{"id":887,"date":"2013-08-04T09:24:22","date_gmt":"2013-08-04T07:24:22","guid":{"rendered":"http:\/\/preventista.sk\/info\/?p=887"},"modified":"2014-02-04T00:25:39","modified_gmt":"2014-02-03T23:25:39","slug":"autentizace-v-cloudu","status":"publish","type":"post","link":"https:\/\/preventista.sk\/info\/autentizace-v-cloudu\/","title":{"rendered":"Autentizace v cloudu"},"content":{"rendered":"

Pot\u0159eba zaji\u0161t\u011bn\u00ed bezpe\u010dnosti informa\u010dn\u00edch syst\u00e9m\u016f provozovan\u00fdch v prost\u0159ed\u00ed cloudu p\u0159in\u00e1\u0161\u00ed n\u011bkter\u00e9 nov\u00e9 v\u00fdzvy, se kter\u00fdmi jsme se dosud setk\u00e1vali zejm\u00e9na v informa\u010dn\u00edch syst\u00e9mech p\u0159\u00edstupn\u00fdch z ve\u0159ejn\u00e9ho internetu.<\/p>\n

Jak se pravideln\u011b do\u010d\u00edt\u00e1me ve sd\u011blovac\u00edch prost\u0159edc\u00edch, na internetu se \u010d\u00edm d\u00e1l t\u00edm v\u00edce krade identita. N\u011bkter\u00e9 p\u0159\u00edpady vy\u0161et\u0159ovala a n\u011bkter\u00e9 i \u00fasp\u011b\u0161n\u011b vy\u0161et\u0159ila policie, podle n\u00e1zoru v\u011bt\u0161iny analytik\u016f se jedn\u00e1 o p\u0159\u00edslove\u010dnou \u0161pi\u010dku ledovce. Pokud \u00fato\u010dn\u00edk z\u00edsk\u00e1 p\u0159\u00edstup k na\u0161emu osobn\u00edmu e-mailov\u00e9mu \u00fa\u010dtu, m\u016f\u017ee to pro n\u00e1s znamenat citeln\u00e9 nep\u0159\u00edjemnosti v osobn\u00edm \u017eivot\u011b. Daleko z\u00e1va\u017en\u011bj\u0161\u00ed d\u016fsledky ale m\u016f\u017ee m\u00edt pr\u016fnik do firemn\u00edho informa\u010dn\u00edho syst\u00e9mu nebo informa\u010dn\u00edho syst\u00e9mu ve\u0159ejn\u00e9 spr\u00e1vy obsahuj\u00edc\u00edho nap\u0159\u00edklad z\u00e1kaznick\u00e1 data (hostovan\u00e9 CRM), bankovn\u00ed transakce (elektronick\u00e9 bankovnictv\u00ed), osobn\u00ed \u00fadaje (port\u00e1ly pro uchaze\u010de o zam\u011bstn\u00e1n\u00ed) nebo dokumenty se z\u00e1va\u017en\u00fdm pr\u00e1vn\u00edm dopadem (webov\u00fd p\u0159\u00edstup k firemn\u00edmu e-mailu, Datov\u00e9 schr\u00e1nky).<\/p>\n

Z uveden\u00e9ho vypl\u00fdv\u00e1, \u017ee pokud chceme prost\u0159ed\u00ed cloudu vyu\u017e\u00edt pro provozov\u00e1n\u00ed informa\u010dn\u00edch syst\u00e9m\u016f obsahuj\u00edc\u00edch i jin\u00e1 data ne\u017e zcela ve\u0159ejn\u00e1, mus\u00edme se d\u016fsledn\u011b zab\u00fdvat ochranou takov\u00fdch syst\u00e9m\u016f p\u0159ed neopr\u00e1vn\u011bn\u00fdm p\u0159\u00edstupem.
\nAutentizace u\u017eivatele je proces ov\u011b\u0159en\u00ed jeho proklamovan\u00e9 identity. Silnou v\u00edcefaktorovou autentizac\u00ed pak rozum\u00edme proces vyu\u017e\u00edvaj\u00edc\u00ed krom\u011b jm\u00e9na a hesla n\u011bjak\u00fd dal\u0161\u00ed faktor, zpravidla vlastnictv\u00ed identifika\u010dn\u00edho p\u0159edm\u011btu (kryptografick\u00e9ho tokenu nebo \u010dipov\u00e9 karty), pop\u0159\u00edpad\u011b biometrii.<\/p>\n

Autentiza\u010dn\u00ed tokeny lze pro n\u00e1\u0161 \u00fa\u010del hrub\u011b rozd\u011blit do dvou skupin. Prvn\u00ed se ozna\u010duje jako CBA (Certificate Based Authentication), ve kter\u00e9 se vyu\u017e\u00edv\u00e1 asymetrick\u00e9 kryptografie. Sem pat\u0159\u00ed nap\u0159\u00edklad USB tokeny \u0159ady iKey nebo eToken a kryptografick\u00e9 \u010dipov\u00e9 karty. Druh\u00e1 skupina se naz\u00fdv\u00e1 OTP (One Time Password), kdy je v tokenu pro ka\u017ed\u00e9 p\u0159ihl\u00e1\u0161en\u00ed generov\u00e1no unik\u00e1tn\u00ed jednor\u00e1zov\u00e9 heslo.
\nZ pohledu u\u017eivatelsk\u00e9ho komfortu, investi\u010dn\u00edch a provozn\u00edch n\u00e1klad\u016f je pro cloudov\u00e9 slu\u017eby vhodn\u011bj\u0161\u00ed volbou autentizace s vyu\u017eit\u00edm metody OTP. OTP tokeny maj\u00ed toti\u017e tu v\u00fdhodu, \u017ee se u\u017eivatel nemus\u00ed starat o obnovu certifik\u00e1t\u016f, rovn\u011b\u017e nen\u00ed pot\u0159eba na stran\u011b klienta instalovat \u017e\u00e1dn\u00fd dodate\u010dn\u00fd software. OTP token nem\u00e1 \u017e\u00e1dn\u00e9 konektory. Nalezneme na n\u011bm pouze tla\u010d\u00edtko a display, ze kter\u00e9ho u\u017eivatel p\u0159i ka\u017ed\u00e9m p\u0159ihl\u00e1\u0161en\u00ed op\u00ed\u0161e vygenerovan\u00fd jednor\u00e1zov\u00fd k\u00f3d do p\u0159ihla\u0161ovac\u00edho formul\u00e1\u0159e. P\u0159ihla\u0161ov\u00e1n\u00ed OTP tokenem tak p\u0159in\u00e1\u0161\u00ed u\u017eivateli v\u00edtanou flexibilitu, pokud se nap\u0159\u00edklad pot\u0159ebuje p\u0159ihl\u00e1sit do cloudov\u00e9 aplikace z mobiln\u00edho telefonu \u010di tabletu.<\/p>\n

Proto\u017ee cloud je zalo\u017een na outsourcingu infrastruktury, nab\u00edz\u00ed se logicky mo\u017enost provozovat autentiza\u010dn\u00ed \u0159e\u0161en\u00ed jako slu\u017ebu rovn\u011b\u017e v prost\u0159ed\u00ed cloudu. V\u00fdhody takov\u00e9ho \u0159e\u0161en\u00ed jsou zjevn\u00e9. Nam\u00edsto budov\u00e1n\u00ed vlastn\u00ed infrastruktury vyu\u017e\u00edv\u00e1me infrastrukturu poskytovatele, kter\u00e1 dosahuje \u0161pi\u010dkov\u00e9 \u00farovn\u011b zabezpe\u010den\u00ed a dal\u0161\u00edch parametr\u016f SLA. V\u00fdhodou autentizace formou slu\u017eby je \u00faspora investi\u010dn\u00edch n\u00e1klad\u016f na licence autentiza\u010dn\u00edho \u0159e\u0161en\u00ed a infrastrukturu. Dal\u0161\u00ed v\u00fdznamnou v\u00fdhodou je vysok\u00e1 rychlost implementace (podle slo\u017eitosti prost\u0159ed\u00ed z\u00e1kazn\u00edka jednotky hodin a\u017e jednotky dn\u016f). Implementace cloudov\u00e9ho autentiza\u010dn\u00edho \u0159e\u0161en\u00ed toti\u017e v podstat\u011b znamen\u00e1 pouze vytvo\u0159en\u00ed nov\u00e9 instance, customizaci jej\u00edch parametr\u016f, nastaven\u00ed rozhran\u00ed na adres\u00e1\u0159ov\u00e9 slu\u017eby a aplikace, kter\u00e9 budou autentiza\u010dn\u00ed \u0159e\u0161en\u00ed vyu\u017e\u00edvat. Posledn\u00edm krokem je import u\u017eivatelsk\u00fdch \u00fa\u010dt\u016f.<\/p>\n

Autentizaci formou slu\u017eby nab\u00edzej\u00ed nap\u0159\u00edklad spole\u010dnosti SafeNet pod ozna\u010den\u00edm SafeNet Authentication Service (SAS) a Symantec pod ozna\u010den\u00edm Validation and ID Protection Service (VIP).<\/p>\n

Konkr\u00e9tn\u00ed p\u0159\u00edklad fungov\u00e1n\u00ed autentizace formou slu\u017eby m\u016f\u017eeme ilustrovat na syst\u00e9mu SafeNet Authentication Service. Tato autentiza\u010dn\u00ed slu\u017eba b\u011b\u017e\u00ed v prost\u0159ed\u00ed \u0161pi\u010dkov\u011b zabezpe\u010den\u00fdch (Tier IV, PCI DSS, ISO 27001, …) geograficky redundantn\u00edch datov\u00fdch center ve Velk\u00e9 Brit\u00e1nii a v Kanad\u011b. Autentiza\u010dn\u00ed slu\u017eba SAS poskytuje n\u011bkolik mo\u017enost\u00ed jak spolupracovat s komponentami informa\u010dn\u00edch syst\u00e9m\u016f, jejich\u017e ochranu zabezpe\u010duje. Pro integraci s komponentami jako jsou Single Sign-on nebo VPN se nej\u010dast\u011bji pou\u017e\u00edv\u00e1 protokol RADIUS, cloudov\u00e9 aplikace obvykle vyu\u017e\u00edvaj\u00ed protokolu SAML. D\u00e1le jsou k dispozici agenti pro b\u011b\u017en\u011b pou\u017e\u00edvan\u00e9 aplikace a prost\u0159ed\u00ed jako nap\u0159. Office 365, Outlook, Citrix apod. Pro p\u0159\u00edpad, \u017ee aplikace nezapad\u00e1 do \u017e\u00e1dn\u00e9 z p\u0159edchoz\u00edch kategori\u00ed, je k dispozici autentiza\u010dn\u00ed API, jeho\u017e vyu\u017eit\u00edm lze vytvo\u0159it vlastn\u00edho agenta na m\u00edru p\u0159\u00edslu\u0161n\u00e9 aplikaci.<\/p>\n

\"SAS_schema3\"<\/a><\/p>\n

Pokud se tedy chyst\u00e1me p\u0159esunout \u010d\u00e1st firemn\u00ed IT infrastruktury do prost\u0159ed\u00ed cloudu, je vhodn\u00e9 k tomu vyu\u017e\u00edt cloudov\u00fdch slu\u017eeb jako nap\u0159. Office 365, Google Apps, salesforce.com apod. ve spojen\u00ed se silnou autentizac\u00ed. Vyu\u017eit\u00edm autentizace formou slu\u017eby n\u00e1m odpadnou starosti s provozem hardwaru a dal\u0161\u00ed infrastruktury. A\u010dkoliv ekonomick\u00e1 v\u00fdhodnost vyu\u017eit\u00ed cloudov\u00fdch technologi\u00ed nemus\u00ed b\u00fdt patrn\u00e1 na prvn\u00ed pohled, p\u0159i zohledn\u011bn\u00ed v\u0161ech u\u0161et\u0159en\u00fdch n\u00e1klad\u016f na implementaci a provoz vlastn\u00edho autentiza\u010dn\u00edho \u0159e\u0161en\u00ed m\u016f\u017ee znamenat zaj\u00edmavou \u00fasporu zdroj\u016f a \u010dasu.<\/p>\n

 <\/p>\n

Vojta Gaman a Petr Slaba<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

Pot\u0159eba zaji\u0161t\u011bn\u00ed bezpe\u010dnosti informa\u010dn\u00edch syst\u00e9m\u016f provozovan\u00fdch v prost\u0159ed\u00ed cloudu p\u0159in\u00e1\u0161\u00ed n\u011bkter\u00e9 nov\u00e9 v\u00fdzvy, se kter\u00fdmi jsme se dosud setk\u00e1vali zejm\u00e9na […]<\/p>\n","protected":false},"author":1,"featured_media":1948,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[4],"tags":[74,32],"class_list":["post-887","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-itbezp","tag-autentizacia","tag-bezpecnost"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t