Peb tab tom tham txog kev ruaj ntseg hauv huab
Tshaj Tawm
Cia li muab tso rau hauv no, ua li cas koj txhawj txog kev nthuav tawm? Koj cov khoom muaj nqis tshaj plaws yog dab tsi? Koj tus lej Social Security? Koj cov ntaub ntawv hauv txhab nyiaj? Cov ntaub ntawv ntiag tug, lossis duab? Koj cov kab lus crypto noob? Yog tias koj tswj hwm lub tuam txhab, lossis muaj lub luag haujlwm rau kev ruaj ntseg ntawm cov ntaub ntawv, koj yuav txhawj xeeb txog tib hom ntaub ntawv raug cuam tshuam, tab sis ntawm abroadyog scale. Koj tau txais kev tso siab los ntawm koj cov neeg siv khoom nrog kev tiv thaiv lawv cov ntaub ntawv.
Raws li cov neeg siv khoom, peb muab kev ruaj ntseg ntawm peb cov ntaub ntawv tso cai. Ntau thiab ntau zaus hnub no cov ntaub ntawv khaws cia hauv huab. Ntau tus neeg muag khoom muab cov kev pabcuam uas tso cai rau cov neeg siv khoom thaub qab cov ntaub ntawv los ntawm lawv lub computer hauv zos mus rau huab. Xav txog nws li lub hard drive virtual nyob saum ntuj. Qhov no tau tshaj tawm tias yog txoj hauv kev nyab xeeb thiab yooj yim los tiv thaiv koj cov ntaub ntawv. Yooj yim, yog. Koj tuaj yeem rov qab tau cov ntaub ntawv uas koj tau yuam kev deleted. Koj tuaj yeem rov qab tau tag nrho lub hard drive uas nws cov ntaub ntawv tau corrupted.
Tab sis nws puas muaj kev nyab xeeb? Koj muab lub xauv thiab tus yuam sij. Qhov tseem ceeb yog, feem ntau, tus username thiab password. Nws yog encrypted thiab paub tsuas yog rau koj. Yog vim li cas cov kws paub txog kev ruaj ntseg pom zoo kom khaws koj tus password kom ruaj ntseg. Yog tias ib tug neeg nkag mus rau koj tus password, lawv muaj tus yuam sij virtual rau koj lub tsev virtual.
Koj paub tag nrho cov no. Koj lo lus zais rau qhov kev pabcuam huab thaub qab yog 16 tus cim ntev, muaj cov tsiaj ntawv loj thiab cov ntawv me, cov lej thiab ob peb cim tshwj xeeb. Koj hloov nws txhua rau lub hlis vim koj paub tias ua rau nws nyuaj rau tus neeg nyiag nkas. Nws txawv ntawm koj lwm tus password - koj tsis siv tib lo lus zais rau ntau qhov chaw. Yuav ua li cas mus tsis ncaj ncees lawm?
Qee lub tuam txhab muab qhov uas lawv tau muab npe ua "Personal Cloud." Western Digital yog ib qho ntawm cov tuam txhab uas muab txoj hauv kev yooj yim rau thaub qab koj cov ntaub ntawv rau koj tus kheej qhov chaw hauv huab. Nws yog networked cia muaj nyob hauv internet. Nws ntsaws rau hauv koj lub router Wi-Fi kom koj tuaj yeem nkag mus tau los ntawm txhua qhov chaw hauv koj lub network. Yooj yim, vim nws tseem txuas nrog hauv internet, koj tuaj yeem nkag mus rau koj tus kheej cov ntaub ntawv los ntawm txhua qhov chaw hauv internet. Nrog yooj yim los pheej hmoo.
Ib Txoj Haujlwm Sib Haum
Nyuam qhuav pib lub xyoo no, hackers tsoo rau Western Digital's systems thiab tau mus download tau kwv yees li 10 Tb ntawm cov ntaub ntawv. Cov neeg xa ntawv dub tom qab ntawd tuav cov ntaub ntawv rau tus nqe txhiv thiab sim sib tham txog sab qaum teb ntawm US $ 10,000,000 rau kev nyab xeeb ntawm cov ntaub ntawv. Cov ntaub ntawv zoo li roj. Los yog tej zaum kub yog ib qho piv txwv zoo dua. Ib tug ntawm cov neeg nyiag nkas tau hais txog qhov tsis qhia npe. Ha! TechCrunch xam phaj nws thaum nws nyob hauv tus txheej txheem ntawm kev lag luam no. Dab tsi yog qhov nthuav yog tias cov ntaub ntawv uas raug cuam tshuam nrog Western Digital's code-signing daim ntawv pov thawj. Qhov no yog thev naus laus zis sib npaug ntawm retina scan. Daim ntawv pov thawj yog npaj los txheeb xyuas tus tswv lossis tus tuav pov hwm zoo. Nrog rau qhov virtual retina scan, tsis tas yuav tsum muaj tus password rau kev nkag mus rau "kev ruaj ntseg" cov ntaub ntawv. Hauv lwm lo lus, nrog daim ntawv pov thawj no tus neeg ua lag luam lub kaus mom dub tuaj yeem taug kev ncaj nraim ntawm lub qhov rooj ntawm lub qhov rooj digital palace.
Western Digital tsis kam hais lus teb rau cov neeg nyiag nkas cov lus thov tias lawv tseem nyob hauv WD lub network. Tus neeg tsis muaj npe hacker qhia kev poob siab tias cov neeg sawv cev ntawm Western Digital yuav tsis rov qab nws hu. officially, hauv a xovxwm tso tawm, Sab hnub poob Digital tshaj tawm tias, "Raws li kev tshawb nrhiav txog niaj hnub no, Lub Tuam Txhab ntseeg tias tog tsis tau tso cai tau txais qee cov ntaub ntawv los ntawm nws lub tshuab thiab tab tom ua haujlwm kom nkag siab qhov xwm txheej thiab thaj tsam ntawm cov ntaub ntawv ntawd." Yog li ntawd, Western Digital yog niam, tab sis tus hacker yog blabbing. Raws li lawv tau ua li cas, tus neeg nyiag nkas piav qhia tias lawv siv cov kev paub tsis zoo thiab muaj peev xwm nkag mus rau cov ntaub ntawv hauv huab raws li tus thawj coj thoob ntiaj teb.
Tus thawj coj thoob ntiaj teb, los ntawm qhov xwm txheej ntawm lub luag haujlwm, muaj kev nkag mus rau txhua yam. Nws tsis xav tau koj tus password. Nws muaj tus yuam sij.
Western Digital Tsis yog Ib leeg
A daim ntawv ntsuam xyuas xyoo tas los pom tias 83% ntawm cov tuam txhab tshawb fawb tau muaj ntau tshaj ib qho cov ntaub ntawv ua txhaum cai, 45% ntawm cov uas yog huab-based. Cov nruab nrab tus nqi ntawm cov ntaub ntawv ua txhaum cai hauv Tebchaws Meskas yog US $ 9.44 lab. Cov nqi tau muab faib ua plaub pawg nqi - kev lag luam poob, kev tshawb nrhiav thiab kev nce ntxiv, ceeb toom thiab xa cov lus teb ua txhaum cai. (Kuv tsis paub meej tias qeb twg cov ntaub ntawv tus nqe txhiv yog nyob rau hauv. Nws tsis paub meej yog tias ib tus neeg teb tau them tus nqe txhiv.) Lub sijhawm nruab nrab nws siv lub koom haum los txheeb xyuas thiab teb cov ntaub ntawv txhaum cai yog li 9 lub hlis. Nws tsis yog qhov xav tsis thoob, yog li ntawd, ntau lub hlis tom qab Western Digital thawj zaug lees paub cov ntaub ntawv ua txhaum cai, lawv tseem tab tom tshawb nrhiav.
Nws yog ib qho nyuaj hais raws nraim pes tsawg lub tuam txhab tau muaj cov ntaub ntawv ua txhaum cai. Kuv paub ib lub tuam txhab ntiag tug loj uas tau tawm tsam los ntawm ransomware. Cov tswv tsis kam sib tham thiab tsis them. Qhov ntawd txhais tau tias, hloov pauv, poob emails thiab cov ntaub ntawv cov ntaub ntawv. Lawv tau xaiv los tsim kho txhua yam ntawm cov ntaub ntawv tsis muaj kab mob thiab rov nruab software. Muaj ib qho tseem ceeb down-time thiab poob productivity. Qhov xwm txheej no yeej tsis muaj nyob hauv xov xwm. Lub tuam txhab ntawd muaj hmoo vim 66% ntawm cov tuam txhab me me mus rau nruab nrab uas raug tawm tsam los ntawm ransomware xaus mus tawm ntawm kev lag luam hauv 6 lub hlis.
- 30,000 lub vev xaib yog hacked txhua hnub
- 4 lab cov ntaub ntawv yog raug nyiag txhua txhua hnub
- 22 billion cov ntaub ntawv tau ua txhaum cai nyob rau hauv 2021
Yog tias koj tau ua lag luam nrog, lossis siv cov kev pabcuam ntawm Capital One, Marriott, Equifax, Target lossis Uber, nws muaj peev xwm tias koj tus password raug cuam tshuam. Txhua lub tuam txhab loj no raug kev tsim txom cov ntaub ntawv tseem ceeb.
- Peev Ib: Ib tus neeg nyiag nkag tau nkag mus rau 100 lab tus neeg siv khoom thiab cov neeg thov los ntawm kev siv qhov tsis zoo hauv lub tuam txhab huab cua.
- Marriott: Cov ntaub ntawv ua txhaum cai tau nthuav tawm cov ntaub ntawv ntawm 500 lab tus neeg siv khoom (qhov kev ua txhaum cai no tsis raug kuaj pom rau 4 xyoo).
- Equifax: Cov ntaub ntawv tus kheej hauv huab ntawm 147 lab tus neeg siv khoom raug nthuav tawm.
- Lub Hom Phiaj: Cybercriminals nkag mus rau 40 lab credit card naj npawb.
- Uber: Hackers cuam tshuam tus tsim tawm lub laptop thiab nkag mus rau 57 lab tus neeg siv thiab 600,000 tus tsav tsheb.
- LastPass[1]: Hackers nyiag 33 lab tus neeg siv khoom cov ntaub ntawv pov thawj hauv huab cia ua txhaum cai rau lub tuam txhab tus thawj tswj tus password no. Tus neeg tawm tsam tau nkag mus rau Lastpass 'cloud storage siv "cloud storage access keys thiab dual storage container decryption keys" nyiag los ntawm nws qhov chaw tsim khoom.
Koj tuaj yeem tshawb xyuas seb koj puas tau raug nthuav tawm hauv cov ntaub ntawv ua txhaum cai ntawm lub vev xaib no: Kuv puas tau pwned? Ntaus koj tus email chaw nyob thiab nws yuav qhia koj seb muaj pes tsawg cov ntaub ntawv ua txhaum cai email chaw nyob tau pom nyob rau hauv. Piv txwv li, kuv ntaus hauv ib qho ntawm kuv tus kheej email chaw nyob thiab pom tias nws tau ua ib feem ntawm 25 qhov sib txawv cov ntaub ntawv ua txhaum cai, suav nrog Evite. , Dropbox, Adobe, LinkedIn thiab Twitter.
Tiv thaiv Cov Neeg Tsis Txaus Siab
Tej zaum yuav tsis muaj kev lees paub rau pej xeem los ntawm Western Digital ntawm qhov tshwm sim. Qhov xwm txheej qhia txog ob yam: cov ntaub ntawv hauv huab tsuas yog muaj kev nyab xeeb raws li nws cov neeg khaws cia thiab cov tuav ntawm cov yuam sij yuav tsum tau ceev faj tshwj xeeb. Txhawm rau hais txog Peter Parker Txoj Cai, nrog rau kev nkag mus hauv paus los ua lub luag haujlwm loj.
Yuav kom meej meej, tus neeg siv hauv paus thiab tus thawj tswj hwm thoob ntiaj teb tsis zoo ib yam. Ob leeg muaj hwj chim ntau tab sis yuav tsum yog cov nyiaj sib cais. Tus neeg siv hauv paus yog tus tswv thiab muaj kev nkag mus rau cov tuam txhab huab account ntawm qib qis tshaj. Yog li, tus as khauj no tuaj yeem tshem tawm tag nrho cov ntaub ntawv, VMs, cov ntaub ntawv neeg siv khoom - txhua yam uas lub lag luam tau ruaj ntseg hauv huab. Hauv AWS, tsuas muaj 10 paub tab, suav nrog kev teeb tsa thiab kaw koj tus account AWS, uas xav tau kev nkag mus rau hauv paus.
Tus thawj tswj nyiaj yuav tsum raug tsim los ua cov haujlwm tswj hwm (duh). Feem ntau muaj ntau tus thawj tswj hwm tus account uas feem ntau yog tus neeg-raws li, tsis zoo li ib tus account hauv paus. Vim tias Tus Thawj Saib Xyuas Nyiaj Txiag raug khi rau ib tus neeg, koj tuaj yeem saib xyuas tau yooj yim leej twg tau hloov pauv hauv ib puag ncig.
Yam tsawg kawg nkaus rau kev ruaj ntseg siab tshaj plaws
Cov ntaub ntawv tshawb fawb txog kev ua txhaum cai tau kawm txog qhov cuam tshuam ntawm 28 yam ntawm qhov hnyav ntawm cov ntaub ntawv ua txhaum cai. Kev siv AI kev ruaj ntseg, ib txoj hauv kev DevSecOps, kev cob qhia cov neeg ua haujlwm, kev tswj tus kheej thiab kev nkag, MFA, kev soj ntsuam kev nyab xeeb txhua tus muaj qhov cuam tshuam zoo hauv kev txo qis nyiaj nruab nrab poob hauv qhov xwm txheej. Txawm li cas los xij, kev ua tsis tiav, kev ruaj ntseg system complex, kev ruaj ntseg kev tsis txaus, thiab huab tsiv teb tsaws yog qhov tseem ceeb uas ua rau muaj kev nce nyiaj ntau dua ntawm tus nqi nruab nrab ntawm cov ntaub ntawv ua txhaum cai. 
Thaum koj tsiv mus rau huab, koj yuav tsum tau ceev faj ntau dua li kev tiv thaiv koj cov ntaub ntawv. Nov yog qee txoj hauv kev ntxiv los txo koj txoj kev pheej hmoo thiab khiav ib puag ncig zoo dua los ntawm a kev ruaj ntseg kev pom:
1. Muli-factor Authentication: tswj MFA rau hauv paus thiab tag nrho cov Administrator accounts. Txawm zoo dua, siv lub cev kho vajtse MFA ntaus ntawv. Ib tug muaj peev xwm hacker yuav xav tau tsis yog tsuas yog tus account lub npe thiab lo lus zais, tab sis kuj lub cev MFA uas generates ib tug synchronized code.
2. Fais fab hauv me me: Txwv leej twg nkag tau rau hauv paus. Qee cov kws paub txog kev ruaj ntseg qhia tsis pub ntau tshaj 3 cov neeg siv. Tswj tus neeg siv hauv paus nkag mus assiduously. Yog tias koj ua tiav kev tswj hwm tus kheej thiab tawm mus rau lwm qhov, ua qhov no. Yog hais tias ib tug nyob rau hauv lub voj voog ntawm kev ntseeg tawm hauv lub koom haum, hloov lub hauv paus lo lus zais. Rov qab MFA ntaus ntawv.
3. Default Account Privileges: Thaum muab cov neeg siv nyiaj tshiab lossis lub luag haujlwm, xyuas kom meej tias lawv tau txais cov cai tsawg kawg nkaus los ntawm lub neej ntawd. Pib nrog txoj cai nkag tsawg kawg nkaus thiab mam li tso cai ntxiv raws li xav tau. Lub hauv paus ntsiab lus ntawm kev muab kev ruaj ntseg tsawg tshaj plaws kom ua tiav ib txoj haujlwm yog ib qho qauv uas yuav dhau SOC2 cov qauv kev ruaj ntseg. Lub tswv yim yog tias txhua tus neeg siv lossis daim ntawv thov yuav tsum muaj kev ruaj ntseg yam tsawg kawg nkaus kom ua tau raws li qhov xav tau. Txoj cai siab dua uas raug cuam tshuam, qhov kev pheej hmoo ntau dua. Conversely, qhov tsawg dua cov cai raug nthuav tawm, qhov kev pheej hmoo tsawg dua.
4. Cov Cai Tswj Xyuas Cov Cai: Tsis tu ncua tshawb xyuas thiab tshuaj xyuas cov cai uas tau muab rau cov neeg siv, lub luag haujlwm, thiab cov nyiaj hauv koj qhov chaw huab cua. Qhov no ua kom ntseeg tau tias cov tib neeg tsuas muaj kev tso cai tsim nyog los ua lawv txoj haujlwm uas tau xaiv.
5. Kev Tswj Xyuas Tus Kheej thiab Cov Cai Lij Choj Hauv Lub Sijhawm: Txheeb xyuas thiab tshem tawm cov cai ntau dhau los lossis tsis siv los txo qhov kev pheej hmoo ntawm kev nkag mus tsis tau tso cai. Tsuas yog muab txoj cai nkag mus rau cov neeg siv thaum lawv xav kom lawv ua haujlwm tshwj xeeb lossis lub sijhawm txwv. Qhov no minimizes qhov chaw nres thiab txo lub qhov rais ntawm lub cib fim rau tej yam kev ruaj ntseg hem. 
6. Embedded daim ntawv pov thawj: Txwv tsis pub lub hard-coding ntawm unencrypted authentication (username, password, access keys) nyob rau hauv scripts, hauj lwm, los yog lwm yam code. Xwb saib mus rau hauv ib secrets manager uas koj tuaj yeem siv los kho cov ntaub ntawv pov thawj.
7. Infrastructure-as-Code (IaC) Configuration: Ua raws li cov kev coj ua zoo tshaj plaws hauv kev nyab xeeb thaum teeb tsa koj qhov chaw huab cua siv IaC cov cuab yeej xws li AWS CloudFormation lossis Terraform. Tsis txhob tso cai rau pej xeem nkag los ntawm lub neej ntawd thiab txwv tsis pub nkag mus rau cov peev txheej tsuas yog cov kev ntseeg siab, cov neeg siv, lossis chaw nyob IP. Siv cov kev tso cai nplua nplua thiab nkag mus rau cov txheej txheem tswj hwm los tswj lub hauv paus ntsiab lus ntawm txoj cai tsawg kawg nkaus.
8. Kev kaw haujlwm: Pab kom nkag tau nkag thiab saib xyuas cov kev ua thiab xwm txheej hauv koj qhov chaw huab. Ncua thiab txheeb xyuas cov cav rau tej yam txawv txav lossis tej yam ua phem. Ua kom muaj kev tswj xyuas cov cav thiab cov ntaub ntawv kev nyab xeeb thiab kev tswj xyuas qhov xwm txheej (SIEM) kev daws teeb meem txhawm rau txheeb xyuas thiab teb cov xwm txheej kev nyab xeeb tam sim.
9. Kev ntsuam xyuas qhov tsis zoo: Ua cov kev ntsuam xyuas tsis tu ncua thiab kev nkag mus rau kev ntsuam xyuas txhawm rau txheeb xyuas qhov tsis muaj zog ntawm kev nyab xeeb hauv koj qhov chaw huab cua. Patch thiab kho tej qhov tsis zoo uas tau txheeb xyuas tam sim ntawd. Ua raws li kev ruaj ntseg hloov tshiab thiab thaj ua rau thaj tso tawm los ntawm koj tus neeg muab kev pabcuam huab thiab xyuas kom lawv tau thov tam sim ntawd los tiv thaiv kev hem thawj uas paub.
10. Kev kawm ntawv thiab kev kawm: Txhawb kev coj noj coj ua ntawm kev paub txog kev ruaj ntseg thiab muab kev cob qhia tsis tu ncua rau cov neeg ua haujlwm txog qhov tseem ceeb ntawm txoj cai ntawm txoj cai tsawg kawg nkaus. Qhia lawv txog cov kev pheej hmoo uas cuam tshuam nrog ntau txoj cai thiab cov kev coj ua zoo tshaj plaws los ua raws thaum nkag mus thiab tswj cov peev txheej hauv huab ib puag ncig.
11. Patches thiab hloov tshiab: Txo cov qhov tsis zoo los ntawm kev hloov kho txhua lub server software. Khaws koj cov vaj tsev huab cua thiab cov ntawv thov cuam tshuam txog hnub tim los tiv thaiv kev paub tsis meej. Cov chaw muab kev pabcuam huab feem ntau tso tawm thaj ua rau thaj chaw nyab xeeb thiab hloov kho tshiab, yog li nyob nrog lawv cov lus pom zoo yog qhov tseem ceeb.
Trust
Nws los ntawm kev ntseeg siab - tsuas yog muab cov neeg hauv koj lub koom haum kev ntseeg siab kom ua tiav cov haujlwm uas lawv yuav tsum tau ua kom ua tiav lawv txoj haujlwm. Cov kws paub txog kev ruaj ntseg pom zoo Xoom Ntseeg. Tus qauv Zero Trust kev ruaj ntseg yog raws li peb lub hauv paus ntsiab lus:
- Tshawb xyuas meej meej - siv tag nrho cov ntaub ntawv muaj nyob rau hauv kev lees paub tus neeg siv tus kheej thiab nkag mus.
- Siv tsawg-tsim cai nkag mus - tsuas yog nyob rau lub sijhawm thiab tsuas yog muaj kev ruaj ntseg txaus.
- Xav tias ua txhaum cai - encrypt txhua yam, ntiav cov kws tshuaj ntsuam xyuas thiab muaj cov lus teb thaum muaj xwm txheej ceev.
Raws li cov neeg siv khoom ntawm huab thiab huab kev pabcuam, nws kuj nqis los ntseeg. Koj yuav tsum nug koj tus kheej, "Kuv puas ntseeg kuv tus neeg muag khoom khaws kuv cov ntaub ntawv muaj txiaj ntsig hauv huab?" Kev ntseeg, qhov no, txhais tau hais tias koj vam khom lub tuam txhab ntawd, lossis ib qho zoo li nws, los tswj kev ruaj ntseg raws li peb tau piav saum toj no. Xwb, yog tias koj teb qhov tsis zoo, koj puas tau npaj ua tib yam kev tswj hwm kev nyab xeeb hauv koj qhov chaw nyob. Koj puas ntseeg koj tus kheej?
Raws li lub tuam txhab muab kev pabcuam hauv huab, cov neeg siv khoom tau tso lawv txoj kev ntseeg siab rau koj los tiv thaiv lawv cov ntaub ntawv hauv koj cov huab cua. Nws yog tus txheej txheem tsis tu ncua. Nyob twj ywm paub txog cov kev hem thawj tshwm sim, hloov kho koj qhov kev tiv thaiv kev nyab xeeb raws li, thiab koom tes nrog cov kws tshaj lij lossis cov kws pab tswv yim kev nyab xeeb kom ntseeg tau tias muaj kev tiv thaiv zoo tshaj plaws rau koj txoj kev lag luam hauv huab huab huab cua puag ncig.
- https://www.bleepingcomputer.com/news/security/lastpass-hackers-stole-customer-vault-data-in-cloud-storage-breach/ ↑
