Izivivinyo zokwamukela ze-VPN gateway ebonakalayo enokuqinisekiswa kwezigaba ezimbili
Khombisa isango isinyathelo ngesinyathelo: ukubhalisa, ukungena, ukwenqaba, ukuhoxiswa nokubuyiselwa, ngakunye kunobufakazi nesimo sokuphumelela esabhalwa ngaphambi kwesivivinyo.
Abathengisi bachaza le divayisi njengebonakalayo futhi ekwazi izigaba ezimbili, futhi alikho nelilodwa kula mazwi amabili eliphendula imibuzo enquma ukuthenga. Yisiphi isithombe se-hypervisor esisekelwayo, amaphi amaklayenti angabhalisa, yini isigaba sesibili esiyifakazelayo ngempela, futhi kwenzekani uma umhlinzeki wobunikazi ewa kusavulekile. Washintshe kube yizigaba zokwamukela ongazisebenzisa emkhankasweni, futhi isinqumo siyeke ukuncika ekutheni iphepha ledatha liyakhombisa kangakanani. Iphepha elingezansi liyisakhiwo salobo bufakazi, hhayi ukuhlelwa kwemikhiqizo.
Yini okufanele umhlinzeki ayiqinisekise mayelana nokusetshenziswa kwalokhu
Qala ngokufinyeza ukusetshenziswa ekhasi elilodwa: i-hypervisor noma ifu, isakhiwo sesivakashi, isithombe esisekelwayo nezixhumanisi okulindele ukuphathwa. Engeza abasebenzisi nezinhlelo zabo zokusebenza, ukuthi amadivayisi aphethwe yini, nokuthi ukubhalisa nokungena kufanele kusebenze kanjani. Bese kuba ukufinyelela okuyimfihlo: izinhlelo zokusebenza neziqalo, ukuhlelwa kwe-DNS, izindlela zokubuya, nokuthi umgudu wokuphuma kwi-inthanethi yomphakathi uyingxenye yesiphakamiso yini.
Ukuphatha nakho kukulolo khasi: ubani onakekela idivayisi, izibuyekezo zivela kuphi, amalogi aya kuphi, ukuhlelwa kuvikelwa kanjani, nokuthi iyiphi inhloso yokubuyisela okwavunyelwana ngayo yiqiniso ibhizinisi. Cela umhlinzeki aqinisekise leyo nhlanganisela ngqo, hhayi ukuthi isofthiwe isebenza kumshini obonakalayo. Gcina ukuncika kwangaphandle njengomhlinzeki wobunikazi noma insizakalo yelayisensi kubonakala, ngoba ziyingxenye yokusetshenziswa noma zilethwa nakho noma cha. Ikhasi lokusetshenziswa elingenakho ukuncika okuqanjwe ngegama ngokuvamile iyikhasi lokusetshenziswa elinokuncika okungaziwa.
Khombisa ukuthi isigaba sesibili siyisigaba sesibili ngempela
Qamba isiqinisekisi nokugeleza kokuqinisekisa, futhi usho ukuthi isinyathelo ngasinye sisungula buphi ubunikazi. Izicelo ezimbili zephasiwedi zilandelana akusona isigaba sesibili, futhi iphasiwedi kanye nekhodi esetshenziswa kanye iyisimangalo esihlukile kunesiqinisekisi se-cryptographic esiboshelwe kusevisi. Bhala ukugeleza okuthengayo, hhayi ilebula elisebhokisini.
Ukumelana nokuphishwa kuyisici esihlukile, futhi umhlahlandlela we-NIST weziqinisekisi ukubheka kanjalo: ikhodi umsebenzisi angakhohliswa ukuba ayidlulise isahambisana nokuqinisekiswa kwezigaba eziningi kodwa yehluleka kuleso simo esengeziwe. Cela leso sici ngokusobala uma sibalulekile kuwe. Bese ufuna umboniso ovela ohlotsheni lweklayenti abasebenzisi bakho abayisebenzisayo ngempela, ohlanganisa ukubhalisa, inselelo enqatshiwe noma ephelile isikhathi, ukubuyisela ngemva kokulahlekelwa isiqinisekisi, nokuhoxiswa komsebenzisi oyedwa ngenkathi abanye besaxhunyiwe. Gcina ukuqinisekiswa kobunikazi besango kusemkhakheni, ngoba iklayenti elithemba noma yiliphi isango lisusile inkinga esikhundleni sokuyixazulula.
Bhala isimo sokuphumelela ngaphambi kokuthi wephule lutho
Ithebula elingezansi liyingxenye yephepha elisinda ekuxhumaneni nomhlinzeki, ngoba umugqa ngamunye ufuna ubufakazi esikhundleni sesiqinisekiso. Gcwalisa isimo sokuphumelela ngaphambi komkhankaso, futhi ubheke umugqa ongenabufakazi njengomugqa ohlulekile. Izigaba ezinhlanu zihlanganisa okufanele ikwenze isango.
| Acceptance stage | Evidence to keep | Pass condition |
|---|---|---|
| Enrolment | Enrolment record with the device type and the identity used | A new device enrols once, and nobody else can enrol it afterwards |
| Sign-in with the second factor | Session record naming both factors and the gateway identity that was checked | The session carries the expected identity and the gateway certificate validated |
| Denial of an unapproved destination | Log line from the control that refused the flow, with the policy name | The flow is refused and the refusal is attributable to one control |
| Revocation of one user | Revocation timestamp and the sessions that survived it | The named user is out and unaffected users keep working |
| Restore from configuration backup | Restored version plus a probe of a revoked identity | The revision matches the backup and revoked identities stay revoked |
Ukubhalisa kuza kuqala ngoba konke okulandela kuncike kukho: idivayisi engakwazi ukubhalisa ayikwazi ukuhlolwa. Ukungena kuyisigaba esihlukile ekubhaliseni, futhi ukwenqaba yisigaba iphepha eliningi elikhohlwayo, ngoba isango elingenisa wonke umuntu alikakhombisi ukuthi lenqaba othile. Ukuhoxiswa nokubuyiselwa kuthwala ingxenye enkulu yengozi yokusebenza, futhi kokubili kushibhile ukukuzilolonga ekopisheni.
Zilolonge ekopisheni, hhayi esangweni elisebenzayo
Sebenzisa izigaba eziphazamisayo ekopisheni yesikhungo, ulandela inqubo yokusetshenziswa esekelwayo, futhi gcina ubufakazi ngabunye nodweshu noshintsho lokuhlelwa kwabo. Umugqa wokuqalisa kabusha awuphendulwa ngokuqalisa kabusha kusuka kukhonsoli, futhi umugqa wokubuyisela awuphendulwa ngokukhipha ukuhlelwa. Qaphela ukuthi yisiphi isimo esibuya sodwa nokuthi yini okufanele ixhume futhi, ngoba lowo mehluko yiwona ithimba lokuphatha eliwutholayo njengefa. Umkhankaso futhi yithuba kuphela lokukala ukubuyisela ngaphandle kokuchaza ukuphazamiseka.
Rekhoda isimo somhlinzeki wobunikazi ngesikhathi somhlolo ngamunye, ngoba umugqa wokuphazamiseka ohlolwe kumhlinzeki onempilo ukhombisa okuphambene nalokho okushiwo yiphepha. Abahloli ababili emkhankasweni owodwa babamba izinto ezihlukile, futhi owesibili ngokuvamile uthola umugqa obufakazi bakhe oyisithombe sesikrini sedashibhodi. Gcina lobo bufakazi bunanyathiselwe kumugqa obungowabo, hhayi kufolda eqanjwe ngeprojekthi.
Kala umthwalo womsebenzi ithimba lakho elizowusebenzisa
Vumelana ngomthwalo ofana neviki ejwayelekile, bese kala lapho okuhlosile ukusetshenzisa khona: ukwenzeka ngasikhathi sinye, ingxubevange yethrafikhi, newindi lokunakekela ithimba elinalo ngempela. Isibalo somsebenzi esikhangisiwe sichaza isimo saselabhorethri futhi asisho lutho ngabasebenzisi bakho. Kala ukubuyisela ngokuqondene nomgomo wokubuyisela, hhayi ngokuqondene nohlelo.
Iphepha liqedwa lapho isigaba ngasinye sinobufakazi futhi ubufakazi ngabunye bunodweshu. Idivayisi enakekelwa othile, enobufakazi bomugqa ngamunye, iwukuthenga okuhlukile kunohlu olude kakhulu lwamabhokisi amakhiwe.