He anga whakatauira mōrearea a STRIDE, i hangaia e Microsoft, e whakarōpū ana i ngā mōrearea haumarutanga ki ngā wāhanga e ono: Te Tinihanga, te Tampering, te Whakahē, te Whakaaturanga Mōhiohio, te Whakakore Ratonga, me te Whakanui Mana. Ka hoatu ki ngā kaiwhakawhanake he huarahi ka taea te pātai "he aha te mea ka hē i konei?" i ngā wā katoa o te huringa ora o te pūmanawa.
He aha me whakamahi ai ngā kaiwhakawhanake i te Tauira Riri STRIDE i roto i ngā Kaupapa Pūmanawa?
Mena kei te tuku waehere koe, kei te whakahaere pipelines, pā atu rānei CI/CD Ahakoa pēhea, me whakauru te whakatauira mōrearea STRIDE ki roto i tō kete taputapu. Ko te STRIDE he whakarāpopototanga mō te Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, me te Elevation of Privilege, arā, e ono ngā momo mōrearea haumarutanga me whai whakaaro ngā kaiwhakawhanake puta noa i te huringa ora o te pūmanawa.
I hangaia e Microsoft i ngā tau tōmua o te rautau 2000, tera pea te anga whakatauira mōrearea STRIDE e ahua tawhito ana. Engari ko tōna kaha kei roto i tōna ngāwari mutunga kore: ka āwhina i ngā tīma ki te pātai pūnaha, "He aha ngā mea ka hē i konei?" Ahakoa te nui o te whanaketanga o te tuku pūmanawa, me ngā hoahoa kapua-taketake, te whakapūtātanga ipu, me CI/CD pipelines, he mea nui tonu a STRIDE. He tino ōrite ki ngā hiahia o ngā DevSecOps hou mā te tuku i tētahi tikanga whai hua, ngāwari hoki mō ngā kaiwhakawhanake hei tautuhi me te aro atu ki ngā mōrearea haumarutanga.
Ehara tēnei i te tauira ariā e rāhuitia ana mō ngā arotake, ngā tirotiro rānei i muri i te matenga. Ko te tauira riri STRIDE tō mahere mō te kimi i ngā wāhi ngoikore i mua i te mahi a ngā kaiwhakaeke. Ahakoa kei te tuhi koe i tētahi tuhinga whakatinanatanga, kei te arotake i tētahi pull request, mā te hono atu rānei i ngā ratonga tuatoru, ka hurahia e STRIDE ngā koki ka whakamahia pea e ngā kaiwhakaeke.
Ko te tikanga o DevSecOps ko te hanga pūmanawa haumaru mai i te tīmatanga. Ehara a STRIDE i te mea hei whakaroa i a koe; engari hei whakaiti i ngā ohorere ā muri ake nei mā te tirotiro i ngā mea tika ināianei. Mā te whakamahi tonu i te anga whakatauira mōrearea STRIDE ka whakapakari i tō kaha ki te matapae me te whakatau wawe i ngā take.
Whakamārama Poto: Ngā Kāwai STRIDE Me Mārama e Ngā Kaiwhakawhanake
E ono ngā wāhanga o te tauira mōrearea STRIDE. E hono ana ia wāhanga ki ngā āhuatanga mamae noa o te pūmanawa me te hanganga.
S: Te Poihau tuakiri (Te Whakakatakata i a Koe) Te Tūponotanga: Ngā kaiwhakamahi, ngā ratonga rānei kāore i whakamanahia e whakaari ana i a rātou anō ehara i te tangata. Tauira: Ka whakaari tētahi kaiwhakahaere CI kua takahia hei kaiwhakatakoto pono, ā, ka panaia ngā huringa haumaru kore. CI/CD Horopaki: Ka whiwhi te kaiwhakaeke i te urunga ki tētahi kaihoko CI, ā, ka tīmata i ngā mahi e āhua ana nō tētahi mema pono o te tīma.
T: Miiri me ngā Raraunga, ngā Waehere rānei (Te Whakararuraru i ō Mea) Mōrearea: Kāore i kitea te whakarerekētanga o ngā waehere, ngā whirihoranga, ngā taonga rānei e ngā kaiwhakaeke. Tauira: Ka whakarerekēhia e te tuhinga tinihanga te ahua o te ipu i te wā o te tukanga hanga. CI/CD Horopaki: Ka whakarerekētia pukutia te taahiraa hanga hei whakatinana i tētahi whakaahua kua whakarerekētia mai i tētahi pūtake kāore i whakamanahia.
R: Te Whakahē (Kāore he Taunakitanga mō te Mea Nā Wai i Mahi) Mōrearea: Te korenga o te kawenga, te korenga rānei o te ara arotake. Tauira: Ka puta he hanumitanga me te kore e manatoko ko wai i whakaae, i tuhi rānei. CI/CD Horopaki: Ka oma ngā hanganga me ngā whakatinanatanga, ā, kāore e tuhia ko wai i tīmata, ā, he uaua ki te whai i ngā take.
I: Te Whakakitenga Mōhiohio (Ngā Mea Ngaro e turuturu ana) Mōrearea: Ngā raraunga tairongo e turuturu ana i roto i ngā rangitaki, i ngā hanganga, i ngā taonga tuku iho rānei. Tauira: Ngā mea ngaro i tāia ki ngā rangitaki i te wā i rahua ai te whakahaere i te tuhinga. CI/CD Horopaki: Ka huraina ngā taurangi taiao me ngā mea ngaro i roto i pipeline ngā rangitaki, ngā karere hapa rānei.
D: Te Whakakorenga i te Ratonga (Te Whakamate i ō Rauemi) Mōrearea: Kāore e wātea ana ngā tukanga, ngā ratonga rānei nā te ngoikore o te arorau, te tukino rānei. Tauira: Ka āraihia te rārangi CI e ngā takahuri mahi mutunga kore. CI/CD Horopaki: He whirihoranga hē pipeline ka pā pinepine rawa, ka pau katoa te kaha o te kaikawe e wātea ana.
E: Te Whakanui i te Mana (Te Whiwhi Uru Atu i te Mea e Whakaaetia ana) Mōrearea: Ngā kaiwhakamahi, ngā ratonga rānei e whiwhi ana i ngā whakaaetanga kāore i tika kia whiwhi rātou. Tauira: A pipeline ngā mahi e rere ana me te urunga taumata-whakaputa kāore i tika kia whai. CI/CD Horopaki: Ka whakahaerehia te mahi a te kaituku me ngā whakaaetanga teitei ake nā te mea he hē te whirihoranga o ngā mana urunga.
Te Whakatauira Riri a STRIDE i roto i te DevOps: Ripanga Tohutoro Tere
| kāwai | Mōrearea DevOps | Tauira Ao-Tuturu |
|---|---|---|
| Te Poihau | Te whakataruna i ngā kaiwhakamahi, i ngā ratonga rānei | Kei te tinihanga te kaiwhakahaere CI i tētahi kaiwhakatakoto whakaputa |
| Miiri | Ngā huringa waehere, whirihoranga rānei kāore i whakamanahia | He tuhinga kino kei roto i te whakatinanatanga pipeline |
| Te Whakahē | Kāore he rangitaki, he ara arotake rānei mō ngā mahi | Hanumi ki te kore commit te waitohu, te ara tirotiro rānei |
| Nga korero Panui | Te turuturu o ngā mea ngaro i roto i ngā poro rākau, i ngā hanganga rānei | Ngā tohu kua tāia ki ngā rangitaki CI |
| Tuhinga o te Ratonga | Te paunga o ngā rauemi, te aukati rānei i te rere o te mahi | Whanui pipeline e raru ana ngā kaiwhai i ngā mahi |
| Te Whakanui i te Mana | Ngā whakaaetanga urunga nui rawa atu mō ngā kaiwhakamahi, ngā tukanga rānei | Dev pipeline tohu me te urunga hua |
Te whakamahi i a STRIDE ki ngā Rerenga Mahi DevOps
Te tinihanga i roto i te DevOps CI/CD Pipelines
Ka whakaata ngā tukanga kore whakamana i te pono pipeline ngā wāhanga. Ngā Wāhi Whakatā: Ka panaia e ngā pūkete kaituku kua takahia te waehere kino i raro i tētahi ingoa kaiwhakamahi tika. Ngā Whakawhirinakitanga: Ka whakamahia e ngā mōkihi kino ngā ingoa e rite ana ki ngā whare pukapuka rongonui (typosquatting) kia puta ai he pono.
Te whakararuraru i roto i te DevOps CI/CD Pipelines
Ka whakawhitihia ngā ipu e te tuhinga whakatinanatanga kua whakarerekētia, ka whakaurua rānei ngā whakahau tinihanga. Ngā Repo: Ka panaia e te kaha commitarotake waehere karo, te werohanga i ngā tatau o muri. Ngā whakawhirinakitanga: Ka whakauruhia e ngā whakahoutanga kino ki ngā whare pukapuka he mahi huna.
Te Whakahē i roto i te DevOps CI/CD Pipelines
Ka tīmatahia ngā whakatinanatanga me te kore e tuhi ko wai i tīmata. Ngā wā okiokinga: Te korenga o commit Kāore e taea te manatoko i te pūtake o ngā huringa nā te hainatanga. Ngā Whakawhirinakitanga: Ka toia ngā huringa mōkihi me te kore he rārangi huringa, he waitohu rānei ka taea te manatoko.
Te Whakakitenga Mōhiohio i roto i te DevOps CI/CD Pipelines
Ngā mea ngaro i huraina i roto i te putanga takiuru nā te mahi patuiro uaua. Ngā okiokinga: ngā kōnae .env, ngā mea ngaro whirihoranga rānei i tūpono kore commiti whakaritea ki te mana pūtake. Ngā Whakawhirinakitanga: Ka whakaatuhia ngā kōnae tairongo e ngā mōkihi he whakaaetanga whirihora-hē.
Te Whakakorenga Ratonga i roto i te DevOps CI/CD Pipelines
Ngā kaiwhakahaere kua utaina rawatia nā te mutunga kore o ngā takahuri whakaoho. Ngā wā okiokinga: Ngā takoha kino me ngā kōnae tino nui, ngā whakaoho hanga uaua rānei. Ngā whakawhirinakitanga: Ka pau ngā rauemi pūnaha nui rawa atu i ngā whare pukapuka auau, kāore rānei i te tino arotauhia.
Te Whakanuia o te Mana i roto i te DevOps CI/CD Pipelines
Mā ngā tohu tiritahi ka taea e ngā mahi ehara i te kaiwhakahaere te mahi i ngā mahi kaiwhakahaere. hooks kāore rānei e hiahiatia ana ngā mana whakahaere mō ngā tuhinga aunoa. Ngā Whakawhirinakitanga: Ka whakahaerehia e ngā whare pukapuka tuatoru ngā tuhinga tāuta me te urunga pakiaka i te wā hanga.
Ngā Tauira ā-Ringine: I mua me muri i te Whakamahinga o STRIDE
Tauira Whakahē: Kāore i Hainatia Commits
Ngā mea e whakatikatikaina ana: te aukati i ngā hanumitanga kāore anō kia arotakehia mā te manatoko commit waitohu.
// Anyone can commit and push, no verification of who or with what identity
git commit -m "update deploy config"
git push origin main
// No branch protection: unsigned, unverified commits merge freely
// .github/settings.yml (missing or absent)Kāore he waitohu, kāore he arotake e hiahiatia ana, ā, kāore he huarahi hei whakaatu i muri mai ko wai te kaituhi o tēnei huringa, i whakarerekētia rānei i te wā e tukuna ana.
// Commit signing enabled and enforced locally
git config commit.gpgsign true
git commit -S -m "update deploy config"
git push origin main
// Branch protection requires signed commits before merge
// .github/settings.yml
branches:
- name: main
protection:
required_signatures: true
required_pull_request_reviews:
required_approving_review_count: 1Inaianei ia commit on main he waitohu manatoko kei a ia, ā, kāore anō kia hainatia commitka whakakahoretia ngā kaupapa i te taumata peka, ka kati ai te āputa whakahē.
Tauira Whakakitenga Mōhiohio: Ngā Mea Ngaro i roto i ngā Rangitaki
Ngā mea e whakatikatikaina ana: te aukati i te turuturu ngaro mā te karo i te tā tika o ngā taurangi taiao tairongo.
// CI job prints the secret directly to logs for "debugging"
steps:
- name: Deploy
run: |
echo "Using API key: $API_KEY"
curl -H "Authorization: Bearer $API_KEY" https://api.example.com/deployKi te kore e angitu tēnei mahi, ki te kore rānei he urunga takiuru a tētahi hoa mahi, $API_KEY kei te noho inaianei i roto i te tuhinga māmā i roto i te hītori CI, e kitea ana e te hunga katoa he urunga pānui ki te pipeline.
// Secret is referenced, never printed, and CI masks it by default
steps:
- name: Deploy
run: |
curl -H "Authorization: Bearer ${{ secrets.API_KEY }}" https://api.example.com/deploy
env:
API_KEY: ${{ secrets.API_KEY }}Ka tangohia te kī mai i te toa huna CI i te wā e oma ana, kāore e whakahokia ki te stdout, ā, ka huna aunoatia e te nuinga o ngā tūāpapa CI i roto i ngā rangitaki ahakoa ka puta noa mai i te putanga.
Me pēhea te whakamahi a ngā kaiwhakawhanake i te STRIDE me te kore he papamuri haumarutanga
Mena kei te mahi koe i roto i te DevSecOps, whakatauira riri me noho hei āhua tūturu. Mā te whakamahi i te whakatauira mōrearea STRIDE hei aratohu i te wā o ngā arotake me te whakatū aunoatanga, ka taea e koe te matapae i ngā take i mua i te taenga mai ki te whakaputa.
Kāore koe e hiahia kia noho hei tohunga haumarutanga. Pātai noa i ngā pātai e pā ana ki a STRIDE i a koe e mahi ana i ngā mahi o ia rā:
I te wā arotake waehere:
- Ka taea e tetahi te tinihanga i tētahi tuakiri i konei?
- Tērā pea ka taea te whakarerekē i tēnei?
I roto i CI/CD arotake:
- Kei te hurahia ngā mea ngaro i ngā wāhi katoa?
- Ka taea te whai i ia mahi?
I te wā o te tātari whakawhirinakitanga:
- Kei te tangohia mai e tātou ngā kōrero mai i ngā puna kua manatokohia?
- Ka taea e tēnei whakawhirinakitanga te whakanui ake i ōna whakaaetanga?
Kātahi ka aunoa i ngā mea ka taea e koe:
- Whakamahia te waitohu commits
- Whakatinanahia te hainatanga o ngā taonga tuku iho
- Whakatūria te matawai i ngā mea ngaro
- Aroturuki i ngā whakahōutanga whakawhirinakitanga
Mā ēnei mahi iti nei ka taea te whakahaere i te tauira riri STRIDE me te kore he utu tāpiri.
I mua i te whakamahi i te whakatauira mōrearea STRIDE i ngā wā katoa, he mea āwhina kia mōhio koe ki te wā me te wāhi e uru ai ki roto i tō rerenga mahi.
Te Aratohu Tino Pai mō te Tiaki i tō CI/CD Pipeline
Akohia me pēhea te tautuhi, te ārai, me te urupare ki CI/CD ngā mōrearea haumarutanga.
Te Whakauru i a STRIDE ki roto i te Tukanga Whakatauira Riri
Ka uru mārire a STRIDE ki te huringa whanaketanga hei arotahi māmā, ka taea te whakahoki anō mō te tautuhi wawe i ngā tūmomo mōrearea haumarutanga. He tino whai hua ina whakamahia tonutia i ngā wāhanga matua:
- I te wā o te Arotakenga WaeherePātai atu ki ngā pātai pēnei i te "Ka taea te tinihanga, te whakarerekē rānei i tēnei?" me te "He ara arotake mō tēnei huringa?"
- I te Whirihoranga CI/CD PipelinesArotakehia mēnā ka hurahia ngā mea ngaro, mēnā ka taea te whai i ngā mahi, mēnā rānei he whānui rawa ngā whānuitanga o ngā whakaaetanga.
- In Whakahaere TiakitangaTirohia mēnā kua manatokohia, kua hainatia, ā, kua kore he tuhinga tāuta mōrearea, he urunga nui rawa rānei ngā mōkihi a te hunga tuatoru.
- I te wā e whakamahere ana i ngā āhuatanga hou, i ngā ratonga hou rānei, whakamahia te anga whakatauira mōrearea STRIDE hei rārangi arowhai hei wānanga i ngā mea ka hē pea mai i ia kāwai mōrearea.
Nā tēnei ka waiho te whakatauira i ngā tūmomo mōrearea STRIDE hei wāhanga whai hua, hei wāhanga mahi hoki o ō mahi haumarutanga, ehara i te tukanga taumaha, engari he whakaaro kua whakauruhia ki roto i ō tukanga whanaketanga me DevOps o ia rā.
Te Mahere a Xygeni ki ia Kāwai STRIDE
Kāore a Xygeni e tohu noa i ngā mōrearea, engari ka pā ki aua mōrearea puta noa i te ao. pipeline.
Tenei te pehea Xygeni's mahere kimi ki ia kāwai STRIDE i roto i te tūturu pipeline:
- Tuumomo: Ngā haki kitenga rerekētanga a Xygeni CI/CD te whakamahi hē i ngā tohu me ngā mahi e whakaari ana i tētahi tuakiri pono, e whakatūpato ana i te tīma kia taea ai te huri i ngā tohu i mua i te whakahaerenga o te mahi.
- Te Whakararuraru: Mā te kitenga whakarerekētanga waehere a Xygeni ka tautuhia ngā huringa kore whakamanatanga ki te whakatinanatanga YAML, ngā kōnae hanga, me IaC ngā tauira, ā, ka whakamōhio atu ki te tīma me te whakaritenga motuhake commit me ngā kōnae e pāngia ana.
- Te Whakahē: Kāore anō kia hainatia ngā haki Xygeni commitme te kaha ki te pana i te parenga peka, ka hoatu ki ngā tīma te tirohanga ki te whakamana i te hainatanga-commit ngā kaupapa here i mua i te whakaurunga.
- Te Whakakitenga Mōhiohio: Ka kitea e te matawai ngaro a Xygeni ngā tohu tuakiri kua kitea i roto i ngā rangitaki, waehere, me te hītori CI, ka whakamanahia mēnā kei te hohe tonu, ā, ka whakahohe i te whakakorenga aunoa mō ngā momo ngaro e tautokona ana.
- Te Whakakorenga o te Ratonga: Ka kitea te rerekētanga o Xygeni i ngā mea rerekē CI/CD ngā mahi, pērā i ngā roanga hanga rerekē, te auau mahi rānei, ā, ka whakatūpato i te tīma i te wā tūturu.
- Te Whakanuia o te Mana: Mā te aroturuki iti rawa o Xygeni ka tautuhia ngā kaiwhakamahi tino whai mana, kāore rānei i te mahi, ā, CI/CD ngā tohu, ā, ka whakaatuhia ki runga hei whakatikatika mā te Health Check āhuatanga.
Whakamutunga: Mā te STRIDE ka whai hua te whakatauira riri mō ngā kaiwhakawhanake
Mā te anga whakatauira mōrearea STRIDE ka hoatu he tirohanga mārama, ka taea te mahi ki ngā kaiwhakawhanake hei tirotiro wawe i ngā mōrearea. Kaua e whakaaro nui rawa. Pātai noa, "He aha ngā mea ka hē i konei?" mō ia wāhanga o tō waehere, repo, pipeline, te whakawhirinakitanga rānei.
Mā te whakatauira mōrearea a STRIDE ka āwhina koe ki te whakatika i ngā hapa haumarutanga i mua i te tīmatanga. Ā, mā ngā taputapu pēnei i a Xygeni ka āwhina koe ki te whakahaere aunoa i tēnei me te kore e tāpiri i te waku.
Whakamahia te tauira mōrearea STRIDE hei wāhanga o tō tuhi, arotake, me te tuku waehere. Mā te whakatauira mōrearea STRIDE tonu ka āwhina i a koe kia mau tonu tō pipelinehe haumaru, ahakoa kei te tipu haere, kei te whanake haere tonu.
FAQ
He aha te tikanga o te kupu STRIDE?
Te Tinihanga, te Tapeke, te Whakahē, te Whakakitenga Mōhiohio, te Whakakore Ratonga, me te Whakanui Mana, e ono ngā wāhanga i hangaia e Microsoft hei whakarite i ngā tūmomo riri haumarutanga.
Me whai mātauranga haumarutanga ahau hei whakamahi i a STRIDE?
Kāo. He rārangi arowhai pātai a STRIDE, pērā i te "ka taea tēnei te tinihanga?" me te "ka taea te whai i tēnei?", ka taea e ngā kaiwhakawhanake te whakamahi i te wā arotake waehere noa, me te CI/CD whirihora.
Kei te whai tikanga tonu a STRIDE mō ngā kaiwhakamahi kapua taketake me CI/CD taiao?
Āe. Ahakoa i hangaia i mua i te whakaurunga ipu me CI/CD i standard, e ono ngā kāwai o STRIDE e hono tika ana ki ngā mea hou pipeline ngā mōrearea pēnei i te whakamahi hē i te tohu, te kore hainatanga commits, me te huraina o ngā mea ngaro.
