Xây dựng và triển khai việc bảo mật mạng cho doanh nghiệp với ISA 2006

MỤC LỤC

LỜI CẢM ƠN

 !"#$%&''(')*+
#,-""#%./%0%
""1234'%567289%(,:5.%;<
%.='%..)'>9' ,?
.=-23/%5.523/9' 
'23@1<9,A+='<9#"
@1B6",C=!'D%./'5'9EE
%<9#" !,
C'%%'FGHI6/J(/K
!L,'%MNO.<9" . P2
L
Q(6-C%.R.2
$( 61""5 '!LA2I/ 0%S-//T
L,'';@U'PN%5(E >%5
"5 ,:.R=' S6'@9%(
"",
:5O*"%;6%.#%MN-$O2,:$
VWE"@26O  (@XYZ[\\]^/
GKJAKA4_`:A_a,ACJ,:5
%;%$"/%.'9#"Kb>-%0ccI 
%$",CcI EO 4#"-%0@1
-cI %5cI .5 S%$--E %7
2< "%5cI > M" cI %
' R-#:$VWE"@26O  (@
XYZ[\\]^68 !/cI .%;<
9%5c=%!0S " ,
:$VWE"@26O  (@XYZ

[\\]^' S%$ cI )E %7"=L,CcI E
 4#"-%0cI  S%$-6&=",
CcI RE 4#""d`eM
%(9C:$CYaZCfb,ga,ACJ/QF "=U/
8h4%E"%0-2FR-68
i P;cI %$@@4,
[
*!%$/cI 252N<.
/I - #"-O ,CcI R- %.
.#"-%5c%$cI %;4,
JS'#</cI E 4#"%0ccI 
%$",
CcI cj2NI%#"-%5.5U@!@7@("6O
cI e<9.=S%9,
a,ACJ/j[/"\kd [\\
:A_O`a,ACJlUe=m
AC:n`hC
Y%$
KJAJYYGCC\o\[
KA4_JYYGCC\o\]
p
TÓM TẮT CỦA BÁO CÁO
:$6VWE"@526O  (@
XYZ[\\]^q 64G
Chương I:Tổng quan về xây dựng và triễn khai bảo mật mạng hệ thống.
C4"D%$%# *+6O  (-3#
R$ r" *O8 (@R 
!6O &*-@%.'4j$2F
46OsIT''/X?Y/ZL
Chương II: Các khái niệm cơ bản về Firewall và Proxy Server.sIT''

a"'%8F*+E"@6O (@,
-"sIT''a"YII'">#. !6O E
C4XXD' t2 /E'(/jd/ UR# *
+sIT''a"YII !6O  (@
,
Chương III: Triễn khai hệ thống Firewall trên ISA Server 2006. :E"'
4+E *+-%56VWE"@2
6O  (@XYZ[\\]^,C4XXXD 
!O6O XYZYII[\\]"#46O
267%#%r# $ XYZ[\\]''I46O6O 
*O8 (@L%.'-!?Y/?ACa/E-? ,
@/E"@ 'S6S')#*+
''(S6S/6/U@82L!
/R      %r-!  J'fIYII[\\o24
Juv'2[\\ow 'w ,
g
MỞ ĐẦU
""/)2+2F/C
%0 S;6/.%0%S> S#"
i %jO=''(E2j*+-'
 S*> ' S@9C
/.%0c9O%9>/$6(/9/j2NI,
/C*"%8 S@
/.c@7 67 S.6O 
,
QO @-*+/=!'D%./I +%$
GVWE"@526O  (@XYZ[\\]^,:E"
'%$>e9/.-*+%>
@"/.c=I 292x
4',K SwE+/2j$6O  (

@6&=6OER@4 !'
,
:$"/I %0>7 SB-R
O,*!/I  .y#"/6(%5
%$ SE7-,f EO 4.yE!
6(,
YG
KA4_
KJA
k
TỔNG QUAN
A/ Tăng cường bảo mật bằng hệ thống phòng thủ đa lớp, đây là hướng
nghiên cứu của các chuyên gia Việt Nam về vấn đề bảo mật an ninh mạng:
JS%$%'("'>';< >%I@+6O d d
' S%25/'< >%I@+6O ('('U"
%&/56%&!,
<S-D '(-$';/%$%.2-
$2z 0%S4/R$&j4# 
'! U%=@"-'5'( 0%S,
*O'y6O@2N >%I@+6O '"
( Sj{2'%>> (/E--'%S
E,2!%I@+6O XII'U"%&j
%#"5 +/!@9i<E>'O%5
.%; S>6O C#G
|C=*O'y68%#>GC=%5 /6O*"$/*O'y*O8
68%#>6"d,
|C6O j(G*O'y<6O68%#>
j;l$'(2mD-j(>9,
|C >%I@+6O "4GC >%I@+6O XII
""-9d7/%MN@

O@U66O $4 S=d@%4#,
"/9%E".$4%4O*O$=i 6O
@2N'( 0%S/,
Bảo mật thiết bị đầu cuối
?(  (@"" eS(68%#
>"#.%S6O 4,""68%#>%.M
]
*+6e@9"e@%S4/2
d"4+2.<O6O@,?
 P68%#>' S(#N/#.>25 "
 (/9'w/4j 0.@<'46O>-
@<',
"!@3Nl?mO*"<#$6O
68%#>}Q#*+- +#.
68%#>'G
|hOd6O @@(<2y~>>"TI,
|hOd>"{lXIImi E=
j@UR"$ (/9%.d3<
(%S%9,
|hOd25 j@U68G3><(%S Sj@U
"68U5."4'2@6(,
R#Oc+-%$%wlI 'mi dr
 >%I@+3 ,C=d=;M>>
/R$'+S@%$i @ U<"
#%#6OI ',
Bảo vệ đa lớp với sự kết hợp hợp lý
CO=;%qF2 =2'@
`2B$ r=6O*"$"=*O8/ M yF' S
U;-*O>'( >%I@+6O /O 59
>,<O"9'<.O@

-O S/@@w@U.2Od6O<O*y
@# $  0%S/"/%q9{2
U.@<'R> "=rOO +r
>>,
o
:$*+'O52<O6O  2;<j
d# S*O/%q9O'y$!%I@+6O 
",?! 2 <.O6O .=;U6O
68%#>/6O 72U>,_O6O
%'"DcO 5</%q9c@
"E i<*+O@ !%;6O
,<O"R#O%;24=
$$O2/6q O%$68@%S,A4
</ S2=(2 @R'E '-%$
=S6S/ 2e%#'=@8UI '@U,
?)i!%I@+6O '6%&%#"1""5 /#
?%$-(O9'1$2%#O6O ,
:SRC68@O/I@t$< >%I
@+6O  -De"  N2%;%S.,
/$?"".O6O 2j(/2%;
>. 9(%S+,
952O=;/%'/@.5O 
=$6O ,O6O •%'/
?.5'(6N*"! R*O'y<-#6
>6O C !,CO6O =;DcO &
=e<+ S*O/.2Od8'P>4i >'(
< >%I@+6O " "d,JSO
@/@w@U/ '(d2Od6OD{
@2 %;9$/>=j*O8%>
*!%r/52*O'y,.. '(/4M%'

'4M>-,
€
B/ Vấn đề bảo mật hệ thống dưới góc nhìn của các chuyên gia an ninh
mạng quốc tế thì “Năm 2010, bảo mật là ưu tiên hàng đầu của doanh nghiệp”
d [\\/6O '%#@,"/Y" I
3=j6>2*Oj#$(6O @
d [\\/I%.g[•&j-%$6O ' S<
%#,
VVấn đề bảo mật thông tin ngày nay trở nên phức tạp hơn bao giờ hết. Nếu triển khai
một giải pháp bảo mật toàn diện cho phép bảo vệ h( tầng và thông tin trong doanh
nghiệp, thực thi các chính sách CNTT và giúp quản lý các hệ thống hiệu quả hơn, thì
các doanh nghiệp có thể đẩy mạnh lợi thế cạnh tranh của họ trong thế giới thông tin
hiện đại^/s@IY‚/a.8-U OQO @
(Y" I%8,
I"j$6O  (%0%8/6O ' >
*E '-%>@#,g[•@
 ('-%$*E '-+/4O<-%$2
O +/26>2;25S( "$>,
j"/C"c+$4-%$6O @
,
QO @"ej(@-$">2,
j-/6O @>$E'/<'F68O
e$-6e">"'6O  (l gg•m/6O 68%#
>l gg•m/6O 7l pƒ•m,
j/@%j@U<2/4j
26O e2.2d46S#,<2/4
j %;6SCl*%5 $6O m'e('-6
q G(#'@8Ulinfrastructure-as-a-servicem/$O'@8Ulplatform-as-
ƒ
a-servicem/  O  . "/O  .  68%#  >/   # $  ' @8  U

lsoftware-as-a-servicem,
„>>)/ECR' S Uj*+,JS
@9DO'+2Oƒ…Cr4-
lu IT2m2/+#%$%52€>ƒ…",
<…C%#q .G…XYv/AXaZZ/Y6I~v'I"/CXY/aCX/
XXK,
Các giải pháp nghiên cứu của các chuyên gia quốc tế khuyên dùng cho doanh
nghiêp
C&j#O6O(#+6i6O 68%#>/
97HI6,/R#6O< "
S6S*+@U4'2U@<'
",C&jR#O.2Od6*/6O  i O
*"< >%I@+6O  S.,
C*O8C#O6O S%S6i
@U4i 6OO<(
%S4>,†@U46S@lI~
TIm%56O'!2.{6<("O
i e%E/.*"$"%.<%.%R
%;%2N&j6(6i,
C&j#O52=CR%S.
<*"!EC+,E'(<E"@
=@U +2/2.5@U<="
*!*"!%S.%;E"@‡/%$"
2Bc+@(< Mc+27U<>
2O"r'9>2cO",
\
C&j#O*O'y>+6i@U 
9%$6O /752-%S'P/%S.
*"!i  '(*O>/ R6$
(> !,

C/ Các vấn đề còn tồn động về việc bảo mật mạng doanh nghiệp
Vấn đề bảo mật chưa được quan tâm đúng mức từ doanh nghiệp
C4*/"'N%$E"@> ( "=%5'
/@8ˆ%r69#%E"/>';TI6I4 (/6
=/=%w,,,52,C4*/@‡%#
$B%5E"@5 STI6I4 (/ S96%w/
'(!*r%#%c j-%$6O ,
Quản trị mạng “chậm chân” hơn các hacker
C. SG2I'%*O8 (
@T'@6Ow'P$'P&6O  %;,‰'
l@ ~*O8TI6I~&jAZm6GV? @%
2I/@%C'P6O %;S%qC
2I! -"/BM"" S#'2I
 %0.57 " 0l@Im2B#q SP.52
$IIl "m ^,2%./;'(/
*O8 (@9=9"'P6O  
%;"%5289w'P/222.%5'yO!
2I.5@V ew^%> (" 7V
^(SSO6O \,
@TI6I9%;%r2/E"@6e S
. '!-%8 0l@ImTI6I9>/@
%./'P6O eI".5%;@U@)%52-$

I2,IO62I/S-&6"%;
6iG2ID- STI6" S>"
-%;l4'<TI6m) S "/3%..5-
"TI6) "%.@@,:$%'4/
%E"/2682/2ID@IuIl' 6@(S@%.m
*O8 (6",CM6E"9/682I%S$2O"p
/2e1-"62@l S4!%;2I "

%5%..5*"'(E @@4m1M%.,:$"-"
*O8 (I 2I2'l25 *!(
%S "mI2IIl25  "m P",
D/ Đề tài “Xây dựng và triển khai việc bảo mật mạng cho doanh nghiệp với
ISA 2006” tập trung giải quyết các vấn đề sau:
' !O6O XYZYII[\\]
"#46O267%#%r# $ XYZ[\\]''I
46O6O *O8 (@L%.'-!?Y/?ACa/
E-? ,
''I46O6O *O8 (@XYZ
YII[\\]6q G
~ Q2ŠII''I%0.XYZYII[\\],
~ C%r "C'II4YIIZ/HI6a"'I/
sIT''a"C'I
~ (=ES-*O'=.5*"$"
TI6/(=E.5w '"6iv'2
fI@,
~ ''I%5(TI6%;{"R2>
9w@UTI6ES. h@,
[
~ ''IE2%;w@U@8U„C
9' ,
~ '=E2%;"TI6%IR
(6O6- "<TI6B%8,
~ 'E"@ 'S6Si %j"#''(S
6S/6/U@826i%r
-!J'fIYII[\\o24Juv'2[\\o,
~ M<%$2O- 2B{I
S@u'II2"TI6@I,
~ :>E' "/:$VWE"@52

6O  (@XYZ[\\]^Da6'
HI6YII/6'Š?aYIIaC'I_IT"%5E
.5"TI6IIŠ?aYII3%5' 
%&S6S@,
~ C-!ZI%52.5%@"
II,
p
NGHIÊN CỨU THỰC NGHIỆM HOẶC LÍ THUYẾT
:$VWE"@526O  (@XYZ[\\]^/
%;2I !@,
:;;#"eM:("d9C:
$CYaZCfb,g/a,ACJ/%$%;jI4
  "=68 (6q G
~J"YIIH@TYII[\\pYa[/%;? ,
~J"XYZH@TYII[\\pYa[/%;E'? 3 "YII
g
~J"C'IH@TWa.5E? r%5"T2I
#,
~ŠIZ?YK?YK~[kg\
~ZIaHŠ]\
~K+,
k
TRÌNH BÀY, ĐÁNH GIÁ BÀN LUẬN VỀ CÁC KẾT QUẢ
Công việc triển khai mô hình mạng bảo mật cho doanh nghiệp dùng ISA
Server 2006 được tiến hành như sau:
Về mặt cài đặt
~J"YII%;H@TYII[\\pYa[%;E'? /@;
@8UHI6YII/J'fIYII[\\o/saYIIŠI I?I2,
~J"XYZH@TYII[\\pYa[%;?  "
YII,

~C " C'I    H@TWa.5%; E  ? r<"
T2,
Về kết nối theo sơ đồ đi dây
~ J" XYZ YII .  [@  (G fI' %; >  @I q  
XII/XI'%;>YT,
~ J"YII "C'I>YT,
~ ZIa%;>J@I ,
Về thiết lập các rule trên ISA
~ '=XII/="II-
*O'y-EwJ'S6SRw
J'II,
~ C-!""3E' "G
a6'Š?a/a6'HI6/aC'I_IT",
Kết quả thực nghiệm
]
~ %;"#%r-!46O S
>YII`C'I`J'XYZYIIsIT''[\\],
~ '%;'IXYZYII[\\]%5%j"#$
*O'=6O @3N,
o
CHƯƠNG 1:TỔNG QUAN VỀ XÂY DỰNG VÀ TRIỂN KHAI BẢO MẬT
MẠNG HỆ THỐNG
1.1 Tầm quan trọng của việc bảo mật mạng.
1.1.1 Nhu cầu thực tế
2 (XII '($4S5(
 @3NlYJQm!R''c.' @-"'
##O6O> "=%I@($6O ,
1.1.2 Khảo sát thực tế
I SS2O%;QO  "=CYXd [\\p/
.o€• "=68-* (XIIld [\\\'kƒ•m,""/

 =O<@N-RO -"+#O
(%S2@"/2{I%.$E>#O%O 6O
!",
"/I‰ QT/.82  %>jYJQ
_I/#@2!%c # *+
6O /+9I •c2%%.O'%#2
(%S",
2%;6O%c / P#> (%$e
U-r/%>(/" ='OE
",Jr@)d [\\k.g\•YJQ*O'y (6O
w@UXII$4I>2_I/4 Sw
>+ =26' !68r-,
QO XII.5Oe@!!2
@@,JSS2OCYX:S>E  "=
sQXd [\\p-"/>ok•@%;2O%$i+
O8($=3>6O ˆgo•@6.
5%=(6O ˆ[p•6-2O\‹Y?
Pd @%S-,
JS(2-2.%'(2Œ*+%>YJQ/
%.'2O9Ur$>l@T Im(O… @O
j ( %>>6O ,-$9;/@O
( 9x6N "*+/>@I2@E""$'*
>6O ,"O%> r<($ -$@
N1c+"4",
€
1.1.3 Những nền tảng cơ bản
CR$'(!S( 2/%I@($ ("
XII-3S%qN,"NE>"'(23'
(6e=.2$ . S*O/B# SU-
%;' ('"'j-$> "=e U

-*'P&# $ ,<2z%j%iU-
".5'r/6z2# $ r•S•,
rl2ImGa#''<9 5$6O "'y
 (XII "=,%E"/ U%=r2%S
"=9  7';/B%5jN"$"2I
•=•,""/ U%="%0@#6 -"%.'%S4
'4G$/)iE/=8,,,h * $2IR-
%@(/"/.5rp@(G R7/ R%I R ,
A2I• R7•9'"6O /<9!
S%qS>'(2I• R%I•,•JR •'U 3
 B<r•w7w%I•l3='(3m/<E>.
5"%&IOm,
ŽQz2l2ImGCR-"5 E"('%>@,
<•=•'(9"'6z2# $ /w%&
HI6/%7z=@U/•@<'
ŽSG:.='E"/<9 >.%;
E92%5O 0=M MrUU U%=2,
<%I@(6O 9-"'- (/-E 'yl'
IIIm//E# $ %,<U- (j(
.%S4=8r=9B7  S"r>
"=U5,JU%=2i y%8w%&4e@<'/%7
2OrE/%r4!@ %5{2z%S
.52eS-3=> "=(E,
1.1.4 Phương thức tấn công phổ biến
Ž-@ GK4-%52eS-
" (',
ƒ
Ž-"GK4';@U%5 " (l9''P
r'P&6O m,
Ž-3>@8UGK4- ("-"6i

w S>';'"- "/E";*O/
2 "=25lr2..5m"36,
bO8>#O%%c  j%SS-%5
3%.%$6>O6O;'y,
a4•'III•9%;w@U%5%7
("O @,:E"'4-=>j'-'(
-*O$9;,:2B# Sc%('2z-
.5'-"%;j ! >/n(N 2…%5E-
>36SP;2•,
/‘/E >%I@(2.52;)%5(
"4'%> S@,<%I@("9-
 S U%8/%;' (! 2 'P&
> "=(E%5E ,‘9%MN4
9@) .5'E" /2E "='(2#ˆc.
2Od*I~ '%5'E" <> "=•2{ 
•B9/r ='c,I>206O 
# $ aIa'/>';%I@(6O %0d3[o,\\\l[\\\m']\,k\\
d [\\p,
1.1.5 Giải pháp
:5O 5(3U-';@U'P&6O /@
#O c*"!~’O*"%5r
dr>%'P&,96%##'O S=
6O 6S0E",C="#
*"%8t*"$FU392c"2•@
,
h%0.=*"%8t/6I#2;6
 U%5O 5r =6N-$•4%%#•$6O
",<6".56q 522•%5
[\
dr'( @U(ˆ%(E@U

%5/>=6O %$,
:I@(6O 52%5O 5c'.*
 ,:56O %MNO.6*"
!w'y">G
~%%82Œ$=6O 
~526O %5-2>/dr"4
*O'y@(/%,,,e<9%5 6S;'y,
~Yw<6O%5 %#>/ "@I2<%I@(%0
%;@(r%;@(,C#yji2. S
6O %4'z'O/ #2;$6
2,
C.-$66O 46O2%MN$$rP'6N,
YJQ.56%4O@@U%5O 96O 
@ !,YJQ".5' UN2O!+=
68- ;'(@'("#O6O !"
46i52<(%Sdr/@U@52,
[
1.2 Mô hình bảo mật cho một hệ thống bất kì:
1.2.1 Thành lập một nhóm chuyên giám sát sự an toàn của hệ thống:
. ". U25 /62892><"
4"5 .5E">/(<%>,
. "M. U! 5%O/46O  
>,C>)/ U. "'j%5"%&
(%S%5E*OR=>,2%
6$6O /O'9%; +!>DO",
:525  j%S"2{ >/0"67%#<-%$.5
@1%S-> (/"4-36
lXIIm,A0"w@U46O 66i SO…  S0.
@/.5-#%5'; j6O (
>268-3XII,Y25 "2B6q 25 

'P&/ Mq OE=39w@U/>%;2>
6ia/ (E=$S‡.,
JS<cy =*+-'25 "4-
36,:E"='%5  ->%> (,
 S>w@U46O 6l-@8U
I '/HI6m/I4%.ci/2O6S"4-
%$%3XII,-'6O I/> (O
%;6O3=<9w@Ua9@)2(
(D3&"%#>'6S4",
C46O 6Rc*O'y6O >%;>
4,Qi25 6S(%S>/4=6O 
%;E"@/*!w'y/46O 6-
 S42O2•'x( e jE4/
[[
=6q O 0 2…@)UE=>%5
25 =4=$=6O  4',
1.2.2 Thẩm định tính rủi ro của hệ thống:
h  …  %8  =        >/  0"  w  @U    j  G 
=“_8ŽJj%S'P&ŽhOd -,
:5'-"%;2*O6%#l8/6$46O 
/=6O mp> r9%;%$,
Y%./67%# S>ENG
~C46O R>.%;%$t-%66O
}
~h*O346O 6.%q6S=6O 
>2},
~C. U#w'(46O  2%;Bt=
6O  2}
~A>6O D -@UO-}
~_8/! =-}"468--}

CEO'9-!@E=$6S=
6O A>,C.'D/*+%;'-"*!2;
825 =4j,I8/.5! -"O
 O%;6S"#/6(.5( S@*E $'P
&6O ,
1.2.3 Xây dựng giải pháp:
2q(O,h. S/ S'
.5-%; +'P&>R2.O-
.5-%U#,C>11'w@U2;
O/O… i (46O %d/%#,
1.2.4 Firewall:
[p
WI {'+ SO… uIT'';'y%(%S)
;=6O >' S<%#*
!6O >,sIT''.5'O#jr# $ r
2;O, UuIT'''dr-
*+>/25 >,'+
uIT''=; S>2O'@@,CuIT''%$US
 S 9/-! (/j@UU5,hI {'+ S
uIT''/#! 5jduIT''/=d'+%8B/
.,,,
1.2.5 Hệ thống kiểm tra xâm nhập mạng (IDS):
JSuIT''%;+'>B2..5'+(2Od25 
.2c%*.,%E"R='4 >X?YS,
I uIT'' S%d/!!.5=X?Y S>%$
25'q>O2,JSX?Y/2'*
%$25%./ .B. UE=
. uIT''{%*/! 2 @--%06l@-
-='%( 0%0%;6 ="5 >m
2525 "dr6euIT'',X?Y4j6O%i

uIT''/-j#%5%O 6O77
uIT''(%S*O,
1.2.6 Hệ thống kiểm tra xâm nhập dựa theo vùng (H-IDS):
K+/w@U S>25 E  "
@$%$ 9j@U,JS jd%#"%
A~X?Y.5-6%$%rI96-2Œ"%&
 "@%S6"6,.' S<>
-%5O 5&4>,! 2 > P;%;
[g
#%$%;I  S<%r%5 = P
A~X?Y,
1.2.7 Hệ thống kiểm tra xâm nhập dựa theo ứng dụng (App-IDS):
Y>';Z~X?Y-89"$,CU"
E=%3 Sj@UU5"*"
j@U%.,'cc. U%=U5/c.5- j6O
d'I3 Oj@UU5,h%;2; SA~X?Y/c
%O 6OiE  S "DO 5,JSZ~X?Y%;
I  SjdP;6O >/ r@)2%c S>
9;%r6,
1.2.8 Phần mềm Anti-Virus (AV)
a# $ Z%;6S "( lT2m/ "
lIIm/>P;@8U#<4j@<'*+,
A-%$*+-%5I {2%r"# SO-Z*O
'y$ " "( ( 6S>'2Od-
%..%>.%;%I@(3 "2/.9"25 
6Ou'I 2m,
1.2.9 Mạng riêng ảo (VPN)
w@Ua%5-""
>3"4' 2 j6O /*O-
*!"$' d*O(%S,"/

2.%$!2%2” ,Q-2Œ(9%5 2 Sa%;
'/#O eS( 25 6O >6Sc
%;2>a,
:5%O 6O j6O >"/9w@UO%#"
%=6O >,:$".5%;*w
@U@1O-$@8Ua(j@U.5
[k