Thaum xyoo 2023 xaus, thaj chaw kev ruaj ntseg hauv cyber tau kub hnyiab nrog cov ntawv ceeb toom thiab kev tshuaj xyuas. Ntawm lawv, cov NSA 2023 Xyoo Kev Ruaj Ntseg Hauv Is Taws Nem Hauv Kev Tshuaj Xyuas tau txais kev saib xyuas. Xygeni, nyob rau hauv lub xyoo no uas muaj kev kub ntxhov, lub hom phiaj yog los pab txhawb kev nkag siab thiab kev txo qis ntawm kev hem thawj rau cov khoom siv software. Nyob rau hauv lub sijhawm uas qhov nyuaj ntawm software yog qhov nyuaj heev, peb qhov kev vam khom rau cov khoom qhib-qhov chaw thiab kev hloov pauv ntawm DevSecOps thiab cov txheej txheem huab-native tau mus txog qhov siab tshiab. Qhov no sneak peek rau hauv Daim ntawv qhia ntawm Xygeni muab kev nkag siab txog cov teeb meem tseem ceeb uas cov neeg ntsib software supply chain security xyoo 2023 thiab muab cov tswv yim los daws cov teeb meem no xyoo 2024.
Table of Contents
Lub Web Complex ntawm Software Supply Chain Security
Nyob rau hauv lub xeev tam sim no ntawm SSCS, kev hem thawj hauv cyber loj heev, ua rau muaj kev txhawj xeeb loj rau cov tuam txhab thiab cov tib neeg ib yam. Kev nce ntxiv ntawm kev ua haujlwm nyob deb thiab kev vam khom ntau ntxiv rau cov kev pabcuam huab tau nthuav dav qhov chaw tawm tsam, ua rau kev tiv thaiv ntawm cov khoom siv software yog qhov kev sib tw loj dua. Kev paub tias cov khoom siv tau dhau los ua qhov kev tawm tsam txhob txwm maj mam pib rau kev lag luam software. Cov lus nug tshwm sim: Peb yuav ua li cas kom muaj kev nyab xeeb hauv lub vev xaib no? Peb puas tuaj yeem ntseeg software los ntawm ob qho tib si qhib-qhov chaw zej zog thiab cov chaw muab kev pabcuam lag luam? Cov koom haum yuav ua li cas kom muaj kev ntseeg siab rau lawv cov neeg siv khoom software txog qhov tsis muaj qhov tsis zoo lossis malware?
Daim Ntawv Tshaj Tawm ntawm Xygeni Yuav Tshawb Pom Dab Tsi
Daim ntawv tshaj tawm ntawm Xygeni lub hom phiaj yog los qhia txog cov xwm txheej thiab cov qauv uas tau txhais software supply chain security xyoo 2023 thiab muab ib qho kev pom thawj zaug txog yam uas xyoo 2024 yuav coj los. Daim ntawv tshaj tawm yuav hais txog:
Cov ntsiab lus tseem ceeb: "Los ntawm cov lej"
Tau sau npe rau xyoo ntawm 'hluav taws kub hauv hav zoov digital,' 2023 tau pom cov xwm txheej uas tau tshwm sim hauv xov xwm, suav nrog cov uas cuam tshuam rau PyTorch, 3CX, thiab MOVEit Transfer. Qhov tseeb tiag yog tias 82% ntawm cov koom haum Tam sim no lawv muaj kev phom sij rau kev tawm tsam software, nrog rau tus lej nruab nrab ntawm cov khoom tsis muaj zog hauv cov khoom xa tuaj nce ntau dua 50% txhua xyoo. NTT Ltd tshaj tawm tias kev lag luam thev naus laus zis yog kev lag luam uas raug tsom mus rau ntau tshaj plaws, suav txog 28% ntawm tag nrho cov kev tawm tsam hauv cov khoom xa tuaj.
Qhib qhov software, suav nrog 70% txog 90% ntawm cov ntawv thov niaj hnub no, ntsib kev nce ntxiv ntawm cov pob khoom phem hauv cov npe pej xeem - qhov xav tsis thoob 245,032 zaug, ob npaug ntawm cov lej los ntawm xyoo dhau los.
Thaj Chaw Tawm Tsam
Xyoo 2023, kev tawm tsam hauv cyber tau nce siab, nrog rau Lub Koom Haum EU rau Kev Ruaj Ntseg Hauv Is Taws Nem kaw 2,580 qhov teeb meem kev ruaj ntseg, 220 ntawm cov uas tau tsom mus rau ntau lub tebchaws uas yog tswv cuab. Ransomware thiab kev tawm tsam tsis kam lees kev pabcuam tau tswj hwm, tab sis kev tawm tsam tsom mus rau cov khoom siv software kuj tau pom. Qhov tseem ceeb, AI chatbots tau nkag mus rau hauv qhov chaw hem thawj cybersecurity, ua rau muaj kev txhawj xeeb txog 'kev cuav pheej yig' thiab kev siv AI los tswj cov ntaub ntawv.
Cov txheej txheem tawm tsam hauv xyoo 2023
Cov neeg tawm tsam txuas ntxiv siv cov txheej txheem uas paub zoo xws li kev dag ntxias thiab kev tsim kho hauv zej zog, cov ntaub ntawv pov thawj raug nyiag, thiab kev tawm tsam raws li cov pob khoom typosquat. Txawm li cas los xij, xyoo 2023 tau pom kev nce ntxiv ntawm cov txheej txheem nyuaj, suav nrog xav tau (Kev Phishing Lub Suab) siv cov lus uas AI tsim los ua lub suab. Cov pob khoom phem uas tau xa mus rau hauv cov npe pej xeem tau txog 245,032 qhov xwm txheej, qhia txog qhov xav tau kev tiv thaiv zoo.
Cov Neeg Ua Phem Siab Tshaj Plaws
Kev nom kev tswv hauv ntiaj teb tau cuam tshuam rau kev ua haujlwm hauv cyber, nrog rau cov APTs uas tau txhawb nqa los ntawm lub xeev koom nrog kev dag ntxias, kev soj xyuas, thiab kev ua phem. Tsov rog Ukraine tau dhau los ua qhov chaw tseem ceeb, qhia txog kev ua haujlwm hauv cyber los ntawm cov neeg ua yeeb yam Lavxias, Iran, thiab North Kauslim. Tuam Tshoj tau ua kom nws txoj haujlwm ruaj khov ua lub zog thoob ntiaj teb CyberPower, thaum kev ua txhaum cai cyber txuas ntxiv mus, piv txwv los ntawm Tuam Tshoj Evasive Panda tsom mus rau ib lub koom haum thoob ntiaj teb.
Tig peb lub hom phiaj mus rau qhov kev tsis sib haum xeeb tsis ntev los no, kev sib ntaus sib tua hauv internet ntawm Hamas thiab Ixayees tau koom nrog kev tawm tsam DDoS sib pauv. Qee tus kws tshuaj ntsuam xyuas txuas Hamas rau kev ua phem ntawm Iran. APT Agrius txuas nrog Iran, tseem hu ua "Agonizing Serpens," uas paub zoo txog nws cov wipers puas tsuaj, tau tsom mus rau cov koom haum Ixayees thoob plaws ntau lub koom haum thiab lub tebchaws. Xyoo 2023, Agrius cov kev siv zog tau tsom mus rau kev kawm thiab kev siv tshuab hauv Ixayees.
Kev Cuam Tshuam ntawm Kev Tawm Tsam
Qhov cuam tshuam ntawm kev tawm tsam hauv cyber, xws li cov kab ke puas tsuaj, kev puas tsuaj ntawm cov ntaub ntawv, thiab kev nkag mus rau hauv lub computer, ntau dua li qhov cuam tshuam nyiaj txiag thiab kev sib raug zoo hauv zej zog. Splunk txoj kev tshawb fawb tau hais txog lub sijhawm thiab cov peev txheej tseem ceeb uas siv rau kev ntxuav, tsuas yog 4% ntawm cov neeg teb tau tshaj tawm tias tsis muaj qhov tshwm sim tseem ceeb.
Cov Lus Qhia Txog Kev Tawm Tsam Tseem Ceeb hauv xyoo 2023
Xyoo no tau pom muaj kev tawm tsam paradigmatic, suav nrog PyTorch nightly InfoStealer, CircleCI qhov xwm txheej, 3CX multi-step attack, MOVEit Transfer data breach, PyPI temporal suspension, NPM Manifest Confusion, JumpCloud attack, thiab VMConnect campaign. Txhua qhov xwm txheej tau hais txog qhov sib txawv thiab kev hloov pauv ntawm SSC kev tawm tsam.
Evolution ntawm Standards thiab Cov Cai
Lub moj khaum kev cai lij choj rau SSC tab tom raug tsim kho. Nrog rau qhov sib txawv ntawm ntau thaj chaw, nws zoo li Tebchaws Meskas muaj lub moj khaum laus tshaj plaws, nrog rau European Union qeeb. Kev tshaj tawm ntawm Txoj Cai Kev Ruaj Ntseg Hauv Tebchaws thiab cov Daim Ntawv Qhia Txog Kev Ruaj Ntseg ntawm Software Open Source yog cov xwm txheej tseem ceeb hauv Tebchaws Meskas. Hauv EU Txoj Cai Cyber Resilience Act tau mus txog qhov kev pom zoo nom tswv, tab sis feem ntau cov koom haum tau ua haujlwm ntawm NIS2 cov lus qhia thiab Digital Operational Resilience Act (DORA).
Tej zaum qhov kev tshwm sim tseem ceeb tshaj plaws thoob ntiaj teb yog kev sib koom ua ke Hloov Qhov Sib Npaug ntawm Kev Pheej Hmoo Cybersecurity: Cov Ntsiab Cai thiab Cov Kev Qhia rau Kev Ruaj Ntseg los ntawm Kev Tsim Software tus coj CISThiab koom nrog ntau tus tub ceev xwm cybersec thoob plaws ntiaj teb.
Saib rau xyoo 2024
Daim ntawv tshaj tawm muaj qee qhov kev kwv yees: Los ntawm xyoo 2025, 45% ntawm cov koom haum thoob ntiaj teb yuav ntsib tsawg kawg ib qho kev tawm tsam SSC. Peb yuav pom cov pab pawg neeg ua txhaum cai koom nrog kev ua txhaum cai hauv cyber, siv cov kev pabcuam Cybercrime-as-a-Service uas paub tab dua. Cov cai tswjfwm uas pib siv thaum lub xyoo yuav txhim kho qhov pom tseeb ntawm cov xwm txheej kev ruaj ntseg, nrog rau ntau cov ntsiab lus tawm tsam thiab cov lus qhia tau qhia. Kev pov hwm kev pheej hmoo hauv cyber yuav qhia txog kev txwv thiab kev ua ntau dhau. Thiab kev nce qib hauv thev naus laus zis yuav sib haum nrog kev ruaj ntseg-los ntawm kev tsim qauv qhov sib txawv, nrog rau ntau lub nra hnyav ntawm sab ntawm cov tuam txhab tsim khoom software.
Xyoo 2023, lub zog AI tau nyiam ntau tus neeg muag khoom kev ruaj ntseg los ntxiv qee qhov "AI kov" rau lawv cov khoom. Txawm li cas los xij, AI tau teeb tsa los ua lub luag haujlwm tseem ceeb rau yav tom ntej ntawm software supply chain securityAI yuav ua lub luag haujlwm ntau ntxiv hauv cov cheeb tsam xws li kev txawj ntse txog kev hem thawj thiab kev ntsuam xyuas kev pheej hmoo, kev tshawb pom qhov tsis zoo hauv cov chaw khaws cov lej, kev ntsuam xyuas qhov tsis muaj zog thiab kev txiav txim siab ua ntej, thiab phishing nres nrhiav tau, tab sis feem ntau yog nyob rau hauv kev kho kom zoo thiab kev tshuaj xyuas cov lej tsis siv neeg.
Tab sis cov neeg ua phem tau pib siv AI ua riam phom, thiab peb yuav pom cov txheej txheem tshiab xws li kev soj ntsuam uas siv AI, kev siv rab hmuv uas ntseeg tau heev phishing, cov cuab yeej AI jailbreaking, lossis cov kev pabcuam daws CAPTCHA.
xaus
Thaum Xygeni npaj yuav tshaj tawm nws daim ntawv qhia txog qhov xwm txheej ntawm software supply chain security Xyoo 2023, tej kev cov nyom thiab kev hem thawj uas kev lag luam ntsib yog qhov pom tseeb. Cov khoom siv software uas ib zaug suav tias yog ib qho txheej txheem tom qab, tau tshwm sim ua lub hom phiaj tseem ceeb rau cov yeeb ncuab cyber. Kev teb ntawm kev lag luam rau cov kev cov nyom no yuav hloov pauv txoj kev ntawm kev ruaj ntseg software hauv xyoo tom ntej. Nyob twj ywm rau daim ntawv qhia tag nrho thaum peb nkag mus rau hauv cov ntsiab lus thiab muab cov kev nkag siab uas tuaj yeem pab taug kev hauv qhov nyuaj ntawm software supply chain security.
