Te Putanga o te Motuhēhēnga Pakaru i roto i ngā Taupānga Tuturu
Ehara i te mea he raruraru ariā noa iho te motuhēhēnga pakaru; he mangere taumata-waehere e arahi ana ki ngā takahi o te ao tūturu. He maha ngā wā ka pekehia e ngā kaiwhakawhanake te motuhēhēnga maha-tauwehe (MFA), ka whakamahia anō ngā tohu puta noa i ngā wātū, ka whakatinana rānei login ngā puka me te kore e whakawhāiti, e whakawhāiti rānei i te tere. Ka noho ēnei āputa hei whāinga matua mō te kaha nanakia me ngā whakaeke whakakī tohu, ka whakaatu i ngā ngoikoretanga manatoko nui. Whakaarohia a login he rerenga e tirotiro ana i te ingoa kaiwhakamahi me te kupuhipa tika anake. Mena kāore te MFA e whakatinanahia, ā, kāore he herenga reiti, ka taea e ngā kaiwhakaeke te whakamahi i ngā putunga tohu hei whiwhi urunga kore mana. Ko te mea kino rawa atu: ka rongoa haumaru ngā kaiwhakawhanake i ngā tohu wātū, kāore rānei i te hurihuri i muri i te login Tukua ngā kaiwhakaeke kia tākaro anō i te tohu kotahi mō ake tonu atu.
Tauira mahi:
⚠️ He tauira mātauranga, kaua e whakamahia i roto i te mahi whakaputa
Ki te kore he paunga o te tohu, he herenga whānuitanga rānei, he kuaha tuwhera tēnei mō te tahae mena ka āraia. Ko te whakahaere wātū ngoikore pēnei ka arahi tika ki te pakaru o te manatoko.
Te manatoko pakaru = te takahi katoa o te pūnaha. Kia takiuru te kaiwhakaeke, ka whakamahia rātou e te taupānga hei kaiwhakamahi tika, kāore he pātai.
Ngā Rahunga Whakahaere Wātū e Ārahi Ana ki te Tahaetanga Pūkete
Ko ngā raruraru whakahaere wātū te wāhi e mate ai te manatoko pakaru. Ko ngā hapa noa ko:
- Ngā wātū pumau, kāore he paunga
- Kāore he hurihanga tohu i muri i te login/takiuru
- Ngā ID wātū matapae
tauira:
⚠️ He tauira mātauranga, kaua e whakamahia i roto i te mahi whakaputa
Mā tēnei tauira ka māmā ake te matapae a ngā kaiwhakaeke i ngā tohu wātū me te tahae i ngā wātū. Ka puta he ngoikoretanga nui o te manatoko ina ngoikore te whakahaere wātū.
Tētahi atu hapa matarohia: te wareware ki te whakatakoto i te HttpAnake or haumaru haki i runga i ngā pihikete. Ko te tikanga ka taea e ngā tuhinga taha-kiritaki (hei tauira, mā XSS) te uru atu ki ngā tohu wātū, ka taea rānei te tuku tohu mā te HTTP.
I tēnei, ahakoa he taumata iti Ngā ngoikoretanga o te XSS ka huri hei huarahi tahae pūkete. Mai i reira, ko te whakanui ake i te mana he mea noa iho o te whakamahi i ngā tūranga ā-roto. Mā ngā mahi whakahaere wātū pai ake ka ārai pea i tēnei.
Haumarutanga OAuth me te Tūkino Whakawhirinaki i Whirihorahia Hē
OAuth He taputapu kaha, engari he wāhi hoki e kitea ai ngā ngoikoretanga manatoko. He maha ngā kaiwhakawhanake e tārua-whakapiri ana i ngā whakaurunga OAuth me te kore e manatoko me pēhea te whakahaere i te whakamana tohu, te tuku rānei i ngā URI.
Ngā raruraru tūturu:
- Ngā URI tukunga kore haumaru, kore rānei he kāri mohoao (tuku_uri=*)
- Kei te ngaro kāwanatanga tawhā (pūtau CSRF)
- Te whakaae i ngā tohu me te kore tirotiro Ka rongo ahau (te hunga whakarongo) rānei exp (paunga)
tauira:
⚠️ Tauira kore haumaru, kaua e whakamahia me te kore he whakamana
Mā tēnei ka whakaaetia ngā tohu rūpahu, ngā tohu tāruarua rānei puta noa i ngā ratonga. Ka taea e ngā kaiwhakaeke te whakaari i a rātou anō hei kaiwhakamahi, te tinihanga rānei i tō pito o muri kia whakaaetia he urunga kore mana. He ngoikoretanga manatoko nui ēnei e ahu mai ana i te haumarutanga oauth kino.cisngota.
Kāore he kōwhiringa mō te haumarutanga OAuth. Ko te tikanga o te OAuth pakaru ko te pakaru o ngā rohe whakawhirinaki, ā, ko te tikanga o tēnā ko te pakaru o te manatoko me te takahi i te tuakiri.
CI/CD Ngā Tūponotanga: Te Motuhēhēnga Pakaru i roto i Pipelinengā API me ngā
Kāore ngā ngoikoretanga motuhēhēnga e mutu i te pito mua. He maha DevSecOps pipelines Whakamahia ngā API ā-roto me ngā pūkete ratonga me te iti o ngā tirotiro whakamana. Ko ngā tohu tuakiri kua whakapūmautia, ngā kī API ngoikore, ngā tohu rānei e whakamahia anōtia ana puta noa i ngā wāhanga he mata whakaeke tūturu katoa i puta mai i te motuhēhēnga pakaru.
tauira:
⚠️ He tauira kore haumaru, kaua e whakamahia i roto i te mahi whakaputa
Mena ka turuturu tēnei tohu (hei tauira, mā roto i ngā rangitaki CI, i tētahi Git rānei commit), ka taea e te tangata te whakaoho i ngā whakatinanatanga, te uru atu rānei ki ngā rauemi ā-roto. Waihoki, he maha ngā API e peke ana i te paunga o te wātū, kāore rānei e huri i ngā tohu ratonga, ā, ka roa te mau o ngā whakaeke, ka uaua hoki te kite. Te whakahaere wātū kino i roto CI/CD he rite ki ngā ngoikoretanga motuhēhēnga teitei ake.
Te manatoko pakaru i roto i te CI/CD = te mana whakahaere katoa o ngā hanganga.
Te Whakapūmau i te Arorau Motuhēhēnga puta noa i te Pūranga
Ko te whakapūmau i te manatoko me mātua aro nui ki te whakawhanake i ngā mea katoa puta noa i ia paparanga:
- Whakaūtia te MFA mā te taunoa, ahakoa mō ngā taputapu ā-roto
- Whakamahia ngā tohu wātū kaha, hurihuri
- whakaturia HttpAnake, haumaru, a SamePae=Pākaha i runga i ngā pihikete whakamana katoa
- Whakamanahia ngā tohu OAuth (Ka rongo ahau, exp, Tuhinga)
- Whakakorehia ngā URI tukunga kāri-māori
- Takiuru me te aroturuki i ngā mea katoa login ka rere
- Whakamātautau aunoa mō te whakahaere wātū me ngā hapa whakamana i te wā CI
Mahi CI/CD pipeline taahiraa:
Ka tīmata te manatoko pakaru me ngā whakaaro ngoikore i roto i te waehere me te whirihoranga. Ko te whakahaere wātū pakari, ko ngā arowhai haumarutanga OAuth tino pakari, me te whakapakari i ngā ngoikoretanga manatoko i ia taahiraa, koinei ngā mea e aukati ana i ngā kaiwhakaeke ki te tomo ki roto i tō pūnaha.
Nga taputapu penei Xygeni āwhina ki te whakamana i te arorau tuakiri, te tohu i te manatoko pakaru, te whakamana i te whakapakeketanga o te wātū, me te tiaki i a DevSecOps pipelinei mua i te taenga atu o ngā kaiwhakaeke ki te mahi whakaputa.
Te Motuhēhēnga Pakaru = Te Whakakorenga Pūnaha Katoa
Ehara te motuhēhēnga pakaru i te hapa iti. Ko te kuaha tēnei ki te takahi katoa o te pūnaha. Kotahi te mea ngoikore login Mā te pūwāhi mutunga, te pihikete wātū ngoikore kotahi, te tukunga OAuth kua whirihorahia hē rānei ka taea te tuku i tō pūhara katoa ki tētahi kaiwhakaeke.
Kia mahara:
- No HttpAnake or haumaru haki? Te mōrearea o te tahae wātū.
- Tohu OAuth kāore he Ka rongo ahau or exp ngā haki? Te mōrearea o te whakamahinga anō o ngā tohu.
- Ngā tohu kua whakapūmautia i roto i pipelines? CI/CD tangohanga.
Take-iti: Te Tahae Pūkete
I whakamahia e te tīma whakawhanake he ID wātū tūmau mō te kaiwhakahaere logini roto i tētahi taiao whakamātautau. I matawaihia e te kaiwhakaeke ngā tauira wātū, ā, i takiuru hei kaiwhakahaere, i uru atu ki ngā raraunga kiritaki, i whakaoho i ngā whakatinanatanga whakamātautau, ā, i te mutunga ka huri ki te prod.
Ehara tēnei i te taumanutia matatau. He motuhēhēnga pakaru, he ngoikore te whakahaere wātū, me te haumarutanga oauth ngoikore, ā, i hua ake ai ngā ngoikoretanga motuhēhēnga i taea te ārai.
Tiakina tō pūnaha whakamana me te mea e whakawhirinaki ana tō taupānga ki a ia, nā te mea e whakawhirinaki ana ia. Kaua e tatari kia roa rawa. Tukua a Xygeni kia āwhina i te whakatinana i ngā mahi pai rawa atu mō te whakamana me te tiaki i ō pipelinemai i te manatoko o te ao tūturu ngā whakaraerae.
