- Imbiza yobusi iyisistimu yobuqili elingisa izinsiza ezisengozini ukuze idonse futhi ibuke ukuhlaselwa kwe-inthanethi ngaphandle kokubeka izimpahla ezibalulekile engozini.
- Kukhona izimbiza zokukhiqiza nokucwaninga, kanye nezimbiza zokusebenzisana okuphansi nokuphezulu, ngayinye inezinhloso ezahlukene, izingozi, kanye nezinzuzo.
- Ukusetshenziswa kwayo okufanele kanye nokuhlanganiswa ne-SOC, SIEM, VAPT, MDR, EDR kanye ne-XDR kunikeza ukutholwa kusenesikhathi, ama-alamu amanga ambalwa kanye nobuhlakani obuwusizo bokusongela.
Ezweni lansuku zonke lokuphepha kwe-inthanethi , kuvela amagama azwakala njengenganekwane yesayensi, futhi elinye lalawo athakazelisa kakhulu yi- honeypot edumile . Akuyona imilingo noma into efana naleyo, kodwa ingenye yamasu ahlakaniphile kakhulu okuqonda ukuthi izigebengu ze-inthanethi zihlasela futhi zimise kanjani ukunyakaza kwazo ngaphambi kokuba zifinyelele ezinhlelweni ezibaluleke kakhulu.
Uma sikhuluma nge- honeypot yokuphepha kwenethiwekhi , empeleni sibhekisela ohlelweni lwesicupho oluklanyelwe ukubonakala lusengozini futhi lukhanga umhlaseli. Ngokuvumela umhlaseli ukuba abambe isicupho, amaqembu okuphepha angabuka amaqhinga awo ngokuthula, aqophe yonke into eyenzeka, futhi asebenzise lonke lolo lwazi ukuqinisa ukuzivikela kwangempela kwenhlangano.
Iyini i-honeypot ekuphepheni kwe-inthanethi kwenethiwekhi?
I- honeypot ekuphepheni kwe-cyber iyisisetshenziswa se-IT esihlelwe ngamabomu ukuze sihlaselwe: singalingisa iseva, isizindalwazi, uhlelo lokusebenza lwewebhu, noma ngisho nenethiwekhi encane yonke. Kumhlaseli, kubonakala sengathi kuyisisulu esisemthethweni, kodwa empeleni, kuyisistimu yobuqili ehlukanisiwe futhi eqashwe ngokucophelela enhloso yayo kuphela ukuheha nokufunda imisebenzi enonya.
Umqondo uwukuthi yonke ithrafikhi efika ebhodweni lokudoba ibhekwa njengesolisayo noma enonya ngokuzenzakalelayo . Akekho okufanele ayisebenzise ngokusemthethweni, ngakho-ke noma yimuphi umzamo wokuyifinyelela, ukuskena amachweba, ukusebenzisa ubuthakathaka, noma ukufaka i-malware ufakwa ngemininingwane eminingi ukuze kuhlaziywe kamuva.
Lezi zinhlelo zingaba yingxenye yenethiwekhi yenkampani noma ilebhu yocwaningo, futhi ngokuvamile zilingisa izinsizakalo zokukhiqiza ezivamile : amaseva ewebhu, i-FTP, i-RDP, i-SSH, izizindalwazi, noma izinhlelo zokusebenza ezinobuthakathaka obaziwayo. Lapho ukukhohlisa kugculisa kakhulu, kulapho amathuba okuba umhlaseli anikele ngesikhathi nezinsiza ukuze akuyekethise.
Ngaphandle kokusebenza njengesicupho, imbiza yoju isebenza njengohlobo lwe -radar yosongo : ivumela ukutholakala okusheshayo kwemisebenzi engavamile okungenzeka ukuthi ayizange iphakamise izinsolo ezinhlelweni zokukhiqiza ezigcwele ithrafikhi esemthethweni.
Incazelo esemthethweni kanye nezimiso eziyisisekelo zezimbiza zoju
Ngokombono osemthethweni, imbiza yobusi iyinsiza yolwazi edalulwe ngamabomu ebaluleke kakhulu ekuhlaselweni nasekuhlaziyweni. Ayinikezi insizakalo yangempela ebhizinisini; inhloso yayo ukuheha abahlaseli nokuqopha ukuziphatha kwabo.
Esinye sezimiso ezibalulekile ukuthi imbiza yobusi kumele isebenze ngohlobo "lokungavikeleki" kudatha yangempela : akufanele iqukathe ulwazi olubucayi, iziqinisekiso ezisebenzayo, noma ukufinyelela okuqondile ezinhlelweni zokukhiqiza; kuyalulekwa futhi ukusebenzisa izinyathelo zokuvikela idatha yomuntu siqu ku-inthanethi . Uma umhlaseli ephumelela ukuyiphula, umonakalo kumele uhlale uvinjelwe kuleyo ndawo elawulwayo.
Esinye isimiso esiyisisekelo esokubuka buthule . Imbiza yobusi ayimvimbi ngokushesha umhlaseli noma yenze izinto zibe nzima kuye kusukela ngomzuzwana wokuqala; ngokuphambene nalokho, ibanika isikhathi esanele sokubona ukuthi yimaphi amathuluzi abawasebenzisayo, ukuthi yimiphi imiyalo abayikhiphayo, ukuthi bahamba kanjani eceleni, nokuthi yini abazama ukuyikhipha.
Okokugcina, ulwazi olukhiqizwe yi-honeypot kufanele luhlanganiswe nenqubo yokuthuthukisa ukuphepha okuqhubekayo : ukubuyekeza imithetho ye-firewall, ukulungisa izinhlelo zokuthola ukungena (i-IDS/IPS), ukuqinisa ukucushwa, ukubeka phambili ama-patches, kanye nokuklama izinqubo ezingcono zokuphendula ezigamekweni.
Indlela imbiza yoju esebenza ngayo ngaphakathi kwenethiwekhi
Ukusebenza okusebenzayo kwe-network honeypot kulula ngomqondo, kodwa kudinga ukuhlela okuningi kobuchwepheshe . Okokuqala, uhlelo lwe-trap luklanyelwe: yiziphi izinsizakalo oluzozilingisa, yiziphi izingqinamba ezibonakala sengathi luzobonisa, kanye nohlobo luni lwedatha engamanga oluzoludalula ukuze lubonakale luthembekile.
Uma isisetshenzisiwe, i-honeypot ixhuma kunethiwekhi (yangaphakathi, yangaphandle, noma ehlukaniswe ngezigaba) futhi ilungiselelwe ukurekhoda konke okwenzekayo ngaphakathi kwayo ngemininingwane eminingi ngangokunokwenzeka : ukuxhumana okungenayo, imiyalo esetshenzisiwe, izinguquko zefayela, imizamo yokukhulisa amalungelo, ukunyakaza okuseceleni, njll.
Uma umhlaseli ethola i-honeypot, ngokuvamile ngokusebenzisa ukuskena okuzenzakalelayo noma ukuskena kwe-IP ngobuningi, uyichaza njengesisulu sangempela. Bese beqala ukuqalisa ama-exploit kits, izikripthi ze-brute-force, i-malware, noma amathuluzi okusebenzisa ngemuva kokuxhashazwa . Wonke lo msebenzi uqashwa ngesikhathi sangempela futhi ugcinwe ukuze uhlaziywe kamuva.
Ngenxa yalokhu kuhlaziya, amaqembu okuphepha angathola amaqhinga, amasu, kanye nezinqubo (ama-TTP) ezazingakabonakali ezinhlelweni zawo zokuzivikela, athole izinhlobo ezintsha ze-malware, noma athole imikhankaso yokuhlasela eqondiswe emikhakheni ethile.
Ngaphezu kwalokho, i-honeypot isiza ukuqinisekisa imibono: uma kusolwa, isibonelo, ukuthi ububanzi be-IP buqondiswe ama-bots athile, i-honeypot ingafakwa kulolo bubanzi obufanayo bese ihlolwa ukuze kubonakale ukuthi imizamo yokungena iyawa yini ngemizuzu embalwa.
Izinhlobo zezimbiza zoju ngokwenhloso yazo
Kuye ngenhloso yazo eyinhloko, izimbiza zoju ngokuvamile zihlukaniswa ngezigaba ezimbili eziyinhloko: izimbiza zoju zokukhiqiza kanye nezimbiza zoju zocwaningo . Zombili zinomqondo wokuba yizicupho, kodwa indlela yazo kanye nokusetshenziswa kwazo kuhlukile kakhulu.
Izimbiza zokukhiqiza zihlanganiswe ezindaweni zangempela zebhizinisi futhi zihloselwe ukutholakala kokungena kusenesikhathi , ukukhiqiza izixwayiso, kanye nokuphazamisa abahlaseli, okubadonsela kude nezimpahla ezibalulekile zenhlangano.
Ngakolunye uhlangothi, izindawo zokucwaninga ezisebenzisa amakhemikhali ngokuvamile ziphathwa amaqembu ezemfundo, amalebhu okuphepha kwe-inthanethi , noma abathengisi abakhulu bezokuphepha. Inhloso yabo ukuqoqa idatha enkulu ngezinsongo ezivelayo, imikhankaso yomhlaba wonke ye-malware, kanye nokuziphatha kwamaqembu ezigebengu ze-inthanethi.
Ezimweni eziningi, imiphumela etholwe kulezi zimbiza zocwaningo yabelwana ngayo nomphakathi wezokuphepha kwe-inthanethi : imibiko yosongo, izisayini ezintsha zokutholwa, izinkomba zokuyekethisa (ama-IoC), kanye namathuluzi okuzivikela abese esetshenziswa emhlabeni jikelele.
Izimbiza zokukhiqiza uju: ukuzivikela okuqondile
Ibhodwe lokukhiqiza lisetshenziswa ngaphakathi kwengqalasizinda yenethiwekhi yenkampani , ngokuvamile ezindaweni ezingenampi (ama-DMZ) noma izingxenye ezithile, ukuze lisebenze njengesistimu yokuxwayisa kusenesikhathi kanye nokuphazamisa.
Umsebenzi wayo osobala kakhulu ukusebenza njengenzwa yokuhlasela yesikhathi sangempela . Uma umhlaseli eqala ukuskena inethiwekhi noma eqala ukusebenzisa izinsiza ezibonakala zisengozini, i-honeypot izoba ngeyokuqala ukushaywa futhi izokhiqiza izexwayiso zethimba lezokuphepha.
Ngaphezu kwalokho, lezi zimbiza zoju zisiza ekuguquleni ukunaka komhlaseli. Esikhundleni sokugxila ngokushesha ezinhlelweni ezibucayi, isigebengu se-inthanethi singachitha isikhathi nomzamo ekwehliseni inkohliso, sinikeze ithimba eliphendulayo ngesehlakalo isikhathi sokuthola , ukuvimbela, nokunciphisa ukungena.
Ngakolunye uhlangothi, ulwazi oluqoqwe yizimbiza zokukhiqiza luwusizo kakhulu ekucwengisiseni imithetho ye-firewall, i-IDS/IPS, i-EDR, noma i-XDR . Ngokuthola amaphethini athile okuhlasela ngokumelene nalezi zinkohliso, ukuziphatha okufanayo kungavinjelwa ngokuzenzakalelayo ezinhlelweni zokukhiqiza.
Kodwa-ke, izimbiza zokukhiqiza kumele zigcinwe zodwa futhi zilawulwe ngokuqinile ukuze kuvinjelwe abahlaseli ukuthi bangazisebenzisi njengesisekelo sokuya kwezinye izinhlelo . Ukuhlukaniswa kwenethiwekhi okungekuhle noma izimvume eziningi kungenza imbiza yokukhiqiza ibe yingozi.
Cwaninga izimbiza zoju: ulwazi olujulile ngesitha
Izimbiza zocwaningo zenzelwe ukuqoqa ubuhlakani bezinsongo ngokuhlelekile . Ngokuvamile ziyingxenye yamanethiwekhi asatshalaliswa emhlabeni wonke athola izigidi zemizamo yokuhlasela yazo zonke izinhlobo, kusukela kuma-bots azenzakalelayo kuya emikhankasweni eqondiwe.
Kulo mongo, ukuhlaziywa okujulile kubhekwa njengobalulekile kunempendulo esheshayo yokusebenza. Kuqoshwa inani elikhulu ledatha: amasampula e-malware, imithwalo ephelele, ukulandelwa kwenethiwekhi okuningiliziwe, izikripthi, kanye nezintambo zokusebenzisa eziyinkimbinkimbi.
Ngalolo lwazi, abacwaningi nabahlaziyi bangahlola imindeni emisha ye-malware , bathole ama-exploit kit amasha, bahlele ingqalasizinda yokulawula nokulawula (C2) yamaqembu athile obugebengu, futhi bathuthukise amathuluzi okuthola nokuphendula asebenza kahle kakhulu.
Imiphumela ivame ukubonakala emibikweni yomphakathi, emithethweni yezinjini ze-antivirus, izisayini ze-IDS, ama-IoC feeds, kanye nezinye izinsiza ezivumela izinkampani nezinhlangano ukuthi ziqinise izindlela zazo zokuzivikela ngaphambi kokuba ukuhlaselwa kube nomthelela omkhulu.
Ngamafuphi, ngenkathi i-honeypot yokukhiqiza igxile ekuvikeleni ngqo inethiwekhi yenhlangano , i-honeypot yocwaningo ifuna ukwandisa ulwazi lomhlaba wonke mayelana nezinsongo futhi inikele ekuphepheni kwayo yonke indawo yedijithali.
Amazinga okuxhumana: ubunzima obuphansi nobuphezulu
Enye indlela evamile yokuhlukanisa ama-honeypot yizinga lawo lokuxhumana nomhlaseli. Ngokuyisisekelo, kwakhiwa umehluko phakathi kwama-honeypot angasebenzi kahle kanye nama-honeypot asebenza kahle kakhulu, ngalinye linezinzuzo nezinkinga zalo.
I-honeypot esebenzisana kancane ilingisa izinsizakalo noma amaphrothokholi athile kuphela, isabela ngendlela elinganiselwe kakhulu. Ngokuvamile kulula ukuyisebenzisa nokuphatha, ngengozi encane yokusebenza , kodwa futhi inikeza umbono ongaphezulu kakhulu wokuhlaselwa.
Ngakolunye uhlangothi kukhona ama-honeypot asebenzisana kakhulu, afana kakhulu nohlelo lwangempela: avumela umhlaseli ukuthi akhiphe imiyalo, afake i-malware, ahlole iziqondiso, andise amalungelo, noma azame ukuhamba eceleni, ngaphakathi kwendawo elawulwa ngokucophelela.
Lezi zimbiza zoju ezisebenzisana kakhulu zinikeza ulwazi olucebile nolunemininingwane eminingi mayelana nokuziphatha kwesigebengu se-inthanethi, kodwa zihilela umzamo omkhulu wokulungisa kanye nengozi enkulu uma zingahlukaniswanga kahle nengqalasizinda yokukhiqiza.
Kuye ngezinhloso kanye nezinsizakusebenza zenhlangano ngayinye, inhlanganisela yazo zombili izindlela ivame ukukhethwa : izimbiza zezinyosi ezisebenzisana kancane ukuze kutholakale kusenesikhathi esikhulu, kanye nezinye izimbiza zezinyosi ezisebenzisana kakhulu ezindaweni ezilawulwayo ukuze kuhlaziywe ngokujulile.
Izimbiza zoju ezisebenzisana kancane: ubulula kanye nengozi ephansi
Ama-honeypots asebenzisana kancane agxila ekulingiseni isethi elinganiselwe yezinsizakalo (isibonelo, iseva yewebhu, i-SSH, noma i-FTP enomsebenzi omncane). Aphendula izicelo ngendlela eyisisekelo, eyanele ukuthi ama-scanner nama-bot azibone njengezisulu ezingaba khona.
Inzuzo yabo eyinhloko ukuthi kulula ukuyibeka kanye nokulungisa : ingafakwa ngokushesha, idinga izinsizakusebenza ezimbalwa zehadiwe, futhi kulula ukuyiqapha. Ngaphezu kwalokho, ngokunganikezi umhlaseli "umshini ophelele," isikhala somhlaseli sokuhamba silinganiselwe.
Nakuba ukusebenzisana kulinganiselwe, lawa ma-honeypots awusizo kakhulu ekutholeni amaphethini okuhlasela okuqala : ukuskena kwama-port, imizamo yamandla amakhulu kuziqinisekiso, ukuhlolwa kokusebenzisa okuzenzakalelayo, njll. Ngalolu lwazi, izihlungi zokuphepha nemithetho kungabuyekezwa kuyo yonke inethiwekhi.
Umkhawulo wabo oyinhloko ukuthi, njengoba bengenalo iqiniso, umhlaseli ongumuntu onekhono angase asheshe ababone njengenkohliso bese enquma ukungawembuli amasu akhe aphelele . Ulwazi mayelana nezigaba zakamuva zokuhlasela nalo luyalahleka.
Noma kunjalo, ezindaweni lapho izinsiza zilinganiselwe noma kufunwa ikhambi elisezingeni lokuqala, izimbiza zoju ezisebenzisana kancane ziyindlela engabizi kakhulu futhi enobungozi obuphansi yokuthola ukubonakala kwezinsongo.
Izimbiza zoju ezisebenzisana kakhulu: imininingwane ephezulu, ukunakekelwa okuphezulu
Ngakolunye uhlangothi, ama-honeypot asebenzisana kakhulu anikeza umhlaseli ulwazi olufana kakhulu nolwesistimu yokukhiqiza yangempela . Angaba amaseva aphelele, imishini ebonakalayo, noma izitsha ezilungiselelwe ngokucophelela ukuze zibonakale zisengozini futhi zikhanga.
Kulolu hlobo lwe-honeypot, umhlaseli angenza ikhodi engadingekile, alande amathuluzi, ashintshe ukucushwa, futhi azame ukushintshela kwezinye izinsiza . Ngenxa yalesi sizathu, ukulawulwa kwenethiwekhi kanye nokuhlukaniswa kumele kusetshenziswe kahle kakhulu.
Inzuzo enkulu ukuthi zivumela ukuthwebula zonke izigaba zokuhlasela: kusukela ekuhloleni kokuqala kuya ekuhlungweni kwedatha okulingisiwe noma ekusetshenzisweni kwe-ransomware mbumbulu. Lokhu kunikeza izinga elibalulekile lemininingwane yokwakha amamodeli angokoqobo okusongela.
Kodwa-ke, ukugcina la ma-honeypot kuhilela ukusetshenziswa okukhulu kwezinsizakusebenza: ama-patches kumele asetshenziswe (ngenkathi kugcinwa ukubukeka okuthile kokuba sengozini), ama-backup kumele aphathwe, ukucushwa kumele kujikeleziswe, futhi kumele kuqinisekiswe ukuthi umhlaseli akakwazi ukusebenzisa i-honeypot njengendawo yokuhlasela abantu besithathu.
Ngenxa yazo zonke lezi zizathu, izimbiza zomhluzi ezisebenzisana kakhulu zivame ukugcinelwa izinhlangano ezinamaqembu okuphepha avuthiwe, noma amalabhorethri agxile ekuhlaziyweni kwe-malware kanye nezinsongo ze-cyber ezithuthukisiwe.
Indlela yokusebenzisa imbiza yoju kunethiwekhi
Ukusebenzisa i-honeypot ephumelelayo akukhona nje ukumisa umshini osengozini nokulindela okuhle. Kudinga isu elicacile nokuhlela ngokucophelela ukuqinisekisa ukuthi i-decoy inikeza inani futhi ayibi yinkinga eyengeziwe yokuphepha.
Isinyathelo sokuqala ukuchaza izinhloso: Ingabe ufuna ubuhlakani bezinsongo zomkhakha othile? Ingabe ufuna ukuthuthukisa ukutholakala kusenesikhathi kokuhlaselwa kwangaphakathi noma kwangaphandle? Ingabe ufuna ukuqeqesha ithimba lezokuphepha ekuphenduleni ezigamekweni? Kuye ngempendulo, kuzokhethwa uhlobo olufanele kakhulu lwembiza yobusi.
Okulandelayo, udinga ukunquma indawo yayo ngaphakathi kwesakhiwo senethiwekhi . Ingabekwa emaphethelweni e-inthanethi, ku-DMZ, engxenyeni yangaphakathi, noma ngisho nasendaweni yelabhorethri ehlukanisiwe, kuye ngohlobo lwethrafikhi ofuna ukuyidonsela nokuqapha.
Ukusethwa kumele kube nokulinganisela okubucayi: ukwenza imbiza yobusi ibonakale ingokoqobo futhi isengozini ngokwanele ukuba ikhange, ngaphandle kokunikeza izinhlelo zokukhiqiza iminyango yangempela. Lokhu kuhilela ukusebenzisa izinguqulo ezindala zezinsizakalo, ukuvula amachweba ngendlela ehlelekile, kanye nedatha elingisiwe ethembekile.
Uma isisebenza, i-honeypot kumele ihlanganiswe namathuluzi okuqapha nokuhlaziya: i-SIEM, i-SOC, izinhlelo zokuloba ezihlanganisiwe, amadeshibhodi okuthola nokuphendula aphethwe (i-MDR, i-EDR, i-XDR) , njll. Ngale ndlela, ulwazi olukhiqizwayo aluhlukanisiwe, kodwa ludla kwezinye izindlela zokuzivikela.
Okokugcina, kuyalulekwa ukuthi kusungulwe izinqubo ezicacile: ukuthi ubani obuyekeza ama-log, kangaki, ukuthi kufanele kwenziwe kanjani uma kutholwa ukuhlaselwa, nokuthi yiziphi izinyathelo ezilandelwayo ukuze kuhunyushwe lokho okufundiwe kube ngcono kwangempela kwendlela yokuma kokuphepha.
Ukuqapha, ukuhlaziya kanye nokusetshenziswa kolwazi oluqoqwe
Amandla eqiniso ebhodwe loju alele kulokho okwenziwa ngedatha eliyikhiqizayo. Akwanele ukumane uyishiye lapho "uma kwenzeka": kufanele uqaphe njalo futhi uhlaziye okwenzekayo ngaphakathi kwebhodwe.
Okokuqala, yonke imicimbi efanele (ukuxhumana, imiyalo, izinguquko zefayela, izinqubo eziqalisiwe) ithunyelwa ohlelweni lwelogi oluphakathi noma i-SIEM , lapho ihlotshaniswa khona nolwazi oluvela kwezinye izinhlelo kunethiwekhi.
Ukusuka lapho, abahlaziyi bangabona amaphethini okuziphatha okusolisayo , njengemizamo yokuqinisekisa ephindaphindwayo evela ekhelini elifanayo le-IP, ukusetshenziswa kwamathuluzi aziwayo ngemuva kokuxhashazwa, noma ukufakwa kwezinhlobo ezithile ze-malware.
Lokhu okutholakele kuhunyushwa kube yimithetho eqondile: ukusayina okusha kwe-IDS/IPS, izinkomba zokuyekethisa ezifakwe ku-EDR, uhlu lwamakheli e-IP avinjelwe ku-firewall, noma ukulungiswa kwezinqubomgomo zokufinyelela zezinsizakalo eziveziwe.
Ngokuhamba kwesikhathi, i-honeypot iziveza njengomthombo ozinzile wobunhloli obusebenzayo bokusongela , okuvumela inhlangano ukuthi ihlale isinyathelo esisodwa phambili kwabahlaseli esikhundleni sokusabela kuphela lapho sebevele bebangele isigameko esibi.
Izinzuzo zokusebenzisa izimbiza zoju ekuphepheni kwenethiwekhi
Ukufaka izimbiza zoju esu lokuphepha kwenethiwekhi kunikeza izinzuzo eziningi ezidlula kakhulu ulwazi lobuchwepheshe. Uma zisetshenziswa kahle, ziba amathuluzi abalulekile okulindela ukuhlaselwa nokunciphisa umthelela wezigameko.
Inzuzo eyinhloko ukutholakala kwezinsongo kusenesikhathi . Njengoba noma yimuphi umzamo wokufinyelela imbiza yobusi usolisa, usebenza njengohlelo lokuxwayisa kusenesikhathi, ikakhulukazi ngokumelene nemisebenzi yokuhlola noma ukuhlaselwa kwabantu ngokuzenzakalelayo.
Okwesibili, ama-honeypot asiza ekunciphiseni umsindo kanye nama-alamu angamanga . Ngokungafani nezinye izinhlelo zokuthola, lapho kuhlanganiswa khona ithrafikhi efanelekile, lapha noma yikuphi ukuxhumana okungagunyaziwe kunethuba elincane kakhulu lokuba msulwa, okwenza kube lula ukubekwa phambili kwezexwayiso.
Futhi zinikeza ingcebo yobuhlakani bezinsongo . Ukubuka ngqo indlela abahlaseli abasebenza ngayo kuvumela ukubuyekeza imithetho, izinqubomgomo, kanye nokucushwa okusekelwe kudatha yangempela, hhayi ekucabangeni noma emibonweni.
Okokugcina, ukusetshenziswa kwayo kuvame ukusebenza kahle . Ngokutshalwa kwezimali okulinganiselwe kuhadiwe nesikhathi, kungaveza ulwazi oluzonga imali eningi ekuphenduleni kwezehlakalo, ekunciphiseni umonakalo, kanye nokubuyiselwa kwesistimu.
Izingozi nezinselele zezimbiza zoju
Naphezu kwazo zonke izinzuzo zazo, izimbiza zoju aziyona ingozi. Uma zakhiwe noma zinakekelwa kabi, zingaletha izingozi ezintsha zokuphepha futhi zibe yikhanda elibuhlungu kunokuba usizo.
Enye yezingozi ezisobala kakhulu ukuthi umhlaseli angasebenzisa i-honeypot njengesisekelo sokuhlasela ezinye izinhlelo enhlanganweni noma ngisho nabantu besithathu, uma ukuhlukaniswa kwenethiwekhi kungachazwanga kahle.
Enye ingozi ukudalulwa okungaba khona ngengozi kolwazi olubucayi uma izimbiza zoju zigcwele idatha yangempela ukuze zibonakale zithembekile. Noma yikuphi okuqukethwe okusetshenziswe ngaphakathi kwe-decoy kumele kwenziwe ngokucophelela.
Izindleko zezinsizakusebenza kumele zicatshangelwe futhi: ukuklama, ukusabalalisa, ukuqapha, nokuhlaziya imbiza eyodwa noma ngaphezulu zezinyosi kudinga isikhathi, abasebenzi abakhethekile, namathuluzi afanele . Uma inhlangano ingakwazi ukwenza lo mzamo, uhlelo luzogcina lushiywe futhi lunganikezi nzuzo.
Okokugcina, kunezimfuneko zomthetho nezokuziphatha . Nakuba ukubamba nokubuka umhlaseli akufani nokuhlasela ngokuphindisela, kubalulekile ukuqinisekisa ukuthobela imithetho esebenzayo mayelana nobumfihlo, ukucutshungulwa kwedatha, kanye nesibopho uma imbiza yobusi isetshenziselwa ukulimaza abantu besithathu.
Ukuhlanganiswa nezinye izindlela zokuphepha kwe-inthanethi
Ama-honeypots akufanele abhekwe njengesixazululo esihlukile, kodwa kunalokho abhekwe njengengxenye eyodwa ngaphakathi kwesu elijulile lokuzivikela . Amandla awo angempela avela lapho ehlanganiswa namanye amathuluzi nezinqubo zokuphepha.
Isibonelo esicacile ukuhlanganiswa kwayo nokuhlolwa kobuthakathaka kanye nokuhlolwa kokungena (i-VAPT) . Imiphumela yalezi zivivinyo ingabonisa ukuthi kunengqondo kuphi ukubeka izimbiza zoju nokuthi yiziphi izinsizakalo okufanele zilingiswe ukuze kubonwe ukuhlaselwa kwangempela ngokumelene nobuthakathaka obufanayo.
Ziphinde zihlangane kahle nezikena ezivamile zobungozi. Okutholakele kulezi zikena kusiza ekunqumeni ukuthi yiluphi uhlobo lwesimo sokukhohlisa olubaluleke kakhulu nokuthi yimaphi amaphethini okuhlasela okufanele aqashwe eduze.
Ezingeni lokusebenza, ukuhlanganiswa ne- Security Operations Center (SOC) , kungaba ngaphakathi noma njengesevisi (SOCaaS), kubalulekile. I-SOC inesibopho sokwamukela nokuxhumanisa izexwayiso ezivela ebhodweni lokudoba nezinye izingqalasizinda, okuthuthukisa ukutholakala nokusabela.
Okokugcina, ngokuxhumanisa ulwazi lwe-honeypot namapulatifomu e -MDR, EDR, kanye ne-XDR , izifundo ezifundwa endaweni yokukhwabanisa zihunyushwa ngqo emithethweni yokuvikela kanye nempendulo ezenzakalelayo kuzo zonke iziphetho nezinhlelo enhlanganweni.
Ukusetshenziswa okusebenzayo kwezimbiza zoju
Ngaphandle kwenkolelo-mbono, ama-honeypot anezindlela eziningi ezisebenzayo zokuphepha kwe-inthanethi kwansuku zonke. Akuwona nje ithoyizi lelebhu, kodwa amathuluzi awusizo kakhulu ezindaweni zangempela.
Enye yezinhlelo zayo ezicacile ukuqoqwa kolwazi mayelana nezinsongo ezivelayo . Njengoba abahlaseli behlola amasu amasha noma besebenzisa i-malware entsha, ama-honeypots angabamba lawo masampula ngaphambi kokuba afike ezinhlelweni ezibalulekile.
Esinye isicelo esibalulekile ukuthuthukisa ukuma kokuzivikela kwenhlangano . Ulwazi olutholakala ekuhlaselweni kwangempela kwe-honeypot lusetshenziselwa ukuqinisa ama-firewall, ukulungisa ukucushwa kwe-IDS/IPS, ukubuyekeza imithetho ye-imeyili, ukuthuthukisa izinqubomgomo zephasiwedi, kanye nokuqinisa izinsizakalo ezivezwe obala.
Ngaphezu kwalokho, izimbiza zoju ziyindawo ekahle yokuqeqesha amaqembu okuphepha . Zivumela ukuphinda kwenziwe izehlakalo zangempela, ukuzijwayeza ukuthola, ukuhlaziya, kanye nokuphendula, futhi zihlole ukuthi abahlaziyi basabela kanjani ezimweni ezicindezelayo ngaphandle kokubeka izimpahla zokukhiqiza engozini.
Ekugcineni, zingasebenza njengesivikelo. Inhlangano ebonisa izindlela zokuthola ezithuthukisiwe kanye namacebo okukhohlisa asebenzayo ingase ingakhangi kangako abahlaseli, abavame ukukhetha ama-target anezivikelo eziyisisekelo.
Sekukonke, izimbiza zoju zihlanganisa indima yokuzivikela eqondile (ukuthola nokuguqula ukuhlaselwa) nengxenye yocwaningo, yokufunda, kanye nokuthuthukiswa okuqhubekayo okuzenza zibe abalingani abawusizo kakhulu ekuvikeleni amanethiwekhi esimanje endaweni esongelayo ehlala ishintshashintsha.
