Idan kana mamaki Menene rashin daidaiton tsaro, ba kai kaɗai ba ne. Wannan rauni na gama gari, wanda aka rarraba a matsayin Kuskuren tsarin tsaro na OWASP, yana shafar kusan kowace irin tarin fasaha, daga kwantena zuwa ayyukan girgije. raunin rashin daidaiton tsaro yana faruwa ne lokacin da aka tura tsarin, ayyuka, ko lambar da ke da matsala ta rashin tsaro ko saitunan da aka fallasa. Ko dai kwamitin gudanarwa ne da aka buɗe, takaddun shaida na asali, ko kuma bokitin S3 da ba daidai ba, waɗannan gibin suna ba wa maharan damar shiga fili.
Rashin daidaiton tsaro ya kasance ɗaya daga cikin raunin da aka fi watsi da shi amma ya yaɗu a cikin haɓaka software na zamani. Idan kun taɓa tambayar menene rashin daidaiton tsaro ko kuma kun yi watsi da shi a cikin ɓangaren kuskuren daidaitawar tsaro na OWASP na jerin Manyan 10, lokaci ya yi da za a yi nazari sosai. Daga Kubernetes da aka fallasa dashboardDon samun takardun shaidar admin na tsoho a cikin yanayin girgije, wannan haɗarin ya fi yawa fiye da yadda masu haɓakawa da yawa suka sani.
Ko da tare da lambar da aka taurare, sabis guda ɗaya da ba daidai ba, bokitin S3 mai izini sosai, ko yanayin gyara kurakurai da aka manta na iya fallasa bayanai masu mahimmanci ko buɗe hanya ga masu kai hari. Waɗannan matsalolin ba wai kawai ka'idoji bane, ainihin keta doka galibi suna faruwa ne daga kurakuran asali na tsari a cikin CI/CD pipelines, Dockerfiles, ko samfuran kayayyakin more rayuwa-kamar-lambar.
A cikin wannan rubutun, za mu bayyana dalilin da yasa rashin daidaiton tsaro har yanzu yana cikin manyan barazanar da ke cikin tsarin OWASP, mu nuna muku yadda yake a aikace, kuma mu bayar da hanyoyin da za a iya magance shi, ba tare da rage jinkirin isar da kayanku ba.
Menene Kuskuren Tsaro?
Rashin daidaiton tsaro yana faruwa ne lokacin da aka tura tsarin, ayyuka, ko aikace-aikace tare da saitunan tsoho marasa tsaro, fasaloli marasa amfani, ko kuma ikon sarrafa damar shiga da aka yarda da su sosai. Idan kun taɓa barin akwatin Docker a fallasa, committed a .env fayil ɗin bisa kuskure, ko kuma ka manta ka kashe yanayin gyara kurakurai a cikin samarwa, ka ga wannan haɗarin yana aiki.
Don sanya shi a hankali, Menene kuskuren tsarin tsaro? Lokaci ne da muhallinku zai yi aiki, amma a buɗe yake ga cin zarafi.
Kuskuren tsarin tsaro na OWASP yana nan A05 a cikin OWASP Mafi Girma 10, kuma saboda kyakkyawan dalili. Yana rufe yanayi iri-iri, tun daga bokitin gajimare da aka saita zuwa ga jama'a, zuwa kanun labarai da suka ɓace, zuwa tsoffin ɗakunan karatu tare da allunan gudanarwa a buɗe.
Abin da ya sa yake da haɗari musamman shine yadda yake da sauƙin rasawa. Masu haɓaka software suna mai da hankali kan rubuta lambar tsaro, amma galibi suna mantawa da cewa fayilolin daidaitawa, CI/CD masu canji, izinin kwantena, da tashoshin da aka fallasa suna da mahimmanci.
Anan ga wasu misalai na zahiri:
- Bokitin AWS S3 ana iya samunsa a bainar jama'a ba tare da tantancewa ba
- Kubernetes dashboard ana iya isa gare shi ta intanet ba tare da wani sharaɗi ba login
- An saita Jenkins tare da tsoffin kalmomin shiga
- Shafukan kuskuren da ba a bayyana ba a cikin samarwa suna nuna alamun tarin bayanai
Kuskuren tsari barazana ce ta ɓoye. Ba sa karya gininka, suna jira a baya har sai wani ya same su.
Dalilin da yasa Rashin Tsarin Tsaro Yake da Rauni Gaske
Da farko, ƙaramin kuskuren tsari ba zai yi kama da barazana ba. Duk da haka, raunin rashin daidaito na tsaro zai iya zama babban cikas cikin sauri, musamman a cikin yanayin girgije da kuma wuraren da ke cike da kwantena inda ayyuka ke da alaƙa.
Masu kai hari galibi suna bincika:
- Buɗe tashoshin jiragen ruwa suna fallasa kayan aikin haɓakawa kamar Kibana ko Jenkins
- Ba a daidaita kanun labarai ba wanda ke ba da damar yin rubutun yanar gizo (XSS)
- Kadarorin girgije na jama'a (misali S3, GCS) an saita su don "karanta/rubuta" ga kowa
- Mai ɗigon ruwa
.gitkundin adireshi ko kuma an fallasa su.envfayiloli a cikin ayyukan GitHub
Bugu da ƙari, ba sa buƙatar amfani da dabarun aikace-aikacen ku. Madadin haka, suna dogara ne akan tsoffin saitunan ku, tutocin da kuka manta, ko kuma bangarorin gudanarwa da ba a gyara ba.
Rahoton 2024 ta IBM X-karfi gano cewa rashin daidaito ya haifar da kashi 25% na dukkan abubuwan da suka faru na tsaron gajimare, wanda hakan ya sanya su zama rukuni na biyu mafi yawan barazanar gajimare, kawai a bayan rashin kula da asali.
Bari mu warware wannan da sauri gefe-gefe:
| Kafa | Ba shi da tsaro ta hanyar tsoho | Tsarin Taurare |
|---|---|---|
| Admin Panel | An kunna ba tare da login | An tabbatar kuma an takaita shi ta hanyar IP |
| S3 Bukata | Samun jama'a | Keɓaɓɓu tare da ƙa'idodin IAM |
| Dockerfile | Yana amfani da tushen mai amfani | Yana aiki kamar ba tushen ba |
| Jenkins | Bayanan asali na asali | An tilasta RBAC & alamu |
Saboda sau da yawa waɗannan matsalolin ba a gano su ba a lokacin gwaji na yau da kullun, suna zama wani ɓangare na farfajiyar harin, suna zaune a cikin kayan aikin ku a hankali har sai wani ya same su. Shi ya sa ake yin magani rashin daidaiton tsaro a matsayin ainihin rauni yana da mahimmanci ga ƙungiyoyin DevOps da AppSec na zamani.
Misalan Rashin Tsarin Tsaro na Rashin Tsarin Lafiya Masu Haɓaka Sau da yawa Suna Rashin Tsarin
Ko da masu haɓaka ƙwarewa suna watsi da kuskuren tsarin tsaro, ba wai don ba su damu ba, amma saboda tsoffin sigogi galibi suna aiki. da kyauGa misalan da ke shiga cikin samarwa sau da yawa fiye da yadda kuke tsammani:
Rashin daidaiton tsaro a cikin kwantena da Dockerfiles
- Yana gudana kamar
rootmaimakon mai amfani mara gata - Bayyana tashoshin jiragen ruwa na ciki a cikin
Dockerfileordocker-compose.yml - Barin wuraren binciken lafiya ba tare da kariya ba
Rashin daidaiton tsarin tsaro na girgije a cikin ajiya da kayayyakin more rayuwa
- S3 buckets tare da izinin "rubutu ga jama'a" ko "rubutu ga jama'a"
- Bokitin GCP ko bulbulan Azure da aka fallasa ta hanyar IAM mara tsari
- Terraform fayiloli marasa ƙuntatawa ko ɓoyewa
CI/CD pipeline matsalolin da rashin daidaiton tsaro ya haifar
- Jenkins ko GitLab CI tare da damar shiga ba tare da an san ko wanene ba
- An adana sirrin da aka adana a cikin rubutu mai sauƙi a cikin pipeline kwantattun bayanai
- Rahotannin ɗaukar hoto na gwaji ko na'urorin daukar hoto na lamba waɗanda ke fallasa hanyoyin ciki
Misalan kuskuren tsarin tsaro na manhajar yanar gizo da aka saba amfani da su
- An kunna yanayin gyara kurakurai a ciki Flask, Django, ko Express
- Saƙonnin kuskuren da ba su da ma'ana suna fallasa alamun tarin bayanai ko bayanan muhalli
- Babu kanun labarai na tsaro na HTTP (
X-Content-Type-Options,Strict-Transport-Security, Da dai sauransu)
Bugu da ƙari, waɗannan ba kawai kurakurai ba ne, har ma wuraren shiga ne da ake iya hasashen za su iya shiga. Masu kai hari sun dogara ne akan na'urar daukar hoto ta atomatik don gano ainihin waɗannan kurakuran.
Idan an samu damar shiga kuma ba a daidaita shi ba, to yana da rauni.
Yadda Ake Hana Rashin Tsarin Tsaro a cikin DevOps
hana rashin daidaiton tsaro Ba game da ƙara sabbin kayan aiki ba ne. Yana game da yin tsari mai aminci a kowane yanayi, daga haɓakawa zuwa samarwa. Ga yadda ake yi:
1. Taurarewa da Wuya da wuri
Fara da saitunan tsaro a cikin rubutun Dockerfiles, Helm, da Terraform ɗinku. Guji fallasa ayyuka akan 0.0.0.0 sai dai idan an buƙata sosai. Cire samfurin takardun shaida, sirrin mai riƙe wuri, da gwada hanyoyin kafin tura lambar.
2. Shiga Cikin Kullewa
Koyaushe a tilasta tabbatarwa da kuma sarrafa damar shiga bisa ga rawar (RBAC). Idan kayan aikin CI ɗinku ko mai gudanarwa dashboard Ba sai an fallasa shi ga intanet ba, an takaita shiga ta hanyar jerin sunayen IP ko VPN.
3. Duba Fayilolin Saita ta atomatik
Yi amfani da kayan aikin da za a iya yin nazari IaC - Kamfanoni a matsayin Code, Jadawalin Helm, da fayilolin Docker a lokacin pull requestsBinciken tsari na tsaye yana da mahimmanci kamar duba lambar aikace-aikacen ku.
4. Sarrafa Sirri a Tsaro
Ajiye takardun shaidarka a cikin manajan sirri, ba a cikin fayilolin lambar ka ko muhalli ba. Bugu da ƙari, juya bayanan sirri lokaci-lokaci kuma duba rajistar shiga don gano cin zarafi.
5. Tabbatar da Ma'auni
Yi amfani da ma'auni kamar CIS, NIST, da kuma OpenSSF Katunan maki don duba ayyukanku da pipelines don kurakurai na yau da kullun na rashin daidaito.
6. Yi amfani da atomatik tare da Guardrails
Maimakon dogaro da sake dubawa da hannu, tilasta saitunan tsaro ta hanyar sarrafa kansa CI/CD guardrailsMisali, gazawar takan taso ne lokacin da albarkatun gajimare na jama'a ba su cika manufofinka ba.
Idan an tabbatar da cewa an yi kuskure, to, ana buƙatar gyara ta atomatik da kuma tabbatar da tsaro pipeline, rashin daidaiton tsari yana raguwa sosai, kuma masu haɓakawa ba sai sun rage gudu ba don su kasance cikin aminci.
Yi amfani da Xygeni don Toshe Tsarin Tsaro mara kyau a cikin CI/CD Pipelines
Rashin daidaiton tsaro yana ɗaya daga cikin raunin da aka fi sani, wanda aka yi watsi da shi, amma Xygeni yana mayar da shi wani abu da za ku iya ganowa, gyarawa, da kuma hana shi ta atomatik.
Ga yadda Xygeni ke taimaka wa ƙungiyoyin DevOps su dakatar da kurakurai kafin su kai ga samarwa:
1. IaC Security Ana dubawa a Lokacin Ainihin
Na'urar daukar hoton Xygeni Fayilolin Terraform, Helm, Kubernetes, da Docker ɗinku akan kowane commit da kuma pull requestYana nuna alamun tsare-tsare masu haɗari kamar:
- Tashoshin da aka fallasa ko kuma haɗin 0.0.0.0
- Rashin izini bisa ga rawar da aka taka
- Rarraba ko ɓoye hanyar sadarwa ta ɓace
2. CI/CD Guardrails don Toshe Gine-gine marasa tsari
Idan naku pipeline yana fallasa sirri, yana amfani da takardun shaidar da ba a saba gani ba, ko kuma yana barin manyan fayiloli a buɗe, Xygeni zai iya toshe ginin ta atomatik. Kuna saita ƙa'idodi, muna aiwatar da su.
3. Gano Tuki a Tsarin
Xygeni yana sa ido kan yanayin ku don ganin canje-canjen da ba a ba da izini ba. Idan bokitin ajiya ya zama na jama'a ba zato ba tsammani, ko kuma an sake kunna alamar gyara kurakurai, za ku sani kafin ya zama abin da ya faru.
4. Manufofi-kamar-Lambar-doka don Amintattun Abubuwan da Aka Yi Amfani da su
Da farko, yi amfani da Xygeni's guardrails don fayyace ainihin ma'anar "tsaro ta hanyar tsoho" ga ƙungiyar ku. Sakamakon haka, zaku iya toshe haɗuwa masu haɗari, faɗakar da ku game da keta dokoki, da kuma kiyaye bin ƙa'idodi, duk ba tare da rubuta rubutun musamman ba.
5. Haɗin gwiwar Gudanar da Sirri
Bugu da ƙari, Xygeni yana gano sirrin da aka ɓoye, alamun da aka ɓoye, ko nassoshi marasa tsaro a cikin fayilolin tsarin CI ɗinku. Hakanan yana haɗawa ba tare da matsala ba tare da Vaults da KMS don tabbatarwa da gyara duk wani takaddun shaida da aka fallasa.
Duk abin da aka yi la'akari da shi, tare da Xygeni ba lallai ne ka dogara da ƙwaƙwalwar ajiya ko jerin abubuwan da aka lissafa don aiwatar da tsare-tsare masu tsaro ba. Madadin haka, tsaro
Shin kuna shirye don dakatar da kuskuren daidaitawa a tushen?
Gwada Xygeni kyauta na tsawon kwanaki 14 kuma ga yadda yake da sauƙi a toshe abin da wasu suka rasa.
