{"id":83855,"date":"2022-04-20T19:55:53","date_gmt":"2022-04-20T16:55:53","guid":{"rendered":"http:\/\/hilmibilici.com\/?p=83855"},"modified":"2024-11-29T14:50:41","modified_gmt":"2024-11-29T11:50:41","slug":"kurumsal-guvenlik-ortaminda-dns-analizinin-onemi","status":"publish","type":"post","link":"http:\/\/hilmibilici.com\/?p=83855","title":{"rendered":"Kurumsal G\u00fcvenlik Ortam\u0131nda DNS Analizinin \u00f6nemi"},"content":{"rendered":"<div class=\"display:none\" style=\"display: none;\">\n<\/div>\n<div class=\"display:none\" style=\"display: none;\">\n<\/div>\n<div class=\"display:none\" style=\"display: none;\">\n<\/div>\n<p><strong>Kurumsal G\u00fcvenlik Ortam\u0131nda DNS Analizinin \u00f6nemi<\/strong><\/p>\n<p>Kurumsal g\u00fcvenlik d\u00fcnyas\u0131 2020 y\u0131l\u0131ndan sonra pandeminin de etkisi ile sonsuza dek de\u011fi\u015fti. Uzaktan \u00e7al\u0131\u015fma, bulut, IoT kavramlar\u0131 neredeyse t\u00fcm i\u015fletmenlerin g\u00fcvenlik yap\u0131lar\u0131n\u0131 d\u00f6n\u00fc\u015ft\u00fcrd\u00fc. CISO\u2019lar\u0131n (siber g\u00fcvenlik uzmanlar\u0131) g\u00f6revi \u015firketi tehdit edebilecek\u00a0siber sald\u0131r\u0131\u00a0riskini en aza indirmektir. Fakat al\u0131\u015f\u0131k olduklar\u0131 ve e\u011fitildikleri alanlar\u0131n de\u011fi\u015fmesi ve Bulut, IoT gibi kavramlar\u0131n art\u0131\u015f\u0131 ile birlikte tamamen farkl\u0131 ortamlarla u\u011fra\u015fmak zorunda kald\u0131lar. Bu de\u011fi\u015fiklikler, uzun s\u00fcredir kullan\u0131lan bir\u00e7ok g\u00fcvenlik arac\u0131n\u0131n (Firewall, proxy, VPN&#8217;ler ve SIEM&#8217;ler gibi) \u00e7ok daha az etkili oldu\u011fu ve g\u00fcvenlik y\u00f6neticilerinin yenilerini bulmas\u0131 gerekti\u011fi anlam\u0131na geliyordu.<\/p>\n<p>Herhangi bir kurumsal a\u011fda, boyutu ne olursa olsun, yaz\u0131c\u0131lar, diskler, zaman hizmetleri, yetkilendirme ve do\u011frulama hizmetleri, yaz\u0131l\u0131m havuzlar\u0131 vb. gibi payla\u015f\u0131lan kaynaklar\u0131 tahsis etmek gerekir. Windows ailesinin i\u015fletim sistemlerinde bu ama\u00e7lar i\u00e7in Sunucu \u0130leti Blo\u011fu (SMB) protokolleri ve Ortak \u0130nternet Dosya Sistemi (CIFS) kullan\u0131lmaktad\u0131r. Bu protokoller, 1980&#8217;lerin ortalar\u0131nda yerel a\u011flar \u00fczerinde \u00e7al\u0131\u015fmak \u00fczere IBM ve Microsoft taraf\u0131ndan geli\u015ftirilen NetBIOS ve NetBEUI protokollerinin evrimidir.<\/p>\n<p><strong>Neden DNS G\u00fcvenli\u011fi?<\/strong><\/p>\n<p>DNS, internetin \u00f6nemli bir bile\u015feni oldu\u011fundan, her zaman sald\u0131rganlar\u0131n hedefi olacakt\u0131r. Gelecekte ortaya \u00e7\u0131kabilecek bu sald\u0131r\u0131lara kar\u015f\u0131 korunman\u0131n en iyi yolu sald\u0131r\u0131larda kullan\u0131lan teknikleri bilmek ve potansiyel girdi noktalar\u0131n\u0131 \u00f6nceden tespit edebilmekten (threat hunting) ge\u00e7er.<\/p>\n<p>Kurumsal Siber G\u00fcvenlik Y\u00f6neticilerinin mevcut kaynaklar\u0131 yetersiz kulland\u0131\u011f\u0131 bir alan da DNS izlemedir.\u00a0\u015eirketlerin h\u00e2lihaz\u0131rda kulland\u0131\u011f\u0131 DNS loglar\u0131ndan faydalan\u0131larak, hemen hemen her kullan\u0131c\u0131 ve makine etkile\u015fimi izlenebilir, analiz edilebilir ve gerekti\u011finde sald\u0131r\u0131lara kar\u015f\u0131 \u00f6nceden engellenebilir.<\/p>\n<p>DNS, veri ak\u0131\u015f\u0131n\u0131n \u015firket i\u00e7i, ayg\u0131tlara, buluta, bir siteye veya farkl\u0131 uzak siteler aras\u0131nda y\u00f6nlendirilip y\u00f6nlendirilmedi\u011fine bakmaz.\u00a0K\u0131sacas\u0131, DNS izleme, bir\u00e7ok CISO&#8217;nun fark etti\u011finden \u00e7ok daha iyi bir g\u00fcvenlik sa\u011flayabilir.<\/p>\n<p><strong>Bir sald\u0131rgan, kurulu\u015fun DNS&#8217;inin kontrol\u00fcn\u00fc ele ge\u00e7irirse, \u015funlar\u0131 kolayca yapabilir:<\/strong><\/p>\n<ol>\n<li>A\u00e7\u0131k kaynaklar \u00fczerinde kontrol elde etme,<\/li>\n<li>Gelen e-postalar\u0131, web isteklerini ve kimlik do\u011frulama giri\u015fimlerini yeniden y\u00f6nlendirme,<\/li>\n<li>SSL\/TLS sertifikalar\u0131 olu\u015fturma ve do\u011frulama.<\/li>\n<\/ol>\n<p><strong>DNS g\u00fcvenli\u011fine iki a\u00e7\u0131dan bak\u0131l\u0131r:<\/strong><\/p>\n<ul>\n<li>DNS&#8217;nin s\u00fcrekli izlenmesi ve kontrol\u00fc,<\/li>\n<li><a href=\"https:\/\/tr.wikipedia.org\/wiki\/DNSSEC\" target=\"_blank\" rel=\"noopener\">DNSSEC<\/a>, DOH ve DoT gibi yeni DNS protokolleri, iletilen DNS sorgular\u0131n\u0131n b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc ve gizlili\u011fini korumaya nas\u0131l yard\u0131mc\u0131 olabilir?<\/li>\n<\/ul>\n<p>Baz\u0131 kurulu\u015flar, kendilerini farkl\u0131 kaynaklardan birden fazla DNS kullan\u0131rken bulurlar. Bu agresif bir \u015fekilde kullan\u0131lan DNS&#8217;nin sa\u011flayabilece\u011fi merkezi g\u00fcvenli\u011fin alt\u0131n\u0131 bo\u015falt\u0131r.\u00a0Oysaki \u015firketler, kimin neye, ne zaman ve nas\u0131l eri\u015fti\u011fine ili\u015fkin ku\u015f bak\u0131\u015f\u0131 g\u00f6r\u00fc\u015fe ihtiya\u00e7 duyar.<\/p>\n<p><strong>Tehdit \u00f6nleme ve g\u00fcvenlik operasyonlar\u0131 i\u00e7in DNS, DHCP ve IPAM&#8217;den yararlanarak daha iyi kurumsal bir g\u00fcvenlik sa\u011flaman\u0131n\u00a0yolu nedir?<\/strong><\/p>\n<p>\u0130\u015fletmelerin, ortalama Internet trafi\u011fi belirli olmas\u0131na ra\u011fmen bazen bir makineden \u00e7ok fazla sorgunun yap\u0131ld\u0131\u011f\u0131 g\u00f6r\u00fcl\u00fcr. Bu yeni veri ak\u0131\u015f\u0131 ba\u011flant\u0131lar\u0131n\u0131n \u00e7o\u011fu ba\u015flang\u0131\u00e7ta tan\u0131nmayacakt\u0131r.\u00a0Bu nedenle sald\u0131rganlar, kurumsal CISO&#8217;lar savunma stratejilerini yeni ortamlar\u0131na uyacak \u015fekilde g\u00fcncellemeden \u00f6nce yapabildikleri kadar \u00e7ok sald\u0131r\u0131y\u0131 s\u0131k\u0131\u015ft\u0131rarak bir saha g\u00fcn\u00fc ge\u00e7iriyorlar.\u00a0DNS, DHCP ve IPAM analizinin b\u00fcy\u00fck bir fark yaratabilece\u011fi yer buras\u0131d\u0131r.<\/p>\n<p>K\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlar\u0131n yakla\u015f\u0131k y\u00fczde 91&#8217;i bir kontrol d\u00fczlemi olarak DNS&#8217;e g\u00fcveniyor.\u00a0Di\u011fer sald\u0131r\u0131lar\u0131n, \u00f6zellikle fidye yaz\u0131l\u0131mlar\u0131n\u0131n ba\u015flang\u0131c\u0131 olan kimlik av\u0131 sald\u0131r\u0131lar\u0131, e-posta veya metin ile ba\u015flayabilir, ancak <strong>DNS<\/strong> ile kar\u015f\u0131la\u015fmadan \u00f6nce fazla zarar veremez.\u00a0D-DOS sald\u0131r\u0131lar\u0131 bile DNS ile ba\u015flar ve DNS, makine \u00f6\u011frenimi ve di\u011fer yapay zeka bi\u00e7imlerinden yararlanan anormallik tabanl\u0131 (s\u0131f\u0131r g\u00fcn) tehdit alg\u0131lamas\u0131 i\u00e7in ideal veri kayna\u011f\u0131d\u0131r. D\u00fczg\u00fcn y\u00f6netilen ve izlenilen bir <strong>DNS<\/strong>, k\u00fcresel tehditlere kar\u015f\u0131, g\u00fcvenlik savunmas\u0131n\u0131 \u00fcst d\u00fczeye \u00e7\u0131kar\u0131r.<\/p>\n<p><a href=\"https:\/\/tr.wikipedia.org\/wiki\/DHCP\" target=\"_blank\" rel=\"noopener\">DHCP<\/a> verileri olmadan, \u00f6zellikle dinamik ortamlarda incelenen ayn\u0131 cihazla ilgili farkl\u0131 olaylar\u0131 ili\u015fkilendirmek zordur.\u00a0DNS ve DHCP olmadan operasyon ekipleri, g\u00fcvenli\u011fi ihlal edilmi\u015f makineleri do\u011fru bir \u015fekilde belirlemekte zorlan\u0131r ve kullan\u0131c\u0131n\u0131n hangi kaynaklara eri\u015fti\u011fi konusunda s\u0131n\u0131rl\u0131 bir g\u00f6r\u00fcn\u00fcrl\u00fc\u011fe sahip olur.<\/p>\n<p>DNS&#8217;i kullanmak ve tehdit istihbarat\u0131 savunmalar\u0131ndan a\u00e7\u0131k\u00e7a ka\u00e7\u0131nmak i\u00e7in \u00f6zel olarak yaz\u0131lm\u0131\u015f bir\u00e7ok sald\u0131r\u0131 t\u00fcr\u00fc vard\u0131r.\u00a0Bu sald\u0131r\u0131lar ancak DNS verilerini derinlemesine analiz ederek engellenebilir.\u00a0Artan bulut ve sitelerden sonra, g\u00fcvenlik ortam\u0131ndaki en b\u00fcy\u00fck de\u011fi\u015fiklik IoT sistemlerine yap\u0131lan sald\u0131r\u0131lar\u0131d\u0131r.\u00a0DNS, IP ba\u011flant\u0131l\u0131 IoT i\u00e7in ortak bir paydad\u0131r. Bu, DNS etkinli\u011fine dayal\u0131 profil olu\u015fturman\u0131n, IoT kaynakl\u0131 g\u00fcvenlik ihlali giri\u015fimlerinin erken uyar\u0131lar\u0131n\u0131 sa\u011flayabilece\u011fi anlam\u0131na gelir.<\/p>\n<p><strong>Sonu\u00e7<\/strong><\/p>\n<p><strong>DNS\u00a0g\u00fcvenli\u011fi<\/strong>, g\u00fcvenlik plan\u0131n\u0131n ayr\u0131lmaz bir par\u00e7as\u0131 olmal\u0131d\u0131r. G\u00fcvenli DNS sunucu hizmetleri, g\u00fcvenli olmayan, k\u00f6t\u00fc niyetli ve istenmeyen web sitelerini filtreleyerek ve engelleyerek web korumas\u0131 ve ebeveyn kontrol\u00fc sa\u011flar.<\/p>\n<p><a href=\"https:\/\/www.dnssense.com\/secure-dns\" target=\"_blank\" rel=\"noopener\">DNSSense Secure DNS<\/a>, kullan\u0131c\u0131lar\u0131n DNS trafi\u011fini analiz ederek web g\u00fcvenli\u011fi ve uygulama kontrol\u00fc sa\u011flayan etkili\/geli\u015fmi\u015f Bulut Tabanl\u0131 bir Siber G\u00fcvenlik Hizmetidir. Geli\u015fmi\u015f ve esnek raporlama \u00f6zelli\u011fi sayesinde a\u011f y\u00f6neticilerine gerekli aksiyonlar\u0131 alabilmeleri i\u00e7in anlaml\u0131 bilgiler sunarak ger\u00e7ek DNS koruma katman\u0131n\u0131 sa\u011flar.<\/p>\n<p>Yine <a href=\"https:\/\/www.dnssense.com\">DNSSense<\/a> <strong>DNS Visibility<\/strong> \u00e7\u00f6z\u00fcm\u00fc ile kurum DNS sunucu loglar\u0131 incelenir ve \u0130stihbarat Servisi filtresinden ge\u00e7irilerek zararl\u0131 olabilecek trafik kontrol alt\u0131na al\u0131nm\u0131\u015f olur.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>DNS\u00a0g\u00fcvenli\u011fi, g\u00fcvenlik plan\u0131n\u0131n ayr\u0131lmaz bir par\u00e7as\u0131 olmal\u0131d\u0131r. G\u00fcvenli DNS sunucu hizmetleri, g\u00fcvenli olmayan, k\u00f6t\u00fc niyetli ve istenmeyen web sitelerini filtreleyerek ve engelleyerek web korumas\u0131 ve ebeveyn kontrol\u00fc sa\u011flar.<\/p>\n","protected":false},"author":1,"featured_media":85024,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[37],"tags":[150,158,159,160,161,162,163,165,168,390],"class_list":["post-83855","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-bilisim-hukuku","tag-dhcp","tag-dns","tag-dns-guvenligi","tag-dns-security","tag-dns-trafigi","tag-dns-visibility","tag-dnssec","tag-doh","tag-dot","tag-secure-dns"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"http:\/\/hilmibilici.com\/index.php?rest_route=\/wp\/v2\/posts\/83855","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/hilmibilici.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/hilmibilici.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/hilmibilici.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/hilmibilici.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=83855"}],"version-history":[{"count":1,"href":"http:\/\/hilmibilici.com\/index.php?rest_route=\/wp\/v2\/posts\/83855\/revisions"}],"predecessor-version":[{"id":85025,"href":"http:\/\/hilmibilici.com\/index.php?rest_route=\/wp\/v2\/posts\/83855\/revisions\/85025"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/hilmibilici.com\/index.php?rest_route=\/wp\/v2\/media\/85024"}],"wp:attachment":[{"href":"http:\/\/hilmibilici.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=83855"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/hilmibilici.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=83855"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/hilmibilici.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=83855"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}