Kei te piki haere te horapa o ngā whakaekenga mekameka tuku pūmanawa, ā, kei te tino kino haere hoki. Hei tauira, Gartner e matapaetia ana ka pāngia te 45% o ngā pakihi katoa e te takahi ture i te tau 2025. Hei tāpiri, Nga Mahi Haumaru Cybersecurity e whakaatu ana i te kaha o tēnei tūmomo mōrearea, e matapaetia ana he $138 piriona te nui o ngā kino ā-tau i te tau 2031. I te katoa, e whakaatu ana ēnei matapae i te hiahia nui kia aro nui ngā whakahaere ki ngā kaupapa matua software supply chain security me te whakatinana i ngā mahi pakari hei tiaki i ngā raraunga tairongo, ngā mahi whakahaere, me ngā ingoa pai.
Nā te mea hou pipelineKo te nui o te whakawhirinaki ki ngā wāhanga o waho, ko te pikinga ake o ngā whare pukapuka tuatoru, ko ngā huringa whanaketanga pūmanawa tere ake, ko ngā mekameka tuku matatini, ko te kore e kitea, ko ngā tikanga whakaeke hou, ko te tango SaaS, me ngā rauemi iti katoa e akiaki ana i te pikinga o... ngā whakaekenga mekameka tuku pūmanawaNō reira, me whakamahi e ngā whakahaere tētahi huarahi whānui, kaha hoki hei aro atu ki ēnei wero me te tiaki i ā rātou mekameka tuku pūmanawa.
He aha te Whakaekenga mekameka tuku pūmanawa?
ENISA tautuhi a Whakaekenga mekameka tuku pūmanawa as "he takahi i tētahi rawa motuhake, hei tauira, te hanganga o te kaiwhakarato pūmanawa me te pūmanawa arumoni, hei whakararu ā-kore i tētahi whāinga, i ētahi whāinga rānei, hei tauira, ngā kiritaki a te kaiwhakarato pūmanawa." Arā, ko te Whakaekenga Mekameka Tuku Pūmanawa he mahi kino e aro ana ki te mekameka tuku pūmanawa, e whai ana ki te whakararu me te whakauru i ngā ngoikoretanga, i ngā pūmanawa kino rānei ki roto i te tukanga whakawhanake me te tohatoha. Nō reira, ka whakamahia e tēnei momo whakaeke te whatunga honohono, ā, he uaua hoki o ngā tukanga, taputapu, me ngā hinonga e uru ana ki te hanga me te tuku pūmanawa.
Ngā wāhanga matua me ngā ariā e pā ana ki te Whakaekenga mekameka tuku pūmanawa
He maha ngā wā ka pakaru ngā tuhinga mō ngā tūraru ipurangi me ngā tuhinga mōhiohio mō te haumarutanga mōhiohio. ngā whakaekenga mekameka tuku pūmanawa ki ngā kāwai motuhake kia pai ake ai te tātari me te tiaki. Nō reira, ka whakaurua e tēnei wāhanga ngā ariā matua e rima kua tautuhia e te Putumōhio Tauira Whakaeke MITREKa hangaia e tēnei rarangi pukapuka ngā tauira whakaeke mekameka tuku hei whakahaere i te tātaritanga mā te whakamahi i ngā momo puna, tae atu ki ngā tūmomo riri hoariri i kohia e NIST.
Te Mahi Whakaeke: Te Aha
Ko te mahi whakaeke he mahi motuhake e tuku ana i tētahi kawenga kino, i tētahi hiahia kino rānei ki tētahi pūnaha. Nō reira, ka puta he kino tika.
- Tauira 1: I whakaurua he pūmanawa kino ki roto i te pūmanawa pūnaha i te wā o te hanga.
- Tauira 2: Ngā whakaritenga pūnaha, ngā tuhinga hoahoa rānei i whakarerekētia mā te kino.
Te Waehere Whakaeke: Te Me Pēhea
Ko te ara whakaeke te tikanga e whakamahia ana e ngā hoariri hei whakamahi i ngā ngoikoretanga, hei tukatuka rānei i ngā ngoikoretanga. Nō reira, e whakaatu ana i te huarahi e uru atu ai, e tukino ai hoki ngā kaiwhakaeke i te mata o te whakaeke.
- Tauira 1: Ka whakarerekē te kaiwhakaeke i te waehere pūtake i roto i tētahi putunga raraunga kua taumanutia.
- Tauira 2: Ka whiwhi te kaiwhakaeke i te urunga kore whakamanatanga ki ngā tuhinga hangarau ā-roto.
Tūhurahia atu anō i roto i tā mātou Papakupu Whakaeke Wetereo mo etahi atu matauranga.
Pūtake Whakaeke: Ko Wai
Mā te pūtake ka tautuhia te pūtake o te whakaeke. Nō reira, ka whakamāramahia te tūranga, te mana, te whanaungatanga rānei o te kaiwhakaeke ki te pūnaha.
- Tauira 1: Ka whakarerekēhia e te tangata whai mana motuhake te hōtuhi e tētahi tangata whai urunga motuhake ki te hanga tūmau.
- Tauira 2: Ka tukuatuhia e tētahi kaiwhakatūkino o waho tētahi mōkihi kua whakaurua ki roto i tētahi rēhita tūmatanui.
Whāinga Whakaeke: Te Take
E whakamārama ana te whāinga i te take o te whakaekenga. Engari, e whakaatu ana i ngā mea e hiahia ana te hoariri ki te whakatutuki.
- Whakararuraru: te aukati i ngā ratonga, i ngā hanganga rānei.
- Te pirau: te whakaiti i te whakawhirinaki mā te whakarerekē i ngā taonga tuku iho, i te waehere pūtake rānei.
- Whakakitenga: te turuturu i ngā mea ngaro tairongo, i ngā taonga hinengaro rānei.
Pānga o te Whakaeke: Ngā Huanga
Hei whakamutunga, e whakaahua ana te pānga i ngā putanga o tētahi whakaeke, e whakaatu ana i ngā pānga ki ngā kaiwhakarato pūmanawa me ngā kiritaki.
- Tauira 1: Ka pirau tetahi kaupapa e whakamahi ana i tētahi papatono kino ā muri ake nei.
- Tauira 2: Ka tāutahia e te tangata he pūmanawa kino ki roto i ā rātou pūnaha mahi me te kore e mōhio.
Ngā Whakaekenga Mekameka Tuku Pūmanawa Tino Noa
He maha ngā momo ngā whakaekenga mekameka tuku pūmanawa kei te noho, ā, me mōhio ngā whakahaere ki ngā momo tūmomo mōrearea i ia wāhanga o te huringa ora. I runga i te anga SLSA, te Whare Wānanga ā-Motu o Amerika Standardme te Hangarau (NIST), a te Tari Haumarutanga Ipurangi me te Haumarutanga Hanganga (CISA), ka taea te whakarōpū i ēnei tūmomo riri ki ngā wāhanga e whā: te pūtake, te hanga, te mōkihi, me ngā tūmomo riri whakawhirinaki.
Ngā Whakaekenga Mekameka Tuku Pūmanawa i te Wāhanga Pūtake
- Tukuna he waehere kino → tirohia me pēhea Tono ipu.tiki hē or ngā hapa whakakore raupapatanga kāore i te haumaru waihangahia he mata whakaeke tika.
- Pūnaha pūtake taupatupatu
- Hangaia mai i tētahi pūtake kua whakarerekētia
- Tuhia he waehere kore haumaru
- Te whakararuraru i ngā kōnae nui → e ai ki te whakamārama i roto i tātaritanga o te tatau o muri o te chmod 777.
Ngā Whakaekenga Mekameka Tuku Pūmanawa i te Wāhanga Hanga
i roto i te Waihanga Hanga, ka whakahiato, ka whakauru hoki ngā kaiwhakawhanake i te waehere ki tētahi putanga e mahi ana. no te mea He tino hira tēnei wāhanga, ko ngā mōrearea ko te karo i ngā tirotiro haumaru i roto i te CI/CD pipeline, te whakarerekē i te waehere i muri i te mana whakahaere putanga, te whakararu rānei i te tukanga hanga. Nekau, ka taea e te waehere kino te ngokingoki ki roto i ngā taonga tuku iho me te kore e kitea.
- Tuhinga CI/CD → hono ki Pūmanawa kino i hangaia i mua i a GitHub.
- Whakarerekētia te waehere i muri i te mana whakahaere pūtake
- Te tukanga hanga whakaaetanga → kua whakaitihia ki Te kimi whakatūpato wawe a DevSecOps.
- Putunga taonga tuku iho
Ngā Whakaekenga Mekameka Tuku Pūmanawa i te Wāhanga Mōkihi
te Wāhanga Mōkihi Ko te wā tēnei e whakakotahi ai tātou i te waehere katoa hei hanga i tētahi hua whakamutunga. He mea mōrearea tēnei wāhanga nā te mea ka whakamahia pea e tētahi ngā mōkihi kino, ka whakarerekē rānei i ngā wāhi ipurangi e tikina ai e tātou. Ka taea e ngā kaiwhakaeke te tukuake i ngā putanga kino o ngā mōkihi rongonui ki ēnei paetukutuku.
- Whakamahia te mōkihi kua taupatupatu → kua hipokina ki roto ngā aromatawai matawai pūmanawa kino.
- Rēhita mōkihi taupatupatu
- Tukuatu i te mōkihi kua whakarerekētia → tātarihia i roto i Pūmanawa kino rūpahu Namso-gen.
Ngā Whakaekenga Mekameka Tuku Pūmanawa i te Wāhanga Whakawhirinakitanga
i roto i te Wāhanga Whakawhirinakitanga, ka tāpirihia e mātou ngā whare pukapuka me ngā mōkihi tuatoru ki tā mātou pūmanawa. He mōrearea tēnei wāhanga nā te mea ka horapa ngāwari, ka horapa puku hoki ngā raruraru o aua wāhanga ki te toenga o te kaupapa.
- Whakamahia te Whakawhirinakitanga Kua Whakararuhia → whakamāramahia me Ngā mōrearea DoS i roto i ngā whakawhirinakitanga huna.
- Ngā Whakawhirinakitanga Tawhito, Ngā Whakaraerae rānei
- Ngā Mōrearea o te Whakawhirinakitanga Whakawhiti
- Ngā Rēhita Mōkihi Kino → kua whakaitihia ki Ngā taputapu haumarutanga DevOps a te whakahaere mōrearea a te hunga tuatoru.
Ngā Mōrearea Noa o te Mekameka Tuku i Ia Wāhanga o te SDLC
| wāhanga | Ngā Tūraru Noa | tauira |
|---|---|---|
| pūtake | • Te tuku waehere kino, kore haumaru rānei • Te whakapōrearea i ngā kōnae nui • Te whakararu i te putunga pūtake | XcodeGhost (2015): kua werohia te waehere kino ki roto i te kaikohikohi Xcode a Apple, ā, kua horapa puta noa i ngā taupānga iOS. |
| hanga | • Te karo i te taha CI/CD arowhai haumaru • Te whakarerekē i te waehere i muri i te mana whakahaere pūtake • Te whakararuraru i ngā putunga taonga tuku iho | SolarWinds Orion (2020): i uru mai ngā kaiwhakaeke ki roto i te whare pipeline, te whakauru i tētahi tatau muri ki roto i ngā whakahōunga pūmanawa kua hainatia. |
| mōkī | • Te tukuake i ngā mōkihi kua whakarerekētia • Ngā rēhita mōkihi paitini • Te tohatoha i ngā taonga kua taupatupatu | NPM o te EventStream (2018): I whakauruhia e te kaiwhakaeke he tatau papamuri ki roto i tētahi mōkihi NPM rongonui kua tangohia mai i ngā mano tini o ngā wā. |
| whakawhirinaki | • Te whakamahi i ngā whakawhirinakitanga tawhito, ngoikore rānei • Te whakamahi i ngā whakawhirinakitanga whakawhiti • Te whakaputa i ngā mōkihi āhua kino | XZ Utils Backdoor (2024): tata tonu te tukuna o tētahi whare pukapuka kōpeketanga kua whakararuhia e ngā torotiana ki roto i ngā tohatoha Linux. |
Ngā Tikanga Whakaeke Pūmanawa Noa
E ai ki te CISE ai ki tētahi pūrongo a te NIST, e toru ngā wāhanga matua o ngā whakaekenga mekameka tuku pūmanawa.
Heoi anō, kei te whakaatuhia mai e ngā aituā tata nei ētahi atu āhuatanga me mārama ngā kaiwhakawhanake.
Kei raro nei ka whakawhānui ake mātou i ngā tikanga tino whai tikanga me ngā tauira mahi.
Ngā Whakahōutanga o te Tahae
Ka takahia e ngā kaiwhakaeke ngā tikanga whakahou tika hei tohatoha i te pūmanawa kino.
Hei tauira, i tukinotia e te whakaekenga a NotPetya i te tau 2017 te tūmau whakahou pūmanawa taake MEDoc o Ukraine, e tuku ana
pūmanawa kino whakangaro e huna ana hei papaki. Hei tiaki i tēnei mōrearea, me tono ngā tīma te kimi me te urupare mō ngā tūmomo mōrearea mō DevOps ngā mahi e tohu ana i ngā whanonga rerekē i roto i ngā rerenga whakahōu.
Te Whakahē i te Waitohu Ture
Ko tēnei tikanga ko te whakamahi kino, te tahae rānei i ngā tiwhikete hainatanga whai mana kia puta ai he tika te waehere kino.
Ko tētahi take nui ko te takahi ture a CCleaner i te tau 2017, i te wā i tohatoha ai ngā kaiwhakaeke i ngā pūmanawa kua whakaurua ki ngā torojane me ngā tiwhikete whai mana.
Nō reira, me whai mana whakahaere pono kotahi ngā whakahaere pērā i ngā mea kua whakaahuatia i roto i ngā rautaki tūāpapa haumarutanga tukutuku
Te Whakararu i te Waehere Pūtake Tuwhera
Ka whakauruhia e ngā hoariri ngā tatau papamuri ki roto i ngā mōkihi pūmanawa tuwhera rongonui, ā, muri iho ka toia ki roto i ngā mano tini kaupapa.
E whakaatu ana te aituā EventStream NPM me te tatau o muri o XZ Utils (2024) i te hiranga o tēnei āhuatanga.
Me arotake e ngā kaiwhakawhanake ngā rauemi pēnei i Ngā Pātai Auau mō te Haumarutanga NPM a ngā aituā mōkihi i pātōtōhia ki te ako me pēhea te karo i ngā whakawhirinakitanga paitini.
Te Pōhēhētanga o te Whakawhirinakitanga
I whakaahuahia tuatahitia e Alex Birsan i te tau 2021, ka whakamahia e tēnei whakaeke ngā tukinga whakaingoa i waenga i ngā rēhita mōkihi ā-roto me ngā rēhita mōkihi tūmatanui, ka tinihanga i ngā pūnaha hanga kia tangohia ngā putanga kino hei utu mō ngā mōkihi ā-roto pono.
Ngā Pāpāho me ngā Mōkihi Kino
Ka whakaputa ngā kaiwhakaeke i ngā mōkihi kino me ngā ingoa rite ki ngā whare pukapuka rongonui (hei tauira, "reqeusts" hei utu mō "tono").
Ka tāutahia noatia ēnei e ngā kaiwhakawhanake, ka uru mai te pūmanawa kino ki roto i ā rātou kaupapa.
Ka tātarihia tētahi tauira tūturu i roto i Pūmanawa kino Namso-gen ā, i roto i tā mātou rārangi o ngā matawai pūmanawa kino pūtake-tuwhera.
hanga Pipeline Miiri
E kitea ana i roto i te taupatupatu SolarWinds Orion, ka taea e ngā kaiwhakaeke te uru ki ngā tūmau hanga ki te wero i ngā waehere kino i te wā whakahiato.
Nā tēnei ka kore e pono te mekameka taonga kua hainatia katoatia. Ko ngā tikanga ārai ko te aroturukitanga CI/CD te pono me te te kitenga whakatupato wawe me te tātari
Ngā kaupapa pūmanawa kino kua hangaia i mua e GitHub.
Te Āhua o te Whakaekenga Mekameka Tuku Pūmanawa: Te Take SolarWinds
Heoi anō, ko te whakaekenga a SolarWinds Orion te tauira tino mōhiotia o te takahi i te mekameka tuku pūmanawa. E whakaatu ana i te huarahi e taea ai e ngā kaiwhakaeke te neke taahiraa i te taahiraa i roto i te tukanga hanga, ā, ko te mutunga iho, ka horahia he waehere kino ki ngā mano tini o ngā kaiwhakamahi.
Tuatahi, i uru ngā kaiwhakaeke ki ngā tūmau hanga a SolarWinds.
I muri i tērā, ka tāpirihia marietia e rātou he waehere kino ki ngā whakahōutanga o Orion.
Nā te mea i hainatia, i tukuna hoki ēnei whakahōutanga hei pūmanawa pono, he maha ngā kamupene i tāuta i ēnei whakahōutanga me te kore e mōhio ki te mōrearea.
I te katoa, neke atu i te 18,000 ngā whakahaere i pāngia, ā, i uru atu ngā kaiwhakaeke ki ngā pūnaha tino tairongo.
Mai i te tirohanga a te kaiwhakawhanake, e toru ngā akoranga māmā e homai ana e tēnei whakaeke:
- Kāore i te rawaka ngā pareparenga ā-rohe: i whakarerekētia te hanganga e ngā kaiwhakaeke pipeline ake.
- He mea nui ngā arowhai tonuhaumaru build attestations, ngā arowhai pono, me te kimi hapa ka āwhina i te aukati i te whakarerekētanga.
- Ka taea e te hanganga paitini kotahi te horapa puta noa i te ao: kotahi pipeline Ka taea e te whakaaetanga te waihanga i tētahi raruraru haumarutanga ā-ao.
Xygeni: Te Pūhara AppSec Katoa-i-te-Kotahi Tino Pai
Nā te mea ka taea e ngā whakaeke mekameka tuku pūmanawa te pā ki ia taahiraa o te SDLC,
te tūāpapa AppSec katoa-i-te-kotahi, Xygeni, e tiaki ana i ngā wāhanga pūtake, hanga, tākai, me te whakawhirinakitanga. Ka hoatu ki ngā kaiwhakawhanake me ngā tīma haumarutanga tētahi wāhi hei ārai, hei kite, hei whakatika i ngā mōrearea i roto i tētahi huarahi māmā. Nō reira, kāore koe e hiahia ki te whakamahi i ngā taputapu maha, ka hipokina e Xygeni te huringa ora katoa.
Te Tiakitanga o te Wāhanga Pūtake
I te wāhanga pūtake, ko ngā mōrearea kei roto ko te kore haumaru commits, ngā putunga paitini, ngā kōnae kua whakarerekētia rānei. Ka matawai a Xygeni i te waehere i te wā tūturu me te hohonu SAST me te kimi mea ngaro.
Ka ārai hoki i ngā mea kino commits i roto i CI/CD guardrails.
Ma tenei, ka mutu nga raruraru i mua i te putanga mai i te putunga.
Parenga Wāhanga Hanga
I te wā hanga, ka ngana pea ngā kaiwhakaeke ki te karo pipelinengā taonga whakarerekē rānei.
Ka tiakina e Xygeni te tukanga hanga me ngā tirotiro e tutuki ana i ngā whakaritenga SLSA, te whakamana i te pono, me ngā waitohu kore-kī. Ka tirotirohia hoki ngā whanonga rerekē i roto CI/CD ngā mahi. Nō reira, ka tohua tonutia ngā hanganga kua whakarerekētia, ā, ka āraia i mua i te tukunga.
Parenga Wāhanga Mōkihi
I te wāhanga mōkihi, he maha ngā wā ka whakauruhia mai e ngā rēhita kua takahia, ngā whare pukapuka kua whakarerekētia rānei te pūmanawa kino. Te kimi pūmanawa kino me te matawai raihana a Xygeni arotakehia ia taonga tuku iho, i te wā e Ka tūtohu a AutoFit i ngā ara whakahou haumaru me tana tātaritanga mōrearea whakatikatika. Ko ngā mōkihi kua manatokohia me ngā mea e tutuki ana i ngā whakaritenga ka neke whakamua i roto i te pipeline.
Te Parenga Wāhanga Whakawhirinakitanga
Ko te waehere tuatoru te mata whakaeke nui rawa atu. Te Tātaritanga Hanganga Pūmanawa a Xygeni (SCA) Ehara i te mea ko ngā CVE anake te mea e whakarārangihia ana, engari ka tirohia mēnā ka taea te whakamahi i te waehere mōrearea. Ka tohu hoki i ngā pūmanawa kino huna me ngā whakawhirinakitanga whakawhiti mōrearea. I runga ake i ngā mea katoa, ka whakarite tēnei kia tukuna noa e ngā kaiwhakawhanake ngā whakawhirinakitanga haumaru.
Ngā Mea Ngaro me te Haumarutanga Hanganga
Haunga te waehere me ngā mōkihi, he maha ngā wā ka whakamahia e ngā whakaeke ngā mea ngaro e turuturu ana, ngā hanganga ngoikore rānei. Ka matawai a Xygeni mō ngā kī, ngā tohu, me ngā tohu tuakiri kua kitea i roto i te waehere, ngā whirihoranga, me ngā paparanga Docker. Ka taea hoki e ia te whakamana me te whakakore aunoa i ngā mea ngaro kua turuturu me Whakatikatika Aunoa. I te wa ano, IaC te matawai hei ārai i ngā whirihoranga hē ka taea e ngā kaiwhakaeke te whakamahi kino i muri mai.
Te Kimi me ngā Whakatikatika Atamai
Ka mutu te nuinga o ngā taputapu i ngā whakatūpato. Ka haere tonu a Xygeni. Ka hangaia e tana miihini AutoFit ngā papaki haumaru, pull requests, he aratohu taahiraa-i-te-taahiraa rānei, i runga i te take. E whakaatu ana hoki tōna tirohanga Mōrearea Whakatikatika ko tēhea putanga papaki te mea haumaru, kia whakatikahia ai e ngā tīma ngā raruraru me te kore e tāpiri i ētahi mea hou.
Kotahi te Pūhara Kotahi
Nā te mea ka honoa e Xygeni SAST, SCA, te kimi pūmanawa kino, te whakahaere i ngā mea ngaro, IaC te matawai, te kimi i ngā hapa, me ngā mana hanga haumaru i roto i te tūāpapa AppSec kotahi,
ka whakaratohia he kapinga katoa puta noa i te SDLCKa whiwhi ngā kaiwhakawhanake me ngā tīma haumarutanga i te pūtake kotahi o te pono me te tirohanga mārama, ngā whakatikatika whai hua, me te tiakitanga kaha mai i ngā whakaekenga mekameka tuku.
Nga mea katoa i whakaarohia, Ko Xygeni, te tūāpapa AppSec katoa-i-te-kotahi tino pai rawa atu, ka āwhina i ngā tīma ki te hanga tere me te noho haumaru. Mā te tiaki i ngā wāhanga pūtake, hanga, mōkihi, me te whakawhirinakitanga, me te tāpiri i ngā whakatikatika aunoa i ia taahiraa, ka whakarite kia mutu ngā whakaeke mekameka tuku pūmanawa i mua i te taenga ki te whakaputa.
