I-laptop ene-infection ku-VPN: lawula iseshini, hhayi umzila
Uma idivayisi ene-infection ise-VPN, qeda iseshini, hoxisa iziqinisekiso futhi gcina ubufakazi esikhundleni sokushintsha umzila.
Imibiko yokuhlukunyezwa kwe-endpoint ivamise ukufika nemizila emifushane ephakanyisiwe: beka i-laptop ku-split tunnel ukuze ikheli elibonakala endaweni ehlosiwe lishintshe. Lokho kushintsha ukubonwa, hhayi ukutheleleka. Idivayisi iqhubeka nokubamba noma yikuphi ukufinyelela kwangaphakathi iseshini yayo esivele inakho, futhi i-malware iqhubeka nokusebenza ku-hardware okungekho oyihlolile. Izimo ezintathu kufanele zibeke ukulandelana komsebenzi: ukuthi iziqinisekiso zedivayisi zisafinyelela ini, ukuthi lokho kufinyelela kusasetshenziswa yini manje, nokuthi yibuphi ubufakazi obungachithwa ukusula okusheshayo.
Isimo sokuqala: iziqinisekiso zisafinyelela ini
I-akhawunti ehoxisiwe noma evalwe ayiyona impendulo ephelele, ngoba iklayenti lingaba nesitifiketi, ithokheni egciniwe, ukhiye owabiwe ngaphambili ogciniwe noma isiqinisekiso somshini esisinda ekushintsheni kwephasiwedi. Yenza imephu yaso sonke isiqinisekisi esisetshenziswa iphrofayela ngaphambi kokukhetha isenzo. Bese uhlola ukuthi umkhiqizo uqeda amaseshini ekuhoxisweni noma wenqaba kuphela amasha.
Lapho i-gateway ikusekela khona, qeda iseshini ngokusobala futhi uqinisekise kusuka kuthebula lokubalwa noma lwamaseshini ukuthi isihambile. Ushintsho oluthinta kuphela ukungena okulandelayo lushiya ukugeleza kwamanje kusasebenza.
Isimo sesibili: ingabe ukufinyelela kusasetshenziswa manje
Hlanganisa iwindi lesexwayiso nesehini langempela, ikheli le-tunnel elinikeziwe kanye nobunikazi bedivayisi. Ukuphuma okwabiwe kwenkampani kumelela wonke umuntu ongemuva kwayo, ngakho ikheli lomphakathi elibonwayo alikwazi ukuthola ukuthi iyiphi i-endpoint eyakha ukugeleza. Lokho kuhlanganisa yisinyathelo abantu abasidlulayo lapho isexwayiso sibonakala sicacile.
Sebenzisa amarekhodi aqoqwa ngempela yisevisi esetshenzisiwe, njengezehlakalo zokuqala nokuma kokubalwa ezixhumanisa iseshini nobunikazi nekheli. Uma lawo marekhodi engaphelele, shono lokho embikweni esikhundleni sokugcwalisa isikhala ngombono we-firewall. Umbiko ohlukanisa ubufakazi nomqaguzo udlula ukubuyekezwa kangcono kunalowo ongenjalo.
Isimo sesithathu: yini okufanele isinde ekuphenduleni
Ukuvimbela okuchitha ikhophi eyodwa yobufakazi kuyisigameko sesibili. Gcina amalografi afanele, amarekhodi amaseshini kanye nezinto ze-endpoint ngokusebenzisa inqubo ephethe ukugcinwa nokufinyelela. Unganamatheli ukuthunyelwa ngaphandle kwithikithi lonke iqembu losekelo elingalifunda.
Bese unquma nomnikazi wesigameko ukuthi ingakanani i-endpoint okufanele yakhiwe kabusha. I-quarantine inciphisa umonakalo ngenkathi kutholakala ububanzi, futhi inciphisa nokuthi abaphendulayo basengabona ini, ngakho leyo mithi emibili kufanele ishintshiswe ngamabomu.
Ukuvimbela kubukeka kanjani ngempela
Ukuvimbela okusebenzayo kunezingqimba: i-quarantine yenethiwekhi esigabeni sokufinyelela, ukuhoxiswa kwesiqinisekisi ngasinye esisetshenziswa iphrofayela, ukuqedwa kwaseshini ngokusobala, kanye nokuvinjelwa kwezimvume zangaphakathi i-akhawunti eyayinazo. Noma yikuphi kwalokho kukodwa kushiya umzila uvulekile.
| Condition | Act first | Defer |
|---|---|---|
| Credentials reach internal systems | Revoke and terminate the session | Endpoint rebuild |
| Access visibly in use | Quarantine, then scope the reach | Rotation of unrelated accounts |
| Evidence still on the device | Preserve artefacts, restrict read access | Reimage |
Ukulandelana kubaluleke kakhulu kunokuphelela ehovini lokuqala. Ukuhoxisa ngaphambi kokusula kukunikeza ithuba lokubona ukuthi iklayenti liphendula kanjani, futhi ukuqeda iseshini ngaphambi kokuhoxisa kubonisa ukuthi i-gateway iyayihlonipha noma cha. Rekhoda ukuthi isiphi isilawuli sadala muphi umphumela.
Ukuhlela umzila kuyisinqumo sesevisi, hhayi ithuluzi lokuvimbela
I-split tunnel inciphisa lokho ukuphuma kwehhovisi okukuthwelayo, kanti i-tunnel egcwele ithumela ithrafikhi eningi ngomzila wokuhlola okhethiwe. Akukho mowudi oqinisekisa i-endpoint, futhi akukho okuhoxisa isiqinisekiso.
Idizayini ye-tunnel egcwele ifanele ukuba khona lapho umzila wokuhlola uhlomele ukuthola nokwenza, okuwumsebenzi ohlukile kunaleso sigameko esiphambi kwakho. Ukushintsha amamodi phakathi nesigameko ngokuvamile kudala ukudideka kokuthi yimaphi amalografi ahambisana nakuphi ukuziphatha. Nquma imodi ngemuva kwalokho, nomnikazi wesevisi kanye neqembu lokuqapha bekhona etafuleni.
Izimo zokwamukelwa kabusha
Bhala izimo zokwamukelwa kabusha ngaphambi kokuba idivayisi ibuye: isimo sokulungisa okufanele siqinisekiswe, isimo sesiqinisekiso ngasinye esiveziwe, izilawuli ze-endpoint okufanele zibike, kanye nezimvume eziphansi kakhulu i-akhawunti eziyidingayo esikhundleni salezo ebevele inazo ngengozi. Zihlukanise zibe yizidingo kanye nokuthandekayo. Isethi yezimvume yasekuqaleni ayisona isidingo.
Ukuskena okuhlanzekile kuwukungena okukodwa, futhi ukungena okuphumelelayo kufakazela kuphela ukuthi uhlelo lokugunyaza lwahamba. Buyisela ukufinyelela ngezigaba, ubheka iseshini nokusetshenziswa kwezinsiza ngaphansi kohlelo olugunyaziwe. Shono umnikazi wanoma yikuphi ukuvinjelwa okusele. Uma ukuhlukunyezwa kufinyelele kozakwethu ngokuphuma kwehhovisi, tshela lowo ozakwethu ngomzila odingwa yinkontileka esikhundleni sokulinda ukuthi bona baqaphele.