Ko te uauatanga o te whanaketanga pūmanawa hou (e tipu haere tonu ana) me whai huarahi matatau ki te haumarutanga. Ko te whakauru i te DevSecOps—te whakakotahitanga o te whanaketanga, te haumarutanga, me ngā mahi—he tohu tēnei i te nekehanga mai i te whakahaere mōrearea ipurangi tauhohe ki te whakahaere mōrearea matatau, kia noho ai te haumarutanga hei wāhanga matua o te huringa oranga whanaketanga.
I roto i tā mātou wāhanga SafeDev Talk, i whakapuaki mai ngā tohunga haumarutanga ipurangi e tohunga ana ki ngā momo mara i ō rātou tirohanga mō te hiranga, ngā wero, me ngā rautaki hei whakatutuki i tēnei whāinga. Tirohia wawe!
Whai muri i ngā whakaaro o ngā kaikōrero o te hui tukutuku, ka rukuhia e tātou te whakahaere mōrearea haumarutanga ipurangi whai hua, me te whakaatu i ētahi o ngā Tikanga Pai a DevSecOps. Pānui tonu!
He aha te mea nui ai te Whakahaere Mōrearea Haumarutanga Ipurangi Matatau?
Hei pūmanawa pipelineKa nui haere te matatau me te uaua o ēnei, ka piki haere hoki ngā mōrearea. Ka kite tātou i muri mai, ko te haumarutanga i roto i te DevOps pipeline ehara i te mea he painga noa iho—he mea whakahau kia mau tonu, kia haumaru hoki te whanaketanga. E whakaatu ana tēnei i te hiahia kia arohia ngā ngoikoretanga haumarutanga i mua i te urunga mai ki ngā taiao whakaputa, kia whakaitihia ai ngā mōrearea me ngā utu.
E tautokona ana tēnei e ngā tatauranga: e tohu ana ngā rangahau roa a IBM Ko te whakatika i tētahi ngoikoretanga i muri i te whakatinanatanga ka eke ki te 100 ngā wā nui atu i te whakatika i mua i roto i te huringa ora.
Te Whakarite i te Whakahaere Mōrearea Ipurangi i Ia Wāhanga
1. Te Rerekētanga o te Mōrearea puta noa i ngā Wāhanga Kāore te mōrearea e tū kotahi; ka puta mai ngā momo rerekē i ngā wāhanga rerekē o te Huringa Ora Whakawhanake Pūmanawa (SDLC). Hei tauira:
- whanaketanga: ngaro me ngā Mahi Waehere Kore Haumaru
- Whakauru: Ngā ngoikoretanga i roto i ngā whakawhirinakitanga ngā whirihoranga rānei
- Te Whakatakotoranga: Ngā Whirihoranga Hē i roto i Hanganga hei Waehere (IaC)
- Te Hanga: Ngā mōrearea e pā ana ki te whakamahinga wā-oma, ki ngā nekehanga taha rānei
Me whakarite ngā mahi haumarutanga kua whakaritea mō ia wāhanga, mai i te whakatauira i ngā tūmomo mōrearea i te hoahoa tuatahi ki te aroturuki i te wā e whakahaerehia ana, ā, me hangai katoa ki ngā mātāpono kore whakawhirinaki.
2. Te Whakatauira i te Tūraru hei Kōhatu Matua
Kāore e taea te whakakorekore i te hiranga o te whakatauira i ngā tūmomo mōrearea. Ahakoa ko tōna whakamahinga pai rawa atu i ngā wāhanga whakaritenga me te hoahoa, ka horapa tōna whai huatanga tae noa ki te whakaurunga me te whakatinanatanga i muri i te whakatinanatanga. Ka taea e koe te whakaiti i ngā mōrearea i muri mai, engari ka tino piki ake ngā utu. Ko te whakaaro nui: he pai ake i te wā tōmua i te wā tōmuri.
Aunoatanga: Te Poutokomanawa o te Whakahaere Mōrearea Haumarutanga Ipurangi Matatau
I te mea he nui ngā ngoikoretanga i kitea e ngā matawai hou, kua noho te aunoatanga hei mea nui:
- Ngā taputapu kimi me te whakarite kaupapa matua pērā i SCA (Tātari Hanganga Pūmanawa) me EPSS (Pūnaha Kaute Matapae Exploit) e whakarato ana i ngā aromatawai hihiri, wā-tūturu. Ko te EPSS, ina koa, e tohu ana i te tūponotanga o te whakamahinga o tētahi ngoikoretanga, e tuku ana i ngā māramatanga mahi hei whakatau i ngā kaupapa matua.
- Whakaurunga me te Pūrongo Me whakauru pai ngā māramatanga haumarutanga ki ngā rerengamahi o nāianei—ahakoa mā roto i ngā monomai IDE, ngā pūnaha tikiti pēnei i a Jira, ngā whakamōhiotanga Slack rānei. Ko te pepeha me pēnei: "Kia noho ki te wāhi e noho ana ngā kaiwhakawhanake". Kāore e taea te whakakorekore i te hiahia mō ngā matohi horopaki me te wātea.
- Te Whakaora Aunoa Ka whakatinanahia e ētahi pūnaha matatau te whakaora aunoa mō ētahi tūponotanga. Hei tauira, ka taea e ngā whakahoutanga whakawhirinakitanga aunoa me te whakatinanatanga kaupapa here te whakakore i ngā tūponotanga me te kore e wawaotanga tangata.
Ngā Take Tangata: Te Mahi Ngātahi me te Kawenga
Ahakoa te aro nui ki ngā taputapu, he mea nui tonu te taha tangata mō te whakahaere tika i ngā mōrearea ipurangi:
- Mātauranga: Me whakangungu ngā kaiwhakawhanake ehara i te mea ko ngā taputapu haumarutanga anake engari me whakangungu hoki ki ngā waehere haumaru me ngā mahi pai rawa atu. E ai ki tētahi o ngā mema o te rōpū, "E kore e taea e te kaiwhakawhanake kāore e mārama ki te hoahoa haumaru te hanga i tētahi pūnaha haumaru."
- Te Kawenga Takohanga: I te mea he nui ngā rārangi ngoikoretanga e whakaputaina ana e ngā matawai aunoa, ko te whakatau i ngā kaupapa matua ka whakawhirinaki ki te mārama o ngā tīma ki te pānga pakihi o ia mōrearea. He maha ngā wā ka tohaina e ngā tīma matatau te 5–10% o ō rātou wā tere ki te aro atu ki te haumarutanga, me te whakakotahi i tēnei ki ā rātou tukanga whakatika hapa o nāianei.
Ngā mahi pai a DevSecOps mō te Whakahaere Mōrearea Ipurangi whai hua
- Whakauruhia te Haumarutanga i te Wā Mua: Mai i te hoahoa ki te whakatinanatanga, me whakarite te haumarutanga hei wāhanga tūturu o ia wāhanga.
- Whakamahi Aunoatanga: Whakamahia ngā taputapu ehara i te mea hei kimi noa iho engari hei whakarite i ngā kaupapa matua, hei tuku pūrongo, tae atu ki te whakatika.
- Whakaako me te Whakamana: Whakaratohia ngā tīma ki ngā mōhiotanga me ngā taputapu hei whakauru i te haumarutanga me te kore e aukati i te tere o te mahi.
- Whakamahi i te Whakatakotoranga Hihiri: Whakauruhia te EPSS, ngā tauira rite rānei, hei arotahi ki ngā ngoikoretanga e tino tūpono ana te whakamahi kino.
Kei te hiahia koe ki te ruku hōhonu atu ki te Whakahaere Mōrearea Matatau i roto i te DevSecOps?
Ko ngā māramatanga i āwhina i te hanga i tēnei tuhinga i ahu mai i tētahi kōrero i roto i tā mātou hui tukutuku SafeDev Talk. Hono atu ki ngā tohunga Ema Fang, Marudhamaran Gunasekaran, Luis Garcia, a Ihu Cuadrado i a rātou e whakapuaki ana i ō rātou wheako, wero, me ngā rautaki mō te whakauru i ngā mahi pai a DevSecOps ki roto i tō huringa oranga whanaketanga.
Mātakihia tā mātou Wāhanga Kōrero SafeDev mō te Whakahaere Mōrearea Matatau i roto i te DevSecOps me te tango i te taahiraa e whai ake nei te tiaki i tō DevOps pipeline me ngā tohutohu a te tohunga me ngā akoranga whai hua!
Te Anamata o te Whakahaere Mōrearea Matatau
Ehara i te mea ko ngā taputapu, ko ngā tukanga rānei te kaupapa matua o te whakahaere mōrearea haumarutanga ipurangi i roto i te DevSecOps—engari ko te whakataurite i te hangarau, te tangata, me ngā mahi hei waihanga i tētahi taiao whanaketanga haumaru, tere hoki. Mā te whakauru i te haumarutanga ki roto i te DNA o tō SDLC, ka taea e ngā whakahaere te auaha me te māia, me te mōhio ehara te haumarutanga i te aukati engari he mea e āhei ai te tipu.
Hei whanaketanga pipelineI te mea ka nui haere te uaua, ka nui haere te hiahia mō ngā otinga hou e urutau ana ki tēnei uauatanga. He taputapu pēnei i Te otinga a Xygeni e whakaatu ana i te heke mai o te whakaurunga haumarutanga, e āwhina ana i ngā whakahaere ki te whakahaere i ngā mahi, ki te whakahaere aunoa i ngā mahi nui, me te whakauru i te whakahaere mōrearea matatau puta noa i te SDLCMā te hono atu ki ngā mahi pai a DevSecOps, ka tukuna e ēnei taputapu ngā māramatanga mahi me te whakatau kaupapa matua hihiri, ka whakamana i ngā tīma ki te aro atu ki ngā ngoikoretanga me te kore e whakararu i te tere me te tere o te whanaketanga. Kaua e tatari: whakatinanahia ngā mahi pai a DevSecOps i te wā e taea ai, ā, whakarei ake i tō whakahaere mōrearea haumarutanga ipurangi!
