OWASP Top 10 ndeimwe yenzvimbo dzinonyanya kushandiswa dzekuchengetedza maapplication pakuona nekuderedza njodzi dzekuchengetedza maapplication ewebhu. Gwaro iri rinotsanangura njodzi dzeOWASP Top 10, mienzaniso chaiyo, nzira dzakanakisisa dzekugadzirisa, uye kuti AppSec yemazuva ano ne software supply chain security mhinduro dzinobatsira masangano kuderedza njodzi mumasangano ese SDLC.
Chirongwa Chekuchengetedza Chikumbiro Chewebhu (OWASP)
Chirongwa Chekuchengetedza Mapurogiramu Ewebhusaiti Yakavhurika (OWASP) isangano rinotungamira risingabatsiri rakatsaurirwa kuvandudza kuchengetedzeka kwesoftware. OWASP inozivikanwa nekujeka kwayo uye kujekesa kwayo commitKushandiswa kwemhinduro dzinotungamirirwa nenharaunda, izvo zvakaita kuti ive nzvimbo inoshandiswa nevanogadzira mapurogiramu, nyanzvi dzekuchengetedza, uye masangano ari kutsvaga nzira dzakanakisisa dzekuchengetedza. Pakati pezvakawanda zvayakaita, chimwe chezvinhu zvakakosha iOWASP Top 10, runyorwa runogara ruchigadziriswa rwenjodzi dzakakosha dzekuchengetedza mawebhusaiti dzinokanganisa maapplication emazuva ano. Inosimbisa kushaya simba kwakanyanya mumaapplication ewebhu, zvichibva padata rechokwadi uye ruzivo rwenyanzvi.
Chinangwa cheOWASP ndechekuita kuti kuchengetedzeka kuve nyore uye kunzwisiswe, ichipa maturusi, marongero, neruzivo rwekubatsira kuchengetedza mashandisirwo kubva pakutanga kusvika padanho repamusoro. OWASP Top 10 inoshanda sehurongwa hunoshanda hwekubatsira vagadziri kutarisa pane zvinokanganisa zvinonyanya kukosha, vachiona kuti vanogona kushandisa mhinduro dzinodiwa zvinobudirira.
Pamusoro gumi peOWASP
OWASP Top 10 inzvimbo huru yekuchengetedza maapplication emasangano anotarisira mawebhusaiti emazuva ano. Kune chero sangano rinoshanda kuchengetedza mawebhusaiti. Inotsanangura njodzi dzakakosha dzekuchengetedza, ichipa ruzivo rwenzira dzakajairika dzekukanganiswa kwemaapplication. OWASP Top 10 yekusagadzikana inoratidza njodzi idzi huru, ichipa mazano ekugadzirisa. Kugadzirisa matambudziko aya zvakananga kwakakosha pakusimbisa kuchengetedzeka kwechero application.
Chii chinonzi OWASP Top 10 uye Mishonga Yayo?
OWASP Top 10 igwaro rekuzivisa vanhu pasi rose rakaburitswa neOpen Web Application Security Project (OWASP). Rinozivisa njodzi dzakanyanya kukoshesesa dzinokanganisa mawebhusaiti emazuva ano zvichibva padata rekurwiswa kwenyika chaiyo, tsvakiridzo yenharaunda, uye ongororo yeindasitiri. Rondedzero iyi inobatsira vanogadzira mapurogiramu, mapoka eAppSec, mainjiniya eDevSecOps, nevatungamiriri vekuchengetedza kuti vatarise njodzi dzinoisa njodzi huru kumapurogiramu, maAPI, uye macheni ekupa software.
OWASP Top 10 iripo inosanganisira zvikamu zvekuchengetedza zvakaita seBroken Access Control, Injection, Security Misconfiguration, Vulnerable and Outdated Components, Software and Data Integrity Failure, uye Server-Side Request Forgery (SSRF). Kunzwisisa njodzi idzi nekushandisa nzira dzakakodzera dzekugadzirisa kwakakosha pakuvaka maapplication akachengeteka, kuderedza kusvibiswa kwesoftware, uye kudzivirira masangano kubva kunjodzi dzemazuva ano dzecyber.
OWASP Mapoka gumi Epamusoro
OWASP Top 10 Vulnerability Pakungotarisa
| Chikamu cheOWASP | Primary Risk | Typical Impact |
|---|---|---|
| Broken Access Control | Kuwana zvisina mvumo | Kuwanikwa kwedata |
| Kukundikana kweCryptographic | Kuvharidzira kusina kusimba | Sensitive data kuba |
| Injection | Kuisa zvinhu zvisina kunaka | Kubvumirana kwedatabase |
| Dhizaini Isina Kuchengetedzwa | Kusasimba kwekuvaka | Kusasimba kwehurongwa hwese |
| Chengetedzo Kusanzwisisika | Kugadzirisa kusina kunaka | Kuwana zvisina mvumo |
| Zvinhu Zvine Mungozi | Zvinhu zvekare zvinotsamira pakuvimba | Kubvumirana kwecheni yekugovera |
| Kukundikana Kwechokwadi | Kudzora hunhu husina kusimba | Kutorwa kweakaundi |
| Kukundikana Kwekuvimbika Kwesoftware | Kukanganisa kuvaka/kuvimba | Kuisa malware |
| Kukundikana kweKunyora & Kutarisa | Kuonekwa kwanonoka | Nguva yakareba yekuramba uripo yemurwisi |
| SSRF | Kushungurudzwa kwezvikumbiro zvemukati | Kubvumirana kwebasa remukati |
1. Kudzora Kupinda Kwakatyoka (A01:2021)
Chii chinonzi Broken Access Control?
Kudzora Kupinda Kwakabhuroka kunoitika kana vashandisi vawana mukana wekuwana data kana zviito zvisina mvumo. Semuenzaniso, murwisi anogona kushandisa URL kuti awane mukana wekutonga. OWASP yakawana dambudziko iri mu94% yemapurogiramu akaedzwa, zvichiita kuti ive imwe yenjodzi dzekuchengetedza dzeOWASP Top 10.
Mishonga yeKudzora Kupinda Kwakabhuroka
Kuti uderedze njodzi iyi, shandisa mukana wekuwana kodzero shoma, shandisa multi-factor authentication (MFA) pamabasa akavanzika, uye gara uchiongorora mvumo dzevashandisi.
Kuchengetedzwa kweZvakavanzika zveXygeni Kunobatsira kuchengetedza ruzivo rwakakosha senge makiyi eAPI nema tokeni, zvichideredza njodzi yekutyorwa kwemutemo wekudzora kupinda. Kugara uchitarisa kunoita kuti system yako ive yakavimbika.
Muenzaniso weRael-World
In 2019, First American Financial Corp pachena pamusoro Zvinyorwa zvinonzwisisika zvinosvika mamiriyoni 850 nekuda kwekudzora kupinda zvisina kunaka. Varwisi vanogona kungochinja URL kuti vawane magwaro akavanzika. Nekuregeredza kuchengetedza nzvimbo dzekupinda zvakanaka, kambani yakasiya data rakavanzika riri panjodzi. Chiitiko ichi chinosimbisa kudiwa kwekusimbisa mabasa evashandisi uye kuve nechokwadi chekuti vanhu vane mvumo chete ndivo vanogona kuwana ruzivo rwakakosha.
Nei zvichikosha nhasi? Mapurogiramu emazuva ano anoburitsa pachena maAPI, masevhisi egore, uye mabasa evashandisi vakapararira, zvichiita kuti kupinda pasina mvumo kuve imwe yenjodzi dzakajairika uye dzinokuvadza dzekuchengetedza dzinokanganisa data rebhizinesi rakavanzika.
2. Kukundikana kweCryptographic (A02:2021)
Chii chinonzi Cryptographic Failures?
Kukundikana kweCryptographic kunoitika kana masisitimu akatadza kunyora data rakavanzika nemazvo, zvichibvumira varwisi kuti vabvise nekushandisa zvisirizvo. Kunyora kwakasimba kwakakosha pakudzivirira data rakavanzika.
Mishonga Yekukundikana kweCryptographic
Chengetedza data rakachengetedzwa uchishandisa AES-256 uye shandisa TLS 1.2 kana kupfuura kuti data rifambe. Gara uchitenderedza makiyi ekunyorera uye uachengetedze uchishandisa nzira dzakakodzera dzekupinda.
Zvivakwa zveXygeni seKodhi (IaC) Kuchengetedzwa inotarisa marongero e encryption panguva yekushandiswa kudzivirira kusasimba mumitemo ye encryption.
Muenzaniso Wenyika Yechokwadi
In 2017, Exactis, kambani yekuunganidza data, yakafumura zvinyorwa zvemunhu mumwe nemumwe zvinosvika mamiriyoni 340 nekuda kwekuvharwa kwedata zvisina kunaka. Varwisi vakawana ruzivo rwemunhu senge mazita, kero, uye nhamba dzefoni nekuti data racho raive rakachengetwa mumashoko asina kujeka. Kutyorwa uku kunoratidza njodzi dzekukundikana kuvanza data rakavanzika. Nekushandisa encryption chaiyo standards dzakadai seAES-256 yedata riri pazororo uye TLS yedata riri kufambiswa, masangano anogona kuchengetedza data ravo kubva pakuwanikwa kusina mvumo.
Nei zvichikosha nhasi? Masangano ari kuramba achichengetedza nekutumira data rine ruzivo rwevatengi, rezvemari, uye rekusimbisa mukati memakore, zvichiita kuti encryption yakasimba ive yakakosha pakudzivirira kuvanzika uye kutevedzera mitemo.
3. Jekiseni (A03:2021)
Chii chinonzi Kurwisa Nejekiseni?
Kukuvadzwa kwekushandisa majekiseni, senge SQL Injection, kunoita kuti vapambi vakwanise kuisa makodhi akaipa musystem yako, zvichiita kuti vakwanise kushandisa kana kuba data. Kurwiswa kwekushandisa majekiseni kunoramba kuri imwe yenjodzi dzakajairika uye dzine simba pakuchengetedza maapplication anokanganisa mawebhusaiti emazuva ano.
Mishonga yekurapa Kurwiswa nejekiseni
Shandisa mibvunzo ine parameter uye simbisa zvinongedzo zvevashandisi. Dzivisa mibvunzo inochinja-chinja pese pazvinogoneka kuti uderedze njodzi.
Kuonekwa kweAnomaly yeXygeni Vatariri CI/CD pipelines yemaitiro asina kujairika, zvichibata kuedza kubaya jekiseni panguva chaiyo.
Muenzaniso Wenyika Yechokwadi
In 2017, Equifax akatambura a kukanganisa kukuru kwedata izvo zvakafumura ruzivo rwemunhu Vatengi vanosvika mamiriyoni zana nemakumi mana nemanomwe. Kutyorwa kwacho kwakakonzerwa ne Kusagadzikana kwekushandiswa kweSQL injection, zvichibvumira vapambi kuti vagone kushandisa webhusaiti yekambani uye kuwana data rakavanzika rakachengetwa mudhatabhesi. Masangano anofanirwa kuve nechokwadi chekuti masisitimu avo akachena zvakanaka. Kugadzirisa nguva dzose uye kuchengetedza mibvunzo yeSQL kwaigona kudzivirira kusasimba uku.
Nei zvichikosha nhasi? Kusashanda zvakanaka kwekushandisa ma "injection" kunoramba kuchikanganisa ma "web applications", ma API, uye ma "workflows" ekuvandudza anobatsirwa neAI uko zvinhu zvisina kusimbiswa zvinosvika kuvaturikiri, ma "databases", kana ma "backend systems".
4. Dhizaini Isina Kuchengetedzwa (A04:2021)
Chii chinonzi Insecure Design?
Kugadzira Kusachengeteka kunoitika kana vagadziri vakatadza kubatanidza kuchengetedzeka muchikamu chekutanga chekugadzira, izvo zvinogadzira matambudziko anonetsa kugadzirisa gare gare. Kusasimba uku kwakaoma kugadzirisa kana maapplication asvika munzvimbo dzekugadzira.
Mishonga yekurapa Dhizaini Isina Kuchengetedzwa
Isawo misimboti yakachengeteka yekugadzira uye maitiro ekutevedzera njodzi pakutanga kwehupenyu hwekugadzira. Gara uchiongorora dhizaini yako kuti uone kana paine zvikanganiso zvinogona kuitika uye uzvigadzirise zvisati zvava matambudziko makuru.
Xygeni's Application Security Posture Management (ASPM) inoona zvikanganiso zvinogona kuitika pakugadzira makombiyuta vasati vazvishandisa, zvichiita kuti vagadziri vagadzire zvinhu zvavo kubva pakutanga.
Muenzaniso Wenyika Yechokwadi
Muenzaniso wechangobva kuitika we Dhizaini Isina Kuchengetedzwa ndiro Kusagadzikana kweMicrosoft Exchange ProxyShell muna 2021Varwisi vakashandisa zvikanganiso zvekugadzira muMicrosoft Exchange's authentication and access control mechanisms, zvichivabvumira kushandisa kodhi vari kure pamaseva asina kuchengetedzeka. Izvi zvaisava zvikanganiso zvekushandisa, asi kushaya simba kwekugadzira kwakakosha kwakaita kuti kushandiswa kuitike kunyangwe mushure mekunge ma patches ashandiswa zvisirizvo. Kutyorwa uku kunosimbisa kukosha kwekubatanidza kuchengetedzeka panguva yekugadzira kudzivirira kushaya simba kuti kusagadzirwe musystem.
Nei zvichikosha nhasi? Kusasimba kwekuchengetedza kwakaunzwa panguva yekugadzira kwakaoma uye kunodhura kugadzirisa gare gare, kunyanya munzvimbo dzekusimudzira dzinogara makore akawanda uye dziri kuchinja nekukurumidza.
5. Kusagadziriswa Kwekuchengetedza (A05:2021)
Chii chinonzi Kusagadziriswa Kwekuchengetedzwa?
Kusagadzirisa zvakanaka kunoitika kana varwisi vakashandisa masisitimu asina kugadzirirwa zvakanaka, akadai seaya anoshandisa marongero akajairika kana kusiya maports asina kufanira akavhurika. Kusagadzirisa zvakanaka kunoramba kuri chimwe chezvikonzero zvikuru zvezviitiko zvekuchengetedzwa kwegore uye maapplication.
Mishonga yekurapa Chengetedzo Kusanzwisisika
Otomatiki macheki ekugadzirisa uchishandisa Infrastructure as Code (IaC) uye gara uchiongorora zvekuchengetedza nguva nenguva. Chengetedza masisitimu ese achivandudzwa nemapetch matsva.
Xygeni's IaC Security inoongorora magadzirirwo asina kunaka usati waisa data uye inotevedzera mitemo yekuchengetedza nguva dzose munzvimbo dzese.
Muenzaniso Wenyika Yechokwadi
In 2018, NASA vakasangana nekusawirirana nekuti marongero asina kugadziriswa zvakanaka in Atlassian JIRA data repurojekiti rakafumurwa uye revashandi. Varwi vakawana ruzivo urwu nekuda kwehurongwa hwakavhurika. Kuongorora kwekuchengetedza otomatiki uye kusimbiswa kwemitemo yekugadziriswa kwakakodzera kwaigona kudzivirira kutyorwa uku. Kuongorora nguva dzose kwaizove kwakaona kushaya simba kwevarwisi vasati vaishandisa.
Nei zvichikosha nhasi? Masevhisi egore asina kugadziriswa zvakanaka, CI/CD pipelines, makontena, uye nzvimbo dzekutonga dzakafumurwa dzichiri chimwe chezvikonzero zvikuru zvekutyorwa kwekuchengetedzwa kwemazuva ano.
6. Zvikamu Zvisina Kusimba uye Zvekare (A06:2021)
Ndezvipi Zvikamu Zvisingachashandi uye Zvisina Nguva?
Zvikamu zviri panjodzi uye zvekare zvinoitika kana ukashandisa maraibhurari kana maframework evamwe vanhu vane zvikanganiso zvekuchengetedza zvinozivikanwa. Varwi vanogona kushandisa zvikanganiso izvi kukanganisa application yako. Iyi injodzi ine njodzi, sezvo kusvika ku60% yemaapplication emazuva ano akavakwa nezvikamu zvevamwe vanhu.
Mishonga yekurapa Zvikamu Zvisina Kusimba uye Zvekare
Gara uchigadzirisa maraibhurari evamwe vanhu uye zvinhu zvinoenderana nawo, uye shandisa Software Composition Analysis (SCA) zvishandiso zvekuona nekugadzirisa zvikanganiso.
Xygeni's Open Source Security inoongorora zvinhu zvaunofarira kudzivirira kushandisa zvinhu zvekare kana zvine njodzi, zvichikubatsira kuchengetedza application yakachengeteka.
Muenzaniso Wenyika Yechokwadi
In 2017, Apache Struts aiva nedambudziko risina kugadziriswa rakaita kuti Equifax kukanganisa, zvichikanganisa mamiriyoni evashandisi. Kushaya simba kwaive mu Apache Struts 2, framework inoshandiswa zvakanyanya, uye Equifax yakatadza kushandisa patch nenguva. Izvi zvakasiya masisitimu avo ari panjodzi yekushandiswa. Kugadziriswa nenguva uye kuongorora nguva dzose kukuvara kwaizodzivirira kutyorwa uku.
Nei zvichikosha nhasi? Mapurogiramu emazuva ano anonyanya kuvimba nemapakeji emahara uye maraibhurari evamwe, zvichiita kuti kurwiswa kwesoftware supply chain uye kuvimba nezvinodiwa nevanhu vari munjodzi kuve dambudziko riri kukura reAppSec.
7. Kukundikana Kwekusimbisa (A07:2021)
Chii chinonzi Kukundikana Kuzivikanwa uye Kusimbiswa?
Kusasimba uku kunoitika kana nzira dzekusimbisa dzisiri dzakasimba kana kuti dzisina kushandiswa zvakanaka, zvichibvumira varwisi kunzvenga zvidzoro zvekuchengetedza.
Mishonga yekurapa Kukundikana Kwekuzivikanwa uye Kusimbiswa
Shandisa mitemo yakasimba yepassword, shandisa multi-factor authentication (MFA), uye ongorora zvinyorwa zve audit authentication kudzivirira kupinda pasina mvumo.
Xygeni's Secrets Security inobatsira kuchengetedza magwaro ako, zvichideredza njodzi yekubuda kwemagwaro panguva yekusimbiswa kwemagwaro.
Muenzaniso Wenyika Yechokwadi
In 2020, ivo Mhete yekuchengetedza kamera kutyorwa kwemutemo kwakakonzerwa nemapassword asina kusimba. Varwisi vakashandisa mapassword akareruka uye vakawana mukana wekuona mavhidhiyo aripo kubva zviuru zvemakamera evashandisiKutyora mutemo uku kunoratidza kukosha kukuru kwemaitiro akasimba ekusimbisa. Nokudaro, kushandisa multi-factor authentication (MFA) uye kusimbisa yakasimba password mitemo zvingadai zvakadzivirira nyore nyore kupinda kusina mvumo.
Nei zvichikosha nhasi? Nzira dzisina kusimba dzekusimbisa maakaundi dziri kuramba dzichiita kuti maakaundi atorerwe, kurwiswa kwezvitupa, uye kupinda zvisina mvumo muSaaS, cloud, uye enterprise mafomu.
8. Kukundikana kweSoftware neData (A08:2021)
Chii chinonzi Kukundikana kweSoftware neData Integrity?
Kusagadzikana uku kunoitika kana kodhi kana zvivakwa zvisingadziviriri kubva mukukanganiswa. Varwisi vanogona kukanganisa kuvaka pipelines, dependencies, kana deployment processes, kuisa kodhi yakaipa muzvinhu zvinovimbwa nazvo. Rudzi urwu rwechikanganiso rwave dambudziko guru nekuda kwekuwedzera kwekurwiswa kwe supply chain, uko kunyange zvikamu zvechitatu zvinovimbwa nazvo zvinonangwa kuti zvipinde muma network.
Mishonga yekurapa Kukundikana kweSoftware neData Integrity
Kuti uderedze izvi, shandisa kusaina kodhi, shandisa maitiro ekuvaka akachengeteka, uye simbisa kuvimbika kwezvikamu zvese zvebato rechitatu.
Xygeni's CI/CD chibatiso inovimbisa kuti yako pipelines dzakachengeteka uye dzinotariswa kuti dzionekwe kana paine zvinhu zvisina kujairika. Xygeni's Anomaly Detection inogona kuona zvinhu zvinofungirwa zvingaratidza kuti pane zviri kuitika.
Muenzaniso Wenyika Yechokwadi
In 2024, kurwiswa kukuru kwecheni yekugovera zvinhu kwakanangwa XZ Zvishandiso, raibhurari yekudzvanya inoshandiswa zvakanyanya mumasisitimu eLinux. XZ Utils chishandiso chakakosha chinoshandiswa pakudzvanya mafaira, chinovimbwa nezviuru zvemasangano. Zvisinei, vapambi vakabudirira kukanganisa maitiro ekuvaka kwepurojekiti nekuisa backdoor mukodhi.
Varwisi havana kuonekwa kwenguva yakati, zvichireva kuti masisitimu aivimba neraibhurari yakanga yakanganiswa aikwanisa kushandiswa kure uye kushandiswa zvakanyanya. Nekuda kweizvozvo, varwisi ava vakawana simba pamusoro pemasisitimu akanga akanganiswa, zvichikonzera kutyorwa kwedata uye kukanganiswa kweruzivo rwakakosha.
Chiitiko ichi chinoratidza pachena njodzi dzinokonzerwa ne supply chain kurwisa. Kunyangwe raibhurari inovimbwa nevanhu vakawanda inogona kushandiswa kukanganisa masisitimu akawanda. Nekuona kuti maitiro ekuvaka akachengeteka, kushandisa matekiniki ekusaina makodhi, uye kugara uchitarisa zvikamu zvevamwe, masangano anogona kudzivirira zvikanganiso zvakadaro kuti zvisapinde mumasisitimu avo.
Nei zvichikosha nhasi? Kurwiswa kweSoftware supply chain kwakanangana nekuvakwa pipelines, marejisiti emapakeji, zvinotsamira, uye CI/CD masisitimu ava njodzi huru mukugadzirwa kwesoftware yemazuva ano.
9. Kukundikana kweKunyora Maakaundi uye Kutarisa Zvekuchengetedza (A09:2021)
Chii chinonzi Kukundikana kweKunyora neKutarisa Zvekuchengetedza?
Kukundikana uku kunoitika kana mapurogiramu asinganyore zviitiko zvekuchengetedza nemazvo kana kuti asina nzira dzekutarisa. Pasina magwaro akadzama, kuona nekupindura pakurwiswa kunova kwakaoma. Kusasimba uku kunowanzo nonoka kuona kutyorwa kwedata, zvichibvumira varwisi kushandisa masisitimu kwenguva yakareba.
Mishonga yekurapa Kukundikana kweKunyora neKutarisa Zvekuchengetedza
Bvumira kunyorwa kwakazara kwezviito zvakakosha, chengeta zvinyorwa zvakachengeteka, uye iva nechokwadi chekuti zvinotariswa kana paine zviitiko zvinofungirwa. Uyezve, shandisa maturusi anoshanda otomatiki kuti akuchenjedze nezvenjodzi dzinogona kuitika.
Kuonekwa kweAnomaly yeXygeni inobatsira kuona mabasa asingawanzoitiki panguva chaiyo. Pamusoro pezvo, CI/CD Kuchengetedza kunoita kuti kunyorwa kwemagwaro nekutarisa marongero acho kushandiswe nguva dzose munzvimbo dzakasiyana-siyana.
Muenzaniso Wenyika Yechokwadi
In 2023, ber vakasangana nekutyorwa kwedata izvo yakakanganisa ruzivo rwevanhu vezviuru zvevatyairiKutyorwa kwacho kwakaitika apo kambani yemagweta yebato rechitatu, Genova Burns, akasangana nechiitiko chekuchengetedza, zvichiburitsa pachena ruzivo rwacho. Kunyangwe hazvo zviziviso zvakakonzereswa, masisitimu ekutarisa eUber akatadza kuona nekupindura kurwiswa kwacho nekukurumidza.
Varwisi vakawana ruzivo rwakakosha, kusanganisira mazita, nhamba dzefoni, uye zvinyorwa zvekutyaira. Kunonoka uku kwakakonzerwa nekushaikwa kwekunyora kwakazara uye masisitimu ekutarisa asina kukwana.
Dai Uber yainyatsoongorora nzira dzekushandisa masisitimu ayo uye yakashandisa nzira dziri nani dzekunyora magwaro, vangadai vakaona magwaro aya nekukurumidza. Nekuda kweizvozvo, kambani ingadai yakaderedza kukuvara kwemukurumbira uye kurasikirwa nemari. Kutyora uku kunosimbisa kukosha kwekuchengetedza masisitimu ekunyora magwaro anoshanda kuti vaone uye vaderedze njodzi nekukurumidza.
Nei zvichikosha nhasi? Kana masangano asina kuona nekutarisisa, anonetseka kuona kurwiswa nekukurumidza, zvichiita kuti varwisi vasaonekwe kwenguva yakareba.
10. Chikumbiro chenhema cheServer-Parutivi (SSRF) (A10:2021)
Chii chinonzi Server-Side Request Forgery?
SSRF inoitika kana vapambi vakanyengedza sevha kuti iite zvikumbiro kunzvimbo dzisina kurongwa, kazhinji vachiwana masevhisi emukati anofanira kudziviswa. Kusagadzikana uku kunobvumira vapambi kuwana data rakavanzika kana kuita mirairo pamasisitimu emukati.
Mishonga yeSSRF
Kuti udzivise SSRF, simbisa zvese zvinopinda mushandisi uye dzora kugona kwesevha kuita zvikumbiro zvekubuda. Pamusoro pezvo, shandisa runyorwa rwevanobvumirwa kudzora maURL api anogona kuwanikwa nesevha.
Xygeni's CI/CD Kuchengetedzwa kunobatsira kuongorora pipelines yezvinetso zvinogona kuitika zveSSRF. Uyezve, Xygeni's Anomaly Detection inogona kubata maitiro ekukumbira asingatarisirwi kana kuti anofungirwa.
Muenzaniso Wenyika Yechokwadi
In 2022, kushaya simba kukuru mu Microsoft Exchange (CVE-2022-41040) yakashandiswa nevapambi vachishandisa matekiniki eSSRF. Vapambi vakakwanisa kutumira zvikumbiro zvine hutsinye kuseva yeExchange, vachipfuura dziviriro dzekuchengetedza mukati.
Vapinda mukati, varwisi vakapinda mukati mehurongwa hwemukati uye vakakanganisa ruzivo rwakavanzika. Nekushandisa SSRF, vakawana mukana usina mvumo wekuwana zviwanikwa zvemukati zvakaganhurirwa, zvichikonzera kutyorwa kukuru kwekuchengetedzwa.
Kusasimba kweSSRF kune njodzi huru nekuti kunoita kuti vapambi vawane masisitimu emukati asingafanirwe kuratidzwa pachena. Dai Microsoft yakashandisa kusimbiswa kwakasimba kwekupinda uye zvirambidzo zvekukumbira zvinobuda, vangadai vakadzivisa kuedza kwevapambi kushandisa kusasimba uku. Kutyora uku kunoratidza kukosha kwekudzora zvikumbiro zvemaseva kune zviwanikwa zvemukati zvine hungwaru uye kuve nechokwadi chekuti masosi akavimbika chete ndiwo anogona kutaurirana nawo.
Nei zvichikosha nhasi? Magadzirirwo emakombiyuta emugore uye maAPI emukati akawedzera kukanganisa kweSSRF, iyo vapambi vanoshandisa kuwana masevhisi emukati akavanzika uye masisitimu emetadata.
Nei OWASP Top 10 Ichiri Kukosha
The OWASP Top 10 defects zvakakosha kumasangano anovavarira kuchengetedza mashandisirwo awo kubva kunjodzi dzinozivikanwa uye dzine njodzi. Njodzi idzi hadzisi dzekufungidzira; dzinomiririra njodzi dzechokwadi dzinogona kutungamira mukutyorwa kwedata, kurasikirwa nemari, uye kukuvara kwemukurumbira. Nekugadzirisa izvi, masangano anogona kuderedza zvakanyanya njodzi yekurwiswa kunobudirira uye kuve nechokwadi chekuti masisitimu avo akasimba kubva kunjodzi dzinochinja-chinja.
Uyezve, kushandisa nzira dzakakurudzirwa dziri pane runyorwa rweOWASP Top 10 defects kunobatsira masangano kutora nzira dzakarongeka dzekuchengetedza. Semuenzaniso, kusimbisa kudzora kupinda, kuchengetedza maitiro ekudzivirira, uye kuderedza njodzi dzekutengesa zvese zvinoita basa rakakosha mukugadzirisa defects idzi. Nekuda kweizvozvo, masangano anoderedza nzvimbo yekurwiswa, zvichiita kuti zviomere varwisi kushandisa kushaya simba kuri musystem.
Sezvo kutyisidzira kwepaindaneti kuri kuramba kuchikura, zvakakosha kuti masangano arambe ari pamberi pematambudziko anogona kuitika. Nekutora matanho nekukurumidza, masangano anovimbisa dziviriro yenguva refu yemapurogiramu avo uye kuchengetedza kuvimba kwevashandisi vavo.
Kupfuura njodzi dzeOWASP Top 10 dzekare, masangano ari kuramba achitarisana nemapakeji emahara ane hutsinye, kurwiswa kwekusawirirana kwevatengi, macampaign ekunyora, kodhi isina kuchengetedzeka yakagadzirwa neAI, CI/CD pipeline kubvumiranwa, kufumurwa muchivande, uye malware esoftware supply chain.
Mapurogiramu emazuva ano eAppSec ari kuwedzera kubatanidza nhungamiro yeOWASP ne software supply chain security, kuchengetedzeka kweAI, uye ongororo yenjodzi dzenguva yekumhanya kugadzirisa nzvimbo dzekurwiswa dziri kuchinja.
Maitiro eXygeni ekutsigira OWASP neOWASP SAMM Initiatives
Kugadzirisa OWASP Top 10 defects Zvakakosha kuchengetedza mawebhusaiti. zvisinei, kuchengetedza chikumbiro chako hakugumiri ipapo. Muenzaniso weOWASP Software Assurance Maturity (SAMM) inopa hurongwa hwekuongorora nekuvandudza kukura kwekuchengetedzwa kwako muhupenyu hwese hwekugadzira software (SDLC). Nokubatanidza Masangano haangogone chete kuderedza matambudziko aripo nekuda kwezvishandiso zvekuchengetedza zveXygeni OWASP Top 10 kuchengetedzeka kusingatarisirwi asi zvakare kuwedzera kukura kwavo kwekuchengetedzwa, sezvakatsanangurwa neOWASP SAMM.
Kusimbisa Kuchengetedzeka Kwemapurogiramu neXygeni
Xygeni inopa masangano simba rekugadzirisa runyorwa rweOWASP Top 10 deficiencies ukuwo ichikurumidzisa kushandiswa kweOWASP SAMM, ichibatsira masangano kuramba achivandudza kukura kwekuchengetedzwa kwesoftware. Nekuita otomatiki kudzora kuchengetedzeka, kugonesa kuisa zvinhu zvakakosha panjodzi, uye kusimbisa manejimendi yezviitiko, Xygeni inobatsira masangano kuvaka software yakachengeteka uye yakasimba, ichideredza njodzi yekutyorwa kwekuchengetedzwa.
Kuburikidza nekutarisa panguva chaiyo, kuona njodzi otomatiki, uye kusimbisa mitemo mukati mese SDLC, Xygeni inoita kuti zvive nyore kuchengetedza uye kutevedzera mitemo, ichienderana nemaitiro akanakisa eOWASP SAMM. Izvi zvinoita kuti masangano akwanise kukura zvishoma nezvishoma pakukura kwavo kwekuchengetedza, negwara rakajeka rekuvandudza nguva dzose.
Tora Chiito Iye Zvino Kuti Uchengetedze Mafomu Ako
The OWASP Top 10 defects ratidza njodzi huru dzekuchengetedza dziri kutarisana nemashandisirwo emazuva ano. Nekutevera Nhungamiro dzeOWASP uye kushandisa nzira dzakanakisisa dzakatsanangurwa pano, unogona chengetedza sangano rako kubva kunjodzi idzi uye kugadzira mapurogiramu anodzivirira kurwiswa kwakaoma.
Simbisa Kuchengetedzeka KwemaApplication Ako uye Software Supply Chain Security.
Mashandisirwo emazuva ano anoda zvinopfuura kungoongorora hutachiona hwechinyakare. Xygeni inobatsira masangano kuona, kuisa zvinhu zvakakosha, uye kugadzirisa njodzi gumi dzeOWASP pamusoro pekodhi yekodhi, kutsamira kwenzvimbo dzakavhurika, CI/CD pipelines, zvivakwa zvegore, uye mafambisirwo ebasa ekuvandudza anobatsirwa neAI.
Tsvaga kuti Xygeni inobatsira sei mapoka eAppSec neDevSecOps kuderedza njodzi mumabasa emazuva ano SDLC!
