I-Laptop noma Ukhiye Wokuvikela we-Hardware Webiwe Ekhefi noma Indawo Yokuphumulela Yesikhumulo Sezindiza: Ukubulala Iseshini Esheshayo¶

Ukuhlwithwa ilaptop yakho etafuleni lesitolo sekhofi, ideski lokusebenzela, noma isihlalo sesitezi sezindiza ngesikhathi isikrini siphapheme futhi sivuliwe, noma uqaphela ukuthi isela lihambe nesikhwama sakho sekhompyutha ephathekayo ngenkathi ukhiye wakho wokuqinisekisa ubunikazi FIDO2 hardware (YubiKey) yayisaxhunywe embobeni ye-USB-C, isimo esiphuthumayo esibi kakhulu sokuphepha ngokomzimba ukuya kwedijithali isisebenzi esikude noma unjiniyela wesofthiwe angabhekana nakho. Ngokungafani nekhompyutha ephathekayo enikwe amandla entshontshiwe egumbini lehhotela (lapho ukubethela kwediski eligcwele njengeFayileVault noma i-BitLocker kugcina idrayivu ikhiyiwe), i-laptop efudumele engakhiyiwe* inika isela i-RAM yakho ekhishiwe, umphathi wephasiwedi ongakhiyiwe (1Password / Bitwarden), amakhukhi wokuqinisekisa isiphequluli bukhoma, ayasebenza AWS / GCP / Azure Ukuqinisekisa kwe-CLI, futhi akubetheliwe -/.ssh okhiye bangasese ngoqwembe lwesiliva.

Uma ukuhlwitha nokubamba kuhilela ukuhlaselwa ngokomzimba, ukugetshengwa, noma izinsongo zezikhali, thuthela endaweni ephephile ngokushesha futhi ushayele inombolo yakho yasendaweni yezimo eziphuthumayo (911 e-United States nase-Canada, 112 ngaphesheya kwe-European Union, 999 e-United Kingdom; bona izinombolo eziphuthumayo) futhi ubuyekeze eyethu ukusinda nokugetshengwa umhlahlandlela. Ungalinge ujahe isela elihlomile noma elibalekayo emgwaqeni noma emotweni. Esikhundleni salokho, khipha i-smartphone yakho ekhukhwini lakho kungakapheli imizuzwana engama-60 bese wenze lokhu kulandelana kweseshini-kubulala kanye ne-hardware-lock ngenkathi ureferensi. I-laptop yomsebenzi yebiwe noma yephulwe ngenkathi uhamba: Ilokhi ye-MDM kanye nokutholwa kwe-zero-downtime, ukwehla kwedathabheyisi yokukhiqiza ngengozi, ukuvuza okuyimfihlo kwe-git, kanye nokuhlolwa kwesigameko, futhi ukuphepha komsebenzi okude kwesimo esiphuthumayo kanye nobumfihlo bedatha.

Yenza lokhu manje¶

1. UNGAMJASHI Isela; khipha i-smartphone yakho phakathi nemizuzwana eyi-15 bese uvula i-Remote Hardware Lock (Find My / Find My Device / Corporate MDM) NGAPHAMBI kokuba isela lifake ikhompuyutha ephathekayo esikhwameni sikaFaraday noma livale i-Wi-Fi. Lapho isela lihlwitha ikhompuyutha ephathekayo evulekile etafuleni lesitolo, ikhompuyutha ephathekayo ihlala ixhumeke ku-Wi-Fi yekhefi (noma i-hotspot yefoni yakho) okokuqala ngqa. 30 to 90 seconds njengoba behla ngebhulokhi:
   • MacBook (iPhone Find My App): Vula Thola I-My -> Amadivayisi -> [I-MacBook Yakho] -> Maka Njengelahlekile (Activate) bese ufaka iphinikhodi yokukhiya enamadijithi angu-4 ukuya kwayisi-6. Ngokushesha lowo myalo ushaya i-MacBook nge-Wi-Fi, i-macOS inqamula iseshini yomsebenzisi esebenzayo, iphoqa isikrini sokukhiya i-firmware/OS, futhi idinga imininingwane yokubethela ye-FileVault ukuze ifakwe kabusha.
   • I-Laptop yeWindows 11: Esipheqululini sefoni yakho, vula account.microsoft.com/devices -> khetha ikhompuyutha ephathekayo yakho -> thepha okuthi Thola idivayisi yami -> Khiya.
2. Uma ikhompyutha yakho ephathekayo ibixhunywe ku-Personal Hotspot ye-smartphone yakho, UNGAYIVALI i-hotspot yakho imizuzwana yokuqala engu-60 UZE uchofoze okuthi "Maka Njengesilahlekile / Isikhiya Esikude", bese uyinqamula ngokushesha ngemva kwalokho. Uma isela lisengaphakathi kwamamitha angu-15 (amafidi angu-50) kuwe ngaphandle kwekhefi, i-Wi-Fi hotspot yefoni yakho esebenzayo ingase ibe uxhumano lwakho lwe-inthanethi * Mark As Lost bulala umyalo kwi-laptop evulekile. Linda imizuzwana engu-30 ukuze umyalo wokukhiya udluliselwe, bese uguqula okuthi Personal Hotspot IVALIWE kanye nokuthi I-Bluetooth IVALIWE (okuphinde kucuphe i-macOS/Windows Dynamic Lock uma ibhanqiwe).
3. Shayela i-IT Security yenkampani yakho / i-SOC Hotline ocingweni lwakho (0 to 3 minutes) ukuxosha i-Global IdP Session Revocation (Okta / Microsoft Entra ID / Google Workspace) KANYE ne-MDM Remote Sula (Jamf / Intune / Kandji). Ngisho noma isela ligcina isikrini sekhompuyutha ephathekayo sivukile ngokunyakazisa i-trackpad futhi ivale i-Wi-Fi, ukuhoxisa ukuvuselela kwakho Single Sign-On (SSO) kanye namathokheni okufinyelela kuseva yefu kuqinisekisa ukuthi isikhathi lapho isela lixhuma khona kabusha ikhompuyutha ephathekayo kunoma yikuphi uxhumano lwe-inthanethi ukuze ufinyelele i-Slack, i-Gmail, i-AporateSb, i-AporateSb kakade (i-AporateSb, i-GitHub vele401 Unauthorized).
4. Uma Isiphathi Sephasiwedi yakho (1Password, Bitwarden, LastPass, Dashlane, Apple Passwords) ibivuliwe kukhompuyutha ephathekayo, GUNYAZA idivayisi entshontshiwe ohlelweni lwakho lokusebenza lwefoni ngokushesha. Vula i-1Password noma i-Bitwarden kuselula yakho, hamba kokuthi Phatha i-Akhawunti / I-Web Vault -> Amaseshini Asebenzayo / Amadivayisi Agunyaziwe, bese uchofoza okuthi Susa Ukugunyaza / Hoxisa kukhompuyutha ephathekayo entshontshiwe, bese ususa Iphasiwedi Eyinhloko Yombhalo Oyikhophi Yakho.
5. Uma Ukhiye Wokuvikela Wezingxenyekazi Zekhompyutha (YubiKey 5C Nano / Titan Key) ishiywe ixhunywe embobeni ye-USB yekhompyutha ephathekayo (noma inamathiselwe okhiye abantshontshiwe), ngena kuma-akhawunti akho kusukela ocingweni lwakho usebenzisa Ukhiye wakho Wokwenza Ikhophi Yasenqolobaneni noma Ukhiye Wokungena bese USUSA lokho kuqinisekisa okuqondile kwe-FIDO2. Ngenkathi ukhiye wehadiwe we-FIDO2 udinga FIDO2 PIN (4 to 63 characters) kokungenaphasiwedi resident-key ukungena, uma kusetshenziswa njengento yesibili (U2F / WebAuthn non-discoverable) kukhompuyutha ephathekayo lapho isiphequluli sakho sesivele sigcine khona igama lakho lomsebenzisi nephasiwedi, noma ubani othinta othintana naye wegolide ku-YubiKey udlula u-2FA ngaphandle kwephinikhodi.
6. Hoxisa futhi uzungezise zonke iziqinisekiso zikanjiniyela wasendaweni ezigcinwe kufolda yakho yasekhaya (-/.ssh/id_ed25519, -/.gnupg, -/.aws/credentials, -/.kube/config, .env amafayela, kanye nama-GitHub/GitLab Personal Access Tokens). Ngisho noma i-SSO yefu ibulawa, umhlaseli ogcina ikhompuyutha ephathekayo evulekile evuliwe unokufinyelela ohlelweni lwefayela okungahluziwe kuwo wonke ukhiye we-SSH ongabetheliwe kanye nethokheni ye-API yefu ehlezi emlandweni wakho wetheminali (-/.zsh_history / -/.bash_history).

Isihlahla sesinqumo: Ukuhlwithwa kwekhompuyutha ephathekayo evuliwe ngokumelene nokwebiwa kokhiye wokuphepha wehadiwe vs. Ukusefa ehlombe¶

Landela leli shati eligelezayo lesivinini esikhulu phakathi nemizuzu yokuqala engu-15 ngemva kwekhefi, indawo yokusebenzela, noma isigameko sokuphepha sesikhumulo sezindiza.

flowchart TD
    A["Isimo Esiphuthumayo Sokuphepha Kwendawo Yokusebenzela Yomphakathi (Ikhefi, Indawo Yokusebenzelana, Indawo Yokuphumula Yezindiza, Isitimela)"] --> B{"Kwenzekani ngempela?"}
    B -->|"I-Laptop Ihlwithiwe Ngenkathi Ivuliwe / Ivuliwe"| C["0-60s: Ocingweni lwakho, qalisa i-Apple ethi Thola I-'Mark Yami Njengelahlekile' noma 'Idivayisi Yekhiye Ye-Microsoft' -> Shayela I-IT SOC ye-MDM Lock/Sula + I-Global SSO Session Kill"]
    B -->|"Ilaptop Intshontshiwe Ngenkathi Ikhiyiwe / Isivalo Sivaliwe / Sivaliwe"| D["I-FileVault / BitLocker ivikela idiski ekuphumuleni -> Qalisa Thola I-My / MDM Remote Sula -> Zungezisa iphasiwedi ye-SSO futhi uhoxise izikhathi zamafu ezisebenzayo"]
    B -->|"Ukhiye Wokuvikela Wezingxenyekazi Zekhompyutha (YubiKey) Untshontshiwe (Wodwa noma Uxhunywe Kukhompyutha ephathekayo)"| E["Ngena ngemvume ku-IdP (Okta/Entra/Google), i-GitHub, i-AWS, kanye nesiphathi sephasiwedi kusuka ocingweni lwakho usebenzisa Ukhiye Wokwenza Ikhophi/Iphasiwedi -> Susa ukubhaliswa kwe-YubiKey okuntshontshiwe"]
    B -->|"Ukusefa Ehlombe / Othile Uthwebule Isikrini Sakho noma Ikhibhodi"| F["Khiya isikrini ngokushesha (Cmd+Ctrl+Q / Win+L) -> Hambisa endaweni yangasese -> Zungezisa igama eliyimfihlo/i-PIN ethayiphiwe + noma yiziphi izinkinobho ze-API ezibonakala esikrinini"]
    C --> G["Susa ukugunyaza i-laptop eyebiwe ngaphakathi kwe-1Password / Bitwarden Web Vault -> Susa wonke amaseshini ewebhu e-Google / Microsoft / Okta / Slack / GitHub"]
    E --> G
    G --> H{"Ingabe ikhompuyutha ephathekayo inabo okhiye bonjiniyela basendaweni (home .ssh, .aws, .gnupg, Git PATs, Docker/K8s tokens)?"}
    H -->|"YEBO: Unjiniyela / Umphathi / Umsunguli weLaptop"| I["Susa okhiye basesidlangalaleni be-.ssh ku-GitHub/GitLab & namaseva okukhiqiza (`okhiye_abagunyaziwe`) -> Vala okhiye be-AWS IAM ku-Console -> Hoxisa ukhiye we-GPG"]
    H -->|"CHA: Ibhizinisi Elijwayelekile / Umsebenzisi Wesiphequluli"| J["Qinisekisa ukuvumelanisa isiphequluli (`I-Chrome/Edge/iCloud Keychain`) iphume ukude -> Faka umbiko Wamaphoyisa wendawo kanye nesicelo sokulondoloza i-Cafe CCTV"]
    I --> J

Ingxenye 1: "I-Kill Chain" Yemizuzu emi-5 yekhompuyutha ephathekayo entshontshiwe evuliwe (Imiyalo ye-Platform-by-platform)¶

Uma ikhompuyutha ephathekayo ihlwithwa ngesikhathi ivuliwe, ungalindi uze uye ekhaya noma uthenge ikhompuyutha entsha ukuze uqale ukuhoxisa ukufinyelela. Zonke izenzo zokuvimbela ezibalulekile ezingezansi zingenziwa ngokuqondile ku-iPhone yakho noma i-smartphone yakho ye-Android ngenkathi umi ngaphakathi kwesitolo sekhofi.

Isinyathelo 1: Phoqa ukukhiya uhlelo lokusebenza ukude (0 to 60 seconds)¶

1. I-Apple MacBook (macOS):
   • Vula uhlelo lokusebenza lwe-Find My* ku-iPhone yakho (noma ngena ku icloud.com/find kunoma yisiphi isiphequluli sefoni, esidlula i-2FA ukuze ukwazi ukuyisebenzisa noma ngabe ifoni yakho yebiwe).
   • Thepha okuthi Amadivayisi -> [I-MacBook Yakho] -> Maka Njengelahlekile -> Yenza kusebenze.
   • Kuthiwani uma isela licisha i-Wi-Fi ngokushesha noma livala isivalo? I Mark As Lost noma Erase This Device iyala ulayini kumaseva e-Apple's APNs bese ishisa i-split-second i-MacBook ngokulandelayo ithinta noma iyiphi inethiwekhi ye-Wi-Fi (noma nge-Find My network). Ukuvala isivalo seMacBook kuphinde kukhiye isikrini ngokuzenzakalelayo uma Dinga iphasiwedi ngokushesha ngemva kokulala noma isilondolozi sesikrini sesiqalile sivuliwe.
2. I-Windows 10 / I-Laptop ye-Windows 11:
   • Esipheqululini sefoni yakho, vula account.microsoft.com/devices, khetha ikhompuyutha ephathekayo yakho, bese ucindezela okuthi Thola idivayisi yami -> Khiya.
   • Uma kuyikhompyutha ephathekayo ye-Windows ephethwe yi-Microsoft Intune, ngena kokuthi Intune Company Portal (portal.manage.microsoft.com) ocingweni lwakho -> khetha ikhompuyutha ephathekayo yakho -> thepha okuthi Izenzo -> Ukhiye Wesilawuli kude noma Setha Kabusha Ikhodi Yokudlula / Sula.

Isinyathelo sesi-2: Bulala konke ukungena ngemvume okukodwa kwefu (i-SSO) namaseshini esiphequluli (1 to 3 minutes)¶

Ngisho noma isela likhubaza i-Wi-Fi kukhompuyutha ephathekayo ukuze uphequlule i-hard drive yakho yasendaweni ungaxhunyiwe ku-inthanethi, ekugcineni bazoxhuma ikhompyutha ephathekayo ku-hotspot yeselula noma bakopishe isiphequluli sakho. Cookies futhi Local Storage Amafayela e-SQLite komunye umshini ukuze aduge amaseshini akho ewebhu ongene kuwo ngemvume. Yenza angavumelekile lawo mathokheni esikhathi ohlangothini lweseva njengamanje ocingweni lwakho:

Ingxenye 2: Kuthiwani uma i-YubiKey yakho noma ukhiye Wokuvikela wezingxenyekazi zekhompuyutha webiwa?¶

Izisebenzi eziningi ezikude zishiya iphrofayela ephansi I-YubiKey 5C Nano ixhunywe unomphela embotsheni eseceleni ye-USB-C yekhompuyutha yazo ephathekayo, noma baphathe YubiKey 5 NFC enyangeni ehlwithwa nesikhwama sabo sekhompyutha ephathekayo. Ukwethuka kuvame ukungena: "Ingabe isela lingasebenzisa i-YubiKey yami ukuze lingene kuwo wonke ama-akhawunti ami? Futhi ngingena kanjani kuma-akhawunti ami ngaphandle kwe-YubiKey yami?"

1. Ukuqonda ukuthi isela LINGAKWENZANI FUTHI NGEKE likwenze nge-YubiKey yakho eyebiwe¶

Ukhiye wokuqinisekisa ubunikazi wehadiwe yesimanje (YubiKey 5 Series, Google Titan, Token2, Nitrokey) isekela amaphrothokholi amane okuqinisekisa ahlukene, ngayinye enephrofayili ehlukile yobungozi lapho yebiwa ngokomzimba:

1. Imininingwane ye-FIDO2 Etholakalayo (Passkeys / Ukungena Ngegama Okungenamagama):
   • ** Ivikelwe i-PIN yakho ye-FIDO2 (4 to 63 alphanumeric characters).** Uma isela lixhuma i-YubiKey yakho entshontshiwe kukhompuyutha yalo futhi lizama ukusebenzisa ukhiye we-FIDO2 ongenaphasiwedi, i-YubiKey hardware chip idinga i-PIN yakho ye-FIDO2. Ngemva kwe-PIN yokuqagela okungalungile okulandelanayo okungu-8, i-applet ye-FIDO2 ku-YubiKey ikhiya unomphela futhi izitini.Factory Reset Required), isula zonke iziqinisekiso.
2. I-FIDO U2F / WebAuthn Second-Factor (Username + Password + Touch YubiKey):
   • AYIKHO IPHINIKHODI EDINGEKAYO NGOKUFAKAZILE kumawebhusayithi amaningi. Uma isela elithi kuphela lintshontshe i-YubiKey yakho ephaketheni lakho lejazi (futhi lingenayo* ikhompyutha yakho ephathekayo noma amaphasiwedi akho), i-YubiKey ayinalo usizo kubo ngoba ukhiye we-U2F awuvezi ukuthi ibhaliswe kumaphi amawebhusayithi.
   • INGOZI EBALULEKILE UMA Intshontshiwe Ixhunywe YI-LAPTOP YAKHO ENGAKHIYIWE: Uma isela lintshontsheilaptop yakho evuliwe NGENXA YE-YubiKey exhunywe eceleni, umphathi wokugcwalisa okuzenzakalelayo wesiphequluli sakho noma iphasiwedi usevele unikeza igama lomsebenzisi nephasiwedi, futhi isela kufanele *lithinte umunwe walo ukuze lidlulisele inkinobho ethi Yubi 2WFA egolideni i-akhawunti, noma i-crypto exchange.
3. I-YubiKey OpenPGP (gpg I-SmartCard) ne-PIV (X.509 Isitifiketi) Ama-apula:
   • Ivikelwe ihadiwe Iphinikhodi yomsebenzisi (okuzenzakalelayo 123456 uma ungakaze uyishintshe) kanye ne-Iphinikhodi yomqondisi (okuzenzakalelayo 12345678) leyo khiya ngemva kwemizamo engalungile emi-3. (Uma ushiye i-PIN ye-OpenPGP kokumisiwe kwasembonini 123456, thatha ukhiye we-PGP kokuthi i-YubiKey isengozini bese uyihoxisa ngokushesha.)
4. Iphasiwedi ye-YubiKey Static / Yubico OTP (Izinhlamvu ezinde ezingama-44 ccccc... iyunithi yezinhlamvu ekhishwa lapho ithintwa):
   • Uma ulungiselele Isikhala 1 noma i-Slot 2 se-YubiKey yakho ukuze uthayiphe iphasiwedi emile noma i-Yubico OTP noma nini lapho iphedi yegolide ithintwa isekhondi elingu-1 kuya kwemi-3, noma ubani ophethe ukhiye angavula i-Notepad, athinte ukhiye, futhi afunde leyo ntambo emile.

2. Iphrothokholi yesinyathelo nesinyathelo ukususa ukubhaliswa kwe-YubiKey eyebiwe emizuzwini emi-5¶

1. Bamba Ukhiye wakho Wokuvikela Wezingxenyekazi Eziyisipele (noma sebenzisa ukhiye wakho wokungena we-iPhone/Android / Uhlelo Lokufakazela ubuqiniso / Amakhodi Ekhophi Yakho):
   • Umkhuba ongcono kakhulu (ogunyazwe i-NIST SP 800-63B) ukubhalisa njalo okungenani okhiye bokuphepha ababili abaphathekayo (owodwa ku-keyring/laptop yakho, omunye ukhiyelwe emthwalweni ophephile noma wokuhamba) kanye nokhiye wokungena wedivayisi ku-smartphone yakho.
2. Ngena kuma-akhawunti akho abaluleke kakhulu futhi ususe KUPHELA i-YubiKey entshontshiwe ngesiteketiso sayo:
   • I-Google / Gmail (myaccount.google.com/signinoptions/two-step-verification): Thepha okuthi Okhiye bokungena kanye nokhiye bokuqinisekisa ubunikazi -> thola ukhiye ontshontshiwe -> cindezela isithonjana se- Doti we-Doti ukuze usisuse.
   • I-ID yeMicrosoft / Entra (mysignins.microsoft.com/security-info): Thola ukhiye othi Ukhiye Wokuvikela -> thepha okuthi Susa.
   • I-ID ye-Apple (Settings -> [Your Name] -> Sign-In & Security -> Two-Factor Authentication -> Security Keys): Thinta ukhiye ontshontshiwe -> Susa Ukhiye.
   • GitHub (github.com/settings/security): Ngaphansi kokuthi Okhiye bokudlula kanye Nezindlela zezinto ezimbili -> Okhiye bokuvikela, chofoza okuthi Susa eduze kokhiye ontshontshiwe.
   • AWS Umsuka / IAM (IAM Console -> Users -> Security credentials -> Multi-factor authentication): Khetha ukhiye wokuqinisekisa ubunikazi we-FIDO ontshontshiwe bese uchofoza okuthi Susa.
   • 1Password / Bitwarden / Cloudflare / Coinbase / Kraken: Vula izilungiselelo zesevisi ngayinye ye-2FA bese ususa ukubhaliswa kwethokheni yehadiwe eyebiwe.

Ingxenye 3: Unjiniyela, i-DevOps, kanye nokuzungezisa ukhiye we-SSH/GPG (I -/.ssh futhi -/.aws izimo eziphuthumayo)¶

Uma ungunjiniyela wesofthiwe, umlawuli we-DevOps/SRE, usosayensi wedatha, noma umsunguli wekhompyutha ephathekayo evuliwe eyebiwa, ukuhoxisa amakhukhi esiphequluli kuwuhhafu wempi. Isela elilahla uhla lwemibhalo lwasekhaya liyakwazi ukufinyelela kuwo wonke ukhiye we-cryptographic osenesikhathi eside kanye nethokheni ye-CLI egcinwe njengombhalo ongenalutho ku-SSD yakho.

Sebenzisa lokhu Izinyathelo Ezi-5 Zokuhlanza Kokuqinisekisa Kanjiniyela ocingweni oluyisipele noma ikhompuyutha ephathekayo yozakwethu phakathi kwemizuzu yokuqala eyi-15:

1. Okhiye be-SSH (-/.ssh/id_ed25519 / -/.ssh/id_rsa): Ngisho noma umushwana wokungena uvikelwe, thatha noma yimuphi ukhiye we-SSH olayishwe kuwo ssh-agent ku-RAM kukhompyutha ephathekayo evuliwe isengozini. Iya ku github.com/settings/keys futhi gitlab.com/-/user_settings/ssh_keys bese ususa ukhiye osesidlangalaleni we-SSH yekhompuyutha ephathekayo ngokushesha, futhi ube nozakwenu akhiphe ukhiye wakho osesidlangalaleni -/.ssh/authorized_keys kuwo wonke amaseva we-Linux wokukhiqiza kanye nabasingathi be-bastion.
2. Imininingwane ye-CLI yamafu (-/.aws/credentials, -/.config/gcloud, -/.azure): Vula Ikhonsoli ye-AWS IAM -> Abasebenzisi -> [Wena] -> Ukuqinisekisa ukuphepha bese uchofoza okuthi Yenza kungasebenzi / Susa kubo bonke Okhiye Bokungena (AKIA...). Hoxisa i-Google Cloud gcloud auth Amathokheni okuvuselela i-OAuth ngekhasi Lokuxhunywa Kwenkampani Yangaphandle Ye-akhawunti Ye-Google (Google Cloud SDK).
3. I-GitHub, i-GitLab, i-npm, i-PyPI, ne-Docker Personal Access Tokens: Iya kokuthi github.com/settings/tokens bese uchofoza okuthi Hoxisa konke kukho kokubili ama-PAT AneGrained Fine and Classic ghp_... amathokheni. Hoxisa -/.npmrc amathokheni (npmjs.com) kanye -/.pypirc amathokheni.
4. Kubernetes (-/.kube/config) & Terraform (-/.terraform.d): Zungezisa izitifiketi zeklayenti ze-Kubeconfig ezimile noma amathokheni e-OIDC futhi uhoxise amathokheni e-Terraform Cloud API (app.terraform.io).
5. Okhiye Bokusayina be-GPG/PGP (-/.gnupg): Shicilela Isitifiketi sakho Sokuhoxiswa Kwe-GPG esenziwe ngaphambilini (gpg --import revoke.asc futhi gpg --keyserver keys.openpgp.org --send-keys [KeyID]) bese ususa ukhiye we-GPG ku-GitHub.

Ingxenye 4: Ukuphendula "Ukusefa Ehlombe" (Othile uthwebule noma obuke isikrini sakho ekhefi/ endizeni)¶

Kuthiwani uma kungekho muntu ontshontshe ikhompyutha yakho ephathekayo ephathekayo, kodwa ngenkathi usebenza esangweni lesikhumulo sezindiza, endizeni, noma ekhefi, ubambe umuntu ohlezi ngemuva kwakho noma esihlalweni esiseduze eqopha isikrini sakho noma ikhibhodi ngekhamera ye-smartphone (noma egqolozele ngqo endaweni evulekile .env ifayela, umyalo wephasiwedi, noma ideskithophu yesilayidi eyimfihlo)?

1. Khiya isikrini sakho ngokushesha ngokuchofoza okukodwa kwe-reflex:
   • macOS: Cindezela Cmd + Ctrl + Q (ivala isikrini ngokushesha ngaphandle kokuvala izinhlelo zokusebenza).
   • IWindows: Cindezela Win + L.
   • Linux: Cindezela Super + L noma Ctrl + Alt + L.
2. Ungaqalisi ukulwa ngokomzimba: Pakisha ikhompuyutha ephathekayo yakho ngokuzolile, hamba uye esihlalweni esiyimfihlo umhlane wakho obondeni oluqinile, futhi ubuyekeze obekubonakala esikrinini sakho noma okubhalwe kukhibhodi yakho phakathi nemizuzu eyi-10 edlule.
3. Zungezisa yonke imfihlo ekhanya esikrinini:
   • Uma uthayiphe iphasiwedi yokungena kwikhompyutha ephathekayo noma isiphathi sephasiwedi Iphasiwedi Eyinhloko kuyilapho othile ebona iminwe yakho, shintsha leyo phasiwedi ngokushesha endaweni eyimfihlo.
   • Uma iwindi letheminali, .env ifayela, unhlokweni we-Postman, noma ikhonsoli yamafu ibibonakala esikrinini, thatha noma yikuphi ukulungiswa okuphezulu 4K ikhamera ye-smartphone ngaphakathi amamitha angu-3 (amafidi angu-10) ithwebule isithombe esisheshayo, esisondezayo sokhiye bakho be-API, bese izungezisa labo khiye ngokushesha (bona Ukuvuza kwe-Zoom noma ukwabelana kwesikrini kweqembu ngephutha).

Uhlu Lokuhlola Lokuqina Kwekhompyutha Yamakhompyutha Amaphuzu Ayisi-6 (Kusethiwe Namuhla)¶

Lungiselela lezi zilungiselelo eziyisithupha zezingxenyekazi zekhompiyutha kanye ne-OS khona manje ukuze kuthi noma isela lihlwitha ikhompuyutha yakho ephathekayo evulekile etafuleni kusasa, ikhompyutha ephathwayo iyazikhiyela ngaphambi kokuba isela lifike emnyango wesitolo sekhofi:

• 1. Nika amandla i-Bluetooth Proximity Auto-Lock (Dynamic Lock ku-Windows / Near Lock noma i-Apple Watch Auto-Lock ku-Mac):
  • Windows 11: Bhangqa i-iPhone yakho noma ifoni ye-Android kukhompuyutha yakho ephathekayo nge-Bluetooth, bese uya kokuthi Izilungiselelo -> Ama-akhawunti -> Izinketho zokungena ngemvume -> I-Dynamic lock bese uhlola "Vumela i-Windows ukuthi ikhiye ngokuzenzakalelayo idivayisi yakho lapho ungekho". Ngokushesha nje lapho isela libaleka amamitha angu-10 (amafidi angu-33) ukusuka etafuleni ngekhompyutha yakho ephathekayo (noma ucisha i-Bluetooth ocingweni lwakho ephaketheni lakho), i-Windows ivala isikrini ngokuzenzakalelayo.
• 2. Setha "Ikhona Elishisayo" kanye Nesibali Sesikhathi Sokukhiya Isikrini Sebhethri Semizuzwana engama-60:
  • Ku-macOS (Izilungiselelo Zesistimu -> Khiya Isikrini) neWindows (Izilungiselelo -> Uhlelo -> Amandla nebhethri -> Isikrini nokulala), setha Vala isibonisi / Dinga iphasiwedi kubhethri ukuze 1 noma 2 iminithi lapho usebenza esidlangalaleni.
• 3. Lungiselela I-1Password / Bitwarden ukuze Ikhiye Ngokushesha Lapho Isistimu Ikhiya noma Ngemva Kweminithi Eli-1 Ingenzi lutho:
  • Ku-1Password -> Izilungiselelo -> Ukuphepha, setha Khiya ngemva kokuthi ikhompuyutha ingasebenzi 1 minute, hlola Khiya lapho ulele, bese uvula i-Touch ID/Windows Hello* ukuze ungalokothi uthayiphe Iphasiwedi yakho Eyinhloko ngokuchofoza izinkinobho ezibonakalayo esidlangalaleni.
• 4. Idinga ukuthinta kwe-Hardware KANYE Nomushwana wokungena kukho konke ssh futhi git Ukusebenza (1Password SSH Agent noma FIDO2 ed25519-sk Izikhiye):
  • Esikhundleni sokushiya kungabhaliwe -/.ssh/id_ed25519 amafayela kusigcinalwazi sakho, gcina okhiye bakho be-SSH ngaphakathi kwe-1Password SSH Agent (edinga imvume ye-biometric Touch ID kukho konke. git push noma ssh uxhumano) NOMA khiqiza i-hardware eboshwe ssh-keygen -t ed25519-sk -O verify-required okhiye abangakwazi ukukopishwa ku-YubiKey yakho futhi badinga iphinikhodi yakho ye-FIDO2 kukho konke ukusetshenziswa.
• 5. Njalo Namathisela I-Magnetic 60-Degree Isihlungi Sesikrini Sobumfihlo se-Micro-Louver (3M / Kensington) esidlangalaleni:
  • Isikrini esiyimfihlo sikazibuthe senza isibonisi sakho sibe mnyama kakhulu kunoma ubani obuka engeli enkulu kuno 30 degrees off-center, esiphuphuthekisa abatshuza ngehlombe endizeni elandelayo noma esihlalweni sekhefi.
• 6. Ungalokothi Ushiye Ikhompuyutha ephathekayo Ingagadiwe "Amasekhondi angu-30 nje" ukuze Uthole Ikhofi noma Usebenzise Indlu yangasese:
  • Kuphelile 70 percent ukwebiwa kwekhefi nesesikhumulweni sezindiza kwenzeka lapho isisebenzi sishiya ikhompuyutha yaso ephathekayo phezu kwetafula imizuzwana engu-45 ukuze sicoshe i-latte ekhawuntani noma sibuze umuntu esingamazi ukuthi "Uyakwazi ukubuka izinto zami?" Hlala upakisha ikhompuyutha ephathekayo esikhwameni sakho futhi uhambe nayo, noma bopha Kensington NanoSaver Steel Cable Lock eduze kohlaka lwetafula olubhawudi.

Izinombolo zezimo eziphuthumayo zesifunda kanye nezinqubomgomo ze-ejensi¶

Ngemva kokukhiya ikhompuyutha ephathekayo entshontshiwe futhi uhoxise izikhathi zamafu ezisebenzayo (imizuzu emi-5 yokuqala), bika ukwebiwa okungokoqobo kuziphathimandla zasendaweni futhi ulondoloze izithombe ze-CCTV zekhefi/yesikhumulo sezindiza ngaphambi kokuba zibhalwe ngaphezulu (amakhefi amaningi abhala phezu kwe-CCTV njalo emahoreni angama-24 kuya kwangu-72):

I-United States neCanada¶

• Ukuthunyelwa Kwamaphoyisa Ezimo Eziphuthumayo (Ukugetshengwa / Umsolwa Osebenzayo Obonakalayo): Shayela u-911*. (Uma ungaphakathi kwetheminali yesikhumulo sezindiza, thinta Amaphoyisa Esikhumulo Sezindiza / Amaphoyisa Asesikhumulweni Sezindiza ngokushesha emsamo oseduze wesango ukuze amaphoyisa akwazi ukuvimba isela ngaphambi kokuphuma kwezokuphepha noma ukugibela isitimela).
• Umbiko Wamaphoyisa Angewona Owezimo Eziphuthumayo (Uyadingeka Emshwalenseni Webhizinisi Nekhadi Lesikweletu): Shayela ku-311* noma ulayini wamaphoyisa wendawo ongewona owezimo eziphuthumayo ukuze uthole Inombolo Yombiko Wesigameko Samaphoyisa.
• Umbiko We-Federal Cyber / Corporate Theft Reporting: Uma idivayisi yebhizinisi evuliwe eyebiwe iphumela ekungeneni kwenethiwekhi okungagunyaziwe noma ukuqola, bika Isikhungo Sezikhalazo Ze-Inthanethi Ye-FBI (ic3.gov) kanye ne-CISA (cisa.gov/report)* e-US, noma Canadian Center for Cyber Security (cyber.gc.ca) eCanada.

I-United Kingdom¶

• Ukuthunyelwa Kwamaphoyisa Ezimo Eziphuthumayo (Ukuphanga / Isela Lisekhona): Shayela 999.
• Umbiko Wamaphoyisa Angewona Owezimo Eziphuthumayo kanye Nendawo Yesitimela/yeSikhumulo Sezindiza:
  • Emakhefi noma ezindaweni zomgwaqo: Shayela ku-101* (noma uthumele ku-inthanethi nombutho wamaphoyisa wendawo) ukuze uthole Inombolo Yereferensi Yobugebengu (CRN) ngokushesha.
  • Ezitimeleni noma ngaphakathi kweziteshi zesitimela/Tube: Umbhalo Amaphoyisa Ezokuthutha AseBrithani (BTP) ku-61016* noma shayela u-0800 40 50 40*.
• Ukuhlola Ukuphulwa Kwedatha (UK GDPR): Uma ikhompuyutha ephathekayo yahlwithwa ngesikhathi ivuliwe futhi iqukethe idatha yomuntu siqu engabethelwe yamakhasimende noma abasebenzi, yazisa Isikhulu Sokuvikelwa Kwedatha (DPO) ngokushesha ukuhlola ukuthi ngabe umbiko wokwephulwa kwe-ICO wamahora angama-72 wase-UK (ico.org.uk)** iyadingeka.

I-European Union¶

• Inombolo Yezimo Eziphuthumayo Yase-Pan-European: Shayela u-112* ukuze uthole usizo lwamaphoyisa olusheshayo kuwo wonke amazwe angamalungu e-EU.
• Umbiko wamaphoyisa (Procès-Verbal / Strafanzeige / Denuncia): Vakashela isiteshi samaphoyisa sendawo esiseduze (Commissariat de Police, Polizeiwache, Comisaría de Policía, Questura) ukuze uthole umbiko wokweba obhalwe isigxivizo, futhi wazise inkampani yakho i-DPO ngokushesha ngaphansi kwe-GDPR Article 33 uma idivayisi ibivuliwe ngesikhathi sokwebiwa.

E-Australia naseNew Zealand¶

• Ukuthunyelwa Kwezimo Eziphuthumayo: Shayela u-000* e-Australia noma 111 eNew Zealand.
• Umbiko Wamaphoyisa Angewona Abezimo Eziphuthumayo: Shayela ku-131 444* (Ulayini Wosizo Lwamaphoyisa e-Australia) noma 105 (Okungeyona eyezimo eziphuthumayo yamaphoyisa aseNew Zealand) ukuze uthole Inombolo Yomcimbi Wamaphoyisa, futhi ubike ukuyekethisa kobufakazi benkampani nge cyber.gov.au (ACSC) noma CERT NZ (cert.govt.nz).

I-India kanye ne-Asia-Pacific¶

• I-India: Shayela u-112* (Ezimo Eziphuthumayo) noma 100 (Amaphoyisa), bese uthumela umbiko othi e-FIR/Isihloko Esilahlekile ngokushesha usebenzisa ingosi yesakhamuzi samaphoyisa esifunda ukuze ube nemibhalo esemthethweni yokucinywa kwempahla ye-MDM yebhizinisi kanye nokuthi CERT-In nokuthobelana.
• I-Singapore & Japan: E-Singapore, shayela u-999* (Ezimo Eziphuthumayo) noma thumela umbiko ku-inthanethi kokuthi Singapore Police Force e-Services Portal (police.gov.sg). E-Japan, bika ngokushesha ku-Koban (Ibhokisi Lamaphoyisa) noma eposini Lamaphoyisa Esikhumulo Sezindiza ukuze uthole i-Tounan-Todoke (Inombolo Yombiko Wokweba).

Imibuzo ejwayelekile ukubuzwa¶

Ingabe kufanele ngichofoze okuthi "Sula Le Divaysi" (Sula Isilawuli kude) noma "Maka Njengelahlekile" (Isikhiya Esikude) kuqala lapho i-MacBook yami noma i-Windows laptop yami yebiwa ingakhiyiwe?¶

Hlala ucupha okuthi **Maka Njengokulahlekile / Ukukhiya Kwesilawuli kude OKOKUQALA**, bese ulinda kuze kuqinisekiswe ukukhiya (noma uxhumanise nethimba lakho lenkampani ye-IT) ngaphambi kokucupha okuthi Sula / Sula ngokugcwele, ngenxa yezizathu ezimbili ezibalulekile. Okokuqala, a `Remote Lock` iphakethe lincane futhi lenza khona manjalo i-microsecond ifinyelela kukhompuyutha ephathekayo nge-Wi-Fi, inqamule iseshini yedeskithophu esebenzayo futhi ikhiye isikrini ngemuva kokubethela kwe-FileVault noma kwe-BitLocker kuyilapho ilondoloza ikhono lekhompuyutha ephathekayo lokukhanyisa indawo yayo ye-GPS/Wi-Fi ibuyele kokuthi Thola My. Okwesibili, uma uchofoza "Khipha Ku-akhawunti" (ehlukile kokuthi Sula), uvala ngephutha i-Activation Lock, uvumele isela ukuthi lisule futhi lidayise kabusha i-MacBook ngokuhlanzekile. Ungalokothi uchofoze okuthi "Susa Le Divaysi" kusukela ku-Find My.

Uma i-laptop yami ibivuliwe i-FileVault (Mac) noma i-BitLocker (Windows), ingabe lokho akuwavikeli amafayela ami ngisho noma yebiwe ngenkathi isikrini sivuliwe?¶

Ukubethela kwediski eligcwele (i-FileVault 2 ne-BitLocker) kuvikela idatha **ekuphumuleni** (uma ikhompuyutha ephathekayo ivaliwe, ilala, noma ikhiyiwe esikrinini sokuqala/sokungena ngemvume). Nokho, ngenkathi ungene kubuso bekhompuyutha yakho isikrini sivuliwe, ukhiye oyinhloko wokubethela uhlezi ku-RAM yesistimu eguquguqukayo ukuze uhlelo lwakho lokusebenza nezinhlelo zokusebenza zikwazi ukufunda nokubhala amafayela. Uma isela lihlwitha ikhompuyutha yakho ephathekayo ngenkathi isikrini siphapheme futhi lilokhu licofa i-trackpad ukuze isikrini singalokothi sikhiywe, i-FileVault ne-BitLocker azibavimbi ukuthi bakopishe amafayela akho, yingakho ukuthumela umyalo osheshayo wokukhiya ocingweni lwakho nokuhoxisa izikhathi zamafu emizuzwaneni yokuqala engama-60 kubaluleke kakhulu.

Kuthiwani uma i-iPhone yami KANYE NE-MacBook yami evuliwe zombili zihlwithwe ndawonye etafuleni elifanayo: ngizikhiya kanjani ngaphandle kwefoni yami ye-2FA?¶

U-Apple wakha indlela ethile ephuthumayo yokudlula lesi simo esiqondile: boleka ifoni yesisebenzi sekhefi, ifoni yomuntu ongamazi, noma ikhompuyutha ephathekayo yozakwenu bese uvula **`icloud.com/find`** ngokuqondile (qaphela i `/find` ekugcineni kwe-URL). Ngokungafani nokuyinhloko `icloud.com` ingosi, **`icloud.com/find` ikuvumela ukuthi ungene ngemvume KUPHELA nge-imeyili ye-ID ye-Apple kanye nephasiwedi NGAPHANDLE kokudinga ikhodi yokuqinisekisa enezici ezimbili enezinhlamvu ezingu-6**. Uma esengaphakathi `icloud.com/find`, ungafaka ngokushesha kokubili i-iPhone yakho ne-MacBook yakho kokuthi **Imodi Elahlekile**, ukhiye izikrini zombili futhi ukhubaze i-Apple Pay ngaphansi kwemizuzwana engu-30.

Ingabe isela lingakwazi ukukhipha okhiye bami abayimfihlo be-SSH noma amaphasiwedi ku-YubiKey 5C Nano entshontshiwe?¶

Cha. I-YubiKey yangempela igcina bonke okhiye abayimfihlo be-FIDO2, U2F, PIV, kanye ne-OpenPGP ngaphakathi kwe-cryptographic Resistant Secure Element hardware chip (`EAL6+` kuqinisekisiwe). Akwenzeki ngokomzimba nangokwezibalo ukukopisha, ukuthekelisa, noma ukufunda ukhiye oyimfihlo othi *out* we-YubiKey ungene kukhompuyutha. Okuwukuphela kwengozi nge-YubiKey eyebiwe ukuthi umuntu onokhiye ngokomzimba angawuxhuma futhi athinte inkinobho yegolide ukuze *awusebenzise* uze ungene kuma-akhawunti akho (GitHub, Google, AWS, SSH `authorized_keys`) futhi ususe lokho kubhaliswa komphakathi kwe-YubiKey.

Ngabe kuphephile ukushiya ilaptop yami etafuleni lesitolo sekhofi imizuzwana engama-60 ukuze ngisebenzise indlu yangasese uma ngikhiya isikrini (Cmd+Ctrl+Q / Win+L) kuqala?¶

Cha. Ngenkathi uvala isikrini sakho nge `Cmd + Ctrl + Q` noma `Win + L` ivikela idatha yakho yedijithali ngemuva kweFayileVault noma i-BitLocker, ayenzi lutho ukuvimba isela ukuthi liphume ngomnyango `$2,500` i-laptop ephathekayo ngemizuzwana emi-4. Ukushiya ikhompuyutha ephathekayo ekhiyiwe inganakiwe etafuleni kuphinde kuyiveze ekuphazanyisweni kwezingxenyekazi zekhompuyutha (njengomhlaseli ononya ofaka ikhebula le-O.MG, i-USB Rubber Ducky, noma i-keylogger yehadiwe embobeni yakho ye-USB-C ngenkathi usendlini yangasese). Hlala uslayida ikhompuyutha ephathekayo yakho esikhwameni sakho bese uyifaka nawe endlini encane ngaso sonke isikhathi.

Imithombo neziqondiso ezisemthethweni¶

• Isikhungo Sikazwelonke Samazinga Nobuchwepheshe (NIST, United States): NIST SP 800-46 Rev. 2 Umhlahlandlela we-Enterprise Telework, Ukufinyelela Okukude, futhi Ulethe Eyakho Idivayisi (BYOD) Ukuphepha kanye Nemihlahlandlela Yobunikazi Bedijithali ye-NIST SP 800-63B (Izimfuneko Zokulahleka Nokuhoxiswa Kwesiqinisekisi Sezingxenyekazi Eziningi).
• I-Cybersecurity and Infrastructure Security Agency (CISA, United States) kanye ne-UK National Cyber ​​Security Center (NCSC): Ukuvikela Amadivayisi Lapho Uhamba (Ukukhiya Kweseshini Engokoqobo, I-Bluetooth Proximity Lock, Ukuncishiswa Kwe-Shoulder-Surfing, kanye Nezinqubo Zokusulwa Kwesilawuli kude se-MDM).
• Yubico AB: Okufanele Ukwenze Uma Ulahlekelwa I-YubiKey Yakho (support.yubico.com) (FIDO2 8-Attempt PIN Lockout, U2F Second-Factor Risk Model, OpenPGP 3-Attempt PIN Lock, and Backup Key Architecture).
• I-Apple Inc. & Microsoft Corporation: I-Apple Platform Security Guide (I-FileVault Volume Encryption, T2 / Apple Silicon Secure Enclave, kanye icloud.com/find I-No-2FA Lost Mode Architecture) kanye ne-Microsoft Windows 11 BitLocker DMA Protection & Dynamic Lock Technical Documentation.
• ** I-European Data Protection Board (EDPB):** Imihlahlandlela 9/2022 Yesaziso Sokuphulwa Kwedatha yomuntu siqu ngaphansi kwe-GDPR (Ukwehlukanisa Okubethelwe-at-Rest Ukwebiwa Kwedivayisi Ekhiyiwe vs. Ukwebiwa Kwedivayisi Evuliwe Iseshini Evuliwe).

Iziqondiso ezihlobene¶

• Ikhompuyutha ephathekayo ephathekayo yebiwe noma yephulwe ngenkathi kuhanjwa: Ilokhi ye-MDM kanye nokutholwa kwe-zero-downtime
• Ukwehla kwesizindalwazi sokukhiqiza ngengozi, ukuvuza okuyimfihlo kwe-git, kanye nokuhlolwa kwesigameko
• Ukuphepha komsebenzi okude kwesimo esiphuthumayo nobumfihlo bedatha
• Ukusebenza ukude nehhotela noma indawo yesikhashana
• Ukusinda nokugetshengwa
• Izinombolo eziphuthumayo