Iyini i-IPS ekuvikelekeni kwekhompyutha futhi iyivikela kanjani inethiwekhi yakho?

Informatec Digital » Amanethiwekhi » Iyini i-IPS ekuvikelekeni kwekhompyutha futhi iyivikela kanjani inethiwekhi yakho?

Ezweni lanamuhla ledijithali, lapho ukuhlaselwa kwe-cyber kuqhubeka nokuguquka, amabhizinisi nabantu ngabanye badinga amathuluzi aqinile nakamuva okuvikela amanethiwekhi abo kanye nezinhlelo zamakhompyutha. Izinhlelo Zokuvimbela Ukungena (i-IPS) sezibe yitshe lesisekelo lokuzivikela okusebenzayo ezinsongweni ezingaziwa kanye nokuhlaselwa okuyinkimbinkimbi, okuhlinzeka ngamakhono okuthola okuthuthukile kanye nokuphendula okuzenzakalelayo ezigamekweni ezingakhubaza ukusebenza kwenhlangano ngemizuzwana embalwa.

Uma uke wezwa amagama afana ne -IDS, i-IPS, noma i-SIEM futhi wazibuza ukuthi ayini nokuthi kungani ebalulekile ekugcineni ukuphepha kwedijithali, lesi sihloko sizokutshela konke okudingeka ukwazi, sichazwe kalula futhi ngokuningiliziwe ukuze ungaphuthelwa lutho. Thola ukuthi iyini i-IPS, isebenza kanjani, ihluke kanjani kwezinye izixazululo, nokuthi yiziphi izinzuzo kanye nemikhawulo yayo.

Iyini i-IPS ekuvikelekeni kwekhompyutha?

Isifinyezo se -IPS simelela i-Intrusion Prevention System . Siyisisombululo sobuchwepheshe—kungaba isofthiwe, ihadiwe, noma isevisi yamafu—eklanyelwe ukuqapha, ukuhlaziya, nokuvikela ithrafikhi yenethiwekhi noma yesistimu kanye nemisebenzi ngokumelene nokufinyelela okungagunyaziwe, izenzo ezinonya, nazo zonke izinhlobo zezinsongo ze-cyber . Ngokungafani nezinhlelo ze-IDS, ezithola futhi zixwayise kuphela, i-IPS ithatha izinyathelo ezizenzakalelayo zokumisa ukuhlasela okungenzeka ngokushesha nje lapho ikuthola , isebenza ngesikhathi sangempela.

Leli khono lokungenelela ngokushesha liyisici esiyinhloko esihlukanisa i-IPS kuneyandulelayo, i-IDS (Intrusion Detection System), ekhawulelwe ekuxwayiseni abaphathi kodwa ayivimbeli imisebenzi esolisayo. Ngakolunye uhlangothi, i-IPS ibona usongo futhi iluqede ngaphambi kokuba lubangele umonakalo owengeziwe.

Ukusebenza nokwakhiwa kwesistimu ye-IPS

I -IPS ifakwe endleleni yethrafikhi yenethiwekhi , ngokuvamile ngemuva kwe-firewall, ihlola yonke i-data engenayo nephumayo ukuthola izimpawu zokuhlasela, i-malware, ukuxhashazwa kobuthakathaka, noma ukuziphatha okungajwayelekile. Uma ithola umsebenzi osolisayo, ayikhiphi nje kuphela isexwayiso kodwa futhi ingavimba ngqo ithrafikhi, ihlukanise imishini ethelelekile, ilahle amaphakethe ayingozi, iqede ukuxhumana, noma ishintshe imithetho ye-firewall ukuze kuqiniswe ukuphepha.

Ukwakhiwa kwe-IPS kungahlukaniswa izigaba eziningana:

• Ukuqapha nokuhlaziya: Ihlola konke ukugeleza kwephakethe, amaphrothokholi, nokuziphatha kwenethiwekhi okuvamile.
• Ukutholwa: Isebenzisa imininingo egciniwe yamasiginesha aziwayo, imithetho echazwe uchwepheshe, nama-algorithms okufunda komshini ukuze kutholwe okudidayo namaphethini okuhlasela.
• Ukungenelela: Uma ithola usongo, yenza impendulo eyodwa noma ngaphezulu ezenzakalelayo (ukuvimbela, ukuhlukaniswa, isaziso, njll.)
• Ukubhalisa nokufunda: Bhala isigameko ukuze unike amandla ukuthuthukiswa nokuzivumelanisa nezinsongo ezifanayo.

Ama-IPS anamuhla asebenzisa ubuhlakani bokwenziwa kanye namasu okufunda okujulile ukuze athuthukise ukutholwa nokunciphisa imiphumela engamanga, azivumelanise ngokuzenzakalelayo nezinsongo ezintsha ezivela nsuku zonke.

Izindlela zokuthola eziyinhloko ezisetshenziswa ku-IPS

Ukuhlonza izinsongo, ama-IPS asebenzisa izindlela ezimbalwa eziphelelisanayo, ezivumela ukutholwa kwakho kokubili ukuhlasela okwaziwayo nokuhluka okusha noma izinsongo ebezingabonwa ngaphambilini:

• Ukutholwa kwesiginesha: Kubandakanya ukuqhathanisa ithrafikhi etholiwe nesizindalwazi samaphethini okuhlasela aziwayo noma ubungozi. Isebenza kakhulu ngokumelene nezinsongo esezihlukanisiwe, kodwa ayikutholi ukuhlaselwa okungaziwa.
• Ukutholwa Okungavamile: I-IPS yakha isisekelo "sokuziphatha kwenethiwekhi okuvamile" futhi iphakamisa i-alamu uma kukhona ukuchezuka okubalulekile, njengokunyuka okungajwayelekile kwethrafikhi, amasevisi enziwe asebenze ngaphandle kwesizathu, noma ukufinyelela okungavamile kuzisetshenziswa ezibalulekile.
• Ukutholwa okusekelwe kunqubomgomo: Umlawuli uchaza imithetho ethile ngokusekelwe ezidingweni kanye nezinqubo ezivunyelwe; noma yimuphi umsebenzi owephula lezi zinqubomgomo ukhiqiza impendulo.
• Ukuhlaziywa kwe-Heuristic nokufunda komshini: Kusetshenziswa ama-algorithms athuthukile akwazi ukuhlonza ukuziphatha okusolisayo okungafakwanga kukhathalogi ngaphambilini, ukuzivumelanisa nezimo ngesikhathi sangempela.

Lokhu kuhlanganiswa kwezindlela kubalulekile ukuze i-IPS ikwazi ukubona kokubili ukuhlaselwa kwe-cyber okwaziwayo kanye nezinsongo ze-zero-day (ukuxhashazwa kobuthakathaka okungakalungiswa).

Izinhlobo zezinhlelo zokuvimbela ukungena (IPS)

Ngokuya ngobubanzi bazo nokuthi zisetshenziswa kuphi, kunezinhlobo ezimbalwa ze-IPS, ngayinye inezinzuzo zayo kanye nemikhawulo:

• Inethiwekhi ye-IPS (NIPS): Isetshenziswa ezindaweni zamasu kunethiwekhi ukuhlaziya ithrafikhi yomhlaba wonke, ukuhlinzeka ukuvikeleka okusabalele nokubonakala okuphelele mayelana nokuthi kwenzekani phakathi kwamakhompyutha namaseva.
• Isikhungo se-IPS (HIPS): Ifakwe ngokuqondile kumadivayisi (amakhompyutha, amaseva, omakhalekhukhwini), ivikela leyo mishini ngayinye futhi isebenze njenge umugqa wokugcina wokuzivikela ngokumelene nokuhlaselwa okuhlosiwe noma kwangaphakathi.
• I-IPS engenantambo (i-WIPS): Isebenza ngokukhethekile ngamanethiwekhi angenantambo, iqapha futhi ivikele ekufinyeleleni okungagunyaziwe noma ukuhlaselwa kwengqalasizinda ye-Wi-Fi.
• Ukuhlaziywa Kokuziphatha Kwenethiwekhi (NBA): Lawa masistimu afunda ukuziphatha kwethrafikhi ukuze kutholwe Ukugeleza okungajwayelekile, ukuhlaselwa kwe-DDoS nezinsongo ezivelayo ngokuhlaziywa kwezibalo namaphethini.

Umkhuba wamanje ukuhlanganisa izinhlobo eziningana ze-IPS ukuze kufezwe ukuvikelwa okunezingqimba eziningi nokuhlanganisiwe , ngokuvamile eceleni kwe-firewall nezinye izinhlelo ezifana ne-SIEM noma i-antivirus yenkampani.

Umehluko phakathi kwe-IDS, IPS ne-SIEM

Kuvamile ukudida noma ukuxuba le miqondo, kodwa ngayinye idlala indima ethile ekuvikelweni kwedijithali:

• I-IDS (Isistimu Yokutholwa Kokungena): igxile ku thola futhi uqaphele mayelana nokufinyelela okungagunyaziwe noma imisebenzi, kodwa akwenzi ukuvimbela ukuhlasela.
• I-IPS (Isistimu Yokuvimbela Ukungena): Ngaphezu kokubona, phendula ngokuzenzakalelayo ukuvimbela noma ukunciphisa ukuhlasela ngesikhathi sangempela.
• I-SIEM (Ulwazi Lokuvikeleka Nokuphathwa Kwemicimbi): Kuyisixazululo sokuphatha esimaphakathi esiqoqa futhi sihlaziye amalogi kuwo wonke amasistimu ukuze kuhlonzwe izitayela, ukukhiqiza imibiko, nokwenza lula uphenyo lwangemva kwesigameko.

Empeleni, ukucushwa okuhle kakhulu kokuphepha kwe-cyber kuvame ukuhlanganisa zonke izinhlelo ezintathu , ngayinye ihlanganisa isici esibalulekile sokuvikela.

Izinzuzo eziyinhloko zesistimu ye-IPS

Ukuba ne-IPS elungiswe kahle kuletha izinzuzo eziningi kuzo zombili izinhlangano ezinkulu namabhizinisi amancane:

• Ukuvikelwa Okusebenzayo: Ihlonza futhi ivimbe izinsongo lapho zenzeka ngaso leso sikhathi, ivimbele ukulimala okwengeziwe.
• Ukuzivikela ngokumelene nokuxhashazwa nokuba sengozini: Ivala iwindi lethuba phakathi kokuhlonza ubungozi kanye nokushicilela/ukusebenzisa ipheshi.
• Ukwehliswa komsebenzi wethimba lezokuphepha: Ukuziphendulela kwezigameko zokuphendula konga isikhathi nomzamo owenziwe ngesandla, okukuvumela ukuthi ugxilise izinsiza emisebenzini enamasu amaningi.
• Ukubonakala nokulawula: Ihlinzeka ngemibiko enemininingwane futhi ikuvumela ukuthi ulungise kalula ukufinyelela kwenethiwekhi noma izinqubomgomo zokusebenzisa.
• Ukukala nokwenza ngokwezifiso: Ijwayelana nazo zonke izinhlobo zendawo, kusukela kumanethiwekhi omhlaba kuya kumadivayisi angawodwana abalulekile.
• Ukuhlanganiswa kwezendlalelo eziningi: Ingahlanganiswa nezinye izixazululo zokuvikela ezifana nezibhulamlilo zesizukulwane esilandelayo, i-UTM, noma i-SIEM ukuze kuqiniswe ukuphepha.

Imikhawulo kanye nokubi kwe-IPS

Nakuba kubalulekile, ama-IPS awanawo amaphutha futhi anobubi obuthile okufanele bucatshangelwe:

• Okuhle okungamanga: Amasistimu asebenzisa ukutholwa okususelwe kokudidayo angavimba umsebenzi osemthethweni uma engalinganiswanga kahle, okungaba nomthelela ekukhiqizeni.
• Izindleko nobunkimbinkimbi: Ukuphatha nokuhlanganiswa kwayo kungase kudinge ulwazi oluthuthukisiwe namaqembu akhethekile, ikakhulukazi ezinhlanganweni ezinkulu.
• Ingozi yokuhlaselwa kwe-DoS/DDoS: Uma i-IPS ingakakhiwe ngendlela efanele, ingakhungatheka futhi ingasebenzi ekuhlaseleni okukhulu kokunqatshelwa kwesevisi.
• Ukuncika emithethweni ebuyekeziwe namasignesha: Ukuvikela kuhle kuphela njengesizindalwazi sokusongela osisebenzisayo.
• Isidingo sokunakekelwa njalo: Kubalulekile ukubuyekeza izinqubomgomo futhi ubuyekeze uhlelo ukuze luvumelane nezinsongo ezintsha.

I-IPS akufanele ibhekwe njengesithiyo sokuphepha kuphela, kodwa njengengxenye yesu lokuzivikela eliphelele.

Imisebenzi esemqoka nezinyathelo ezingathathwa yi-IPS

Izimpendulo ezizenzakalelayo ezivame kakhulu ezenziwa yi-IPS lapho kutholwa ukuhlasela okungaba khona zifaka:

• Lahla amaphakethe anonya ngesikhathi sangempela ukuze bangafiki lapho beya khona.
• Vimba ithrafikhi eya noma esuka kumthombo wokuhlasela wamakheli e-IP.
• Setha kabusha ukuxhumana ezikhonjwe njengeziyingozi.
• Shintsha imithetho ye-firewall ukuqinisa isivikelo.
• Hlukanisa amadivayisi noma izingxenye zenethiwekhi okungenzeka kube sengozini.
• Thumela izexwayiso ezizenzakalelayo nemibiko ethimbeni lezokuphepha ukuze livumele ukuhlaziya okwenziwa ngesandla kanye nezimpendulo ezengeziwe.

Kwezinye izimo, i-IPS iphinde isebenzise lokho okubizwa ngokuthi "i-virtual patch ," okungukuthi, ungqimba lwemithetho noma izinqubomgomo ezivimbela ukusetshenziswa ekufinyeleleni ubuthakathaka, ngisho nangaphambi kokuba isofthiwe ethintekile ikhiphe isibuyekezo esisemthethweni.

Kungani usebenzise i-IPS kunethiwekhi yakho?

Ukusetshenziswa kwezinhlelo zokuvimbela ukungena sekuyinto ebalulekile ku:

• Hlangana nezidingo zokuphepha nezokucwaninga emikhakheni elawulwayo (ezezimali, ezempilo, izimboni, njll.).
• Vimbela ukuvuza kolwazi kanye nokufinyelela okungagunyaziwe okungathinta kakhulu isithunzi nokusebenza kwenkampani.
• Thola futhi uvimbele izinsongo eziyinkimbinkimbi njengokuhlasela kwe-brute force, i-malware ethuthukisiwe, i-ransomware, i-Trojans, noma amagobolondo ewebhu.
• Khawulela ukusetshenziswa kwamaphrothokholi angavikelekile, ukuqinisekisa ukuthi ukubethela okuqinile kuphela nezinguqulo ezibuyekeziwe zezinsizakalo ezibalulekile ezisetshenziswayo.

Ukukhethwa nokucushwa kwe-IPS kufanele kusekelwe kusayizi wenethiwekhi, uhlobo lolwazi okufanele luvikelwe, kanye nesabelomali esitholakalayo. Kumanethiwekhi amancane, i-firewall enokusebenza okuhlanganisiwe kwe-IPS ingase yanele, kuyilapho izindawo zezinkampani eziyinkimbinkimbi zizodinga izixazululo ezizinikele, ezenziwe ngokwezifiso.

Amathrendi amanje: Next-Generation IPS

Amasistimu e-IPS athuthuke kakhulu kusukela ezinguqulweni zawo zakuqala. Namuhla, bagqama kulokhu:

• Ukuhlanganiswa namanethiwekhi wamafu nama-hybrid: Izixazululo zesimanje zingasatshalaliswa ezindaweni zamafu kanye ne-SaaS futhi zisekele amanethiwekhi asabalalisiwe.
• I-automation esekelwe kubuhlakani bokwenziwa: Ukufunda okujulile kunika amandla ukutholakala kwezinsongo ebezingabonwa ngaphambilini ngezinto ezimbalwa kakhulu ezingamanga.
• Ukubuyekezwa njalo kwamasiginesha: Abathengisi babuyekeza imininingo yabo egciniwe cishe ngesikhathi sangempela ukuze bahlanganise ukuxhashazwa okusha nokuba sengozini.
• Ukuphatha okumaphakathi: Aphathwa ngama-consoles ahlanganisiwe, ukwenza lula ukuqapha nokubikwa kwezigameko emabhizinisini amakhulu.
• Umthamo wokuhlanganisa ne-SIEM nezinye izinhlelo: Inika amandla ukubonakala okuphelele futhi ilungiselela impendulo ezehlakalweni eziyinkimbinkimbi.

Ukuba ne -IPS elungiselelwe kahle futhi esesikhathini kwenza umehluko omkhulu phakathi kokuvimbela ukuhlaselwa kwe-cyber kanye nokuphulwa kokuphepha . Ukuvikelwa kwenethiwekhi kanye nohlelo kudinga kakhulu izixazululo ezihlakaniphile, ezenzakalelayo, neziguquguqukayo ezikwazi ukuphendula esimweni sosongo esishintsha njalo.