Inethiwekhi yendawo yenkampani yakho isibe yinhliziyo cishe yakho konke okwenzayo.Ukufinyelela kuzinhlelo zokusebenza, amafayela abiwe, izinsizakalo zamafu, izingcingo zevidiyo, amaphrinta, i-IoT, ip amakhamera...futhi, vele, iWindows njengohlelo lokusebenza oluhamba phambili kumakhompyutha. Inkinga ukuthi le LAN efanayo manje isiyisisulu esihehayo kunoma yimuphi umhlaseli ohlakaniphe kancane.
Akwanele nje "ukufaka i-antivirus bese kuphelile"Ukuthuthukisa ukuphepha kwenkampani yakho usebenzisa ama-Windows LAN kuhilela ukuhlanganisa imikhuba emihle yokuklama inethiwekhi, izilawuli zokufinyelela, ukuvikelwa komngcele, ukucushwa okufanele kwezinsizakalo ze-Microsoft Entra (ezaziwa ngokuthi i-Azure AD), kanye—into esivame ukuyikhohlwa—ukuziphatha kahle amakhophi wokulondoloza kanye nokuphathwa kweziqinisekiso. Ake sibone, isinyathelo ngesinyathelo, ukuthi ungayivikela kanjani ngempela i-LAN yenkampani yesimanje ngaphandle kokulahlekelwa yingqondo phakathi nale nqubo.
Iyini inethiwekhi ye-LAN ebhizinisini lesimanje le-Windows?
I-LAN (Inethiwekhi Yendawo Yasendaweni) inethiwekhi exhumanisa amadivayisi ehhovisi lakho noma ezitezi eziningi/izakhiwo eziseduze, okuvumela ukwabelana ngedatha, izinhlelo zokusebenza, amaphrinta, ukufinyelela i-inthanethi, kanye nezinsizakalo zamafu. Indawo evamile ye-Windows ifaka phakathi ama-PC, amaseva, amaphrinta enethiwekhi, amafoni e-VoIP, izindawo zokufinyelela ze-Wi-Fi, amakhamera e-IP, kanye nenani elikhulayo lamadivayisi e-IoT.
Ama-LAN amaningi ebhizinisi amanje asebenzisa i-Ethernet njengobuchwepheshe bawo obuyinhlokoukuhlanganisa izintambo zethusi noma ze-fiber optic kanye, ezimweni eziningi, i-Wi-Fi (WLAN). Uma amadivayisi exhuma ngaphandle kwentambo, sisabhekisela kuyo njengenethiwekhi yendawo, kodwa ngaphansi kwendinganiso ye-IEEE 802.11, nazo zonke izingozi ezengeziwe zokuxhumeka okungenantambo.
Ezinkampanini eziphakathi nezinkulu, kuvamile ukuthi i-LAN ingabi "i-flat soup" eyodwa.
Ama-subnet amaningana nama-VLAN athunyelwa eminyangweni ehlukene, izinsizakalo ezibalulekile (amaseva, abalawuli besizinda, amakhamera, i-IP telephony…) kanye nezindawo zezivakashi, futhi ama-router nama-switch aphethwe asetshenziswa ukulawula ukuhamba kwethrafikhi nokuphoqelela izinqubomgomo zokuphepha.
Izingxenye ezibalulekile ze-LAN nokuthi zithinta kanjani ukuphepha
Ukuphepha kwe-LAN yakho ku-Windows kuncike kokubili kwihadiwe kanye nokucushwa kwayo.Lezi yizinto eziyisisekelo okumele uzilawule futhi uzilungiselele kahle ukuze ugweme ukushiya iminyango ivulekele abahlaseli bangaphakathi noma bangaphandle.
- Amakhebula kanye nendawo ebonakalayoUkuxhuma izintambo ezindala (Isigaba 5/5e samabanga amade) akugcini nje ngokunciphisa isivinini kodwa futhi kungabangela amaphutha okudlulisa kanye nokuwa kwezixhumanisi okufihla izinkinga zokuphepha noma okuphazamisa ukuqapha. Ukuthuthela ku-Cat6, Cat6A, noma ngaphezulu kuthuthukisa ukusebenza kanye nokuqina futhi kunciphisa izithiyo ezigabeni ezibalulekile.
- AmaswishiLawa amadivayisi axhumanisa yonke imishini ku-LAN. Iswishi ephethwe kahle ikuvumela ukuthi udale ama-VLAN, usebenzise i-QoS, ukhawulele amachweba, uthole ama-loop, unike amandla ukuqinisekiswa kwe-802.1X, nokuningi. Iswishi eshibhile, engalawulwa isho ukulawula okuncane kokuxhuma nokuthi iyiphi ithrafikhi ehamba ngayo.
- Ama-routers nama-firewallI-router ivame ukuba yindlela yokungena kwi-inthanethi futhi ivame ukufaka imisebenzi ye-firewall. Ebhizinisini, ikhambi elifanele ukuba ne-firewall ezinikele (ebonakalayo noma ebonakalayo) ehlukanisa ngokucacile i-LAN yangaphakathi kwi-inthanethi, ichaze ukuthi yimaphi amachweba adaluliwe, futhi isebenzise ukuhlolwa kwethrafikhi kanye nokuhlunga okuqukethwe.
- Izindawo Zokufinyelela ze-Wi-Fi (i-WAP)Lezi yizindawo zokungena zamafoni eselula, ama-laptop, namadivayisi e-IoT. Kufanele zilungiselelwe ngokubethela okuqinile (i-WPA2-Enterprise noma i-WPA3), ukuqinisekiswa okuphakathi, amanethiwekhi ezivakashi ahlukene, futhi, uma kungenzeka, ukuhlanganiswa nezinqubomgomo zakho ze-Microsoft Entra Conditional Access.
- Amabhuloho kanye nama-repeaterAmabhuloho, izandiso ze-Wi-Fi, kanye neziphindaphindi zesignali zandisa ububanzi benethiwekhi, kodwa uma zingalungiselelwanga kahle, zingadala izingxenye "zezipoki" ezingalawulwa futhi ezingaqashelwanga. Kubalulekile ukuthi zihloniphe ukuhlukaniswa futhi zizuze izinqubomgomo zokuphepha ezifanayo njenge-LAN yonke.
- Amaseva eWindows kanye nabalawuli besizindaIseva yefayela, futhi ikakhulukazi, abalawuli besizinda se-Active Directory, bagxila ebufakazini, izinqubomgomo zeqembu, kanye nedatha ebucayi. Uma othile ethola ukufinyelela kwe-RDP kumlawuli wesizinda oneziqinisekiso ezibuthakathaka, angakwazi ukulawula yonke inhlangano ngokoqobo.
- Amakhompyutha eklayenti ane-WindowsZiyisixhumanisi lapho izici zobuchwepheshe nezomuntu zihlanganiswa khona kakhulu. Izinhlelo eziphelelwe yisikhathiAbashayeli abadala, isofthiwe ye-antivirus esidala, noma abasebenzisi abanamalungelo okuphatha endawo bayindlela ephelele yokuguqula noma iyiphi i-malware ibe yinhlekelele.
Izinhlobo ezivamile zokuhlaselwa kwe-LAN yezinkampani
I-LAN yenkampani esebenzisa amafasitela ingahlushwa yinoma yini kusukela ekuhlaselweni okunomsindo omkhulu kuya ekungeneni okuyimfihlo. okungatholakali izinyanga eziningi. Ukuqonda ama-vector avame kakhulu kuyisihluthulelo sokuklama izindlela zokuzivikela ezisebenzayo.
- Ukuhlasela kokuskena nokuhlolaUmhlaseli uhlola ukuthi yimaphi amadivayisi akunethiwekhi, yimaphi ama-port avulekile, nokuthi yimaphi amasevisi adaluliwe. Bangase basebenzise ama-TCP scan, ama-port sweep, kanye namasu okuhlukaniswa kwamaphakethe ukuze bazame ukudlula ezinye izihlungi. Nakuba lokhu kuhlasela kubonakala "kungenangozi" ekuqaleni, kuyisigaba sokuqala sokuxhashazwa kwangempela.
- Ukuhogela nokubuka ithrafikhiNgedivayisi exhunywe ku-switch port engalungiselelwe kahle, noma ngokusebenzisa inethiwekhi ye-Wi-Fi evulekile noma engavikelekile kahle, umhlaseli angabamba ithrafikhi ye-LAN, aqaphele iziqinisekiso zombhalo ocacile (uma i-TLS ingasetshenziswa), amaseshini, amakheli angaphakathi, kanye namaphethini okuziphatha. Kumodi "yokuskena", angaphinde ashintshe noma akhiphe idatha ukuze isetshenziswe kamuva.
- Ukuhlaselwa kwe-malware nokuguqulwa noma umonakaloI-Ransomware, i-Trojans, kanye ne-worms zisebenzisa izinhlelo ze-Windows ezindala, ama-akhawunti anamalungelo amaningi, kanye nokuntuleka kokuhlukaniswa ukuze kubethelwe amafayela, kwebiwe idatha, noma kushintshwe ulwazi olubalulekile. Ukuhlasela okufana nokuphazanyiswa noma ukuphambuka kwedatha kuvumela abahlaseli ukuthi bashintshe amarekhodi e-accounting, izizindalwazi, noma ama-payroll ngaphandle kokutholwa ngokushesha.
- Ukwebiwa kwephasiwedi (ukuqhekeka kwephasiwedi)Uma amaphasiwedi esizinda ebuthakathaka noma esetshenziswa kabusha kuzo zonke izinhlelo, ukuhlaselwa kwe-brute-force noma kwezichazamazwi kungawaphula ngokushesha. Abahlaseli basesha futhi ama-password hashes kubalawuli besizinda noma ezindaweni zokusebenza ezonakele ukuze benze ukuhlaselwa kwe-pass-the-hash. Sebenzisa abaphathi bephasiwedi abanjengo abaphathi be-password ukunciphisa ukusetshenziswa kabusha nokusiza iziqinisekiso ezihlukile ngesevisi ngayinye.
- Ukukhwabanisa kwe-DNS kanye nokuqondisa kabusha okunonyaUkufaka ubuthi ku-DNS yangaphakathi noma yangaphandle kukuvumela ukuthi uqondise kabusha abasebenzisi kumawebhusayithi mbumbulu noma ngabe bathayipha i-URL efanele. Lokhu kungasetshenziswa ukuthwebula iziqinisekiso, ukusabalalisa i-malware, noma ukuzenza izinhlelo zokusebenza zenkampani.
Izindlela eziyisisekelo ezinhle zokuvikela i-Windows LAN
Indawo yokuqala yokuvikela i-LAN yakho ukusebenzisa izinyathelo zokuhlanzeka zedijithali ezicacile kakhulu. ezithinta amaphasiwedi, izibuyekezo, ukuhlukaniswa kwenethiwekhi, kanye nokulawulwa kokufinyelela okungokoqobo nokunengqondo emishinini.
- Inqubomgomo yephasiwedi eqinileLe nqubomgomo idinga ukusetshenziswa kwamaphasiwedi amade (ubuncane bezinhlamvu ezingu-12) anezinhlamvu ezinkulu nezincane, izinombolo, kanye nezimpawu, igwema ukusetshenziswa kolwazi lomuntu siqu olusobala, futhi ilungiselela ukuphelelwa yisikhathi okufanelekile ngezikhathi ezithile. Ezindaweni ze-Windows, lokhu kusetshenziswa kalula nge-Group Policy Objects (GPOs) esizindeni. Qedela le nqubomgomo ngabaphathi bamaphasiwedi abanjengo-[insert password manager name here]. I-KeepassXC.
- Ukuqinisekiswa okuqinile kanye nokuqinisekiswa kobunikaziIhlanganisa igama lomsebenzisi nephasiwedi nezinto eziningi zokuqinisekisa (i-MFA) futhi, lapho kufaneleka khona, i-biometrics (izigxivizo zeminwe, ukuqashelwa kobuso) ihlanganiswe ku-Windows Hello for Business. Uma kunzima ukuzenza umsebenzisi, kulapho umhlaseli eba nezinketho ezimbalwa zokweba iziqinisekiso zokungena ngemvume.
- Izinhlelo ezibuyekeziweUkugcina ama-Windows, abashayeli benethiwekhi, i-firmware yamaswishi, ama-router, kanye nezindawo zokufinyelela, kanye nesofthiwe yeseva, kusesikhathini kubalulekile. Ukuhlasela okuningi kusasebenzisa ubuthakathaka obudala obekukhona izinyanga noma iminyaka ngabo. Kunconywa ukusizakala ngabahlinzeki abanikeza ama-patches kanye nokuhlolwa.
- Ukuhlukaniswa kwe-LANAkuyona into enhle ukuba nenkampani yonke ku-subnet eyodwa. Sebenzisa ama-VLAN ukuhlukanisa abasebenzisi, amaseva, i-VoIP, amakhamera, amadivayisi e-IoT, izivakashi, kanye nezindawo zokuhlola. Lokhu kwenza kube nzima ngomhlaseli oye walimaza umshini owodwa ukuthi ahambe eceleni.
- Ukubethela kwethrafikhi ebucayiIphoqelela ukusetshenziswa kwe-TLS kuzinhlelo zokusebenza zangaphakathi nezangaphandle (i-HTTPS, i-SMTPS, i-LDAPS, njll.), ivikela ukuxhumana okukude nama-VPN aqinile, futhi isebenzisa amaphrothokholi aphephile okuphathwa kwedivayisi (isb., i-SSH esikhundleni se-Telnet). Lokhu kuvimbela i-sniffer ku-LAN ukuthi "ingaboni" iziqinisekiso noma idatha ecacile.
Ukuphepha kwe-Zero Trust: Vikela ukufinyelela kwenethiwekhi nge-Microsoft Entra kanye ne-Global Secure Access
Ifilosofi ye-Zero Trust isekelwe emcabangweni olula kakhulu.Ungathembi ngokuzenzakalelayo noma iyiphi idivayisi, umsebenzisi, noma indawo, noma ngabe "ingaphakathi" kwe-LAN. I-Microsoft ifake le ndlela ku-Secure Future Initiative yayo, ikakhulukazi ku-"Secure Networks".
Kumabhizinisi asebenzisa izinsizakalo zeWindows neMicrosoft, i-Entra (eyayikade i-Azure AD)Lokhu kuholela ekwengezeni izendlalelo eziningana zokuvikela inethiwekhi nokufinyelela: ukuqapha okuqhubekayo kweseshini, ukulawula ukuthi umsebenzisi uxhuma kuphi, ukuthi usebenzisa muphi umzila wenethiwekhi, nokuthi hlobo luni lwethrafikhi abaludalayo. Yilapho izici ezifana ne-Global Secure Access, i-Microsoft Login Private Access, kanye nezinqubomgomo ze-Conditional Access zisebenza khona.
Lungiselela izindawo eziqanjwe ngamagama ku-Microsoft Login ID Ikuvumela ukuthi ucacise ukuthi yimaphi amanethiwekhi ezinkampani, amagatsha, kanye nezifunda ezisemthethweni nezithembekile. Ngaphandle kwalezi zincazelo, ukutholwa kwezingozi okusekelwe endaweni kusebenza kabi kakhulu futhi kwandisa imiphumela engamanga, okwenza kube nzima ukuhlukanisa ukungena kwehhovisi okuvamile nomzamo osolisayo ovela ku-VPN engaziwa noma izwe lapho inkampani yakho ingasebenzi khona.
Imikhawulo Yomqashi v2 (TRv2) Ziyinsika ebalulekile: zivimbela abasebenzisi abangagunyaziwe kumadivayisi akho e-LAN kanye nawezinkampani ukuthi baqinisekise abaqashi be-Microsoft Entra bangaphandle. Ngaphandle kwazo, umuntu onemininingwane eyebiwe angaxhuma kumqashi ongaphansi kolawulo lwakhe futhi aveze idatha nge-OneDrive yangaphandle, i-SharePoint, noma ama-Teams ngaphandle kokuthi amathuluzi akho endabuko e-DLP ayithole.
Ukuhlolwa Kokufinyelela Okuqhubekayo Komhlaba Wonke kanye nokulawulwa kweseshini ye-granular
Ezindaweni ze-Windows ezihlanganiswe ne-Microsoft Entra, kubalulekile ukulawula isikhathi sokuphila samathokheni okufinyelela.Ngokuhlolwa Okuqhubekayo Kokufinyelela Okujwayelekile (i-Universal CAE), konke ukuxhumana kwenethiwekhi okuvikelwe yi-Global Secure Access kuqinisekiswa kabusha ngokuguquguqukayo ngokusekelwe ezenzakalweni ezibalulekile.
Uma i-Universal CAE ingasebenziIthokheni elibiwe lingahlala lisebenza imizuzu engama-60 kuya kwengama-90 ngisho nangemva kokuba umsebenzisi eshintshe iphasiwedi yakhe, i-akhawunti yakhe ikhutshaziwe, noma kutholakale ingozi enkulu. Lokhu kunikeza abahlaseli isikhathi sokuhambahamba kunethiwekhi, ukuxhuma kuzinhlelo zokusebenza zangaphakathi, nokukhipha idatha.
Ukusebenzisa i-Universal CAE ngendlela eqinile yokuphoqelelaNoma yikuphi ukuhoxiswa kweseshini, isignali enobungozi obukhulu, noma ushintsho esimweni somsebenzisi kuphoqa ukuqinisekiswa kabusha cishe ngokushesha. Ngaphezu kwalokho, imizamo yokusebenzisa kabusha amathokheni avela kuma-IP ahlukene ivinjelwa ngempumelelo, okususa i-vector yokuhlasela evamile kuma-Windows LAN.
Kubalulekile ukubuyekeza zonke izinqubomgomo zokufinyelela ezinemibandela ukuqinisekisa ukuthi abayikhubazi i-CAE emisebenzini ethile. Ezinye izinkampani, ngezizathu zokuhambisana, zidala okuhlukile okube sekuba yizihibe ezihlala njalo.
Iklayenti Lokufinyelela Okuphephile Lomhlaba Wonke: Ukuletha i-LAN ephephile kuwo wonke amakhompyutha e-Windows
Ukuze ukuvikelwa kwenethiwekhi ye-Zero Trust kusebenze kahle, wonke amadivayisi aphethwe kumele asebenzise iklayenti le-Global Secure Access.Uma i-PC ye-Windows yenkampani ingenayo le klayenti efakiwe, ithrafikhi yayo ingaya ngqo kwi-inthanethi noma ezinsizeni zangaphakathi ngaphandle kokudlula ezilawulini zomngcele noma ekuhlolweni kokuhambisana.
Ngaphandle kweklayenti elithunyelwe kuzo zonke izindawo zokugcina eziphethwe Abahlaseli bangasebenzisa lawa madivayisi "angasebenzi" ukuze bathole ukufinyelela kokuqala, bahambe ngaphesheya kwe-LAN, noma bakhiphe ulwazi. Ngaphezu kwalokho, lawa madivayisi awazuzi ekuhlolweni kwenethiwekhi ezinqubweni zokufinyelela ezinemibandela, ukubuyiselwa kwe-IP yomthombo, noma imikhawulo yabaqashi.
Uma iklayenti lisebenza, amadivayisi e-Windows angaxhuma ngokuphephile. Ukufinyelela kokubili izinhlelo zokusebenza ze-SaaS kanye nezinsizakusebenza zangaphakathi kunikezwa nge-Microsoft Entra Private Access, kusetshenziswa njalo izinqubomgomo ezifanayo zobunikazi kanye nenethiwekhi. Ideshibhodi ye-Global Secure Access ikuvumela ukuthi uqaphe isimo seklayenti, uqinisekise ukuxhumana, futhi uthathe isinyathelo sokulungisa uma kutholwa izinkinga.
Elinye iphuzu elibalulekile amalayisense okufinyelela okuphephile emhlabeni wonkeUkuze usebenzise i-Microsoft Entra Internet Access kanye ne-Microsoft Entra Private Access, kudingeka i-Microsoft Entra ID P1. Uma umqashi wakho engenawo amalayisense afanele noma engakabelwa abasebenzisi, ithrafikhi yakhe ngeke idluliselwe ku-Global Secure Access futhi izohlala ingavikelekile. Kunconywa ukusebenzisa ilayisensi esekelwe eqenjini futhi uqaphe ukuphelelwa yisikhathi ukuze ugweme ukulahlekelwa yi-coverage ngengozi.
Amaphrofayili okudlulisa ithrafikhi kanye nokulawula okungena nokuphumayo kwi-LAN yakho
Ukudlulisa ithrafikhi kuyindlela eqinisekisa ukuthi ithrafikhi ye-LAN idlula ezingqimbeni zokuphepha kusuka ku-Global Secure Access futhi "ayiphumi" ngqo ngomnyango we-inthanethi.
I-Microsoft ichaza izinhlobo ezintathu zamaphrofayili okudlulisela phambili: eyodwa yethrafikhi ye-Microsoft (M365, i-Microsoft Entra ID, iGrafu, i-SharePoint, i-Exchange…), enye ye-Private Access (izinsiza zangaphakathi) kanye nenye ye-General Internet Access (iwebhu yomphakathi, i-non-Microsoft SaaS, njll.).
Uma lawa maphrofayela engavunyelweIzinqubomgomo zokuphepha, ukuhlunga okuqukethwe, ukuvikelwa kwezinsongo, kanye ne-CAE azikwazi ukusetshenziswa. Noma yisiphi isigebengu se-inthanethi esineziqinisekiso ezivumelekile singaxhuma ezinsizeni zakho kusuka kunoma iyiphi inethiwekhi, ngaphandle kokudlula emngceleni wakho wesimanje.
Kubalulekile futhi ukuchaza ngokucacile ububanzi bephrofayili ngayinyeUma unikeza ukudluliselwa "kubo bonke abasebenzisi" ngaphandle kokukuhlola kuqala ngamaqembu okuhlola, iphutha lokucushwa lingashiya yonke inkampani ingaxhunyiwe ku-inthanethi. Ngokuphambene nalokho, uma uchaza ububanzi obuncane kakhulu, uzoba nabasebenzisi abasebenza ngaphandle kokuvikelwa ngaphandle kokuthi othile aqaphele.
Okokugcina, qinisekisa ukuthi ithrafikhi ye-Microsoft 365 igeleza ngenkuthalo nge-Global Secure Access.Uma enye yaleyo thrafikhi ishiywe ngaphandle (ngenxa yamakhasimende amadala, ukucushwa ngesandla, noma amadivayisi angenamakhasimende), ulahlekelwa ukubonakala emisebenzini ebaluleke kakhulu ekukhiqizeni nasekusebenzisaneni, futhi kuba nzima kakhulu ukuhlanganisa ama-IP wangempela nokungena ngemvume kanye nezaziso.
I-Web Gateway evikelekile, ukuhlunga okuqukethwe kanye ne-TLS ezindaweni ze-Windows
I-LAN yenkampani evikelekile ye-Windows ayigcini nje ngokuvimbela amachweba ku-firewall.Kubalulekile futhi ukuhlola ithrafikhi ye-HTTP/HTTPS ephumayo, njengoba izinsongo eziningi zanamuhla zihamba zifihliwe.
Iphrofayili yokudlulisela ukufinyelela ku-inthanethi Le phrofayela iphoqa izicelo zewebhu zabasebenzisi bakho ukuthi zidlule ku-Secure Web Gateway (SWG) ye-Global Secure Access. Uma le phrofayela ingasebenzi, abasebenzisi bangaphequlula ngqo futhi balande i-malware, baxhume kuma-domain omyalo nokulawula, noma bakhiphe idatha ngaphandle kokuhlunga okuphakathi.
Iziqondiso zokuhlunga okuqukethwe kwewebhu ziyisisekelo salokhu kulawulaNgaphandle kwabo, ukufinyelela kunoma yisiphi isigaba sesayithi (okunonya, ubugebengu bokweba imininingwane ebucayi, isofthiwe ephangiwe, okuqukethwe okungafanele, njll.) kuvulekile. Indlela ephumelela kakhulu ukusebenzisa imithetho esekelwe ezigabeni (i-malware, ukukhwabanisa, ubusela, umsebenzi wobugebengu, njll.), kunokuthembela kuphela ohlwini lwama-URL athile, asheshe aphelelwe yisikhathi.
Lezi ziqondiso kumele zixhunywe kumaphrofayili okuphephaUma lezi zici zidalwe kodwa zingahlotshaniswa nanoma iyiphi iphrofayili noma iphrofayili yokubhekisela, azisetshenziswa nhlobo futhi zidala umuzwa wokuvikeleka ongamanga. Ngaphezu kwalokho, ukuhlanganiswa ne-Conditional Access kuvumela ukuhlunga okuqinile lapho kutholwa ingozi ephezulu (isibonelo, uma idivayisi ingalandeli imithetho noma umsebenzisi engena endaweni engavamile).
Ingxenye ebalulekile ukuhlolwa kwe-TLSNjengoba cishe yonke ithrafikhi yewebhu ibethelwe, uma izikhathi ze-HTTPS zingasuswa ekubethelweni endaweni yokulawula, izici eziningi zokuhlunga, i-DLP, kanye nezici zokuthola usongo zizoyeka ukusebenza. Lokhu kufezwa kusetshenziswa isitifiketi se-CA esiphakathi esikhiqiza ngokuguquguqukayo izitifiketi zamasayithi amakhompyutha akho e-Windows axhuma kuwo.
Qaphela okuhlukile kwe-TLS kanye nokuphathwa kwesitifiketi
Ukuhlolwa kwe-TLS akuyona isimo sokuthi "setha kube kanye bese ukhohlwa".Kunamaphuzu amabili abucayi kakhulu: imithetho yokudlula kanye nokuphelelwa yisikhathi kwesitifiketi sokuhlola.
Imithetho Yokudlula I-TLS Zikuvumela ukuthi ukhiphe izizinda noma izinhlelo zokusebenza ezithile ezingasekeli ukuhlolwa (isibonelo, izinsizakalo ezine-pining yesitifiketi noma i-TLS ehambisanayo). Inkinga ivela lapho lokhu okuhlukile kuqoqana ngokuhamba kwesikhathi, kuyeka ukuhlolwa, futhi kuba izindawo ezingaboni ukuthi abahlaseli bafuna ngamabomu ukuguqula umyalo wabo nokulawula ukuxhumana.
Kunconywa ukuthi ubuyekeze imithetho yokudlula ngezikhathi ezithile futhi ususe noma yiziphi izindawo ezingasadingeki noma eziphindaphindwayo kakade ohlwini lokweqa uhlelo. I-Global Secure Access ikhawulela inani lemithetho nezindawo zokuhlala ngomqashi ngamunye, ngakho ukugcina ukucushwa kuhlanzekile futhi kuphephile kwenza ukuphathwa kube lula.
Ngokuphathelene nesitifiketi sokuhlola se-TLSUma iphelelwa yisikhathi, ukuqedwa kwe-TLS kuyayeka ukusebenza ngokushesha. Ulahlekelwa ukuhlunga i-URL, ukutholwa kwezinsongo, kanye nanoma yikuphi ukulawula ithrafikhi ye-HTTPS. Akuvamile ukuthi abahlaseli bazame ukunciphisa isikhathi semikhankaso yabo ngezikhathi lapho bazi khona ukuthi ezinye izinhlangano ziyazikhulula izilawuli zazo ngesikhathi sokuvuselelwa kwezitifiketi.
Okungcono kakhulu, gcina iwindi okungenani izinsuku ezingama-90 ngaphambi kokuphelelwa yisikhathi.Sebenzisa izitifiketi ezinobuncane bokusebenza kwezinyanga eziyisithupha bese uhlela ukuvuselelwa usebenzisa ingqalasizinda yakho ye-PKI (i-ADCS, i-OpenSSL, njll.). Ngaphezu kwalokho, qapha izinga lephutha lokuhlola i-TLS bese uligcina lingaphansi kuka-1%, njengoba amazinga aphezulu evame ukukhombisa izinkinga zokuthembana okuhlelekile, ukungalingani, noma ngisho nemizamo yangamabomu yokubangela ukwehluleka kokuhlola.
Ubuhlakani bezingozi, i-firewall yamafu, kanye nokuvikelwa kwehhovisi legatsha
Ngaphandle kokuhlunga ngezigaba, ukusetshenziswa kobuhlakani bokusongela Uhlu oluguquguqukayo lwezizinda nama-URL anobungozi aziwayo lubalulekile ekuvimbeleni ukuxhumana nengqalasizinda yokuhlasela esebenzayo. Uma ungakuvumeli lokhu kuhlunga ku-Global Secure Access, amadivayisi angaqhubeka nokuxhumana namaseva omyalo nokulawula ngisho nangemva kokutholwa kwezinye izendlalelo.
Iphrofayili yokuphepha eyisisekelo ye-Global Secure Access Inikeza isivikelo esijwayelekile kubo bonke abaqashi, kodwa kungumqondo omuhle ukudala amaphrofayili enziwe ngokwezifiso axhunywe ezinqubomgomo zokufinyelela okunemibandela ukuze kucatshangelwe umongo (ubani umsebenzisi, iyiphi idivayisi axhuma kuyo, ukuthi uxhuma kuphi, njll.).
Kwamagatsha axhunywe ngemigudu ye-IPsecI-Global Secure Access cloud firewall inesibopho sokulawula ithrafikhi ephumayo eya kwi-inthanethi. Uma ungalungiseleli izinqubomgomo ze-firewall zala manethiwekhi akude, wonke amathrafikhi awo aphumayo azodlula ngaphandle kokuhlunga ungqimba lwenethiwekhi, okuvumela umhlaseli obeka engcupheni indawo yokusebenza yehhovisi legatsha ukuthi axhume kunoma iyiphi indawo yangaphandle ngaphandle kwemingcele.
Ukuchaza isimo "sokuphika ngokuzenzakalelayo" Bese ukuvula ithrafikhi edingekayo kuphela evela emagatsheni kunciphisa kakhulu amathuba okuphuma komoya kanye nokuhamba eceleni ukuya kwezinye izindawo, njengefu.
Ukuvimbela ukulahleka kwedatha, ukudluliswa kwamafayela, kanye nokuvikelwa kwe-AI yokukhiqiza
Enye yezindlela ezilula zokukhipha ulwazi ku-LAN Kuhilela ukusebenzisa izinsizakalo zokudlulisa amafayela ezisemthethweni, isitoreji samafu, noma ngisho nezinhlelo zokusebenza ze-AI ezikhiqizayo ukuze kulayishwe amadokhumenti abucayi.
Izinqubomgomo zokuhlunga okuqukethwe kwenethiwekhi ku-Global Secure Access vumela ukuqapha nokulawula ukudluliswa kwamafayela ngeziphequluli, izinhlelo zokusebenza, nama-API. Ngaphandle kwalezi zinqubomgomo, umsebenzisi ononya noma i-akhawunti esengozini angalayisha amadokhumenti ayimfihlo, iziqinisekiso, noma impahla yobuhlakani kumasevisi angaphandle ngaphandle kokuthola umkhondo ezinhlelweni zakho zokugcina.
Emkhakheni we-AI, i-AI Gateway kanye nokuvikelwa kwayo kwe-Prompt Shield Zengeza olunye ungqimba: zivimbela izinhlelo zokusebenza ze-AI zebhizinisi ukuthi zingahlaselwa ukuhlaselwa kokufakwa komyalo (ukuqhekeka kwejele okusheshayo, imiyalelo enonya efihliwe kokuqukethwe kwangaphandle, njll.) okungabangela ukuthi imodeli ingazinaki izinqubomgomo zangaphakathi, iveze idatha yangaphakathi, noma ikhiqize okuqukethwe kwe-phishing.
Sebenzisa lezi zilawuli ezingeni lenethiwekhi esikhundleni sohlelo lokusebenza ngohlelo lokusebenza Kuqinisekisa ukuma okuvumelanayo: awunciki eqenjini ngalinye lokuthuthukisa ukuthi lizisebenzise ngokuzimela izinyathelo zokuphepha ngokumelene nokufakwa ngokushesha kanye nokulahleka kwedatha ezixazululweni zabo ze-AI.
Ukufinyelela okunemibandela okusekelwe kunethiwekhi yokufinyelela okuphephile yomhlaba wonke kanye nokubonisana
Izinqubomgomo ze-Microsoft Zokufinyelela Okunemibandela Ziyinhlanganisela phakathi kobunikazi kanye nenethiwekhi. Enkampanini efuna ukuthola okuningi kwi-Windows LAN yayo, kubalulekile ukufuna ukuthi abasebenzisi baqinisekise kuphela izinsiza zenkampani uma ithrafikhi yabo idlula ku-Global Secure Access.
"Inethiwekhi ehambisanayo" ilawula ku-Conditional Access Bavumela lokho kanye: ukuqinisekisa ukuthi ukuqinisekiswa kuvela kusevisi yezokuphepha ye-Microsoft hhayi kunoma yiliphi ikheli le-IP le-inthanethi. Ngaphandle kwalezi zilawuli, umhlaseli oweba iziqinisekiso angaxhuma noma kuphi, edlula izihlungi zakho zokuqukethwe, ubuhlakani bezosongo, noma i-CAE.
Isibonakaliso Sokufinyelela Okuphephile Komhlaba Wonke Sokufinyelela Okunemibandela Lokhu kuxazulula enye inkinga: lapho ithrafikhi idlula ku-proxy, ikheli le-IP lomthombo elibonwa yi-Microsoft Entra ID ngokuvamile liyi-proxy, hhayi ikheli le-IP langempela lomsebenzisi. Ukuvumela lokhu kusayina kuvumela ulwazi olwengeziwe ukuthi lufakwe esicelweni ukuze izinqubomgomo ezisekelwe endaweni kanye nokutholwa kwezingozi (uhambo olungenakwenzeka, ama-IP angaziwa, izakhiwo zokungena ezingaziwa) ziqhubeke nokusebenza kahle.
Uma lokhu kusayina kungenziwangaAmalogi okungena azobonisa kuphela ama-IP e-proxy aphumayo, okwenza kube nzima noma yiluphi uphenyo lwe-forensic noma impendulo yesigameko, futhi anciphise ukunemba kokutholwa kwengozi okuzenzakalelayo.
Ukufinyelela Kwangasese kwe-Microsoft: Faka: I-Zero Trust for Internal Resources
Izinkampani eziningi zisathembele kuma-VPN endabuko ukuze zifinyelele izinsiza zangaphakathi (amaseva amafayela, ama-ERP, izinhlelo zokusebenza zangaphakathi). I-Entra yokufinyelela kwangasese ye-Microsoft ifuna ukufaka esikhundleni saleyo modeli ngemodeli ye-Zero Trust, lapho isicelo ngasinye siqinisekiswa futhi sigunyazwe ngokuningiliziwe.
Izixhumi zenethiwekhi ezizimele "ziyi-broker" ezixhumanisa i-LAN yakho ne-Global Secure AccessUma zingasebenzi noma ziphelelwe yisikhathi, abasebenzisi bangase balingeke ukuba basebenzise ezinye izindlela zokufinyelela ezingaphephile kangako, noma uzophoqeleka ukuthi uveze izinsizakalo ngqo kwi-inthanethi.
Iqembu ngalinye lezixhumi kufanele libe okungenani nezimo ezimbili ezisebenzayo ezisesikhathini.Ukuze kugwenywe amaphuzu alodwa okwehluleka, isixhumi esisodwa eqenjini sisho ukuthi inkinga yesofthiwe, isibuyekezo esibi, noma ngisho nesenzo esibi sendawo kungashiya zonke izinhlelo zokusebenza ezizimele ezincike kulelo qembu zingafinyeleli.
Ukuhlukaniswa kohlelo lokusebenza ekufinyeleleni okuyimfihlo Leli elinye iphuzu elibalulekile. Uma uchaza izingxenye ezibanzi kakhulu (ububanzi obukhulu be-IP, amachweba amaningi angahlungiwe, ukusetshenziswa okungakhethi kwe-Quick Access), empeleni uphinda imodeli evumelayo yama-VPN endabuko. Indlela enconywayo iwukuhlukanisa ngesicelo, usebenzisa ama-FQDN noma ama-IP namachweba athile, bese uhlobanisa ingxenye ngayinye nezinqubomgomo zokufinyelela okunemibandela ngokusekelwe kubungozi kanye nohlobo lwensiza.
I-DNS yangasese, ithrafikhi yangaphakathi, kanye nokusebenza ekufinyeleleni okukude
Ukulungiswa kwamagama kwangaphakathi kubalulekile ukuze i-Private Access isebenze kahle.Uma ungalungiseleli i-DNS yangasese efanele, abasebenzisi abakude ngeke bakwazi ukuxazulula ama-FQDN angaphakathi ngomhubhe ophephile, futhi imishini yabo ye-Windows izobuyela kumaseva e-DNS omphakathi, lapho lawo magama engekho khona.
Uma iphrofayili Yokufinyelela Okuyimfihlo ivuliwe kodwa ama-port e-DNS angashicilelwa (53 UDP/TCP) ezigabeni ezifanele, noma uma izijobelelo ze-DNS eziyimfihlo zingachazwanga, iklayenti le-Global Secure Access alikwazi ukuhambisa imibuzo yangaphakathi ye-DNS. Lokhu kubangela ukuthi izingxenye ezisekelwe ku-FQDN zingasebenzi, futhi umsebenzisi ugcina exhuma ngqo, ngaphandle kwezinqubomgomo zenethiwekhi.
Ukuthuthukisa ukusebenza ngaphandle kokulahla ukuphephaIzici ezifana ne-Intelligent Local Access (ILA) zivumela ithrafikhi yangasese ukuthi idluliselwe endaweni lapho umsebenzisi ekwinethiwekhi yenkampani uqobo, okugwema ukuhamba okungadingekile efwini ngenkathi kugcinwa izilawuli zokufinyelela ezinemibandela.
Ukufinyelela Okusheshayo, ngakolunye uhlangothi, kumele kuxhunywe kahle kumaqembu ezixhumi ezisebenzayo Izinqubomgomo Zokufinyelela Okunemibandela sezivele zikhona. Ngaphandle kwalokho, abasebenzisi ngeke bakwazi ukufinyelela izinsiza zangaphakathi lapho bezidinga, noma okubi nakakhulu, bazokwazi ukwenza kanjalo ngaphandle kwe-MFA eyengeziwe, ukuthobela imithetho yedivayisi, noma ukuhlolwa kwendawo.
Abalawuli besizinda, i-RDP, kanye nezinzwa zokuphepha endaweni ye-Windows
Ku-LAN esekelwe ku-Windows, abalawuli besizinda yibo abawumgomo oyinhloko.Noma ubani olawula isizinda ulawula ama-akhawunti, izinqubomgomo, amaqembu, kanye, empeleni, inethiwekhi yonke.
Uma abaphathi befinyelela abalawuli besizinda nge-RDP Besebenzisa i-Microsoft Private Sign-In, kumele benze kanjalo ngokuqinisekiswa okumelana nobugebengu bokweba imininingwane ebucayi: isibonelo, okhiye bokuphepha be-FIDO2, Windows Hello for Business ngokusekelwa okuqinile, noma izindlela ezifanayo ezidinga ubufakazi bokubethela ubunikazi.
Ngaphandle kwalezi zindlela ezimelanaUmhlaseli okwazi ukweba iziqinisekiso noma amathokheni weseshini yokuntshontsha angaziphinda ukuze asungule amaseshini e-RDP kumlawuli wesizinda, enze ukuhlaselwa kwe-DCSync ukuze akhiphe ama-hashes awo wonke ama-akhawunti, adale amathikithi egolide e-Kerberos futhi alondoloze ukuphikelela kwesikhathi eside, noma ashintshe ama-GPO ukuze asebenzise i-malware enkulu.
Izinzwa zokufinyelela eziyimfihlo ezifakwe kubalawuli besizinda Zivumela izinqubomgomo eziqinile ukuthi zisetshenziswe ezicelweni ze-Kerberos ezivela kunethiwekhi yendawo. Ngaphandle kwalezi zinzwa, noma iyiphi idivayisi enokufinyelela ku-LAN ingacela amathikithi esevisi ezinsizakalweni ezikhethekile ngaphandle kokulawulwa kwe-MFA, ukuthobela imithetho, noma umongo, okuthuthukisa imodeli yokuthembana engacacile ngokusekelwe kuphela ekubeni "ngaphakathi" kwenethiwekhi.
Ukusekela ngokulondoloza kwe-LAN, ukugcinwa, kanye nokuphathwa kokusebenza
Ukuphepha kwe-LAN akugcini ekuvimbeleni ukufinyelela okungagunyaziwe.Kusho futhi ukukwazi ukululama uma kukhona okungahambi kahle. Umlilo esikhungweni sedatha, i-ransomware ebethela iseva yefayela, noma ukwehluleka kwehadiwe kungayikhubaza inkampani uma kungekho ama-backup aklanywe kahle.
Kunconywa ukuthi kuhlanganiswe idatha yebhizinisi kuseva yefayela. noma kumasevisi okugcina aphephile anenqubomgomo yokusekela ngokulondoloza ecacile, okuhlanganisa nokusekela ngokulondoloza ngaphandle kwendawo (ngaphandle kwehhovisi noma kwenye indawo) ezimweni zenhlekelele enkulu. Ukuqhathaniswa kwezindlela zokusekelayo ukukhetha isu elingcono kakhulu.
Isizinda seWindows esiphethwe kahle Kwenza kube lula ukwabiwa kwemvume, ukuphoqelelwa kwenqubomgomo yephasiwedi, ukuthunyelwa kwesofthiwe, kanye nokuphathwa kokuvuselelwa. Kuqinisekisa ukuthi wonke amakhompyutha kunethiwekhi asebenzisa izinguqulo zobungcweti zeWindows ezingafakwa kahle ku-Active Directory noma ku-Microsoft Entra.
Ngaphezu kwesofthiwe ye-antivirus ebuyekeziwe kuwo wonke ama-PC namasevaKunconywa ukuthi kusungulwe ukulungiswa njalo: ukubuyekeza amalogi, ukuhlola isimo sama-backup, ukusebenzisa ama-patches abalulekile, amalayisense okugcina impahla, kanye nokulandelela izehlakalo. Ukunikeza lo mthwalo wemfanelo kumuntu wangaphakathi noma umhlinzeki wangaphandle kusiza ukuvimbela izinkinga ukuthi zingakhungatheki.
Okokugcina, ungalokothi ubukele phansi isici somuntuUkuhlunga amakheli e-MAC, ukukhubaza amachweba e-Ethernet angasetshenziswanga, ukukhawulela ukufakwa kwesofthiwe, kanye nokuhlukaniswa nge-VLAN kunciphisa umonakalo ongabangelwa yiphutha lesisebenzi kanye nesenzo esihlosiwe ngumuntu onganelisekile ngaphakathi kwenhlangano.
Inethiwekhi ye-LAN eklanywe kahle futhi ephethwe kahle endaweni ye-Windows, ethuthukisiwe ngamakhono e-Microsoft Entra, Ukufinyelela Okuphephile Komhlaba Wonke, ukuhlukaniswa, ukuhlunga iwebhu, kanye nobuhlakani bokusongelaIba namandla kakhulu kunesethi elula yezintambo namaswishi: iba yipulatifomu ephephile lapho inkampani yakho ingaqhubeka nokukhula khona, ifaka i-IoT, izinsizakalo zamafu kanye ne-AI ekhiqizayo ngaphandle kokuzibeka engcupheni yokuhlaselwa kwe-cyber okuvame kakhulu namuhla.
