Ko te OWASP Top 10 tētahi o ngā tohutoro haumarutanga tono e whakamahia whānuitia ana mō te tautuhi me te whakaiti i ngā mōrearea haumarutanga tono tukutuku tino nui. E whakamārama ana tēnei aratohu i ngā mōrearea OWASP Top 10, ngā tauira o te ao tūturu, ngā mahi pai mō te whakatikatika, me te pēhea o te AppSec hou me software supply chain security ka āwhina ngā otinga i ngā whakahaere ki te whakaiti i te mōrearea puta noa i te SDLC.
Te Kaupapa Haumarutanga Taupānga Tukutuku Tuwhera (OWASP)
Te Kaupapa Haumarutanga Taupānga Tukutuku Tuwhera (OWASP) he whakahaere kore-painga matua e whakatapua ana ki te whakapai ake i te haumarutanga pūmanawa. E mōhiotia ana a OWASP mō tōna māramatanga me committe aro ki ngā otinga e ārahihia ana e te hapori, ā, kua waiho hei rauemi matua mā ngā kaiwhakawhanake, ngā tohunga haumarutanga, me ngā whakahaere e whai ana ki te whakamahi i ngā tikanga haumarutanga pai rawa atu. I roto i ana takoha maha, ko tētahi o ngā mea tino nui ko te OWASP Top 10, he rārangi whakahoutia tonutia o ngā mōrearea haumarutanga tono tukutuku tino nui e pā ana ki ngā tono hou. E whakaatu ana i ngā ngoikoretanga tino kino i roto i ngā tono tukutuku, i runga i ngā raraunga o te ao tūturu me ngā māramatanga tohunga.
Ko te kaupapa matua a OWASP he whakarite kia wātea, kia mārama hoki te haumarutanga, mā te whakarato i ngā taputapu, ngā anga mahi, me ngā mātauranga hei āwhina i te haumarutanga o ngā tono mai i te tīmatanga. Ko te OWASP Top 10 he anga mahi hei āwhina i ngā kaiwhakawhanake ki te arotahi ki ngā ngoikoretanga tino nui, kia taea ai e rātou te whakatinana i ngā otinga e tika ana.
Ngā OWASP Top 10
Ko te OWASP Top 10 he rauemi haumarutanga tono taketake mō ngā whakahaere e tiaki ana i ngā tono tukutuku hou. Mō ngā whakahaere katoa e mahi ana ki te tiaki i ngā tono tukutuku. E whakamārama ana i ngā tūmomo riri haumarutanga tino nui, e tuku ana i ngā tirohanga ki ngā huarahi noa e takahia ai ngā tono. E whakaatu ana ngā ngoikoretanga o te OWASP Top 10 i ēnei mōrearea matua, e tuku ana i ngā taunakitanga mahi hei whakaiti i aua mōrearea. He mea nui te aro atu ki ēnei ngoikoretanga hei whakapakari i te haumarutanga o tētahi tono.
He aha ngā OWASP Top 10 me ā rātou rongoā?
Ko te OWASP Top 10 he tuhinga mōhiotanga e mōhiotia ana puta noa i te ao i whakaputaina e te Open Web Application Security Project (OWASP). Ka tautuhia ngā mōrearea haumarutanga tino nui e pā ana ki ngā tono tukutuku hou i runga i ngā raraunga whakaeke o te ao tūturu, te rangahau hapori, me te tātari ahumahi. Ka āwhina te rārangi i ngā kaiwhakawhanake, ngā tīma AppSec, ngā miihini DevSecOps, me ngā kaiārahi haumarutanga ki te whakatau i ngā ngoikoretanga e tino mōrearea ana ki ngā tono, ngā API, me ngā mekameka tuku pūmanawa.
Kei roto i ngā OWASP Top 10 o nāianei ngā wāhanga haumarutanga pēnei i te Mana Uru Pakaru, te Werohanga, te Whirihoranga Hē Haumarutanga, ngā Wāhanga Whakaraerae me ngā Wāhanga Tawhito, ngā Rahunga Pūmanawa me te Pono Raraunga, me te Tūkino Tono Taha-Tūmau (SSRF). He mea nui te mārama ki ēnei mōrearea me te whakatinana i ngā rautaki whakatika tika mō te hanga tono haumaru, te whakaiti i te tūponotanga o te haumarutanga pūmanawa, me te tiaki i ngā whakahaere mai i ngā tūmomo riri ipurangi o ēnei rā.
Ngā Kāwai 10 Tino Pai o OWASP
Tirohanga Poto mō ngā Ngāwaritanga 10 o runga o OWASP
| Kāwai OWASP | Morearea Tuatahi | Paanga Angamaheni |
|---|---|---|
| Mana Uru Pakaru | Whakauru kore | Whakaaturanga Raraunga |
| Ngā Rahunga Tuhimana | Whakamunatanga ngoikore | Te tahae raraunga tairongo |
| Injection | Te whakatinanatanga whakauru kino | Te takahi i te pātengi raraunga |
| Hoahoa Haumaru | Ngā ngoikoretanga o te hanganga whare | Ngā ngoikoretanga puta noa i te pūnaha |
| Hē Whakatikatika Haumarutanga | Tatūnga hē | Whakauru kore |
| Nga Wae Whakaraerae | Ngā whakawhirinakitanga tawhito | Te whakahekenga o te mekameka tuku |
| Motuhēhēnga Rahunga | Ngā mana whakahaere tuakiri ngoikore | Te tango kaute |
| Ngā Rahunga Pono Pūmanawa | Te whakararuraru i te hanga/te whakawhirinakitanga | Whakaurunga pūmanawa kino |
| Ngā Rahunga Takitaki me te Aroturuki | Te kitenga whakaroa | Te roa o te noho a te kaiwhakaeke |
| SSRF | Te tukino i te tono ā-roto | Te whakahekenga ratonga ā-roto |
1. Mana Uru Pakaru (A01:2021)
He aha te Mana Uru Pakaru?
Ka puta te Mana Uru Pakaru ina whiwhi ngā kaiwhakamahi i te urunga kore whakamanatanga ki ngā raraunga, ki ngā mahi rānei. Hei tauira, ka taea e te kaiwhakaeke te whakarerekē i tētahi URL hei whiwhi urunga kaiwhakahaere. I kitea tēnei take e OWASP i roto i te 94% o ngā tono kua whakamatautauria, ā, koinei tētahi o ngā ngoikoretanga haumarutanga OWASP Top 10 tino kitea.
Ngā Rongoā mō te Mana Uru Pakaru
Hei whakaiti i tēnei mōrearea, whakatinanahia te urunga iti rawa te mana, whakatinanahia te motuhēhēnga maha-tauwehe (MFA) mō ngā mahi tairongo, me te arotake i ngā whakaaetanga kaiwhakamahi i ia wā.
Ngā Mea Ngaro a Xygeni, te Haumarutanga Ka āwhina i te tiaki i ngā mōhiohio tairongo pērā i ngā kī API me ngā tohu, ka whakaiti i te mōrearea o ngā takahi mana uru. Mā te aroturuki tonu ka whakarite i te pono o tō pūnaha.
Tauira o te Ao Rael
In 2019, Ko te kamupene First American Financial Corp kua whakakitea ki runga 850 miriona ngā tuhinga tairongo nā te korenga o te mana whakahaere urunga tika. Ka taea e ngā kaiwhakaeke te whakarerekē noa i tētahi URL hei uru atu ki ngā tuhinga muna. Mā te kore e tiaki tika i ngā pūwāhi urunga, i waiho e te kamupene ngā raraunga tairongo kia ngoikore. E whakanui ana tēnei mahi i te hiahia kia whakamanahia ngā tūranga kaiwhakamahi me te whakarite kia uru noa ngā tāngata whai mana ki ngā mōhiohio tairongo.
He aha te hiranga o tēnei mea i tēnei rā? E whakaatu ana ngā tono hou i ngā API, ngā ratonga kapua, me ngā tūranga kaiwhakamahi tohatoha, e hanga ana i te urunga kore whakamanatanga hei tētahi o ngā mōrearea haumarutanga tino noa me te kino e pā ana ki ngā raraunga pakihi tairongo.
2. Ngā Rahunga Whakamuna (A02:2021)
He aha ngā Rahunga Tuhimuna?
Ka puta ngā hapa whakamunatanga ina kore e taea e ngā pūnaha te whakamuna tika i ngā raraunga tairongo, ka taea ai e ngā kaiwhakaeke te hopu me te whakamahi hē i aua raraunga. He mea nui te whakamunatanga pakari hei tiaki i ngā raraunga tairongo.
Ngā Rongoā mō ngā Rahunga Tuhimunatanga
Whakamunatia ngā raraunga kua rongoatia ki te AES-256, ā, whakamanahia te TLS 1.2, neke atu rānei, mō ngā raraunga e tukuna ana. Hurihia ngā kī whakamuna i ia wā, ā, tiakina mā te whakamahi i ngā mana uru tika.
Te Hanganga o Xygeni hei Waehere (IaC) Haumarutanga Ka tirohia ngā tautuhinga whakamunatanga i te wā whakatinanatanga hei ārai i ngā ngoikoretanga o ngā kaupapa here whakamunatanga.
Tauira Ao-Tuturu
I roto i te 2017, Tino tika, he umanga whakahiato raraunga, i huraina he 340 miriona ngā rekoata takitahi nā te whakamunatanga hē. I uru atu ngā kaiwhakaeke ki ngā mōhiohio whaiaro pēnei i ngā ingoa, ngā wāhitau, me ngā tau waea nā te mea i rongoa ngā raraunga i roto i te tuhinga māmā. E whakaatu ana tēnei takahi i ngā mōrearea o te kore e whakamuna i ngā raraunga tairongo. Mā te whakamahi i te whakamunatanga tika standardI roto i ngā hangarau pēnei i te AES-256 mō ngā raraunga e takoto ana me te TLS mō ngā raraunga e haere ana, ka taea e ngā whakahaere te tiaki i ā rātou raraunga mai i te urunga kore whakamanatanga.
He aha te hiranga o tēnei mea i tēnei rā? Kei te piki haere te penapena me te whakawhiti a ngā whakahaere i ngā raraunga tairongo mō ngā kiritaki, ngā pūtea, me te manatoko puta noa i ngā taiao kapua, ā, he mea nui te whakamunatanga kaha hei tiaki i te tūmataitinga me te tutuki i ngā ture.
3. Werohanga (A03:2021)
He aha ngā Whakaeke Werohanga?
Mā ngā ngoikoretanga werohanga, pērā i te SQL Injection, ka taea e ngā kaiwhakaeke te whakauru waehere kino ki roto i tō pūnaha, ka taea ai e rātou te whakarerekē, te tahae rānei i ngā raraunga. Ko ngā whakaeke werohanga tētahi o ngā mōrearea haumarutanga tono tino noa me te tino pānga e pā ana ki ngā tono tukutuku o ēnei rā.
Ngā rongoā mō Ngā Whakaeke Werohanga
Whakamahia ngā patai kua whakarārangihia ngā tawhā, ā, whakamanahia ngā whakaurunga a ngā kaiwhakamahi. Āta karohia ngā patai hihiri i ngā wā katoa e taea ana hei whakaiti i ngā mōrearea.
Te Kitenga i te Āhuatanga Kāore i te Tika a Xygeni Aroturuki CI/CD pipelinemō ngā whanonga rerekē, te hopu i ngā nganatanga werohanga pea i te wā tonu.
Tauira Ao-Tuturu
In 2017, Equifax i pāngia e te pakaru raraunga nui i huraina ngā mōhiohio whaiaro o 147 miriona kiritaki. I puta te takahi i tētahi Ngā ngoikoretanga o te werohanga SQL, e āhei ai ngā kaiwhakaeke ki te whakahaere i te paetukutuku a te kamupene me te uru atu ki ngā raraunga tairongo kua rongoatia ki te pātengi raraunga. Me whakarite e ngā whakahaere kia tika te horoi a ā rātou pūnaha i ngā whakaurunga a ngā kaiwhakamahi. Mā te whakatikatika me te tiaki i ngā patai SQL i ia wā ka ārai pea i tēnei ngoikoretanga.
He aha te hiranga o tēnei mea i tēnei rā? Kei te pā tonu ngā ngoikoretanga werohanga ki ngā tono tukutuku, ki ngā API, me ngā rerengamahi whanaketanga āwhina-AI, ina tae atu ngā whakaurunga kāore i manatokohia ki ngā kaiwhakamāori, ki ngā pātengi raraunga, ki ngā pūnaha papamuri rānei.
4. Hoahoa Kore-Haumaru (A04:2021)
He aha te Hoahoa Kore-Haumaru?
Ka puta te Hoahoa Kore Haumaru ina kore e whakauruhia e ngā kaiwhakawhanake te haumarutanga ki te wāhanga hoahoa tuatahi, ka puta he ngoikoretanga e uaua ana ki te whakatika i muri mai. He uaua ki te whakatika i ēnei ngoikoretanga ina tae atu ngā tono ki ngā taiao whakaputa.
Ngā rongoā mō Hoahoa Haumaru
Whakauruhia ngā mātāpono hoahoa haumaru me te whakatauira mō ngā tūmomo mōrearea i te tīmatanga o te huringa whanaketanga. Arotakehia tō hoahoa i ia wā mō ngā ngoikoretanga pea, ā, whakatikahia i mua i te noho hei take nui.
Xygeni's Application Security Posture Management (ASPM) Ka tautuhia ngā hapa hoahoa pea i mua i te whakamahinga a ngā kaiwhakaeke, kia mōhio ai ngā kaiwhakawhanake kei te whakauru i te haumarutanga ki roto i ā rātou hua mai i te tīmatanga.
Tauira Ao-Tuturu
He tauira o te ao tūturu hou ake nei Hoahoa Haumaru ko te Ngā ngoikoretanga o Microsoft Exchange ProxyShell i te tau 2021I whakamahia e ngā kaiwhakaeke ngā hapa hoahoa i roto i ngā tikanga manatoko me te whakahaere urunga a Microsoft Exchange, ā, ka taea e rātou te whakahaere waehere mamao i runga i ngā tūmau ngoikore. Ehara i te hapa whakatinanatanga ēnei ngoikoretanga, engari ko ngā ngoikoretanga hoahoa taketake i taea ai te whakamahi ahakoa i muri i te whakamahinga hē o ngā papaki. E whakaatu ana tēnei takahi i te hiranga o te whakauru i te haumarutanga i te wāhanga hoahoa hei ārai i te hanganga o ngā ngoikoretanga ki roto i te pūnaha.
He aha te hiranga o tēnei mea i tēnei rā? He uaua, he utu nui hoki te whakatika i ngā ngoikoretanga haumarutanga i puta mai i te wā hoahoa, inā koa i roto i ngā taiao whanaketanga kapua-taketake me te tere whanake.
5. Whirihoranga Hē o te Haumarutanga (A05:2021)
He aha te Whirihoranga Hē o te Haumarutanga?
Ka puta ngā whirihoranga hē o te haumarutanga ina whakamahia e ngā kaiwhakaeke ngā pūnaha kāore i whirihorahia tika, pērā i ngā pūnaha e whakamahi ana i ngā tautuhinga taunoa, e waiho ana rānei i ngā tauranga kāore e tika kia tuwhera. Ko ngā whirihoranga hē tonu tētahi o ngā tino take o ngā aituā haumarutanga kapua me ngā taupānga.
Ngā rongoā mō Hē Whakatikatika Haumarutanga
Aunoatia ngā tirotiro whirihoranga mā te whakamahi i Hanganga hei Waehere (IaC) me te whakahaere i ngā arotake haumarutanga auau. Me whakahōu tonu ngā pūnaha katoa ki ngā whakahoutanga hou.
Xygeni's IaC Security Ka matawai i ngā whirihoranga hē i mua i te whakatinanatanga, ā, ka whakatinanahia ngā kaupapa here haumarutanga puta noa i ngā taiao katoa.
Tauira Ao-Tuturu
I roto i te 2018, NASA i pāngia e te takahi nā te mea ngā tautuhinga whirihora hē in Atlassian JIRA i whakaatuhia ngā raraunga tairongo mō te kaupapa me ngā kaimahi. I uru atu ngā kaiwhakaeke ki ngā mōhiohio nā te whirihoranga tuwhera. Mā ngā arowhai haumarutanga aunoa me te whakatinanatanga o ngā kaupapa here whirihoranga tika ka ārai pea i tēnei takahi. Mā ngā arotake auau ka kitea te ngoikoretanga i mua i te whakamahinga a ngā kaiwhakaeke.
He aha te hiranga o tēnei mea i tēnei rā? Ngā ratonga kapua kua whirihorahia he, CI/CD pipelineKo ngā pūnaha whakahaere, ngā ipu, me ngā atanga whakahaere kua kitea kei te noho tonu hei tino take o ngā takahi haumarutanga o ēnei rā.
6. Ngā Wāhanga Whakaraerae me ngā Wāhanga Tawhito (A06:2021)
He aha ngā wāhanga ngoikore me ngā wāhanga tawhito?
Ka puta ngā wāhanga ngoikore, tawhito hoki ina whakamahi koe i ngā whare pukapuka tuatoru, i ngā anga rānei e mōhiotia ana he hapa haumarutanga. Ka taea e ngā kaiwhakaeke te whakamahi i ēnei ngoikoretanga hei whakararu i tō tono. He tūmomo mōrearea tēnei, nā te mea tae atu ki te 60% o ngā tono hou kua hangaia ki ngā wāhanga tuatoru.
Ngā rongoā mō Ngā Wāhanga Whakaraerae me ngā Wāhanga Tawhito
Whakahōu tonu i ngā whare pukapuka me ngā whakawhirinakitanga a te hunga tuatoru, ā, whakamahia te Tātari Hanga Pūmanawa (SCA) ngā taputapu hei kimi me te whakatika i ngā ngoikoretanga.
Xygeni's Open Source Security Ka matawai i ō whakawhirinakitanga hei ārai i te whakamahi i ngā wāhanga tawhito, kino rānei, ā, ka āwhina i a koe ki te pupuri i tētahi taupānga haumaru.
Tauira Ao-Tuturu
In 2017, Apache Struts he ngoikoretanga kāore anō kia whakatikatikaina, ā, i hua ake ai te Te pakaru o Equifax, e pā ana ki te miriona o ngā kaiwhakamahi. I roto i te ngoikoretanga Apache Struts 2, he anga e whakamahia whānuitia ana, ā, kāore a Equifax i pai ki te whakamahi i te papaki i te wā tika. Nā tēnei i waiho ai ā rātou pūnaha kia tūpono ki te whakamahi kino. Mā ngā whakahōutanga wā tika me te matawai i ngā ngoikoretanga auau ka ārai i tēnei takahi.
He aha te hiranga o tēnei mea i tēnei rā? He nui te whakawhirinaki o ngā tono hou ki ngā mōkihi pūtake tuwhera me ngā whare pukapuka tuatoru, ā, e piki haere ana te āwangawanga o AppSec mō ngā whakaekenga mekameka tuku pūmanawa me ngā whakawhirinakitanga ngoikore.
7. Ngā Rahunga Whakamotuhēhēnga (A07:2021)
He aha ngā hapa o te tautuhi me te manatoko?
Ka puta ēnei ngoikoretanga ina ngoikore ngā tikanga motuhēhēnga, ina kore rānei e whakatinanahia tika, ka taea ai e ngā kaiwhakaeke te karo i ngā mana whakahaere haumarutanga.
Ngā rongoā mō Ngā Rahunga o te Tāutu me te Motuhēhēnga
Whakatinanahia ngā kaupapa here kupuhipa pakari, whakatinanahia te manatoko maha-wāhanga (MFA), me te arotake i ngā rangitaki manatoko hei ārai i te urunga kore whakamanatanga.
Mā te Haumarutanga o ngā Mea Ngaro a Xygeni ka tiaki i ō taipitopito tuakiri, ka whakaiti i te tūponotanga o ngā turuturu i te wā o te tukanga manatoko.
Tauira Ao-Tuturu
In 2020, te Kamera haumarutanga mowhiti i puta te takahi i ngā kupuhipa ngoikore. I whakamahia e ngā kaiwhakaeke ngā kupuhipa māmā, ā, i whiwhi urunga atu ki ngā whāngai ataata ora mai i ngā mano tini o ngā kāmera a ngā kaiwhakamahi. E whakaatu ana tēnei takahi i te hiahia nui mō ngā mahi manatoko kaha ake. Nō reira, ko te whakatinanatanga motuhēhēnga-maha-maha (MFA) me te whakakaha ngā kaupapa here kupuhipa kaha kua ngāwari noa iho te aukati i te urunga kore mana.
He aha te hiranga o tēnei mea i tēnei rā? Nā te ngoikore o ngā tikanga manatoko, ka taea tonu te tango i ngā pūkete, te whakakī i ngā tohu tuakiri, me te urunga kore mana puta noa i te SaaS, te kapua, me enterprise tono.
8. Ngā Rahunga Pūmanawa me te Pono Raraunga (A08:2021)
He aha ngā hapa o te pono o ngā pūmanawa me ngā raraunga?
Ka puta ēnei ngoikoretanga ina kore te waehere, te hanganga rānei e tiaki i te takahi ture. Ka taea e ngā kaiwhakaeke te whakararu i te hanganga pipelinengā āhuatanga pēnei i te whakawhirinakitanga, ngā tukanga whakatinanatanga rānei, te werohanga i te waehere kino ki roto i ngā whakahōunga pono. Kua noho tēnei momo hapa hei āwangawanga nui nā te pikinga ake o ngā whakaeke mekameka tuku, ā, ko ngā wāhanga tuatoru pono ka arohia ki te kuhu ki roto i ngā whatunga.
Ngā rongoā mō Ngā Rahunga Pūmanawa me te Pono Raraunga
Hei whakaiti i tēnei, whakatinanahia te hainatanga waehere, whakamahia ngā tukanga hanga haumaru, me te manatoko i te pono o ngā wāhanga tuatoru katoa.
Xygeni's CI/CD Haumarutanga whakarite e koutou pipelineKei te haumaru, kei te aroturukitia hoki ngā āhuatanga rerekē. Ka taea e te Kitenga Āhua rerekē a Xygeni te tautuhi i ngā mahi whakapae e tohu ana i te takahi ture.
Tauira Ao-Tuturu
In 2024, he whakaekenga nui ki te mekameka tuku i arohia Ngā Utils XZ, he whare pukapuka kōpeketanga e whakamahia whānuitia ana i roto i ngā pūnaha Linux. He taputapu nui a XZ Utils e whakamahia ana mō te kōpeke i ngā kōnae, e whakawhirinakihia ana e ngā mano tini o ngā whakahaere. Heoi, i angitu ngā kaiwhakaeke ki te whakararu i te tukanga hanga o te kaupapa mā te werohanga i tētahi kuaha whakamuri ki roto i te waehere.
Kāore i kitea ngā kaiwhakaeke mō tētahi wā, ā, ko te tikanga he ngoikore ngā pūnaha e whakawhirinaki ana ki te whare pukapuka kua takahia ki te whakahaere waehere mamao me te whakamahi kino atu. Nā te mea i pērā ai, ka riro i ēnei kaiwhakaeke te mana whakahaere i ngā pūnaha kua pāngia, ā, ka hua ake he takahi raraunga me te takahi i ngā mōhiohio tairongo.
He whakamahara mārama tēnei āhuatanga ki ngā tūponotanga o te ngā whakaekenga mekameka tuku. Ahakoa he whare pukapuka e tino pono ana, ka taea te whakarerekē hei whakararu i ngā pūnaha maha. Mā te whakarite i ngā tukanga hanga haumaru, te whakamahi i ngā tikanga waitohu-waehere, me te aroturuki tonu i ngā wāhanga tuatoru, ka taea e ngā whakahaere te ārai i aua ngoikoretanga kei uru ki roto i ā rātou pūnaha.
He aha te hiranga o tēnei mea i tēnei rā? Ngā whakaekenga mekameka tuku pūmanawa e aro ana ki te hanga pipelines, ngā rēhita mōkihi, ngā whakawhirinakitanga, me CI/CD kua noho ngā pūnaha hei mōrearea nui mō te whanaketanga pūmanawa o ēnei rā.
9. Ngā Rahunga o te Takiuru me te Aroturuki Haumarutanga (A09:2021)
He aha ngā hapa o te takiuru me te aroturuki haumarutanga?
Ka puta ēnei hapa ina kore ngā tono e tuhi tika i ngā kaupapa haumarutanga, kāore rānei he tikanga aroturuki. Ki te kore he rangitaki taipitopito, ka uaua te kimi me te whakautu ki ngā whakaeke. He maha ngā wā ka whakaroa ēnei ngoikoretanga i te kimi i ngā takahi ture, ka taea ai e ngā kaiwhakaeke te whakamahi kino i ngā pūnaha mō ngā wā roa.
Ngā rongoā mō Ngā Rahunga o te Takiuru me te Aroturuki Haumarutanga
Whakahohehia te takiuru whānui mō ngā mahi nui katoa, rongoatia ngā rangitaki kia haumaru, ā, kia aroturukitia hoki mō ngā mahi whakapae. Hei tāpiri, whakamahia ngā taputapu aunoa hei whakatūpato i a koe ki ngā tūmomo mōrearea pea.
Te Kitenga i te Āhuatanga Kāore i te Tika a Xygeni ka āwhina i te tautuhi i ngā mahi rerekē i te wā tonu. Hei tāpiri, CI/CD Mā te haumarutanga ka whakarite kia whakamahia tonutia ngā whirihoranga takiuru me te aroturuki puta noa i ngā taiao.
Tauira Ao-Tuturu
In 2023, über i pāngia e te pakaru raraunga i i takahia ngā mōhiohio whaiaro o ngā mano tini taraiwaI puta te takahi i te wā i takahia ai e tētahi umanga ture tuatoru, Genova Burns, i pāngia e tētahi aituā haumarutanga, i huraina ai ngā raraunga. Ahakoa i puta ngā whakatūpato, kāore i taea e ngā pūnaha aroturuki a Uber te kite me te urupare wawe ki te whakaekenga.
I uru atu ngā kaiwhakaeke ki ngā mōhiohio tairongo, tae atu ki ngā ingoa, ngā nama waea, me ngā tuhinga taraiwa. Ko te take matua o tēnei whakaroa ko te korenga o te takiuru whānui me ngā pūnaha aroturuki koretake.
Me i aro turuki tika a Uber i te urunga atu ki āna pūnaha, ā, me i whakatinana hoki i ngā tikanga pai ake mō te takiuru raraunga, kua kitea wawetia e rātou te takahi ture. Nō reira, kua whakaitihia pea e te kamupene te kino o te ingoa me ngā mate pūtea. E whakaatu ana tēnei takahi ture i te hiranga o te pupuri i ngā pūnaha takiuru me te aroturuki whai hua hei kite me te whakaiti i ngā tūmomo riri i te wā wawe.
He aha te hiranga o tēnei mea i tēnei rā? Ki te kore e kitea tika, e aroturukitia ana hoki, ka uaua ki ngā whakahaere te kite wawe i ngā whakaeke, ā, ka kore e kitea ngā kaiwhakaeke mō te wā roa.
10. Tono Hūpā taha-tūmau (SSRF) (A10:2021)
He aha te tinihanga tono taha-tūmau?
Ka puta te SSRF ina tinihanga ngā kaiwhakaeke i tētahi tūmau kia tono ki ngā wāhi kāore i te whakaarohia, kia uru atu ai ki ngā ratonga ā-roto e tika ana kia herea. Mā tēnei ngoikoretanga ka taea e ngā kaiwhakaeke te uru atu ki ngā raraunga tairongo, te whakahaere rānei i ngā whakahau i runga i ngā pūnaha ā-roto.
Ngā rongoā mō te SSRF
Hei ārai i te SSRF, manatokohia ngā whakaurunga katoa a ngā kaiwhakamahi, ā, whakawhāitihia te kaha o te tūmau ki te tuku tono ki waho. Hei tāpiri, whakamahia ngā rārangi whakaae hei whakahaere i ngā URL ka taea e te tūmau te uru atu.
Xygeni's CI/CD Ka āwhina te haumarutanga ki te aroturuki pipelines mō ngā ngoikoretanga SSRF pea. Hei tāpiri, ka taea e te Xygeni's Anomaly Detection te hopu i ngā tauira tono ohorere, whakapae rānei.
Tauira Ao-Tuturu
In 2022, he ngoikoretanga nui i roto i Microsoft Exchange (CVE-2022-41040) i whakamahia kinotia e ngā kaiwhakaeke mā te whakamahi i ngā tikanga SSRF. I taea e ngā kaiwhakaeke te tuku tono kino ki te tūmau Exchange, me te karo i ngā parenga haumarutanga ā-roto.
I roto i te whare, ka uru atu ngā kaiwhakaeke ki ngā pūnaha o roto, ā, ka takahia ngā raraunga tairongo. Mā te whakamahi i te SSRF, i whiwhi rātou i te urunga kore whakamanatanga ki ngā rauemi ā-roto kua herea, ā, i arahina atu ai ki ngā takahi haumarutanga nui.
He tino morearea ngā ngoikoretanga SSRF nā te mea ka taea e ngā kaiwhakaeke te uru atu ki ngā pūnaha ā-roto kāore e tika kia whakaaturia ki te marea. Me i whakatinanahia e Microsoft he whakamana whakauru pakari ake me ngā here tono puta atu, kua āraia pea e rātou ngā ngana a ngā kaiwhakaeke ki te whakamahi i tēnei ngoikoretanga. E whakaatu ana tēnei takahi i te hiranga o te whakahaere i ngā tono tūmau ki ngā rauemi ā-roto tairongo, me te whakarite kia taea e ngā puna pono, manatoko anake te taunekeneke ki a rātou.
He aha te hiranga o tēnei mea i tēnei rā? Kua whakapiki ake ngā hoahoa kapua-taketake me ngā API ā-roto i te pānga o ngā ngoikoretanga SSRF, e whakamahia ana e ngā kaiwhakaeke hei uru atu ki ngā ratonga ā-roto tairongo me ngā pūnaha raraunga.
He aha te Hiranga tonu o te OWASP Top 10
te Ngā ngoikoretanga matua 10 o OWASP He mea nui ēnei mō ngā whakahaere e whai ana ki te tiaki i ā rātou tono mai i ngā tūmomo riri tino noa, tino morearea hoki. Ehara ēnei mōrearea i te ariā noa; engari he mōrearea tūturu ka arahi pea ki ngā takahi raraunga, ki te ngaronga pūtea, me te kino o te ingoa pai. Mā te aro atu ki ēnei ngoikoretanga, ka taea e ngā whakahaere te whakaiti i te mōrearea o ngā whakaeke angitu, me te whakarite kia pakari ā rātou pūnaha ki ngā tūmomo riri e whanake haere ana.
Hei tāpiri atu ki tēnā, mā te whakatinana i ngā rongoā kua tūtohutia i roto i te rārangi o ngā ngoikoretanga OWASP Top 10 ka āwhina i ngā whakahaere ki te whai i tētahi huarahi rautaki ki te haumarutanga. Hei tauira, ko te whakapakari i te mana urunga, te tiaki i ngā mahi whakamunatanga, me te whakaiti i ngā mōrearea o te mekameka tuku he mea nui katoa ki te whakatika i ēnei ngoikoretanga. Nō reira, ka whakaitihia e ngā whakahaere te mata o te whakaeke, ka uaua ake mā ngā kaiwhakaeke te whakamahi i ngā ngoikoretanga o te pūnaha.
I te whanaketanga o ngā tūmomo mōrearea ipurangi, he mea nui kia noho mataara tonu ngā whakahaere ki ngā ngoikoretanga pea. Mā te mahi wawe, ka whakarite ngā whakahaere i te tiakitanga mō te wā roa mō ā rātou tono, ā, ka mau tonu te whakawhirinaki o ā rātou kaiwhakamahi.
Haunga ngā ngoikoretanga tuku iho o te OWASP Top 10, kei te piki haere te aro o ngā whakahaere ki ngā mōkihi pūmanawa tuwhera kino, ngā whakaekenga whakapoauau whakawhirinakitanga, ngā kaupapa patopato, ngā waehere haumaru kore i hangaia e te AI, CI/CD pipeline te takahi i te ture, te huraina o ngā mea ngaro, me te pūmanawa kino i roto i te mekameka tuku pūmanawa.
Kei te piki haere te whakakotahitanga o ngā kaupapa AppSec hou i ngā aratohu OWASP me software supply chain security, te haumarutanga AI, me te tātari mōrearea wā-oma hei aro atu ki ngā mata whakaeke e whanake haere ana.
Te Tautoko a Xygeni i ngā Kaupapa OWASP me OWASP SAMM
Te whakatika i te Ngā ngoikoretanga matua 10 o OWASP he mea nui mō te haumarutanga o ngā tono tukutuku. Heoi, kāore e mutu i reira te tiaki i tō tono. Tauira Pakeketanga Pūmanawa Whakapūmau OWASP (SAMM) he anga mō te aromatawai me te whakapai ake i tō pakeketanga haumarutanga puta noa i te huringa ora o te whanaketanga pūmanawa (SDLC). Na te whakauru Mā ngā taputapu haumarutanga whānui a Xygeni, kāore e taea e ngā whakahaere te whakaiti noa i te Ngā ngoikoretanga haumarutanga 10 o runga o OWASP engari ka whakarei ake hoki i tō rātou pakaritanga haumarutanga whānui, e ai ki tā OWASP SAMM i whakamārama ai.
Te Whakapakari i te Haumarutanga Taupānga me Xygeni
Ka whakamanahia e Xygeni ngā whakahaere ki te aro atu ki rārangi o ngā ngoikoretanga 10 o runga o OWASP me te whakateretere i te whakaurunga o te OWASP SAMM, me te āwhina i ngā whakahaere ki te whakapai tonu i te pakeketanga o te haumarutanga pūmanawa. Mā te whakahaere aunoa i ngā mana whakahaere haumarutanga, te whakahohe i te whakatau kaupapa matua e hangai ana ki te mōrearea, me te whakapakari i te whakahaere aituā, ka āwhina a Xygeni i ngā whakahaere ki te hanga pūmanawa haumaru, pakari, me te whakaiti i te mōrearea o ngā takahi haumarutanga.
Mā te aroturukitanga wā-tūturu, te kimi ngoikoretanga aunoa, me te whakatinanatanga kaupapa here puta noa i te SDLC, ka whakangawaritia e Xygeni ngā mahi haumarutanga me te whakatutuki i ngā whakaritenga, e hangai ana ki ngā mahi pai a OWASP SAMM. Mā tēnei ka taea e ngā whakahaere te whakatipu haere i tō rātou pakeketanga haumarutanga, me te whai mahere mārama mō te whakapai tonu.
Me Mahi Inaianei hei Haumaru i ō Taupānga
te Ngā ngoikoretanga matua 10 o OWASP whakamāramahia ngā mōrearea haumarutanga tino nui e pā ana ki ngā tono hou. Mā te whai i te Ngā aratohu a te OWASP me te whakatinana i ngā mahi pai kua whakarārangihia i konei, ka taea e koe tiakina tō whakahaere mai i ēnei tūmomo mōrearea me te hanga taupānga e tū atu ana ki ngā whakaekenga matatini.
Whakapakari i te Haumarutanga o tō Taupānga me Software Supply Chain Security.
He nui ake ngā mahi e hiahiatia ana e ngā tono hou i te matawai ngoikoretanga tuku iho. Xygeni āwhina i ngā whakahaere ki te tautuhi, ki te whakatau i ngā kaupapa matua, me te whakatika i ngā mōrearea 10 o te OWASP puta noa i te waehere pūtake, ngā whakawhirinakitanga pūtake tuwhera, CI/CD pipelines, hanganga kapua, me ngā rerengamahi whanaketanga āwhina-AI.
Tirohia me pēhea te āwhina a Xygeni i ngā tīma AppSec me DevSecOps ki te whakaiti i te mōrearea puta noa i te ao hou. SDLC!
