Baarakɛminɛn min bɛ baara kɛ ni CrowdStrike/SentinelOne ye walima a datugulen don VPN Kill-Switch tiɲɛnen fɛ k’a sɔrɔ a bɛ baara kɛ yɔrɔjan¶

Kɔrɔtɔko hakɛw tɛ kelen ye jamana kelen-kelen bɛɛ la. Nin ɲɛ in bɛ baara kɛ ni 911 ye, o ye Ameriki ni Kanada jamanaw ka nimɔrɔ ye. Jamana caman wɛrɛw bɛ baara kɛ ni 112, 999 walima nimɔrɔ wɛrɛ ye. I ka jamana ka nimɔrɔ ɲini.

Ni i kununna so biro kɔnɔ, lotɛli so kɔnɔ, walima baarakɛyɔrɔ yɔrɔjan dɔ la, k’a ye ko i ka ɔridinatɛri min bɔra i ka baarakɛyɔrɔ fɛ, o bɛ "Connected, No Internet" jira Wi-Fi réseau bɛɛ kɔnɔ, ko a bɛ ban ka lotɛli walima awiyɔnbonda minɛbagaw ka dondaw don yɔrɔ dɔ doni, walima ko a bɛ bin Windows Blue Screen of Death kɔnɔ min tɛ ban (BSOD) bɔgɔdaga ( .PAGE_FAULT_IN_NONPAGED_AREA walima SYSTEM_THREAD_EXCEPTION_NOT_HANDLED) ye yɔrɔjan baara kɔrɔtɔko ye min bɛ kɛ ni wari caman ye. Bi baarakɛda sigidaw la, nin dasiri bɛɛ lajɛlen in bɛ sɔrɔ tuma bɛɛ lakana fɛɛrɛ saba otomatiki dɔ la kelen fɛ: Endpoint Detection and Response (EDR) Network Containment quarantine min bɛ daminɛ CrowdStrike Falcon, SentinelOne, walima Microsoft Defender for Endpoint fɛ, o ye kɛrɛnkɛrɛnnenya la kernel-mode security driver tiɲɛnen ye min bɛ operasɔn sitɛmu kura bali booting, walima stuck Always-On VPN / Zero-Trust Network Access (ZTNA) Kill-Switch (Zscaler Client Connector, Cisco AnyConnect / Secure Client, Palo Alto GlobalProtect, walima Fortinet FortiClient) min bɛ sigida DNS ni DHCP taamasiyɛnw bɛɛ bali fo ka se tunnel dɔ sigili ma. Ni i ka lockout bɛ ni ransomware binkanni walima wari ɲinini ye min bɛ baara la, i ka taa i ka jɛkulu ka Lakanali Baarakɛyɔrɔ (SOC) la ani ka i ka sigida lajɛ kɔrɔtɔko nimɔrɔw ni fɛnsɔrɔko gɛlɛnw walima ɲɛnamaya lakanani siraw tiɲɛna. Walasa ka yɔrɔjan baara gɛlɛyaw sɔrɔ minnu bɛ tali kɛ o la, aw ye an ka gafew lajɛ minnu bɛ kuma baarakɛyɔrɔ ɔridinatɛri sonyalen walima karilen taama senfɛ ani MDM lock recovery, . baara kɛli yɔrɔjan na ka bɔ lotɛli dɔ la, ani backup ɛntɛrinɛti ni ɲɔgɔndan.

Ikomi tɔnw ka labanyɔrɔw gɛlɛyara ni fɛnw ye minnu bɛ se ka fɛnw tiɲɛ, ni baarakɛlaw ka jatew ye minnu tɛ marako ye, ani Microsoft BitLocker walima macOS FileVault disiki dafalen sirili, kuntigiw ka gɛlɛyaw ɲɛnabɔcogo jɔnjɔnw (i n’a fɔ Windows sigili kokura walima porogaramuw ka foliw bɔli) bɛna dɛsɛ walima ka kɔnɔnafiliko juguba dɔ lawuli i ka CISOw kan dashboard (dasibɔlan) ye. Nka, n’i y’a sɛgɛsɛgɛ n’i bɛ EDR Host Isolation, VPN Captive-Portal Deadlock, walima Kernel Driver Bootloop ɲɛ, ani k’i ka IT Helpdesk walima SecOps jɛkulu ɲininka 48-digit BitLocker Recovery Key walima One-Time Offline Maintenance / Uncontain Token tigitigi la kumakan weleli fɛ, i bɛ se aw ka baarakɛyɔrɔ lasegin a cogo kɔrɔ la miniti 15 kɔnɔ ka bɔ diɲɛ yɔrɔ bɛɛ la.

Aw bɛ o kɛ sisan¶

AW KAN’a ɲini ka jɛkulu ka ɔridinatɛri ko, ka a lasegin, walima ka a daminɛ ka bɔ Linux walima USB stick la min ma yamaruya. Ka baarakɛyɔrɔ ɔridinatɛri daminɛ ka bɔ kɛnɛma USB drive la, o bɛ UEFI Secure Boot ani Trusted Platform Module (TPM 2.0) PCR dafalen sɛgɛsɛgɛ, ka disque dur datugu o yɔrɔnin bɛɛ BitLocker ekran kɔfɛ min ye nimɔrɔ 48 ye ani ka lasɔmini jugu ci i ka sosiyete ka Lakanali Baarakɛyɔrɔ (SOC) ma, waati min na ɔridinatɛri bɛ ɲɔgɔn sɔrɔ kokura.
A dɔn ni i ka ɛntɛrinɛti balilen don EDR Quarantine fɛ ni VPN Kill-Switch Deadlock ye. Command Prompt da wuli (cmd.exe) walima Terminal finɛtiri ka boli ping 8.8.8.8 ani nslookup google.com. Ni pake kelen-kelen bɛɛ dɛsɛra ni General failure walima Transmit failed. Error code 1231 hali n’i ka Wi-Fi taamasiyɛn b’a fɔ ko “Connected,” tasuma-fanga-minɛn dɔ (EDR Network Containment walima VPN Kill-Switch gɛlɛn) bɛ ka bɔ pakew bɛɛ fili Windows Filtering Platform (WFP) layɛrɛ.
Ni i bɛ lotɛli, kafe, walima awiyɔnbonda la ani i ka Always-On VPN ye Wi-Fi don yɔrɔ bali ("Captive Portal Chicken-and-Egg Deadlock"), i ka ɔridinatɛri don i ka telefɔni seleke naani ka Wi-Fi Hotspot selilɛri la FƆLƆ. Ikomi i ka smartfon hotspot tɛ baara kɛ ni portal don yɔrɔ minɛlen ye, i ka tɔn ka Always-On VPN walima Zscaler ciden bɛna o kɛ o yɔrɔnin bɛɛ, i ka i ka telefɔni selilɛri kunnafoniw kan, ka sariya kura o sariya kura bɔ duguma walima ka token bali ka bɔ IT la, ani ka sira di i ma ka waati dɔɔnin Captive Portal Bypass / Disable Password ɲini.
Ni i ka Windows ɔridinatɛri sirilen bɛ Saya Écran Bleu dan tɛ (BSOD) bootloop su kelen lakanani kura kɔfɛ, foto ta tigitigi Stop Code ani .sys dosiye tɔgɔ min bɛ ɛkran bulu jukɔrɔ (i n’a fɔ csagent.sys walima SentinelMonitor.sys). O dosiye tɔgɔ b’a fɔ i ka IT jɛkulu ye o yɔrɔnin bɛɛ la ni EDR kanal file walima kernel driver fililen dɔ de kɛra sababu ye ka a tiɲɛ.
Sanni i ka don Windows Safe Mode walima WinRE Command Prompt kɔnɔ jɛkulu ka PC kan, i ka i ka IT Helpdesk wele i ka telefɔni na k’a ɲini u fɛ u k’i ka ɔridinatɛri BitLocker Recovery Key (min bɛ bɛn nimɔrɔ 8 fɔlɔw ma) kalan walima k’a ci i ma Key ID jiralen bɛ i ka ɛkran kan). I tɛ se ka seginkanni cikan dɔ da wuli walima ka don Safe Mode kɔnɔ baarakɛda ka ɔridinatɛri sirilen kan k’a sɔrɔ i ma o nimɔrɔ 48 don.
Ni CrowdStrike Falcon, SentinelOne, walima Defender for Endpoint y’i ka ɔridinatɛri bila "Network Containment" (Host Isolation) kɔnɔ, i ka scriptw baara dabila walima ka filew cili dabila ani ka i ka corporate Security Operations Center (SOC) wele telefɔni fɛ. I tun bɛ min kɛ ka kɔn lockout ɲɛ (i n’a fɔ ka developpeur compiler, penetration test tool, PowerShell build, o ɲɛfɔ tigitigi script, walima ka ɲɔgɔndan kɛ ni taama-sira ye) walasa SOC sɛgɛsɛgɛlikɛla ka se k’a sɛgɛsɛgɛ ko a kɛra nkalon ye ani ka "Lift Containment" digi ka bɔ sankaba konsolɛ la (min bɛ se i ka ɔridinatɛri ma a yɛrɛma hali n’i bɛ dankan na).

Danger

Mun na EDR "Network Containment" bɛ sira di hali bi Cloud Console ka kuma i ka ɔridinatɛri fɛ (Ni i tora Wi-Fi la dɔrɔn). Ni CrowdStrike Falcon, SentinelOne, walima Microsoft Defender ye ɔridinatɛri min bɛ se ka kɛ walima min bɛ sigasiga, o bɛ baarakɛlaw ka navigatɔrɔn ka taama, imɛri, SMB tilali, ani ping file ɲinini kɛmɛsarada la 100 bali - N'A YE TLS dusukun tantanni tunɛri kelen sirilen ye min bɛ EDR sensɛri min bɛ i ka ɔridinatɛri kɔnɔ ani feerekɛla ka sankaba ɲɛnabɔli baarakɛminɛnw cɛ (*.crowdstrike.com walima *.sentinelone.net). I KAN’i ka Wi-Fi faga walima k’i ka Ethernet kabɔri bɔ k’a sɔrɔ i bɛ kuma IT SecOps fɛ. Ni i ka ɔridinatɛri bɛ ni Wi-Fi walima smartfon hotspot jɛgɛncogo raw ye ɛntɛrinɛti kan, SOC sɛgɛsɛgɛlikɛla bɛ se k’i ka ɔridinatɛri bɔ yɔrɔjan na ni digi kelen ye segin 30 kɔnɔ k’a sɔrɔ a ma token kelen sɛbɛn i ka klaviyeti kan.

Desizɔn jiri: Ka tɔnw ka ɔridinatɛriw ka rezow datugucogo ni u ka butikiw sɛgɛsɛgɛ¶

Baara kɛ ni nin jatebɔsɛbɛn in ye walasa k’a jira ko baarakɛyɔrɔ lakanani layini min ye i ka ɔridinatɛri datugu ani ka sira sɔrɔ ka taa a segincogo tigitigi la.

flowchart TD
    A["Yɔrɔjan baarakɛyɔrɔ ɔridinatɛri min datugulen don walima a tɛ se ka ɲɔgɔn sɔrɔ"] --> B{"Yala ɔridinatɛri bɛ daminɛ ka don Windows / macOS tabali kɔnɔ wa?"}
    B -->|"Ayi: A bɛ bin Écran Bleu (BSOD) Loop walima BitLocker Screen kɔnɔ"| C{"Mun de bɛ jira ekran kan?"}
    C -->|"BSOD tɔgɔladonni csagent.sys, SentinelMonitor.sys, walima wdfilter.sys"| D["KERNEL DRIVER BOOTLOOP: Boot to WinRE Recovery -> BitLocker Key nimɔrɔ 48 don ka bɔ IT la -> Kanal file fililen bɔ walima ka driver tɔgɔ caman wuli Safe Mode kɔnɔ"]
    C -->|"Blue BitLocker Recovery Screen bɛ ɲini ka 48-digit kilisi ɲini"| E["TPM PCR TRIP: USB docks/drives bɛɛ bɔ -> Reboot -> Ni ɲininkali kɛra hali bi, i bɛ IT Helpdesk wele ni 8-char Key ID ye walasa ka Recovery Key sɔrɔ min bɛ ni 48 ye"]
    B -->|"Ɔwɔ: Boots to Desktop, nka ZERO ɛntɛrinɛti / réseau sɔrɔli"| F{"Mun bɛ kɛ ni i ye VPN / ZTNA & Wi-Fi cogoya lajɛ?"}
    F -->|"Lotɛli/Aeroport la: Wi-Fi bɛ don ɲɔgɔn na, nka Captive Portal don yɔrɔ tɛna da wuli"| G["CAPTIVE PORTAL DEADLOCK: I ka ɔridinatɛri don Smartphone Hotspot la fɔlɔ -> VPN lafasali -> Walima ka Travel Router dɔ don a kɔnɔ walasa ka portal doncogo dafa telefɔni na"]
    F -->|"So/Hotspot Wi-Fi bɛ ɲɔgɔn sɔrɔ, nka ping 8.8.8.8 b’a fɔ ko ‘General Failure’."| H{"Yala VPN kliyan sirilen bɛ ‘Connecting / Kill-Switch Active’ kɔnɔ WA WA EDR Isolating ye wa?"}
    H -->|"VPN Client ko 'Network Lock / Kill Switch Active - A tɛ se ka se Gateway ma'."| I["VPN KILL-SWITCH LOCK: Yɛlɛma ka taa telefɔni hotspot la -> Walima ka IT One-Time Disable Password don Zscaler / AnyConnect / GlobalProtect kɔnɔ"]
    H -->|"VPN bɛ dabila walima a tigɛlen don, OR lakana pop-up bɛ fɔ ko ‘Host Isolated’."| J["EDR NETWORK CONTAINMENT: Wi-Fi to ɲɔgɔn na -> Ka Corporate SOC wele -> Jatigila tɔgɔ di -> SOC bɛ ‘Lift Containment’ digi OR ka Offline Maintenance Token di"]

Ɲɛjirali 1nan : Ɔridinatɛri ɔridinatɛri min bilala dankan na EDR fɛ "Network Containment" (CrowdStrike, SentinelOne, Defender) fɛ¶

Bi baarakɛyɔrɔw ka ɔridinatɛriw bɛ baara kɛ ni Endpoint Detection and Response (EDR) sensɛriw ye minnu bɛ se ka kɛ kernel-level ye sanni ka kɛ mɔgɔw ka laadala antivirus porogaramuw ye. Ni EDR sensɛri ye kɛwalew kɔlɔsi minnu bɛ i n’a fɔ ɛntɛrinɛti binkanni - i n’a fɔ porogaramu injiniyɛri min bɛ binary bolonɔbilalen dɔ lajɛ, kunnafonidilan min bɛ PowerShell walima Python otomatiki script gɛlɛn dɔ baara, ni dilanbaga dɔ bɛ jatebɔsɛbɛn dɔ da wuli min bɛ se ka kɛ ni makɔrɔ ye, walima taamakɛla min bɛ tali kɛ lotɛli rezo dɔ la min bɛ se ka ARP spoofing pakew bɔ - tulonkɛ gafe min bɛ otomatiki la, o bɛ Network daminɛ Containment (Jatigila danfara).

EDR Network Containment quarantine dɔ dɔncogo¶

A tɛ i n’a fɔ Wi-Fi jigincogo nɔgɔman, EDR kɔlɔsili bɛ fɛɛrɛ taamasiɲɛ kɛrɛnkɛrɛnnenw jira kosɛbɛ:

Wi-Fi bɛ "Connected" walima "No Internet, Secured" jira, O bɛɛ n'a ta, Sigida LAN minɛnw tɛ ye: I tɛ se ka ping kɛ i yɛrɛ ka so routeur (192.168.1.1), tɛ se ka sɛbɛnni kɛ ka taa sigida ka ɛntɛrinɛti sɛbɛnnikɛlan dɔ la, ani ping 8.8.8.8 bɛ segin ka na General failure walima Transmit failed o yɔrɔnin bɛɛ (<1 ms) bawo EDR sensɛri ka Windows Filtering Platform (WFP) weleli bolibaga bɛ TCP/UDP/ICMP pake bɛɛ minɛ k’a fili sanni a ka se Wi-Fi karti ma don dɔ.
Active Remote Desktop, Slack, Zoom ani Browser Sessions Freeze Simultaneously: Seginkanni 2 kɔnɔ, kɛwale daminɛni kɔfɛ, sosɛti bɛɛ bɛ da siɲɛ kelen.
Ka Sigida EDR cogoya lajɛ cikan sira fɛ (No Admin Rights Needed):
CrowdStrike Falcon: Da wuli cikan ɲinini (cmd.exe) ka boli sc query csagent. Ni a b’a jira STATE: 4 RUNNING, ani boli netstat -ano | findstr :443 b'a jira ko dɔrɔn min bɛ baara kɛ ESTABLISHED bɔli ɲɔgɔndan minnu bɛ ɔridinatɛri bɛɛ kan olu ye CSFalconService.exe ka kuma AWS/CrowdStrike sankaba IP ladɛrɛsiw fɛ, i ka jatigila bɛ Falcon Network Containment kɔnɔ.
SentinelOne: Aw ye SentinelOne shield taamasiyɛn bulama lajɛ sistɛmu kɔnɔ (walima menu bar macOS kan). Ni a yɔrɔ ka jan, a ka ciden cogoya bɛ kalan ** .Network Quarantined / . Disconnected from Network by Management**.
Microsoft Defender for Endpoint (MDE): Windows Security kunnafoni tositi dɔ bɛ se k’a fɔ waati kunkurunnin kɔnɔ ko "Nin minɛn in farala ɲɔgɔn kan i ka ɲɛmɔgɔ fɛ," while MsSense.exe tora taabolo kelen ye min bɛ Sɔn tasuma-fanga-minɛn fɛ.

I bɛ se ka kɛ cogo min na ka bɔ dankan na yɔrɔjan fɛ (Online Cloud Release vs. Offline Maintenance Token)¶

Fɛɛrɛ fila bɛ yen aw ka IT Security Operations Center (SOC) bɛ se ka EDR ka danfara bila:

Segin-ka-bɔnye sira	Ni A bɛ Baara Kɛ	Taabolo tigitigi min bɛ Kɛ ni IT SecOps ye
Sira A: Sankaba min bɛ fiɲɛ kan (Teliya: Seginnkanni 30)	Ni i ka ɔridinatɛri bɛ ni ɛntɛrinɛti raw baarakɛta ye (i n’a fɔ i ka so Wi-Fi walima i ka smartfon ka selilɛri Wi-Fi hotspot - A TƐ lotɛli minɛyɔrɔ ye min ma sɛgɛsɛgɛ).	1. Aw bɛ aw ka ɔridinatɛri Wi-Fi don aw ka so routeur walima smartphone cellular hotspot la. 2. Aw bɛ aw ka IT Service Desk / SOC wele telefɔni na ani ka aw ka Ɔridinatɛri Jatigila tɔgɔ di (boli `hostname` in Command Prompt kɔnɔ). 3. SOC sɛgɛsɛgɛlikɛla bɛ lasɔmini daminɛlen lajɛ CrowdStrike Falcon, SentinelOne, walima Defender dakun na, k’a taamasiyɛn iko nkalon pozitif ɲuman, ka "Lift Containment" / "Reconnect to Network." digi. 4. Ikomi EDR sensɛri ka ɲɛnabɔli sira sirilen bɛ sɔn ka tɛmɛ quarantine firewall fɛ, i ka ɔridinatɛri bɛ unlock cikan sɔrɔ seginkanni 15 fo 60 kɔnɔ** ani ɛntɛrinɛti dafalen bɛ segin a yɛrɛma k’a sɔrɔ a ma daminɛ kokura.
Sira B: Siɲɛ kelen Offline Ladonni Token / Passphrase (Ni sankaba kanal bɛ bali)	Ni i sirilen bɛ lotɛli/aviyɔn Wi-Fi dakun kɔfɛ min ma sɛgɛsɛgɛ walima ni tasuma-fanga sariya tiɲɛnen dɔ bɛ hali EDR sankaba dusukun tantanni bali.	1. Ikomi EDR sensɛri tɛ se ka se sankaba konsolɛ la fo n’i donna lotɛli Wi-Fi dakun na (wa i tɛ se ka lotɛli Wi-Fi dakun doni k’a sɔrɔ EDR sensɛri bɛ i ka navigatɛri bila dankan na), i k’a fɔ SOC sɛgɛsɛgɛlikɛla ye ko i bɛ offline / captive-portal cogo la. 2. SOC sɛgɛsɛgɛlikɛla bɛ i ka ɔridinatɛri kɛrɛnkɛrɛnnen ka Unique Agent ID (`AID`) u ka konsolɛ kɔnɔ ani ka minɛn kɛrɛnkɛrɛnnen dɔ labɛn siɲɛ kelen ladonni taamasiyɛn (CrowdStrike) walima Agent Passphrase (SentinelOne) min bɛ kɛ ni taamasiyɛn 24 ye. 3. Baara kɛ ni cikan kɔrɔtalen ye walima ni agent UI ye, ka token (`CsUninstallTool.exe /maintenance` walima `sentinelctl unprotect -k "<passphrase>"`) ka containment filter driver jigin sigida la.

Ɲɛjirali 2nan: VPN Kill-Switch walima ZTNA Captive-Portal Deadlock min karilen don tuma bɛɛ¶

Ni i ka ɔridinatɛri tɛ SecOps ka danfara la, nka o nɔ na, a bɛ baarakɛda dɔ ɲɛminɛ Always-On VPN walima Zero-Trust Network Access (ZTNA) kliyan (Zscaler Client Connector, Cisco AnyConnect / Cisco Secure Client ni Network Visibility Module, Palo Alto GlobalProtect, walima Netskope) min labɛnna ni Strict ye, o bɛ kɛ cogo di Kill-Switch ("Fail-Closed" / "Ka taamasiyɛnw bɛɛ bali minnu tɛ tɔnw ye ni dannaya tɛ")?

1. "Hotel / Airport Captive Portal Deadlock" (Kɔnɔ-ni-kɔnɔ-jaan) ɲɛnabɔli .¶

Nin ye mun ye yɔrɔjan baarakɛla ba caman bɛ datugu u ka ɔridinatɛriw kɔnɔ sɔgɔma o sɔgɔma lotɛli, kafew ani awiyɔnbonda la:

Walasa ka ɛntɛrinɛti sɔrɔ lotɛli walima awiyɔnbonda Wi-Fi kan, i ka kan ka ɛntɛrinɛti yɔrɔ dɔ da wuli, ka sira wɛrɛ sɔrɔ HTTP/DNS fɛ ka taa lotɛli sigida don yɔrɔ la (captive.apple.com walima neverssl.com), ka i ka so nimɔrɔ ni i tɔgɔ laban sɛbɛn.
Nka, i ka tɔn ka ɔridinatɛri ka Always-On VPN Kill-Switch b’a ye ko lotɛli Wi-Fi ye "Untrusted Non-Corporate Network" ye, wa a bɛ sigida HTTP ni DNS ɲininiw bɛɛ bali o yɔrɔnin bɛɛ fo VPN tunnel sirilen min bɛ taa tɔnba ɲɛmɔgɔso la, o ka ɲɔgɔn sɔrɔ.
VPN tunnel tɛ se ka ɲɔgɔn sɔrɔ fo n’i y’i ka so nimɔrɔ sɛbɛn lotɛli don yɔrɔ la, ani i tɛ se ka lotɛli don yɔrɔ doni bawo VPN Kill-Switch bɛ i ka navigatɛri bali.

Aw bɛ nin bypass fɛɛrɛ naani sɛgɛsɛgɛlenw dɔ kɛ walasa ka deadlock tiɲɛ joona k’a sɔrɔ aw mago tɛ admin rights la:

+-----------------------------------------------------------------------+
|  4 WAYS TO BREAK A VPN KILL-SWITCH CAPTIVE PORTAL DEADLOCK            |
|                                                                       |
|  METHOD 1 (Smartphone USB/Wi-Fi Tethering + MAC Clone / Travel Router)|
|  Authenticate the hotel captive portal on a pocket Travel Router      |
|  (or Android Wi-Fi Share), then connect your work laptop to the       |
|  already-authenticated router Wi-Fi.                                  |
|                                                                       |
|  METHOD 2 (Built-In Mini Captive Portal Browser Inside VPN Client)    |
|  Click the Zscaler / GlobalProtect / AnyConnect tray icon ->          |
|  Click "Captive Portal Detected / Open Login Window".                 |
|                                                                       |
|  METHOD 3 (Gateway IP Direct Entry in Browser)                        |
|  Run `ipconfig` -> Find "Default Gateway" (e.g., 10.0.0.1) ->         |
|  Type `http://10.0.0.1` directly into Edge/Chrome address bar.        |
|                                                                       |
|  METHOD 4 (Authenticate on Phone First -> Call IT for Disable Code)   |
|  Tether laptop to Phone Cellular Data -> Get Zscaler/VPN Disable      |
|  Password from IT -> Pause VPN for 10 min -> Join Hotel Wi-Fi.        |
+-----------------------------------------------------------------------+

Fɛɛrɛ 1 - Smartphone Wi-Fi Bridge walima Pocket Travel Router Trick (A bɛ baara kɛ waati kɛmɛsarada la 100):
I ka baarakɛyɔrɔ ɔridinatɛri tɛ se ka danfara don lotɛli Wi-Fi réseau min ma sɛgɛsɛgɛ ani i yɛrɛ ka routeur min donna kaban lotɛli dakun na.
Ni telefɔni Android b’i bolo (Wi-Fi Sharing): I ka Android telefɔni don lotɛli Wi-Fi la, ka so nimɔrɔ minɛlen dondaw dafa i ka telefɔni ekran kan, o kɔfɛ, i ka telefɔni Mobile Hotspot da (bi Samsung Pixel/Android telefɔniw bɛ Wi-Fi Repeater / Wi-Fi Sharing mode dɛmɛ waati kelen na, k’i ka lotɛli Wi-Fi lase i ka telefɔniw fɛ hotspot ni zeru selilɛri kunnafoniw bɛ baara kɛ). I ka baarakɛyɔrɔ ɔridinatɛri siri i ka telefɔni yɔrɔ la: VPN bɛ don o yɔrɔnin bɛɛ.
Ni aw bɛ Pocket Travel Router ta (i n’a fɔ GL.iNet Beryl/Slate; aw ye a lajɛ baara kɛli yɔrɔjan na ka bɔ lotɛli dɔ la): I ka taama routeur siri lotɛli Wi-Fi la, ka lotɛli doncogo dafa ni i ka smartfon navigatɛri ye, ka i ka baarakɛyɔrɔ ɔridinatɛri don i ka taama routeur ka WPA3 Wi-Fi walima Ethernet port la.
Fɛɛrɛ 2nan - Local Default Gateway IP sɛbɛn ka ɲɛsin i ka navigatɛri kɔnɔ (http://10.x.x.x):
Tuma caman na, VPN Kill-Switch walima Zscaler DNS proxy bɛ DNS domani tɔgɔ ɲininiw (bɔgɔli) dɔrɔn de minɛ neverssl.com walima google.com), k’a sɔrɔ a bɛ sira di hali bi sigida subnet IP pake raw ma u ka se sigida routeur da la fo segin 60 Wi-Fi jɛɲɔgɔnya kɔfɛ.
Da wuli cikan-sɛbɛn (cmd.exe), suguya ipconfig, ani ka Default Gateway IP adrɛsi lajɛ jukɔrɔ Wireless LAN adapter Wi-Fi (misali la, 172.16.0.1 walima 192.168.20.1).
I ka navigatɛri da wuli ka ** sɛbɛn .http://172.16.0.1** (ka baara kɛ ni http://, abada https://, ani nimɔrɔ tigitigi minnu bɛ bɔ i ka Default Gateway) kɔnɔ ka taa ladɛrɛsi yɔrɔ la. O bɛ lotɛli ka portal captive controller (dakun minɛlen) gosi IP fɛ k’a sɔrɔ a ma mago ɲɛ DNS resolution (DNS resolution) la, ka donna-yɔrɔ jira.
Fɛɛrɛ 3nan - Baara kɛ ni Zscaler / GlobalProtect / AnyConnect "Open Captive Portal" Butɔn ye walima Baara daminɛ kokura:
Zscaler Client Connector (ZCC) kɔnɔ: Zscaler finɛtiri da wuli ka bɔ sistɛmu sanubɔlan kɔnɔ, ** digi .More** -> Troubleshoot -> Restart Service (min tɛ daɲɛ dogolen wajibiya wa a bɛ seginkanni 30 dakun surun dɔ da wuli captive-portal detection window seginni waati).
Palo Alto GlobalProtect kɔnɔ: I ka tigɛli saba menu digi GlobalProtect sanubɔlan pop-up sanfɛ kinin fɛ -> Settings -> General -> ni cogoya b'a fɔ ko "Captive Portal Detected," i bɛ bulu ** digi .Remediate** butɔni walasa ka GlobalProtect ka sandboxed mini-browser daminɛ.

2. "Zombie VPN Adapter / DNS Loopback tiɲɛnen ( ) labɛnni.`127.0.0.1` walima `100.64.0.1`)" Crash dɔ kɔfɛ."¶

Ni i bɛ so i ka Wi-Fi nɔrɔlen kan, ani i ka ɔridinatɛri batiri salen kɔfɛ walima a tiɲɛnen kɔfɛ k’a sɔrɔ i bɛ jɛkulu ka VPN la, i ka ɔridinatɛri bɛ daminɛ ni zero DNS resolution ye do (websitew b’a fɔ DNS_PROBE_FINISHED_NXDOMAIN, ani i tɛ se ka hali jɛkulu ka VPN baarakɛla ka domɛni tɔgɔ ɲɛnabɔ walasa ka VPN cɛsiri kokura)?

O bɛ kɛ ni VPN kliyan dɔ tiɲɛna k’a sɔrɔ a ma i ka Wi-Fi karti DNS sigicogo lasegin saniya, k’i ka réseau adaptateur to kudayi a ɲɛsinna IP tunnel virtuel salen ma (100.64.0.1 ka ɲɛsin Zscaler/Tailscale CGNAT ma walima 127.0.0.1): .

Windows DNS Cache ani Winsock Catalog (A bɛ baara kɛ ni Admin Rights tɛ DNS Flush la):
Command Prompt da wuli ka boli ipconfig /flushdns.
Boli nslookup vpn.yourcompany.com 8.8.8.8 (ka fɛn wɛrɛ bila a nɔ na vpn.yourcompany.com ni i ka sosiyete ka VPN gateway jatigila tɔgɔ ye). Ni a bɛ fara a kan 8.8.8.8 ka se a laban ma nslookup cikan, i bɛ i ka ɔridinatɛri ka sigida DNS ɲɛnabɔlan tiɲɛnen tɛmɛn ka Google ka foroba DNS ɲininkali kɛ k’a ɲɛsin (ni port 53 dabɔra) walasa k’i ka tɔn ka VPN dakun IP ladɛrɛsi jatebɔ raw dɔn.
Jɛɲɔgɔnya kɛ ni tɔnba ka VPN dakun ye ni a ka IP adrɛsi jateden raw ye:
Ni Cisco AnyConnect walima GlobalProtect dɛsɛra ni "A tɛ se ka sèrwɛri ladɛrɛsi ɲɛnabɔ," i ka IP adrɛsi jateden raw nɔrɔ (203.0.113.50) ka don VPN sèrvèr box kɔnɔ k’a ɲɛsin (ni sariya y’a to) walima ka IT wele walasa ka Zscaler / VPN App-Profile Disable Password sɔrɔ walasa ka réseau virtuel adaptateur (ncpa.cpl).

Ɲɛjirali 3nan: Ka segin ka bɔ EDR Kernel Driver Blue Screen (`BSOD`) Bootloop (Boloci) ye¶

Zuluyekalo san 2024, kanal labɛncogo kura tiɲɛnen dɔ gɛrɛla CrowdStrike Falcon Windows sensor (csagent.sys / Channel File 291) kɛra sababu ye diɲɛ kɔnɔ, baarakɛda Windows masin miliyɔn 8,5 ka tiɲɛ yɔrɔnin kelen PAGE_FAULT_IN_NONPAGED_AREA Blue Screen of Death bootloop sanni operasɔn sitɛmu yɛrɛ ka se ka don ɛntɛrinɛti la walasa ka fix dɔ telesarse. O butiki suguw bɛ kɛ tuma ni tuma ni SentinelOne (SentinelMonitor.sys), Microsoft ka lafasalikɛla (WdFilter.sys), walima VPN NDIS filɛri bolifɛnw bɛ ɲɔgɔn sɔrɔ ni Windows kuraman kura ye.

Parce que (bari) sofɛrɛ min bɛ ka bɔnɛ, o labɛnna i n’a fɔ ** .BOOT_START (Start = 0) kernel driver**, Windows b’a don hakili la a daminɛ segin fɔlɔ yɛrɛ la - waati jan sanni Wi-Fi walima sankaba ɲɛnabɔli ka daminɛ. Fɛɛrɛ kelen min bɛ se ka a labɛn BOOT_START kernel driver bootloop bɛ sigida la Windows Recovery Environment fɛ (WinRE).

+-----------------------------------------------------------------------+
|  HOW TO BREAK AN EDR KERNEL DRIVER BSOD BOOTLOOP VIA WinRE            |
|                                                                       |
|  1. Force-interrupt boot 2-3 times (or hold Shift + Restart on        |
|     Recovery screen) until "Choose an option" blue menu appears.      |
|  2. Click Troubleshoot -> Advanced options -> Command Prompt          |
|     (or Startup Settings -> F4/F5 Safe Mode).                         |
|  3. Read the 8-character "Recovery Key ID" on screen to your IT       |
|     Helpdesk over the phone -> Type the 48-digit BitLocker Key.       |
|  4. In WinRE Command Prompt, locate the Windows partition (`C:` or    |
|     `D:`), delete the corrupted `.sys` channel file or rename the     |
|     faulty driver folder, and type `wpeutil reboot`.                  |
+-----------------------------------------------------------------------+

Sigida WinRE Seginkanni senfɛ-senfɛ (A bɛ ɲɛminɛ ni i ka IT dɛmɛnan ye telefɔni kan)¶

A don Windows Recovery Environment kɔnɔ (WinRE):
Buti fila tugu-tugulen kɔfɛ minnu ma ɲɛ, Windows 10 ni Windows 11 bɛ Recovery ("A bɛ iko Windows ma doni ka ɲɛ") ekran bulu jira u yɛrɛma.
Aw ye ** digi .See advanced repair options** -> Troubleshoot -> Advanced options -> Command Prompt (o bɛ teliya wa a bɛ segin-ka-bɔnye dɔɔnin de wajibiya ka tɛmɛ Safe Mode kan).
Disiki Encrypté da wuli ni i ka 48-Digit BitLocker Recovery Key ye:
Ikomi i ka tɔn ka disiki gɛlɛn sirilen don ni BitLocker ye, WinRE bɛna o yɔrɔnin bɛɛ ɛkran bulu dɔ jira min b’a fɔ ko: "Enter the recovery key for this drive" ka fara Key ID kan (8 hexadecimal characters, i n’a fɔ A1B2C3D4).
I ka sosiyete ka IT Helpdesk wele i ka telefɔni seleke naani kan, ka i ka ɔridinatɛri ka Hostname / Asset Tag kalan u ye ani BitLocker Key ID min bɛ ni taamasiyɛn 8 ye, ani ka fɛɛrɛtigi bila ka BitLocker Recovery Key jateden 48 kalan ka segin (a faralen don bloki 8 kan ni jateden 6 ye). Nimɔrɔ 48 sɛbɛn ka ɲɛ ani ka digi Enter.
A dɔn Drive Letter jumɛn bɛ i ka Windows Installation minɛ WinRE kɔnɔ:
WinRE segin-ka-bɔnye sigida kɔnɔ, i ka Windows drive kunba bɛ to ka di drive letter ** .D:** walima ** .E:** sani C: (bari EFI/Recovery tilayɔrɔba dogolen fitinin bɛ ta C:).
Ka sɛbɛen masin na dir C:\Windows ani ka digi Enter. Ni a ko File Not Found, ka sɛbɛen masin na dir D:\Windows fo ka se ka drive letter sɔrɔ min kɔnɔ i ka Windows foli (foli) kɔnɔ.
Ka kanal File bɔli walima Driver tɔgɔ caman cili kɛ (Per IT Instructions):
Ni aw b’a fɛ ka CrowdStrike Channel File Update tiɲɛnen sɔrɔ: Aw bɛ taa CrowdStrike driver directory (cd /d C:\Windows\System32\drivers\CrowdStrike walima D:\Windows\System32\drivers\CrowdStrike), ka kanal filen tiɲɛnen sɛgɛsɛgɛ min ɲɛfɔra i ka IT jɛkulu fɛ (misali la, del C-00000291*.sys), ani ka digi Enter. Parce que kanal .sys dosiyew ye sariya kura ye min bɛ se ka wuli sanni ka kɛ kɔnɔko ye csagent.sys motɛri, ka kanal filen tiɲɛnen dɔ bɔ yen, o b’a to Windows ni Falcon sensor bɛ se ka daminɛ saniya ani ka kanal file jɔlen telesarse ka bɔ sankaba la.
Ka ɲɛsin VPN sabanan walima Lakanali Filɛri Driver tiɲɛnen ma: I ka IT ɲɛmɔgɔ ka cikan fɛ, i ka bɔnɛ kɛrɛnkɛrɛnnen tɔgɔ caman wɛrɛ da .sys bolifɛntigi (ren C:\Windows\System32\drivers\<FaultyDriver>.sys <FaultyDriver>.sys.bak) walima k' a ka baara daminɛ nafa bali sɛbɛnfura kɔnɔ min tɛ ɛntɛrinɛti kan (reg load HKLM\OfflineSystem C:\Windows\System32\Config\SYSTEM), o kɔ aw bɛ ** sɛbɛn .wpeutil reboot** ka daminɛ kokura Windows kɔnɔ cogo bɛnnen na.

Warning

Mun na i man kan ka i ka BitLocker Recovery Key nimɔrɔ 48 tila abada Chat walima Email la min ma sɛgɛsɛgɛ. Ni i ka IT Helpdesk ye i ka BitLocker Recovery Key nimɔrɔ 48 di telefɔni fɛ walasa ka bootloop dɔ labɛn, i kana a sɛbɛn abada sɛbɛn nɔrɔlen kan min sirilen bɛ ɔridinatɛri la walima k’a mara email sɛbɛn kɔnɔ min ma siri. Mɔgɔ o mɔgɔ bɛ o kilisi 48 sɔrɔ, o bɛ se k’i ka tɔn ka disque dur bɛɛ decrypt kɛ k’a sɔrɔ a ma kɛ ɛntɛrinɛti kan. A kɔlɔsi ko baarakɛda sigida minnu ɲɛnabɔlen don koɲuman (Microsoft Intune / Entra ID / MBAM) bɛ u yɛrɛma BitLocker segin-ka-bɔnye kilisi kura yɛrɛyɛrɛ wuli (ka segin) kɔfɛ ni i ka ɔridinatɛri daminɛna ka segin Windows kɔnɔ dɔrɔn, ka don jɛkulu ka rezow la.

Sigidaw ka kɔrɔtɔko nimɔrɔw ani baaradaw ka sariyaw¶

Hali ni yɔrɔjan baarakɛla kelen ka ɔridinatɛri bilali dankan na, a ka c’a la, o ye nkalon pozitif walima captive-portal kɛlɛ ye min bɛ kɛ yɔrɔnin kelen, EDR datugucogo barikama walima BSOD wulicogo barikama waati kelen na baarakɛɲɔgɔn caman cɛ, o bɛ se ka kɛ taamasiyɛn ye diɲɛ feerekɛlaw ka tiɲɛni walima baarakɛda ka kunmabɔnafolo ko kɛlen dɔ min bɛ baara la:

Etazuni ani Kanada: Ni EDR ka dankarili walima jamaba ka bootloop ye nɔ bila 911 ciyɔrɔw la, dɔgɔtɔrɔso dɔgɔtɔrɔso baarakɛyɔrɔw la, kɔrɔtɔko yɔrɔw la, walima awiyɔn/tɛmɛsira infɔrɔmasiko, aw bɛ teliya ka sigida Continuity of Operations (COOP) / Downtime Paper Protocols baara ani ka 911 wele walasa ka ɲɛnamaya lakanani kɔrɔtɔko dɔw kɛ. Sibɛri ko jugu minnu kɛra yɔrɔ bɛɛ la, olu fɔ CISA (Sibɛri lakanani ni fɛnsɔrɔko lakanani baarada) ye 1-844-SAY-CISA (1-844-729-2472 walima cisa.gov/report) ani Kanada ka sibɛri lakanani baarada la 1-833-CYBER-88.
Royaume-Uni: Aw bɛ telefɔni 999 wele walasa ka ɲɛnamaya lakanani kɔrɔtɔlenw sɔrɔ. Baarakɛda minnu bɛ kɛ ɛntɛrinɛti kan ani kunmabɔnafolo minɛni ko minnu bɛ Angletɛri jɛkuluw de kan, olu ka kan ka fɔ Jamana ka ɛntɛrinɛti lakanani baarada (NCSC) fɛ ncsc.gov.uk.
Erɔpu tɔnba: Aw bɛ 112 wele walasa ka kɔrɔtɔko baara kɛ. EU NIS2 Directive (Directive (EU) 2022/2555) ani GDPR sariyasen 33 kɔnɔ, seko ni dɔnko baarada minnu ka gɛlɛn kosɛbɛ, olu ka kan ka baarakɛcogo tiɲɛnibaw walima lakanako gɛlɛnw fɔ u ka jamana CSIRT (Computer Security Incident Response Team) ani ENISA ye.
Ɔsitarali ani Zelande kura: Aw bɛ 000 wele Ɔsitarali walima 111 Nuwɛlika walasa ka kɔrɔtɔko baara kɛ. Baarakɛda ka ɛntɛrinɛti lakanani kunbɛnni walima wari ɲinini ko kɛlenw fɔ Australian Signals Directorate’s Australian Cyber Security Center (ASD ACSC) ye nin yɔrɔ in na 1300 CYBER1 (1300 292 371) walima CERT NZ / NCSC NZ.
Endi ani Azi Pasifiki: Aw bɛ 112 wele Ɛndujamana na (ka jɛkulu ka ɛntɛrinɛti ko kɛlenw fɔ CERT-In ye), 119 Japon ani Kore Dugu, walima 995 Singapuri (SingCERT). Walasa ka diɲɛ kɔnɔ kɔrɔtɔko nimɔrɔw dɔn, aw ye sɛbɛn ɲɛ kɔrɔtɔko nimɔrɔw.

Tip

I ka "$30 Pocket Travel Router" ni Smartphone USB Tethering Cable ta i ka ɔridinatɛri bɔrɔ kɔnɔ: Lafasali ɲuman kelen min bɛ se ka kɛ ka ɲɛsin tɔnw ka Always-On VPN captive-portal lockouts ma ni i bɛ taa, o ye taama routeur ye min bonya bɛ se i ka bɔrɛ kɔnɔ (i n’a fɔ GL.iNet router) min ni USB-C data cable faralen don ɲɔgɔn kan i ka smartfon na. Ikomi i bɛ lotɛli walima awiyɔn Wi-Fi tiɲɛ i ka telefɔni seleke naani ɲɛ kan taama-sira fɛ, i ka tɔn ka ɔridinatɛri ka Zscaler walima AnyConnect ciden bɛ WPA3 rezo saniyalen, a yɛrɛ ta, min sɛgɛsɛgɛra ka kɔn, o dɔrɔn de ye, wa a tɛ a ka captive-portal kill-switch daminɛ abada.

Ɲininkali minnu bɛ kɛ tuma caman na¶

Mun na CrowdStrike Falcon walima SentinelOne ye n ka baarakɛyɔrɔ ɔridinatɛri bila dankan na k’a sɔrɔ n tun tɛ kojugu si kɛ?¶

Bi Endpoint Detection and Response (EDR) furaw tɛ banakisɛw siginiden dɔntaw dɔrɔn sɛgɛsɛgɛ; u bɛ taabolo kɛcogo kɔlɔsi waati yɛrɛ la, hakilijagabɔ pikiri, ani cikan-sɛbɛnw sɔsɔliw ni kɛwalew jateminɛcogo ye (`IOAs` - Binkanni jiralanw). Baara sariyalen minnu bɛ kɛ tuma caman na minnu bɛ to ka EDR Network Containment otomatiki trip, olu dɔw ye porogaramu dilannikɛlaw ye minnu bɛ sigida jɔli sɛbɛnw walima debuggers bolonɔbilalenw baara, IT baarakɛlaw bɛ baara kɛ `nmap` walima PowerShell ka réseau sɔrɔli cikanw, ka USB rubber-ducky-style macro keypad dɔ don min ma yamaruya, walima ka don lotɛli Wi-Fi routeur labɛnbali dɔ la min bɛ ARP-spoofing / Man-in-the-Middle lafasali sariyaw daminɛ. Ni i ye i ka SOC wele o yɔrɔnin bɛɛ, o b’a to sɛgɛsɛgɛlikɛla dɔ bɛ se ka taabolo jiri sɛgɛsɛgɛ ani k’i ka baara kɛtaw sɛbɛn fin miniti damadɔ kɔnɔ.

Ni n ka ɔridinatɛri bɛ EDR Network Containment kɔnɔ, yala n ka IT jɛkulu bɛ se ka n ka ekran ye hali bi walima ka n bila ka n bila dankan na yɔrɔjan wa?¶

Ɔwɔ, ni i ka ɔridinatɛri bɛ Wi-Fi réseau baarakɛlen dɔ la hali bi (i n’a fɔ i ka so routeur walima i ka smartfon ka selilɛri hotspot). Ni CrowdStrike Falcon, SentinelOne, walima Microsoft Defender for Endpoint ye ɔridinatɛri bila Network Containment kɔnɔ, kernel filter driver bɛ baarakɛlaw ka taamacogo nɔgɔman bɛɛ bali k’a sɔrɔ a bɛ TLS ɲɛnabɔli tunnel sirilen kɛrɛnkɛrɛnnen dɔ da wuli k’a jɛya ɔridinatɛri ka EDR sensor ni sankaba konsolɛ cɛ. O ɲɛnabɔli sira fɛ, i ka SOC sɛgɛsɛgɛlikɛla bɛ se ka yɔrɔjan sɛgɛsɛgɛlikɛlan dɔ da wuli (`Real Time Response` ka CrowdStrike walima `Live Response` in Defender) ani ka "Lift Containment" digi walasa k'i ka réseau doncogo segin segin 30 kɔnɔ k'a sɔrɔ i ma foyi sɛbɛn.

Mun na n ka baarakɛyɔrɔ ɔridinatɛri barika banna ka BitLocker Recovery Key ɲini n’a ye nimɔrɔ 48 ye, k’a sɔrɔ n y’a don lotɛli monitor walima USB-C docking station kɔnɔ?¶

Enterprise Windows ɔridinatɛriw bɛ baara kɛ ni karti ba ka **Trusted Platform Module (TPM 2.0)** puce ye walasa ka fɛnɲɛnamafagalan tigitigiw suman ani ka kɔn ka daminɛ ka labɛn (**Platform Configuration Registers `PCR 0, 2, 4, 7, 11`**) tuma o tuma n’i ye kuran butɔni digi. N’i ye sanpɛrɛn dock, kɛnɛma USB drive, walima monitor hub don min bɛ UEFI daminɛcogo walima PCIe DMA bisi labɛncogo Changer sani Windows ka daminɛ, TPM bɛ hardware sumanikɛlan caman yeli ye, wa a bɛ ban ka decryption key bila a yɛrɛma, o bɛ a ɲini i fɛ i ka BitLocker Recovery Key 48 digit kɛ i n’a fɔ sonyali kunbɛnni lakanani. Fɔlɔ, **aw ka USB-minɛnw bɛɛ, docks (dakunw) ani HDMI kabɔriw bɔ a la ka ɔridinatɛri daminɛ kokura a yɛrɛ ye** - waati kɛmɛsarada la 90, TPM sumanikɛlan bɛ bɛn tugun ani ɔridinatɛri bɛ daminɛ Windows kɔnɔ yɛrɛ k’a sɔrɔ a mago tɛ nimɔrɔ 48 kilisi la.

Yala ne yɛrɛ bɛ se ka Zscaler Client Connector, Cisco AnyConnect, walima GlobalProtect bali ka baara kɛ ni Windows Task Manager ye wa?¶

Ayi, jɛkulu ka ɔridinatɛri min labɛnna ka ɲɛ, i tɛ se ka mɔgɔ faga `ZSATray.exe`, . `CSFalconService.exe`, . `vpnagent.exe`, walima `PanGPS.exe` ka bɔ Baarakɛlaw ɲɛmɔgɔ fɛ. O lakanabagaw bɛ baara kɛ i n’a fɔ **Windows Protected Processes (`Protected Process Light / PPL` / . `ELAM` Anti-Malware baarakɛminɛnw)** minnu bɛ `SYSTEM` ni kernel yɛrɛlafasali bolifɛnw ye; hali ni baarakɛla dɔ ka sigida ɲɛmɔgɔw ka josariyaw bɛ a la, Windows bɛ ban `Access Denied` ni i b’a ɲini ka PPL lakanani baarakɛyɔrɔ dɔ dabila k’a sɔrɔ **Tamper Protection / App-Profile Disable Password** kriptografiki ma sɔrɔ min bɔra baarakɛyɔrɔ sankaba konsolɛ la.

Ni ne bɛ baara kɛ waatibolo wɛrɛ la ani ni ne ka sosiyete ka IT Helpdesk bɛ sunɔgɔ la ni ne ka ɔridinatɛri datugulen don do?¶

Fɔlɔ, i k’a lajɛ ni i ka jɛkulu bɛ ni **24/7 Security Operations Center (SOC) walima On-Call Major Incident Hotline** ye min danfaralen don ni tile IT Helpdesk sariyalen ye (baarakɛda fanba minnu bɛ baara kɛ ni CrowdStrike walima SentinelOne bɛnkan ye ni 24/7 Managed Detection and Response ye`MDR`] jɛkulu walima ka PagerDuty escalation nimɔrɔ dɔ mara baarakɛwaati kɔfɛ, min sɛbɛnnen bɛ i ka baarakɛlaw ka intranet kan walima onboarding sheet kan). Filanan, ni i ka dasiri ye **BitLocker Recovery Key screen** ye, i k’a lajɛ n’i bɛ se ka don i ka tɔn ka **Microsoft 365 / Entra ID "My Account" dakun na (`myaccount.microsoft.com/device-list`)** ka bɔ i ka smartfon navigatɛri la ni i ka MFA authenticator app ye - baarakɛda caman b’a to baarakɛlaw k’u yɛrɛ ka ɔridinatɛri ka BitLocker seginkanni kilisi 48 sɔrɔ u yɛrɛ ka baarakɛminɛnw na u ka telefɔni selilɛri fɛ.

Mun na ne ka so Wi-Fi bɛ baara dabila ne ka baarakɛyɔrɔ ɔridinatɛri kan, ne ni jɛkulu ka VPN tigɛlen kɔfɛ dɔrɔn?¶

Jɛkulu ka VPN labɛncogo dɔw bɛ baara kɛ ni fɛɛrɛ ye min bɛ wele ko **"Always-On Quarantine / Trusted Network Detection (TND)"** min bɛ ɛntɛrinɛti sɔrɔli bɛɛ bali ni laɲini ye tuma o tuma ni VPN tunɛri tigɛra k’a sɔrɔ a bɛ jɛkulu ka biro so farikoloma kɔkan, walasa ka kunnafonidilanw bɔli bali. Tuma wɛrɛw la, VPN ka ɲɔgɔndan tigɛlen bɛ DNS sèrvɛrɛ ladɛrɛsi kɔrɔlen to (`10.x.x.x`) min maralen bɛ i ka Wi-Fi adaptateur kan walasa i ka so routeur kana se ka ɛntɛrinɛti ladɛrɛsiw ɲɛnabɔ. Dɔrɔn **segin ka don jɛkulu ka VPN** la (walima ka boli `ipconfig /flushdns` ani ka Wi-Fi Off and On wuli) walasa i ka siraw ka sira saniya ka tɛmɛ jɛkulu ka da la min yamaruyara.

Gafe minnu bɛ tali kɛ o ko la¶

Sosow ani ɲɛmɔgɔyaso ka bilasiralikan¶

CISA (Cybersecurity and Infrastructure Security Agency): Ka labanyɔrɔ dɔnni ni jaabi (EDR) Kernel Sensor tiɲɛniw ni BitLocker seginni taabolo jɛnsɛnnenw labɛn ka kɛɲɛ ni sɛgɛsɛgɛli ye.
Microsoft Corporation (Microsoft Learn): BitLocker Recovery Guide: TPM PCR Validation Lockouts gɛlɛyaw ɲɛnabɔli ani ka baara kɛ ni WinRE Command Prompt ye walasa ka Boot-Critical Drivers ɲɛnabɔ ani Microsoft Defender for Endpoint Machine Isolation Architecture.
NIST (National Institute of Standards and Technology): NIST ka gafe kɛrɛnkɛrɛnnen 800-207: Zero Trust Architecture (ZTA) ani NIST SP 800-83 Rev. 1: Gafe min bɛ porogaramu juguw kunbɛnni ni u ɲɛnabɔcogo kan tabali ni ɔridinatɛriw kama.
CrowdStrike, Inc. & SentinelOne: Falcon Sensor Network Containment Architecture, Ladonni Token Jigincogo, ani Kanal File Lasegin sɛbɛnw.
Zscaler & Cisco Systems: Ka Portal Captive Detection ɲɛnabɔ tuma bɛɛ Zero Trust Network Access (ZTNA) kɔnɔ ani Fail-Closed Firewall politiki gɛlɛnw na.