Ina pātai te tangata he aha te National Vulnerability Database, e kōrero ana rātou mō te putunga raraunga mana a te kāwanatanga o Amerika e whakakotahi ana, e whakarei ana hoki i ngā raraunga mō ngā ngoikoretanga haumarutanga kua whakakitea ki te marea. Ko te national vulnerability database nvd e whakahaerehia ana e NIST (te National Institute of Standardme te Hangarau) ā, kua hangaia ki runga i te standards penei CVE, CVSS, CPE, me SCAP. I te kī māmā noa, ka tangohia e te NVD National Vulnerability Database ngā tohu tuakiri ngoikoretanga mata (CVE) ka tāpirihia:
- Ngā kaute kaha (CVSS)
- Ngā inenga pānga
- Ngā mahere hua me te putanga (CPE)
- Ngā tohutoro ki ngā tohutohu, ngā papaki, me ngā tuhipoka a te kaihoko
- Ngā hononga ki ngā ngoikoretanga taketake (CWE)
Na mena tō matawai, SCA taputapu, ranei mōrea dashboard kei te whakaatu i ngā ngoikoretanga kua whakarōpūtia me ngā ngoikoretanga kua tohua, he tūponotanga nui kei muri i ngā whakaaturanga ngā raraunga NVD e whakakaha ana i a ia. Koinei te kaupapa matua o te National Vulnerability Database: he mea whakarei ake, standardhe rarangi ngoikoretanga kua whakapūmautia ka taea e ētahi atu taputapu me ngā tukanga te whakamahi aunoa. Kia mārama ai tātou he aha te aukati i te ngaronga raraunga i tēnei ao tohatoha, ka mutu tātou me ngā wāhi matapo i muaciste wāhi tino pai e noho humarie ai ngā kaiwhakaeke.
He aha ngā raraunga kei roto i te Pūtake Raraunga Whakaraerae ā-Motu o NVD? #
Hei mārama ki te Pūtake Raraunga Whakaraerae ā-Motu, he mea whai hua mā DevSecOps, he mea āwhina ki te wehewehe i ngā mea e rongoatia ana, e whakaputaina ana hoki e ia:
- Ngā tāurunga ngoikore e hangai ana ki te CVE: Ko ia tuhinga i roto i te Pūtake Raraunga Whakaraerae ā-Motu e hangai ana ki tētahi ID CVE, ā, kei roto hoki he whakaahuatanga taipitopito ake, ngā hua e pāngia ana, me ngā tohutoro hangarau.
- Ngā mōhiohio mō te kaha me te pānga: Ka tohaina e te Pūtake Raraunga Whakaraerae ā-Motu o NVD ngā kaute CVSS (v2/v3), ngā inenga pānga, me ētahi taipitopito whakamahinga, e whakamahia ana e ngā taputapu hei whakatau i ngā mahi whakaora.
- Ngā mahere hua me te whirihoranga: Ka hono a NVD i ngā ngoikoretanga ki ngā kaihoko, hua, me ngā putanga motuhake mā roto i ngā tohu tautuhi CPE, me ngā rārangi arowhai whirihoranga hei tautoko i ngā turanga turanga haumaru.
- Te whakarōpūtanga ngoikore (CWE): He maha ngā wā ka whakahuatia ngā CWE e ngā whakaurunga e tohu ana i te ngoikore o te waehere, o te hoahoa rānei, e whakarato ana i te horopaki e whai hua ana mō te waehere haumaru me ngā kaupapa AppSec.
- Ngā API me ngā whāngai raraunga: Ka whakaatuhia e te Pūtake Raraunga ngā whāngai JSON me ngā API kia taea ai e ngā taputapu te tukutahi aunoa i ngā raraunga ngoikoretanga, ngā kaute, me ngā kōrero a te kaihoko ki roto dashboardngā matawai, me ngā CI/CD pipelines.
Mai i te tirohanga a DevSecOps, he aha te National Vulnerability Database mēnā ehara i te reo e whakamahia whānuitia ana e ēnei taputapu katoa hei kōrero mō ngā ngoikoretanga i ngā wā katoa?
He aha ngā take e aro nui ai ngā tīma DevSecOps ki te NVD? #
Mō ngā tīma DevSecOps me AppSec, ehara te NVD National Vulnerability Database i te paetukutuku engari he whakawhirinakitanga huna kua whakauruhia ki roto i tā rātou mekameka taputapu katoa.
SCA ngā taputapu, ngā matawai ipu, ngā matawai mōkihi OS, ngā matawai hanganga, me te maha atu CI/CD haumarutanga whakamahia te National Vulnerability Database NVD ki te:
- Whakatauhia he CVE ID ki tētahi whakaahuatanga whai tikanga
- Ngā kaute kaha o te kukume me ngā inenga āheinga whakamahi
- Maherehia ngā ngoikoretanga ki ngā putanga whare pukapuka, ki ngā whakaahua rānei
- Whāngaihia ngā raraunga mōrearea ki roto i ngā pūnaha tikiti me ngā inenga dashboards
Koia te take he pātai mō te aha te National Vulnerability Database he pātai mō "Nō hea ā mātou kitenga ngoikoretanga, ā, ka taea e mātou te whakawhirinaki ki a rātou?" Mā te mārama ki te NVD National Vulnerability Database ka whakamārama he aha i puta ohorere ai tō whakahōunga iti i roto i te whare pukapuka. dashboards, he aha rānei te take e ahua mōrearea ai ētahi take ahakoa te āhua ngaro.
Ngā Whakaaro Hē Noa mō te NVD #
Pērā i ngā whakaeke mekameka tuku taonga, i ngā mōkihi kino rānei, he maha ngā whakaaro hē mō te mea he National Vulnerability Database me ngā mea ka taea, kāore rānei e taea e ia te mahi.
He whakaaro hē #1: He wā tūturu te NVD, ā, he oti hoki #
He tokomaha e whakaaro ana kei te hou tonu te NVD mō ia CVE. Inaa, ka mahi te NVD i tētahi whakarangatira taahiraa: ka tangohia ngā tuhinga CVE taketake, ka tāpirihia he kaute, he mahere hua, me ētahi atu raraunga raraunga. He roa te wā e pau ana ki taua mahi tāpiri, ā, mai i te tau 2024, kua hua ake ngā rārangi mahi kua tuhia pai, me ngā whakaroa i te tātari katoa i ngā ngoikoretanga hou. Mō ngā tīma DevSecOps, ko te tikanga o tēnei ko ētahi o ngā CVE e kitea ana e koe i roto i ō taputapu ka puta wawe mai me ngā raraunga hapa, ka roa rānei te wā ka puta mai me te horopaki katoa. He mana te Pūtake Raraunga Whakaraerae ā-Motu o NVD, engari kāore i te tere tonu.
He whakaaro hē #2: He matawai ngoikore te NVD #
Ko tētahi atu whakaaro hē mō te NVD ko te whakaaro he matawai hohe e tirotiro ana i tō taiao. Kāore. Ko te National Vulnerability Database NVD he huinga raraunga tohutoro, ehara i te miihini kimi. Ō matawai, SCA ngā taputapu, me ngā kaihoko e mahi ana i te kimi. Kātahi ka maherehia e rātou ngā pūmanawa me ngā whirihoranga kua kitea ki ngā raraunga kei roto i te National Vulnerability Database hei whakatau ko ēhea CVE e tika ana me te kaha o aua mea.
Whakaaro hē #3: Ki te kore i roto i te NVD, ehara i te raruraru #
He tino morearea tēnei i roto i software supply chain securityEhara i te mea ka puta katoa ngā mōrearea hei CVE, ā, ehara i te mea ka tino whakareihia katoatia ngā ngoikoretanga i roto i te NVD i te wā tika. Kua whakaatuhia e ngā rangahau te āhua o te whakaroa o te tātari, te ngaro rānei o ngā raraunga raraunga i roto i te NVD, ka waiho ngā whakahaere ki ngā āputa, inā koa ka whakawhirinaki rātou ki te NVD hei puna pono anake. Mō ngā tīma DevSecOps, me mārama te pātengi raraunga hei kotahi te whakauru arohaehae, kaua te kōrero katoa.ens.
Me pēhea te whakamahi pai i te NVD National Vulnerability Database i roto i te DevSecOps? #
Mena kei te whakamahi koe i te hangarau hou pipelines, kāore koe e whakamahi ā-ringa i te NVD; mā āu taputapu e mahi tēnā māu. Engari ka taea tonu e koe te hoahoa i tō kaupapa i runga i te tirohanga tūturu o te Pūtake Raraunga Whakaraerae ā-Motu me tōna wāhi e tika ana. He huarahi mahi:
- Whakamahia te NVD hei paparanga whakataurite: Whakamahia ngā taputapu e whakawhirinaki ana ki ngā raraunga NVD o te National Vulnerability Database kia ōrite ai ngā CVE, te kaha, me ngā hua puta noa i te matawai, te pūrongo, me te dashboards.
- Whakakotahitia te NVD me ngā tohutohu a te kaihoko, ā, whakamahia te mātauranga: Nā te mea ka taea e te whakarei ake i te Pūtake Raraunga Whakaraerae ā-Motu o NVD te whakaroa, te kukume mai i ngā tohutohu kaihoko, te mōhiohio mōrearea, me te whakamahi i ngā whāngai hei whakakī i ngā āputa me te whakarite i ngā mōrearea o te ao tūturu.
- Whakawhiti raraunga e hangai ana ki te NVD ki roto CI/CD: Whakauruhia ngā matawai me SCA ngā taputapu e whakamahi ana i roto i tōu pipelinekia tirohia ai ngā hanganga hou ki ngā raraunga ngoikoretanga hou i mua i te whakatinanatanga.
- Maherehia ngā raraunga NVD ki SBOMngā kauwhata whakawhirinakitanga me ngā kauwhata: Mō te haumarutanga mekameka tuku, hono atu SBOMka maherehia e s me te whakawhirinakitanga ki ngā tāurunga NVD. Mā tēnei ka taea e koe te whakautu wawe: "Ko tēhea pipelineme ngā ratonga e pāngia ana e tēnei CVE?”
5. Kia mōhio ki ngā herenga, inā koa mō ngā mōkihi kino: Ko ngā pātengi raraunga e aro ana ki te CVE e arotahi ana ki ngā ngoikoretanga kua whakakitea, ehara i te mea ko ngā mōkihi kino, ko ngā wāhanga kua huna i roto i ngā rēhita tūmatanui rānei. Koinei te wāhi e puta ai ngā taputapu tautoko (pēnei i Xygeni (tētahi atu tūāpapa haumarutanga mekameka tuku rānei) ka kohia ngā mea kāore e taea e te NVD te hipoki ko ia anake.
Te Wāhi e Tū ai te NVD i roto i tētahi Rautaki Whakaraerae Hou? #
Nā, me hoki whakamuri tātou: he aha te tikanga o tēnei mea i roto i ngā tikanga rautaki?
- Ko te rārangi tohutoro e whakamahia ana e te nuinga o te umanga hei whakaahua me te tatau i ngā ngoikoretanga.
- Ko te standardpūtake raraunga e hangai ana ki te s e āhei ai ngā taputapu ki te kōrero i tētahi reo noa mō te mōrearea.
- He mea whakaurunga nui Tuhinga o mua whakahaere ngoikoretanga, DevSecOps, me ngā kaupapa hanganga ture.
- ko reira e kore he matawai, ehara i te mea katoa pūnaha whakatūpato wawe, ehara i te mea hei whakakapi mō te haumarutanga mekameka tuku, mō te whakamahi kino rānei i te mōhiohio.
Ki te mea kei te whakatū koe i tō whakahaere ngoikoretanga i runga i te Pūtake Raraunga NVD, kei roto koe i te kamupene pai: tata ki te katoa e pena ana. Ko te mahi nui ko te mārama ki te Pūtake Raraunga Whakaraerae ā-Motu o NVD hei tūāpapa, kaua ko te whare katoa.
Whakamahia hei whakataurite, hei whakatauranga, hei kapinga hoki. Whakanuia ki ngā tohutohu a te kaihoko, whakamahia ngā raraunga, me ngā mea kua whakatapua software supply chain security. Ā, kia tino mohio kei a koe ō DevSecOps pipelineKaua ko āu pūrongo hauwhā anake, engari me whakarongo ki ngā kōrero a te National Vulnerability Database ki a koe.
Koinā te huarahi e huri ai koe i te whakautu ki te pātai he aha te National Vulnerability Database mai i te whakamāramatanga maroke hei mea e hanga ana i te āhua o te tuku me te tiaki i ngā pūmanawa.
