Veille Technologique \u2013 Nathan Vitter<\/title>\r\n <link href=\"https:\/\/fonts.googleapis.com\/css2?family=Sora:wght@400;600;700&family=DM+Sans:wght@400;500&display=swap\" rel=\"stylesheet\">\r\n <style>\r\n *, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }\r\n :root {\r\n --blue: #1E40AF; --blue-dark: #1E3A8A; --blue-mid: #2563EB;\r\n --accent: #38BDF8; --bg: #F0F4F8; --card: #FFFFFF;\r\n --text: #0F172A; --muted: #475569; --border: #E2E8F0;\r\n --red: #DC2626; --green: #059669; --orange: #D97706;\r\n }\r\n body { font-family: 'DM Sans', sans-serif; background: var(--bg); color: var(--text); }\r\n \r\n nav.navbar {\r\n position: fixed; top: 0; left: 50%; transform: translateX(-50%);\r\n background: rgba(10,15,30,0.75); backdrop-filter: blur(14px);\r\n z-index: 1000; padding: 10px 24px;\r\n border-radius: 0 0 16px 16px; width: 100%; max-width: 1100px;\r\n }\r\n .navbar ul { display: flex; justify-content: center; flex-wrap: wrap; list-style: none; gap: 2px; }\r\n .navbar li { position: relative; }\r\n .navbar a { color: rgba(255,255,255,.85); text-decoration: none; font-family: 'Sora',sans-serif; font-size: 13px; font-weight: 600; display: block; padding: 7px 11px; border-radius: 6px; transition: all .2s; }\r\n .navbar a:hover { color: var(--accent); background: rgba(255,255,255,.07); }\r\n .navbar li ul { display: none; position: absolute; top: calc(100% + 4px); left: 0; background: white; min-width: 190px; box-shadow: 0 8px 24px rgba(0,0,0,.14); border-radius: 10px; z-index: 999; overflow: hidden; }\r\n .navbar li ul li a { color: #1e293b; padding: 10px 16px; font-size: 13px; border-radius: 0; }\r\n .navbar li ul li a:hover { background: var(--bg); color: var(--blue); }\r\n .navbar li:hover > ul { display: block; }\r\n .spacer { height: 68px; }\r\n \r\n .hero {\r\n background: linear-gradient(135deg, #0F2460 0%, #1E40AF 50%, #2563EB 100%);\r\n padding: 72px 20px 60px; text-align: center; position: relative; overflow: hidden;\r\n }\r\n .hero::after { content:''; position:absolute; bottom:-1px; left:0; right:0; height:40px; background:var(--bg); clip-path:ellipse(55% 100% at 50% 100%); }\r\n .hero-dots { position:absolute; inset:0; background-image:radial-gradient(circle,rgba(255,255,255,.08) 1px,transparent 1px); background-size:28px 28px; }\r\n .hero h1 { font-family:'Sora',sans-serif; font-size:40px; font-weight:700; color:white; position:relative; }\r\n .hero h1 span { color:var(--accent); }\r\n .hero p { color:rgba(255,255,255,.75); font-size:16px; margin-top:12px; position:relative; }\r\n \r\n .content { max-width: 860px; margin: 0 auto; padding: 50px 20px 80px; }\r\n \r\n \/* Dispositif de veille *\/\r\n .dispositif {\r\n background: white; border-radius: 16px; padding: 32px;\r\n box-shadow: 0 4px 20px rgba(0,0,0,.07); margin-bottom: 48px;\r\n border-left: 5px solid var(--blue);\r\n }\r\n .dispositif h2 { font-family:'Sora',sans-serif; color: var(--blue-dark); font-size: 1.1em; margin-bottom: 14px; }\r\n .dispositif p { color: var(--muted); font-size: 0.9em; line-height: 1.75; margin-bottom: 12px; }\r\n \r\n .outil-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(160px, 1fr)); gap: 12px; margin-top: 20px; }\r\n .outil-card {\r\n background: #f8faff; border-radius: 12px; padding: 16px;\r\n border: 1px solid var(--border); text-align: center;\r\n }\r\n .outil-card .icon { font-size: 24px; margin-bottom: 8px; }\r\n .outil-card h3 { font-family:'Sora',sans-serif; font-size: 0.82em; color: var(--blue-dark); margin-bottom: 5px; font-weight: 700; }\r\n .outil-card p { font-size: 0.76em; color: var(--muted); line-height: 1.5; }\r\n \r\n \/* Section titre *\/\r\n .section-title {\r\n font-family:'Sora',sans-serif; font-size: 1.1em; color: var(--blue-dark);\r\n border-left: 5px solid var(--blue); padding-left: 15px;\r\n margin: 48px 0 24px; font-weight: 700;\r\n }\r\n \r\n \/* Article card *\/\r\n .article-card {\r\n background: white; border-radius: 16px; padding: 28px 30px;\r\n box-shadow: 0 4px 20px rgba(0,0,0,.07); margin-bottom: 24px;\r\n border-top: 3px solid var(--border); transition: box-shadow .2s;\r\n }\r\n .article-card:hover { box-shadow: 0 8px 30px rgba(30,64,175,.1); }\r\n \r\n .article-meta {\r\n display: flex; align-items: center; gap: 10px; margin-bottom: 12px; flex-wrap: wrap;\r\n }\r\n .article-num {\r\n background: var(--blue); color: white;\r\n font-family:'Sora',sans-serif; font-size: 0.7em; font-weight: 700;\r\n padding: 3px 11px; border-radius: 999px;\r\n }\r\n .article-source { font-size: 0.76em; color: var(--muted); font-weight: 600; }\r\n .article-date { font-size: 0.76em; color: #9ca3af; }\r\n \r\n .article-title {\r\n font-family:'Sora',sans-serif; font-size: 1em; font-weight: 700;\r\n color: var(--blue-dark); margin-bottom: 12px; line-height: 1.4;\r\n }\r\n .article-resume { font-size: 0.875em; color: var(--muted); line-height: 1.75; margin-bottom: 16px; }\r\n \r\n \/* Tags techniques *\/\r\n .tech-tags { display: flex; flex-wrap: wrap; gap: 6px; margin-bottom: 16px; }\r\n .tech-tag {\r\n font-family:'Sora',sans-serif; font-size: 10.5px; font-weight: 700;\r\n padding: 3px 10px; border-radius: 999px; border: 1px solid;\r\n }\r\n .tech-tag.red { background: #FEF2F2; color: var(--red); border-color: #FECACA; }\r\n .tech-tag.blue { background: #EFF6FF; color: var(--blue); border-color: #BFDBFE; }\r\n .tech-tag.green { background: #F0FDF4; color: var(--green); border-color: #BBF7D0; }\r\n .tech-tag.orange { background: #FFFBEB; color: var(--orange); border-color: #FDE68A; }\r\n \r\n \/* Analyse *\/\r\n .article-analyse {\r\n background: #f0f4ff; border-radius: 10px; padding: 16px 20px;\r\n border-left: 4px solid var(--blue); margin-bottom: 14px;\r\n }\r\n .article-analyse h4 {\r\n font-family:'Sora',sans-serif; font-size: 0.72em; font-weight: 700;\r\n color: var(--blue); margin-bottom: 6px; text-transform: uppercase; letter-spacing: 0.5px;\r\n }\r\n .article-analyse p { font-size: 0.85em; color: #374151; line-height: 1.65; }\r\n \r\n \/* Lien cours *\/\r\n .lien-cours {\r\n background: #f0fdf4; border-radius: 10px; padding: 14px 18px;\r\n border-left: 4px solid var(--green); margin-bottom: 14px;\r\n }\r\n .lien-cours h4 {\r\n font-family:'Sora',sans-serif; font-size: 0.72em; font-weight: 700;\r\n color: var(--green); margin-bottom: 6px; text-transform: uppercase; letter-spacing: 0.5px;\r\n }\r\n .lien-cours p { font-size: 0.85em; color: #166534; line-height: 1.65; }\r\n \r\n .article-link {\r\n display: inline-flex; align-items: center; gap: 5px;\r\n font-family:'Sora',sans-serif; font-size: 0.78em; color: var(--blue);\r\n text-decoration: none; font-weight: 700;\r\n }\r\n .article-link:hover { text-decoration: underline; }\r\n \r\n footer { text-align: center; padding: 30px; color: #9ca3af; font-size: 0.85em; }\r\n <\/style>\r\n<\/head>\r\n<body>\r\n \r\n<nav class=\"navbar\">\r\n <ul>\r\n <li><a href=\"\/\">Accueil<\/a><\/li>\r\n <li><a href=\"\/index.php\/ap\/\">AP<\/a><\/li>\r\n <li><a href=\"\/index.php\/activites\/\">Activit\u00e9s<\/a><\/li>\r\n <li><a href=\"\/index.php\/projets\/\">Projets<\/a><\/li>\r\n <li>\r\n <a href=\"\/index.php\/stages\/stages\/\">Stages \u25bc<\/a>\r\n <ul>\r\n <li><a href=\"\/index.php\/stages\/1ere-annee\/\">Stage 1\u00e8re ann\u00e9e<\/a><\/li>\r\n <li><a href=\"\/index.php\/stages\/2eme-annee\/\">Stage 2\u00e8me ann\u00e9e<\/a><\/li>\r\n <\/ul>\r\n <\/li>\r\n <li><a href=\"\/index.php\/veille\/\">Veille<\/a><\/li>\r\n <li><a href=\"\/index.php\/cv\/\">CV<\/a><\/li>\r\n <li><a href=\"\/index.php\/contact\/\">Contact<\/a><\/li>\r\n <li><a href=\"\/index.php\/competences\/\">Comp\u00e9tences<\/a><\/li>\r\n <li><a href=\"\/index.php\/certifications\/\">Certifications<\/a><\/li>\r\n <\/ul>\r\n<\/nav>\r\n \r\n<div class=\"spacer\"><\/div>\r\n \r\n<section class=\"hero\">\r\n <div class=\"hero-dots\"><\/div>\r\n <h1>Veille <span>Technologique<\/span><\/h1>\r\n <p>Sujet : Les ransomwares et les m\u00e9canismes techniques pour s'en prot\u00e9ger<\/p>\r\n<\/section>\r\n \r\n<div class=\"content\">\r\n \r\n \r\n <div class=\"dispositif\">\r\n <h2>Mon dispositif de veille<\/h2>\r\n <p>\r\n J'ai choisi ce sujet car il est directement li\u00e9 \u00e0 mon option SISR. En tant que futur administrateur syst\u00e8mes et r\u00e9seaux, je dois comprendre non seulement comment fonctionnent les ransomwares, mais surtout quels outils et architectures techniques permettent de s'en d\u00e9fendre. C'est exactement ce qu'on a mis en place en cours : pfSense, Suricata, ELK\/SIEM, segmentation r\u00e9seau, sauvegardes avec Bacula.\r\n <\/p>\r\n <p>\r\n Pour rester inform\u00e9, j'utilise plusieurs sources compl\u00e9mentaires, avec une pr\u00e9f\u00e9rence pour les contenus techniques plut\u00f4t que les articles grand public.\r\n <\/p>\r\n <div class=\"outil-grid\">\r\n <div class=\"outil-card\">\r\n <div class=\"icon\">\ud83d\udd14<\/div>\r\n <h3>Google Alertes<\/h3>\r\n <p>Mots-cl\u00e9s : \"ransomware Active Directory\", \"pfSense IDS ransomware\", \"SIEM detection\"<\/p>\r\n <\/div>\r\n <div class=\"outil-card\">\r\n <div class=\"icon\">\ud83d\udce1<\/div>\r\n <h3>ANSSI<\/h3>\r\n <p>Bulletins officiels, guides techniques et alertes de l'agence nationale de s\u00e9curit\u00e9<\/p>\r\n <\/div>\r\n <div class=\"outil-card\">\r\n <div class=\"icon\">\ud83d\udcf0<\/div>\r\n <h3>LeMagIT \/ ZDNet<\/h3>\r\n <p>Actualit\u00e9s et analyses techniques sur les cybermenaces et les solutions de protection<\/p>\r\n <\/div>\r\n <div class=\"outil-card\">\r\n <div class=\"icon\">\ud83d\udcac<\/div>\r\n <h3>Reddit \/ GitHub<\/h3>\r\n <p>r\/netsec, r\/cybersecurity et d\u00e9p\u00f4ts GitHub pour les retours d'exp\u00e9rience techniques<\/p>\r\n <\/div>\r\n <\/div>\r\n <\/div>\r\n \r\n <h2 class=\"section-title\">Articles et analyses techniques<\/h2>\r\n \r\n \r\n <div class=\"article-card\">\r\n <div class=\"article-meta\">\r\n <span class=\"article-num\">Article 1<\/span>\r\n <span class=\"article-source\">ANSSI \/ AVTIS<\/span>\r\n <span class=\"article-date\">2025<\/span>\r\n <\/div>\r\n <div class=\"article-title\">Active Directory : principale porte d'entr\u00e9e des ransomwares en 2025<\/div>\r\n <div class=\"tech-tags\">\r\n <span class=\"tech-tag red\">Active Directory<\/span>\r\n <span class=\"tech-tag blue\">GPO<\/span>\r\n <span class=\"tech-tag blue\">Comptes \u00e0 privil\u00e8ges<\/span>\r\n <span class=\"tech-tag orange\">Mouvement lat\u00e9ral<\/span>\r\n <\/div>\r\n <p class=\"article-resume\">\r\n Selon l'ANSSI, les intrusions via Active Directory ont augment\u00e9 de 37 % en un an. Les ransomwares ne ciblent plus directement les fichiers : ils compromettent d'abord un compte utilisateur standard, escaladent les privil\u00e8ges via des failles AD (Pass-the-Hash, Kerberoasting), puis se propagent lat\u00e9ralement sur tout le domaine avant de d\u00e9clencher le chiffrement. Une fois un compte administrateur de domaine compromis, l'attaquant peut d\u00e9ployer le ransomware sur toutes les machines en quelques minutes via GPO.\r\n <\/p>\r\n <div class=\"article-analyse\">\r\n <h4>Mon analyse technique<\/h4>\r\n <p>En cours, on a configur\u00e9 Active Directory avec des GPO et la gestion des droits utilisateurs. Cette attaque illustre pourquoi le principe du moindre privil\u00e8ge est critique : un utilisateur standard ne doit jamais avoir les droits administrateur local. La mise en place d'une politique de mots de passe robuste via GPO, la d\u00e9sactivation des comptes inutilis\u00e9s et la s\u00e9paration des comptes admin\/utilisateur sont des contremesures directes contre ce type d'attaque.<\/p>\r\n <\/div>\r\n <div class=\"lien-cours\">\r\n <h4>Lien avec mes activit\u00e9s<\/h4>\r\n <p>TP Windows Server (AD, GPO, habilitations) \u2014 Chapitre 6 PowerShell & Active Directory \u2014 Habilitation des comptes d'un domaine<\/p>\r\n <\/div>\r\n <a class=\"article-link\" href=\"https:\/\/avtis.fr\/cybersecurite-2025-les-nouvelles-attaques-ciblant-les-entreprises-francaises\/\" target=\"_blank\">Lire l'article complet \u2192<\/a>\r\n <\/div>\r\n \r\n \r\n <div class=\"article-card\">\r\n <div class=\"article-meta\">\r\n <span class=\"article-num\">Article 2<\/span>\r\n <span class=\"article-source\">IS Decisions<\/span>\r\n <span class=\"article-date\">Juillet 2025<\/span>\r\n <\/div>\r\n <div class=\"article-title\">Segmentation r\u00e9seau par VLANs : comment limiter la propagation des ransomwares<\/div>\r\n <div class=\"tech-tags\">\r\n <span class=\"tech-tag blue\">VLAN<\/span>\r\n <span class=\"tech-tag blue\">pfSense<\/span>\r\n <span class=\"tech-tag blue\">DMZ<\/span>\r\n <span class=\"tech-tag orange\">Mouvement lat\u00e9ral<\/span>\r\n <\/div>\r\n <p class=\"article-resume\">\r\n Une des principales raisons pour lesquelles les ransomwares se propagent rapidement dans un r\u00e9seau est l'absence de segmentation. Sans VLANs, une machine compromise peut atteindre tous les autres \u00e9quipements du r\u00e9seau. La segmentation par VLANs coupl\u00e9e \u00e0 des r\u00e8gles de filtrage strictes sur un pare-feu comme pfSense permet de contenir l'attaque dans un seul segment. Selon l'ANSSI, une PME qui segmente correctement son r\u00e9seau r\u00e9duit de 85 % le p\u00e9rim\u00e8tre accessible en cas de compromission d'un poste.\r\n <\/p>\r\n <div class=\"article-analyse\">\r\n <h4>Mon analyse technique<\/h4>\r\n <p>On a configur\u00e9 pfSense avec des VLANs et des r\u00e8gles ACL en cours. Concr\u00e8tement, si un poste client est infect\u00e9 dans le VLAN 10 (utilisateurs), les r\u00e8gles pfSense bloquent toute communication vers le VLAN 20 (serveurs) et le VLAN 30 (sauvegardes). Le ransomware reste donc isol\u00e9 au segment compromis. La DMZ isole \u00e9galement les serveurs accessibles depuis internet pour \u00e9viter qu'ils ne deviennent un vecteur d'attaque interne.<\/p>\r\n <\/div>\r\n <div class=\"lien-cours\">\r\n <h4>Lien avec mes activit\u00e9s<\/h4>\r\n <p>TP Cisco (VLANs, ACL, routage inter-VLAN) \u2014 Cluster pfSense HA\/CARP \u2014 AP3 Port de Cherbourg (DMZ, VLAN, IDS)<\/p>\r\n <\/div>\r\n <a class=\"article-link\" href=\"https:\/\/www.isdecisions.com\/fr\/blog\/securite-des-donnees\/comment-proteger-active-directory-contre-ransomwares\" target=\"_blank\">Lire l'article complet \u2192<\/a>\r\n <\/div>\r\n \r\n \r\n <div class=\"article-card\">\r\n <div class=\"article-meta\">\r\n <span class=\"article-num\">Article 3<\/span>\r\n <span class=\"article-source\">OpenNix \/ Culpur.net<\/span>\r\n <span class=\"article-date\">2025-2026<\/span>\r\n <\/div>\r\n <div class=\"article-title\">Suricata IDS\/IPS sur pfSense : d\u00e9tecter les comportements ransomware en temps r\u00e9el<\/div>\r\n <div class=\"tech-tags\">\r\n <span class=\"tech-tag red\">Suricata<\/span>\r\n <span class=\"tech-tag blue\">pfSense<\/span>\r\n <span class=\"tech-tag blue\">IDS\/IPS<\/span>\r\n <span class=\"tech-tag green\">D\u00e9tection temps r\u00e9el<\/span>\r\n <\/div>\r\n <p class=\"article-resume\">\r\n Suricata, int\u00e9gr\u00e9 \u00e0 pfSense, analyse le trafic r\u00e9seau en temps r\u00e9el et compare les flux aux signatures d'attaques connues. En mode IPS (inline), il peut bloquer automatiquement les paquets malveillants. Les r\u00e8gles Emerging Threats couvrent notamment les communications C2 (Command & Control) des ransomwares. Les logs sont g\u00e9n\u00e9r\u00e9s au format EVE JSON, un format structur\u00e9 facilement int\u00e9grable dans un SIEM comme ELK ou Wazuh pour la corr\u00e9lation d'\u00e9v\u00e9nements.\r\n <\/p>\r\n <div class=\"article-analyse\">\r\n <h4>Mon analyse technique<\/h4>\r\n <p>On a d\u00e9ploy\u00e9 Suricata en cours dans le cadre de la s\u00e9curisation du SI. Concr\u00e8tement, un ransomware qui tente de contacter son serveur C2 via HTTP\/HTTPS g\u00e9n\u00e8re un trafic anormal d\u00e9tectable par les r\u00e8gles de signatures. En mode IPS, pfSense peut dropper ces paquets automatiquement. La configuration du format EVE JSON permet ensuite d'envoyer les alertes vers ELK pour les visualiser et cr\u00e9er des tableaux de bord de d\u00e9tection.<\/p>\r\n <\/div>\r\n <div class=\"lien-cours\">\r\n <h4>Lien avec mes activit\u00e9s<\/h4>\r\n <p>S\u00e9curisation SI (pfSense, Stormshield, Suricata, ELK\/SIEM) \u2014 AP3 Port de Cherbourg (IDS)<\/p>\r\n <\/div>\r\n <a class=\"article-link\" href=\"https:\/\/culpur.net\/2026\/03\/31\/deploying-suricata-ids-behind-pfsense-network-intrusion-detection-for-self-hosted-infrastructure\/\" target=\"_blank\">Lire l'article complet \u2192<\/a>\r\n <\/div>\r\n \r\n \r\n <div class=\"article-card\">\r\n <div class=\"article-meta\">\r\n <span class=\"article-num\">Article 4<\/span>\r\n <span class=\"article-source\">ES Protect \/ ANSSI<\/span>\r\n <span class=\"article-date\">2025-2026<\/span>\r\n <\/div>\r\n <div class=\"article-title\">La r\u00e8gle 3-2-1 et les sauvegardes air-gapped : seule protection r\u00e9elle contre le chiffrement<\/div>\r\n <div class=\"tech-tags\">\r\n <span class=\"tech-tag green\">Bacula<\/span>\r\n <span class=\"tech-tag green\">PRA\/PCA<\/span>\r\n <span class=\"tech-tag green\">Sauvegarde air-gapped<\/span>\r\n <span class=\"tech-tag orange\">Chiffrement ransomware<\/span>\r\n <\/div>\r\n <p class=\"article-resume\">\r\n La r\u00e8gle 3-2-1 reste la meilleure protection contre les ransomwares : 3 copies des donn\u00e9es, sur 2 supports diff\u00e9rents, avec 1 copie hors site. La variante 3-2-1-1 ajoute une copie \"air-gapped\", c'est-\u00e0-dire d\u00e9connect\u00e9e du r\u00e9seau, inaccessible depuis internet. Cette pr\u00e9caution a sauv\u00e9 des centaines d'entreprises lors de la vague NotPetya. Une sauvegarde isol\u00e9e dans un VLAN d\u00e9di\u00e9 sans acc\u00e8s internet (comme un VLAN 60 bloqu\u00e9 par pfSense) offre une protection \u00e9quivalente en environnement virtualis\u00e9.\r\n <\/p>\r\n <div class=\"article-analyse\">\r\n <h4>Mon analyse technique<\/h4>\r\n <p>En cours, on a mis en place Bacula pour la sauvegarde client\/serveur. Pour r\u00e9sister aux ransomwares, la sauvegarde doit \u00eatre dans un VLAN isol\u00e9, sans acc\u00e8s bidirectionnel : le serveur de sauvegarde peut acc\u00e9der aux clients, mais pas l'inverse. Un ransomware qui compromet un serveur ne peut pas atteindre les sauvegardes. La planification des sauvegardes (quotidienne, hebdomadaire) et les tests de restauration r\u00e9guliers sont aussi essentiels.<\/p>\r\n <\/div>\r\n <div class=\"lien-cours\">\r\n <h4>Lien avec mes activit\u00e9s<\/h4>\r\n <p>Chapitre 2 \u2013 Sauvegarde client\/serveur avec Bacula \u2014 Cluster pfSense HA\/CARP (isolation r\u00e9seau) \u2014 VMware vCenter (PRA\/PCA)<\/p>\r\n <\/div>\r\n <a class=\"article-link\" href=\"https:\/\/esprotect.fr\/cybersecurite\/bonnes-pratiques-securiser-reseau-informatique\/\" target=\"_blank\">Lire l'article complet \u2192<\/a>\r\n <\/div>\r\n \r\n \r\n <div class=\"article-card\">\r\n <div class=\"article-meta\">\r\n <span class=\"article-num\">Article 5<\/span>\r\n <span class=\"article-source\">Gridinsoft \/ Datasecuritybreach<\/span>\r\n <span class=\"article-date\">2025<\/span>\r\n <\/div>\r\n <div class=\"article-title\">Triple extorsion et destruction des donn\u00e9es : l'\u00e9volution technique des ransomwares en 2025<\/div>\r\n <div class=\"tech-tags\">\r\n <span class=\"tech-tag red\">Triple extorsion<\/span>\r\n <span class=\"tech-tag red\">Chiffrement AES\/RSA<\/span>\r\n <span class=\"tech-tag red\">Exfiltration<\/span>\r\n <span class=\"tech-tag orange\">LockBit 4.0<\/span>\r\n <\/div>\r\n <p class=\"article-resume\">\r\n En 2025, les ransomwares ont \u00e9volu\u00e9 vers un mod\u00e8le de triple extorsion : chiffrement des donn\u00e9es (AES-256 + RSA-4096 pour la cl\u00e9), exfiltration et menace de publication, puis attaques DDoS sur l'infrastructure de la victime pour forcer le paiement. LockBit 4.0 int\u00e8gre d\u00e9sormais des vitesses de chiffrement optimis\u00e9es par multithreading. Les wipers (HermeticWiper, CaddyWiper) vont plus loin en d\u00e9truisant les donn\u00e9es de fa\u00e7on irr\u00e9versible. 86 % des attaques de 2024 ont entra\u00een\u00e9 des interruptions op\u00e9rationnelles majeures.\r\n <\/p>\r\n <div class=\"article-analyse\">\r\n <h4>Mon analyse technique<\/h4>\r\n <p>La combinaison AES (chiffrement sym\u00e9trique des donn\u00e9es) + RSA (chiffrement de la cl\u00e9 AES) utilis\u00e9e par les ransomwares modernes est math\u00e9matiquement incassable sans la cl\u00e9 priv\u00e9e. Cela rend les sauvegardes encore plus critiques. La d\u00e9tection pr\u00e9coce via un SIEM (ELK) est essentielle : une augmentation anormale des op\u00e9rations d'\u00e9criture sur le syst\u00e8me de fichiers ou des connexions vers des IPs inconnues sont des indicateurs de compromission (IoC) d\u00e9tectables avant le chiffrement complet.<\/p>\r\n <\/div>\r\n <div class=\"lien-cours\">\r\n <h4>Lien avec mes activit\u00e9s<\/h4>\r\n <p>S\u00e9curisation SI (ELK\/SIEM, Kali Linux) \u2014 Stormshield VPN (chiffrement des communications) \u2014 Lab 12 & 13 VPN IPsec PKI (chiffrement asym\u00e9trique)<\/p>\r\n <\/div>\r\n <a class=\"article-link\" href=\"https:\/\/fr.gridinsoft.com\/article\/ransomware\" target=\"_blank\">Lire l'article complet \u2192<\/a>\r\n <\/div>\r\n \r\n \r\n <div class=\"article-card\">\r\n <div class=\"article-meta\">\r\n <span class=\"article-num\">Article 6<\/span>\r\n <span class=\"article-source\">Hornetsecurity \/ ES Protect<\/span>\r\n <span class=\"article-date\">2025<\/span>\r\n <\/div>\r\n <div class=\"article-title\">SIEM et ELK : centralisation des logs pour d\u00e9tecter une attaque ransomware avant qu'elle n'\u00e9clate<\/div>\r\n <div class=\"tech-tags\">\r\n <span class=\"tech-tag blue\">ELK \/ Elasticsearch<\/span>\r\n <span class=\"tech-tag blue\">SIEM<\/span>\r\n <span class=\"tech-tag green\">Kibana<\/span>\r\n <span class=\"tech-tag green\">Corr\u00e9lation d'\u00e9v\u00e9nements<\/span>\r\n <\/div>\r\n <p class=\"article-resume\">\r\n Un SIEM (Security Information and Event Management) comme la stack ELK (Elasticsearch, Logstash, Kibana) centralise les logs de tous les \u00e9quipements (pare-feu pfSense, serveurs Windows\/Linux, Suricata) et permet de corr\u00e9ler des \u00e9v\u00e9nements qui semblent anodins s\u00e9par\u00e9ment mais r\u00e9v\u00e8lent une attaque combin\u00e9s. Par exemple : un \u00e9chec d'authentification RDP suivi d'une connexion r\u00e9ussie depuis une IP externe, puis une augmentation des \u00e9critures disque \u2014 ces trois \u00e9v\u00e9nements corr\u00e9l\u00e9s indiquent une compromission en cours. Les entreprises qui d\u00e9tectent et isolent une machine dans les 30 premi\u00e8res minutes contiennent l'incident dans 78 % des cas.\r\n <\/p>\r\n <div class=\"article-analyse\">\r\n <h4>Mon analyse technique<\/h4>\r\n <p>En cours, on a d\u00e9ploy\u00e9 ELK\/SIEM pour centraliser les logs et cr\u00e9er des alertes. La puissance du SIEM r\u00e9side dans la corr\u00e9lation : Logstash ing\u00e8re les logs EVE JSON de Suricata, les journaux Windows Event (connexions, GPO), les logs pfSense. Kibana permet de cr\u00e9er des dashboards et des r\u00e8gles d'alerte automatiques. Par exemple, une r\u00e8gle qui d\u00e9clenche une alerte si plus de 1000 fichiers sont modifi\u00e9s en moins de 5 minutes peut d\u00e9tecter un ransomware en phase de chiffrement.<\/p>\r\n <\/div>\r\n <div class=\"lien-cours\">\r\n <h4>Lien avec mes activit\u00e9s<\/h4>\r\n <p>S\u00e9curisation SI (pfSense, Stormshield, Suricata, ELK\/SIEM, Kali Linux) \u2014 Outil de supervision Zabbix\/Centreon \u2014 Scripts Shell Linux (automatisation des logs)<\/p>\r\n <\/div>\r\n <a class=\"article-link\" href=\"https:\/\/www.hornetsecurity.com\/fr\/blog\/statistiques-ransomwares\/\" target=\"_blank\">Lire l'article complet \u2192<\/a>\r\n <\/div>\r\n \r\n<\/div>\r\n \r\n<footer>Copyright \u00a9 2026 | Nathan Vitter \u2013 BTS SIO SISR \u2013 Lyc\u00e9e Saint-Exup\u00e9ry<\/footer>\r\n \r\n<\/body>\r\n<\/html>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Veille Technologique \u2013 Nathan Vitter Accueil AP Activit\u00e9s Projets Stages \u25bc Stage 1\u00e8re ann\u00e9e Stage 2\u00e8me ann\u00e9e Veille CV Contact […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"site-sidebar-layout":"no-sidebar","site-content-layout":"","ast-site-content-layout":"full-width-container","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"disabled","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"class_list":["post-596","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/nathanvitter.fr\/index.php\/wp-json\/wp\/v2\/pages\/596","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nathanvitter.fr\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/nathanvitter.fr\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/nathanvitter.fr\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nathanvitter.fr\/index.php\/wp-json\/wp\/v2\/comments?post=596"}],"version-history":[{"count":13,"href":"https:\/\/nathanvitter.fr\/index.php\/wp-json\/wp\/v2\/pages\/596\/revisions"}],"predecessor-version":[{"id":772,"href":"https:\/\/nathanvitter.fr\/index.php\/wp-json\/wp\/v2\/pages\/596\/revisions\/772"}],"wp:attachment":[{"href":"https:\/\/nathanvitter.fr\/index.php\/wp-json\/wp\/v2\/media?parent=596"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

\n\t\t\t\t

\n\t\t\t\t\t

\n\t\t\t\t

\n\t\t\t\t\t\r\n\r\n\r\n \r\n \r\n Veille Technologique \u2013 Nathan Vitter<\/title>\r\n <link href=\"https:\/\/fonts.googleapis.com\/css2?family=Sora:wght@400;600;700&family=DM+Sans:wght@400;500&display=swap\" rel=\"stylesheet\">\r\n <style>\r\n *, *::before, *::after { margin: 0; padding: 0; box-sizing: border-box; }\r\n :root {\r\n --blue: #1E40AF; --blue-dark: #1E3A8A; --blue-mid: #2563EB;\r\n --accent: #38BDF8; --bg: #F0F4F8; --card: #FFFFFF;\r\n --text: #0F172A; --muted: #475569; --border: #E2E8F0;\r\n --red: #DC2626; --green: #059669; --orange: #D97706;\r\n }\r\n body { font-family: 'DM Sans', sans-serif; background: var(--bg); color: var(--text); }\r\n \r\n nav.navbar {\r\n position: fixed; top: 0; left: 50%; transform: translateX(-50%);\r\n background: rgba(10,15,30,0.75); backdrop-filter: blur(14px);\r\n z-index: 1000; padding: 10px 24px;\r\n border-radius: 0 0 16px 16px; width: 100%; max-width: 1100px;\r\n }\r\n .navbar ul { display: flex; justify-content: center; flex-wrap: wrap; list-style: none; gap: 2px; }\r\n .navbar li { position: relative; }\r\n .navbar a { color: rgba(255,255,255,.85); text-decoration: none; font-family: 'Sora',sans-serif; font-size: 13px; font-weight: 600; display: block; padding: 7px 11px; border-radius: 6px; transition: all .2s; }\r\n .navbar a:hover { color: var(--accent); background: rgba(255,255,255,.07); }\r\n .navbar li ul { display: none; position: absolute; top: calc(100% + 4px); left: 0; background: white; min-width: 190px; box-shadow: 0 8px 24px rgba(0,0,0,.14); border-radius: 10px; z-index: 999; overflow: hidden; }\r\n .navbar li ul li a { color: #1e293b; padding: 10px 16px; font-size: 13px; border-radius: 0; }\r\n .navbar li ul li a:hover { background: var(--bg); color: var(--blue); }\r\n .navbar li:hover > ul { display: block; }\r\n .spacer { height: 68px; }\r\n \r\n .hero {\r\n background: linear-gradient(135deg, #0F2460 0%, #1E40AF 50%, #2563EB 100%);\r\n padding: 72px 20px 60px; text-align: center; position: relative; overflow: hidden;\r\n }\r\n .hero::after { content:''; position:absolute; bottom:-1px; left:0; right:0; height:40px; background:var(--bg); clip-path:ellipse(55% 100% at 50% 100%); }\r\n .hero-dots { position:absolute; inset:0; background-image:radial-gradient(circle,rgba(255,255,255,.08) 1px,transparent 1px); background-size:28px 28px; }\r\n .hero h1 { font-family:'Sora',sans-serif; font-size:40px; font-weight:700; color:white; position:relative; }\r\n .hero h1 span { color:var(--accent); }\r\n .hero p { color:rgba(255,255,255,.75); font-size:16px; margin-top:12px; position:relative; }\r\n \r\n .content { max-width: 860px; margin: 0 auto; padding: 50px 20px 80px; }\r\n \r\n \/* Dispositif de veille *\/\r\n .dispositif {\r\n background: white; border-radius: 16px; padding: 32px;\r\n box-shadow: 0 4px 20px rgba(0,0,0,.07); margin-bottom: 48px;\r\n border-left: 5px solid var(--blue);\r\n }\r\n .dispositif h2 { font-family:'Sora',sans-serif; color: var(--blue-dark); font-size: 1.1em; margin-bottom: 14px; }\r\n .dispositif p { color: var(--muted); font-size: 0.9em; line-height: 1.75; margin-bottom: 12px; }\r\n \r\n .outil-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(160px, 1fr)); gap: 12px; margin-top: 20px; }\r\n .outil-card {\r\n background: #f8faff; border-radius: 12px; padding: 16px;\r\n border: 1px solid var(--border); text-align: center;\r\n }\r\n .outil-card .icon { font-size: 24px; margin-bottom: 8px; }\r\n .outil-card h3 { font-family:'Sora',sans-serif; font-size: 0.82em; color: var(--blue-dark); margin-bottom: 5px; font-weight: 700; }\r\n .outil-card p { font-size: 0.76em; color: var(--muted); line-height: 1.5; }\r\n \r\n \/* Section titre *\/\r\n .section-title {\r\n font-family:'Sora',sans-serif; font-size: 1.1em; color: var(--blue-dark);\r\n border-left: 5px solid var(--blue); padding-left: 15px;\r\n margin: 48px 0 24px; font-weight: 700;\r\n }\r\n \r\n \/* Article card *\/\r\n .article-card {\r\n background: white; border-radius: 16px; padding: 28px 30px;\r\n box-shadow: 0 4px 20px rgba(0,0,0,.07); margin-bottom: 24px;\r\n border-top: 3px solid var(--border); transition: box-shadow .2s;\r\n }\r\n .article-card:hover { box-shadow: 0 8px 30px rgba(30,64,175,.1); }\r\n \r\n .article-meta {\r\n display: flex; align-items: center; gap: 10px; margin-bottom: 12px; flex-wrap: wrap;\r\n }\r\n .article-num {\r\n background: var(--blue); color: white;\r\n font-family:'Sora',sans-serif; font-size: 0.7em; font-weight: 700;\r\n padding: 3px 11px; border-radius: 999px;\r\n }\r\n .article-source { font-size: 0.76em; color: var(--muted); font-weight: 600; }\r\n .article-date { font-size: 0.76em; color: #9ca3af; }\r\n \r\n .article-title {\r\n font-family:'Sora',sans-serif; font-size: 1em; font-weight: 700;\r\n color: var(--blue-dark); margin-bottom: 12px; line-height: 1.4;\r\n }\r\n .article-resume { font-size: 0.875em; color: var(--muted); line-height: 1.75; margin-bottom: 16px; }\r\n \r\n \/* Tags techniques *\/\r\n .tech-tags { display: flex; flex-wrap: wrap; gap: 6px; margin-bottom: 16px; }\r\n .tech-tag {\r\n font-family:'Sora',sans-serif; font-size: 10.5px; font-weight: 700;\r\n padding: 3px 10px; border-radius: 999px; border: 1px solid;\r\n }\r\n .tech-tag.red { background: #FEF2F2; color: var(--red); border-color: #FECACA; }\r\n .tech-tag.blue { background: #EFF6FF; color: var(--blue); border-color: #BFDBFE; }\r\n .tech-tag.green { background: #F0FDF4; color: var(--green); border-color: #BBF7D0; }\r\n .tech-tag.orange { background: #FFFBEB; color: var(--orange); border-color: #FDE68A; }\r\n \r\n \/* Analyse *\/\r\n .article-analyse {\r\n background: #f0f4ff; border-radius: 10px; padding: 16px 20px;\r\n border-left: 4px solid var(--blue); margin-bottom: 14px;\r\n }\r\n .article-analyse h4 {\r\n font-family:'Sora',sans-serif; font-size: 0.72em; font-weight: 700;\r\n color: var(--blue); margin-bottom: 6px; text-transform: uppercase; letter-spacing: 0.5px;\r\n }\r\n .article-analyse p { font-size: 0.85em; color: #374151; line-height: 1.65; }\r\n \r\n \/* Lien cours *\/\r\n .lien-cours {\r\n background: #f0fdf4; border-radius: 10px; padding: 14px 18px;\r\n border-left: 4px solid var(--green); margin-bottom: 14px;\r\n }\r\n .lien-cours h4 {\r\n font-family:'Sora',sans-serif; font-size: 0.72em; font-weight: 700;\r\n color: var(--green); margin-bottom: 6px; text-transform: uppercase; letter-spacing: 0.5px;\r\n }\r\n .lien-cours p { font-size: 0.85em; color: #166534; line-height: 1.65; }\r\n \r\n .article-link {\r\n display: inline-flex; align-items: center; gap: 5px;\r\n font-family:'Sora',sans-serif; font-size: 0.78em; color: var(--blue);\r\n text-decoration: none; font-weight: 700;\r\n }\r\n .article-link:hover { text-decoration: underline; }\r\n \r\n footer { text-align: center; padding: 30px; color: #9ca3af; font-size: 0.85em; }\r\n <\/style>\r\n<\/head>\r\n<body>\r\n \r\n<nav class=\"navbar\">\r\n <ul>\r\n <li><a href=\"\/\">Accueil<\/a><\/li>\r\n <li><a href=\"\/index.php\/ap\/\">AP<\/a><\/li>\r\n <li><a href=\"\/index.php\/activites\/\">Activit\u00e9s<\/a><\/li>\r\n <li><a href=\"\/index.php\/projets\/\">Projets<\/a><\/li>\r\n <li>\r\n <a href=\"\/index.php\/stages\/stages\/\">Stages \u25bc<\/a>\r\n <ul>\r\n <li><a href=\"\/index.php\/stages\/1ere-annee\/\">Stage 1\u00e8re ann\u00e9e<\/a><\/li>\r\n <li><a href=\"\/index.php\/stages\/2eme-annee\/\">Stage 2\u00e8me ann\u00e9e<\/a><\/li>\r\n <\/ul>\r\n <\/li>\r\n <li><a href=\"\/index.php\/veille\/\">Veille<\/a><\/li>\r\n <li><a href=\"\/index.php\/cv\/\">CV<\/a><\/li>\r\n <li><a href=\"\/index.php\/contact\/\">Contact<\/a><\/li>\r\n <li><a href=\"\/index.php\/competences\/\">Comp\u00e9tences<\/a><\/li>\r\n <li><a href=\"\/index.php\/certifications\/\">Certifications<\/a><\/li>\r\n <\/ul>\r\n<\/nav>\r\n \r\n<div class=\"spacer\"><\/div>\r\n \r\n<section class=\"hero\">\r\n <div class=\"hero-dots\"><\/div>\r\n <h1>Veille <span>Technologique<\/span><\/h1>\r\n <p>Sujet : Les ransomwares et les m\u00e9canismes techniques pour s'en prot\u00e9ger<\/p>\r\n<\/section>\r\n \r\n<div class=\"content\">\r\n \r\n \r\n <div class=\"dispositif\">\r\n <h2>Mon dispositif de veille<\/h2>\r\n <p>\r\n J'ai choisi ce sujet car il est directement li\u00e9 \u00e0 mon option SISR. En tant que futur administrateur syst\u00e8mes et r\u00e9seaux, je dois comprendre non seulement comment fonctionnent les ransomwares, mais surtout quels outils et architectures techniques permettent de s'en d\u00e9fendre. C'est exactement ce qu'on a mis en place en cours : pfSense, Suricata, ELK\/SIEM, segmentation r\u00e9seau, sauvegardes avec Bacula.\r\n <\/p>\r\n <p>\r\n Pour rester inform\u00e9, j'utilise plusieurs sources compl\u00e9mentaires, avec une pr\u00e9f\u00e9rence pour les contenus techniques plut\u00f4t que les articles grand public.\r\n <\/p>\r\n <div class=\"outil-grid\">\r\n <div class=\"outil-card\">\r\n <div class=\"icon\">\ud83d\udd14<\/div>\r\n <h3>Google Alertes<\/h3>\r\n <p>Mots-cl\u00e9s : \"ransomware Active Directory\", \"pfSense IDS ransomware\", \"SIEM detection\"<\/p>\r\n <\/div>\r\n <div class=\"outil-card\">\r\n <div class=\"icon\">\ud83d\udce1<\/div>\r\n <h3>ANSSI<\/h3>\r\n <p>Bulletins officiels, guides techniques et alertes de l'agence nationale de s\u00e9curit\u00e9<\/p>\r\n <\/div>\r\n <div class=\"outil-card\">\r\n <div class=\"icon\">\ud83d\udcf0<\/div>\r\n <h3>LeMagIT \/ ZDNet<\/h3>\r\n <p>Actualit\u00e9s et analyses techniques sur les cybermenaces et les solutions de protection<\/p>\r\n <\/div>\r\n <div class=\"outil-card\">\r\n <div class=\"icon\">\ud83d\udcac<\/div>\r\n <h3>Reddit \/ GitHub<\/h3>\r\n <p>r\/netsec, r\/cybersecurity et d\u00e9p\u00f4ts GitHub pour les retours d'exp\u00e9rience techniques<\/p>\r\n <\/div>\r\n <\/div>\r\n <\/div>\r\n \r\n <h2 class=\"section-title\">Articles et analyses techniques<\/h2>\r\n \r\n \r\n <div class=\"article-card\">\r\n <div class=\"article-meta\">\r\n <span class=\"article-num\">Article 1<\/span>\r\n <span class=\"article-source\">ANSSI \/ AVTIS<\/span>\r\n <span class=\"article-date\">2025<\/span>\r\n <\/div>\r\n <div class=\"article-title\">Active Directory : principale porte d'entr\u00e9e des ransomwares en 2025<\/div>\r\n <div class=\"tech-tags\">\r\n <span class=\"tech-tag red\">Active Directory<\/span>\r\n <span class=\"tech-tag blue\">GPO<\/span>\r\n <span class=\"tech-tag blue\">Comptes \u00e0 privil\u00e8ges<\/span>\r\n <span class=\"tech-tag orange\">Mouvement lat\u00e9ral<\/span>\r\n <\/div>\r\n <p class=\"article-resume\">\r\n Selon l'ANSSI, les intrusions via Active Directory ont augment\u00e9 de 37 % en un an. Les ransomwares ne ciblent plus directement les fichiers : ils compromettent d'abord un compte utilisateur standard, escaladent les privil\u00e8ges via des failles AD (Pass-the-Hash, Kerberoasting), puis se propagent lat\u00e9ralement sur tout le domaine avant de d\u00e9clencher le chiffrement. Une fois un compte administrateur de domaine compromis, l'attaquant peut d\u00e9ployer le ransomware sur toutes les machines en quelques minutes via GPO.\r\n <\/p>\r\n <div class=\"article-analyse\">\r\n <h4>Mon analyse technique<\/h4>\r\n <p>En cours, on a configur\u00e9 Active Directory avec des GPO et la gestion des droits utilisateurs. Cette attaque illustre pourquoi le principe du moindre privil\u00e8ge est critique : un utilisateur standard ne doit jamais avoir les droits administrateur local. La mise en place d'une politique de mots de passe robuste via GPO, la d\u00e9sactivation des comptes inutilis\u00e9s et la s\u00e9paration des comptes admin\/utilisateur sont des contremesures directes contre ce type d'attaque.<\/p>\r\n <\/div>\r\n <div class=\"lien-cours\">\r\n <h4>Lien avec mes activit\u00e9s<\/h4>\r\n <p>TP Windows Server (AD, GPO, habilitations) \u2014 Chapitre 6 PowerShell & Active Directory \u2014 Habilitation des comptes d'un domaine<\/p>\r\n <\/div>\r\n <a class=\"article-link\" href=\"https:\/\/avtis.fr\/cybersecurite-2025-les-nouvelles-attaques-ciblant-les-entreprises-francaises\/\" target=\"_blank\">Lire l'article complet \u2192<\/a>\r\n <\/div>\r\n \r\n \r\n <div class=\"article-card\">\r\n <div class=\"article-meta\">\r\n <span class=\"article-num\">Article 2<\/span>\r\n <span class=\"article-source\">IS Decisions<\/span>\r\n <span class=\"article-date\">Juillet 2025<\/span>\r\n <\/div>\r\n <div class=\"article-title\">Segmentation r\u00e9seau par VLANs : comment limiter la propagation des ransomwares<\/div>\r\n <div class=\"tech-tags\">\r\n <span class=\"tech-tag blue\">VLAN<\/span>\r\n <span class=\"tech-tag blue\">pfSense<\/span>\r\n <span class=\"tech-tag blue\">DMZ<\/span>\r\n <span class=\"tech-tag orange\">Mouvement lat\u00e9ral<\/span>\r\n <\/div>\r\n <p class=\"article-resume\">\r\n Une des principales raisons pour lesquelles les ransomwares se propagent rapidement dans un r\u00e9seau est l'absence de segmentation. Sans VLANs, une machine compromise peut atteindre tous les autres \u00e9quipements du r\u00e9seau. La segmentation par VLANs coupl\u00e9e \u00e0 des r\u00e8gles de filtrage strictes sur un pare-feu comme pfSense permet de contenir l'attaque dans un seul segment. Selon l'ANSSI, une PME qui segmente correctement son r\u00e9seau r\u00e9duit de 85 % le p\u00e9rim\u00e8tre accessible en cas de compromission d'un poste.\r\n <\/p>\r\n <div class=\"article-analyse\">\r\n <h4>Mon analyse technique<\/h4>\r\n <p>On a configur\u00e9 pfSense avec des VLANs et des r\u00e8gles ACL en cours. Concr\u00e8tement, si un poste client est infect\u00e9 dans le VLAN 10 (utilisateurs), les r\u00e8gles pfSense bloquent toute communication vers le VLAN 20 (serveurs) et le VLAN 30 (sauvegardes). Le ransomware reste donc isol\u00e9 au segment compromis. La DMZ isole \u00e9galement les serveurs accessibles depuis internet pour \u00e9viter qu'ils ne deviennent un vecteur d'attaque interne.<\/p>\r\n <\/div>\r\n <div class=\"lien-cours\">\r\n <h4>Lien avec mes activit\u00e9s<\/h4>\r\n <p>TP Cisco (VLANs, ACL, routage inter-VLAN) \u2014 Cluster pfSense HA\/CARP \u2014 AP3 Port de Cherbourg (DMZ, VLAN, IDS)<\/p>\r\n <\/div>\r\n <a class=\"article-link\" href=\"https:\/\/www.isdecisions.com\/fr\/blog\/securite-des-donnees\/comment-proteger-active-directory-contre-ransomwares\" target=\"_blank\">Lire l'article complet \u2192<\/a>\r\n <\/div>\r\n \r\n \r\n <div class=\"article-card\">\r\n <div class=\"article-meta\">\r\n <span class=\"article-num\">Article 3<\/span>\r\n <span class=\"article-source\">OpenNix \/ Culpur.net<\/span>\r\n <span class=\"article-date\">2025-2026<\/span>\r\n <\/div>\r\n <div class=\"article-title\">Suricata IDS\/IPS sur pfSense : d\u00e9tecter les comportements ransomware en temps r\u00e9el<\/div>\r\n <div class=\"tech-tags\">\r\n <span class=\"tech-tag red\">Suricata<\/span>\r\n <span class=\"tech-tag blue\">pfSense<\/span>\r\n <span class=\"tech-tag blue\">IDS\/IPS<\/span>\r\n <span class=\"tech-tag green\">D\u00e9tection temps r\u00e9el<\/span>\r\n <\/div>\r\n <p class=\"article-resume\">\r\n Suricata, int\u00e9gr\u00e9 \u00e0 pfSense, analyse le trafic r\u00e9seau en temps r\u00e9el et compare les flux aux signatures d'attaques connues. En mode IPS (inline), il peut bloquer automatiquement les paquets malveillants. Les r\u00e8gles Emerging Threats couvrent notamment les communications C2 (Command & Control) des ransomwares. Les logs sont g\u00e9n\u00e9r\u00e9s au format EVE JSON, un format structur\u00e9 facilement int\u00e9grable dans un SIEM comme ELK ou Wazuh pour la corr\u00e9lation d'\u00e9v\u00e9nements.\r\n <\/p>\r\n <div class=\"article-analyse\">\r\n <h4>Mon analyse technique<\/h4>\r\n <p>On a d\u00e9ploy\u00e9 Suricata en cours dans le cadre de la s\u00e9curisation du SI. Concr\u00e8tement, un ransomware qui tente de contacter son serveur C2 via HTTP\/HTTPS g\u00e9n\u00e8re un trafic anormal d\u00e9tectable par les r\u00e8gles de signatures. En mode IPS, pfSense peut dropper ces paquets automatiquement. La configuration du format EVE JSON permet ensuite d'envoyer les alertes vers ELK pour les visualiser et cr\u00e9er des tableaux de bord de d\u00e9tection.<\/p>\r\n <\/div>\r\n <div class=\"lien-cours\">\r\n <h4>Lien avec mes activit\u00e9s<\/h4>\r\n <p>S\u00e9curisation SI (pfSense, Stormshield, Suricata, ELK\/SIEM) \u2014 AP3 Port de Cherbourg (IDS)<\/p>\r\n <\/div>\r\n <a class=\"article-link\" href=\"https:\/\/culpur.net\/2026\/03\/31\/deploying-suricata-ids-behind-pfsense-network-intrusion-detection-for-self-hosted-infrastructure\/\" target=\"_blank\">Lire l'article complet \u2192<\/a>\r\n <\/div>\r\n \r\n \r\n <div class=\"article-card\">\r\n <div class=\"article-meta\">\r\n <span class=\"article-num\">Article 4<\/span>\r\n <span class=\"article-source\">ES Protect \/ ANSSI<\/span>\r\n <span class=\"article-date\">2025-2026<\/span>\r\n <\/div>\r\n <div class=\"article-title\">La r\u00e8gle 3-2-1 et les sauvegardes air-gapped : seule protection r\u00e9elle contre le chiffrement<\/div>\r\n <div class=\"tech-tags\">\r\n <span class=\"tech-tag green\">Bacula<\/span>\r\n <span class=\"tech-tag green\">PRA\/PCA<\/span>\r\n <span class=\"tech-tag green\">Sauvegarde air-gapped<\/span>\r\n <span class=\"tech-tag orange\">Chiffrement ransomware<\/span>\r\n <\/div>\r\n <p class=\"article-resume\">\r\n La r\u00e8gle 3-2-1 reste la meilleure protection contre les ransomwares : 3 copies des donn\u00e9es, sur 2 supports diff\u00e9rents, avec 1 copie hors site. La variante 3-2-1-1 ajoute une copie \"air-gapped\", c'est-\u00e0-dire d\u00e9connect\u00e9e du r\u00e9seau, inaccessible depuis internet. Cette pr\u00e9caution a sauv\u00e9 des centaines d'entreprises lors de la vague NotPetya. Une sauvegarde isol\u00e9e dans un VLAN d\u00e9di\u00e9 sans acc\u00e8s internet (comme un VLAN 60 bloqu\u00e9 par pfSense) offre une protection \u00e9quivalente en environnement virtualis\u00e9.\r\n <\/p>\r\n <div class=\"article-analyse\">\r\n <h4>Mon analyse technique<\/h4>\r\n <p>En cours, on a mis en place Bacula pour la sauvegarde client\/serveur. Pour r\u00e9sister aux ransomwares, la sauvegarde doit \u00eatre dans un VLAN isol\u00e9, sans acc\u00e8s bidirectionnel : le serveur de sauvegarde peut acc\u00e9der aux clients, mais pas l'inverse. Un ransomware qui compromet un serveur ne peut pas atteindre les sauvegardes. La planification des sauvegardes (quotidienne, hebdomadaire) et les tests de restauration r\u00e9guliers sont aussi essentiels.<\/p>\r\n <\/div>\r\n <div class=\"lien-cours\">\r\n <h4>Lien avec mes activit\u00e9s<\/h4>\r\n <p>Chapitre 2 \u2013 Sauvegarde client\/serveur avec Bacula \u2014 Cluster pfSense HA\/CARP (isolation r\u00e9seau) \u2014 VMware vCenter (PRA\/PCA)<\/p>\r\n <\/div>\r\n <a class=\"article-link\" href=\"https:\/\/esprotect.fr\/cybersecurite\/bonnes-pratiques-securiser-reseau-informatique\/\" target=\"_blank\">Lire l'article complet \u2192<\/a>\r\n <\/div>\r\n \r\n \r\n <div class=\"article-card\">\r\n <div class=\"article-meta\">\r\n <span class=\"article-num\">Article 5<\/span>\r\n <span class=\"article-source\">Gridinsoft \/ Datasecuritybreach<\/span>\r\n <span class=\"article-date\">2025<\/span>\r\n <\/div>\r\n <div class=\"article-title\">Triple extorsion et destruction des donn\u00e9es : l'\u00e9volution technique des ransomwares en 2025<\/div>\r\n <div class=\"tech-tags\">\r\n <span class=\"tech-tag red\">Triple extorsion<\/span>\r\n <span class=\"tech-tag red\">Chiffrement AES\/RSA<\/span>\r\n <span class=\"tech-tag red\">Exfiltration<\/span>\r\n <span class=\"tech-tag orange\">LockBit 4.0<\/span>\r\n <\/div>\r\n <p class=\"article-resume\">\r\n En 2025, les ransomwares ont \u00e9volu\u00e9 vers un mod\u00e8le de triple extorsion : chiffrement des donn\u00e9es (AES-256 + RSA-4096 pour la cl\u00e9), exfiltration et menace de publication, puis attaques DDoS sur l'infrastructure de la victime pour forcer le paiement. LockBit 4.0 int\u00e8gre d\u00e9sormais des vitesses de chiffrement optimis\u00e9es par multithreading. Les wipers (HermeticWiper, CaddyWiper) vont plus loin en d\u00e9truisant les donn\u00e9es de fa\u00e7on irr\u00e9versible. 86 % des attaques de 2024 ont entra\u00een\u00e9 des interruptions op\u00e9rationnelles majeures.\r\n <\/p>\r\n <div class=\"article-analyse\">\r\n <h4>Mon analyse technique<\/h4>\r\n <p>La combinaison AES (chiffrement sym\u00e9trique des donn\u00e9es) + RSA (chiffrement de la cl\u00e9 AES) utilis\u00e9e par les ransomwares modernes est math\u00e9matiquement incassable sans la cl\u00e9 priv\u00e9e. Cela rend les sauvegardes encore plus critiques. La d\u00e9tection pr\u00e9coce via un SIEM (ELK) est essentielle : une augmentation anormale des op\u00e9rations d'\u00e9criture sur le syst\u00e8me de fichiers ou des connexions vers des IPs inconnues sont des indicateurs de compromission (IoC) d\u00e9tectables avant le chiffrement complet.<\/p>\r\n <\/div>\r\n <div class=\"lien-cours\">\r\n <h4>Lien avec mes activit\u00e9s<\/h4>\r\n <p>S\u00e9curisation SI (ELK\/SIEM, Kali Linux) \u2014 Stormshield VPN (chiffrement des communications) \u2014 Lab 12 & 13 VPN IPsec PKI (chiffrement asym\u00e9trique)<\/p>\r\n <\/div>\r\n <a class=\"article-link\" href=\"https:\/\/fr.gridinsoft.com\/article\/ransomware\" target=\"_blank\">Lire l'article complet \u2192<\/a>\r\n <\/div>\r\n \r\n \r\n <div class=\"article-card\">\r\n <div class=\"article-meta\">\r\n <span class=\"article-num\">Article 6<\/span>\r\n <span class=\"article-source\">Hornetsecurity \/ ES Protect<\/span>\r\n <span class=\"article-date\">2025<\/span>\r\n <\/div>\r\n <div class=\"article-title\">SIEM et ELK : centralisation des logs pour d\u00e9tecter une attaque ransomware avant qu'elle n'\u00e9clate<\/div>\r\n <div class=\"tech-tags\">\r\n <span class=\"tech-tag blue\">ELK \/ Elasticsearch<\/span>\r\n <span class=\"tech-tag blue\">SIEM<\/span>\r\n <span class=\"tech-tag green\">Kibana<\/span>\r\n <span class=\"tech-tag green\">Corr\u00e9lation d'\u00e9v\u00e9nements<\/span>\r\n <\/div>\r\n <p class=\"article-resume\">\r\n Un SIEM (Security Information and Event Management) comme la stack ELK (Elasticsearch, Logstash, Kibana) centralise les logs de tous les \u00e9quipements (pare-feu pfSense, serveurs Windows\/Linux, Suricata) et permet de corr\u00e9ler des \u00e9v\u00e9nements qui semblent anodins s\u00e9par\u00e9ment mais r\u00e9v\u00e8lent une attaque combin\u00e9s. Par exemple : un \u00e9chec d'authentification RDP suivi d'une connexion r\u00e9ussie depuis une IP externe, puis une augmentation des \u00e9critures disque \u2014 ces trois \u00e9v\u00e9nements corr\u00e9l\u00e9s indiquent une compromission en cours. Les entreprises qui d\u00e9tectent et isolent une machine dans les 30 premi\u00e8res minutes contiennent l'incident dans 78 % des cas.\r\n <\/p>\r\n <div class=\"article-analyse\">\r\n <h4>Mon analyse technique<\/h4>\r\n <p>En cours, on a d\u00e9ploy\u00e9 ELK\/SIEM pour centraliser les logs et cr\u00e9er des alertes. La puissance du SIEM r\u00e9side dans la corr\u00e9lation : Logstash ing\u00e8re les logs EVE JSON de Suricata, les journaux Windows Event (connexions, GPO), les logs pfSense. Kibana permet de cr\u00e9er des dashboards et des r\u00e8gles d'alerte automatiques. Par exemple, une r\u00e8gle qui d\u00e9clenche une alerte si plus de 1000 fichiers sont modifi\u00e9s en moins de 5 minutes peut d\u00e9tecter un ransomware en phase de chiffrement.<\/p>\r\n <\/div>\r\n <div class=\"lien-cours\">\r\n <h4>Lien avec mes activit\u00e9s<\/h4>\r\n <p>S\u00e9curisation SI (pfSense, Stormshield, Suricata, ELK\/SIEM, Kali Linux) \u2014 Outil de supervision Zabbix\/Centreon \u2014 Scripts Shell Linux (automatisation des logs)<\/p>\r\n <\/div>\r\n <a class=\"article-link\" href=\"https:\/\/www.hornetsecurity.com\/fr\/blog\/statistiques-ransomwares\/\" target=\"_blank\">Lire l'article complet \u2192<\/a>\r\n <\/div>\r\n \r\n<\/div>\r\n \r\n<footer>Copyright \u00a9 2026 | Nathan Vitter \u2013 BTS SIO SISR \u2013 Lyc\u00e9e Saint-Exup\u00e9ry<\/footer>\r\n \r\n<\/body>\r\n<\/html>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Veille Technologique \u2013 Nathan Vitter Accueil AP Activit\u00e9s Projets Stages \u25bc Stage 1\u00e8re ann\u00e9e Stage 2\u00e8me ann\u00e9e Veille CV Contact […]<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"site-sidebar-layout":"no-sidebar","site-content-layout":"","ast-site-content-layout":"full-width-container","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"disabled","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"class_list":["post-596","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/nathanvitter.fr\/index.php\/wp-json\/wp\/v2\/pages\/596","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nathanvitter.fr\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/nathanvitter.fr\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/nathanvitter.fr\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nathanvitter.fr\/index.php\/wp-json\/wp\/v2\/comments?post=596"}],"version-history":[{"count":13,"href":"https:\/\/nathanvitter.fr\/index.php\/wp-json\/wp\/v2\/pages\/596\/revisions"}],"predecessor-version":[{"id":772,"href":"https:\/\/nathanvitter.fr\/index.php\/wp-json\/wp\/v2\/pages\/596\/revisions\/772"}],"wp:attachment":[{"href":"https:\/\/nathanvitter.fr\/index.php\/wp-json\/wp\/v2\/media?parent=596"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}