Okwu Mmalite
Ọzụzụ mmata nchekwa na-ada mgbe ọ bụ usoro iwu. Ndị ọrụ chọrọ ahụmịhe aka-aka na-achọpụta mbọ phishing n'ụdị ọnọdụ dị adị. GoPhish na-enye ikpo okwu maka ịme anwansị ndị a, mana mbugharị ọdịnala na-emepụta njide-22: ndị otu nchekwa na-eji ụbọchị na-ahazi akụrụngwa kama ịzụ ndị ọrụ.
Ntọala GoPhish a na-ahụkarị chọrọ ihe nkesa na-enye, ịhazi akụrụngwa SMTP, mejuputa HTTPS, ịtọlite ọdụ data, na ime ka mkpokọ niile sie ike megide mwakpo. Maka otu na-enweghị akụrụngwa DevOps raara onwe ya nye, usoro ntinye awa 4-8 a na-egbu oge mmemme ọzụzụ site na izu ma ọ bụ ọnwa.
Ntuziaka a na-egosi gị otu esi amalite mmepụta-njikere GoPhish akụrụngwa na nkeji 5 kama 5 awa, na-agụnye nhazi nhazi siri ike na CIS Benchmark v2.1.0 nrubeisi, ma na-enye nduzi nhazi SMTP nke ịchọrọ ịgafe nzacha spam ma nweta ọnụego nnyefe dị elu.
Kedu ihe kpatara ntinye GoPhish ji dị mgbagwoju anya karịa ka ọ dị
GoPhish pụtara n'ụzọ kwụ ọtọ: ọ bụ otu Go ọnụọgụ abụọ nwere interface webụ. Agbanyeghị, mbugharị mmepụta na-ekpughe nnukwu mgbagwoju anya zoro n'okpuru elu ahụ dị mfe.
Nhazi SMTP na-anọchite anya nnukwu ihe ịma aka. GoPhish kwesịrị izipu ozi-e nke pụtara na o ziri ezi iji nwalee nzaghachi ndị ọrụ ma na-ezere nzacha spam nke ga-egbochi nnyefe. Nke a chọrọ nhazi SPF/DKIM/DMRC kwesịrị ekwesị, njikwa aha IP, yana na-ekewakarị akụrụngwa SMTP na sistemụ email mmepụta gị.
Ịkwado nchekwa dị oke mkpa. Ikpo okwu simulation phishing na-ejikwa data dị nro gụnyere ozi kọntaktị onye ọrụ, nsonaazụ mkpọsa na-egosi ndị ọrụ pịrị njikọ ọjọọ, yana enwere ike weghara nzere sitere na simulations. Nchekwa na-ezighi ezi nwere ike ikpughe data a ma ọ bụ kwe ka ikpo okwu n'onwe ya mebie ma jiri ya mee mwakpo phishing n'ezie.
Ntọlite HTTPS nwere asambodo bara uru enweghị mkparịta ụka. Ihe nchọgharị ọgbara ọhụrụ na-akọwapụta saịtị HTTP dị ka enweghị nchebe, yana ndị ọrụ a zụrụ azụ ka ha zere phishing ga-atụkwasị obi ozugbo ibe saịtị HTTP dabere. Ịhazi ka anyị ezoro ezo ma ọ bụ ndị nwe asambodo ndị ọzọ na-agbakwunye mgbagwoju anya na ibuga.
Nhazi nchekwa data na nkwado ndabere na mpaghara hụ na data mkpọsa na-aga n'ihu n'ofe nkesa malitegharịa ma na-echekwa nsonaazụ akụkọ ihe mere eme achọrọ maka nleba mmata nchekwa ogologo oge. Ntọala PostgreSQL ma ọ bụ MySQL chọrọ akụrụngwa na mmezi ọzọ.
Usoro nnabata GoPhish nke kwadoro onwe ya zuru oke
Ịghọta usoro ntinye nke ọdịnala na-enyere aka ịghọta ihe kpatara ngwọta ejiri echekwa oge dị ukwuu ma belata ihe egwu.
Ndokwa nkesa na-amalite site n'ịhọrọ onye na-eweta VPS na ịhazi sava nwere opekempe 4GB RAM na nchekwa 80GB. Ubuntu 20.04 LTS bụ sistemụ arụmọrụ akwadoro maka nnabata CIS Benchmark.
Nrụnye na nhazi Docker na-enye njikwa maka njikwa na mmelite dị mfe. Nke a chọrọ ịwụnye Docker Engine, hazie ikike onye ọrụ, yana iji arịa ule gosipụta nrụnye.
Nbugharị akpa GoPhish Docker gụnyere ịdọrọ onyonyo GoPhish gọọmentị, ịhazi mgbanwe gburugburu ebe obibi maka njikọ nchekwa data yana nzere nchịkwa, yana ọdụ ụgbọ mmiri maka interface nchịkwa na sava phishing.
Ntọala nchekwa data PostgreSQL chọrọ ịmepụta akpa nchekwa data dị iche, ịhazi mpịakọta na-adịgide adịgide maka nchekwa data, na ịmepụta njikọ echekwara n'etiti GoPhish na nchekwa data.
Nginx reverse proxy nhazi na-enyere HTTPS aka na Let's Encrypt asambodo, arịrịọ proxies na akpa GoPhish, ma na-emejuputa nkụnye eji isi mee nchekwa na mmachi ọnụego.
Nhazi nkesa SMTP nwere ike ịbụ nzọụkwụ kachasị mgbagwoju anya. Nke a gụnyere ma ọ bụ ijikọ na onye na-eweta SMTP dị ugbu a ma ọ bụ ibuga ihe nkesa SMTP raara onwe ya nye, na-ahazi ndekọ SPF/DKIM/DMARC na DNS, na-emejuputa atumatu ikpo ọkụ IP iji guzobe aha onye na-ezipụ, na ịhazi njirimara na ntọala TLS.
Ịgbasi ike nchekwa na-emetụta ndụmọdụ CIS Benchmark gụnyere nhazi firewall, hardening SSH, mmelite nchekwa akpaaka, sistemu nchọpụta mbubata, na ịde osisi zuru oke.
Usoro a niile na-achọkarị awa 4-8 maka ndị nchịkwa nwere ahụmahụ yana ogologo oge maka otu ndị na-anwa ibuga mbụ ha.
Ntọala SMTP: Ihe Mere-ma ọ bụ nkwụsịtụ maka ịme anwansị phishing
Nnyefe email na-ekpebi ma ịme anwansị phishing gị ọ ga-aga nke ọma ma ọ bụ daa. Ọbụna mkpọsa GoPhish ahaziri nke ọma abaghị uru ma ọ bụrụ na ozi ịntanetị eruteghị igbe mbata ndị ọrụ.
Aha IP bụ ntọala nke nnyefe email na-aga nke ọma. Adreesị IP ọhụrụ enweghị aha, ndị na-eweta email na-enyo ha enyo. Izipu nnukwu mpịakọta site na IP ọhụrụ na-ebute spam nzacha ozugbo.
Ikpo ọkụ IP bụ usoro nke ji nwayọọ nwayọọ na-eme ka aha onye na-ezitere ya dị mma. Nke a gụnyere ibido site na obere mpịakọta email (mail 50 na ụbọchị 1) wee na-abawanye nke ọma karịa ụbọchị 18+ ruo mgbe ị ruru olu ebumnuche gị. Ịwụfe okpomoku IP fọrọ nke nta ka ọ bụrụ na ọ ga-ekwe nkwa idobe folda spam.
Adreesị IP raara onwe ya nye dị mkpa maka ịme phishing. Ịkekọrịta adreesị IP na ndị na-ezigara ndị ọzọ pụtara na omume ha adịghị mma nwere ike imebi aha gị na ọnụego nnyefe gị. Ọtụtụ ndị na-eweta SMTP jisiri ike na-enye IP raara onwe ya nye maka nke a.
Ndekọ SPF na-enye ikike nke sava ozi gị izipu ozi-e n'aha ngalaba gị. Na-enweghị nhazi SPF kwesịrị ekwesị, sava ndị nnata nwere ike jụ ozi-e gị kpamkpam ma ọ bụ kaa ya akara dị ka mgbalị nhụsianya nwere ike ime.
Mbinye aka DKIM n'ụzọ cryptograph na-achọpụta na emezighị ozi-e na mbufe wee si na sava ndị ikike. Ndị isi na-eweta email gụnyere Gmail na Microsoft 365 chọrọ DKIM.
Amụma DMRC na-agwa ndị sava nnata ka ha ga-esi ejikwa ozi-e ndị na-adaba nyocha SPF ma ọ bụ DKIM. Nhazi DMRC kwesịrị ekwesị na-eme ka nnyefe dị mma ma na-echebe ngalaba gị pụọ na mbọ phishing n'ezie iji akara gị.
Reverse DNS (PTR records) kwesịrị dakọtara na aha nnabata nke ihe nkesa gị. DNS reverse ezighi ezi bụ ihe ngosi spam na-ahụkarị nke ọtụtụ nzacha na-enyocha.
Maka otu na-enweghị akụrụngwa SMTP dị adị, ịtọlite sava SMTP simulation phishing raara onwe ya nye site na iji Poste.io ma ọ bụ nyiwe ndị yiri ya na-enye njikwa zuru oke na nnapụta. Nke a chọrọ VPS dị iche (opekempe 4GB RAM), ọrụ okpomọkụ IP dị ka Lemlist ($ 29 / ọnwa) ma ọ bụ WarmupInbox ($ 9 / ọnwa), nlekota aha na-aga n'ihu, na nlekọta na-aga n'ihu.
GoPhish dị njikere ígwé ojii: Mmepụta ngwa ngwa
Mbugharị GoPhish jisiri ike na-ewepụ usoro nhazi niile ma na-enye nchekwa na nnabata ọkwa ụlọ ọrụ.
Oge mmalite na-agbada site na awa ruo nkeji. Ndị otu nchekwa nwere ike ịmalite imepụta mkpọsa ozugbo kama itinye ụbọchị na akụrụngwa.
A na-etinyerịrị ihe siri ike zuru oke, na-eme ka ikpo okwu na-emezu ihe ndị chọrọ nrubeisi na-enweghị nhazi akwụkwọ ntuziaka. Nke a gụnyere iwu firewall kwesịrị ekwesị, ike ike SSH, mmelite nchekwa akpaaka, na igbu osisi zuru oke.
A na-ahazi akụrụngwa SMTP ma kpoo ọkụ, na-enye ọnụego nnabata dị elu ozugbo na-enweghị usoro ikpo ọkụ IP na-ewe izu. SPF/DKIM/DMRC ahaziri mbụ na-eme ka ozi-e rute igbe mbata kama nchekwa nchekwa spam.
Ebujuru ndebiri email ndị ọkachamara, na-enye ndị otu nchekwa mmalite maka ịme anwansị phishing na-enweghị mkpa imepụta ndebiri site na ọkọ ma ọ bụ nyochaa usoro phishing dị ugbu a.
A na-ewulite Scalability n'ime. Ma ọzụzụ ndị ọrụ 50 ma ọ bụ 5,000, akụrụngwa na-akpaghị aka na-eme ka ọ na-edozi mpịakọta mkpọsa na-enweghị aka aka ma ọ bụ mmebi arụmọrụ.
Nkwado teknụzụ 24/7 na-enyere aka dozie nsogbu nnyefe, kwalite mkpọsa, na hazie ikpo okwu iji dakọtara ebumnuche ọzụzụ.
Ọnụ ego maka GoPhish a na-achịkwa na-amalite na $0.50 / hour na-enweghị nkwa, na-eme ka ọ nweta ya maka òtù ọ bụla nha. Ọnwụnwa n'efu nke ụbọchị 7 na-enye ndị otu aka ịnwale ikpo okwu na mkpọsa n'ezie tupu ha emee.
Nkwenye arụmọrụ nke pụtara ihe n'ezie
Ọtụtụ nyiwe ọzụzụ mmata nchekwa na-ekwe nkwa na-edoghị anya gbasara ibelata ike phishing. Mbugharị GoPhish chịkwaara gụnyere nkwa a kapịrị ọnụ, nke enwere ike ịtụnye ya na nkwado ego.
Ndị otu kwesịrị iru eru n'okpuru 20% ọnụego phishing n'ime ọnwa 3 nke ịmalite ịme anwansị oge niile. Metiriiki a na-atụ pasentị ndị ọrụ pịa njikọ ọjọọ ma ọ bụ nyefee nzere na mkpọsa phishing emepụtara.
Ebumnuche ogologo oge gụnyere n'okpuru 5% ọnụego phishing n'ime ọnwa 12. Nke a na-anọchi anya mmata nchekwa ọkwa ụwa ma na-ebelata nke ukwuu ihe egwu nhazi site na mwakpo phishing.
A na-enye nkwụghachi zuru ezu ma ọ bụrụ na emezughị nkwa ndị a, na-eche na ndị otu na-agbaso usoro ọzụzụ akwadoro nke ịme ngosi kwa ọnwa ma ọ bụ ọnwa abụọ. Ntughari ihe egwu a na-eme ka ndị otu na-etinye ego n'atụghị egwu na nkuzi mmata nchekwa.
Mmezu nke ụwa n'ezie: Site na ntọala ruo mkpọsa nke mbụ
Ụzọ kachasị ọsọ maka ịme anwansị phishing dị irè gụnyere ịghọta ebumnuche gị, ịhazi ikpo okwu nke ọma, na ịmalite mkpọsa dabara na ọkaibe nke ndị ọrụ.
Malite site n'ịkọwapụta ntọala gị. Mepee mkpọsa mbụ site na iji ụzọ aghụghọ ọkaibe agafeghị oke iji guzobe ọkwa mmata ndị ọrụ ugbu a. Usoro ntọala a na-akọwa ihe isi ike mkpọsa n'ọdịnihu yana ihe ndị ka mkpa ọzụzụ.
Ihe isi ike na-aga n'ihu na-eme ka ndị ọrụ ghara inwe afọ ojuju. Mgbasa ozi n'oge nwere ike iji akara phishing doro anya dị ka mperi mkpope ma ọ bụ adreesị izipu enyo enyo. Mgbasa ozi ndị emechara na-agbakwunye usoro ọkaibe dịka ngalaba ime ime ma ọ bụ nkọwa n'oge dabara na mmemme dị ugbu a.
Ihe gbasara ugboro mkpọsa. Ngosipụta nke ọnwa ọ bụla na-eme ka mmata nchekwa dị ọhụrụ na-emepụtaghị “ike ọgwụgwụ nke ịme anwansị” ebe ndị ọrụ na-ata ahụhụ na ọzụzụ. Mgbasa ozi kwa izu abụọ na-arụ ọrụ nke ọma maka ụlọ ọrụ nwere nnukwu ihe ize ndụ ma ọ bụ otu ndị na-enwe mwakpo phishing na-arụsi ọrụ ike.
Nzaghachi ozugbo dị oke mkpa. Mgbe ndị ọrụ pịa njikọ ọjọọ, ha kwesịrị ịhụ ọdịnaya ọzụzụ ozugbo na-akọwa ihe ngosi ndị ha tụfuru yana otu esi amata mbọ ndị yiri ya n'ọdịnihu.
Ezubere iche ọkwa ngalaba na-enye ohere ịhazi mkpọsa ka ọ bụrụ egwu egwu akọwapụtara nke ọma. Ndị otu ego nwere ike ịnweta ozi ịntanetị akwụkwọ ọnụahịa adịgboroja, ebe ndị ọrụ IT na-ahụ mbọ iwe ihe ubi maka nyiwe igwe ojii.
Ịgba egwu site na bọọdụ ndị isi na nnabata maka ndị ọrụ na-akọpụta mbọ phishing emebere na-akwalite omume nchekwa dị mma na mgbanwe omenala.
Mmekọrịta na mmemme ịma ọkwa nchekwa sara mbara
Ngwunye phishing na-arụ ọrụ kacha mma dịka akụkụ nke mmemme mmata nchekwa zuru oke. GoPhish na-enye ọzụzụ aka-na, mana oge ọzụzụ, akwụkwọ akụkọ nchekwa, na nkwukọrịta ndị isi na-ewusi nkuzi ike.
Ndepụta metrik gafere ọnụego ọpịpị na-enye nghọta miri emi. Nyochaa ọnụego mkpesa iji hụ ole ndị ọrụ na-arụsi ọrụ ike na-akọ phishing a na-enyo enyo kama ịzere pịa. Soro oge-iji pịa iji chọpụta ndị ọrụ na-eme ngwa ngwa na ndị na-enyocha ozi-e nke ọma.
Kee ihe nlere anya na mmemme ụwa. Mgbe mkpọsa phishing n'ezie lekwasịrị anya ụlọ ọrụ gị, malite ụdị ịme anwansị ahụ iji nwalee ma ndị ọrụ ghọtara usoro a wee kwalite nzaghachi kwesịrị ekwesị.
Mkpesa ndị isi na-atụgharị rịzọlt simulation ka ọ bụrụ asụsụ ihe egwu azụmahịa. Kama "23% nke ndị ọrụ pịrị njikọ ahụ," nkwurịta okwu "ihe dị ka ndị ọrụ 230 nwere ike ịdaba na mwakpo n'ezie, nke nwere ike iduga ohi nzere, nnyefe ransomware, ma ọ bụ mpụ data."
Mmechi: Kwụsị Ịhazi, Malite Ọzụzụ
Oge awa ọ bụla ejiri hazie akụrụngwa GoPhish bụ otu awa anaghị eji azụ ndị ọrụ ọzụzụ. Ụbọchị ọ bụla na-egbu oge n'ịmalite mmemme mmata nchekwa bụ ụbọchị ọzọ ndị na-awakpo nwere ohere ịnweta ndị ọrụ na-enyeghị ọzụzụ.
Usoro mbugharị ahụ dị mkpa. GoPhish nke kwadoro onwe ya na-azụ ahịa otu oge maka nrụzi na-aga n'ihu, nchekwa nchekwa, na nchọpụta nsogbu nnyefe. Mbugharị ndị a na-achịkwa na-ewepụ ihe niile gbasara akụrụngwa, na-enye ndị otu nchekwa ohere ilekwasị anya naanị n'ịmepụta mmemme ọzụzụ dị irè.
Nkwenye arụmọrụ na-enye ntụkwasị obi na itinye ego na nkuzi mmata nchekwa ga-ewepụta mbelata ihe egwu enwere ike. Nkwado ego na-eme ka ndị na-ere ahịa ga-aza ajụjụ maka nsonaazụ, ọ bụghị naanị atụmatụ ikpo okwu.
Ị dịla njikere ịmalite mmemme ịme phishing gị taa? Nweta GoPhish dị njikere mmepụta na nnwale ụbọchị 7 n'efu wee ziga mkpọsa mbụ gị n'ihe na-erughị nkeji iri.
