He aha te OWASP? Ko tōna tikanga ko te Open Web Application Security Project, he whakahaere kore-painga e whakatapua ana ki te whakarei ake i te haumarutanga o ngā pūmanawaMō ngā tohunga i roto i te whanaketanga me te haumarutanga, inā koa ko te hunga e mahi ana i roto i te DevSecOps, he mea nui te mārama ki te tikanga o te OWASP. Ka whakaratohia he taputapu, he mahi pai, me te mātauranga e tika ana mō te hanga tono haumaru.
He mea nui te mārama ki te kaupapa me ngā takoha a te Open Web Application Security Project mō ngā tīma e whai ana ki te whakaiti i ngā mōrearea, ki te whakatutuki i ngā paearu haumarutanga, me te whakawhanake i ngā pūmanawa pakari mai i te tīmatanga.
Tautuhinga:
He aha te tikanga o te OWASP? #
Hei whakautu i te tikanga o te OWASP: e pā ana ki te Kaupapa Haumarutanga Taupānga Tukutuku Tuwhera, i whakatūria i te tau 2001 hei kaupapa ā-ao e whakatairanga ana i ngā rauemi tuwhera-pūtake hei āwhina i ngā whakahaere ki te hoahoa, ki te hanga, me te whakahaere i ngā pūmanawa haumaru. Ko te "tuwhera" i roto i te OWASP e whakanui ana i ōna committe whakapau kaha ki te whakarite kia wātea noa ngā rauemi me ngā taputapu katoa. Kei roto i ngā kaitautoko ko ngā kaiwhakawhanake, ngā kaiwhakamātautau, ngā miihini haumarutanga, me ētahi atu tohunga hangarau mōhiohio e mahi tahi ana ki te whakaputa ihirangi kua arotakehia e ngā hoa. Mā tēnei tauira ka wātea whānuitia ngā aratohu pono me te kore he here raihana.
Te Kaupapa a OWASP mō te Haumarutanga Pūmanawa #
Mā te mārama ki te tikanga o te OWASP, ka mōhio koe ki tana kaupapa matua: kia whakamanahia ngā tīma pūmanawa ki ngā mōhiotanga haumarutanga ka taea te whakamahi. Ka honoa te āputa whakawhitiwhiti kōrero i waenga i ngā tūranga whakawhanake me te haumarutanga mā te whakaputa:
- Waehere haumaru standards
- Nga rauemi matauranga
- Ngā taputapu whakamātautau haumarutanga
- Ngā anga mahi kua whānuitia te whakamahi pērā i te OWASP Top 10
Mā ēnei tuku ka āwhina i te whakaiti i te arai whakaurunga mō te whakauru i ngā mahi haumarutanga ki roto i ia wāhanga o te huringa ora o te whanaketanga pūmanawa, kia rite tonu ki Ngā mātāpono o DevSecOps.
He aha te hiranga o OWASP ki a DevSecOps? #
He aha te OWASP i roto i te horopaki o DevSecOps? He rauemi taketake e whakauru ana i te haumarutanga i roto i ngā rerengamahi whakauru me te whakatinanatanga tonu. Mā te mārama ki te tikanga o te OWASP ka āwhina i ngā tīma ki te whakamahi pai i ngā taputapu me te mātauranga ki te kite wawe i ngā ngoikoretanga, te whakamahi i ngā tikanga waehere haumaru me te whakangungu i ngā kaiwhakawhanake mō ngā tūmomo riri o te ao tūturu. Ka tautokohia hoki e ia ngā mahi matua pēnei i te whakatauira tūmomo riri, te whirihoranga haumaru, me te arotake waehere.
Ngā OWASP Top 10: He Tohutoro Taketake #
Ko tētahi o ngā hua matua o te Kaupapa Haumarutanga Taupānga Tukutuku Tuwhera ko te OWASP Top 10, e whakamārama ana i ngā take haumarutanga tino nui i roto i ngā taupānga tukutuku. Ka whakahoutia i ia wā i runga i ngā raraunga ā-ao, ka āwhina i ngā tīma ki te whakatau i ngā kaupapa matua me te mārama ki ngā tūmomo riri nui pēnei i:
- Mana Uru Pakaru
- Ngā Rahunga Tuhimana
- Injection
- Hoahoa Haumaru
He maha ngā wā ka whakamahia e ngā tohunga haumarutanga ngā Top 10 hei pūtake mō te tutuki i ngā whakaritenga, te tirotiro waehere, me te mātauranga a ngā kaiwhakawhanake. Ko te mōhio ki te tikanga o OWASP ko te mārama ki te tūranga o tēnei tohutoro nui ki te hanga i te whanaketanga haumaru. standards.
Ngā Kaupapa Kē Atu e Hira Ana ki a DevSecOps #
Haunga ngā 10 o runga, he maha ngā taputapu me ngā anga e tukuna ana e OWASP e tika ana mō ngā tikanga DevSecOps:
- ASVS (Manatoko Haumarutanga Taupānga) Standard): E whakatakoto ana i ngā whakaritenga mō te whakawhanaketanga me te whakamātautau taupānga haumaru.
- SAMM (Tauira Pakeketanga Pūmanawa Whakapūmau): Aromatawai me te whakarei ake i ngā mahi haumarutanga pūmanawa a te whakahaere.
- OWASP ZAP: He taputapu DAST tuwhera-pūtake e whakamahia ana hei tautuhi i ngā ngoikoretanga mā te matawai aunoa.
- Tirotiro Whakawhirinakitanga: Ka tātari i ngā whakawhirinakitanga kaupapa mō ngā take haumarutanga e mōhiotia ana.
- Raupapa Pepa Tinihanga: Ka whakarato i te concisngā tohutohu mahi pai rawa atu mā ngā kaiwhakawhanake.
E whakaatu ana ēnei kaupapa i te kaupapa matua o te Kaupapa Haumarutanga Taupānga Tukutuku Tuwhera: te waihanga i te tautoko e wātea ana, e taea ai te mahi, mō te tuku pūmanawa haumaru.
Ngā Pānga ki te Whakatutukitanga #
Ahakoa ehara i te hinonga ture, he mana nui a OWASP i roto i ngā anga hanganga ture. Hei tauira:
- Kei roto i te PCI DSS ngā aratohu OWASP mō te whakawhanaketanga waehere haumaru.
- ISO / IEC 27001 a Ngā anga NIST kia rite ki ngā rautaki whakahaere mōrearea a OWASP.
- I te nuinga o te wā ka whakatauritea ngā arotake haumarutanga ki te OWASP Top 10.
Mā te whai i ngā whakaritenga o te Kaupapa Haumarutanga Taupānga Tukutuku Tuwhera, ka taea e ngā whakahaere te whakaatu pai ake i te aro nui ki te haumarutanga me te whakatutuki i ngā tumanakohanga arotake. He mea nui te mārama ki te tikanga o te OWASP ina whakamahia ana āna taputapu hei tautoko i ngā hiahia whakahaere me ngā ture.
Te Noho Tūturu o te Hapori me te Kaihoko #
Ko tētahi o ngā āhuatanga tino nui o te OWASP ko tana tauira kore-kaihoko, e whakahaerehia ana e te hapori. Ka mahi a OWASP me te kore whakaaro arumoni, me te whakarite kia tutuki i ngā taputapu me ngā tuhinga ngā taiao whanaketanga me ngā hiahia haumarutanga rerekē.
Nā tēnei huarahi kore whakaaro motuhake kua whakatūria te OWASP hei mana pono puta noa i ngā ahumahi. He pai ana anga urutau mō te whānuitanga o ngā tūāpapa, mai i ngā tono kapua taketake ki ngā pūnaha tawhito.
Uara ki te Kaiārahi Haumarutanga #
Mō ngā kaiārahi haumarutanga, ko te mārama ki te tikanga o te OWASP he hanganga nui mō te hanga me te whakahaere i ngā kaupapa haumarutanga tono. Ka tautokona e ōna rauemi:
- Te whakamahere rautaki me te whakawhanake mahere huarahi
- Te whakamārama i ngā haumitanga haumarutanga
- Te hoahoa i ngā kaupapa whakangungu kaiwhakawhanake
Mā te OWASP Top 10, ka āwhina i te whakawhitiwhiti kōrero i waenga i ngā kaipupuri hea hangarau me ngā kaipupuri hea kore-hangarau mā te whakamaori i ngā mōrearea ki ngā kupu mārama, e mārama ai.
Na, He aha te mea nui ki a DevSecOps? #
Nā te mea kua mōhio koe ki tēnei mea, ka taea e koe te tīmata ki te whakauru i te haumarutanga puta noa i te huringa whanaketanga, kia taea ai: te kimi wawe i ngā ngoikoretanga, te whakamana tonu i te haumarutanga, te tautoko i ngā whakaritenga, te whakangungu haumarutanga tauine me te maha atu. Mai i te matawai whakawhirinakitanga ki te waehere haumaru ki te rite ki te whakaritenga, ka whakaratohia he turanga mō ngā whakahaere e whai ana ki te build security ki roto i ia paparanga o tā rātou hoahoa pūmanawa. Ina pātai koe he aha te tikanga o OWASP, kei te kōrero koe mō tētahi o ngā mana tino whai pānga i roto i te haumarutanga tono hou.
Tuhinga rite Xygeni hei tautoko i ngā whāinga a OWASP mā te whakahohe i software supply chain security me te tirohanga puta noa CI/CD pipelines, hei tautoko anō i te whakatinanatanga o ōna mātāpono i roto i ngā taiao DevSecOps o te ao tūturu.
#
Mātakihia tā mātou Haerenga Hua or Whakaritea he Whakamātau Free!
