{"id":4223,"date":"2023-08-25T00:00:00","date_gmt":"2023-08-25T00:00:00","guid":{"rendered":"https:\/\/tech-lib.eu\/tech\/jak-funguje-firewall-pochopeni-technologie-firewallu\/"},"modified":"2023-08-25T00:00:00","modified_gmt":"2023-08-25T00:00:00","slug":"jak-funguje-firewall-pochopeni-technologie-firewallu","status":"publish","type":"post","link":"https:\/\/tech-lib.eu\/tech\/jak-funguje-firewall-pochopeni-technologie-firewallu\/","title":{"rendered":"Jak funguje firewall. Pochopen\u00ed technologie firewallu"},"content":{"rendered":"
\n
<\/div>\n

Zabezpe\u010den\u00ed s\u00edt\u011b nen\u00ed kompletn\u00ed bez firewall\u016f, kter\u00e9 funguj\u00ed jako fyzick\u00e1 bari\u00e9ra mezi va\u0161\u00edm po\u010d\u00edta\u010dem nebo s\u00edt\u00ed a \u0161irok\u00fdm propojen\u00fdm internetem. Slou\u017e\u00ed jako str\u00e1\u017ece, kter\u00fd hl\u00edd\u00e1 a \u0159\u00edd\u00ed tok datov\u00fdch paket\u016f mezi va\u0161\u00edm za\u0159\u00edzen\u00edm a vn\u011bj\u0161\u00edmi s\u00edt\u011bmi. V t\u00e9to eseji se budeme podrobn\u011b zab\u00fdvat firewally, a to od jejich z\u00e1klad\u016f a\u017e po jejich sofistikovan\u011bj\u0161\u00ed funkce. <\/p>\n

Jak vysv\u011btlit firewall laikovi? <\/div>\n

Firewall je zjednodu\u0161en\u011b \u0159e\u010deno hardware nebo software, kter\u00fd filtruje p\u0159\u00edchoz\u00ed a odchoz\u00ed s\u00ed\u0165ov\u00fd provoz podle p\u0159edem stanoven\u00fdch bezpe\u010dnostn\u00edch krit\u00e9ri\u00ed. Slou\u017e\u00ed jako bari\u00e9ra, kontroluje ka\u017ed\u00fd datov\u00fd paket, kter\u00fd j\u00edm proch\u00e1z\u00ed, a podle ur\u010dit\u00fdch pravidel jej povoluje nebo blokuje. Br\u00e1ny firewall jsou internetovou obdobou vyhazova\u010d\u016f a zaji\u0161\u0165uj\u00ed, aby do s\u00edt\u011b vstupoval pouze povolen\u00fd provoz. Jak funguje br\u00e1na firewall v syst\u00e9mu Windows? <\/p>\n

<\/div>\n

Syst\u00e9m Windows je vybaven integrovanou br\u00e1nou firewall s n\u00e1zvem Windows Firewall, kter\u00e1 nab\u00edz\u00ed minim\u00e1ln\u00ed \u00farove\u0148 zabezpe\u010den\u00ed. Na z\u00e1klad\u011b sady zadan\u00fdch pravidel sleduje p\u0159\u00edchoz\u00ed i odchoz\u00ed provoz. Obvykle povoluje odchoz\u00ed p\u0159ipojen\u00ed, ale br\u00e1n\u00ed p\u0159\u00edchoz\u00edm p\u0159ipojen\u00edm. Vytvo\u0159en\u00edm pravidel pro povolen\u00ed nebo z\u00e1kaz konkr\u00e9tn\u00edch program\u016f nebo port\u016f jej lze upravit tak, aby vyhovoval konkr\u00e9tn\u00edm pot\u0159eb\u00e1m. <\/p>\n

<\/div>\n

S\u00ed\u0165ov\u00e1 \u00farove\u0148 a aplika\u010dn\u00ed \u00farove\u0148 jsou dv\u011b \u00farovn\u011b, na kter\u00fdch br\u00e1na Windows Firewall funguje. Na \u00farovni s\u00edt\u011b zkoum\u00e1 adresy a porty p\u0159\u00edchoz\u00edch a odchoz\u00edch paket\u016f. P\u0159i rozhodov\u00e1n\u00ed o povolen\u00ed nebo z\u00e1kazu paket\u016f se na aplika\u010dn\u00ed \u00farovni zkoumaj\u00ed data v nich obsa\u017een\u00e1. Krom\u011b toho poskytuje mo\u017enost volby, zda povolit upozorn\u011bn\u00ed p\u0159i zam\u00edtnut\u00ed pokusu o p\u0159ipojen\u00ed. Jak je paket zpracov\u00e1v\u00e1n br\u00e1nou firewall? <\/p>\n

<\/div>\n

Br\u00e1na firewall kontroluje hlavi\u010dku ka\u017ed\u00e9ho datov\u00e9ho paketu, kter\u00fd vstupuje do s\u00edt\u011b, kterou st\u0159e\u017e\u00ed, aby zjistila zdrojovou a c\u00edlovou adresu a pou\u017eit\u00e9 porty. Aby ur\u010dil, zda m\u00e1 paket povolit, nebo odm\u00edtnout, porovn\u00e1v\u00e1 tyto \u00fadaje s p\u0159edem stanoven\u00fdmi pravidly. <\/p>\n

<\/div>\n

Firewally pou\u017e\u00edvaj\u00ed k posuzov\u00e1n\u00ed paket\u016f r\u016fzn\u00e9 metody filtrov\u00e1n\u00ed. Mezi tyto metody pat\u0159\u00ed br\u00e1ny na aplika\u010dn\u00ed \u00farovni (proxy), stavov\u00e1 kontrola a filtrov\u00e1n\u00ed paket\u016f. Zat\u00edmco stavov\u00e1 kontrola zkoum\u00e1 kontext paketu v r\u00e1mci aktivn\u00ed komunika\u010dn\u00ed relace, filtrov\u00e1n\u00ed paket\u016f zkoum\u00e1 hlavi\u010dku paketu. Br\u00e1ny na aplika\u010dn\u00ed \u00farovni slou\u017e\u00ed jako prost\u0159edn\u00edci, kte\u0159\u00ed p\u0159i p\u0159\u00edjmu paket\u016f p\u0159eb\u00edraj\u00ed roli zam\u00fd\u0161len\u00e9ho p\u0159\u00edjemce a prov\u00e1d\u011bj\u00ed dal\u0161\u00ed bezpe\u010dnostn\u00ed kontroly. Dok\u00e1\u017ee br\u00e1na firewall rozpoznat hackery? <\/p>\n

<\/div>\n

Firewally jsou prim\u00e1rn\u011b ur\u010deny k ochran\u011b p\u0159ed vn\u011bj\u0161\u00edmi hrozbami a k zastaven\u00ed neleg\u00e1ln\u00edho p\u0159\u00edstupu. Nejsou neproniknuteln\u00e9, ale dok\u00e1\u017e\u00ed rozpoznat a zastavit n\u011bkter\u00e9 \u00fatoky, nap\u0159\u00edklad ty, kter\u00e9 zahrnuj\u00ed zn\u00e1m\u00fd malware nebo neobvykl\u00e9 chov\u00e1n\u00ed s\u00edt\u011b. Firewally nedok\u00e1\u017eou zastavit ka\u017ed\u00fd druh \u00fatoku ani zastavit ka\u017ed\u00fd druh pokusu o hackersk\u00fd \u00fatok. <\/p>\n

<\/div>\n

Br\u00e1ny firewall se \u010dasto pou\u017e\u00edvaj\u00ed ve spojen\u00ed s dal\u0161\u00edmi bezpe\u010dnostn\u00edmi opat\u0159en\u00edmi, jako jsou syst\u00e9my detekce a prevence naru\u0161en\u00ed (IPS), kter\u00e9 zvy\u0161uj\u00ed bezpe\u010dnost. Tyto syst\u00e9my monitoruj\u00ed vzorce s\u00ed\u0165ov\u00e9ho provozu, hledaj\u00ed nesrovnalosti a okam\u017eit\u011b zastavuj\u00ed \u0161kodliv\u00e9 aktivity. <\/p>\n

<\/div>\n

Z\u00e1v\u011brem lze \u0159\u00edci, \u017ee br\u00e1ny firewall slou\u017e\u00ed jako str\u00e1\u017eci mezi va\u0161\u00edm za\u0159\u00edzen\u00edm a internetem a jsou z\u00e1sadn\u00edmi prvky zabezpe\u010den\u00ed s\u00edt\u011b. Br\u00e1ny firewall p\u0159edstavuj\u00ed kl\u00ed\u010dovou vrstvu zabezpe\u010den\u00ed, ale m\u011bly by b\u00fdt pou\u017e\u00edv\u00e1ny v sou\u010dinnosti s dal\u0161\u00edmi bezpe\u010dnostn\u00edmi n\u00e1stroji, aby bylo dosa\u017eeno \u00fapln\u00e9ho zabezpe\u010den\u00ed s\u00edt\u011b. Funguj\u00ed tak, \u017ee filtruj\u00ed p\u0159\u00edchoz\u00ed a odchoz\u00ed s\u00ed\u0165ov\u00fd provoz na z\u00e1klad\u011b zadan\u00fdch pravidel.<\/p><\/div>\n

\n
FAQ<\/div>\n
\n
M\u016f\u017ee \u00fato\u010dn\u00edk firewall p\u0159ekonat?<\/div>\n

Br\u00e1ny firewall jsou kl\u00ed\u010dov\u00fdm bezpe\u010dnostn\u00edm opat\u0159en\u00edm, ale nejsou odoln\u00e9 v\u016f\u010di \u00fatok\u016fm ze strany znal\u00fdch protivn\u00edk\u016f. Navzdory jejich \u00fa\u010dinnosti existuje \u0159ada technik, jak br\u00e1nu firewall obej\u00edt nebo podkopat: Zranitelnosti aplikac\u00ed: Pokud jsou v programech nebo slu\u017eb\u00e1ch b\u011b\u017e\u00edc\u00edch v s\u00edti d\u00edry, mohou \u00fato\u010dn\u00edci t\u011bchto nedostatk\u016f vyu\u017e\u00edt, aby p\u0159ekonali zabezpe\u010den\u00ed br\u00e1ny firewall a neopr\u00e1vn\u011bn\u011b vstoupili do syst\u00e9mu. Chybn\u00e1 konfigurace: <\/p>\n

<\/div>\n

2. Nevhodn\u00e9 nastaven\u00ed br\u00e1ny firewall nebo \u0161patn\u00e1 pravidla mohou v\u00e9st ke zranitelnostem, kter\u00e9 mohou \u00fato\u010dn\u00edci vyu\u017e\u00edt. Br\u00e1na firewall m\u016f\u017ee b\u00fdt zraniteln\u00e1, pokud m\u00e1 laxn\u00ed z\u00e1sady \u0159\u00edzen\u00ed p\u0159\u00edstupu nebo povoluje nepot\u0159ebn\u00e9 otev\u0159en\u00e9 porty. Zranitelnosti nult\u00e9ho dne (zero-day exploits) jsou zranitelnosti, kter\u00e9 dosud nebyly vy\u0159e\u0161eny, proto\u017ee nejsou zn\u00e1my \u0161irok\u00e9 ve\u0159ejnosti. \u00dato\u010dn\u00edci mohou b\u00fdt schopni obej\u00edt ochranu br\u00e1ny firewall pomoc\u00ed t\u011bchto chyb d\u0159\u00edve, ne\u017e budou identifikov\u00e1ny a opraveny. Br\u00e1ny firewall nemohou chr\u00e1nit p\u0159ed strategiemi soci\u00e1ln\u00edho in\u017een\u00fdrstv\u00ed, jako je phishing nebo vyd\u00e1v\u00e1n\u00ed se za \u00fato\u010dn\u00edka. <\/p>\n

<\/div>\n

4. \u00da\u010dinnost br\u00e1ny firewall je ohro\u017eena, pokud se \u00fato\u010dn\u00edkovi poda\u0159\u00ed p\u0159esv\u011bd\u010dit d\u016fv\u011bryhodn\u00e9ho u\u017eivatele, aby prozradil p\u0159\u00edstupov\u00e9 \u00fadaje nebo se dostal p\u0159es br\u00e1nu firewall pomoc\u00ed soci\u00e1ln\u00edho in\u017een\u00fdrstv\u00ed. 5. Pokro\u010dil\u00e9 trval\u00e9 hrozby (APT): APT jsou vysoce technick\u00e9, c\u00edlen\u00e9 \u00fatoky, jejich\u017e c\u00edlem je vyhnout se odhalen\u00ed po del\u0161\u00ed dobu. \u00dato\u010dn\u00edci p\u016fsob\u00edc\u00ed v r\u00e1mci APT \u010dasto pou\u017e\u00edvaj\u00ed nejmodern\u011bj\u0161\u00ed strategie, aby se dostali p\u0159es firewally, nap\u0159\u00edklad vyv\u00edjej\u00ed vlastn\u00ed malware nebo pou\u017e\u00edvaj\u00ed \u0161ifrovan\u00e9 metody komunikace. <\/p>\n

<\/div>\n

A\u010dkoli jsou firewally pro zabezpe\u010den\u00ed s\u00edt\u011b nezbytn\u00e9, m\u011bly by b\u00fdt zahrnuty i dal\u0161\u00ed ochrann\u00e9 prvky, jako jsou syst\u00e9my detekce naru\u0161en\u00ed (IDS), rutinn\u00ed aktualizace softwaru, \u0161kolen\u00ed u\u017eivatel\u016f a p\u0159\u00edsn\u00e1 omezen\u00ed p\u0159\u00edstupu. Aby se sn\u00ed\u017eila pravd\u011bpodobnost, \u017ee se \u00fato\u010dn\u00edkovi poda\u0159\u00ed obej\u00edt br\u00e1nu firewall, je t\u0159eba vytvo\u0159it v\u00edcevrstv\u00fd bezpe\u010dnostn\u00ed pl\u00e1n. <\/p>\n<\/div>\n

\n
Jak br\u00e1na firewall chr\u00e1n\u00ed data?<\/div>\n

Br\u00e1na firewall slou\u017e\u00ed jako bari\u00e9ra mezi d\u016fv\u011bryhodnou vnit\u0159n\u00ed s\u00edt\u00ed a ned\u016fv\u011bryhodnou vn\u011bj\u0161\u00ed s\u00edt\u00ed, obvykle internetem, a chr\u00e1n\u00ed tak data. Podle p\u0159edem definovan\u00fdch bezpe\u010dnostn\u00edch po\u017eadavk\u016f sleduje a reguluje p\u0159\u00edchoz\u00ed i odchoz\u00ed s\u00ed\u0165ov\u00fd provoz. <\/p>\n

<\/div>\n

Br\u00e1na firewall zkoum\u00e1 datov\u00e9 pakety p\u0159en\u00e1\u0161en\u00e9 po s\u00edti a zji\u0161\u0165uje, zda spl\u0148uj\u00ed stanoven\u00e9 bezpe\u010dnostn\u00ed standardy. Zkoum\u00e1 mimo jin\u00e9 zdrojov\u00e9 a c\u00edlov\u00e9 IP adresy, \u010d\u00edsla port\u016f a dal\u0161\u00ed \u00fadaje specifick\u00e9 pro dan\u00fd protokol. <\/p>\n

<\/div>\n

Mezi metody ochrany dat pou\u017e\u00edvan\u00e9 br\u00e1nou firewall pat\u0159\u00ed: <\/p>\n

<\/div>\n

1. Filtrov\u00e1n\u00ed paket\u016f: Tato technika zkoum\u00e1 ka\u017ed\u00fd paket zvl\u00e1\u0161\u0165 a porovn\u00e1v\u00e1 jej se seznamem pravidel. Paket je povolen k pr\u016fchodu, pokud spl\u0148uje po\u017eadavky, av\u0161ak pakety, kter\u00e9 p\u0159edpis\u016fm nevyhovuj\u00ed, jsou zastaveny. <\/p>\n

<\/div>\n

2. Stavov\u00e1 kontrola: Tato metoda sleduje stav p\u0159ipojen\u00ed v s\u00edti. Aby potvrdila, \u017ee pakety jsou sou\u010d\u00e1st\u00ed leg\u00e1ln\u00edho a nav\u00e1zan\u00e9ho spojen\u00ed, zkoum\u00e1 jejich kontext. Stavov\u00e9 br\u00e1ny firewall uchov\u00e1vaj\u00ed z\u00e1znam (stav) ka\u017ed\u00e9ho spojen\u00ed a na jeho z\u00e1klad\u011b se rozhoduj\u00ed, zda v budoucnu povol\u00ed p\u0159\u00edchoz\u00ed pakety. <\/p>\n

<\/div>\n

3. Filtrov\u00e1n\u00ed na aplika\u010dn\u00ed vrstv\u011b: Tato \u0161pi\u010dkov\u00e1 metoda pracuje na aplika\u010dn\u00ed vrstv\u011b s\u00ed\u0165ov\u00e9ho z\u00e1sobn\u00edku. Prohl\u00ed\u017e\u00ed obsah s\u00ed\u0165ov\u00fdch paket\u016f a vyhled\u00e1v\u00e1 a zastavuje konkr\u00e9tn\u00ed protokoly aplika\u010dn\u00ed \u00farovn\u011b nebo nebezpe\u010dn\u00fd malware. 4. Syst\u00e9my detekce a prevence naru\u0161en\u00ed (IDS\/IPS): Pro identifikaci a zastaven\u00ed potenci\u00e1ln\u00edch \u00fatok\u016f obsahuj\u00ed n\u011bkter\u00e9 br\u00e1ny firewall funkce IDS\/IPS. Zkoumaj\u00ed vzory s\u00ed\u0165ov\u00e9ho provozu a signatury, aby odhalily nesrovnalosti a okam\u017eit\u011b je zma\u0159ily. <\/p>\n

<\/div>\n

Br\u00e1na firewall pomoc\u00ed t\u011bchto technik funguje jako str\u00e1\u017ece br\u00e1ny, kter\u00fd umo\u017e\u0148uje pr\u016fchod leg\u00e1ln\u00edch dat a z\u00e1rove\u0148 zabra\u0148uje ne\u017e\u00e1douc\u00edmu p\u0159\u00edstupu nebo potenci\u00e1ln\u011b nebezpe\u010dn\u00e9mu provozu. Toto opat\u0159en\u00ed umo\u017e\u0148uje chr\u00e1nit citliv\u00e1 data p\u0159ed neopr\u00e1vn\u011bn\u00fdm p\u0159\u00edstupem, \u00fatoky a \u00faniky dat, v\u010detn\u011b osobn\u00edch \u00fadaj\u016f, finan\u010dn\u00edch z\u00e1znam\u016f a soukrom\u00fdch firemn\u00edch dat.<\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Zabezpe\u010den\u00ed s\u00edt\u011b nen\u00ed kompletn\u00ed bez firewall\u016f, kter\u00e9 funguj\u00ed jako fyzick\u00e1 bari\u00e9ra mezi va\u0161\u00edm po\u010d\u00edta\u010dem nebo s\u00edt\u00ed a \u0161irok\u00fdm propojen\u00fdm internetem. Slou\u017e\u00ed jako str\u00e1\u017ece, kter\u00fd hl\u00edd\u00e1 a \u0159\u00edd\u00ed tok datov\u00fdch paket\u016f mezi va\u0161\u00edm za\u0159\u00edzen\u00edm a vn\u011bj\u0161\u00edmi s\u00edt\u011bmi. V t\u00e9to eseji se budeme podrobn\u011b zab\u00fdvat firewally, a to od jejich z\u00e1klad\u016f a\u017e po jejich sofistikovan\u011bj\u0161\u00ed funkce. Jak … \u010c\u00edst d\u00e1l<\/a><\/p>\n","protected":false},"author":2853,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[396],"tags":[],"class_list":["post-4223","post","type-post","status-publish","format-standard","hentry","category-zabezpeceni-site"],"_links":{"self":[{"href":"https:\/\/tech-lib.eu\/tech\/wp-json\/wp\/v2\/posts\/4223","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tech-lib.eu\/tech\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tech-lib.eu\/tech\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tech-lib.eu\/tech\/wp-json\/wp\/v2\/users\/2853"}],"replies":[{"embeddable":true,"href":"https:\/\/tech-lib.eu\/tech\/wp-json\/wp\/v2\/comments?post=4223"}],"version-history":[{"count":0,"href":"https:\/\/tech-lib.eu\/tech\/wp-json\/wp\/v2\/posts\/4223\/revisions"}],"wp:attachment":[{"href":"https:\/\/tech-lib.eu\/tech\/wp-json\/wp\/v2\/media?parent=4223"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tech-lib.eu\/tech\/wp-json\/wp\/v2\/categories?post=4223"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tech-lib.eu\/tech\/wp-json\/wp\/v2\/tags?post=4223"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}