Kev Tawm Tsam Txog Kev Muab Khoom Siv Software yog dab tsi? #
Hauv cov lus txhais no peb yuav txhais lub ntsiab lus ntawm kev tawm tsam software supply chain, thiab peb kuj yuav qhia txog qee qhov piv txwv ntawm kev tawm tsam software supply chain.
Raws li koj twb paub lawm, kev tawm tsam software supply chain yog ib hom kev tawm tsam cyberattacks tshwj xeeb. Lawv feem ntau tsom mus rau cov khoom siv software sab nraud, cov tsev qiv ntawv, cov cuab yeej tsim kho, lossis cov khoom siv uas siv los tsim thiab faib cov ntawv thov software. Tsis txhob tawm tsam lub koom haum uas koj xav tau ncaj qha, cov neeg ua phem hem nkag mus rau hauv cov neeg muab khoom software lossis cov neeg muab kev pabcuam uas koj ntseeg siab, kev qhia txog cov lej phem or sab nraum qab uas tom qab ntawd xa mus rau cov neeg siv kawg ua ib feem ntawm kev hloov kho tshiab lossis kev teeb tsa raug cai. Raws li kev tawm tsam software xa khoom siv cov kev sib raug zoo ntawm kev ntseeg siab tsis meej hauv SDLC, nws ua rau nws nyuaj thiab tshwj xeeb tshaj yog insidious thiab nyuaj rau nrhiav pom.
Kev txhais kom meej:
Kev Tawm Tsam Txog Kev Muab Khoom Siv Software yog dab tsi thiab Vim Li Cas Lawv Thiaj Tseem Ceeb? #
Tsis zoo li kev tawm tsam hauv cyber li niaj zaus, kev tawm tsam software supply chain ua rau cov ntsiab lus tseem ceeb ntawm cov txheej txheem tsim daim ntawv thov puas tsuaj. Yog tias lawv ua tiav, lawv tuaj yeem nthuav dav sai thiab cuam tshuam rau ntau txhiab lub koom haum tib lub sijhawm. Hom kev tawm tsam no tau txais kev saib xyuas ntau nrog cov xwm txheej tseem ceeb xws li SolarWinds breach (uas peb yuav hais hauv qab no), qhov twg cov kev hloov tshiab raug cuam tshuam tau kis tus kab mob rau ntau tsoomfwv thiab enterprise cov kab ke. Vim li cas cov neeg ua phem thiaj li xav paub? Qhov kev thov kom ua tau zoo yog nyob rau hauv qhov ncav cuag dav thiab cov cai siab uas feem ntau cuam tshuam nrog cov khoom siv software, ua rau cov kev tawm tsam no ua tau zoo thiab ua rau puas tsuaj loj heev.
Cov Cim Tseem Ceeb #
Qee qhov tseem ceeb ntawm kev tawm tsam software supply chain yog:
- Kev Siv Nyiaj Txiag Rau Kev Ntseeg Siab: Cov neeg ua phem feem ntau siv qhov zoo ntawm kev sib raug zoo ntawm cov neeg tsim khoom thiab lawv cov cuab yeej, kev vam khom sab nraud, thiab cov neeg muag khoom.
- Kev cuam tshuam sab nraud: ib qho kev sib haum xeeb tshwj xeeb thiab ib qho tuaj yeem kis mus rau ntau tus neeg raug tsim txom los ntawm cov kev faib tawm software
- Stealth thiab Persistence: Cov lej phem feem ntau raug muab tso rau hauv cov pob khoom software uas tau kos npe, zoo li raug cai, ua rau muaj kev ruaj khov mus sij hawm ntev
- Kev Sau Npe Sib Txawv: vim tias qhov kev tawm tsam zoo li no pib los ntawm sab saud hauv cov khoom xa tuaj, kev nrhiav qhov chaw tuaj yeem nyuaj heev thiab siv sijhawm ntau.
Cov Vectors Feem Ntau ntawm Kev Tawm Tsam Software Supply Chain
#
Cov Cheebtsam & Kev Txuas Nrog Sab Nraud: cov neeg tawm tsam tuaj yeem cuam tshuam cov pob OSS uas siv dav dav lossis cov SDK tshwj xeeb, uas tsis paub tias suav nrog hauv cov haujlwm tsim kho
Tsim Cov Txheej Txheem thiab CI/CD Pipelines: siv cov chaw tsim khoom tsis raug lossis tsis muaj zog los txhaj cov khoom phem thaum lub sijhawm sau lossis ntim khoom software
Cov Chaw Khaws Cov Code: kev nkag mus tsis raug cai rau cov chaw khaws cia cov lej qhov chaw (piv txwv li, GitHub) los hloov cov lej raug cai nrog cov payloads phem
Kev Hloov Kho Software thiab Cov Txheej Txheem Kho: kev cuam tshuam lossis kev tswj hwm cov channel hloov tshiab kom xa cov qauv software uas ntseeg siab tau
Tam sim no, cia peb tshawb nrhiav qee qhov piv txwv. Yog tias koj xav tau cov ntaub ntawv ntxiv txog cov kab mob thiab hom kev tawm tsam - dhia hauv!
Piv txwv ntawm Kev Tawm Tsam Txog Kev Muab Khoom Siv Software #
- SolarWinds Orion (2020): qhov no tej zaum yuav yog ib qho piv txwv uas muaj npe nrov tshaj plaws. Cov neeg tawm tsam tau ntxig lub qhov rooj tom qab hu ua "SUNBURST" rau hauv qhov hloov tshiab software raug cai, uas tau rub tawm los ntawm ntau dua 18,000 tus neeg siv khoom, suav nrog Fortune 500 cov tuam txhab thiab cov koom haum tsoomfwv Meskas.
- Codecov Bash Uploader (2021): nyob rau hauv cov ntaub ntawv no cov neeg ua phem hem thawj tau hloov kho tsab ntawv siv hauv CI pipelines, nyiag cov ntaub ntawv pov thawj thiab cov hloov pauv ib puag ncig los ntawm ntau txhiab qhov project
- UAParser.js (2021): an NPM Lub tsev qiv ntawv uas siv los ntawm ntau lab tus neeg raug nyiag thiab luam tawm dua nrog kev khawb crypto thiab malware nyiag daim ntawv pov thawj
- Kaseya VSA (2021): ntawm no, cov neeg tawm tsam tau siv qhov tsis muaj zog hauv lub platform saib xyuas chaw deb kom xa ransomware mus rau cov chaw muab kev pabcuam thiab lawv cov neeg siv khoom.
Cov piv txwv ntawm kev tawm tsam software no qhia txog ntau yam txheej txheem thiab qhov cuam tshuam loj heev, uas qhia txog qhov xav tau kev kuaj xyuas kev ncaj ncees ntawm software.
Qee Cov Txheej Txheem Tshawb Pom thiab Tiv Thaiv #
Vim tias qhov nyuaj thiab nws qhov xwm txheej zais cia, kev tiv thaiv thiab nrhiav pom kev tawm tsam software xa khoom yuav tsum muaj cov txheej txheem kev ruaj ntseg ntau txheej:
- SBOM (Daim Ntawv Qhia Txog Cov Khoom Siv Software): Khaws cov khoom muag kom ntxaws txog txhua yam khoom siv sab nraud thiab lawv cov qauv kom pom cov kev hloov pauv tsis zoo lossis tsis tau tso cai
- Kev Kos Npe thiab Kev Txheeb Xyuas Tus lej: Xyuas kom meej tias txhua yam khoom siv tau kos npe thiab txheeb xyuas cryptographically thaum lub sijhawm tsim thiab xa tawm
- Kev Saib Xyuas Lub Sijhawm Khiav: Siv EDR thiab runtime application self-protection (RASP) los nrhiav cov cwj pwm txawv txawv thaum lub sijhawm ua haujlwm
- Kev Tswj Xyuas Kev Nkag Mus Thiab Kev Tshuaj Xyuas: Ua kom muaj kev nkag mus rau cov chaw khaws cov code thiab CI/CD cov chaw ib puag ncig nrog ntau yam kev lees paub thiab kev tswj hwm kev nkag mus raws li lub luag haujlwm
- Kev Tshawb Xyuas Qhov Tsis Zoo Tsis Tu Ncua: Siv cov cuab yeej ua haujlwm tsis siv neeg los luam theej cov kev vam khom qhib-qhov chaw thiab nrhiav pom qhov tsis zoo lossis kev teeb tsa tsis raug.
- Kev Tswj Xyuas Kev Pheej Hmoo ntawm Tus Muag Khoom: Soj ntsuam kev ruaj ntseg ntawm txhua tus neeg muag khoom sab nraud, tshwj xeeb tshaj yog cov neeg uas nkag mus rau cov chaw tsim kho uas muaj kev nkag siab tob
Koj puas paub txog qhov cuam tshuam ntawm kev pheej hmoo rau cov pab pawg kev ruaj ntseg thiab DevSecOps? #
#
Cov thawj coj kev ruaj ntseg, DevOps thiab DevSecOps pab pawg yuav tsum rov kho lawv cov tswv yim los daws cov kev pheej hmoo ntawm kev tawm tsam software:
Kev koom ua ke DevSecOps: Kev ruaj ntseg yuav tsum tau muab tso rau hauv thoob plaws hauv lub voj voog software, txij li kev tsim qauv mus txog rau kev xa tawm
Kev Nyab Xeeb Kev Nyab Xeeb: Suav nrog cov kev hem thawj ntawm cov khoom xa tuaj rau hauv kev ntsuam xyuas kev pheej hmoo thiab kev xyaum ua qauv kev hem thawjcises
Kev Kawm Txuj Ci rau Cov Neeg Tsim Khoom: Qhia cov neeg tsim khoom txog kev coj ua coding ruaj ntseg thiab kev pheej hmoo ntawm kev koom ua ke cov khoom sab nraud uas tsis tau kuaj xyuas zoo
Cov kev coj ua no tsis yog tsuas yog txo qhov kev pheej hmoo ntawm kev cuam tshuam xwb tab sis kuj txhawb nqa kev coj noj coj ua uas muaj kev ruaj ntseg ua ntej thoob plaws kev txhim kho thiab kev ua haujlwm.
Vim Li Cas Koj Yuav Tsum Saib Xyuas? #
Kev nkag siab txog kev tawm tsam software supply chain yog dab tsi yog qhov tseem ceeb rau txhua tus neeg uas tsim cov software applications. Vim tias cov kev tawm tsam no siv cov txheej txheem uas ua rau muaj kev hloov pauv software sai, hloov cov cuab yeej ntseeg siab mus rau hauv cov vectors ntawm kev cuam tshuam, lawv muaj kev phom sij heev. Los ntawm cov piv txwv ntawm kev tawm tsam supply chain thiab cov tswv yim tiv thaiv dav dav, nws pom tseeb tias txhawm rau kom txo tau lawv koj xav tau: kev pom tseeb, kev lav phib xaub, thiab kev koom ua ke ntawm kev ruaj ntseg hla kev ua haujlwm.
Rau cov koom haum uas xav saib xyuas thiab ruaj ntseg lawv cov khoom siv software, Xygeni yog lo lus teb. Saib peb cov yeeb yaj kiab qhia txog lossis tau a Sim dawb hnub no!
