9 r\u00fdchlej\u0161ie a\u2026","rel":"","context":"V &quot;Bezpe\u010dnos\u0165&quot;","block_context":{"text":"Bezpe\u010dnos\u0165","link":"https:\/\/preventista.sk\/info\/category\/itbezp\/"},"img":{"alt_text":"\u010co je to kybernetick\u00e1 bezpe\u010dnos\u0165?","src":"https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2017\/03\/clanok.png?fit=800%2C400&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2017\/03\/clanok.png?fit=800%2C400&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2017\/03\/clanok.png?fit=800%2C400&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/preventista.sk\/info\/wp-content\/uploads\/2017\/03\/clanok.png?fit=800%2C400&ssl=1&resize=700%2C400 2x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/preventista.sk\/info\/wp-json\/wp\/v2\/posts\/2189","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/preventista.sk\/info\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/preventista.sk\/info\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/preventista.sk\/info\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/preventista.sk\/info\/wp-json\/wp\/v2\/comments?post=2189"}],"version-history":[{"count":9,"href":"https:\/\/preventista.sk\/info\/wp-json\/wp\/v2\/posts\/2189\/revisions"}],"predecessor-version":[{"id":2198,"href":"https:\/\/preventista.sk\/info\/wp-json\/wp\/v2\/posts\/2189\/revisions\/2198"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/preventista.sk\/info\/wp-json\/wp\/v2\/media\/2193"}],"wp:attachment":[{"href":"https:\/\/preventista.sk\/info\/wp-json\/wp\/v2\/media?parent=2189"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/preventista.sk\/info\/wp-json\/wp\/v2\/categories?post=2189"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/preventista.sk\/info\/wp-json\/wp\/v2\/tags?post=2189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}