Kurwiswa kweSoftware Supply Chain: Ndinofanira kunetseka here?

Tekinoroji yesoftware yakashanduka, uye ma hackers akashandukawo nayo. Kukwikwidzana kwemauto nevanhu vanoita zvakaipa kwaingogumira pakusasimba uye kurwiswa kwakanangana nesoftware yakashandiswa. Kurwisa ketani yekugovera software, kunyangwe zvisiri pachena, kwaisava chinangwa chikuru chevanhu vakaipa…

Kurwiswa kwakaitwa nevakawanda sekutanga kwekuchinja kwemaitiro eAdvanced Persistent Threats (APTs) kwaive SolarWinds kurwisaKwete yekutanga, asi ine simba guru rakaita kuti ITsec inyanye kupararira.

Mienzaniso: SolarWinds, Codecov, Kaseya

SolarWinds ikambani huru inotengesa software inopa maturusi ekutarisa network nezvivakwa. Chimwe chezvigadzirwa zvekambani iyi iOrion, puratifomu yekutarisa nekutarisira zvivakwa. Inoshandiswa nemasangano ehurumende neakazvimirira anopfuura 30,000 kutarisira zviwanikwa zvavo zveIT. Orion inoshandisa masisitimu eIT kuti iwane data relog nesystem performance.

Muna Zvita 2019, ma hackers akawana ma network, masisitimu nedata rezviuru zvevatengi veSolarWinds. Vakarwisa software supply chain yavo vachiisa kodhi yakaipa mupuratifomu. Mushure mezvo, SolarWinds yakaunza backdoor malware sechinongedzo kuOrion software, iyo ma hackers aigona kuwana nekuzviti vashandisi nemaakaundi emasangano akakuvadzwa. Kutyorwa kweSolarWinds kwakafungidzira kumuka kwekuchengetedzwa kwepamhepo kumasangano ese anoshanda munyika ye cloud-native.

Kurwiswa uku kwekutengesa kwakateverwa nedzimwe dzakadai seCodecov, chishandiso chekufukidza makodhi esoftware. Muna Ndira 2021, kambani iyi yakagadzira makodhi emagetsi. murwisi akatora chitupa chebasa yakachengetwa nekukanganisa mumufananidzo weCodecov's Docker, iyo mutambi akashandisa kugadzirisa script ye uploader muchishandiso. Mutambi achangoisa mutsetse mumwe chete wekodhi wakatumira zvese CI's environment variables kune controlled server yemurwisi apo script yakaitwa. Kwemwedzi yakati wandei, vatambi vakaipa vakawana mukana wekuwana masisitimu aishandisa modified Codecov script.

Gare gare, musi wa2 Chikunguru, 2021, kurwiswa kwaKaseya yakaitika. Puratifomu yayo yeVSA inoshandiswa neMSP dzakawanda dzinopa masevhisi eIT kune mamwe makambani kuti dziite manejimendi yemapatch uye kutarisa vatengi. MaHackers akarwisa chain yeKaseya VSA, achikanganisa zvivakwa zvayo uye akazoburitsa zvinyorwa zvine hutsinye pamaseva eVSA emunharaunda kuti aparadze masisitimu emakambani anotungamirirwa, vachivanza data ravo uye vachida rudzikinuro. Ransomware kuburikidza nechishandiso chetrojanised chinoshandiswa neMSPs pamakambani avo anotungamirirwa, ayo ari iwo ekupedzisira chinangwa. Kuchenjera sei!

Kubva pakaitika chiitiko cheSolarWinds, kwave nekurwiswa kwakawanda kwemakambani ekupa software, zvichikanganisa chimiro nehupfumi hwemakambani akadai seSamsung, Uber, Nissan, Nvidia, nedzimwe dzakawanda. Sekureva kwaGartner, "panosvika gore ra2025, 45% yemasangano pasi rese achave arwiswa nemakambani avo ekupa software, kuwedzera katatu kubva muna 2021."

Chizvarwa Chitsva Chekurwisa Kushandiswa KweSoftware

Kurwisa maapplication ekambani kana nzvimbo dzekugadzira zvinongokonzera munhu mumwe chete anobatwa. Izvi, pamwe chete nekuti makambani mazhinji atove neAppSec dziviriro dzakadai seAST, SCA kana kuti maturusi eWAF, zvakakonzera kubuda kwechizvarwa chitsva chevapambi vakananga kugadzira software. pipelineKurwiswa kwemagetsi emagetsi kunogona kukanganisa zviuru zvemakambani nekurwisa kumwe chete kuri nyore: amplifier yakakodzera.

Nzvimbo yekuvandudza zvinhu iri nyore kunangwa nevapambi. Nzvimbo yayo yakakura yekurwisa inopa mukana wekuwana nzvimbo yekugadzira zvinhu nedata rayo. Nzvimbo yese yeDevOps zvishandiso: nzvimbo dzekuchengetedza, masisitimu ekudzora mashandisirwo emagetsi, maturusi ekuvaka, maturusi ekuisa zvinhu, matemplate eInfrastructure as Code, macontainers, mafaira escript, nezvimwewo, yakakura uye haina njodzi. Uyezve, maturusi ese aya ari kure nekudzora nzvimbo yekuchengetedza uye anotungamirirwa nemapoka ekugadzira zvinhu. MaHackers vanoziva izvi uye vanoshandisa mukana wekusasimba uku.

Chinangwa Chitsva

Kazhinji vagadziri vemapurogiramu vanonyora zvakavanzika mukodhi yekodhi senge marekodhi nemakiyi ekuyedza panguva yekugadzira. Izvi zvinochengetwa mumafaira anowanzo shandiswa pasi pehurongwa hweshanduro, uye zvinogona kuwanikwa nevapambi mune ramangwana, kunyangwe mafaira kana zvakavanzika zvikabviswa. Izvi zvinobvumira vapambi kuisa backdoors, kuverenga kodhi yekodhi, kuisa kodhi yakaipa, kubvisa data rakavanzika, nezvimwewo… Kana vatambi vane utsinye vagara vashanda. login zvitupa zvavanogona kufambisa padivi nepakati SDLC. Magwaro aya anovabvumira kushandisa mamwe maturusi uye kuwana kodzero dzevashandisi vepamusoro kuti vatsvage ruzivo rwakakosha.

MaHackers anogona kushandisa zvitupa kuti aputse mutemo SDLC, asi zvinogonawo kupinda mumatura kana maturusi asina kurongwa zvakanaka kana kusachengetedza, izvo zvinoisa masisitimu nedata panjodzi.

Kurwiswa kunotarisawo mapakeji emahara. Tose tinoziva nyaya dzinotyisa nezvekurwiswa kunoshandisa zvipingamupinyi zvinozivikanwa, zvakaita seLog4j. Kune rumwe rutivi, kurwiswa kwekutengesa kwakasiyana: varwisi vanoisa kodhi yakaipa mumapakeji emahara anozivikanwa kuti azoshandiswa gare gare mukuvaka nemasangano mazhinji pasi rose.

Muchidimbu: ma hackers anogona kushandisa mukana wekuwana zvinhu zvisina kunaka, zvikanganiso zvisina kunaka uye kushaya simba mune CI/CD pipeline zvivakwa senzira yekuisa malware musoftware inogona kushandiswa nevakawanda.

Maitiro ekudzivirira edu SDLC kubva kuSoftware Supply Chain Attacks?

Huwandu hwekurwiswa kwekutengesa zvinhu huri kuramba huchikura, uye musika uri kuita zvinoenderana nemamiriro ezvinhu aya. Mamwe masangano akagadzira hurongwa hwekugadzirisa software supply chain security, seNIST Secure Software Development Framework (SSDF) uye Google's Supply Chain Levels for Software Artifacts (SLSA). Zvisinei, hapana makambani akawanda anoita kuti zvive zvakakosha kuchengetedza maturusi eDevOps nezvivakwa kudzivirira kurwiswa kwecheni yavo yekutengesa. Kutaura zvazviri, 82% yemaCIO vanofunga kuti vachave panjodzi yekubatwa navo.

Makambani haafanire kungonetseka nezvekuchengetedza maapplication avo chete asiwo nezvesoftware uye zvinhu zvekare zviri chikamu chehurongwa hwavo. SDLC sezvo vanhu vakaipa vari kunanga cheni yekugovera. Kupararira kwenzvimbo yekurwiswa, kusaziva kwemapoka ekugadzira rudzi urwu rwekurwiswa uye kushaikwa kwezvishandiso zvekuchengetedza zvine hunyanzvi kuri kubvumira varwisi kutarisa cheni yekugovera software.