Mena kei te whakahaere koe i ngā ngoikoretanga i roto i ō rerengamahi DevOps, ehara i te mea he ariā noa te mārama ki te rerekētanga i waenga i te CWE me te CVE (koinei te tūāpapa o te whakatau kaupapa whai hua. Neke atu i te 23,000 ngā CVE i whakaaturia i te haurua tuatahi o te tau 2025 anake) he pikinga 16% i ia tau - ā, ko te āputa i waenga i te ngoikore kua whakarārangihia me te ngoikoretanga e whakamahia nuitia ana kei te tere ake te kati atu i mua. E whakamārama ana tēnei aratohu i te hononga o te CWE me te CVE, me pēhea te āwhina a ngā pūnaha whakatauranga pēnei i te CVSS me te EPSS i a koe ki te whakatau kaupapa, me pēhea te whakamahi i ngā mea e rua i roto i tōu... pipeline hei whakatika i te mea tino nui.
Ngā Kaupapa Taketake: He aha te CWE me te CVE?
He aha te CWE?
CWE (Tauhinga ngoikore noa) he rārangi hanganga o ngā ngoikoretanga pūmanawa—whakaarohia he rārangi o ngā hapa waehere me te hoahoa. Whakahaeretia e MITER, ka āwhina a CWE ki te tautuhi i ngā tauira, ki te kore e whakatikahia, ka arahi pea ki ngā ngoikoretanga haumarutanga.
- Taumu'a: Ārai i ngā ngoikore kei uru ki te waehere i te wā whakawhanake.
- tauira: Ko te CWE-89 e pā ana ki te SQL Injection—he hapa hoahoa e huaki ai te kuaha ki ngā mahi tinihanga o te pātengi raraunga.
- Ngā kaipānui: Ko ngā kaiwhakawhanake matua, ko ngā kaihoahoa haumarutanga, me ngā kaiwhakaako.
He aha te CVE?
Engari, CVE (Nga Mahi Kino me nga Whakatau) Ka tautuhi i ngā ngoikoretanga motuhake i roto i ngā pūmanawa kua whakamahia kētia. Ka tohaina he ID CVE ahurei ki ia ngoikoretanga kia māmā ai te aroturuki me te whakatika.
- Taumu'a: Whakahaerehia me te whakatika i ngā take haumarutanga o nāianei.
- tauira: Tērā pea ka whakaahuahia e te CVE-2023-12345 tētahi putunga arai i roto i tētahi whare pukapuka e whakamahia whānuitia ana.
- Ngā kaipānui: Ngā miihini DevOps, ngā tīma SOC, me ngā kaitātari haumarutanga.
CVE me CWE: Te Mārama ki te Rerekētanga
He maha ngā wā ka ara ake te tautohetohe mō te CVE me te CWE nā te mea he tata te hononga o ngā mea e rua, engari he rerekē ngā kaupapa e whai hua ana. Ahakoa ka whakarārangihia e te CWE (Common Weakness Enumeration) ngā hapa pea i roto i te hoahoa waehere, ka arotahi te CVE ki ngā ngoikoretanga motuhake kua tautuhia i roto i ngā pūmanawa o te ao tūturu. Mā te mārama ki te Common Weakness Enumeration me ngā ngoikoretanga me ngā whakaaturanga noa ka āwhina i te whakakī i te āputa i waenga i te whanaketanga me ngā mahi, me te whakarite kei te whai wāhi ngā mahi haumarutanga matatau me te urupare.
| CWE | CVE | |
|---|---|---|
| He aha te mea | He momo ngoikore o te pūmanawa | He tauira ngoikoretanga motuhake |
| Puritia e | MITER | Ngā Mana Tau MITRE / CVE |
| taumu'a | Ārai i ngā hapa i te wā whakawhanake | Aroturuki me te whakatika i ngā ngoikoretanga e mōhiotia ana |
| tauira | CWE-89: Werohanga SQL (te momo ngoikore) | CVE-2021-44228: Log4Shell (he whakamahinga motuhake) |
| Ngā kaipānui | Ngā kaiwhakawhanake, ngā kaihoahoa, ngā kaiwhakaako | DevOps, ngā tīma SOC, ngā kaitātari haumarutanga |
| whanaungatanga | Kotahi te CWE ka taea te pūtake o ngā mano tini o ngā CVE | Ka hono ia CVE ki tētahi CWE matua |
| A, no te whakamahi | Neke-mauī, arotake waehere, SAST | Te whakahaere papaki, SCA, urupare mō ngā aituā |
Te Tūranga o te Whakatau: Te Whakatakoto i ngā Mea Hiranga
Kia kitea ngā ngoikoretanga (CWE) me ngā ngoikoretanga rānei (CVE), ko te whakatau i ngā mea matua te wero e whai ake nei. He maha ngā wā ka whakamahia e ngā kaihangarau ngā pūnaha whakatau maha—pēnei i te CVSS me te EPSS—me te kore he mahere mahi mārama. Nō reira, he mea nui te mārama ki te mahi a ēnei whakatau.
Te Kaute CVSS
Te Pūnaha Whakatau i ngā Whakaraeraetanga Noa (CVSS) ka arotake i ngā ngoikoretanga i runga i tō rātou kaha, mā te whakamahi i ngā inenga pēnei i te āheinga ki te whakamahi me te pānga. Nō reira, ko ngā kaute kei waenga i te 0 (mōrearea iti) ki te 10 (tino nui).
- Te kaha: E mōhiotia whānuitia ana, ā, e whakamāramahia ana hoki.
- He ngoikore: Kāore i te whai i te horopaki o te wā tūturu, ka nui rawa te whakatau i ngā mea matua.
Te Kaute EPSS
Te Pūnaha Kaute Matapae Whakamahi (EPSS) e matapae ana i te tūponotanga o te mahi kino i te ao tūturu, e āwhina ana i a koe ki te arotahi ki ngā ngoikoretanga e whakamahia ana e ngā kaiwhakaeke.
- Te kaha: E mōhio ana ki te horopaki, ā, he hihiri hoki.
- He ngoikore: Hei tāpiri atu ki te CVSS engari ehara i te mea hei whakakapinga takitahi.
I te tau 2026, ka whakakotahi ngā tūāpapa matua i te CVSS me te EPSS me te tātaritanga taea te toro atu, e tātari ana i ngā kitenga ehara i te mea mā te kaha, te tūponotanga rānei, engari mā te mea kei te karangatia te waehere ngoikore i roto i tō tono. Ko tēnei huarahi paparanga-toru te umanga inaianei. standard hei whakaiti i te haruru ngoikore i roto i ngā turanga waehere nui.
Te mahere i te CWE ki te CVE
Te Tātaitanga o ngā Ngoikoretanga Noa He maha ngā wā ka honoa ngā whakaurunga ki ngā CVE, e hono ana i te āputa i waenga i ngā ngoikoretanga pea me ō rātou whakaaturanga o te ao tūturu. Hei tauira:
- CWE-79 (XSS) → CVE-2023-56789 (whakamahinga XSS i roto i tētahi taupānga tukutuku).
Nō reira, mā te mārama ki te rerekētanga o te CVE me te CWE ka taea e ngā kaihangarau te rapu i ngā ngoikoretanga ki ngā pūtake o ō rātou ngoikoretanga, me te whakatinana i ngā tikanga tiaki hoahoa pai ake.
Kimihia ngā Utauta Tika mō te Whakahaere CWE me te CVE
1. Tūhurahia ngā Putumōhio me ngā Utauta CWE
He rārangi hanganga o ngā ngoikoretanga pūmanawa te rārangi CWE. Hei tāpiri, he mea tino nui mō te ārai i ngā ngoikoretanga i te tīmatanga o te whanaketanga.
- Tirohia te paetukutuku CWE: Tūhurahia ngā ngoikoretanga o te CWE mā te kāwai, mā te hiranga rānei ki tō puranga.
- Te Mahere CWE ki te CVE: Whakamahia ngā taputapu a MITRE hei hono i ngā ngoikoretanga noa ki ngā CVE motuhake, me te hono i ngā hapa hoahoa me ngā ngoikoretanga ka taea te whakamahi.
Aki pro: Whakamahia te CWE hei paearu mō ngā arotake waehere, tāpirihia rānei ki CI/CD ngā taputapu pēnei i a Xygeni hei kimi aunoa me te ārai i ngā hapa waehere.
2. Rapu me te Aroturuki i ngā CVE i te Wā-tūturu
Ka whakarārangihia e ngā pātengi raraunga CVE ngā ngoikoretanga kei roto i ngā pūmanawa, ka taea ai te whakatika tere ake. Hei tāpiri, mā te aunoa i tēnei tukanga ka taea te penapena wā nui.
- Rapua ngā CVE mā te Hua, mā te Kaihoko rānei: Whakamahia te NVD CVE Raraunga Raraunga ki te kimi i ngā ngoikoretanga e mōhiotia ana.
- Aunoa matohi: Ka whakauruhia e ngā taputapu pēnei i a Xygeni te aroturuki CVE ki roto i tō CI/CD pipelines, me te whakarite kia tere tonu ngā whakatūpato mō ngā ngoikoretanga nui.
Te Mahi a ngā Awa Whakatakoto Kaupapa Matua a Xygeni
Mā Xygeni ka māmā ake te whakahaere i te CVE me te CWE mā te tuku i ngā Raupapa Matua e arotahi ana ki ngā mōrearea ka taea te mahi. Mā te tātari i ngā whakaurunga Tatau Ngāwari Noa me ngā ngoikoretanga CVE, ka whakarite a Xygeni kia arotahi tō rōpū ki te whakatika i ngā mea tino nui.
Āhuatanga matua:
- Ngā Hūnere o waho o te Pouaka
Ka whakaratohia e Xygeni ngā awa kua tautuhia i mua, pērā i te "Xygeni Prioritization" me te "Xygeni Reachability".- Tauira: Tātarihia ngā take iti-matua, whakaitihia te 28,000 ngoikoretanga ki ētahi ngoikoretanga ka taea te mahi mā te whakakotahi i te EPSS, te taea te toro atu, te pānga pakihi, me te whakaaturanga ipurangi. A Xygeni ASPM pūhara e hono ana i ngā kitenga CWE me CVE mai i SAST, SCA, DAST, me ngā matawai tuatoru ki roto i tētahi tirohanga mōrearea matua kotahi, kia whakatikahia ai e tō rōpū ngā ngoikoretanga nui, kaua ko ērā anake he nui te kaute CVSS.
- Ngā Kōrere Ritenga mō te Mana Whakapūmau
Hangaia he awaawa ritenga e hāngai ana ki tō whakahaere. Hei tauira:- Te āheinga ki te toro atu: Kei te karangatia te waehere ngoikore i roto i tō tono?
- Te Whakamahinga: He aha te tūponotanga ka whakamahia kinotia te ngoikoretanga?
- Horopaki CWE me CVE Whakauru
- Mā ngā mahere CWE ka āwhina i te tautuhi i ngā pūtake, pērā i ngā ngoikoretanga o te waehere (hei tauira, CWE-89: SQL Werohanga).
- Mā ngā māramatanga CVE, e whakareihia ana e ngā kaute EPSS me CVSS, ka whakatauria ngā ngoikoretanga i runga i te mōrearea o te ao tūturu.
He aha te Hiranga o tēnei mō ngā Tīma DevOps me te Haumarutanga
Ehara i te mea ko te whakatika i ngā ngoikoretanga anake te whakahaere i te CVE me te CWE—engari ko te whakatika i ngā ngoikoretanga tika. Nō reira, mā ngā taputapu a Xygeni ka taea e koe te:
- Arotahi ki ngā ngoikoretanga ka taea te whakatutuki mai i te Te Tātaitanga o ngā Ngoikoretanga Noa rārangi.
- Whakaritea ngā CVE ki te kaupapa matua mā te pānga ki te ao tūturu.
- Whakaritea ngā whakatikatika ki ngā kaupapa matua o te pakihi.
Whakangāwaritia te Whakahaere CVE me te CWE i Tēnei Rā
Ko te whakahaere i te CVE me te CWE i te tauine he nui ake i te aroturuki i ngā tohu tautuhi, engari ko te hono i ngā ngoikoretanga, te tatau i te kaha whakamahi o te ao tūturu, me te whakatika i ngā mea e tino hira ana i roto i tō taiao. Nā Xygeni Pūhara AppSec Katoa-i-te-Kotahi ka hono SAST, SCA, ASPM, me te whakatau kaupapa matua e whakamahia ana e te AI hei whakaiti i te haruru o ngā ngoikoretanga, kia iti ake ai te wā e pau i tō rōpū ki te whakamātau i ngā ngoikoretanga, kia nui ake ai te wā e pau i a rātou ki te tuku waehere haumaru.
FAQ
He aha te rerekētanga i waenganui i te CWE me te CVE?
E whakaahua ana te CWE (Common Weakness Enumeration) i tētahi momo ngoikore pūmanawa, te kāwai pūtake o ngā ngoikoretanga. E tautuhi ana te CVE (Common Vulnerabilities and Exposures) i tētahi tauira ngoikoretanga motuhake i roto i tētahi hua motuhake. Ka taea e te CWE kotahi te pūtake o ngā mano tini o ngā CVE.
He aha te tauira o te CWE me te CVE?
E whakaahua ana a CWE-89 i te SQL Injection hei momo ngoikore. Ko te CVE-2021-44228 (Log4Shell) he ngoikoretanga motuhake ka taea te whakamahi i roto i te Apache Log4j. E hono ana a Log4Shell ki tētahi pūtake o te CWE, engari he CVE motuhake, ka taea te whai me tana ake papaki me te kaute kaha.
Ko tēhea te mea nui ake: CWE, CVE rānei?
He rerekē ngā mahi a ngā mea e rua, ā, he pai te mahi tahi. Ka āwhina ngā CWE ki te ārai i ngā ngoikoretanga i te wā whakawhanake. Ka āwhina ngā CVE ki te whakatika i ngā ngoikoretanga e mōhiotia ana i roto i te whakaputa. Ka whakamahia e ngā kaupapa haumarutanga pakeke te CWE i te wā arotake waehere me te SAST matawai, me te aroturuki CVE i te wā SCA me te whakahaere papaki.
He aha te CVSS, ā, he aha tōna hononga ki te CVE?
Ko te CVSS (Common Vulnerability Scoring System) te anga whakatau i te kaha o te raru e whakamahia ana hei aromatawai i ngā CVE i runga i te tauine 0–10. Ka āwhina i te whakatau i ngā CVE hei whakatika tuatahi — engari kāore i te whai horopaki whakamahi wā-tūturu, koia te take e whakakotahi ai te nuinga o ngā tīma i ēnei me ngā kaute EPSS.
He aha te EPSS, ā, he aha tōna hiranga?
Mā te EPSS (Exploit Prediction Scoring System) ka matapaetia te tūponotanga ka whakamahia kinotia tētahi CVE i te ao tūturu i roto i ngā rā 30 e whai ake nei. I te whakakotahitanga me te tātaritanga kaha me te taea o te toro atu o te CVSS, ko te EPSS te huarahi tino whai hua ki te whakaiti i te haruru o te ngoikoretanga me te arotahi ki te whakaora i ngā mea e arohia ana e ngā kaiwhakaeke.
He pēhea te āwhina a Xygeni ki te whakahaere i te CWE me te CVE?
Ka whakakotahi te Funnel Whakatairanga a Xygeni i te CVSS, te EPSS, te taea te toro atu, te whakaaturanga ipurangi, me te pānga pakihi hei whakaiti i ngā mano tini o ngā kitenga CVE mata ki ētahi mōrearea ka taea te mahi. Ka tautuhia e ngā mahere CWE ngā pūtake kia taea ai e ngā tīma te whakatika i te ngoikore o raro - kaua e whakatika noa i ngā tauira takitahi.
