Selelekela ho SSDF le Bohlokoa ba Eona bo Holang
The Moralo o Sireletsehileng oa Nts'etsopele ea Software (SSDF), e entsoe ke NIST (Setsi sa Sechaba sa Standardle Theknoloji), e fana ka moralo o hlakileng oa ho eketsa ts'ireletso mohatong o mong le o mong oa potoloho ea bophelo ba nts'etsopele ea software. Tlhaloso ea SSDF Ho thusa mekhatlo ho fokotsa bofokodi, ho sireletsa liketane tsa phepelo ea software, le ho netefatsa mekhoa e sireletsehileng ea moralo. NIST SSDF ho bohlokoa ha litšokelo tsa inthanete li ntse li hola, le ho fihlella Setifikeiti sa SSDF e tiisa hore lihlopha li latela lits'ebetso tse sireletsehileng tsa nts'etsopele 'me li fihlela litlhoko tsa taolo. Ka ho sebelisa mekhoa ena, mekhatlo e ka haha software e sireletsehileng, ea fokotsa likotsi esale pele, 'me ea boloka botšepehi ba software.
SSDF ke eng?
Moelelo oa SSDF o bolela sebopeho se hlophisitsoeng sete ea mekhoa e etselitsoeng ho ntlafatsa ts'ireletso ea software ka ho sebetsana le bofokodi kapele le ka mokhoa o tsitsitseng. Jwalo ka ha ho hlalositswe ho NIST SP 800-218, NIST SSDF e fana ka mokhoa o hlakileng oa ho sireletsa nts'etsopele ea software, e shebaneng le ho kopanya ts'ireletso ho pholletsa le potoloho ea bophelo ba nts'etsopele ea software (SDLC).
Ka mantsoe a mang, moelelo oa SSDF o totobatsa mehato e potlakileng ea ts'ireletso tse thusang mekhatlo ho fokotsa likotsi le ho sireletsa liketane tsa phepelo ea software. Moralo o Sireletsehileng oa Nts'etsopele ea Software ha o fokotse feela bofokoli empa hape o netefatsa ho latela melaoana e ntseng e fetoha joalo ka DORA le NIS2. Mohlala, e kenyelletsa litataiso tsa ho netefatsa botšepehi ba lintho tsa khale le ho sireletsa mekhoa ea ho itšetleha ka tsona ho thibela litlhaselo tsa ketane ea phepelo.
Hobaneng NIST SSDF e le ea Bohlokoa bakeng sa Tšireletso ea Software
Joalokaha ho boletsoe ho Tokomane ea NIST SP 800-218, ho amohela mekhoa ea Moralo oa Nts'etsopele ea Software e Sireletsehileng ho thusa mekhatlo ho fihlela lipheo tse tharo tsa mantlha:
Fokotsa Bofokoli ba Software:
Sa pele, ka ho kenya ditaolo tsa tshireletso esale pele, mekgatlo e ka fokotsa dikotsi pele di mpefala. Mohlala, bopaki ba SSDF bo fana ka bopaki ba hore mekgwa e sireletsehileng e latelwa ka hloko.Sireletsa Khahlanong le Litlhaselo tsa Ketane ea Phepelo:
Keketseho ea litlhaselo tsa ketane ea phepelo ea software e totobatsa tlhoko ea mehato ea ho nka bohato ba pele. Tabeng ena, ho amohela litataiso tsa NIST Secure Software Development Framework ho netefatsa tšireletso khahlanong le litšokelo tse kang ho sitisoa ke botšehetsi.Netefatsa Boikamahanyo ba Taolo:
Meralo ea taolo e kang taelo ea DORA le NIS2 e sireletsa mekhoa ea nts'etsopele. Ka lebaka leo, ho latela NIST SSDF ho tšehetsa ho latela melaoana ena.
Ha ho nahanoa ka lintlha tsena, ho kenya tšebetsong NIST SSDF ke leano la hocision bakeng sa ho ntlafatsa ts'ireletso ea software le ho mamella.
Sireletsa Hao CI/CD Pipeline
Sireletsa khahlanong le PPE, malware, le chefo ea lintho tse entsoeng ka maiketsetso ka maano a litsebi a tsoang ho Luis Garcia oa Xygeni.
Mekhoa ea Bohlokoa ea NIST SSDF
Moralo oa NIST SSDF, o hlalositsoe ho NIST SP 800-218, e kopanya mekhoa ea nts'etsopele ea software ka lihlopha tse 'neKa lebaka leo, mekhoa ena ea bohlokoa bakeng sa ho fokotsa bofokoli, ho ntlafatsa ts'ireletso, le ho netefatsa hore melao e lateloa ho pholletsa le potoloho ea bophelo ea nts'etsopele ea software (SDLC)Ho utloisisa ka botlalo moelelo oa SSDF le ho fihlela bopaki ba SSDF, mekhatlo e hloka lisebelisoa tse nolofatsang le ho tšehetsa lits'ebetso tsena. Ka lehlohonolo, Xygeni e fana ka ditharollo tse etsang hore ho kenngwa tshebetsong ha Moralo wa Ntlafatso ya Software o Sireletsehileng ho be le bokgoni le katleho.
Lokisa Mokhatlo (PO)
NIST SSDF e qala ka ho hlalosa litlhoko tsa ts'ireletso, ho hlophisa libaka tse sireletsehileng tsa nts'etsopele, le lihlopha tsa koetliso. Ha e le hantle, mehato ena e theha motheo oa nts'etsopele e sireletsehileng ea software 'me e tsamaisana le moelelo oa SSDF oa ho kenya ts'ireletso mohatong o mong le o mong oa SDLCHase feela seo, empa mehato ena e boetse e thusa mekhatlo ho lula e le mafolofolo ho fokotseng likotsi.
Mohlala, Xygeni's Application Security Posture Management (ASPM) tharollo e thusa lihlopha ho bona ka botlalo ka boemo ba ts'ireletso ba lits'ebetso tsa bona. Ka ho etsa joalo, e lumella lihlopha ho lemoha bofokoli le litlhophiso tse fosahetseng esale pele. Ka lebaka leo, Xygeni e netefatsa hore lihlopha li itokiselitse hantle ho fihlela litlhoko tsa netefatso ea SSDF. Ho feta moo, mokhoa ona oa ho sebetsa ka thata o thusa bahlahisi ho kopanya mekhoa e sireletsehileng ka mokhoa o se nang mathata. Ka lebaka leo, mekhatlo e ka amohela Moralo oa Nts'etsopele ea Software e Sireletsehileng ka kholiseho le katleho.
Sireletsa Software (PS)
Ho sireletsa software ho kenyelletsa ho netefatsa hore khoutu, tikoloho le meralo ea motheo litšokelong. NIST SSDF e totobatsa tlhoko ea ho laola tlhahisoleseding e hlokolosi le ho boloka botšepehi ba khoutu, e leng karolo ea bohlokoa ea moelelo oa SSDF.
Xygeni Secrets Security e lemoha le ho thibela ho dutla ha sephiri ka nako ya sebele, e netefatsa hore data e hlokolosi jwalo ka diphasewete le dinotlolo tsa API ha e pepeswe. Ho feta moo, Ho Fumana Anomaly ea Xygeni ho lekola ka ho tsoelang pele CI/CD pipelinele libaka tsa polokelo bakeng sa mesebetsi e belaetsang. Mehato ena e tšehetsa bopaki ba SSDF ka ho netefatsa hore software e lula e sirelelitsoe nakong eohle ea nts'etsopele.
Hlahisa Software e Sirelelitsoeng Hantle (PW)
Moralo oa Nts'etsopele ea Software o Sireletsehileng o totobatsa bohlokoa ba ho kopanya diteko tsa tshireletso ntshetsopeleng le ho kenngwa tshebetsong ha tsona Mohato ona o matlafatsa moelelo oa SSDF ka ho tšoara bofokoli esale pele le ho netefatsa botšepehi ba software.
Xygeni e tšehetsa mokhoa ona ka ho kenya liskena tsa ts'ireletso kahare ho CI/CD pipelines. Lihlopha li ka lemoha bofokoli le ho se be le diphetoho tse nepahetseng ka bohona nakong ya kaho e nngwe le e nngwe. Ho feta moo, netefatso ya botšepehi ba kaho ya Xygeni e hlahisa bopaki bo dumellanang le SLSA, e leng se netefatsang hore ha ho motho ya senyang mesebetsi ya matsoho nakong ya ntshetsopele. Bokgoni bona bo thusa mekgatlo ho fihlella bopaki ba SSDF ka boitshepo.
Arabela ho Kotsi (RV)
Ho arabela bofokoding kapele ho bohlokoa bakeng sa ho boloka software e sireletsehileng. NIST e khothaletsa tlhokomelo e tsoelang pele le karabelo e potlakileng, e tsamaellanang le tlhaho ea ho nka bohato ba pele ea moelelo oa SSDF.
Tlhokomelo le ho lemoha lintho tse sa tloaelehang tsa Xygeni ka nako ea sebele li khetholla litšokelo tse ka bang teng libakeng tsa nts'etsopele le pipelines. Ha mathata a hlaha, Xygeni e tsebisa lihlopha tsa tšireletso hang-hang, e nolofalletsa tokiso e potlakileng. Mokhoa ona o tšehetsa bopaki ba SSDF ka ho netefatsa hore kholofalo li rarolloa ka potlako le ka katleho.
Sireletsa Bokamoso ba Hao: Amohela NIST SSDF bakeng sa Nts'etsopele ea Software e Tieang
Moralo o Sireletsehileng oa Nts'etsopele ea Software, e hlalositsoe ho NIST SP 800-218, e bontša mokhoa o bonolo oa ho haha software e sireletsehilengHa lihlopha li utloisisa moelelo oa SSDF 'me li tlatsa bopaki ba SSDF, li ka fokotsa mefokolo ea ts'ireletso, tsa itšireletsa khahlanong le litlhaselo tsa ketane ea phepelo, le ho fihlela melao ea indasteri.
Ka ho sebelisa lisebelisoa tsa Xygeni, ho sebelisa mekhoa ena ea moralo oa NIST ho ba bonolo. Xygeni e thusa ho sireletsa mohato o mong le o mong oa nts'etsopele ea software ka ho fana ka ponahalo e hlakileng, ho laola liphiri, ho hlahloba botšepehi ba ho aha, le ho lemoha mesebetsi e sa tloaelehang.
Na u se u loketse ho sireletsa ts'ebetso ea hau ea nts'etsopele ea software?
Ikopanye le Xygeni kajeno ho ntlafatsa Moralo o Sireletsehileng oa Ntlafatso ea Software ho latela melao le ho aha software e tiileng le e sireletsehileng.
