Teburin Abubuwan Ciki
Ana ƙirƙirar aikace-aikacen girgije-native, waɗanda suka ƙunshi sassa daban-daban masu zaman kansu da aka sani da ƙananan ayyuka, ta amfani da hanyar haɓaka software mai agile da ake kira DevSecOps, wanda ke jaddada haɗin gwiwa da tsaro a duk tsawon aikin.
Wani muhimmin al'amari na haɓaka aikace-aikacen girgije shine amfani da Ci gaba da Haɗawa/Ci gaba da Isarwa (CI/CD) pipelines. Wadannan pipelines yana bawa masu haɓaka software damar haɗa sabbin canje-canjen lambar ba tare da wata matsala ba tare da ɓata lokaci ba tare da kuma ci gaba da isar da sabuntawa ga aikace-aikacen. Duk da haka, binciken da aka yi kwanan nan ya nuna mahimmancin la'akari da zagayowar rayuwar haɓaka software gaba ɗaya (SDLC), wanda aka sani da sarkar samar da software (SSC), dangane da tsaro.
A cikin yanayin ci gaba da bunkasar software da tsaro, ci gaba da fuskantar barazanar da ka iya tasowa yana da matukar muhimmanci. Shi ya sa Cibiyar Kasa ta Standards da Technology (NIST) sun ɗauki wani muhimmin mataki ta hanyar bugawa NIST SP 800-204D, hadawa software supply chain security (SSCS) yana aunawa zuwa CI/CD pipelines. Wannan takarda ta gina bisa tushen Tsarin Haɓaka Manhajar Tsaro (SSDF), wanda NIST kuma ta fitar.
Ga ƙungiyoyin da ke neman haɓaka yanayin tsaron sarkar samar da kayayyaki, wannan sabon albarkatu daga NIST yana zuwa a matsayin kadara mai daraja a kan lokaci. A cikin 'yan shekarun nan, mun shaida yunƙurin da yawa na yin katsalandan kan sarƙoƙin samar da software, yana mai jaddada buƙatar gaggawa ta inganta matakan tsaro. Kashi 82% na CIOs sun nuna damuwa game da raunin da sarƙoƙin samar da software ɗinsu ke da shi ga hare-hare masu yuwuwa.
Idan kana damuwa game da tsaron sarkar samar da kayayyaki, yana da muhimmanci ka tuna cewa kungiyoyi da yawa suna da irin wannan damuwa kuma suna neman hanyoyin rage haɗari da ƙarfafa sarkar samar da software ɗinsu. Bari mu zurfafa cikin dabarun da la'akari da su don haɗa kai. SSCS yana auna ayyukan DevOps na yau da kullun.
Da farko dai, yana da matuƙar muhimmanci a fayyace harin sarkar samar da kayayyaki da kuma takamaiman Software Supply Chain Security Barazana da ke tasowa a lokacin matakin tushe.
SSCS da kuma CI/CD Pipelines: Zuciyar DevSecOps
Ci gaba da Haɗawa da Ci gaba da Aiki (CI/CD) Pipelines sun kawo sauyi a tsarin haɓaka software, suna aiki a matsayin ginshiƙin tsarin DevSecOps mai saurin canzawa. pipelines tsari ne mai rikitarwa wanda ke sarrafa lambar daga tushe daban-daban, gami da ma'ajiyar bayanai ta ɓangare na farko da kuma na ɓangare na uku na buɗe-tushen bayanai ko na kasuwanci.
Tsarin ginawa a cikin waɗannan pipelines wani rawa ce mai rikitarwa ta dogaro da dabaru na aikace-aikace, tana samar da gini daga kayan tarihi na lambar tushe daban-daban. Da zarar an ƙirƙiri waɗannan kayan tarihi, ana adana su a cikin ma'ajiyar gini na musamman, ana yin gwaji mai tsauri kafin a naɗe su. Ana adana waɗannan fakitin a cikin takamaiman ma'ajiyar bayanai, ana duba su don gano raunin da ke tattare da su, kuma a ƙarshe ana tura su a cikin yanayin gwaji ko samarwa. Dandamali kamar GitHub Actions workflows, GitLab Runners, da Buildcloud sun goyi bayan waɗannan hanyoyin aiki.
Don tsaron SSC a cikin waɗannan hanyoyin aiki, samar da bayanai masu yawa na asali shine mafi mahimmanci. Wannan bayanan yana tabbatar da ganowa da kuma ɗaukar alhakin a duk lokacin aiki. pipeline, wanda ke aiki a matsayin alamar bayyana gaskiya. Yana da mahimmanci a magance duka hanyoyin tsaro na SSC na ciki don software na ɓangare na farko da kuma hanyoyin tsaro da suka shafi sassan software na ɓangare na uku. Manyan manufofin guda biyu ne:
- Aiwatar da matakan kariya don hana yin katsalandan ga tsarin samar da manhaja da kuma hana gabatar da sabbin manhajoji masu cutarwa.
- Kiyaye mutuncin CI/CD pipeline kayayyakin tarihi da ayyuka ta hanyar ayyana ayyuka da izini ga duk masu ruwa da tsaki a cikin pipeline.
Kayayyakin more rayuwa na DevOps: Tushen CI/CD
Kayan aiki da fasahohin da ke ƙarfafa ayyukan DevOps su ne manyan hanyoyin aiki na Ci gaba da Haɗawa. Tsarinsu da kula da su suna da matuƙar muhimmanci ga tsaro da amincin dukkan sassan. CI/CD tsari. Ba za a iya yin shawarwari kan bincike da sabunta waɗannan kayan aikin akai-akai don tabbatar da cewa an magance raunin da ke tattare da shi ba.
Na'urorin daukar hoto na rauni ta atomatik sun zama abokan tarayya masu mahimmanci a wannan aikin. Ta hanyar ci gaba da sa ido kan kayan aikin DevOps da tsare-tsare, suna iya gano yiwuwar rauni ko kurakurai a ainihin lokaci. Wannan hanyar aiki mai kyau tana ba da haske game da lafiyar tsaro gabaɗaya na yanayin DevOps, yana ba da damar gyarawa cikin lokaci.
Bugu da ƙari, zaɓar plugins a cikin kayan aikin DevOps na iya yin tasiri sosai ga tsaro. Duk da cewa plugins suna inganta aiki, suna kuma iya gabatar da rauni idan ba a tantance su yadda ya kamata ba. Yana da mahimmanci a tantance plugins bisa ga sunansu, tarihin tsaronsu, da kuma tallafin al'umma. Bita akai-akai da sabuntawa na waɗannan plugins na iya ƙara ƙarfafa yanayin tsaro.
Tsaro a cikin CI/CD Pipelines: Wanda Ba Za a Yi Muhawara Ba
Kowane mataki na CI/CD pipeline, daga gina lambar zuwa lambar sarrafawa commits da ayyukan tura-tura, suna buƙatar tsauraran matakan tsaro. Lambar tsaro commits sune tushen waɗannan pipelines. Aiwatar da bita kan lambar, gano lambobin da ba su da kyau, da kuma bin ƙa'idodin tsaro na iya rage raunin da ke tattare da su sosai.
Ayyukan tura-tura, waɗanda suka haɗa da canje-canjen lambobi, dole ne a ƙarfafa su da hanyoyin tabbatarwa masu aminci, kamar tantance abubuwa da yawa (MFA), don hana shiga ba tare da izini ba. pipelineYa kamata a gudanar da ayyukan ginin a cikin yanayi mai tsaro da keɓewa. Yin amfani da wakilai masu tsaro na gini, sabunta kayan aikin gini da abubuwan da suka dogara da su akai-akai, da kuma tabbatar da sahihancin tsarin ginin duk matakai ne masu mahimmanci a wannan fanni.
Bugu da ƙari, ingancin shaidu da shaidu a cikin tsarin sabunta software yana da matuƙar muhimmanci. Tabbatar da sahihanci da amincin sabunta software yana tabbatar da cewa ba a taɓa su ba yayin aiwatar da aiwatarwa.
Build Attestations: Mai Kula da CI/CD tsari
Shaidawa su ne jaruman da ba a taɓa ambata ba wajen tabbatar da tsarin samar da software. Waɗannan tarin bayanai da aka tabbatar, waɗanda aka samar ta hanyar takamaiman tsari, masu amfani za su iya tabbatar da su, suna samar da wani tsari na aminci da gaskiya. Yayin da ƙungiyoyi ke fifita tabbatar da tsarin samar da software ɗinsu, tattara bayanai da suka shafi tsarin ginawa da ƙirƙirar aikace-aikace ya zama mafi mahimmanci.
Bayanan metadata game da tsarin ginawa yana ba da haske game da kayan aiki, sigar, tsari, da dogaro da aka yi amfani da su, suna aiki a matsayin tsari na ginin. Hakazalika, bayanan metadata akan ƙirƙirar aikace-aikace yana ba da hoto na tsarin haɓakawa, ɗakunan karatu, da dogaro na ɓangare na uku da aka yi amfani da su. Wannan cikakken tarin bayanai yana ba da ganuwa mara misaltuwa game da asali da amincin tushen lambar.
Ta hanyar amfani da shaidu da kuma tattara bayanai cikin himma, ƙungiyoyi za su iya inganta ayyukansu sosai software supply chain securityWannan hanyar ba wai kawai tana samar da gaskiya da tantancewa ba, har ma tana shimfida harsashin ingantaccen sa ido, bincike, da nazarin tsaro a duk tsawon lokacin haɓaka software.
Jawabin ƙarshe da matakai na gaba
Binciken da aka yi kwanan nan game da raunin software da hare-haren sun nuna damuwa mai mahimmanci ga kamfanonin da ke haɓaka software a ƙarƙashin tsarin DevSecOps mai ban sha'awa wanda ke amfani da Ci gaba da Haɗawa/Ci gaba da Isarwa (CI/CD) pipelines. Ƙungiyoyin gwamnati da na kamfanoni masu zaman kansu yanzu suna mayar da hankali kan ayyukan da suka shafi dukkan ayyukan SDLC, wanda aka haɗa shi da sarkar samar da software (SSC).
Ingancin kowane aiki a cikin SSC yana da matuƙar muhimmanci ga tsaronsa gaba ɗaya. Barazanar wannan mutunci na iya fitowa daga masu aikata laifuka waɗanda ke amfani da rauni ko kuma daga kurakurai da gazawa a cikin bincike mai kyau a lokacin SDLCGanin muhimmancin wannan batu, shirye-shirye kamar Dokar Zartarwa (EO) 14028, Tsarin Ci Gaban Software na NIST (SSDF), da kuma wasu dandali daban-daban na masana'antu sun zurfafa bincike kan tsaron SSC, da nufin ƙarfafa tsaron duk wani software da aka tura.
Wannan ƙarin mayar da hankali ya nuna buƙatar ɗaukar matakai masu dacewa don haɗa tabbacin tsaron SSC cikin CI/CD pipelines ba tare da wata matsala ba. Irin wannan haɗin kai yana da mahimmanci ga ƙungiyoyi su magance tsaron SSC yadda ya kamata yayin da suke haɓakawa da kuma amfani da aikace-aikacen da suka samo asali daga girgije. Gina manyan kayayyakin tsaro na SSC yana buƙatar haɗa kayan tarihi daban-daban, gami da lissafin kayan software (SBOM) da kuma tsarin tabbatar da sassan software. Yayin da waɗannan ƙayyadaddun bayanai da buƙatu ke ci gaba da bunƙasa ta hanyar haɗin gwiwa a cikin dandalin tattaunawa na gwamnati da masana'antu, suna ci gaba da zama masu mahimmanci wajen tsara makomar tsaron SSC.
A shirye don bincika sarkakiyar haɗakarwa SSCS Za ku iya ɗaukar mataki a kan DevOps? Sauke cikakken takardar Xygeni a yau. Yi bincike kan cikakkun bayanai, mafi kyawun ayyuka, da dabarun da za a iya aiwatarwa don ƙarfafa tsarin DevOps ɗinku. Ba wa ƙungiyar ku ilimin da za ta runguma SSCS yana aunawa cikin sauƙi kuma yana jagorantar hanya zuwa software supply chain securityKada ku rasa—download Yanzu.
