Kupu Whakataki #
Ka pātai ia kaiwhakawhanake he aha te honeypot i roto i te haumarutanga ipurangi, me te hiranga o taua mea. Ko te honeypot he pūnaha tinihanga e whai ana i ngā ūnga tūturu hei kukume i ngā kaiwhakaeke. Ko te honeypotting e pā ana ki te mahi whakamahi i ēnei mahanga hei aroturuki i ngā whanonga kino, hei kohikohi i ngā mōhiohio mō ngā tūmomo mōrearea, hei whakapakari hoki i ngā parepare. I ēnei rā, kua noho hei mea nui ēnei taputapu tinihanga mō ngā kairangahau me ngā tīma haumarutanga. I roto i tēnei aratohu, ka hipokina e mātou te whakamāramatanga o ngā honeypot, tō rātou tūranga i roto i ngā rautaki parepare, me te pēhea e taea ai e ngā kaiwhakawhanake te whakamahi pai i roto i te DevOps me te… CI/CD pipelines.
He aha te Honeypot? #
He taiao whakahaeretia te honeypot, he mea hanga kia rite ki tētahi pūnaha tūturu. E whakapono ana ngā kaiwhakaeke kua kitea e rātou tētahi tono, ratonga rānei e ngoikore ana, ko ngā kaiwawao ia e aroturuki puku ana i ia mahi hei kohi raraunga.
I roto i te mahi, ka hopukina e te honeypot ngā rautaki, ngā tikanga, me ngā tukanga whakaeke rekoata (TTP). Hei tauira, mā te honeypotting ka taea e ngā kaiwhakawhanake te ako i ngā nganatanga kaha-kino, ngā kawenga hītinihanga, ngā whanonga pūmanawa kino rānei, me te kore e whakararu i ngā pūnaha whakaputa.
Hei tohutoro, CISA e whakaatu ana i ngā honeypots i roto i tana aratohu hangarau tinihanga, ā, e pupuri ana a OWASP i te Kaupapa Honeypot OWASP, e rua ēnei e whakarato ana i ngā rauemi whai hua mō ngā tīma e hiahia ana ki te whakatinana i ēnei tikanga.
He aha te Honeypot i roto i te Haumarutanga Ipurangi? #
I roto i te haumarutanga ipurangi, ehara i te mahanga anake te honipoti — he pūnaha whakatūpato wawe, he puna mōhiohio mō ngā tūmomo mōrearea hoki. Mā te whakatauira i ngā rawa tūturu, ka kitea e ēnei taiao tinihanga ngā urutomo, ka whakararuraru i ngā hoariri, ā, ka whakakitea te whanonga a ngā kaiwhakaeke i roto i te mahi.
He maha ngā wā ka whakamahia ēnei e ngā whakahaere ki:
- Kitea ngā kaipahua i mua i tō rātou taenga ki te mahi whakaputa.
- Hurihia ngā whakaeke kia matara atu i ngā ratonga nui.
- Kohikohi raraunga mō ngā mahi tinihanga hou, ngā pūmanawa kino, me ngā tikanga whakahau-me-te-whakahaere.
He aha Hei Take #
He painga motuhake te whakamahinga o te honi-potting mō ngā mea e rua enterpriseme ngā kaiwhakawhanake:
- Te kitenga wawe: ka tautuhia ngā urutomo i mua i te puta mai o tētahi kino tūturu.
- Te mātauranga mōrearea: ka hopukina ngā taputapu, ngā kawenga, me ngā whanonga a te kaiwhakaeke hei tātaritanga.
- Te wehewehe: ka moumou taima me rauemi ngā hoariri ki te aro ki ngā pūnaha rūpahu.
- Papa whakamātautau haumaru: ka taea te ako motuhake i ngā zero-days, i ngā waka whakapae rānei.
Nō reira, ka tukuna e ngā taiao tinihanga ngā māramatanga e kore e taea e te matawai tuku iho, te pareārai ahi, te pātengi raraunga ngoikoretanga rānei te whakarato.
Nga Ahuatanga Matua #
- Wehenga: Ka wehe motuhake ngā maminga i te mahi whakaputa, ā, ka ārai i ngā kaiwhakaeke ki te pā atu ki ngā rawa tuturu.
- Te taunekeneke iti me te taunekeneke teitei: ko ētahi e whai ana i ngā ratonga taketake anake, ko ētahi ia e whai ana i ngā taiao katoa.
- Whakauru: Ka hopukina e ngā kaiwawao ia mahi a te kaiwhakaeke, kia kitea katoatia ai rātou.
- Te whakahaeretanga mōrearea: Ka hangaia e ngā tīma ngā mahanga me te ārai kaha hei ārai i te tukino.
Te Honeypotting i roto i ngā DevOps Hou me te Kapua #
Kāore te mahi honi i te herea ki ngā taiwhanga rangahau anake. I ēnei rā, kua whakatinanahia e ngā kaiwhakawhanake ngā taiao tinihanga puta noa i te kapua me CI/CD ngā rerengamahi. Hei tauira:
- Ngā pūwāhi API rūpahu hei kimi i ngā waeatanga kino.
- Ngā ipu rūpahu i roto pipelinehei hopu i ngā nganatanga werohanga.
- Ngā mahanga kapua hei takiuru i te urunga kore mana.
Nō reira, ko ngā pūnaha tinihanga i roto i pipelineāwhina i te pupuri i te mekameka tuku pūmanawa. Mō ngā kaiwhakawhanake, ko ēnei ngā mea tinihanga hei whakangungu rakau, hei taputapu ako hoki.
Ngā Wero me ngā Mōrearea o ngā Honeypots #
Ahakoa tōna uara, he maha ngā wero kei roto i ngā hangarau tinihanga:
- Whakatikatika: ka tere te ngaro o te mana o ngā mahanga tawhito.
- Te mōrearea o te tukinoKi te kore e wehea, ka whakamahia pea e ngā hoariri te mahanga tonu.
- Te ti'aturi teka: mā te whakawhirinaki anake ki te tinihanga ka mahue ngā wāhi matapo.
- Te whakauruKi te kore he SIEM/SOAR, tērā pea kāore i te tino whakamahia ngā raraunga kua kohia.
Nō reira, me kī atu ēnei mahanga hei tāpiri, kaua hei whakakapi, i ētahi atu papa tiaki.
Te heke mai o te whakatipu honi #
Ko te heke mai e tohu ana ki ngā hangarau tinihanga atamai ake:
- Ngā mahanga e whakahaerehia ana e te AI e urutau ana i te wā tūturu.
- Te whakaurunga ki ngā whāngai mōrearea o te ao.
- Ngā maminga i roto i ngā rēhita mōkihi, i ngā putunga rūpahu rānei hei whakaatu i ngā tukuake kino.
Nō reira, ka noho tonu te tinihanga hei wāhanga nui o ngā rautaki haumarutanga o ēnei rā.
Te Āwhina a Xygeni #
Ahakoa ka kitea e ngā honipoti ngā tūmomo riri i te wā e mahi tahi ana, Ka ārai a Xygeni i te whakaurunga o te waehere kino pipelinei te tuatahiMā te tūāpapa AppSec katoa-i-te-kotahi a Xygeni e tiaki ngā mōrearea e whakaatuhia ana e ēnei mahanga:
- SAST hei kimi i te waehere haumaru kore.
- SCA hei tohu i ngā whakawhirinakitanga mōrearea.
- Ngā mea ngaro me IaC te matawai hei aukati i ngā tohu tuakiri me ngā whirihoranga hē e kitea ana.
- Te kitenga kino ki te kite i ngā mea whakapae pipeline whanonga.
I runga ake i ngā mea katoa, ka whakarite a Xygeni ehara i te mea ko ngā tīma anake e mārama ana He aha te honeypot i roto i te haumarutanga ipurangi engari ka ārai hoki i ngā tūmomo riri tūturu i mua i te horapa haere.
Tīmatahia he whakaaturanga me Xygeni ā, tirohia me pēhea tō pipelineka taea te pupuri i mua i te taenga atu o ngā kaiwhakaeke.
