He aha te turuturu huna?
Te turuturu ngaro, e mōhiotia ana ko "leak secret"s" rānei "whakaatu huna," ko te whakaaturanga kore whakamana o ngā mōhiohio muna, pērā i ngā kī API, ngā kupuhipa, me ngā tiwhikete tūmataiti. Ka taea tēnei te puta mā roto i ngā momo huarahi, tae atu ki ngā hapa tangata, ngā pūnaha whirihoranga hē, me ngā whakaeke kino.
I ahu mai te ariā o te turuturu huna i ngā rā tōmua o te whakamunatanga i te wā i tīmata ai ngā kairangahau ki te ako i te āhua o te huraina tūpono, āta rānei o ngā mōhiohio tairongo. Heoi, kāore i whānuitia te whakamahinga o te kupu "turuki huna" tae noa ki te mutunga o te rautau 20, i te wā i tīmata ai te whakamahi hei whakaahua i ngā mōrearea haumarutanga e pā ana ki te pikinga ake o te whakamahinga o ngā hangarau mōhiohio me te whakawhitiwhiti kōrero matihiko.
Ko te whakaeke tuatahi i mōhiotia i puta i te tau 1982 i te wā i tahaetia ai e tētahi rōpū kaipahua ngā kī whakamunatanga i whakamahia hei tiaki i ngā raraunga huna a te kāwanatanga o Amerika. Ko tēnei whakaekenga, Ko tēnei whakaeke, e mōhiotia ana ko VENONA, i ārahi ki tētahi panoni nui i ngā kaupapa here me ngā tikanga haumarutanga a te kāwanatanga, ā, i āwhina anō hoki ki te whakapiki i te mōhiotanga ki te hiranga o te tiaki i ngā mōhiohio tairongo.
Te whānui ake o ngā ratonga kapua, te whakaurunga tonu, me te tuku (CI/CD) ngā mahi, me te horapa o te waehere pūtake tuwhera kua piki ake te tūponotanga ka hunahia ngā mea ngaro ki roto i ngā putunga tūmatanui. Me tīmata tātou ki ngā take noa e puta ai te turuturu o ngā mea ngaro. Me pānui tonu!
Ngā Take o te Whakaekenga Tūtaki Ngā Mea Ngaro
He maha ngā take ka puta he leak secret whakaeke, tae atu ki:
- Hapa tangata: Ko te hapa tangata te tino take o ngā turuturu ngaro. Hei tauira, ka tūpono pea te kaiwhakawhanake commit ngā mōhiohio muna ki tētahi putunga waehere tūmatanui.
- Ngā pūnaha whirihoranga hē: Ka taea e ngā pūnaha kāore i te whirihora tika te whakaatu i ngā mea ngaro, pērā i ngā kī API me ngā kupuhipa, ki ngā kaiwhakamahi kāore i whakamanahia. Hei tauira, ko tētahi tūmau tukutuku kāore i te whirihora tika ka taea e ngā kaiwhakaeke te tiro i ngā ihirangi o āna kōnae whirihoranga, kei roto pea ngā mea ngaro.
- Ngā whakaeke kino: Ka taea hoki e ngā kaimahi kino te whakamahi i ngā momo tikanga hei tahae i ngā mea ngaro, pērā i ngā whakaeke hangarau pāpori, ngā whakaeke hītinihanga, me ngā whakaeke pūmanawa kino. Hei tauira, ka īmēra pea te kaiwhakaeke i tētahi kaimahi e whakaari ana he māngai tautoko hangarau mōhiohio tika ia, ā, ka tinihanga i te kaimahi kia whakakitea ōna tohu tuakiri. Ina hoki, 83% o ngā pakaru raraunga i te tau 2022 i uru atu ki ngā kaiwhakaari o roto e pā ana ki Verizon rangahau.
- Ngā kaupapa here me ngā tikanga haumarutanga ngoikore: Kāore pea i te pakari ngā kaupapa here me ngā tikanga haumarutanga a ngā whakahaere hei tiaki i ngā mea ngaro. Hei tauira, kāore pea te whakahaere e tono i ngā kaimahi kia whakamahi i ngā kupuhipa pakari, kia whakahohe rānei i te manatoko maha-āhuatanga. Hei tauira, 81% o i te tau 2022, ko ngā takahi kua whakapumautia i ahu mai i ngā kupuhipa ngoikore, i whakamahia anō, i tahaetia rānei, whai muri i te LastPass pūrongo.
- Waiho: Tērā pea ka warewarehia e ngā whakahaere te tiaki tika i ā rātou pūnaha me ngā raraunga, ka māmā ake ai te tahae a ngā kaiwhakaeke i ngā mea ngaro. Hei tauira, tērā pea ka rahua e tētahi whakahaere te tāuta i ngā papaki haumarutanga, te whakahou rānei i ana pūnaha.
- Te kore mohio: Kāore pea ngā kaimahi i te mōhio ki ngā mōrearea o te huraina o ngā mea ngaro, kāore rānei rātou i te mōhio me pēhea te tiaki tika i aua mea. Hei tauira, 90% o ngā whakaekenga ipurangi he rautaki hangarau pāpori..
Te pānga o ngā whakaeke turuturu ngaro
Ka pā kino pea ngā whakaeke turuturu ngaro ki ngā whakahaere. Tērā pea ka pāngia ngā whakahaere e pāngia ana e ngā whakaeke turuturu ngaro e ēnei pānga kino:
- Te takahi i ngā taputapu me ngā hanganga whakawhanake pūmanawa: Ka taea e ngā kaiwhakaeke te whakararu i ngā taputapu whakawhanake pūmanawa me ngā hanganga, pērā i ngā putunga waehere pūtake, ngā pūnaha hanga, me CI/CD pipelines, hei whakauru i te waehere kino ki roto i ngā hua pūmanawa me te kore e kitea. Kātahi ka taea te whakatinana i tēnei waehere ki ngā pūnaha a ngā kiritaki, ka hoatu he tatau whakamuri ki ngā kaiwhakaeke ki roto i ā rātou whatunga.
- I paitinihia Pipeline: Ka taea e ngā kaiwhakaeke te whakararu i te mekameka tuku pūmanawa a te kaihoko hei whakapōrearea i ngā hua o te whakahaere ki te waehere kino. Kātahi ka taea te tāuta i tēnei waehere e ngā kiritaki a te kaihoko, ā, ka taea e ngā kaiwhakaeke te uru atu ki ā rātou pūnaha.
- Nga pakaru raraunga: Ka taea e ngā whakaeke turuturu ngaro te arahi ki te whakakitenga o ngā raraunga tairongo, pērā i ngā tuhinga a te kiritaki, ngā mōhiohio pūtea, me ngā taonga hinengaro. Kātahi ka taea te tahae i ēnei raraunga ka whakamahia mō ngā mahi tinihanga, ka taea rānei te tuku ki te marea, ka kino ai te ingoa o te whakahaere.
- Te whakararuraru i ngā mahi: Ka taea e ngā kaiwhakaeke te uru atu ki ngā pūnaha nui, pērā i ngā tūmau whakaputa, i ngā pātengi raraunga rānei, hei whakararuraru, hei whakamutu rānei i ngā mahi. Ka taea e tēnei te arahi ki ngā mate pūtea nui me te kino o te ingoa pai.
- Te tahae i ngā taonga hinengaro me ngā mōhiohio tūmataiti: Ka taea e ngā kaiwhakaeke te tahae i ngā mea ngaro, pērā i te waehere pūtake, i ngā mea ngaro hokohoko rānei, hei whakawhanake i ngā hua whakataetae, hei tahae rānei i te painga whakataetae o tētahi kamupene. Ka pā kino pea tēnei takahi ture mēnā ka tahae angitu te kaiwhakaeke i ngā mōhiohio tairongo, pērā i ngā tohu urunga, ngā kī API rānei, mai i te SCM. Mā ēnei tohu tuakiri tahaetia, ka taea e ngā kaiwhakaeke te uru kore whakamana ki ngā pūnaha whakaputa, ka arahi pea ki ngā aituā haumarutanga kino atu. Ka taea e rātou te uru atu ki ngā raraunga tūmataiti, te whakahaere i ngā mahi pūnaha, te tango rānei i ngā mōhiohio muna, ka whakararu i te pono o te pūnaha me te tūmataitinga me te whakawhirinaki o ngā kaiwhakamahi.
- Nga ngaronga puteaKo ngā takahi raraunga, tae atu ki ngā mea i ahu mai i ngā whakaeke turuturu ngaro, ka arahi pea ki ngā mate pūtea nui mō ngā whakahaere. Ko te utu mō te urupare ki tētahi whakaeke turuturu ngaro ko te tirotiro i te aituā, te whakatika i te ngoikoretanga, me te whakamōhio atu ki ngā tāngata e pāngia ana. Tērā pea ka pāngia ngā whakahaere e ngā whiu me ētahi atu whiu mai i ngā kaiwhakahaere mēnā kāore e tiakina pai ā rātou mea ngaro. Hei tauira, i raro i te ture GDPR i te EU, ka taea te whiu i ngā whakahaere ki te 20 miriona euros, ki te 4% rānei o tā rātou moni whiwhi ā-ao, ko tēhea te mea teitei ake, mō ngā takahi tino kino. I te US, he maha ngā ture tūmataiti i ngā taumata ā-motu me ā-rohe e whakatū ana i ngā rongoā whakahaere, i ngā whiu ā-ture rānei mō te kore tutuki i ngā ture, mai i te $100 ki te $50,000 mō ia takahi, me te tapeke o te $25,000 ki te $1.5 miriona mō ngā takahi katoa o tētahi whakaritenga kotahi i roto i te tau maramataka.
- Te kino ingoa: Ka taea e ngā whakaeke turuturu ngaro te whakakino i te ingoa o tētahi whakahaere. Tērā pea ka ngaro te whakawhirinaki o ngā kiritaki me ngā kaipupuri moni ki te kaha o te whakahaere ki te tiaki i ō rātou raraunga me te tūmataitinga. Ka taea e tēnei te arahi ki te ngaronga o te pakihi, ā, ka uaua ake te kukume mai i ngā kiritaki me ngā kaipupuri moni hou.
- Te arotakenga ture: Mā te kore e tiaki i ngā ngoikoretanga pea, tae atu ki te mōrearea o ngā whakaeke turuturu huna, ka aro pea ngā kaiwhakahaere ture e tirotiro ana i te kaupapa, ka whakatakoto whiu me ētahi atu whiu ki te whakahaere. Ka piki ake pea ngā utu me ngā kawenga ture. Hei tauira, i tirotirohia e te Securities and Exchange Commission (SEC) te whakaekenga ipurangi a SolarWinds, ā, i whakapaehia te SolarWinds Corporation mō te tinihanga me ngā hapa whakahaere ā-roto e pā ana ki ngā mōrearea me ngā ngoikoretanga o te ipurangi e mōhiotia ana.
Ngā Tauira o te Ao Tūturu o Leak Secrets patua
Ko ngā takahi raraunga i puta mai i ngā tohu tuakiri tahae te momo takahi raraunga tino noa, ā, kua pērā tonu mai i te tau 2021, e ai ki te Pūrongo Utu a IBM mō te Takahanga Raraunga 2022Ka taea hoki e ngā whakaeke turuturu ngaro te pā kino ki ngā whakahaere, me te utu toharite o te ao mō te pakaru raraunga e eke ana ki te $4.35 miriona i te tau 2022, mō Te 2022 Ripoata Tirohanga Tukino Raraunga a Verizon (DBIR):
Anei tētahi whakarāpopototanga poto o ētahi whakaeke turuturu ngaro i tuhia i ngā tau tata nei:
- I te marama o Hanuere 2023, I whakakitea e GitHub tētahi takahi raraunga i reira i tahaetia angitu ai e ngā kaiwhakaeke ngā tiwhikete hainatanga waehere mō ētahi putanga o GitHub Desktop me Atom. I whakaatuhia e te rangahau i uru atu ngā kaiwhakaeke ki tētahi pūnaha ā-roto o GitHub, ā, i taea ai e rātou te tārua i ngā putunga motuhake me te whiwhi ture kore i ngā tiwhikete hainatanga waehere. E whakaatu ana tēnei mahi i te hiranga nui o ngā kawa haumarutanga pakari mō te tiaki i ngā tiwhikete hainatanga waehere, ā, e whakanui ana hoki i te hiahia o ngā kaiwhakawhanake ki te piri ki ngā mahi pai rawa atu i roto i te haumarutanga ngaro hei whakaiti i te mōrearea o ngā mahi rite ā muri ake nei.
- I te Maehe 2023, I tūtaki a GitHub ki tētahi whakaekenga nui ki te mekameka tuku taongaHe mea i whakapuakina hētia ki te marea commit i hurahia te kī SSH tūmataiti mō te ratonga a GitHub. Nā tēnei mahi i whai wāhi ai te kaiwhakaeke ki te whai i a GitHub, me te whakaatu i tētahi tinihanga nui, ā, he nui te mōrearea haumarutanga. Heoi, i tere tonu te whakatika a GitHub i te āhuatanga, ā, i whakakapia tā rātou kī hei mahi ārai.
Me pēhea te ārai Leak Secret patua
He maha ngā mahi ka taea e ngā whakahaere te mahi hei ārai i aua whakaeke, Tae atu ki:
- Whakaakohia ngā kaimahi mō ngā mōrearea o te turuturu huna me te pehea ki te tiaki i ngā mea ngaro.Me mōhio ngā kaimahi ki ngā momo whakaeke turuturu ngaro, me pēhea te tautuhi me te karo i aua momo whakaeke. Me whakangungua hoki rātou ki te penapena me te whakahaere tika i ngā mea ngaro.
- Whakatinanahia ngā mana whakahaere haumaru pakari. Me whakatinana e ngā whakahaere ngā mana whakahaere haumarutanga pakari, pērā i ngā pareārai ahi, ngā pūnaha kimi urutomo, me ngā rārangi mana whakahaere urunga, hei tiaki i ā rātou pūnaha me ngā raraunga mai i te urunga kore whakamanatanga. Me whakamahi hoki rātou i tētahi taputapu whakahaere huna hei penapena me te whakahaere haumaru i ngā mea ngaro.
- Whakamahia he taputapu matawai hei kimi i ngā mea ngaro i mua i committe tuku i a rātou ki ngā putunga raraunga, te whakatinana rānei i a rātou ki roto CI/CD pipelineTuhinga o mua IaC ngā whirihoranga. Mā tēnei ka tukuna he urupare inamata ki ngā kaiwhakawhanake me ngā DevOps, ka ārai i ngā mea ngaro kei uru ki te hītori putanga, ki te hanganga whakaputa rānei.
- Aroturuki i ngā pūnaha me ngā whatunga mō ngā mahi whakapae. Me matawai e ngā whakahaere ā rātou pūnaha me ngā whatunga mō ngā mahi whakapae e tohu ana i tētahi whakaeke turuturu ngaro.
- Kia whai mahere hei whakautu atu ki ngā whakaeke turuturu ngaro. Mena ka kitea he whakaeke turuturu ngaro, me whai mahere ngā whakahaere hei whakautu tere me te whai hua. Me whakauru ki roto i tēnei mahere ngā mahi hei pupuri i te kino, hei whakaiti i te pānga, me te tirotiro i te aituā.
Me pēhea te āwhina a Xygeni ki te karo i te turuturu huna
Xygeni Secrets Security he otinga whānui e neke atu ana i te tiaki noa i ngā mea ngaro hei whakarite i te haere tonu, te haumarutanga, me te pakari o te mekameka tuku pūmanawa hou. Ehara i te mea he taputapu kimi noa iho, engari he committe whakatinanatanga ki tētahi kaupapa here kore-pūmau-ngaro, e tutukihia ana mā roto i tētahi raupapa o ngā āhuatanga tino hira e tiaki ana i te huringa ora o te whanaketanga pūmanawa.
Nga Painga Matua me nga waahanga Xygeni Secrets Security
Xygeni Secrets Security he maha ngā painga me ngā āhuatanga matua e tukuna ana, tae atu ki:
- Te kimi me te ārai i te wā tūturuKa hono a Xygeni ki a Git hooks ki te matawai me te kimi i ngā mea ngaro i mua i te commitki ngā putunga raraunga. Mā tēnei ka tukuna he urupare inamata ki ngā kaiwhakawhanake, ā, ka ārai i ngā mea ngaro kei uru ki te hītori putanga.
- Matawai whānui: Kei tua atu i ngā taurite tauira tuku iho, ka taea e Xygeni te kite me te whakamana i te whānuitanga o ngā whakatakotoranga ngaro, ahakoa te reo, te whare pukapuka, te tūāpapa rānei.
- Whakamanatanga atamai: Mā te tukanga whakamana atamai a Xygeni ka whakaitihia ngā hua teka, kia mōhio ai ko ngā ngoikoretanga anake kua manatokohia ka whiwhi ngā kaiwhakawhanake i ngā whakamōhiotanga.
- He wheako kaiwhakawhanake maeneene: Mā te otinga kore-whakaohooho a Xygeni ka whakarei ake i te wheako o ngā kaiwhakawhanake mā te WebUI e whakarato ana i ngā māramatanga mahi, ā, ka taea hoki e ngā kaiwhakawhanake te ako me te whakamahi i ngā mahi pai rawa atu mō te haumarutanga i te wā tonu.
- Te whakatinanatanga o ngā kaupapa here me te aroturuki tonu: Mā te hoahoa parepare a Xygeni ka taea e ngā whakahaere te whakatinana i ngā kaupapa here haumarutanga tino pakari puta noa i te huringa whanaketanga, me te tautuhi wawe me te whakatika i ngā hapa.
Mā te aro atu ki ngā pūtake o te turuturu huna, me te whakarato i tētahi otinga whānui e whakauru ana i te haumarutanga ki roto i te tukanga whakawhanake, ka āwhina a Xygeni i ngā whakahaere ki te tiaki i ā rātou mea ngaro mai i te urunga kore whakamanatanga.
Anei ētahi tauira motuhake o te āwhina a Xygeni i ngā whakahaere ki te aukati i te turuturu ngaro:
- kaiwhakawhanake commitngā kī API ki tētahi putunga waehere tūmatanui: Mā te whakaurunga matau Git a Xygeni ka kitea ngā kī API i mua i te commiti whakamātauhia, ā, ka mutu te commit, te aukati i te huraina o ngā mea ngaro.
- Ka whakamahia e te kaiwhakaeke tētahi ngoikoretanga hei uru atu ki ngā kōnae whirihoranga: Mā te matawai whānui a Xygeni ka kitea ngā raraunga tairongo i roto i ngā kōnae whirihoranga, ka whakatūpato hoki i te whakahaere, ka taea ai e ia te whakatika i te ngoikoretanga me te ārai i te kaiwhakaeke kei tahae raraunga mēnā ka whakamahia kinotia.
He taputapu nui te huarahi a Xygeni ki te kimi i ngā mea ngaro mā te hunga whakahaere katoa e hiahia ana ki te tiaki i ā rātou mea ngaro mai i te urunga kore mana. Mā te whakatinanatanga o Xygeni, ka taea e ngā whakahaere te whakaiti i te tūponotanga o te whakaeke turuturu ngaro, me te tiaki i ā rātou raraunga mai i te tahae.
Mena ka hiahia koe ki etahi atu korero mo Leak Secret Ngā whakaekenga me pēhea te ārai i aua whakaekenga, pātai atu mō tētahi hui tahi me tā mātou tīma ā, mā rātou e whakatau ō koutou feaa katoa.
