Ngā Mahanga Whānui mō te Whakatutukitanga Software Supply Chain Security

Pūkawa software supply chain security anga

E ai ki te kōrero o mua, he maha ngā software supply chain security kei te wātea ngā anga i ēnei rā. Anei ētahi tauira rongonui:

1. Ngā Taumata Mekameka Tuku mō ngā Taonga Pūmanawa (SLSA)

I whakawhanakehia e Google, SLSA e tautuhi ana i tētahi anga maha-taumata hei whakarite i te pono me te pūtake mai o ngā taonga pūmanawa puta noa i te mekameka tuku. Ka tukuna e ia taumata he taurangi haumarutanga motuhake, mai i te hainatanga taketake ki ngā whakamana o ngā hanganga ka taea te tārua me te manatoko whakamuna. He pai mō ngā whakahaere e rapu ana i tētahi huarahi ngāwari me te taipitopito ki te tiaki i tā rātou mekameka tuku pūmanawa.

Ngā Taumata Matua o te SLSA:

• Taumata 1 (Waitohu Taketake): Tāpirihia ai te hainatanga taketake ki ngā taonga tuku iho, hei whakatū i te mana pupuri me te ārai i te whakarerekētanga.
• Taumata 2 (Ngā Hanganga Ka Taea te Whakaputa): Ka whakarite kia ōrite, kia taea hoki te manatoko i ngā hanganga puta noa i ngā taiao, me te tuhi hoki i ngā mōhiohio pūtake.
• Taumata 3 (Manatoko Tuimotu): E whakarato ana i te manatoko whakamunatanga o ngā hanganga me ngā whakawhirinakitanga, e tuku ana i te tino whakapumautanga o te pono.
• Taumata 4 (Hainatanga me ngā Whakamanatanga Whakapai Ake): Ka whakatinana i te hainatanga me ngā whakamana matatau mō te haumarutanga mōrahi me te kimi i ngā whakarerekētanga.

2. CIS Software Supply Chain Security e tu'unga

E whakawhanakehia e te Te Pokapū Haumarutanga Ipurangi (CIS), he puna pono mō ngā aratohu haumarutanga, ka whakaratohia e tēnei paearu he huarahi hanganga hei tiaki i ngā mekameka tuku pūmanawa. Ka tukuna ngā taunakitanga whakahaunga puta noa i ngā wāhanga matua e rima:

• Waehere Pūtake: Tiakina tō pūtake waehere mai i te urunga kore whakamanatanga me ngā whakarerekētanga.
• Hangaia te Pono: Me whakarite kia tika te hanganga o ngā rauemi me ngā tukanga hanga.
• Whakahaere Tiakitanga: Whakahaere me te manatoko haumaru i ngā whakawhirinakitanga pūmanawa a te hunga tuatoru.
• Te Pono Tukunga: Ārai i ngā tukunga pūmanawa mai i te tāhae me te tohatoha kore whakamanatanga.
• Te Pono o te Whakatakotoranga: Whakatinanahia ngā tikanga haumaru mō te whakatinana i ngā pūmanawa ki ngā taiao whakaputa.

Neke atu i te 100 ngā taunakitanga mai i te akuaku taketake ki ngā whakahaere matatau, CIS Ka aro atu a Benchmark ki ngā whakahaere o ngā rahi katoa me ngā pūkenga hangarau katoa. Nā tōna āhua ngāwari me te urutau ka taea te whakarite ki ngā taiao whanaketanga me ngā hangarau rerekē.

3. Manatoko Wāhanga Pūmanawa OWASP Standard

He anga hou te SCVS i whakawhanakehia e te Tuwhera Kaupapa Haumarutanga Taupānga Tukutuku (OWASP)Ko tōna whāinga he whakatū i tētahi standardhe huarahi motuhake hei manatoko i te pono me te pūtake mai o ngā wāhanga pūmanawa puta noa i te mekameka tuku. Ka whakaratohia e tēnei anga he huinga o ngā mahi, ngā mana whakahaere, me ngā mahi pai hei āwhina i ngā whakahaere:

• Kia nui ake te tirohanga me te mana whakahaere i ā rātou wāhanga pūmanawa.
• Tāutuhia me te whakaiti i ngā ngoikoretanga haumarutanga i mua i te huri hei mahi tinihanga.
• Whakahāngaitia ā rātou mahi ki ngā mahi pai rawa atu o te umanga, ā, standards.

4.OpenSSF NGĀWAI

Ko tēnei kaupapa aromatawai-ā-tangata tūao whakamana i ngā kaupapa tuwhera-pūtake ki te whakaatu i ā rātou committe aro ki te haumarutanga me te whakapai ake i tō rātou tūnga haumarutanga. Mā te whai i ngā mahi pai rawa atu i ngā wāhanga matua pēnei i te whakahaere whakawhirinakitanga, te hanga pono, me te hainatanga tuku, ka taea e ngā kaupapa te whiwhi tohu e mohiotia ana puta noa i te pūnaha tuwhera-pūtake.

He maha ngā painga o te whai wāhi atu ki te OpenSSF Kaupapa Tohu Mahi Pai, tae atu ki:

• Kua pai ake te noho haumaru: Mā te whai i ngā tikanga pai kua whakarārangihia i roto i te kaupapa, ka taea e ngā kaupapa te whakapai ake i tō rātou tūnga haumarutanga me te whakaiti i te mōrearea o ngā ngoikoretanga.
• Kua piki ake te tirohanga: Ka whakamihia ngā kaupapa e whiwhi tohu ana mō ā rātou committe aro ki te haumarutanga, ka taea ai e rātou te kukume mai i ngā kaiwhakamahi hou, ngā kaituku takoha, me ngā kaitautoko.
• Tautoko hapori: Mā te kaupapa nei ka taea te uru atu ki tētahi hapori o ngā tohunga haumarutanga hei āwhina i ngā kaupapa ki te whakatutuki i ā rātou whāinga haumarutanga.

5. OpenSSF Kowaho

Whakaarohia he kāri pūrongo haumarutanga mō ngā kaupapa tuwhera-pūtake. Koinei te mea nui o te Kowaho e whakarato ana. Ka tātarihia ngā mōhiohio e wātea ana ki te marea hei aromatawai i te hauora haumarutanga o ngā kaupapa tuwhera-pūtake puta noa i ngā āhuatanga maha:

• Ngā taunga: Ka tautuhi me te aromatawai i ngā ngoikoretanga pea i roto i ngā pūmanawa tuatoru e whakamahia ana e te kaupapa.
• Ngā pūnaha hanga: Ka tirohia ngā mahi hanga haumaru hei whakarite i te pono o te waehere kua whakahiatohia.
• Waitohu tukunga: Manatoko mēnā kua hainatia mamatitia ngā tukunga hei ārai i te whakarerekētanga.
• Whakakitenga ngoikore: Aromatawai i ngā mahi a te kaupapa mō te tautuhi, te tuku pūrongo, me te whakatau i ngā ngoikoretanga.

6.  Anga Haumarutanga Tuturu (ESF)

ESF Software Supply Chain Security (SSCS) he kaupapa whānui e arahina ana e te Anga Haumarutanga Tuturu (ESF) e arotahi ana ki te tiaki i te tukanga whakawhanake me te tuku pūmanawa katoa. E whakanui ana i te mahi tahi i waenga i ngā hinonga tūmatanui me ngā hinonga tūmataiti hei aro atu ki ngā ngoikoretanga me te whakaiti i ngā mōrearea puta noa i te mekameka tuku.

Anei ētahi o ngā āhuatanga matua o te ESF SSCS:

• Whakapai ake i te haumarutanga o ngā pūmanawa tuwhera-pūtake e whakamahia ana i roto i ngā hanganga matua me ngā Pūnaha Haumarutanga ā-Motu.
• Whakatairanga i ngā mahi pai mō te whakahaere i ngā whakawhirinakitanga, te hanga pūnaha, me te hainatanga tuku.
• Whakatairanga i te māramatanga me te kawenga takohanga i roto i te mekameka tuku pūmanawa.
• Whakaitihia te mōrearea o ngā whakaekenga ipurangi me ngā takahi ture e puta mai ana i ngā ngoikoretanga o ngā wāhanga pūmanawa.