{"id":2867,"date":"2026-07-13T02:27:03","date_gmt":"2026-07-13T02:27:03","guid":{"rendered":"https:\/\/govelocks.com\/?p=2867"},"modified":"2026-07-13T02:27:04","modified_gmt":"2026-07-13T02:27:04","slug":"remote-access-vulnerabilities","status":"publish","type":"post","link":"https:\/\/govelocks.com\/vi\/remote-access-vulnerabilities\/","title":{"rendered":"C\u00e1c l\u1ed7 h\u1ed5ng truy c\u1eadp t\u1eeb xa: R\u1ee7i ro k\u1ef9 thu\u1eadt v\u00e0 tu\u00e2n th\u1ee7 NIST"},"content":{"rendered":"<p>Truy c\u1eadp t\u1eeb xa hi\u1ec7n l\u00e0 \u0111i\u1ec3m truy c\u1eadp h\u00e0ng \u0111\u1ea7u cho ransomware, \u0111\u01b0\u1ee3c x\u00e1c nh\u1eadn b\u1edfi d\u1eef li\u1ec7u ph\u1ea3n \u1ee9ng s\u1ef1 c\u1ed1 n\u0103m 2024. B\u01b0\u1edbc \u0111\u1ea7u ti\u00ean \u0111\u1ec3 \u0111\u00f3ng <strong>l\u1ed7 h\u1ed5ng truy c\u1eadp t\u1eeb xa<\/strong> l\u00e0 t\u1eeb ch\u1ed1i quan ni\u1ec7m l\u1ed7i th\u1eddi r\u1eb1ng m\u1ed9t thi\u1ebft b\u1ecb b\u00ean trong v\u00f9ng an to\u00e0n l\u00e0 an to\u00e0n.<\/p>\n<ul>\n<li>X\u00e1c minh danh t\u00ednh, t\u00ecnh tr\u1ea1ng thi\u1ebft b\u1ecb v\u00e0 quy\u1ec1n truy c\u1eadp tr\u01b0\u1edbc khi c\u1ea5p k\u1ebft n\u1ed1i \u2014 kh\u00f4ng ph\u1ea3i sau.<\/li>\n<li>Thay th\u1ebf s\u1ef1 tin t\u01b0\u1edfng ng\u1ea7m \u0111\u1ecbnh b\u1eb1ng vi\u1ec7c x\u00e1c minh li\u00ean t\u1ee5c cho m\u1ed7i phi\u00ean l\u00e0m vi\u1ec7c.<\/li>\n<li>X\u1eed l\u00fd m\u1ecdi k\u1ebft n\u1ed1i t\u1eeb xa nh\u01b0 m\u1ed9t \u0111i\u1ec3m ti\u1ec1m n\u0103ng b\u1ecb x\u00e2m ph\u1ea1m cho \u0111\u1ebfn khi \u0111\u01b0\u1ee3c ch\u1ee9ng minh ng\u01b0\u1ee3c l\u1ea1i.<\/li>\n<\/ul>\n<h2>C\u1ea5u tr\u00fac c\u1ee7a m\u1ed9t v\u1ee5 x\u00e2m ph\u1ea1m truy c\u1eadp t\u1eeb xa<\/h2>\n<p>Truy c\u1eadp t\u1eeb xa l\u00e0 \u0111i\u1ec3m truy c\u1eadp h\u00e0ng \u0111\u1ea7u cho ransomware, nh\u01b0 \u0111\u00e3 x\u00e1c nh\u1eadn b\u1edfi d\u1eef li\u1ec7u ph\u1ea3n \u1ee9ng s\u1ef1 c\u1ed1 ng\u00e0nh n\u0103m 2024. K\u1ebb t\u1ea5n c\u00f4ng hi\u1ebfm khi x\u00e2m nh\u1eadp tr\u1ef1c ti\u1ebfp qua t\u01b0\u1eddng l\u1eeda th\u1ebf h\u1ec7 m\u1edbi hi\u1ec7n \u0111\u1ea1i. Thay v\u00e0o \u0111\u00f3, h\u1ecd t\u00ecm ki\u1ebfm m\u1ed9t c\u1ed5ng VPN ch\u01b0a v\u00e1 l\u1ed7i, s\u1eed d\u1ee5ng th\u00f4ng tin \u0111\u0103ng nh\u1eadp b\u1ecb \u0111\u00e1nh c\u1eafp tr\u00ean c\u1ed5ng RDP d\u1ec5 b\u1ecb l\u1ed9, ho\u1eb7c khai th\u00e1c m\u1ed9t c\u00f4ng c\u1ee5 t\u1eeb xa c\u1ea5u h\u00ecnh sai \u0111\u1ec3 c\u00f3 \u0111\u01b0\u1ee3c \u0111i\u1ec3m \u0111\u1ee9ng ban \u0111\u1ea7u.<\/p>\n<p>M\u1ed9t khi \u0111\u00e3 v\u00e0o trong, m\u1ee5c ti\u00eau c\u1ee7a h\u1ecd l\u00e0 di chuy\u1ec3n ngang \u2014 nh\u1ea3y t\u1eeb \u0111i\u1ec3m b\u1ecb x\u00e2m ph\u1ea1m ban \u0111\u1ea7u \u0111\u1ebfn c\u00e1c m\u00e1y ch\u1ee7 gi\u00e1 tr\u1ecb cao, b\u1ed9 \u0111i\u1ec1u khi\u1ec3n mi\u1ec1n ho\u1eb7c c\u00e1c t\u00e0i s\u1ea3n OT quan tr\u1ecdng. H\u1ecd th\u01b0\u1eddng s\u1eed d\u1ee5ng c\u00e1c k\u1ef9 thu\u1eadt \u201cs\u1ed1ng s\u00f3t tr\u00ean \u0111\u1ea5t\u201d (LotL), t\u1eadn d\u1ee5ng c\u00e1c c\u00f4ng c\u1ee5 h\u1ee3p ph\u00e1p nh\u01b0 PowerShell ho\u1eb7c Windows Management Instrumentation \u0111\u1ec3 tr\u00e1nh k\u00edch ho\u1ea1t h\u1ec7 th\u1ed1ng ph\u00e1t hi\u1ec7n \u0111i\u1ec3m cu\u1ed1i.<\/p>\n<p>Kh\u00f4ng c\u00f3 ph\u00e2n \u0111o\u1ea1n m\u1ea1ng chi ti\u1ebft v\u00e0 ki\u1ec3m so\u00e1t truy c\u1eadp \u0111\u00fang th\u1eddi \u0111i\u1ec3m, m\u1ed9t phi\u00ean l\u00e0m vi\u1ec7c t\u1eeb xa b\u1ecb x\u00e2m ph\u1ea1m c\u00f3 th\u1ec3 cho ph\u00e9p k\u1ebb x\u00e2m nh\u1eadp ti\u1ebfp c\u1eadn r\u1ed9ng r\u00e3i trong n\u1ed9i b\u1ed9.<\/p>\n<p>Sai l\u1ea7m nghi\u00eam tr\u1ecdng l\u00e0 xem truy c\u1eadp t\u1eeb xa nh\u01b0 m\u1ed9t v\u1ea5n \u0111\u1ec1 k\u1ebft n\u1ed1i ch\u1ee9 kh\u00f4ng ph\u1ea3i v\u1ea5n \u0111\u1ec1 ki\u1ebfn tr\u00fac an ninh. C\u00e1c ki\u1ebfn tr\u00fac truy\u1ec1n th\u1ed1ng tin t\u01b0\u1edfng m\u1ecdi th\u1ee9 b\u00ean trong m\u1ea1ng LAN doanh nghi\u1ec7p. An ninh hi\u1ec7n \u0111\u1ea1i y\u00eau c\u1ea7u x\u00e1c minh li\u00ean t\u1ee5c cho m\u1ecdi l\u1ea7n c\u1ed1 g\u1eafng k\u1ebft n\u1ed1i, b\u1ea5t k\u1ec3 IP ngu\u1ed3n ho\u1eb7c v\u1ecb tr\u00ed m\u1ea1ng.<\/p>\n<p>Trong khi h\u01b0\u1edbng d\u1eabn n\u00e0y t\u1eadp trung v\u00e0o c\u00e1c l\u1ed7 h\u1ed5ng \u1edf l\u1edbp m\u1ea1ng, c\u00e1c nguy\u00ean t\u1eafc v\u1ec7 sinh danh t\u00ednh t\u01b0\u01a1ng t\u1ef1 c\u0169ng \u00e1p d\u1ee5ng cho truy c\u1eadp v\u1eadt l\u00fd. C\u00e1c <a href=\"https:\/\/govelocks.com\/vi\/products\/\">gi\u1ea3i ph\u00e1p ki\u1ec3m so\u00e1t truy c\u1eadp n\u00e2ng cao<\/a> cho ph\u00e9p th\u1ef1c thi ch\u00ednh s\u00e1ch th\u1ed1ng nh\u1ea5t tr\u00ean c\u00e1c c\u1eeda, t\u1ee7 v\u00e0 gi\u00e1 \u0111\u1ee1 m\u00e1y ch\u1ee7, gi\u1ea3m thi\u1ec3u r\u1ee7i ro truy c\u1eadp v\u1eadt l\u00fd tr\u00e1i ph\u00e9p c\u00f3 th\u1ec3 b\u1ed5 sung cho m\u1ed9t v\u1ee5 x\u00e2m ph\u1ea1m h\u1ee3p l\u00fd.<\/p>\n<p>\u0110\u1ec3 c\u00f3 c\u00e1i nh\u00ecn to\u00e0n di\u1ec7n h\u01a1n v\u1ec1 xu h\u01b0\u1edbng an ninh truy c\u1eadp, h\u00e3y truy c\u1eadp v\u00e0o c\u00e1c <a href=\"https:\/\/govelocks.com\/vi\/industry-knowledge\/\">ngu\u1ed3n th\u00f4ng tin ng\u00e0nh v\u1ec1 tu\u00e2n th\u1ee7 NIST v\u00e0 CMMC<\/a>.<\/p>\n<h2>8 L\u1ed7 h\u1ed5ng truy c\u1eadp t\u1eeb xa quan tr\u1ecdng trong doanh nghi\u1ec7p<\/h2>\n<p>C\u00e1c l\u1ed7 h\u1ed5ng sau \u0111\u00e2y \u0111\u1ea1i di\u1ec7n cho nh\u1eefng kho\u1ea3ng tr\u1ed1ng d\u1ec5 b\u1ecb khai th\u00e1c nh\u1ea5t trong h\u1ea1 t\u1ea7ng truy c\u1eadp t\u1eeb xa. \u0110\u1ed1i v\u1edbi t\u1eebng l\u1ed7 h\u1ed5ng, ch\u00fang t\u00f4i n\u00eau r\u00f5 nh\u1eefng g\u00ec c\u1ea7n x\u00e1c minh trong qu\u00e1 tr\u00ecnh ki\u1ec3m tra an ninh v\u00e0 sai l\u1ea7m m\u00e0 c\u00e1c nh\u00f3m an ninh th\u01b0\u1eddng m\u1eafc ph\u1ea3i.<\/p>\n<h3>1. B\u1ed9 t\u1eadp trung VPN v\u00e0 c\u1ed5ng k\u1ebft n\u1ed1i ch\u01b0a v\u00e1 l\u1ed7i<\/h3>\n<p>Thi\u1ebft b\u1ecb VPN\u2014d\u00f9 d\u1ef1a tr\u00ean ph\u1ea7n c\u1ee9ng hay \u1ea3o\u2014\u0111\u1ec1u ti\u1ebfp x\u00fac tr\u1ef1c ti\u1ebfp v\u1edbi internet v\u00e0 \u0111\u00e3 tr\u1edf th\u00e0nh m\u1ee5c ti\u00eau ch\u00ednh c\u1ee7a c\u00e1c t\u00e1c nh\u00e2n nh\u00e0 n\u01b0\u1edbc v\u00e0 t\u1ed9i ph\u1ea1m. C\u00e1c CVE cho c\u00e1c s\u1ea3n ph\u1ea9m VPN h\u00e0ng \u0111\u1ea7u \u0111\u00e3 b\u1ecb khai th\u00e1c t\u00edch c\u1ef1c trong v\u00f2ng v\u00e0i gi\u1edd sau khi ti\u1ebft l\u1ed9, th\u01b0\u1eddng tr\u01b0\u1edbc khi c\u00e1c b\u1ea3n v\u00e1 \u0111\u01b0\u1ee3c \u00e1p d\u1ee5ng.<\/p>\n<ul>\n<li><strong>Nh\u1eefng \u0111i\u1ec1u c\u1ea7n x\u00e1c minh:<\/strong> Phi\u00ean b\u1ea3n firmware hi\u1ec7n t\u1ea1i so v\u1edbi c\u00e1c c\u1ea3nh b\u00e1o b\u1ea3o m\u1eadt c\u1ee7a nh\u00e0 cung c\u1ea5p.<\/li>\n<li>Ki\u1ec3m tra c\u00e1c thi\u1ebft b\u1ecb ph\u1ea7n c\u1ee9ng \u0111\u00e3 h\u1ebft h\u1ea1n s\u1eed d\u1ee5ng v\u00e0 kh\u00f4ng c\u00f2n nh\u1eadn \u0111\u01b0\u1ee3c c\u1eadp nh\u1eadt.<\/li>\n<li>X\u00e1c nh\u1eadn r\u1eb1ng c\u00e1c giao di\u1ec7n qu\u1ea3n l\u00fd kh\u00f4ng b\u1ecb ph\u01a1i b\u00e0y tr\u00ean internet c\u00f4ng c\u1ed9ng.<\/li>\n<\/ul>\n<p>M\u1ed9t trong nh\u1eefng s\u01a1 su\u1ea5t g\u00e2y thi\u1ec7t h\u1ea1i l\u1edbn nh\u1ea5t l\u00e0 xem c\u00e1c c\u1ed5ng VPN nh\u01b0 c\u00e1c thi\u1ebft b\u1ecb tri\u1ec3n khai v\u00e0 qu\u00ean \u0111i. VPN kh\u00f4ng \u0111\u01b0\u1ee3c v\u00e1 l\u1ed7i cung c\u1ea5p m\u1ed9t \u0111\u01b0\u1eddng h\u1ea7m tr\u1ef1c ti\u1ebfp v\u00e0o m\u1ea1ng doanh nghi\u1ec7p, b\u1ecf qua h\u1ea7u h\u1ebft c\u00e1c l\u1edbp ph\u00f2ng th\u1ee7 bi\u00ean gi\u1edbi.<\/p>\n<h3>2. RDP (Giao th\u1ee9c \u0110i\u1ec1u khi\u1ec3n M\u00e1y t\u00ednh T\u1eeb xa) qu\u00e1 d\u1ec5 d\u00e0ng cho ph\u00e9p truy c\u1eadp<\/h3>\n<p>RDP v\u1eabn l\u00e0 m\u1ed9t trong nh\u1eefng ph\u01b0\u01a1ng th\u1ee9c ph\u1ed5 bi\u1ebfn nh\u1ea5t \u0111\u1ec3 ph\u00e1t t\u00e1n ph\u1ea7n m\u1ec1m t\u1ed1ng ti\u1ec1n. K\u1ebb t\u1ea5n c\u00f4ng qu\u00e9t c\u1ed5ng m\u1edf 3389 v\u00e0 th\u1ef1c hi\u1ec7n c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng brute-force ho\u1eb7c khai th\u00e1c c\u00e1c l\u1ed7 h\u1ed5ng \u0111\u00e3 bi\u1ebft trong c\u00e1c phi\u00ean b\u1ea3n RDP c\u0169 h\u01a1n. Ngay c\u1ea3 v\u1edbi m\u1eadt kh\u1ea9u m\u1ea1nh, n\u1ebfu kh\u00f4ng c\u00f3 x\u00e1c th\u1ef1c c\u1ea5p m\u1ea1ng (NLA) v\u00e0 gi\u1edbi h\u1ea1n IP ngu\u1ed3n, m\u1ee9c \u0111\u1ed9 ph\u01a1i nhi\u1ec5m l\u00e0 \u0111\u00e1ng k\u1ec3.<\/p>\n<ul>\n<li><strong>Ki\u1ec3m tra k\u1ef9 thu\u1eadt \u0111\u1ec3 x\u00e1c \u0111\u1ecbnh ph\u01a1i nhi\u1ec5m RDP:<\/strong> X\u00e1c nh\u1eadn r\u1eb1ng RDP kh\u00f4ng b\u1ecb ph\u01a1i b\u00e0y tr\u1ef1c ti\u1ebfp ra internet.<\/li>\n<li>\u0110\u1ea3m b\u1ea3o r\u1eb1ng NLA \u0111\u01b0\u1ee3c th\u1ef1c thi v\u00e0 ch\u1ec9 s\u1eed d\u1ee5ng c\u00e1c m\u00e1y trung chuy\u1ec3n c\u1ee5 th\u1ec3.<\/li>\n<li>Xem x\u00e9t c\u00e1c quy t\u1eafc t\u01b0\u1eddng l\u1eeda \u0111\u1ec3 ph\u00e1t hi\u1ec7n truy c\u1eadp RDP tr\u00e1i ph\u00e9p.<\/li>\n<\/ul>\n<p>D\u1ef1a v\u00e0o RDP \u0111\u1ec3 qu\u1ea3n tr\u1ecb t\u1eeb xa m\u00e0 kh\u00f4ng c\u00f3 d\u1ecbch v\u1ee5 gateway nh\u01b0 Remote Desktop Gateway (RD Gateway) ho\u1eb7c proxy phi\u00ean zero-trust l\u00e0 m\u1ed9t ngu\u1ed3n th\u01b0\u1eddng xuy\u00ean g\u00e2y x\u00e2m nh\u1eadp.<\/p>\n<h3>3. Thi\u1ebfu x\u00e1c th\u1ef1c \u0111a y\u1ebfu t\u1ed1 (MFA) theo ng\u1eef c\u1ea3nh<\/h3>\n<p>Nhi\u1ec1u t\u1ed5 ch\u1ee9c \u0111\u00e3 tri\u1ec3n khai MFA, nh\u01b0ng k\u1ebb t\u1ea5n c\u00f4ng \u0111\u00e3 th\u00edch nghi. C\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng b\u1eb1ng ph\u01b0\u01a1ng ph\u00e1p push bombing, \u0111\u1ed5i SIM, v\u00e0 phishing trung gian c\u00f3 th\u1ec3 v\u01b0\u1ee3t qua c\u00e1c tri\u1ec3n khai c\u01a1 b\u1ea3n. MFA theo ng\u1eef c\u1ea3nh\u2014\u0111\u00e1nh gi\u00e1 s\u1ef1 tu\u00e2n th\u1ee7 c\u1ee7a thi\u1ebft b\u1ecb, v\u1ecb tr\u00ed \u0111\u1ecba l\u00fd v\u00e0 h\u00e0nh vi ng\u01b0\u1eddi d\u00f9ng\u2014cung c\u1ea5p m\u1ee9c \u0111\u1ed9 b\u1ea3o v\u1ec7 m\u1ea1nh h\u01a1n.<\/p>\n<ul>\n<li><strong>C\u00e1c ki\u1ec3m tra ki\u1ec3m to\u00e1n ch\u00ednh v\u1ec1 MFA:<\/strong> \u0110\u1ea3m b\u1ea3o MFA \u0111\u01b0\u1ee3c th\u1ef1c thi cho t\u1ea5t c\u1ea3 c\u00e1c ph\u01b0\u01a1ng th\u1ee9c truy c\u1eadp t\u1eeb xa, bao g\u1ed3m VPN, RDP v\u00e0 c\u00e1c \u1ee9ng d\u1ee5ng web.<\/li>\n<li>X\u00e1c nh\u1eadn r\u1eb1ng c\u00e1c nh\u1eafc nh\u1edf MFA li\u00ean k\u1ebft v\u1edbi ki\u1ec3m tra tr\u1ea1ng th\u00e1i thi\u1ebft b\u1ecb (v\u00ed d\u1ee5: EDR \u0111ang ch\u1ea1y, m\u1ee9c v\u00e1 c\u1ee7a h\u1ec7 \u0111i\u1ec1u h\u00e0nh).<\/li>\n<li>X\u00e1c nh\u1eadn r\u1eb1ng c\u00e1c ch\u00ednh s\u00e1ch truy c\u1eadp \u0111i\u1ec1u ki\u1ec7n \u0111i\u1ec1u ch\u1ec9nh \u0111\u1ed9ng m\u1ee9c \u0111\u1ed9 x\u00e1c th\u1ef1c d\u1ef1a tr\u00ean c\u00e1c t\u00edn hi\u1ec7u r\u1ee7i ro.<\/li>\n<\/ul>\n<p>X\u1eed l\u00fd MFA nh\u01b0 m\u1ed9t \u00f4 checkbox thay v\u00ec ki\u1ec3m so\u00e1t d\u1ef1a tr\u00ean r\u1ee7i ro l\u00e0 m\u1ed9t thi\u1ebfu s\u00f3t ph\u1ed5 bi\u1ebfn. \u0110\u1ed1i v\u1edbi c\u00e1c phi\u00ean c\u00f3 r\u1ee7i ro cao\u2014ch\u1eb3ng h\u1ea1n nh\u01b0 truy c\u1eadp v\u00e0o c\u00e1c b\u1ed9 \u0111i\u1ec1u khi\u1ec3n mi\u1ec1n ho\u1eb7c m\u1ea1ng OT\u2014c\u00e1c b\u01b0\u1edbc x\u00e1c minh b\u1ed5 sung nh\u01b0 token FIDO2 ch\u1ed1ng phishing l\u00e0 c\u1ea7n thi\u1ebft.<\/p>\n<h3>4. R\u1ee7i ro T\u00e1ch Tunnels v\u00e0 Di chuy\u1ec3n Lateral<\/h3>\n<p>T\u00e1ch tunneling cho ph\u00e9p ng\u01b0\u1eddi d\u00f9ng t\u1eeb xa truy c\u1eadp v\u00e0o c\u00e1c t\u00e0i nguy\u00ean internet c\u00f4ng c\u1ed9ng m\u00e0 kh\u00f4ng c\u1ea7n \u0111\u1ecbnh tuy\u1ebfn qua VPN doanh nghi\u1ec7p. Trong khi n\u00f3 c\u1ea3i thi\u1ec7n hi\u1ec7u su\u1ea5t, n\u00f3 b\u1ecf qua c\u00e1c ki\u1ec3m so\u00e1t l\u1ecdc n\u1ed9i dung, ph\u00f2ng ch\u1ed1ng x\u00e2m nh\u1eadp v\u00e0 trung gian b\u1ea3o m\u1eadt truy c\u1eadp \u0111\u00e1m m\u00e2y (CASB).<\/p>\n<p>Quan tr\u1ecdng h\u01a1n, n\u1ebfu c\u00e0i \u0111\u1eb7t VPN cho ph\u00e9p truy c\u1eadp \u0111\u1ea7y \u0111\u1ee7 Layer 3 v\u00e0o m\u1ea1ng LAN c\u1ee7a doanh nghi\u1ec7p, b\u1ea5t k\u1ef3 ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i n\u00e0o tr\u00ean \u0111i\u1ec3m cu\u1ed1i \u0111\u00f3 \u0111\u1ec1u c\u00f3 th\u1ec3 chuy\u1ec3n h\u01b0\u1edbng tr\u1ef1c ti\u1ebfp \u0111\u1ebfn c\u00e1c m\u00e1y ch\u1ee7 n\u1ed9i b\u1ed9.<\/p>\n<ul>\n<li><strong>C\u00e0i \u0111\u1eb7t VPN c\u1ea7n ki\u1ec3m tra:<\/strong> \u0110\u1ea3m b\u1ea3o b\u1eadt l\u1ecdc l\u01b0u l\u01b0\u1ee3ng n\u1ed9i b\u1ed9 giao di\u1ec7n (th\u01b0\u1eddng g\u1ecdi l\u00e0 \u201cVPN filter\u201d ho\u1eb7c \u201cdanh s\u00e1ch truy c\u1eadp\u201d).<\/li>\n<li>\u0110\u00e1nh gi\u00e1 xem t\u00e1ch tunneling c\u00f3 h\u1ee3p l\u00fd v\u00ec l\u00fd do kinh doanh hay kh\u00f4ng; n\u1ebfu b\u1eadt, c\u1ea7n th\u1ef1c thi b\u1ea3o m\u1eadt c\u1ea5p DNS v\u00e0 b\u1ea3o v\u1ec7 bi\u00ean \u0111\u00e1m m\u00e2y.<\/li>\n<li>L\u1eadp b\u1ea3n \u0111\u1ed3 c\u00e1c m\u1ee9c \u0111\u1ed9 tin c\u1eady ng\u1ee5 \u00fd: m\u1ed9t VPN kh\u00f4ng n\u00ean c\u1ea5p quy\u1ec1n truy c\u1eadp to\u00e0n b\u1ed9 subnet theo m\u1eb7c \u0111\u1ecbnh.<\/li>\n<\/ul>\n<p>B\u1eadt t\u00e1ch tunneling m\u00e0 kh\u00f4ng c\u00f3 c\u00e1c ki\u1ec3m so\u00e1t b\u1ea3o m\u1eadt \u0111i\u1ec3m cu\u1ed1i t\u01b0\u01a1ng \u0111\u01b0\u01a1ng t\u1ea1o ra m\u1ed9t \u0111\u01b0\u1eddng m\u00f2n b\u00f3ng t\u1ed1i cho l\u01b0u l\u01b0\u1ee3ng \u0111i\u1ec1u khi\u1ec3n v\u00e0 l\u1ec7nh c\u1ee7a ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i \u0111\u1ed3ng th\u1eddi l\u00e0m l\u1ed9 c\u00e1c t\u00e0i s\u1ea3n n\u1ed9i b\u1ed9.<\/p>\n<h3>5. C\u00f4ng c\u1ee5 Truy c\u1eadp t\u1eeb xa \u201cB\u00f3ng t\u1ed1i\u201d kh\u00f4ng qu\u1ea3n l\u00fd<\/h3>\n<p>Khi IT xem x\u00e9t truy c\u1eadp t\u1eeb xa, h\u1ecd ngh\u0129 \u0111\u1ebfn VPN doanh nghi\u1ec7p v\u00e0 c\u00e1c c\u00f4ng c\u1ee5 \u0111i\u1ec1u khi\u1ec3n t\u1eeb xa \u0111\u01b0\u1ee3c ph\u00ea duy\u1ec7t. Nh\u01b0ng c\u00e1c nh\u00f3m k\u1ef9 thu\u1eadt, nh\u00e0 th\u1ea7u v\u00e0 nh\u00e0 cung c\u1ea5p b\u00ean th\u1ee9 ba th\u01b0\u1eddng c\u00e0i \u0111\u1eb7t c\u00e1c ti\u1ec7n \u00edch t\u1eeb xa c\u1ee7a ri\u00eang h\u1ecd\u2014TeamViewer, AnyDesk, LogMeIn ho\u1eb7c c\u00e1c bi\u1ebfn th\u1ec3 VNC\u2014m\u00e0 kh\u00f4ng c\u00f3 s\u1ef1 gi\u00e1m s\u00e1t b\u1ea3o m\u1eadt.<\/p>\n<p>Nh\u1eefng c\u00f4ng c\u1ee5 \u201cIT b\u00f3ng t\u1ed1i\u201d n\u00e0y th\u01b0\u1eddng thi\u1ebfu ghi nh\u1eadt k\u00fd t\u1eadp trung, x\u00e1c th\u1ef1c m\u1ea1nh ho\u1eb7c ghi l\u1ea1i phi\u00ean l\u00e0m vi\u1ec7c.<\/p>\n<ul>\n<li><strong>C\u00e1c b\u01b0\u1edbc ph\u00e1t hi\u1ec7n:<\/strong> Th\u1ed1ng k\u00ea t\u1ea5t c\u1ea3 ph\u1ea7n m\u1ec1m truy c\u1eadp t\u1eeb xa tr\u00ean c\u00e1c \u0111i\u1ec3m cu\u1ed1i b\u1eb1ng m\u1ed9t t\u00e1c nh\u00e2n ph\u00e1t hi\u1ec7n ho\u1eb7c ph\u00e2n t\u00edch m\u1ea1ng.<\/li>\n<li>Th\u1ef1c thi danh s\u00e1ch cho ph\u00e9p \u1ee9ng d\u1ee5ng \u0111\u1ec3 ch\u1eb7n c\u00e1c c\u00f4ng c\u1ee5 truy c\u1eadp t\u1eeb xa kh\u00f4ng \u0111\u01b0\u1ee3c ph\u00e9p.<\/li>\n<li>\u0110\u1ed1i v\u1edbi c\u00e1c c\u00f4ng c\u1ee5 c\u1ee7a b\u00ean th\u1ee9 ba \u0111\u00e3 \u0111\u01b0\u1ee3c ph\u00ea duy\u1ec7t, b\u1eaft bu\u1ed9c t\u00edch h\u1ee3p v\u1edbi nh\u00e0 cung c\u1ea5p danh t\u00ednh doanh nghi\u1ec7p v\u00e0 y\u00eau c\u1ea7u x\u00e1c th\u1ef1c \u0111a y\u1ebfu t\u1ed1 (MFA).<\/li>\n<\/ul>\n<p>Cho ph\u00e9p truy c\u1eadp t\u1eeb xa t\u1ea1m th\u1eddi v\u00ec ti\u1ec7n l\u1ee3i m\u00e0 kh\u00f4ng \u0111\u01b0a c\u00e1c c\u00f4ng c\u1ee5 n\u00e0y v\u00e0o c\u00f9ng m\u1ed9t qu\u1ea3n tr\u1ecb danh t\u00ednh v\u00e0 b\u1ea3o m\u1eadt nh\u01b0 VPN doanh nghi\u1ec7p l\u00e0 m\u1ed9t r\u1ee7i ro k\u00e9o d\u00e0i.<\/p>\n<h3>6. Th\u1eed th\u00e1ch Credential Stuffing v\u00e0 Ki\u1ec3m so\u00e1t Truy c\u1eadp d\u1ef1a tr\u00ean Vai tr\u00f2 y\u1ebfu (RBAC)<\/h3>\n<p>K\u1ebb t\u1ea5n c\u00f4ng th\u01b0\u1eddng l\u1ea5y \u0111\u01b0\u1ee3c th\u00f4ng tin x\u00e1c th\u1ef1c h\u1ee3p l\u1ec7 t\u1eeb c\u00e1c v\u1ee5 vi ph\u1ea1m tr\u01b0\u1edbc \u0111\u00f3 v\u00e0 th\u1eed ch\u00fang tr\u00ean c\u00e1c c\u1ed5ng truy c\u1eadp t\u1eeb xa. N\u1ebfu kh\u00f4ng c\u00f3 ch\u00ednh s\u00e1ch kh\u00f3a t\u00e0i kho\u1ea3n m\u1ea1nh m\u1ebd, ph\u00e1t hi\u1ec7n \u0111\u0103ng nh\u1eadp b\u1ea5t th\u01b0\u1eddng v\u00e0 th\u1ef1c thi quy\u1ec1n t\u1ed1i thi\u1ec3u, m\u1ed9t m\u1eadt kh\u1ea9u b\u1ecb x\u00e2m ph\u1ea1m c\u00f3 th\u1ec3 m\u1edf ra c\u00e1nh c\u1eeda truy c\u1eadp m\u1ea1ng r\u1ed9ng l\u1edbn.<\/p>\n<p>RBAC y\u1ebfu h\u01a1n c\u00e0ng l\u00e0m t\u0103ng r\u1ee7i ro: th\u00f4ng tin x\u00e1c th\u1ef1c c\u1ee7a ng\u01b0\u1eddi v\u1eadn h\u00e0nh c\u00f3 th\u1ec3 c\u1ea5p quy\u1ec1n truy c\u1eadp nhi\u1ec1u h\u01a1n so v\u1edbi vai tr\u00f2 c\u1ee7a h\u1ecd y\u00eau c\u1ea7u.<\/p>\n<ul>\n<li><strong>\u0110i\u1ec3m ki\u1ec3m tra:<\/strong> Ki\u1ec3m tra xem t\u1ea5t c\u1ea3 c\u00e1c t\u00e0i kho\u1ea3n truy c\u1eadp t\u1eeb xa c\u00f3 b\u1ecb kh\u00f3a theo t\u1ed5 ch\u1ee9c v\u00e0 c\u00f3 ph\u00e1t hi\u1ec7n b\u1ea5t th\u01b0\u1eddng hay kh\u00f4ng.<\/li>\n<li>Xem x\u00e9t c\u00e1c \u00e1nh x\u1ea1 RBAC: c\u00e1c nh\u00e0 th\u1ea7u v\u00e0 b\u00ean th\u1ee9 ba c\u00f3 \u0111\u01b0\u1ee3c c\u1ea5p t\u00e0i kho\u1ea3n d\u00e0nh ri\u00eang, gi\u1edbi h\u1ea1n th\u1eddi gian thay v\u00ec \u0111\u0103ng nh\u1eadp chung chung kh\u00f4ng?<\/li>\n<li>X\u00e1c minh r\u1eb1ng quy\u1ec1n qu\u1ea3n tr\u1ecb vi\u00ean \u0111\u01b0\u1ee3c ph\u00e2n chia r\u00f5 r\u00e0ng v\u1edbi vai tr\u00f2 ng\u01b0\u1eddi d\u00f9ng t\u1eeb xa ti\u00eau chu\u1ea9n.<\/li>\n<\/ul>\n<p>Vi\u1ec7c s\u1eed d\u1ee5ng th\u00f4ng tin \u0111\u0103ng nh\u1eadp c\u1ed1 \u0111\u1ecbnh, c\u00f3 th\u1eddi h\u1ea1n d\u00e0i cho c\u00e1c b\u00ean ngo\u00e0i v\u00e0 kh\u00f4ng th\u1ef1c thi quy\u1ec1n t\u1ed1i thi\u1ec3u t\u1ea1o ra m\u1ed9t l\u1ed1i \u0111i \u0111\u00e1ng tin c\u1eady cho c\u00e1c h\u00e0nh \u0111\u1ed9ng di chuy\u1ec3n ngang.<\/p>\n<h3>7. C\u1ea5u h\u00ecnh \u0111i\u1ec3m cu\u1ed1i kh\u00f4ng an to\u00e0n (BYOD)<\/h3>\n<p>Thi\u1ebft b\u1ecb c\u00e1 nh\u00e2n kh\u00f4ng qu\u1ea3n l\u00fd introduces m\u1ed9t kho\u1ea3ng tr\u1ed1ng l\u1edbn trong an ninh truy c\u1eadp t\u1eeb xa. Kh\u00f4ng c\u00f3 ph\u1ea7n m\u1ec1m ph\u00e1t hi\u1ec7n v\u00e0 ph\u1ea3n h\u1ed3i \u0111i\u1ec3m cu\u1ed1i (EDR), v\u00e1 l\u1ed7i b\u1ea3o m\u1eadt ho\u1eb7c m\u00e3 h\u00f3a \u0111\u0129a, laptop t\u1ea1i nh\u00e0 b\u1ecb x\u00e2m ph\u1ea1m c\u00f3 th\u1ec3 l\u1ea5y c\u1eafp token phi\u00ean ho\u1eb7c \u0111\u00f3ng vai tr\u00f2 trung t\u00e2m. VPN truy\u1ec1n th\u1ed1ng th\u01b0\u1eddng ch\u1ec9 ki\u1ec3m tra ch\u1ee9ng ch\u1ec9 h\u1ee3p l\u1ec7 ho\u1eb7c th\u00f4ng tin \u0111\u0103ng nh\u1eadp, kh\u00f4ng ki\u1ec3m tra t\u00ecnh tr\u1ea1ng c\u1ee7a thi\u1ebft b\u1ecb.<\/p>\n<ul>\n<li><strong>Y\u00eau c\u1ea7u tu\u00e2n th\u1ee7:<\/strong> Th\u1ef1c thi c\u00e1c ch\u00ednh s\u00e1ch tu\u00e2n th\u1ee7 thi\u1ebft b\u1ecb y\u00eau c\u1ea7u m\u1ee9c v\u00e1 l\u1ed7i t\u1ed1i thi\u1ec3u c\u1ee7a h\u1ec7 \u0111i\u1ec1u h\u00e0nh, m\u00e3 h\u00f3a \u0111\u0129a v\u00e0 c\u00f3 EDR ho\u1ea1t \u0111\u1ed9ng tr\u01b0\u1edbc khi c\u1ea5p quy\u1ec1n truy c\u1eadp.<\/li>\n<li>S\u1eed d\u1ee5ng x\u00e1c th\u1ef1c thi\u1ebft b\u1ecb d\u1ef1a tr\u00ean ch\u1ee9ng ch\u1ec9 li\u00ean k\u1ebft v\u1edbi danh t\u00ednh qu\u1ea3n l\u00fd.<\/li>\n<li>Trong c\u00e1c t\u00ecnh hu\u1ed1ng BYOD, tri\u1ec3n khai m\u1ed9t agent d\u1ecbch v\u1ee5 truy c\u1eadp an to\u00e0n (SASE) ho\u1eb7c m\u1ed9t phi\u00ean duy\u1ec7t web c\u00e1ch ly.<\/li>\n<\/ul>\n<p>Xem x\u00e9t x\u00e1c th\u1ef1c ng\u01b0\u1eddi d\u00f9ng v\u00e0 \u0111\u1ed9 tin c\u1eady c\u1ee7a thi\u1ebft b\u1ecb l\u00e0 c\u00f9ng m\u1ed9t v\u1ea5n \u0111\u1ec1 l\u00e0 m\u1ed9t sai l\u1ea7m nghi\u00eam tr\u1ecdng. X\u00e1c minh danh t\u00ednh ch\u1ec9 ri\u00eang kh\u00f4ng ch\u1ee9ng minh \u0111\u01b0\u1ee3c \u0111i\u1ec3m cu\u1ed1i kh\u00f4ng ch\u1ee9a ph\u1ea7n m\u1ec1m \u0111\u1ed9c h\u1ea1i.<\/p>\n<h3>8. Thi\u1ebfu gi\u00e1m s\u00e1t v\u00e0 ghi nh\u1eadt k\u00fd phi\u00ean l\u00e0m vi\u1ec7c<\/h3>\n<p>Kh\u00f4ng c\u00f3 ghi l\u1ea1i li\u00ean t\u1ee5c c\u00e1c phi\u00ean l\u00e0m vi\u1ec7c v\u00e0 ph\u00e2n t\u00edch h\u00e0nh vi, nh\u00f3m an ninh kh\u00f4ng th\u1ec3 ph\u00e1t hi\u1ec7n khi m\u1ed9t phi\u00ean l\u00e0m vi\u1ec7c h\u1ee3p l\u1ec7 b\u1ecb l\u1ea1m d\u1ee5ng. K\u1ebb t\u1ea5n c\u00f4ng chi\u1ebfm \u0111o\u1ea1t phi\u00ean h\u1ee3p l\u1ec7 c\u00f3 th\u1ec3 tr\u1ed9m d\u1eef li\u1ec7u, thay \u0111\u1ed5i c\u1ea5u h\u00ecnh ho\u1eb7c duy tr\u00ec s\u1ef1 t\u1ed3n t\u1ea1i m\u00e0 kh\u00f4ng k\u00edch ho\u1ea1t c\u1ea3nh b\u00e1o.<\/p>\n<ul>\n<li><strong>Nh\u1eefng \u0111i\u1ec1u c\u1ea7n thi\u1ebft \u0111\u1ec3 gi\u00e1m s\u00e1t:<\/strong> \u0110\u1ea3m b\u1ea3o t\u1ea5t c\u1ea3 c\u00e1c phi\u00ean l\u00e0m vi\u1ec7c t\u1eeb xa \u2014 bao g\u1ed3m quy\u1ec1n truy c\u1eadp \u0111\u1eb7c quy\u1ec1n v\u00e0o c\u00e1c m\u00e1y ch\u1ee7 quan tr\u1ecdng \u2014 \u0111\u01b0\u1ee3c ghi l\u1ea1i, l\u1eadp ch\u1ec9 m\u1ee5c v\u00e0 l\u01b0u tr\u1eef an to\u00e0n.<\/li>\n<li>Tri\u1ec3n khai ph\u00e2n t\u00edch h\u00e0nh vi ng\u01b0\u1eddi d\u00f9ng v\u00e0 th\u1ef1c th\u1ec3 (UEBA) \u0111\u1ec3 ph\u00e1t hi\u1ec7n ho\u1ea1t \u0111\u1ed9ng b\u1ea5t th\u01b0\u1eddng, nh\u01b0 truy c\u1eadp v\u00e0o nh\u1eefng th\u1eddi \u0111i\u1ec3m kh\u00f4ng b\u00ecnh th\u01b0\u1eddng ho\u1eb7c t\u1ea3i xu\u1ed1ng h\u00e0ng lo\u1ea1t t\u1ec7p tin.<\/li>\n<li>T\u00edch h\u1ee3p nh\u1eadt k\u00fd phi\u00ean l\u00e0m vi\u1ec7c v\u1edbi h\u1ec7 th\u1ed1ng SIEM \u0111\u1ec3 ph\u00e2n t\u00edch m\u1ed1i li\u00ean h\u1ec7 v\u1edbi c\u00e1c s\u1ef1 ki\u1ec7n an ninh kh\u00e1c.<\/li>\n<\/ul>\n<p>D\u1ef1a v\u00e0o nh\u1eadt k\u00fd x\u00e1c th\u1ef1c \u0111\u01a1n gi\u1ea3n \u0111\u1ec3 ch\u1ee9ng minh an ninh l\u00e0 kh\u00f4ng \u0111\u1ee7. Kh\u00f4ng c\u00f3 kh\u1ea3 n\u0103ng quan s\u00e1t c\u1ea5p \u0111\u1ed9 phi\u00ean, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 t\u1ed3n t\u1ea1i trong h\u1ec7 th\u1ed1ng nhi\u1ec1u th\u00e1ng m\u00e0 kh\u00f4ng b\u1ecb ph\u00e1t hi\u1ec7n.<\/p>\n<h2>\u00c1p d\u1ee5ng c\u00e1c l\u1ed7 h\u1ed5ng v\u00e0o c\u00e1c bi\u1ec7n ph\u00e1p gi\u1ea3m thi\u1ec3u k\u1ef9 thu\u1eadt<\/h2>\n<p>\u0110\u1ec3 \u01b0u ti\u00ean c\u00e1c n\u1ed7 l\u1ef1c kh\u1eafc ph\u1ee5c, s\u1eed d\u1ee5ng b\u1ea3n \u0111\u1ed3 sau li\u00ean k\u1ebft t\u1eebng lo\u1ea1i l\u1ed7 h\u1ed5ng v\u1edbi nguy\u00ean nh\u00e2n g\u1ed1c r\u1ec5 v\u00e0 bi\u1ec7n ph\u00e1p gi\u1ea3m thi\u1ec3u k\u1ef9 thu\u1eadt hi\u1ec7u qu\u1ea3 nh\u1ea5t. \u0110i\u1ec1u n\u00e0y gi\u00fap ph\u00f9 h\u1ee3p vi\u1ec7c kh\u1eafc ph\u1ee5c v\u1edbi c\u00e1c vector t\u1ea5n c\u00f4ng c\u1ee5 th\u1ec3 \u0111\u01b0\u1ee3c ph\u00e1t hi\u1ec7n trong qu\u00e1 tr\u00ecnh ki\u1ec3m tra.<\/p>\n<table>\n<thead>\n<tr>\n<th>Danh m\u1ee5c L\u1ed7 h\u1ed5ng<\/th>\n<th>Nguy\u00ean nh\u00e2n G\u1ed1c r\u1ec5 K\u1ef9 thu\u1eadt<\/th>\n<th>Chi\u1ebfn l\u01b0\u1ee3c gi\u1ea3m thi\u1ec3u \u0111\u1ec1 xu\u1ea5t<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>C\u1ed5ng VPN ch\u01b0a v\u00e1 l\u1ed7i<\/td>\n<td>C\u1eadp nh\u1eadt firmware ch\u1eadm, thi\u1ebft b\u1ecb c\u0169 k\u1ef9<\/td>\n<td>Qu\u1ea3n l\u00fd v\u00e1 l\u1ed7i t\u1ef1 \u0111\u1ed9ng; chuy\u1ec3n sang m\u00f4 h\u00ecnh bi\u00ean ph\u1ea7n m\u1ec1m \u0111\u1ecbnh ngh\u0129a<\/td>\n<\/tr>\n<tr>\n<td>RDP qu\u00e1 d\u1ec5 d\u00e0ng c\u1ea5p ph\u00e9p<\/td>\n<td>Ti\u1ebfp x\u00fac tr\u1ef1c ti\u1ebfp internet, kh\u00f4ng c\u00f3 MFA<\/td>\n<td>\u0110\u1eb7t RDP sau proxy nh\u1eadn di\u1ec7n danh t\u00ednh; th\u1ef1c thi truy c\u1eadp \u0111\u00fang th\u1eddi \u0111i\u1ec3m<\/td>\n<\/tr>\n<tr>\n<td>Tri\u1ec3n khai MFA y\u1ebfu<\/td>\n<td>OTP t\u0129nh kh\u00f4ng c\u00f3 ng\u1eef c\u1ea3nh thi\u1ebft b\u1ecb<\/td>\n<td>Tri\u1ec3n khai truy c\u1eadp \u0111i\u1ec1u ki\u1ec7n d\u1ef1a tr\u00ean r\u1ee7i ro v\u1edbi token FIDO2 ch\u1ed1ng l\u1eeba \u0111\u1ea3o<\/td>\n<\/tr>\n<tr>\n<td>Chia Tunneling \/ Di chuy\u1ec3n ngang<\/td>\n<td>Truy c\u1eadp to\u00e0n b\u1ed9 subnet t\u1eeb kh\u00e1ch h\u00e0ng VPN<\/td>\n<td>Micro-segmentation; danh s\u00e1ch l\u1ecdc VPN; th\u1ef1c thi k\u1ebft n\u1ed1i kh\u00f4ng tin c\u1eady<\/td>\n<\/tr>\n<tr>\n<td>C\u00f4ng c\u1ee5 t\u1eeb xa b\u00f3ng t\u1ed1i<\/td>\n<td>Ph\u1ea7n m\u1ec1m kh\u00f4ng \u0111\u01b0\u1ee3c ph\u00e9p, thi\u1ebfu ki\u1ec3m k\u00ea<\/td>\n<td>Ch\u00ednh s\u00e1ch ki\u1ec3m so\u00e1t \u1ee9ng d\u1ee5ng; h\u1ee3p nh\u1ea5t truy c\u1eadp t\u1eeb xa tr\u00ean n\u1ec1n t\u1ea3ng qu\u1ea3n l\u00fd<\/td>\n<\/tr>\n<tr>\n<td>L\u00e0m \u0111\u1ea7y th\u00f4ng tin x\u00e1c th\u1ef1c \/ RBAC y\u1ebfu<\/td>\n<td>Kh\u00f4ng ph\u00e1t hi\u1ec7n m\u1ed1i \u0111e d\u1ecda danh t\u00ednh, quy\u1ec1n truy c\u1eadp qu\u00e1 r\u1ed9ng<\/td>\n<td>Truy c\u1eadp qu\u1ea3n tr\u1ecb \u0111\u00fang th\u1eddi \u0111i\u1ec3m; x\u00e1c th\u1ef1c d\u1ef1a tr\u00ean r\u1ee7i ro; xem x\u00e9t RBAC t\u1ef1 \u0111\u1ed9ng<\/td>\n<\/tr>\n<tr>\n<td>\u0110i\u1ec3m cu\u1ed1i kh\u00f4ng an to\u00e0n<\/td>\n<td>BYOD m\u00e0 kh\u00f4ng ki\u1ec3m tra tu\u00e2n th\u1ee7 thi\u1ebft b\u1ecb<\/td>\n<td>M\u1edf r\u1ed9ng t\u01b0 th\u1ebf b\u1ea3o m\u1eadt \u0111i\u1ec3m cu\u1ed1i v\u00e0o quy\u1ebft \u0111\u1ecbnh truy c\u1eadp; s\u1eed d\u1ee5ng ki\u1ebfn tr\u00fac Zero Trust<\/td>\n<\/tr>\n<tr>\n<td>Thi\u1ebfu gi\u00e1m s\u00e1t Phi\u00ean l\u00e0m vi\u1ec7c<\/td>\n<td>Kh\u00f4ng ghi l\u1ea1i phi\u00ean ho\u1eb7c UEBA<\/td>\n<td>Tri\u1ec3n khai qu\u1ea3n l\u00fd truy c\u1eadp \u0111\u1eb7c quy\u1ec1n (PAM) v\u1edbi c\u00e1ch ly v\u00e0 gi\u00e1m s\u00e1t phi\u00ean<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>\u0110i\u1ec3m m\u00f9 c\u00f4ng nghi\u1ec7p: Truy c\u1eadp t\u1eeb xa trong M\u00f4i tr\u01b0\u1eddng OT v\u00e0 ICS<\/h2>\n<p>M\u00f4i tr\u01b0\u1eddng c\u00f4ng ngh\u1ec7 v\u1eadn h\u00e0nh (OT)\u2014nh\u00e0 m\u00e1y, ti\u1ec7n \u00edch, t\u1ef1 \u0111\u1ed9ng h\u00f3a t\u00f2a nh\u00e0\u2014\u0111\u01b0a ra m\u1ed9t t\u1eadp h\u1ee3p c\u00e1c l\u1ed7 h\u1ed5ng truy c\u1eadp t\u1eeb xa kh\u00e1c bi\u1ec7t. C\u00e1c c\u00f4ng c\u1ee5 truy c\u1eadp t\u1eeb xa truy\u1ec1n th\u1ed1ng c\u1ee7a CNTT ch\u01b0a bao gi\u1edd \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf cho h\u1ec7 th\u1ed1ng \u0111i\u1ec1u khi\u1ec3n c\u00f4ng nghi\u1ec7p (ICS) ch\u1ea1y c\u00e1c giao th\u1ee9c c\u0169 v\u1edbi b\u1ea3o m\u1eadt t\u00edch h\u1ee3p s\u1eb5n.<\/p>\n<p>Tuy nhi\u00ean, nhi\u1ec1u t\u1ed5 ch\u1ee9c ch\u1ec9 \u0111\u01a1n gi\u1ea3n m\u1edf r\u1ed9ng VPN doanh nghi\u1ec7p c\u1ee7a h\u1ecd v\u00e0o m\u1ea1ng OT, t\u1ea1o ra m\u1ed9t c\u1ea7u n\u1ed1i ph\u1eb3ng gi\u1eefa CNTT v\u00e0 OT.<\/p>\n<p>\u0110\u00e2y l\u00e0 m\u1ed9t sai l\u1ea7m nghi\u00eam tr\u1ecdng. K\u1ebb t\u1ea5n c\u00f4ng x\u00e2m ph\u1ea1m m\u1ed9t m\u00e1y t\u00ednh \u0111\u1ec3 b\u00e0n CNTT c\u00f3 th\u1ec3 d\u1ec5 d\u00e0ng chuy\u1ec3n sang c\u00e1c b\u1ed9 \u0111i\u1ec1u khi\u1ec3n logic l\u1eadp tr\u00ecnh (PLC) ho\u1eb7c giao di\u1ec7n ng\u01b0\u1eddi-m\u00e1y (HMI) thi\u1ebfu x\u00e1c th\u1ef1c hi\u1ec7n \u0111\u1ea1i. Cu\u1ed9c t\u1ea5n c\u00f4ng n\u1ed5i ti\u1ebfng c\u1ee7a Colonial Pipeline v\u00e0o n\u0103m 2021 \u0111\u00e3 khai th\u00e1c m\u1ed9t m\u1eadt kh\u1ea9u VPN b\u1ecb r\u00f2 r\u1ec9 duy nh\u1ea5t d\u1eabn tr\u1ef1c ti\u1ebfp \u0111\u1ebfn m\u1ea1ng OT, bu\u1ed9c ph\u1ea3i \u0111\u00f3ng c\u1eeda ho\u1ea1t \u0111\u1ed9ng ho\u00e0n to\u00e0n.<\/p>\n<p>Nh\u1eefng g\u00ec c\u1ea7n x\u00e1c minh trong m\u00f4i tr\u01b0\u1eddng OT:<\/p>\n<ul>\n<li>M\u1ea1ng OT c\u00f3 \u0111\u01b0\u1ee3c ph\u00e2n \u0111o\u1ea1n kh\u1ecfi CNTT v\u1edbi v\u00f9ng phi qu\u00e2n s\u1ef1 (DMZ) v\u00e0 c\u1ed5ng c\u1ea5p \u1ee9ng d\u1ee5ng kh\u00f4ng?<\/li>\n<li>C\u00e1c phi\u00ean k\u1ef9 thu\u1eadt t\u1eeb xa c\u00f3 \u0111\u01b0\u1ee3c \u0111\u1ecbnh tuy\u1ebfn qua m\u1ed9t m\u00e1y ch\u1ee7 nh\u1ea3y v\u1edbi ghi l\u1ea1i phi\u00ean v\u00e0 ph\u00ea duy\u1ec7t th\u1ee7 c\u00f4ng kh\u00f4ng?<\/li>\n<li>C\u00e1c th\u00f4ng tin \u0111\u0103ng nh\u1eadp m\u1eb7c \u0111\u1ecbnh c\u00f3 \u0111\u01b0\u1ee3c thay \u0111\u1ed5i tr\u00ean t\u1ea5t c\u1ea3 ph\u1ea7n c\u1ee9ng ICS kh\u00f4ng, v\u00e0 c\u00e1c c\u01a1 ch\u1ebf x\u00e1c th\u1ef1c c\u00f3 \u0111\u01b0\u1ee3c c\u00e1ch ly kh\u1ecfi Active Directory doanh nghi\u1ec7p n\u1ebfu vi\u1ec7c x\u00e2m ph\u1ea1m AD c\u00f3 th\u1ec3 lan r\u1ed9ng \u0111\u1ebfn OT kh\u00f4ng?<\/li>\n<li>C\u00e1c nh\u1eadt k\u00fd truy c\u1eadp t\u1eeb xa c\u1ee7a OT c\u00f3 \u0111\u01b0\u1ee3c \u0111\u01b0a v\u00e0o h\u1ec7 th\u1ed1ng SIEM m\u00e0 \u0111\u1ed9i ng\u0169 an ninh th\u1ef1c s\u1ef1 theo d\u00f5i kh\u00f4ng?<\/li>\n<\/ul>\n<p>Gi\u1ea3i ph\u00e1p c\u00f4ng nghi\u1ec7p y\u00eau c\u1ea7u m\u1ed9t gi\u1ea3i ph\u00e1p truy c\u1eadp t\u1eeb xa OT chuy\u00ean d\u1ee5ng cung c\u1ea5p quy\u1ec1n truy c\u1eadp chi ti\u1ebft, gi\u1edbi h\u1ea1n th\u1eddi gian v\u1edbi \u0111\u1ea7y \u0111\u1ee7 ghi l\u1ea1i phi\u00ean, thay v\u00ec VPN \u0111a n\u0103ng. Gove\u2019s <a href=\"https:\/\/govelocks.com\/vi\/solutions\/\">gi\u1ea3i ph\u00e1p ki\u1ec3m so\u00e1t truy c\u1eadp doanh nghi\u1ec7p<\/a> \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 t\u00edch h\u1ee3p an ninh v\u1eadt l\u00fd v\u00e0 logic cho m\u00f4i tr\u01b0\u1eddng c\u00f4ng nghi\u1ec7p, gi\u00fap \u0111\u1ea3m b\u1ea3o r\u1eb1ng ch\u1ec9 nh\u1eefng nh\u00e2n vi\u00ean c\u00f3 th\u1ea9m quy\u1ec1n\u2014d\u01b0\u1edbi s\u1ef1 gi\u00e1m s\u00e1t ch\u1eb7t ch\u1ebd\u2014m\u1edbi c\u00f3 th\u1ec3 t\u01b0\u01a1ng t\u00e1c v\u1edbi h\u1ea1 t\u1ea7ng quan tr\u1ecdng.<\/p>\n<p>Ngo\u00e0i ra, <a href=\"https:\/\/govelocks.com\/vi\/access-control-integration\/\">t\u00edch h\u1ee3p ki\u1ec3m so\u00e1t truy c\u1eadp v\u1edbi EDR<\/a> c\u00f3 th\u1ec3 cung c\u1ea5p kh\u1ea3 n\u0103ng nh\u00ecn to\u00e0n di\u1ec7n v\u1ec1 m\u1ed1i \u0111e d\u1ecda th\u1ed1ng nh\u1ea5t tr\u00ean c\u1ea3 l\u0129nh v\u1ef1c CNTT v\u00e0 OT.<\/p>\n<h2>Chuy\u1ec3n \u0111\u1ed5i Ki\u1ebfn tr\u00fac: VPN truy\u1ec1n th\u1ed1ng so v\u1edbi Truy c\u1eadp M\u1ea1ng Kh\u00f4ng Tin c\u1eady (ZTNA)<\/h2>\n<p>VPN k\u1ebf th\u1eeba theo m\u00f4 h\u00ecnh \u201ck\u1ebft n\u1ed1i r\u1ed3i x\u00e1c th\u1ef1c\u201d: ng\u01b0\u1eddi d\u00f9ng thi\u1ebft l\u1eadp m\u1ed9t \u0111\u01b0\u1eddng h\u1ea7m t\u1edbi m\u1ea1ng, v\u00e0 \u0111\u0103ng nh\u1eadp th\u00e0nh c\u00f4ng s\u1ebd c\u1ea5p quy\u1ec1n truy c\u1eadp n\u1ed9i b\u1ed9 r\u1ed9ng r\u00e3i, th\u01b0\u1eddng kh\u00f4ng gi\u1edbi h\u1ea1n.<\/p>\n<p>Truy c\u1eadp M\u1ea1ng Kh\u00f4ng Tin c\u1eady (ZTNA) \u0111\u1ea3o ng\u01b0\u1ee3c \u0111i\u1ec1u n\u00e0y: ng\u01b0\u1eddi d\u00f9ng \u0111\u01b0\u1ee3c x\u00e1c th\u1ef1c tr\u01b0\u1edbc, sau \u0111\u00f3 m\u1ed9t \u0111\u01b0\u1eddng h\u1ea7m an to\u00e0n, d\u00e0nh ri\u00eang cho \u1ee9ng d\u1ee5ng, ch\u1ec9 \u0111\u01b0\u1ee3c thi\u1ebft l\u1eadp t\u1edbi c\u00e1c t\u00e0i nguy\u00ean r\u00f5 r\u00e0ng \u0111\u01b0\u1ee3c ph\u00e9p cho phi\u00ean \u0111\u00f3.<\/p>\n<p>B\u1ea3ng d\u01b0\u1edbi \u0111\u00e2y l\u00e0m n\u1ed5i b\u1eadt c\u00e1c kh\u00e1c bi\u1ec7t v\u1ec1 v\u1eadn h\u00e0nh v\u00e0 b\u1ea3o m\u1eadt \u1ea3nh h\u01b0\u1edfng \u0111\u1ebfn quy\u1ebft \u0111\u1ecbnh mua s\u1eafm ki\u1ebfn tr\u00fac truy c\u1eadp t\u1eeb xa.<\/p>\n<table>\n<thead>\n<tr>\n<th>T\u00ednh n\u0103ng<\/th>\n<th>VPN Truy\u1ec1n Th\u1ed1ng<\/th>\n<th>Truy c\u1eadp M\u1ea1ng Kh\u00f4ng Tin c\u1eady (ZTNA)<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>M\u00f4 h\u00ecnh Truy c\u1eadp<\/td>\n<td>Truy c\u1eadp c\u1ea5p m\u1ea1ng; ng\u01b0\u1eddi d\u00f9ng th\u1ea5y to\u00e0n b\u1ed9 subnet<\/td>\n<td>Truy c\u1eadp c\u1ea5p \u1ee9ng d\u1ee5ng; ng\u01b0\u1eddi d\u00f9ng ch\u1ec9 th\u1ea5y c\u00e1c \u1ee9ng d\u1ee5ng \u0111\u01b0\u1ee3c ph\u00e9p<\/td>\n<\/tr>\n<tr>\n<td>C\u01a1 s\u1edf Tin c\u1eady<\/td>\n<td>Tin c\u1eady ng\u1ea7m \u0111\u1ecbnh d\u1ef1a tr\u00ean v\u1ecb tr\u00ed m\u1ea1ng<\/td>\n<td>X\u00e1c minh li\u00ean t\u1ee5c danh t\u00ednh, thi\u1ebft b\u1ecb v\u00e0 ng\u1eef c\u1ea3nh<\/td>\n<\/tr>\n<tr>\n<td>R\u1ee7i ro Di chuy\u1ec3n b\u00ean c\u1ea1nh<\/td>\n<td>Cao\u2014khi \u0111\u00e3 v\u00e0o m\u1ea1ng, cu\u1ed9c t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 kh\u00e1m ph\u00e1<\/td>\n<td>Th\u1ea5p\u2014kh\u00f4ng c\u00f3 kh\u1ea3 n\u0103ng nh\u00ecn th\u1ea5y m\u1ea1ng; k\u1ebft n\u1ed1i vi ph\u00e2n \u0111o\u1ea1n<\/td>\n<\/tr>\n<tr>\n<td>\u0110\u1ed9 tr\u1ec5 &amp; Hi\u1ec7u su\u1ea5t<\/td>\n<td>Th\u01b0\u1eddng y\u00eau c\u1ea7u \u0111\u1ecbnh tuy\u1ebfn qua trung t\u00e2m trung gian<\/td>\n<td>C\u00e1c \u0111i\u1ec3m bi\u00ean d\u1ef1a tr\u00ean \u0111\u00e1m m\u00e2y c\u1ea3i thi\u1ec7n hi\u1ec7u su\u1ea5t; c\u00f3 th\u1ec3 breakout t\u1ea1i ch\u1ed7<\/td>\n<\/tr>\n<tr>\n<td>Kh\u1ea3 n\u0103ng m\u1edf r\u1ed9ng<\/td>\n<td>H\u1ea1n ch\u1ebf b\u1edfi c\u00f4ng su\u1ea5t thi\u1ebft b\u1ecb t\u1eadp trung<\/td>\n<td>T\u0103ng quy m\u00f4 linh ho\u1ea1t, d\u1ef1a tr\u00ean \u0111\u00e1m m\u00e2y<\/td>\n<\/tr>\n<tr>\n<td>T\u00edch h\u1ee3p v\u1edbi EDR<\/td>\n<td>H\u1ea1n ch\u1ebf; th\u01b0\u1eddng ch\u1ec9 ki\u1ec3m tra s\u1ee9c kh\u1ecfe \u0111i\u1ec3m cu\u1ed1i c\u01a1 b\u1ea3n<\/td>\n<td>T\u00edch h\u1ee3p s\u00e2u v\u1edbi t\u01b0 th\u1ebf \u0111i\u1ec3m cu\u1ed1i v\u00e0 t\u00edn hi\u1ec7u EDR<\/td>\n<\/tr>\n<tr>\n<td>Ph\u00f9 h\u1ee3p v\u1edbi ti\u00eau chu\u1ea9n tu\u00e2n th\u1ee7<\/td>\n<td>Kh\u00f3 th\u1ef1c thi ch\u00ednh s\u00e1ch theo phi\u00ean l\u00e0m vi\u1ec7c<\/td>\n<td>Ghi nh\u1eadt k\u00fd chi ti\u1ebft v\u00e0 th\u1ef1c thi ch\u00ednh s\u00e1ch \u0111\u01a1n gi\u1ea3n h\u00f3a vi\u1ec7c \u00e1nh x\u1ea1 v\u1edbi NIST\/CMMC<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u0110\u1ed1i v\u1edbi c\u00e1c t\u1ed5 ch\u1ee9c qu\u1ea3n l\u00fd h\u1ec7 th\u1ed1ng truy c\u1eadp v\u1eadt l\u00fd ph\u1ee9c t\u1ea1p c\u1ea7n t\u00edch h\u1ee3p v\u00e0o m\u00f4 h\u00ecnh truy c\u1eadp t\u1eeb xa, <a href=\"https:\/\/govelocks.com\/vi\/enterprise-access-control\/\">ki\u1ec3m so\u00e1t truy c\u1eadp c\u1ea5p doanh nghi\u1ec7p<\/a> gi\u1ea3i ph\u00e1p t\u1eeb Gove c\u00f3 th\u1ec3 l\u1ea5p \u0111\u1ea7y kho\u1ea3ng c\u00e1ch gi\u1eefa c\u00e1c b\u1ed9 \u0111i\u1ec1u khi\u1ec3n ch\u00ednh s\u00e1ch ZTNA v\u00e0 ph\u1ea7n c\u1ee9ng kh\u00f3a t\u1ea1i ch\u1ed7. Th\u00eam v\u00e0o \u0111\u00f3, <a href=\"https:\/\/govelocks.com\/vi\/cloud-access-control-lock\/\">kh\u00f3a ki\u1ec3m so\u00e1t truy c\u1eadp d\u1ef1a tr\u00ean \u0111\u00e1m m\u00e2y<\/a> \u0111\u01b0\u1ee3c thi\u1ebft k\u1ebf \u0111\u1ec3 ho\u1ea1t \u0111\u1ed9ng t\u1ef1 nhi\u00ean trong khu\u00f4n kh\u1ed5 zero-trust, cung c\u1ea5p c\u00e1c s\u1ef1 ki\u1ec7n m\u1edf c\u1eeda nh\u1eadn di\u1ec7n ph\u00f9 h\u1ee3p v\u1edbi \u0111\u0103ng nh\u1eadp ZTNA.<\/p>\n<h2>Ph\u00f9 h\u1ee3p Truy c\u1eadp t\u1eeb xa v\u1edbi C\u00e1c khu\u00f4n kh\u1ed5 An ninh (NIST &amp; CMMC)<\/h2>\n<p>C\u00e1c khu\u00f4n kh\u1ed5 an ninh cung c\u1ea5p c\u00e1ch c\u1ea5u tr\u00fac \u0111\u1ec3 \u0111\u00e1nh gi\u00e1 v\u00e0 gi\u1ea3m thi\u1ec3u c\u00e1c l\u1ed7 h\u1ed5ng truy c\u1eadp t\u1eeb xa. Hai khu\u00f4n kh\u1ed5 \u0111\u1eb7c bi\u1ec7t ph\u00f9 h\u1ee3p:<\/p>\n<ul>\n<li><strong>NIST SP 800-46 (H\u01b0\u1edbng d\u1eabn v\u1ec1 An ninh L\u00e0m vi\u1ec7c t\u1eeb xa v\u00e0 Truy c\u1eadp t\u1eeb xa c\u1ee7a Doanh nghi\u1ec7p):<\/strong> T\u00e0i li\u1ec7u n\u00e0y tr\u1ef1c ti\u1ebfp \u0111\u1ec1 c\u1eadp \u0111\u1ebfn ki\u1ebfn tr\u00fac truy c\u1eadp t\u1eeb xa, khuy\u1ebfn ngh\u1ecb s\u1eed d\u1ee5ng c\u1ed5ng \u1ee9ng d\u1ee5ng, x\u00e1c th\u1ef1c ch\u1eb7t ch\u1ebd l\u1eabn nhau, v\u00e0 xem x\u00e9t l\u1ea1i nh\u1eadt k\u00fd truy c\u1eadp \u0111\u1ecbnh k\u1ef3. N\u00f3 khuy\u00ean c\u00e1c t\u1ed5 ch\u1ee9c xem t\u1ea5t c\u1ea3 c\u00e1c thi\u1ebft b\u1ecb kh\u00e1ch t\u1eeb xa l\u00e0 kh\u00f4ng \u0111\u00e1ng tin tr\u1eeb khi ch\u00fang \u0111\u00e1p \u1ee9ng c\u00e1c ti\u00eau chu\u1ea9n an ninh doanh nghi\u1ec7p. H\u01b0\u1edbng d\u1eabn c\u1eadp nh\u1eadt ph\u00f9 h\u1ee3p v\u1edbi c\u00e1c nguy\u00ean t\u1eafc Zero Trust \u0111\u01b0\u1ee3c n\u00eau trong NIST SP 800\u2011207.<\/li>\n<li><strong>CMMC 2.0 (Ch\u1ee9ng nh\u1eadn M\u00f4 h\u00ecnh tr\u01b0\u1edfng th\u00e0nh An ninh m\u1ea1ng):<\/strong> \u0110\u1ed1i v\u1edbi c\u00e1c nh\u00e0 th\u1ea7u qu\u1ed1c ph\u00f2ng, CMMC c\u1ea5p \u0111\u1ed9 2 y\u00eau c\u1ea7u 110 ki\u1ec3m so\u00e1t an ninh, trong \u0111\u00f3 nhi\u1ec1u ki\u1ec3m so\u00e1t \u1ea3nh h\u01b0\u1edfng tr\u1ef1c ti\u1ebfp \u0111\u1ebfn truy c\u1eadp t\u1eeb xa. C\u00e1c ki\u1ec3m so\u00e1t li\u00ean quan bao g\u1ed3m x\u00e1c th\u1ef1c \u0111a y\u1ebfu t\u1ed1 cho c\u00e1c phi\u00ean l\u00e0m vi\u1ec7c t\u1eeb xa (IA.L2\u20113.5.3), c\u01a1 ch\u1ebf kh\u00f3a phi\u00ean (AC.L2\u20113.1.10), v\u00e0 m\u00e3 h\u00f3a CUI trong qu\u00e1 tr\u00ecnh truy\u1ec1n t\u1ea3i (SC.L2\u20113.13.8). C\u00e1c ki\u1ec3m to\u00e1n vi\u00ean s\u1ebd \u0111\u1eb7c bi\u1ec7t xem x\u00e9t c\u00e1ch c\u00e1c k\u1ebft n\u1ed1i truy c\u1eadp t\u1eeb xa \u0111\u01b0\u1ee3c gi\u00e1m s\u00e1t v\u00e0 c\u00e1ch ph\u00e2n chia quy\u1ec1n h\u1ea1n.<\/li>\n<\/ul>\n<p>Vi\u1ec7c \u00e1nh x\u1ea1 ki\u1ebfn tr\u00fac truy c\u1eadp t\u1eeb xa c\u1ee7a b\u1ea1n theo c\u00e1c ti\u00eau chu\u1ea9n n\u00e0y kh\u00f4ng ch\u1ec9 gi\u00fap b\u1ea1n ph\u00f9 h\u1ee3p v\u1edbi c\u00e1c th\u1ef1c h\u00e0nh t\u1ed1t nh\u1ea5t c\u1ee7a ng\u00e0nh m\u00e0 c\u00f2n cung c\u1ea5p m\u1ed9t n\u1ec1n t\u1ea3ng c\u00f3 th\u1ec3 x\u00e1c minh \u0111\u01b0\u1ee3c m\u00e0 c\u00e1c ki\u1ec3m to\u00e1n vi\u00ean v\u00e0 nh\u00e0 b\u1ea3o hi\u1ec3m c\u00f4ng nh\u1eadn. Ph\u00e2n t\u00edch kho\u1ea3ng tr\u1ed1ng ch\u1ee7 \u0111\u1ed9ng d\u1ef1a tr\u00ean ti\u00eau ch\u00ed NIST v\u00e0 CMMC th\u01b0\u1eddng ti\u1ebft l\u1ed9 ch\u00ednh nh\u1eefng l\u1ed7 h\u1ed5ng d\u1eabn \u0111\u1ebfn c\u00e1c vi ph\u1ea1m.<\/p>\n<h2>Ki\u1ec3m tra An ninh Truy c\u1eadp T\u1eeb xa: Danh s\u00e1ch Ki\u1ec3m tra X\u00e1c minh<\/h2>\n<p>S\u1eed d\u1ee5ng danh s\u00e1ch ki\u1ec3m tra n\u00e0y \u0111\u1ec3 nhanh ch\u00f3ng \u0111\u00e1nh gi\u00e1 c\u00e1c l\u1ed7i c\u1ea5u h\u00ecnh ph\u1ed5 bi\u1ebfn nh\u1ea5t v\u00e0 c\u00e1c kho\u1ea3ng tr\u1ed1ng trong quy tr\u00ecnh truy c\u1eadp t\u1eeb xa. M\u1ed7i m\u1ee5c nh\u1eafm v\u00e0o \u0111i\u1ec3m th\u1ea5t b\u1ea1i c\u00f3 nguy c\u01a1 cao \u0111\u00e3 \u0111\u01b0\u1ee3c x\u00e1c \u0111\u1ecbnh trong c\u00e1c cu\u1ed9c \u0111i\u1ec1u tra ph\u1ea3n \u1ee9ng s\u1ef1 c\u1ed1.<\/p>\n<ul>\n<li><strong>T\u00ecnh tr\u1ea1ng firmware &amp; v\u00e1 l\u1ed7i VPN:<\/strong> Ghi l\u1ea1i phi\u00ean b\u1ea3n firmware hi\u1ec7n t\u1ea1i c\u1ee7a m\u1ecdi c\u1ed5ng VPN v\u00e0 t\u01b0\u1eddng l\u1eeda. L\u00ean l\u1ecbch c\u1eadp nh\u1eadt trong v\u00f2ng 48 gi\u1edd k\u1ec3 t\u1eeb khi ph\u00e1t hi\u1ec7n l\u1ed7 h\u1ed5ng CVE nghi\u00eam tr\u1ecdng.<\/li>\n<li><strong>Ti\u1ebfp x\u00fac RDP:<\/strong> X\u00e1c nh\u1eadn r\u1eb1ng c\u1ed5ng 3389 kh\u00f4ng th\u1ec3 truy c\u1eadp t\u1eeb internet. X\u00e1c th\u1ef1c r\u1eb1ng t\u1ea5t c\u1ea3 truy c\u1eadp RDP \u0111\u1ec1u th\u00f4ng qua Gateway RDP ho\u1eb7c proxy qu\u1ea3n l\u00fd truy c\u1eadp \u0111\u1eb7c quy\u1ec1n.<\/li>\n<li><strong>Th\u1ef1c thi MFA:<\/strong> X\u00e1c minh r\u1eb1ng t\u1ea5t c\u1ea3 c\u00e1c ph\u01b0\u01a1ng th\u1ee9c truy c\u1eadp t\u1eeb xa\u2014VPN, VDI, \u1ee9ng d\u1ee5ng web\u2014\u0111\u1ec1u y\u00eau c\u1ea7u MFA theo ng\u1eef c\u1ea3nh. Ki\u1ec3m tra kh\u1ea3 n\u0103ng ch\u1ed1ng t\u1ea5n c\u00f4ng push bombing b\u1eb1ng c\u00e1ch s\u1eed d\u1ee5ng s\u1ed1 kh\u1edbp ho\u1eb7c FIDO2.<\/li>\n<li><strong>R\u00e0o c\u1ea3n di chuy\u1ec3n ngang:<\/strong> Xem x\u00e9t c\u00e1c quy t\u1eafc l\u1ecdc VPN v\u00e0 ch\u00ednh s\u00e1ch t\u01b0\u1eddng l\u1eeda. \u0110\u1ea3m b\u1ea3o ng\u01b0\u1eddi d\u00f9ng t\u1eeb xa ch\u1ec9 truy c\u1eadp v\u00e0o c\u00e1c \u1ee9ng d\u1ee5ng c\u1ee5 th\u1ec3, kh\u00f4ng ph\u1ea3i to\u00e0n b\u1ed9 m\u1ea1ng con.<\/li>\n<li><strong>Tu\u00e2n th\u1ee7 thi\u1ebft b\u1ecb cu\u1ed1i:<\/strong> \u0110\u1ea3m b\u1ea3o r\u1eb1ng c\u00e1c thi\u1ebft b\u1ecb kh\u00f4ng c\u00f3 agent EDR ho\u1ea1t \u0111\u1ed9ng ho\u1eb7c c\u00f3 b\u1ea3n v\u00e1 h\u1ec7 \u0111i\u1ec1u h\u00e0nh l\u1ed7i th\u1eddi b\u1ecb t\u1eeb ch\u1ed1i truy c\u1eadp. X\u00e1c nh\u1eadn m\u00e3 h\u00f3a \u0111\u0129a cho laptop x\u1eed l\u00fd d\u1eef li\u1ec7u nh\u1ea1y c\u1ea3m.<\/li>\n<li><strong>Danh s\u00e1ch c\u00f4ng c\u1ee5 b\u00f3ng t\u1ed1i:<\/strong> Ch\u1ea1y c\u00f4ng c\u1ee5 ph\u00e1t hi\u1ec7n \u0111\u1ec3 x\u00e2y d\u1ef1ng danh s\u00e1ch t\u1ea5t c\u1ea3 ph\u1ea7n m\u1ec1m truy c\u1eadp t\u1eeb xa \u0111\u00e3 c\u00e0i \u0111\u1eb7t tr\u00ean c\u00e1c thi\u1ebft b\u1ecb qu\u1ea3n l\u00fd. So s\u00e1nh v\u1edbi danh s\u00e1ch c\u00f4ng c\u1ee5 \u0111\u01b0\u1ee3c ph\u00ea duy\u1ec7t v\u00e0 lo\u1ea1i b\u1ecf c\u00e1c m\u1ee5c kh\u00f4ng \u0111\u01b0\u1ee3c ph\u00e9p.<\/li>\n<li><strong>Ghi h\u00ecnh phi\u00ean l\u00e0m vi\u1ec7c:<\/strong> X\u00e1c nh\u1eadn r\u1eb1ng t\u1ea5t c\u1ea3 c\u00e1c phi\u00ean c\u00f3 \u0111\u1eb7c quy\u1ec1n \u0111\u1ec1u \u0111\u01b0\u1ee3c ghi h\u00ecnh. Ki\u1ec3m tra r\u1eb1ng c\u00e1c b\u1ea3n ghi \u0111\u01b0\u1ee3c l\u01b0u tr\u1eef an to\u00e0n v\u00e0 \u0111\u01b0\u1ee3c l\u1eadp ch\u1ec9 m\u1ee5c \u0111\u1ec3 d\u1ec5 d\u00e0ng xem x\u00e9t trong tr\u01b0\u1eddng h\u1ee3p s\u1ef1 c\u1ed1.<\/li>\n<li><strong>T\u00edch h\u1ee3p nh\u1eadt k\u00fd:<\/strong> \u0110\u1ea3m b\u1ea3o r\u1eb1ng nh\u1eadt k\u00fd truy c\u1eadp t\u1eeb xa\u2014\u0111\u1eb7c bi\u1ec7t t\u1eeb VPN, RDP v\u00e0 gi\u1ea3i ph\u00e1p PAM\u2014\u0111\u01b0\u1ee3c chuy\u1ec3n ti\u1ebfp \u0111\u1ebfn h\u1ec7 th\u1ed1ng SIEM. Tinh ch\u1ec9nh c\u1ea3nh b\u00e1o cho c\u00e1c h\u00e0nh tr\u00ecnh kh\u00f4ng th\u1ec3 x\u1ea3y ra, truy c\u1eadp v\u00e0o th\u1eddi gian b\u1ea5t th\u01b0\u1eddng, v\u00e0 t\u1ea3i xu\u1ed1ng h\u00e0ng lo\u1ea1t t\u1ec7p tin.<\/li>\n<li><strong>\u0110\u00e1nh gi\u00e1 RBAC:<\/strong> Ki\u1ec3m tra vai tr\u00f2 ng\u01b0\u1eddi d\u00f9ng v\u00e0 quy\u1ec1n truy c\u1eadp. Ki\u1ec3m tra c\u00e1c t\u00e0i kho\u1ea3n chung, quy\u1ec1n qu\u00e1 m\u1ee9c v\u00e0 c\u00e1c t\u00e0i kho\u1ea3n c\u0169 c\u1ee7a nh\u00e2n vi\u00ean ho\u1eb7c nh\u00e0 th\u1ea7u \u0111\u00e3 ngh\u1ec9 vi\u1ec7c.<\/li>\n<li><strong>Ph\u00e2n \u0111o\u1ea1n OT:<\/strong> Trong m\u00f4i tr\u01b0\u1eddng c\u00f4ng nghi\u1ec7p, x\u00e1c nh\u1eadn r\u1eb1ng kh\u00f4ng c\u00f3 tuy\u1ebfn \u0111\u01b0\u1eddng tr\u1ef1c ti\u1ebfp t\u1eeb VLAN CNTT \u0111\u1ebfn m\u1ea1ng OT m\u00e0 kh\u00f4ng qua DMZ v\u00e0 m\u00e1y nh\u1ea3y trung gian.<\/li>\n<\/ul>\n<h2>Gia c\u1ed1 R\u00eca M\u1ea1ng T\u1eeb Xa c\u1ee7a B\u1ea1n: C\u00e1c B\u01b0\u1edbc Ti\u1ebfp Theo cho Nh\u00f3m An Ninh<\/h2>\n<p>X\u00e1c \u0111\u1ecbnh c\u00e1c l\u1ed7 h\u1ed5ng l\u00e0 b\u01b0\u1edbc \u0111\u1ea7u ti\u00ean. Chuy\u1ec3n t\u1eeb t\u01b0 th\u1ebf ph\u1ea3n \u1ee9ng sang ki\u1ebfn tr\u00fac b\u1ec1n v\u1eefng \u0111\u00f2i h\u1ecfi m\u1ed9t s\u1ef1 chuy\u1ec3n \u0111\u1ed5i c\u00f3 ch\u1ee7 \u0111\u00edch h\u01b0\u1edbng t\u1edbi c\u00e1c r\u00eca m\u1ea1ng \u0111\u01b0\u1ee3c \u0111\u1ecbnh ngh\u0129a b\u1eb1ng ph\u1ea7n m\u1ec1m v\u00e0 x\u00e1c minh li\u00ean t\u1ee5c. C\u00e1c h\u00e0nh \u0111\u1ed9ng sau \u0111\u00e2y d\u1ef1a tr\u00ean danh s\u00e1ch ki\u1ec3m tra ki\u1ec3m to\u00e1n v\u00e0 ph\u00f9 h\u1ee3p v\u1edbi ch\u01b0\u01a1ng tr\u00ecnh c\u1ee7a b\u1ea1n v\u1edbi c\u00e1c m\u1ed1i \u0111e d\u1ecda hi\u1ec7n \u0111\u1ea1i.<\/p>\n<ul>\n<li><strong>Th\u1ef1c hi\u1ec7n \u0111\u00e1nh gi\u00e1 l\u1ed7 h\u1ed5ng truy c\u1eadp t\u1eeb xa to\u00e0n di\u1ec7n:<\/strong> V\u01b0\u1ee3t ra ngo\u00e0i c\u00e1c qu\u00e9t t\u1ef1 \u0111\u1ed9ng v\u00e0 bao g\u1ed3m x\u00e1c th\u1ef1c th\u1ee7 c\u00f4ng c\u00e1c \u0111\u01b0\u1eddng d\u1eabn truy c\u1eadp, s\u1eed d\u1ee5ng ch\u1ee9ng ch\u1ec9 v\u00e0 quy t\u1eafc ph\u00e2n \u0111o\u1ea1n.<\/li>\n<li><strong>Th\u1eed nghi\u1ec7m gi\u1ea3i ph\u00e1p Truy c\u1eadp M\u1ea1ng Kh\u00f4ng Tin C\u1eady (ZTNA):<\/strong> B\u1eaft \u0111\u1ea7u v\u1edbi m\u1ed9t nh\u00f3m ng\u01b0\u1eddi d\u00f9ng c\u00f3 r\u1ee7i ro cao\u2014ch\u1eb3ng h\u1ea1n nh\u01b0 nh\u00e0 cung c\u1ea5p b\u00ean th\u1ee9 ba ho\u1eb7c qu\u1ea3n tr\u1ecb vi\u00ean\u2014\u0111\u1ec3 x\u00e1c nh\u1eadn hi\u1ec7u su\u1ea5t v\u00e0 c\u1ea3i thi\u1ec7n b\u1ea3o m\u1eadt.<\/li>\n<li><strong>T\u00edch h\u1ee3p c\u00e1c t\u00edn hi\u1ec7u \u0111i\u1ec3m cu\u1ed1i v\u00e0 danh t\u00ednh:<\/strong> K\u1ebft n\u1ed1i EDR v\u00e0 nh\u00e0 cung c\u1ea5p danh t\u00ednh c\u1ee7a b\u1ea1n v\u1edbi c\u00e1c ch\u00ednh s\u00e1ch truy c\u1eadp \u0111\u1ec3 s\u1ee9c kh\u1ecfe thi\u1ebft b\u1ecb v\u00e0 r\u1ee7i ro ng\u01b0\u1eddi d\u00f9ng \u0111\u1ecbnh h\u00ecnh \u0111\u1ed9ng m\u1ecdi k\u1ebft n\u1ed1i.<\/li>\n<li><strong>M\u1edf r\u1ed9ng c\u00f9ng m\u1ee9c \u0111\u1ed9 nghi\u00eam ng\u1eb7t \u0111\u1ebfn c\u00e1c m\u00f4i tr\u01b0\u1eddng OT:<\/strong> Tri\u1ec3n khai truy c\u1eadp t\u1eeb xa chuy\u00ean d\u1ee5ng v\u1edbi c\u00e1ch ly phi\u00ean v\u00e0 quy tr\u00ecnh ph\u00ea duy\u1ec7t th\u1ee7 c\u00f4ng cho c\u00e1c h\u1ec7 th\u1ed1ng \u0111i\u1ec1u khi\u1ec3n c\u00f4ng nghi\u1ec7p.<\/li>\n<\/ul>\n<p>C\u00e1c ki\u1ebfn tr\u00fac s\u01b0 an ninh c\u1ee7a Gove c\u00f3 th\u1ec3 gi\u00fap b\u1ea1n l\u1eadp b\u1ea3n \u0111\u1ed3 ki\u1ebfn tr\u00fac truy c\u1eadp t\u1eeb xa hi\u1ec7n t\u1ea1i c\u1ee7a b\u1ea1n theo c\u00e1c nguy\u00ean t\u1eafc Zero Trust v\u00e0 th\u1ef1c hi\u1ec7n ki\u1ec3m to\u00e1n k\u1ef9 l\u01b0\u1ee1ng theo c\u00e1c ki\u1ec3m so\u00e1t c\u1ee7a NIST v\u00e0 CMMC. <a href=\"https:\/\/govelocks.com\/vi\/contact\/\">Y\u00eau c\u1ea7u Ki\u1ec3m to\u00e1n An ninh Truy c\u1eadp T\u1eeb xa ho\u1eb7c \u0110\u00e1nh gi\u00e1 Th\u1eed nghi\u1ec7m ZTNA<\/a> \u0111\u1ec3 b\u1eaft \u0111\u1ea7u kh\u1eafc ph\u1ee5c c\u00e1c l\u1ed7 h\u1ed5ng quan tr\u1ecdng nh\u1ea5t c\u1ee7a b\u1ea1n ngay h\u00f4m nay.<\/p>","protected":false},"excerpt":{"rendered":"<p>Remote access is now the top entry point for ransomware, confirmed by 2024 incident response data. The first step to [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":2875,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"set","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[22],"tags":[],"class_list":["post-2867","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-industry-knowledge"],"_links":{"self":[{"href":"https:\/\/govelocks.com\/vi\/wp-json\/wp\/v2\/posts\/2867","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/govelocks.com\/vi\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/govelocks.com\/vi\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/govelocks.com\/vi\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/govelocks.com\/vi\/wp-json\/wp\/v2\/comments?post=2867"}],"version-history":[{"count":1,"href":"https:\/\/govelocks.com\/vi\/wp-json\/wp\/v2\/posts\/2867\/revisions"}],"predecessor-version":[{"id":2876,"href":"https:\/\/govelocks.com\/vi\/wp-json\/wp\/v2\/posts\/2867\/revisions\/2876"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/govelocks.com\/vi\/wp-json\/wp\/v2\/media\/2875"}],"wp:attachment":[{"href":"https:\/\/govelocks.com\/vi\/wp-json\/wp\/v2\/media?parent=2867"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/govelocks.com\/vi\/wp-json\/wp\/v2\/categories?post=2867"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/govelocks.com\/vi\/wp-json\/wp\/v2\/tags?post=2867"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}