pokynmi t\u00fdkaj\u00facimi sa pracovnej stanice s\u00a0privilegovan\u00fdm pr\u00edstupom<\/a>). To sa vy\u017eaduje na z\u00e1klade politiky, ktorej dodr\u017eiavanie sa d\u00f4kladne monitoruje. Tieto pracovn\u00e9 stanice pou\u017e\u00edvaj\u00fa presne ur\u010den\u00fd obraz a\u00a0v\u0161etok softv\u00e9r v\u00a0zariaden\u00ed je pod \u00faplnou spr\u00e1vou. Z\u00a0d\u00f4vodu minimaliz\u00e1cie mo\u017en\u00fdch riz\u00edk s\u00fa povolen\u00e9 iba ur\u010dit\u00e9 \u010dinnosti, pri\u010dom pou\u017e\u00edvatelia nem\u00f4\u017eu omylom ob\u00eds\u0165 ochranu pracovnej stanice spr\u00e1vcu, preto\u017ee pre zariadenie nemaj\u00fa opr\u00e1vnenia spr\u00e1vcu. V\u00a0r\u00e1mci \u010fal\u0161ej ochrany pracovn\u00fdch stan\u00edc sa ka\u017ed\u00fd pr\u00edstup mus\u00ed uskuto\u010dni\u0165 pomocou karty Smart Card, pri\u010dom pr\u00edstup ku ka\u017edej z\u00a0nich je obmedzen\u00fd na konkr\u00e9tnu skupinu pou\u017e\u00edvate\u013eov. \n<\/span><\/p>\nPoslednou \u00farov\u0148ou je mal\u00fd po\u010det (menej ne\u017e p\u00e4\u0165) n\u00fadzov\u00fdch kont. Tieto kont\u00e1 s\u00fa ur\u010den\u00e9 len na mimoriadne situ\u00e1cie a\u00a0s\u00fa zabezpe\u010den\u00e9 n\u00fadzov\u00fdmi postupmi s\u00a0viacer\u00fdmi krokmi. Ka\u017ed\u00e9 pou\u017eitie t\u00fdchto kont je monitorovan\u00e9 a\u00a0sp\u00fa\u0161\u0165a v\u00fdstrahy. \n<\/span><\/p>\nZis\u0165ovanie hrozieb \n<\/span><\/h3>\nPravidelne uskuto\u010d\u0148ujeme nieko\u013eko automatick\u00fdch kontrol. Realizuj\u00fa sa ka\u017ed\u00fdch nieko\u013eko min\u00fat, aby sa overilo, \u017ee v\u0161etky s\u00fa\u010dasti pracuj\u00fa o\u010dak\u00e1van\u00fdm sp\u00f4sobom, a\u00a0to aj pri prid\u00e1van\u00ed nov\u00fdch funkci\u00ed po\u017eadovan\u00fdch z\u00e1kazn\u00edkmi: \n<\/span><\/p>\n\nZis\u0165ovanie naru\u0161en\u00ed:<\/strong> Vyh\u013ead\u00e1vame vzory, ktor\u00e9 indikuj\u00fa naru\u0161enie. T\u00fato mno\u017einu zis\u0165ovan\u00ed pravidelne roz\u0161irujeme. Okrem toho pou\u017e\u00edvame automatizovan\u00e9 testy, ktor\u00e9 sp\u00fa\u0161\u0165aj\u00fa tieto vzory. To znamen\u00e1, \u017ee tie\u017e kontrolujeme, \u010di na\u0161a logika zis\u0165ovania naru\u0161en\u00ed pracuje spr\u00e1vne. \n<\/span><\/li>\nTesty preniknutia:<\/strong> Tieto testy sa uskuto\u010d\u0148uj\u00fa nepretr\u017eite. Rozmanit\u00fdmi sp\u00f4sobmi sa sna\u017eia ohrozi\u0165 zabezpe\u010denie slu\u017eby a\u00a0my o\u010dak\u00e1vame, \u017ee sa im to nikdy nepodar\u00ed. Ak sa im to podar\u00ed, vieme, \u017ee sa vyskytla chyba, a\u00a0ihne\u010f ju m\u00f4\u017eeme odstr\u00e1ni\u0165. \n<\/span><\/li>\nAudit:<\/strong> V\u0161etky \u010dinnosti spr\u00e1vy sa zaznamen\u00e1vaj\u00fa do denn\u00edka. Ak\u00e1ko\u013evek neo\u010dak\u00e1van\u00e1 aktivita (napr\u00edklad vytv\u00e1ranie kont s\u00a0opr\u00e1vneniami spr\u00e1vcom), sp\u00f4sob\u00ed spustenie v\u00fdstrah, na ktor\u00e9 reagujeme d\u00f4kladnou kontrolou danej akcie, aby sme sa uistili, \u017ee je v\u00a0poriadku. \n<\/span><\/li>\n<\/ul>\nSpomenuli sme, \u017ee v\u0161etky va\u0161e \u00fadaje v\u00a0slu\u017ebe Azure AD tie\u017e \u0161ifrujeme? Je to tak. V\u0161etky ulo\u017een\u00e9 \u00fadaje ident\u00edt v\u00a0slu\u017ebe Azure AD s\u00fa chr\u00e1nen\u00e9 pomocou \u0161ifrovania BitLocker. A\u00a0\u010do pren\u00e1\u0161an\u00e9 \u00fadaje? Tie chr\u00e1nime tie\u017e. V\u0161etky rozhrania API slu\u017eby Azure AD s\u00fa webov\u00e9 a\u00a0na \u0161ifrovanie \u00fadajov pou\u017e\u00edvaj\u00fa protokol SSL prostredn\u00edctvom protokolu HTTPS.\u00a0<\/span>V\u0161etky servery slu\u017eby Azure AD s\u00fa nakonfigurovan\u00e9 na pou\u017e\u00edvanie protokolu TLS\u00a01.2. Povo\u013eujeme prich\u00e1dzaj\u00face pripojenia cez TLS\u00a01.1 a\u00a01.0 na podporu extern\u00fdch klientov. Explicitne odmietame v\u0161etky pripojenia cez star\u0161ie verzie protokolu SSL vr\u00e1tane verzi\u00ed 3.0 a\u00a02.0.\u00a0<\/span>Pr\u00edstup k\u00a0inform\u00e1ci\u00e1m je obmedzen\u00fd prostredn\u00edctvom opr\u00e1vnenia zalo\u017een\u00e9ho na tokenoch a\u00a0\u00fadaje ka\u017ed\u00e9ho n\u00e1jomn\u00edka s\u00fa pr\u00edstupn\u00e9 len kont\u00e1m povolen\u00fdm v\u00a0danom n\u00e1jomn\u00edkovi. Okrem toho na\u0161e intern\u00e9 rozhrania API uplat\u0148uj\u00fa pridan\u00fa po\u017eiadavku pou\u017e\u00edva\u0165 overenie klienta\/servera pomocou protokolu SSL na z\u00e1klade d\u00f4veryhodn\u00fdch certifik\u00e1tov a\u00a0re\u0165az\u00ed vyd\u00e1vania. \n<\/span><\/p>\nZ\u00e1vere\u010dn\u00e1 pozn\u00e1mka \n<\/span><\/h3>\nAzure AD sa poskytuje dvomi sp\u00f4sobmi. V\u00a0tomto pr\u00edspevku je op\u00edsan\u00e9 zabezpe\u010denie a\u00a0\u0161ifrovanie verejnej slu\u017eby poskytovanej a\u00a0prev\u00e1dzkovanej spolo\u010dnos\u0165ou Microsoft. Ak m\u00e1te podobn\u00e9 ot\u00e1zky t\u00fdkaj\u00face sa na\u0161ich n\u00e1rodn\u00fdch cloudov\u00fdch in\u0161tanci\u00ed, ktor\u00e9 prev\u00e1dzkuj\u00fa d\u00f4veryhodn\u00ed partneri, nev\u00e1hajte sa obr\u00e1ti\u0165 na t\u00edmy svojich kont. \n<\/span><\/p>\n(Pozn\u00e1mka: M\u00f4\u017eete pou\u017ei\u0165 jednoduch\u00e9 overenie. Ak svoje slu\u017eby Microsoft Online spravujete alebo pou\u017e\u00edvate prostredn\u00edctvom URL adries s\u00a0koncovkou .com, tento pr\u00edspevok opisuje, ako chr\u00e1nime a\u00a0\u0161ifrujeme va\u0161e \u00fadaje.) \n<\/span><\/p>\nZabezpe\u010denie va\u0161ich \u00fadajov je pre n\u00e1s hlavnou prioritou a\u00a0berieme ho VE\u013dMI v\u00e1\u017ene. D\u00fafam, \u017ee tento preh\u013ead na\u0161ich postupov \u0161ifrovania a\u00a0zabezpe\u010denia \u00fadajov v\u00e1s uspokojil a\u00a0bol pre v\u00e1s u\u017eito\u010dn\u00fd. \n<\/span><\/p>\nS\u00a0pozdravom \n<\/span><\/p>\nAlex Simons (Twitter: @Alex_A_Simons) \n<\/span><\/p>\nRiadite\u013e pre spravovanie programov \n<\/span><\/p>\nDiv\u00edzia identity spolo\u010dnosti Microsoft<\/span><\/p>\n\u00a0<\/p>\n
[aktualizovan\u00e9 3.\u00a010.\u00a02017, pridan\u00e9 konkr\u00e9tne inform\u00e1cie o\u00a0pou\u017e\u00edvanej verzii protokolov TLS a\u00a0SSL]<\/p>\n","protected":false},"excerpt":{"rendered":"
Dobr\u00fd de\u0148, priatelia! V\u00a0posledn\u00fdch rokoch do\u0161lo k\u00a0mnoh\u00fdm naru\u0161eniam cloudov\u00fdch slu\u017eieb identity, a\u00a0tak sa n\u00e1s \u013eudia \u010dasto p\u00fdtaj\u00fa, ako zabezpe\u010dujeme \u00fadaje z\u00e1kazn\u00edkov. Dne\u0161n\u00fd blog preto bude venovan\u00fd podrobn\u00fdm inform\u00e1ci\u00e1m o\u00a0ochrane \u00fadajov z\u00e1kazn\u00edkov v\u00a0slu\u017ebe Azure AD. Zabezpe\u010denie \u00fadajov\u00fdch centier a\u00a0slu\u017eieb Za\u010dnime \u00fadajov\u00fdmi centrami. V\u00a0prvom rade musia v\u0161etci pracovn\u00edci v\u00a0\u00fadajov\u00fdch centr\u00e1ch spolo\u010dnosti Microsoft absolvova\u0165 osobn\u00fa previerku. Pr\u00edstup do<\/p>\n","protected":false},"author":0,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[150],"product":[161,151],"audience":[196],"tags":[222,236],"coauthors":[],"class_list":["post-1152","post","type-post","status-publish","format-standard","hentry","content-type-tips-and-guides","product-enterprise-mobility-security","product-microsoft-365","audience-enterprise","tag-azure","tag-mac"],"yoast_head":"\n
Ako zabezpe\u010dujeme va\u0161e \u00fadaje v\u00a0slu\u017ebe Azure AD - Microsoft 365 Blog<\/title>\n \n \n \n \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n\t \n