- Ukuqaliswa kwezinqubomgomo eziyinkimbinkimbi kanye nobude obuncane ngokusekelwe ezindinganisweni zokuphepha zamanje.
- Ukusetshenziswa Kwezinqubomgomo Zephasiwedi Ezinezinhlayiya Ezinhle (i-FGPP) ukuze kusetshenziswe imikhawulo eqinile kubasebenzisi abanamalungelo athile.
- Umehluko phakathi kwesitoreji se-hash se-LM ne-NT ukuze kuthuthukiswe ukumelana nokuhlaselwa.
- Ukwamukelwa kwama-password kanye ne-MFA ukunciphisa izingozi zamandla amakhulu kanye nokwebiwa kweziqinisekiso.
Uma kukhulunywa ngokuphatha ukuphepha kunethiwekhi yezinkampani, i-Achilles' heel ngokungangabazeki iwukuphathwa kweziqinisekiso. Kuyiqiniso ukuthi izigebengu ze-inthanethi azisebenzisi njalo amasu ayinkimbinkimbi; ngezinye izikhathi, ukuhlasela ngamandla amakhulu noma ukuqagela nje amaphethini avamile kwanele ukungena ohlelweni bese uqala ukuhamba eceleni kwengqalasizinda kuze kube yilapho bethola imali eningi.
Ukuze kuvinjelwe inethiwekhi yethu ukuthi ingabi yisihlungi, kubalulekile ukumisa i-Active Directory ukuze amaphasiwedi angabi umdlalo. Akukhona nje ukusetha ubude obuncane, kodwa mayelana nokusebenzisa isu eliphelele elihlanganisa izinqubomgomo eziqinile, ukugcinwa okuphephile kwama-hashes, futhi, ngaphezu kwakho konke, ukuqeqeshwa okuqhubekayo ukuze abasebenzi bangagcini benamathisela inothi le-post-it nephasiwedi yabo kusikrini sekhompyutha yabo.
Izihluthulelo zigcinwa kanjani ohlelweni lwe-Windows?
I-Windows ayigcini amaphasiwedi ngombhalo ocacile (lokho kungaba ukuzibulala kwedijithali), kodwa kunalokho isebenzisa imisebenzi yendlela eyodwa, eyaziwa kangcono ngokuthi ama-hashes e-cryptographic . Empeleni, kuwumsebenzi wezibalo oguqula iphasiwedi ibe uchungechunge lwezinhlamvu ezingenakushintshwa. Kuma-domain e-Active Directory, kusetshenziswa izinhlobo ezimbili eziyinhloko: i-LM (LAN Manager) OWF kanye ne-NT OWF.
Uhlelo lwe-LM manje seluyisistimu esiphelelwe yisikhathi esinakekelwa ngezinjongo zokuhambisana, njengoba luhlukanisa ukhiye ube amabhlogo amabili angama-7-byte futhi lusengozini enkulu. Ngakolunye uhlangothi, i -hash ye-NT isebenzisa i-algorithm ye-MD4 futhi iyindinganiso yokuqinisekisa ezizindeni zanamuhla. Kubalulekile ukwazi ukuthi lawa makhi ahlala kufayela le -NTDS.DIT lesizindalwazi se-Active Directory, esivikelwe yizingqimba zokubethela ezifana ne-AES-256 ezinguqulweni zakamuva ze-Windows Server.
Ngaphezu kwesizindalwazi esiphakathi, kukhona i-SAM yendawo kumakhompyutha kanye neziqinisekiso ezigciniwe . Lokhu kokugcina kuvumela umsebenzisi ukuthi angene noma ngabe ikhompyutha ilahlekelwe uxhumano lwayo nesilawuli sesizinda, ngokusekelwe ku-hash ethathwe egameni lomsebenzisi kanye ne-NT OWF.
Ukulungiselela izinqubomgomo zephasiwedi: Isinyathelo ngesinyathelo
Ukuze sihleleke esiphithiphithini, singaphatha okhiye abavela ku-Group Policy Management Console (GPMC). Ngokuzulazula siye ku- Computer Configuration > Security Settings > Account Policies , singachaza imithetho yesizinda sonke.
- Ubude nobunkimbinkimbi: Izinhlamvu eziyisishiyagalombili azisanele. Izinhlangano ezifana ne-INCIBE ziphakamisa okungenani Izinhlamvu eziyi-12Ubunzima kufanele buvunyelwe ukuze kuphoqelelwe ukusetshenziswa kwezinhlamvu ezinkulu, izinhlamvu ezincane, izinombolo, kanye nezimpawu.
- Umlando kanye nokusebenza kahle: Ukuze uvimbele umsebenzisi ukuthi ashintshe phakathi kwamaphasiwedi amabili afanayo, kunconywa ukuthi umlando wamaphasiwedi angu-24Ngokuphathelene nosuku lokuphelelwa yisikhathi, kungaqinisekiswa ukuthi kuvumelekile izinsuku ezingaba ngu-45 ukuze kuphoqelelwe ukuvuselelwa.
- Ukuvinjwa kwe-akhawunti: Ukuze umise ukufafaza ngephasiwedi, kubalulekile ukuhlela umkhawulo wokuvimba (isibonelo, imizamo engu-8 ehlulekile) bese uchaza isikhathi sokulinda, njengemizuzu engu-30, ngaphambi kokuba i-akhawunti izivule noma idinga ukungenelela komlawuli.
Iziqondiso Zobuncane Obuncane (i-FGPP)
Akubona bonke abasebenzisi abasesilinganisweni esifanayo sengozi. Umamukeli akadingi inqubomgomo yokuphepha efanayo nomphathi wesistimu onamalungelo aphezulu . Yilapho-ke i-Strong Password Policies (FGPP) ingena khona, itholakala kusukela ku-Windows Server 2008.
Lokhu kulawulwa nge- Active Directory Administration Center (ADAC) , ikakhulukazi esitsheni sokuLungiswa kwephasiwedi. Lapha, singakha i-Password Configuration Object (PSO) bese siyinika iqembu elithile lokuphepha, njengeqembu elibizwa ngokuthi i-gs_workers . Ngale ndlela, singadinga abaphathi ukuthi basebenzise amaphasiwedi amade kakhulu futhi ayinkimbinkimbi kunabanye abasebenzi.
Umehluko phakathi kwamaphasiwedi nama-password
Ngezinye izikhathi sikhathazeka kakhulu ngokusebenzisa izimpawu ezingavamile okungekho muntu ozikhumbulayo, lapho amandla angempela ekhona ngobude. Yilapho kungena khona amagama okungena . Ngokungafani nephasiwedi yendabuko, igama lokungena liwuchungechunge olude lwamagama oluvame ukufaka izikhala.
Kunzima kakhulu ukuwavula usebenzisa amakhompyutha ngoba isikhala sokusesha sikhulu kakhulu . Ngaphezu kwalokho, kulula ngabantu ukuwakhumbula, okunciphisa amathuba okuthi umsebenzisi abhale iphasiwedi endaweni engaphephile. Ukuze kuvinjelwe ukukhiqizwa kwama-LM hashes (uhlobo olubuthakathaka kakhulu), indlela ephumelelayo ukudala amaphasiwedi aqinile ngokuwadinga ukuba abe made kunezinhlamvu ezingu-14.
Ukugcinwa, ukuhlolwa kwezimali, kanye nokuxazulula izinkinga
Uma imithetho isisetshenzisiwe, kubalulekile ukuqapha ukuhambisana. Ungasebenzisa imiyalo efana ne -`net accounts` kumyalo wokubuka inqubomgomo yamanje, noma umyalo we -`Get-ADDefaultDomainPasswordPolicy` nge-PowerShell ukuthola imininingwane yesizinda.
Uma umsebenzisi ekhononda ngokuthi inqubomgomo entsha ayisetshenziswa kuye, singasebenzisa i-`gpupdate /force` ukuze sivuselele izinqubomgomo noma sisebenzise i-`gpresult /r` ukuze sihlaziye ukuthi yimaphi ama-GPO asetshenziswa emshinini. Kubalulekile futhi ukuqapha ukuphindaphindwa phakathi kwabalawuli besizinda nge -`repadmin /replsummary` , njengoba ukuntuleka kokuvumelanisa kungabangela ukuthi umsebenzisi avinjwe kuseva eyodwa kodwa hhayi kwenye.
Ukuze kugwenywe ukuxina abasebenzi ngemikhawulo eyeqile, kunconywa ukusebenzisa amathuluzi avela eceleni. Abaphathi bamaphasiwedi abavulekile bavumela ukusetshenziswa kwamaphasiwedi ahlukile naqinile ngaphandle kokuwakhumbula wonke, kuyilapho izinhlelo zokusetha kabusha amaphasiwedi (SSPRs) zivimbela ukwesekwa kobuchwepheshe ekuxinanisweni yizingcingo njalo lapho umuntu ekhohlwa amaphasiwedi akhe.
Ukuphepha kobunikazi ku-Active Directory kuncike ekubaleni phakathi kokuqina kobuchwepheshe, ukusetshenziswa kwama-hashes anamuhla njenge-NT kanye ne-AES-256, ukusetshenziswa kwezinqubomgomo ezihlanganisiwe ezisekelwe ebungozini bomsebenzisi, kanye nokusetshenziswa kwezinyathelo ezengeziwe ezifana nokuqinisekiswa kwezinto eziningi (i-MFA) , okusebenza njengesithiyo esikhulu lapho iphasiwedi yehluleka.
