Ki te hiahia koe ki te hanga pūmanawa haumaru, me whakaaro koe kia rite ki te tangata e hiahia ana ki te wawahi. I roto i te ao mōrearea o ēnei rā, ehara i te mea he mea tāpiri noa te haumarutanga tukutuku. ngā CVE e mōhiotia ana te hoko rānei i tētahi atu matawai. Ko te whakaaro kia waiho koe ki roto i te hinengaro o tētahi kaipahua rorohiko, he kaipahua rorohiko mā e mōhio ana ki te pūnaha o roto, ā, e whakamahi ana i taua mōhiotanga hei whakapakari. Ko te tikanga o te haumarutanga ipurangi i ēnei rā ko te whakaaro pērā i tētahi kaipahua rorohiko mā mai i te rārangi tuatahi o te waehere.
He aha te Kaipahua Pōtae Mā?
He tohunga haumarutanga te kaipahua pōtae mā e whakamahi ana i ngā tikanga ōrite ki ngā kaimahi kino, engari hei tiaki i ngā pūnaha, kaua hei wawahi i a rātou kia kino ai. Whakaarohia he mahi taumanutia me te whakaaetanga me te kaupapa. Koinei te hunga e tautuhi ana, e whakatika ana i ngā ngoikoretanga, e whakatauira ana i ngā whakaeke, e aromatawai ana hoki i ngā mōrearea i mua i te whakamahinga a ngā kaiwhakaeke tūturu.
He mea nui kia wehewehea te hacking pōtae mā (white hat hacking) mai i te kupu whānui, ā, he koretake hoki i ētahi wā, arā, ko te "hacking matatika". Ka taea e te hacking matatika te tohu i te whakamātautau tutuki i ngā whakaritenga, i ngā aromatawai whānui rānei. He hangarau ake te hacking pōtae mā, he mahi ā-ringa, ā, he mea whakauru hohonu ki roto i ngā rerengamahi tuku pūmanawa.
I roto i te horopaki DevSecOps, ka mahi ngā kaipahua pōtae mā hei hoariri ā-roto: ngā kaiwhakawhanake, ngā miihini AppSec, me CI/CD ngā rangatira e whakaaro kino ana i a rātou e hanga ana i te taha tiaki. E matapae ana rātou me pēhea te honohono a ngā kaiwhakaeke i ngā pepeke, te whakamahi hē i ngā ariā, te whakamahi rānei i ngā rohe whakawhirinaki puta noa i ngā putunga, pipelines, me ngā pūnaha wā-oma.
Mā te mārama ki te tikanga o te kaipahua pōtae mā ka āwhina i ngā tīma hangarau ki te neke atu i te haumarutanga tauhohe ki te whakatauira tūmomo mōrearea matatau. Engari ko te whakaaro: ki te taea e au te whakamahi i tēnei, ka taea hoki e tētahi atu. Ā, ka whakatikahia e au i mua i a rātou.
Kei te hiahia koe ki te tiaki i ō kaupapa GitHub katoa?
Mena kei te whakaaro koe me pēhea te tiaki i ō putunga GitHub i tua atu i ngā whakarerekētanga kēmu, kaua e mahue tā mātou pou hohonu mō ngā whakaaetanga, pull requests, CI/CD te whakaurunga, me ētahi atu.
Te Rahunga o te Ao Tūturu: CI/CD mahi
Ka arohia e ngā kaiwhakaeke te mekameka tuku pūmanawa nā te mea he nui ngā ngoikoretanga kei roto. Whakaarohia tētahi take i kumea mai ai tētahi whakawhirinakitanga kino ki roto i tētahi GitHub Actions. pipelineI whakamahia e te kaiwhakaeke he taahiraa hanga hei tango i ngā mea ngaro. Ehara tēnei i te ariā noa; ka puta tēnei ina whakawhirinaki koe ki te waehere kāore i tuhia e koe, ā, kāore koe e aroturuki i ngā mea e rere ana i te wā o te CI.
Mā te whakaaro ki tētahi kaipahua ka kitea te ngāwari o te hanga o ngā pūnaha hei mata whakaeke. Koinei te arotahi e whakamahia ana e ngā kaipahua potae mā hei tiaki i ngā hanganga i mua i te pakaru.
Ngā Wāhi Matapo o te Kaiwhakawhanake i roto i te AppSec
Ko ētahi o ngā mōrearea nui rawa atu i ahu mai i te waehere i tuhia e ngā kaiwhakawhanake anō. Hei tauira:
- Kua tukuna ngā kōnae whirihoranga taunoa ki ngā repo tūmatanui, e turuturu ana ngā tohu tuakiri
- Ngā kī API kua whakapūmautia ki te waehere o mua
- Ngā ratonga moroiti ā-roto me te kore whakamana tāuru
Ehara ēnei i te kore-rā tauhou; he hapa o ia rā. Anei tētahi wāhanga tūturu mai i tētahi ratonga Node.js:
app.post('/admin', (req, res) => { if (req.body.user === 'admin') { grantAccess(); } }); Kāore he mana, kāore he whakamana, kāore he takiuru. Ka tīmata te mahi tinihanga pōtae mā mā te tautuhi me te whakamahi i ēnei hapa arorau hei whakapakeke i te waehere. Ko te haumarutanga ipurangi e whakawhirinaki ana ki te mārama ki ēnei hononga ngoikore.
Te Tirotiro me te Whakamahi Kino i te Ao Tūturu
He nui atu ngā mahi tirotiro a AppSec hou i tua atu i ngā matawai tauranga. E rapu ana ngā kaipahua pōtae mā i:
- Ngā pūwāhi mutunga kua kitea i roto i ngā hoahoa ratonga moroiti (hei tauira, ngā papatohu whakahaere kāore i whakamanahia, ngā ara patuiro rānei)
- Ngā turuturu o te taurangi taiao i roto i ngā rangitaki (pēnei i ngā tohu, ngā taipitopito tuakiri, ngā URI pātengi raraunga rānei mai i ngā tohu puranga)
- Ngā API tūmatanui, ngā API ā-roto rānei e whakahoki mai ana i ngā mōhiohio nui rawa, tairongo rānei, me te kore manatoko
Hei tauira, ka tīmata pea te kaiwhakaeke mā te whakarārangi i ngā pito mutunga tuwhera puta noa i ngā ratonga moroiti. Ka kitea e rātou he ara tirotiro hauora kua kitea e whakahoki ana i ngā whirihoranga taiao. Ka arahina rātou ki tētahi API ā-roto e whakaae ana ki ngā JWT engari kāore e whakamana i ngā whānuitanga. Kātahi ka honoa e rātou ēnei whirihoranga hē hei whakanui ake i ngā mana, hei tango rānei i ngā raraunga kaiwhakamahi.
Ko ngā taputapu pēnei i te amass, te subfinder, me te nmap ka āwhina i te mahere i te mata o te whakaeke, engari ko te mana tūturu kei roto i te here i ēnei wāhi ngoikore. Ka whai te hacking pōtae mā i tēnei huarahi ki te tautuhi i ngā rerenga arorau ka taea te whakamahi kāore e kitea i roto i te standard matawai
E whakaatu pinepine ana ngā pūrongo utu hapa i ngā hapa arorau, ehara i te CVE, i te mea te huarahi matua ki te whakamahi kino. He aha ai? Nā te mea he maha ngā wā e whakaarohia ana he haumaru te arorau pakihi, ā, kāore ngā matawai tuku iho e hopu i te whakamahi hē i te mahi e tika ana. Ko te haumarutanga ipurangi me whakanoho koe ki te hinengaro o te kaipahua e mōhio ana ki te karo i te arorau, kaua ko te kimi noa i te wetereo pakaru.
Te Hurihuri Pūtake Tuwhera: Ina Ngau Whakamuri Ngā Whakawhirinakitanga
Ko tētahi mōrearea nui i roto i te AppSec, engari kāore i te arohia, ko te nekenekehanga o ngā mōkihi a te hunga tuatoru. Tērā pea ko tō CI pipeline kei te whakamahi tonu i te mea tawhito rorirori putanga me tētahi tauira pepeke poke e mōhiotia ana. Ka wehewehea e te kaipahua pōtae mā ō putanga o nāianei me ō putanga ngoikore, ka tārua i te mahi kino, ka tohu i taua mea.
Me pehea te whakatika:
- Pin putanga tika
- Manatokohia ngā tātaitai
- Whakamahia ngā kōnae raka me ngā taputapu arotake
Kaua e whakaaro npm arotake he rawaka. Whakaaunoatia ngā tirotiro OSV-Scanner me te whakauru i ngā matohi ki roto i tō pipelineAnō, ko te kaupapa o te haumarutanga tukutuku he whakaaro pērā i te kaipahua rorohiko, i mua i tā rātou whakaaro pērā i a koe.
CI/CD Pipeline hei Waehere Whakaeke
Mai i te tirohanga a te kaipahua, tō CI/CD he maina koura. Anei te whanaketanga o tētahi whakaeke tūturu:
- Kua whakaurua mai he mōkihi kino
- Ka whakahaerehia i te wā o te mahi CI
- Ka whakapūtātia ngā mea ngaro mā te HTTP, DNS rānei
koutou hanga.yml ehara i te kōnae whirihora noa iho; he mata riri ka taea te whakarite. Whakamahia ngā tohu whaimana, whakamanahia ngā taonga tuku iho, me whakauru SBOM Kaupapa here hei raka. He tauira tino pai tēnei mō te take me tīmata te haumarutanga tukutuku mā te whakanoho i a koe ki roto i te hinengaro o tētahi kaipahua.
Me pēhea te whakapai ake a Xygeni i te haumarutanga ipurangi mā te whakaaro pērā i te kaipahua pōtae mā
He mea nui te mahi a ngā kaipahua pōtae mā ki te tiaki i a rātou anō CI/CD pipelines. Xygeni whakauru tika i tēnei hinengaro whanoke ki roto Ngā mahi a DevSecOps.
Ka aro turuki tonu a Xygeni mō:
- Pipeline hurihuri
- Te whakakitenga ngaro
- Ngā āhuatanga rerekē o te whakawhirinakitanga
Hei tauira, mena a kua werohia te mōkihi kino Ki roto i tētahi mahi GitHub Actions, ka taea e Xygeni te kite i te āhuatanga rerekē i mua i te otinga o te hanganga. Ka tautuhia e ia ngā whanonga whakapae, ka tirohia ngā huringa ohorere, ā, ka tohua aunoatia ngā tauira ngoikore.
Ko te mea e pai ai a Xygeni mō ngā rerengamahi DevSecOps ko tōna arotahi ki ngā mōrearea tūturu, ka taea te whakamahi, ehara i te haruru. He mea mahi āna whakatūpato, he mea hanga hei whakaata i te mahi a ngā kaiwhakaeke tūturu, ā, kua hangaia kia tauinehia ki te tere o ngā kaiwhakawhanake.
He mea nui te whakamahi i te whakaaro pōtae mā, engari he pai ake te whakahaere aunoa: tukua a Xygeni kia whakapakari mai i te tīmatanga. commit.
Te Kite i ngā Pepeke Arorau i roto i te Waehere Ritenga
Ka ngaro i ngā matawai ngā hapa o te arorau pakihi. Whakamahia he arai whakamana, ko te whakamana tohu anake ka tirohia mō te aroaro, ehara i te mana. Ka pānuihia e te kaipahua pōtae mā te ara waehere, ka whai i ngā tikanga, ka kitea te kōhao. Koinei te whakaaro me whakamahi e koe. Whakahaerehia ngā aratohu ā-ringa. Whaia ngā whakaurunga ki te pānga. Whakaarohia kia rite ki te tangata e whakamahi ana i te arorau, kaua ko te wetereo anake. Koinei te ngako o te hacking potae mā.
He aha koe e hiahia ana ki ētahi atu mea ehara i te mea noa iho SAST, DAST, me SCA
Ngā taputapu tātari pūmau me ngā taputapu tātari hihiri (SAST, DAST, SCA) he mea nui mō te tautuhi i ngā tauira e mōhiotia ana o ngā ngoikoretanga me ngā mōrearea whakawhirinakitanga. Heoi anō, he herenga kei a rātou ka waiho pea he āputa nui i roto i te kapinga:
- Kāore rātou e wetewete i ngā mea ngaro o te base64 i roto i ngā kōnae taiao
- Ka ngaro i a rātou ngā hapa whakahaere urunga e hangai ana ki te arorau
- Ka taea e rātou te haruru, ā, kāore e whai kaupapa matua
Kāore ēnei taputapu e rahua ana; engari ka pai ake te mahi ina whakauruhia ki roto i tētahi DevSecOps whānui ake, e mōhio ana ki te horopaki. pipelineKa nui haere tōna whai huatanga ina honoa ki te whakamana horopaki, te tātari whanonga, me te hononga mōrearea.
Koinei te wāhi e tāpirihia ai e ngā tūāpapa pēnei i a Xygeni te uara tūturu. Mā te aroturuki i te whanonga wā-oma, te tohu pipeline ngā nekehanga, me te tātari i ngā āhuatanga rerekē i roto i CI/CD ngā rerengamahi, ngā tāpiringa Xygeni SAST/DAST/SCA me ngā mātauranga mahi e ahu mai ana i te mahi a ngā kaiwhakaeke tūturu.
Ehara te mahi tinihanga pōtae mā i te tirotiro i ngā pouaka. Engari mō te kimi i ngā mea ka whakamahia e te tangata kino. Ko te tikanga o te haumarutanga ipurangi ko te titiro ki tua atu i ngā taputapu me te whakanoho i a koe ki roto i te hinengaro o te kaipahua i ia paparanga.
He Pukapuka Tākaro Pōtae Mā mō ngā Tīma DevSecOps
Whakauruhia ngā whakaaro whakahē ki roto i ō rerengamahi DevSecOps:
- Tauira mōrearea i ia āhuatanga hou
- Puritia he rārangi arowhai waehere haumaru
- Whakapakarihia tō CI/CD me ngā pūwāhi tirotiro arotake
He aha te kaipahua pōtae mā i roto i te horopaki DevSecOps? Ko te mema o te tīma e wero ana i ngā whakapae, e whakamātautau ana i ngā take taha, e matapae ana hoki i ngā ara tukino.
Ngā Whakaaro Whakamutunga: Whakaaunoa te Hinengaro Pōtae Mā
Te haumarutanga ipurangi, te whakanoho i a koe ki roto i te hinengaro o tētahi kaipahua raraunga. E ai ki tāu i kite ai, ina tupu tēnei, ka pai ake te haumarutanga ipurangi. Ko te mahi a te kaipahua raraunga mā he kimi i ngā ngoikoretanga i mua i te kimi a tētahi atu. Kāore koe e hiahia kia noho hei kaimahi wā-katoa, engari me whai koe i te tirohanga.
He aha te kaipahua pōtae mā i roto i te taiao whakawhanake o ēnei rā? He tangata e hanga ana i ngā pūnaha haumaru mā te whakaaro kino. He pai ake, aunoatia taua hinengaro. Hangaia ki roto i tō pipelines. Me waiho hei wāhanga o te mahi a tō tīma mai i te tīmatanga commitEhara te haumarutanga ipurangi i te mahi noa iho; he hinengaro, ā, ko taua hinengaro he hacking pōtae mā.
Ehara i te mea ko ngā taputapu anake te mahi tinihanga pōtae mā. Ko te whakanoho i a koe ki roto i te hinengaro o te kaipahua, te mārama ki te wāhi e noho ana ngā mōrearea tūturu, me te aro atu ki aua mōrearea mā te waehere, kaua ko te kaupapa here anake. He aha te kaipahua pōtae mā? He tangata e tiaki ana mā te whakaeke tuatahi.
