He whai hua noa iho ngā tohutohu haumarutanga kapua ina aro atu ki ngā āputa tūturu e whakamahia ana e ngā kaiwhakaeke: he peere S3 tūmatanui kāore i kitea e tetahi, he kaiwhakahaere CI me te kāri mohoao AWS ngā whakaaetanga, he mea ngaro i turuturu i roto i te rangitaki hanga, he whakawhirinakitanga kino rānei i tāuta puku i te wā o te pipeline oma. Ko te nuinga o ngā aituā haumarutanga kapua ehara i te mea nā ngā tūmomo riri kāore i te mōhiotia. E puta mai ana i ngā ngoikoretanga e mōhiotia ana kāore i whakatinanahia, i whakaritea ki mua, i whakatikahia rānei.
Kei roto i tēnei aratohu ngā tohutohu haumarutanga kapua whai hua e 20 kua whakaritea e ngā paparanga: te tuakiri, te raraunga, te hanganga, te mekameka tuku pūmanawa, CI/CD pipelinete kimi, me te urupare ki ngā aituā. Ahakoa kei te whakapakari koe i tētahi pūkete kapua kotahi, kei te tiaki rānei i tētahi rōpū maha DevSecOps pipeline, ka āwhina ēnei whakahaere ki te aukati i ngā takahi ture e tūpono ana.
He aha i kore ai e angitu te haumarutanga o te kapua ahakoa te maha o ngā tohutohu mō te haumarutanga o te kapua
Ko te haumarutanga kapua te huinga o ngā mana whakahaere, ngā kaupapa here, me ngā taputapu e tiaki ana i ngā raraunga, ngā tono, me ngā hanganga e rere ana i roto i ngā taiao kapua. E kapi ana i te tuakiri, te whatunga, ngā raraunga, te waehere tono, ngā whakawhirinakitanga, te whirihoranga hanganga, me te hanganga. pipelines.
Ko te take e kore ai e angitu tonu, ahakoa mō ngā tīma pakeke, ehara i te kore mātauranga. E toru ngā raruraru hanganga:
- Tere vs. haumarutanga. PipelineKa tere te neke. Ka whakakorehia ngā mana whakahaere e tāpiri ana i te waku. Kāore ngā tīma e tika ana te haumarutanga kapua e tāpiri i ngā kēti, engari ka aunoatia e rātou te whakatinanatanga tika ki roto i te tukanga mahi.
- Te wehewehenga o ngā taputapu. Te matawai i ngā mea ngaro i roto i te taputapu kotahi, SCA i roto i tētahi atu, IaC i roto i te tuatoru. Mēnā kāore he tirohanga kotahi, ka takoto ngā āputa i waenga i ngā paparanga kapinga, ā, kāore ngā kitenga e hono ki te mōrearea tūturu.
- Ngenge mataara. Mā ngā matawai e whakaatu ana i ngā rau CVE ia rā ka whakangungua ngā kaihangarau kia kaua e aro ki ngā kitenga, tae atu ki ngā mea nui. Ehara i te mea whiriwhiri te whakatau i ngā mea matua; koia te mea e whakatau ana mēnā kei te mahi te haumarutanga.
Kua hangaia ngā tohutohu haumarutanga kapua i raro nei hei whakakī i aua āputa i roto i te huarahi whaihua. Engari i te whakaaro ki te haumarutanga kapua hei raruraru wā-oma anake, ka hipokina e rātou te ara tuku katoa mai i te waehere ki te kapua.
20 Tohutohu Haumarutanga Kapua:
Ngā Tohutohu Haumarutanga Kapua mō te Whakahaere Tuakiri me te Uru
1. Whakahohehia te Motuhēhēnga Maha-Tauwāhi i ngā Wāhi Katoa
Ko te MFA tonu te mana whakahaere ROI teitei rawa atu i roto i te haumarutanga kapua. Ka aukati i ngā whakaeke tahae tohu, ā, e mōhio ana ngā kaiwhakaeke. He ūnga ngāwari tetahi pūkete kāore he MFA.
Whakaūtia te MFA mō ngā tuakiri tangata katoa i roto i ō taiao kapua: ngā pūkete kaiwhakawhanake, ngā papatohu kaiwhakahaere, ngā tomokanga kaiwhakarato kapua, CI/CD dashboardWhakamahia ngā MFA ātete-hītinihanga (ngā kī taputapu, ngā kī kupuhipa) mō ngā pūkete rangatira. Ko ngā waehere wā-ā-wā mā te taupānga whakamana te pae iti rawa.
2. Whakamahia te Mana Iti Rawa, Ina koa ki ngā Tuakiri Kore-Tangata
Te Mātāpono o te Mana Iti Rawa e mārama ana ki te tangata. Ko te wāhanga e ngaro tonu ana i ngā tīma ko ngā tuakiri ehara i te tangata: CI/CD ngā pūkete ratonga, ngā mahi Lambda, ngā kawenga mahi ipu, ngā kaiwhakahaere GitHub Actions.
Ka kohia e ēnei tuakiri ngā whakaaetanga kāri-māori nā te mea kotahi te whirihoranga, ā, kāore e tirohia anō. Koinei tonu ngā mea e arohia ana e ngā kaiwhakaeke i roto i ngā whakaeke mekameka tuku, nā te mea kei a rātou te urunga ki ngā mea ngaro, ki ngā putunga raraunga, ki ngā rauemi whakaputa, me ngā pūnaha o muri mai.
Arotakehia ngā whakaaetanga pūkete ratonga ia toru marama. Tangohia ngā mea kāore i whakamahia i roto i ngā rā 90.
3. Whakakapia ngā Tohu Whaimana Roa ki ngā Tohu Whaimana Poto
Ko ngā kī API tūmau me ngā tohu roa te ora tētahi o ngā tino take o ngā pakaru kapua. Ka puta commiti whakatakotoria ki ngā repo, i turuturu ki roto i ngā rangitaki CI, i tāruatia ki roto i a Slack, ā, i warewarehia ki roto Tuhinga .env ngā kōnae , kātahi ka noho mana mō ngā marama, mō ngā tau rānei.
Whakakapia ki ngā tohu whaimana poto i ngā wāhi katoa e taea ai: Te mahi a te AWS STS, Te Rōpū Tuakiri Mahi GCP, Ngā Mahi a GitHub OIDC. Mēnā kāore e taea te karo i ngā tohu tuakiri tūmau, rongoatia ki roto i tētahi kaiwhakahaere ngaro (Vault, AWS Secrets Manager, Azure Key Vault) ka huri aunoa.
4. Whakatinanahia te Urunga Wā-Tū-i-te-Wā mō ngā Mana Whakarei Ake
He mōrearea te urunga tūmau a te kaiwhakahaere. Ko te tikanga he nui te kotahi tuakiri kua takahia hei tae atu ki te whakaputanga.
Mā ngā pūnaha urunga JIT (AWS IAM Identity Center, GCP Privileged Access Manager, Okta Access Requests) ka taea te tuku urunga teitei ake ina hiahiatia, he wā poto, ā, he rangitaki arotake katoa. Ka whiwhi ngā kaiwhakawhanake i ngā mea e hiahiatia ana e rātou i te wā e hiahiatia ana. Kāore e kitea e ngā kaiwhakaeke he ūnga tūmau.
5. Whakaū i te Kore Whakawhirinaki puta noa i te Whakawhitiwhitinga Ratonga-ki-Ratonga
E whakaarohia ana e ngā tauira āputa tuku iho he pono ngā mea katoa i roto i te whatunga. Ko ngā taiao kapua taketake me ngā ratonga moroiti, ngā ipu, me ngā kawenga mahi hihiri ka whakararu i taua whakaaro.
Pouaka Kore ko te tikanga ka manatokohia, ka whakamanahia hoki ia tono, ahakoa nō hea mai. Whakatinanahia te manatoko ratonga-ki-ratonga (mTLS, tuakiri whatunga ratonga), whakatinanahia ngā kaupapa here whatunga i te taumata mahi, ā, mā te taunoa ka whakaarohia te hokohoko ā-roto he kore whakawhirinaki.
Ngā Tohutohu Haumarutanga Kapua Tiaki Raraunga
6. Whakamunatia ngā mea katoa, tae atu ki te Waka ā-roto
Te whakamunatanga i te okiokinga (AES-256, KMS whakahaeretia) kei te inaianei standard whakaharatau. Ko te āputa kei te nuinga o ngā tīma ko whakamunatanga i te wā e haere ana mō te waka ā-roto.
I roto i tētahi VPC me ngā ratonga moroiti me te whakawhitiwhiti kōrero ipu-ki-ipu, kāore te waka e noho "ki roto" i te haumaru tūturu. Whakatinanahia he TLS tahi (mTLS) mō te whakawhitiwhiti kōrero ratonga ā-roto. Whakamahia he whatunga ratonga (Istio, Linkerd) he paparanga whatunga kore-whirinaki rānei hei whakamana aunoa i tēnei, kaua e whakawhirinaki ki ia tīma ki te whirihora tika.
7. Kimihia, ā, Whakatikatikahia ngā Mea Ngaro kua Whakakitea i mua i te horapa
He mea ngaro commitKāore e noho huna te mea e piri ana ki tētahi putunga raraunga. Ka tātaihia e GitHub ngā putunga raraunga tūmatanui i roto i ngā hēkona. Kāore ngā putunga raraunga ā-roto e āraihia, ina tae mai tētahi mea ngaro ki roto i te hītori o Git, ka taea e te hunga katoa he urunga ki te putunga raraunga, i nāianei, i te heke mai rānei.
He mea nui ngā paparanga ārai (pre-commit hooks, ngā monomai IDE) engari kāore i te rawaka. Me matawai tonu koe puta noa i ngā putunga katoa tae atu ki ngā raraunga hītori commits, CI/CD rakau, IaC ngā kōnae, me ngā whakaahua ipu. Ina kitea he mea ngaro, me tere tonu te urupare: tangohia, hurihia, me aromatawai mēnā i uru atu i waenga i te whakaaturanga me te kitenga.
8. Whakarōpūhia ngā Raraunga me te Whakamahi i ngā Mana Whakahaere i runga i te Tairongo
Kāore e rite te mōrearea o ngā raraunga katoa i roto i tō taiao kapua mēnā ka kitea. Mā te whakahaere i ngā mea katoa kia rite, ka nui rawa te haumi i ngā mana whakahaere ki ngā raraunga iti te mōrearea, ā, ka iti iho te tiaki i ngā raraunga e tino hira ana.
Whakarōpūhia ngā raraunga mā te aro (tūmatanui, ā-roto, tūmataiti, herea). Whakamahia ngā mana uru, te whakamunatanga standardme ngā whakaritenga takiuru arotake ki ia taumata. Whakarōpū aunoatia mēnā ka taea, kāore e taea te tauine i te tohu ā-ringa.
Haumarutanga Hanganga me te Whirihoranga
9. Matawai IaC i ia Commit, Kaua i mua noa i te whakatinanatanga
Ko te Hanganga hei Waehere te wāhi e hangaia ai ngā whirihoranga hē, ehara i te mea kei roto i te whakaputanga. He peere S3 tūmatanui, he rōpū haumarutanga tuwhera, he tūranga IAM rānei me *:* Kāore ngā whakaaetanga e puta noa mai i te tūpono. Ka tīmata hei rārangi i roto i tētahi kōnae Terraform, i tētahi whakaaturanga Kubernetes rānei kāore i tohua e tetahi.
IaC me whakahaere te matawai i ia pull request, me ngā kitenga i puta ake i roto i te tukanga arotake waehere. Scan Terraform, Kubernetes manifests, CloudFormation, Helm charts, Dockerfiles, me CI/CD ngā whirihoranga
Xygeni IaC Security matawai i ngā hōputu katoa e tautokona ana i ia commit, ka mahere i ngā kitenga ki ngā rauemi motuhake, ā, ka whakauru atu ki tō rerenga mahi PR kia whiwhi urupare ai ngā kaiwhakawhanake i te wāhi e mahi ana rātou, kaua i roto i tētahi wāhi motuhake dashboard kāore rātou e tuwhera. Tīmatahia he whakamātautau kore utu →
10. Whakamahia te Kaupapahere Haumarutanga hei Waehere
Kāore ngā arotake haumarutanga ā-ringa e tauine. E tauine ana te kaupapa here-pērā-i-te-waehere.
Whakamahia ngā taputapu pēnei i te OPA (Open Policy Agent) me Kyverno rānei hei whakaatu i ngā ture haumarutanga hei waehere kua whakamātauhia, kua whakamātauhia. Whakaūtia i pipeline taumata kia whakatinanahia ai a Kubernetes me whai mana: pono kāore rānei e angitu te hanga i tētahi ipu e whakahaeretia ana hei pakiaka, i ia wā, i ia wā. Ina noho ngā kaupapa here i roto i te waehere, ka arotakehia, ka whakapaitia pērā i tētahi atu mahi hangarau. Ina noho i roto i ngā tuhinga, ka nekeneke haere.
11. Whakaū i ngā Tūāpapa Whirihoranga Haumaru me te Aroturuki i te Hekenga
Kua arotauhia ngā whirihoranga taunoa mō te whai wāhitanga, ehara i te haumarutanga. Kei roto i ngā ratonga kapua, ngā wā whakahaere ipu, me ngā tautau Kubernetes kua whakahaeretia ngā tautuhinga e ngāwari ana ki te whakamahi, ā, he ngāwari hoki ki te whakamahi.
Tīmata mai i CIS Ngā paearu mō tō kaiwhakarato kapua, te wā whakahaere ipu, me te pūnaha whakahaere. Whakakōnaehia hei kaupapa here-hei-waehere kia whakamanahia aunoa. Aroturuki tonu mō te rerekētanga, ko te wiki kua hipa e tutuki ana i ngā whakaritenga whirihoranga, tērā pea kāore e tutuki i tēnei rā whai muri i te huringa tere i raro i te pēhanga.
12. Wehewehea ngā Whatunga me te Whakawhāiti i te Nekehanga Taha
Ko te tikanga o ngā hoahoa whatunga papatahi, ina whakararu te kaiwhakaeke i tētahi kawenga mahi, ka taea e rātou te toro atu ki ngā mea katoa. Kei roto i te wehewehenga whatunga te radius pahūtanga.
Whakamahia ngā VPC, ngā whatunga iti, me ngā rōpū haumarutanga hei waihanga i ngā rohe wehe mā te mahi me te aro. Whakawhāitihia te rere o ngā ratonga ki te rawhiti-uru ki ngā mea e hiahiatia ana anake. Whakatinanahia te tātari putanga, ko te nuinga o ngā kawenga mahi kua takahia me tae atu ki tētahi tūmau e whakahaerehia ana e te kaiwhakaeke, ā, ko ngā mana putanga tētahi o ō whai wāhitanga pai ki te kite, ki te ārai rānei i tēnā.
Ngā Tohutohu Haumarutanga Kapua o te Mekameka Tuku Pūmanawa
Kāore ētahi o ngā tohutohu haumarutanga kapua tino nui e tīmata i roto i te papatohu kaiwhakarato kapua. Ka tīmata wawe ake, i roto i te mekameka tuku pūmanawa. Ngā whakawhirinakitanga, CI/CD Ka taea e ngā rerengamahi, ngā mea ngaro, ngā tuhinga hanga, me ngā taonga tuku iho te whakararu i te kapua i mua i te whakatinanatanga.
13. Matawaihia ngā Whakawhirinakitanga katoa i mua i te urunga ki tō hanganga
Ko ngā mōkihi pūtake tuwhera te huarahi urunga tuatahi tino noa i roto i ngā whakaeke mekameka tuku hou. Nā te kaupapa Shai-Hulud o te tau 2024 i takahi i te 830+ ngā mōkihi npm. Nā te tatau muri o XZ Utils i tata takahi i te manatoko SSH puta noa i ngā miriona pūnaha Linux. I ngā take e rua, i tae mai te waehere kino mā te tukanga tāutanga whakawhirinaki noa.
Basic SCA Kāore e ranea (Te Tātari Hanga Pūmanawa), ngā rārangi CVE mata. Ko ngā mea e hiahiatia ana e koe:
- Tātaritanga āheinga: kei te karangatia te mahi whakaraerae i roto i tō waehere?
- Te kimi pūmanawa kino: kei te whakaatu tēnei mōkihi i ngā whanonga kino, ngā tuhinga huna, ngā waeatanga whatunga ohorere, te huringa ora hooks e tāuta ana i ngā wā whakahaere o waho?
- Te whakatauranga EPSSHe aha te tūponotanga kei te whakamahia whānuitia tēnei CVE i te ao tūroa i tēnei wā, ehara i te mea he ariā noa iho?
14. Maukati Raro CI/CD Pipelines
CI/CD Ka taea e ngā pūnaha te uru atu ki ngā mea ngaro, ngā tohu kapua, me ngā taiao whakaputa. He iti ake hoki te pakari o ēnei pūnaha i ērā o ngā pūnaha whakaputa e whakamahia ana e rātou.
Ngā mana whakahaere hei whakamana:
- Me arotake te waehere mō ngā huringa katoa ki pipeline ngā kōnae whirihoranga (.github/ngā rerengamahi/, Kōnae Jenkins, etc.)
- Whakawhāitihia ngā kaiwhakahaere whaiaro ki ngā putunga kua whakaaetia, ko te urunga ki ngā kaiwhakahaere kāore anō kia arotakehia he ara tika ki te tahae tohu.
- Kaua rawa e tuku i ngā mea ngaro hei taurangi taiao kuputuhi noa; whakamahia he whakaurunga kaiwhakahaere ngaro
- Arotake pipeline ngā rangitaki mō ngā whakahau ohorere, ngā waeatanga whatunga rerekē, ngā whakahaerenga rānei i ngā hāora ohorere
Xygeni CI/CD Haumarutanga whakakaha guardrails tika i roto i to pipeline , te aukati i ngā hanganga haumaru kore, te kimi i ngā rerengamahi kua werohia, me te whakarite pipeline te pono i ia wāhanga. Pukahia he whakaaturanga →
15. Whakamanahia te Pono o te Hanga me te Waitohu i ngā Taonga Tawhito
Mena ka taea e te kaiwhakaeke te wero waehere ki roto i tētahi tuhinga hanga, te whakarerekē i tētahi taonga tuku iho i muri i te whakahiatotanga, te whakararu rānei i tētahi kaiwhakahaere CI, ko rātou te rangatira o tō mekameka tuku pūmanawa, ahakoa te ma o tō waehere pūtake.
Whakaūtia ngā mana whakahaere pono o te hanga:
- Tāpirihia ngā putanga whakawhirinakitanga katoa me ngā whakaahua turanga ki ngā whakarāpopototanga tika, kaua ki ngā tūtohu
- Waitohuhia ngā taonga hangahanga me te manatoko i ngā waitohu i mua i te whakatinanatanga
- Aroturukihia ngā huringa ohorere ki CI/CD ngā kōnae rerengamahi, ko ngā rerengamahi i werohia te tohu matua i roto i ngā whakaekenga pēnei i a Shai-Hulud
- Whakatinanahia ngā whakamanatanga SLSA hei whakaatu i te mea i hangaia, nō tēhea pūtake, ā, nā tēhea pipeline
Te Kimi i ngā Tūraru me te Whakautu i ngā Aituā
16. Whakapūmau i te Takiuru me te Tirohanga Hanga puta noa i te Puranga Katoa
Kāore e taea e koe te kite i ngā mea kāore e kitea. Ko te nuinga o te aroturuki haumarutanga kapua e aro ana ki te wā whakahaere, CloudTrail, ngā rangitaki rere VPC, me GuardDuty. He mea tika tēnā engari kāore i te rawaka.
I angitu ngā whakaekenga pērā i a Shai-Hulud me SolarWinds nā te mea i puta te taupatupatu i roto i te hanganga. pipeline, i mua noa atu i te taenga o tetahi mea ki te aroturuki i te whakaputanga. Me kapi te tirohanga katoa puta noa i ngā huringa waehere pūtake, ngā paparanga hanga me ngā paparanga taonga, te wā whakahaere kapua, me te mahi API.
17. Whakatairangahia ngā Kitenga mā te Whakamahinga, Kaua ko te Kaha anake
Mā te matawai e whakaputa ana i te 500 kitenga i ia wiki ka whakangungua ngā tīma kia kaua e aro ki ngā kitenga, tae atu ki ngā mea nui. Ko te whakatau i ngā kaupapa matua te mea e wehewehe ana i ngā kaupapa haumarutanga e mahi ana mai i ngā mea kei runga pepa.
Ko te whakatau kaupapa matua whai hua e whakakotahi ana i: te taea te toro atu (kei te whakahaerehia te waehere ngoikore?), te whakaaturanga (kei te anga atu te ratonga ki te ipurangi?), te kaute EPSS (te tūponotanga o te whakamahinga hohe), me te horopaki pakihi (taiao whakaputa vs. taiao whakawhanake).
Xygeni ASPM ka kawea mai ngā kitenga katoa SAST, SCA, IaC, ngā mea ngaro, me pipeline security ki tētahi tirohanga mōrearea kotahi, me te whakarite i ngā kaupapa matua e whakaatu ana i te mea tika kia whakatikahia i te tuatahi ki tō rōpū. Pukahia he whakaaturanga →
18. Whakatūria ngā Tūāpapa Whēkau me te Whakatūpato mō ngā Hē
Ka hopukina e ngā waitohu e mōhiotia ana he kino ngā tūmomo riri e mōhiotia ana. Ka hopukina e te kitenga i ngā momo rerekētanga whanonga ngā tūmomo riri kāore i te mōhiotia, ngā rā-kore, ngā tauira whakaeke hou, me ngā tūmomo riri o roto.
No to koutou CI/CD te taiao, te whakatū i ngā tūāpapa mō te roanga hanga noa, ngā tauira tāutanga mōkihi noa, ngā ūnga whatunga e tumanakohia ana i te wā hanga, me standard ngā tauira urunga ngaro. Ko ngā peka ke mai i ēnei turanga ko tō tohu whakatūpato tuatahi, ā, ko te paparanga tēnei e kore e kitea e te nuinga o ngā tīma.
19. Tautuhia ngā Pukapuka Whakahaere mō ngā Horopaki Aituā Motuhake ki te Kapua
Kāore ngā mahere urupare aituā whānui e whai whakaaro ki ngā horopaki kapua-motuhake: he mōkihi kua taupatupatuhia kua tāutahia puta noa i ngā ratonga 40, he kaiwhakahaere CI kua tahaetia ngā tohu tuakiri e tētahi tuhinga tāutanga kino, he taonga hanga i raweketia pea i roto i ngā haora 72 kua hipa.
Hangaia he pukapuka whakahaere motuhake mō: te whakawhirinakitanga kua ngoikore, pipeline te tahae tohu tuakiri, te whakaaturanga raraunga i puta mai i te whirihoranga hē, me te werohanga rerenga mahi CI kino. Me tautuhi e ia pukapuka whakahaere ko wai te rangatira o te urupare, ko te mea ka whakakorea tonutia, me ngā tātaritanga taihara e hiahiatia ana hei whakatau i te radius pahūtanga.
20. Whakahaerehia te Whakangungu Papamahicises, E rua ngā wā i te tau te iti rawa
He whakapae noa iho te pukapuka whakahaere kāore anō kia whakamatautauria. Te whakamātautau i runga i te tēpucisKa hurahia ngā āputa o tō mahere urupare i mua i te mahi a te kaiwhakaeke. Ehara i te mea ko te whai i te pukapuka rautaki kia tino tika te whāinga, engari ko te kimi i ngā mea e ngaro ana.
Oma i te iti rawa e rua ngā whakakori tinanacisia tau, e whakatauira ana i ngā momo horopaki rerekē: he takahi i te mekameka tuku, he takahi raraunga nā te whirihoranga hē, he kaiwhakahaere CI kua takahia. Whakaurua ngā tīma ka whakautu tūturu, te haumarutanga, DevOps, me ngā kaiwhakawhanake waea-waea.
Rārangi Arowhai Tohutohu Haumarutanga Kapua: Tohutoro Tere
| Apa | Mana Matua |
|---|---|
| tuakiri | MFA i ngā wāhi katoa, te iti rawa o te mana, ngā tohu mātauranga poto te roa, te urunga JIT |
| Raraunga | Whakamuna i te wā e takoto ana, i te wā e haere ana, te matawai me te whakakore aunoa i ngā mea ngaro, te whakarōpūtanga raraunga |
| hanganga | IaC matawai kei te haere commit, kaupapa here-hei-waehere, CIS te whakatinanatanga taketake, te wehewehenga whatunga |
| Raina tuku | SCA me te āheinga ki te toro atu me te kimi i ngā pūmanawa kino, CI/CD te whakapakeke, te hanga i te pono me te SLSA |
| Rapu | Te takiuru pokapū, te whakatau kaupapa matua e hangai ana ki te EPSS, te kimi i ngā hapa whanonga |
| urupare | Ngā pukapuka whakahaere motuhake-kapua, tepu mahicises, kua tuhia te aromatawai i te radius pahūtanga |
Me pēhea te āwhina a Xygeni ki te whakamahi i ngā tohutohu haumarutanga kapua puta noa i te puranga katoa
Ka mahi noa ngā tohutohu haumarutanga kapua ina taea e ngā tīma te whakatinana i aua tohutohu puta noa i te huringa katoa o te tuku pūmanawa. Ko te nuinga o ngā taputapu e kapi ana i te paparanga kotahi: te wā whakahaere, te waehere, ngā whakawhirinakitanga, ngā mea ngaro, ngā mea rānei CI/CD. Engari ka neke ngā whakaeke tūturu i ngā paparanga.
Ka hono a Xygeni i ēnei paparanga me te kimi, te whakatau kaupapa matua, me te whakatikatika whakauru mai i te pana git tuatahi ki te whakaputa.
| Apa | Te Pūkenga o Xygeni | Ngā Mea e Ārai Ana |
|---|---|---|
| Ko te waehere puna | SAST + Te whakaora AI | Werohanga, hapa whakamana, hoahoa kore haumaru |
| Ngā taunga | SCA + Te Kimi Pūmanawa Kino + EPSS | Ngā ngoikoretanga o te mekameka tuku, ngā mōkihi ngoikore |
| ngaro | Haumarutanga Ngaro + Whakakorenga-Aunoa | Te whakaaturanga tohu, te mōrearea tohu roa |
| IaC & Whirihoranga | IaC Security | Ngā whirihoranga hē i mua i te taenga ki te whakaputanga |
| CI/CD Pipeline | CI/CD Haumarutanga + Te Kitenga i ngā Āhuatanga Kāore i te Tika | Pipeline werohanga, te whakahekenga o te kaikawe |
| Hangaia ngā taonga tuku iho | Build Security + SLSA provenance | Ngā taonga kua whakarerekētia, ngā tukunga kāore i hainatia |
| Tūnga mōrearea | ASPM | Tirohanga kotahi, te whakatauranga whakawhiti-paparanga |
Ko te hua: ka whiwhi ngā tīma haumarutanga i te tohu, kaua i te haruru. Ka whiwhi ngā kaiwhakawhanake i ngā urupare i te wāhi e mahi ana rātou, ehara i te mea i roto i tētahi taputapu motuhake kāore e whakatuwheratia e rātou. Ā, ka uru te haumarutanga ki te tukanga tuku, ehara i te kēti e whakaroa ana i tōna tere.
Thoughts Final
He māmā noa te whakarārangi i ngā tohutohu haumarutanga kapua engari he uaua ake te whakatinana. Kāore ngā tīma e whakaiti ana i te mōrearea kapua tūturu e whakawhirinaki ana ki ngā arotake ā-ringa, ki ngā taputapu marara, ki te whakatau kaupapa matua-kino anake rānei. Engari, ka aunoatia e rātou ngā mana whakahaere haumarutanga i roto. pipelines, te whakatau i ngā mea matua mā te whakamahi pai, me te whakahaere i te mekameka tuku pūmanawa katoa hei wāhanga o te mata whakaeke kapua.
Ko te tikanga o tēnā he nui atu i te hanganga wā-oma te tiaki. Ko te tikanga he tiaki i te waehere pūtake, ngā whakawhirinakitanga, ngā mea ngaro, IaC, CI/CD ngā rerengamahi, te hanga taonga tuku iho, me te tūnga mōrearea o te tono.
Mena ka waiho e ō taputapu o nāianei he āputa i waenga i aua paparanga, ka āwhina a Xygeni ki te kati i aua āputa mā te kimi, te whakarite kaupapa matua, me te whakatika i te ara katoa mai i te waehere ki te kapua.
???? Me tiimata to whakamatautau koreutu mo te 7-ra , kāore he kāri nama e hiahiatia ana, ka puta ngā hua matawai i roto i ngā meneti
???? Tukuna he demo ā, tirohia te āhua o te hononga o Xygeni ki tō kapua motuhake, me pipeline tatūnga
Mō te Kaituhi
Kai-whakarewa me te CTO
Fatima Said he tohunga ki ngā ihirangi a te kaiwhakawhanake mō AppSec, DevSecOps, me software supply chain securityKa hurihia e ia ngā tohu haumarutanga uaua hei aratohu mārama, whai hua hoki, hei āwhina i ngā tīma ki te whakarite i ngā kaupapa matua kia tere ake, ki te whakaiti i te haruru, me te tuku waehere haumaru ake.
