[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"find-articles-16-zero-trust":3,"content-query-NPxshHqMl4":271},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"image":11,"hubs":12,"tags":16,"body":19,"_type":265,"_id":266,"_source":267,"_file":268,"_stem":269,"_extension":270},"\u002Farticles\u002F2026-07\u002F16-zero-trust","2026-07",false,"","Zero Trust на практике для mid-market","С чего начать защиту доступов без бюджета enterprise.","2026-07-16T09:40:00","https:\u002F\u002Fimages.unsplash.com\u002Fphoto-1563986768609-322da13575f3?w=800&q=80",[13,14,15],"security","it","itsm",[13,17,18],"zero-trust","access",{"type":20,"children":21,"toc":255},"root",[22,38,45,50,55,61,66,71,91,103,109,114,132,137,143,148,171,176,182,187,210,215,221,244,250],{"type":23,"tag":24,"props":25,"children":26},"element","p",{},[27,30,36],{"type":28,"value":29},"text","Zero Trust для mid-market — это не платформа за бюджет корпорации, а ",{"type":23,"tag":31,"props":32,"children":33},"strong",{},[34],{"type":28,"value":35},"четыре привычки за 90 дней",{"type":28,"value":37},": знать учётные записи, требовать второй фактор, не пускать всех в одну сеть и видеть аномалии. Ниже только то, что снижает риск, без рамочной теории.",{"type":23,"tag":39,"props":40,"children":42},"h2",{"id":41},"за-90-дней-не-за-программу-трансформации",[43],{"type":28,"value":44},"За 90 дней, не за программу трансформации",{"type":23,"tag":24,"props":46,"children":47},{},[48],{"type":28,"value":49},"Enterprise-картина (микросегментация всего, CASB, полный NDR) откладывается. Mid-market чаще ломают через украденный пароль админа, забытый VPN-аккаунт подрядчика и общий доступ к файловому шару. Закройте этот контур — уже другой класс угроз.",{"type":23,"tag":24,"props":51,"children":52},{},[53],{"type":28,"value":54},"Владелец — ИТ плюс один спонсор из бизнеса (финансы или операционный директор): без него MFA «для всех» не взлетит.",{"type":23,"tag":39,"props":56,"children":58},{"id":57},"шаг-1-инвентаризация-учётных-записей",[59],{"type":28,"value":60},"Шаг 1. Инвентаризация учётных записей",{"type":23,"tag":24,"props":62,"children":63},{},[64],{"type":28,"value":65},"Соберите в одну таблицу (потом — в CMDB\u002Fкаталог): сотрудник, подрядчик, сервисная УЗ, админ, гость. Источники: AD\u002FLDAP, IdP, локальные админы на серверах, VPN, почта, облачные консоли.",{"type":23,"tag":24,"props":67,"children":68},{},[69],{"type":28,"value":70},"За две недели пометьте:",{"type":23,"tag":72,"props":73,"children":74},"ul",{},[75,81,86],{"type":23,"tag":76,"props":77,"children":78},"li",{},[79],{"type":28,"value":80},"кто не входил 45+ дней — к отключению;",{"type":23,"tag":76,"props":82,"children":83},{},[84],{"type":28,"value":85},"общие ящики и «admin \u002F admin» на оборудовании;",{"type":23,"tag":76,"props":87,"children":88},{},[89],{"type":28,"value":90},"подрядчики с бессрочным доступом.",{"type":23,"tag":24,"props":92,"children":93},{},[94,96,101],{"type":28,"value":95},"Это уже Zero Trust: ",{"type":23,"tag":31,"props":97,"children":98},{},[99],{"type":28,"value":100},"не доверяем УЗ только потому, что она когда-то была заведена",{"type":28,"value":102},". Привяжите заявку на доступ и отзыв к сервисному процессу — иначе инвентарь снова разъедется.",{"type":23,"tag":39,"props":104,"children":106},{"id":105},"шаг-2-mfa-там-где-вход-равен-ущербу",[107],{"type":28,"value":108},"Шаг 2. MFA там, где вход равен ущербу",{"type":23,"tag":24,"props":110,"children":111},{},[112],{"type":28,"value":113},"Приоритет: почта, IdP\u002FSSO, VPN, облачные консоли, админ-RDP. Не начинайте с «MFA на кофейный киоск».",{"type":23,"tag":72,"props":115,"children":116},{},[117,122,127],{"type":23,"tag":76,"props":118,"children":119},{},[120],{"type":28,"value":121},"Сотрудники — приложение-аутентификатор или ключ, не SMS, если можете себе это позволить.",{"type":23,"tag":76,"props":123,"children":124},{},[125],{"type":28,"value":126},"Админы — отдельный контур, Privileged Access по возможности, хотя бы jump-хост и запрет прямого RDP из интернета.",{"type":23,"tag":76,"props":128,"children":129},{},[130],{"type":28,"value":131},"Подрядчики — MFA + срок в заявке, автоотзыв.",{"type":23,"tag":24,"props":133,"children":134},{},[135],{"type":28,"value":136},"Отказ «нам неудобно» закрывается пилотом на ИТ и финансах на одну неделю, затем — на всех, у кого есть доступ к персональным данным и платежам.",{"type":23,"tag":39,"props":138,"children":140},{"id":139},"шаг-3-сегментация-без-перестройки-сети",[141],{"type":28,"value":142},"Шаг 3. Сегментация без «перестройки сети»",{"type":23,"tag":24,"props":144,"children":145},{},[146],{"type":28,"value":147},"Полная микросегментация — дорого. Для mid-market хватает грубого разреза:",{"type":23,"tag":72,"props":149,"children":150},{},[151,156,161,166],{"type":23,"tag":76,"props":152,"children":153},{},[154],{"type":28,"value":155},"рабочие места не ходят на управление гипервизорами и АСУ;",{"type":23,"tag":76,"props":157,"children":158},{},[159],{"type":28,"value":160},"гостевая Wi-Fi не видит корпоративную LAN;",{"type":23,"tag":76,"props":162,"children":163},{},[164],{"type":28,"value":165},"серверы учёта и бэкапа не торчат в ту же VLAN, что принтеры;",{"type":23,"tag":76,"props":167,"children":168},{},[169],{"type":28,"value":170},"VPN выдаёт не «всю сеть», а группы по роли (офис, 1С\u002FERP, админка).",{"type":23,"tag":24,"props":172,"children":173},{},[174],{"type":28,"value":175},"Даже три VLAN и четыре правила на фаерволе убирают типичный ransomware-разнос «с ноутбука бухгалтера на контроллер».",{"type":23,"tag":39,"props":177,"children":179},{"id":178},"шаг-4-мониторинг-который-кто-то-читает",[180],{"type":28,"value":181},"Шаг 4. Мониторинг, который кто-то читает",{"type":23,"tag":24,"props":183,"children":184},{},[185],{"type":28,"value":186},"Не SIEM «как у банка». Минимум:",{"type":23,"tag":72,"props":188,"children":189},{},[190,195,200,205],{"type":23,"tag":76,"props":191,"children":192},{},[193],{"type":28,"value":194},"неуспешные входы и входы админов в нерабочее время (IdP + VPN);",{"type":23,"tag":76,"props":196,"children":197},{},[198],{"type":28,"value":199},"отключение MFA, смена MX, новые OAuth-приложения к почте;",{"type":23,"tag":76,"props":201,"children":202},{},[203],{"type":28,"value":204},"массовая рассылка с ящика сотрудника;",{"type":23,"tag":76,"props":206,"children":207},{},[208],{"type":28,"value":209},"появление локального админа на рабочей станции.",{"type":23,"tag":24,"props":211,"children":212},{},[213],{"type":28,"value":214},"Алерты — в ту же очередь, что инциденты ИТ, с SLA «посмотреть за час» для админских входов. Без очереди мониторинг — это лог, который читают после инцидента.",{"type":23,"tag":39,"props":216,"children":218},{"id":217},"чего-не-делать-в-первые-90-дней",[219],{"type":28,"value":220},"Чего не делать в первые 90 дней",{"type":23,"tag":72,"props":222,"children":223},{},[224,229,234,239],{"type":23,"tag":76,"props":225,"children":226},{},[227],{"type":28,"value":228},"Не покупать «Zero Trust platform» до инвентаря и MFA.",{"type":23,"tag":76,"props":230,"children":231},{},[232],{"type":28,"value":233},"Не обещать бизнесу «нулевой доверие ко всему трафику» — не выполните.",{"type":23,"tag":76,"props":235,"children":236},{},[237],{"type":28,"value":238},"Не исключать гендира из MFA «потому что командировки».",{"type":23,"tag":76,"props":240,"children":241},{},[242],{"type":28,"value":243},"Не оставлять break-glass учётку без сейфа, журнала и ежеквартальной проверки.",{"type":23,"tag":39,"props":245,"children":247},{"id":246},"как-понять-что-сработало",[248],{"type":28,"value":249},"Как понять, что сработало",{"type":23,"tag":24,"props":251,"children":252},{},[253],{"type":28,"value":254},"Через квартал у вас: нет бессрочных подрядчиков, MFA на почте и VPN > 95% активных УЗ, три сегмента сети, инциденты доступов в одной очереди. Это и есть практический Zero Trust для mid-market. Дальше — усложнять сегменты и закрывать сервисные УЗ, а не начинать с презентации концепции.",{"title":7,"searchDepth":256,"depth":256,"links":257},2,[258,259,260,261,262,263,264],{"id":41,"depth":256,"text":44},{"id":57,"depth":256,"text":60},{"id":105,"depth":256,"text":108},{"id":139,"depth":256,"text":142},{"id":178,"depth":256,"text":181},{"id":217,"depth":256,"text":220},{"id":246,"depth":256,"text":249},"markdown","content:articles:2026-07:16-zero-trust.md","content","articles\u002F2026-07\u002F16-zero-trust.md","articles\u002F2026-07\u002F16-zero-trust","md",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"image":11,"hubs":272,"tags":273,"body":274,"_type":265,"_id":266,"_source":267,"_file":268,"_stem":269,"_extension":270},[13,14,15],[13,17,18],{"type":20,"children":275,"toc":453},[276,285,289,293,297,301,305,309,324,333,337,341,356,360,364,368,387,391,395,399,418,422,426,445,449],{"type":23,"tag":24,"props":277,"children":278},{},[279,280,284],{"type":28,"value":29},{"type":23,"tag":31,"props":281,"children":282},{},[283],{"type":28,"value":35},{"type":28,"value":37},{"type":23,"tag":39,"props":286,"children":287},{"id":41},[288],{"type":28,"value":44},{"type":23,"tag":24,"props":290,"children":291},{},[292],{"type":28,"value":49},{"type":23,"tag":24,"props":294,"children":295},{},[296],{"type":28,"value":54},{"type":23,"tag":39,"props":298,"children":299},{"id":57},[300],{"type":28,"value":60},{"type":23,"tag":24,"props":302,"children":303},{},[304],{"type":28,"value":65},{"type":23,"tag":24,"props":306,"children":307},{},[308],{"type":28,"value":70},{"type":23,"tag":72,"props":310,"children":311},{},[312,316,320],{"type":23,"tag":76,"props":313,"children":314},{},[315],{"type":28,"value":80},{"type":23,"tag":76,"props":317,"children":318},{},[319],{"type":28,"value":85},{"type":23,"tag":76,"props":321,"children":322},{},[323],{"type":28,"value":90},{"type":23,"tag":24,"props":325,"children":326},{},[327,328,332],{"type":28,"value":95},{"type":23,"tag":31,"props":329,"children":330},{},[331],{"type":28,"value":100},{"type":28,"value":102},{"type":23,"tag":39,"props":334,"children":335},{"id":105},[336],{"type":28,"value":108},{"type":23,"tag":24,"props":338,"children":339},{},[340],{"type":28,"value":113},{"type":23,"tag":72,"props":342,"children":343},{},[344,348,352],{"type":23,"tag":76,"props":345,"children":346},{},[347],{"type":28,"value":121},{"type":23,"tag":76,"props":349,"children":350},{},[351],{"type":28,"value":126},{"type":23,"tag":76,"props":353,"children":354},{},[355],{"type":28,"value":131},{"type":23,"tag":24,"props":357,"children":358},{},[359],{"type":28,"value":136},{"type":23,"tag":39,"props":361,"children":362},{"id":139},[363],{"type":28,"value":142},{"type":23,"tag":24,"props":365,"children":366},{},[367],{"type":28,"value":147},{"type":23,"tag":72,"props":369,"children":370},{},[371,375,379,383],{"type":23,"tag":76,"props":372,"children":373},{},[374],{"type":28,"value":155},{"type":23,"tag":76,"props":376,"children":377},{},[378],{"type":28,"value":160},{"type":23,"tag":76,"props":380,"children":381},{},[382],{"type":28,"value":165},{"type":23,"tag":76,"props":384,"children":385},{},[386],{"type":28,"value":170},{"type":23,"tag":24,"props":388,"children":389},{},[390],{"type":28,"value":175},{"type":23,"tag":39,"props":392,"children":393},{"id":178},[394],{"type":28,"value":181},{"type":23,"tag":24,"props":396,"children":397},{},[398],{"type":28,"value":186},{"type":23,"tag":72,"props":400,"children":401},{},[402,406,410,414],{"type":23,"tag":76,"props":403,"children":404},{},[405],{"type":28,"value":194},{"type":23,"tag":76,"props":407,"children":408},{},[409],{"type":28,"value":199},{"type":23,"tag":76,"props":411,"children":412},{},[413],{"type":28,"value":204},{"type":23,"tag":76,"props":415,"children":416},{},[417],{"type":28,"value":209},{"type":23,"tag":24,"props":419,"children":420},{},[421],{"type":28,"value":214},{"type":23,"tag":39,"props":423,"children":424},{"id":217},[425],{"type":28,"value":220},{"type":23,"tag":72,"props":427,"children":428},{},[429,433,437,441],{"type":23,"tag":76,"props":430,"children":431},{},[432],{"type":28,"value":228},{"type":23,"tag":76,"props":434,"children":435},{},[436],{"type":28,"value":233},{"type":23,"tag":76,"props":438,"children":439},{},[440],{"type":28,"value":238},{"type":23,"tag":76,"props":442,"children":443},{},[444],{"type":28,"value":243},{"type":23,"tag":39,"props":446,"children":447},{"id":246},[448],{"type":28,"value":249},{"type":23,"tag":24,"props":450,"children":451},{},[452],{"type":28,"value":254},{"title":7,"searchDepth":256,"depth":256,"links":454},[455,456,457,458,459,460,461],{"id":41,"depth":256,"text":44},{"id":57,"depth":256,"text":60},{"id":105,"depth":256,"text":108},{"id":139,"depth":256,"text":142},{"id":178,"depth":256,"text":181},{"id":217,"depth":256,"text":220},{"id":246,"depth":256,"text":249}]