Selelekela: Tsamaiso ea ho ba kotsing e thehiloeng likotsing tlas'a Molao oa ho mamella Cyber
Lihlopha tsa sejoale-joale li se li ntse li tseba hore ho lokisa bofokoli bo bong le bo bong ha ho khonehe. Se hlileng se leng bohlokoa ke ho lokisa tse nepahetseng. Ke ka lebaka leo taolo ea bofokoli bo thehiloeng kotsing e se e le mokhoa o ratoang haholo bakeng sa lihlopha tsa DevSecOps. Leha ho le joalo, Kopanong ea Europe, ena ha e sa le mokhoa o motle feela. Cyber Resilience Act e hlahisa ditlamo tse tiileng tsa molao, haholoholo ha software e kenyeletsa ditaba tse thathamisitsweng ho CISKhataloge e Tsejoang ea ho Senyeha ha Batho ba Senyehileng.
Moelelong ona o mocha, ho beha pele bofokodi ho tloha ho khetho ea ts'ireletso ho ea ho tlhoko ea ho latela melao. Lihlopha li tlameha ho paka hore lia utloisisa hore na ke bofokodi bofe bo sebelisoang hampe ka mafolofolo le hore na li etsa qeto ea hore na li lokisoe pele ke eng.
Taolo ea Bofokoli bo Thehiloeng Kotsing le Bofokoli bo Tsejoang bo Sebelisitsoeng Hampe
Taolo ea bofokoli e thehiloeng kotsing e shebana le ho pepesehela ha 'nete ho fapana le ho se be matla haholo. Ho e-na le ho tšoara li-CVE tsohle ka ho lekana, lihlopha li etelletsa pele ho latela tšebeliso e mpe, ho fihlella habonolo le tšusumetso.
Mona ke moo bofokoli bo tsebahalang bo sebelisoang hampe bapala karolo ea bohlokoa. Ha CVE e hlaha ho CISKhataloge e Tsejoang ea ho Senyeha ha Batho ba Senyehileng, e tiisa hore bahlaseli ba se ba ntse ba e sebelisa libakeng tsa sebele. Letšoao leo le na le boima bo boholo ho feta lintlha tsa khopolo-taba.
Haeba o batla tlhaloso e tebileng ea hore na li-KEV ke eng le hore na u ka li khetholla joang, o ka bala poso ea rona ea pejana. Mathata a Tsejoang a Senyehileng: Seo U Lokelang ho se Lokisa PeleSehloohong sena, re shebana le kamoo li-KEV li kenang kateng mehlaleng ea ho latela melao le ho beha lintho pele tlas'a Cyber Resilience Act.
Seo Molao oa ho Ikemela ha Inthanete o se Hlokang Hantle
The Cyber Resilience Act e beha boikarabello ba tshireletso ya inthanete bakeng sa dihlahiswa tse nang le dielemente tsa dijithale tse rekiswang EU. Ho ya ka ditokomane tsa semmuso tsa EU:
- https://www.european-cyber-resilience-act.com/
- https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act
Bahlahisi ba tlameha ho:
- Hlalosa le ho sebetsana le bofokoli ho pholletsa le potoloho ea bophelo ba sehlahisoa
- Thibela software ea ho romella thepa ka bofokoli bo tsebahalang bo sebelisoang hampe
- Etsa kopo ea tokiso ka nako hang ha ho tsejoa hore ho na le ts'ebeliso e mpe
- Boloka bopaki ba ho sebetsana le bofokodicision
Ka mantsoe a mang, hang ha bofokoli bo hlaha CISKhataloge e Tsejoang ea ho Senyeha ha Batho ba Senyehileng, ho e hlokomoloha ho baka kotsi ea ts'ireletso le ea taolo.
Molao oa ho Ikemela ha Cyber (CRA) ke eng?
The Cyber Resilience Act ke molaoana oa EU o hlalosang litlhoko tse tlamang tsa ts'ireletso ea inthanete bakeng sa software le lihlahisoa tsa dijithale tse rekisoang Europe. E hloka hore barekisi ba laole bofokoli ho pholletsa le potoloho ea bophelo ba sehlahisoa le ho qoba ho lokolla software e nang le bofokoli bo tsebahalang bo sebelisoang hampe.
Lethathamo la Litekanyetso tsa ho Etella Pele ho Kotsi ea CRA
| Tlhokahalo ea | Seo CRA e se Lebeletseng | Mokhoa o Molemohali oa Lihlopha |
|---|---|---|
| Sebelisa temoho hampe | Thibela software ea ho romella thepa e nang le bofokoli bo tsejoang bo sentsoeng hampe | Bapisa liphetho ka bohona khahlanong le CISKhataloge e Tsejoang ea ho Senyeha ha Batho ba Senyehileng |
| Ho beha lintho pele ho latela likotsi | Tsepamisa maikutlo holim'a bofokoli bo bakang kotsi ea 'nete ea ts'ireletso | Kopanya li-KEV, EPSS, phihlello, le ho pepesehela thepa |
| Phetoho e nakong | Etsa ditokiso ntle le tieho e sa utlwahaleng hang ha ho se ho tsejwa hore ho se ho sebediswe hampe | Hlalosa litokiso tsa SLA hona joale bakeng sa li-KEV tse ka fihlellehang 'me u li qobelle ho sebetsa CI/CD |
| Tlhahlobo e tsoelang pele | Sebetsana le bofokoli ho pholletsa le potoloho ea bophelo ba sehlahisoa | Etsa li-scan tse tsoelang pele khoutung, litšekamelo, le pipelines |
| Litaolo tsa tokollo | Qoba ho lokolla lihlahisoa tse nang le liphoso tse sebelisoang hampe | Thibela ho kopanngoa kapa ho kenngoa ha li-KEV ha li ama khoutu e ka fihlellehang |
| Decisho latela li-ion | Paka kamoo bofokoli bocisli-ion li entsoe | Boloka litlaleho tsa tlhahlobo bakeng sa ho lemoha, ho beha lintho pele le liketso tsa tokiso |
| Kopanyo ea moqapi | Mehato ea ts'ireletso ha ea lokela ho sitisa mesebetsi ea nts'etsopele | Ho beha maemo a holimo pele ka ho toba ho pull requests le CI pipelines |
| Boikarabello ba potoloho ea bophelo | Boloka tšireletso ka mor'a ho lokolloa | Latela liphetoho tsa KEV le EPSS bakeng sa mefuta e rometsoeng |
Hobaneng ha KEV e le ea Bohlokoa ho Lateleng Melao ea CRA
The CISKhataloge e Tsejoang ea ho Senyeha ha Batho ba Senyehileng e thathamisa li-CVE tseo bahlaseli ba seng ba ntse ba li sebelisa hampe naheng. Ka mantsoe a mang, e tlosa ho se hlaka ho beheng lintho tsa bohlokoa pele.
Ho ena le ho botsa "Na see se ka sebelisoa hampe?", lihlopha joale li lokela ho botsa potso e tobileng haholoanyane:
"Na see se se se ntse se sebelisoa hampe, hona na re se romela?"
Tlas'a Molao oa ho Ikemela ha Marang-rang, phapang eo ea bohlokoa ka molao. Ka lebaka leo, li-KEV li fetoha sesosa se matla ka ho fetisisa sa li-SLA tsa tokiso le thibelo ea tokollo. Moelelong ona, taolo ea bofokoli bo thehiloeng kotsing e tsamaellana ka tlhaho le litebello tsa taolo.
CVSS, EPSS, le KEV li sebeletsa merero e fapaneng
Ho beha lintho pele ka nepo, lihlopha li tlameha ho utloisisa pele hore na lets'oao ka leng le emela eng.
- CVSS e bontša tšusumetso e ka bang teng
- EPSS e hakanya monyetla oa ho sebelisoa hampe
- CISKhataloge e Tsejoang ea ho Senyeha ha Batho ba Senyehileng e tiisa hore tlhekefetso e se e ntse e etsahala
Ha e nkoa e le 'ngoe feela, tekanyo ka 'ngoe e ka khelosa. Leha ho le joalo, ha lihlopha li li sebelisa hammoho, li fumana moelelo o hlakileng haholoanyane. Ka lebaka lena, ho kopanya matšoao ana ho theha motheo oa taolo e sebetsang ea bofokoli bo thehiloeng kotsing.
Tsamaiso ea ho ba kotsing e thehiloeng likotsing e sebetsang
Ha e le hantle, mohlala oa ho beha lintho pele o susumetsoang ke kotsi o latela phallo e hlakileng le e ka phetoang.
- Lemoha bofokoli ho pholletsa le khoutu le ho itšetleha ka eona
- Hlahloba lipapali khahlanong le CISKhataloge e Tsejoang ea ho Senyeha ha Batho ba Senyehileng
- Lekola monyetla oa ho sebelisa EPSS
- Netefatsa phihlello ho kopo ea hau kapa pipeline
- Sebelisa melao ea tokiso e ipapisitseng le ho pepesehela le karolo ea sehlahisoa
Ka lebaka leo, lihlopha li khaotsa ho tšoara manane a bofokoli e le mesaletsa e sa fetoheng 'me li qala ho a tšoara e le tšireletso e tiileng eacisli-ion.
Mefuta e fapaneng ea ho Beha Pele Lintho Tse Sebetsoang ke Lihlopha Kajeno
Hase lihlopha tsohle tse behang kotsi pele ka tsela e tšoanang. Ka kakaretso, re bona mehlala e meraro e tloaelehileng libakeng tsa sebele.
1. Mohlala oa Pele oa Bohloko
Lihlopha li lokisa mathata ho latela CVSS feela.
Mohlala ona o bonolo ho o amohela. Leha ho le jwalo, o baka lerata mme ha o fihlelle ditebello tsa Cyber Resilience Act.
2. Mohlala o Tsamaiswang ke Monyetla
Lihlopha li itšetleha ka EPSS ho bolela esale pele hore na bahlaseli ba ka sebelisa eng ka mor'a moo.
Mokhoa ona o ntlafatsa ho tsepamisa maikutlo. Leha ho le jwalo, o ntse o hloloheloa bofokodi boo bahlaseli ba seng ba ntse ba bo sebelisa hampe.
3. Mohlala o Hlokomelang Tšebeliso e Mpe
Lihlopha li kopanya EPSS le CISKhataloge e Tsejoang ea ho Senyeha ha Batho ba Senyehileng le moelelo oa tekheniki.
Ka lehlakoreng le leng, mohlala ona o tshehetsa ka ho fetisisa taolo ya bofokodi bo itshetlehileng hodima dikotsi mme o hokahanya ka ho toba le ditlamo tsa CRA.
Kamoo Xygeni e Sebetsang ho Beha Pele CRA e Loketse
Xygeni e thusa lihlopha ho fetola taolo hore e be mosebetsi oa letsatsi le letsatsi.
Hona le ho itšetleha feela ka dashboards, Xygeni e qobella decisli-ion hantle moo liphetoho tsa khoutu li etsahalang teng. Ka hoo, ho beha lintho pele ho fetoha ntho e iketsahallang le e tsitsitseng.
Bokhoni ba bohlokoa bo kenyelletsa:
- Kamano e iketsang le CISKhataloge e Tsejoang ea ho Senyeha ha Batho ba Senyehileng
- Sephetho sa monyetla oa ho sebelisa hampe se thehiloeng ho EPSS
- Tlhahlobo ea phihlello ho netefatsa ho pepesehela ha 'nete
- Guardrails e thibelang e kopana kapa e lokolloa ha li-KEV li ama khoutu e ka fihlellehang
- Tokiso e iketsahalletseng ka mokhoa o sireletsehileng pull requests
- Litlaleho tse felletseng tsa tlhahlobo li lokela ho bontšoa Cyber Resilience Act latelwa
Ka bokhutšoanyane, lihlopha ha li bone kotsi feela. Li e nka ka tsela e pheta-phetoang le e ka hlahlojoang.
Mohlala oa Dev ho ea ho Dev: KEV e Thibela Tokollo
Ak'u nahane ka ntlafatso ea boitšepo e hlahisang CVE.
- Bofokodi bo hlaha ho CISKhataloge e Tsejoang ea ho Senyeha ha Batho ba Senyehileng
- Xygeni e e lemoha nakong ea pull request
- Tlhahlobo ea phihlello e tiisa hore tsela ea khoutu e ea sebetsa
- Guardrails thibela ho kopanya ka bohona
- Bot e etsa tlhahiso ea ntlafatso e sireletsehileng 'me e etsa liteko
Moqapi o rarolla bothata ka mokhoa o tšoanang oa ts'ebetso. Tokollo e lula e latela melao. Ha ho hlokahale liboka.
Ka mantsoe a mang, ena ke taolo ea bofokoli e thehiloeng kotsing e sebelisoang hantle moo bahlahisi ba seng ba ntse ba sebetsa teng.
Lebaka Leo Sena se Leng Bohlokoa ho Feta ho Latela Melao
Le hoja Cyber Resilience Act Ha e bakile phetoho ena, melemo e ea pele.
Lihlopha tse behang pele ho sebelisa li-KEV, EPSS, le moelelo:
- Fokotsa mokhathala oa temoso
- Khutsufatsa nako ea tokiso
- Qoba li-patches tsa maemo a tšohanyetso
- Romela software e sireletsehileng ka boitšepo
Ka kakaretso, ho latela melao ho fetoha sephetho sa tlhaho sa ho etsa ts'ireletso ka tsela e nepahetseng.
Mehopolo ea ho Qetela: CRA e Etsa Hore Tsamaiso e Thehiloeng Kotsing e be Tlamo
The Cyber Resilience Act e hlophisa semmuso seo lihlopha tsa tšireletso li seng li ithutile sona ka tsela e thata. Hase bofokoli bohle bo bohlokoa ka ho lekana.
The CISKhataloge e Tsejoang ea ho Senyeha ha Batho ba Senyehileng e hlalosa seo bahlaseli ba se sebelisang kajeno. EPSS e bolela esale pele seo ba tla se sebelisa ka mor'a moo. Moelelo o bontša hore na oa u ama.
Hammoho, li theha mokhoa oa sejoale-joale taolo ea bofokoli bo thehiloeng kotsing.
Xygeni e thusa lihlopha ho sebelisa mohlala ona ka ho tsoelang pele, ka bohona, le ka tsela eo bahlahisi ba e amohelang.
About Mongoli
ngotsoeng ke Fatima Said, Motsamaisi oa Papatso ea Litaba ea ikhethang ka Tšireletso ea Likopo ho Tšireletso ea Xygeni.
Fátima e theha dikahare tse loketseng bahlahisi, tse thehilweng dipatlisisong ho AppSec, ASPM, le DevSecOps. O fetolela mehopolo e rarahaneng ea tekheniki hore e be temohisiso e hlakileng, e sebetsang e hokahanyang boqapi ba ts'ireletso ea inthanete le tšusumetso ea khoebo.
