Ke hoʻomaopopo nei i ka helu ʻana o nā nāwaliwali maʻamau no DevSecOps #
Inā ʻoe e hoʻolilo i ka manawa kūpono e nānā hou ana i nā ʻike palekana, ʻike hope ʻoe i nā ʻano like e kū hou mai ana: SQL injection ma aneʻi, kahi deserialization palekana ʻole ma laila, kahi hōʻoia hoʻokomo poina i kahi āu i manaʻo ʻole ai. Ma hope o kekahi manawa, hakakā kēlā me kēia ʻenekinia AppSec a me kēlā me kēia hui DevSecOps me ka nīnau like e kū mai ana i ka wā e hoʻāʻo ai ʻoe e hoʻokomo i ke kauoha i loko o ka haunaele: he aha ka mea a CWE e hoʻokaʻawale nei, a no ke aha he mea nui ia i ka wā e hoʻāʻo nei ʻoe e ʻōlelo like nā hui ʻenekinia a me nā hui palekana? Ke hele nei kēia glossary ma o ka mea he CWE, ʻaʻole mai kahi manaʻo kumumanaʻo akā mai ka manaʻo o kekahi i ʻike i nā haneli o pipelines, nā ʻumi o nā codebases, a me kahi parade lōʻihi o nā hewa e hana hou ana. E noʻonoʻo i kēia e like me ka episode aʻe i loko o kahi moʻo: ma hope o ka hoʻomaopopo ʻana i nā pūʻolo ʻino, nā wahi makapō o ke kaulahao lako, a me ka walaʻau nāwaliwali, ua hiki i ka manawa e wehewehe i ke kiʻina hana e hoʻopaʻa ai i nā pilikia he nui.
ke kumu o ke #
E hoʻomaka kākou me ka maopopo: ʻo CWE ke kū nei no Ka Helu ʻana o nā Nāwaliwali Maʻamau, he papa inoa i hoʻomohala ʻia e ke kaiāulu o nā nāwaliwali polokalamu a me nā lako maʻamau. Ke nīnau ka poʻe he aha ka CWE i ka palekana cyber, ke nīnau maoli nei lākou e pili ana i ka puke wehewehe ʻōlelo i kaʻana like ʻia e nā mea loiloi, nā mea hoʻomohala, a me nā mea hana palekana e wehewehe i ka nā kumu koʻikoʻi ma hope o nā nāwaliwali. Ma hea e wehewehe ai nā CVE nā hihia kikoʻī o nā nāwaliwali i nā huahana, wehewehe lākou i ka kuhihewa kumu ʻo ia ke kumu o ia mau mea. No laila he aha ia? ʻAʻole ia he nāwaliwali ponoʻī akā he ʻano kīnā hou, he papa nāwaliwali. A he aha ka nāwaliwali CWE? Pili ia i nā nāwaliwali i pili pono i kekahi o kēia mau nāwaliwali i wehewehe ʻia e CWE. Ke hōʻailona kahi scanner iā "CWE-79" a i ʻole "CWE-89," ke kuhikuhi nei ia i ka pilikia hoʻonohonoho kuleana no ka hoʻohana hewa ʻana. ʻO ka hoʻomaopopo ʻana i ke ʻano o ka CWE hāʻawi i nā hui i kahi hiʻohiʻona koʻikoʻi o ka pilikia no ka mea ʻo ka hoʻoponopono ʻana i ka nāwaliwali e pale aku i nā ʻohana holoʻokoʻa o nā nāwaliwali, ʻaʻole hoʻokahi wale nō hihia.
No ke aha e holo mau ai nā hui DevSecOps i ka CWE? #
ʻO kekahi o nā haʻalulu mua no nā hui e hoʻomāhuahua ana i kā lākou DevSecOps pipelineʻo ia hoʻi mīkini ʻimi, SAST hana, Nā mea hana DAST, SCA paepae ai, a hoʻolei nā mea kālailai ipu a puni i nā mea hōʻike CWE me he mea lā ua ʻike mua nā mea a pau iā lākou ma ka naʻau. I ka manawa koke, he pipeline haki no ka mea ua loaʻa i kahi puka kūkulu ʻo "CWE-22" a i ʻole "CWE-502," a nīnau nā mea hoʻomohala, "ʻAe ... akā he aha ka CWE ma nā huaʻōlelo palekana pūnaewele e hiki ai iā mākou ke hana pū me?" Aia kēia hakahaka ma nā wahi āpau:
- ʻŌlelo ka palekana ma nā code CWE.
- ʻŌlelo nā mea hoʻomohala ma nā kiʻikuhi, nā hana, a me nā hale waihona puke.
- Noʻonoʻo nā kime huahana i nā hiʻohiʻona a me nā lā palena.
Aia ka helu ʻana o nā nāwaliwali maʻamau e hoʻopili i kēlā hakahaka. Ke maopopo iā ʻoe ke ʻano o ka CWE, maopopo iā ʻoe ke kumu kumu, ʻaʻole wale ka hōʻailona. Ke maopopo iā ʻoe ka helu ʻana o nā nāwaliwali maʻamau, hiki iā ʻoe ke hoʻomaopopo pehea e pili ai nā nāwaliwali i ka hoʻohana maoli ʻana.
Ke Wehewehe ʻana i nā Mea i Uhi ʻia #
I mea e maopopo maoli ai i ke ʻano o ia mea, pono ʻoe e ʻike i ke ʻano o ka papahana. Mālama ʻia ʻo CWE e MITER ma ke ʻano he hoʻokaʻawale ʻana o nā ʻano nāwaliwali i alakaʻi ʻia e ke kaiāulu. ʻO kēia mau mea:
- Nā hewa hōʻoia hoʻokomo (e laʻa, nā hemahema injection, nā overflows buffer)
- Nā hewa hōʻoia a me ka ʻae ʻana
- Hoʻohana hewa ʻana o ka API
- Ka lawelawe ʻana i nā hewa a me nā pilikia logic ʻokoʻa
- Nā nāwaliwali o ka hoʻonohonoho ʻana a me ke kaiapuni
- Nā pilikia serialization/deserialization
- Nā hemahema o ka hoʻokele kumuwaiwai a me ka hoʻomanaʻo
Pane kēia i kahi hapa nui o ke ʻano o CWE i ka palekana pūnaewele: ʻaʻole ia he scanner nāwaliwali, a i ʻole kahi papa inoa o nā hana hoʻopunipuni i ʻike ʻia, a i ʻole kahi waihona ʻikepili o nā CVE kikoʻī. He taxonomy ia, ka puke wehewehe ʻōlelo ma hope o ka ʻōlelo nāwaliwali.
A hoʻohana ʻia kēlā puke wehewehe ʻōlelo ma nā wahi āpau: ma nā komo NVD, ma SAST nā mea i loaʻa, ma ke aʻo ʻana i nā code palekana, ma nā kumu hoʻohālike hoʻoweliweli, ma nā ʻōnaehana hoʻokō, a ma aneane kēlā me kēia ʻāpana o nā mea hana DevSecOps.
Nā Manaʻo Kūpono ʻole e pili ana i ia mea, a ʻaʻole ia #
E like me kā mākou i ʻike ai me nā pūʻolo ʻino a i ʻole nā pilikia hilinaʻi, hoʻomaopopo pinepine nā hui palekana i ka mea e pono ai nā ʻenehana e hana. Pēlā nō ia me CWE, no laila he mea kūpono ke ʻimi i nā manaʻo kuhihewa maʻamau e pili ana i ke ʻano o kahi CWE a me ke kumu o kēia mau kuhihewa he mea nui.
Kuhihewa #1: Ma ke ʻano he waihona ʻikepili nāwaliwali #
ʻO kēia ka hewa maʻamau a nā hui e hana ai i ka wā e nīnau ai lākou he aha ka CWE i ka palekana cyber. ʻO CVE kahi papa inoa o nā nāwaliwali maoli; he papa inoa ia o nā māhele nāwaliwaliInā nīnau kekahi he aha ka nāwaliwali maʻamau o ka helu ʻana, ʻo ka pane: "he CVE i hāʻawi ʻia i kahi kumu CWE."
Kuhihewa #2: He mea nui wale nō lākou i nā hui AppSec #
I ka hana maoli, he mea nui ka CWE i kēlā me kēia ʻāpana o kahi DevSecOps pipeline:
- SAST palapala ʻāina i loaʻa iā CWE
- SCA palapala ʻāina o nā mea hana i CWE ke hoʻokomo nā nāwaliwali i kēia mau lepili
- Heluhelu nā mea hoʻomohala i nā wehewehe CWE i ka wā e hoʻoponopono ai i nā pilikia
- Hoʻohana nā hiʻohiʻona hoʻoweliweli iā lākou ma ke ʻano he mau poloka kūkulu
- Hoʻopāʻālua palekana standardpalapala ʻāina s i nā māhele CWE
Inā ʻoe e kūkulu i nā polokalamu, hoʻopilikia ka helu nāwaliwali maʻamau iā ʻoe, inā ʻoe e ʻike a ʻaʻole paha.
Kuhihewa #3: He pohihihi loa lākou e pono ai #
ʻIke ʻia kekahi mau wehewehe ʻana he mea paʻakikī i ka nānā mua ʻana, akā ʻo ka waiwai maoli aia i ke kūlike. Inā ʻaʻole ʻoe maopopo i ke ʻano o ka CWE, e like ia me kahi code cryptic. Ke aʻo ʻoe i ke ʻano, hiki iā ʻoe ke hoʻohui koke, hoʻonohonoho i nā mea nui, a hoʻolālā i kāu mau hoʻoponopono.
Pehea e hoʻomaikaʻi ai ʻo CWE i ka hoʻokele nāwaliwali a me DevSecOps? #
ʻO ka hoʻomaopopo ʻana i ke ʻano o CWE i ka palekana pūnaewele e hoʻololi i ke ʻano o ka hoʻoponopono ʻana a me ka hoʻoponopono ʻana o nā hui i nā pilikia. Ma kahi o ke kinai ʻana i kēlā me kēia CVE pākahi, ʻo ka helu ʻana o ka nāwaliwali maʻamau e ʻae i nā hui e ʻike i nā ʻano:
- No ke aha mākou e ʻike mau nei i nā pilikia injection ma nā lawelawe?
- No ke aha e ʻike hou ʻia ai nā hewa hōʻoia?
- No ke aha i pilikia mau ai kekahi mau hoʻonohonoho ʻana?
ʻO kēia ke kumu o ka hoʻomaopopo ʻana i ke ʻano o ka CWE: e pale aku i nā ʻano āpau o nā nāwaliwali, ʻaʻole e pane wale iā lākou. pipelineKe hōʻike nei i kahi nāwaliwali o kēia ʻano, hiki i nā hui ke palapala iā ia e hoʻopaʻa i nā alakaʻi coding, ka ʻike e kū nei, a me nā kulekele hana ponoʻī.re.
Pehea e pili ai i nā nāwaliwali maoli (ka pilina CVE → CWE) #
Hoʻomaka kēlā me kēia nāwaliwali ma ke ʻano he komo CVE. I ka hoʻonui ʻana o nā mea loiloi i kēlā mau CVE, hāʻawi lākou i kahi CWE e wehewehe ana i ke kumu. He mea nui kēlā palapala ʻāina i nā mea hana, ka helu ʻana i ka pilikia, dashboards, a me nā kaʻina hana hoʻoponopono. I ka ʻōlelo maʻalahi:
- Hōʻike ʻo CVE iā ʻoe he aha i hana ai.
- Hōʻike ʻo CWE iā ʻoe no ke aha i hana ʻia ai.
Inā ʻaʻole maopopo i kahi hui ke ʻano o ka CWE, nalo lākou i ke "kumu." ʻO ia ke alakaʻi ʻana i ka mālama ʻana i nā nāwaliwali e like me nā hanana kaʻawale ma kahi o nā hōʻailona o nā nāwaliwali kūkulu. E luʻu i loko o nā ʻokoʻa koʻikoʻi ma waena o CWE a me CVE.
Ka Helu ʻana o nā Nāwaliwali Maʻamau i ka Coding Palekana, SAST, a Pipeline hana nona iho #
Hoikehonua, pipelineHoʻopuka nā s i nā nui he nui o nā mea i loaʻa. ʻO ka helu ʻana i nā nāwaliwali maʻamau e hāʻawi i ka hoʻonohonoho ʻana i kēlā nui. ʻO ka hoʻomaopopo ʻana i ke ʻano o CWE i ka palekana cyber e kōkua i nā ʻenekinia DevSecOps:
- Kūkulu i nā puka pā hana aunoa a puni nā māhele pilikia kiʻekiʻe
- E hoʻonohonoho i nā nāwaliwali i hoʻohana nui ʻia ma ke ao maoli
- E hoʻohālikelike i ka hoʻonaʻauao mea hoʻomohala me nā ʻano maoli
- Hoʻohui i nā lula e pili ana i ka CWE i loko SAST a me nā hoʻāʻo ʻāpana
- E hōʻemi i ka walaʻau ma o ka noʻonoʻo ʻana i nā pilikia e hana hou ʻia ana
A i ka wā e hōʻike ai kahi mea hana i kahi nāwaliwali CWE, hana ia i kahi ʻōlelo i kaʻana like ʻia ma waena o nā mea hoʻomohala a me nā loiloi palekana i ka wā o nā loiloi code.
No ke aha e pili ai Software Supply Chain Security a me Xygeni #
ʻOiai ke kālele nei ia i nā nāwaliwali o ka polokalamu, ʻaʻole i ka ʻike ʻana i nā pūʻolo ʻino, ʻo ka hoʻomaopopo ʻana i ke ʻano o CWE he mea nui ia i ka ʻike ʻana i nā ʻano hoʻonohonoho. nā nāwaliwali i nā ʻāpana open-source a i ʻole nā palapala kūkuluʻAʻole hopu ʻo CWE i nā hana ʻino, akā hōʻike ia i nā ʻano palupalu a nā mea hoʻouka e hana ʻino nei. Hoʻopili kēia i ka laulā ākea pilikia kaulahao lako polokalamuInā hāʻule pinepine nā hui i nā nāwaliwali like, ʻike maopopo ka poʻe hoʻouka kaua i kahi e hahau ai.
ʻO ka pane maoli i ka nīnau "He aha ka helu ʻana o nā nāwaliwali maʻamau?" #
E hōʻuluʻuluʻia:
- He aha ka CWE i ka palekana pūnaewele? ʻO ka ʻōnaehana hoʻokaʻawale e kākoʻo ana i ke ʻano o ka wehewehe ʻana, ka nānā ʻana, a me ka hoʻoponopono ʻana i nā nāwaliwali.
- He aha ka nāwaliwali o ka CWE? He ʻano nāwaliwali, ʻaʻole he nāwaliwali, akā, ʻo ke kīnā ma hope ona.
- He aha ka Helu o nā Nāwaliwali Maʻamau? ʻO ka nāwaliwali i pili i kahi nāwaliwali kikoʻī.
ʻO ke aʻo ʻana i ka helu ʻana o nā nāwaliwali maʻamau ua like ia me ke aʻo ʻana i ke ʻano o ka pilikia polokalamu. Ke hoʻomaopopo ʻoe i ke ʻano, e ʻike maopopo ʻia ke ʻano o ka nāwaliwali holoʻokoʻa. A i ka wā e hiki ai i nā hui DevSecOps ke ʻike i nā ʻano ma kahi o nā pilikia kaʻawale, e hoʻomaikaʻi ka palekana ma kona kumu, ʻaʻole wale ma kona ʻili.
