{"id":703,"date":"2024-02-29T23:48:43","date_gmt":"2024-02-29T20:48:43","guid":{"rendered":"https:\/\/www.fibacloud.com\/tr\/kaynaklar\/?p=703"},"modified":"2026-10-06T02:41:35","modified_gmt":"2026-10-05T23:41:35","slug":"bulut-guvenligi-riskleri-anlama-ve-yonetme","status":"publish","type":"post","link":"https:\/\/www.fibacloud.com\/tr\/kaynaklar\/guvenlik\/bulut-guvenligi-riskleri-anlama-ve-yonetme\/","title":{"rendered":"Bulut G\u00fcvenli\u011fi: Riskleri Anlama ve Y\u00f6netme"},"content":{"rendered":"
\n

Bulut g\u00fcvenli\u011fi, tek bir \u00fcr\u00fcn\u00fcn a\u00e7\u0131lmas\u0131yla tamamlanan bir \u00f6zellik de\u011fildir. Kimlikler, a\u011f eri\u015fimi, uygulamalar, veriler ve kurtarma s\u00fcre\u00e7leri birlikte y\u00f6netilir. Ba\u015flang\u0131\u00e7 noktas\u0131 hangi varl\u0131\u011f\u0131n korunaca\u011f\u0131n\u0131, hangi olay\u0131n i\u015fletmeyi etkileyece\u011fini ve kontrol\u00fcn kim taraf\u0131ndan y\u00fcr\u00fct\u00fclece\u011fini belirlemektir.<\/p>\n

\"Kimlik
Kontrol\u00fcn varl\u0131\u011f\u0131 kadar \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 g\u00f6steren kan\u0131t ve g\u00f6rev sahibi de \u00f6nemlidir.
G\u00f6rseli b\u00fcy\u00fct \u2192<\/a><\/figcaption><\/figure>\n

\u00d6nce kapsam ve sorumluluk<\/h2>\n

Sunucular\u0131, veri depolar\u0131n\u0131, alan adlar\u0131n\u0131, y\u00f6netim hesaplar\u0131n\u0131 ve d\u0131\u015f hizmet ba\u011flant\u0131lar\u0131n\u0131 envantere al\u0131n. \u00dcretim, test ve ki\u015fisel deneme kaynaklar\u0131n\u0131 ay\u0131r\u0131n. Sahibi bilinmeyen bir kaynakta yama ve eri\u015fim incelemesi aksayabilir. Her \u00f6nemli bile\u015fenin teknik ve i\u015f taraf\u0131nda sorumlusu bulunmal\u0131d\u0131r.<\/p>\n

Sa\u011flay\u0131c\u0131n\u0131n fiziksel altyap\u0131y\u0131 y\u00f6netmesi, m\u00fc\u015fterinin i\u015fletim sistemi veya uygulama sorumlulu\u011funu otomatik olarak \u00fcstlenmesi anlam\u0131na gelmez. Y\u00f6netilen \u00fcr\u00fcnlerde g\u00f6rev da\u011f\u0131l\u0131m\u0131 de\u011fi\u015febilir. Yama, g\u00fcvenlik duvar\u0131, yedekleme, g\u00fcnl\u00fck inceleme ve olay m\u00fcdahalesini hizmet kapsam\u0131na g\u00f6re tek tek e\u015fle\u015ftirin.<\/p>\n

Kimlik ve yetkiyi daralt\u0131n<\/h2>\n

Y\u00f6netim hesaplar\u0131nda uygun \u00e7ok fakt\u00f6rl\u00fc do\u011frulama kullan\u0131n ve ortak hesaplardan ka\u00e7\u0131n\u0131n. G\u00fcnl\u00fck \u00e7al\u0131\u015fma i\u00e7in gereken yetkiyle ola\u011fan\u00fcst\u00fc y\u00f6netim yetkisini ay\u0131r\u0131n. API anahtarlar\u0131n\u0131n hangi uygulamada kullan\u0131ld\u0131\u011f\u0131n\u0131, kimin yenileyece\u011fini ve nas\u0131l iptal edilece\u011fini kay\u0131t alt\u0131nda tutun.<\/p>\n

\u00c7al\u0131\u015fan veya tedarik\u00e7i ayr\u0131ld\u0131\u011f\u0131nda hesaplar, anahtarlar ve eri\u015fim yollar\u0131 birlikte de\u011ferlendirilmelidir. Bir hesab\u0131 kapatmak b\u00fct\u00fcn otomasyon s\u0131rlar\u0131n\u0131 ge\u00e7ersiz k\u0131lmayabilir. Yetki incelemesini yaln\u0131z olay sonras\u0131nda de\u011fil, d\u00fczenli i\u015fletim rutini i\u00e7inde yap\u0131n. Kullan\u0131lmayan eri\u015fimleri kald\u0131rmak gereksiz sald\u0131r\u0131 y\u00fczeyini azalt\u0131r.<\/p>\n

A\u011f ve uygulama kontrollerini birlikte ele al\u0131n<\/h2>\n

Y\u00f6netim portlar\u0131n\u0131 herkesin eri\u015febildi\u011fi \u015fekilde b\u0131rakmay\u0131n; gerekli kaynaklar\u0131 ve yollar\u0131 a\u00e7\u0131k\u00e7a tan\u0131mlay\u0131n. A\u011f kural\u0131, uygulama yetkilendirmesinin yerini tutmaz. \u0130nternete a\u00e7\u0131k uygulamalarda oturum y\u00f6netimi, girdi i\u015fleme, ba\u011f\u0131ml\u0131l\u0131k g\u00fcncellemeleri ve s\u0131r saklama gibi konular ayr\u0131ca incelenmelidir.<\/p>\n

De\u011fi\u015fiklikten \u00f6nce uygulaman\u0131n ger\u00e7ekten kulland\u0131\u011f\u0131 ba\u011flant\u0131lar\u0131 \u00e7\u0131kar\u0131n. A\u015f\u0131r\u0131 geni\u015f kural\u0131 kapat\u0131rken gerekli servisleri kesmemek i\u00e7in test ve geri d\u00f6n\u00fc\u015f haz\u0131rlay\u0131n. Hem beklenen eri\u015fimin \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 hem gereksiz eri\u015fimin engellendi\u011fini do\u011frulay\u0131n. Yaln\u0131z ba\u015far\u0131l\u0131 ba\u011flant\u0131ya bakmak s\u0131n\u0131r\u0131n do\u011fru kuruldu\u011funu g\u00f6stermez.<\/p>\n

Veri koruma ve kurtarma<\/h2>\n

Veriyi hassasiyetine ve i\u015f de\u011ferine g\u00f6re s\u0131n\u0131fland\u0131r\u0131n. Aktar\u0131mda ve depolamada koruma ko\u015fullar\u0131n\u0131, anahtar eri\u015fimini ve saklama s\u00fcresini belirleyin. \u015eifreleme, yetkili bir hesab\u0131n yanl\u0131\u015fl\u0131kla veri silmesini engellemez; yedekleme ve eri\u015fim s\u0131n\u0131r\u0131 ayr\u0131 kontrollerdir.<\/p>\n

Yede\u011fi hangi ar\u0131zadan korumak istedi\u011finizi tan\u0131mlay\u0131n. Ayn\u0131 hesap veya depolama alan\u0131ndaki b\u00fct\u00fcn kopyalar ayn\u0131 olaydan etkilenebilir. Geri y\u00fckleme denemesinde verinin a\u00e7\u0131lmas\u0131n\u0131, tutarl\u0131l\u0131\u011f\u0131n\u0131 ve uygulaman\u0131n \u00e7al\u0131\u015fmas\u0131n\u0131 kontrol edin. Kabul edilebilir veri kayb\u0131 ile hizmete d\u00f6n\u00fc\u015f s\u00fcresini i\u015f birimleriyle belirleyin.<\/p>\n

\u0130zleme ve m\u00fcdahale plan\u0131<\/h2>\n
    \n
  1. Y\u00f6netici oturumlar\u0131, yetki de\u011fi\u015fiklikleri ve kritik uygulama hatalar\u0131 i\u00e7in anlaml\u0131 olaylar se\u00e7in.<\/li>\n
  2. Alarm\u0131 kimin inceleyece\u011fini ve hangi durumda m\u00fcdahale edece\u011fini belirleyin.<\/li>\n
  3. Sistem saatlerini tutarl\u0131 tutun; olay kay\u0131tlar\u0131n\u0131 gerekli s\u00fcre ve eri\u015fim s\u0131n\u0131r\u0131yla saklay\u0131n.<\/li>\n
  4. Bir olayda eri\u015fim iptali, izolasyon, kan\u0131t koruma ve kurtarma s\u0131ras\u0131n\u0131 yaz\u0131n.<\/li>\n
  5. De\u011fi\u015fikliklerden sonra kontrolleri yeniden de\u011ferlendirin; eski bir denemeyi s\u00fcresiz g\u00fcvence saymay\u0131n.<\/li>\n<\/ol>\n

    K\u00fc\u00e7\u00fck ekipler i\u00e7in \u00f6ncelik, uygulanabilir birka\u00e7 kontrol\u00fcn d\u00fczenli i\u015flemesidir. Sahipsiz bir alarm y\u0131\u011f\u0131n\u0131 yerine kritik kimlikler, yedekler ve d\u0131\u015f eri\u015fim \u00fczerinde \u00f6l\u00e7\u00fclebilir kontrol kurmak daha s\u00fcrd\u00fcr\u00fclebilir bir ba\u015flang\u0131\u00e7 sa\u011flar.<\/p>\n

    S\u0131k sorulan sorular<\/h2>\n
    \n
    Bulut sa\u011flay\u0131c\u0131s\u0131 g\u00fcvenli\u011fi tamamen \u00fcstlenir mi?<\/strong><\/dt>\n
    \n

    Hizmet kapsam\u0131na ba\u011fl\u0131 g\u00f6revleri \u00fcstlenir. Veri, kullan\u0131c\u0131 yetkileri ve m\u00fc\u015fteri uygulamas\u0131 i\u00e7in sorumluluklar genellikle devam eder; g\u00f6rev payla\u015f\u0131m\u0131 a\u00e7\u0131k\u00e7a do\u011frulanmal\u0131d\u0131r.<\/p>\n<\/dd>\n

    Yedeklerin bulundu\u011funu g\u00f6rmek yeterli mi?<\/strong><\/dt>\n
    \n

    Hay\u0131r. Geri y\u00fckleme, veri tutarl\u0131l\u0131\u011f\u0131 ve uygulama \u00e7al\u0131\u015fmas\u0131 denenmelidir. Dosyan\u0131n listelenmesi kurtar\u0131labilirli\u011fi tek ba\u015f\u0131na g\u00f6stermez.<\/p>\n<\/dd>\n<\/dl>\n

    Sonraki ad\u0131m<\/h2>\n

    VPN eri\u015fim s\u0131n\u0131r\u0131n\u0131<\/a> ve yedekleme plan\u0131n\u0131<\/a> bu kontrol listesine ba\u011flay\u0131n. Her \u00f6nemli risk i\u00e7in bir sorumlu, kontrol ve do\u011frulama kayd\u0131 olu\u015fturun.<\/p>\n

    Kaynaklar<\/h2>\n
      \n
    1. NIST \u2014 The Cybersecurity Framework (CSF) 2.0<\/a><\/li>\n
    2. CISA \u2014 Cross-Sector Cybersecurity Performance Goals<\/a><\/li>\n
    3. OWASP \u2014 Application Security Verification Standard<\/a><\/li>\n
    4. CISA \u2014 StopRansomware Guide<\/a><\/li>\n<\/ol>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

      Bulut g\u00fcvenli\u011fi, tek bir \u00fcr\u00fcn\u00fcn a\u00e7\u0131lmas\u0131yla tamamlanan bir \u00f6zellik de\u011fildir. Kimlikler, a\u011f eri\u015fimi, uygulamalar, veriler ve kurtarma s\u00fcre\u00e7leri birlikte y\u00f6netilir. Ba\u015flang\u0131\u00e7 noktas\u0131 hangi varl\u0131\u011f\u0131n korunaca\u011f\u0131n\u0131, hangi olay\u0131n i\u015fletmeyi etkileyece\u011fini ve kontrol\u00fcn kim taraf\u0131ndan y\u00fcr\u00fct\u00fclece\u011fini belirlemektir. Kontrol\u00fcn varl\u0131\u011f\u0131 kadar \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 g\u00f6steren kan\u0131t ve g\u00f6rev sahibi de \u00f6nemlidir.G\u00f6rseli b\u00fcy\u00fct \u2192 \u00d6nce kapsam ve sorumluluk Sunucular\u0131, veri depolar\u0131n\u0131, […]<\/p>\n","protected":false},"author":1,"featured_media":1371,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31],"tags":[],"class_list":["post-703","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-guvenlik"],"_links":{"self":[{"href":"https:\/\/www.fibacloud.com\/tr\/kaynaklar\/wp-json\/wp\/v2\/posts\/703","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.fibacloud.com\/tr\/kaynaklar\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.fibacloud.com\/tr\/kaynaklar\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.fibacloud.com\/tr\/kaynaklar\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.fibacloud.com\/tr\/kaynaklar\/wp-json\/wp\/v2\/comments?post=703"}],"version-history":[{"count":1,"href":"https:\/\/www.fibacloud.com\/tr\/kaynaklar\/wp-json\/wp\/v2\/posts\/703\/revisions"}],"predecessor-version":[{"id":705,"href":"https:\/\/www.fibacloud.com\/tr\/kaynaklar\/wp-json\/wp\/v2\/posts\/703\/revisions\/705"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.fibacloud.com\/tr\/kaynaklar\/wp-json\/wp\/v2\/media\/1371"}],"wp:attachment":[{"href":"https:\/\/www.fibacloud.com\/tr\/kaynaklar\/wp-json\/wp\/v2\/media?parent=703"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.fibacloud.com\/tr\/kaynaklar\/wp-json\/wp\/v2\/categories?post=703"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.fibacloud.com\/tr\/kaynaklar\/wp-json\/wp\/v2\/tags?post=703"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}