TL, DR
Yawancin jerin raunin da ke tattare da rauni suna gaya muku abin da zai iya faruwa ba daidai ba. CISKasida ta KEV tana gaya muku abin da ke faruwa a yanzu. Sanannun raunin da aka yi amfani da su (KEVs) sune CVEs da aka tabbatar ana amfani da su a daji. CISA yana kula da kundin tsarin mulki kuma yana ba da umarnin jadawalin gyara ga hukumomin tarayya ta hanyar Dokar Aiki ta Binding 22-01. Yawancin ƙungiyoyi masu zaman kansu suna amfani da wannan jerin don rage hayaniyar faɗakarwa da kuma gano abin da ya kamata a gyara da farko.
CVSS, EPSS, da KEV suna amsa tambayoyi uku daban-daban. CVSS tana auna tsananin ka'ida - yaya wannan zai iya zama muni? EPSS tana annabta yiwuwar amfani da shi cikin kwanaki 30 - yaya yuwuwar hakan za a kai hari? KEV ta tabbatar da amfani da shi - shin ana kai hari ga wannan a yanzu? Rauni mai matsakaicin maki na CVSS, babban maki na EPSS, da kuma alamar KEV ya fi gaggawa fiye da makin CVSS mai mahimmanci ba tare da wata shaida ta amfani da shi ba. Alamun guda uku suna aiki tare, ba tare da musanya ba.
KEV a cikin dogaro da kai ba haɗari bane na ka'ida - yana da wa'adin ƙarshe. KEVs galibi suna ɗauke da abubuwan da suka shafi ɓangare na uku, tsarin aiki, kwantena, da CI/CD Abubuwan da ƙungiyoyi ke ɗauka a matsayin aminci ne. An tabbatar da cewa an yi amfani da CVE-2023-4966 (CitrixBleed) cikin kwanaki bayan an bayyana shi. An kama CVE-2024-1086 ta hannun ƙungiyoyin ransomware jim kaɗan bayan shigar da Kev Catalog ɗinta. standard Gyaran Kevs masu fuskantar intanet yana ɗaukar kwana 1-3, ba tsarin faci na yau da kullun ba.
Wannan rubutun ya ƙunshi: menene KEVs da kuma yadda suka bambanta da CVEs, CVSS, da EPSS; yadda ake gina tsarin aiki na fifiko a kusa da CISKasida; da kuma yadda Xygeni yana sarrafa daidaitawar KEV ta atomatik, aiwatar da aikin tsaro, da gyara a duk faɗin CI/CD pipelines — gami da tsarin tsaro na YAML mai aiki.
Wadanne Abubuwa Ne Suka Fi Sanin Rauni Da Ake Amfani Da Su (KEVs)?
Kowace na'urar daukar hoton rauni tana samar da sakamakon da aka kimanta bisa ga tsananin CVSS. Matsalar ita ce CVSS tana auna tasirin ka'ida, ba amfani da shi ba. CISKundin Kasida Mai Sanin Raunin da Aka Yi Amfani da Shi (KEV) ya magance wata matsala daban, mafi gaggawa: yana lissafa CVEs da maharan ke amfani da su a yanzu, tare da sanya wa'adin lokaci. Ga kowace ƙungiya da ke ƙoƙarin yanke shawara kan abin da za ta gyara da farko, ita ce siginar da ta fi dacewa a samu.
Sanannun Rauni da Aka Yi Amfani da su (KEVs) ne An tabbatar da cewa raunin da CVE ta lissafa ana amfani da shi a dajiHukumar Tsaron Yanar Gizo da Kayayyakin more rayuwa ta Amurka (CISA) yana kula da jami'in KEV Catalog kuma yana buƙatar lokacin gyarawa ta hanyar Umarnin Aiki Mai Dorewa 22-01. Ƙungiyoyi masu zaman kansu da yawa yanzu suna amfani da wannan jerin don ba da fifiko ga faci.
Ko da yake CVSS ma'aunin maki m tasirin, KEVs suna wakiltar m cin zarafi. A wata ma'anar, suna mayar da "watakila za a iya cin zarafi" zuwa "a yi amfani da su," suna buƙatar SLAs masu sauri da kuma sarrafa su ta atomatik guardrails.
KEVs vs CVEs vs EPSS
Ƙungiyoyin tsaro sau da yawa suna rikitar da waɗannan kalmomin da suka shafi. Fahimtar bambancin yana da mahimmanci don samun daidaiton haɗari
| Acronym | source | Nufa |
|---|---|---|
| CVE | NVD | Mai ganowa na musamman don raunin da aka bayyana. |
| CVSS | NVD / FARKO | Yana auna tsananin ka'ida (tasiri + amfani). |
| EPS | FIRST.org | Yana hasashen yiwuwar cin zarafi cikin kwanaki 30. |
| KEV | CISA | Yana tabbatar da cin zarafin da ake yi a zahiri kuma yana saita wa'adin lokaci. |
Tare, waɗannan tsarin suna samar da tsarin haɗari: CVSS yana nuna yadda zai iya zama mummuna, EPSS yana nuna yadda zai iya kasancewa, kuma Known Ulnerabilities suna nuna abin da ke faruwa a zahiri.
Karin bayani: Maki na CVSS: Yadda ake Rubuta CVSS da kuma EPSS vs CVSS: Menene Bambancin?
Me yasa KEVs ke da mahimmanci ga Masu Haɓakawa da CISOs
Da farko, haskakawar KEVs ɗabi'ar mai kai hari kai tsayeNa biyu, galibi suna shiga cikin kayan aikin ɓangare na uku, tsarin gini, kwantena, ko CI/CD abubuwan da ƙungiyoyi ke ɗauka a matsayin abin dogaro, waɗanda ƙungiyoyi ke ɗauka a matsayin aminci., Gyaran da aka jinkirta zai iya buɗe hanyoyin motsi a gefe a cikin ginin ku da kayayyakin isar da kaya.
Misalai na baya-bayan nan:
- CVE-2024-1086 (Linux nf_tables): an ƙara shi zuwa kundin KEV; ƙungiyoyin ransomware sun yi amfani da shi a tsakiyar 2024.
- CVE-2023-4966 (CitrixBleed): an tabbatar da cin zarafi cikin kwanaki bayan an bayyana shi; tilasta aiwatar da matakan gaggawa a duk duniya.
Takeaway: Kevs ba barazana ba ce mai yuwuwa, su ne m Saboda haka, a yi la'akari da duk wani rauni da aka sani da ake amfani da shi a matsayin "gyara-yanzu", sai dai idan binciken isa ga abin ya tabbatar da akasin haka.
Yadda Ake Bin Diddigin Kuma Fifita Raunukan Da Aka San Da Su A Amfani Da Su
Da farko, duba jami'in CISSanannen Kasida game da Rauni da Aka Yi Amfani da Shi sannan ka yi alama a kan duk wani abu da ya dace a cikin na'urar daukar hoton tsaro. Sannan, yi amfani da wannan bayanin don yanke shawara kan waɗanne gyara ne ya kamata su fara faruwa. Bugu da ƙari, haɗa Sanannun Abubuwan Lalacewar Amfani tare da Maki EPSS don rage hayaniya da kuma mai da hankali kan raunin da ke shafar lambar tafiyar ku.
Gudun aikin mataki-mataki:
- Daidaita bayanai: Cire sabbin sabuntawa daga shafin yanar gizo CISJerin kowace rana kuma haɗa su da sauran hanyoyin magance raunin ku.
- Sakamakon tag: Yi wa kowane binciken lakabi a matsayin "An San Amfani da Shi" lokacin da ID ɗin ya dace da shi CISJeri.
- Duba iya isa gare shi: Duba ko lambar mai rauni tana aiki a cikin manhajarka ko gininka pipeline.
- Kimanta amfani: amfani EPS don gano wasu matsalolin da za a iya kai wa hari nan ba da jimawa ba.
- Aiwatar da wa'adin ƙarshe:
- Rashin lafiyar da ke fuskantar intanet: gyara cikin kwana 1-3.
- Na ciki: gyara cikin mako guda.
- Lambar ba ta aiki: a kula da ita kuma a tabbatar da ita akai-akai.
- Amsoshi ta atomatik: Tsarin yana toshe haɗin da ba shi da aminci, yana buɗewa lafiya pull requests, kuma yana tattara abubuwan da ba a keɓance ba don tabbatar da cewa ƙungiyoyi ba su rasa komai ba.
Daga Wayar da Kan Jama'a Zuwa Aiki: Gyaran Atomatik Tare da Xygeni
A aikace, sarrafa duk wannan da hannu ba ya da yawa. Saboda haka, Xygeni yana haɗa raunin da aka sani da aka yi amfani da shi kai tsaye zuwa ga na'urarka CI/CD hanyoyin aiki, juya faɗakarwa zuwa ayyuka na gaske, masu jagora.
- Alaƙa mai wayo: An gano daidaito tsakanin CVEs da CISJerin da kuma nuna matsalolin "gyara-yanzu" a ciki pull requests.
- Sauƙin isa gare shi + Amfani: Yana tabbatar da ko hanyar lambar mai rauni tana gudana kuma tana haɗi EPS bayanai don kafincisfifiko.
- Guardrails: Yana dakatar da haɗakar haɗari ko tura kayan aiki idan wani lahani da aka yi amfani da shi ya shafi fayiloli ko ayyuka masu mahimmanci.
- Gyaran Kai-tsaye: Yana buɗe amintaccen PRs, yana duba yiwuwar canje-canje masu karyewa, kuma yana gudanar da gwaje-gwaje kafin a haɗa.
- Rijistar binciken kuɗi: Yana adana bayanan abin da aka gyara da kuma lokacin da aka gyara, yana tallafawa manufofin tsaron cikin gida.
A takaice, bayanan sirrin barazana suna nuna abin da ake kai hari, Xygeni yana tabbatar da cewa an gyara shi da sauri, lafiya, kuma ta atomatik.
Misali Tsarin Tsaro (YAML)
guardrail:
id: "kev-protection"
description: "Block merges if known exploited vulnerability detected"
conditions:
- match: vulnerability.kev == true
- match: reachability == "reachable"
actions:
- block: merge
- notify: ["slack:#security-alerts", "jira:SEC-OPS"]
- create_pr: true
sla:
critical: 72h
high: 7d
Wannan doka tana aiki babu hade don ayyukan da aka sani da rashin amfani da ƙwayoyin cuta, yana sanar da tashoshi masu dacewa, kuma yana ƙirƙirar gyara PR ta atomatik, duk a cikin na'urarka CI/CD guardrails.
Ƙaramin akwati: Hana shigar da KEV
- Week 1: Sabuwar ɗakin karatu na bude tushen ya wuce SAST amma ya haɗa da CVE-2023-4966.
- Week 2: Haɗin KEV na Xygeni ya gano shi a cikin sabon CISSabuntawa.
- Week 3: Guardrails dakatar da haɗin; Gyaran Kai-tsaye yana gabatar da sigar da aka gyara.
Sakamakon: Ƙungiyar ta guji jigilar kaya sananniya raunin da aka yi amfani da shi zuwa samarwa da kuma mayar da ja pipeline kwarara a cikin gudu ɗaya.
Xygeni yana daidaita CVEs ɗinku na buɗewa da CISKasida ta KEV ta atomatik, tana nuna alamun raunin da aka yi amfani da shi a ciki pull requests, yana aiwatar da guardrails wanda ke toshe haɗuwa mara aminci, kuma yana buɗe PRs na gyara tare da ingantaccen canjin da aka gina a ciki.
