Te Take e Puta ai ngā Ngāwari Haumarutanga i roto i ngā Pūmanawa

1. Ngā Mahi Whakawaehere Kino: He Take Nui e Puta ai Ngā Whakaraeraetanga Haumarutanga i roto i ngā Pūmanawa

Ka whakaurua e ngā kaiwhakawhanake ngā ngoikoretanga haumarutanga ina tuhia e rātou he waehere kore haumaru. Ki te kore he manatoko whakauru tika, he manatoko haumaru, he whakamunatanga hoki, ka taea e ngā kaiwhakaeke te whakahaere ngāwari i ngā tono. Nō reira, ka hangaia e ēnei ngoikoretanga pūmanawa he wāhi urunga mō ngā tūmomo riri ipurangi, ā, ka mutu, ka arahi atu ki ngā takahi raraunga me te tango i ngā pūnaha.

Werohanga SQL – He Whakaraeraetanga Haumarutanga Noa

Hei tauira, ko te werohanga SQL tētahi o ngā ngoikoretanga haumarutanga tino noa. Ka whakamahia e ngā kaiwhakaeke tēnei ngoikoretanga ina kore e taea e ngā kaiwhakawhanake te horoi i ngā whakaurunga a te kaiwhakamahi. Nō reira, ka werohia e rātou ngā whakahau SQL, ka karo i te manatoko, ka uru atu ki ngā raraunga tairongo. I roto i te wā, kua puta he pakaru raraunga nui i roto i te maha o ngā ahumahi nā tēnei ngoikoretanga.

Ngā Huanga o ngā Whakaeke Werohanga SQL:

• Ka tahaetia e ngā kaipahua ngā taipitopito tuakiri kaiwhakamahi me ngā raraunga pūtea, ka hua ake he mate pūtea.
• Ka whakarerekē, ka muku rānei ngā kaiwhakakino i ngā tuhinga o te pātengi raraunga, ka puta ai ngā raruraru ki te pono o ngā raraunga.
• Ka pāngia ngā whakahaere e te turuturu o ngā mōhiohio kiritaki me ngā raruraru pūtea.

Me pēhea te ārai i tēnei ngoikoretanga haumarutanga:

Hei whakaiti i te mōrearea o ngā whakaekenga werohanga SQL, me mahi ngā whakahaere i ngā mahi matatau i ia wāhanga o te whanaketanga.

• Whāia ngā aratohu waehere haumaru mai i Ngā 10 Pai rawa atu o OWASP ki te whakaiti i nga raruraru.
• Whakamahia ngā patai kua whakarārangihia te tawhā, ā, whakaritea ngā tauākī hei aukati Te wero SQL.
• Whakahaere Te Whakamātautau Haumarutanga Taupānga Pūmau (SAST) kia kitea wawe ai ngā ngoikoretanga.

Mā te mahi i ēnei mahi ārai, ka taea e ngā pakihi te whakaiti i te tūponotanga o ngā whakaeke werohanga SQL me te whakapakari i te haumarutanga o ngā taupānga.

2. Pūmanawa Kāore anō kia Whakatikahia: He Take Matua o ngā Ngāwari Haumarutanga

He maha ngā ngoikoretanga haumarutanga i ahu mai i ngā pūmanawa kāore anō kia whakatikatikaina. Inaa, e rapu kaha ana ngā kaipahua ipurangi i ngā ngoikoretanga e mōhiotia ana, me te tumanako ka whakaroa ngā whakahaere i te whakatikatika. Nō reira, ko ngā pakihi e kore e aro ki ngā whakahoutanga haumarutanga ka waiho ā rātou pūnaha kia tūpono ki ngā whakaekenga.

Log4Shell – He ngoikore nui ki te haumarutanga

Hei tauira, ko Log4Shell tētahi o ngā ngoikoretanga haumarutanga kino rawa atu i ngā tau tata nei. Nā te whānui o te whakamahinga, i taea ai e te ngoikoretanga Log4Shell (CVE-2021-44228) i roto i te Apache Log4j te whakahaere i ngā waehere mamao i runga i ngā miriona taputapu. Nā reira, i pāngia ngā pakihi puta noa i ngā ahumahi rerekē e ngā pakaru raraunga nui me ngā rahunga pūnaha. Ko te mea kino rawa atu, i whakamahia e ngā kaipahua ipurangi tēnei ngoikoretanga i te ao whānui, ā, i pāngia ngā whakahaere puta noa i te ao.

Ngā Pānga o ngā Whakamahinga Log4Shell:

• I whakamahia e ngā kaipahua ipurangi te ransomware, ā, i tahaetia hoki ngā raraunga tairongo, ā, i whakararuraru i ngā mahi o te ao.
• I pāngia ngā kamupene nunui, tae atu ki a Microsoft, Amazon, me Tesla, e ngā takahi haumarutanga nui.
• Neke atu i te $12 piriona te utu katoa mō te whakaiti i te mate puta noa i te ao, e ai ki te CISHe Pūrongo.

Me pēhea te ārai i tēnei ngoikoretanga haumarutanga:

• Whakamahia te whakahaere papaki aunoa hei whakarite kia noho whakahōu tonu te pūmanawa.
• Whakaritea te whakatikatika mā te whakamahi i te Pūnaha Kaute Matapae Exploit (EPSS) ki te whakatika i ngā ngoikoretanga mōrearea nui i te tuatahi.
• Whakaatuhia Application Security Posture Management (ASPM) hei aroturuki tonu i ngā pūmanawa tawhito.

Mā te whakatinana i ēnei tikanga haumarutanga, ka taea e ngā whakahaere te noho matatau i mua i ngā kaiwhakaeke me te ārai i te whakamahinga o ngā ngoikoretanga pūmanawa a meake nei.

3. Ngā Whirihoranga Hē: He Whakaraerae Haumarutanga Ka Taea te Ārai

He maha rawa ngā wā, ka puta he ngoikoretanga haumarutanga nui nā ngā ratonga kapua, ngā pātengi raraunga, me ngā tautuhinga whatunga kua whirihorahia hētia. Ki te kore e whakamahia e ngā tīma haumarutanga ngā mana whakahaere urunga tika, ka taea e ngā kaiwhakaeke te whakamahi ngāwari i ngā whirihoranga hē me te whiwhi urunga kore whakamanatanga.

Ngā Pātengi Raraunga Kua Whakakitea me ngā Whirihoranga Ngoikore

Ko tētahi o ngā hapa tino kitea ko te waiho i ngā pātengi raraunga kapua kia wātea ki te marea. He maha ngā whakahaere kāore e tiaki tika i ēnei pātengi raraunga, ka waiho kia tuwhera ki te whakaeke. Nō reira, ka matawaihia e ngā kaipahua te ipurangi mō ngā ratonga kua whirihorahia he, ā, ka tahaetia ngā raraunga tairongo. I roto i te wā, kua hua ake i ēnei ngoikoretanga haumarutanga he turuturu raraunga nui.

Ngā Pānga o ngā Whirihoranga Hē o te Kapua:

• Ka whiwhi ngā kaiwhakamahi kore mana i te urunga katoa ki ngā pātengi raraunga, ka whakaatu i ngā raraunga pakihi nui.
• Ka tangohia e ngā kaiwhakaeke ngā raraunga a ngā kiritaki ka hokona atu ki te tukutuku pouri, ka piki ake ai te tūponotanga o te tinihanga.
• Ka whiua ngā kamupene ki ngā whiu ture mō te takahi i ngā ture GDPR me te CCPA nā te ngoikore o ngā mana whakahaere haumarutanga.

Me pēhea te ārai i tēnei ngoikoretanga haumarutanga:

Hei whakaiti i te mōrearea o ngā whirihoranga hē, me whakamahi ngā whakahaere i ngā tikanga whakatinanatanga haumaru, me te whakatinana i ngā kaupapa here urunga tino pakari.

• whakamahi Ihanganga hei Waehere (IaC) haumarutanga hei whakatinana i ngā whirihoranga tika.
• Whakatinanahia te Mana Uru Tūāpapa-Turanga (RBAC) hei whakawhāiti i te urunga kore mana.
• whakahohe Ngā taputapu Whakahaere Mea Ngaro hei tiaki i ngā tohu tairongo.

Mā te whakatinana i ēnei mana whakahaere, ka taea e ngā pakihi te whakaiti i ngā mōrearea whirihoranga hē me te whakarei ake i te haumarutanga kapua.

4. Ngā Whakaekenga o te Mekameka Tuku: He Take e Tupu Ana Ngā Whakaraeraetanga Haumarutanga i roto i ngā Pūmanawa

Ka whakawhirinaki ngā tono hou ki ngā whare pukapuka me ngā whakawhirinakitanga a te hunga tuatoru. Heoi, he maha ngā wā ka aro atu ngā kaiwhakaeke ki ēnei wāhanga hei werohanga pūmanawaNā konei, me tiaki e ngā pakihi ā rātou mekameka tuku pūmanawa hei ārai i ngā takahi ture nui.

Ko te whakaeke i te mekameka tuku a SolarWinds

I uru puku ngā kaipahua ipurangi ki ngā whakahoutanga o SolarWinds Orion, ka werohia ngā tatau o muri ki roto i te rorohiko e whakamahia whānuitia ana. enterprise pūmanawa. Nā reira, mano tini ngā whakahaere i tāuta i ngā whakahōutanga kino, tae atu ki ngā kamupene Fortune 500 me ngā tari kāwanatanga, kāore i te mōhiotia.

Ngā Huanga o ngā Whakaekenga mekameka tuku:

• I whakamahia e ngā kaipahua rorohiko ngā tatau papamuri hei whiwhi urunga roa ki ngā whatunga umanga me ngā whatunga kāwanatanga.
• I pāngia ngā tari kāwanatanga e te tutei me ngā whakararuraru i ngā mahi, ā, i whakararuraru i te haumarutanga o te motu.
• Neke atu i te $100 miriona te kino pūtea, e ai ki te Pūrongo a te Kāwanatanga o Amerika.

Me pēhea te tiaki i te mekameka tuku pūmanawa:

I te mea kei te piki haere ngā whakaekenga a te mekameka tuku taonga, me mahi ngā pakihi i ngā mahi matatau hei tiaki i ō rātou whakawhirinakitanga.

• tango Tātaritanga Hanganga Pūmanawa (SCA) hei matawai tonu i ngā ngoikoretanga me te kite wawe i ngā mōrearea.
• Whakatinanahia a Xygeni Open Source Security hei tautuhi me te aukati i ngā mōkihi kua pangia e te pūmanawa kino i mua i te whakararuraru i ngā taupānga.
• Whakahaerehia ngā Pire Rauemi Pūmanawa (SBOMs) hei aroturuki i ngā wāhanga tuatoru, kia mārama ai te mekameka tuku pūmanawa.

5. Ngā Tūraru o Roto: He Ngāwari Haumarutanga e Hiahiatia Ana

Ahakoa he tokomaha e aro ana ki ngā tūmomo riri o waho, he rite tonu te mōrearea o ngā tūponotanga o roto. Ka taea e ngā kaimahi kino me ngā kaimahi mangere te whakauru i ngā ngoikoretanga haumarutanga mā te whirihora hē i ngā pūnaha, te whakahaere hē i ngā raraunga tairongo, te whakaatu kore rānei i ngā tohu urunga. Nō reira, me whakatinana e ngā whakahaere ngā kaupapa here haumarutanga ā-roto kia iti ake ai te mōrearea o ngā tūmomo riri o roto.

Atanga Kaiwhakahaere Kua Whakakitea Nā te ngoikore o ngā Mana Whakauru

Hei tauira, ko ngā tono tukutuku me ngā papa whakahaere kāore he here—ko rātou ngā tino whāinga mō ngā whakaekenga kaha-kino. Mēnā ka kore ngā kamupene e whakatinana i ngā kaupapa here manatoko kaha, ka taea e ngā kaiwhakaeke te uru atu ki ngā pūnaha nui. Heoi anō, he maha ngā tūmomo riri o roto e puta mai ana nā te ngoikore o ngā mana uru, ehara i te mea he kino noa iho.

Ngā Pānga o ngā Tūraru o Roto:

• Ka hurahia noatia e ngā kaimahi ngā raraunga tairongo, ka takahi i ngā ture hanganga ture.
• Ka tahaetia e ngā kaipahua ngā tohu kaiwhakahaere, ka whakanuia ake ngā mana whakahaere, ka riro i a rātou ngā pūnaha nui.
• E ai ki te ture, ka pāngia ngā whakahaere e te kino o te taha pūtea me te ingoa pai. Ripoata a Gartner.

Me pēhea te whakaiti i ngā tūmomo mōrearea o roto:

Hei whakaiti i ngā tūmomo riri o roto, me whakamahi e ngā pakihi ngā kaupapa here urunga tino pakari me ngā taputapu aroturuki.

• Whakaūtia te Motuhēhēnga Maha-Waenga (MFA) mō ngā pūkete kaiwhakahaere katoa hei ārai i te urunga kore whakamanatanga.
• Whakawhāitihia te urunga ki ngā papatohu whakahaere mā te whakamahi i ngā VPN, i ngā whatunga tūmataiti rānei hei whakaiti i te pānga.
• Hurihia atu Te Kitenga i te Āhuatanga Kāore i te Tika a Xygeni hei aroturuki i ngā mahi whakapae i roto i CI/CD pipelines me te haki i ngā whanonga rerekē.

Mā te whakatinana i ēnei mana whakahaere haumarutanga ā-roto, ka taea e ngā whakahaere te whakaiti i ngā mōrearea e pā ana ki ngā tūmomo riri o roto.