Ak'haonte ea Cloud Cloud (AWS/GCP/Azure) kapa Domain e Emisitsoe: Keketseho ea Hang-hang le Ho Failover¶

Ho tsosa likeletso tse likete tsa PagerDuty le mehala ea bareki hobane sebaka sa hau sa marang-rang sa tlhahiso ea k'hamphani, sesebelisoa sa SaaS, API, le khoebo. @yourcompany.com lengolo-tsoibila li nyametse ka nako e le ngoe inthaneteng (eseng ka lebaka la phoso ea khoutu, empa hobane **mongolisi oa domain o behile clientHold Ho emisoa sebakeng sa hau sa mantlha ** kapa AWS, Google Cloud (GCP), kapa Microsoft Azure e emisitse mohiri oa hau oa leru) ke ts'ohanyetso e teng. Letsatsi le leng le le leng, likhoebo tse etsang phaello li putlama ka ho felletseng hobane karete ea mokoloto ea mohiruoa ea mehleng e felile, bot e ithorisang e thibelang phishing e ile ea tšoaea PDF e kentsoeng ke mosebelisi ka nkhong ea S3, lengolo-tsoibila le sa netefatsoang ICANN WHOIS le ile la qhoma kamora matsatsi a 15, kapa senotlolo sa IAM se lutlileng se hlakisitse ka mokhoa o sa lumelloang. qhekella potoloho breaker.

Haeba sebaka sa hau sa marang-rang se emisitsoeng kapa marang-rang a marang-rang a ts'ehetsa telemetry ea bophelo bo botle, phepelo ea tšohanyetso, kapa lits'ebetso tsa ts'ireletso ea ts'ebeliso ea sechaba, kenya ts'ebetso hang-hang ba feilang sebakeng sa heno 'me u tsebise lits'ebeletso tsa ts'ohanyetso haeba ts'ireletso ea sechaba e ameha ( letsetsa 911 United States le Canada, 112 ho pholletsa le European Union, 999 United Kingdom; bona kaofela dinomoro tsa tshohanyetso). Bakeng sa mathata a tšoanang a tekheniki le ts'ebetso, bona moralo oa ts'ebetso ea khoebo le ho hlaphoheloa ha likoluoa, khoebo ransomware le tlolo ea molao ea seva, le ho tima (POS) le marang-rang a theohile.

Etsa sena hona joale¶

1. Matha metsotsoana e 10 whois le dig +trace sheba ho terminal ho fumana hore na Domain Name ea hau (clientHold) kapa Cloud Hosting Account (AWS/GCP/Azure) ke eona e hlileng e theohileng. Le ka mohla u se ke ua senya metsotso e 45 ka ho lokisa lihlopha tsa Kubernetes kapa li-balancers tsa cloud load ha mongolisi oa domain a utsoetse li-nameservers tsa hau. Matha whois yourdomain.com | grep -i "status": ha o bona clientHold, serverHold, redemptionPeriod, kapa li-nameservers li fetotsoe ho sedoparking.com / verification-hold.suspended-domain.com, li-server tsa hau tsa maru li ntse li sebetsa hantle, 'me ho tima ke karolo ea 100 lekholong boemong ba Domain Registrar.
2. ** Tlosa puisano ea hau ea ketsahalo ea tšohanyetso ho tloha qalong @yourcompany.com imeile hang hang.** Ha sebaka sa hau sa mantlha se emisoa kapa se behiloe clientHold, **liimeile tsohle tse kenang tsa MX ho @yourcompany.com li-bounces **, ho kenyeletsoa li-imeile tsa ho seta bocha password, likhoutu tsa netefatso ea 2FA, le litekete tsa ho araba ho tsoa ho mongolisi oa sebaka sa hau sa marang-rang le AWS Trust & Safety. Hang-hang hlahloba hore na mo ngolisi oa hau kapa ak'haonte ea motso oa leru e tlameletsoe ho @yourcompany.com aterese ea lengolo-tsoibila; haeba ho joalo, fana ka sehlopha sa kantle ho sehlopha @gmail.com kapa aterese ea sebaka sa bobeli ho tekete e 'ngoe le e' ngoe ea tšehetso le mohala oa mohala.
3. Haeba domain name ea hau e buletsoe clientHold ka lebaka la lengolo-tsoibila le sa netefatsoang la ICANN WHOIS (Molao oa Matsatsi a 15), tlanya sehokelo sa netefatso kapa u fetole Imeile ea Ngoliso sebakeng sa ngoliso. Tlas'a ** Tumellano ea Kamohelo ea Mongolisi oa ICANN 2013 (RAA) Whois Accuracy Specification, haeba Lethathamo la ho Ingolisa le Ngolisoe ka har'a matsatsi a 5 ho reka, tobetsa konopo ea khalendara ea 1 kapa ho hloleha ho tobetsa khalendara. ntlafatso ea puisano, mongolisi o qobelloa ka molao ho beha sebaka sa marang-rang clientHold (ho paka DNS). Ho romella hape le ho tobetsa sehokelo sa lengolo-tsoibila le le leng ho tlosa clientHold nakong ea metsotso e 15 ho isa ho e 60.
4. .* Hang-hang: (a) tlosa kapa u behelle ka thoko URL e khopisitseng/kemiso ea mosebelisi e boletsoeng boipelaetsong, (b) fana ka Abuse Pheko ea Bopaki + Bopaki ba Bohata-Positive Escalation ka deske ea mongolisi ea tlhekefetso ea mohala/moqoqo, le © hlahisa Secondary Mirror Domainyourcompany.co kapa yourcompany-app.com) kahoo bareki le bareki ba API ba ka lula ba sebetsa ha DNS e ntse e phatlalatsa.
5. Haeba AWS, GCP, kapa Azure e emisitse ak'haonte ea hau ea leru ea tlhahiso bakeng sa Ho hloleha ha Tefiso, lefa chelete e neng e behiloe nakong e fetileng ka karete ea bobeli ea banka OR terata/ACH 'me u bule Ticket ea ho Reactivation ea Root-Level Billing. Se ** ** bula ak'haonte e ncha ea AWS/GCP 'me u leke ho falla ho tsoa mehloling e sa fumaneheng ea 1% ea li-account tsa 0% tse sa fumaneheng. ea meqolo ea hau ea EBS, li-database tsa RDS, le libakete tsa S3 li ntse li le sebakeng se leqhoa bakeng sa matsatsi a 30 ho isa ho a 90 pele e hlakoloa ka ho sa feleng. Ho lefa chelete e sirelelitsoeng ka nako ho Root Billing Console ho etsa hore motho a kenye letsoho nakong ea metsotso e 15 ho isa ho lihora tse 4.
6. Haeba AWS, GCP, kapa Azure e emisitse ak'haonte ea hau bakeng sa tlolo ea "Acceptable Use Policy (AUP) / Trust & Safety / Compromised IAM Key", fetola linotlolo tsohle tsa IAM hang-hang 'me u arabele Case ID e tobileng Setsing sa Ts'ehetso sa Motso. Cloud Trust & Safety lihlopha li ke ke tsa ** le ka mohla** ho phahamisa ts'ebetso ea ts'ireletso ho fihlela u paka hore senotlolo se koetsoe. Maemo a EC2/Compute Engine crypto-mining, nolofalletsa MFA ho mosebelisi oa Root, 'me u kopanye le Root-Cause & Remediation Report ho nyeoe ea ts'ehetso ea Trust & Safety.

Sefate sa liqeto: Ho hlahloba le ho rarolla sebaka sa tlhahiso kapa ho emisoa ha leru¶

flowchart TD
    Start["TLHOKOMELISO E KAOFELA: Sebaka sa Marang-rang, API, le lengolo-tsoibila la khoebo le theohile"] --> Diag["Matha Tlhahlobo ea Bobeli ea Bobeli ea 10: whois yourdomain.com LE cheka +trace yourdomain.com"]

    Diag -->|"WHOIS e bontša clientHold, serverHold, redemptionPeriod, kapa NS e pakiloeng"| DomainCrisis{"Ke eng e entseng hore Mongolisi oa Domain a emisoe?"}

    DomainCrisis -->|"1. ICANN 15-Matsatsi a WHOIS ho hloleha ho netefatsoa ka lengolo-tsoibila"| ICANNFix["Kena ho Mongolisi -> Romela hape lengolo-tsoibila la netefatso la RAA (kapa ntlafatsa Ngoliso ho Gmail e sebetsang) -> Tobetsa sehokelo -> Phela ka mor'a metsotso e 15 ho isa ho e 60"]
    DomainCrisis -->|"2. Sebaka se feliloeng ke nako / se hlolehile ho nchafatsa karete ea mokitlane"| RenewFix["Lefa tefiso ea nchafatso (hammoho le Tefiso ea Topollo ea $80-$250 haeba matsatsi a 30+ a felile) -> Khutlisa Li-Nameservers tsa moetlo -> Flush Public DNS"]
    DomainCrisis -->|"3. Tlhekefetso ea Mongolisi / Phishing / Ho Emisoa ha Malware"| AbuseFix["1. Tlosa URL/faele e tšoaelitsoeng ho seva 2. Bopaki ba Bohata bo Bohata / bo Remediated ka Registrar Trust & Safety 3. Kenya Failover Domain ea Bobeli"]

    Diag -->|"Domain DNS e rarolla hantle, empa Cloud IPs/Console return Account Account E Emisitsoe"| CloudCrisis{"Hobaneng ha AWS / GCP / Azure e emisitse Cloud Tenant?"}

    CloudCrisis -->|"1. Ho hloleha ha Tefiso (Karete e Feletseng / Banka ACH Hana / Moedi Hit)"| CloudBill["1. Kena u le Root User / Mookameli oa Tefiso 2. Kenya karete e ncha ea mokitlane kapa karete ea bekapo 'me u tobetse 'Leka Tefo hape' 3. Bula Nyeoe ea Tšehetso ea Ts'ehetso"]
    CloudCrisis -->|"2. E sekiselitsoe IAM Key / Rogue Crypto-Mining Sebelisa Spike"| CloudSec["1. Fetola / Hlakola Linotlolo tsa Phihlello tsa IAM tse lutlileng 2. Felisa maemo a mabifi 'me u nolofalletse Motso oa MFA 3. Araba ho Trust & Safety Case + kopa Spend Waiver"]
    CloudCrisis -->|"3. Letšoao la Tšebeliso e Mpe ea Mokha oa Boraro / DMCA / AUP Abuse Folakha ho S3 / VM"| CloudAUP["1. Arola kapa u hlakole ntho e tšoailoeng ea S3 / VM IP 2. Araba ho AWS/GCP Trust & Safety Case ID ka WAF/Upload guardrails"]

Mokhahlelo oa 1: Tlhahlobo ea forensic ea metsotso e 3 (Na ke Registrar ea Domain, DNS, kapa Cloud Provider?)¶

Ha kopo ea hau ea tlhahiso e fifala mme basebetsi ba hoeletsa hore "tsohle li theohile, esita le lengolo-tsoibila la rona," u se ke oa hakanya. Tsamaisa litaelo tsena tse tharo ho tsoa ho terminal efe kapa efe ea laptop (macOS, Linux, kapa Windows WSL/PowerShell) ho supa hantle lera le u emisitseng.

1. Taelo ea 1: Sheba lintlha tsa boemo ba ICANN Extensible Provisioning Protocol (EPP)¶

Matha:

whois yourdomain.com | grep -E -i "Status|Name Server|Expiry"

Mokhahlelo oa 2: Ho Rarolla ho emisoa ha Mongoli oa Sebaka (clientHold / Tlhekefetso / Senotlolo sa ICANN)¶

Haeba oa hau whois sheba ho senola clientHold kapa li-nameservers tse pakiloeng, latela pina e nepahetseng e ka tlase.

Track A: Ho phahamisa ICANN WHOIS Verification Suspension (15-Minutes Fix)¶

Tlas'a ICANN 2013 RAA Whois Accuracy Program, neng kapa neng ha u ngolisa domain name e ncha, fetisetsa domain name, kapa u fetola Lebitso la Pele la Ngoliso, Lebitso la Pele, kapa Aterese ea Imeile, mongolisi o romela lengolo-tsoibila le nang le sehlooho se reng " TLHOKOMELISO E KANG HAHOLO e hlokahalang bakeng sa yourdomain.com." 1. Kena ka har'a phanele ea taolo ea domain name ea hau. Letlapa le lefubelu le bofubelu bo khanyang holimo skrineng le tla re: "Domeine ena e emisitsoe ha ho ntse ho lebeletsoe ho netefatsoa ke ICANN Whois." 2. The Catch-22 Trap: Haeba Imeile ea Ngoliso faeleng e admin@yourdomain.com, ha o khone ho fumana lengolo-tsoibila la netefatso hobane yourdomain.com ha joale e emisitsoe. 3. The Lokisa: Ka hare ho Litlhophiso tsa Domain Contact / WHOIS, fetola **Aterese ea Imeile e Ngolisitsoeng ** ho ea ho aterese ea kantle e sebetsang (joalo ka @gmail.com aterese eo u e laolang), boloka phetoho, tobetsa "Khutlisa lengolo-tsoibila la netefatso," bula inbox ea Gmail, ebe u tobetsa sehokelo sa netefatso. 4. API ea boiketsetso ea mongolisi hang-hang e romella EPP update ho ntsha taelo clientHold ho tloha sebakeng sa motso sa Verisign/Registry ka hare ho metsotso e 5 ho isa ho e 20.

Pina ea B: Ho Phahamisa Mongolisi "Tlhahiso / Phishing / Malware / AUP" Ho emisoa¶

Kajeno, li-registrar tse kholo tsa domain (Namecheap, GoDaddy, Tucows/Enom/OpenSRS, Porkbun, Cloudflare Registrar, Squarespace Domains) li ingolisa ho liphepelo tsa bohlale ba ts'okelo (Netcraft, PhishTank, Spamhaus, Google Safe Browsing, AbuseIPDB). Haeba senokoane se sekisetsa plugin ea WordPress ho subdomain e lebetsoeng ea papatso (promo.yourdomain.com), kapa haeba mosebelisi a kenya PDF ea ho kena e seng ea nnete ho bakete ea litaba tsa sesebelisoa sa hau sa SaaS (cdn.yourdomain.com/uploads/invoice.pdf), bot e itirisang e romella Tsebiso ea ho Theha ha Phishing ** ea Tier-1 ho mongolisi oa hau, 'me rakonteraka oa ho latela melao ea kantle ho naha o beha motso oohle oa hau ()yourdomain.com) ka clientHold.

Mohato ka mohato ho nyoloha ho fumana clientHold phahamisoa ka lihora ho fapana le matsatsi¶

1. Batla ID ea Tikete ea Tlhekefetso Hantle le URL e tšoailoeng:
2. Sheba lebokose la poso la lengolo-tsoibila le amanang le ak'haonte ea hau ea mongolisi (le lebitso la WHOIS Abuse) bakeng sa lengolo-tsoibila le tsoang ho abuse@, legal@, kapa compliance@[registrar].com.
3. Batla URL e nepahetseng kapa aterese ea IP e qotsitsoeng tlalehong ea tlhekefetso.
4. ** Lokisa kapa U Arole Mohloli o tšoailoeng Hang-hang:**
5. Leha tletlebo e le phoso e fosahetseng (mohlala, leqephe la hau la ho kena le le leng le le leng la khamphani e le 'ngoe [SSO] le tšoailoe ka bohata e le "Microsoft 365 phishing page" ke sekena sa AI), ** thibela ka nakoana kapa beha lenane la tumello la IP ka pel'a tsela e itseng e tšoailoeng** ha ho khonahala, kapa nka linepe tse pakang hore ke mohiruoa ea netefalitsoeng.
6. Haeba faele e kentsoeng ke basebelisi kapa subdomain e sekiselitsoeng e ne e le kotsi e le kannete, ** hlakola faele / setshelo hang-hang **, emisa ak'haonte ea mosebelisi ea hlekefetsang, 'me u thibele tsela ho Cloudflare / WAF ea hau.
7. Romela Karabo ea "Executive Abuse & Escalation Critical Infrastructure":
8. Araba ka kotloloho ho Tikete ea Tlhekefetso ea mongolisi (ho boloka se nepahetseng [Ticket #...] tekeno ea sehlooho e le hore bahlaseli ba bona ba e tsamaise) MME letsetsa mohala oa ts'ehetso oa mohala oa 24/7 oa mo ngolisi ho kopa mookameli ho tšoaea Tikete ea Tlhekefetso joalo ka "Tlhahiso ea SaaS / Positive Maaka: Tokiso e Felletse."
9. Kenyelletsa lintlha tsena tse 4 tsa bopaki bo tlamang karabong ea hau e ngotsoeng:
   1. Tiiso ya ho Tloswa Hanghang: "URL e tlalehiloeng ([exact URL]) e ne e le letlotlo le sa lumelloeng la motho oa boraro / thepa ea papatso e senyehileng mme e hlakotsoe ka ho sa feleng [Timestamp UTC]. Hona joale e khutlisa HTTP 404 Not Found / 410 Gone."
   2. Litlhokomelo tsa Thibelo ea Ts'ebetso li Kentsoe: "Re kentse melao ea Web Application Firewall (WAF), ra thibela ho kenya lifaele tsa sechaba tse sa netefatsoang, 'me ra potoloha lintlha tsohle tsa seva ho thibela ho hlaha hape."
   3. Tsebiso e sa Lekanyetsoang ea Kameho ea Khoebo: "Ho beha sebaka sa mantlha sa motso yourdomain.com ho clientHold e thehile lisebelisoa tsa tlhahiso le imeile ea khoebo bakeng sa [Number] bareki/bahiruoa ba molaong."
   4. Kopo ea ho Tlosoa Hang-hang ea clientHold: "Ka kopo tlosa EPP clientHold boemo ho yourdomain.com hanghang. Re itlama ho arabela litlalehong tsa tlhekefetso ea nakong e tlang nakong ea lihora tse 2 ntle le hore re hloke ho ts'oaroa ka metso."
10. Hlakola TTL ea "Negative Caching (NXDOMAIN)" ho Litharollo tsa Sechaba tsa DNS Hang ha e Phahamisitsoe:
11. Hang-hang mongolisi oa tlosa clientHold, domain name ea hau e khutletse ho .com li-server tsa metso, empa Google Public DNS (8.8.8.8Cloudflare DNS (1.1.1.1), mme OpenDNS e kanna ea tsoela pele ho boloka ba shoeleng NXDOMAIN kapa karabo e emeng metsotso e 15 ho isa ho e 60.
12. Etela hang-hang lisebelisoa tsa mahala tsa cache-flush web ho Google Public DNS Flush Cache (developers.google.com/speed/public-dns/cache) le Cloudflare 1.1.1.1 Hlakola Cache (one.one.one.one/purge-cache/), mofuta yourdomain.com (le A, AAAA, NS, MX), ebe o tobetsa Flush Cache hore basebelisi ba lefats'e ba hokahane hape nakong ea metsotsoana e 60.

Mokhahlelo oa 3: Ho Rarolla ho emisoa ha Akhaonto ea Cloud Cloud (AWS, Google Cloud, Microsoft Azure)¶

Ha Amazon Web Services (AWS), Google Cloud Platform (GCP), kapa Microsoft Azure e emisa akhaonto ea leru kapa morero, mokhoa oa ho hlaphoheloa o itšetlehile ka ho feletseng hore na ho emisoa ho bakiloe ke ** Ho hloleha ha Tefiso / Tefo ** khahlano le ** Tšepo & Tšireletseho / Litlhaloso Tse Senyehileng **.

Papiso ea cloud provider suspension lifecycles le lifensetere tsa ho tsosolosa¶

Leano le Felletseng la 1: Ho Sebetsa ho Tsoa ho Khaotsoang ha Tefiso ea Leru (Ha Karete e Hana kapa Khoele e Tletseng)¶

Hobaneng ha lik'hamphani tse tšehelitsoeng hantle ka lichelete li angoa ke ho emisoa ha litefiso? 1. Karete ea mokoloto faeleng e fihlile ** khoeli le khoeli ea tšebeliso ea khoeli le khoeli ea koporasi ** (mohlala, moeli oa $ 25,000) ka lebaka la sekhahla sa ho qetela sa khoeli le khoeli kapa nchafatso ea selemo le selemo ea Reserved Instance; 2. Karete e ne e le ea mothehi ea tlohileng kapa VP ea Boenjiniere eo karete ea hae e neng e hlakotsoe ke HR/Finance; kapa 3. Sistimi ea bomenemene ea banka e thibetse tefiso e kholo ea AWS/GCP e le "ketso e belaetsang ea karete e seng hona joale."

Lethathamo la mehato ea metsotso e 30 ea ho etsa tefiso hape¶

1. Kena ka ho Fetisisa Joalo ka Mong'a Akhaonto ea Motso kapa Mookameli oa Tefiso: Likarolo tse Tloaelehileng tsa Moetsi oa IAM/Motsamaisi hangata ha li khone ho kena skrineng sa ho Buelloa ha Litefo ha ak'haonte e emisitsoe. Sebelisa lengolo-tsoibila la AWS Root User (kapa GCP Billing Account Administrator / Azure Account Administrator).
2. U se ke U Tobetsa Feela "Leka hape" ho Karete e Tšoanang e Hanneng Pele U Letsa Banka: Haeba mochine oa bomenemene oa banka ea hau o thibetse tefiso ea $14,000 AWS, ho tobetsa "Leka hape" ka makhetlo a mararo ho khomphutha ea AWS ho tla etsa hore ho fokotsehe ka thata tse ling tse tharo le ho notlela mokhoa oa ho lefa. Kapa:
3. Kenya karete ea mokitlane ea khoebo e fapaneng ka ho felletseng kapa karete ea mokitlane (ho arola tefo ho likarete tse peli haeba khokahano ea mofani e lumella litefo tse sa fellang); KAPA
4. Letsetsa nomoro ea mohala e ka morao ho karete ea koporasi **pele ** pele, etsa hore desiki ea bomenemene ea khoebo ea banka e tlose sebaka sa barekisi. Amazon Web Services / Google Cloud / Microsoft Azure 'me u phahamise moeli oa transaction e le 'ngoe bakeng sa lihora tse 24, 'me feela ka nako eo tobetsa Leka hape Tefo ho cloud console.
5. Haeba Khampani ea Hao e Lefa ka Invoic Wire / ACH (Net-30 Enterprise Accounts) le Invoice e Fetile Matsatsi a 60+ a Fetileng:
6. Romela Same-Day Fedwire (eseng ACH ya matsatsi a 3) bakeng sa tekanyo e felletseng e neng e behilwe, khoasolla banka ea semmuso Wire Confirmation Receipt e nang le IMAD/OMAD Federal Reference Number, 'me u hokele PDF eo ka kotloloho ho nyeoe e potlakileng Litefo le Ts'ehetso ea Akhaonto u kopa bukana ea hang-hang **Promise-to-Pay-lefapha e boelanya le terata.
7. ** Netefatsa Boemo ba Boemo ba Kamorao ho Ts'ebetso (The "Stoped VM & Dynamic IP" Trap):**
8. Ha AWS, GCP, kapa Azure e bula ak'haonte e emisitsoeng, **mechini e meng e ile ea emisa (haholo-holo li-VM tsa Azure Deallocated le GCP Compute Engine) HA E qale ka bobona , 'me mochini ofe kapa ofe o neng o sa sebelise static Elastic IP / Reserved Static IP e tla tla le aterese e ncha ea sechaba.
9. Hang-hang hlahloba sebaka se seng le se seng sa EC2 / Compute Engine / Azure VMs, qala maemo leha e le afe a emisitsoeng, netefatsa hore Elastic Load Balancers le li-database tsa RDS li teng. Available, 'me u hlahlobe hore na DNS ea hau ke efe A lirekoto li ntse li tsamaisana le li-IP tsa hau tsa sechaba tse sebetsang.

Protocol e qaqileng ea 2: Ho hlaphoheloa ho tsoa ho Ts'ireletso ea Leru / Senotlolo se Senyehileng / Tšepo & Ho emisoa ha Tšireletso¶

Haeba moqapi a entse phoso ka phoso .env faele e nang le an AWS_ACCESS_KEY_ID le AWS_SECRET_ACCESS_KEY (kapa senotlolo sa Ak'haonte ea Ts'ebeletso ea GCP ea JSON) sebakeng sa polokelo ea sechaba sa GitHub, li-automated hacker bots li hula senotlolo seo nakong ea metsotsoana e 1.5 ebe u phunya liketsahalo tse 200 tse kholo tsa GPU (p4d.24xlarge) libakeng tse kang ap-east-1 kapa sa-east-1 ho cheka chelete ea crypto kapa ho qala litlhaselo tsa DDoS. Ka mor'a lihora tse seng kae, Trust & Safety ea AWS/GCP e tla lemoha phoso ebe e beha Karolo ea Tšireletso ea Tšireletso / Ho Emisoa ha Akhaonto akhaonteng ea hau.

Mokhoa oa ho fumana AWS / GCP / Azure Trust & Safety ho phahamisa karabelo ea ts'ireletso ka nako e ka tlase ho lihora tse 4¶

Lihlopha tsa ts'ireletso ea Cloud li latela lethathamo le tiileng: li tla ** hana ** ho bula ak'haonte ea hau hape ho fihlela u paka hore ho e bula hape ho ke ke ha qalisa tlhaselo hanghang. 1. Hlahloba Sebaka se seng le se seng (Ho kenyeletsoa le Batho ba nang le Bokooa/ba Kenang ho Kena) 'me u hlakole Vector ea Compromise: - Kena ho IAM Console: Timisa le ho Hlakola Senotlolo sa Phihlello sa IAM se senyehileng (le basebelisi leha e le bafe ba sa tloaelehang ba IAM ba ka morao, mesebetsi, kapa Bafani ba Boitsebiso, mohlaseli a ba etselitseng ho boloka mamello). - Numella Hardware kapa Virtual MFA ho Root User le basebelisi bohle ba IAM. - Bula AWS Resource Explorer / Tag Editor / EC2 Global View (sheba libaka tsohle tsa lefats'e tse 30+, eseng feela us-east-1) le Emisa maemo ohle a sa dumellwang a EC2, Auto Scalling Groups, dihlopha tsa EKS, le mesebetsi ya Lambda e thehilweng ke mohlaseli. 2. Fana ka Tlaleho ea Tokiso ea Tšireletso ea Likarolo tse 4 mabapi le Nyeoe ea Tšehetso ea Semmuso: - Bula Setsi sa Ts'ehetso ho khomphutha ea hau ea leru ebe u araba kopo e bulehileng Tshireletso ea Akhaonto / Tšepo & Tšireletso ka: - 1. Lebaka la Motso: "IAM User [Name] senotlolo AKIA... e ile ea pepesoa ka mokhoa o sa lebelloang sebakeng sa polokelo ea khoutu ho [Time]." - 2. Ho hlakolwa ha Bopaki: "Senotlolo sa ho Kena AKIA... le mosebelisi oa IAM ea khopo [Name] li hlakotsoe ka ho sa feleng, 'me Root/IAM MFA e sebelisoa." - 3. Tlhoekiso ea Mehloli ho Libakeng Tsohle: "Maemo ohle a sa lumelloeng ke EC2 libakeng [List Regions] li felisitsoe." - 4. Kopo ea ho notlolla Tlhahiso e potlakileng + Phetoho ea Tefiso e Senyehileng: "Mosebetsi oa rona o molaong oa tlhahiso ho [Your Region] sebeletsa [Number] bareki 'me hajoale ha e sebetse. Ka kopo tlosa ho emisoa ha ak'haonte hang-hang, 'me re kopa ho lokisoa ho kolota/mokitlane bakeng sa $[Amount] liqoso tsa bomenemene tse bakiloeng ke ho itšunya-tšunya ho sa lumelloe ke letho." - *(Keletso: AWS le GCP li lula li fana ka *nako e le' ngoe ea 100% ea ho tlosoa ha mokoloto ka nako e le 'ngoe ** bakeng sa mashome a likete tsa lidolara ka litefiso tsa bomenemene tsa merafo ea crypto hang ha u qeta lethathamo la bona la molao la ho lokisa akhaonto e sekiselitsoeng.)

Mokhahlelo oa 4: Ho kenya ts'ebetsong boemo ba tšohanyetso "Break-Glass" bofokoli ba bobeli ka metsotso e 30¶

Haeba sebaka sa hau sa mantlha (yourcompany.com) e notletsoe ka tlas'a registry serverHold kapa qabang ea molao e rarahaneng e tla nka lihora tse 48 ho isa ho tse 72 ho rarolla, o se ke oa lula kantle ho naha matsatsi a mararo. Khoebo e 'ngoe le e' ngoe ea thekenoloji le khoebo ea e-commerce e ka khutlisetsa phihlello ea bareki le lengolo-tsoibila la basebetsi nakong ea metsotso e 30 ho isa ho e 45 e sebelisa Emergency Secondary Mirror Domain (yourcompany.co, yourcompany.io, kapa getyourcompany.com).

Lethathamo la Metsotso e 30 ea Emergency Secondary Domain Cutover¶

1. Ngolisa (kapa Kenya ts'ebetsong) Sebaka sa Hao sa Bobeli ho Mongolisi ea Arohileng: Le ka mohla u se ke ua ngolisa sebaka sa hau sa polokelo ho mongolisi ea tšoanang ea sa tsoa emisa sebaka sa hau sa mantlha. Ngodisa yourcompany-app.com kapa yourcompany.co ho mongolisi ea ikemetseng (joaloka Cloudflare Registrar, Porkbun, kapa AWS Route 53) a sebelisa karete ea khoebo e arohaneng le lengolo-tsoibila le netefalitsoeng.
2. ** Kenya faele ea hau ea Zone ho Cloudflare kapa Route 53: ** Romella (kapa kopitsa) DNS ea hau A, AAAA, CNAME, le TXT e rekota ho tsoa ho phanele ea hau ea mantlha ea DNS ho ea sebakeng se secha sa libaka tsa libaka joalo app.yourcompany.co le api.yourcompany.co supa ho li-balancers tsa hau tsa mojaro oa tlhahiso tse ts'oanang hantle.
3. ** Ntlafatsa Setifikeiti sa Hao sa Mojaro / Setifikeiti sa Ingress TLS (Keketso ea SAN):** Eketsa *.yourcompany.co le yourcompany.co joalo ka ** Mabitso a Mang a Sehlooho (SANs) ** ho AWS ACM ea hau / Let's Encrypt / Cloudflare edge SSL setifikeiti, 'me u kenye lebitso le lecha la moamoheli ho melao ea hau ea sehlooho sa Nginx/Envoy/ALB le manane a tumello a CORS.
4. Kenya Sebaka sa Bobeli joalo ka Lebitso le Tiisitsoeng la Domain ho Google Workspace kapa Microsoft 365:
5. Ka hare Google Workspace Admin Console (admin.google.com -> Account -> Domains -> Laola Domains -> Kenya Domain Alias) kapa Microsoft 365 Admin Center (Settings -> Domains -> Add Domain), eketsa yourcompany.co ebe u beha netefatso TXT le MX e rekota ho DNS ea sebaka sa hau se secha.
6. Ka mor'a metsotso e 15, mosebeletsi e mong le e mong o fumana lengolo-tsoibila ho firstname@yourcompany.co ka har'a inbox ea bona e teng e nang le zero mailbox migration.

Mohato oa 5: Ho thatafatsa domain name ea hau le li-account tsa leru hore sena se se hlole se etsahala hape¶

Hang ha tlhahiso e khutletse marang-rang, kenya ts'ireletso ena e mehlano ea meralo nakong ea lihora tse 48:

1. Tiisa Registry Lock (serverDeleteProhibited / serverUpdateProhibited / serverTransferProhibited): Bakeng sa libaka tsa tlhahiso ea bohlokoa-kholo, ntlafatsa sebaka sa hau sa marang-rang ho ** Registry Lock ** (e fanoeng ke Cloudflare, MarkMonitor, CSC Corporate Domains, le bangolisi ba ka sehloohong), e hlokang netefatso ea li-cryptographic tse tsoang kantle ho sehlopha pele li-nameservers kapa maemo a domain a ka fetoloa.
2. Le ka mohla U se Ke Ua Tšoara Likahare tse Tsoang ho Basebelisi (UGC) kapa Lihokelo tsa Lipapatso ho Sebaka sa Hao sa Tlhahiso ea Apex: Kamehla fana ka lintho tse kentsoeng ke basebelisi, li-PDF tsa bareki, le lihokelo tsa ho sala morao lengolo-tsoibila ho tsoa domainng e arohaneng ka ho felletseng ea sandboxed (mohlala, yourcompany-usercontent.com sebakeng sa yourcompany.com). Ka tsela eo, haeba mosebelisi a kenya faele e mpe e bakang bot ea mongolisi ea iketselitseng, ke sebaka sa litaba tse lahliloeng feela se tšoailoeng, eseng sesebelisoa sa hau sa mantlha sa tlhahiso kapa lengolo-tsoibila la koporasi.
3. ** Lokisa Mekhoa ea ho Tefo e Kopanetsoeng + ACH Backup + Cloud Billing Anomaly Alerts:** Eketsa bonyane likarete tse peli tse ikemetseng tsa mekoloto tse tsoang libankeng tse peli tse fapaneng hammoho le **ACH ak'haonte ea banka e tobileng ** ho AWS, GCP, Azure, le mongolisi oa sebaka sa hau, 'me u nolofalletse *AWS Cost Anomaly Detection/Leqephe la GCP Budge spikes ka liperesente tse fetang 25.
4. Iketsetse Mongolisi ea Thehiloeng Karolong le lengolo-tsoibila la Cloud Root sebakeng se Ikemetseng sa Sekondari: O seke oa seta admin@yourcompany.com joalo ka lengolo-tsoibila la ho hlaphoheloa bakeng sa yourcompany.com. Sebelisa lebokose la mangolo le sirelelitsoeng ka Hardware-YubiKey sebakeng sa tsamaiso se ikemetseng kapa mohiri oa boitsebiso ba khoebo hore o tle o fumane mangolo-tsoibila a netefalitsoeng le a ts'ehetso le ha sebaka sa hau sa mantlha se theohile.

Linomoro tsa libaka tsa tšohanyetso le liprothokholo tsa mekhatlo¶

Lipotso tse botsoang khafetsa¶

Haeba AWS, Google Cloud, kapa Azure e emisa ak'haonte ea rona bakeng sa ho se lefe kapa ho hlekefetsa, na li-database tsa rona tsa tlhahiso le linkho tsa S3 li hlakoloa hang-hang?¶

Che. AWS, GCP, kapa Microsoft Azure ha e hlakole data ea hau ka Letsatsi la 1 la ho emisoa. Ha ak'haonte e emisitsoe, mechini ea hau ea sebele ea emisoa 'me phihlello ea sechaba ea libakete tsa hau tsa polokelo le li-balancers tsa mojaro li koetsoe, **empa liperesente tse 100 tsa meqolo ea hau ea EBS, database tsa RDS, lintho tsa S3, le linepe li lula li bolokiloe sebakeng se batang bonyane matsatsi a 30** (le ho AWS, liak'haonte li lula li fumaneha nakong ea matsatsi a 60 a poso). Hang ha u lefa chelete e setseng e fetelletseng kapa u rarolle tekete ea Trust & Safety, tikoloho ea hau ea tlhahiso e tla tsosolosoa ntle le ho hloka ho tsosolosoa ho tloha ho li-backups.

Hobaneng ha sebaka sa rona sa marang-rang se ile sa emisa ka tšohanyetso ho rarolla ka clientHold boemo ha ho nchafatsoa ha sebaka sa rona ho sa lokelehe bakeng sa likhoeli tse ling tse 8?¶

Ha domain name e lefshoang le hole le letsatsi la ho felloa ke nako e kena ka tšohanyetso **`clientHold`**, ho na le lisosa tse peli feela: (1) **ICANN 15-Letsatsi la WHOIS Ho hloleha ho netefatsoa ** (motho e mong o ntlafalitse lebitso la Ngoliso kapa aterese ea lengolo-tsoibila, kapa o fetisitse sebaka, mme a hloleha ho tobetsa sehokelo sa netefatso se rometsoeng ka lengolo-tsoibila ho Mongolisi nakong ea matsatsi a 15), kapa (2) **Tlhekefetso ea Mongolisi / Phishing / Malware * e tlalehile ho emisoa ha hau * sehlopha sa boikamahanyo ba mongodisi). Kena ho portal ea hau ea ngoliso hang-hang: ICANN netefatso ea ho ts'oara e tla hlaka nakong ea metsotso e 15 ka mor'a ho tobetsa sehokelo se rometsoeng, ha Abuse hold e hloka ho araba tekete ea ho latela melao ea mongolisi.

Hobaneng e le ea rona @ourcompany.com na lengolo-tsoibila le ntse le tlaleheloa ha sebaka sa rona sa Marang-rang se tlalehiloe feela bakeng sa sehokelo sa bosholu ba bohata?¶

Ha mongolisi oa domain a beha EPP **`clientHold`** sebakeng sa motso oa hau (`ourcompany.com`), ngoliso e tlosa ** moifo o felletseng oa domain (kaofela `NS` litlaleho)** ho tsoa lefats'eng lohle `.com` li-server tsa metso. Hobane li-server tsa lefats'e ha li sa khona ho sheba sebaka sa hau sa marang-rang `NS` kapa `MX` direkoto, lengolo-tsoibila le leng le le leng le kenang ho `@ourcompany.com` ha e sebetse ka phoso ea ho batla DNS, leha lengolo-tsoibila la hau le amohetsoe ka thoko ho Google Workspace kapa Microsoft 365. Ke ka lebaka lena o tlamehang ho buisana le mongolisi oa hau ka linako tsohle ho tsoa sehlopheng. `@gmail.com` kapa aterese ea sebaka sa bobeli nakong ea `clientHold` ho tima.

Re fihlela motho joang ho AWS, GCP, kapa ho registrar ea domain haeba feela re na le "Basic" ea mahala ea tšehetso?¶

Leha e le ho $0 Basic Support tier, **AWS, GCP, le Azure li lumella basebelisi ba Root ba liakhaonto tse emisitsoeng ho bula linyeoe tsa ts'ehetso tsa "Akhaonto le Tefiso" tse tlang pele mahala**, 'me Setsing sa Tšehetso sa AWS u ka khetha **"Mohala"** e le mokhoa oa hau oa ho ikopanya kahoo AWS Account & Billing setsebi se letsetsa mohala oa hau ka metsotso e seng mekae feela. Haeba u rarolla bothata bo potlakileng ba tlhahiso, u ka boela ua ntlafatsa ak'haonte ea hau ea AWS hang-hang ka har'a khokahanyo ho ** Tšehetso ea Khoebo ($ 100 ka bonyane ka khoeli)** kapa **Enterprise On-Ramp** ho bula puisano ea moenjiniere oa theknoloji ea 15/7 hang hang le ho phahama ha mohala.

Ho thoe'ng haeba mosebeletsi ea sehlōhō kapa moqapi oa mehleng a tšoere lebitso la ngoliso ea domain kapa ak'haonte ea AWS Root mme a hana ho fana ka eona?¶

Haeba motho eo e kileng ea e-ba mohiruoa, setsi se ikemetseng, kapa mothehi-'moho le eena a laola ak'haonte ea mongolisi kapa lintlha tsa motso oa maru 'me a notlela k'hamphani ntle, e nke joalo ka taolo ea khoebo e haufi le koluoa ​​​​ea ho koala kantle. Mongolisi e mong le e mong ea ka sehloohong oa domain le mofani oa maru o na le molao **Ho Khutlisa Akhaonto ea K'hamphani / Ts'ebetso ea Liphapano tsa Motho ea Ngolisitseng** moo mokhatlo oa molao oa khoebo o ka romellang **Articles of Incorporation, Letter ea IRS EIN, ngoliso ea matšoao a khoebo, le liphatlalatso tsa khale tsa tefo tsa banka/karete ea mokoloto** tse pakang hore k'hamphani e lefelletse sebaka sa marang-rang kapa ho molaoli ea fetisetsoang ho mohiri bakeng sa molaoli oa khoebo. Sheba motataisi oa rona ho [likhohlano tsa tšebelisano-'moho, mothehi-'moho le eena oa banka, le ho koaloa ha likhoebo](partnership-dispute-rogue-cofounder-bank-drain-and-corporate-lockout.md).

DNS e nka nako e kae ho khutla lefatšeng ka bophara ka mor'a hore mongolisi a tlose clientHold?¶

Hang ha mongolisi a fana ka taelo ea EPP ea ho tlosa `clientHold`, ngoliso ea maemo a holimo (joalo ka Verisign for `.com`) e nchafatsa li-server tsa libaka tsa motso nakong ea **3 ho isa ho metsotso e 15**. Basebelisi ba bangata ba Marang-rang ba tla khona ho fihla sebakeng sa hau sa Marang-rang hape nakong ea metsotso e 15 ho isa ho e 30, 'me u ka potlakisa hoo ho isa ho **tlas'a metsotso e 2** molemong oa sephethephethe sa lefats'e ka ho hlakola sebaka sa hau sa marang-rang mecheng ea sechaba bakeng sa **Google Public DNS (`8.8.8.8`)** le **Cloudflare DNS (`1.1.1.1`)**.

Litataiso tse amanang¶

• Morero oa ts'ebetso ea khoebo le ho hlaphoheloa ha likoluoa
• Khoebo ea thekollo ea khoebo le tlolo ea seva
• Khang ea likamano, mothehi-'moho le eena oa banka, le ho koaloa ha khoebo
• Ho tima ha ntlha ea thekiso (POS), marang-rang a theohile, le ts'ebetso ea likarete tsa mokoloto tse kantle ho marang-rang

Mehloli le tataiso ea semmuso¶

• Internet Corporation bakeng sa Mabitso le Linomoro tse Fanoeng (ICANN): 2013 Registrar Accreditation Agreement (RAA) Whois Accuracy Program Specification (15-day Verification Mandate), Extensible Provisioning Protocol (EPP) Status Codes (clientHold, serverHold, redemptionPeriod), le Pholisi e Feletseng ea Boingoliso ba Pholisi (ERRP).
• Litšebeletso tsa Websaete tsa Amazon (AWS) Litokomane tsa Semmuso: Ho Emisoa ha Akhaonto, Ho Tsosolosoa, le Ka mor'a ho Koala Data Retention Lifecycle (30-Day Suspension / 60-Day Post-Closure Window) le AWS Compromiseed IAM Credential Remediation Protocol.
• Google Cloud Platform (GCP) le Litokomane tsa Semmuso tsa Microsoft Azure: Ho Khunoloha ha Botlokotsebe ba Tefiso ea Cloud, Botšepehi ba Morero le Tšireletso ea Boipiletso ba Mosebetsi, le Mehato e Abisitsoeng ea ho Buella Ngoliso ea Azure.
• Cybersecurity and Infrastructure Security Agency (CISA, United States) le National Cyber ​​Security Center (NCSC, United Kingdom): Cloud Security Technical Reference Architecture, Root Account MFA Enforcement, le Domain Registry Lock Mekhoa e Molemo ka ho Fetisisa.
• Setsi sa Naha sa Maemo le Theknoloji (NIST, United States): NIST SP 800-61 Rev. 2 (Tlhahiso ea ho Tšoara Ketsahalo ea Tšireletso ea Khomphutha) le NIST SP 800-53 (DNS Integrity le Cloud Access Control Standards).