{"id":5504,"date":"2020-12-13T17:39:20","date_gmt":"2020-12-13T16:39:20","guid":{"rendered":"https:\/\/nethemba.com\/?p=5504"},"modified":"2020-12-29T12:56:38","modified_gmt":"2020-12-29T11:56:38","slug":"prirucka-nasho-zakaznika-i","status":"publish","type":"post","link":"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/","title":{"rendered":"Pr\u00edru\u010dka n\u00e1\u0161ho z\u00e1kazn\u00edka I"},"content":{"rendered":"

V\u0161etko, \u010do ste chceli vedie\u0165 o na\u0161ich IT bezpe\u010dnostn\u00fdch slu\u017eb\u00e1ch<\/h1>\n

Cie\u013eom nasleduj\u00faceho dokumentu je na z\u00e1klade na\u0161ich 14-ro\u010dn\u00fdch sk\u00fasenost\u00ed v oblasti etick\u00e9ho hackovania (vykonan\u00fdch stovky penetra\u010dn\u00fdch testov a bezpe\u010dnostn\u00fdch auditov pre mno\u017estvo <\/span>na\u0161ich z\u00e1kazn\u00edkov<\/span><\/a>) vysvetli\u0165 ako si vybra\u0165 vhodn\u00fd penetra\u010dn\u00fd test alebo bezpe\u010dnostn\u00fd audit a to tak, aby bol v s\u00falade s va\u0161imi o\u010dak\u00e1vaniami, bol vykonan\u00fd najviac profesion\u00e1lne a za najlep\u0161iu cenu. <\/span>Dokument je rozdelen\u00fd na tri \u010dasti, ktor\u00e9 bud\u00fa postupne zverejnen\u00e9 na na\u0161om blogu.<\/span>
\n<\/span>
\n<\/span>Prv\u00e1 \u010das\u0165:<\/b>\u00a0<\/span><\/p>\n

Ak\u00fd penetra\u010dn\u00fd test alebo bezpe\u010dnostn\u00fd audit potrebujem (RFI)<\/span><\/a><\/p>\n

Druh\u00e1 \u010das\u0165:\u00a0<\/b><\/p>\n

Chcem ponuku, \u010do odo m\u0148a potrebujete? (RFP)<\/a>
\n<\/span>Rozhodol som sa pre va\u0161e slu\u017eby, po\u010fme do toho!<\/span><\/a>
\nAko priprav\u00edm testovacie prostredie a testovacie \u00fa\u010dty?<\/a>
\n<\/span>Testovanie \u00faspe\u0161ne prebieha, \u010do m\u00e1m \u010daka\u0165?<\/a>
\nV\u00fdsledn\u00e1 spr\u00e1va<\/a><\/p>\n

Tretia \u010das\u0165:<\/b><\/p>\n

Opakovan\u00e9 testy a bug bounty program
\n<\/span><\/a>Ak\u00e9 technologick\u00e9 certifik\u00e1ty by mali ma\u0165 etick\u00ed hackeri?<\/a>
\nPre\u010do pr\u00e1ve testy u \u201cslobodnej\u201d firmy?<\/a><\/p>\n

<\/a>Ak\u00fd penetra\u010dn\u00fd test alebo bezpe\u010dnostn\u00fd audit potrebujem? (RFI)<\/span><\/h1>\n

Testy webov\u00fdch aplik\u00e1ci\u00ed<\/span><\/h2>\n

Ak ste mal\u00e1 firma bez vlastnej internej infra\u0161trukt\u00fary, tak zrejme v\u00e1s bude zauj\u00edma\u0165 penetra\u010dn\u00fd test v\u00e1\u0161ho webu alebo va\u0161ej webovej aplik\u00e1cie. Ak m\u00e1te mal\u00fd alebo stredne ve\u013ek\u00fd web bez komplexnej dynamickej funkcionality, tak v\u00e1m posta\u010d\u00ed n\u00e1\u0161 najpopul\u00e1rnej\u0161\u00ed <\/span>\u0161tandardn\u00fd penetra\u010dn\u00fd test<\/span><\/a>. Jeho cie\u013eom je behom fixn\u00e9ho \u010dasu (3 dni) odhali\u0165 \u010do najviac kritick\u00fdch alebo in\u00fdch v\u00e1\u017enych zranite\u013enost\u00ed. Ide o \u201cblackbox\u201d simul\u00e1ciu re\u00e1lneho hackersk\u00e9ho \u00fatoku, kedy potenci\u00e1lny \u00fato\u010dn\u00edk m\u00e1 na vyhackovanie va\u0161ej aplik\u00e1cie fixn\u00fd \u010das tri dni. Odpoved\u00e1 teda na ot\u00e1zku – \u010do v\u0161etko dok\u00e1\u017ee profesion\u00e1lny hacker odhali\u0165 a zneu\u017ei\u0165 behom uveden\u00e9ho \u010dasu?<\/span><\/p>\n

Bohu\u017eia\u013e tri dni obvykle nesta\u010dia na odhalenie v\u00e4\u010d\u0161iny zranite\u013enost\u00ed, obzvl\u00e1\u0161\u0165 v zlo\u017eitej\u0161\u00edch a komplexnej\u0161\u00edch aplik\u00e1ci\u00e1ch. Na toto je vhodn\u00fd <\/span>detailn\u00fd bezpe\u010dnostn\u00fd audit<\/span><\/a>, ktor\u00fd vykon\u00e1vame pod\u013ea OWASP bezpe\u010dnostnej testovacej pr\u00edru\u010dky (moment\u00e1lne vo <\/span>verzii 4.2<\/span><\/a>). Ide o najdetailnej\u0161\u00ed webov\u00fd test, ktor\u00fd vykon\u00e1vame striktne pod\u013ea tejto otvorenej metodol\u00f3gie.\u00a0<\/span><\/p>\n

V pr\u00edpade z\u00e1ujmu z\u00e1kazn\u00edka realizujeme aj audit zdrojov\u00fdch k\u00f3dov aplik\u00e1cie. Ke\u010f\u017ee zdrojov\u00fd k\u00f3d je obvykle rozsiahly, s\u00fastre\u010fujeme sa \u0161peci\u00e1lne na z h\u013eadiska bezpe\u010dnosti kritick\u00e9 \u010dasti k\u00f3du – autentifik\u00e1ciu, autoriz\u00e1ciu a session management.<\/span><\/p>\n

Pri detailnom bezpe\u010dnostnom audite prech\u00e1dzame a testujeme v\u0161etky formul\u00e1re webovej aplik\u00e1cie na v\u0161etky druhy zn\u00e1mych webov\u00fdch \u00fatokov. Preto je tento audit aj v\u00fdrazne pracnej\u0161\u00ed (potrebujeme cca 2-4 t\u00fd\u017edne na detailn\u00e9 otestovanie jednej aplik\u00e1cie). S\u00fa\u010das\u0165ou tohto testu je aj tvorba (programovanie) exploitov, \u010do s\u00fa \u0161pecializovan\u00e9 programy, ktor\u00fdmi prakticky demon\u0161trujeme zneu\u017eitie odhalen\u00fdch kritick\u00fdch zranite\u013enost\u00ed. Detailn\u00fd bezpe\u010dnostn\u00fd audit odpor\u00fa\u010dame pre v\u0161etky z h\u013eadiska bezpe\u010dnosti kritick\u00e9 aplik\u00e1cie, ktor\u00e9 disponuj\u00fa citliv\u00fdmi osobn\u00fdmi alebo finan\u010dn\u00fdmi \u00fadajmi, \u010di umo\u017e\u0148uj\u00fa finan\u010dn\u00e9 prevody. Tento test je preto vhodn\u00fd pre finan\u010dn\u00fd sektor, stredne ve\u013ek\u00e9 \u010di ve\u013ek\u00e9 spolo\u010dnosti. Odpor\u00fa\u010dame ho realizova\u0165 pred nasaden\u00edm akejko\u013evek novo vyvinutej aplik\u00e1cie do produk\u010dn\u00e9ho prostredia.<\/span><\/p>\n

Testy mobiln\u00fdch aplik\u00e1ci\u00ed<\/span><\/h2>\n

Ma\u0165 pekn\u00fa a funk\u010dn\u00fa mobiln\u00fa aplik\u00e1ciu je v s\u00fa\u010dasnej dobe pre ve\u013ek\u00e9 mno\u017estvo firiem u\u017e nevyhnutnos\u0165 a \u0161tandard s\u00fa\u010dasne. Mobiln\u00e9 aplik\u00e1cie pre Android alebo iPhone m\u00f4\u017eu obsahova\u0165 tak\u00e9 druhy zranite\u013enost\u00ed, ktor\u00e9 sa vo webov\u00fdch aplik\u00e1ci\u00e1ch nenach\u00e1dzaj\u00fa. Preto odpor\u00fa\u010dame ka\u017ed\u00fa tak\u00fato mobiln\u00fa aplik\u00e1ciu pred jej ofici\u00e1lnym spusten\u00edm d\u00f4kladne otestova\u0165.<\/span><\/p>\n

V r\u00e1mci slu\u017eby <\/span>bezpe\u010dnostn\u00fd audit mobilnej aplik\u00e1cie<\/span><\/a> vykon\u00e1vame ako testovanie serverovej \u010dasti webov\u00fdch slu\u017eieb (REST\/SOAP), tak klientskej \u010dasti (frontend) samotnej aplik\u00e1cie (Android aplik\u00e1cie nap\u00edsan\u00e9 v Jave dekompilujeme, iOS aplik\u00e1cie nap\u00edsan\u00e9 v Objective C reverzujem a disassemblujeme). S\u00fa\u010das\u0165 testovania je tie\u017e akt\u00edvne sledovanie a intervencia do komunik\u00e1cie medzi samotnou mobilnou aplik\u00e1ciou a jej serverovou stranou (pri tejto komunik\u00e1cii upravujeme ako \u017eiadosti aplik\u00e1cie, tak odpovede zo strany servera s cie\u013eom identifikova\u0165 zranite\u013enosti). Vyu\u017e\u00edvame na to r\u00f4zne tzv. \u201cfault injection\u201d n\u00e1stroje. Dok\u00e1\u017eeme ob\u00eds\u0165 r\u00f4zne bezpe\u010dnostn\u00e9 ochrany, ktor\u00fdmi sa aplik\u00e1cia chr\u00e1ni (napr\u00edklad SSL pinning, detekcia roota\/jailbreaku, obfusk\u00e1cia k\u00f3du atd). Otestovanie jednej mobilnej aplik\u00e1cie na jednej platforme trv\u00e1 r\u00e1dovo 1-3 t\u00fd\u017edne.<\/span><\/p>\n

Extern\u00e9 penetra\u010dn\u00e9 testy<\/span><\/h2>\n

Ak ste u\u017e v\u00e4\u010d\u0161ia firma, tak pravdepodobne u\u017e disponujete vlastnou sie\u0165ovou infra\u0161trukt\u00farou (extern\u00e1 a intern\u00e1 firemn\u00e1 sie\u0165), ktor\u00fa je potrebn\u00e9 udr\u017eiava\u0165 a zabezpe\u010dova\u0165. Na to v\u00e1m pom\u00f4\u017ee n\u00e1\u0161 <\/span>extern\u00fd penetra\u010dn\u00fd test<\/span><\/a>. Ten dok\u00e1\u017ee by\u0165 realizovan\u00fd v kompletnej \u201cblackbox\u201d forme, kedy n\u00e1m ako z\u00e1kazn\u00edk neposkytnete \u017eiadne inform\u00e1cie o va\u0161ej sie\u0165ovej infra\u0161trukt\u00fare. V r\u00e1mci f\u00e1zy, ktor\u00e1 sa naz\u00fdva \u201cinformation gathering\u201d sa tieto potrebn\u00e9 inform\u00e1cie pok\u00fasime z\u00edska\u0165 z verejne dostupn\u00fdch registrov \u010di datab\u00e1z. Na\u0161im cie\u013eom je identifikova\u0165 va\u0161e potenci\u00e1lne sie\u0165ov\u00e9 IP rozsahy alebo IP adresy. T\u00e1to f\u00e1za je pas\u00edvna, \u010do znamen\u00e1, \u017ee va\u0161ich serverov \u010di sie\u0165ov\u00fdch prvkov sa \u201cnedot\u00fdkame\u201d, len zhroma\u017e\u010fujeme dostupn\u00e9 inform\u00e1cie o va\u0161ej infra\u0161trukt\u00fare. N\u00e1sledne, ke\u010f z\u00edskame zoznam va\u0161ich potenci\u00e1lnych IP adries alebo IP rozsahov, tak v\u00e1s kontaktujeme a nech\u00e1me si od v\u00e1s explicitne potvrdi\u0165, \u017ee ide skuto\u010dne o va\u0161e re\u00e1lne IP adresy. Pokra\u010dova\u0165 v akt\u00edvnom testovan\u00ed IP adries, ktor\u00e9 v\u00e1m nepatria, je toti\u017e neleg\u00e1lne.\u00a0<\/span><\/p>\n

Druh\u00e1, zhruba o jeden de\u0148 r\u00fdchlej\u0161ia alternat\u00edva je\u00a0 n\u00e1m rovno posla\u0165 va\u0161e IP rozsahy alebo zoznamy IP adries, ktor\u00e9 si \u017eel\u00e1te otestova\u0165. N\u00e1sledne sa dok\u00e1\u017eeme pusti\u0165 do penetra\u010dn\u00e9ho testovania. Extern\u00fd penetra\u010dn\u00fd test trv\u00e1 r\u00e1dovo p\u00e1r dn\u00ed a\u017e t\u00fd\u017ed\u0148ov (pod\u013ea ve\u013ekosti testovanej infra\u0161trukt\u00fary).<\/span><\/p>\n

Intern\u00e9 penetra\u010dn\u00e9 testy<\/span><\/h2>\n

A\u017e <\/span>60% v\u0161etk\u00fdch bezpe\u010dnostn\u00fdch incidentov poch\u00e1dza vraj od intern\u00fdch zamestnancov<\/span><\/a> z internej siete. Preto je d\u00f4le\u017eit\u00e9 dba\u0165 aj o bezpe\u010dnos\u0165 internej sie\u0165ovej infra\u0161trukt\u00fary. Na jej otestovanie pon\u00fakame <\/span>penetra\u010dn\u00fd test intranetu<\/span><\/a>. Ten m\u00f4\u017ee by\u0165 realizovan\u00fd bu\u010f z poh\u013eadu n\u00e1hodn\u00e9ho anonymn\u00e9ho \u00fato\u010dn\u00edka (\u010dlovek, ktor\u00fd pri\u0161iel do firmy na pohovor a pripojil si laptop v zasada\u010dke), tak z poh\u013eadu be\u017en\u00e9ho zamestnanca (napr\u00edklad sekret\u00e1rky, ktor\u00e1 m\u00e1 pr\u00edstup do firemn\u00e9ho dom\u00e9nov\u00e9ho servera). Obvykle n\u00e1m sta\u010d\u00ed anonymn\u00fd pr\u00edstup do internej siete, aby sme dok\u00e1zali ob\u00eds\u0165 ochrany ako MAC security, 802.1x \u010di in\u00e9 ochrany na linkovej vrstve. \u00datokmi ako ARP poisoning a vyd\u00e1van\u00edm sa za \u201cofici\u00e1lny\u201d sie\u0165ov\u00fd router dok\u00e1\u017eeme relat\u00edvne r\u00fdchlo z\u00edska\u0165 opr\u00e1vnenia in\u00fdch intern\u00fdch pou\u017e\u00edvate\u013eov (tak\u017ee \u010dastokr\u00e1t ofici\u00e1lny \u00fa\u010det sekret\u00e1rky nakoniec ani nepotrebujeme). Pok\u00fdm to nem\u00e1me \u0161pecifikovan\u00e9 inak, tak najv\u00e4\u010d\u0161\u00edm cie\u013eom intern\u00e9ho penetra\u010dn\u00e9ho testu je kompromitova\u0165 hlavn\u00fd dom\u00e9nov\u00fd server (AD) a hlavn\u00fd sie\u0165ov\u00fd router, ktor\u00fd smeruje v\u0161etku sie\u0165ov\u00fa prev\u00e1dzku z va\u0161ej firmy do Internetu. Toto de facto znamen\u00e1, \u017ee sa n\u00e1m podarilo z\u00edska\u0165 pln\u00fa kontrolu nad va\u0161ou internou sie\u0165ou. V minulosti sme v\u00e4\u010d\u0161inu intern\u00fdch penetra\u010dn\u00fdch testov realizovali \u201consite\u201d, teda fyzicky u z\u00e1kazn\u00edka. V s\u00fa\u010dasnej pandemickej dobe sme sa prakticky \u00faplne \u201cprepli\u201d do testovania na dia\u013eku cez z\u00e1kazn\u00edkmi vytvoren\u00e9 VPN spojenie. Ak sa n\u00e1jdu korpor\u00e1cie, ktor\u00e9 maj\u00fa ve\u013ea pobo\u010diek na celom svete s oddelen\u00fdmi intern\u00fdmi sie\u0165ami, tak na ich kompletn\u00e9 otestovanie potrebujeme VPN spojenie do ka\u017edej jednej lokality.<\/span><\/p>\n

Lok\u00e1lny bezpe\u010dnostn\u00fd audit<\/span><\/h2>\n

Pri \u201cpotulk\u00e1ch\u201d po internej sieti \u010dastokr\u00e1t objav\u00edme z poh\u013eadu z\u00e1kazn\u00edka k\u013e\u00fa\u010dov\u00fd alebo kritick\u00fd server, ktor\u00fd vy\u017eaduje detailn\u00e9 otestovanie a to z poh\u013eadu ako neprivilegovan\u00e9ho, tak privilegovan\u00e9ho pou\u017e\u00edvate\u013ea. V tomto pr\u00edpade zah\u00e1jime <\/span>lok\u00e1lny bezpe\u010dnostn\u00fd audit<\/span><\/a>, ktor\u00e9ho cie\u013eom je odhali\u0165 v\u0161etky mo\u017en\u00e9 zranite\u013enosti v danom lok\u00e1lnom syst\u00e9me a nain\u0161talovan\u00fdch aplik\u00e1ci\u00e1ch. A pom\u00f4c\u0165 n\u00e1sledne pri jeho \u010fal\u0161om zabezpe\u010den\u00ed (tzv. hardening). Pri tomto syst\u00e9movom audite napr\u00edklad overujeme v\u0161etky mo\u017en\u00e9 sp\u00f4soby neautorizovanej eskal\u00e1cie neprivilegovan\u00fdch pou\u017e\u00edvate\u013eov na privilegovan\u00fdch (administr\u00e1tor \/ root).<\/span><\/p>\n

Soci\u00e1lne in\u017einierstvo<\/span><\/h2>\n

V\u0161etky vy\u0161\u0161ie uveden\u00e9 testy sa t\u00fdkali h\u013eadania zranite\u013enost\u00ed, ktor\u00e9 umo\u017e\u0148uj\u00fa \u00fatoky na technol\u00f3gie. Bohu\u017eia\u013e \u010dastokr\u00e1t sa st\u00e1va, \u017ee aj napriek tomu, \u017ee pou\u017e\u00edvate vysoko bezpe\u010dn\u00e9 technol\u00f3gie (syst\u00e9my, aplik\u00e1cie), tak sa stanete obe\u0165ou hackersk\u00e9ho \u00fatoku. V tomto pr\u00edpade hovor\u00edme o tzv. \u00fatokoch soci\u00e1lneho in\u017einierstva, kedy predmetom \u00fatoku nie s\u00fa technol\u00f3gie, ale samotn\u00ed \u013eudia. \u00dato\u010dn\u00edk pri soci\u00e1lnom in\u017einierstva vyu\u017e\u00edva typick\u00e9 \u013eudsk\u00e9 vlastnosti ako altruizmus, d\u00f4ver\u010divos\u0165, potreba pom\u00e1ha\u0165, ale aj sebectvo \u010di strach z autor\u00edt.\u00a0<\/span><\/p>\n

Soci\u00e1lne in\u017einierstvo<\/span><\/a>, ktor\u00e9 vykon\u00e1vame, pozost\u00e1va z troch \u010dast\u00ed.<\/span><\/p>\n

Prv\u00e1 \u010das\u0165 predstavuje internetov\u00fd cielen\u00fd phishing (tzv. spear-phishing), kedy sa sna\u017e\u00edme obvykle e-mailami alebo instantnou komunik\u00e1ciou zmanipulova\u0165 va\u0161ich zamestnancov. A to tak, aby n\u00e1m poskytli zvolen\u00e9 citliv\u00e9 inform\u00e1cie alebo n\u00e1m umo\u017enili vykona\u0165 inak nepovolen\u00e9 oper\u00e1cie.<\/span><\/p>\n

Druh\u00e1 \u010das\u0165 prebieha telefonicky alebo SMS spr\u00e1vami, kedy vyu\u017e\u00edvame met\u00f3dy impersonifik\u00e1cie (vyd\u00e1vanie sa za in\u00fa osobu) \u010di caller ID spoofing (vol\u00e1me pre obe\u0165 z vopred zn\u00e1mych podvrhnut\u00fdch \u010d\u00edsel, ktor\u00fdm d\u00f4veruje).<\/span><\/p>\n

Tretia f\u00e1za predstavuje samotn\u00fa fyzick\u00fa infiltr\u00e1ciu do budovy z\u00e1kazn\u00edka. Na to obvykle potrebujeme tzv. \u201cGet Out Of Jail Letter\u201d, teda dokument podp\u00edsan\u00fd veden\u00edm firmy, prehlasuj\u00faci, \u017ee ide len o test, aby sme sa vyhli pr\u00edpadnej fyzickej konfront\u00e1cii.<\/span><\/p>\n

Ka\u017ed\u00fd z\u00e1kazn\u00edk je in\u00fd a vy\u017eaduje in\u00e9 scen\u00e1re soci\u00e1lne in\u017einierstva. Niektor\u00ed zamestnanci z\u00e1kazn\u00edkov maj\u00fa vy\u0161\u0161ie bezpe\u010dnostn\u00e9 povedomie a preto s\u00fa im\u00fanni na trivi\u00e1lne \u00fatoky soci\u00e1lneho in\u017einierstva (ako napr\u00edklad na phishing e-maily \u010di rozsypan\u00e9 USB k\u013e\u00fa\u010de s malv\u00e9rom). Preto vypracuv\u00e1vame sofistikovanej\u0161ie scen\u00e1re, ktor\u00e9 n\u00e1sledne za radom sk\u00fa\u0161ame.\u00a0<\/span>\u00a0<\/span><\/p>\n

Dobre realizovan\u00e9 soci\u00e1lne in\u017einierstvo je \u010dastokr\u00e1t ve\u013emi \u00faspe\u0161n\u00e9. Aj v dne\u0161nej dobe m\u00f4\u017eeme vidie\u0165, ako v\u00fdborne funguj\u00fa podvodn\u00edci vyd\u00e1vaj\u00faci sa za zamestnancov Microsoftu, ktor\u00ed v\u00e1m zavolaj\u00fa cez telef\u00f3n a sna\u017eia sa z\u00edska\u0165 pr\u00edstup k v\u00e1\u0161mu po\u010d\u00edta\u010du a citliv\u00fdm osobn\u00fdm \u00fadajom.<\/span><\/p>\n

\u0160pecializovan\u00e9 testy<\/span><\/h2>\n

Ak ste z\u00e1kazn\u00edk, ktor\u00fd m\u00e1 z\u00e1ujem o \u0161pecifick\u00e9 testy nejakej konkr\u00e9tnej technol\u00f3gie alebo platformy, tak n\u00e1m dajte vedie\u0165. M\u00e1me expertov a sk\u00fasenosti s bezpe\u010dnos\u0165ou nasleduj\u00facich technol\u00f3gi\u00ed:<\/span><\/p>\n

Bezpe\u010dnostn\u00fd audit smart kontraktov<\/span><\/a> – ak potrebujete otestova\u0165 decentralizovan\u00e9 aplik\u00e1cie v Solidity nad Ethereum (\u010di in\u00fdm) blockchainom, ktor\u00fd umo\u017enuje smart kontrakty. T\u00e9me zranite\u013enost\u00ed v smart kontraktoch sme sa venovali v <\/span>tomto dlh\u0161om \u010dl\u00e1nku<\/span><\/a>.<\/span><\/p>\n

Bezpe\u010dnostn\u00fd audit SAP syst\u00e9mov<\/span><\/a> – ak chcete otestova\u0165 bezpe\u010dnos\u0165 va\u0161ich SAP syst\u00e9mov a aplik\u00e1ci\u00ed. Ke\u010f\u017ee SAP je ve\u013emi zlo\u017eit\u00fd robustn\u00fd syst\u00e9m, tak m\u00e1me ve\u013emi vysok\u00fa \u00faspe\u0161nos\u0165 jeho kompromitovania.<\/span><\/p>\n

Bezpe\u010dnostn\u00fd audit \u010dipov\u00fdch kariet<\/span><\/a> – v minulosti sme <\/span>demon\u0161trovali prelomenie<\/span><\/a> najroz\u0161\u00edrenej\u0161\u00edch \u010dipov\u00fdch kariet na svete (Mifare Classic) a tie\u017e sme ako prv\u00ed publikovali open-source n\u00e1stroj na ich prelomenie (<\/span>mfoc<\/span><\/a>, dostupn\u00fd napr\u00edklad v hackerskej distrib\u00facii Kali). Tieto sk\u00fasenosti sme opakovane vyu\u017eili na auditovanie r\u00f4znych technol\u00f3gi\u00ed bezdr\u00f4tov\u00fdch \u010dipov\u00fdch kariet (sp\u013a\u0148aj\u00face \u0161tandardy<\/span> ISO 15693<\/span><\/a> a <\/span>ISO\/IEC 14443<\/span><\/a>).<\/span><\/p>\n

Bezpe\u010dnostn\u00fd audit bezdr\u00f4tov\u00fdch (WiFi) siet\u00ed<\/span><\/a> – podvrhnut\u00e9 wifi hotspoty (tzv. \u201cRogue APs\u201d) m\u00f4\u017eu predstavova\u0165 ne\u017eelan\u00fd sp\u00f4sob \u00faniky citliv\u00fdch inform\u00e1cii z va\u0161ej internej siete. Podobne nedostato\u010dne zabezpe\u010den\u00e1 intern\u00e1 wifi sie\u0165 znamen\u00e1, \u017ee \u00fato\u010dn\u00edk kompromituje v\u00e1s, va\u0161ich zamestnancov alebo z\u00e1kazn\u00edkov. Toto v\u0161etko dok\u00e1\u017ee odhali\u0165 bezpe\u010dnostn\u00fd audit bezdr\u00f4tov\u00fdch (WiFi) siet\u00ed, ktor\u00fd radi realizujeme fyzicky vo va\u0161ich priestoroch.<\/span><\/p>\n

Bezpe\u010dnostn\u00fd audit <\/span>SCADA<\/span><\/a> a <\/span>IoT<\/span><\/a> – ak vyr\u00e1bate vlastn\u00fd hardv\u00e9r alebo ste podnik s kritickou priemyselnou infra\u0161trukt\u00farou, tak m\u00f4\u017eete vyu\u017ei\u0165 na\u0161e \u0161pecializovan\u00e9 SCADA a IoT bezpe\u010dnostn\u00e9 audity, ktor\u00e9 dok\u00e1\u017eu odhali\u0165 zranite\u013enosti vo va\u0161om hardv\u00e9ri \u010di v priemyselnej infra\u0161trukt\u00fare. Tieto zranite\u013enosti m\u00f4\u017eu ma\u0165 \u010dasto fat\u00e1lne d\u00f4sledky v pr\u00edpade zneu\u017eitia – napr\u00edklad zlyhanie v\u00fdrobnej linky, gener\u00e1tora, znefunk\u010dnenie kardio stimul\u00e1tora at\u010f.<\/span><\/p>\n

V na\u0161ej firme m\u00e1me sk\u00fasenost\u00ed s testovan\u00edm bezpe\u010dnosti propriet\u00e1rnych VoIP telef\u00f3nov, WiFi routrov, palubn\u00fdch jednotiek do \u00e1ut, mobiln\u00fdch BTS stan\u00edc \u010di priemyselnej infra\u0161trukt\u00fary.<\/span><\/p>\n

V druhej \u010dasti \u010dl\u00e1nku<\/a> si vysvetl\u00edme, ak\u00e9 presne inform\u00e1cie potrebujeme od v\u00e1s na vytvorenie vhodnej ponuky, podp\u00edsanie zml\u00fav, vytvorenie testovacieho prostredia a testovac\u00edch \u00fa\u010dtov a spustenie samotn\u00e9ho testovania.<\/p>\n","protected":false},"excerpt":{"rendered":"

V\u0161etko, \u010do ste chceli vedie\u0165 o na\u0161ich IT bezpe\u010dnostn\u00fdch slu\u017eb\u00e1ch Cie\u013eom nasleduj\u00faceho dokumentu je na z\u00e1klade na\u0161ich 14-ro\u010dn\u00fdch sk\u00fasenost\u00ed v oblasti etick\u00e9ho hackovania (vykonan\u00fdch stovky penetra\u010dn\u00fdch testov a bezpe\u010dnostn\u00fdch auditov pre mno\u017estvo na\u0161ich z\u00e1kazn\u00edkov) vysvetli\u0165 ako si vybra\u0165 vhodn\u00fd penetra\u010dn\u00fd test alebo bezpe\u010dnostn\u00fd audit a to tak, aby bol v s\u00falade s va\u0161imi o\u010dak\u00e1vaniami, bol […]<\/p>\n","protected":false},"author":2,"featured_media":5508,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[2870,13],"tags":[511,2868,2869,2871,496,513],"class_list":["post-5504","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","category-uncategorized-sk","tag-bezpecnostne-audity-sk","tag-eticke-hackovanie","tag-it-bezpecnostne-sluzby","tag-owasp-web-security-testing-guide","tag-penetracne-testy-sk","tag-socialne-inzinierstvo-sk"],"yoast_head":"\nPr\u00edru\u010dka n\u00e1\u0161ho z\u00e1kazn\u00edka I - Nethemba<\/title>\n<meta name=\"description\" content=\"Ak\u00fd penetra\u010dn\u00fd test alebo bezpe\u010dnostn\u00fd audit potrebujem? (RFI) OWASP testy webov\u00fdch a mobiln\u00fdch aplik\u00e1ci\u00ed\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/\" \/>\n<meta property=\"og:locale\" content=\"sk_SK\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Pr\u00edru\u010dka n\u00e1\u0161ho z\u00e1kazn\u00edka I - Nethemba\" \/>\n<meta property=\"og:description\" content=\"Ak\u00fd penetra\u010dn\u00fd test alebo bezpe\u010dnostn\u00fd audit potrebujem? (RFI) OWASP testy webov\u00fdch a mobiln\u00fdch aplik\u00e1ci\u00ed\" \/>\n<meta property=\"og:url\" content=\"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/\" \/>\n<meta property=\"og:site_name\" content=\"Nethemba\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/nethemba\" \/>\n<meta property=\"article:published_time\" content=\"2020-12-13T16:39:20+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2020-12-29T11:56:38+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/nethemba.com\/wp-content\/uploads\/2020\/12\/owasp-web-security-testing-guide.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1101\" \/>\n\t<meta property=\"og:image:height\" content=\"586\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Pavol Lupt\u00e1k\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@nethemba\" \/>\n<meta name=\"twitter:site\" content=\"@nethemba\" \/>\n<meta name=\"twitter:label1\" content=\"Autor\" \/>\n\t<meta name=\"twitter:data1\" content=\"Pavol Lupt\u00e1k\" \/>\n\t<meta name=\"twitter:label2\" content=\"Predpokladan\u00fd \u010das \u010d\u00edtania\" \/>\n\t<meta name=\"twitter:data2\" content=\"11 min\u00fat\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/\"},\"author\":{\"name\":\"Pavol Lupt\u00e1k\",\"@id\":\"https:\/\/nethemba.com\/de\/#\/schema\/person\/5f4ba68c8e1a2013d30e0804245b8234\"},\"headline\":\"Pr\u00edru\u010dka n\u00e1\u0161ho z\u00e1kazn\u00edka I\",\"datePublished\":\"2020-12-13T16:39:20+00:00\",\"dateModified\":\"2020-12-29T11:56:38+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/\"},\"wordCount\":2305,\"commentCount\":0,\"image\":{\"@id\":\"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/nethemba.com\/wp-content\/uploads\/2020\/12\/owasp-web-security-testing-guide.png\",\"keywords\":[\"bezpe\u010dnostn\u00e9 audity\",\"etick\u00e9 hackovanie\",\"it bezpe\u010dnostn\u00e9 slu\u017eby\",\"OWASP web security testing guide\",\"penetra\u010dn\u00e9 testy\",\"soci\u00e1lne in\u017einierstvo\"],\"articleSection\":[\"Blog\",\"Uncategorized @sk\"],\"inLanguage\":\"sk-SK\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/\",\"url\":\"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/\",\"name\":\"Pr\u00edru\u010dka n\u00e1\u0161ho z\u00e1kazn\u00edka I - Nethemba\",\"isPartOf\":{\"@id\":\"https:\/\/nethemba.com\/de\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/nethemba.com\/wp-content\/uploads\/2020\/12\/owasp-web-security-testing-guide.png\",\"datePublished\":\"2020-12-13T16:39:20+00:00\",\"dateModified\":\"2020-12-29T11:56:38+00:00\",\"author\":{\"@id\":\"https:\/\/nethemba.com\/de\/#\/schema\/person\/5f4ba68c8e1a2013d30e0804245b8234\"},\"description\":\"Ak\u00fd penetra\u010dn\u00fd test alebo bezpe\u010dnostn\u00fd audit potrebujem? (RFI) OWASP testy webov\u00fdch a mobiln\u00fdch aplik\u00e1ci\u00ed\",\"breadcrumb\":{\"@id\":\"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/#breadcrumb\"},\"inLanguage\":\"sk-SK\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"sk-SK\",\"@id\":\"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/#primaryimage\",\"url\":\"https:\/\/nethemba.com\/wp-content\/uploads\/2020\/12\/owasp-web-security-testing-guide.png\",\"contentUrl\":\"https:\/\/nethemba.com\/wp-content\/uploads\/2020\/12\/owasp-web-security-testing-guide.png\",\"width\":1101,\"height\":586},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/nethemba.com\/sk\/domov\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Pr\u00edru\u010dka n\u00e1\u0161ho z\u00e1kazn\u00edka I\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/nethemba.com\/de\/#website\",\"url\":\"https:\/\/nethemba.com\/de\/\",\"name\":\"Nethemba\",\"description\":\"We care about your security\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/nethemba.com\/de\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"sk-SK\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/nethemba.com\/de\/#\/schema\/person\/5f4ba68c8e1a2013d30e0804245b8234\",\"name\":\"Pavol Lupt\u00e1k\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"sk-SK\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/978b23022518d076eaa243b375d2e0272af4f00dd502ce79cc357276d9bc2495?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/978b23022518d076eaa243b375d2e0272af4f00dd502ce79cc357276d9bc2495?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/978b23022518d076eaa243b375d2e0272af4f00dd502ce79cc357276d9bc2495?s=96&d=mm&r=g\",\"caption\":\"Pavol Lupt\u00e1k\"},\"sameAs\":[\"https:\/\/www.nethemba.com\/\"],\"url\":\"https:\/\/nethemba.com\/sk\/author\/nethemba-admin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Pr\u00edru\u010dka n\u00e1\u0161ho z\u00e1kazn\u00edka I - Nethemba","description":"Ak\u00fd penetra\u010dn\u00fd test alebo bezpe\u010dnostn\u00fd audit potrebujem? (RFI) OWASP testy webov\u00fdch a mobiln\u00fdch aplik\u00e1ci\u00ed","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/","og_locale":"sk_SK","og_type":"article","og_title":"Pr\u00edru\u010dka n\u00e1\u0161ho z\u00e1kazn\u00edka I - Nethemba","og_description":"Ak\u00fd penetra\u010dn\u00fd test alebo bezpe\u010dnostn\u00fd audit potrebujem? (RFI) OWASP testy webov\u00fdch a mobiln\u00fdch aplik\u00e1ci\u00ed","og_url":"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/","og_site_name":"Nethemba","article_publisher":"https:\/\/www.facebook.com\/nethemba","article_published_time":"2020-12-13T16:39:20+00:00","article_modified_time":"2020-12-29T11:56:38+00:00","og_image":[{"width":1101,"height":586,"url":"https:\/\/nethemba.com\/wp-content\/uploads\/2020\/12\/owasp-web-security-testing-guide.png","type":"image\/png"}],"author":"Pavol Lupt\u00e1k","twitter_card":"summary_large_image","twitter_creator":"@nethemba","twitter_site":"@nethemba","twitter_misc":{"Autor":"Pavol Lupt\u00e1k","Predpokladan\u00fd \u010das \u010d\u00edtania":"11 min\u00fat"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/#article","isPartOf":{"@id":"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/"},"author":{"name":"Pavol Lupt\u00e1k","@id":"https:\/\/nethemba.com\/de\/#\/schema\/person\/5f4ba68c8e1a2013d30e0804245b8234"},"headline":"Pr\u00edru\u010dka n\u00e1\u0161ho z\u00e1kazn\u00edka I","datePublished":"2020-12-13T16:39:20+00:00","dateModified":"2020-12-29T11:56:38+00:00","mainEntityOfPage":{"@id":"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/"},"wordCount":2305,"commentCount":0,"image":{"@id":"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/#primaryimage"},"thumbnailUrl":"https:\/\/nethemba.com\/wp-content\/uploads\/2020\/12\/owasp-web-security-testing-guide.png","keywords":["bezpe\u010dnostn\u00e9 audity","etick\u00e9 hackovanie","it bezpe\u010dnostn\u00e9 slu\u017eby","OWASP web security testing guide","penetra\u010dn\u00e9 testy","soci\u00e1lne in\u017einierstvo"],"articleSection":["Blog","Uncategorized @sk"],"inLanguage":"sk-SK","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/","url":"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/","name":"Pr\u00edru\u010dka n\u00e1\u0161ho z\u00e1kazn\u00edka I - Nethemba","isPartOf":{"@id":"https:\/\/nethemba.com\/de\/#website"},"primaryImageOfPage":{"@id":"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/#primaryimage"},"image":{"@id":"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/#primaryimage"},"thumbnailUrl":"https:\/\/nethemba.com\/wp-content\/uploads\/2020\/12\/owasp-web-security-testing-guide.png","datePublished":"2020-12-13T16:39:20+00:00","dateModified":"2020-12-29T11:56:38+00:00","author":{"@id":"https:\/\/nethemba.com\/de\/#\/schema\/person\/5f4ba68c8e1a2013d30e0804245b8234"},"description":"Ak\u00fd penetra\u010dn\u00fd test alebo bezpe\u010dnostn\u00fd audit potrebujem? (RFI) OWASP testy webov\u00fdch a mobiln\u00fdch aplik\u00e1ci\u00ed","breadcrumb":{"@id":"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/#breadcrumb"},"inLanguage":"sk-SK","potentialAction":[{"@type":"ReadAction","target":["https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/"]}]},{"@type":"ImageObject","inLanguage":"sk-SK","@id":"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/#primaryimage","url":"https:\/\/nethemba.com\/wp-content\/uploads\/2020\/12\/owasp-web-security-testing-guide.png","contentUrl":"https:\/\/nethemba.com\/wp-content\/uploads\/2020\/12\/owasp-web-security-testing-guide.png","width":1101,"height":586},{"@type":"BreadcrumbList","@id":"https:\/\/nethemba.com\/sk\/prirucka-nasho-zakaznika-i\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/nethemba.com\/sk\/domov\/"},{"@type":"ListItem","position":2,"name":"Pr\u00edru\u010dka n\u00e1\u0161ho z\u00e1kazn\u00edka I"}]},{"@type":"WebSite","@id":"https:\/\/nethemba.com\/de\/#website","url":"https:\/\/nethemba.com\/de\/","name":"Nethemba","description":"We care about your security","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/nethemba.com\/de\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"sk-SK"},{"@type":"Person","@id":"https:\/\/nethemba.com\/de\/#\/schema\/person\/5f4ba68c8e1a2013d30e0804245b8234","name":"Pavol Lupt\u00e1k","image":{"@type":"ImageObject","inLanguage":"sk-SK","@id":"https:\/\/secure.gravatar.com\/avatar\/978b23022518d076eaa243b375d2e0272af4f00dd502ce79cc357276d9bc2495?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/978b23022518d076eaa243b375d2e0272af4f00dd502ce79cc357276d9bc2495?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/978b23022518d076eaa243b375d2e0272af4f00dd502ce79cc357276d9bc2495?s=96&d=mm&r=g","caption":"Pavol Lupt\u00e1k"},"sameAs":["https:\/\/www.nethemba.com\/"],"url":"https:\/\/nethemba.com\/sk\/author\/nethemba-admin\/"}]}},"_links":{"self":[{"href":"https:\/\/nethemba.com\/sk\/wp-json\/wp\/v2\/posts\/5504","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nethemba.com\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nethemba.com\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nethemba.com\/sk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/nethemba.com\/sk\/wp-json\/wp\/v2\/comments?post=5504"}],"version-history":[{"count":0,"href":"https:\/\/nethemba.com\/sk\/wp-json\/wp\/v2\/posts\/5504\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nethemba.com\/sk\/wp-json\/wp\/v2\/media\/5508"}],"wp:attachment":[{"href":"https:\/\/nethemba.com\/sk\/wp-json\/wp\/v2\/media?parent=5504"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nethemba.com\/sk\/wp-json\/wp\/v2\/categories?post=5504"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nethemba.com\/sk\/wp-json\/wp\/v2\/tags?post=5504"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}