Ukuqinisa i-Windows 11 nge-SecPol kanye ne-GPO: Umhlahlandlela Ophelele

Uma uqala ukuhlola izimfihlo zokuphepha ze-Windows 11 , nakanjani ufinyelela iphuzu elifanayo: amakhompyutha abasebenzisi ayisixhumanisi esibuthakathaka. Uhlelo lwe-Windows 11 olusanda kufakwa, ngaphandle kokucushwa okufanele kokuphepha, luyisisulu esilula se- malware , i-ransomware, kanye nabahlaseli abahamba eceleni kunethiwekhi.

Izindaba ezinhle ukuthi i-Windows 11 iletha izici eziningi zokuqinisa , eziningi zazo ezingalawulwa nge-SecPol (Local Security Policy) kanye ne-Group Policy Objects (GPOs). Inselele isekwazini ukuthi yini okufanele uyishintshe, ukuthi ungayihlanganisa kanjani nesisekelo sokuphepha se-Microsoft, nokuthi ungayiqedi kanjani ingxenye yebhizinisi lakho kule nqubo. Lapha uzothola umhlahlandlela ophelele wokuqinisa i-Windows 10, ikakhulukazi i- Windows 11 ene-SecPol, ama-GPO, i-Defender, kanye namathuluzi asemthethweni njenge-Security Compliance Toolkit.

Kuyini ukuqina kwe-Windows 11 futhi kungani kufanele ukwenze manje?

Uma sikhuluma ngokuqinisa i-Windows 11, sisho ukunciphisa indawo yokuhlasela yesistimu: ukukhubaza izingxenye ezingadingekile, ukumisa ngokuphephile kuphela okudingekayo, nokuqinisa iziqinisekiso, inethiwekhi, izinhlelo zokusebenza, kanye nezinqubo zokuqalisa. Konke lokhu kwenziwa kusetshenziswa i-SecPol.msc, Gpedit.msc, GPMC, kanye namathuluzi afana ne-RSAT, Intune, noma i-Configuration Manager.

Izindawo zokusebenza ze-Windows 10 kanye ne-11 ziyizisulu ezithandwa kakhulu ngabahlaseli ngoba yilapho abasebenzisi bephequlula khona iwebhu, bavule ama-imeyili, baxhuma amadrayivu e-USB, bafake isofthiwe, futhi basebenzise ama-macro. Ukuqinisa okuphumelelayo kunciphisa kakhulu amathuba okuxhashazwa, kodwa kudinga ukuhlela, ukuhlola, kanye nenqubomgomo ecacile yokuthi yini evunyelwe nengavunyelwe.

Ukuvula nje i-antivirus yakho akwanele. Indlela eqinile yokuqinisa ihlanganisa ukulawulwa kohlelo lokusebenza, ukunciphisa ubuso bokuhlasela (i-ASR), ukuvikelwa kweziqinisekiso, ukubethela, ama-firewall, ukuloba, ukuqinisekiswa okuqinile , kanye nesu lokubuyekeza umsindo. Futhi, okubaluleke kakhulu, konke lokhu kumele kuphathwe phakathi ngokusebenzisa ama-GPO esizinda noma izinqubomgomo ze-MDM , hhayi ngesandla ngokuchofoza ku-PC ngayinye.

Ngaphandle kwezici zobuchwepheshe, kukhona isici sokucabanga: i-Windows "esebenzayo" akuyona ngempela i-Windows "ephephile". Izici eziningi ezinikwe amandla ngokuzenzakalelayo zenza impilo ibe lula kumsebenzisi kodwa nakumhlaseli , ngakho-ke ukuqinisa kumayelana nokuthola ibhalansi efanele yendawo yakho.

I-SecPol, i-Gpedit kanye ne-GPMC: isango lokuqina

Isinyathelo sokuqala sokuqinisa i-Windows 11 sihilela ukuqonda kahle amathuluzi ayo endabuko: i-SecPol.msc (Inqubomgomo Yokuphepha Yasendaweni), i-Gpedit.msc (Umhleli Wenqubomgomo Yeqembu), kanye ne-GPMC (Ikhonsoli Yokuphathwa Kwenqubomgomo Yeqembu) . Lawa mathuluzi akuvumela ukuthi ulawule cishe zonke izici zokuphepha kwesistimu.

Kumakhompyutha ahlanganiswe nesizinda, ukuphathwa okusebenzayo kwenziwa nge-Group Policy Management Console (GPMC) kusuka kuseva noma iklayenti eline-RSAT efakiwe . Ukuze uyivule, mane nje uye ku-Qala, sesha "Ukuphathwa Kwenqubomgomo Yeqembu," bese uqalisa i-console. Ukusuka lapho, ungakha Izinto Zenqubomgomo Yeqembu (ama-GPO), uzixhumanise namasayithi, izizinda, noma amayunithi enhlangano (ama-OU), bese ulawula ukuhlela nokuxhumanisa izimvume.

Ezingeni lendawo, i-Gpedit.msc kanye ne-SecPol.msc zingabalingani bakho bokuhlola noma amakhompyutha angahlanganiswanga nesizinda. Finyelela kuzo ngokuthayipha i-gpedit.msc noma i-secpol.msc ebhokisini lokusesha noma ku-Run. Uma uhlangabezana namaphutha emvume noma imiyalezo yokuthi uhlelo alukwazi ukuvulwa, hlola ubulungu beqembu lakho lomlawuli futhi, kwezinye izimo, lungisa ifolda ye-C:\Windows\System32\GroupPolicy (isibonelo, ngokuqamba kabusha i-Machine ibe yi-Machine.old bese uvuselela ukucushwa).

Qaphela ukuthi ukuze usebenzise i-GPMC udinga ukuba nesici se- Group Policy Management (RSAT) esifakiwe kanye nezimvume ezifanele kuma-GPO nama-OU. Ngokuzenzakalelayo, yi-Domain kanye ne-Enterprise Admins kuphela abangadala futhi baxhumanise ama-GPO, yize ukulawula kungadluliselwa emaqenjini athile.

Ukudala i-GPO eyisisekelo yokuqinisa i-Windows 11 kusetshenziswa i-PowerShell

Indlela ephumelela kakhulu yokusebenzisa ukuqina ngobuningi ukuhlanganisa i-GPO ne-PowerShell . Kusukela kumojuli ye-GroupPolicy, ungakha futhi ugcwalise izinqubomgomo ngaphandle kokusebenzisa igundane, okukuvumela ukuthi uguqule izikripthi, uphindaphinde izindawo, futhi wenze izinqubo ngokuzenzakalela.

Okokuqala, faka i-RSAT kusuka kuzilungiselelo > Izinhlelo zokusebenza > Izici ozikhethela zona > Engeza isici , usesha i-“RSAT: Amathuluzi Okuphatha Inqubomgomo Yeqembu”. Bese ungenisa imodyuli kuseshini ye-PowerShell enamalungelo okuphatha.

Indlela ejwayelekile yokusebenza kwe-GPO eqinile ingaba yile:

• Dala i-GPO eyisisekelo, isibonelo “Ukuqinisa-W11”, ezinikele kuphela kwezokuphepha.
• Usar I-Set-GPRegistryValue ukubhala okhiye ababalulekile: ukukhiya kwe-USB, izinqubomgomo ze-PowerShell, ama-Office macros, I-CMD, I-AutoRun, i-Edge, i-RDP, i-SMB, njll.
• Xhuma i-GPO ne-OU equkethe amakhompyutha aqondiwe bese uphoqa uhlelo lwayo lokusebenza nge I-New-GPLink - Iphoqelelwe Yebo.

Ngale ndlela, isibonelo, ungakhubaza isitoreji se -USB ngokushintsha inani lokuqala lesevisi ye-USBSTOR libe ngu-4, udinge i-PowerShell ukuthi isebenzise izikripthi ezisayiniwe kuphela (ExecutionPolicy=AllSigned), uvimbele ama-macro angathembekile ku-Office (VBAWarnings), uvimbele ukusetshenziswa kwe-CMD (DisableCMD), noma ukhubaze i-SMBv1 ukuze ususe inqwaba yobuthakathaka befa.

Isihluthulelo ukuthi ushintsho ngalunye lubhalwe phansi futhi luhlolwe endaweni yelebhu noma i-OU yokuhlola ngaphambi kokuba luthunyelwe kuyo yonke inhlangano, ngoba ezinye izinqubomgomo zingaphula imisebenzi noma izinhlelo zokusebenza ezindala.

I-Microsoft Security Compliance Toolkit kanye ne-Security Baselines

Esikhundleni sokuvuselela isondo, kunengqondo kakhulu ukusebenzisa izisekelo zokuphepha ezisemthethweni ze-Microsoft . Konke lokhu kusatshalaliswa ngaphakathi kwe -Security Compliance Toolkit (SCT) , iphakheji equkethe ama-GPO alungiselelwe kusengaphambili, amathuluzi okuhlaziya, kanye nemibhalo.

I-SCT ifaka phakathi izisekelo ze- Windows 11 (21H2, 22H2, 23H2, 24H2), i-Windows 10, i-Windows Server 2016/2019/2022/2025, i-Microsoft 365 Apps , kanye ne-Edge . Ifaka phakathi nezinsiza ezifana nalezi:

Kuhlanganisa nezinsiza ezifana nalezi:

• Umhlaziyi Wenqubomgomo: iqhathanisa ama-GPO omunye nomunye noma ngokumelene nokucushwa kwangempela kwekhompyutha, ithola ukungasebenzi kahle, izingxabano kanye nokuphambuka.
• LGPO.exe: Isebenzisa izinqubomgomo zendawo ezivela kumafayela e-Registry.pol, amathempulethi okuphepha, noma ama-backups e-GPO, afaneleka kakhulu kumakhompyutha angewona awesizinda.
• SetObjectSecurity.exe: ilungisa izincazelo zokuphepha kumafayela, okhiye bokubhalisa, izinsizakalo, amasheya e-SMB, njll.
• I-GPO2PolicyRules: iguqula ama-backup e-GPO abe amafayela e-.PolicyRules angahlaziywa nge-Policy Analyzer ngaphandle kokudlula ku-GUI.

Izisekelo zilandela izimiso ezicacile: zenzelwe izinhlangano eziphethwe kahle lapho abasebenzisi abajwayelekile bengenawo amalungelo okuphatha , kuphela ukucushwa okunciphisa izinsongo zamanje okushintshwayo, futhi inhloso ukugwema ukwephula okungaphezu kwalokho abakulungisayo. Isibonelo, inketho ayisebenzi uma ingozi eyinciphisayo iphansi futhi umthelela wokusebenza uphezulu.

Lezi zisekelo ziyatholakala kwi- Windows Pro, Enterprise, Education kanye ne-Pro Education/SE , futhi zingasetshenziswa kusetshenziswa izinqubomgomo ze-GPO zendabuko kanye ne-MDM (i-Intune ifaka amathempulethi athile ezisekelo zokuphepha ze-Windows 10/11).

Ukuvikelwa kweziqinisekiso kanye nokuqina kwe-LSASS

Esinye sezingxenye ezibaluleke kakhulu ze-Windows yi -LSASS (Local Security Authority Subsystem Service) , inqubo egcina iziqinisekiso kwimemori ukuze umsebenzisi angadingi ukuqinisekisa njalo. Uma umhlaseli ekwazi ukulahla i-LSASS, angase antshontshe ama-password hashes, amathikithi e-Kerberos, noma ngisho namaphasiwedi acacile uma i-WDigest isebenza.

Ukuze unciphise le ngozi, kunezindlela eziningana ezinconywayo ongazisebenzisa nge-SecPol noma i-GPO:

• Nciphisa ukugcinwa kwemininingwane: ukunciphisa inani lama-logon agciniwe noma ukuwakhubaza ngokuphelele ezindaweni zokusebenza ezibalulekile, ukuvimbela iziqinisekiso zomphathi wesizinda ukuthi zingahlali ku-SAM.
• Khubaza i-WDigestLokhu kuvimbela ukuthi igama lokungena lingagcinwa embhalweni ocacile ku-LSASS.
• Nika amandla i-Credential GuardKu-Windows 10/11 Enterprise, ihlukanisa iziqinisekiso endaweni ebonakalayo, engafinyeleleki ezinqubweni ezinamalungelo ambalwa.
• Nika amandla ubuqotho benkumbulo (HVCI): kuqinisa kakhulu ikhodi engalayishwa kumongo we-LSASS.

Konke lokhu kulawulwa ngezinqubomgomo zokuphepha ezithuthukisiwe kanye nezinqubomgomo ze-MS Security Guide , ezifakiwe ku-Security Compliance Toolkit. Kudinga ihadiwe ehambisanayo (i-UEFI, i-TPM efanelekile , ukwesekwa kwe-virtualization), kodwa ukuthuthukiswa kokuphepha kubalulekile, ikakhulukazi ekuhlaselweni kwe-Pass-the-Hash noma i-Pass-the-Ticket.

Ukulawulwa kohlelo lokusebenza: Imikhawulo ye-AppLocker, i-ASR, kanye nokusebenza

I-vector evamile yokuhlasela ngumsebenzisi osebenzisa noma yini: okunamathiselwe, ama-binary e-GitHub, izikripthi ezivela ku-who-know-where, kanye nezinhlelo zokusebenza eziphathwayo. Ukulawulwa kohlelo lokusebenza ku-Windows 10/11 kubhekiswa ngezingxenye eziningana: i-AppLocker, imithetho ye-Defender ASR, kanye nezinqubomgomo zokusebenzisa iskripthi (ikakhulukazi i-PowerShell).

Nge -AppLocker, ungachaza ukuthi yimaphi ama-executable, ama-MSI installers, ama-scripts, kanye nezinhlelo zokusebenza ezipakishiwe ezingase zisebenze, ngokusekelwe emithethweni kumshicileli, indlela, noma i-hash. Ilungiselelwe nge-Gpedit noma i-Group Policy ku- Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker . Okungcono kakhulu, kufanele uqale kumodi yokuhlola, ubuyekeze imiphumela, bese ushintshela kumodi yohlelo lokusebenza.

Okokugcina, lawula i-PowerShell ngezinqubomgomo zokusebenzisa: dinga i-AllSigned noma, ezindaweni ezidinga kakhulu, vimba ngqo ukwenziwa kwezikripthi zomsebenzisi futhi uvumele kuphela izikripthi ezisayinwe yinkampani. Ngaphezu kwalokho, ungabhalisa imibhalo futhi uvimbele izinguqulo ezindala ze-PowerShell ukuze unciphise ama-vector okugwema.

Ukuvikelwa kwe-Ransomware: Ukufinyelela okulawulwayo kumafolda nakuma-backups

I-Ransomware ihlasela ngqo amafayela abasebenzisi kanye nezinsiza ezabiwe. Ukuze kuncishiswe lokhu, i-Windows 10/11 ifaka phakathi i-Controlled Folder Access ngaphakathi kwe-Microsoft Defender Exploit Guard. Lesi sici sivimbela izinqubo ezingagunyaziwe ekuguquleni izindlela ezithile (Amadokhumenti, iDeskithophu, njll.).

Kusuka ku-Windows Security, ungavumela i-Ransomware Protection > Controlled Folder Access , ungeze amafolda avikelwe, futhi uvumele izinhlelo zokusebenza ezithembekile. Ezingeni lebhizinisi, kungcono ukulilungiselela usebenzisa i-Group Policy Objects (GPOs) noma i-Intune ukuqinisekisa ukuthi wonke amakhompyutha asebenzisa inqubomgomo efanayo.

Ngaphezu kwalokho, imikhuba emihle idinga uhlelo oluqinile lokusekela ngokulondoloza lwe-3-2-1 : okungenani amakhophi amathathu, ezindaweni ezimbili ezahlukene zokugcina, kanye neyodwa engekho endaweni yokugcina noma endaweni yokugcina engaguquki. Kungakhathaliseki ukuthi ukuqina kwakho kuqine kangakanani, uma i-ransomware ibhala idatha futhi kungekho ukusekela ngokulondoloza okuqinisekisiwe, lesi sigameko siba sibi kakhulu.

Kunconywa ukuhlela ukwenziwa kwama-backup njalo, ukuhlola ukubuyiselwa kwe-backup ngezikhathi ezithile , nokuqinisekisa ukuthi iziqinisekiso ezisetshenziselwa ukwenziwa kwama-backup azivezwa ezindaweni zokusebenza ezifanayo ezingase zibe sengozini.

I-Secure Boot, i-ELAM, kanye nokubethela idiski nge-BitLocker

Elinye izinga elibalulekile lokuphepha lisenqubweni yokuqalisa uhlelo uqobo kanye nokuvikelwa kwediski. Yilapho i-UEFI, i-Secure Boot, i-TPM, i-ELAM, kanye ne-BitLocker zisebenza khona.

Njengoba i-Secure Boot ivuliwe ku-UEFI, i-firmware ivumela kuphela ama-bootloader asayiniwe futhi aqinisekisiwe ukuthi alayishe, okwenza kube nzima ukufaka ama-bootkit akhiyela ohlelweni lokusebenza ngaphambi kokuthi alayishe. I-ELAM (Early Launch Anti-Malware) ikuvumela ukuthi ubhalise umshayeli we-anti-malware olayisha ngaphambi kwanoma yibaphi abashayeli beqembu lesithathu futhi uhlukanise ukuthi yibaphi abashayeli abangaqalwa.

Ukuqalisa okulinganisiwe , kuhlanganiswe ne-TPM, kudala ilogi lapho izingxenye zayo zilayishwa khona ngesikhathi senqubo yokuqalisa, engabuyekezwa yizixazululo zokuphepha ukuze kutholakale ukuphazamiseka. Lokhu kunciphisa amathuba okushintsha okunonya kuchungechunge lokuqalisa olungatholakali.

Ngokuphathelene nedatha, i-BitLocker inikeza ukubethela okugcwele kwediski nge-AES , ivikela ulwazi uma ikhompyutha ilahlekile, yebiwe, noma idiski isusiwe. Okungcono kakhulu, i-BitLocker kufanele isetshenziswe ne-TPM kanye, uma kudingeka, ne-PIN ekuqaleni. Izinto Zenqubomgomo Yeqembu (ama-GPO) zikuvumela ukuthi wenze i-algorithm yokubethela ibe yi-standard, usebenzise ukubethela kuwo wonke ama-drive, ulawule ukugcinwa kwezinkinobho zokubuyisa, futhi uvimbele ukucushwa okubuthakathaka.

Ukuphathwa kwe-akhawunti, amalungelo, kanye nokuqinisekiswa

Ukuphathwa kwe-akhawunti kungenye insika yokuqinisa. Isinyathelo sokuqala ukususa imikhuba emibi njengokusebenzisa i-akhawunti yomphathi eyakhelwe ngaphakathi kukho konke noma ukuyishiya nephasiwedi efanayo kuwo wonke amadivayisi . Le akhawunti kufanele iqanjwe kabusha, ikhutshazwe uma kungenzeka, futhi iphathwe ngesisombululo esifana ne -LAPS , esinikeza amaphasiwedi ahlukile ngedivayisi ngayinye futhi iwajikelezise.

Okubaluleke ngokulinganayo ukuhlukanisa ama-akhawunti abasebenzisi kuma-akhawunti omphathi. Umphathi akufanele aphequlule i-inthanethi noma afunde i-imeyili esebenzisa i-akhawunti enelungelo. Kunconywa imodeli yama-akhawunti amabili : i-akhawunti eyodwa ejwayelekile yokusetshenziswa kwansuku zonke kanye nenye i-akhawunti yokuphatha kuphela yemisebenzi esezingeni eliphezulu, okungcono kakhulu ngemikhawulo ekufinyeleleni iwebhu kanye ne-imeyili.

Ukuze uthole ukufinyelela okubucayi (ama-VPN, ukufinyelela okukude, izinguquko kwingqalasizinda ebalulekile, ukufinyelela idatha eyimfihlo), kunconywa kakhulu ukuthi kudingeke ukuqinisekiswa kwezinto eziningi okusekelwe kuhadiwe : I-Windows Hello for Business (i-PIN noma i-biometrics esekelwa yi-TPM), okhiye be-FIDO2, amakhadi ahlakaniphile, njll. Lokhu kunciphisa kakhulu umthelela wokwebiwa kweziqinisekiso.

Ezingeni lephrothokholi, kuyalulekwa ukuphoqelela ukusetshenziswa kwe -Kerberos kanye ne-NTLMv2 , ukukhubaza i-NTLMv1, futhi, lapho kungenzeka, ugweme izindlela zakudala. Kubalulekile futhi ukunika amandla inqubomgomo ye -NoLMHash ukuvimbela ukugcinwa kwama-hashes e-LM abuthakathaka kakhulu.

Inethiwekhi, i-firewall, izinsizakalo kanye nezinqubo zesikhathi esidlule

Uhlelo lwe-Windows oluqinile lulawula nokuthi yini engangena futhi iphume kunethiwekhi nokuthi yimaphi ama-port enethiwekhi avulekile avelelayo. I -Windows Firewall kufanele inikwe amandla kumaphrofayili esizinda, angasese, nawomphakathi, ngemithetho ecacile engenayo nephumayo. Ngokuvamile, kufanele kuvunyelwe ithrafikhi edingekayo kuphela ehlobene nezinsizakalo nezinhlelo zokusebenza ezaziwayo.

Kusendlalelo senethiwekhi, kuyalulekwa ukuthi:

• Sayina futhi ubethele iziteshi eziphephile phakathi kwezindawo zokusebenza kanye nabalawuli besizinda, ukuvimbela ukuhlaselwa kwabantu abaphakathi nendawo.
• Ukuxhumana kwe-SMB nge-SMB bese ukhubaza i-SMBv1.
• Vala ukusebenza I-NetBIOS nge-TCP/IP ezindaweni zokusebenzelana zesimanje, njengoba kudala izingozi ezindaweni ezindala kuphela.
• Vimba ukuxhumana okungaziwa ezivumela ukufaka abasebenzisi ohlwini, amasheya, noma izinqubomgomo.

Sidinga futhi ukucabangela izixhumi ezinobungozi obukhulu njenge-FireWire noma i-Thunderbolt, ezivumela ukufinyelela okuqondile kwe-DMA kwimemori . Uma kungenzeka, lezi kufanele zikhutshazwe ku-UEFI noma nge-Group Policy, noma okungenani ukuvikelwa kwe-kernel DMA okutholakala ku-Windows 10/11 kufanele kuvunyelwe.

Ngokuphathelene nezinsizakalo, umthetho ucacile: noma yini engabalulekile kufanele isuswe noma ikhutshazwe . Buyekeza izinsizakalo eziqala ngokuzenzakalelayo, izindima ezifakiwe, kanye nezici ze-Windows. Kumaseva abalulekile kanye nezindawo zokusebenza, nciphisa ukusetshenziswa kwe-RDP kube okungenani, okuvikelwe yi-VPN, i-MFA, kanye nama-GPO athile aqinisa ukuphepha kwensizakalo.

Izinqubomgomo zokuphepha zendawo, i-MSS, kanye nokususwa kwezici ezingadingekile

I-SecPol.msc ihlanganisa ingxenye enkulu yezinqubomgomo zokuphepha zendawo: izinqubomgomo zephasiwedi, ukukhiya ama-akhawunti, amalungelo abasebenzisi, kanye nezinketho zokuphepha . Lezi zinketho ezifanayo zivame ukuphathwa yi-Group Policy Objects (GPOs) ezingeni lesizinda noma leyunithi yenhlangano (OU), kodwa kubalulekile ukuhlukanisa ngokucacile phakathi kwalokho okusetshenziswa endaweni nalokho okuvela kusizinda. I-AccessChk ingasetshenziswa ukuhlola izimvume nokuhlola izabelo.

I-Microsoft iphinde ichaze uchungechunge lwezilungiselelo ezikhethekile ezaziwa ngokuthi i-MSS (Microsoft Security Settings) , ezivezwa ngamathempulethi okuphatha engeziwe ku-Security Compliance Toolkit. Nakuba ezinye seziphelelwe yisikhathi, ezinye ziyaqhubeka nokunikeza ukuqina okwengeziwe: izikhathi zokuphelelwa yisikhathi kokuxhumeka, ukuphathwa kwamaphakethe e-TCP, ukuziphatha kwenethiwekhi okuzenzakalelayo, njll.

Ingxenye ebalulekile yokuqinisa ukususa noma ukukhubaza izici ezingeke zisetshenziswe : izingxenye ze-Windows ozikhethela zona, izinsizakalo zokwabelana ngamafayela endawo kanye nephrinta, ukushiswa kwe-CD uma kungadingeki, i-Telnet, i-FTP engabethelwe, i-Windows Remote Shell, izici zokuhlola noma ezingasetshenziswa kakhulu njenge- Copilot ezindaweni zezinkampani lapho ingozi ingakahlolwa khona, kanye nokuhlanza okufakiwe okudala okuhambisanayo kwerejista.

Uma izingxenye ezimbalwa zikhona ohlelweni, uveza indawo yokuhlasela encane futhi kulula ukugcina ukucushwa kulawulwa futhi kuhlolwe.

Ukuhlola, ukuloba okuhlanganisiwe, kanye nokuvimba ukubalwa okuyingozi

Awukwazi ukuvikela lokho ongakwazi ukukubona. Ingxenye ebalulekile yokuqinisa iwukuchaza inqubomgomo eqinile yokuhlola nokuqinisekisa ukuthi imicimbi efanele igcinwa ngokuthembekile, okungcono kakhulu endaweni yokugcina impahla ephakathi.

Ku-Windows 10/11, Izinqubomgomo Zokuhlola Ezithuthukisiwe zivumela ubunye ngesigaba (ukungena ngemvume, ukufinyelela into, izinguquko zenqubomgomo, ukusetshenziswa kwamalungelo, njll.). Kunconywa ukuthi kuvunyelwe ukuhlola imisebenzi ebalulekile, kulungiselelwe usayizi welogi ofanele , futhi kuvinjelwe amalogi ukuthi angabhali ngaphezulu kwemicimbi yakamuva ngaphandle kokuwagcina kungobo yomlando.

Ngaphezu kwalokho, kungumqondo omuhle ukuthumela amalogi edivayisi kuseva yomcimbi ophakathi, i-SIEM, noma isisombululo esifanayo , ukuze umhlaseli angasusi nje umkhondo endaweni yokusebenza eyonakele. Lokhu kwenza kube lula ukuthola amaphethini, ukuhlanganisa imicimbi, nokwenza uphenyo lwangemva kwesigameko.

Ngesikhathi esifanayo, kuyadingeka ukunciphisa ulwazi umsebenzisi ojwayelekile angaluthola ohlelweni: ukuvimba ukukhiqizwa kwemibiko ye-RSOP ngabasebenzisi abangenamalungelo, ukufihla izakhiwo zokuphepha zamafayela namafolda kubasebenzisi ngokungadingekile, nokuvimbela ulwazi oluningi kakhulu ukuthi lungadalulwa esikrinini sokukhiya.

Ukuphathwa kwamandla, ukulala kanye nokulala ebusika ezindaweni ezibucayi

Kumakhompyutha ajwayelekile abasebenzisi, imisebenzi yokulala, yokulala ebusika, kanye neyokulala ehlanganisiwe isiza ukonga amandla, kodwa ezindaweni ezibucayi kakhulu zingadalula idatha: okuqukethwe yimemori kugcinwa noma kulahlwe kudiski ku-hiberfil.sys, lapho okhiye bokubethela noma olunye ulwazi olubucayi lungashiywa khona.

Ngakho-ke, ezindaweni eziphephile kakhulu, kuyinto evamile ukukhubaza lezi zimo zamandla nge-Group Policy bese ulungiselela izinqubomgomo eziqinile zokukhiya iseshini (isibonelo, ukukhiya ngemva kwemizuzu eyi-15 yokungasebenzi kanye nokusebenzisa i-screensaver evikelwe ngephasiwedi). Lokhu kunciphisa ingozi yokuthi othile asebenzise ikhompyutha evuliwe nengagadiwe.

Inhlanganisela yokukhiya okuzenzakalelayo , izikhathi ezinengqondo zokungenzi lutho, kanye nezimo zokukhubaza ezigcina okuqukethwe kwememori kuyisendlalelo esengeziwe sokuvikelwa ngokomzimba, ikakhulukazi esiwusizo kuma -laptop noma imishini ezindaweni ezihlanganyelwe.

Ukulungisa, izinguqulo ze-x64, kanye nezibuyekezo eziqhubekayo

Wonke lo mzamo wokucushwa uyalahleka uma uhlelo lungalungiswanga kahle. Ama-patches e-Windows kanye nezinhlelo zokusebenza alungisa ubuthakathaka obuvame ukusetshenziswa ngokushesha ekuhlaselweni kosuku olulodwa, ngakho-ke kubalulekile ukuba nesu lokuvuselela njalo nokulawula izibuyekezo ezizenzakalelayo ezingafiki ngesikhathi.

Ezindaweni zezinkampani, lokhu kuhilela ukusebenzisa i-WSUS, i-Configuration Manager, noma i-Windows Update for Business , kuhlanganiswe ne-Wake-on-LAN ukuze kusetshenziswe izibuyekezo ngaphandle kwamahora ajwayelekile ebhizinisi. Kubalulekile ukuchaza amafasitela okulungisa, ukubeka phambili ama-patches abalulekile, kanye nenqubo ecacile yokubuyisela emuva uma i-patch iphula okuthile okubalulekile.

Ngaphezu kwalokho, kuyalulekwa ukwenza kube ngokwejwayelekile kuzinguqulo ze-x64 ze-Windows , okuhlanganisa nokunciphisa ukuphepha okwengeziwe (i-kernel DEP esekelwe kwihadiwe, i-PatchGuard, ukusayina komshayeli okuphoqelekile, njll.) okungekho kuzinguqulo ze-x86. Ngokufanayo, ukunamathela ezinguqulweni zakamuva ze-Windows 10/11 kunciphisa ukuchayeka kumasu asevele encishisiwe kulezo zinguqulo.

Izimiso ezifanayo ziyasebenza ezinhlelweni zokusebenza: Ihhovisi, iziphequluli, i-Java, i-.NET, abafundi be -PDF , amaklayenti e-imeyili… noma yini evula okuqukethwe okungathembekile kufanele ibe senguqulweni yakamuva esekelwayo enama-patches , okungcono kakhulu ilandele iziqondiso zokuqinisa eziqondene nomthengisi (isb., izisekelo zokuphepha ze-Office noma ama-GUI okucushwa kwesiphequluli esivikelekile).

Ngazo zonke lezi zinto ezingenhla ezihlelwe kahle—izisekelo ze-Microsoft, ukusetshenziswa okuhlakaniphile kwe-SecPol kanye ne-GPO, iziqinisekiso ezivikelwe, ukuqalisa okuphephile, ukubethela, i-firewall encane, ukulawula uhlelo lokusebenza, ukuloga okuqinile, kanye nokuqeqeshwa okuqinile kokulungisa—i-Windows 11 isuka ekubeni uhlelo olulula olusebenzayo iye endaweni yokugcina eqinile ngempela , emelana kakhulu nokuhlaselwa kwansuku zonke futhi elungele ukuhlanganiswa nesu lokuphepha elihlanganisiwe ngaphakathi kwenhlangano.