He tere te neke o ngā tono hou, me ngā kaiwhakaeke anō hoki. Ki te kore e kitea tika, ka taea e ngā mahi kino te huna i roto i tō hanganga mō ngā wiki. Koinei te wāhi te kimi pokanoa pūtake tuwhera ka tae mai. Ka mātakihia e ēnei pūnaha tō whatunga, ō kaihautū, me pipelines mō ngā whanonga rerekē.
An pūnaha kimi urutomo tuwhera ka āwhina i ngā tīma ki te kite, ki te whakatūpato, ā, i ētahi wā ka ārai i ngā tūmomo riri i te wā tonu. Heoi anō, he maha ngā pūnaha kimi me te ārai i te urutomo whakauru ngāwari ki roto CI/CD me ngā taiao kapua, ka waiho te haumarutanga hei wāhanga o tō rerenga mahi o ia rā.
He aha te Kitenga Urupare Pūtake Tuwhera?
Mā te kimi urutomo tuwhera ka whakamahia ngā taputapu ā-hapori hei tautuhi i ngā waka rerekē, ngā rangitaki whakapae, ngā huringa waehere kore whakamanatanga rānei puta noa i tō taiao. Mā ēnei otinga ka āwhina ngā kaiwhakawhanake me ngā miihini haumarutanga ki te aroturuki tonu i ngā mahi me te urupare i mua i te hurihanga o ngā take iti hei aituā.
Ka kohia e te pūnaha kimi urutomo pūtake tuwhera ngā raraunga mai i ngā whatunga, ngā kaihautū, me pipelines, ka whakamahi i ngā ture kimi, ā, ka whakaputa aunoa i ngā whakatūpato ina kitea he mea rerekē. Mā te tātari i ngā whanonga kaua ko ngā waitohu tūmau anake, ka āwhina Ngā tīma DevSecOps te hopu wawe i ngā āhuatanga rerekē, ā, ka tere ake te urupare atu.
Heoi anō, he maha ngā pūnaha kimi me te ārai i te urutomo e whakawhānui ana i tēnei ariā mā te mahi tonu. Ka taea e rātou te aukati i ngā waka kino, te wehe i ngā mahi kua takahia, te aukati rānei i ngā hanganga morearea i roto i te CI/CD, te huri i te kimi hei ārai.
Te whakamārama tere:
Mā te kitenga pokanoa pūtake tuwhera ka kitea te tirohanga ā-wā tonu puta noa i ngā pūnaha me pipelines, e whakakotahi ana i ngā tātaritanga, ngā matohi, me ngā urupare aunoa hei aukati i ngā tūmomo riri i mua i te horapa haere.
Te Hanga i tētahi Hanganga Kitenga Urupare Pūtake Tuwhera Iti rawa
I roto i te mahi, e toru ngā paparanga matua o tētahi tautuhinga kimi pai:
- Ngā pūoko whatunga (NIDS)Hopukia ngā waka e haere mai ana, e haere atu ana, me te waka e haere ana ki te rawhiti ki te hauauru.
- Ngā Kaihoko Manaaki (HIDS): Mātaki i ngā kōnae, ngā rangitaki, me ngā tukanga e rere ana.
- CI/CD a SCM kitea: Kitea ngā huringa o pipelinengā whakaaetanga, ngā whirihoranga rānei.
Kātahi, honoa ngā mea katoa mā roto i tō SIEM me aunoa i ngā whakautu: ārai i ngā mahi, tapahi i ngā ara whatunga, whakatuwhera i ngā tīkiti, whakaoho rānei pull requests.
Ka hono tēnei huarahi i te kimi me te mahi, e kapi ana i te wā whakahaere me te mekameka tuku pūmanawa anō hoki.
Xygeni ka whakapakari i tēnei hanganga mā te tāpiri te kimi i ngā āhuatanga rerekē i roto i CI/CD, pūmanawa kino me te aukati mōkihi kino, a te whakatau kaupapa matua e ahu mai ana i te taea te toro atu me te whakamahi mō ngā whakatūpato tino hira.
Ka whakakotahi te hoahoanga iti i ngā pūoko whatunga, ngā kaihoko manaaki, me CI/CD te ine waea me te aunoatanga. Ka whakapotohia e tēnei tatūnga ngā wā kimi me te urupare, ā, ka ārai i te nekehanga taha i mua i te taenga ki te whakaputanga.
Whakautu Whaihua Playbooks
Kia tae mai ngā whakatūpato, mārama playbooks Ka āwhina i a koe ki te mahi tere me te noho pūmau. Ko te whakatakotoranga whai hua o te kimi tūkinotanga pūtake tuwhera ehara i te mea ko te kimi noa i ngā tūmomo riri, engari ko te urupare whai hua me te ako mai i ia huihuinga.
A) Whakatūpato whatunga
Whakamanahia te kitenga, whakareihia ki ngā raraunga kaiwhakamahi, ki ngā raraunga putunga rānei, ā, āraia tonutia ngā waka whakapae. Waihangahia he tīkiti Jira, he tīkiti haumaru rānei pull request mēnā he mahi e hiahiatia ana. Ka hurihia e tēnei taahiraa tō pūnaha kimi urutomo tuwhera ki roto i tētahi rerenga mahi ora, kaua ki tētahi taputapu tūmau.
B) Pipeline whakarerekētanga
Whakahokia kāore i whakamanahia commits, kati te mahi e rere ana, ka tirohia mēnā he turuturu ngā tohu tuakiri, he kōnae hanga rānei kua whakarerekētia.
Ka tautuhi aunoa a Xygeni, ka tohu hoki ngā huringa rerenga mahi kāore i whakamanahia, te whakarite CI/CD pipelinekia noho ma, kia taea hoki te whai.
C) Whakatūpato mōkihi kino
Taratahitia te whakawhirinakitanga e pāngia ana, whakatūpatohia tō rōpū, ka whakaputa i tētahi PR hei whakakapi, hei whakahou rānei i te putanga. Whakatupato Moata Ka tautoko te miihini i roto i te Xygeni i ngā pūnaha kimi me te aukati i te urutomo mā te tautuhi me te aukati i ngā mōkihi kino puta noa i ngā pūnaha rauropi pēnei i te npm, PyPI, me Maven.
Ngā Tohu Moata i roto i te Kitenga Urupare Pūtake Tuwhera
Kāore e tika ana kia arohia ngā whakatūpato katoa. Heoi, mā te horopaki me te kitenga wawe, ka taea e ngā tīma te wehewehe ngāwari i ngā tūmomo riri tūturu mai i te haruru papamuri.
Mā te matawai tonu i ngā rangitaki kitenga urutomo tuwhera me ngā raraunga rēhita ka hopu wawe i ngā tukuake kino. Nō reira, ka taea e koe te whakarite i ngā tūmomo riri hohe hei utu mō te whai i ngā tūmomo riri iti te mōrearea, kāore rānei e tika ana.
Heoi anō, mā te whakakotahi i te tātaritanga taea te toro atu me te tātaritanga taea te whakamahi ka hoatu he tirohanga raraunga ki a koe mō ngā mea tino nui. Ngā ara arotake me ngā kaupapa here iti rawa te mana whakarei ake i te tirohanga, te ārai i te whakamahinga hē a roto, te nekenekehanga whirihoranga rānei i roto CI/CD taiao.
Tango matua:
Mā ngā tohu tōmua me te whakarite i ngā kaupapa matua o te horopaki ka aro tonu ngā kaiwhakawhanake ki ngā ngoikoretanga ka taea te whakamahi kino, kaua ki ngā hua teka.
Me pēhea te whakauru i te Kitenga Urupare Pūtake Tuwhera ki roto i ngā Taiao DevOps
Ka tere te neke o ngā hanganga hou, me pērā anō hoki te haumarutanga. Nō reira, ko te whakauru tika i te kimi pokanoa pūtake tuwhera ki roto CI/CD pipelineHe mea nui ngā taiao aroturuki kapua me te kapua. I roto i te mahi, ina uru te kimi ki roto i te tukanga tuku, ka puta wawe ake ngā whakatūpato, ā, ka tino heke te wā whakautu.
Anei me pēhea te mahi whai hua a ngā tīma DevSecOps:
- Whakatūpato aunoa: Whirihorahia tō pūnaha kimi urutomo tuwhera hei tuku kaupapa ki a Slack, Jira, ki tō SIEM rānei ina puta he mahi rerekē i roto i ngā hanganga, i ngā whakatinanatanga rānei. Mā tēnei ka taea e ngā kaiwhakawhanake te urupare i te wā tonu.
- Te tirohanga o te ipu: Whakahaerehia ngā pūoko whatunga i te taha o ngā tautau, ngā ipu rānei o Kubernetes hei kite i ngā nekehanga taha me ngā rerekētanga o te wā whakahaere.
- Whakakotahitanga kapua: Honoa ō taputapu kimi ki ngā rangitaki kapua pēnei i a AWS CloudTrail, Azure Monitor, GCP Audit Logs rānei kia kotahi ai te tirohanga puta noa i ngā taiao.
- Te whakatinanatanga o ngā kaupapa here: Whakamahia ngā putanga kitenga hei whakahohe i ngā rerengamahi whakaora aunoa, hei aukati i ngā whakatinanatanga morearea, hei whakamana rānei i ngā paerewa tutuki i ngā whakaritenga.
Ano, Mā te hono i te kimi pokanoa pūtake tuwhera me te kimi hapa, te matawai ngoikoretanga, me te tātari waehere ka whakaratohia he kapinga katoa puta noa i tō huringa oranga whanaketanga pūmanawa. He tino pai te hangai o tēnei huarahi paparanga ki ngā anga pēnei i MITER ATT&CK me te Aratohu Kimi me te Urupare mō ngā Tūraru a OWASP
Rarangi Arowhai Whakatinana
Kei raro nei tētahi ripanga māmā ka taea e ngā tīma te whai hei whakatinana me te whakahaere te kimi pokanoa pūtake tuwhera tōtika:
| Hipanga | Mahi |
|---|---|
| 1. Tautuhia te Whānuitanga | Tāutuhia ngā ratonga matua, ngā tautau, me ngā putunga raraunga e tika ana kia whakahaerehia te kimi. |
| 2. Whakatakotohia ngā Pūoko | Tāutahia ngā pūoko whatunga (NIDS) me ngā kaiwhakahaere manaaki (HIDS) puta noa i te hanganga kua tautuhia. |
| 3. Whakauru CI/CD | Tāpiri pre-commit hooks, pipeline ngā atamira, ngā keti haumarutanga rānei hei kite aunoa i ngā mahi morearea me ngā huringa waehere. |
| 4. Whakaōrite i ngā Rangitaki | Standardte whakarite i ngā whakatakotoranga o te huihuinga me te waihanga i ngā ture tūāpapa e hono ana ki ngā rautaki MITRE ATT&CK. |
| 5. Honoa te SIEM | Tukuna ngā whakatūpato mai i tō pūnaha kimi urutomo tuwhera ki a SIEM, Slack, Jira rānei mō te mahi tahi tere ake. |
| 6. Whakahohehia te Whakatūpato Moata | Whakahohehia te aroturuki mō ngā mōkihi kino me ngā mahi whakapae i roto CI/CD pipelines. |
| 7. Whakaritea ngā mea matua mā te āheinga ki te tae atu | Whakamahia ngā raraunga āheinga ki te toro atu me te whakamahi hei whakatika i ngā mea e tino mōrearea ana i te tuatahi, hei whakaiti i te ngenge o te tūpato. |
| 8. Whakamatau me te Whakapai ake | Whakahaerehia ngā whakangungu a te tīma whero/kikorangi, arotakehia ngā matohi, me te whakahou i ngā ture i ia wā kia mau tonu ai te kounga o te kitenga. |
He Akoranga Take Poto: Mai i te Tirohanga ki te Mahi
Te tango te kimi pokanoa pūtake tuwhera Ehara i te mea ko te tāutanga anake te kaupapa, engari ko te waihanga i tētahi porowhita urupare tere i waenga i ngā whakatūpato, ngā kaiwhakawhanake, me te aunoatanga. E whakaatu ana te tere tere e toru wiki e whai ake nei me pēhea te neke a ngā tīma mai i te parepare tauhohe ki te parepare matatau.
He wiki 1: Whakatakotoria ngā pūoko me ngā kaihoko manaaki, kātahi ka whirihora i tō pūnaha kimi urutomo tuwhera hei tuku matohi ki a Slack, ki a Jira rānei. Tīmata te kohikohi raraunga kaupapa me te whakatikatika i ngā ture kimi taketake.
He wiki 2: Honoa ngā putanga kimi ki CI/CD pipelines. Ārai aunoa i ngā mahi kore haumaru, wehea ngā wāhanga e pāngia ana, ā, whakaputa pull requests hei whakatikatika. Nō reira, ka kite tika ngā kaiwhakawhanake i ngā take i roto i ā rātou rerenga mahi.
He wiki 3: Tāpirihia ngā whāngai mōhiotanga whakatūpato wawe me te whakatauranga taea te toro atu hei whakatau i ngā mea matua ngā whakatūpato e tino hira ana. Mā tēnei ka whakaitihia ngā hua teka mā te neke atu i te haurua, ā, ka mārama hoki ki ngā tīma te whakamahinga pai puta noa i ngā rawa.
Xygeni i roto i te Mahi: Te Whakakaha i te Kitenga Urupare Pūtake Tuwhera
Ko ngā taputapu IDS tuku iho e aro nui ana ki te hokohoko whatunga me te mahi a te kaihautū. Heoi, ko ngā whakaeke hou e aro nui ana ki pipelinengā āhuatanga, ngā whakawhirinakitanga, me ngā taiao hanga. Xygeni whakarei ake i nga kaha o ngā pūnaha kimi urutomo pūtake tuwhera mā te whakawhānui i ō rātou toronga ki roto i te te huringa ora katoa o te whanaketanga pūmanawa.
- CI/CD te kimi i ngā āhuatanga rerekē: Ka aroturuki tonu i ngā rerengamahi hanga, ngā whakaaetanga, me ngā taurangi taiao hei kite i ngā huringa whakapae, ohorere rānei i mua i te whakamahinga a ngā kaiwhakaeke.
- Te kitenga e pā ana: Ka whakakotahi i ngā matohi mai i ngā pūnaha kimi me te ārai urutomo maha me ngā raraunga ngoikore, te ngāwari ki te whakamahi, me te taea te toro atu hei whakaatu i ngā tūmomo riri e tino tika ana.
- Whakautu aunoa: Ka whakaoho aunoa i ngā mahi, pērā i te aukati i ngā hanganga morearea, te wehe i ngā putunga kua pakaru, te waihanga rānei i ngā putunga haumaru pull requests mā ngā kaiwhakawhanake e arotake.
- Te tirohanga kotahi: Takoha dashboarde hono ana i ngā kaupapa hanganga, te ngohe waehere, me ngā mōrearea whakawhirinakitanga ki te tirohanga kotahi, e whakangāwari ana i te tātari mō ngā tīma haumarutanga me ngā tīma DevOps.
I roto i te poto, ka whakakapi a Xygeni i te āputa i waenga i te aroturukitanga IDS tawhito me te aunoatanga DevSecOps hou. Ka kawea mai e ia te mātauranga me te whakaritenga ki te kimi pokanoa pūtake tuwhera, e āhei ai te urupare tere ake, te tiakitanga kaha ake, me te mōhiotanga wā-tūturu puta noa i te mekameka tuku pūmanawa katoa.
Thoughts Final
Kāore e ranea te kimi noa. Mā te whakakotahi i te tirohanga, te aunoatanga, me te urupare atamai ka hangaia he parenga pono e tiaki ana i ia wāhanga o te whanaketanga.
Modern ngā pūnaha kimi me te ārai i te urutomo kia mōhio ai ngā tīma me te tere e hiahiatia ana e rātou ki te kimi, ki te tātari, me te aukati i ngā tūmomo riri i mua i te horapa. Mā te whakamahi i ēnei pūnaha, ka taea e ngā kaiwhakawhanake te auaha me te maia, me te mōhio ki tā rātou waehere, pipelines, ā, kei te noho haumaru tonu ngā hanganga.
???? Tirohia te whakawhānui ake a Xygeni i te kitenga urutomo ki tō CI/CD pipelines. Tonoa he whakamātautau kore utu→
