Te Whakamātautau Whakauru vs Te Matawai Whakaraerae: Ngā Mea Me Mōhio Ngā Kaiwhakawhanake
He tere te whanaketanga o ēnei rā, me ngā kaiwhakaeke anō hoki. Nō reira, kāore e taea te kimi me te whakatika wawe i ngā ngoikoretanga haumarutanga. Heoi anō, he maha ngā tīma e hē ana ki te mahi. whakamātautau urunga vs matawai ngoikoretanga, me te mea he rite tonu te mahi a ngā mea e rua. Ko te mea pono, ka aro atu rātou ki ngā paparanga rerekē o te mōrearea haumarutanga, ā, ka tautoko tetahi i tetahi puta noa i te SDLC.
E whakamārama ana tēnei aratohu i te mahi a ia mea, te wā e whakamahia ai, me te whakamahinga aunoa a ngā tīma DevSecOps hou i ngā mea e rua mā te whakamātautau haumarutanga tonu.
He aha te Matawai Whakaraeraetanga?
A matawai ngoikoretanga ka tirotiro aunoa i ngā pūnaha, waehere, ngā whakawhirinakitanga rānei mō ngā ngoikoretanga e mōhiotia ana.
He rite te mahi ki te pūnaha tonu health check, te whakataurite i tō taiao ki ngā pātengi raraunga nui pēnei i te NDV.
Ko ngā taputapu matawai ngoikoretanga e rapu ana i:
- Ngā whare pukapuka, ngā ipu rānei kua tawhito
- Ngā papaki ngaro, ngā whirihoranga hē rānei
- Ngā CVE e mōhiotia ana, ngā whakawhirinakitanga mōrearea nui rānei
- Ngā mea ngaro kua whakapūmautia, ngā tauira waehere haumaru kore rānei
Nā te tere me te auau o te oma o ēnei matawai, ka tukuna e rātou he urupare tata-tūturu ki ngā kaiwhakawhanake. Heoi anō, ka whakauruhia tika ngā papaaho matawai hou ki roto CI/CD pipelines, Nga Mahi a GitHub, me ngā IDE.
I te poto, matawai whakaraeraetanga ka āwhina i ngā tīma ki te kite wawe i ngā raruraru noa, i mua i te taenga ki te whakaputa.
He aha te Whakamātautau Whakauru?
Te whakamātautau tohu, i tētahi atu ringa, he whakaeke whakatauira.
Engari ko te tautuhi noa i ngā hapa e mōhiotia ana, ka ngana kaha ngā kaiwhakamātautau pene (ngā taputapu aunoa rānei) ki te whakamahi i aua hapa. Ko te whāinga he aromatawai i te nekehanga pea a te kaiwhakaeke tūturu i roto i tō taiao.
A whakamātautau werohanga taea te whakauru ki:
- Te ngana ki te whakamahi i ngā API ngoikore
- Te whakamātautau i te manatoko me te mana uru
- Te herea i ngā take maha hei whakatauira i te nekehanga taha
- Te aromatawai i te pānga pakihi me te whakaaturanga raraunga
He rerekē ki te matawai ngoikoretanga, me whai tohungatanga tangata me te horopaki te whakamātautau urunga. Nō reira, he rite tonu ki te ā-ringa, ā-wā, me te whai kiko, e mahia ana i mua i ngā tukunga nui, i ngā arotake hanganga ture rānei.
Te Whakamātautau Whakauru me te Matawai Whakaraerae: Ngā Rerekētanga Matua
| āhuatanga | Te Matawai Viknerability | Nga Whakatau Whakamene |
|---|---|---|
| whāinga | Kimihia aunoa ngā ngoikoretanga e mōhiotia ana | Whakatauira ā-ringa i ngā whakaeke o te ao tūturu |
| Aronga | Aunoa me te haere tonu | He mea ārahi e te tangata, he mea arotahi hoki |
| hōhonu | Taumata-mata, whānuitanga o te kapinga | Te whakamahi hōhonu, te arotahi ki te mahi kino |
| auautanga | Ia wiki, ia wā rānei, ia wā kua whakauruhia commit | Ia hauwhā, i mua rānei i ngā tukunga nui |
| huaputa | Rārangi o ngā ngoikoretanga kua kitea | Te taunakitanga mō te whakamahinga kino, te pūrongo pānga, te tohutohu whakaiti i te pānga |
| Best mo | Te kimi mōrearea me te akuaku auau | Te whakamana i ngā mōrearea tūturu me te tutuki i ngā whakaritenga |
Me pēhea te whakamārama i ēnei rerekētanga
māramatanga whakamātautau urunga vs matawai ngoikoretanga he rite ki te tiaki i tētahi mīhini uaua. E rua ngā huarahi kia mau tonu te whakahaere haumaru o tō pūnaha, engari ratou mahi i ngā kaupapa rerekē a mahi i ngā hohonutanga rerekē.
He rite te mahi a te matawai ngoikoretanga ki tētahi tirotiro noa, he tere, he taea te tukurua, ā, he tino pai mō te hopu wawe i ngā take noa. Ka āwhina i a koe ki te kite i ngā whakawhirinakitanga tawhito, ngā papaki ngaro, ngā whirihoranga haumaru kore rānei i mua i te taenga ki te whakaputanga. He rerekē, he rite te whakamātautau urunga ki tētahi whakamātautau ahotea katoa, ka panaia te tono ki ōna rohe, ka whakaatu i te āhua o tana tauhohenga i raro i ngā āhuatanga whakaeke tūturu.
Ka whakamahia e te matawai ngoikoretanga te aunoatanga me te standardngā pūnaha whakatauranga kua whakaritea, he mea tino pai mō ia rā DevSecOps pipelines. I taua wā, ka tāpirihia e te whakamātautau urunga te auahatanga me te whakaaro tangata hei whakatauira i ngā ara whakaeke o te ao tūturu e ngaro pea i te aunoatanga. Ka mahi tahi rātou, ka hangaia he tukanga kotahi e whakakotahi ana i te tere me te tere o mua.ciskatote.
Ina oti tika, ka noho hei porowhita urupare tonu te matawai ngoikoretanga me te whakamātautau urunga. Mā te matawai ka kitea whānuitia ngā momo waehere, ā, mā te whakamātautau ka whakaū ko ēhea ngā ngoikoretanga ka taea te whakamahi. Mā taua taurite ka āwhina i ngā tīma kia noho matatau, kaua ki te tauhohe, ka kitea wawe, ka whakamanahia hoki.
Hei whakamutunga, kaua e mātaki i te avmatawai ngoikore vs whakamātautau werohanga hei kōwhiringa i waenga i ngā taputapu. He hononga mahi tahi tēneiMā ngā matawai aunoa ka kitea ngā mōrearea i te tauine nui, ā, mā ngā whakamātautau pene ka whakarite kia mahi ngā whakatikatika i te wā e tika ana.
Nga pai me nga kino o ia Tikanga
He kaha, he taupatupatu hoki ō ngā huarahi e rua, ā, mā te mārama ki ēnei huarahi ka āwhina i ngā tīma ki te whakatau āhea me pēhea te whakamahi tika i ia huarahi.
| tikanga | AtAKi | raruraru |
|---|---|---|
| Te Matawai Viknerability | ✅ Tere, ā, aunoa hoki ✅ Ka taea te tauine ngāwari puta noa i ngā kaupapa ✅ Ka whakauru ki roto CI/CD ✅ He pai mō te urupare tonu | ⚠️ Ngā kitenga papaku ⚠️ Tērā pea kei roto ko ngā hua hē ⚠️ He iti noa iho ngā ngoikoretanga e mōhiotia ana |
| Nga Whakatau Whakamene | ✅ Whakatauira whakaeke tūturu ✅ Whakaū i te āheinga whakamahi ✅ Whakamanahia ngā mana whakahaere me guardrails ✅ Ka whakarato i te horopaki pakihi | ⚠️ He utu nui, he puhoi hoki ⚠️ Kāore e haere tonu ⚠️ E whakawhirinaki ana ki te tohungatanga o te kaiwhakamātautau |
I te poto, Ka kitea aunoatia e te matawai ngā ngoikoretanga, ā, mā te whakamātautau urunga ka whakamārama ko ēhea ngā mea tino hira. He mea nui ngā mea e rua mō te parepare hōhonu.
Te Whakakotahitanga o ngā Mea e Rua e ngā Kaiwhakawhanake CI/CD
I ngā rerengamahi DevSecOps o ēnei rā, ka taea e ngā kaiwhakawhanake te whakauru i ngā tikanga e rua me te kore e whakaroa i ngā hanganga.
Ko te mea nui ko te aunoatanga me te whakarite atamai.
Whakaurunga taahiraa-i-te-taahiraa:
- Matawai wawe, ā, i ia wā: Whakahaerehia aunoa ngā matawai ngoikoretanga ki ia pull request.
- Āraia te waehere haumaru kore: whakamahi guardrails hei ārai i te whakakotahitanga o ngā ngoikoretanga kino rawa atu.
- Whakatauirahia ngā whakaeke: Whakaritea ngā whakamātautau pene māmā i te wā e whakaritea ana hei whakamana i ngā ture kimi.
- Whakatakotoria ngā mea matua me te mohio: Whakakotahitia ngā raraunga matawai me ngā inenga whakamahi pēnei i te EPSS te tātaritanga āheinga rānei.
- Whakatikatika aunoa: Whakaoho haumaru pull requests me ngā whakawhirinakitanga kua papakihia, ngā whakahōunga whirihoranga rānei.
Nā reira, ka mau tonu ngā tīma whakawhanake i ngā mea e rua tere me te haumaru, me te kore e tatari mō ngā arotake ā-hauwhā.
tauira:
A CI/CD pipeline e whakahaere ana i a Xygeni's SCA a SAST ngā matawai i ia commit.
Ina puta he ngoikoretanga, ka tirohia e te tūāpapa te āheinga ki te whakamahi, ka waihangahia he whakatikatika PR, ā, ka tuhia te huihuinga.
Ā muri ake nei, ka whakamanahia e tētahi whakamātautau pene poto kua kati te mōrearea i te whakatikatika.
Mā tēnei porowhita ka noho haumaru tō tono i roto i ia tere tere.
Me pēhea te whakahaere a te Xygeni Vulnerability Scanner i te Continuous AppSec
I roto i te mahi, he maha tonu ngā tīma e tautohetohe ana whakamātautau urunga vs matawai ngoikoretanga, engari ko te pono, ka tino pai te mahi tahi ina whakakapia te āputa e te aunoatanga.
Matawai Whakaraerae a Xygeni ka whakaora i taua aunoatanga. Ka aroturuki tonu i tō waehere, i ō whakawhirinakitanga, me pipelines, e whakarerekē ana i te mea i mua he mahi ā-ringa, ā-wā, hei tukanga DevSecOps tere, pono hoki.
Nga Kaha Matua
- Pipeline-aunoatanga taketake: Ka hono tika a Xygeni ki roto CI/CD ngā taiao pēnei i a GitHub Actions, GitLab CI, Jenkins, Azure DevOps rānei. Nō reira, ka whakahaerehia aunoatia e ia hanganga he matawai ngoikoretanga vs whakamātautau urunga te kaupapa matua, te tirotiro mō ngā CVE e mōhiotia ana, ngā whirihoranga hē, ngā mea ngaro, me ngā mōrearea mōkihi pūtake tuwhera.
- Te mātauranga whakamahi kino: Hei tāpiritanga, ka whakarei ake i ngā hua mā te whakamahi i ngā raraunga mai i EPSS, CISHe KEV, me te tātari taea te toro atu hei whakaatu ko ēhea ngā ngoikoretanga tūturu, ā, ko ēhea hoki ngā ngoikoretanga ka taea te whakamahi kino.
- Guardrails mō ngā kaiwhakawhanake: Nā reira, ka āraia aunoatia ngā hanumitanga mōrearea, ngā whakahōutanga whakawhirinakitanga rānei. Ka taea e ngā kaiwhakawhanake te whakatakoto kaupapa here haumarutanga e whakamana ana i te tutuki i ngā whakaritenga me te kore e whakaroa i ngā tukunga.
- Te whakatikatika aunoa: I tua atu, Pūmanawa Xygeni ka whakatuwhera haumaru pull requests me ngā putanga kua whakaritea, ngā papaki whirihoranga rānei. Ka tohu anō hoki i ngā huringa pea e takahi ana i te Mōrearea Whakaora kia kitea i mua i te pānga ki te mahi whakaputa.
- Te tirohanga nui: Ngā kitenga katoa: SAST, SCA, IaC, me Ngā Mea Ngaro, ka puta mai i roto i te kotahi dashboardNō reira, ka taea e ngā tīma DevSecOps te aroturuki i te ahunga whakamua, te whakarite i ngā kaupapa matua mā te whakamahi pai, me te whakaiti i te haruru.
Me pēhea te tautoko i te whakamātautau werohanga
Ahakoa te matawai ngoikoretanga me te whakamātautau urunga he maha ngā wā ka rite ki te whakataetae, he rite tonu te mahi tahi a ngā tikanga e rua.
Ka hipokina e te matawai te whānui me te tere, ko te whakamātautau werohanga e whakarato ana i te horopaki me te hōhonutanga.
ki te Matawai Whakaraeraetanga Xygeni, ka taea e koe te pupuri i te matawai tonu me te whakamana tonu i ngā hua mā te whakamātautau ā-ringa, mā te whakamātautau kua whakaritea rānei.
Hei tauira:
- Whakahaerehia ngā matawai ngoikoretanga aunoa i ia pull request.
- Whakamanahia ngā kitenga matua mā te whakamahi i ngā whakamātautau pene māmā i te wā e whakatakoto ana i te whakaahua.
- Whakatikatika aunoa mā te Pūmanawa Xygeni mō te whakatikatika tere, haumaru hoki.
Mā tēnei tukanga mahi ka tutuki te tautohetohe i waenganui i whakamātautau urunga vs matawai ngoikoretanga ka ngaro, nā te mea ka whiwhi koe i ngā mea e rua: te tere mai i te matawai me te whakamanawa mai i te whakamātautau.
Whakatau: He aha te pai o te mahi tahi o te Whakamātautau Wetewete me te Matawai Whakaraerae
Hei whakamutunga, ko te kōrero mō whakamātautau urunga vs matawai ngoikoretanga kaua e pā ki te whiriwhiri i tētahi, i tētahi rānei, engari me te whakakotahi i ngā mea e rua i runga i te mohio.
Te matawai ngoikoretanga me te whakamātautau urunga Ka whai hua anake ina noho tahi te tirohanga aunoa me te manatoko o te ao tūturu.
Ina whakauruhia ki ngā taputapu pēnei i Matawai Whakaraeraetanga Xygeni, ka noho maeneene te taurite:
- Matawai tonu hei ārai i ngā hokinga whakamuri.
- Whakamātauria i ia wā hei whakaū i te manawanui.
- Whakatika aunoa hei pupuri i te tere o te tuku.
Hei tāpiritanga, mā tēnei tauira whakauru ka whakarite kia matawai ngoikoretanga vs whakamātautau urunga Ka tautoko tetahi i tetahi. Mā te matawai ka kitea tonutia, ā, mā te whakamātautau ka whakaū i te āheinga tūturu.
I te pae hopea, whakamātautau urunga vs matawai ngoikoretanga āwhina tahi i ngā tīma whakawhanake ki te tiaki i ā rātou katoa SDLC, mai i te waehere pūtake ki te whakaputa, me te kore e ngaro te tere.
Mō te Kaituhi
tuhituhia e Fatima Said, Kaiwhakahaere Hokohoko Ihirangi he tohunga ki te Haumarutanga Taupānga i Haumarutanga Xygeni.
Ka waihangahia e Fátima ngā ihirangi rangahau-ā-kaiwhakawhanake i runga i te AppSec, ASPM, me DevSecOps. Ka whakamāori ia i ngā ariā hangarau uaua ki ngā māramatanga mārama, whai hua hoki e hono ana i te auahatanga haumarutanga tukutuku me te pānga pakihi.
