{"id":14082,"date":"2024-07-03T13:26:43","date_gmt":"2024-07-03T07:26:43","guid":{"rendered":"https:\/\/dtasiagroup.com\/security-awareness-and-log-management-for-security-analysts\/"},"modified":"2024-07-23T15:36:59","modified_gmt":"2024-07-23T09:36:59","slug":"nhan-thuc-an-ninh-va-quan-ly-nhat-ky-cho-cac-nha-phan-tich-an-ninh","status":"publish","type":"post","link":"https:\/\/dtasiagroup.com\/vi\/nhan-thuc-an-ninh-va-quan-ly-nhat-ky-cho-cac-nha-phan-tich-an-ninh\/","title":{"rendered":"Nh\u1eadn th\u1ee9c v\u1ec1 an ninh v\u00e0 qu\u1ea3n l\u00fd log cho c\u00e1c nh\u00e0 ph\u00e2n t\u00edch b\u1ea3o m\u1eadt"},"content":{"rendered":"<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/cdn-jnkep.nitrocdn.com\/GTmurwhroBoLJVMAHNGccmBVEhSunPoF\/assets\/images\/optimized\/rev-ed4d356\/graylog.org\/wp-content\/uploads\/2022\/12\/Picture8-1.png\" alt=\"\" width=\"503\" height=\"236\" \/><\/p>\n<p>Trong m\u00f4i tr\u01b0\u1eddng l\u00e0m vi\u1ec7c t\u1eeb xa ng\u00e0y nay, c\u00e1c chuy\u00ean gia an ninh c\u1ea7n \u0111\u01b0\u1ee3c \u0111\u00e0o t\u1ea1o ki\u1ebfn th\u1ee9c chuy\u00ean s\u00e2u v\u1ec1 an ninh b\u1ea3o m\u1eadt, v\u01b0\u1ee3t xa c\u00e1c ch\u01b0\u01a1ng tr\u00ecnh \u0111\u00e0o t\u1ea1o ti\u00eau chu\u1ea9n v\u1ec1 vi\u1ec7c &#8220;kh\u00f4ng nh\u1ea5p v\u00e0o li\u00ean k\u1ebft l\u1eeba \u0111\u1ea3o&#8221;\u00a0 cho ph\u1ea7n c\u00f2n l\u1ea1i c\u1ee7a c\u00f4ng ty. M\u1eb7c d\u00f9 c\u00e1c nh\u00e0 ph\u00e2n t\u00edch b\u1ea3o\u00a0 r\u1ea5t gi\u1ecfi trong vi\u1ec7c nh\u1eadn di\u1ec7n email l\u1eeba \u0111\u1ea3o v\u00e0 thi\u1ebft l\u1eadp m\u1eadt kh\u1ea9u an to\u00e0n, nh\u01b0ng nh\u1eadn th\u1ee9c v\u1ec1 an ninh m\u1ea1ng c\u1ea7n ph\u1ea3i \u0111\u01b0\u1ee3c m\u1edf r\u1ed9ng \u0111\u1ec3 t\u1ed1i \u01b0u h\u00f3a chi\u1ebfn l\u01b0\u1ee3c qu\u1ea3n l\u00fd log, nh\u1eb1m b\u1eaft k\u1ecbp c\u00e1c m\u1ed1i \u0111e d\u1ecda ng\u00e0y c\u00e0ng ph\u00e1t tri\u1ec3n v\u00e0 tinh vi.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Ch\u1ecdn m\u1ed9t Framework \u0111\u1ec3 s\u0103n l\u00f9ng c\u00e1c m\u1ed1i \u0111e d\u1ecda<\/strong><\/p>\n<p>Vi\u1ec7c s\u0103n l\u00f9ng c\u00e1c m\u1ed1i \u0111e d\u1ecda r\u1ea5t c\u1ea7n\u00a0 \u0111\u1ec3 gi\u1ea3m thi\u1ec3u r\u1ee7i ro t\u1eeb c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng l\u1eeba \u0111\u1ea3o. \u0110\u1ec3 ng\u0103n ch\u1eb7n c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng l\u1eeba \u0111\u1ea3o tr\u1edf th\u00e0nh c\u00e1c s\u1ef1 c\u1ed1 r\u00f2 r\u1ec9 d\u1eef li\u1ec7u ho\u1eb7c ransomware, vi\u1ec7c ch\u1ee7 \u0111\u1ed9ng t\u00ecm ki\u1ebfm c\u00e1c d\u1ea5u hi\u1ec7u x\u00e2m nh\u1eadp l\u00e0 r\u1ea5t c\u1ea7n thi\u1ebft.<\/p>\n<p>X\u00e2y d\u1ef1ng m\u1ed9t ch\u01b0\u01a1ng tr\u00ecnh b\u1ea3o m\u1eadt v\u1eefng ch\u1eafc bao g\u1ed3m vi\u1ec7c hi\u1ec3u\u00a0 c\u00e1c m\u00f4 h\u00ecnh t\u1ea5n c\u00f4ng kh\u00e1c nhau v\u00e0 c\u00f3 kh\u1ea3 n\u0103ng theo d\u00f5i c\u00e1c chi\u1ebfn thu\u1eadt, k\u1ef9 thu\u1eadt v\u00e0 quy tr\u00ecnh (TTPs) c\u1ee7a c\u00e1c t\u00e1c nh\u00e2n \u0111e d\u1ecda. B\u1ed1n framework n\u1ed5i b\u1eadt nh\u1ea5t cho m\u1ee5c \u0111\u00edch n\u00e0y l\u00e0:<\/p>\n<ul>\n<li><strong>Lockheed Martin Cyber Kill Chain\u00ae<\/strong><\/li>\n<li><strong>FireEye Attack Lifecycle<\/strong><\/li>\n<li><strong>Gartner Cyber Attack Model<\/strong><\/li>\n<li><strong>MITRE ATT&amp;CK Lifecycle<\/strong><\/li>\n<\/ul>\n<p>M\u1ed7i khung l\u00e0m vi\u1ec7c cung c\u1ea5p m\u1ed9t c\u00e1ch ti\u1ebfp c\u1eadn ri\u00eang bi\u1ec7t \u0111\u1ec3 theo d\u00f5i c\u00e1c t\u00e1c nh\u00e2n \u0111e d\u1ecda, nh\u01b0ng ch\u00fang \u0111\u1ec1u c\u00f3 m\u1ed9t s\u1ed1 \u0111i\u1ec3m t\u01b0\u01a1ng \u0111\u1ed3ng. V\u00ed d\u1ee5, s\u1ef1 kh\u00e1c bi\u1ec7t gi\u1eefa Lockheed Martin Cyber Kill Chain v\u00e0 MITRE ATT&amp;CK lifecycle minh h\u1ecda c\u00e1c ph\u01b0\u01a1ng ph\u00e1p gi\u00e1m s\u00e1t t\u00e1c nh\u00e2n \u0111e d\u1ecda kh\u00e1c nhau.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>T\u1ea1i sao vi\u1ec7c ch\u1ecdn Framework l\u1ea1i quan tr\u1ecdng<\/strong><\/p>\n<p>Vi\u1ec7c ch\u1ecdn framework ph\u00f9 h\u1ee3p l\u00e0 r\u1ea5t quan tr\u1ecdng v\u00ec n\u00f3 h\u01b0\u1edbng d\u1eabn c\u00e1ch b\u1ea1n l\u1eadp b\u1ea3n \u0111\u1ed3 c\u00e1c truy v\u1ea5n s\u0103n l\u00f9ng m\u1ed1i \u0111e d\u1ecda m\u1ed9t c\u00e1ch ch\u1ee7 \u0111\u1ed9ng. Hi\u1ec3u r\u00f5 m\u1ee5c ti\u00eau b\u1ea1n c\u1ea7n t\u00ecm ki\u1ebfm v\u00e0 c\u00e1ch t\u00ecm ki\u1ebfm cho ph\u00e9p b\u1ea1n t\u1ea1o ra c\u00e1c c\u1ea3nh b\u00e1o c\u00f3 \u0111\u1ed9 ch\u00ednh x\u00e1c cao h\u01a1n, t\u1eeb \u0111\u00f3 c\u1ea3i thi\u1ec7n c\u00e1c ch\u1ec9 s\u1ed1 quan tr\u1ecdng nh\u01b0 Th\u1eddi gian Trung b\u00ecnh \u0111\u1ec3 X\u00e1c \u0111\u1ecbnh (Mean Time to Identify &#8211; MTTI) v\u00e0 Th\u1eddi gian Trung b\u00ecnh \u0111\u1ec3 Ph\u1ea3n \u1ee9ng (Mean Time to Respond &#8211; MTTR).<\/p>\n<p>B\u1eb1ng c\u00e1ch \u0111\u1ed3ng b\u1ed9 h\u00f3a c\u00e1c chi\u1ebfn l\u01b0\u1ee3c s\u0103n l\u00f9ng m\u1ed1i \u0111e d\u1ecda c\u1ee7a b\u1ea1n v\u1edbi framework \u0111\u00e3 ch\u1ecdn, b\u1ea1n c\u00f3 th\u1ec3 n\u00e2ng cao kh\u1ea3 n\u0103ng c\u1ee7a t\u1ed5 ch\u1ee9c trong vi\u1ec7c ph\u00e1t hi\u1ec7n v\u00e0 ph\u1ea3n \u1ee9ng v\u1edbi c\u00e1c m\u1ed1i \u0111e d\u1ecda m\u1ed9t c\u00e1ch hi\u1ec7u qu\u1ea3 h\u01a1n, \u0111\u1ea3m b\u1ea3o m\u1ed9t m\u1ea1ng l\u01b0\u1edbi an to\u00e0n v\u00e0 b\u1ec1n v\u1eefng h\u01a1n.<\/p>\n<p>&nbsp;<\/p>\n<p class=\"nitro-offscreen\"><strong>V\u00ed d\u1ee5<\/strong><\/p>\n<p class=\"nitro-offscreen\">So s\u00e1nh <a href=\"https:\/\/www.lockheedmartin.com\/en-us\/capabilities\/cyber\/cyber-kill-chain.html\">Lockheed Martin Cyber Kill Chain<\/a> \u00a0<a href=\"https:\/\/attack.mitre.org\/\">MITRE ATT&amp;CK framework<\/a> cho th\u1ea5y c\u00e1ch m\u00e0 framework thay \u0111\u1ed5i c\u00e1ch ti\u1ebfp c\u1eadn c\u1ee7a c\u00e1c nh\u00e0 ph\u00e2n t\u00edch b\u1ea3o m\u1eadt \u0111\u1ed1i v\u1edbi c\u00e1c ho\u1ea1t \u0111\u1ed9ng nh\u01b0 s\u0103n l\u00f9ng v\u00e0 ph\u00e1t hi\u1ec7n c\u00e1c m\u1ed1i \u0111e d\u1ecda.<\/p>\n<table class=\"nitro-offscreen\">\n<tbody>\n<tr>\n<td>Cyber Kill Chain<\/td>\n<td>MITRE ATT&amp;CK<\/td>\n<\/tr>\n<tr>\n<td><b>Reconnaissance<\/b>: looking for information about a company, scanning networks<\/td>\n<td><b>Reconnaissance<\/b>: looking for information about a company, scanning networks<\/td>\n<\/tr>\n<tr>\n<td><b>Weaponization<\/b>: looking for a vulnerability that they can exploit as a backdoor<\/td>\n<td><b>Resource Development<\/b>: Looking for resources that can support their plan<\/td>\n<\/tr>\n<tr>\n<td><b>Delivery<\/b>: Delivering the payload to the victim<\/td>\n<td><b>Initial Acces<\/b>s: Attempting to gain unauthorized access to systems, network, software<\/td>\n<\/tr>\n<tr>\n<td><b>Exploitation<\/b>: Using the discovered vulnerability to execute the malicious code<\/td>\n<td><\/td>\n<\/tr>\n<tr>\n<td><b>Installation<\/b>: Installing malware on target asset<\/td>\n<td><b>Execution<\/b>: Executing malicious code<\/td>\n<\/tr>\n<tr>\n<td><\/td>\n<td><b>Persistence<\/b>: Finding a way to remain in systems and networks<\/td>\n<\/tr>\n<tr>\n<td><\/td>\n<td><b>Privilege Escalation<\/b>: Attempting to gain additional levels of access and permissions within systems and networks<\/td>\n<\/tr>\n<tr>\n<td><\/td>\n<td><b>Defense Evasion<\/b>: Hiding from security tools and analysts and not triggering alerts<\/td>\n<\/tr>\n<tr>\n<td><\/td>\n<td><b>Credential Access:\u00a0<\/b>Attempting to steal usernames and passwords<\/td>\n<\/tr>\n<tr>\n<td><\/td>\n<td><b>Credential Access:\u00a0<\/b>Attempting to steal usernames and passwords<\/td>\n<\/tr>\n<tr>\n<td><\/td>\n<td><b>Discovery<\/b>: Learning about the environment<\/td>\n<\/tr>\n<tr>\n<td><\/td>\n<td><b>Lateral Movement<\/b>: Moving throughout the environment as part of persistence<\/td>\n<\/tr>\n<tr>\n<td><\/td>\n<td><b>Collection<\/b>: Gathering or exfiltrating sensitive information<\/td>\n<\/tr>\n<tr>\n<td><b>Command and Control (C2)<\/b>: Establishing a remote communication channel<\/td>\n<td><b>Command and Control (C2)<\/b>: Establishing a remote communication channel<\/td>\n<\/tr>\n<tr>\n<td><b>Actions on Objectives<\/b>: Completing the attack either by deploying a malware or exfiltrating information<\/td>\n<td><b>Exfiltration<\/b>: Stealing data<\/td>\n<\/tr>\n<tr>\n<td><\/td>\n<td><b>Impact<\/b>: Manipulating, interrupting, or destroying systems and data<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Trong khi <strong>Cyber Kill Chain <\/strong>t\u1eadp trung v\u00e0o vi\u1ec7c x\u00e1c \u0111\u1ecbnh c\u00e1c ch\u1ec9 b\u00e1o c\u1ee7a malware v\u00e0 ransomware, <strong>MITRE ATT&amp;CK framwork<\/strong> \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 ph\u00e1t hi\u1ec7n c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng c\u00f3 ch\u1ee7 \u0111\u00edch (Advanced persistent threats &#8211; APTs), c\u0169ng c\u00f3 th\u1ec3 li\u00ean quan \u0111\u1ebfn malware ho\u1eb7c ransomware. C\u1ea3 hai framework \u0111\u1ec1u nh\u1ea5n m\u1ea1nh c\u00e1ch m\u00e0 c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng l\u1eeba \u0111\u1ea3o th\u01b0\u1eddng b\u1eaft \u0111\u1ea7u v\u1edbi c\u00e1c chi\u1ebfn thu\u1eadt trinh s\u00e1t (Reconnaisance) c\u01a1 b\u1ea3n v\u00e0 t\u1ea5n c\u00f4ng phi k\u1ef9 thu\u1eadt (social engineering) \u0111\u1ec3 chuy\u1ec3n t\u1ea3i c\u00e1c g\u00f3i d\u1eef li\u1ec7u ho\u1eb7c t\u1ea1o \u0111i\u1ec1u ki\u1ec7n ph\u00e1t tri\u1ec3n t\u00e0i nguy\u00ean.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>L\u1eadp b\u1ea3n \u0111\u1ed3 truy v\u1ea5n s\u0103n l\u00f9ng m\u1ed1i \u0111e d\u1ecda\u00a0 Framework<\/strong><\/p>\n<div class=\"flex flex-grow flex-col max-w-full\">\n<div class=\"min-h-[20px] text-message flex w-full flex-col items-end gap-2 whitespace-pre-wrap break-words [.text-message+&amp;]:mt-5 overflow-x-auto\" dir=\"auto\" data-message-author-role=\"assistant\" data-message-id=\"7cc65bed-ccb6-46bb-bb3e-6011a6587a4b\">\n<div class=\"flex w-full flex-col gap-1 empty:hidden first:pt-[3px]\">\n<div class=\"markdown prose w-full break-words dark:prose-invert light\">\n<p>B\u1ea5t k\u1ec3 b\u1ea1n ch\u1ecdn framework n\u00e0o, \u0111i\u1ec1u quan tr\u1ecdng l\u00e0 l\u1eadp b\u1ea3n \u0111\u1ed3 c\u00e1c truy v\u1ea5n s\u0103n l\u00f9ng m\u1ed1i \u0111e d\u1ecda ch\u1ee7 \u0111\u1ed9ng c\u1ee7a b\u1ea1n theo framework \u0111\u00f3. Hi\u1ec3u r\u00f5 nh\u1eefng g\u00ec c\u1ea7n t\u00ecm ki\u1ebfm v\u00e0 c\u00e1ch th\u1ee9c t\u00ecm ki\u1ebfm s\u1ebd cho ph\u00e9p b\u1ea1n t\u1ea1o ra c\u00e1c c\u1ea3nh b\u00e1o c\u00f3 \u0111\u1ed9 ch\u00ednh x\u00e1c cao h\u01a1n, t\u1eeb \u0111\u00f3 c\u1ea3i thi\u1ec7n c\u00e1c ch\u1ec9 s\u1ed1 quan tr\u1ecdng nh\u01b0 Th\u1eddi gian Trung b\u00ecnh \u0111\u1ec3 X\u00e1c \u0111\u1ecbnh (MTTI) v\u00e0 Th\u1eddi gian Trung b\u00ecnh \u0111\u1ec3 Ph\u1ea3n \u1ee9ng (MTTR).<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<div class=\"mt-1 flex gap-3 empty:hidden ml-3\">\n<div class=\"items-center justify-start rounded-xl p-1 flex\">\n<div><\/div>\n<div class=\"flex items-center\"><strong>N\u00e2ng cao d\u1eef li\u1ec7u \u0111\u1ec3 n\u00e2ng cao m\u1ee9c \u0111\u1ed9 ch\u00ednh x\u00e1c c\u1ee7a c\u1ea3nh b\u00e1o<\/strong><\/div>\n<\/div>\n<\/div>\n<p>C\u1ea3nh b\u00e1o theo th\u1eddi gian th\u1ef1c l\u00e0 r\u1ea5t quan tr\u1ecdng, nh\u01b0ng ch\u00eca kh\u00f3a \u0111\u1ec3 \u0111\u1ea1t \u0111\u01b0\u1ee3c \u0111i\u1ec1u n\u00e0y n\u1eb1m \u1edf c\u00e1ch b\u1ea1n t\u1ed5ng h\u1ee3p v\u00e0 li\u00ean k\u1ebft d\u1eef li\u1ec7u log c\u1ee7a m\u00ecnh. Kh\u00f4ng ph\u1ea3i m\u1ecdi c\u1ea3nh b\u00e1o \u0111\u1ec1u ch\u1ec9 ra s\u1ef1 hi\u1ec7n di\u1ec7n c\u1ee7a k\u1ebb t\u1ea5n c\u00f4ng, do \u0111\u00f3 vi\u1ec7c n\u00e2ng cao d\u1eef li\u1ec7u l\u00e0 c\u1ea7n thi\u1ebft \u0111\u1ec3 thi\u1ebft l\u1eadp c\u00e1c k\u00edch ho\u1ea1t ph\u00f9 h\u1ee3p.<\/p>\n<p>C\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng l\u1eeba \u0111\u1ea3o th\u01b0\u1eddng d\u1eabn \u0111\u1ebfn vi\u1ec7c \u0111\u00e1nh c\u1eafp th\u00f4ng tin x\u00e1c th\u1ef1c. T\u1ed9i ph\u1ea1m m\u1ea1ng c\u00f3 th\u1ec3 s\u1eed d\u1ee5ng nh\u1eefng th\u00f4ng tin n\u00e0y \u0111\u1ec3 x\u00e1c minh email ho\u1eb7c \u0111\u0103ng nh\u1eadp v\u00e0o c\u00e1c t\u1ed5 ch\u1ee9c ho\u1eb7c g\u1eedi ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i k\u1ebft n\u1ed1i v\u1edbi trung t\u00e2m \u0111i\u1ec1u khi\u1ec3n c\u1ee7a ch\u00fang (C2).<\/p>\n<p>\u0110\u1ec3 \u0111\u1ea1t \u0111\u01b0\u1ee3c c\u1ea3nh b\u00e1o ch\u00ednh x\u00e1c cao, h\u00e3y \u0111\u1ea3m b\u1ea3o r\u1eb1ng b\u1ea1n c\u00f3 th\u1ec3 nh\u00f3m d\u1eef li\u1ec7u \u0111\u00e3 t\u1ed5ng h\u1ee3p theo c\u00e1c tr\u01b0\u1eddng ho\u1eb7c t\u1ea1o nhi\u1ec1u nh\u00f3m kh\u00e1c , ch\u1eb3ng h\u1ea1n nh\u01b0:<\/p>\n<ul>\n<li>C\u00e1c \u0111i\u1ec1u ki\u1ec7n xung quanh vi\u1ec7c gia t\u0103ng l\u1ed7i \u0111\u1ed1i v\u1edbi c\u00e1c tri\u1ec3n khai m\u1edbi<\/li>\n<li>T\u1ef7 l\u1ec7 \u0111\u0103ng nh\u1eadp th\u1ea5t b\u1ea1i cao theo t\u00ean ng\u01b0\u1eddi d\u00f9ng<\/li>\n<li>Kh\u1edfi \u0111\u1ed9ng c\u1ed5ng TCP m\u1edbi tr\u00ean c\u00e1c m\u00e1y ch\u1ee7 c\u00f3 k\u1ebft n\u1ed1i \u0111\u1ebfn c\u00e1c v\u1ecb tr\u00ed kh\u00f4ng x\u00e1c \u0111\u1ecbnh<\/li>\n<\/ul>\n<p>Vi\u1ec7c t\u1ea1o ra c\u00e1c c\u1ea3nh b\u00e1o b\u1ea3o m\u1eadt hi\u1ec7u qu\u1ea3 \u0111\u00f2i h\u1ecfi vi\u1ec7c thi\u1ebft l\u1eadp c\u00e1c quy t\u1eafc \u0111\u1ee7 ph\u1ee9c t\u1ea1p \u0111\u1ec3 c\u00f3 th\u1ec3 ph\u00e1t hi\u1ec7n nh\u01b0ng kh\u00f4ng qu\u00e1 ph\u1ee9c t\u1ea1p \u0111\u1ebfn m\u1ee9c ch\u00fang kh\u00f4ng bao gi\u1edd \u0111\u01b0\u1ee3c k\u00edch ho\u1ea1t.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Ensuring Data Works for Forensics<\/strong><\/p>\n<p>Security analysts are also investigators. Forensic analysis can be time-consuming because it requires examining historical data to understand what happened before, during, and after an event.<\/p>\n<p>In the aftermath of a phishing attack, you need to trace activities back to the original compromised user and device. Effective forensic analysis capabilities can help you shut down threats efficiently.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>\u0110\u1ea3m b\u1ea3o D\u1eef li\u1ec7u Ho\u1ea1t \u0111\u1ed9ng T\u1ed1t cho Ph\u00e2n t\u00edch \u0110i\u1ec1u tra<\/strong><\/p>\n<p>C\u00e1c nh\u00e0 ph\u00e2n t\u00edch b\u1ea3o m\u1eadt c\u0169ng l\u00e0 nh\u1eefng \u0111i\u1ec1u tra vi\u00ean. Ph\u00e2n t\u00edch \u0111i\u1ec1u tra c\u00f3 th\u1ec3 m\u1ea5t nhi\u1ec1u th\u1eddi gian v\u00ec n\u00f3 \u0111\u00f2i h\u1ecfi ph\u1ea3i ki\u1ec3m tra d\u1eef li\u1ec7u l\u1ecbch s\u1eed \u0111\u1ec3 hi\u1ec3u nh\u1eefng g\u00ec \u0111\u00e3 x\u1ea3y ra tr\u01b0\u1edbc, trong v\u00e0 sau m\u1ed9t s\u1ef1 ki\u1ec7n.<\/p>\n<p>Sau m\u1ed9t cu\u1ed9c t\u1ea5n c\u00f4ng l\u1eeba \u0111\u1ea3o, b\u1ea1n c\u1ea7n truy ng\u01b0\u1ee3c l\u1ea1i c\u00e1c ho\u1ea1t \u0111\u1ed9ng ban \u0111\u1ea7u c\u1ee7a ng\u01b0\u1eddi d\u00f9ng v\u00e0 thi\u1ebft b\u1ecb \u0111\u00e3 b\u1ecb x\u00e2m ph\u1ea1m. Kh\u1ea3 n\u0103ng ph\u00e2n t\u00edch \u0111i\u1ec1u tra hi\u1ec7u qu\u1ea3 c\u00f3 th\u1ec3 gi\u00fap b\u1ea1n lo\u1ea1i b\u1ecf c\u00e1c m\u1ed1i \u0111e d\u1ecda m\u1ed9t c\u00e1ch nhanh ch\u00f3ng.<\/p>\n<p>\u0110\u1ec3 h\u1ed7 tr\u1ee3 vi\u1ec7c n\u00e0y, h\u00e3y tri\u1ec3n khai c\u00e1c bi\u1ec7n ph\u00e1p qu\u1ea3n l\u00fd log t\u1eadp trung v\u00e0o an ninh m\u1ea1ng. B\u1ea1n c\u00f3 th\u1ec3 c\u00e2n nh\u1eafc:<\/p>\n<ul>\n<li>Thu th\u1eadp log t\u1eeb c\u00e1c thi\u1ebft b\u1ecb, ng\u01b0\u1eddi d\u00f9ng v\u00e0 \u1ee9ng d\u1ee5ng ph\u00f9 h\u1ee3p<\/li>\n<li>\u0110\u1ea3m b\u1ea3o t\u00ednh nh\u1ea5t qu\u00e1n gi\u1eefa d\u1eef li\u1ec7u v\u00e0 c\u00e1c \u0111\u1ecbnh d\u1ea1ng<\/li>\n<li>Thi\u1ebft l\u1eadp m\u1ed9t m\u1ed1c th\u1eddi gian nh\u1ea5t qu\u00e1n tr\u00ean t\u1ea5t c\u1ea3 c\u00e1c log<\/li>\n<\/ul>\n<p>V\u1edbi c\u00e1c bi\u1ec7n ph\u00e1p qu\u1ea3n l\u00fd log \u0111\u00fang \u0111\u1eafn, c\u00f4ng c\u1ee5 qu\u1ea3n l\u00fd log t\u1eadp trung c\u1ee7a b\u1ea1n c\u00f3 th\u1ec3 tr\u1edf th\u00e0nh m\u1ed9t c\u00f4ng c\u1ee5 ph\u00e2n t\u00edch an ninh m\u1ea1nh m\u1ebd.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>T\u1ef1 \u0111\u1ed9ng h\u00f3a c\u00e1c Quy tr\u00ecnh Th\u1ee7 c\u00f4ng<\/strong><\/p>\n<p>T\u1ef1 \u0111\u1ed9ng h\u00f3a c\u00f3 th\u1ec3 gi\u1ea3m \u0111\u00e1ng k\u1ec3 c\u00e1c ch\u1ec9 s\u1ed1 an ninh quan tr\u1ecdng c\u1ea7n ph\u1ea3i theo d\u00f5i, \u0111\u1eb7c bi\u1ec7t \u0111\u1ed1i v\u1edbi c\u00e1c nh\u00f3m nh\u1ecf. M\u1eb7c d\u00f9 &#8220;t\u1eadn d\u1ee5ng t\u1ef1 \u0111\u1ed9ng h\u00f3a&#8221; c\u00f3 th\u1ec3 nghe nh\u01b0 m\u1ed9t kh\u1ea9u hi\u1ec7u, nh\u01b0ng m\u1ed9t s\u1ed1 quy tr\u00ecnh t\u1ef1 \u0111\u1ed9ng h\u00f3a \u00edt t\u1ed1n c\u00f4ng s\u1ee9c th\u1ef1c s\u1ef1 mang l\u1ea1i gi\u00e1 tr\u1ecb cao gi\u00fap t\u0103ng c\u01b0\u1eddng kh\u1ea3 n\u0103ng ph\u00f2ng th\u1ee7 an ninh c\u1ee7a b\u1ea1n.<\/p>\n<p>T\u1ef1 \u0111\u1ed9ng h\u00f3a c\u00f3 th\u1ec3 ti\u1ebft ki\u1ec7m th\u1eddi gian v\u00e0 th\u1ef1c\u00a0 c\u00e1c bi\u1ec7n ph\u00e1p ch\u1ee7 \u0111\u1ed9ng \u0111\u1ec3 ng\u0103n ch\u1eb7n t\u1ed9i ph\u1ea1m m\u1ea1ng, d\u00f9 l\u00e0 \u0111\u1ec3 tu\u00e2n th\u1ee7 quy \u0111\u1ecbnh hay gi\u1ea3m thi\u1ec3u r\u1ee7i ro t\u1eeb c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng l\u1eeba \u0111\u1ea3o. T\u1ef1 \u0111\u1ed9ng h\u00f3a hi\u1ec7u qu\u1ea3 bao g\u1ed3m:<\/p>\n<ul>\n<li>L\u00ean l\u1ecbch b\u00e1o c\u00e1o<\/li>\n<li>Thi\u1ebft l\u1eadp c\u00e1c quy t\u1eafc \u0111a t\u1ea7ng \u0111\u1ec3 ch\u1eb7n t\u1ef1 \u0111\u1ed9ng<\/li>\n<li>Th\u1ef1c hi\u1ec7n c\u00e1c truy v\u1ea5n s\u0103n l\u00f9ng m\u1ed1i \u0111e d\u1ecda \u0111\u01b0\u1ee3c \u0111\u1ecbnh tr\u01b0\u1edbc m\u1ed9t c\u00e1ch th\u01b0\u1eddng xuy\u00ean<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p><strong>Graylog: Qu\u1ea3n l\u00fd Log T\u1eadp trung cho Nh\u1eadn th\u1ee9c T\u00ecnh hu\u1ed1ng<\/strong><\/p>\n<p>\u0110\u1ed1i v\u1edbi c\u00e1c nh\u00e0 ph\u00e2n t\u00edch an ninh, nh\u1eadn th\u1ee9c \u0111\u01b0\u1ee3c hi\u1ec3u l\u00e0 nh\u1eadn th\u1ee9c t\u00ecnh h\u00ecnh (Situation Awareness). Vi\u1ec7c hi\u1ec3u r\u00f5 c\u00e1c r\u1ee7i ro c\u1ee5 th\u1ec3 \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn t\u1ed5 ch\u1ee9c c\u1ee7a b\u1ea1n th\u01b0\u1eddng \u0111\u00f2i h\u1ecfi s\u1ef1 h\u1ee3p nh\u1ea5t c\u1ee7a c\u00e1c d\u1eef li\u1ec7u \u0111a d\u1ea1ng \u0111\u1ec3 c\u00f3 \u0111\u01b0\u1ee3c c\u00e1i nh\u00ecn t\u1ed5ng th\u1ec3.<\/p>\n<p>Gi\u1ea3i ph\u00e1p qu\u1ea3n l\u00fd log t\u1eadp trung c\u1ee7a Graylog cho ph\u00e9p b\u1ea1n thu th\u1eadp, t\u1ed5ng h\u1ee3p v\u00e0 li\u00ean k\u1ebft d\u1eef li\u1ec7u log trong m\u00f4i tr\u01b0\u1eddng ph\u1ee9c t\u1ea1p c\u1ee7a b\u1ea1n. Giao di\u1ec7n tr\u1ef1c quan c\u1ee7a ch\u00fang t\u00f4i gi\u00fap ng\u01b0\u1eddi d\u00f9ng \u1edf m\u1ecdi tr\u00ecnh \u0111\u1ed9 k\u1ef9 n\u0103ng c\u00f3 th\u1ec3 b\u1ea3o v\u1ec7 d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m m\u1ed9t c\u00e1ch ch\u1ee7 \u0111\u1ed9ng. V\u1edbi kh\u1ea3 n\u0103ng ph\u00e2n t\u00edch an ninh c\u1ee7a Graylog, b\u1ea1n c\u00f3 \u0111\u01b0\u1ee3c nh\u1eadn th\u1ee9c t\u00ecnh hu\u1ed1ng c\u1ea7n thi\u1ebft, v\u00e0 c\u00e1c b\u1ea3ng \u0111i\u1ec1u khi\u1ec3n c\u1ee7a ch\u00fang t\u00f4i cung c\u1ea5p nh\u1eefng c\u00e1i nh\u00ecn nhanh ch\u00f3ng \u0111\u1ec3 gi\u00e1m s\u00e1t v\u00e0 gi\u1ea3m thi\u1ec3u r\u1ee7i ro m\u1ed9t c\u00e1ch ch\u1ee7 \u0111\u1ed9ng.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>V\u1ec1 DT Asia<\/strong><\/p>\n<p>DT Asia \u0111\u01b0\u1ee3c th\u00e0nh l\u1eadp n\u0103m 2007 v\u1edbi s\u1ee9 m\u1ec7nh \u0111\u01b0a c\u00e1c gi\u1ea3i ph\u00e1p b\u1ea3o m\u1eadt CNTT ti\u00ean phong kh\u00e1c nhau t\u1eeb Hoa K\u1ef3, Ch\u00e2u \u00c2u v\u00e0 Israel gia nh\u1eadp th\u1ecb tr\u01b0\u1eddng.<\/p>\n<p>Hi\u1ec7n t\u1ea1i, DT Asia \u0111\u00e3 l\u00e0 m\u1ed9t nh\u00e0 ph\u00e2n ph\u1ed1i gi\u00e1 tr\u1ecb gia t\u0103ng trong khu v\u1ef1c \u0111\u1ed1i v\u1edbi c\u00e1c gi\u1ea3i ph\u00e1p an ninh m\u1ea1ng, cung c\u1ea5p c\u00f4ng ngh\u1ec7 ti\u00ean ti\u1ebfn cho c\u00e1c t\u1ed5 ch\u1ee9c ch\u00ednh ph\u1ee7 tr\u1ecdng y\u1ebfu c\u0169ng nh\u01b0 c\u00e1c kh\u00e1ch h\u00e0ng t\u01b0 nh\u00e2n l\u1edbn bao g\u1ed3m c\u00e1c ng\u00e2n h\u00e0ng to\u00e0n c\u1ea7u v\u00e0 c\u00e1c c\u00f4ng ty trong danh s\u00e1ch Fortune 500. V\u1edbi c\u00e1c v\u0103n ph\u00f2ng v\u00e0 \u0111\u1ed1i t\u00e1c r\u1ed9ng kh\u1eafp trong khu v\u1ef1c Ch\u00e2u \u00c1 Th\u00e1i B\u00ecnh D\u01b0\u01a1ng, ch\u00fang t\u00f4i hi\u1ec3u r\u00f5 h\u01a1n v\u1ec1 th\u1ecb tr\u01b0\u1eddng v\u00e0 t\u1eeb \u0111\u00f3 mang \u0111\u1ebfn nh\u1eefng gi\u1ea3i ph\u00e1p b\u1ea3n \u0111\u1ecba h\u00f3a ph\u00f9 h\u1ee3p v\u1edbi t\u1eebng qu\u1ed1c gia, t\u1eebng t\u1ed5 ch\u1ee9c.<\/p>\n<p>&nbsp;<\/p>\n<p><strong>C\u00e1ch ch\u00fang t\u00f4i c\u00f3 th\u1ec3 gi\u00fap b\u1ea1n<\/strong><\/p>\n<p>N\u1ebfu b\u1ea1n mu\u1ed1n bi\u1ebft th\u00eam v\u1ec1 &#8220;Security Awareness and Log Management for Security Analysts&#8221;, b\u1ea1n \u0111ang \u1edf \u0111\u00fang n\u01a1i, ch\u00fang t\u00f4i s\u1eb5n s\u00e0ng gi\u00fap \u0111\u1ee1! DTA l\u00e0 nh\u00e0 ph\u00e2n ph\u1ed1i c\u1ee7a Graylog, \u0111\u1eb7c bi\u1ec7t t\u1ea1i Vi\u1ec7t Nam v\u00e0 ch\u00e2u \u00c1, c\u00e1c k\u1ef9 thu\u1eadt vi\u00ean c\u1ee7a ch\u00fang t\u00f4i c\u00f3 kinh nghi\u1ec7m s\u00e2u r\u1ed9ng v\u1ec1 s\u1ea3n ph\u1ea9m v\u00e0 c\u00e1c c\u00f4ng ngh\u1ec7 li\u00ean quan m\u00e0 b\u1ea1n lu\u00f4n c\u00f3 th\u1ec3 tin t\u01b0\u1edfng. Ch\u00fang t\u00f4i cung c\u1ea5p c\u00e1c gi\u1ea3i ph\u00e1p tr\u1ecdn g\u00f3i cho s\u1ea3n ph\u1ea9m n\u00e0y, bao g\u1ed3m t\u01b0 v\u1ea5n, tri\u1ec3n khai v\u00e0 d\u1ecbch v\u1ee5 b\u1ea3o tr\u00ec.<\/p>\n<p>Nh\u1ea5n v\u00e0o \u0111\u00e2y \u0111\u1ec3 bi\u1ebft th\u00eam th\u00f4ng tin chi ti\u1ebft: <a href=\"https:\/\/dtasiagroup.com\/graylog\/\">https:\/\/dtasiagroup.com\/graylog\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Trong m\u00f4i tr\u01b0\u1eddng l\u00e0m vi\u1ec7c t\u1eeb xa ng\u00e0y nay, c\u00e1c chuy\u00ean gia an ninh c\u1ea7n \u0111\u01b0\u1ee3c \u0111\u00e0o t\u1ea1o ki\u1ebfn th\u1ee9c chuy\u00ean s\u00e2u v\u1ec1 an ninh b\u1ea3o m\u1eadt, v\u01b0\u1ee3t xa c\u00e1c ch\u01b0\u01a1ng tr\u00ecnh \u0111\u00e0o t\u1ea1o ti\u00eau chu\u1ea9n v\u1ec1 vi\u1ec7c &#8220;kh\u00f4ng nh\u1ea5p v\u00e0o li\u00ean k\u1ebft l\u1eeba \u0111\u1ea3o&#8221;\u00a0 cho ph\u1ea7n c\u00f2n l\u1ea1i c\u1ee7a c\u00f4ng ty. M\u1eb7c d\u00f9 c\u00e1c nh\u00e0 ph\u00e2n t\u00edch b\u1ea3o\u00a0 r\u1ea5t gi\u1ecfi trong vi\u1ec7c nh\u1eadn di\u1ec7n email l\u1eeba \u0111\u1ea3o v\u00e0 thi\u1ebft l\u1eadp m\u1eadt kh\u1ea9u an to\u00e0n, nh\u01b0ng nh\u1eadn th\u1ee9c v\u1ec1 an ninh m\u1ea1ng c\u1ea7n ph\u1ea3i \u0111\u01b0\u1ee3c m\u1edf r\u1ed9ng \u0111\u1ec3 t\u1ed1i \u01b0u h\u00f3a chi\u1ebfn l\u01b0\u1ee3c qu\u1ea3n l\u00fd log, nh\u1eb1m b\u1eaft k\u1ecbp c\u00e1c m\u1ed1i \u0111e d\u1ecda ng\u00e0y c\u00e0ng ph\u00e1t tri\u1ec3n v\u00e0 tinh vi.<\/p>\n","protected":false},"author":11,"featured_media":14056,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[79,66],"tags":[],"class_list":["post-14082","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bai-viet","category-news-vi"],"_links":{"self":[{"href":"https:\/\/dtasiagroup.com\/vi\/wp-json\/wp\/v2\/posts\/14082","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dtasiagroup.com\/vi\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dtasiagroup.com\/vi\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dtasiagroup.com\/vi\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/dtasiagroup.com\/vi\/wp-json\/wp\/v2\/comments?post=14082"}],"version-history":[{"count":0,"href":"https:\/\/dtasiagroup.com\/vi\/wp-json\/wp\/v2\/posts\/14082\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dtasiagroup.com\/vi\/wp-json\/wp\/v2\/media\/14056"}],"wp:attachment":[{"href":"https:\/\/dtasiagroup.com\/vi\/wp-json\/wp\/v2\/media?parent=14082"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dtasiagroup.com\/vi\/wp-json\/wp\/v2\/categories?post=14082"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dtasiagroup.com\/vi\/wp-json\/wp\/v2\/tags?post=14082"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}