A ngoikoretanga o te rā kore Ko tētahi o ngā mōrearea nui rawa atu o te haumarutanga tukutuku. He hapa tēnei kāore e mōhiotia ana e te tangata tae noa ki te wā e whakamahia kinotia ana.
Ina kitea, ā, ina whakamahia e ngā kaiwhakaeke, ko te mutunga iho he te whakamahi i te kore-rā, he wāhanga waehere, he tikanga rānei e huri ana i taua ngoikore huna hei tūmomo mōrearea tūturu. Mō ngā tīma pūmanawa me DevSecOps, ko ēnei ngā mahi whakaraeraetanga o te rā kore waihangahia ngā wāhi matapo e kore e taea e ngā matawai noa, ngā taputapu ārai huaketo, me ngā papaki te āwhina.
Ka tere te neke o ngā kaiwhakaeke inaianei, e aro ana ki te waehere, ngā whakawhirinakitanga, me CI/CD pipelines.
Te maarama me pehea a te whakamahi i te kore-rā te whai huatanga, me te pēhea te kite wawe i tēnei mea, he wāhanga nui inaianei mō te pupuri i te haumaru o tētahi tukanga whanaketanga o ēnei rā.
He aha te mea e tino mōrearea ai te ngoikore o te Zero-Day
A te whakamahi i te kore-rā ka whakamahi i tētahi ngoikoretanga i mua i te mōhio o te kaihoko kei te noho.
He rerekē tēnei i ngā hapa e mōhiotia ana, kāore he papaki, kāore he whakatikatika, ā, he maha ngā wā kāore he huarahi pono hei kite i ngā hapa tae noa ki te putanga mai o te whakaeke.
He maha ngā wā ka huna ēnei ngoikoretanga i roto i ngā whare pukapuka pūmanawa, i ngā pūtirotiro, i ngā wāhanga tuatoru rānei. Kia kitea rā anō, ka taea e ngā kaiwhakaeke te whakamahi i aua ngoikoretanga hei patu, ka horahia hoki ngā waehere kino mā roto i ngā taputapu me ngā putunga pono.
Na te mea tenei, ngā mahi whakaraeraetanga o te rā kore ka taea te neke tere puta noa i ngā mekameka tuku me ngā taiao kapua.
Mā te whakawhirinakitanga kotahi i roto i tētahi kaupapa pūtake tuwhera ka whakaatu pea i ngā mano tini o ngā hanganga i mua i te kitenga atu.
Te Mārama ki ngā Whakamahinga o te Ngāwari o te Zero-Day
Hei mārama ki te whakamahinga a ngā kaiwhakaeke i ēnei ngoikoretanga, he pai ki te titiro ki te raupapatanga noa o te whakamahi i te kore-rā:
- Ka kitea e te kairangahau, e te kaiwhakaeke rānei tētahi hapa kāore e mōhiotia.
- Ka waihangahia e te kaiwhakaeke he waehere whakamahi hei whakamahi i taua hapa.
- Ka whakamahia te mahi tinihanga i ngā whakaekenga tūturu, ka tohaina rānei ki te ipurangi.
- Ka tautuhia e ngā kaihoko te raru, ā, ka tukuna he papaki.
- Ka tere te mahi a ngā tīma haumarutanga ki te tono whakahōutanga me te whakaiti i te pānga mai o ngā mea kino.
Hei tauira, IBM X-Force i pūrongo i tētahi kēhi i whakamahia ai e ngā kaiwhakaeke tētahi ngoikoretanga zero-day i roto i te pūmanawa whakawhiti kōnae GoAnywhere i roto i ngā haora 24 o te kitenga.
E whakaatu ana tēnei i te iti o te matapihi i waenga i te kitenga me te whakamahinga kino, i ētahi wā he torutoru noa ngā haora.
Ehara i te mea he ariā noa iho ēnei whakaekenga. Kua pā mai he kino nui ki roto i enterprise ngā pūnaha, ngā pūmanawa tuwhera-pūtake, me ngā mekameka tuku taonga o te ao.
Ngā Tauira o te Ao Tūturu o ngā Whakaekenga Zero-Day
Kāore e onge ana ngā whakaekenga Zero-day. Ka puta ēnei i ngā paparanga katoa o ngā pūmanawa hou, mai i ngā pūtirotiro ki ngā pūnaha hanga me ngā taputapu kaiwhakawhanake.
Ko ngā tauira e whai ake nei e whakaatu ana i te tere o te whakamahi a ngā kaiwhakaeke i ngā ngoikoretanga kāore i te mōhiotia i mua i te urupare a ngā kaiwawao:
- Whakawhiti MOVEit (2023)I whakamahia e ngā kaiwhakaeke tētahi ngoikoretanga werohanga SQL kore-rā (CVE-2023-34362) i roto i te Progress MOVEit Transfer. Nā tēnei mahi tinihanga i taea ai te tahae raraunga nui mai i ngā rau whakahaere, tae atu ki ngā peeke me ngā tari kāwanatanga, i mua i te tukunga o tētahi papaki.
- Google Chrome (2025)I whakamahia whānuitia te ngoikoretanga zero-day (CVE-2025-10585) i roto i te miihini JavaScript V8 a Chrome. I tukuna e Google he papaki tere i muri i te whakaū kei te haere tonu ngā whakaeke.
- Te Whakaekenga o te Mekameka Tuku a SolarWinds (2020)I whakaurua e ngā kaiwhakaeke he waehere kino ki roto i tētahi whakahoutanga pūmanawa pono mō te tūāpapa Orion a SolarWinds, ā, neke atu i te 18,000 ngā whakahaere i pāngia. Ahakoa kāore i te whai hua kotahi, i mahi pērā i te kore-rā i roto i te mekameka tuku.
- Microsoft Exchange Server (2021, “ProxyLogon”): E whā ngā ngoikoretanga zero-day i āhei ai ngā kaiwhakaeke ki te uru mamao ki ngā tūmau Exchange puta noa i te ao. I tere te taenga mai o ngā papaki, engari kua maha kē ngā pūnaha kua takahia.
- Kiritaki Zoom (2022)Nā te whakamahi i te kore-rā ka taea e ngā kaiwhakaeke mamao te whakahaere waehere i te wā o ngā waeatanga ataata i runga i ngā kiritaki Windows kāore anō kia whakatikatikaina. I hokohokohia te hapa i roto i te tūmataitinga i mua i te whakaaturanga ki te marea.
E whakaatu ana ia take me pēhea ngā mahi whakaraeraetanga o te rā kore ka horapa puta noa i ngā whakawhirinakitanga, pipelines, me ngā taiao kapua i roto i ngā hāora.
Koia te mea nui o te tirohanga whānui, te kitenga i ngā āhuatanga rerekē, me ngā whakatūpato wawe hei aukati i ēnei tūmomo mōrearea i mua i te horapa.
E whakaatu ana hoki ēnei aituā i tētahi panonitanga o te rautaki a te kaiwhakaeke, mai i ngā whakaekenga pito whakamutunga takitahi ki te urunga mai o ngā pūnaha hanga, ngā whakawhirinakitanga, me ngā DevOps. pipelines.
Ngā Whakamahinga Zero-Day i roto i te Mekameka Tuku Pūmanawa
Ko ngā mahi whakamahi kore-rā o ēnei rā e aro ana ki te mekameka tuku pūmanawa, kaua ko ngā pito mutunga, ko ngā pūnaha whakahaere rānei anake.
Ka whakamahia e ngā kaiwhakaeke ngā whakawhirinakitanga kua takahia, ngā tuhinga kino, me CI/CD ngā whirihoranga hē hei neke whakamua i roto i te tukanga whakawhanake.
Ko ētahi o ngā huarahi whakaeke tino noa ko:
- whakaputa ngā mōkihi kua pangia ki ngā rēhita pūtake tuwhera.
- Te werohanga i ngā utunga kore-rā ki roto i ngā tuhinga whai muri i te tāutanga.
- Te whakamahi kino i ngā mahi hanga, i ngā tohu rānei kāore i aroturukitia.
- Toikoi ngā kaitiaki tika, me ā rātou pūkete rānei.
Kāore e taea e ngā taputapu mutunga tuku iho te kite i ēnei tūmomo riri nā te mea ka puta mai i mua i e oma ana te pūmanawa i te wā e whakawhanaketia ana, e hangahia ana, e whakauruhia ana rānei.
Koia te take he mea nui te kitea o DevSecOps me te matawai aunoa.
Te Huringa Ora me te Āputa Kitenga
| wāhanga | Ngā Mahi a te Kaiwhakaeke | Wero Kaiwawao |
|---|---|---|
| Te Kitea me te Whakamahinga Patu | Kimihia tētahi hapa kāore i te mōhiotia, ka hanga i tētahi whakamahinga pai i mua i te whakaaturanga. | Kāore he waitohu, he papaki rānei e mōhiotia ana; kāore e kitea ngā kaiwawao. |
| Te Whakatakotoranga o te Whakamahinga | Tukuna ngā kawenga mā te hītinihanga, ngā mōkihi kua pangia, ngā whakahōutanga kino rānei. | Ka kitea i muri i te whakatinanatanga anake; he iti te wā urupare. |
| Papaki me te Whakakitenga | Ka tukuna e te kaihoko he whakahōutanga, ā, ka tūmatanui te whakaaturanga tinihanga. | Ka noho tuwhera tonu ngā pūnaha kia whakamatautauria rā anō, kia whakatinanahia rā anō ngā papaki. |
Ko te āputa kitea te wā tino morearea. Ina kei te wātea ngā mahi whakaraeraetanga kore-rā, ā, kāore he waitohu, he papaki rānei a ngā tīma, ka tere te neke a ngā kaiwhakaeke. Ko te kati i tēnei āputa me kimi wawe, me aroturuki tonu, me ngā parepare e ahu mai ana i ngā whanonga.
Ngā Raraunga kei Muri i ngā Tūraru o te Ao Kore-Rā Hou
E whakaatu ana ngā pūrongo hou i te tere me te noa o ngā mahi kore-rā:
- te Rōpū Matauranga Tūkino a Google (GTIG) korerotia 75 ngā ngoikoretanga o te kore-rā i whakamahia i te ngahere i te tau 2024, he pikinga 30 ōrau mai i te tau i mua.
- Taipitopito 44 ōrau o aua rā-kore i whäia enterprise ngā pūnaha pēnei i ngā VPN, ngā pareārai ahi, me ngā taputapu whakahaere, e whakaatu ana kei te arotahi ngā kaiwhakaeke inaianei ki ngā hanganga whai hua nui.
- te IBM 2025 Risk Intelligence Index i tuhia neke atu i te 65,000 whakaraeraetanga me ngā mahi tinihanga e wātea ana ki te marea, he maha kua whakamahia anō, kua tākaihia anō ki roto i ngā whakaeke zero-day hou.
E whakaatu ana ēnei tatauranga he aha me kite ngā tīma i ngā tohu o ngā mahi tinihanga mō te ngoikore o te rā kore i mua i te putanga mai o tētahi papaki.
Ngā Mea e tika ana kia Whakaurua e te Parenga Zero-Day Pai rawa atu
Hei whakawhāiti i te pānga o tētahi te whakamahi i te kore-rā, me maha ngā paparanga me te whakanoho wawe i ngā parepare ki roto i te rerenga whanaketanga. Kei roto i tētahi huarahi katoa:
- Matawai-tūturu i ngā rēhita pēnei i te npm me te PyPI hei kite i ngā mōkihi whakapae i mua i te urunga ki ngā hanganga
- Ngā pūnaha whakatūpato wawe e tohu ana i ngā mōkihi hou, i ngā huringa ohorere rānei o te kaiwhakaputa e tohu ana i tētahi ngoikoretanga kore-rā i te ao tūroa.
- Ngā pareārai ārai e aukati ana, e wehea rānei ngā wāhanga mōrearea aunoa
- Te kitenga i ngā āhuatanga rerekē puta noa CI/CD pipelines hei kimi i ngā whanonga hanga-wā rerekē e tohu ana i tētahi whakawhirinakitanga kua whakamahia
- Te aroturuki i te ingoa o te hoa mahi hei kimi i ngā pūkete kaitiaki rūpahu, i tahaetia rānei, e whakaputa ana pea i tētahi tukunga e mau ana i te mahi kino.
- Te whakatinana tonu i ngā kaupapa here hei ārai i te hanumitanga o ngā waehere haumaru kore ki ngā peka matua
E ai ki te National Vulnerability Database, neke atu i te 29,000 ngā CVE hou i tuhia i te tau 2024. Ahakoa ka whakarārangihia ngā take zero-day i muri i te whakaaturanga, e whakaatu ana tēnei tipu i te tere o te putanga mai o ngā ngoikoretanga me te take e aukati ai i tētahi te whakamahi i te kore-rā ngā take o mua.
Me pēhea te āwhina a Xygeni ki te whakaiti i ngā mahi kino o te Zero-Day
Xygeni ka waiho te kitenga wawe me te tiaki aunoa ki roto i tō rerenga DevOps hei whakaiti i te matapihi o te whakaaturanga ki te whakamahi i te kore-rā. Ko ngā āheinga matua ko:
- Te aro turuki tonu i ngā kete hou me ngā kete o nāianei mō ngā tohu tōmua o te whanonga mōrearea
- An Pūnaha Whakatupato Moata e whakamōhio ana i ngā tīma ina puta he tauira whakamahi kino pea i roto i ngā rēhita
- Ārai aunoa, ārai rānei i ngā whakawhirinakitanga whakapae kia kore ai e taea e te whakamahi i te kore-rā te uru ki roto i ō taonga hanga
- Te kitenga kino i ngā wā hanga e whakaatu ana i ngā huringa kōnae ohorere, i ngā waeatanga mamao rānei e ōrite ana ki te whanonga whakamahi kino
- Te aroturuki i te ingoa pai mō ngā kaitiaki me ngā kaiwhakaputa hei kite i ngā huringa ohorere e tohu ana i tētahi hapa
- Te whakatau kaupapa matua e mōhio ana ki te horopaki e āwhina ana i ngā tīma ki te whakatau mēnā ka huri pea tētahi take kua kitea hei mahi kino mō te rā kore i roto i tō rātou taiao.
Ka honoa a Xygeni ki ngā pūnaha CI noa me te mana whakahaere pūtake kia whiwhi ai koe i ēnei parenga me te kore he tuhinga tāpiri, he tatūnga taumaha rānei.
Ngā Mahi Pai hei Whakarite mō te Zero-Day e Whai Ake Nei
- Mau tonu SBOMs kia mōhio ai koe ki ngā waehere me ngā mōkihi kei roto i ia hanganga
- Ngā putanga whakawhirinakitanga pine ā, karohia ngā kāri mohoao e tuku ana i tētahi mōkihi kāore i te mōhiotia kia uru mai, ka whakahaere i tētahi mahi whakamahi kore-rā
- Whakahaerehia ngā matawai paparanga: ngā arowhai tūmau, ngā whakamātautau hihiri, me te aroturuki whanonga
- Whakaaunoatia ngā tukanga whakapiri me te huri whakamuri hei whakaiti i te whakaaturanga ina puta he mahi kino mō te kore-rā
- Whakawhāitihia ngā mea ngaro me ngā whakaaetanga i roto i ngā mahi hanga kia kore ai e tere te piki haere o te mahi tinihanga
- Whakangunguhia ngā tīma ki te kite i ngā mōrearea o te mekameka tuku me te urupare wawe ina puta mai ngā tohu o te mahi kino i te rā kore.
Mā ngā taputapu pēnei i a Xygeni ka āwhina i te aunoa i te nuinga o ēnei mahi me te whakaiti i ngā mahi ā-ringa me te whakapai ake i te kitenga i tētahi mahi kino mō te kore-rā.
Ngā Whakaaro Whakamutunga: Te Noho Kotahi te Hikoi ki Mua i ngā Mahi Kore-Rā
Ka whanake tonu ngā tūmomo riri kore-rā. Koia te take me huri anō hoki ngā parepare. Kāore e ranea te tiaki i ngā pito mutunga anake. Me kitea me te tiaki ngā tīma e tīmata ana i roto i te waehere, i ngā whakawhirinakitanga, me pipelines.
Mā te whakakotahi i te matawai wā-tūturu, ngā whakatūpato wawe, me te aukati aunoa, ka taea e koe te whakaiti i te tūponotanga ka tae atu tētahi mahi kino kore-rā ki te whakaputa. Kimihia wawe, āraia tere ake, ā, kia kotahi te taahiraa ki mua i tō mekameka tuku pūmanawa.
