Ko tētahi taputapu nui e whai hua ana ki te whakapakari i te haumarutanga pūmanawa ko te Pire Rauemi Pūmanawa, rānei SBOM. Ahakoa SBOMkua roa e whakamahia ana e ngā kaiwhakawhanake pūmanawa, kua tino piki ake te hiranga o ēnei i ngā wā tata nei, inā koa me te tukunga o te Te Whakataunga Whakahaere mō te Whakapai ake i te Haumarutanga Ipurangi o te Motu. Engari he aha te SBOM, ā, he aha i tino hira ai i roto i te ao o te haumarutanga pūmanawa? Me wetewete tātou i ngā mea ngaro, me te tūhura i tō rātou hiranga.
Ripanga o Ihirangi
He aha te mea SBOM?
E mōhio ana koe he aha te SBOM"E ai ki te kōrero a NTIA, "He SBOM he rārangi taonga kua whakapūmautia, he rārangi o ngā kai e hanga ana i ngā wāhanga pūmanawa. " Whakaarohia he rārangi kai mō tētahi tunu kai. Pērā i te tunu kai e whakarārangi ana i ngā wāhanga katoa e hiahiatia ana hei hanga i tētahi rihi, he SBOM e whakarārangi ana i ngā wāhanga katoa me ngā whakawhirinakitanga e hanga ana i tētahi tono pūmanawa. Kei roto i tēnei ko ngā mea katoa mai i ngā whare pukapuka tuwhera me ngā wāhanga tuatoru ki te waehere me ngā raihana rangatira.
SBOM Mā te haumarutanga ka kitea whānuitia ngā poraka hanga o tētahi tono pūmanawa, ā, ka taea e ngā whakahaere te mārama me te whakahaere i ngā mōrearea haumarutanga pea e pā ana ki ia wāhanga. Mā tēnei tirohanga ka taea te aromatawai i ngā ngoikoretanga, te whai i ngā whakahōutanga, me te tautuhi i ngā ngoikoretanga pea i roto i te mekameka tuku pūmanawa.
Ngā Takahanga Matua o te Taraiwa SBOM Adoption
Tuhinga o mua SBOM Kua piki haere te kaha o te haumarutanga i ngā tau tata nei, nā ētahi kaupapa me ngā whanaketanga matua i ārahi:
- Te Whakataunga Whakahaere mō te Whakapai ake i te Haumarutanga Ipurangi o te Motu (EO 14028)I te marama o Mei 2021, i whakaputa te Whare White i te EO 14028, e whakahau ana i te whakamahinga o SBOMmō ētahi pūnaha pūmanawa nui i roto i te kāwanatanga ā-motu, ā, e akiaki ana i te whakamahinga o ēnei pūnaha puta noa i te rāngai tūmataiti.
- National Institute of StandardWhakahōutanga o te Anga Haumarutanga Ipurangi me te Hangarau (NIST)I te tau 2022, i whakahoutia e te NIST tana Anga Haumarutanga Ipurangi kia whakauruhia ai hei mana whakahaere matua mō te whakapai ake software supply chain security.
- Te Whakahaere ā-Ao mō Standardte whakatinanatanga (ISO) Standardwhakatūnga: I te tau 2023, I whakaputaina e ISO te ISO/IEC 5280:2023 standard hoki SBOMs, e whakarato ana i tētahi standardhe huarahi matatau ki te waihanga, ki te whakahaere, me te whakawhiti raraunga.
He aha ngā mōhiohio e SBOM kei roto?
SBOMKei te wātea ngā whakatakotoranga rerekē, he painga me ngā ngoikoretanga o ia whakatakotoranga. Ko te SPDX me te CycloneDX ētahi o ngā mea e whakamahia whānuitia ana. SBOM whakatakotoranga.
Ko te tikanga kei roto i tēnei ko ngā wāhanga matua e whai ake nei:
- Waenga PūmanawaHe rārangi taipitopito o ngā wāhanga pūmanawa katoa e whakamahia ana i roto i te hua, tae atu ki ngā whare pukapuka, ngā anga mahi, me ngā pūnaha rua.
- Ngā Tau PutangaNgā tohu putanga motuhake mō ia wāhanga pūmanawa, e āhei ai te whai me te tautuhi i ngā ngoikoretanga pea.
- Ngā taungaHe mahere e whakaatu ana i ngā whanaungatanga i waenga i ngā wāhanga pūmanawa, e whakaatu ana i te āhua o tā rātou taunekeneke me te whakawhirinaki tetahi ki tetahi.
- MetadataNgā mōhiohio tāpiri e pā ana ki ia wāhanga pūmanawa, pērā i te raihana, ngā taipitopito kaihoko, me ngā mōhiohio mana pupuri.
- Nga ngoikoretanga HaumaruMena kei te wātea, me ngā mōhiohio e pā ana ki ngā ngoikoretanga e mōhiotia ana e pā ana ki ngā wāhanga pūmanawa.
Tauira o CycloneDX SBOM i te hōputu JSON
{ "bomFormat": "CycloneDX", "specVersion": "1.3", "serialNumber": "urn:uuid:6a77d60f-8711-4fb2-ba57-80a8a4a6d2a1", , "version": 1, "metadata": { "timestamp": "2023-10-30T12:30:00Z", "tools": [ { "vendor": "Xygeni.io", "name": "SBOM Generator", "version": "1.0" } ] }, "components": [ { "type": "library", "name": "nacl-library", "version": "1.0.0", "group": "com.example.security", "licenses": [ { "id": "Apache-2.0", "name": "Apache License 2.0", "url": "https://opensource.org/licenses/Apache-2.0" } ] }, { "type": "application", "name": "secure-app", "version": "2.5.1", "group": "com.example.apps", "licenses": [ { "id": "MIT", "name": "MIT License", "url": "https://opensource.org/licenses/MIT" } ], "components": [ { "type": "framework", "name": "Spring Boot", "version": "2.6.0", "licenses": [ { "id": "Apache-2.0", "name": "Apache License 2.0", "url": "https://opensource.org/licenses/Apache-2.0" } ] }, { "type": "library", "name": "log4j", "version": "2.14.1", "licenses": [ { "id": "Apache-2.0", "name": "Apache License 2.0", "url": "https://opensource.org/licenses/Apache-2.0" } ] } ] } ] } He aha SBOM He mea nui te haumarutanga i roto i te haumarutanga pūmanawa
Te Tāutu me te Whakatikatika i te Ngāwaritanga kua Whakapaitia
SBOMHe mea nui te mahi a ēnei ki te tautuhi me te whakatika i ngā ngoikoretanga haumarutanga i roto i ngā tono pūmanawa. Mā te whakarato i tētahi rārangi whānui o ngā wāhanga pūmanawa katoa me ō rātou whakawhirinakitanga, ka taea e ngā whakahaere te:
- Aroturuki i te pūtake o ngā wāhanga: SBOME whakaatu ana ngā kaupapa i ngā takenga mai o ngā wāhanga pūmanawa, e āhei ai ngā whakahaere ki te whai i te waehere pūtake taketake, i te mōkihi rānei, mō ngā whakaaturanga ngoikoretanga me ngā papaki.
- Tāutuhia ngā ngoikoretanga e mōhiotia ana: SBOMKa taea te matawai i ngā pūmanawa ki ngā pātengi raraunga ngoikoretanga hei tautuhi i ngā ngoikoretanga e mōhiotia ana e pā ana ki ngā wāhanga motuhake. Mā tēnei huarahi matatau ka āwhina i ngā whakahaere ki te whakarite i te whakatikatika i ngā ngoikoretanga nui i mua i te whakamahinga a ngā kaiwhakaeke.
- Aunoatia te matawai ngoikoretanga: SBOMKa taea te whakamahi i te s hei whakahaere aunoa i ngā tukanga matawai ngoikoretanga, hei penapena i te wā me te kaha mō ngā kaiwhakawhanake me ngā tīma haumarutanga. Ka taea e tēnei whakahaere aunoa te whakapai ake i te whai huatanga o ngā mahi whakahaere ngoikoretanga.
Te Whakarei Ake i te Whakatutukitanga ki te Haumarutanga Standards
Tuhinga o mua SBOM Kei te piki haere te hiranga o te haumarutanga mō ngā whakahaere kia whakaatu i te tutuki i ngā whakaritenga haumarutanga pūmanawa standardme ngā ture. He maha ngā umanga ahumahi me ngā tari kāwanatanga kua whakahau i te whakamahinga o SBOMs, tae atu ki:
- Te Tari Tiaki o Amerika (DoD): E whakahau ana kia whakamahia SBOMmō ngā pūmanawa katoa i whakawhanakehia mā, i whakamahia rānei e te DoD.
- Te Tari Haumarutanga ā-Motu (NSA): E taunaki ana kia whakamahia hei whakapai ake i te software supply chain security.
- Te Whakahaere Whakawhitiwhiti Kōrero me te Pārongo ā-Motu (NTIA)): E whakatairanga ana i te whanaketanga me te tangohanga o SBOM standardngā aratohu me ngā aratohu.
- te OpenSSF Rōpū MahiHe kaupapa ā-hapori e whakatairanga ana i te standardte whakatinanatanga me te tangohanga o SBOMs.
Mā te whakatutuki i ēnei ture, ka taea e ngā whakahaere te whakaatu i ō rātou pūkenga committe aro ki te haumarutanga tukutuku me te tiaki i a rātou anō i ngā utu whaina me ngā whiu pea.
Whakarei ake i te Puataata me te Whaiwhai
Ka whakatairangahia e rātou te māramatanga me te whai i ngā āhuatanga puta noa i te mekameka tuku pūmanawa. Mā te whakarato i tētahi tirohanga mārama, whānui hoki o ngā wāhanga o te pūmanawa me ō rātou takenga mai, SBOMKa taea e s te āwhina ki te:
- Te tautuhi me te whakaitihia ngā whakaeke mekameka tuku: SBOMKa taea te whakamahi i te s hei tautuhi i ngā ngoikoretanga pea i puta mai i ngā wāhanga, i ngā kaiwhakarato rānei kua takahia. Ka taea te whakamahi i ēnei mōhiohio hei mahi i ngā mahi whakatika hei tiaki i ngā whakaekenga mekameka tuku.
- Whakapai ake i te mahi tahi a ngā kaipupuri hea: SBOMKa taea e ngā mahi te whakahaere i te mahi tahi i waenga i ngā kaiwhakawhanake, ngā tīma haumarutanga, me ētahi atu kaipupuri hea puta noa i te mekameka tuku pūmanawa. Mā tēnei ka āwhina kia mārama te katoa ki te hanganga me te tūnga haumarutanga o te pūmanawa.
Te Urupare Whai Hua mō ngā Aituā
Ka taea e rātou te āwhina ki te whakaiti i te mōrearea o ngā pānga o muri mai i ngā ngoikoretanga haumarutanga mā te:
- Te tautuhi wawe me te whakatikatika: SBOMMā tēnei ka taea e ngā whakahaere te tautuhi me te whakatika i ngā ngoikoretanga i te tīmatanga o te tukanga whakawhanake i mua i te whakatinanatanga ki ngā taiao whakaputa. Ka taea e tēnei te ārai i ngā pānga o muri mai, pērā i te pakaru raraunga me te motuhanga o ngā ratonga.
- Te wā i whakaitihia ki te whakatau: SBOMKa taea e s te whakateretere i te tukanga whakapiripiri mā te whakarato i te māramatanga mārama ki ngā kaiwhakawhanake mō ngā wāhanga e pāngia ana me ō rātou whakawhirinakitanga. Ka taea e tēnei te whakaiti i te wā e pau ana ki te tautuhi me te whakamahi i ngā whakapiripiri, ka whakaiti i te matapihi o te whai wāhi mō ngā kaiwhakaeke ki te whakamahi i ngā ngoikoretanga.
Nga Tikanga Putanga i roto SBOM Te Whakatinanatanga Haumarutanga
I te mea ko te tangohanga o SBOMKei te tipu haere tonu, kei te hangaia te whenua e ētahi au hou:
- Standardte whakahoahoa me te mahi tahi: te standardKo te whakatinanatanga o ngā hōputu, pērā i te CycloneDX, kei te whakatairanga i te mahi tahi i waenga i ngā taputapu me ngā tūāpapa rerekē.
- Te whakaurunga ki a DevOps me CI/CD Pipelines: SBOMkei te whakauruhia ki roto i te DevOps me CI/CD pipelinehei whakahaere aunoa i te whakaputa, te whakahaere, me te tohatoha raraunga.
- Rangi-mai SBOM Nga otinga: Ko te taiao SBOM Kei te puta ake ngā otinga, e whakarato ana i tētahi tūāpapa haumaru, tauine hoki mō ngā whakahaere hei whakahaere i ā rātou raraunga.
- Te Whakanuia o te Mahi Ngātahi me te Hanga Hapori: te SBOM kei te tipu haere te hapori, me te mahi tahi a ngā whakahaere me ngā tāngata takitahi ki ngā kaupapa hei whakatairanga i SBOM te whakatinanatanga me te whanaketanga o te haumarutanga.
Me pēhea taku whiwhi i tētahi SBOM & Whakapai ake i te Haumarutanga o taku Pūmanawa?
Nā te mea kua mōhio koe inaianei he aha te SBOM e mārama ana koe ko te whakaputa me te pupuri i tētahi SBOM He mahi uaua te haumarutanga, inā koa mō ngā whakahaere he nui, he matatini hoki te mekameka tuku pūmanawa. Te tūāpapa o Xygeni ka taea te whakaputa aunoa SBOMs mō ō putunga pūmanawa i roto i ngā whakatakotoranga SPDX me CycloneDX e whakamahia whānuitia ana. Ka whakarite hoki i te tutuki i ngā ture me ngā whakaritenga ahumahi a te kāwanatanga o Amerika standardngā mea pēnei i te Cybersecurity and Infrastructure Security Agency (CISNgā whakaritenga a A).
Te Hurihanga i te Haumarutanga Pūmanawa me te Whakapūmau i te Pono Mamati
SBOM he mana whakarerekē i te ao matihiko, e huri ana i te ao software supply chain security me te whakamana i ngā whakahaere ki te whakatere māia i ngā āhuatanga uaua o ngā pūnaha pūmanawa hou. Nā tō rātou kaha ki te whakarei ake i te māramatanga, te tiaki i te pono, me te whakahaere i ngā ture, he mea nui ēnei mō ngā tīma haumarutanga puta noa i te ao.
Te Whakapai SBOM He mea nui te haumarutanga mō tētahi whakahaere e whai ana ki te whakapai ake i ngā mahi haumarutanga pūmanawa. Te mārama ki te aha te mea he SBOM ka whakarei ake i te tirohanga ki te mekameka tuku, ka āwhina i ngā tīma haumarutanga ki te whakahaere i ngā mōrearea me te whakarite kia tutuki pai ngā whakaritenga.
As SBOM kei te tipu haere tonu te whakamahinga, kei te mārama haere tōna tūranga matua ki te tiaki i ngā pūnaha pūmanawa. Ko ngā whakahaere e tautoko ana i SBOMEhara i te mea ko ngā ngoikoretanga anake tā rātou e whakahaere ana; engari kei te haumi hoki rātou ki te haumarutanga pūmanawa o te heke mai, me te whakarite kia mau tonu te pono me te pakari o ā rātou hanganga mamati. SBOMEhara i te mea he taputapu noa iho ngā mea nei; he mea nui rautaki hoki mā ngā whakahaere e whai ana kia angitu i roto i tētahi ao honohono-rahi, e whakahaerehia ana e ngā raraunga.
