V dne\u0161n\u00ed dob\u011b, kdy v\u011bt\u0161ina firem uchov\u00e1v\u00e1 sv\u00e9 obchodn\u00ed, \u00fa\u010detn\u00ed a dal\u0161\u00ed, pro podnik\u00e1n\u00ed podstatn\u00e9 informace, v elektronick\u00e9 podob\u011b, je na m\u00edst\u011b se zamyslet nad ochranou t\u011bchto dat. Majitel\u00e9 a mana\u017ee\u0159i firem, stejn\u011b jako jednotliv\u00ed u\u017eivatel\u00e9, jsou p\u0159esv\u011bd\u010dov\u00e1ni neutuchaj\u00edc\u00ed medi\u00e1ln\u00ed a marketingovou mas\u00e1\u017e\u00ed, co je k\u00fd\u017eenou cestou k bezpe\u010dnosti jejich dat. Tato kampa\u0148 je intenzivn\u011b podporov\u00e1na hororov\u00fdmi sc\u00e9n\u00e1\u0159i ztr\u00e1ty nebo p\u0159\u00edmo zneu\u017eit\u00ed dat, a\u0165 ji\u017e na z\u00e1klad\u011b hav\u00e1rie, nedbalosti u\u017eivatele nebo c\u00edlen\u00e9ho \u00fatoku. <\/p>\n\n\n\n
Auditorsk\u00e9 a poradensk\u00e9 firmy p\u0159esv\u011bd\u010duj\u00ed sv\u00e9 potenci\u00e1ln\u00ed z\u00e1kazn\u00edky o nezbytnosti pravideln\u00fdch bezpe\u010dnostn\u00edch audit\u016f jako cesty k dokonale bezpe\u010dn\u00e9mu IT a bombarduj\u00ed potenci\u00e1ln\u00ed z\u00e1kazn\u00edky normami (ISO 17799 a dal\u0161\u00ed) a z\u00e1kony (z\u00e1kon \u010d. 151\/2000 Sb. o telekomunikac\u00edch, z\u00e1kon \u010d. 101\/2000 Sb. o ochran\u011b osobn\u00edch \u00fadaj\u016f, atd.). Prodejci nejr\u016fzn\u011bj\u0161\u00edch softwarov\u00fdch i hardwarov\u00fdch bezpe\u010dnostn\u00edch prost\u0159edk\u016f se zase p\u0159edh\u00e1n\u011bj\u00ed v prezentaci sv\u00e9ho zbo\u017e\u00ed a prezentuj\u00ed rizika, kter\u00e1 \u201epr\u00e1v\u011b jen jejich unik\u00e1tn\u00ed \u0159e\u0161en\u00ed\u201c odstran\u00ed. Pro samotn\u00e9 IT mana\u017eery je to spletit\u00e1 d\u017eungle pln\u00e1 marketingov\u00fdch past\u00ed, pro majitele nebo mana\u017eery podniku je to u\u017e v\u016fbec nep\u0159ehledn\u00e9 bludi\u0161t\u011b. <\/p>\n\n\n\n
Kde je tedy pravda? Jako obvykle se pravda skr\u00fdv\u00e1 n\u011bkde mezi ob\u011bma v\u00fd\u0161e popsan\u00fdmi extr\u00e9my, tedy n\u011bkde mezi pravidelnou \u201ezdravotn\u00ed prohl\u00eddkou informa\u010dn\u00edho syst\u00e9mu\u201c a nasazen\u00edm sofistikovan\u00fdch prost\u0159edk\u016f ochrany dat. <\/p>\n\n\n\n
P\u0159ed jakoukoliv investic\u00ed do ochrany dat je t\u0159eba se zamyslet nad t\u00edm, jak\u00e1 data vlastn\u011b uchov\u00e1v\u00e1me, v jak\u00e9 podob\u011b a jakou maj\u00ed hodnotu. Slovo \u201ehodnota\u201c zde nep\u0159edstavuje p\u0159\u00edmo vy\u010d\u00edslitelnou cenu pro n\u00e1s nebo pro dal\u0161\u00ed subjekty (nap\u0159. konkurenci), ale i cenu, kterou by n\u00e1s st\u00e1la ztr\u00e1ta \u010di po\u0161kozen\u00ed dat. Je to podobn\u00e9 jako s autem, jeho kr\u00e1de\u017e\u00ed je majiteli zp\u016fsobena \u0161koda ve v\u00fd\u0161i re\u00e1ln\u00e9 ceny auta, ale dal\u0161\u00ed \u0161koda se d\u00e1 vy\u010d\u00edslit t\u00edm, jak\u00e9 n\u00e1klady vzniknou n\u00e1hradou vozu \u2013 z\u00e1p\u016fj\u010dkou n\u00e1hradn\u00edho vozu nebo n\u00e1kupem nov\u00e9ho. Do doby, ne\u017e kr\u00e1de\u017e auta majitel vy\u0159e\u0161\u00ed, m\u016f\u017ee nap\u0159. p\u0159ij\u00edt o obchody t\u00edm, \u017ee nen\u00ed schopen se dostavit za z\u00e1kazn\u00edkem (a\u0165 ji\u017e pro dojedn\u00e1n\u00ed nov\u00e9ho obchodu nebo spln\u011bn\u00ed podm\u00ednek st\u00e1vaj\u00edc\u00edho). Jako posledn\u00ed, nikoliv v\u0161ak nejmen\u0161\u00ed \u0161koda je ztr\u00e1ta dobr\u00e9ho jm\u00e9na (nap\u0159. op\u011bt vlivem nemo\u017enosti splnit smluvn\u00ed podm\u00ednky). Analogicky se m\u016f\u017eeme d\u00edvat na ztr\u00e1tu, kr\u00e1de\u017e, po\u0161kozen\u00ed \u010di zneu\u017eit\u00ed na\u0161ich dat. <\/p>\n\n\n\n
Snad ka\u017ed\u00fd, i dom\u00e1c\u00ed u\u017eivatel za\u017eil n\u011bjakou ztr\u00e1tu dat vlivem hav\u00e1rie PC nebo zni\u010den\u00ed m\u00e9dia, na n\u011bm\u017e data byla ulo\u017eena. Asi ka\u017ed\u00fd si n\u011bkdy omylem smazal data nebo je p\u0159epsal neaktu\u00e1ln\u00ed starou verz\u00ed. V tento okam\u017eik zoufale hled\u00e1me n\u011bjakou z\u00e1lohu dat nebo jsme odsouzeni k jejich op\u011btovn\u00e9mu vytvo\u0159en\u00ed. Do t\u00e9to kategorie tak\u00e9 pat\u0159\u00ed z\u00e1m\u011brn\u00e9 zni\u010den\u00ed, po\u0161kozen\u00ed nebo zm\u011bna dat. Tento p\u0159\u00edpad je hor\u0161\u00ed ne\u017e samotn\u00e1 ztr\u00e1ta, proto\u017ee modifikaci dat obvykle nepozn\u00e1me hned a pokud ano, pak je t\u011b\u017ek\u00e9 nal\u00e9zt a opravit takto po\u0161kozen\u00e1 data. Pamatujte na to, \u017ee nejen \u201enep\u0159\u00edtel z internetu\u201c je hrozbou, stejn\u011b nebezpe\u010dn\u00fd (mo\u017en\u00e1 je\u0161t\u011b nebezpe\u010dn\u011bj\u0161\u00ed) m\u016f\u017ee b\u00fdt \u201evnit\u0159n\u00ed nep\u0159\u00edtel\u201c v podob\u011b zneuznan\u00e9ho zam\u011bstnance, kter\u00fd zn\u00e1 strukturu a hodnotu dat. <\/p>\n\n\n\n
Krom\u011b ztr\u00e1ty je dal\u0161\u00ed re\u00e1lnou hrozbou, \u017ee se na\u0161e data dostanou do nepovolan\u00fdch rukou a budou vyu\u017eita \u010di zneu\u017eita. Nemus\u00ed j\u00edt zrovna o zneu\u017eit\u00ed \u010d\u00edsla va\u0161\u00ed kreditn\u00ed karty, kter\u00e9 jste sv\u011b\u0159ili pochybn\u00e9mu internetov\u00e9mu obchodu, ale sta\u010d\u00ed pouh\u00e9 \u201evytunelov\u00e1n\u00ed\u201c kontakt\u016f z va\u0161\u00ed elektronick\u00e9 po\u0161ty. Nap\u0159. r\u016fzn\u00e9 viry jsou schopny se po napaden\u00ed PC rozeslat na v\u0161echny kontakty v adres\u00e1\u0159i u\u017eivatele. Jakou pov\u011bst z\u00edsk\u00e1 u\u017eivatel takov\u00e9ho zavirovan\u00e9ho PC z n\u011bj\u017e proud\u00ed nab\u00eddky na viagru nebo \u201ezaru\u010den\u011b prav\u00fd odkaz na fotky nah\u00e9 Anny Kurnikovov\u00e9\u201c, p\u0159\u00edpadn\u011b se rozes\u00edl\u00e1 virus samotn\u00fd, nen\u00ed asi t\u0159eba p\u0159\u00edli\u0161 rozepisovat. O tom, jakou \u0161kodu na pov\u011bsti toto znamen\u00e1 v p\u0159\u00edpad\u011b firemn\u00edho PC, ani nemluv\u011b. Je t\u0159eba p\u0159ipomenout, \u017ee romantick\u00e1 p\u0159edstava hackera dob\u00fdvaj\u00edc\u00edho se do na\u0161ich s\u00edt\u00ed a PC je sp\u00ed\u0161e n\u00e1m\u011btem na film, drtiv\u00e1 v\u011bt\u0161ina (t\u00e9m\u011b\u0159 90%) \u00fanik\u016f dat m\u00e1 na sv\u011bdom\u00ed \u201evnit\u0159n\u00ed nep\u0159\u00edtel\u201c v podob\u011b zam\u011bstnance posti\u017een\u00e9 spole\u010dnosti. \u0160k\u00e1la mo\u017en\u00fdch zneu\u017eit\u00ed dat je velice pestr\u00e1, od pouh\u00e9 diskreditace posti\u017een\u00e9 spole\u010dnosti a\u017e po vyu\u017eit\u00ed dat v konkuren\u010dn\u00edm boji (nap\u0159. pr\u016fmyslov\u00e1 \u0161pion\u00e1\u017e).<\/p>\n\n\n\n
M\u00edt data a nem\u00edt k nim p\u0159\u00edstup? I to je re\u00e1lnou hrozbou dne\u0161n\u00edch u\u017eivatel\u016f. Klasick\u00fdm p\u0159\u00edkladem m\u016f\u017ee b\u00fdt virus\/\u010derv, kter\u00fd se \u0161\u00ed\u0159il d\u00edky chyb\u011b ve Windows a projevoval se tak, \u017ee p\u00e1r sekund po startu po\u010d\u00edta\u010de se objevil dialog, \u017ee do cca 30 sekund bude PC vypnuto. Tak\u017ee u\u017eivatel m\u011bl sice sv\u00e1 data, ale vlivem \u010dinnosti \u010derva k nim vlastn\u011b nemohl (za 30 sekund se mnoho stihnout ned\u00e1). V podnikov\u00e9m prost\u0159ed\u00ed to m\u016f\u017ee b\u00fdt je\u0161t\u011b hor\u0161\u00ed. \u00datokem znep\u0159\u00edstupn\u011bn\u00fd web server s internetov\u00fdm obchodem m\u016f\u017ee znamenat v lep\u0161\u00edm p\u0159\u00edpad\u011b po\u0161kozen\u00ed jm\u00e9na firmy, v hor\u0161\u00edm p\u0159\u00edpad\u011b jej\u00ed likvidaci. Je t\u0159eba se zamyslet nad t\u00edm, co pro majitele dat nebo jeho spolupracuj\u00edc\u00ed obchodn\u00ed partnery znamen\u00e1 nedostupnost konkr\u00e9tn\u00edch dat. Je mo\u017en\u00e9, \u017ee zjist\u00edte, \u017ee jednodenn\u00ed v\u00fdpadek webov\u00e9ho serveru s prezentac\u00ed spole\u010dnosti neznamen\u00e1 celkem nic, ale v\u00fdpadek mailov\u00e9ho syst\u00e9mu po dobu 1 hodiny je katastrofou. <\/p>\n\n\n\n
Pokud si u\u017e uv\u011bdomujeme rizika, kter\u00e1 na\u0161im dat\u016fm hroz\u00ed, je na m\u00edst\u011b stanovit si bezpe\u010dnostn\u00ed politiku pro nakl\u00e1d\u00e1n\u00ed s daty. Zjednodu\u0161en\u011b \u0159e\u0161eno, m\u011bli bychom m\u00edt jasno v tom KDE a JAK jsou na\u0161e data ulo\u017eena, KDO a JAK\u00c9 p\u0159\u00edstupy m\u00e1 k dat\u016fm, p\u0159ed JAK\u00ddMI hrozbami a JAK jsou data zabezpe\u010dena a JAK spl\u0148ujeme p\u0159\u00edpadn\u00e9 legislativn\u00ed n\u00e1roky na ulo\u017een\u00ed a zabezpe\u010den\u00ed dat. Probereme ve zkratce oblasti, na kter\u00e9 je t\u0159eba se p\u0159i definov\u00e1n\u00ed bezp. politiky zam\u011b\u0159it: <\/p>\n\n\n\n
Asi ka\u017ed\u00fd uzn\u00e1, \u017ee chr\u00e1nit sofistikovan\u00fdmi syst\u00e9my p\u0159\u00edstupy do informa\u010dn\u00edch syst\u00e9m\u016f a pak m\u00edt servery v neuzam\u010den\u00e9 serverovn\u011b, nen\u00ed to prav\u00e9 \u0159e\u0161en\u00ed. V oblasti fyzick\u00e9 bezpe\u010dnosti se zam\u011b\u0159ujeme na vybudov\u00e1n\u00ed organiza\u010dn\u00edch a technick\u00fdch opat\u0159en\u00ed proti neautorizovan\u00e9mu p\u0159\u00edstupu, po\u0161kozen\u00ed, znehodnocen\u00ed, zni\u010den\u00ed \u010di jin\u00fdm z\u00e1sah\u016fm do dat v\u010detn\u011b zamezen\u00ed neautorizovan\u00e9ho p\u0159\u00edstupu do prostor, kde jsou data fyzicky ulo\u017eena. Nezapom\u00ednejme, \u017ee tato oblast se t\u00fdk\u00e1 i bezpe\u010dn\u00e9ho ulo\u017een\u00ed z\u00e1loh kritick\u00fdch dat. <\/p>\n\n\n\n
P\u0159i budov\u00e1n\u00ed bezpe\u010dnostn\u00ed politiky je t\u0159eba jasn\u011b definovat u\u017eivatelsk\u00e9 p\u0159\u00edstupy k dat\u016fm. Bez znalosti toho, kte\u0159\u00ed u\u017eivatel\u00e9 pracuj\u00ed s jak\u00fdmi daty nelze tuto oblast bezpe\u010dnostn\u00ed politiky zvl\u00e1dnout. Je t\u0159eba definovat opat\u0159en\u00ed pro ochranu a kontrolu p\u0159\u00edstupu k informac\u00edm. Zde plat\u00ed, \u017ee u\u017eivatel m\u00e1 m\u00edt p\u0159\u00edstup k syst\u00e9m\u016fm a dat\u016fm, se kter\u00fdmi opravdu pracuje. Benevolence v definici p\u0159\u00edstup\u016f vede k tomu, \u017ee se radik\u00e1ln\u011b zv\u00fd\u0161\u00ed riziko po\u0161kozen\u00ed dat (\u00famysln\u00e9ho i ne\u00famysln\u00e9ho \u010di z nedbalosti) nebo dokonce zcizen\u00ed a zneu\u017eit\u00ed dat. Zde je t\u0159eba p\u0159ipomenout, \u017ee krom\u011b p\u0159\u00edstup\u016f k dat\u016fm je nutno o\u0161et\u0159it i mo\u017enost si tato data \u201eodn\u00e9st\u201c. V dne\u0161n\u00ed dob\u011b, kdy ka\u017ed\u00fd vlastn\u00ed USB kl\u00ed\u010de \u010di pam\u011b\u0165ov\u00e9 karty s kapacitou v \u0159\u00e1du stovek MB \u010di jednotek GB, je vynesen\u00ed dat z organizace naprosto re\u00e1ln\u00e9. <\/p>\n\n\n\n
Do oblasti bezpe\u010dnosti IT pat\u0159\u00ed tak\u00e9 spln\u011bn\u00ed legislativn\u00edch po\u017eadavk\u016f na ochranu a nakl\u00e1d\u00e1n\u00ed s n\u011bkter\u00fdmi druhy dat. Snad ka\u017ed\u00e1 organizace uchov\u00e1v\u00e1 nap\u0159. osobn\u00ed data, kter\u00e1 podl\u00e9haj\u00ed z\u00e1konu \u010d. 101\/2000 Sb. o ochran\u011b osobn\u00edch \u00fadaj\u016f. Je t\u0159eba zn\u00e1t a respektovat dal\u0161\u00ed z\u00e1konn\u00e9 normy, kter\u00e9 upravuj\u00ed nap\u0159. pr\u00e1vo autorsk\u00e9, definuj\u00ed elektronick\u00fd podpis a jeho u\u017e\u00edv\u00e1n\u00ed. V oblasti legislativy je nejlep\u0161\u00ed naj\u00edt partnera, kter\u00fd organizaci pom\u016f\u017ee dost\u00e1t v\u0161em z\u00e1konn\u00fdm norm\u00e1m, kter\u00e9 se IT dot\u00fdkaj\u00ed. <\/p>\n\n\n\n
V neposledn\u00ed \u0159ad\u011b by se ka\u017ed\u00e1 organizace m\u011bla p\u0159ipravit na havarijn\u00ed situace (\u017eiveln\u00e9 pohromy, po\u017e\u00e1r, \u00famysln\u00e9 zni\u010den\u00ed dat nebo infrastruktury, atd.), kter\u00e9 po\u0161kod\u00ed IT organizace natolik, \u017ee je bude t\u0159eba znovu vybudovat. Zde je op\u011bt rozumn\u00e9 zhodnotit, kter\u00e9 syst\u00e9my a kter\u00e1 data jsou kritick\u00e1 a zaslou\u017e\u00ed si ochranu s mo\u017enost\u00ed rekonstrukce v \u0159\u00e1du jednotek hodin a kter\u00e9 syst\u00e9my mohou b\u00fdt rekonstruov\u00e1ny po del\u0161\u00ed dobu. N\u011bkter\u00e9 organizace budou nuceny kritick\u00e9 syst\u00e9my duplikovat v geograficky vzd\u00e1len\u00e9 lokalit\u011b, aby v p\u0159\u00edpad\u011b hav\u00e1rie a zni\u010den\u00ed provozn\u00edho syst\u00e9mu bylo mo\u017eno de facto ihned obnovit provoz z t\u011bchto z\u00e1lo\u017en\u00edch syst\u00e9m\u016f. V oblasti havarijn\u00edch pl\u00e1n\u016f je nutno tak\u00e9 myslet na z\u00e1lohov\u00e1n\u00ed dat a proto\u017ee zde plat\u00ed \u201et\u011b\u017eko na cvi\u010di\u0161ti, lehko na boji\u0161ti\u201c, je dobr\u00e9 si nap\u0159. jednou ro\u010dn\u011b zkusit \u201ecvi\u010dn\u00fd poplach\u201c s rekonstrukc\u00ed kritick\u00fdch syst\u00e9m\u016f. To jist\u011b p\u0159in\u00e1\u0161\u00ed dodate\u010dn\u00e9 n\u00e1klady do IT, ale z\u00e1rove\u0148 garantuje, \u017ee v p\u0159\u00edpad\u011b hav\u00e1rie je organizace schopna udr\u017eet kontinuitu provozu informa\u010dn\u00edch syst\u00e9m\u016f. <\/p>\n\n\n\n
Je na m\u00edst\u011b u\u017eivatele sezn\u00e1mit s t\u00edm, jak\u00e1 pravidla maj\u00ed dodr\u017eovat p\u0159i pr\u00e1ci s IT spole\u010dnosti. Zde plat\u00ed, \u017ee bez sezn\u00e1men\u00ed u\u017eivatele s t\u011bmito pravidly by mu nem\u011bl b\u00fdt d\u00e1n p\u0159\u00edstup k \u017e\u00e1dn\u00fdm syst\u00e9m\u016fm. Bohu\u017eel zde \u010dasto organizace selh\u00e1vaj\u00ed, proto\u017ee nov\u00fd pracovn\u00edk \u201emus\u00ed hned za\u010d\u00edt d\u011blat byznys\u201c a tak \u010dasto ze z\u00e1kladn\u00edho pro\u0161kolen\u00ed o bezpe\u010dnosti IT sejde. Nejde o to, jen sezn\u00e1mit u\u017eivatele s p\u0159\u00edkazy a z\u00e1kazy, ale hlavn\u011b mu vysv\u011btlit, jak z jeho pohledu nevinn\u00e9 ud\u00e1losti mohou ohrozit bezpe\u010dnost dat organizace. U\u017eivatel \u010dasto ani netu\u0161\u00ed, jak\u00e9 riziko p\u0159edstavuje, kdy\u017e nech\u00e1 rodinn\u00e9 p\u0159\u00edslu\u0161n\u00edky, aby \u201epracovali\u201c s jeho firemn\u00edm notebookem a p\u0159ipojovali se nekontrolovan\u011b na internet. Tot\u00e9\u017e plat\u00ed o p\u0159enosn\u00fdch m\u00e9di\u00edch. U\u017eivatel mus\u00ed b\u00fdt nejen pou\u010den o pravidlech, ale m\u011bl by dostat z\u00e1kladn\u00ed informace o v\u00fdznamu bezp. politiky a rizic\u00edch, kter\u00e1 nedodr\u017eov\u00e1n\u00edm pravidel hroz\u00ed. <\/p>\n\n\n\n
Mnoh\u00e9 firmy podlehnou poku\u0161en\u00ed prov\u00e9st bezpe\u010dnostn\u00ed audit jenom s pomoc\u00ed extern\u00edho partnera a sv\u011b\u0159\u00ed se mu pln\u011b do rukou. Stejn\u011b jako nen\u00ed \u00fapln\u011b ide\u00e1ln\u00ed auditovat bezpe\u010dnost IT pouze sv\u00fdmi prost\u0159edky, nen\u00ed tak\u00e9 nejlep\u0161\u00ed cestou spolehnout se jen na extern\u00ed autoritu. Z\u00e1kladem by m\u011bla b\u00fdt intern\u00edm IT definovan\u00e1 bezpe\u010dnostn\u00ed politika. Ta by m\u011bla vzniknout za aktivn\u00edho p\u0159isp\u011bn\u00ed dal\u0161\u00edch odd\u011blen\u00ed, kter\u00e1 by m\u011bla definovat povahu a hodnotu dat, kter\u00e1 vytv\u00e1\u0159\u00ed a zpracov\u00e1vaj\u00ed. S takto vytvo\u0159enou bezpe\u010dnostn\u00ed politikou m\u016f\u017ee intern\u00ed IT prov\u00e9st jak\u00fdsi \u201ep\u0159edaudit\u201c, nakolik je tato politika napl\u0148ov\u00e1na v praxi. Na toto posta\u010d\u00ed pouh\u00fd seznam bod\u016f s hodnotami spl\u0148ujeme\/spl\u0148ujeme \u010d\u00e1ste\u010dn\u011b\/nespl\u0148ujeme. U posledn\u00edch dvou hodnot (spl\u0148ujeme \u010d\u00e1ste\u010dn\u011b\/nespl\u0148ujeme) by m\u011blo b\u00fdt dopln\u011bno, pro\u010d tomu tak je. Je mo\u017en\u00e9 (a \u010dasto to tak v praxi je), \u017ee spln\u011bn\u00ed br\u00e1n\u00ed objektivn\u00ed technick\u00e9 nebo jin\u00e9 p\u0159ek\u00e1\u017eky. <\/p>\n\n\n\n
Takto je spole\u010dnost p\u0159ipravena definovat jasn\u00e9 zad\u00e1n\u00ed pro extern\u00edho auditora \u010di konzultanta v oblasti bezpe\u010dnosti a v\u00ed, jak\u00e1 o\u010dek\u00e1v\u00e1n\u00ed od t\u00e9to slu\u017eby m\u00e1. Z\u00e1rove\u0148 je intern\u00ed IT schopn\u00e9 plnohodnotn\u011b se \u00fa\u010dastnit auditu jako rovnopr\u00e1vn\u00fd partner a nikoliv jako mentorovan\u00fd \u017e\u00e1\u010dek pod p\u0159\u00edsn\u00fdm zrakem zkou\u0161ej\u00edc\u00edho u\u010ditele, jak tomu v praxi \u010dasto b\u00fdv\u00e1. Bezpe\u010dnostn\u00ed audit je proces zmapov\u00e1n\u00ed aktu\u00e1ln\u00edho stavu bezpe\u010dnosti dat a hled\u00e1n\u00ed cest k n\u00e1prav\u011b nalezen\u00fdch nedostatk\u016f a zlep\u0161en\u00ed st\u00e1vaj\u00edc\u00edho stavu. V\u00fdstupem je jasn\u00e1 zpr\u00e1va CO konkr\u00e9tn\u011b pot\u0159ebuje firma prov\u00e9st za zm\u011bny a JAK\u00dd je smysl t\u011bchto zm\u011bn s respektov\u00e1n\u00edm b\u011b\u017en\u00e9ho provozu v podniku, re\u00e1ln\u00e9 hodnoty spravovan\u00fdch dat a s rozumn\u00fdm zhodnocen\u00edm potenci\u00e1ln\u00edch rizik. Pot\u00e9 lze p\u0159istoupit k pl\u00e1nov\u00e1n\u00ed investic do bezpe\u010dnosti dat s pln\u00fdm v\u011bdom\u00edm v\u0161ech z\u00fa\u010dastn\u011bn\u00fdch, pro\u010d se tak d\u011bje. U\u017eivatel\u00e9 si budou v\u011bdomi, jak\u00e9 zm\u011bny nastanou v jejich b\u011b\u017en\u00e9m pou\u017e\u00edv\u00e1n\u00ed v\u00fdpo\u010detn\u00ed techniky a co je jejich d\u016fvodem. IT odd\u011blen\u00ed bude v\u011bd\u011bt, jak pracn\u00e9 bude realizovat navr\u017een\u00e9 zm\u011bny z pohledu implementace, n\u00e1sledn\u00e9 \u00fadr\u017eby a provozu. Veden\u00ed spole\u010dnosti \u010di majitel\u00e9 budou sezn\u00e1meni s t\u00edm, pro\u010d tyto konkr\u00e9tn\u00ed n\u00e1klady maj\u00ed vynalo\u017eit. <\/p>\n\n\n\n
Ve chv\u00edli, kdy m\u00e1me jasno v ot\u00e1zk\u00e1ch bezpe\u010dnostn\u00ed politiky, v\u00edme, nakolik ji spl\u0148ujeme a kde n\u00e1s naopak bota tla\u010d\u00ed, m\u016f\u017eeme za\u010d\u00edt uva\u017eovat o tom, jak\u00e9 technick\u00e9 prost\u0159edky n\u00e1m pomohou tyto nedostatky odstranit. I v t\u00e9to oblasti bych apeloval na \u201ezdrav\u00fd selsk\u00fd rozum\u201c. Jist\u011b je l\u00e1kav\u00e9 nakoupit high-end bezpe\u010dnostn\u00ed syst\u00e9my a za\u0159\u00edzen\u00ed, ale p\u0159ed n\u00e1kupem bychom m\u011bli m\u00edt p\u0159edstavu CO chceme \u0159e\u0161it a JAKOU M\u00cdRU bezpe\u010dnosti chceme dos\u00e1hnout. Jin\u00e1 m\u00edra bezpe\u010dnosti bude rozumn\u00e1 v bance a jin\u00e1 ve v\u00fdrobn\u00edm podniku. R\u016fzn\u00e9 organizace budou definovat odli\u0161n\u00e9 druhy dat jako kritick\u00e9. V\u017edy je t\u0159eba m\u00edt na pam\u011bti, \u017ee neexistuje obecn\u011b platn\u00e1 definice bezpe\u010dnost\u00ed politiky, obecn\u00e1 \u0161ablona bezpe\u010dnostn\u00edho auditu a obecn\u00fd seznam hardwarov\u00fdch a softwarov\u00fdch prost\u0159edk\u016f ochrany dat a informa\u010dn\u00edch syst\u00e9m\u016f. V\u017edy budete \u0159e\u0161it tuto problematiku pr\u00e1v\u011b pro va\u0161e prost\u0159ed\u00ed a jen s v\u011bdom\u00edm neopakovatelnosti v t\u00e9to oblasti budete schopni dos\u00e1hnout stavu bl\u00edzk\u00e9ho ide\u00e1ln\u00edmu zabezpe\u010den\u00ed va\u0161ich dat a IT. <\/p>\n\n\n\n
Na z\u00e1v\u011br bych r\u00e1d p\u0159ipomn\u011bl, \u017ee i doma dnes jist\u011b m\u00e1te IT prost\u0159ed\u00ed, by\u0165 miniaturn\u00ed a \u017ee i dom\u00e1c\u00ed IT by m\u011blo respektovat alespo\u0148 z\u00e1kladn\u00ed principy bezpe\u010dnosti. Jako mal\u00fd dom\u00e1c\u00ed \u00fakol si zkuste definovat, jak\u00e9 hrozby \u010d\u00edhaj\u00ed na va\u0161e \u201emal\u00e9 dom\u00e1c\u00ed IT\u201c, jak\u00e1 data vytv\u00e1\u0159\u00edte a uchov\u00e1v\u00e1te doma, co by znamenala jejich ztr\u00e1ta \u010di zni\u010den\u00ed. Definujte si, do jak\u00fdch prost\u0159edk\u016f pro zabezpe\u010den\u00ed dat chcete investovat s ohledem pr\u00e1v\u011b na cenu dat. Toto mal\u00e9 dom\u00e1c\u00ed cvi\u010den\u00ed v\u00e1m pom\u016f\u017ee k pochopen\u00ed v\u00fd\u0161e uveden\u00fdch princip\u016f a pravidel p\u0159ed jejich aplikac\u00ed v mnohem rozs\u00e1hlej\u0161\u00ed d\u017eungli podnikov\u00e9ho IT. <\/p>\n","protected":false},"excerpt":{"rendered":"
V dne\u0161n\u00ed dob\u011b, kdy v\u011bt\u0161ina firem uchov\u00e1v\u00e1 sv\u00e9 obchodn\u00ed, \u00fa\u010detn\u00ed a dal\u0161\u00ed, pro podnik\u00e1n\u00ed podstatn\u00e9 informace, v elektronick\u00e9 podob\u011b, je na m\u00edst\u011b se zamyslet nad ochranou t\u011bchto dat. Majitel\u00e9 a mana\u017ee\u0159i firem, stejn\u011b jako jednotliv\u00ed u\u017eivatel\u00e9, jsou p\u0159esv\u011bd\u010dov\u00e1ni neutuchaj\u00edc\u00ed medi\u00e1ln\u00ed a marketingovou mas\u00e1\u017e\u00ed, co je k\u00fd\u017eenou cestou k bezpe\u010dnosti jejich dat. Tato kampa\u0148 je intenzivn\u011b […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ocean_post_layout":"","ocean_both_sidebars_style":"","ocean_both_sidebars_content_width":0,"ocean_both_sidebars_sidebars_width":0,"ocean_sidebar":"","ocean_second_sidebar":"","ocean_disable_margins":"enable","ocean_add_body_class":"","ocean_shortcode_before_top_bar":"","ocean_shortcode_after_top_bar":"","ocean_shortcode_before_header":"","ocean_shortcode_after_header":"","ocean_has_shortcode":"","ocean_shortcode_after_title":"","ocean_shortcode_before_footer_widgets":"","ocean_shortcode_after_footer_widgets":"","ocean_shortcode_before_footer_bottom":"","ocean_shortcode_after_footer_bottom":"","ocean_display_top_bar":"default","ocean_display_header":"default","ocean_header_style":"","ocean_center_header_left_menu":"","ocean_custom_header_template":"","ocean_custom_logo":0,"ocean_custom_retina_logo":0,"ocean_custom_logo_max_width":0,"ocean_custom_logo_tablet_max_width":0,"ocean_custom_logo_mobile_max_width":0,"ocean_custom_logo_max_height":0,"ocean_custom_logo_tablet_max_height":0,"ocean_custom_logo_mobile_max_height":0,"ocean_header_custom_menu":"","ocean_menu_typo_font_family":"","ocean_menu_typo_font_subset":"","ocean_menu_typo_font_size":0,"ocean_menu_typo_font_size_tablet":0,"ocean_menu_typo_font_size_mobile":0,"ocean_menu_typo_font_size_unit":"px","ocean_menu_typo_font_weight":"","ocean_menu_typo_font_weight_tablet":"","ocean_menu_typo_font_weight_mobile":"","ocean_menu_typo_transform":"","ocean_menu_typo_transform_tablet":"","ocean_menu_typo_transform_mobile":"","ocean_menu_typo_line_height":0,"ocean_menu_typo_line_height_tablet":0,"ocean_menu_typo_line_height_mobile":0,"ocean_menu_typo_line_height_unit":"","ocean_menu_typo_spacing":0,"ocean_menu_typo_spacing_tablet":0,"ocean_menu_typo_spacing_mobile":0,"ocean_menu_typo_spacing_unit":"","ocean_menu_link_color":"","ocean_menu_link_color_hover":"","ocean_menu_link_color_active":"","ocean_menu_link_background":"","ocean_menu_link_hover_background":"","ocean_menu_link_active_background":"","ocean_menu_social_links_bg":"","ocean_menu_social_hover_links_bg":"","ocean_menu_social_links_color":"","ocean_menu_social_hover_links_color":"","ocean_disable_title":"default","ocean_disable_heading":"default","ocean_post_title":"","ocean_post_subheading":"","ocean_post_title_style":"","ocean_post_title_background_color":"","ocean_post_title_background":0,"ocean_post_title_bg_image_position":"","ocean_post_title_bg_image_attachment":"","ocean_post_title_bg_image_repeat":"","ocean_post_title_bg_image_size":"","ocean_post_title_height":0,"ocean_post_title_bg_overlay":0.5,"ocean_post_title_bg_overlay_color":"","ocean_disable_breadcrumbs":"default","ocean_breadcrumbs_color":"","ocean_breadcrumbs_separator_color":"","ocean_breadcrumbs_links_color":"","ocean_breadcrumbs_links_hover_color":"","ocean_display_footer_widgets":"default","ocean_display_footer_bottom":"default","ocean_custom_footer_template":"","ocean_post_oembed":"","ocean_post_self_hosted_media":"","ocean_post_video_embed":"","ocean_link_format":"","ocean_link_format_target":"self","ocean_quote_format":"","ocean_quote_format_link":"post","ocean_gallery_link_images":"on","ocean_gallery_id":[],"footnotes":""},"categories":[5],"tags":[],"class_list":["post-122","post","type-post","status-publish","format-standard","hentry","category-technologie","entry"],"yoast_head":"\n