Zviri Mukati
Zero Trust inzira itsva inopikisa pfungwa yekare yekuvimba kusina kujeka, ichida kusimbiswa nekusimbiswa nguva dzose. Zero Trust inobuda sechiratidzo chetariro mukusawirirana kwe Software Supply Chain Security (SSCS), uko kuvimba kuri chinhu chinodhura. Kusiya fungidziro dzekare, kunoisa ziso rekunzwisisa pamushandisi wese, mudziyo, uye mashandisirwo, kunyanya zvakakosha pakuchengetedza kuvimbika kwezvigadzirwa zvesoftware nenzvimbo dzazvo—zvivharo zvesoftware yakachengetekaTibatanei parwendo rwekuchengetedzwa kusingazununguki sezvatinopinda munyika yeZero Trust uye SSCS, uko kuvimba kunowanikwa, kwete kungofungidzirwa.
Kusavimba ne SSCS: Kusimudzira Kuchengetedzwa kuburikidza neKuvimbika Kusingazununguki
Zero Trust yave nzira yekuchengetedzwa inozivikanwa zvikuru. Masangano mazhinji akashandisa misimboti yayo yekuvandudza mamiriro avo ekuchengetedzwa munyika yedhijitari iri kuramba ichibatana uye yakaoma. Sekureva kwemumwe munhu Ongororo yeArmis, 33% yevashandi veIT vaitarisira kuti masangano avo aizoshandisa mamodheru eZero Trust muna 2023. Mafungiro aya akakosha zvikuru munharaunda ye SSCS, uko kuvimbika kwezvinhu zvakagadzirwa nesoftware nenzvimbo dzazvo dzekuchengetedza kwakakosha.
Patinotendeukira kunharaunda ye Software Supply Chain Security (SSCS), chinangwa chedu chinogumira pakusimba kwesoftware artifacts nereserve dzinovachengeta. Munyaya iyi, kuvimbana hakusi chinhu chakapihwa; mhedzisiro yakananga yekusimba kusingachinji. Sezvo software artifacts dzichifamba mumareserve akasiyana-siyana, dzichigara dzichichinja uye dzichibatanidzwa, pamwe chete dzinoumba chigadzirwa chekupedzisira.
Mukuita uku kwakaoma, kuve nechokwadi chekuti zvinhu izvi zvakagadzirwa zvakanaka uye matura acho akachengetedzwa zvakanaka ndicho chinhu chakakosha, sezvo kuvimbika uku ndiko kunoita kuti vanhu vavimbe.
Muenzaniso weZero Trust unofunga kuti kutyisidzira kunogona kuvapo kunze, uye mukati mesangano, zvichisimbisa kuti kuvimbana hakufanirwe kuva pachena.
Nheyo huru dzepfungwa dzeZero Trust maererano nehurongwa hwekugovera software dzinosanganisira:
- Simbisa zvese, usavimbe nechinhu. Iyi nheyo ndiyo musimboti weZero Trust uye inoshandawo kune software supply chain. Zvese zvigadzirwa zvesoftware, kubva ku source code kusvika kune zvakashandiswa, zvinofanirwa kuongororwa kuti ndezvechokwadi uye zvakarurama here zvisati zvashandiswa.
- Kuwana mukana wekuwana ropafadzo shoma. Ingopa vashandisi nemasisitimu mukana wavanoda chete wekuita mabasa avo. Izvi zvinobatsira kuderedza nzvimbo yekurwiswa uye kudzivirira vanhu vane hutsinye kuti vasawane mukana wekushandisa zvinhu zvinokuvadza.
Kutarisa nekuongorora nguva dzose. Zero Trust haisi nzira yekuchengetedza zvinhu nguva dzose. Inoda kugara uchitarisa uye uchiongorora software supply chain kuti uone uye upindure kutyisidziro.
Zero Trust ingashandiswa sei muchikamu chekugovera software?
Danho rekudzivirira: Kusimbisa Maitiro Ekugadzira Software
Kuisa Zero Trust muzvirongwa zvinobudirira SSCS, seti yakazara yematanho ekudzivirira akakosha. Kuchengetedza maitiro ekugadzira software kubva mukukanganiswa kwakaipa uye kudzivirira kuunzwa kwekuvandudzwa kwemakodhi anokuvadza kunoda nzira huru dzekudzivirira:
Access Control:
- Shandisai basa-based access control (RBAC) kudzora kupinda mumakodhi uye kuvaka nzvimbo zvichienderana nemabasa evashandisi nemvumo.
- Shandisa two-factor authentication (2FA) kusimbisa authentication uye kuita kuti zviomere varwisi kuwana mukana usina mvumo.
- Shandisa mukana wekuwana ruzivo rushoma kuitira kuti vashandisi nemagwaro kana kuti ma integrations vawane mukana wekuwana zviwanikwa zvavanoda chete kuti vaite mabasa avo.
Kusaina Zvinhu:
- Zvinoda kusaina zvese zvishandiso zvesoftware zvinoshandiswa mukugadzirwa.
- Shandisa simba rekusaina rakavimbika (CA) kuti uone kuti siginecha yega yega yezvikamu ndeyechokwadi.
- Shandisa otomatiki kusaina magwaro kuti uve nechokwadi chekuti zvese zvishandiso zvesoftware zvasainwa zvisati zvaiswa.
Nekuisa chibvumirano, masangano anogona kuderedza njodzi yekupinzwa kwekodhi yakaipa muchikamu chekutengesa software.
Kuona Kodhi Yakaipa:
- Shandisa static analysis kuti uone kodhi yakaipa iri mu pipelines uye zvigadzirwa zvesoftware.
- Shandisa sandboxing nedzimwe nzira dzekutsvaga nekuongorora zvinhu zvesoftware zvisati zvashandiswa.
Kuvimbiswa Kwekuvimbika: Kuchengetedza Kuchena Kwezvinhu Zvishandiso zveSoftware
Kusavimba ne SSCS Inoenderera mberi nekudzivirira kurwiswa kwakaipa kusvika pakuona kuti zvigadzirwa zvesoftware zvakavimbika muhupenyu hwese hwekugadzira, zvinosanganisira:
Kutevera Kubva uye Zvipupuriro:
- Shandisa sisitimu yekutevera mavambo uye shanduko dzezvese zvigadzirwa zvesoftware muhupenyu hwese hwekugadzira. Izvi zvinogona kuitwa uchishandisa nzira dzakasiyana-siyana, dzakadai se blockchain technology, digital watermarking, uye hash-based signatures.
- Shandisa kutevedza kwakabva ruzivo kuti uone uye uongorore zviitiko zvinofungirwa muchikamu chekutengesa software. Semuenzaniso, kana chinhu chesoftware chikagadziriswa nenzira isina mvumo, kutevedza kwakabva ruzivo kunogona kushandiswa kutsvaga kwakabva shanduko uye kutora matanho ekugadzirisa.
Nekutevera mavambo uye shanduko dzesoftware, masangano anogona kuita kuti zviomere varwisi kuvanza mabasa avo ehuipi. Semuenzaniso, dai SolarWinds yakashandisa provenance tracking, zvingadai zvakava nyore kuziva kwakabva kodhi yehuipi yakapinzwa muOrion SDK.
Zvivakwa Zvinogona Kudzokororwa:
- Shandisa nzvimbo dzekuvaka dzinokwanisa kudzokororwa dzinogara dzichigadzira zvinhu zvakafanana zvesoftware kubva kukodhi imwe chete. Izvi zvinogona kuitwa nekushandisa maturusi akadai seDocker nePacker kugadzira nzvimbo dzekuvaka dzisingachinjiki.
- Shandisa zvinhu zvinodzokororwa kuti uone kana software artifacts dziripo padanho rega rega rekugadzira software. Semuenzaniso, unogona kushandisa checksum kuti uone kuti software artifact haina kumbokanganiswa kubva payakagadzirwa.
Nekushandisa ma reproducible builds, masangano anogona kuderedza njodzi yekupinzwa kwekodhi yakaipa mu software supply chain panguva yekuvaka. Semuenzaniso, muna 2020, SolarWinds Orion software yakakanganiswa neboka reRussia re cyber espionage. Varwisi vakakwanisa kuisa kodhi yakaipa mu software, iyo yakazogoverwa kune vatengi veSolarWinds pasi rese. Kurwiswa uku kwakabudirira nekuti nharaunda yekuvaka yeSolarWinds yakanga isingagone kuitwezve.
Dai SolarWinds yakaita kuti pave nekugadzira mapurogiramu anogona kudzokororwa, vapambi vangadai vasina kukwanisa kuisa kodhi yakaipa musoftware vasina kuonekwa.
Kusimbiswa Kwekuvimbika Kwezvinhu Zvakagadzirwa:
Shandisa masaini edhijitari uye ma hashe e cryptographic kuti uone kuti software artifacts dzakasimba here padanho rega rega rekugadzira. Izvi zvinogona kuitwa uchishandisa maturusi akadai se Xygeni Build Security.
- Shandisa certification ye artifact integrity kuti uone shanduko dzisina mvumo dze software artifacts. Semuenzaniso, kana software artifact ikagadziriswa nenzira isina mvumo, certification ye artifact integrity ichaona shanduko yacho uye ichaburitsa yambiro.
Nekushandisa matanho ekusimbisa kuvimbika kwezvinhu zvakagadzirwa, masangano anogona kuderedza njodzi yekupinzwa kwekodhi yakaipa muchikamu chekugovera software pane chero nhanho yekugadzira nekutumira.
Pazasi pane muenzaniso wekuti musanganiswa wezviyero izvi ungabatanidzwa sei mu CI/CD pipeline:
- 1. Kusimbiswa kweMushandisi: Mushandisi anopinda musystem achishandisa two-factor authentication (2FA) kuti awedzere kuchengetedzeka.
- 2. Kuongorora Kudzora Kupinda Mubasa (RBAC): Kutarisira Kodhi Yekunobva (SCM) system inotarisa kana mushandisi ane mvumo inodiwa yeku commit kuchinja.
- 3. Kodhi Commit: Mushandisi ane mvumo commitkodhi itsva inochinja kunzvimbo yekuchengetedza, zvichikonzera CI/CD pipeline.
- 4. Kuongororwa Kwekutevedzera Mutemo uye Kuvimbisa Hunhu: Kodhi iyi inoedzwa kuti ione kana ichitevedzera mitemo yekodhi standarduye kuvimbiswa kwemhando yepamusoro.
- 5. Chakavanzika & IaC Kuongorora: The pipeline inoskena zvakavanzika zvine magwaro akavanzika, zvakaita semapassword kana makiyi eAPI, kudzivirira kutyorwa kwekuchengetedzwa.
- 6. Kuwanikwa Kwemakodhi Akaipa: Zvishandiso zvekuongorora zvisina kusimba zvinotsvaga ma codebase kuti zvione mapatani anoratidza kodhi yakaipa, senge backdoors kana zvimwe zvinotyisidzira kuchengetedzeka, kuti zvive nechokwadi chekuti kodhi yacho yakachengeteka uye yakavimbika.
- 7. Vulnerability Scanning: The pipeline inoongorora codebase uye zvinoenderana nayo kuti ione kana paine chero dambudziko rinozivikanwa.
- 8. Kusimbiswa kweSainicha: Saini dzezvinhu zvese zvinoshandiswa mukubatanidzwa kwacho dzinosimbiswa kuti dzive nechokwadi chekuti ndezvechokwadi uye zvinovimbwa.
- 9. Kugadzirwa kweZvipupuriro: Kana bvunzo dzese dzapera, gwaro rekusimbisa rinogadzirwa, richisimbisa kuchengetedzeka uye kuvimbika kwechigadzirwa chekupedzisira.
- 10. Kugadzirira Kugovera Zvigadzirwa: Chigadzirwa chakasimbiswa chinogadzirwa kuti chigoverwe kune vatengi vekupedzisira, zvichiita kuti vagamuchire chigadzirwa chakachengeteka uye chakasimbiswa.
Kuchinjika uye Kuchinja-chinja: Chimiro Chenzvimbo Dzakasiyana-siyana
Hurongwa hweZero Trust hwe SSCS inofanira kuva yakasimba uye inochinjika, ichitsigira nzvimbo dzakasiyana-siyana dzekugadzira software, kubva kuzvivakwa zve microservices zvegore kusvika kune zvechinyakare on-premisemasisitimu. Kutevedzera standard Maumbirwo euchapupu, akadai semetadata uye masiginecha edhijitari, anoita kuti pave nekushanda pamwe chete uye zvinoita kuti pave nekubatanidzwa kwakanaka nezvishandiso zvekuchengetedza zviripo.
Munguva ino apo kutyorwa kwekuchengetedzwa kwemakambani uye kushaya simba kuri kuwedzera, kushandisa nzira yeZero Trust muchikamu che Software Supply Chain Security idanho rekuita kuti software yako ive yakasimba uye yakavimbika. Nekubatanidza matanho ekudzivirira uye kuve nechokwadi chekuti software yako inoshanda zvakanaka padanho rega rega, masangano anogona kuvaka masisitimu esoftware akachengeteka, akasimba, uye akavimbika, achichengetedza midziyo yavo yedhijitari uye achisimbisa ketani yavo yekupa software kubva kunjodzi dzinogona kuitika.
Zero Trust uye SSCS pamwe chete vanoumba hwaro hwakasimba hwehurongwa hwekuchengetedza mune ramangwana apo kuchengetedzeka kwakakosha. Masangano anogona kufamba-famba munzvimbo yedhijitari inogara ichichinja nekuvimba uye kushinga nekutarisa pakuvimbika nekuvimbana.
