{"id":118997,"date":"2023-07-18T13:00:20","date_gmt":"2023-07-18T11:00:20","guid":{"rendered":"https:\/\/fotc.com\/?p=118997"},"modified":"2023-07-18T13:18:56","modified_gmt":"2023-07-18T11:18:56","slug":"google-cloud-armor","status":"publish","type":"post","link":"https:\/\/fotc.com\/ro\/blog\/google-cloud-armor\/","title":{"rendered":"Proteja\u021bi-v\u0103 aplica\u021biile web cu Google Cloud Armor"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Securitatea este un element esen\u021bial al oric\u0103rui serviciu cloud. Toate companiile vor s\u0103 \u0219tie c\u0103 informa\u021biile lor sunt \u00een siguran\u021b\u0103. Google Cloud Armor v\u0103 poate proteja sistemele de atacurile bazate pe web \u0219i poate atenua atacurile distribuite de refuzare a serviciului (DDoS). V\u0103 asigur\u0103 securitate la nivel de \u00eentreprindere, indiferent dac\u0103 aplica\u021bia este implementat\u0103 \u00een Google Cloud, on-premise sau \u00eentr-o infrastructur\u0103 multicloud.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Frecven\u021ba atacurilor DDoS este tot mai mare \u00een ultimii ani, at\u00e2t la nivel global, c\u00e2t \u0219i mai mult \u00een regiunea EMEA (Europa, Orientul Mijlociu, Africa), potrivit unui raport publicat de firma de securitate cibernetic\u0103 Radware. La sf\u00e2r\u0219itul anului 2022, frecven\u021ba atacurilor DDoS blocate a crescut de 3,5 ori (de la 8,4 pe zi la sf\u00e2r\u0219itul anului 2021, la 29,3 ori pe zi un an mai t\u00e2rziu).&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u00cen EMEA, organiza\u021biile au \u00eenregistrat \u00een medie 45 de atacuri pe zi, potrivit acestui raport. Cifra este de patru ori mai mare comparativ cu un an mai devreme (c\u00e2nd se \u00eenregistrau 11,3 atacuri pe zi). Securitatea \u0219i protec\u021bia \u00eempotriva atacurilor de re\u021bea au devenit una dintre cele mai mari provoc\u0103ri pentru orice organiza\u021bie. \u00cen acest articol, v\u0103 prezent\u0103m Google Cloud Armor \u0219i cum func\u021bioneaz\u0103. Ve\u021bi afla ce este, ce atacuri poate bloca \u0219i cum poate fi integrat cu alte servicii Google Cloud.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-ce-este-google-cloud-armor\">Ce este Google Cloud Armor?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Cloud Armor este o solu\u021bie <a href=\"https:\/\/fotc.com\/ro\/google-cloud-platform\/\" class=\"ek-link\">Google Cloud<\/a> pentru protec\u021bie \u00eempotriva atacurilor DDoS. Aceasta furnizeaz\u0103 protec\u021bie automat\u0103 \u00eempotriva atacurilor DDoS de tip L3 \u0219i L4, dar poate oferi \u0219i protec\u021bie de tip Layer 7. Include \u0219i unele caracteristici inovatoare, cum ar fi limitarea ratei, gestionarea bot-urilor \u0219i protec\u021bie adaptiv\u0103.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cloud Armor func\u021bioneaz\u0103 \u0219i ca un Firewall pentru aplica\u021bii web, ceea ce \u00eenseamn\u0103 c\u0103 poate recunoa\u0219te \u0219i bloca tipurile comune de atacuri. Acesta con\u021bine reguli preconfigurate, ce pot fi ajustate \u00een sub-reguli specifice. Astfel, pute\u021bi proteja aplica\u021bia \u00eempotriva atacurilor de SQL injection, atacurilor XSS (cross-site-scripting) comune \u0219i altor c\u00e2torva atacuri de fixare a sesiunii. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Cloud Armor poate seta controale de acces bazate pe IP \u0219i localizare geo, astfel \u00eenc\u00e2t s\u0103 pute\u021bi permite sau refuza traficul \u00een func\u021bie de surs\u0103 \u0219i loca\u021bia geografic\u0103 sau pute\u021bi filtra traficul pe baza adreselor IPv4 sau IPv6 sau a CIDR-urilor.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Unele dintre func\u021biile de securitate oferite de Google Cloud Armor func\u021bioneaz\u0103 automat, \u00eens\u0103 acest lucru nu se aplic\u0103 tuturor. Important este c\u0103 merit\u0103 s\u0103 folosi\u021bi protec\u021bia Google Cloud Armor chiar \u0219i atunci c\u00e2nd Google Cloud nu este singura voastr\u0103 solu\u021bie cloud. Protec\u021bia va func\u021biona \u0219i \u00een cazul unui model cloud hibrid sau multi-cloud. \u00centr-o astfel de arhitectur\u0103, back-end-ul pentru echilibrarea \u00eenc\u0103rc\u0103turii trebuie s\u0103 fie de tip Internet NEG (network endpoint group).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">C\u00e2mpul de b\u0103t\u0103lie: atacurile DDoS Layer 7, care vizeaz\u0103 aplica\u021biile web<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Dac\u0103 sunte\u021bi familiarizat cu modelul de referin\u021b\u0103 ISO\/OSI care standardizeaz\u0103 comunicarea \u00een re\u021bea \u00eentre diferite dispozitive, \u0219ti\u021bi c\u0103 layer 7, la cel mai \u00eenalt nivel, corespunde nivelului de aplica\u021bie. La acest nivel se aplic\u0103 func\u021bia \u201e<strong>Protec\u021bie adaptiv\u0103<\/strong>\u201d. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Sarcina sa este de a bloca un atac \u00eenainte ca acesta s\u0103 ajung\u0103 la backend-ul echilibratorului de \u00eenc\u0103rcare. Fiecare regul\u0103 de securitate este \u00eemp\u0103r\u021bit\u0103 \u00eentr-un set de reguli de filtrare bazate pe adresa IP a cererii primite, intervalul de adrese IP sau codul de regiune. C\u00e2nd se creeaz\u0103 reguli personalizate, sunt utiliza\u021bi parametrii din layerele L3-L7.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Definirea regulilor WAF (web application firewall)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u00cen Google Cloud Armor, este posibil s\u0103 defini\u021bi reguli cu diferite priorit\u0103\u021bi, acord\u00e2nd prioritate implement\u0103rilor diferite \u00een func\u021bie de acestea. De asemenea, pute\u021bi utiliza reguli WAF (web application firewall) preconfigurate care con\u021bin zeci de semn\u0103turi compilate din standardele din industrie, disponibile open source. Fiecare astfel de semn\u0103tur\u0103 corespunde unei reguli pentru detectarea atacurilor \u00een cadrul unui set de reguli. Regulile WAF se concentreaz\u0103 pe limitarea primelor 10 amenin\u021b\u0103ri legate de vulnerabilit\u0103\u021bi \u00een securitatea aplica\u021biei web OWASP.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Utilizarea regulilor poate fi de mare convenien\u021b\u0103 pentru companii. Acestea permit Google Cloud Armor s\u0103 evalueze zeci de semn\u0103turi de trafic diferite. Astfel, face referire la reguli definite de utilizatori \u00een loc s\u0103 solicite definirea manual\u0103 a fiec\u0103rei semn\u0103turi.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Cum func\u021bioneaz\u0103 Google Cloud Armor?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Google Cloud Armor garanteaz\u0103:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><strong>Protec\u021bie continu\u0103 \u00eempotriva atacurilor DDoS<\/strong> \u00een re\u021bea sau de protocol.<\/li><li><strong>Protec\u021bie pentru aplica\u021biile \u0219i serviciile<\/strong> din backend-ul echilibratorului de \u00eenc\u0103rcare.<\/li><li><strong>Detectarea \u0219i atenuarea atacurilor de re\u021bea,<\/strong> permi\u021b\u00e2nd doar cereri legitime prin serverele proxy.<\/li><li><strong>Utilizarea parametrilor din straturile L3-L7 <\/strong>\u00een cazul regulilor personaizare. Protec\u021bia adaptiv\u0103 poate fi activat\u0103 pentru fiecare dintre aceste reguli, care detecteaz\u0103 \u0219i blocheaz\u0103 atacurile DDoS de la Layer 7.<\/li><\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u00cen diagrama de mai jos este ilustrat\u0103 loca\u021bia modulelor externe globale Load Balancer, a re\u021belei Google \u0219i a centrelor de date Google.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_59.png\" alt=\"\" class=\"wp-image-119667\" width=\"602\" height=\"486\" srcset=\"https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_59.png 632w, https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_59-300x242.png 300w, https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_59-123x99.png 123w, https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_59-142x115.png 142w, https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_59-217x175.png 217w, https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_59-349x282.png 349w, https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_59-227x183.png 227w, https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_59-26x21.png 26w\" sizes=\"(max-width: 602px) 100vw, 602px\" \/><\/figure><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Utiliz\u0103ri practice ale Cloud Armor<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Configurarea Cloud Armor este foarte simpl\u0103. Ve\u021bi g\u0103si Cloud Armor \u00een consola Google Cloud \u00een sec\u021biunea Re\u021bea\/Securitatea re\u021belei. Acolo, pute\u021bi crea o politic\u0103 de securitate \u0219i o pute\u021bi configura pentru a v\u0103 ajuta s\u0103 v\u0103 proteja\u021bi aplica\u021bia web. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Mai jos pute\u021bi vedea c\u00e2teva exemple pratice ale protec\u021biei Cloud Armor. <\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Permiterea accesului de la anumite adrese IP cu ajutorul listelor de acces<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">O situa\u021bie comun\u0103 este reprezentat\u0103 \u00een diagrama de mai jos. \u00cen acest caz, numai membrii organiza\u021biei, cu adrese IP sau blocuri IP atribuite de organiza\u021bie \u0219i lista\u021bi cu acces, pot acces serviciile din backend-ul echilibratorului de \u00eenc\u0103rcare. Acest lucru permite controlul asupra accesului at\u00e2t la dispozitivele de echilibrare a \u00eenc\u0103rc\u0103turii aplica\u021biei externe, c\u00e2t \u0219i la cele clasice.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full is-resized\"><img decoding=\"async\" src=\"https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_60.png\" alt=\"\" class=\"wp-image-119678\" width=\"533\" height=\"401\" srcset=\"https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_60.png 565w, https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_60-300x226.png 300w, https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_60-123x93.png 123w, https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_60-142x107.png 142w, https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_60-233x175.png 233w, https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_60-375x282.png 375w, https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_60-243x183.png 243w, https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_60-26x20.png 26w\" sizes=\"(max-width: 533px) 100vw, 533px\" \/><\/figure><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Blocarea anumitor adrese folosind listele de refuz<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Serviciul permite, de asemenea, o opera\u021biune invers\u0103 precum cea exemplificat\u0103 mai sus. Aceasta implic\u0103 crearea unor reguli de securitate care resping traficul provenind din anumite adrese IP sau intervale CIDR. Aceast\u0103 practic\u0103 este ilustrat\u0103 \u00een urm\u0103toarea diagram\u0103:<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-full\"><img decoding=\"async\" width=\"526\" height=\"429\" src=\"https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_63.png\" alt=\"\" class=\"wp-image-119684\" srcset=\"https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_63.png 526w, https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_63-300x245.png 300w, https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_63-123x100.png 123w, https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_63-142x116.png 142w, https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_63-215x175.png 215w, https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_63-346x282.png 346w, https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_63-224x183.png 224w, https:\/\/fotc.com\/app\/uploads\/2023\/07\/Screenshot_63-26x21.png 26w\" sizes=\"(max-width: 526px) 100vw, 526px\" \/><\/figure><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Reguli personalizate pentru filtrarea parametrilor \u00eentre layere<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">\u00cen Google Cloud Armor, pute\u021bi utiliza limbajul personalizat al regulilor pentru a defini una sau mai multe expresii. C\u00e2nd serviciul prime\u0219te o solicitare, o evalueaz\u0103 pe baza acestor expresii, permi\u021b\u00e2nd astfel blocarea sau accesul pentru traficul extern.<\/p>\n\n\n<div class=\"bg-yellow banners mt-4 mb-4\">\r\n  <div class=\"container \">\r\n    <div class=\"row sw\">\r\n        <div class=\"col-md-7 sw col-12 mb-md-0\">\r\n        <span style=\"margin-bottom: 1rem;\r\n    font-weight: 500;margin-top: 25px;\r\n    line-height: 1.1;\r\n    font-size: 2rem; display: block; color:#fff\">Implementa\u021bi Google Cloud Armor cu ajutorul<\/span>\r\n        <\/div>\r\n        <div class=\"col-md-5 sw sww\">\r\n        <img decoding=\"async\" style=\"margin-top:25px;\" src=\"\/app\/uploads\/2023\/02\/FOTC-LOGO-WWW-RGB-RED-2.png\">\r\n        <\/div>\r\n        <\/div>\r\n        <div class=\"row\">\r\n          <div class=\"col-md-7\"><p style=\"color:#fff\">FOTC, partener premium Google <\/p><\/div>\r\n        <div class=\"col-md-5 col-12 text-cent-right\">\r\n        <a class=\"newbtn bannerbtn\" href=\"https:\/\/fotc.com\/ro\/contact\/\">Contacta\u021bi FOTC<\/a>\r\n        \r\n        <\/div>\r\n    <\/div>\r\n  <\/div>\r\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Securitatea este un element esen\u021bial al oric\u0103rui serviciu cloud. Toate companiile vor s\u0103 \u0219tie c\u0103 informa\u021biile lor sunt \u00een siguran\u021b\u0103. Google Cloud Armor v\u0103 poate proteja sistemele de atacurile bazate pe web \u0219i poate atenua atacurile distribuite de refuzare a serviciului (DDoS). V\u0103 asigur\u0103 securitate la nivel de \u00eentreprindere, indiferent dac\u0103 aplica\u021bia este implementat\u0103 \u00een&#8230;<\/p>\n","protected":false},"author":19,"featured_media":118998,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_editorskit_title_hidden":false,"_editorskit_reading_time":4,"_editorskit_is_block_options_detached":false,"_editorskit_block_options_position":"{}","footnotes":""},"categories":[562],"tags":[],"class_list":["post-118997","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-google-cloud-platform-ro"],"_links":{"self":[{"href":"https:\/\/fotc.com\/ro\/wp-json\/wp\/v2\/posts\/118997","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fotc.com\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fotc.com\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fotc.com\/ro\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/fotc.com\/ro\/wp-json\/wp\/v2\/comments?post=118997"}],"version-history":[{"count":0,"href":"https:\/\/fotc.com\/ro\/wp-json\/wp\/v2\/posts\/118997\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/fotc.com\/ro\/wp-json\/wp\/v2\/media\/118998"}],"wp:attachment":[{"href":"https:\/\/fotc.com\/ro\/wp-json\/wp\/v2\/media?parent=118997"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fotc.com\/ro\/wp-json\/wp\/v2\/categories?post=118997"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fotc.com\/ro\/wp-json\/wp\/v2\/tags?post=118997"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}