Yayin da zagayowar rayuwar sarkar samar da software ke ci gaba daga lambar tushe zuwa kayan tarihi da za a iya aiwatarwa, matakin ginawa yana matsayin muhimmin maƙasudi. Duk da haka, wannan matakin sauyi yana kuma fuskantar barazanar da za su iya kawo cikas ga amincin software da kuma build securityWaɗannan barazanar na iya kutsa kai cikin tsarin ginawa ta hanyoyi daban-daban, gami da kauce wa abin da aka kafa CI/CD pipeline, gyara tsarin sarrafa lambar bayan tushe, yin katsalandan ga tsarin ginawa da kansa, ko sarrafa ma'ajiyar kayan tarihi. A cikin wannan rubutun shafin yanar gizo, mun zurfafa cikin waɗannan barazanar kuma mun bincika hare-haren gina sarkar samar da software mafi yawan gaske. Wannan abun ciki yana ci gaba da binciken jerin shafukan yanar gizon mu software supply chain security a ko'ina cikin SDLC.
Matakin Ginawa a Tsarin Rayuwar Haɓaka Software
Matakin ginawa na tsawon rayuwar sarkar samar da software ya ƙunshi tsarin canza lambar tushe zuwa kayan aikin software da za a iya aiwatarwa. Wannan matakin ya ƙunshi tattarawa, haɗawa, da kuma tattara lambar tushe, da kuma samar da fakitin shigarwa da fayilolin daidaitawa.
Build security Barazanar su ne raunin da zai iya ba wa abokin gaba damar gabatar da canje-canje marasa izini ga software yayin aikin ginawa ba tare da canza lambar tushe ba. Ana iya gabatar da waɗannan barazanar ta hanyoyi daban-daban, kamar lalata yanayin ginin ko amfani da raunin da ke cikin kayan aikin gini.
Barazanar Sarkar Samar da Manhaja Mafi Yawa - Harin Ginawa
Tazarar CI/CD
Wannan yana nufin aikin kauce wa ka'idojin da aka kafa CI/CD (haɗa kai akai-akai da kuma isar da sako akai-akai) pipeline ginawa da buga manhaja kai tsaye ba tare da fuskantar tsauraran gwaje-gwaje, tabbatarwa, da kuma hanyoyin tantancewa ba waɗanda jami'in ya saba aiwatarwa. pipelineAna iya yin wannan ta hanyar gina manhajar da hannu a wajen CI/CD muhalli ko ta hanyar amfani da kayan aiki ko rubutun da ke ba da damar yin gyare-gyare ba tare da izini ba ga tsarin ginin. Misalin wannan nau'in harin vector shine Jenkins HariA shekarar 2022, masu kutse sun kutsa kai cikin ginin pipeline na wani sanannen aikin software mai tushe mai suna Jenkins. Masu kutse sun saka lambar mugunta a cikin fayil ɗin Jenkins, wanda shine rubutun da ke bayyana tsarin ginawa. Lambar mugunta ta ba wa masu kutse damar ketare hanyar. CI/CD pipelineyana duba tsaro sannan ya saka lambarsa a cikin tsarin ginawa. Sannan ana aiwatar da wannan lambar a kan tsarin ƙungiyoyin da suka shigar da software ɗin.
Gyara lambar bayan sarrafa tushe
Wannan aikin ya ƙunshi yin canje-canje ba tare da izini ba ga lambar tushe bayan an shigar da shi commitAn yi amfani da shi zuwa tsarin kula da tushen da aka amince da shi (SCS) sannan a gina manhajar ta amfani da wannan lambar da aka gyara. Ana iya yin hakan ta hanyar gyara lambar kai tsaye a kan wurin aiki na mai haɓakawa ko ta amfani da kayan aiki ko rubutun waje don saka lambar mugunta a cikin tsarin ginawa. Misalin wannan harin vector shine GitLab Attack a 2022. Masu kutse sun kutsa kai cikin ginin. pipeline of GitLabMasu kutse sun saka lambar sirri mai cutarwa a cikin GitLab CI/CD pipeline, wanda shine kayan aiki wanda ke sarrafa atomatik build security tsari. Lambar mugunta ta ba wa masu kutse damar gyara lambar bayan an duba ta a cikin ikon sarrafa tushe. Wannan ya ba su damar saka lambar su a cikin software ɗin, wanda daga nan aka aiwatar da shi akan tsarin ƙungiyoyin da suka shigar da software ɗin.
Tsarin gina sulhu
Wannan ya ƙunshi sarrafa ko canza tsarin ginin da kansa, ko dai ta hanyar shiga kai tsaye zuwa yanayin ginin ko ta hanyar amfani da rauni a cikin kayan aikin gini ko dogaro da wasu kamfanoni. Ana iya yin wannan don shigar da lambar mugunta a cikin fitowar ginin, lalata asalin ginin, ko kuma wargaza tsarin ginin gaba ɗaya. Misali mafi shahara na wannan harin vector shine SolarWinds AttackWani mahari ya sami damar shiga dandalin gina SolarWinds ba tare da izini ba, tsarin da ake amfani da shi don tattarawa da kuma naɗe software na SolarWinds Orion. Wannan rubutun ya saka lambar mugunta a cikin software na SolarWinds Orion da aka haɗa. Lokacin da masu amfani suka shigar da software ɗin da aka lalata, an aiwatar da lambar mugunta akan tsarin su, wanda ya ba mahari damar shiga tsarin su ba tare da izini ba. Maharin ya kuma sami damar satar bayanai masu mahimmanci daga tsarin su, kamar takardun shaida, kadarorin ilimi, da bayanan abokin ciniki.
Ma'ajiyar kayan tarihi ta Compromise
Wannan yana nufin shiga ba tare da izini ba ko kuma yin amfani da ma'ajiyar kayan tarihi, inda ake adana fakitin software da binary don rarrabawa ga masu amfani na ciki ko na waje. Masu kai hari za su iya amfani da wannan rauni don gabatar da lambar mugunta, lalata sahihancin software ɗin, ko kuma katse tsarin turawa. Misalin wannan harin vector shine RubyGems a shekarar 2022Masu kutse sun kutsa cikin ma'ajiyar kayan tarihi na RubyGems. Masu kutse sun maye gurbin wani kayan tarihi na gaskiya da wani abu mai cutarwa, wanda dubban ƙungiyoyi suka sauke daga baya tare da Ruby on Rails. Wannan kayan tarihi na cutarwa ya ba masu kutse damar aiwatar da lambar sirri akan tsarin ƙungiyoyin da suka shigar da software. Wannan na iya ba su damar satar bayanai, shigar da malware, ko kuma kawo cikas ga ayyukan.
Alamar karshe
Yayin da ƙungiyoyi ke ci gaba da rungumar hanyoyin haɓaka software waɗanda ke mai da hankali kan sarrafa kansa da kuma ci gaba da isar da su, mahimmancin tabbatar da tsarin gina software bai taɓa zama mafi girma ba. Ta hanyar aiwatar da ingantattun matakan tsaro a duk lokacin ginawa, ƙungiyoyi na iya rage haɗarin faɗawa cikin mummunan hari wanda zai iya lalata amincin da amincin software ɗin su.
Dabaru da aka bayyana a cikin wannan rubutun shafin yanar gizo da misalan da aka bayar suna tunatar da mu cewa matakin ginawa wuri ne mai rauni a cikin sarkar samar da software. Ya kamata ƙungiyoyi su yi taka tsantsan da waɗannan barazanar kuma su aiwatar da matakan tsaro da suka wajaba don kare software ɗinsu daga hari. Ta hanyar yin hakan, za su iya tabbatar da sahihanci, tsaro, da amincin software ɗinsu ga masu amfani da su da abokan cinikinsu.
Shiga Tafiyarmu Zuwa Tsarin Tsaron Manhaja na Manhaja
Kada ku rasa wannan damar ta kasancewa a gaba wajen guje wa barazanar sarkar samar da software. Yi rijista a shafin yanar gizon mu a yau kuma ku zama na farko da zai karɓi sabbin bayanai, don tabbatar da cewa ƙungiyar ku ta kasance mai juriya da aminci a tsakanin barazanar da ke tasowa. Tare, za mu iya gina tsarin software mai ƙarfi da aminci ga kowa.
Kalli Bidiyon Nunin Mu
