Kāore e taea e ngā AppSec o ēnei rā te whakawhirinaki ki ngā rerengamahi ā-ringa. Whakahaere aunoa i ngā ngoikoretanga he mea nui inaianei, ehara i te kōwhiringa. Nō nā tata nei mātou i whai wāhi ai ki te whakauru atu ki te Ngā Mahi Whakawhanake Whaihua podcast, kei reira tā mātou CTO Luis Rodriguez ngā māramatanga i tohaina i roto i te wānanga "Te Tiaki i ngā Hononga Ngoikore: Te Ārai i ngā Whakaekenga o te Mekameka Tuku i mua i te Hurihuri." I roto i tēnei kōrero, i whakamārama a Luis me pēhea DevSecOps ka taea e ngā tīma te noho ki mua i ngā tūmomo riri nui o ēnei rā. I runga ake i ngā mea katoa, i whakaaturia e ia ko te angitu e whakawhirinaki ana ki te whakakotahi i te aunoatanga me te whakatau kaupapa matua e hangai ana ki te mōrearea me te hanga parepare kaha ki te ngā mōkihi npm kino.
Akoranga 1: Whakaitihia te Ngangau mā te Whakarite i ngā Kaupapa Matua e Hangai ana ki te Mōrearea
Tuatahi, i whakamārama a Luis ko te mea tino uaua ehara i te kimi i ngā ngoikoretanga, engari ko te kimi ko ēhea ngā mea tino nui. Ka tukuna e ngā taputapu tuku iho he mutunga kore ngā whakatūpato, ā, he maha ka puta he hua hē. Nō reira, ka ngaro te wā o ngā kaihangarau ki te whai i ngā raruraru kāore e tūpono ana ki te tūpono.
Te whakatau kaupapa matua e hangai ana ki te mōrearea e whakatau ana i tēnei. Ka tirohia te āheinga whakamahi, te whakaaturanga, me te pānga pakihi hei whakaatu i ngā take ka whakamahia pea e ngā kaiwhakaeke. Hei tāpiri, ko tā Xygeni Application Security Posture Management ka whakaiti i ngā whakatūpato tae atu ki te 90%, kia mārama ake ai te mahi haumarutanga, kia iti ake ai hoki te whakararuraru.
Tango matua: Ko te pono, ehara te mahi aunoa i te mea mō te nui o te matawai, engari mō te whakaatu i ngā hua he iti ake, engari ko ngā take tino nui anake.
Akoranga 2: Kei roto kē i tōu ngā mōkihi npm kino Pipeline
Tuarua, i whakanui a Luis i tētahi āhuatanga e kore e taea te wareware: ngā mōkihi npm kino kei te waipuke i ngā pūnaha rauropi tuwhera. Inaa, kotahi i roto i ia tekau ngā mōkihi npm, PyPI rānei i whakaputaina i te tau 2024 i roto i te pūmanawa kino. Nā reira, ka horapa tere atu ngā whakaeke mekameka tuku i te nuinga o ngā tīma.
Tangohia te take o te Noke Shai-Hulud: kotahi te mōkihi kino i pangia e te rau o ngā kaupapa i roto i ngā hāora. Ehara i te mea he tino whakararuraru noa iho tēnei, engari i whakaatu anō hoki i te whakamahinga a ngā kaiwhakaeke i ngā whakawhirinakitanga kāore i te pinea, me CI/CD ngā tauira whakawhirinaki.
Ka aro atu a Xygeni ki tēnei me:
- Te aro turuki tonu i ngā rēhita hei tohu i ngā mōkihi kino.
- Guardrails ka mutu te hanga ina kitea ngā whakawhirinakitanga kua wehea.
- Ngā whakatūpato mōrearea e whakamōhio tonu ana i ngā tīma ina puta mai he tūmomo mōrearea hou.
Tango matua: i runga i ēnei kōrero, me te whakawhirinaki noa ki ngā tikanga tuku iho SCA Ki te kore e ranea, me aukati te aunoatanga i te pūmanawa kino i te wā tonu.
Akoranga 3: Whakamarumaru i te Wheketere mā te Aunoatanga Whakahaere Whakaraerae
Tuatoru, i whakamahara mai a Luis kāore ngā kaiwhakaeke e aro noa ki ngā tono, engari ka whakaekea e rātou pipeline ake. He ngāwari te whakauru atu ki ngā Mahi ngoikore a GitHub, ngā rerengamahi kāore i te pinea, me ngā tohu tino rangatira. Arā, ko te CI/CD Ko te pūnaha te "wheketere" o ngā pūmanawa hou. Mēnā ka takahia te wheketere, ka tūpono ngā taonga katoa o muri mai.
Koinei te wahi te whakahaere aunoa i ngā ngoikoretanga tino kanapa. Hei tauira, mā te whakauru i ngā arowhai aunoa, ngā taonga kua hainatia, me te kimi i ngā hapa ki roto CI/CD, ka taea e ngā tīma te:
- Ārai i te rere o ngā rerengamahi kore haumaru.
- Manatokohia ia hanganga me ngā whakaū whakamunatanga.
- Kimihia tonutia ngā mahi rerekē, ngā pikinga mana, ngā monomai tinihanga rānei.
Tango matua: Hei whakamutunga, me whai mana whakahaere aunoa tonu te tiaki i te wheketere, e kore rawa ngā arotake ā-ringa anake e tauine nui.
Te Tikanga o Tēnei mō ngā Tīma DevSecOps
I te katoa, he mārama te akoranga mai i te kōrero a Luis: me whakakotahi e te AppSec hou te whakahaere aunoa i ngā ngoikoretanga, te tiaki i ngā mōkihi npm kino, me te whakatau i ngā kaupapa matua e hangai ana ki te mōrearea. Ki te kore, ka tūpono ngā tīma ki te toremi i roto i te haruru i te wā e whakamahia ana e ngā kaiwhakaeke ngā āputa.
Mā Xygeni, ka whiwhi ngā whakahaere i:
- Te kimi rawa me te rarangi taonga aunoa.
- Ngā awa hihiri mō te whakarite i te whakaraeraetanga e hangai ana ki te mōrearea.
- Kua whakauruhia te pūmanawa kino me te kimi mea ngaro i roto i te wā tūturu CI/CD.
Nō reira, ehara i te mea ko te whai hua anake te kaupapa o te aunoatanga; koinei anake te huarahi hei noho pakari ki ngā whakaekenga e whanake haere ana i roto i te mekameka tuku.
Mātakihia te Kōrero Katoa me Luis Rodríguez
Tirohia te wāhanga katoa "Te Tiaki i ngā Hononga Ngoikore: Te Ārai i ngā Whakaekenga o te Mekameka Tuku i mua i te Hurihuri" me te ako me pēhea te whakahaere aunoa i ngā ngoikoretanga i roto i tō DevSecOps pipeline.
Kua rite koe ki te whakamahi i ēnei akoranga?
Ehara i te ariā noa te whakahaere i ngā ngoikoretanga me te tiaki i ngā mōkihi npm kino, engari he mea ka taea e koe te tīmata i tēnei rā. Mā Xygeni, ka whiwhi koe i te whakatau kaupapa matua e hangai ana ki te mōrearea, te kimi pūmanawa kino i te wā tūturu, me CI/CD guardrails taua tauine me tō tīma.
Tīmata to whakamātautau koreutu me te kite me pēhea te uru tika o te whakahaeretanga ngoikore ki roto i tō pipeline.
