Mena kei te maere koe he aha te whirihoranga haumarutanga hē, kāore koe i te mokemoke. Ko tēnei ngoikoretanga noa, e kiia ana he He whirihoranga hē o te haumarutanga OWASP, ka pā ki te nuinga o ngā momo puranga hangarau, mai i ngā ipu ki ngā ratonga kapua. A ngoikoretanga whirihoranga hē o te haumarutanga Ka puta tēnei ina whakatinanahia ngā pūnaha, ngā ratonga, ngā waehere rānei me ngā taunoa kore haumaru, ngā tautuhinga kua kitea rānei. Ahakoa he papatohu whakahaere tuwhera, he tohu taunoa, he peere S3 whirihora-kore rānei, ka hoatu e ēnei āputa he wāhi urunga mārama ki ngā kaiwhakaeke.
Ko te whirihoranga hē o te haumarutanga tētahi o ngā ngoikoretanga e tino warewarehia ana, engari e whānuitia ana i roto i te whanaketanga pūmanawa o ēnei rā. Mena kua pātai koe he aha te whirihoranga hē o te haumarutanga, kua tirohia rānei i roto i te wāhanga whirihoranga hē o te haumarutanga OWASP o te rārangi Top 10, kua tae ki te wā ki te tirotiro tata atu. Mai i Kubernetes kua kitea dashboardki ngā tohu kaiwhakahaere taunoa i roto i ngā taiao kapua, he nui ake te kitea o tēnei mōrearea i tā te nuinga o ngā kaiwhakawhanake e mōhio ana.
Ahakoa te whakakaha o te waehere, ka taea e te ratonga kotahi kua whirihorahia he, te peere S3 tino whakaae, te aratau patuiro kua warewarehia rānei te whakaatu i ngā raraunga tairongo, te whakatuwhera rānei i te ara mō ngā kaiwhakaeke. Ehara i te mea he ariā noa iho ēnei take, he maha ngā wā ka puta mai ngā takahi tūturu i ngā hapa whirihoranga taketake i roto i te CI/CD pipelines, Dockerfiles, ngā tauira hanganga-hei-waehere rānei.
I roto i tēnei pou, ka whakamāramahia e mātou te take e noho tonu ai te hapa whirihoranga haumarutanga hei tētahi o ngā tūmomo riri nui i roto i te anga OWASP, ka whakaaturia ki a koe tōna āhua i roto i te mahi, ā, ka tukuna atu hoki he huarahi hei ārai i tēnei, me te kore e whakaroa i tō tukunga.
He aha te Whirihoranga Hē o te Haumarutanga?
Ka puta te whirihoranga hē o te haumarutanga ina whakatinanahia ngā pūnaha, ngā ratonga, ngā tono rānei me ngā tautuhinga taunoa kāore i te haumaru, ngā āhuatanga kāore e hiahiatia, ngā mana urunga tino whakaaetia rānei. Mena kua waiho e koe he ipu Docker kia kitea, committed a .env kōnae mā te hē, i wareware rānei ki te mono i te aratau patuiro i roto i te whakaputanga, kua kite koe i tēnei mōrearea e mahi ana.
Ki te waiho noa, He aha te whirihoranga haumarutanga hē? Koinei te wā e mahi ana tō taiao, engari he whānui te tūponotanga mō te tukino.
Kei te hē te whirihoranga haumarutanga o OWASP A05 i roto i te Ngā 10 Pai rawa atu o OWASP, ā, he take pai hoki. Ka hipokina e ia te whānuitanga o ngā āhuatanga, mai i ngā peere kapua kua whakatakotoria ki te tūmatanui, ki ngā pane haumarutanga ngaro, ki ngā whare pukapuka tawhito me ngā papatohu whakahaere tuwhera.
Ko te mea e tino mōrearea ai ko te ngāwari o te ngaro. Ka arotahi ngā kaiwhakawhanake ki te tuhi waehere haumaru, engari he maha ngā wā ka warewarehia ko ngā kōnae whirihora, CI/CD He mea nui anō hoki ngā taurangi, ngā whakaaetanga ipu, me ngā tauranga kua whakakitea.
Anei ētahi tauira o te ao tūturu:
- He pēke AWS S3 e taea ai te uru atu ki te marea me te kore manatoko
- He Kubernetes dashboard ka taea te toro atu mā te ipurangi, kāore he login
- Kua whirihorahia a Jenkins ki ngā kupuhipa taunoa
- Ngā whārangi hapa kupu-kupu i roto i te whakaputa e whakaatu ana i ngā tohu puranga
He tūmomo mōrearea puku ngā whirihoranga hē. Kāore e pakaru tō hanganga, engari e tatari ana i muri kia kitea rā anō e tetahi.
He aha te take he ngoikore tūturu te whirihoranga hē o te haumarutanga
I te tirohanga tuatahi, kāore pea te hapa iti e rite ki te tūmomo mōrearea. Heoi anō, he ngoikoretanga whirihoranga haumarutanga ka tere tonu te huri hei takahi whānui, inā koa i roto i ngā taiao kapua-taketake me ngā taiao ipu-ipu e hono tahi ana ngā ratonga.
He maha ngā wā ka matawaihia e ngā kaiwhakaeke:
- Whakatuwheratia ngā tauranga e whakaatu ana i ngā taputapu whakawhanake pēnei i a Kibana, i a Jenkins rānei
- Ngā pane kua whirihorahia he e āhei ai te tuhinga whakawhiti-pae (XSS)
- Ngā rawa kapua tūmatanui (hei tauira, S3, GCS) kua whakaritea kia "pānui/tuhi" mō te katoa
- turuturu
.gitngā whaiaronga, ngā mea kua whakakitea rānei.envngā kōnae i roto i ngā kaupapa GitHub
Heoi anō, kāore rātou e hiahia ki te whakamahi i te arorau o tō tono. Engari, ka whakawhirinaki rātou ki ō taunoa, ki ō haki kua warewarehia, ki ō papatohu whakahaere kāore anō kia whakatikatikaina.
He ripoata 2024 na IBM X-Force kitea e nā ngā whirihoranga hē i hua ai te 25% o ngā aituā haumarutanga kapua katoa, ko rātou te tuarua o ngā momo tūmomo riri kapua e tino kitea ana, i muri tata iho i te whakahaere hē o te tuakiri.
Me wehewehe tātou i tēnei mā te whakaahuatanga poto:
| tautuhinga | Kāore i te Haumaru i te Taunoa | Whirihoranga Whakapakari |
|---|---|---|
| Paewhiri Kaiwhakahaere | Whakahohetia me te kore login | Kua manatokohia & kua herea te IP |
| S3 Peere | Te urunga a te iwi | Tūmataiti me ngā ture IAM |
| Dockerfile | Ka whakamahi i te kaiwhakamahi pūtake | Ka oma hei kore-pūtake |
| Jenkins | Ngā tohu taunoa | RBAC me ngā tohu kua whakamanahia |
Nā te mea he maha ngā wā kāore e kitea ēnei take i te wā whakamātautau noa, ka noho hei wāhanga o te mata whakaeke, ka noho puku i roto i tō hanganga kia kitea rā anō e tetahi. Koia te take e rongoatia ai whirihoranga hē o te haumarutanga he mea nui te whakaraeraetanga tūturu mō ngā tīma DevOps me AppSec o ēnei rā.
Ngā Tauira Whakaraerae Haumarutanga Whirihoranga Hē e Ngarohia Ana e ngā Kaiwhakawhanake
Ahakoa ngā kaiwhakawhanake mohio, kāore e aro ki ngā whirihoranga hē o te haumarutanga, ehara i te mea kāore rātou e aro, engari nā te mea he maha ngā wā ka mahi ngā tautuhinga taunoa. pai rawaKei raro nei ngā tauira e puta puku ana ki te mahi hanga i ngā wā maha atu i tō whakaaro:
He whirihoranga hē o te haumarutanga i roto i ngā ipu me ngā kōnae Docker
- Te oma hei
roothei utu mō tētahi kaiwhakamahi kāore i te whai mana - Te whakaatu i ngā tauranga o roto
Dockerfileordocker-compose.yml - Waiho i ngā pito whakamutunga tirotiro hauora kia kore e tiakina
Ngā ngoikoretanga whirihoranga hē o te haumarutanga kapua i roto i te rokiroki me te hanganga
- S3 pakete me ngā whakaaetanga "pānui-iwi" me te "tuhi-iwi" rānei
- Ngā peere GCP, ngā putunga Azure rānei i whakaatuhia mā te IAM whirihora hē
- Terraform ngā kōnae kāore he here urunga, he whakamunatanga rānei
CI/CD pipeline ngā take i puta mai i te whirihoranga hē o te haumarutanga
- Jenkins rānei GitLab CI me te urunga ingoamuna kua whakahohea
- Ngā mea ngaro e rongoatia ana i roto i te tuhinga māmā pipeline configs
- Ngā pūrongo kapinga whakamātautau, ngā matawai waehere rānei e whakaatu ana i ngā ara ā-roto
Ngā tauira whirihoranga hē o te haumarutanga taupānga tukutuku noa
- Kua whakahohea te aratau patuiro i roto i pounamu, Django, Express rānei
- Ngā karere hapa kupu poto e whakaatu ana i ngā tohu puranga, i ngā taipitopito taiao rānei
- Ngā pane haumarutanga HTTP ngaro (
X-Content-Type-Options,Strict-Transport-Security, etc.)
Hei tāpiri, ehara ēnei i te hapa noa iho, engari he wāhi tomo matapae. Ka whakawhirinaki ngā kaiwhakaeke ki ngā matawai aunoa kia kitea tika ai ēnei hapa.
Ki te kore e taea te uru atu, ā, kāore i te tika te whirihoranga, he ngoikore.
Me pēhea te ārai i ngā ngoikoretanga whirihoranga hē o te haumarutanga i roto i te DevOps
ārai whirihoranga hē o te haumarutanga Ehara i te mea mō te tāpiri i ngā taputapu hou. Engari mō te whakarite i te whirihoranga haumaru hei taunoa i roto i ngā taiao katoa, mai i te whakawhanaketanga ki te whakaputa. Anei te mahi:
1. Ka Tautohe wawe a Harden
Tīmata ki ngā tautuhinga haumaru i roto i ō Dockerfiles, ngā tūtohi Helm, me ngā tuhinga Terraform. Kaua e whakaatu i ngā ratonga ki te 0.0.0.0 mēnā kāore e tino hiahiatia. Tangohia ngā tohu tuakiri tauira, ngā mea ngaro pupuri wāhi, me ngā ara whakamātautau i mua i te tuku waehere.
2. Te urunga ki te rāhui
Me whakatinana tonu te manatoko me te mana uru e hangai ana ki te tūranga (RBAC). Mena kei te whakamahi koe i tō taputapu CI, i tō kaiwhakahaere rānei dashboard kāore e hiahiatia kia tūtaki ki te ipurangi, kia whakawhāitihia te urunga mā ngā rārangi whakaae IP, VPN rānei.
3. Matawai Aunoa i ngā Kōnae Whirihoranga
Whakamahia ngā taputapu ka taea te tātari IaC - Hanganga hei Waehere, ngā tūtohi Helm, me ngā Dockerfiles i te wā pull requestsHe rite te hiranga o te tātaritanga tūmau o tō whirihoranga ki te matawai i tō waehere tono.
4. Whakahaerehia ngā mea ngaro me te haumaru
Penapenahia ngā taipitopito tuakiri ki roto i tētahi kaiwhakahaere huna, kaua ki roto i ō kōnae waehere, taiao rānei. Hei tāpiri, hurihia ngā mea ngaro i ia wā, me te arotake i ngā rangitaki urunga kia kitea ai te tukino.
5. Whakamanahia ki ngā Paearu
Whakamahia ngā paearu pēnei i CIS, NIST, me OpenSSF Ngā kāri kaute hei tirotiro i ō kaupapa me pipelines mō ngā hapa whirihoranga hē noa.
6. Aunoatia ki Guardrails
Kaua e whakawhirinaki ki ngā arotake ā-ringa, engari whakamanahia ngā whirihoranga haumaru mā te whakamahi i ngā pūnaha aunoa. CI/CD guardrailsHei tauira, ka rahua te hanga ina kore ngā rauemi kapua tūmatanui e tutuki i ō kaupapa here.
Ina he wāhanga o ngā mahi taunoa haumaru, te aunoatanga, me te whakamanatanga pipeline, ka tino heke te mōrearea o te whirihoranga hē, ā, kāore e hiahiatia ana e ngā kaiwhakawhanake te whakaroa i te mahi kia noho haumaru ai.
Whakamahia a Xygeni hei Ārai i te Whirihoranga Hē o te Haumarutanga CI/CD Pipelines
Ko te whirihoranga hē o te haumarutanga tētahi o ngā ngoikoretanga e tino kitea ana, e warewarehia ana, engari ka hurihia e Xygeni hei mea ka taea e koe te kite, te whakatika, me te ārai aunoa.
Anei te āwhina a Xygeni i ngā tīma DevOps ki te aukati i ngā whirihoranga hē i mua i te taenga ki te whakaputa:
1. IaC Security Matawai i te Wā Tūturu
Ngā matawai Xygeni ō kōnae Terraform, Helm, Kubernetes, me Docker i ia commit a pull request. Ka tohu i ngā whirihoranga mōrearea pēnei i:
- Ngā tauranga kua kitea, ngā herenga 0.0.0.0 rānei
- Te kore o ngā whakaaetanga e hangai ana ki te tūranga
- Ngaro ana te wehewehenga whatunga, te whakamunatanga rānei
2. CI/CD Guardrails hei Ārai i ngā Hanganga Whirihora Hē
Ki te koutou pipeline ka whakaatu i ngā mea ngaro, ka whakamahi i ngā tohu taunoa, ka waiho rānei i ngā kōnae nui kia tuwhera, ka taea e Xygeni te aukati aunoa i te hanganga. Māu e whakatakoto ngā ture, mā mātou e whakamana.
3. Te Kimi i te Hurihuri Whirihoranga
Ka aroturukihia e Xygeni ō taiao mō ngā huringa kāore i whakamanahia. Mēnā ka tūmatanui te peere rokiroki, ka whakahohea anō rānei te haki patuiro, ka mōhio koe i mua i te huri hei aituā.
4. Kaupapahere-hei-Waehere mō ngā Taunoa Haumaru
Hei tīmatanga, whakamahia a Xygeni guardrails hei tautuhi tika i te tikanga o te "haumaru mā te taunoa" mō tō rōpū. Nō reira, ka taea e koe te aukati i ngā hanumitanga mōrearea, te whakatūpato mō ngā takahi kaupapa here, me te pupuri i te tutuki i ngā whakaritenga, me te kore e tuhi i ngā tuhinga ritenga.
5. Whakaurunga Whakahaere Ngā Mea Ngaro
Hei tāpiritanga, ka kitea e Xygeni ngā mea ngaro kua whakapūmautia, ngā tohu e turuturu ana, ngā tohutoro haumaru kore rānei i roto i ō kōnae whirihoranga CI. Ka hono pai hoki ki a Vaults me KMS hei whakamana me te whakatika i ngā tohu kua kitea.
Ahakoa ngā mea katoa, me Xygeni, kāore koe e hiahia ki te whakawhirinaki ki te mahara, ki ngā rārangi arowhai rānei hei whakamana i ngā whirihoranga haumaru. Engari, ko te haumarutanga
Kua rite koe ki te aukati i ngā whirihoranga hē i te pūtake?
Whakamātauria a Xygeni mō te kore utu mō ngā rā 14 kia kite ai i te ngāwari o te aukati i ngā mea e ngaro ana i ētahi atu.
