Computer >> Hướng Dẫn Máy Tính >  >> Kết Nối Mạng >> An Ninh Mạng

Công nghệ bảo mật mạng (Network Security Technologies)

Công nghệ bảo mật mạng là gì?

Là tập hợp các giải pháp phần cứng, phần mềm, giao thức và kỹ thuật được thiết kế để bảo vệ tính toàn vẹn, bảo mật và sẵn sàng của cơ sở hạ tầng mạng và dữ liệu truyền tải trên đó. Mục tiêu: Ngăn chặn, Phát hiện, Phản hồi, Khôi phục các mối đe dọa.

Phân loại theo chức năng (Functional Categories)

1. Kiểm soát truy cập & Xác thực (Access Control & Authentication)

  • NAC (Network Access Control): Cisco ISE, Aruba ClearPass, FortiNAC, Portnox. 802.1X, MAB, Posture Assessment, Guest/Quarantine VLAN.
  • Zero Trust Network Access (ZTNA): Zscaler ZPA, Cloudflare Access, Twingate, Tailscale, Netskope Private Access. "Never trust, always verify". Thay thế VPN truyền thống.
  • PAM (Privileged Access Management): CyberArk, BeyondTrust, Thycotic, HashiCorp Vault. JIT Access, Session Recording, Credential Vault.
  • MFA/Identity Provider: Microsoft Entra ID, Okta, Ping Identity, Duo, YubiKey (FIDO2/WebAuthn).

2. Bảo vệ biên giới & Phân đoạn mạng (Perimeter & Network Segmentation)

  • NGFW (Next-Gen Firewall): Palo Alto Networks, Fortinet FortiGate, Check Point Quantum, Cisco Secure Firewall (Firepower), Sophos XGS, WatchGuard. App-ID, User-ID, SSL Decrypt, IPS, AV, Sandbox, DNS Security.
  • Web Application Firewall (WAF): Cloudflare, AWS WAF, Azure WAF, F5 ASM, Imperva, ModSecurity (Open Source). Bảo vệ Layer 7 (OWASP Top 10).
  • DDoS Protection: Cloudflare, Akamai, AWS Shield, Radware, Arbor Networks (NETSCOUT). Scrubbing Center, Anycast.
  • Network Segmentation / Micro-segmentation: VLAN, VRF, VXLAN, Cisco ACI, VMware NSX, Illumio, Guardicore (Akama), Zero Trust Segmentation.
  • Secure Web Gateway (SWG): Zscaler, Netskope, Forcepoint, Menlo Security (Browser Isolation). URL Filtering, Malware Scan, DLP, CASB.

3. Phát hiện & Phản hồi威胁 (Threat Detection & Response)

  • NDR (Network Detection & Response): ExtraHop Reveal(x), Corelight (Zeek-based), Vectra AI, Darktrace, Arctic Wolf. Phân tích traffic (PCAP/NetFlow/Metadata), ML/Behavioral, MITRE ATT&CK mapping.
  • IDS/IPS (Intrusion Detection/Prevention System): Suricata (Open Source), Snort (Cisco), Zeek (Bro - NSM), Palo Alto/Cisco/Fortinet Integrated IPS. Signature + Anomaly.
  • SIEM (Security Information & Event Management): Splunk, Elastic (ELK), Microsoft Sentinel, IBM QRadar, LogRhythm, CrowdStrike Falcon LogScale. Centralized Logging, Correlation, Alerting.
  • SOAR (Security Orchestration, Automation & Response): Palo Alto Cortex XSOAR, Splunk SOAR, FortiSOAR, Tines, Siemplify (Google). Playbook tự động hóa IR.
  • XDR (Extended Detection & Response): CrowdStrike Falcon, Microsoft Defender XDR, SentinelOne Singularity, Palo Alto Cortex XDR, Trend Vision One. Gắn kết Endpoint + Network + Cloud + Identity + Email.
  • Deception Technology: Attivo Networks, Acalvio, TrapX, Canary Tokens (Thinkst). Honeypot/Honeytoken hiện đại.

4. Bảo vệ dữ liệu & Mã hóa (Data Protection & Encryption)

  • TLS/SSL (Transport Layer Security): TLS 1.3 (Bắt buộc), Certificate Management (ACME/Let's Encrypt, Venafi, DigiCert, Sectigo), mTLS.
  • IPsec / MACsec (IEEE 802.1AE): Mã hóa Layer 3 / Layer 2. Site-to-Site VPN, DC Interconnect.
  • WireGuard / OpenVPN / IKEv2: VPN Protocols hiện đại.
  • DLP (Data Loss Prevention): Microsoft Purview, Forcepoint, Digital Guardian, Nightfall, Cyberhaven. Content Inspection, Context-Aware, Endpoint/Network/Cloud/Email DLP.
  • Encryption at Rest: AES-256-XTS (BitLocker, FileVault, LUKS), HSM (Hardware Security Module - Thales, AWS CloudHSM, Azure Dedicated HSM), KMS.
  • Tokenization / Format-Preserving Encryption: Bảo vệ PII/PCI trong DB/App (Protegrity, Voltage).

5. Quản trị lỗ hổng & Cấu hình an toàn (Vulnerability & Configuration Management)

  • Vulnerability Scanner: Tenable.io/Nessus, Qualys VMDR, Rapid7 InsightVM, OpenVAS/GVM (Open Source), Microsoft Defender Vulnerability Management.
  • Patch Management / Automated Remediation: Automox, NinjaOne, Action1 (Free <100 EP), Ivanti, Microsoft Intune/WSUS, Ansible/Puppet/Chef.
  • CIS Benchmarks / STIGs / NIST SP 800-53 / ISO 27001 Controls: Baseline cấu hình an toàn.
  • CSPM (Cloud Security Posture Management): Wiz, Orca, Prisma Cloud, Microsoft Defender for Cloud, CrowdStrike Falcon Cloud Security.
  • CNAPP (Cloud-Native Application Protection Platform): Kết hợp CSPM + CWPP + CIEM + DSPM + API Security.

6. Bảo mật Email & Hợp tác (Email & Collaboration Security)

  • Secure Email Gateway (SEG) / ICES (Integrated Cloud Email Security): Proofpoint, Mimecast, Microsoft Defender for Office 365, Google Workspace Security, Abnormal Security, Avanan. Anti-Phishing (AI/ML), Sandbox, URL Rewriting, DMARC/DKIM/SPF, DLP.
  • DMARC Enforcement: p=reject/quarantine. Bảo vệ domain khỏi spoofing.

7. Bảo mật Đám mây & Container (Cloud & Container Security)

  • CWPP (Cloud Workload Protection Platform): Runtime protection cho VM, Container, Serverless (Falco, Sysdig, Aqua, Prisma Cloud, Defender for Cloud).
  • KSPM (Kubernetes Security Posture Management): Kube-bench, Kyverno, OPA Gatekeeper, ARMO, KSOC.
  • Container Image Scanning: Trivy, Grype, Snyk, Anchor, Aqua, JFrog Xray. CI/CD Integration.

8. Bảo mật OT/ICS/IoT (Operational Technology / Industrial Control Systems / IoT)

  • OT Security Platform: Claroty, Dragos, Nozomi Networks, Armis, Forescout. Passive Monitoring (SPAN/TAP), Asset Inventory, Vuln Mgmt, Threat Detection (MITRE ATT&CK for ICS), Segmentation Enforcement.
  • IoT/OT Network Segmentation: VLAN, ACL, Firewall, NAC (Forescout, Cisco ISE, Aruba ClearPass).

Mô hình triển khai hiện đại: SASE / SSE

SASE (Secure Access Service Edge - Gartner 2019): Kết hợp Network (SD-WAN) + Security (SSE) dưới dạng Cloud-Native Service.

  • SSE (Security Service Edge): SWG + CASB + ZTNA + FWaaS (Firewall as a Service) + DLP + RBI (Remote Browser Isolation).
  • Vendor: Zscaler, Netskope, Palo Alto Prisma Access, Cato Networks, Cloudflare One, Fortinet FortiSASE, Versa (Verizon), Cisco Umbrella+Meraki SD-WAN.

Công nghệ mới nổi (Emerging Technologies)

  • AI/ML cho Threat Detection: Behavioral Analytics, UEBA, Automated Threat Hunting, Generative AI cho SOC (Copilot, Charlotte AI).
  • eBPF (Extended Berkeley Packet Filter): Kernel-level visibility cho Network/Container Security (Cilium, Tetragon, Pixie, Falco).
  • Confidential Computing (TEE/Enclave): Intel SGX/TDX, AMD SEV-SNP, ARM CCA. Bảo vệ data-in-use.
  • Post-Quantum Cryptography (PQC): Kyber (KEM), Dilithium (Sig), SPHINCS+ (Sig) - NIST Standardized 2024. Hybrid TLS 1.3 / IPsec / SSH.
  • SBOM (Software Bill of Materials) / Supply Chain Security: SPDX, CycloneDX, SLSA, Sigstore, Cosign, in-toto.

Kết luận

Công nghệ bảo mật mạng đã chuyển từ Perimeter-based (Firewall/VPN) sang Identity-centric, Data-centric, Cloud-native (Zero Trust, SASE/SSE, XDR, CNAPP). Không có "silver bullet". Chiến lược hiệu quả: Defense in Depth (Đa lớp) + Zero Trust Architecture + Automation (SOAR, IaC, Policy as Code) + Continuous Monitoring (SIEM/NDR/XDR) + Threat Intelligence Integration + Skilled Human (SOC, Hunt, IR). Lựa chọn công nghệ phụ thuộc: Quy mô, Ngành, Rủi ro, Ngân sách, Kỹ năng team, Compliance.