Pamene chaka cha 2023 chikutha, nkhani zokhudza chitetezo cha pa intaneti zikudzaza ndi malipoti ndi kusanthula. Pakati pawo, Kuwunikanso Chaka cha Chitetezo cha pa Intaneti cha NSA 2023 yakopa chidwi. Xygeni, m'chaka chino chovuta, ikufuna kuthandiza kumvetsetsa ndi kuchepetsa zoopsa zomwe zingachitike pa unyolo wopereka mapulogalamu. Munthawi yomwe zovuta za mapulogalamu ndizovuta kwambiri, kudalira kwathu zigawo zotseguka komanso kusintha kwa DevSecOps ndi njira zoyambira pamtambo kwafika pamlingo watsopano. Kuyang'ana uku pang'onopang'ono mu Lipoti la Xygeni imapereka chidziwitso pa mavuto akuluakulu omwe akukumana nawo software supply chain security mu 2023 ndipo akupereka njira zothetsera vutoli mu 2024.
M'ndandanda wazopezekamo
Webusaiti Yovuta ya Software Supply Chain Security
Mu mkhalidwe wa pano wa SSCS, ziwopsezo za pa intaneti zikuchulukirachulukira, zomwe zikubweretsa nkhawa yayikulu kwa makampani ndi anthu pawokha. Kuwonjezeka kwa ntchito zakutali komanso kudalira kwambiri ntchito zochokera ku mitambo kwakulitsa malo owukira, zomwe zapangitsa kuti chitetezo cha unyolo wopereka mapulogalamu chikhale chovuta kwambiri. Kuzindikira kuti unyolo wopereka mapulogalamu wakhala njira yowukira mwadala kukuyamba pang'onopang'ono m'makampani opanga mapulogalamu. Mafunso amabwera: Kodi tingateteze bwanji intaneti yovutayi? Kodi tingakhulupirire mapulogalamu ochokera m'magulu otseguka komanso opereka chithandizo chamalonda? Kodi mabungwe angathandize bwanji ogula mapulogalamu awo kukhala ndi chidaliro pankhani yosakhala ndi zofooka kapena pulogalamu yaumbanda?
Zimene Lipoti la Xygeni Lidzavumbulutsa
Lipoti la Xygeni likufuna kuwunikira zochitika ndi zomwe zafotokozedwa software supply chain security mu 2023 ndipo ikupereka chithunzithunzi choyamba cha zomwe 2024 ingabweretse. Lipotilo lidzafotokoza izi:
Mfundo Zazikulu: "Malinga ndi Manambala"
Chaka cha 'moto wa m'nkhalango wa digito,' 2023 idawona zochitika zazikulu, kuphatikizapo zomwe zidakhudza PyTorch, 3CX, ndi MOVEit Transfer. Zoona zake n'zakuti Mabungwe 82% Pakadali pano ali pachiwopsezo cha kuukiridwa ndi mapulogalamu opereka chithandizo, ndipo chiwerengero chapakati cha zinthu zomwe zili pachiwopsezo mu unyolo wopereka chithandizo chikuwonjezeka ndi zoposa 50% pachaka. NTT Ltd inanena kuti gawo la ukadaulo ndilo makampani omwe amakhudzidwa kwambiri, ndipo ndi 28% ya ziwopsezo zonse za unyolo wopereka chithandizo.
Mapulogalamu otseguka, omwe ali ndi 70% mpaka 90% ya ma stack amakono ogwiritsira ntchito, ikukumana ndi kuwonjezeka kwa ma phukusi oipa m'ma registry a boma - milandu yodabwitsa 245,032, kuwirikiza kawiri ziwerengero za zaka zam'mbuyomu.
Malo Oukira
Mu 2023, ziwopsezo za pa intaneti zinali kukwera, ndipo Bungwe la EU la Chitetezo cha Paintaneti Kulemba zochitika zachitetezo 2,580, 220 mwa izi makamaka zinkayang'ana mayiko angapo omwe ali mamembala. Ziwopsezo za ransomware ndi kukana ntchito zidachuluka, koma ziwopsezo zolunjika pa unyolo wopereka mapulogalamu zidawonedwanso. Chochititsa chidwi n'chakuti, ma chatbot a AI adalowa m'malo owopsa achitetezo cha pa intaneti, zomwe zidayambitsa nkhawa zokhudzana ndi 'zabodza zotsika mtengo' komanso kusintha kwa chidziwitso pogwiritsa ntchito AI.
Njira Zowukira mu 2023
Owukira adapitiliza kugwiritsa ntchito njira zodziwika bwino monga spear phishing ndi social engineering, stolen credentials, ndi ziwopsezo zodalira anthu monga typosquat package. Komabe, mu 2023 njira zamakono zawonjezeka, kuphatikizapo kufuna (Voice Phishing) pogwiritsa ntchito mauthenga opangidwa ndi AI otsanzira mawu. Maphukusi oipa omwe adayikidwa m'malo olembetsera anthu onse adafika pamilandu yoopsa 245,032, zomwe zikugogomezera kufunika koteteza anthu mwamphamvu.
Ochita Zinthu Zoopsa Kwambiri
Magulu andale za dziko anakhudza ntchito za pa intaneti, ndipo mabungwe ochirikiza boma omwe anali ndi udindo wothandiza anthu pa intaneti ankachita zinthu zabodza, zaukazitape, komanso zowononga anthu. Nkhondo ya ku Ukraine inakhala malo ofunikira kwambiri, kuwonetsa ntchito za pa intaneti za anthu aku Russia, Iran, ndi North Korea. China inalimbitsa udindo wake monga CyberPower yapadziko lonse, pomwe upandu wa pa intaneti unapitirira kukula, monga momwe zinachitikira ndi Evasive Panda yaku China yolimbana ndi bungwe lopanda phindu padziko lonse lapansi.
Poganizira kwambiri za mikangano yaposachedwa, mikangano ya pa intaneti pakati pa Hamas ndi Israeli inali yokhudza ziwopsezo za DDoS. Akatswiri ena amalumikiza Hamas ndi zochita zoopseza za ku Iran. APT Agrius yolumikizidwa ndi Iran, yomwe imadziwikanso kuti "Agonizing Serpens," yodziwika bwino ndi ziwopsezo zake zowononga, yakhala ikulimbana kwambiri ndi mabungwe aku Israeli m'magawo ndi mayiko osiyanasiyana. Mu 2023, khama la Agrius lidayang'ana kwambiri magawo a maphunziro ndi ukadaulo ku Israeli.
Zotsatira za Ziwopsezo
Zotsatira za kuukira kwa pa intaneti pa intaneti, monga kuwonongeka kwa makina, kuwonongeka kwa deta, ndi kulowerera, zinaposa zotsatira zachuma ndi chikhalidwe cha anthu. Kafukufuku wa Splunk adawonetsa nthawi ndi zinthu zomwe zagwiritsidwa ntchito poyeretsa, ndipo 4% yokha ya omwe adayankha adati palibe zotsatirapo zazikulu.
Chidule cha Ziwopsezo Zoyenera mu 2023
Chaka chino chakhala ndi ziwopsezo zosiyanasiyana, kuphatikizapo PyTorch nightly InfoStealer, CircleCI incident, 3CX multi-step attack, MOVEit Transfer data brunch, PyPI temporal suspension, NPM Manifest Confusion, JumpCloud attack, ndi VMConnect campaign. Chochitika chilichonse chinawonetsa kusiyanasiyana ndi kusintha kwa ziwopsezo za SSC.
Chisinthiko cha Standardmalamulo ndi malamulo
Ndondomeko yoyendetsera malamulo a SSC ikukonzedwa. Ndi mphamvu zosiyana kwambiri m'madera osiyanasiyana, zikuwoneka kuti US ili ndi dongosolo lokhwima kwambiri, pomwe European Union ikuchedwa. Ndondomeko Yachitetezo Chapadziko Lonse pa Intaneti ndi Mapu a Chitetezo cha Mapulogalamu Otseguka Zinali zochitika zazikulu ku US. Mu EU, Cyber Resilience Act inagwirizana pandale, koma mabungwe ambiri adagwira ntchito motsatira malangizo a NIS2 ndi Digital Operational Resilience Act (DORA).
Mwina chochitika chofunika kwambiri padziko lonse lapansi chinali chitsogozo chogwirizana Kusintha Kuchuluka kwa Chiwopsezo cha Chitetezo cha Paintaneti: Mfundo ndi Njira Zotetezera Mapulogalamu Opangidwa ndi Kapangidwe kutsogozedwa ndi CISNdipo akuluakulu ambiri a zachinsinsi padziko lonse lapansi adagwirizana nawo.
Onani mu 2024
Lipotilo likupereka maulosi ena: Pofika chaka cha 2025, 45% ya mabungwe padziko lonse lapansi adzakumana ndi chiwembu chimodzi cha SSC. Tidzaona magulu a zigawenga ogwirizana akuchita zaupandu pa intaneti, pogwiritsa ntchito zopereka zaupandu wa pa intaneti monga ntchito. Malamulo omwe adzayamba kugwira ntchito chaka chino adzawongolera kuwonekera bwino pazochitika zachitetezo, ndi zambiri zokhudza ziwopsezo ndi maphunziro omwe aphunziridwa. Inshuwalansi ya zoopsa pa intaneti idzawonetsa malire ndi zochulukirapo. Ndipo kupita patsogolo kwaukadaulo kudzagwirizana ndi chitetezo chogwirizana ndi kapangidwe kake chizolowezi, ndi katundu wochulukirapo kumbali ya opanga mapulogalamu.
Mafunde a AI adakopa ogulitsa ambiri achitetezo mu 2023 kuti awonjezere "kukhudza kwa AI" kuzinthu zawo. Komabe, AI ikukonzekera kutenga gawo lofunikira mtsogolo mwa software supply chain security. Luso laukadaulo (AI) lidzakhala ndi gawo lalikulu m'magawo monga nzeru za ziwopsezo ndi kuwunika zoopsa, kuzindikira zolakwika m'malo osungira ma code, kuwunika kufooka ndi kuyika patsogolo, ndi phishing kuukira kuzindikira, koma makamaka mu kukonzanso mwanzeru ndi kuwunikira ma code automation.
Koma ochita zoipa anayamba kugwiritsa ntchito AI, ndipo tiwona njira zatsopano monga kufufuza pogwiritsa ntchito AI, mkondo wokhutiritsa kwambiri phishing, zida za AI zowononga, kapena ntchito zothetsa vuto la CAPTCHA.
Kutsiliza
Pamene Xygeni ikukonzekera kuulula lipoti lake lonse lokhudza momwe zinthu zilili software supply chain security Mu 2023, mavuto ndi ziwopsezo zomwe makampani akukumana nazo zikuonekeratu. Unyolo wopereka mapulogalamu womwe kale unkaonedwa ngati njira yobisika, wayamba kukhala chandamale chachikulu cha adani a pa intaneti. Kuyankha kwa makampaniwa ku mavutowa kudzasintha njira yopezera chitetezo cha mapulogalamu m'zaka zikubwerazi. Khalani tcheru kuti mupeze lipoti lonse pamene tikufufuza mwatsatanetsatane ndikupereka chidziwitso chomwe chingathandize kuyenda m'malo ovuta a software supply chain security.
