niy khien eho cic td chirc mit nhieu thdi gian vi cdng sire cua eae quan tti vien Cdngnghe thdng tin (CNTT), keo theo ting chi phi cua td chirc vi die biet li rat dd xay ra sai sdt Chuydn gia anh ninh mang Dell SecureWorks da nghidn cim cae trudng hop cu the trong thuc td vi dua ra 5 khuyen nghi 0up quan ly tudng lua hidu qua. Bai bio gioi thieu nhiing khuyen nghi quan trong niy.
Firvwall
dli cdc quy tde FirewaU. Boi theo quy luat tu nhien thi viec thay doi la yeu to can thiit cho sy phdt tiien cua mdt tl chflc va phdn dnh sy thay dli ttong mdi tmong bao mat hoac rdiu eau phdt sirdi ttong co sd ngudi dflng. Nlu ban chl su thay ddi ttong quan ly FirewaU eo the lam suy yeu chue nang eua mgng, md ra nhung ll hing an nirdi trong mang vd can ttd sy phdt triin ttong tuong lai cua mdt to chflc. Tuy nhidn, nlu khdng co mdt sy rdiin nhdn rd rang vl nhflng Oiay dli ttong kl hoach quan ly tham chi xem vide tiiay dli quy tde trdn FirewaU la don gian CO the lam anh hudng toi mgng eua mdt tl ehue.
Vide thay dli kl hogch quan ly Id dl giam tiiilu riii ro. Do vay, mpt sy thay dli dupc ddnh gia la hieu qua khi nd thu tiidp dupe cac so Udu quan ttpng trong qua tiirdi thay dli eae quy tac tmy cap. Vi dy rdiu sy giam luu lupng IP dot ngpt hpac gia tang bat
ngd d cdc khu vyc cy thi. Nhiing tham si nhu vdy s6 giflp xdc dirdi rdiflng thdt bgi vd nhupe dilm trong khi thay dli quy tde Firewall. Kiiu 0dm sdt ndy cl thi cung cdp ednh bdo sdm vl cdc khd ndng thiiu hyt hodc rdiflng tde d|ng dli vH cdc mfle dich vy vd h | tiling tiien chit. Ngodi ra, nl cflng cung cdp ban ghi Mim nghi|m dl ddnh gid sy tiidnh cing hay tiidt bgi cua m|t logt cdc tiigy dli nhdm giflp so sdrdi tirdi hi|u qud so vdi tindc khi thay dli. Cy till, khi thay dli m|t kl hogch qudn ly edn:
- Thiit ldp m|t phuang phdp dupc chdp nhdn dl ydu cdu thay dli chirdi sdeh vd ddt ra cdc ydu cdu chinh sdeh
- Thyc hidn gidm sdt hpp ly, xdc dinh nhflng nguli cl thi vd khdng thi uy quyin che m|t sy thay dli
- Quan ly tudng lua tdp trung dl tgc hi|u qua, ede ehinh sdeh thyc thi vd phdn phii
- Md ta cdc thdng tin Udn Igc cdn thiit vd cdc dilm phii hpp hdi hoa dl xu ly hpp ly eho bdt ky thay doi ndo
- Tgo ra m|t cdch Mim nghidm dl theo ddi cdc yeu cdu, hdnh ddng vd kit qua cua m|t sy thay dli tudng lua
Tuy nhidn, thay dli cdch qudn ly khdng chi dli hoi mdt tdp hpp cdc cdng cu phdn mim md nl d n la m|t qud trinh thyc thi ky ludt ttdn mgng vd ydu cdu phai cl thia thudn tfl tdt cd mpi nguli ttuy cdp t n cdu hmh FuewaU. Nlu khdng cl thing tin Uln Ige rd rdng vl chirdi sdeh vd uu tidn, thi m|t h | thing qudn ly thay dli cull cimg s& bi suy yiu bdi ehmh hdrdi vi eua nguli tiny edp mgng.
2. KIEM TRA CAC THAY D O I FIREWALL T R U a C K H I AP DUNG
Sy thay dli quy tde Firewall cl thi ldm xudt hi|n riii ro Mnh doanh. M|t sy gidn dodn ttong Mnh doanh co thi ldm thiit hai Mnh tl eho t l chflc. Mfle
IFACE: « t h l IP: 192.168.0.2
FIREWALL
IFACE: ethO IP: 194.236.S0.155
tiiilt hgi ude tinh Id nhiiu hon so vii Mnh phi md tl chflc dl bl ra Ai thu nghi|m m|t edu hbih tindc khi nl dupc dp dyng thyc tl cho mgng cua hp. Hon nfla nlu khing thyc hi|n vi|c Mim tta ddy du cdc thay dli el thi ddn din nhiing vdn dl nhu ttl mgng hodc ldm mdt tinh hodn chlnh cua mgng.
Do vdy, cdn thdn ttpng vd ttdnh tii da vi|c chiidi sua cde quy tde FirewaU ttdn cde thllt bi dang van hdnh bap v | h | thing mgng cua bdt ky t l chflc ndo.
M|t gidi phdp cl thi Id Mim tta nhung thay dli ttong m|t sandbox do tuong ty nhu h | thing cua bgn, chgy nhu m|t mdi trudng thi nghidm. Nhiing thiit bi ndy ndn dupc tdch bi|t ra khii h | thing dang vdn hdnh cua t l chflc. Sy tdch bi|t ndy d thi Id thyc hi|n ti*n m|t cdu ttflc vdt ly hoac thdng qua m|t cdu hinh 0ao di|n mgng khdng ddy du.
Nlu thyc tl khing thi duy tii m|t mdi tining thu nghiim thi nhflng thay dli chinh sdeh hay quy tde cl thi dupc thyc hi|n trdn m|t giao di|n qudn ly tinng tdm vd md r|ng nhu Id m|t sy cdp nhdt chirdi sdeh cho FirewaU. Ldm nhu vdy cho phip quay ttd Igi kl hogch qudn ly cfl dl ddng hon so voi vide thyc hi|n thay dli cdu tnic vdt ly vi khi nay d thi phdi tiin hdnh nhiiu Mim tta hon trade khi dp dyng vdo tiiyc tl.
Ndn ddnh nhiiu thii 0an dl thuc hidn thu nghiem cdn thdn tindc khi thyc hidn mdt thay dli vl cdu
hinh FirewaU. Cdc kl hogch Uiu nghidm nhflng thgy dli Fuewall ndn:
- Xem xit Igi chuih sach an ninh cua tdt ed cdc thiit bi trdn mgng cho phfl hpp cflng nhu el kl hogeh chuyin dli dy phing vd phyc hii
- Dam bao rdng cdc tiring lua ty nl da du bdo mdt tmy cdp
- Thyc hi|n Mim tta ttdn dft U|u bdn trong vd bdn ngodi mgng cua tl chflc bdng cdch su dyng m|t gii sniffer thich hpp
- Hay Mim chflng chdc chdn rdng FirewaU eho phip vd ngan ehan dft U|u theo cde ehmh sdeh vd bd quy tde da tiiilt ldp
- Hodn thdnh Mim tta hidu sudt dl xdc dirdi cdch nang cao hay ldm gidm bdt hogt ddng mang cua mdt cdu hinh moi, dac bidt dli voi mgng ridng do (VPN)
- Kiim tta tuih tuong thieh eung rdiu kha nang tuong tde cua cdc FirewaU vdi cdc flng dyng vd thiit bi khdc ttdn mang, dac biet la tfl cde nguin vd nhd cung cap khdng ding nhdt
- Tgo mpt cdch Mim nghidm di phan tich xu huong vd nguyen nhan co ban.
Ngodi ra, mdt vdn dl khdc edn dupe dl cap din do Id viec cdc he thing FuewaU da ngimg san xudt nhung vdn cl khd nbilu cdc cdng ty dang su dyng rdiung hd thing FirewaU ndy. Boi nhirng h | thing nay ehfla cde kha nang quan ly bdn vd gioi ban nen cl the giflp quan ly rdiung thay dli nhdt qudn ttong cdc mgng ttdn mdt Uch trinh dupc bilt trade vd ngan chgn nhung thay dli khdng mcng muln vdo cdu hinh hidn tgi cua mgng, hgn chl cdc ca hdi md mpt sy thay dli se lam suy yiu chflc nang. Mac dfl vay, nhiing edng ty nay cung ndn el nhiing kl hogch thu nghiem rdiung thay dli FirewaU dl el thi dli pho Mp thoi voi rdiiing tudi hulng an nudi ttong tuong lai.
3. DLT PHONG CAU H I N H FIREWALL JRlSaC K H I THU'C H I E N THAY D O I CAC QUY TAC
Nhiing vdn dl tii t | nhdt khi tiiay dli cdu hmh cd xu hulng xay ra ding thii, se biin thdch thfle thdrdi m|t tham hpa. Ching hgn, dl el thi ngan chan cdc cudc tdn cdng tfl ehii dieh vy phan tdn (DDcS- Distributed Derual ef Service) vde cdc khach hang hoac cdc ttang web d gid tii, doi hoi phdi thay doi ddng kl cdu hmh FirewaU. Trong nhiing tradng hpp nay, thuong khdng co thdi gian dl Mim tta. Do vay, dllu quan ttpng la cl mdt he thing vci cdc kl hcach ehuyin dli dy phdng vd phyc hii, trade khi xudt hien cde nhu edu cdp thiit.
Trfl mdt si tradng hpp quan ttpng cln thdng thuing thi mdt ban sao cdu hirdi dupc thyc hidn sau khi eo sy thay dli. Ban sao cdu hinh Id mdt phdn quan ttpng cua mdt h | thing giflp phyc hii h | thing khi xdy ra sy el. Nhiiu nin tang bdc mat hoac edu hmh phdn mim dupc Mim tta vd sao luu dy phdng.
Theo thoi gian, nhiing sao luu dy phing nay cd thi eung cdp nhiiu ban cho mdt sy ehuyin tilp an todn toi m|t cdu hmh moi. Chang hgn cung edp eho vi|e xay dung m|t hi so cd nhan vl cdc hogt ddng mang. Hi sa ndy el thi giflp theo ddi mdt tinh nang su dyng mgng eiing nhu phdt hien hdnh vi bdt thudng thdng qua cdc thue bao (ngudi su dyng)
hoac cde vdn dl vl luu lupng tdi trdn mgng.
Cde cdng cy sao chyp edu hinh d thi dupc thiit ldp dl gui m|t bdo cdo ti; d|ng hdng ngdy. Khi xdy ra tiiay dli, bdo cdo cho phip cdc nhd qudn ly CNTT nhin Igi cdc cdu hUih trade dl. Ding thii cflng cho phip quan tri vidn rdidn bdn m|t mdy nlu m|t thiit bi hing don gidn md khdng cdrdi bdo. Do vdy, khi quan ly sy tiiay dli edu hirdi edn chfl y:
- Khi chuyin sang m|t FirewaU mil cdn phdi cdu hinh Igi phdn cflng h | thing FirewaU dl bdo v | mgng chlng Igi sy tiny cdp trdi phip. Qud tilnh cdu hudi el till dua ra m|t tin thuang an ninh tgm thdi.
Khi dl, cdn cdi ddt cdc bdn vd Ili vd phdn mim giao di|n edn thiit cho tmy cdp bi xa. Chi ngudi qudn tri ldm cdng vi|e dd mil dupc qudn ly cdc FirewaU ttong edu hinh. Tdt cd ede dich vy qudn ly khdc cho cde FirewaU ndn dupc vd hidu hIa. Tgo tdi khodn qudn tri vidn cdp duoi chi sau khi mang da dupc cdu hinh dflng.
- Ding bd hca cdc ding hi ndi bd che mil FirewaU voi tat cd cdc thiit bi mgng khdc dl dam bdo chdc chdn cdc bdn ghi cl thi dupe so sdnh chinh xdc
- Khdng gift cdc tap tin cdu hinh FirewaU dy phing ttdn mgng eua d n g ty minh vi nlu mgng bi tteo se khdng tray cap dupc toi cde tdp tin ndy.
Thyc tl da thdy nhiiu edng ty phdi xay dyng Igi FirewaU cua hp tfl ddu sau khi chuyin sang cdu hirdi mii tiidt bai. DP dl, vi|c duy tii ban dy phing edu hinh bdc mdt FirewaU hi|n el Id rdt quan ttpng cho bdt ky mdt chuong trinh an runh vflng chdc.
4 . G I A M SAT TRUY CAP T O I CAU H I N H FIREWALL CUA N G U Q I SLT D g NG
Cac quan tri vidn CNTT bdo mdt rdt chfl f gidm sdt luu lupng FuewaU. Ngegi trfl m|t ll hing ttong bdo mat mgng thi FirewaU la m|t dilm duy rdidt rdidp canh vdo mgng vd ehfla dyng bdng chflng vl cde
Flwwm Mock UnwatitMl TraMe
kit nil khdng mong muln. Cdc Firewall d thi tilt 1| md d|c hgi, Trojan horses vd root Mts (bd dyng cii glc) thing qua cdnh bdo cua cde kit nil bi tfl chii hodc qud nhiiu kit nil dupc cho phip.
Dpe m|t bdn ghi luu lupng FirewaU d thi hoi khi hiiu, rdiung cdc bdn ghi tiny cdp cua nguli su dyng cl xu hudng dupc don gidn hIa vd d thi hogt d|ng nhu m|t h | thing phdt hi$n xdm rdidp co bdn. Cdc bdn ghi nguli su dyng cimg cdp hai logi bdo mdt dft U|u qugn ttpng. Logi bdo mdt thfl nhdt: cdc ban ghi el thi theo ddi cdc tmy nhdp khdng tudn theo quy tde FiiewaU. Nlu thay dli cdu hinh Firewall cdc qudn tri viln d thi dang nhdp vd ldm thay dli FuewaU ttdi phip, khi ndy d thi gdy ra mdt In dinh ttong qud tilnh di chuyin sang FirewaU moi vd ddn din phdi thia hi|p sy tudn thu ting thi cho ydu cdu bdo mdt. Logi bdo mdt thfl hai: Ddng nhdp el thi phdt hi|n cdc d gdng ttuy cdp ttdi phip tfl bin ttong hodc bin ngodi mgng. Ddng nhdp khdng thdnh d n g tdi FirewaU hodc mdy chu d chirc ndng ddc bi|t d thi dupc coi Id m|t sy d gdng thdm nhdp trdi phip. Ddy Id ddu hi|u nhde cho qudn tri viln mgng ngdn chdn hodc gidm tdt ca cdc kit nil tfl vflng dl hodc cdc dia chilP rdiu mdt quy ludt. Nlu el kl hogch dl tgo ra mOt quy tde nhu vdy se giflp Mim tta dupc noi cl dia chl EP gid mgo.
Tuong ty nhu vdy, cdc kit nil ra bdn ngodi khdng xdc dirdi cl till Id m|t con dudng dl mdt nguli sd dyng ttdi phip su dyng dl tmy edp vdo h | thing cua m|t tl chflc vd sir dyng n l nhu Id mdt b | phong
(opthnaO
vSphere Client for iPad
cho cde thu rdc hoac de tdn cdng cdc mdy tinh khae tfl chinh may chu Web cua tl chue. Trong tradng hpp ndy, khuyin nghi dupe dua ra la cac tl chflc ndn thudng xuydn Mim
tta danh sdeh tray c^p el le ndn mil ngdy mdt ldn dl Mim tta xem el ai dl ldm thay dli cdc quy tde FirewaU. Cde nhd qudn ly CNTT ndn gift danh sdeh nhiing ngudi dupc uy quyin dl thay dli cdc quy tde FirewaU vd danh sdeh dl phai dupc gift an tcdn vd tit ban cd la dl offUne. Bdo qudn danh sdeh ndy ndn dupc eoi la mdt phdn cua kl hogch tiiay dli quan ly ting thi de cac quan tii vidn hiiu ldm thi ndo thay doi cde quy tde cho dflng. Hdu hit cac san pham nin tang FuewaU ehinh dlu cung cap cdc ban ghi tiny nhdp ngudi dflng. Tuy nhidn, ban than cdc ban ghi ndy da phai dupc an todn, hoac nlu cl mpt xam nhap nghidm ttpng khde lam thay dli ndi dung thi se la bdng chflng vl sy tham nhdp va bi Icgi bo. Do vay, ndn tgo mdt hoac nhiiu tdi khoan nguoi dflng ehi tray nhdp dpe (read-only) vao cdc ban ghi vd su dyng nhung kha nang ndy dl Mim tta cdc ban ghi.
5. KIEM N G H I E M LICH T R I N H C H I N H SACH T H ^ Q N G XUYEN
Bao mat FuewaU cl nghia la khdng till cl mdt chinh sdeh bao mat chat che, cho dfl chinh sach do cd till Id sy kit hpp cua cdc quy tac vd nguydn tae xung quanh phuong phdp bao mat da dupe xay dyng. Bpi vi FuewaU thyc thi cdc chinh sach bao mat cho mpt tl chflc nhung nl khdng ty bac ve dupe eho ehinh no. Mat khdc, tiiudng thi chinh sach bao
VMware vCenter Server mdt FirewaU chi la vdndl "thiit lap va bo" (set and forget) dl phdt triin tu cac thay dli quy tde ngdn hgn chfl khdng phdi tfl nhu cdu thay dli cua tl chflc hoac mdi traing an ninh.
Ngodi ra, theo tiili gian, cdc quy tde d thi khdng phfl hpp v6i chinh sdeh bao mat vd cdc quy tde khdng su dung d thi ldm nghen luu lupng mgng va Id rdo can eho cdc thay dli mang.
Tuy nhidn, bao mat ma khdng tuan tiiu theo Uch trinh cflng ed thi mang din rui ro phap ly, lam thay dli thuong xuydn nhiing ydu cdu quy dinh bao mat dft lidu dli (nhu xu ly dft Udu the tin dung, quan ly chflng khoan, tl chflc y tl va thdng tin tai chtnh....).
Do vay, dft Udu Firewall ndn dupc thu thdp va danh gia theo mdt Uch trmh thudng xuydn nham dung hoa cac quy tac tmy nhap voi cac tmh hinh an ninh ting the dl phdt hidn cdc hanh vi vi phgm chinh sdeh ciing nhu cac vdn dl khae. Thdi gian xem xet, danh gia Igi cac quy tac ndn tuong flng vol tan si thay dli quy tac FirewaU. Viec lap danh sach cdc thay dli dupc tinh tfl ldn xem xet cull cflng. Vi nhimg xem xit nay se biet dupc nhung thay dli nay do ai thyc hidn vd nguydn nhan tgo ra nhung thay dli do. SI ldn dupc dl nghi dl xem xet lai cac ehmh sach la khi xde dinh dupc cde yiu tl sau:
- Dua ra FirewaU moi hoac bien phdp an ninh khdc ma lam thay dli dang kl cdc kha nang cua mgng
- Dua ra cac flng dyng IP moi cho mgng
- Thay dli mdt ISP moi (Intemet Service Provider- Nha eung edp dich vy Intemet)
- Phil hop voi mdt dli tde Mnh doanh de bat ddu
Firewall
Server
chia se luu lupng mgng
- Trai qua mdt thay dli hpgt d|ng hpac Mnh dcanh quan ttpng
- Duy tri Mm nggch nhan vidn quan tipng
Bi bap ve tdi sdn CNTT mdt cdch tiidt dl thi bac mdt mgng cdn hcgt ddng ttong cdc lop el cimg tinh ehdt edng vide. Boi vi FirewaU thiit ldp dl chdp nhdn luu lupng tmy cdp nhiiu nhdt khi dat 6 vi tri gdn vol bdn ngpdi nhdt vd chdp nhdn luu lupng tmy cdp it nhdt khi dat gdn vdi cdc dfl U|u dd dupc bdc v|. Do dl bdt ky m|t su xem xit Igi ehinh sdeh FirewaU ndn dam bdo cde lip FirewaU hogt d|ng tiieo dflng trinh tii. Cl thi Mch hogt cing lpc d biin cua mgng vd ndi dung lpc sdt nhdt vii n|i dung nhdn dupe. Phuang phdp ndy cflng giflp tgo ra cdc vflng bao mdt cho cdc tdi san CNTT.
KET LUAN
Ld ding san phdm ddu tidn cua mgng ludi phing
ngy, FirewaU dupc xem Id cdng cy rdt quan ttpng dl bdo vd tdi sdn CNTT. Thay dli Mnh doanh vd cdc nhu cdu bdo mdt tgo ra thdch thuc cho nhiiu tl chflc ttong vi|c thyc hidn quan ly tudng lua mdt cdch thich hpp, d$c bidt Id nhftng tl chflc d hgn chl vl nhdn lye vd nguin lye ddnh cho bdo mdt Mac dfl cdc khuyin nghi dupc dug ra ttcng bdi bdo khing ding nghia cung cdp mOt danh sdeh todn didn cdc nhi|m vy edn thiit dl gift cho chflc nang FirewaU hogt d|ng hi|u qud. Nhung nhiing khuyin nghi ndy Id thdnh phdn quan ttong dli vdi bdt ky m|t chuong tilnh qudn ly FirewaU danh tilng. Thyc hi|n tiieo nhftng khuyin nghi ndy si giflp ttdnh dupc cdc tinh hulng xdy ra dli vdi vdn dl bdo mdt bdng FirewaU vd vi vdy mgng cfla tl chflc se cl dupc bao v | tit hon tii cdc FirewaU vd gidm thiiu rui ro eho cdc tl chflc khi tham khdo nhftng khuyin nghj ndy.
NTT (Nguon Secureworks)