I te mutunga o te tau 2023, kua mura te ao o te haumarutanga tukutuku i ngā pūrongo me ngā tātaritanga. I roto i ēnei, ko te Arotake i te Tau Haumarutanga Ipurangi a te NSA 2023 kua arohia. Ko te whāinga a Xygeni, i tēnei tau pōrearea, he whai wāhi ki te mārama me te whakaiti i ngā tūmomo riri ki te mekameka tuku pūmanawa. I tēnei wā e tino uaua ana te pūmanawa, kua eke tō tātou whakawhirinaki ki ngā wāhanga tuwhera-pūtake me te whanaketanga o DevSecOps me ngā huarahi kapua-taketake ki ngā taumata hou. He tirohanga poto tēnei ki roto Te pūrongo a Xygeni e whakarato ana i ngā māramatanga ki ngā wero matua e pā ana ki software supply chain security i te tau 2023, ā, e tuku ana hoki i ngā rautaki hei whakatika i aua raruraru i te tau 2024.
Ripanga o Ihirangi
Te Tukutuku Matatini o Software Supply Chain Security
I roto i te āhua o nāianei o SSCS, kei te nui haere ngā tūmomo riri ipurangi, ā, he āwangawanga nui tēnei mō ngā kamupene me ngā tāngata takitahi. Nā te pikinga ake o te mahi mamao me te pikinga ake o te whakawhirinaki ki ngā ratonga kapua kua whānui ake te mata o te whakaeke, ā, kua nui ake te wero o te tiaki i te mekameka tuku pūmanawa. Kei te āta puta ake te mōhiotanga kua noho te mekameka tuku hei huarahi whakaeke āta whakaarohia ki te umanga pūmanawa. Ka ara ake ngā pātai: Me pēhea tā tātou tiaki i tēnei tukutuku uaua? Ka taea e tātou te whakawhirinaki ki ngā pūmanawa mai i ngā hapori tuwhera me ngā kaiwhakarato arumoni? Me pēhea e taea ai e ngā whakahaere te whakapūmau i te whakapono ki ā rātou kaihoko pūmanawa mō te kore o ngā ngoikoretanga, o ngā pūmanawa kino rānei?
Ngā mea ka hurahia e te Pūrongo a Xygeni
Ko te whāinga o te pūrongo a Xygeni he whakamārama i ngā kaupapa me ngā ia o te ao i tautuhi i software supply chain security i te tau 2023, ā, e whakaatu ana i tētahi tirohanga tuatahi ki ngā mea ka puta mai i te tau 2024. Ka kapi i te pūrongo:
Ngā Kaupapa Matua: "Nā ngā Tau"
I tapaina ko te tau o 'ngā ahi ngahere matihiko"I te tau 2023, i kitea ngā aituā rongonui, tae atu ki ngā mea i pā ki a PyTorch, 3CX, me MOVEit Transfer. Ko te mea pōuri koia tēnei 82% o nga whakahaere kei te ngoikore rātou i ngā whakaekenga mekameka tuku pūmanawa i tēnei wā, me te pikinga toharite o ngā wāhanga ngoikore i roto i te mekameka tuku mā te neke atu i te 50% ia tau. E ai ki a NTT Ltd ko te rāngai hangarau te ahumahi e tino arohia ana, e 28% o ngā whakaekenga mekameka tuku katoa.
Pūmanawa pūtake tuwhera, kei roto ko 70% ki te 90% o ngā puranga tono o nāianei, e pāngia ana e te pikinga ake o ngā mōkihi kino i roto i ngā rēhita tūmatanui – he 245,032 ngā tauira whakamiharo, he ruarua te nui ake i ngā tau o mua.
Te Whenua Whakaeke
I te tau 2023, i piki haere ngā whakaekenga ipurangi, me te Te Tari Haumarutanga Ipurangi o te EU I tuhia e 2,580 ngā aituā haumarutanga, 220 o ēnei i aro nui ki ngā whenua mema maha. Ko ngā whakaekenga ransomware me te whakakorenga-ratonga te nuinga, engari i kitea anō hoki ngā whakaekenga arotau ki te mekameka tuku pūmanawa. He mea nui, i uru atu ngā karetao kōrerorero AI ki te ao o ngā tūmomo riri haumarutanga tukutuku, me te whakauru mai i ngā āwangawanga mō ngā 'rūpahu iti te utu' me te whakahaere mōhiohio e whakahohea ana e te AI.
Ngā Tikanga Whakaeke i te tau 2023
I haere tonu ngā kaiwhakaeke ki te whakamahi i ngā tikanga mōhiotia pēnei i te spear phishing me te social engineering, ngā tohu tuakiri tahae, me ngā whakaeke whakawhirinakitanga pēnei i ngā mōkihi typosquat. Heoi, i te tau 2023 i kitea te pikinga ake o ngā tikanga matatau, tae atu ki hiahia (Hītinihanga Reo) mā te whakamahi i ngā karere whakaata reo i hangaia e te AI. Ko ngā mōkihi kino i whakatinanahia i roto i ngā rēhita tūmatanui i eke ki te 245,032 ngā tauira whakamataku, e whakaatu ana i te hiahia mō ngā mahi ārai pakari.
Ngā Kaiwhakaari Tūmatanui
I awehia ngā mahi ipurangi e ngā mahi tōrangapū whenua, me te whai wāhi atu a ngā APT tautokona e te kāwanatanga ki ngā kōrero teka, ki ngā mahi tutei, me te mahi whakararuraru. I noho te pakanga o Ukraine hei kaupapa matua, e whakaatu ana i ngā mahi ipurangi a ngā kaiwhakaari o Ruhia, o Īrāna, me Kōrea-ki-te-Raki. I whakapūmau a Haina i tōna tūranga hei Mana Ipurangi o te ao, i te mea kei te whanake tonu te hara ipurangi, hei tauira mā te Evasive Panda a Haina e aro ana ki tētahi NGO o te ao.
I te tahuritanga o tā tātou arotahi ki ngā pakanga o nā tata nei, ko te pakanga ipurangi i waenganui i a Hamas me Iharaira i uru atu ki ngā whakaekenga DDoS tauutuutu. E hono ana ētahi kaitātari i a Hamas ki ngā mahi riri a Iran. Ko te APT Agrius e hono ana ki Iran, e mōhiotia ana ko "Agonizing Serpens", e mōhiotia whānuitia ana mō āna kaihoroi whakangaro, kua aro nui ki ngā whakahaere o Iharaira puta noa i ngā rāngai me ngā whenua. I te tau 2023, i aro nui ngā mahi a Agrius ki ngā rāngai mātauranga me te hangarau i Iharaira.
Te Pānga o ngā Whakaeke
Ko te pānga matihiko o ngā whakaeke ipurangi, pērā i te pakaru o ngā pūnaha, te pirau raraunga, me ngā urutomo, i nui ake i ngā pānga pūtea me te pāpori. Te rangahau a Splunk i whakanuia te nui o te wā me ngā rauemi i pau ki te horoi, ā, 4% anake o ngā kaiwhakautu i kī kāore he hua nui.
Whakarāpopototanga o ngā Whakaekenga e tika ana i te tau 2023
I kitea i te tau ngā whakaekenga tauira, tae atu ki te PyTorch nightly InfoStealer, te aituā CircleCI, te whakaekenga maha-taahiraa 3CX, te pakaru raraunga MOVEit Transfer, te whakatārewatanga wā PyPI, te NPM Manifest Confusion, te whakaekenga JumpCloud, me te kaupapa VMConnect. I whakaatuhia e ia aituā te āhua kanorau me te whanaketanga o ngā whakaeke SSC.
Tuhinga o mua Standardngā Ture me ngā Ture
Kei te hangaia te anga ture mō te SSC. Nā te rerekētanga o ngā kaha puta noa i ngā rohe, te āhua nei ko te US te anga tino pakari, engari kei te whakaroa te Kotahitanga o Ūropi. Ko te whakaputanga o te Rautaki Haumarutanga Ipurangi ā-Motu me te Mahere Ara Haumarutanga Pūmanawa Pūtake Tuwhera ko ngā kaupapa nui i te US. I roto i te EU i tae te Cyber Resilience Act ki tētahi whakaaetanga tōrangapū, engari ko te nuinga o ngā whakahaere i mahi i runga i te aratohu NIS2 me te Digital Operational Resilience Act (DORA).
Ko te huihuinga kotahi pea te mea nui rawa atu o te ao ko te aratohu tahi Te Huri i te Taurite o te Mōrearea Haumarutanga Ipurangi: Ngā Mātāpono me ngā Huarahi mō te Pūmanawa Haumarutanga mā te Hoahoa arahina e CISA, i uru atu hoki ki te tini o ngā mana whakahaere haumarutanga ipurangi puta noa i te ao.
He tirohanga ki te tau 2024
E whakaatu ana te pūrongo i ētahi matapae: I te tau 2025, ka pāngia te 45% o ngā whakahaere puta noa i te ao e te whakaekenga SSC kotahi pea. Ka kite tātou i ngā rōpū taihara kua whakaritea e uru ana ki te hara ipurangi, me te whakamahi i ngā tuku Hara Ipurangi-hei-Ratonga kua pakeke ake. Mā ngā ture e whai mana ana i roto i te tau ka whakapai ake i te māramatanga o ngā aituā haumarutanga, me te whakaatu i ngā taipitopito whakaeke me ngā akoranga kua akohia. Ka whakaatuhia e te inihua mōrearea ipurangi ngā here me ngā taikaha. Ā, ka hangai ngā whanaketanga hangarau ki te haumarutanga-ā-hoahoa ia au, me te nui ake o te kawenga i te taha o ngā kaihanga pūmanawa.
I kukume te ngaru AI i te tini o ngā kaihoko haumarutanga i te tau 2023 ki te tāpiri i ētahi "pā AI" ki ā rātou hua. Ahakoa rā, kua rite te AI ki te whai wāhi nui ki te heke mai o software supply chain securityKa nui ake te tūranga o te AI i roto i ngā wāhanga pēnei i te mōhiotanga mōrearea me te aromatawai mōrearea, te kimi i ngā āhuatanga rerekē i roto i ngā putunga waehere, te aromatawai ngoikoretanga me te whakatau kaupapa matua, me hītinihanga whakaeke kitea, engari ko te nuinga o te wā he mahi whakaora atamai me te aunoatanga o te arotake waehere.
Engari i tīmata ngā kaiwhakaari kino ki te whakamahi i te AI hei patu, ā, ka kite tātou i ngā tikanga hou pēnei i te tirotiro a te AI, te tao tino whakapono. hītinihanga, ngā taputapu hangarau mohio mō te jailbreaking, ngā ratonga whakaoti CAPTCHA rānei.
Opaniraa
I a Xygeni e whakarite ana ki te hura i tana pūrongo whānui mō te āhua o software supply chain security I te tau 2023, ka kitea ngā wero me ngā tūmomo mōrearea e pā ana ki te umanga. Ko te mekameka tuku pūmanawa i whakaarohia i mua he mahi huna, kua puta hei whāinga matua mā ngā hoariri ipurangi. Ko te urupare a te umanga ki ēnei wero ka hanga i te huarahi o te haumarutanga pūmanawa i ngā tau e haere ake nei. Me tatari mai mō te pūrongo katoa i a mātou e ruku ana ki ngā taipitopito me te whakarato i ngā māramatanga hei āwhina i te whakatere i te whenua uaua o software supply chain security.
