[{"id":355,"title":"Unicorn Sosyal M\u00fchendisli\u011fin Sihirli Arac\u0131","content":"<p><iframe style=\"width: 776px; height: 435px;\" src=\"https:\/\/www.youtube.com\/embed\/5afj34PKCSo\" width=\"776\" height=\"435\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\n<h1>Sessiz Tehdit: Unicorn ve Office Makrolar\u0131yla Gelen Siber Sald\u0131r\u0131lar<\/h1>\n<p>Siber sald\u0131r\u0131lar\u0131n giderek daha <strong>basit ama daha etkili<\/strong> h&acirc;le geldi\u011fi bir d&ouml;nemdeyiz. Art\u0131k karma\u015f\u0131k exploit zincirlerine gerek kalmadan, yaln\u0131zca <strong>bir Microsoft Office belgesi<\/strong> &uuml;zerinden kurum a\u011flar\u0131na s\u0131zmak m&uuml;mk&uuml;n. Bu noktada &ouml;ne &ccedil;\u0131kan ara&ccedil;lardan biri de <strong>Unicorn<\/strong>.<\/p>\n<p>Unicorn, siber sald\u0131rganlar\u0131n g&uuml;&ccedil;l&uuml; <strong>PowerShell betiklerini<\/strong>, masum gibi g&ouml;r&uuml;nen bir <strong>Office makrosu<\/strong> i&ccedil;ine gizlemesine imk&acirc;n tan\u0131r. Kullan\u0131c\u0131 a&ccedil;\u0131s\u0131ndan bak\u0131ld\u0131\u011f\u0131nda ortada yaln\u0131zca bir Word ya da Excel dosyas\u0131 vard\u0131r. Ancak perde arkas\u0131nda, sistemin kontrol&uuml;n&uuml; ele ge&ccedil;irmeye y&ouml;nelik ciddi bir sald\u0131r\u0131 ba\u015flat\u0131l\u0131r.<\/p>\n<hr>\n<h2>Unicorn Nas\u0131l &Ccedil;al\u0131\u015f\u0131r?<\/h2>\n<p>Unicorn&rsquo;un &ccedil;al\u0131\u015fma mant\u0131\u011f\u0131 teknik olarak karma\u015f\u0131k de\u011fildir; ancak etkisi olduk&ccedil;a y\u0131k\u0131c\u0131d\u0131r:<\/p>\n<ol>\n<li>\n<p><strong>Oltalama (Phishing)<\/strong><br>Kurban, genellikle e-posta yoluyla g&ouml;nderilen bir Office dosyas\u0131n\u0131 a&ccedil;ar.<\/p>\n<\/li>\n<li>\n<p><strong>Makrolar\u0131n Etkinle\u015ftirilmesi<\/strong><br>&ldquo;\u0130&ccedil;eri\u011fi g&ouml;r&uuml;nt&uuml;lemek i&ccedil;in makrolar\u0131 etkinle\u015ftirin&rdquo; uyar\u0131s\u0131, sosyal m&uuml;hendisli\u011fin klasik ama h&acirc;l&acirc; en etkili y&ouml;ntemlerinden biridir.<\/p>\n<\/li>\n<li>\n<p><strong>Arka Planda PowerShell &Ccedil;al\u0131\u015ft\u0131r\u0131lmas\u0131<\/strong><br>Makro etkinle\u015ftirildi\u011fi anda, gizlenmi\u015f PowerShell komutlar\u0131 sessizce &ccedil;al\u0131\u015f\u0131r.<\/p>\n<\/li>\n<li>\n<p><strong>Kod Karma\u015f\u0131kla\u015ft\u0131rma (Obfuscation)<\/strong><br>Zararl\u0131 kod, imza tabanl\u0131 antivir&uuml;s sistemlerinden ka&ccedil;acak \u015fekilde karma\u015f\u0131kla\u015ft\u0131r\u0131lm\u0131\u015ft\u0131r.<\/p>\n<\/li>\n<\/ol>\n<p>Sonu&ccedil; olarak kullan\u0131c\u0131 hi&ccedil;bir \u015fey fark etmezken, sald\u0131rgan sistem &uuml;zerinde komut &ccedil;al\u0131\u015ft\u0131rabilir, arka kap\u0131 b\u0131rakabilir veya a\u011f i&ccedil;inde yatay hareket edebilir.<\/p>\n<hr>\n<h2>Neden Unicorn Bu Kadar Tehlikeli?<\/h2>\n<p>Unicorn&rsquo;u tehlikeli yapan \u015fey s\u0131f\u0131r g&uuml;n a&ccedil;\u0131klar\u0131 de\u011fil; <strong>insan davran\u0131\u015f\u0131n\u0131 hedef almas\u0131d\u0131r<\/strong>.<\/p>\n<ul>\n<li>\n<p>Office dosyalar\u0131 h&acirc;l&acirc; en &ccedil;ok g&uuml;venilen dosya t&uuml;rleri aras\u0131nda<\/p>\n<\/li>\n<li>\n<p>PowerShell, Windows&rsquo;un yerle\u015fik ve g&uuml;&ccedil;l&uuml; bir bile\u015feni<\/p>\n<\/li>\n<li>\n<p>Makrolar, bir&ccedil;ok kurumda h&acirc;l&acirc; aktif<\/p>\n<\/li>\n<\/ul>\n<p>Bu &uuml;&ccedil;l&uuml; bir araya geldi\u011finde, sald\u0131r\u0131 <strong>me\u015fru bir i\u015flem gibi<\/strong> g&ouml;r&uuml;n&uuml;r.<\/p>\n<hr>\n<h2>En Zay\u0131f Halka: \u0130nsan Fakt&ouml;r&uuml;<\/h2>\n<p>Teknik &ouml;nlemler ne kadar g&uuml;&ccedil;l&uuml; olursa olsun, sald\u0131r\u0131n\u0131n ilk ad\u0131m\u0131 genellikle ayn\u0131d\u0131r:<\/p>\n<blockquote>\n<p><strong>&ldquo;Kullan\u0131c\u0131 dosyay\u0131 a&ccedil;t\u0131.&rdquo;<\/strong><\/p>\n<\/blockquote>\n<p>Bu nedenle makalelerde ve ger&ccedil;ek vaka analizlerinde tekrar tekrar vurgulanan nokta \u015fudur:<br><strong>En zay\u0131f halka h&acirc;l&acirc; insand\u0131r.<\/strong><\/p>\n<hr>\n<h2>Unicorn ve Benzeri Sald\u0131r\u0131lara Kar\u015f\u0131 Al\u0131nabilecek &Ouml;nlemler<\/h2>\n<h3>1. Kullan\u0131c\u0131 Fark\u0131ndal\u0131k E\u011fitimi<\/h3>\n<ul>\n<li>\n<p>Phishing e-postalar\u0131n\u0131n nas\u0131l ay\u0131rt edilece\u011fi<\/p>\n<\/li>\n<li>\n<p>Makro uyar\u0131lar\u0131n\u0131n neden tehlikeli oldu\u011fu<\/p>\n<\/li>\n<li>\n<p>&ldquo;Acil&rdquo;, &ldquo;fatura&rdquo;, &ldquo;kargo&rdquo; gibi tetikleyici ba\u015fl\u0131klara kar\u015f\u0131 dikkat<\/p>\n<\/li>\n<\/ul>\n<p>E\u011fitim, tek seferlik de\u011fil <strong>s&uuml;rekli<\/strong> olmal\u0131d\u0131r.<\/p>\n<hr>\n<h3>&nbsp;2. Office Makrolar\u0131n\u0131 Devre D\u0131\u015f\u0131 B\u0131rakma<\/h3>\n<p>Kurumsal ortamlarda:<\/p>\n<ul>\n<li>\n<p>\u0130nternetten gelen Office belgelerinde makrolar\u0131 varsay\u0131lan olarak kapatmak<\/p>\n<\/li>\n<li>\n<p>Sadece imzal\u0131 ve g&uuml;venilir makrolara izin vermek<\/p>\n<\/li>\n<\/ul>\n<p>Bu ad\u0131m, Unicorn gibi ara&ccedil;lar\u0131n etkisini ciddi &ouml;l&ccedil;&uuml;de azalt\u0131r.<\/p>\n<hr>\n<h3>&nbsp;3. Uygulama Kontrol&uuml; (AppLocker vb.)<\/h3>\n<ul>\n<li>\n<p>Yetkisiz PowerShell &ccedil;al\u0131\u015ft\u0131r\u0131lmas\u0131n\u0131 k\u0131s\u0131tlamak<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131c\u0131 ba\u011flam\u0131nda script &ccedil;al\u0131\u015ft\u0131rmay\u0131 s\u0131n\u0131rlamak<\/p>\n<\/li>\n<li>\n<p>Sadece onayl\u0131 uygulamalara izin vermek<\/p>\n<\/li>\n<\/ul>\n<p>Bu yakla\u015f\u0131m, sald\u0131r\u0131 ba\u015far\u0131l\u0131 olsa bile <strong>etki alan\u0131n\u0131 daralt\u0131r<\/strong>.<\/p>\n<hr>\n<h2>Teknoloji De\u011fil, Al\u0131\u015fkanl\u0131klar Hedefte<\/h2>\n<p>Unicorn &ouml;rne\u011fi bize \u015funu net \u015fekilde g&ouml;steriyor:<\/p>\n<blockquote>\n<p><strong>Siber sald\u0131r\u0131lar art\u0131k sistemi de\u011fil, kullan\u0131c\u0131y\u0131 hack&rsquo;liyor.<\/strong><\/p>\n<\/blockquote>\n<p>G&uuml;venlik;<\/p>\n<ul>\n<li>\n<p>Sadece firewall,<\/p>\n<\/li>\n<li>\n<p>Sadece antivir&uuml;s,<\/p>\n<\/li>\n<li>\n<p>Sadece EDR de\u011fildir.<\/p>\n<\/li>\n<\/ul>\n<p>Ger&ccedil;ek g&uuml;venlik, <strong>fark\u0131ndal\u0131k + politika + teknik kontrol<\/strong> birle\u015fimidir.<\/p>\n<p>Makrolar, PowerShell ve insan davran\u0131\u015f\u0131 bir araya geldi\u011finde olu\u015fan bu sessiz tehdidi ciddiye almak, bug&uuml;n al\u0131nabilecek en do\u011fru kararlardan biridir.<\/p>","excerpt":"","created_at":"2025-11-28 09:07:55","updated_at":"2026-09-07 20:39:28","category_id":15,"view_count":470,"reading_time":4,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-11-28 06:07:00","featured_image":"9f66b0a47cf70f8d4b8e4eafd7b09a07.png","slug":"unicorn-sosyal-muhendisligin-sihirli-araci","category_name":"Bilgi G\u00fcvenligi","category_slug":"bilgi-guvenligi","category_color":"#894376"},{"id":354,"title":"Web Kimlik Do\u011frulama Temelleri Nas\u0131l \u00c7al\u0131\u015f\u0131r","content":"<p>&nbsp;<\/p>\n<p><iframe style=\"width: 786px; height: 441px;\" src=\"https:\/\/www.youtube.com\/embed\/TMiLTv7BSXw\" width=\"786\" height=\"441\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\n<p>&nbsp;<\/p>\n<h1>Bir Web Sitesi Seni Nas\u0131l &ldquo;Hat\u0131rlar&rdquo;?<\/h1>\n<h2>Cookie, Session ve Token Mant\u0131\u011f\u0131n\u0131 Basit&ccedil;e Anlayal\u0131m<\/h2>\n<p>&nbsp;<\/p>\n<p>Bir web sitesine giri\u015f yapt\u0131\u011f\u0131nda seni <strong>isminle kar\u015f\u0131layan<\/strong>,<br>sepetteki &uuml;r&uuml;nleri <strong>kald\u0131\u011f\u0131n yerden g&ouml;steren<\/strong><br>veya tekrar \u015fifre sormadan gezmene izin veren sistem hi&ccedil; dikkatini &ccedil;ekti mi?<\/p>\n<blockquote>\n<p>&ldquo;Bu site beni nas\u0131l hat\u0131rl\u0131yor?&rdquo;<br>&ldquo;Taray\u0131c\u0131y\u0131 kapatsam bile neden h&acirc;l&acirc; giri\u015f yapm\u0131\u015f g&ouml;r&uuml;n&uuml;yorum?&rdquo;<br>&ldquo;G&uuml;venli bir oturum nas\u0131l sa\u011flan\u0131yor?&rdquo;<\/p>\n<\/blockquote>\n<p>Bu sorular\u0131n cevab\u0131 genellikle <strong>&uuml;&ccedil; temel yap\u0131n\u0131n<\/strong> i&ccedil;inde gizlidir:<\/p>\n<p><strong>Cookie<\/strong><br><strong>Session<\/strong><br><strong>Token<\/strong><\/p>\n<p>Bu yaz\u0131da bu kavramlar\u0131 <strong>insani, sade ve SEO uyumlu<\/strong> bir dille;<br>karma\u015faya girmeden ama mant\u0131\u011f\u0131n\u0131 ka&ccedil;\u0131rmadan anlataca\u011f\u0131z.<\/p>\n<hr>\n<h2>Web Neden Seni Hat\u0131rlamak Zorunda?<\/h2>\n<p>HTTP protokol&uuml;n&uuml;n temel bir &ouml;zelli\u011fi vard\u0131r:<\/p>\n<blockquote>\n<p><strong>Stateless<\/strong> (durumsuzdur)<\/p>\n<\/blockquote>\n<p>Yani:<\/p>\n<ul>\n<li>\n<p>Her istek ba\u011f\u0131ms\u0131zd\u0131r<\/p>\n<\/li>\n<li>\n<p>Sunucu, bir &ouml;nceki iste\u011fi &ldquo;hat\u0131rlamaz&rdquo;<\/p>\n<\/li>\n<\/ul>\n<p>Bu y&uuml;zden taray\u0131c\u0131 ile sunucu aras\u0131nda bir <strong>haf\u0131za mekanizmas\u0131<\/strong> gerekir.<br>\u0130\u015fte Cookie, Session ve Token tam olarak bu bo\u015flu\u011fu doldurur.<\/p>\n<hr>\n<h2>Cookie (&Ccedil;erez) Nedir?<\/h2>\n<p><strong>Cookie<\/strong>, taray\u0131c\u0131da saklanan k&uuml;&ccedil;&uuml;k veri par&ccedil;ac\u0131klar\u0131d\u0131r.<\/p>\n<ul>\n<li>\n<p>Kullan\u0131c\u0131 taraf\u0131nda tutulur<\/p>\n<\/li>\n<li>\n<p>Her istekte sunucuya otomatik g&ouml;nderilir<\/p>\n<\/li>\n<li>\n<p>Genellikle anahtar&ndash;de\u011fer (key=value) yap\u0131s\u0131ndad\u0131r<\/p>\n<\/li>\n<\/ul>\n<h3>Ne \u0130\u015fe Yarar?<\/h3>\n<ul>\n<li>\n<p>Oturum bilgisi ta\u015f\u0131mak<\/p>\n<\/li>\n<li>\n<p>Kullan\u0131c\u0131 tercihlerini hat\u0131rlamak<\/p>\n<\/li>\n<li>\n<p>Dil, tema, sepet bilgisi saklamak<\/p>\n<\/li>\n<\/ul>\n<h3>Avantajlar\u0131<\/h3>\n<p>\u2714 Basit<br>\u2714 H\u0131zl\u0131<br>\u2714 Taray\u0131c\u0131 taraf\u0131ndan otomatik y&ouml;netilir<\/p>\n<h3>Riskleri<\/h3>\n<p>\u26a0\ufe0f XSS sald\u0131r\u0131lar\u0131nda &ccedil;al\u0131nabilir<br>\u26a0\ufe0f Yanl\u0131\u015f yap\u0131land\u0131r\u0131l\u0131rsa g&uuml;venlik a&ccedil;\u0131\u011f\u0131 olu\u015fturur<\/p>\n<blockquote>\n<p><strong>Not:<\/strong><br>Cookie i&ccedil;ine <strong>\u015fifre veya hassas veri<\/strong> koymak ciddi bir hatad\u0131r.<\/p>\n<\/blockquote>\n<hr>\n<h2>Session (Oturum) Nedir?<\/h2>\n<p><img src=\"https:\/\/images.wondershare.com\/edrawmax\/templates\/communication-diagram-for-login.png?utm_source=chatgpt.com\" alt=\"Image\" width=\"716\" height=\"412\"><\/p>\n<p><strong>Session<\/strong>, kullan\u0131c\u0131n\u0131n kimli\u011finin <strong>sunucu taraf\u0131nda<\/strong> tutuldu\u011fu yap\u0131d\u0131r.<\/p>\n<p>&Ccedil;al\u0131\u015fma mant\u0131\u011f\u0131 \u015f&ouml;yledir:<\/p>\n<ol>\n<li>\n<p>Kullan\u0131c\u0131 giri\u015f yapar<\/p>\n<\/li>\n<li>\n<p>Sunucu bir <strong>Session ID<\/strong> &uuml;retir<\/p>\n<\/li>\n<li>\n<p>Bu ID, kullan\u0131c\u0131ya cookie olarak g&ouml;nderilir<\/p>\n<\/li>\n<li>\n<p>As\u0131l bilgiler sunucuda saklan\u0131r<\/p>\n<\/li>\n<\/ol>\n<p>Yani:<\/p>\n<ul>\n<li>\n<p>Cookie &rarr; Sadece bir anahtar<\/p>\n<\/li>\n<li>\n<p>Session &rarr; Ger&ccedil;ek verinin kendisi<\/p>\n<\/li>\n<\/ul>\n<h3>Avantajlar\u0131<\/h3>\n<p>\u2714 Daha g&uuml;venlidir<br>\u2714 Hassas veri taray\u0131c\u0131da tutulmaz<\/p>\n<h3>Dezavantajlar\u0131<\/h3>\n<p>Sunucu y&uuml;k&uuml; olu\u015fturur<br>Da\u011f\u0131t\u0131k sistemlerde &ouml;l&ccedil;ekleme zordur<\/p>\n<p>Session yap\u0131s\u0131, &ouml;zellikle <strong>klasik PHP \/ ASP.NET \/ Java<\/strong> tabanl\u0131 uygulamalarda &ccedil;ok yayg\u0131nd\u0131r.<\/p>\n<hr>\n<h2>Token Nedir?<\/h2>\n<p><img src=\"https:\/\/media.geeksforgeeks.org\/wp-content\/uploads\/20240129170011\/Low-Level-Design-%281%29.png?utm_source=chatgpt.com\" alt=\"Image\" width=\"610\" height=\"305\"><\/p>\n<p><strong>Token<\/strong>, modern web ve mobil uygulamalar\u0131n vazge&ccedil;ilmezidir.<\/p>\n<p>En yayg\u0131n &ouml;rnek:<\/p>\n<ul>\n<li>\n<p><strong>JWT (JSON Web Token)<\/strong><\/p>\n<\/li>\n<\/ul>\n<h3>Nas\u0131l &Ccedil;al\u0131\u015f\u0131r?<\/h3>\n<ul>\n<li>\n<p>Kullan\u0131c\u0131 giri\u015f yapar<\/p>\n<\/li>\n<li>\n<p>Sunucu imzal\u0131 bir token &uuml;retir<\/p>\n<\/li>\n<li>\n<p>Token istemciye verilir<\/p>\n<\/li>\n<li>\n<p>Her istekte token g&ouml;nderilir<\/p>\n<\/li>\n<li>\n<p>Sunucu token&rsquo;\u0131 do\u011frular<\/p>\n<\/li>\n<\/ul>\n<p>Burada kritik nokta:<\/p>\n<blockquote>\n<p>Sunucu genellikle <strong>oturum saklamaz<\/strong>, sadece do\u011frular.<\/p>\n<\/blockquote>\n<h3>Avantajlar\u0131<\/h3>\n<p>\u2714 Stateless (&ouml;l&ccedil;eklenebilir)<br>\u2714 API ve mobil uygulamalar i&ccedil;in ideal<br>\u2714 Mikroservis mimarisine uygun<\/p>\n<h3>Riskleri<\/h3>\n<p>\u26a0\ufe0f &Ccedil;al\u0131n\u0131rsa s&uuml;resi bitene kadar ge&ccedil;erlidir<br>\u26a0\ufe0f G&uuml;venli saklanmazsa b&uuml;y&uuml;k risk olu\u015fturur<\/p>\n<hr>\n<h2>Cookie &ndash; Session &ndash; Token Kar\u015f\u0131la\u015ft\u0131rmas\u0131<\/h2>\n<p><strong><img src=\"https:\/\/miro.medium.com\/v2\/resize%3Afit%3A2000\/1%2AKzrxQ5xubPBVYkSIMnixAA.jpeg?utm_source=chatgpt.com\" alt=\"Image\" width=\"609\" height=\"658\"><\/strong><\/p>\n<table>\n<thead>\n<tr>\n<th>&Ouml;zellik<\/th>\n<th>Cookie<\/th>\n<th>Session<\/th>\n<th>Token<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Nerede tutulur<\/td>\n<td>Taray\u0131c\u0131<\/td>\n<td>Sunucu<\/td>\n<td>\u0130stemci<\/td>\n<\/tr>\n<tr>\n<td>G&uuml;venlik<\/td>\n<td>D&uuml;\u015f&uuml;k-Orta<\/td>\n<td>Y&uuml;ksek<\/td>\n<td>Yap\u0131land\u0131rmaya ba\u011fl\u0131<\/td>\n<\/tr>\n<tr>\n<td>&Ouml;l&ccedil;eklenebilirlik<\/td>\n<td>\u0130yi<\/td>\n<td>Zay\u0131f<\/td>\n<td>&Ccedil;ok iyi<\/td>\n<\/tr>\n<tr>\n<td>API\/Mobil uyum<\/td>\n<td>Zay\u0131f<\/td>\n<td>Zay\u0131f<\/td>\n<td>M&uuml;kemmel<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<hr>\n<h2>Hangisi Daha G&uuml;venli?<\/h2>\n<p>Bu sorunun tek bir cevab\u0131 yok.<\/p>\n<p>\ud83d\udd10 <strong>Do\u011fru cevap \u015fudur:<\/strong><\/p>\n<blockquote>\n<p>Kullan\u0131m senaryosuna g&ouml;re do\u011fru yap\u0131land\u0131r\u0131lm\u0131\u015f olan.<\/p>\n<\/blockquote>\n<ul>\n<li>\n<p>K&uuml;&ccedil;&uuml;k bir web sitesi &rarr; Session<\/p>\n<\/li>\n<li>\n<p>Kurumsal web uygulamas\u0131 &rarr; Session + Secure Cookie<\/p>\n<\/li>\n<li>\n<p>Mobil &amp; API tabanl\u0131 sistem &rarr; Token (JWT)<\/p>\n<\/li>\n<\/ul>\n<p>Yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f bir Token,<br>do\u011fru yap\u0131land\u0131r\u0131lm\u0131\u015f bir Session&rsquo;dan <strong>daha g&uuml;vensiz<\/strong> olabilir.<\/p>\n<p><img src=\"https:\/\/techdocs.broadcom.com\/content\/dam\/broadcom\/techdocs\/us\/en\/assets\/docops\/aa91\/ca_strong_authentication_system_architecture.png?utm_source=chatgpt.com\" alt=\"Image\" width=\"660\" height=\"322\"><\/p>\n<hr>\n<h2>En B&uuml;y&uuml;k Hata: Mant\u0131\u011f\u0131 Bilmeden Kullanmak<\/h2>\n<p>Bir&ccedil;ok g&uuml;venlik a&ccedil;\u0131\u011f\u0131 \u015furadan &ccedil;\u0131kar:<\/p>\n<ul>\n<li>\n<p>Cookie&rsquo;ye hassas veri koymak<\/p>\n<\/li>\n<li>\n<p>Session ID&rsquo;yi \u015fifrelenmemi\u015f iletmek<\/p>\n<\/li>\n<li>\n<p>Token&rsquo;\u0131 localStorage&rsquo;da korumas\u0131z tutmak<\/p>\n<\/li>\n<\/ul>\n<p>Oysa sorun teknoloji de\u011fil, <strong>bilin&ccedil;tir<\/strong>.<\/p>\n<hr>\n<h2>Sonu&ccedil;: Web Seni Hat\u0131rl\u0131yorsa, Bir Sebebi Var<\/h2>\n<p>Bir web sitesi seni hat\u0131rl\u0131yorsa:<\/p>\n<ul>\n<li>\n<p>Ya taray\u0131c\u0131nda bir <strong>cookie<\/strong> vard\u0131r<\/p>\n<\/li>\n<li>\n<p>Ya sunucuda sana ait bir <strong>session<\/strong> tutuluyordur<\/p>\n<\/li>\n<li>\n<p>Ya da cebinde (istemcinde) bir <strong>token<\/strong> ta\u015f\u0131yorsundur<\/p>\n<\/li>\n<\/ul>\n<p>Ger&ccedil;ek g&uuml;venlik, bu yap\u0131lar\u0131n <strong>nas\u0131l &ccedil;al\u0131\u015ft\u0131\u011f\u0131n\u0131 bilmekle<\/strong> ba\u015flar.<\/p>\n<blockquote>\n<p><strong>Web g&uuml;venli\u011finde en b&uuml;y&uuml;k risk,<br>&ldquo;&ccedil;al\u0131\u015f\u0131yor&rdquo; diye dokunulmayan sistemlerdir.<\/strong><\/p>\n<\/blockquote>\n<p>Cookie, Session ve Token&rsquo;\u0131 anlamak;<br>sadece geli\u015ftiriciler i&ccedil;in de\u011fil,<br>dijital d&uuml;nyada bilin&ccedil;li olmak isteyen herkes i&ccedil;in temel bir ad\u0131md\u0131r.<\/p>","excerpt":"","created_at":"2025-11-28 09:06:56","updated_at":"2026-09-07 14:34:50","category_id":15,"view_count":472,"reading_time":5,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-11-28 06:06:00","featured_image":"0cefb24017e2cc4bb04b2d2b24503386.png","slug":"web-kimlik-dogrulama-temelleri-nasil-calisir","category_name":"Bilgi G\u00fcvenligi","category_slug":"bilgi-guvenligi","category_color":"#894376"},{"id":353,"title":"IAM m\u0131 PAM m\u0131?","content":"<p>&nbsp;<\/p>\n<p><iframe style=\"width: 701px; height: 393px;\" src=\"https:\/\/www.youtube.com\/embed\/f9Vkh1L1XPE\" width=\"701\" height=\"393\" allowfullscreen=\"allowfullscreen\"><\/iframe><\/p>\n<p>&nbsp;<\/p>\n<ul>\n<li>\n<p>Ba\u015fl\u0131k: <strong>IAM m\u0131 PAM m\u0131? \u0130\u015fte Sistem G&uuml;venli\u011finizin Anahtar\u0131!<\/strong> (<a title=\"IAM m\u0131 PAM m\u0131? - &Ouml;nder Ak&ouml;z - IT Blogger\" href=\"..\/..\/..\/iam-mi-pam-mi?utm_source=chatgpt.com\">&Ouml;nder Online<\/a>)<\/p>\n<\/li>\n<li>\n<p>\u0130&ccedil;erikte, kritik sistemler i&ccedil;in hangi eri\u015fim modelinin daha etkili oldu\u011funun sorguland\u0131\u011f\u0131 bir podcast yaz\u0131s\u0131 oldu\u011fu belirtiliyor, ancak i&ccedil;erik g&ouml;vdesi k\u0131sa tutulmu\u015f. (<a title=\"IAM m\u0131 PAM m\u0131? - &Ouml;nder Online\" href=\"..\/..\/..\/iam-mi-pam-mi\">&Ouml;nder Online<\/a>)<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>IAM ve PAM &mdash; Temel Kavramlar (Sayfayla \u0130lgili \u0130&ccedil;eri\u011fe Dayal\u0131 A&ccedil;\u0131klama)<\/h2>\n<p>A\u015fa\u011f\u0131daki &ouml;zet genel g&uuml;venlik kaynaklar\u0131na dayanarak <strong>IAM ve PAM aras\u0131ndaki temel farklar\u0131 ve ne anlama geldiklerini<\/strong> sana net bir \u015fekilde anlat\u0131r:<\/p>\n<h3>&nbsp;IAM (Identity and Access Management)<\/h3>\n<p>IAM, bir organizasyonda <strong>kimlerin, hangi sistemlere ve kaynaklara, ne zaman ve nas\u0131l eri\u015febilece\u011fini y&ouml;netmeyi sa\u011flayan kapsaml\u0131 bir sistemdir<\/strong>.<br>Bu sistem:<\/p>\n<ul>\n<li>\n<p>Kullan\u0131c\u0131 kimliklerini olu\u015fturur ve do\u011frular<\/p>\n<\/li>\n<li>\n<p>Eri\u015fim politikalar\u0131n\u0131 uygular<\/p>\n<\/li>\n<li>\n<p>Parola, rol, &ccedil;ok fakt&ouml;rl&uuml; do\u011frulama gibi mekanizmalar\u0131 y&ouml;netir<br>IAM, \u015firket genelindeki t&uuml;m kullan\u0131c\u0131lar i&ccedil;in eri\u015fim kontrol&uuml;n&uuml; sa\u011flar ve g&uuml;venli\u011fi art\u0131r\u0131r. (<a title=\"IAM (Identity &amp; Access Management) Nedir? IAM vs. PAM ...\" href=\"https:\/\/uzmanposta.com\/blog\/iam\/?utm_source=chatgpt.com\">Uzman Posta<\/a>)<\/p>\n<\/li>\n<\/ul>\n<h3>&nbsp;PAM (Privileged Access Management)<\/h3>\n<p>PAM ise IAM&rsquo;in bir alt k&uuml;mesi gibi g&ouml;r&uuml;nse de <strong>&ouml;zellikle ayr\u0131cal\u0131kl\u0131 hesaplara odaklan\u0131r<\/strong>.<br>PAM &ccedil;&ouml;z&uuml;mleri:<\/p>\n<ul>\n<li>\n<p>Sisteme y&ouml;netici gibi y&uuml;ksek ayr\u0131cal\u0131klara sahip hesaplarla eri\u015fimi s\u0131k\u0131 denetim alt\u0131na al\u0131r<\/p>\n<\/li>\n<li>\n<p>Ayr\u0131cal\u0131kl\u0131 parolalar\u0131 g&uuml;venle saklar ve y&ouml;netir<\/p>\n<\/li>\n<li>\n<p>Ayr\u0131cal\u0131kl\u0131 eri\u015fimleri kaydeder ve izler<br>Yani t&uuml;m kullan\u0131c\u0131lara de\u011fil, yaln\u0131zca kritik yetkisi olanlara ekstra g&uuml;venlik katman\u0131 sa\u011flar. (<a title=\"IAM ve PAM Kar\u015f\u0131la\u015ft\u0131rmas\u0131 - vMind Dijital D&ouml;n&uuml;\u015f&uuml;m &Ouml;nc&uuml;s&uuml;\" href=\"https:\/\/www.vmind.com.tr\/iam-nedir-iam-ve-pam-karsilastirmasi-464?utm_source=chatgpt.com\">vMind<\/a>)<\/p>\n<\/li>\n<\/ul>\n<hr>\n<h2>IAM vs PAM &mdash; K\u0131sa ve Net Farklar<\/h2>\n<table>\n<thead>\n<tr>\n<th>&Ouml;zellik<\/th>\n<th>IAM<\/th>\n<th>PAM<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Kapsam<\/td>\n<td>T&uuml;m kullan\u0131c\u0131 eri\u015fimi<\/td>\n<td>Yaln\u0131zca ayr\u0131cal\u0131kl\u0131 hesaplar<\/td>\n<\/tr>\n<tr>\n<td>Ama&ccedil;<\/td>\n<td>Kimlik ve eri\u015fimi y&ouml;netmek<\/td>\n<td>Ayr\u0131cal\u0131klar\u0131 denetlemek ve g&uuml;vence alt\u0131na almak<\/td>\n<\/tr>\n<tr>\n<td>Risk Odak<\/td>\n<td>Genel eri\u015fim ve yetkilendirme<\/td>\n<td>Kritik hesaplar\u0131n k&ouml;t&uuml;ye kullan\u0131m riski<\/td>\n<\/tr>\n<tr>\n<td>Kullan\u0131m Alan\u0131<\/td>\n<td>E-posta, uygulamalar, servisler<\/td>\n<td>Sunucular, veritaban\u0131 y&ouml;netimi, y&ouml;netici ara&ccedil;lar\u0131<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>Temel fikir:<\/strong><br>IAM, geni\u015f &ccedil;apta kimlik ve eri\u015fim y&ouml;netimidir; PAM ise &ouml;zellikle sistem y&ouml;neticileri gibi riskli hesaplar\u0131n <strong>daha s\u0131k\u0131 kontrol ve izlenmesini<\/strong> sa\u011flar. (<a title=\"IAM ve PAM Kar\u015f\u0131la\u015ft\u0131rmas\u0131 - vMind Dijital D&ouml;n&uuml;\u015f&uuml;m &Ouml;nc&uuml;s&uuml;\" href=\"https:\/\/www.vmind.com.tr\/iam-nedir-iam-ve-pam-karsilastirmasi-464?utm_source=chatgpt.com\">vMind<\/a>)<\/p>\n<hr>\n<h2>Neden Hem IAM Hem PAM &Ouml;nemli?<\/h2>\n<p>Tek ba\u015f\u0131na IAM &ccedil;o\u011fu eri\u015fim ihtiyac\u0131n\u0131 kar\u015f\u0131lar. Ancak <strong>y&uuml;ksek ayr\u0131cal\u0131kl\u0131 hesaplar\u0131n<\/strong> k&ouml;t&uuml;ye kullan\u0131m\u0131, veri ihlallerinin en yayg\u0131n nedenlerinden biridir. Bu y&uuml;zden modern siber g&uuml;venlik stratejileri hem IAM&rsquo;i hem de PAM&rsquo;i bir arada kullanarak hem genel eri\u015fimi hem de kritik yetkileri kontrol alt\u0131nda tutar. (<a title=\"IAM (Identity &amp; Access Management) Nedir? IAM vs. PAM ...\" href=\"https:\/\/uzmanposta.com\/blog\/iam\/?utm_source=chatgpt.com\">Uzman Posta<\/a>)<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>","excerpt":"IAM ve PAM \u2014 Temel Kavramlar (Sayfayla \u0130lgili \u0130\u00e7eri\u011fe Dayal\u0131 A\u00e7\u0131klama)","created_at":"2025-11-28 09:05:27","updated_at":"2026-09-08 00:00:00","category_id":15,"view_count":571,"reading_time":3,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-11-28 06:05:27","featured_image":"\/uploads\/images\/2025\/12\/6947be430603c_1766309443.jpg","slug":"iam-mi-pam-mi","category_name":"Bilgi G\u00fcvenligi","category_slug":"bilgi-guvenligi","category_color":"#894376"}]