Sezvo hupenyu hwesoftware supply chain huchifambira mberi kubva pa source code kuenda ku executable artifacts, danho rekuvaka rinomira senzvimbo yakakosha. Asi, danho iri rekuchinja rinogonawo kutyisidzirwa zvakasiyana-siyana zvinogona kukanganisa kuvimbika kwesoftware uye build securityZvipingamupinyi izvi zvinogona kupinda muhurongwa hwekuvaka kuburikidza nenzira dzakasiyana-siyana, kusanganisira kunzvenga zvakagara zviripo. CI/CD pipeline, kugadzirisa kodhi yekudzora manyuko emashoko, kukanganisa maitiro ekuvaka pachawo, kana kukanganisa marepository ezvigadzirwa. Muchinyorwa chino cheblog, tinonyatsoongorora njodzi idzi uye tinoongorora kurwiswa kwakajairika kwesoftware supply chain build. Izvi zvirimo zvinoenderera mberi neongororo yedu yeblog. software supply chain security mu SDLC.
Danho reKuvaka muKutenderera kweHupenyu hweSoftware Development
Danho rekuvaka rehupenyu hwese hwesoftware supply chain rinosanganisira maitiro ekushandura source code kuita executable software artifacts. Danho iri rinosanganisira kuunganidza, kubatanidza, uye kurongedza source code, pamwe nekugadzira mapakeji ekuisa uye mafaira ekugadzirisa.
Build security Zvityiso zvipingamupinyi zvinogona kubvumira muvengi kuti aite shanduko dzisina mvumo kusoftware panguva yekuvaka pasina kuchinja kodhi yekombiyuta. Zvityiso izvi zvinogona kuunzwa nenzira dzakasiyana-siyana, dzakadai sekukanganisa nharaunda yekuvaka kana kushandisa zvipingamupinyi zviri muzvishandiso zvekuvaka.
Zvinotyisa Zvikuru zveSoftware Supply Chain -Build Attacks
Bypass CI/CD
Izvi zvinoreva tsika yekunzvenga zvakagara zviripo CI/CD (kubatanidzwa nguva dzose uye kuendesa nguva dzose) pipeline kugadzira nekuburitsa software zvakananga pasina kuongororwa kwakasimba, kuongororwa, uye kuongororwa kwemaitiro anowanzoitwa nevakuru vakuru. pipelineIzvi zvinogona kuitwa nekugadzira software nemaoko kunze kwe CI/CD nharaunda kana nekushandisa maturusi kana manyoro anobvumira shanduko dzisina mvumo pamaitiro ekuvaka. Muenzaniso werudzi urwu rwekurwisa vector waive Kurwiswa kwaJenkinsMuna 2022, matsotsi akapinda muchivakwa ichi pipeline yepurojekiti yesoftware inozivikanwa inonzi Jenkins. MaHackers akaisa kodhi yakaipa muJenkinsfile, inova script inotsanangura maitiro ekuvaka. Kodhi yakaipa yakabvumira maHackers kuti vasashandise CI/CD pipelinevanoongorora kuchengetedzeka kwesoftware uye vanoisa kodhi yavo mumaitiro ekuvaka. Iyi kodhi inozoshandiswa pamasisitimu emasangano akaisa software iyi.
Chinja kodhi mushure mekudzora kwesource
Muitiro uyu unosanganisira kuchinja kodhi yekodhi pasina mvumo mushure mekunge yaitwa. commitYakaiswa kune system yekudzora manyuko inovimbwa nayo (SCS) uye yobva yavaka software iyi uchishandisa iyi modified code. Izvi zvinogona kuitwa nekushandura zvakananga kodhi iri panzvimbo yekushandira yevagadziri kana nekushandisa maturusi ekunze kana mascripts kuisa kodhi yakaipa mumaitiro ekuvaka. Muenzaniso weiyi vector attack yaive GitLab Attack muna 2022. MaHackers vakapinda muchivako ichi. pipeline of GitLabMa hackers akaisa kodhi yakaipa muGitLab CI/CD pipeline, inova chishandiso chinoita kuti build security maitiro. Kodhi yakaipa yakabvumira ma hackers kugadzirisa kodhi mushure mekunge yaongororwa kuti ionekwe senzira yekudzora ma source. Izvi zvakavabvumira kuisa kodhi yavo musoftware, iyo yakazoshandiswa pamasystem emasangano akaisa software.
Maitiro ekuvaka zvikanganiso
Izvi zvinosanganisira kushandisa kana kuchinja maitiro ekuvaka pachawo, kungave kuburikidza nekupinda zvakananga kunzvimbo yekuvaka kana nekushandisa kushaya simba muzvishandiso zvekuvaka kana kuvimba nevamwe. Izvi zvinogona kuitwa kuisa kodhi yakaipa mumhedzisiro yekuvaka, kukanganisa mhedzisiro yekuvaka, kana kukanganisa maitiro ekuvaka zvachose. Muenzaniso wakakurumbira wekurwisa uku kwevector waive SolarWinds Attack. Murwisi akanga awana mukana usina mvumo wekupinda papuratifomu yekuvaka yeSolarWinds, sisitimu inoshandiswa kuunganidza nekubatanidza SolarWinds Orion software. Chinyorwa ichi chakaisa kodhi yakaipa muSolarWinds Orion software yakagadzirwa. Vashandisi pavakaisa software yakakanganiswa, kodhi yakaipa yaishandiswa pamasisitimu avo, zvichipa mukana usina mvumo wekupinda mumasisitimu avo. Murwisi akakwanisawo kuba data rakavanzika kubva kumasisitimu avo, senge zvitupa, pfuma yepfungwa, uye ruzivo rwevatengi.
Nzvimbo yekuchengetedza zvinhu zvechinyakare
Izvi zvinoreva kupinda kana kushandiswa zvisina mvumo kwenzvimbo yekuchengetedza zvinhu, uko mapakeji esoftware nemabinaries zvinochengetwa kuti zvigoverwe kune vashandisi vemukati kana vekunze. Varwisi vanogona kushandisa mukana uyu wekusagadzikana kuunza kodhi yakaipa, kukanganisa chokwadi chesoftware, kana kukanganisa maitiro ekuisa. Muenzaniso wekurwisa uku kwevector waive RubyGems muna 2022. MaHackers vakapinda mudura reRubyGems. MaHackers vakatsiva chinhu chepamutemo nechinhu chine njodzi, icho chakazotorwa nezviuru zvemasangano achigadzira software neRuby on Rails. Chinhu ichi chine njodzi chakabvumira maHackers kushandisa kodhi isina kurongeka pamasisitimu emasangano akaisa software. Izvi zvinogona kuvabvumira kuba data, kuisa malware, kana kukanganisa mashandiro.
Final Remark
Sezvo masangano achiramba achigamuchira maitiro ekugadzira software anosimbisa otomatiki uye kuendesa nguva dzose, kukosha kwekuchengetedza maitiro ekugadzira software hakuna kumbonyanya kukura. Nekushandisa matanho akasimba ekuchengetedza mukati mechikamu chekuvaka, masangano anogona kuderedza zvakanyanya njodzi yekurwiswa kwakaipa kunogona kukanganisa kuvimbika uye kuchengetedzeka kwesoftware yavo.
Maitiro anotsanangurwa muchinyorwa chino cheblog uye mienzaniso yakapihwa inoshanda sechiyeuchidzo chekuti danho rekuvaka inzvimbo isina njodzi muhurongwa hwekugovera software. Masangano anofanira kungwarira kutyisidzira uku uye kuita matanho ekuchengetedza anodiwa kudzivirira software yavo kubva mukurwiswa. Nekuita izvi, vanogona kuve nechokwadi chekuti software yavo yakavimbika, yakachengeteka, uye yakavimbika kune vashandisi vavo nevatengi.
Batana Nesu Rwedu Kuenda Kunzvimbo Yesoftware Yakachengeteka
Musapotsa mukana uyu wekuti murambe muri pamberi pevamwe mukudzivirira kutyisidzira kwekutengesa software. Nyorerai kublog redu nhasi uye muve vekutanga kugamuchira ruzivo rwedu rutsva, muchivimbisa kuti sangano renyu rinoramba rakagadzikana uye rakachengeteka pakati pematambudziko ari kuchinja. Pamwe chete, tinogona kuvaka ecosystem yesoftware yakasimba uye yakachengeteka kune wese munhu.
Tarisa Vhidhiyo Yedu Demo
