{"id":2911,"date":"2025-11-14T13:15:49","date_gmt":"2025-11-14T12:15:49","guid":{"rendered":"https:\/\/www.sycope.com\/post\/arp-spoofing-how-to-detect-a-man-in-the-middle-attack-and-arp-poisoning-in-a-lan-network"},"modified":"2026-01-30T11:44:01","modified_gmt":"2026-01-30T10:44:01","slug":"arp-spoofing-jak-wykryc-atak-man-in-the-middle-i-zatruwanie-arp-w-sieci-lan","status":"publish","type":"post","link":"https:\/\/www.sycope.com\/pl\/post\/arp-spoofing-jak-wykryc-atak-man-in-the-middle-i-zatruwanie-arp-w-sieci-lan","title":{"rendered":"ARP Spoofing \u2013 jak wykry\u0107 atak Man-in-the-Middle i zatruwanie ARP w sieci LAN"},"content":{"rendered":"<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_88 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.sycope.com\/pl\/post\/arp-spoofing-jak-wykryc-atak-man-in-the-middle-i-zatruwanie-arp-w-sieci-lan\/#Co_warto_wiedziec_od_razu\" >Co warto wiedzie\u0107 od razu<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.sycope.com\/pl\/post\/arp-spoofing-jak-wykryc-atak-man-in-the-middle-i-zatruwanie-arp-w-sieci-lan\/#Czym_jest_ARP_Spoofing_i_dlaczego_jest_tak_grozny\" >Czym jest ARP Spoofing i dlaczego jest tak gro\u017any?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.sycope.com\/pl\/post\/arp-spoofing-jak-wykryc-atak-man-in-the-middle-i-zatruwanie-arp-w-sieci-lan\/#Jakie_sa_konsekwencje_udanego_ataku\" >Jakie s\u0105 konsekwencje udanego ataku?\u00a0<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.sycope.com\/pl\/post\/arp-spoofing-jak-wykryc-atak-man-in-the-middle-i-zatruwanie-arp-w-sieci-lan\/#Jak_atak_Man-in-the-Middle_wyglada_w_danych_sieciowych_%E2%80%94_symptomy_korelacje_i_logika_detekcji\" >Jak atak Man-in-the-Middle wygl\u0105da w danych sieciowych \u2014 symptomy, korelacje i logika detekcji\u00a0<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.sycope.com\/pl\/post\/arp-spoofing-jak-wykryc-atak-man-in-the-middle-i-zatruwanie-arp-w-sieci-lan\/#Krok_po_kroku_jak_wykorzystac_analize_ruchu_sieciowego_do_wykrycia_anomalii\" >Krok po kroku: jak wykorzysta\u0107 analiz\u0119 ruchu sieciowego do wykrycia anomalii\u00a0<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.sycope.com\/pl\/post\/arp-spoofing-jak-wykryc-atak-man-in-the-middle-i-zatruwanie-arp-w-sieci-lan\/#Prewencja_i_reagowanie_najlepsze_praktyki_w_zakresie_bezpieczenstwa_sieci_LAN\" >Prewencja i reagowanie: najlepsze praktyki w zakresie bezpiecze\u0144stwa sieci LAN\u00a0<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.sycope.com\/pl\/post\/arp-spoofing-jak-wykryc-atak-man-in-the-middle-i-zatruwanie-arp-w-sieci-lan\/#Wnioski_i_dobre_praktyki\" >Wnioski i dobre praktyki\u00a0<\/a><\/li><\/ul><\/nav><\/div>\n<h2 data-start=\"214\" data-end=\"249\"><span class=\"ez-toc-section\" id=\"Co_warto_wiedziec_od_razu\"><\/span><span class=\"TextRun SCXW139232877 BCX0\" lang=\"PL-PL\" xml:lang=\"PL-PL\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW139232877 BCX0\" data-ccp-parastyle=\"heading 3\">Co warto wiedzie\u0107 od razu<\/span><\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"46\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">ARP spoofing to atak w sieci lokalnej, w kt\u00f3rym napastnik podszywa si\u0119 pod inne urz\u0105dzenie, wysy\u0142aj\u0105c fa\u0142szywe komunikaty ARP, aby przej\u0105\u0107 ruch sieciowy mi\u0119dzy u\u017cytkownikiem a np. bram\u0105 sieciow\u0105. Pozwala to na pods\u0142uchiwanie, modyfikacj\u0119 lub blokowanie przesy\u0142anych danych. Technika ta jest cz\u0119sto wykorzystywana w atakach typu Man-in-the-Middle w sieciach LAN. <\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"46\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Mechanizm ataku<\/span><\/b><span data-contrast=\"auto\"> polega na wysy\u0142aniu <\/span><b><span data-contrast=\"auto\">fa\u0142szywych pakiet\u00f3w ARP<\/span><\/b><span data-contrast=\"auto\">, kt\u00f3re wprowadzaj\u0105 b\u0142\u0119dne wpisy do tablic ARP urz\u0105dze\u0144. W efekcie ruch sieciowy trafia do atakuj\u0105cego, a nie do rzeczywistego celu.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"46\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Najbardziej charakterystyczny symptom<\/span><\/b><span data-contrast=\"auto\"> to <\/span><b><span data-contrast=\"auto\">konflikt adres\u00f3w<\/span><\/b><span data-contrast=\"auto\"> \u2013 ten sam adres MAC zostaje przypisany do dw\u00f3ch r\u00f3\u017cnych adres\u00f3w IP (np. bramy i stacji roboczej).<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"46\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Wykrycie ataku<\/span><\/b><span data-contrast=\"auto\"> jest mo\u017cliwe dzi\u0119ki <\/span><b><span data-contrast=\"auto\">analizie ruchu sieciowego<\/span><\/b><span data-contrast=\"auto\"> i <\/span><b><span data-contrast=\"auto\">monitorowaniu anomalii<\/span><\/b><span data-contrast=\"auto\"> w komunikacji ARP, takich jak duplikaty adres\u00f3w MAC czy nietypowy wolumen ruchu ARP.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"46\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"5\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Ochrona przed zatruwaniem ARP<\/span><\/b><span data-contrast=\"auto\"> opiera si\u0119 na trzech filarach:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"o\" data-font=\"Courier New\" data-listid=\"46\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1440,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Courier New&quot;,&quot;469769242&quot;:[9675],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;o&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"2\"><b><span data-contrast=\"auto\">Szyfrowaniu transmisji<\/span><\/b><span data-contrast=\"auto\"> (HTTPS, SSH, VPN) \u2013 nawet je\u015bli ruch zostanie przechwycony, dane pozostan\u0105 nieczytelne.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"o\" data-font=\"Courier New\" data-listid=\"46\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1440,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Courier New&quot;,&quot;469769242&quot;:[9675],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;o&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"2\"><b><span data-contrast=\"auto\">Zaawansowanych funkcjach prze\u0142\u0105cznik\u00f3w<\/span><\/b><span data-contrast=\"auto\">, takich jak <\/span><b><span data-contrast=\"auto\">Dynamic ARP Inspection (DAI)<\/span><\/b><span data-contrast=\"auto\"> i <\/span><b><span data-contrast=\"auto\">Port Security<\/span><\/b><span data-contrast=\"auto\">, kt\u00f3re blokuj\u0105 fa\u0142szywe pakiety ARP.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"o\" data-font=\"Courier New\" data-listid=\"46\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:1440,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Courier New&quot;,&quot;469769242&quot;:[9675],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;o&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"2\"><b><span data-contrast=\"auto\">Ci\u0105g\u0142ym monitoringu sieci<\/span><\/b><span data-contrast=\"auto\">, kt\u00f3ry pozwala wykry\u0107 nieprawid\u0142owo\u015bci w czasie rzeczywistym.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<h3 data-start=\"1390\" data-end=\"1435\"><\/h3>\n<h3 data-start=\"1390\" data-end=\"1435\"><span class=\"TextRun SCXW141226658 BCX0\" lang=\"PL-PL\" xml:lang=\"PL-PL\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW141226658 BCX0\" data-ccp-parastyle=\"heading 3\">Typowe objawy i reakcje \u2013 w skr\u00f3cie<\/span><\/span><span class=\"EOP SCXW141226658 BCX0\" data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<div class=\"_tableContainer_1rjym_1\">\n<div class=\"group _tableWrapper_1rjym_13 flex w-fit flex-col-reverse\" tabindex=\"-1\">\n<div style=\"overflow-x: auto; margin: 20px 0; font-family: 'DM Sans', sans-serif;\">\n<div style=\"overflow-x: auto; margin: 20px 0; font-family: 'DM Sans', sans-serif;\">\n<table style=\"width: 100%; border-collapse: collapse; border: 1px solid #ddd; font-family: 'DM Sans', sans-serif; font-size: 15px;\">\n<thead>\n<tr style=\"background-color: #f4f6fb; color: #222; text-align: left;\">\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Objaw w sieci LAN<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Co mo\u017ce oznacza\u0107<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Zalecane dzia\u0142anie<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Ten sam adres MAC przypisany do dw\u00f3ch IP<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Mo\u017cliwe zatruwanie ARP lub b\u0142\u0119dna konfiguracja<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Zweryfikuj tablic\u0119 ARP i monitoruj duplikaty w narz\u0119dziu do analizy ruchu sieciowego<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Wzrost liczby pakiet\u00f3w ARP w kr\u00f3tkim czasie<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Pr\u00f3ba masowego podszycia si\u0119 pod urz\u0105dzenia<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Sprawd\u017a \u017ar\u00f3d\u0142a ruchu, uruchom alerty w systemie monitoringu<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Brak odpowiedzi urz\u0105dze\u0144 \/ utrata po\u0142\u0105czenia<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Atak typu DoS spowodowany b\u0142\u0119dnym mapowaniem adres\u00f3w<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Odtw\u00f3rz poprawne wpisy ARP, izoluj urz\u0105dzenie z podejrzanym MAC<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Nietypowe op\u00f3\u017anienia w transmisji<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Atak Man-in-the-Middle \u2013 ruch przechodzi przez dodatkowy punkt<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Przeanalizuj \u015bcie\u017ck\u0119 pakiet\u00f3w i zidentyfikuj po\u015brednika<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<p data-start=\"2258\" data-end=\"2641\"><span class=\"TextRun SCXW58391688 BCX0\" lang=\"PL-PL\" xml:lang=\"PL-PL\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW58391688 BCX0\">Ataki takie jak ARP <\/span><span class=\"NormalTextRun SpellingErrorV2Themed SCXW58391688 BCX0\">Spoofing<\/span><span class=\"NormalTextRun SCXW58391688 BCX0\"> nie zawsze s\u0105 widoczne na pierwszy rzut oka. Ich si\u0142a tkwi w prostocie i w tym, \u017ce wykorzystuj\u0105 podstawowe zaufanie mi\u0119dzy urz\u0105dzeniami w sieci.<\/span><\/span><span class=\"LineBreakBlob BlobObject DragDrop SCXW58391688 BCX0\"><span class=\"SCXW58391688 BCX0\">\u00a0<\/span><br class=\"SCXW58391688 BCX0\" \/><\/span><span class=\"TextRun SCXW58391688 BCX0\" lang=\"PL-PL\" xml:lang=\"PL-PL\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW58391688 BCX0\">Jedynym skutecznym sposobem, aby wykry\u0107 i zneutralizowa\u0107 atak Man-in-the-Middle, jest <\/span><\/span><span class=\"TextRun SCXW58391688 BCX0\" lang=\"PL-PL\" xml:lang=\"PL-PL\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW58391688 BCX0\">proaktywna analiza ruchu sieciowego<\/span><\/span><span class=\"TextRun SCXW58391688 BCX0\" lang=\"PL-PL\" xml:lang=\"PL-PL\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW58391688 BCX0\">, wspierana przez <\/span><\/span><span class=\"TextRun SCXW58391688 BCX0\" lang=\"PL-PL\" xml:lang=\"PL-PL\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW58391688 BCX0\">ci\u0105g\u0142y monitoring<\/span><\/span><span class=\"TextRun SCXW58391688 BCX0\" lang=\"PL-PL\" xml:lang=\"PL-PL\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW58391688 BCX0\"> i <\/span><\/span><span class=\"TextRun SCXW58391688 BCX0\" lang=\"PL-PL\" xml:lang=\"PL-PL\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW58391688 BCX0\">automatyczne alerty na konflikty adres\u00f3w<\/span><\/span><span class=\"TextRun SCXW58391688 BCX0\" lang=\"PL-PL\" xml:lang=\"PL-PL\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW58391688 BCX0\">.<\/span><\/span><\/p>\n<h2 data-start=\"184\" data-end=\"236\"><\/h2>\n<h2 data-start=\"184\" data-end=\"236\"><span class=\"ez-toc-section\" id=\"Czym_jest_ARP_Spoofing_i_dlaczego_jest_tak_grozny\"><\/span><span class=\"NormalTextRun SCXW159201556 BCX0\" data-ccp-parastyle=\"heading 2\">Czym jest ARP <\/span><span class=\"NormalTextRun SpellingErrorV2Themed SCXW159201556 BCX0\" data-ccp-parastyle=\"heading 2\">Spoofing<\/span><span class=\"NormalTextRun SCXW159201556 BCX0\" data-ccp-parastyle=\"heading 2\"> i dlaczego jest tak gro\u017any?<\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3 data-start=\"238\" data-end=\"288\"><span class=\"TextRun SCXW242504260 BCX0\" lang=\"PL-PL\" xml:lang=\"PL-PL\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW242504260 BCX0\" data-ccp-parastyle=\"heading 3\">Czym jest protok\u00f3\u0142 ARP \u2014 proste por\u00f3wnanie<\/span><\/span><span class=\"EOP SCXW242504260 BCX0\" data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Protok\u00f3\u0142 ARP (Address Resolution Protocol) dzia\u0142a w sieci lokalnej jak ksi\u0105\u017cka telefoniczna \u2014 t\u0142umaczy adresy logiczne (IP) na adresy fizyczne (MAC). Kiedy host A chce wys\u0142a\u0107 ramk\u0119 do hosta B w tej samej podsieci, pyta: \u201ekto ma IP X.X.X.X? Podaj sw\u00f3j MAC\u201d. Odbiorca odpowiada, a nadawca zapisuje relacj\u0119 IP\u2194MAC w lokalnej tablicy ARP. Dzi\u0119ki temu kolejne pakiety trafiaj\u0105 bezpo\u015brednio do w\u0142a\u015bciwego urz\u0105dzenia.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Kluczowe cechy ARP:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"45\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">dzia\u0142a na warstwie 2\/3 modelu OSI;<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"45\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">jest bezstanowy i prosty \u2014 \u017c\u0105dania i odpowiedzi nie s\u0105 podpisane ani uwierzytelniane;<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"45\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">wpisy ARP s\u0105 zwykle przechowywane tymczasowo i od\u015bwie\u017cane okresowo.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Ta prostota u\u0142atwia komunikacj\u0119, ale jednocze\u015bnie tworzy luk\u0119, kt\u00f3r\u0105 potrafi wykorzysta\u0107 atakuj\u0105cy.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Na czym polega zatruwanie ARP (ARP Poisoning)<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Zatruwanie ARP polega na wysy\u0142aniu fa\u0142szywych odpowiedzi ARP do jednego lub wielu host\u00f3w, \u017ceby narzuci\u0107 b\u0142\u0119dne mapowanie IP\u2192MAC. Atakuj\u0105cy mo\u017ce na przyk\u0142ad:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"44\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">wys\u0142a\u0107 do komputera A odpowied\u017a, \u017ce \u201ebrama 192.168.1.1 ma MAC aa:bb:cc:dd:ee:ff\u201d \u2014 gdzie aa:bb&#8230; to MAC atakuj\u0105cego;<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"44\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">jednocze\u015bnie wys\u0142a\u0107 do bramy odpowied\u017a, \u017ce \u201ekomputer A ma MAC aa:bb:cc:dd:ee:ff\u201d.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Skutek: zar\u00f3wno komputer A, jak i brama zapisuj\u0105 w swoich tablicach ARP, \u017ce ruch do drugiej strony powinien i\u015b\u0107 przez MAC atakuj\u0105cego. Od tego momentu atakuj\u0105cy otrzymuje ruch obu stron i mo\u017ce go:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"43\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">przekazywa\u0107 w niezmienionej formie (przezroczyste pods\u0142uchiwanie),<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"43\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">modyfikowa\u0107 (wstrzykiwanie, podmiana tre\u015bci),<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"43\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">blokowa\u0107 (lokalny DoS).<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">W praktyce atak realizuje si\u0119 przy u\u017cyciu narz\u0119dzi, kt\u00f3re automatycznie wysy\u0142aj\u0105 sekwencje fa\u0142szywych odpowiedzi ARP z odpowiednim interwa\u0142em, aby stale utrzymywa\u0107 \u201ezatrute\u201d wpisy w tablicach ofiar.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Dlaczego to w og\u00f3le dzia\u0142a? \u2014 s\u0142abo\u015bci protoko\u0142u ARP<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Powodem skuteczno\u015bci ARP Spoofing jest projekt samego ARP \u2014 protok\u00f3\u0142 zosta\u0142 zaprojektowany z za\u0142o\u017ceniem zaufania w obr\u0119bie LAN. ARP:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"42\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">nie weryfikuje, sk\u0105d pochodzi odpowied\u017a;<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"42\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">akceptuje pierwsz\u0105 napotkan\u0105 odpowied\u017a i zapisuje j\u0105 w tablicy;<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"42\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">nie stosuje mechanizm\u00f3w kryptograficznych ani podpis\u00f3w.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Dodatkowo, typowe systemy operacyjne i urz\u0105dzenia sieciowe aktualizuj\u0105 wpisy ARP bez dodatkowej walidacji \u2014 przyjmuj\u0105 \u201egratuitous ARP\u201d lub nadpisuj\u0105 istniej\u0105ce wpisy nowymi danymi. To sprawia, \u017ce atak przebiega szybko i skutecznie, cz\u0119sto bez widocznych symptom\u00f3w na poziomie aplikacji u\u017cytkownika.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Po\u0142\u0105czenie z atakiem Man-in-the-Middle<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Celem ARP Spoofing zwykle jest wcielenie si\u0119 w pozycj\u0119 po\u015brednika, czyli przeprowadzenie ataku Man-in-the-Middle. R\u00f3\u017cnica tkwi w poziomie i metodzie wej\u015bcia mi\u0119dzy stronami komunikacji:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"41\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">Atak Man-in-the-Middle to szersze poj\u0119cie \u2014 opisuje sytuacj\u0119, gdy napastnik kontroluje przesy\u0142 danych mi\u0119dzy dwiema stronami i mo\u017ce je pods\u0142uchiwa\u0107 lub zmienia\u0107.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"41\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">ARP Spoofing to technika uzyskania takiej pozycji w sieci LAN.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Konsekwencje, gdy atakuj\u0105cy zostaje po\u015brednikiem:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"40\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">dane przesy\u0142ane bez szyfrowania staj\u0105 si\u0119 czytelne;<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"40\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">sesje uwierzytelnione jednorazowymi ciasteczkami lub tokenami mog\u0105 zosta\u0107 przej\u0119te;<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"40\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">ofiara nie musi zauwa\u017cy\u0107 \u017cadnej zmiany w widoku swoich aplikacji, mimo \u017ce ruch przebiega przez zewn\u0119trzne urz\u0105dzenie.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Szybkie por\u00f3wnanie: normalna wymiana ARP vs zatruwanie ARP<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<div class=\"_tableContainer_1rjym_1\">\n<div class=\"group _tableWrapper_1rjym_13 flex w-fit flex-col-reverse\" tabindex=\"-1\">\n<div style=\"overflow-x: auto; margin: 20px 0; font-family: 'DM Sans', sans-serif;\">\n<div style=\"overflow-x: auto; margin: 20px 0; font-family: 'DM Sans', sans-serif;\">\n<table style=\"width: 100%; border-collapse: collapse; border: 1px solid #ddd; font-family: 'DM Sans', sans-serif; font-size: 15px;\">\n<thead>\n<tr style=\"background-color: #f4f6fb; color: #222; text-align: left;\">\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Element<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Normalna wymiana ARP<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Zatruwanie ARP<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Kto inicjuje<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Host potrzebuj\u0105cy MAC dla danego IP<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Atakuj\u0105cy inicjuje i wysy\u0142a fa\u0142szywe odpowiedzi<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Weryfikacja odpowiedzi<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Brak kryptograficznej weryfikacji<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">R\u00f3wnie\u017c brak \u2014 st\u0105d skuteczno\u015b\u0107 ataku<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Trwa\u0142o\u015b\u0107 wpisu<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Tymczasowy, odnawiany przez normalne \u017c\u0105dania<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Utrzymywany przez powtarzane fa\u0142szywe odpowiedzi<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Mo\u017cliwo\u015b\u0107 wykrycia r\u0119cznego<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Mo\u017cliwe, wymaga sprawdzenia tablic ARP<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Trudne bez monitoringu \u2014 objawy mog\u0105 by\u0107 subtelne<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Kiedy zatruwanie ARP jest szczeg\u00f3lnie niebezpieczne<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Atak staje si\u0119 krytyczny, gdy w sieci istniej\u0105 zasoby przesy\u0142aj\u0105ce dane w postaci niezaszyfrowanej lub gdy:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"39\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">sie\u0107 jest p\u0142aska, bez segmentacji;<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"39\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">urz\u0105dzenia u\u017cytkownik\u00f3w nie stosuj\u0105 VPN ani HTTPS jako wymuszonego standardu;<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"39\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">brak jest mechanizm\u00f3w kontroli warstwy 2 (DAI, Port Security) oraz system\u00f3w do analizy ruchu sieciowego.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">W takich warunkach ARP Spoofing mo\u017ce by\u0107 nie tylko etapem wywiadowczym, lecz pocz\u0105tkiem powa\u017cniejszych atak\u00f3w: eskalacji uprawnie\u0144, kradzie\u017cy to\u017csamo\u015bci, instalacji malware.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h2 data-start=\"214\" data-end=\"267\"><span class=\"ez-toc-section\" id=\"Jakie_sa_konsekwencje_udanego_ataku\"><\/span><span class=\"TextRun SCXW105729786 BCX0\" lang=\"PL-PL\" xml:lang=\"PL-PL\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW105729786 BCX0\" data-ccp-parastyle=\"heading 2\">Jakie s\u0105 konsekwencje udanego ataku?<\/span><\/span><span class=\"EOP SCXW105729786 BCX0\" data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><span data-contrast=\"auto\">Udanemu ARP Spoofing zawsze towarzyszy jedno z dw\u00f3ch zjawisk: <\/span><b><span data-contrast=\"auto\">pods\u0142uchiwanie i manipulacja ruchem (Man-in-the-Middle)<\/span><\/b><span data-contrast=\"auto\"> lub <\/span><b><span data-contrast=\"auto\">ca\u0142kowita degradacja komunikacji (DoS)<\/span><\/b><span data-contrast=\"auto\">.<\/span><br \/>\n<span data-contrast=\"auto\">W obu przypadkach skutki s\u0105 powa\u017cne, poniewa\u017c atakuj\u0105cy uzyskuje realn\u0105 kontrol\u0119 nad przep\u0142ywem danych w sieci lokalnej \u2013 a wi\u0119c nad najcenniejszym zasobem ka\u017cdej organizacji: <\/span><b><span data-contrast=\"auto\">informacj\u0105 w tranzycie<\/span><\/b><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Dla zespo\u0142\u00f3w bezpiecze\u0144stwa kluczowe jest rozumienie nie tylko symptom\u00f3w, ale te\u017c pe\u0142nej <\/span><b><span data-contrast=\"auto\">\u015bcie\u017cki eksploatacji<\/span><\/b><span data-contrast=\"auto\">: co dok\u0142adnie atakuj\u0105cy mo\u017ce zrobi\u0107 po skutecznym zatruciu tablic ARP, jakie s\u0105 skutki w warstwach wy\u017cszych i jak to wida\u0107 w danych telemetrycznych.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Pods\u0142uchiwanie i kradzie\u017c danych (Sniffing)<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">To pierwszy i najcz\u0119stszy cel ataku Man-in-the-Middle w sieci LAN.<\/span><br \/>\n<span data-contrast=\"auto\">Po zainfekowaniu tablic ARP urz\u0105dzenie atakuj\u0105cego staje si\u0119 po\u015brednikiem w komunikacji mi\u0119dzy ofiar\u0105 a bram\u0105 sieciow\u0105. Ka\u017cdy pakiet przechodzi przez jego interfejs, zanim trafi do celu.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">W praktyce oznacza to pe\u0142n\u0105 widoczno\u015b\u0107:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"38\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">\u017c\u0105da\u0144 i odpowiedzi HTTP przesy\u0142anych otwartym tekstem,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"38\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">logowa\u0144 SMTP, POP3, FTP, Telnet, LDAP bez TLS,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"38\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">ciasteczek sesyjnych i token\u00f3w uwierzytelniaj\u0105cych,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"38\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><span data-contrast=\"auto\">nazw u\u017cytkownik\u00f3w, numer\u00f3w kont, danych osobowych i metadanych dokument\u00f3w.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Za pomoc\u0105 narz\u0119dzi takich jak Wireshark, tcpdump czy dsniff, atakuj\u0105cy mo\u017ce filtrowa\u0107 ruch i automatycznie ekstraktowa\u0107 po\u015bwiadczenia z warstw aplikacyjnych.<\/span><br \/>\n<span data-contrast=\"auto\">W efekcie powstaje pe\u0142ny <\/span><b><span data-contrast=\"auto\">obraz aktywno\u015bci u\u017cytkownika<\/span><\/b><span data-contrast=\"auto\">, \u0142\u0105cznie z otwieranymi stronami, nazwami plik\u00f3w czy tre\u015bci\u0105 zapyta\u0144 HTTP.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Z punktu widzenia zespo\u0142u SOC, wykrycie pods\u0142uchiwania wymaga monitorowania:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"37\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">nienaturalnej liczby sesji ARP w por\u00f3wnaniu do baseline\u2019u,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"37\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">pojawienia si\u0119 nowego hosta o roli proxy w przep\u0142ywach TCP,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"37\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">r\u00f3wnoczesnych po\u0142\u0105cze\u0144 do bramy i klient\u00f3w (dwukierunkowy tunel MITM).<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Przejmowanie sesji (Session Hijacking)<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Kiedy aplikacje u\u017cywaj\u0105 ciasteczek lub token\u00f3w do utrzymywania sesji, a ruch nie jest w pe\u0142ni szyfrowany, atakuj\u0105cy mo\u017ce przechwyci\u0107 identyfikator sesji i odtworzy\u0107 j\u0105 na swoim urz\u0105dzeniu.<\/span><br \/>\n<span data-contrast=\"auto\">W ten spos\u00f3b loguje si\u0119 do systemu \u201ew imieniu\u201d u\u017cytkownika bez konieczno\u015bci znajomo\u015bci has\u0142a.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Najcz\u0119stsze cele:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"36\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">panele administracyjne CMS i ERP,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"36\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">aplikacje webowe bez wymuszonego HTTPS,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"36\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">poczta webowa, interfejsy bankowo\u015bci i CRM.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Przej\u0119cie sesji jest szczeg\u00f3lnie niebezpieczne, gdy aplikacja:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"35\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">nie wi\u0105\u017ce sesji z adresem IP lub fingerprintem przegl\u0105darki,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"35\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">nie stosuje atrybut\u00f3w <\/span><span data-contrast=\"auto\">Secure<\/span><span data-contrast=\"auto\"> i <\/span><span data-contrast=\"auto\">HttpOnly<\/span><span data-contrast=\"auto\"> dla cookies,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"35\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">u\u017cywa d\u0142ugotrwa\u0142ych token\u00f3w JWT bez rotacji.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Z punktu widzenia sieci, w momencie przej\u0119cia sesji system do analizy ruchu sieciowego mo\u017ce zarejestrowa\u0107:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"34\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">r\u00f3wnoleg\u0142e przep\u0142ywy TCP o identycznym ID sesji z r\u00f3\u017cnych adres\u00f3w MAC,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"34\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">zmian\u0119 \u017ar\u00f3d\u0142owego IP w \u015brodku sesji,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"34\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">niezgodno\u015b\u0107 User-Agent lub TLS fingerprint.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">To klasyczne sygna\u0142y lateralnego przej\u0119cia sesji w wyniku ataku Man-in-the-Middle.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Modyfikacja ruchu w locie (Traffic Tampering)<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">W bardziej zaawansowanych scenariuszach atakuj\u0105cy nie tylko pods\u0142uchuje, ale <\/span><b><span data-contrast=\"auto\">modyfikuje<\/span><\/b><span data-contrast=\"auto\"> tre\u015b\u0107 ruchu w czasie rzeczywistym.<\/span><br \/>\n<span data-contrast=\"auto\">Mo\u017ce to by\u0107:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"33\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">podmiana link\u00f3w do plik\u00f3w wykonywalnych,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"33\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">wstrzykni\u0119cie skrypt\u00f3w JavaScript w stron\u0119 HTTP,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"33\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">przekierowanie u\u017cytkownika na stron\u0119 phishingow\u0105,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"33\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><span data-contrast=\"auto\">manipulacja nag\u0142\u00f3wkami DNS lub HTTP (np. Host, Location, Set-Cookie).<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Z perspektywy warstwy sieciowej atak polega na tym, \u017ce po przechwyceniu pakietu IP atakuj\u0105cy rekonstruuje payload i modyfikuje go przed przekazaniem dalej.<\/span><br \/>\n<span data-contrast=\"auto\">Zachowuje przy tym poprawne sumy kontrolne i identyfikatory TCP, przez co z punktu widzenia ofiary transmisja wygl\u0105da ca\u0142kowicie prawid\u0142owo.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Systemy NDR mog\u0105 to wykry\u0107 poprzez:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"32\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">analiz\u0119 zmian w rozmiarze pakiet\u00f3w (delta payload vs baseline),<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"32\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">r\u00f3\u017cnice checksum IP\/TCP mimo braku retransmisji,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"32\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">korelacj\u0119 tre\u015bci HTTP (hashy) mi\u0119dzy oryginalnym a przekazanym pakietem.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Taka analiza wymaga pe\u0142nej inspekcji pakiet\u00f3w (Deep Packet Inspection) lub monitorowania integralno\u015bci payload\u00f3w w czasie rzeczywistym.<\/span><br \/>\n<span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Ataki typu DoS (Denial of Service) w warstwie 2<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Nie ka\u017cdy ARP Spoofing ma na celu przej\u0119cie ruchu. W niekt\u00f3rych przypadkach atakuj\u0105cy <\/span><b><span data-contrast=\"auto\">celowo zrywa komunikacj\u0119<\/span><\/b><span data-contrast=\"auto\">. Wystarczy, \u017ce wy\u015ble do ofiary fa\u0142szyw\u0105 odpowied\u017a ARP mapuj\u0105c\u0105 IP bramy sieciowej na <\/span><b><span data-contrast=\"auto\">nieistniej\u0105cy lub losowy adres MAC<\/span><\/b><span data-contrast=\"auto\">.<\/span><br \/>\n<span data-contrast=\"auto\">Efekt: ka\u017cda pr\u00f3ba wys\u0142ania pakietu ko\u0144czy si\u0119 niepowodzeniem, bo ramek nie da si\u0119 dostarczy\u0107.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Tego typu DoS:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"31\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">nie wymaga du\u017cego ruchu,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"31\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">nie jest widoczny na firewallu,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"31\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">blokuje tylko wybranych host\u00f3w (np. pracownik\u00f3w konkretnego dzia\u0142u).<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">W systemach analizy ruchu sieciowego DoS ARP wida\u0107 jako:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"30\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">nag\u0142y spadek liczby przep\u0142yw\u00f3w wychodz\u0105cych z hosta,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"30\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">wzrost liczby nieudanych retransmisji TCP,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"30\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">d\u0142ugotrwa\u0142e ARP requesty bez odpowiedzi.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Lateral movement i eskalacja uprawnie\u0144<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Skuteczny atak Man-in-the-Middle rzadko jest ko\u0144cem dzia\u0142a\u0144 napastnika.<\/span><br \/>\n<span data-contrast=\"auto\"> Po przechwyceniu po\u015bwiadcze\u0144 lub token\u00f3w sesyjnych atakuj\u0105cy wykorzystuje je do:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"29\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">poruszania si\u0119 po innych segmentach LAN (lateral movement),<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"29\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">uzyskania dost\u0119pu do system\u00f3w zarz\u0105dzania (AD, DNS, DHCP),<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"29\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">wstrzykni\u0119cia oprogramowania z\u0142o\u015bliwego lub backdoora w infrastrukturze.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Na tym etapie wykrycie ataku wymaga integracji analizy ruchu sieciowego z SIEM i EDR, aby korelowa\u0107 zachowania sieciowe (nietypowe po\u0142\u0105czenia) z aktywno\u015bci\u0105 host\u00f3w (nowe procesy, logowania, eksport plik\u00f3w).<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Analiza przep\u0142ywu pakiet\u00f3w \u2014 jak system NDR widzi atak Man-in-the-Middle<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Systemy NDR mog\u0105 analizowa\u0107 dane w czasie rzeczywistym, \u0142\u0105cz\u0105c ruch L2, L3 i L4 w jeden obraz.<\/span><br \/>\n<span data-contrast=\"auto\"> Poni\u017cej przyk\u0142adowy fragment zarejestrowanego ataku w widoku pakietowym:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Frame 121: ARP, Reply 192.168.1.1 is-at aa:bb:cc:dd:ee:ff<\/span><br \/>\n<span data-contrast=\"auto\">Frame 122: ARP, Reply 192.168.1.137 is-at aa:bb:cc:dd:ee:ff<\/span><br \/>\n<span data-contrast=\"auto\">Frame 123: TCP SYN 192.168.1.137 \u2192 93.184.216.34 (example.com)<\/span><br \/>\n<span data-contrast=\"auto\">Frame 124: TCP SYN 192.168.1.1 \u2192 93.184.216.34 (example.com)<\/span><br \/>\n<span data-contrast=\"auto\">Frame 125: TCP SYN 192.168.1.137 \u2192 192.168.1.1<\/span><br \/>\n<span data-contrast=\"auto\">Frame 126: TCP ACK 192.168.1.1 \u2192 192.168.1.137<\/span><br \/>\n<span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"auto\">Interpretacja analityczna:<\/span><\/b><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"28\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">Linie 121\u2013122: klasyczny wzorzec zatrucia ARP \u2013 ten sam MAC (aa:bb:cc:dd:ee:ff) przypisany do dw\u00f3ch adres\u00f3w IP (brama i host).<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"28\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">Linie 123\u2013124: ruch HTTP z ofiary i bramy pojawia si\u0119 w tym samym czasie \u2013 atakuj\u0105cy przejmuje obie strony sesji.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"28\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">Linie 125\u2013126: po\u0142\u0105czenie lokalne mi\u0119dzy hostem a bram\u0105 jest teraz terminowane przez atakuj\u0105cego, kt\u00f3ry pe\u0142ni funkcj\u0119 proxy.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Dodatkowo NDR koreluje t\u0119 aktywno\u015b\u0107 z metadanymi TCP:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"27\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">wzrost RTT o 72% wzgl\u0119dem baseline\u2019u,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"27\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">asymetria liczby pakiet\u00f3w (sent\/received),<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"27\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">pojawienie si\u0119 nowego hopa w \u015bcie\u017cce (traceroute delta = +1).<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">To wystarcza do potwierdzenia aktywnego ataku Man-in-the-Middle i uruchomienia reakcji \u2013 np. automatycznej izolacji portu lub przekazania zdarzenia do SIEM.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Wymiar biznesowy i regulacyjny<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Konsekwencje udanego ARP Spoofing nie ko\u0144cz\u0105 si\u0119 na aspektach technicznych.<\/span><br \/>\n<span data-contrast=\"auto\"> Z punktu widzenia organizacji to:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"26\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">naruszenie poufno\u015bci danych osobowych<\/span><\/b><span data-contrast=\"auto\"> \u2013 w kontek\u015bcie RODO oznacza obowi\u0105zek notyfikacji incydentu,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"26\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">utrat\u0119 integralno\u015bci danych<\/span><\/b><span data-contrast=\"auto\"> \u2013 ryzyko b\u0142\u0119d\u00f3w w transakcjach, raportach, przesy\u0142kach danych,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"26\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">zak\u0142\u00f3cenie ci\u0105g\u0142o\u015bci dzia\u0142ania<\/span><\/b><span data-contrast=\"auto\"> \u2013 przerwy w komunikacji lub serwisach krytycznych,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"26\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">straty reputacyjne<\/span><\/b><span data-contrast=\"auto\"> \u2013 pods\u0142uch lub manipulacja ruchem wewn\u0119trznym cz\u0119sto wycieka do medi\u00f3w szybciej ni\u017c komunikaty wewn\u0119trzne.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Dlatego ARP Spoofing powinien by\u0107 traktowany w politykach bezpiecze\u0144stwa na r\u00f3wni z atakami aplikacyjnymi i incydentami DDoS (link do naszego artyku\u0142u o DDoS).<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Tabela skutk\u00f3w technicznych i operacyjnych<\/span><\/b><\/h3>\n<div class=\"_tableContainer_1rjym_1\">\n<div class=\"group _tableWrapper_1rjym_13 flex w-fit flex-col-reverse\" tabindex=\"-1\">\n<div style=\"overflow-x: auto; margin: 20px 0; font-family: 'DM Sans', sans-serif;\">\n<div style=\"overflow-x: auto; margin: 20px 0; font-family: 'DM Sans', sans-serif;\">\n<table style=\"width: 100%; border-collapse: collapse; border: 1px solid #ddd; font-family: 'DM Sans', sans-serif; font-size: 15px;\">\n<thead>\n<tr style=\"background-color: #f4f6fb; color: #222; text-align: left;\">\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Kategoria incydentu<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Mechanizm ataku<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Objawy techniczne<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Potencjalne skutki biznesowe<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Priorytet reakcji<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Pods\u0142uchiwanie (Sniffing)<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Przechwytywanie pakiet\u00f3w ARP\/MAC<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Nietypowe przep\u0142ywy TCP, nowy po\u015brednik w komunikacji<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Utrata poufno\u015bci danych, kradzie\u017c po\u015bwiadcze\u0144<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Krytyczny<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid:#ddd; font-weight: bold; color: #1769ff;\">Przejmowanie sesji<\/td>\n<td style=\"padding: 12px; border: 1px solid:#ddd;\">Przechwycenie token\u00f3w lub cookies<\/td>\n<td style=\"padding: 12px; border: 1px solid:#ddd;\">R\u00f3wnoleg\u0142e sesje z r\u00f3\u017cnych IP\/MAC<\/td>\n<td style=\"padding: 12px; border: 1px solid:#ddd;\">Nieautoryzowany dost\u0119p do system\u00f3w, fraud<\/td>\n<td style=\"padding: 12px; border: 1px solid:#ddd;\">Krytyczny<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 12px; border: 1px solid:#ddd; font-weight: bold; color: #1769ff;\">Modyfikacja ruchu<\/td>\n<td style=\"padding: 12px; border: 1px solid:#ddd;\">Manipulacja payloadami<\/td>\n<td style=\"padding: 12px; border: 1px solid:#ddd;\">Zmiany checksum, anomalia HTTP hash<\/td>\n<td style=\"padding: 12px; border: 1px solid:#ddd;\">Wstrzykni\u0119cie z\u0142o\u015bliwego kodu, phishing<\/td>\n<td style=\"padding: 12px; border: 1px solid:#ddd;\">Krytyczny<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid:#ddd; font-weight: bold; color: #1769ff;\">DoS L2<\/td>\n<td style=\"padding: 12px; border: 1px solid:#ddd;\">Mapowanie IP\u2192fa\u0142szywy MAC<\/td>\n<td style=\"padding: 12px; border: 1px solid:#ddd;\">Brak komunikacji, powtarzaj\u0105ce ARP requesty<\/td>\n<td style=\"padding: 12px; border: 1px solid:#ddd;\">Przest\u00f3j operacyjny, utrata dost\u0119pno\u015bci<\/td>\n<td style=\"padding: 12px; border: 1px solid:#ddd;\">Wysoki<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 12px; border: 1px solid:#ddd; font-weight: bold; color: #1769ff;\">Lateral Movement<\/td>\n<td style=\"padding: 12px; border: 1px solid:#ddd;\">Wykorzystanie przechwyconych danych<\/td>\n<td style=\"padding: 12px; border: 1px solid:#ddd;\">Nowe po\u0142\u0105czenia w segmentach<\/td>\n<td style=\"padding: 12px; border: 1px solid:#ddd;\">Rozprzestrzenianie si\u0119 incydentu<\/td>\n<td style=\"padding: 12px; border: 1px solid:#ddd;\">Wysoki<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<p><span data-contrast=\"auto\">Konsekwencje skutecznego ARP Spoofing s\u0105 wielowarstwowe \u2013 od prostego sniffingu po pe\u0142ne przej\u0119cie infrastruktury.<\/span><br \/>\n<span data-contrast=\"auto\"> Najwi\u0119kszym zagro\u017ceniem nie jest sam moment zatrucia tablic, ale <\/span><b><span data-contrast=\"auto\">d\u0142ugofalowe skutki<\/span><\/b><span data-contrast=\"auto\">: utrata poufno\u015bci, przej\u0119cie sesji, utrata integralno\u015bci danych i zak\u0142\u00f3cenie dzia\u0142ania us\u0142ug.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Dzi\u0119ki systemom klasy NDR organizacja mo\u017ce zobaczy\u0107 ten atak w pe\u0142nej perspektywie \u2014 nie tylko jako konflikt ARP, ale jako <\/span><b><span data-contrast=\"auto\">ci\u0105g logicznie powi\u0105zanych zdarze\u0144 w warstwach 2\u20134<\/span><\/b><span data-contrast=\"auto\">.<\/span><br \/>\n<span data-contrast=\"auto\">To pozwala reagowa\u0107 precyzyjnie, zanim nast\u0105pi kompromitacja i zamieni\u0107 incydent w \u017ar\u00f3d\u0142o wiedzy o faktycznym stanie bezpiecze\u0144stwa sieci LAN.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h2 data-start=\"0\" data-end=\"103\"><\/h2>\n<h2 data-start=\"0\" data-end=\"103\"><span class=\"ez-toc-section\" id=\"Jak_atak_Man-in-the-Middle_wyglada_w_danych_sieciowych_%E2%80%94_symptomy_korelacje_i_logika_detekcji\"><\/span><span class=\"TextRun SCXW26598784 BCX0\" lang=\"PL-PL\" xml:lang=\"PL-PL\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW26598784 BCX0\" data-ccp-parastyle=\"heading 2\">Jak atak Man-in-the-Middle wygl\u0105da w danych sieciowych \u2014 symptomy, korelacje i logika detekcji<\/span><\/span><span class=\"EOP SCXW26598784 BCX0\" data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><span data-contrast=\"auto\">Rozpoznanie ARP Spoofing w praktyce wymaga wi\u0119cej ni\u017c tylko zauwa\u017cenia nietypowego wpisu w tablicy ARP. Dla do\u015bwiadczonych zespo\u0142\u00f3w SOC czy administrator\u00f3w NOC liczy si\u0119 <\/span><b><span data-contrast=\"auto\">korelacja zdarze\u0144 na poziomie warstwy 2, 3 i 4<\/span><\/b><span data-contrast=\"auto\">, obserwowana w kontek\u015bcie ca\u0142ej topologii sieci i typowych wzorc\u00f3w komunikacji. Dopiero wtedy mo\u017cna z wysokim prawdopodobie\u0144stwem potwierdzi\u0107, \u017ce mamy do czynienia z rzeczywistym atakiem Man-in-the-Middle, a nie b\u0142\u0119dem konfiguracyjnym czy kolizj\u0105 adres\u00f3w.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Systemy klasy NDR (Network Detection and Response) \u2014 takie jak Sycope \u2014 analizuj\u0105 nie tylko pojedyncze pakiety ARP, ale r\u00f3wnie\u017c ich <\/span><b><span data-contrast=\"auto\">dystrybucj\u0119 czasow\u0105, kierunek, powtarzalno\u015b\u0107 oraz wp\u0142yw na inne protoko\u0142y<\/span><\/b><span data-contrast=\"auto\"> (TCP, DNS, HTTP). Dzi\u0119ki temu s\u0105 w stanie odr\u00f3\u017cni\u0107 autentyczne zmiany w topologii od aktywnego zatrucia tablic ARP.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Duplikaty adres\u00f3w MAC \u2014 najczystszy sygna\u0142 anomalii w warstwie 2<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">W \u015brodowisku LAN ka\u017cdy adres MAC powinien by\u0107 unikalny w danym segmencie. Gdy system detekcji odnotowuje, \u017ce ten sam adres MAC zosta\u0142 przypisany do dw\u00f3ch lub wi\u0119cej adres\u00f3w IP, powstaje klasyczny wzorzec zatruwania ARP.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Z technicznego punktu widzenia wygl\u0105da to tak: host A (ofiara) i brama sieciowa (gateway) otrzymuj\u0105 od atakuj\u0105cego fa\u0142szywe odpowiedzi ARP, kt\u00f3re podmieniaj\u0105 wpisy w ich tablicach. Efektem jest, \u017ce ruch mi\u0119dzy nimi zaczyna przechodzi\u0107 przez urz\u0105dzenie po\u015brednie.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Systemy analizy ruchu monitoruj\u0105 takie zjawiska nie tylko punktowo, ale te\u017c w czasie \u2014 tworz\u0105 <\/span><b><span data-contrast=\"auto\">korelacje temporalne<\/span><\/b><span data-contrast=\"auto\"> mi\u0119dzy zdarzeniami. Je\u017celi ten sam MAC jest raportowany z r\u00f3\u017cnymi adresami IP w kr\u00f3tkim odst\u0119pie (np. 10\u201330 sekund), alert zyskuje wysok\u0105 wag\u0119 ryzyka.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"auto\">Przyk\u0142adowy scenariusz:<\/span><\/b><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Alert: Conflict Detected<\/span><br \/>\n<span data-contrast=\"auto\">MAC: aa:bb:cc:dd:ee:ff<\/span><br \/>\n<span data-contrast=\"auto\">Linked IPs: 192.168.1.1 (Gateway), 192.168.1.137 (Workstation)<\/span><br \/>\n<span data-contrast=\"auto\">Severity: Critical<\/span><br \/>\n<span data-contrast=\"auto\">Pattern: Duplicate MAC Mapping (2 IPs within 15s)<\/span><br \/>\n<span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">W sieciach dobrze zarz\u0105dzanych taki alert jest jednoznacznym dowodem rozpocz\u0119cia ataku Man-in-the-Middle.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Wzorce wolumetryczne i semantyczne \u2014 anomalia w komunikacji ARP<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Drugi rodzaj symptom\u00f3w dotyczy <\/span><b><span data-contrast=\"auto\">wolumenu i natury komunikacji ARP<\/span><\/b><span data-contrast=\"auto\">.<\/span><br \/>\n<span data-contrast=\"auto\">W zdrowej sieci ruch ARP jest umiarkowany, \u015bci\u015ble zale\u017cny od liczby host\u00f3w i czasu od\u015bwie\u017cania cache. W przypadku ARP Spoofing pojawia si\u0119 nag\u0142y, nienaturalny wzrost liczby pakiet\u00f3w ARP \u2014 zw\u0142aszcza odpowiedzi (ARP Reply), kt\u00f3re nie odpowiadaj\u0105 \u017cadnym zapytaniom (ARP Request).<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Systemy analizy ruchu wykrywaj\u0105 ten wzorzec poprzez:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"25\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">monitorowanie relacji Request\/Reply w czasie;<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"25\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">analiz\u0119 liczby pakiet\u00f3w <\/span><i><span data-contrast=\"auto\">gratuitous ARP<\/span><\/i><span data-contrast=\"auto\">;<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"25\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">identyfikacj\u0119 host\u00f3w, kt\u00f3re generuj\u0105 nadmiar odpowiedzi bez wcze\u015bniejszego \u017c\u0105dania.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><b><span data-contrast=\"auto\">Interpretacja ekspercka:<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> Atakuj\u0105cy utrzymuje \u201ezatrucie\u201d tablic ARP wysy\u0142aj\u0105c co kilka sekund pakiety typu <\/span><i><span data-contrast=\"auto\">gratuitous reply<\/span><\/i><span data-contrast=\"auto\">, by nadpisa\u0107 poprawne wpisy. Systemy monitoruj\u0105ce \u0142\u0105cz\u0105 ten wzrost z danymi z NetFlow \u2014 je\u015bli ten sam host generuje du\u017cy wolumen ARP i r\u00f3wnocze\u015bnie uczestniczy w przep\u0142ywach TCP, kt\u00f3rych wcze\u015bniej nie obserwowano, ryzyko potwierdzonego ataku ro\u015bnie wyk\u0142adniczo.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Korelacja z logami prze\u0142\u0105cznik\u00f3w \u2014 flapping MAC i anomalia topologiczna<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Zatruwanie ARP nie jest widoczne tylko w pakietach. \u015alady pojawiaj\u0105 si\u0119 r\u00f3wnie\u017c w infrastrukturze sieciowej: prze\u0142\u0105czniki rejestruj\u0105 tzw. <\/span><b><span data-contrast=\"auto\">MAC flapping<\/span><\/b><span data-contrast=\"auto\"> \u2014 czyli szybkie przemieszczanie si\u0119 tego samego adresu MAC mi\u0119dzy r\u00f3\u017cnymi portami.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">To szczeg\u00f3lnie warto\u015bciowy wska\u017anik, bo \u0142\u0105czy warstw\u0119 logiczn\u0105 (ARP) z fizyczn\u0105 (porty). W logach syslog lub SNMP mog\u0105 pojawia\u0107 si\u0119 wpisy:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">%SW_MGMT-4-MAC_FLAP: MAC aa:bb:cc:dd:ee:ff moved from Gi1\/0\/5 to Gi1\/0\/23<\/span><br \/>\n<span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Taka zmiana jest nienaturalna, je\u015bli nie wynika z prze\u0142\u0105czenia hosta lub rekonfiguracji sieci. System NDR, kt\u00f3ry zbiera dane z wielu \u017ar\u00f3de\u0142, potrafi po\u0142\u0105czy\u0107 te informacje w <\/span><b><span data-contrast=\"auto\">kontekstowy obraz zdarzenia<\/span><\/b><span data-contrast=\"auto\">: host o danym MAC pojawia si\u0119 na kilku portach, generuje niestandardowy ruch ARP i uczestniczy w przep\u0142ywach TCP z hostami, z kt\u00f3rymi wcze\u015bniej nie komunikowa\u0142 si\u0119.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">To przyk\u0142ad korelacji wielo\u017ar\u00f3d\u0142owej \u2014 nie pojedynczy alert, ale <\/span><b><span data-contrast=\"auto\">zbie\u017cno\u015b\u0107 symptom\u00f3w<\/span><\/b><span data-contrast=\"auto\">, kt\u00f3ra zwi\u0119ksza wiarygodno\u015b\u0107 detekcji.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Skutki warstwy 3 i 4 \u2014 degradacja jako\u015bci transmisji<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">W momencie, gdy ruch zaczyna przechodzi\u0107 przez po\u015brednika, zmieniaj\u0105 si\u0119 charakterystyki po\u0142\u0105cze\u0144 TCP i UDP. Wida\u0107 to w danych telemetrycznych:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"24\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">wzrost RTT (Round Trip Time)<\/span><\/b><span data-contrast=\"auto\"> mi\u0119dzy hostem a bram\u0105,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"24\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">nieregularny jitter<\/span><\/b><span data-contrast=\"auto\"> i retransmisje TCP,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"24\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">spadek przepustowo\u015bci<\/span><\/b><span data-contrast=\"auto\"> i anomalia w kszta\u0142cie przep\u0142yw\u00f3w (np. nag\u0142y spadek MSS lub okna TCP).<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">W systemie do analizy ruchu sieciowego mo\u017cna zaobserwowa\u0107 to jako:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"23\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">zmian\u0119 profilu latency dla konkretnego segmentu VLAN,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"23\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">asymetryczne przep\u0142ywy TCP (request i response id\u0105 r\u00f3\u017cnymi \u015bcie\u017ckami),<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"23\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">wzrost liczby niepe\u0142nych sesji TCP (SYN bez ACK).<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Takie objawy nie s\u0105 dowodem samym w sobie, ale w po\u0142\u0105czeniu z duplikatami MAC i wzrostem ruchu ARP wskazuj\u0105 na aktywny atak Man-in-the-Middle.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Wielowarstwowa korelacja anomalii \u2014 spos\u00f3b wykrywania w praktyce<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Zaawansowana detekcja nie opiera si\u0119 na jednym wska\u017aniku, ale na <\/span><b><span data-contrast=\"auto\">modelu wagowym<\/span><\/b><span data-contrast=\"auto\"> \u0142\u0105cz\u0105cym wiele zjawisk. Systemy mog\u0105 stosowa\u0107 logik\u0119 regu\u0142ow\u0105 lub uczenie behawioralne, gdzie ka\u017cde odchylenie zwi\u0119ksza poziom ryzyka:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<div>\n<div class=\"_tableContainer_1rjym_1\">\n<div class=\"group _tableWrapper_1rjym_13 flex w-fit flex-col-reverse\" tabindex=\"-1\">\n<div style=\"overflow-x: auto; margin: 20px 0; font-family: 'DM Sans', sans-serif;\">\n<div style=\"overflow-x: auto; margin: 20px 0; font-family: 'DM Sans', sans-serif;\">\n<table style=\"width: 100%; border-collapse: collapse; border: 1px solid #ddd; font-family: 'DM Sans', sans-serif; font-size: 15px;\">\n<thead>\n<tr style=\"background-color: #f4f6fb; color: #222; text-align: left;\">\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Wska\u017anik<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Opis<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Waga w detekcji<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Duplikat MAC<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Ten sam MAC powi\u0105zany z wieloma IP<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">0.9<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Gratuitous ARP<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Wzrost odpowiedzi bez \u017c\u0105da\u0144<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">0.7<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">MAC Flapping<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Zmiana portu fizycznego dla tego samego MAC<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">0.6<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Asymetria TCP<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Ruch przez nowy w\u0119ze\u0142 po\u015bredni<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">0.5<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Wzrost RTT \/ retransmisje<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Anomalia w przep\u0142ywach<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">0.4<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<p><span data-contrast=\"auto\">Po\u0142\u0105czenie trzech lub wi\u0119cej symptom\u00f3w powy\u017cej progu (np. 2.0) skutkuje automatycznym alarmem o charakterze \u201eARP-based MITM\u201d.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h3><span data-ccp-props=\"{}\">\u00a0<\/span><\/h3>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Studium przypadku \u2014 jak wygl\u0105da atak Man-in-the-Middle w praktyce danych<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">W zebranym przez system pakiecie ARP mo\u017cna zauwa\u017cy\u0107 powtarzaj\u0105ce si\u0119 wpisy:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Frame 124: ARP, Reply 192.168.1.1 is-at aa:bb:cc:dd:ee:ff<\/span><br \/>\n<span data-contrast=\"auto\">Frame 125: ARP, Reply 192.168.1.137 is-at aa:bb:cc:dd:ee:ff<\/span><\/p>\n<p><span data-contrast=\"auto\">Analiza temporalna pokazuje, \u017ce te pakiety pojawiaj\u0105 si\u0119 w odst\u0119pie 5 sekund, przez ca\u0142y czas trwania sesji. R\u00f3wnocze\u015bnie w metadanych NetFlow wida\u0107 nowy host (MAC: aa:bb:cc:dd:ee:ff) uczestnicz\u0105cy w przep\u0142ywach HTTP mi\u0119dzy 192.168.1.137 a zewn\u0119trznym serwerem 93.184.216.34 (example.com).<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">To klasyczny przyk\u0142ad potwierdzonego atak Man-in-the-Middle z wykorzystaniem ARP Spoofing: ruch wci\u0105\u017c dociera do celu, ale ka\u017cdy pakiet przechodzi przez dodatkowy punkt po\u015bredni. System mo\u017ce natychmiast wygenerowa\u0107 alert o wysokim poziomie ryzyka i zarekomendowa\u0107 automatyczn\u0105 izolacj\u0119 portu na prze\u0142\u0105czniku.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Ekspercka interpretacja: co r\u00f3\u017cni analiz\u0119 reaktywn\u0105 od proaktywnej<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">R\u0119czne wykrywanie ataku (np. <\/span><span data-contrast=\"auto\">arp -a<\/span><span data-contrast=\"auto\"> lub por\u00f3wnanie tablic ARP) to metoda reaktywna \u2014 pozwala zidentyfikowa\u0107 problem dopiero wtedy, gdy ju\u017c trwa.<\/span><br \/>\n<span data-contrast=\"auto\"> Systemy klasy NDR, wykorzystuj\u0105ce analiz\u0119 ruchu sieciowego w czasie rzeczywistym, pozwalaj\u0105 na <\/span><b><span data-contrast=\"auto\">proaktywne wykrycie anomalii<\/span><\/b><span data-contrast=\"auto\"> w momencie, gdy proces zatrucia dopiero si\u0119 zaczyna.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">R\u00f3\u017cnic\u0119 mo\u017cna sprowadzi\u0107 do trzech wymiar\u00f3w:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<div class=\"_tableContainer_1rjym_1\">\n<div class=\"group _tableWrapper_1rjym_13 flex w-fit flex-col-reverse\" tabindex=\"-1\">\n<div style=\"overflow-x: auto; margin: 20px 0; font-family: 'DM Sans', sans-serif;\">\n<div style=\"overflow-x: auto; margin: 20px 0; font-family: 'DM Sans', sans-serif;\">\n<table style=\"width: 100%; border-collapse: collapse; border: 1px solid #ddd; font-size: 15px; font-family: 'DM Sans', sans-serif;\">\n<thead>\n<tr style=\"background-color: #f4f6fb; color: #222; text-align: left;\">\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Kryterium<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Analiza r\u0119czna<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Analiza w czasie rzeczywistym<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Zakres<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Wybrane hosty<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Ca\u0142a sie\u0107 (100% ruchu)<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Czas reakcji<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Po fakcie<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">W trakcie trwania ataku<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">\u0179r\u00f3d\u0142o danych<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Tablice ARP<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Pakiety, flowy, logi, telemetria<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Korelacja<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Brak<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Automatyczna, wielowarstwowa<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Rezultat<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Diagnoza<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Detekcja + reakcja (alert, izolacja)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<p><span data-contrast=\"auto\">ARP Spoofing zostawia w danych sieciowych wyra\u017ane \u015blady, ale widoczne tylko wtedy, gdy system patrzy szerzej ni\u017c pojedynczy pakiet. Najbardziej wiarygodne wska\u017aniki to:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"22\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">duplikaty MAC adresowane do r\u00f3\u017cnych IP,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"22\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">wzrost liczby <\/span><i><span data-contrast=\"auto\">gratuitous ARP<\/span><\/i><span data-contrast=\"auto\">,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"22\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">flapping MAC na prze\u0142\u0105cznikach,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"22\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><span data-contrast=\"auto\">anomalia w przep\u0142ywach TCP i zwi\u0119kszona latencja.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Po\u0142\u0105czenie tych symptom\u00f3w w ramach analizy kontekstowej umo\u017cliwia precyzyjne wykrycie ataku Man-in-the-Middle w czasie rzeczywistym. W dalszej cz\u0119\u015bci artyku\u0142u poka\u017cemy, jak wykorzysta\u0107 analiz\u0119 ruchu sieciowego do automatycznego rozpoznawania takich wzorc\u00f3w i natychmiastowego reagowania \u2014 zanim atakuj\u0105cy zd\u0105\u017cy cokolwiek przechwyci\u0107.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<\/div>\n<h2 data-start=\"0\" data-end=\"73\"><\/h2>\n<h2 data-start=\"0\" data-end=\"73\"><span class=\"ez-toc-section\" id=\"Krok_po_kroku_jak_wykorzystac_analize_ruchu_sieciowego_do_wykrycia_anomalii\"><\/span><span class=\"TextRun SCXW71851345 BCX0\" lang=\"PL-PL\" xml:lang=\"PL-PL\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW71851345 BCX0\" data-ccp-parastyle=\"heading 2\">Krok po kroku: jak wykorzysta\u0107 analiz\u0119 ruchu sieciowego do wykrycia anomalii<\/span><\/span><span class=\"EOP SCXW71851345 BCX0\" data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Dlaczego analiza r\u0119czna nie wystarcza<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Komenda <\/span><span data-contrast=\"auto\">arp -a<\/span><span data-contrast=\"auto\"> czy podgl\u0105d cache s\u0105 u\u017cyteczne jedynie post factum. Daj\u0105 migawk\u0119 stanu jednego hosta, nie pokazuj\u0105 dynamiki zmian i nie obejmuj\u0105 ca\u0142ej domeny rozg\u0142oszeniowej. W praktyce:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"21\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">s\u0105 reaktywne, a nie proaktywne<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"21\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">nie skaluj\u0105 si\u0119 na setki VLAN i tysi\u0119cy host\u00f3w<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"21\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">nie tworz\u0105 baseline\u2019u, nie wykrywaj\u0105 odchyle\u0144 w czasie<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Wniosek jest prosty: potrzebny jest system, kt\u00f3ry obserwuje ca\u0142o\u015b\u0107, rozumie normalno\u015b\u0107, wychwytuje odchylenia i automatycznie koreluje sygna\u0142y.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Rola system\u00f3w do analizy ruchu sieciowego klasy NDR<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Dzia\u0142aj\u0105 jako nieinwazyjna warstwa obserwacyjna. G\u0142\u00f3wne za\u0142o\u017cenia:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"20\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Pokrycie<\/span><\/b><span data-contrast=\"auto\">: widoczno\u015b\u0107 ruchu w segmentach krytycznych na poziomie L3-L4<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"20\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Czas rzeczywisty<\/span><\/b><span data-contrast=\"auto\">: przetwarzanie strumieni pakiet\u00f3w i metadanych bez op\u00f3\u017anie\u0144 operacyjnych<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"20\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Baseline<\/span><\/b><span data-contrast=\"auto\">: model normalno\u015bci dla ARP oraz ruchu aplikacyjnego w przekroju host, VLAN, port prze\u0142\u0105cznika, serwis<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"20\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Korelacja<\/span><\/b><span data-contrast=\"auto\">: \u0142\u0105czenie L2 sygna\u0142\u00f3w ARP z L3 i L4 oraz telemetri\u0105 z prze\u0142\u0105cznik\u00f3w<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><strong>\u0179r\u00f3d\u0142a danych, kt\u00f3re warto w\u0142\u0105czy\u0107:\u00a0<\/strong><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"19\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">ruch pakietowy i metadane flow<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"19\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">logi i telemetria prze\u0142\u0105cznik\u00f3w oraz kontroler\u00f3w<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"19\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">DHCP i RADIUS do mapowania IP do to\u017csamo\u015bci<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"19\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><span data-contrast=\"auto\">DNS i atrybuty sesji aplikacyjnych dla kontekstu<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Pipeline detekcji \u2014 od sygna\u0142u do decyzji<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<ol>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"Aptos\" data-listid=\"18\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Ingest i normalizacja<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> Pakiety ARP i ruch L3 s\u0105 dekodowane do wsp\u00f3lnego modelu. Wydzielamy kluczowe atrybuty: Sender IP, Sender MAC, Target IP, opcode, interwa\u0142 czasowy.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ol>\n<ol>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"Aptos\" data-listid=\"18\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Uczenie baseline\u2019u<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> System wyznacza naturaln\u0105 intensywno\u015b\u0107 ARP na segment oraz typowe pary IP do MAC. Tworzy te\u017c map\u0119 topologii i przypisania MAC do port\u00f3w prze\u0142\u0105cznik\u00f3w.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ol>\n<ol>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"Aptos\" data-listid=\"18\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Regu\u0142y sygna\u0142owe L2<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> Uruchamiane s\u0105 lekkie regu\u0142y typu: duplikat MAC, gratuitous ARP bez wcze\u015bniejszego requestu, wysoki odsetek ARP Reply, flapping MAC na porcie.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ol>\n<ol>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"Aptos\" data-listid=\"18\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Korelacja wielowarstwowa<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> Sygna\u0142y L2 s\u0105 zestawiane z anomaliami L3 i L4: asymetria TCP, wzrost RTT, niekompletne sesje, nieznane przep\u0142ywy do nowego po\u015brednika.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ol>\n<ol>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"Aptos\" data-listid=\"18\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"5\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Ocena ryzyka i de-duplikacja<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> Ka\u017cdemu przypadkowi przypisywana jest waga i zaufanie. Zdarzenia s\u0105 \u0142\u0105czone w jeden incydent z timeline\u2019em i \u015bcie\u017ck\u0105 dowodow\u0105.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ol>\n<ol>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"Aptos\" data-listid=\"18\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"6\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Alert i workflow reakcji<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> Alert zawiera kontekst: podejrzany MAC, powi\u0105zane IP, porty, VLAN, wska\u017aniki i pr\u00f3bk\u0119 PCAP lub rekonstrukcj\u0119 zdarze\u0144.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ol>\n<p><span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Jak system wykrywa atak \u2014 regu\u0142y i progi, kt\u00f3re dzia\u0142aj\u0105<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Poni\u017cej przyk\u0142adowe regu\u0142y implementowane w silniku detekcji. Zapis w pseudokodzie, aby \u0142atwo prze\u0142o\u017cy\u0107 je na dowolny system.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"auto\">R1. Duplikat MAC w kr\u00f3tkim oknie<\/span><\/b><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">IF count_distinct(IP) mapped_to(MAC=X) within 30s &gt;= 2<\/span><br \/>\n<span data-contrast=\"auto\">THEN raise indicator &#8222;Duplicate MAC&#8221; severity=high<\/span><br \/>\n<span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"auto\">R2. Gratuitous ARP nienaturalnie cz\u0119ste<\/span><\/b><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">IF ARP.reply_without_request_ratio(segment) &gt; baseline(segment) * 5<\/span><br \/>\n<span data-contrast=\"auto\">AND count(ARP.reply from Host H) within 60s &gt; 30<\/span><br \/>\n<span data-contrast=\"auto\">THEN indicator &#8222;Gratuitous ARP surge&#8221; severity=medium<\/span><br \/>\n<span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"auto\">R3. MAC flapping na prze\u0142\u0105czniku<\/span><\/b><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">IF MAC X observed_on_ports &gt;= 2 within 60s<\/span><br \/>\n<span data-contrast=\"auto\">THEN indicator &#8222;MAC flapping&#8221; severity=medium context=ports<\/span><br \/>\n<span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"auto\">R4. Asymetria i degradacja TCP<\/span><\/b><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">IF RTT(host A -&gt; gateway) increases by &gt; 50% vs 24h baseline<\/span><br \/>\n<span data-contrast=\"auto\">AND retransmissions(A) &gt; baseline(A) * 3<\/span><br \/>\n<span data-contrast=\"auto\">THEN indicator &#8222;Transport degradation&#8221; severity=medium<\/span><br \/>\n<span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"auto\">Regu\u0142a korelacyjna MITM-ARP<\/span><\/b><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">IF R1 AND (R2 OR R3) AND (R4 OR NewFlow(A-&gt;UnknownPeer))<\/span><br \/>\n<span data-contrast=\"auto\">THEN ALERT &#8222;ARP-based Man-in-the-Middle&#8221; severity=critical<\/span><br \/>\n<span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Wizualizacja ataku \u2014 co powinno zobaczy\u0107 NOC i SOC<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Dobry dashboard nie pokazuje samej etykiety alertu. Powinien z\u0142o\u017cy\u0107 incydent w ca\u0142o\u015b\u0107, aby analityk podj\u0105\u0142 decyzj\u0119 w kilka sekund.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"auto\">Przyk\u0142adowy komunikat alertu na widoku zdarzenia:<\/span><\/b><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Wykryto konflikt ARP<\/span><br \/>\n<span data-contrast=\"auto\">Adres MAC [aa:bb:cc:dd:ee:ff] u\u017cywany przez IP [192.168.1.1 \u2014 BRAMA]<\/span><br \/>\n<span data-contrast=\"auto\">oraz IP [192.168.1.137 \u2014 ATAKUJ\u0104CY]<\/span><br \/>\n<span data-contrast=\"auto\">Segment: VLAN 20\u00a0 |\u00a0 Switch: sw-core-01\u00a0 |\u00a0 Porty: Gi1\/0\/5, Gi1\/0\/23<\/span><br \/>\n<span data-contrast=\"auto\">Czas: 2025-10-24 12:01:05\u201312:03:42\u00a0 |\u00a0 Status: Active<\/span><br \/>\n<span data-contrast=\"auto\">Wska\u017aniki: Duplicate MAC, Gratuitous ARP surge, MAC Flapping, RTT\u2191 +72%<\/span><br \/>\n<span data-contrast=\"auto\">Artefakty: PCAP 12 MB, NetFlow 38 wpis\u00f3w, syslog 4 wpisy<\/span><br \/>\n<span data-contrast=\"auto\">Rekomendacje: Od\u0142\u0105cz port Gi1\/0\/23, czyszczenie ARP na gateway, uniewa\u017cnij sesje<\/span><br \/>\n<span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/p>\n<p><strong>Na panelu powinny by\u0107 dost\u0119pne:\u00a0<\/strong><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"17\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">wykres intensywno\u015bci ARP w czasie z zaznaczonym progiem i baseline<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"17\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">mapa IP do MAC z liniami wskazuj\u0105cymi konflikt<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"17\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">kontekst topologii: VLAN, switch, port<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"17\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><span data-contrast=\"auto\">przycisk do wygenerowania zrzutu PCAP i playbook reakcji<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Tabela operacyjna \u2014 sygna\u0142, \u017ar\u00f3d\u0142o, logika, pr\u00f3g, zaufanie<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<div class=\"_tableContainer_1rjym_1\">\n<div class=\"group _tableWrapper_1rjym_13 flex w-fit flex-col-reverse\" tabindex=\"-1\">\n<div style=\"overflow-x: auto; margin: 20px 0; font-family: 'DM Sans', sans-serif;\">\n<div style=\"overflow-x: auto; margin: 20px 0; font-family: 'DM Sans', sans-serif;\">\n<table style=\"width: 100%; border-collapse: collapse; border: 1px solid #ddd; font-size: 15px; font-family: 'DM Sans', sans-serif;\">\n<thead>\n<tr style=\"background-color: #f4f6fb; color: #222; text-align: left;\">\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Sygna\u0142<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">\u0179r\u00f3d\u0142o<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Logika detekcji<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Przyk\u0142adowy pr\u00f3g<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Zaufanie<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Duplikat MAC<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Pakiety ARP<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Ten sam MAC przypisany do \u2265 2 IP w 30 s<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">2 IP w 30 s<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Bardzo wysokie<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Gratuitous ARP surge<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Pakiety ARP<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Reply bez Request przekracza baseline<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">5 razy baseline<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Wysokie<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">MAC flapping<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Syslog, SNMP, telemetry<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">MAC widoczny na wielu portach w kr\u00f3tkim oknie<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">2 porty w 60 s<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">\u015arednie\u2013wysokie<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Asymetria i degradacja TCP<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Flow, metryki transportowe<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">RTT i retransmisje powy\u017cej baseline<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">RTT +50%, REXMIT x3<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">\u015arednie<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">Nowy po\u015brednik w \u015bcie\u017cce<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Flow, tracer, topologia<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Pojawia si\u0119 nowy w\u0119ze\u0142 w \u015bcie\u017cce A\u2194gateway<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">1 nowy hop<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Wysokie<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Dlaczego monitoring sieci to jedyna skuteczna metoda w czasie rzeczywistym<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Atak oparty na ARP Spoofing wykorzystuje fundamentaln\u0105 ufno\u015b\u0107 protoko\u0142u. Nie zobaczysz go w logach aplikacji, nie z\u0142apiesz go filtrem na brzegu, a endpoint nie zawsze zareaguje. Tylko sta\u0142y monitoring sieci z pe\u0142nym pokryciem i korelacj\u0105 wielowarstwow\u0105:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"16\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">wykrywa odchylenia natychmiast, zanim dojdzie do kradzie\u017cy danych<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"16\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">dostarcza artefakty dowodowe do forensics<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"16\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">umo\u017cliwia automatyczn\u0105 reakcj\u0119 na poziomie portu i VLAN<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Praktyczna miara skuteczno\u015bci to:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"15\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">TTD<\/span><\/b><span data-contrast=\"auto\"> czas do wykrycia poni\u017cej jednej minuty<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"15\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">MTTR<\/span><\/b><span data-contrast=\"auto\"> czas do przywr\u00f3cenia \u0142\u0105czno\u015bci i czystych tablic ARP poni\u017cej pi\u0119tnastu minut<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"15\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">FPR<\/span><\/b><span data-contrast=\"auto\"> niski odsetek fa\u0142szywych alarm\u00f3w dzi\u0119ki korelacji sygna\u0142\u00f3w<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-ccp-props=\"{&quot;335559739&quot;:0}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Od detekcji do reakcji \u2014 logika operacyjna SOC\/NDR<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Wykrycie anomalii to dopiero po\u0142owa sukcesu. Warto\u015b\u0107 systemu klasy NDR ujawnia si\u0119 w <\/span><b><span data-contrast=\"auto\">zintegrowanym cyklu reagowania<\/span><\/b><span data-contrast=\"auto\">: od identyfikacji po pe\u0142ne wyeliminowanie zagro\u017cenia z sieci. Tu w\u0142a\u015bnie wchodzi w gr\u0119 playbook \u2013 predefiniowany zestaw dzia\u0142a\u0144, kt\u00f3re SOC lub NOC mo\u017ce wykona\u0107 natychmiast po potwierdzeniu ataku Man-in-the-Middle.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Celem nie jest tylko \u201ezgasi\u0107 po\u017car\u201d, ale <\/span><b><span data-contrast=\"auto\">odtworzy\u0107 pierwotny stan sieci, zebra\u0107 dowody i zabezpieczy\u0107 \u015brodowisko przed rekurencj\u0105 incydentu<\/span><\/b><span data-contrast=\"auto\">. System NDR mo\u017ce automatycznie przekaza\u0107 kontekst do narz\u0119dzi SIEM\/SOAR, kt\u00f3re uruchomi\u0105 ten proces zgodnie z ustalonym scenariuszem.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Playbook powinien \u0142\u0105czy\u0107 trzy elementy:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ol>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"Aptos\" data-listid=\"13\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Szybk\u0105 izolacj\u0119 \u017ar\u00f3d\u0142a<\/span><\/b><span data-contrast=\"auto\">, aby powstrzyma\u0107 atak w czasie rzeczywistym,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ol>\n<ol>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"Aptos\" data-listid=\"13\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Rekonstrukcj\u0119 topologii i czyszczenie wpis\u00f3w ARP<\/span><\/b><span data-contrast=\"auto\">, aby przywr\u00f3ci\u0107 poprawn\u0105 komunikacj\u0119,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ol>\n<ol>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"Aptos\" data-listid=\"13\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Zabezpieczenie \u015blad\u00f3w i wdro\u017cenie \u015brodk\u00f3w trwa\u0142ych<\/span><\/b><span data-contrast=\"auto\">, kt\u00f3re uniemo\u017cliwi\u0105 powt\u00f3rzenie ataku.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ol>\n<p><span data-contrast=\"auto\">Poni\u017cej przedstawiono minimalny, a jednocze\u015bnie kompletny zestaw krok\u00f3w operacyjnych.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Minimalny playbook w systemie NDR<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<div class=\"_tableContainer_1rjym_1\">\n<div class=\"group _tableWrapper_1rjym_13 flex w-fit flex-col-reverse\" tabindex=\"-1\">\n<div style=\"overflow-x: auto; margin: 20px 0; font-family: 'DM Sans', sans-serif;\">\n<div style=\"overflow-x: auto; margin: 20px 0; font-family: 'DM Sans', sans-serif;\">\n<table style=\"width: 100%; border-collapse: collapse; border: 1px solid #ddd; font-size: 15px; font-family: 'DM Sans', sans-serif;\">\n<thead>\n<tr style=\"background-color: #f4f6fb; color: #222; text-align: left;\">\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Etap<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Dzia\u0142anie<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Cel operacyjny<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Narz\u0119dzie \/ odpowiedzialno\u015b\u0107<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">1. Detekcja<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Wykrycie alertu \u201eARP-based MITM\u201d przez analiz\u0119 ruchu sieciowego<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Potwierdzenie anomalii i identyfikacja \u017ar\u00f3d\u0142a<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">System NDR<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">2. Weryfikacja<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Korelacja wska\u017anik\u00f3w (duplikat MAC, gratuitous ARP, asymetria TCP)<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Wykluczenie fa\u0142szywego alarmu<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Analityk SOC<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">3. Izolacja<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Od\u0142\u0105czenie portu lub VLAN podejrzanego hosta<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Natychmiastowe zatrzymanie ataku<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">NOC \/ Switch CLI \/ API SOAR<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">4. Odtworzenie stanu<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Czyszczenie cache ARP (arp -d *) na bramach i hostach<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Przywr\u00f3cenie poprawnych mapowa\u0144<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Administrator sieci<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">5. Analiza dowodowa<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Eksport PCAP, NetFlow, log\u00f3w ARP i syslog<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Potwierdzenie mechanizmu i wektora<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">SOC \/ Forensics<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">6. Uniewa\u017cnienie sesji<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Wymuszenie ponownego logowania i reset token\u00f3w<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Zablokowanie potencjalnych sesji przej\u0119tych<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Zesp\u00f3\u0142 bezpiecze\u0144stwa aplikacji<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">7. Remediacja trwa\u0142a<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Aktywacja DAI, port security, progi ARP<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Zabezpieczenie przed powt\u00f3rzeniem incydentu<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Architekt sieciowy<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">8. Dokumentacja i raport<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Wpis do rejestru incydent\u00f3w, aktualizacja regu\u0142 detekcji<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Uczenie systemu na przysz\u0142o\u015b\u0107<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">SOC Lead \/ CISO<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<p data-start=\"8503\" data-end=\"9006\" data-is-last-node=\"\" data-is-only-node=\"\"><span class=\"TextRun SCXW99142359 BCX0\" lang=\"PL-PL\" xml:lang=\"PL-PL\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW99142359 BCX0\">W idealnym scenariuszu system wykrywa <\/span><span class=\"NormalTextRun ContextualSpellingAndGrammarErrorV2Themed SCXW99142359 BCX0\">ataku\u00a0 Man<\/span><span class=\"NormalTextRun SCXW99142359 BCX0\">-in-the-Middle w czasie kr\u00f3tszym ni\u017c 60 sekund (TTD), a pe\u0142ne przywr\u00f3cenie poprawnego stanu sieci (MTTR) zajmuje nie wi\u0119cej ni\u017c kwadrans.<\/span> <span class=\"NormalTextRun SCXW99142359 BCX0\">Kluczem jest nie tylko precyzyjna analiza ruchu sieciowego, ale tak\u017ce <\/span><\/span><span class=\"TextRun SCXW99142359 BCX0\" lang=\"PL-PL\" xml:lang=\"PL-PL\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW99142359 BCX0\">automatyzacja decyzji operacyjnych<\/span><\/span><span class=\"TextRun SCXW99142359 BCX0\" lang=\"PL-PL\" xml:lang=\"PL-PL\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW99142359 BCX0\">.<\/span> <span class=\"NormalTextRun SCXW99142359 BCX0\">Dzi\u0119ki gotowym <\/span><span class=\"NormalTextRun SpellingErrorV2Themed SCXW99142359 BCX0\">playbookom<\/span><span class=\"NormalTextRun SCXW99142359 BCX0\"> i integracji z infrastruktur\u0105 prze\u0142\u0105cznik\u00f3w, <\/span><span class=\"NormalTextRun SpellingErrorV2Themed SCXW99142359 BCX0\">systemy NDR<\/span><span class=\"NormalTextRun SCXW99142359 BCX0\"> mog\u0105 dzia\u0142a\u0107 nie jak pasywny obserwator, ale jak aktywny element obrony \u2014 reaguj\u0105cy, zanim u\u017cytkownik zauwa\u017cy, \u017ce co\u015b jest nie tak.<\/span><\/span><span class=\"EOP SCXW99142359 BCX0\" data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h2 data-start=\"0\" data-end=\"60\"><\/h2>\n<h2 data-start=\"0\" data-end=\"60\"><span class=\"ez-toc-section\" id=\"Prewencja_i_reagowanie_najlepsze_praktyki_w_zakresie_bezpieczenstwa_sieci_LAN\"><\/span><span class=\"TextRun SCXW367038 BCX0\" lang=\"PL-PL\" xml:lang=\"PL-PL\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW367038 BCX0\" data-ccp-parastyle=\"heading 2\">Prewencja i reagowanie: najlepsze praktyki w zakresie bezpiecze\u0144stwa sieci LAN<\/span><\/span><span class=\"EOP SCXW367038 BCX0\" data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p><span data-contrast=\"auto\">Ataki typu ARP Spoofing s\u0105 trudne do ca\u0142kowitego wyeliminowania, poniewa\u017c wykorzystuj\u0105 zaufany i fundamentalny protok\u00f3\u0142 warstwy 2.<\/span><br \/>\n<span data-contrast=\"auto\"> Z tego powodu skuteczna strategia ochrony musi obejmowa\u0107 <\/span><b><span data-contrast=\"auto\">trzy komplementarne filary<\/span><\/b><span data-contrast=\"auto\">:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ol>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"Aptos\" data-listid=\"12\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Metody pasywne<\/span><\/b><span data-contrast=\"auto\"> \u2013 zabezpieczaj\u0105ce dane nawet w przypadku przechwycenia ruchu.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ol>\n<ol>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"Aptos\" data-listid=\"12\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Metody aktywne<\/span><\/b><span data-contrast=\"auto\"> \u2013 utrudniaj\u0105ce lub blokuj\u0105ce sam mechanizm ataku.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ol>\n<ol>\n<li aria-setsize=\"-1\" data-leveltext=\"%1.\" data-font=\"Aptos\" data-listid=\"12\" data-list-defn-props=\"{&quot;335552541&quot;:0,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769242&quot;:[65533,0],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;%1.&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Metody proaktywne<\/span><\/b><span data-contrast=\"auto\"> \u2013 zapewniaj\u0105ce wykrycie i reakcj\u0119 w czasie rzeczywistym.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ol>\n<p><span data-contrast=\"auto\">Tylko synergia tych podej\u015b\u0107 buduje odporno\u015b\u0107 sieci LAN, redukuj\u0105c ryzyko zar\u00f3wno pods\u0142uchu, jak i sabota\u017cu komunikacji.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Metody pasywne \u2014 ochrona danych przed odczytem<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Pasywna warstwa zabezpiecze\u0144 nie zatrzymuje samego ataku, ale <\/span><b><span data-contrast=\"auto\">eliminuje skutki kompromitacji poufno\u015bci danych<\/span><\/b><span data-contrast=\"auto\">. W praktyce oznacza to, \u017ce nawet je\u015bli atakuj\u0105cy przechwyci ruch, nie b\u0119dzie w stanie niczego odczyta\u0107.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"auto\">Szyfrowanie ponad wszystko<\/span><\/b><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"11\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">HTTPS \/ TLS 1.3<\/span><\/b><span data-contrast=\"auto\"> \u2013 pe\u0142ne szyfrowanie sesji HTTP minimalizuje ryzyko wycieku hase\u0142, token\u00f3w i ciasteczek.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"11\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">SSH \/ SFTP<\/span><\/b><span data-contrast=\"auto\"> \u2013 ka\u017cda administracyjna komunikacja w sieci (CLI, transfer plik\u00f3w) powinna by\u0107 tunelowana w szyfrowanym kanale.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"11\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">VPN (IPsec \/ SSL)<\/span><\/b><span data-contrast=\"auto\"> \u2013 zapewnia poufno\u015b\u0107 i integralno\u015b\u0107 ruchu mi\u0119dzy segmentami LAN i zdalnymi u\u017cytkownikami.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"11\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">DNS over HTTPS \/ DNS over TLS<\/span><\/b><span data-contrast=\"auto\"> \u2013 ukrywa zapytania DNS, kt\u00f3re cz\u0119sto s\u0105 pierwszym celem atakuj\u0105cego MITM.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Ekspercka praktyka:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"10\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">Wymuszaj protoko\u0142y szyfrowane w konfiguracji aplikacji i urz\u0105dze\u0144 sieciowych.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"10\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">U\u017cywaj certyfikat\u00f3w organizacyjnych (CA) i mechanizmu HSTS, aby unikn\u0105\u0107 downgrade\u2019\u00f3w.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"10\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">Regularnie testuj konfiguracje SSL\/TLS (np. narz\u0119dziem testssl.sh) pod k\u0105tem podatno\u015bci.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Metody aktywne \u2014 blokowanie wektora ataku<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Tu celem nie jest ochrona tre\u015bci, lecz <\/span><b><span data-contrast=\"auto\">uniemo\u017cliwienie atakuj\u0105cemu wstawienia si\u0119 w \u015bcie\u017ck\u0119 komunikacji<\/span><\/b><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p aria-level=\"4\"><b><i><span data-contrast=\"none\">Statyczne tablice ARP<\/span><\/i><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:319,&quot;335559739&quot;:319}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">To najbardziej bezpo\u015bredni spos\u00f3b zabezpieczenia sieci: administrator przypisuje r\u0119cznie sta\u0142e powi\u0105zania IP\u2194MAC dla krytycznych host\u00f3w (serwer\u00f3w, bram, kontroler\u00f3w).<\/span><br \/>\n<span data-contrast=\"auto\"> W efekcie wpis\u00f3w nie da si\u0119 nadpisa\u0107 fa\u0142szywymi odpowiedziami ARP.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Zalety:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"9\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">Odporno\u015b\u0107 na ARP poisoning w zakresie ustalonych par IP\/MAC.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"9\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">Pewno\u015b\u0107 mapowania kluczowych urz\u0105dze\u0144 (gateway, DHCP, DNS, serwery krytyczne).<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">Ograniczenia:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"8\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Brak skalowalno\u015bci<\/span><\/b><span data-contrast=\"auto\"> \u2013 utrzymanie tysi\u0119cy statycznych wpis\u00f3w jest nierealne w dynamicznych \u015brodowiskach.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"8\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Brak elastyczno\u015bci<\/span><\/b><span data-contrast=\"auto\"> \u2013 zmiana urz\u0105dzenia wymaga r\u0119cznej aktualizacji konfiguracji.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"8\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><b><span data-contrast=\"auto\">Potencjalne b\u0142\u0119dy administracyjne<\/span><\/b><span data-contrast=\"auto\"> \u2013 b\u0142\u0119dny wpis = przerwa w \u0142\u0105czno\u015bci.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">W praktyce statyczne tablice ARP sprawdzaj\u0105 si\u0119 w segmentach infrastrukturalnych i \u015brodowiskach zamkni\u0119tych (np. OT, serwerownie, systemy SCADA).<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p aria-level=\"4\"><b><i><span data-contrast=\"none\">Dynamic ARP Inspection (DAI) i Port Security<\/span><\/i><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:319,&quot;335559739&quot;:319}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Zaawansowane prze\u0142\u0105czniki sieciowe klasy enterprise (Cisco, Juniper, Extreme, HP, itp.) oferuj\u0105 natywne funkcje chroni\u0105ce przed zatruciem ARP.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"auto\">Dynamic ARP Inspection (DAI)<\/span><\/b><br \/>\n<span data-contrast=\"auto\"> To mechanizm, kt\u00f3ry analizuje ka\u017cde \u017c\u0105danie i odpowied\u017a ARP w locie, por\u00f3wnuj\u0105c je z wiarygodnymi \u017ar\u00f3d\u0142ami \u2014 np. tabel\u0105 DHCP snooping.<\/span><br \/>\n<span data-contrast=\"auto\"> Je\u017celi wpis IP\u2194MAC nie jest zgodny z tym, co wynika z serwera DHCP, pakiet zostaje odrzucony.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Zalety:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"7\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">Chroni przed spoofingiem nawet w du\u017cych, dynamicznych sieciach.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"7\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">Integruje si\u0119 z mechanizmami uwierzytelniania (802.1X).<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"7\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">Wspiera logowanie i alertowanie na poziomie prze\u0142\u0105cznika.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><b><span data-contrast=\"auto\">Port Security<\/span><\/b><br \/>\n<span data-contrast=\"auto\">Ogranicza liczb\u0119 adres\u00f3w MAC, kt\u00f3re mog\u0105 si\u0119 pojawi\u0107 na danym porcie. Je\u017celi zostanie wykryty nowy MAC, port mo\u017ce zosta\u0107 automatycznie wy\u0142\u0105czony lub przeniesiony w stan ochrony (shutdown \/ restrict).<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">To skuteczny spos\u00f3b blokowania pr\u00f3b podszywania si\u0119 pod inne urz\u0105dzenia w czasie rzeczywistym \u2014 szczeg\u00f3lnie w sieciach biurowych i \u015brodowiskach BYOD.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Metody proaktywne \u2014 wykrywanie i reagowanie<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">W praktyce nawet najbardziej restrykcyjne konfiguracje nie zapewni\u0105 pe\u0142nej szczelno\u015bci. Nowe urz\u0105dzenia, segmenty, b\u0142\u0119dne konfiguracje czy awarie DHCP tworz\u0105 luki, kt\u00f3re mog\u0105 zosta\u0107 wykorzystane. Dlatego <\/span><b><span data-contrast=\"auto\">ci\u0105g\u0142y monitoring sieci i analiza ruchu sieciowego<\/span><\/b><span data-contrast=\"auto\"> staj\u0105 si\u0119 ostateczn\u0105 warstw\u0105 bezpiecze\u0144stwa \u2014 siatk\u0105, kt\u00f3ra wykryje ka\u017cdy atak, gdy tylko si\u0119 zaczyna.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Systemy klasy NDR:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"6\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">obserwuj\u0105 ruch ARP w ca\u0142ej domenie rozg\u0142oszeniowej,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"6\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">identyfikuj\u0105 anomalie w czasie rzeczywistym (duplikaty MAC, gratuitous ARP, flapping),<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"6\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">koreluj\u0105 dane z warstw transportowych i aplikacyjnych,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"6\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"4\" data-aria-level=\"1\"><span data-contrast=\"auto\">wizualizuj\u0105 konflikt IP\u2194MAC z precyzj\u0105 co do portu i urz\u0105dzenia,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"6\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"5\" data-aria-level=\"1\"><span data-contrast=\"auto\">automatyzuj\u0105 reakcj\u0119 \u2014 np. odci\u0119cie portu lub powiadomienie SIEM\/SOAR.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-contrast=\"auto\">W dynamicznych \u015brodowiskach chmurowych i wirtualnych to jedyny spos\u00f3b na skuteczne wykrywanie pr\u00f3b zatrucia ARP, zanim dojdzie do przej\u0119cia sesji lub kradzie\u017cy danych.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Po wykryciu incydentu \u2014 schemat reakcji SOC\/NOC<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Bez wzgl\u0119du na \u017ar\u00f3d\u0142o alertu (system NDR, prze\u0142\u0105cznik, SIEM), reakcja powinna przebiega\u0107 wed\u0142ug standardowego playbooka.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<div class=\"_tableContainer_1rjym_1\">\n<div class=\"group _tableWrapper_1rjym_13 flex w-fit flex-col-reverse\" tabindex=\"-1\">\n<div style=\"overflow-x: auto; margin: 20px 0; font-family: 'DM Sans', sans-serif;\">\n<div style=\"overflow-x: auto; margin: 20px 0; font-family: 'DM Sans', sans-serif;\">\n<table style=\"width: 100%; border-collapse: collapse; border: 1px solid #ddd; font-size: 15px; font-family: 'DM Sans', sans-serif;\">\n<thead>\n<tr style=\"background-color: #f4f6fb; color: #222; text-align: left;\">\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Krok<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Dzia\u0142anie<\/th>\n<th style=\"padding: 12px; border: 1px solid #ddd;\">Cel operacyjny<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">1<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Identyfikacja \u017ar\u00f3d\u0142a \u2013 potwierd\u017a adres MAC i IP atakuj\u0105cego w logach<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Okre\u015blenie wektora i zakresu ataku<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">2<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Izolacja hosta \u2013 od\u0142\u0105cz port na prze\u0142\u0105czniku lub przenie\u015b urz\u0105dzenie do VLAN kwarantanny<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Zatrzymanie ataku w czasie rzeczywistym<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">3<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Odtworzenie tablic ARP \u2013 czyszczenie cache (arp -d *) na bramach i hostach<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Przywr\u00f3cenie poprawnego routingu<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">4<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Uniewa\u017cnienie sesji \u2013 wymu\u015b ponowne logowanie, zresetuj tokeny<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Eliminacja ryzyka przej\u0119cia konta<\/td>\n<\/tr>\n<tr>\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">5<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Analiza forensyczna \u2013 eksport PCAP, NetFlow, syslog, identyfikacja \u015blad\u00f3w<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Zabezpieczenie dowod\u00f3w i \u017ar\u00f3d\u0142a<\/td>\n<\/tr>\n<tr style=\"background-color: #fafbff;\">\n<td style=\"padding: 12px; border: 1px solid #ddd; font-weight: bold; color: #1769ff;\">6<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Wzmocnienie ochrony \u2013 aktywacja DAI, port security, regu\u0142 NDR<\/td>\n<td style=\"padding: 12px; border: 1px solid #ddd;\">Zapobieganie ponownemu wyst\u0105pieniu incydentu<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<p><span data-contrast=\"auto\">W \u015brodowisku obj\u0119tym monitoringiem sieci czas reakcji (MTTR) powinien wynosi\u0107 <\/span><b><span data-contrast=\"auto\">kilka minut<\/span><\/b><span data-contrast=\"auto\">, a TTD (Time To Detect) \u2013 <\/span><b><span data-contrast=\"auto\">poni\u017cej minuty<\/span><\/b><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Komplementarno\u015b\u0107 prewencji i detekcji<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Warto podkre\u015bli\u0107: nie istnieje pojedynczy mechanizm, kt\u00f3ry zapewni pe\u0142ne bezpiecze\u0144stwo sieci LAN.<\/span><br \/>\n<span data-contrast=\"auto\"> Statyczne ARP i DAI ograniczaj\u0105 powierzchni\u0119 ataku, ale nie gwarantuj\u0105 wykrycia. Z kolei systemy NDR oparte na [analiza ruchu sieciowego] nie blokuj\u0105 pakiet\u00f3w, ale informuj\u0105 o ka\u017cdym odchyleniu od normy.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Tylko po\u0142\u0105czenie:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"5\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">szyfrowania (pasywna ochrona danych),<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"5\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">twardych zasad sieciowych (DAI, port security),<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"5\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">i <\/span><b><span data-contrast=\"auto\">ci\u0105g\u0142ego monitoringu ruchu<\/span><\/b><span data-contrast=\"auto\"> (detekcja anomalii),<\/span><br \/>\n<span data-contrast=\"auto\"> tworzy pe\u0142ny model odporno\u015bci.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<h2 data-start=\"174\" data-end=\"208\"><\/h2>\n<h2 data-start=\"174\" data-end=\"208\"><span class=\"ez-toc-section\" id=\"Wnioski_i_dobre_praktyki\"><\/span><span class=\"TextRun SCXW40004042 BCX0\" lang=\"PL-PL\" xml:lang=\"PL-PL\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW40004042 BCX0\" data-ccp-parastyle=\"heading 2\">Wnioski i dobre praktyki<\/span><\/span><span class=\"EOP SCXW40004042 BCX0\" data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:299,&quot;335559739&quot;:299}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">ARP nie jest przestarza\u0142y \u2013 ale wci\u0105\u017c niebezpiecznie ufny<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Protok\u00f3\u0142 ARP to filar komunikacji w sieciach lokalnych, jednak jego konstrukcja nie przewiduje \u017cadnej weryfikacji autentyczno\u015bci komunikat\u00f3w. To czyni go idealnym celem dla atakuj\u0105cych: w \u015brodowisku bez kontroli i korelacji nawet pojedynczy host mo\u017ce zainfekowa\u0107 tablice dziesi\u0105tek urz\u0105dze\u0144 w kilka sekund. Dlatego kluczow\u0105 zasad\u0105 nowoczesnych sieci LAN powinno by\u0107 <\/span><b><span data-contrast=\"auto\">\u201ezaufanie oparte na dowodach\u201d, a nie na mechanizmach protoko\u0142\u00f3w sprzed 40 lat\u201d<\/span><\/b><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Detekcja na warstwie 2 jest tak samo wa\u017cna jak monitoring aplikacyjny<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Wielu administrator\u00f3w koncentruje si\u0119 na firewallach, SIEM-ach i systemach EDR, ignoruj\u0105c warstw\u0119 L2 \u2013 tam, gdzie zaczyna si\u0119 wi\u0119kszo\u015b\u0107 atak\u00f3w wewn\u0119trznych.<\/span><br \/>\n<span data-contrast=\"auto\">ARP Spoofing nie zostawia \u015blad\u00f3w w logach serwerowych ani aplikacyjnych \u2013 jego obecno\u015b\u0107 mo\u017cna wykry\u0107 wy\u0142\u0105cznie przez <\/span><b><span data-contrast=\"auto\">ci\u0105g\u0142\u0105 analiz\u0119 ruchu sieciowego<\/span><\/b><span data-contrast=\"auto\">. Dlatego strategiczn\u0105 zasad\u0105 bezpiecze\u0144stwa powinno by\u0107: \u201eNie mo\u017cesz zabezpieczy\u0107 tego, czego nie widzisz\u201d.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Wczesna detekcja jest ta\u0144sza ni\u017c reakcja<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Koszt reakcji na skuteczny atak Man-in-the-Middle ro\u015bnie wyk\u0142adniczo z ka\u017cd\u0105 minut\u0105.<\/span><br \/>\n<span data-contrast=\"auto\">Im szybciej system wykryje duplikaty MAC lub nietypowe gratuitous ARP, tym mniejszy wp\u0142yw na u\u017cytkownik\u00f3w i dane. W praktyce ka\u017cda minuta op\u00f3\u017anienia to:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">ryzyko utraty po\u015bwiadcze\u0144,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">przej\u0119cie sesji,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"3\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">degradacja dzia\u0142ania kluczowych us\u0142ug.<\/span><br \/>\n<span data-contrast=\"auto\"> Z tego wzgl\u0119du <\/span><b><span data-contrast=\"auto\">real-time monitoring<\/span><\/b><span data-contrast=\"auto\"> nie jest luksusem, lecz konieczno\u015bci\u0105 \u2014 zw\u0142aszcza w \u015brodowiskach o du\u017cej dynamice adresacji (DHCP, IoT, BYOD).<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Prewencja techniczna ma sens tylko w po\u0142\u0105czeniu z widoczno\u015bci\u0105<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Statyczne tablice ARP, DAI czy port security potrafi\u0105 skutecznie zablokowa\u0107 pojedynczy wektor, ale \u017caden z tych mechanizm\u00f3w nie dzia\u0142a w pr\u00f3\u017cni. Ich warto\u015b\u0107 ro\u015bnie dopiero wtedy, gdy s\u0105 <\/span><b><span data-contrast=\"auto\">powi\u0105zane z kontekstem behawioralnym<\/span><\/b><span data-contrast=\"auto\">: kto, kiedy, gdzie i jak d\u0142ugo generuje ruch ARP. Dlatego najlepsze \u015brodowiska bezpiecze\u0144stwa \u0142\u0105cz\u0105 mechanizmy zapobiegawcze (konfiguracja sieci) z ci\u0105g\u0142\u0105 obserwacj\u0105 i uczeniem si\u0119 wzorc\u00f3w zachowania urz\u0105dze\u0144.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">\u201eZero Trust\u201d zaczyna si\u0119 w LAN<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Model \u201eZero Trust\u201d nie dotyczy tylko aplikacji i u\u017cytkownik\u00f3w \u2013 jego implementacja powinna zaczyna\u0107 si\u0119 od samego do\u0142u stosu sieciowego. Ka\u017cde urz\u0105dzenie w LAN powinno by\u0107 weryfikowane, profilowane i monitorowane.<\/span><br \/>\n<span data-contrast=\"auto\"> W praktyce oznacza to:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">obserwacj\u0119 wszystkich komunikat\u00f3w ARP, DHCP, DNS, ICMP,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">automatyczne wykrywanie nowych adres\u00f3w MAC i ich historii,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"2\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">budowanie relacji zaufania na podstawie danych telemetrycznych, a nie domy\u015blnych regu\u0142.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Automatyzacja reakcji to kolejny krok ewolucji<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Systemy klasy NDR nie tylko pokazuj\u0105 anomalie \u2013 potrafi\u0105 dzia\u0142a\u0107. Po\u0142\u0105czenie z SIEM i SOAR pozwala automatycznie odci\u0105\u0107 hosta, wyczy\u015bci\u0107 tablice ARP, a nawet zmieni\u0107 konfiguracj\u0119 prze\u0142\u0105cznika. To kierunek, w kt\u00f3rym zmierza bezpiecze\u0144stwo sieci: <\/span><b><span data-contrast=\"auto\">od obserwacji do autonomicznej reakcji<\/span><\/b><span data-contrast=\"auto\">, skracaj\u0105cej MTTR z godzin do minut.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Edukacja administrator\u00f3w i u\u017cytkownik\u00f3w nadal ma znaczenie<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Nawet najlepszy monitoring nie zast\u0105pi \u015bwiadomo\u015bci. Administratorzy powinni regularnie analizowa\u0107 alerty zwi\u0105zane z ARP i rozumie\u0107 ich kontekst, a u\u017cytkownicy \u2013 zna\u0107 objawy potencjalnego MITM (ostrze\u017cenia o certyfikatach, nag\u0142e roz\u0142\u0105czenia VPN).<\/span><br \/>\n<span data-contrast=\"auto\">Najlepsze organizacje \u0142\u0105cz\u0105 technologi\u0119 z procesem: szkolenia, playbooki i automatyzacj\u0119 reakcji w jeden sp\u00f3jny ekosystem obrony.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Warto\u015b\u0107 monitoringu nie ko\u0144czy si\u0119 na bezpiecze\u0144stwie<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Analiza ruchu sieciowego w kontek\u015bcie bezpiecze\u0144stwa sieci LAN ma dodatkow\u0105 warto\u015b\u0107:<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"auto\">poprawia wydajno\u015b\u0107 infrastruktury (wczesne wykrycie kolizji i anomalii),<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"2\" data-aria-level=\"1\"><span data-contrast=\"auto\">umo\u017cliwia optymalizacj\u0119 trasowania i segmentacji VLAN,<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:[8226],&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"3\" data-aria-level=\"1\"><span data-contrast=\"auto\">wspiera zgodno\u015b\u0107 z regulacjami (RODO, ISO 27001, NIS2).<\/span><br \/>\n<span data-contrast=\"auto\"> W praktyce to <\/span><b><span data-contrast=\"auto\">inwestycja w stabilno\u015b\u0107 ca\u0142ego ekosystemu IT<\/span><\/b><span data-contrast=\"auto\">, nie tylko w bezpiecze\u0144stwo.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/li>\n<\/ul>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Najwi\u0119kszym b\u0142\u0119dem jest zak\u0142adanie, \u017ce \u201enas to nie dotyczy\u201d<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">ARP Spoofing to nie atak laboratoryjny \u2013 to realny, codzienny problem w sieciach korporacyjnych, biurowych i przemys\u0142owych. Zdarza si\u0119 nawet w \u015brodowiskach wirtualnych i chmurowych, gdzie maszyny wsp\u00f3\u0142dziel\u0105 interfejsy logiczne.<\/span><br \/>\n<span data-contrast=\"auto\">Dlatego zamiast pyta\u0107 <\/span><i><span data-contrast=\"auto\">czy<\/span><\/i><span data-contrast=\"auto\">, nale\u017cy pyta\u0107 <\/span><i><span data-contrast=\"auto\">kiedy<\/span><\/i><span data-contrast=\"auto\"> i <\/span><i><span data-contrast=\"auto\">jak szybko to wykryjemy<\/span><\/i><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><b><span data-contrast=\"none\">Kluczowy wniosek: widoczno\u015b\u0107 to nowa granica bezpiecze\u0144stwa<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:281,&quot;335559739&quot;:281}\">\u00a0<\/span><\/h3>\n<p><span data-contrast=\"auto\">Ataki ewoluuj\u0105, ale mechanizmy sieciowe pozostaj\u0105 te same. Odpowiedzi\u0105 nie jest wymiana protoko\u0142\u00f3w, lecz ich <\/span><b><span data-contrast=\"auto\">inteligentna obserwacja i analiza<\/span><\/b><span data-contrast=\"auto\">. Organizacje, kt\u00f3re inwestuj\u0105 w ci\u0105g\u0142y monitoring sieci i systemy pokroju Sycope, zyskuj\u0105 nie tylko odporno\u015b\u0107 na ataki Man-in-the-Middle, ale te\u017c pe\u0142n\u0105 \u015bwiadomo\u015b\u0107 tego, co naprawd\u0119 dzieje si\u0119 w ich sieci.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"auto\">Bo bezpiecze\u0144stwo nie polega dzi\u015b na budowaniu mur\u00f3w \u2013 polega na tym, \u017ceby <\/span><b><span data-contrast=\"auto\">widzie\u0107 ka\u017cdy ruch zanim zrobi to kto\u015b inny<\/span><\/b><span data-contrast=\"auto\">.<\/span><span data-ccp-props=\"{&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Co warto wiedzie\u0107 od razu ARP spoofing to atak w sieci lokalnej, w kt\u00f3rym napastnik podszywa si\u0119 pod inne urz\u0105dzenie, wysy\u0142aj\u0105c fa\u0142szywe komunikaty ARP, aby przej\u0105\u0107 ruch sieciowy mi\u0119dzy u\u017cytkownikiem a np. bram\u0105 sieciow\u0105. Pozwala to na pods\u0142uchiwanie, modyfikacj\u0119 lub blokowanie przesy\u0142anych danych. Technika ta jest cz\u0119sto wykorzystywana w atakach typu Man-in-the-Middle w sieciach LAN. [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":1397,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[99],"tags":[206,207,205,128],"product":[165,166],"topic":[167],"sycope_author":[251],"class_list":["post-2911","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-arp-spoofing-pl","tag-ataki-man-in-the-middle","tag-bezpieczenstwo-sieci","tag-cyberbezpieczenstwo","product-security-pl","product-visibility-pl","topic-bezpieczenstwo-sieci","sycope_author-pawel-drzewiecki"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/posts\/2911","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/comments?post=2911"}],"version-history":[{"count":3,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/posts\/2911\/revisions"}],"predecessor-version":[{"id":3284,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/posts\/2911\/revisions\/3284"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/media\/1397"}],"wp:attachment":[{"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/media?parent=2911"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/categories?post=2911"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/tags?post=2911"},{"taxonomy":"product","embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/product?post=2911"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/topic?post=2911"},{"taxonomy":"sycope_author","embeddable":true,"href":"https:\/\/www.sycope.com\/pl\/wp-json\/wp\/v2\/sycope_author?post=2911"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}