ʻO ka moʻokāki Cloud Production (AWS/GCP/Azure) a i ʻole Domain Hoʻokuʻu ʻia: Hoʻonui koke ʻia a me ka Failover¶

E ala aʻe i nā kaukani o PagerDuty mau mākaʻikaʻi a me nā mea kūʻai aku kelepona no ka mea ʻo kāu pūnaewele hana holoʻokoʻa, noi SaaS, API, a me nā hui. @yourcompany.com Ua nalowale ka leka uila mai ka pūnaewele (ʻaʻole no ka code bug, akā no ka mea, ua kau kāu ** domain registrar i kahi clientHold ʻO ka hoʻokuʻu ʻia ʻana ma kāu kikowaena mua** a i ʻole AWS, Google Cloud (GCP), a i ʻole Microsoft Azure i hoʻokuʻu i kāu mea hoʻolimalima kapuaʻi hana) he ulia pōpilikia hana. I kēlā me kēia lā, ʻeleʻele loa nā ʻoihana waiwai no ka pau ʻana o ke kāleka hōʻaiʻē ʻoihana a kekahi limahana mua, ua hōʻailona wahaheʻe kekahi bot anti-phishing i kahi PDF i hoʻouka ʻia e ka mea hoʻohana ma ka bakeke S3, kahi leka uila leka uila **ICANN WHOIS i hoʻopaʻa inoa ʻole ʻia ma hope o 15 mau lā, a i ʻole kahi kī IAM leaked i wili i ka ʻae ʻole ʻana o ka mea hāʻawi kālā crypto-mining.

Inā kākoʻo kāu kikowaena a i ʻole ʻōnaehana kapuaʻi i ke kelepona mālama ola koʻikoʻi, ka hoʻouna pilikia, a i ʻole nā ​​​​pūnaewele palekana hoʻohana lehulehu, e hoʻāla koke i nā hemahema ma ka hale a haʻi aku i nā lawelawe pilikia inā pili ka palekana o ka lehulehu (e kelepona iā 911 ma ʻAmelika Hui Pū ʻIa a me Kanada, 112 ma waena o ka European Union, 999 ma United Kingdom; e ʻike i nā mea āpau. helu pilikia). No nā pilikia ʻenehana like ʻole a me nā ʻoihana hana, e ʻike hoʻolālā hoʻomau ʻoihana a me ka hoʻihoʻi ʻana i ka pōʻino, ʻoihana ransomware a me ka uhaki kikowaena, a ʻO ka pau ʻana o ka wahi kūʻai (POS) a i lalo ka pūnaewele.

E hana i kēia i kēia manawa¶

1. **Holo i 10 kekona whois a dig +trace e ʻimi mai kahi pahu e hoʻoholo ai i kāu inoa Domain (clientHold) a i ʻole kāu moʻokāki Cloud Hosting (AWS/GCP/Azure). Holo whois yourdomain.com | grep -i "status": ina ike oe clientHold, serverHold, redemptionPeriod, a i ʻole nā ​​inoa inoa i hoʻololi ʻia i sedoparking.com / verification-hold.suspended-domain.com, ke holo maikaʻi nei kāu mau kikowaena kapuaʻi, a ʻo ka pau ʻana he 100 pakeneka ma ka Domain Registrar level.
2. E hoʻololi i kāu kamaʻilio pilikia pilikia mai kāu mea mua @yourcompany.com leka uila koke. Ke hoʻokuʻu ʻia a kau ʻia paha kāu kikowaena mua clientHold, ka leka uila MX komo mai a pau i @yourcompany.com bounce, me nā leka uila hoʻoponopono hou ʻana i ka ʻōlelo huna, nā code hōʻoia 2FA, a me nā tikiki pane mai kāu mea kākau inoa pūnaewele a me AWS Trust & Safety. E nānā koke inā paʻa kāu moʻokāki a i ʻole ka mooolelo aʻa kapuaʻi i kahi @yourcompany.com helu leka uila; inā pēlā, e hoʻolako i kahi hui waho @gmail.com a i ʻole ka helu ʻāina lua ma kēlā me kēia palapala kākoʻo a me ke kelepona.
3. **Inā aia kāu kikowaena clientHold ma muli o ka leka uila ICANN WHOIS (ka 15-Day Rule), e kaomi i ka loulou hōʻoia a i ʻole e hoʻololi i ka Email Registrant ma ka portal registrar. koi ʻia e kau i ka domain ma clientHold (ka paka ana i ka DNS). ʻO ka hoʻouna hou ʻana a me ke kaomi ʻana i kēlā loulou leka uila e wehe clientHold i loko o 15 a 60 mau minuke.
4. **Inā hoʻokuʻu ʻia kāu kikowaena e ka Luna Kakau "Hoʻomāinoino / Trust & Safety" no ka hoʻomāinoino ʻia ʻana o ka phishing, malware, a i ʻole hōʻailona hōʻailona, ​​​​mai pane wale i ka pila pila pepa hōʻino. I ka manawa koke: (a) wehe a hoʻokaʻawale paha i ka URL hewa ʻole/ka hoʻoili ʻia ʻana o ka mea hoʻohana i hōʻike ʻia i loko o ka hoʻopiʻi, (b) e hoʻouna i ka Ause Cure Proof + False-Positive Escalation ma o ke kelepona ola a me ke kamaʻilio kamaʻilio ʻana, a © e wili i kahi Secondary Mirror Domain (yourcompany.co a i ʻole yourcompany-app.com) no laila hiki i nā mea kūʻai a me nā mea kūʻai aku API ke hoʻomau i ka hana ʻoiai e hoʻolaha ana ʻo DNS.
5. **Inā hoʻopaneʻe ʻo AWS, GCP, a i ʻole Azure i kāu waihona kapuaʻi hana no ka Pili ʻole ʻana, e uku i ke koena i hala me ke kāleka panakō lua A i ʻole uea/ACH a wehe i kahi Ticket Hoʻōla Hoʻihoʻi Pili Kūʻē Kūʻē. Paʻa nā bākeke S3 i loko o ka moku hau hau no 30 a 90 mau lā ma mua o ka holoi mau ʻana. ʻO ka uku ʻana i ke koena i hala ma ka Root Billing Console e hoʻāla hou ʻia i loko o 15 minuke a i 4 hola.
6. **Inā hoʻopanee ʻo AWS, GCP, a i ʻole Azure i kāu moʻokāki no ka "Acceptable Use Policy (AUP) / Trust & Safety / Compromised IAM Key", e hoʻohuli koke i nā kī IAM āpau a pane i ka ID Case ID ma ka Root Support Center. E hoʻohana i ka MFA i ka mea hoʻohana Root, a hoʻopili i kahi Root-Cause & Remediation Report i ka hihia kākoʻo Trust & Safety.

lāʻau hoʻoholo: ʻike a hoʻoholo i kahi kahua hana a i ʻole ka hoʻokuʻu ʻana i ke ao¶

flowchart TD
    Start["KA PALAPALA PALAPALA: Paenaewele, API, a me ka leka uila i lalo"] --> Diag["Holo i ka 10-Second Terminal Diagnosis: whois yourdomain.com A eli + trace yourdomain.com"]

    Diag -->|"Hōʻike ʻo WHOIS i ka clientHold, serverHold, redemptionPeriod, a i ʻole NS paʻa"| DomainCrisis{"He aha ke kumu o ka hoʻokuʻu ʻia ʻana o ke Kakau Kakau Domain?"}

    DomainCrisis -->|"1. ICANN 15-Day WHOIS Email Verification Failure"| ICANNFix["E hoʻopaʻa inoa -> E hoʻouna hou i ka leka uila hōʻoia RAA (a i ʻole e hōʻano hou i ka mea kākau inoa i ka hana Gmail) -> Kaomi i ka loulou -> Noho i 15 a 60 min"]
    DomainCrisis -->|"2. Kāleka ʻAiʻe i pau ʻole / ʻAʻole hōʻano hou i ke kāleka hōʻaiʻē"| RenewFix["E uku i ka uku hou (me $ 80- $ 250 Uku Hoʻihoʻi inā 30+ mau lā i hala aku nei) -> Hoʻihoʻi i nā Nameservers maʻamau -> Flush Public DNS"]
    DomainCrisis -->|"3. Kakau Kakau / Phishing / Malware Hoʻokuʻu"| AbuseFix["1. Wehe i ka URL i hōʻailona ʻia/faila ma ke kikowaena 2. Waiho i ka False-Positive / Remediated Proof me ka Registrar Trust & Safety 3. Hoʻā i ka Secondary Failover Domain"]

    Diag -->|"Hoʻoholo maikaʻi ka Domain DNS, akā ua hoʻihoʻi ʻo Cloud IPs/Console moʻokāki"| CloudCrisis{"No ke aha i hoʻokuʻu ai ʻo AWS / GCP / Azure i ka Cloud Tenant?"}

    CloudCrisis -->|"1. ʻAʻole hiki ke hoʻopaʻa kālā (kāleka pau ʻole / hōʻole ʻia ʻo Bank ACH / Limit Hit)"| CloudBill["1. E ʻeʻe ma ke ʻano he Root User / Billing Admin 2. E hoʻohui i kahi kāleka hōʻaiʻē hou a i ʻole kāleka kākoʻo a kaomi 'E ho'āʻo hou i ka uku' 3. E wehe i ka hihia kākoʻo hoʻihoʻi kālā."]
    CloudCrisis -->|"2. Kākoʻo IAM Key / Rogue Crypto-Mining Spend Spike"| CloudSec["1. Hoʻololi/ Holoi i nā kī komo IAM i leaked."]
    CloudCrisis -->|"3. Hae hoʻomāinoino a ka ʻaoʻao ʻekolu / DMCA / AUP ma S3 / VM"| CloudAUP["1. Hoʻokaʻawale a holoi paha i ka mea S3 i hōʻailona ʻia / VM IP 2. E pane i ka AWS/GCP Trust & Safety Case ID me WAF/Upload guardrails."]

Māhele 1: ʻO ka maʻi forensic 3-minuke (ʻo ia ka Domain Registrar, DNS, a i ʻole ka Cloud Provider?)¶

Ke pōʻeleʻele kāu noi hana a hoʻōho nā limahana "ua pau nā mea āpau, ʻo kā mākou leka uila," mai kuhi. E holo i kēia mau kauoha ʻekolu mai kekahi pahu pona (macOS, Linux, a i ʻole Windows WSL/PowerShell) e kuhikuhi i ka papa kuhikuhi pololei i hoʻokuʻu iā ʻoe.

1. Kauoha 1: E nānā i nā code kūlana ICANN Extensible Provisioning Protocol (EPP)¶

Holo:

whois yourdomain.com | grep -E -i "Status|Name Server|Expiry"

Māhele 2: Hoʻoholo i ka hoʻokuʻu ʻia ʻana o ke Kakau Kakau Domaine (clientHold / Hoʻomāinoino / Laka ICANN)¶

Ina kou whois hōʻike hōʻike clientHold a i ʻole nā inoa inoa paʻa, e hahai i ke ala hoʻihoʻi pololei ma lalo.

Track A: Hoʻokiʻekiʻe i kahi ICANN WHOIS Hoʻopaʻa Hoʻopaʻa leka uila (15-Minute Hoʻoponopono)¶

Ma lalo o ka ICANN 2013 RAA Whois Accuracy Program, i kēlā me kēia manawa āu e hoʻopaʻa inoa ai i kahi domain hou, e hoʻololi i kahi kikowaena, a i ʻole e hoʻololi i ka inoa mua o ka mea kākau inoa, ka inoa hope, a i ʻole ka leka uila, e hoʻouna ka mea kākau inoa i kahi leka uila koi ʻia ʻo "IMMEDIATE VERIFICATION koi ʻia no kāudomain.com." 1. E ʻeʻe i kāu papa hoʻopaʻa inoa inoa. E hōʻike ʻia kahi hae ʻulaʻula ʻulaʻula ma ka piko o ka pale: "Ua hoʻokuʻu ʻia kēia kahua me ka kali ʻana i ka hōʻoia hoʻopili ʻana iā ICANN Whois." 2. The Catch-22 Trap: Inā ʻo ka leka uila ma ka faila admin@yourdomain.com, ** ʻaʻole hiki iā ʻoe ke loaʻa ka leka uila hōʻoia no ka mea yourdomain.com ua hoʻokuʻu ʻia i kēia manawa.** 3. Ka Hoʻoponopono: I loko o nā hoʻonohonoho Domain Contact / WHOIS o ka mea kākau inoa, e hoʻololi i ka **Wāhi leka leka uila ** i kahi leka uila e hana ana (e like me kahi @gmail.com e mālama i ka hoʻololi, kaomi "Resend Verification Email," wehe i ka Gmail inbox, a kaomi i ka loulou hōʻoia. 4. Hoʻouna koke ka API automated o ka mea kākau inoa i kahi EPP update kauoha e wehe clientHold mai ka Verisign/Registry root zone i loko o 5 a 20 minuke.

Track B: Hoʻokiʻekiʻe i kahi Kakau Kakau "Hōʻino / Phishing / Malware / AUP" Hoʻokuʻu¶

I kēia lā, kau inoa nā mea kākau inoa nui (Namecheap, GoDaddy, Tucows/Enom/OpenSRS, Porkbun, Cloudflare Registrar, Squarespace Domains) i nā hānai hoʻoweliweli hoʻoweliweli (Netcraft, PhishTank, Spamhaus, Google Safe Browsing, AbuseIPDB). Inā hoʻololi ka mea hacker i kahi plugin WordPress ma kahi subdomain marketing poina (promo.yourdomain.com), a i ʻole inā hoʻouka kekahi mea hoʻohana i ka PDF login hoʻopunipuni i ka bakeke maʻiʻo mea hoʻohana SaaS app (cdn.yourdomain.com/uploads/invoice.pdf), ke hoʻouna aku nei kekahi boti maʻemaʻe i kahi Tier-1 Phishing Takedown Notice i kāu mea kākau inoa, a waiho ʻia e kahi ʻaelike hoʻokō ma waho o ka ʻāina i kāu ** domain root (yourdomain.com)** ma clientHold.

ʻO ka piʻi ʻana i kēlā me kēia ʻanuʻu e loaʻa clientHold hāpai ʻia i nā hola ma mua o nā lā¶

1. E ʻimi i ka ID Ticket hōʻino pololei a me ka URL i Haʻi ʻia:
2. E nānā i ka pahu leka uila e pili ana me kāu moʻokāki hoʻopaʻa inoa (a me ka pilina ʻo WHOIS Abuse) no kahi leka uila mai abuse@, legal@, a i ʻole compliance@[registrar].com.
3. E ʻimi i ka ** URL pololei a i ʻole IP address** i ʻōlelo ʻia ma ka hōʻike hoʻomāinoino.
4. Hoʻoponopono a hoʻokaʻawale paha i ka Puna i Haʻi ʻia koke:
5. ʻOiai ʻo ka hoʻopiʻi hoʻopiʻi he hoʻopunipuni (no ka laʻana, ua hōʻailona hewa ʻia kāu ʻaoʻao inoa inoa Single Sign-On [SSO] ma ke ʻano he "Microsoft 365 phishing page" e kahi scanner AI), ** hoʻopaʻa manawa a waiho i kahi papa inoa ʻae IP ma mua o ke ala i hōʻailona ʻia** inā hiki, a i ʻole e hopu i nā kiʻi kiʻi e hōʻoiaʻiʻo ana ʻo ia kāu portal authenticated.
6. Inā hewa maoli ka faila i hoʻouka ʻia e ka mea hoʻohana a i ʻole subdomain i hoʻopaʻa ʻia, ** holoi koke i ka faila/paʻa**, hoʻokuʻu i ka moʻokāki o ka mea hoʻohana ʻino, a kāpae i ke ala ma kāu ʻaoʻao Cloudflare/WAF.
7. E hoʻouna i ka pane "Executive Abuse Cure & Critical Infrastructure Escalation":
8. E pane pololei i ka palapala hōʻino a ka mea kākau inoa (mālama i ka pololei [Ticket #...] ʻO ke kumuhana kumu no laila e hele ai kā lākou parser iā ia) AND kelepona i ka laina kākoʻo kelepona 24/7 o ka mea kākau inoa e noi i kahi luna e hōʻailona i ka Ticket Hoʻomāinoino ma ke ʻano "SaaS Hoʻopuka / False Positive: Remediation Complete."
9. E hoʻokomo i kēia mau manaʻo hōʻoia 4 i kāu pane kākau:
   1. Ka hōʻoia o ka wehe koke ʻana: "ʻO ka URL i hōʻike ʻia ([exact URL]) he waiwai kūʻai kūʻai ʻole ʻia e nā ʻaoʻao ʻekolu a ua holoi mau ʻia ma [Timestamp UTC]. Hoʻihoʻi ʻo ia iā HTTP i kēia manawa 404 Not Found / 410 Gone."
   2. Ua hoʻokō ʻia nā ala kiaʻi hoʻomalu ʻōnaehana: "Ua hoʻohana mākou i nā lula o ka Web Application Firewall (WAF), hoʻopaʻa i ka hoʻouka ʻana i nā faila lehulehu ʻaʻole i hōʻoiaʻiʻo ʻia, a ua hoʻololi i nā hōʻoia kikowaena āpau e pale ai i ka hana hou ʻana."
   3. ** Hoʻolaha Hoʻolaha Pāʻoihana Kūʻē ʻole:** "Ke kau nei i ka waihona apex kumu yourdomain.com ma clientHold ua lawe iho i ka hana hana a me ka leka uila hui no [Number] nā mea kūʻai aku i nā ʻoihana kūpono. "
   4. ** Noi no ka wehe koke ia clientHold:** "E ʻoluʻolu e wehe i ka EPP clientHold kūlana ma yourdomain.com koke. Hoʻopaʻa mākou i ka pane ʻana i nā hōʻike hoʻomāinoino i ka wā e hiki mai ana i loko o 2 mau hola me ka ʻole e koi ʻia kahi paʻa kumu-domain."
10. E hoʻomaʻemaʻe i ka "Negative Caching (NXDOMAIN)" TTL ma Public DNS Resolvers i ka wā i hāpai ʻia:
11. ʻO ka manawa e wehe ai ka mea kākau inoa clientHold, ua hoʻi kāu kikowaena i ka .com nā kikowaena kumu, akā Google Public DNS (8.8.8.8), Cloudflare DNS (1.1.1.1), a hiki i ka OpenDNS ke hoʻomau i ka mālama ʻana i nā mea make NXDOMAIN a i ʻole ka pane paʻa no 15 a 60 mau minuke.
12. E kipa koke i nā mea hana hoʻoheheʻe cache-flush pūnaewele manuahi ma Google Public DNS Flush Cache (developers.google.com/speed/public-dns/cache) a me Cloudflare 1.1.1.1 Hoʻomaʻemaʻe Cache (one.one.one.one/purge-cache/), ʻano yourdomain.com (a A, AAAA, NS, MX), a kaomi i ka Flush Cache no laila e hui hou nā mea hoʻohana honua i loko o 60 kekona.

Māhele 3: Hoʻoholo i ka hoʻokuʻu ʻia ʻana o kahi moʻokāki Production Cloud (AWS, Google Cloud, Microsoft Azure)¶

Ke hoʻokuʻu nei ʻo Amazon Web Services (AWS), Google Cloud Platform (GCP), a i ʻole Microsoft Azure i kahi moʻokāki kapua a i ʻole papahana, ke kaʻina hana hoʻihoʻi e hilinaʻi nui ʻia inā i hoʻomaka ʻia ka hoʻokuʻu ʻia e ** Billing / Payment Failure** versus ** Trust & Safety / Compromised Credentials**.

Ka hoʻohālikelike ʻana o nā manawa hoʻomaha hoʻomaha a me nā puka makani hoʻāla hou¶

Kūkākūkā kikoʻī 1: Hoʻihoʻi hou ʻana mai ka hoʻokuʻu ʻia ʻana o ke kālā kālā (ke hōʻole ke kāleka a i ʻole ka uea)¶

No ke aha e loaʻa ai nā ʻoihana kālā maikaʻi i ka hoʻokuʻu ʻia ʻana o ka bila? 1. Ua paʻa ke kāleka hōʻaiʻē ma ka waihona i kāna palena hoʻolimalima hui o kēlā me kēia mahina (e laʻa., palena $25,000) ma muli o ka spike autoscaling hope o ka mahina a i ʻole ka hoʻohou hou ʻana o Reserved Instance makahiki; 2. No ka ka mea hoʻokumu i haʻalele a i ʻole VP of Engineering nona kā kāleka i kāpae ʻia e HR/Finance; a i ʻole 3. Ua ālai ʻia ka ʻōnaehana hoʻopunipuni automated o ka panakō i kahi uku nui AWS/GCP ma ke ʻano he "kāleka kānalua-ʻaʻole i kēia manawa."

Ka papa inoa hoʻihoʻi hoʻihoʻi kālā he 30 mau minuke¶

1. E ʻeʻe wale ma ke ʻano he Root Account Owner a i ʻole Luna Hoʻokele Pili: ʻAʻole hiki i nā hana IAM Developer/Admin maʻamau ke komo i ka pale hoʻihoʻi kālā hoʻopaʻa ʻia ke hoʻokuʻu ʻia kahi moʻokāki. E hoʻohana i ka AWS Root User email (a i ʻole GCP Billing Account Administrator / Azure Account Administrator).
2. **Mai kaomi wale "E ho'āʻo hou" ma ke kāleka hōʻole ʻia ma mua o ke kāhea ʻana i ka panakō: ** Inā ua kāohi ka mīkini hoʻopunipuni o kāu panakō i kahi uku AWS $14,000, kaomi "E ho'āʻo hou" ʻekolu manawa i ka console AWS e hoʻāla hou i ʻekolu hōʻole paʻakikī a laka i ke ʻano uku. paha:
3. E hoʻokomo i kāleka hōʻaiʻē hui ʻokoʻa a i ʻole kāleka hōʻaiʻē (e hoʻokaʻawale i ka uku ma nā kāleka ʻelua inā ʻae ka console o ka mea hoʻolako i nā uku hapa); A I OLE
4. Kāhea i ka helu kelepona ma ke kua o ke kāleka hui mua, e hoʻomaʻemaʻe i ka pākaukau hoʻopunipuni kālepa o ka panakō i ka poloka kalepa ma Amazon Web Services / Google Cloud / Microsoft Azure a hoʻokiʻekiʻe i ka palena pāʻani hoʻokahi no 24 mau hola, a a laila kaomi i ka Retry Payment i loko o ka console cloud.
5. Inā Uku Kou Hui ma ka Invoiced Wire / ACH (Net-30 Enterprise Accounts) a me kahi Invoice i hele i 60+ mau lā i hala:
6. E hoʻouna i Same-Day Fedwire (ʻaʻole he 3-lā ACH) no ke koena piha i hala, e hoʻoiho i ka panakō kūhelu Wire Confirmation Receipt i loaʻa ka IMAD/OMAD Federal Reference Number, a e hoʻopili pololei i kēlā PDF i kahi ** Billing & Account Support Case ** e noi ana i kahi manual koke ** Promise-to-Transit ** Ke Keʻena Kūʻai / Transit. hoʻolauleʻa i ka uea.
7. E hōʻoia i ka mokuʻāina ma hope o ka hoʻihoʻi hou ʻana (ʻo ka "Trap VM & Dynamic IP" i pani ʻia):
8. Ke hoʻāla hou ʻo AWS, GCP, a i ʻole Azure i kahi moʻokāki i hoʻokuʻu ʻia, **ʻaʻole i hoʻopaʻa hou kekahi mau mīkini virtual (ʻoi aku ka Azure Deallocated VM a me GCP Compute Engine) i kā lākou iho , a ʻo kēlā me kēia mīkini i hoʻohana ʻole i kahi ** Elastic IP / Reserved Static IP ** e puka mai me kahi ** IP IP lehulehu hou.
9. E nānā koke i kēlā me kēia wahi ma EC2 / Compute Engine / Azure VMs, e hoʻomaka i nā manawa i kū, e hōʻoia i kāu Elastic Load Balancers a me nā ʻikepili RDS. Available, a e nānā i kāu DNS A ʻike mau nā moʻolelo i kāu IP lehulehu.

Kūkākūkā kikoʻī 2: Hoʻihoʻi ʻana mai kahi Cloud Security / Kiʻi i hoʻopaʻa ʻia / Trust & Suspension Safety¶

Inā hana hewa ka mea hoʻomohala i kahi .env waihona i loaʻa kahi AWS_ACCESS_KEY_ID a AWS_SECRET_ACCESS_KEY (a i ʻole GCP Service Account JSON kī) i kahi waihona GitHub lehulehu, ʻimi nā bots hacker automated i kēlā kī i loko o 1.5 kekona a wili i 200 mau manawa GPU nunui (p4d.24xlarge) ma nā wahi like ap-east-1 a i ʻole sa-east-1 i kaʻu cryptocurrency a i ʻole hoʻomaka i nā hoʻouka kaua DDoS. I loko o nā hola, ʻike ʻo AWS/GCP Trust & Safety i ka anomaly a kau i kahi ** Protective Security Quarantine / Account Suspension ** ma kāu moʻokāki.

Pehea e loaʻa ai iā AWS / GCP / Azure Trust & Safety e hāpai i kahi quarantine palekana ma lalo o 4 mau hola¶

Ke hahai nei nā hui palekana ao i kahi papa inoa koʻikoʻi: e ** hōʻole ** e hoʻāla hou i kāu moʻokāki a hiki i kou hōʻoia ʻana ʻaʻole e hoʻomaka koke ka hoʻouka ʻana. 1. E hoʻopaʻa i kēlā me kēia ʻāpana (me nā ʻāpana kīnā ʻole / koho i loko) a Holoi i ka Vector Compromise: - E komo i loko o ka IAM Console: E hoʻopau a Holoi i ka IAM Access Key i hoʻopaʻa ʻia (a me nā mea hoʻohana IAM backdoor, nā kuleana, a i ʻole nā ​​mea hoʻolako Identity i hana ʻia e hoʻomau i ka hoʻomau). - E ho'ā i ka Hardware a i ʻole Virtual MFA ma ka Root User a me nā mea hoʻohana IAM āpau. - E wehe i ka AWS Resource Explorer / Tag Editor / EC2 Global View (e nānā ana i ** 30+ mau ʻāina honua**, ʻaʻole wale us-east-1) a me Hoʻopau i nā manawa EC2 ʻae ʻole a pau, nā Pūʻulu Scaling Auto, nā pūʻulu EKS, a me nā hana Lambda i wili ʻia e ka mea hoʻouka. 2. E hoʻouna i ka hōʻike hoʻoponopono palekana 4-Part ma ka hihia kākoʻo Official: - E wehe i ka Support Center i kāu ʻoluʻolu kapua a e pane i ka ** moʻolelo palekana / Trust & Safety Case ** me: - 1. Ke kumu: "IAM Mea hoʻohana [Name] kī AKIA... ua ʻike ʻole ʻia i loko o kahi waihona code ma [Time]." - 2. Hoʻihoʻi i ka hōʻoia: "Kī Komo AKIA... a me ka mea hoʻohana ʻino IAM [Name] ua holoi mau ʻia, a ua hoʻokō ʻia ʻo Root/IAM MFA." - 3. Hoʻomaʻemaʻe Punawai ma nā ʻāpana āpau: "ʻO nā manawa EC2 ʻae ʻole āpau ma nā wahi [List Regions] ua hoopauia." - 4. Noi no ka wehe koke ʻana i ka hana + hoʻoponopono pili kālā i hoʻopaʻa ʻia: "ʻO kā mākou hana hana kūpono ma [Your Region] lawelawe [Number] nā mea kūʻai aku a aia ma waho i kēia manawa. E ʻoluʻolu e hoʻokiʻekiʻe koke i ka hoʻokuʻu ʻia ʻana o ka moʻokāki, a ke noi nei mākou i ka hoʻololi ʻana i nā bila pili kālā no ka $[Amount] i nā uku hoʻopiʻi hoʻopunipuni i loaʻa i ka wā o ke komo ʻole ʻia." - (Manaʻo kōkua: Hāʻawi mau ʻo AWS a me GCP i hoʻokahi manawa 100% hōʻaiʻē hōʻaiʻē maikaʻi no nā ʻumi kaukani kālā i nā koina hoʻopunipuni crypto-mining ke hoʻopau ʻoe i kā lākou papa inoa hoʻoponopono hoʻoponopono i hoʻopaʻa ʻia.)

Māhele 4: Ke hoʻā ʻana i kahi ulia pōpilikia "Break-Glass" hoʻopau domain lua ma 30 mau minuke¶

Inā kāu kikowaena mua (yourcompany.com) ua laka ʻia ma lalo o kahi papa inoa serverHold a i ʻole he hoʻopaʻapaʻa kānāwai paʻakikī e 48 a 72 mau hola e hoʻoponopono ai, mai noho ma waho no nā lā ʻekolu. Hiki i kēlā me kēia ʻenehana a me nā ʻoihana e-commerce ke hoʻihoʻi i ka ʻike o ka mea kūʻai aku a me ka leka uila limahana i loko o 30 a 45 mau minuke me ka hoʻohana ʻana i kahi Emergency Secondary Mirror Domain (yourcompany.co, yourcompany.io, a i ʻole getyourcompany.com).

30-Minute ulia pōpilikia lua Domain Cutover Checklist¶

1. E hoʻopaʻa inoa (a i ʻole e hoʻā) i kāu Domain Secondary ma kahi Kakau Kaʻawale: Mai hoʻopaʻa inoa i kāu kikowaena waihona ma ka mea hoʻopaʻa inoa hoʻokahi i hoʻokuʻu wale i kāu kikowaena mua. Kakau inoa yourcompany-app.com a i ʻole yourcompany.co ma kahi kākau inoa kūʻokoʻa (e like me Cloudflare Registrar, Porkbun, a i ʻole AWS Route 53) me ka hoʻohana ʻana i kahi kāleka hui ʻokoʻa a me ka leka uila i hōʻoia ʻia.
2. Hoʻokomo i kāu faila Zone i Cloudflare a i ʻole Alanui 53: Hoʻokuʻu (a kope paha) i kāu DNS A, AAAA, CNAME, a TXT nā moʻolelo mai kāu papa DNS mua i loko o ka waihona ʻāpana o ka domain hou no laila app.yourcompany.co a api.yourcompany.co kuhikuhi i kāu mau mea kaulike hoʻoili hana like.
3. Hoʻohou i kāu Load Balancer / Ingress TLS Certificate (SAN Addition): Hoʻohui *.yourcompany.co a yourcompany.co e like me Subject Alternative Names (SANs) ma kāu palapala AWS ACM / Let's Encrypt / Cloudflare edge SSL, a hoʻohui i ka inoa inoa hou i kāu Nginx/Envoy/ALB host-header routing rules a CORS allowlists.
4. Hoʻohui i ka Domain Secondary ma ke ʻano he Alias Domain Verified ma Google Workspace a i ʻole Microsoft 365:
5. Ma loko Google Workspace Admin Console (admin.google.com -> Moʻokāki -> Nā Kahua -> Manage Domains -> Hoʻohui i kahi inoa inoa inoa) a i ʻole Microsoft 365 Admin Center (Settings -> Domains -> Add Domain), hoʻohui yourcompany.co a hoʻopili i ka hōʻoia TXT a MX nā moʻolelo i loko o kāu kikowaena DNS hou.
6. I loko o 15 mau minuke, loaʻa koke i kēlā me kēia limahana ka leka uila ma firstname@yourcompany.co i loko o kā lākou pahu pahu me ka neʻe ʻana o ka pahu leta ʻole.

Māhele 5: Hoʻopaʻa i kāu waihona a me nā moʻokāki kapua i ʻole e hana hou kēia¶

Ke hoʻi hou mai ka hana ma ka pūnaewele, e hoʻokō i kēia mau pale pale ʻelima i loko o 48 mau hola:

1. E hoʻokō i ka Laka Kakau (serverDeleteProhibited / serverUpdateProhibited / serverTransferProhibited): No nā kikowaena hana koʻikoʻi, e hoʻomaikaʻi i kāu kikowaena i Registry Lock (i hāʻawi ʻia e Cloudflare, MarkMonitor, CSC Corporate Domains, a me nā mea kākau inoa nui), e koi ana i ka hōʻoia cryptographic multi-person out-of-band ma mua o ka hoʻololi ʻana i nā nameservers a i ʻole nā ​​kūlana kikowaena.
2. Mai hoʻokipa i nā maʻiʻo i hana ʻia e ka mea hoʻohana (UGC) a i ʻole nā ​​loulou kūʻai aku ma kāu Domain Apex Production: E lawelawe mau i ka hoʻouka ʻana o nā mea hoʻohana, PDF mea kūʻai aku, a me nā loulou huli leka uila i waho mai kahi ** domain pahu pahu kaʻawale loa** (no ka laʻana, yourcompany-usercontent.com ma kahi o yourcompany.com). Ma ia ala, inā hoʻouka ka mea hoʻohana i kahi faila ʻino e hoʻoulu ai i kahi bot hoʻomāinoino automated registrar, ʻo ke kahua maʻiʻo hoʻopau wale ʻia ka hae ʻia, ʻaʻole loa kāu polokalamu hana kumu a i ʻole leka uila hui.
3. E hoʻonohonoho i nā ala uku ʻelua + ACH Backup + Cloud Billing Anomaly Alerts: E hoʻohui i ** ʻelua kāleka hōʻaiʻē kūʻokoʻa mai ʻelua mau panakō ʻokoʻa** a me ka ACH direct-debit bank account ma AWS, GCP, Azure, a me kāu mea kākau inoa, a hiki iā AWS Cost Anomaly Detection / GCP Budget Alerts i kēlā me kēia lā.
4. Hoʻonohonoho i kahi Kakau Kakau Koho a me Cloud Root leka uila ma ke kahua kūʻokoʻa lua: ʻAʻole loa e hoʻonohonoho. admin@yourcompany.com e like me ka leka uila ho'ōla no yourcompany.com. E hoʻohana i ka pahu leta i hoʻolaʻa ʻia e ka lako kamepiula-YubiKey ma kahi kikowaena hoʻomalu kūʻokoʻa a i ʻole ka mea hoʻolimalima ʻoihana ʻoihana i hiki iā ʻoe ke loaʻa mau i ka hōʻoia a kākoʻo i nā leka uila ʻoiai ke hāʻule kāu kikowaena mua.

Nā helu ulia pōpilikia āpana a me nā protocols oihana¶

Nīnau pinepine¶

Inā hoʻokuʻu ʻo AWS, Google Cloud, a i ʻole Azure i kā mākou moʻokāki no ka uku ʻole a hōʻino paha, ua holoi koke ʻia kā mākou ʻikepili hana a me nā bākeke S3?¶

ʻAʻole. Ke hoʻokuʻu ʻia kahi moʻokāki, kāpae ʻia kāu mau mīkini virtual a paʻa ʻia ke komo ʻana o ka lehulehu i kāu mau bākeke mālama a me nā mea kaulike ukana, **akā 100 ka nui o kāu mau puke EBS, RDS database, S3 mea, a me nā kiʻi paʻi e mālama ʻia i loko o kahi waiho anu no nā lā he 30 liʻiliʻi ** (a ma AWS, hiki ke hoʻihoʻi hou ʻia nā moʻokāki i ka pukaaniani 60 lā a hiki i ka 9 mau lā ma hope o ka pani ʻana). Ke uku ʻoe i ke koena i hala a hoʻoholo paha i ka tikiki Trust & Safety, e hoʻihoʻi ʻia kāu wahi hana kikoʻī me ka ʻole pono e kūkulu hou mai nā waihona.

No ke aha i ho'ōki koke ai kā mākou pūnaewele i ka hoʻoholo me a clientHold ke kūlana i ka wā ʻaʻole hiki ke hoʻololi hou ʻia kā mākou kikowaena no 8 mahina?¶

Ke komo koke mai kahi domain i uku ʻia a mamao loa mai kona lā pau ʻana **`clientHold`**, ʻelua wale nō kumu: (1) **ICANN 15-Day WHOIS Contact Verification Failure** (hōʻano hou kekahi i ka inoa Registrant a i ʻole ka leka uila, a i ʻole ka hoʻololi ʻana i ka domain, a ʻaʻole i kaomi i ka loulou hōʻoia koi i leka uila ʻia i ka mea kākau inoa i loko o 15 mau lā), a i ʻole (2) **Hinoino / Phishing / Malware Hoʻoweliweli i hōʻike ʻia i kāu URL i hoʻopaʻa ʻia i ka hoʻopaʻa inoa hoʻoweliweli ** hui hoʻokō). E komo koke i loko o kāu puka hoʻopaʻa inoa: wehe ʻia kahi paʻa hōʻoia ICANN i loko o 15 mau minuke ma hope o ke kaomi ʻana i ka loulou i hoʻopaʻa ʻia, aʻo ka hoʻopaʻa hoʻomāinoino e pono e pane i ka palapala hoʻopaʻa inoa o ka mea kākau inoa.

No ke aha kā mākou @ourcompany.com e lele pū ana ka leka uila i ka wā i hōʻike ʻia ai kā mākou pūnaewele no kahi loulou phishing maikaʻi ʻole?¶

Ke kau ʻia kahi mea kākau inoa i kahi EPP **`clientHold`** ma kāu kahua kumu (`ourcompany.com`), hoʻopau ke kākau inoa i ka **ʻelele domain holoʻokoʻa (all `NS` records)** mai ka honua `.com` nā kikowaena kumu. No ka mea, ʻaʻole hiki i nā kikowaena leka o ka honua ke nānā hou aku i kāu kikowaena `NS` a i ʻole `MX` nā moʻolelo, kēlā me kēia leka uila e hiki mai ana i `@ourcompany.com` ʻaʻole i hāʻule me ka hewa hulina DNS, ʻoiai inā mālama ʻia kāu leka uila ma Google Workspace a i ʻole Microsoft 365. ʻO ia ke kumu e pono ai ʻoe e kamaʻilio mau me kāu mea kākau inoa mai kahi hui waho. `@gmail.com` a i ʻole ka helu kuhi henua lua i ka wā a `clientHold` pio.

Pehea mākou e hiki ai i kahi kanaka ma AWS, GCP, a i ʻole ka mea kākau inoa domain inā loaʻa iā mākou ka pae kākoʻo manuahi "Basic"?¶

ʻOiai ma ka $0 Basic Support tier, **AWS, GCP, a me Azure e ʻae i nā mea hoʻohana Root o nā moʻokāki i hoʻokuʻu ʻia e wehe i nā hihia kākoʻo "Account a me Billing" kiʻekiʻe me ka uku ʻole **, a ma ka AWS Support Center hiki iā ʻoe ke koho **"Phone"** ma ke ʻano o kāu hoʻopili ʻana no laila ke kelepona pololei ʻo AWS Account & Billing i kāu kelepona i loko o nā minuke. Inā ʻoe e hoʻoholo nei i kahi hoʻopau wikiwiki, hiki iā ʻoe ke hoʻomaikaʻi i kāu moʻokāki AWS ma kahi o loko o ka console i ka ** Business Support ($100/mahina liʻiliʻi)** a i ʻole **Enterprise On-Ramp** tier e wehe koke i ka 15-minuke 24/7 ola ʻenehana loea a me ka piʻi ʻana o ke kelepona.

He aha inā paʻa kahi limahana rogue a ex-developer i ka inoa inoa inoa inoa a i ʻole AWS Root mooolelo a hōʻole e hāʻawi iā ia?¶

Inā hoʻokele ka ex-employe, freelance agency, a i ʻole rogue co-founder i ka mooolelo kākau inoa a i ʻole nā ​​hōʻoia kumu aʻa a hoʻopaʻa i ka ʻoihana, e mālama iā ia ma ke ʻano he hoʻokele hui a me ka pilikia lockout insider. Loaʻa i kēlā me kēia mea hoʻopaʻa inoa kikowaena nui a me ka mea hāʻawi kapuaʻi he **Kaʻina Hoʻihoʻi Pūnaewele / Kaʻina Hoʻopaʻapaʻa Kakau** kahi e hiki ai i ka hui ʻoihana kānāwai ke hoʻouna i kāna **Articles of Incorporation, IRS EIN Letter, inoa inoa inoa ʻoihana, a me nā ʻōlelo pili kālā panakō/kāleka hōʻaiʻē ** e hōʻoiaʻiʻo ana ua uku ʻia ka hui no ka domain a i ʻole ka mea hoʻolimalima kapua e hoʻihoʻi ikaika i ka mana hoʻomalu. E ʻike i kā mākou alakaʻi ma [ka hoʻopaʻapaʻa hui ʻana, ka hoʻoheheʻe ʻana i ka panakō co-founder, a me ka laka ʻoihana](partnership-dispute-rogue-cofounder-bank-drain-and-corporate-lockout.md).

Pehea ka lōʻihi o ka hoʻi ʻana o DNS ma ka honua holoʻokoʻa ma hope o ka wehe ʻana o ka mea kākau inoa clientHold?¶

Ke hoʻouna ka mea kākau inoa i ke kauoha EPP e wehe `clientHold`, ka papa inoa kiʻekiʻe (e like me Verisign for `.com`) hoʻohou i nā kikowaena aʻa i loko o **3 a 15 mau minuke**. Hiki i ka hapa nui o nā mea hoʻohana pūnaewele ke kiʻi hou i kāu pūnaewele i loko o 15 a 30 mau minuke, a hiki iā ʻoe ke wikiwiki a hiki i **ma lalo o 2 mau minuke** no ka hapa nui o nā kaʻa puni honua ma o ka holoi lima lima ʻana i ka hoʻokomo ʻino-cache o kāu kikowaena ma nā palapala pūnaewele lehulehu no **Google Public DNS (`8.8.8.8`)** a me **Cloudflare DNS (`1.1.1.1`)**.

Nā alakaʻi pili¶

• Hoʻolālā hoʻomau ʻoihana a me ka hoʻihoʻi ʻana i ka pōʻino
• ʻO ka ransomware pāʻoihana a me ka uhaki kikowaena
• ʻO ka hoʻopaʻapaʻa hui, ka hoʻoheheʻe kālā co-founder, a me ka laka ʻoihana
• ʻO ka pau ʻana o ka point-of-sale (POS), hoʻohaʻahaʻa i ka pūnaewele, a me ka hoʻoili ʻana i nā kāleka hōʻaiʻē waho

Nā kumu a me ke alakaʻi kūhelu¶

• Pūnaewele Pūnaewele no nā inoa i hāʻawi ʻia a me nā helu (ICANN): 2013 Registrar Accreditation Agreement (RAA) Whois Accuracy Program Specification (15-Day Verification Mandate), Extensible Provisioning Protocol (EPP) Status Codes (clientHold, serverHold, redemptionPeriod), a me ke Kumukānāwai Hoʻopau Hoʻopaʻa Hoʻopaʻa inoa (ERRP).
• ʻO Amazon Web Services (AWS) Palapala Manaʻo: Hoʻokuʻu ʻia ka moʻokāki, hoʻihoʻi hou, a me ka hoʻopaʻa ʻana i ka ʻikepili ma hope o ka pani ʻana (30-lā hoʻokuʻu / 60-lā ma hope o ka pani ʻana i ka puka makani) a me ka AWS Compromised IAM Credential Remediation Protocol.
• Google Cloud Platform (GCP) a me Microsoft Azure Official Documentation: Cloud Billing Delinquency Recovery, Project Trust & Safety Appeal Workflows, and Deallocated Azure Subscription Reactivation Procedures.
• Cybersecurity and Infrastructure Security Agency (CISA, United States) a me National Cyber ​​Security Center (NCSC, United Kingdom): Cloud Security Technical Reference Architecture, Root Account MFA Enforcement, a me Domain Registry Lock Best Practices.
• National Institute of Standards and Technology (NIST, United States): NIST SP 800-61 Rev. 2 (Computer Security Incident Handling Guide) a me NIST SP 800-53 (DNS Integrity and Cloud Access Control Standards).