Sesebelisoa se seng sa bohlokoa se fumanang botumo ho matlafatseng ts'ireletso ea software ke Bili ea Lisebelisoa tsa Software kapa SBOM. Ha a ntse a SBOMLi-software li 'nile tsa sebelisoa ke bahlahisi ba software nako e telele, bohlokoa ba tsona bo eketsehile ka mokhoa o ke keng oa latoloa morao tjena, haholo-holo ka ho lokolloa ha Taelo ea Phethahatso mabapi le Ntlafatso ea Tšireletso ea Marang-rang ea Sechaba. Empa ke eng SBOM, hona ke hobane'ng ha e le ea bohlokoa hakaale lefapheng la ts'ireletso ea software? A re rarolleng liphiri 'me re hlahlobe bohlokoa ba tsona.
Tafole ea likateng
Ke eng SBOM?
Na ua tseba hore na SBOM"Joalokaha NTIA e bolela ka bokgabane, "An SBOM ke lethathamo la lintho tse se nang letho, lethathamo la metsoako e etsang likarolo tsa software. " Nahana ka eona e le lethathamo la metsoako bakeng sa risepe. Feela joalokaha risepe e thathamisa likarolo tsohle tse hlokahalang ho etsa sejana, SBOM e thathamisa likarolo tsohle le litšekamelo tse etsang sesebelisoa sa software. Sena se kenyelletsa ntho e 'ngoe le e 'ngoe ho tloha lilaebraring tsa mohloli o bulehileng le likarolo tsa mokha oa boraro ho ea ho khoutu ea beng ba eona le lilaesense.
SBOM tšireletso e fana ka pono e felletseng ea metheo ea ts'ebetso ea software, e lumellang mekhatlo ho utloisisa le ho laola likotsi tse ka bang teng tsa ts'ireletso tse amanang le karolo ka 'ngoe. Ponahalo ena e thusa ho lekola bofokoli, ho latela lintlafatso, le ho khetholla lintlha tse ka bang teng tsa bofokoli ka har'a ketane ea phepelo ea software.
Liketsahalo tsa Bohlokoa Ho Khanna SBOM Ho amoheloa
Ho amoheloa ha SBOM Tšireletso e fumane matla a maholo lilemong tsa morao tjena, e susumetsoa ke liketsahalo le lintlafatso tse 'maloa tsa bohlokoa:
- Taelo ea Phethahatso mabapi le Ntlafatso ea Tšireletso ea Inthanete ea Sechaba (EO 14028): Ka Mots'eanong 2021, White House e ntshitse EO 14028, e laelang tshebediso ya SBOMs bakeng sa litsamaiso tse itseng tsa bohlokoa tsa software mmusong oa kopanelo 'me li khothalletsa ho amoheloa ha tsona ho pholletsa le lekala la poraefete.
- Setsi sa Sechaba sa StandardNtlafatso ea Moralo oa Ts'ireletso ea Inthanete le Theknoloji (NIST): Ka 2022, NIST e ntlafalitse Moralo oa eona oa Ts'ireletso ea Marang-rang ho li kenyelletsa e le taolo ea bohlokoa bakeng sa ho ntlafatsa software supply chain security.
- Mokhatlo oa Machaba oa Standardtlhahiso (ISO) Standardtlhahiso: Ka 2023, ISO e phatlalalitse ISO/IEC 5280:2023 standard etsoe SBOMs, ho fana ka standardmokhoa o hlophisitsoeng oa ho theha, ho laola le ho fapanyetsana lintlha.
Ke tlhahisoleseding efe e etsang SBOM na?
SBOMLi fumaneha ka mekhoa e fapaneng, e 'ngoe le e 'ngoe e na le melemo le mathata a eona. SPDX le CycloneDX ke tse ling tsa tse sebelisoang khafetsa. SBOM liforomo.
Hangata e kenyelletsa likarolo tse latelang tsa bohlokoa:
- Lisebelisoa tsa Software: Lethathamo le qaqileng la likarolo tsohle tsa software tse sebelisitsoeng sehlahisoa, ho kenyeletsoa lilaeborari, meralo le li-binary.
- Linomoro tsa Phetolelo: Dintlha tse ikgethang tsa mofuta o itseng bakeng sa karolo e nngwe le e nngwe ya software, tse nolofalletsang ho latelwa le ho hlwaya bofokodi bo ka bang teng.
- Ho itšepa'Mapa oa likamano lipakeng tsa likarolo tsa software, tse bontšang kamoo li sebelisanang le ho itšetleha ka tsona.
- phaketse: Tlhahisoleseding e eketsehileng e amanang le karolo ka 'ngoe ea software, joalo ka laesense, lintlha tsa morekisi, le tlhaiso-leseling ea litokelo tsa mongoli.
- Likotsi tsa Ts'ireletso: Haeba e fumaneha, tlhahisoleseling mabapi le bofokoli bo tsejoang bo amanang le likarolo tsa software.
Mohlala oa CycloneDX SBOM ka mokhoa oa JSON
{ "bomFormat": "CycloneDX", "specVersion": "1.3", "serialNumber": "urn:uuid:6a77d60f-8711-4fb2-ba57-80a8a4a6d2a1", , "version": 1, "metadata": { "timestamp": "2023-10-30T12:30:00Z", "tools": [ { "vendor": "Xygeni.io", "name": "SBOM Generator", "version": "1.0" } ] }, "components": [ { "type": "library", "name": "nacl-library", "version": "1.0.0", "group": "com.example.security", "licenses": [ { "id": "Apache-2.0", "name": "Apache License 2.0", "url": "https://opensource.org/licenses/Apache-2.0" } ] }, { "type": "application", "name": "secure-app", "version": "2.5.1", "group": "com.example.apps", "licenses": [ { "id": "MIT", "name": "MIT License", "url": "https://opensource.org/licenses/MIT" } ], "components": [ { "type": "framework", "name": "Spring Boot", "version": "2.6.0", "licenses": [ { "id": "Apache-2.0", "name": "Apache License 2.0", "url": "https://opensource.org/licenses/Apache-2.0" } ] }, { "type": "library", "name": "log4j", "version": "2.14.1", "licenses": [ { "id": "Apache-2.0", "name": "Apache License 2.0", "url": "https://opensource.org/licenses/Apache-2.0" } ] } ] } ] } Ke hobane'ng ha SBOM Tšireletso e Bohlokoa Tšireletsong ea Software
Tlhahlobo le Pheko e Ntlafetseng ea Bofokoli
SBOMLi bapala karolo ea bohlokoa ho khetholleng le ho lokiseng bofokoli ba ts'ireletso lits'ebetsong tsa software. Ka ho fana ka lethathamo le felletseng la likarolo tsohle tsa software le litšekamelo tsa tsona, li nolofalletsa mekhatlo ho:
- Latela tšimoloho ea likarolo: SBOMs e senola tšimoloho ea likarolo tsa software, e leng se lumellang mekhatlo ho sala morao ho khoutu ea mohloli oa pele kapa sephutheloana bakeng sa litšenolo le li-patches tsa bofokoli.
- Hlalosa bofokoli bo tsebahalang: SBOMs li ka skenoa khahlanong le li-database tsa bofokoli ho khetholla bofokoli bo tsejoang bo amanang le likarolo tse itseng. Mokhoa ona oa ho itšireletsa o thusa mekhatlo ho beha pele bofokoli ba bohlokoa pele bo ka sebelisoa hampe ke bahlaseli.
- Iketsetse ho hlahloba bofokoli: SBOMs e ka sebelisoa ho iketsetsa lits'ebetso tsa ho hlahloba bofokoli, ho boloka nako le boiteko bakeng sa bahlahisi le lihlopha tsa ts'ireletso. Boiketsetso bona bo ka ntlafatsa haholo katleho ea boiteko ba taolo ea bofokoli.
Ho Latela Ts'ireletso ho Ntlafalitsoeng Standards
Ho amoheloa ha SBOM tšireletso e ntse e e-ba ea bohlokoa haholo bakeng sa mekhatlo ho bontša ho latela ts'ireletso ea software standardle melawana. Mekhatlo e 'maloa ea indasteri le mekhatlo ea mmuso e laetse tšebeliso ea SBOMs, ho kenyelletsa:
- Lefapha la Tšireletso la US (DoD): E laela hore ho sebelisoe SBOMs bakeng sa software eohle e ntshetsweng kapa e sebediswang ke DoD.
- Setsi sa Tšireletso ea Naha (NSA): E khothaletsoa hore e sebelisoe ho ntlafatsa boleng ba software supply chain security.
- Tsamaiso ea Naha ea Likhokahano le Tlhahisoleseling (NTIA)): E khothalletsa nts'etsopele le ho amoheloa ha SBOM standardle litataiso.
- The OpenSSF Sehlopha se sebetsang: Morero o tsamaisoang ke sechaba o khothalletsang standardho theha le ho amohela SBOMs.
Ka ho latela ditaelo tsena, mekgatlo e ka bontsha commitho sireletsa tshireletso ya inthanete le ho itshireletsa dikotlong le dikotlong tse ka bang teng.
Ponaletso e Matlafalitsoeng le Traceability
Li khothalletsa pepeneneng le ho sala morao ho pholletsa le ketane ea phepelo ea software. Ka ho fana ka pono e hlakileng le e felletseng ea likarolo tsa software le tšimoloho ea tsona, SBOMs e ka thusa ho:
- Khetholla le fokotsa litlhaselo tsa ketane ea phepelo: SBOMs e ka sebelisoa ho khetholla bofokoli bo ka bang teng bo hlahisitsoeng ke likarolo kapa bafepedi ba nang le mathata. Tlhahisoleseling ena e ka sebelisoa ho nka mehato ea ho lokisa ho itšireletsa khahlanong le litlhaselo tsa ketane ea phepelo.
- Ntlafatsa tšebelisano-'moho lipakeng tsa bankakarolo: SBOMs e ka nolofatsa tšebelisano-'moho pakeng tsa bahlahisi, lihlopha tsa tšireletso, le bankakarolo ba bang ho pholletsa le ketane ea phepelo ea software. Sena se ka thusa ho netefatsa hore bohle ba amehang ba na le kutloisiso e hlakileng ea sebopeho sa software le boemo ba ts'ireletso.
Karabelo e Atlehang ea Ketsahalo
Li ka thusa ho fokotsa kotsi ea litlamorao tse latelang tse bakoang ke bofokoli ba ts'ireletso:
- Ho tsebahatsa le ho lokisa bothata kapele: SBOMs e nolofalletsa mekhatlo ho lemoha le ho lokisa bofokoli qalong ea ts'ebetso ea nts'etsopele pele e ka fetisetsoa libakeng tsa tlhahiso. Sena se ka thibela litlamorao tse latelang, joalo ka ho tlola ha data le ho tima ha eona.
- Nako e fokotsehileng ea tharollo: SBOMs e ka potlakisa ts'ebetso ea ho lokisa ka ho fa bahlahisi kutloisiso e hlakileng ea likarolo tse amehileng le litšekamelo tsa tsona. Sena se ka fokotsa nako e nkang ho khetholla le ho sebelisa li-patches, sa fokotsa monyetla oa hore bahlaseli ba sebelise bofokoli.
Emerging Trends in SBOM Kamohelo ea Tšireletso
E le kamohelo ea SBOMHa mekhoa e ntse e hola, mekhoa e 'maloa e ntseng e hlaha e bopa sebaka:
- Standardho kopanya le ho sebelisana 'moho: The standardHo ntlafatsa difomete, jwalo ka CycloneDX, ho kgothaletsa tshebedisano-mmoho pakeng tsa disebediswa le dipolatefomo tse fapaneng.
- Kopanyo le DevOps le CI/CD Pipelines: SBOMli ntse li kopanngoa ho DevOps le CI/CD pipelineho iketsetsa tlhahiso, tsamaiso le kabo ea data.
- E thehiloe marung SBOM Solutions: E thehiloe marung SBOM Litharollo lia hlaha, li fa mekhatlo sethala se ka atolosoang le se sireletsehileng bakeng sa ho laola data ea bona.
- Tšebelisano-'moho e Eketsehileng le Kaho ea Sechaba: The SBOM sechaba se ntse se hola, ka mekhatlo le batho ka bomong ba sebelisana 'moho mererong ea ho khothaletsa SBOM ho amoheloa le ho ntlafatsoa ha tshireletso.
Nka fumana joang SBOM & Ntlafatsa Tšireletso ea Software ea ka?
Jwale kaha o a tseba hore na SBOM u utloisisa hore ho hlahisa le ho boloka SBOM tshireletso e ka ba mosebetsi o rarahaneng, haholo-holo bakeng sa mekhatlo e nang le ketane e kholo le e rarahaneng ea phepelo ea software. Sethala sa Xygeni e ka hlahisa ka bo eona SBOMs bakeng sa polokelo ea hau ea software ka mekhoa e sebelisoang haholo ea SPDX le CycloneDX. E boetse e netefatsa hore melao le indasteri ea mmuso oa US lia lateloa. standards, joalo ka Setsi sa Tšireletso ea Marang-rang le Ts'ireletso ea Meralo ea Motheo (CISLitlhoko tsa A).
Ho Fetola Tšireletso ea Software le ho Netefatsa Botšepehi ba Dijithale
SBOM ke matla a fetolang lefats'e la dijithale, a fetolang software supply chain security le ho matlafatsa mekhatlo ho tsamaisa ka boitšepo mathata a tikoloho ea software ea sejoale-joale. Bokhoni ba bona ba ho ntlafatsa ponaletso, ho sireletsa botšepehi, le ho nolofatsa ho latela melao bo ba etsa sesebelisoa sa bohlokoa bakeng sa lihlopha tsa ts'ireletso lefatšeng ka bophara.
Ho amohela SBOM tšireletso e bohlokoa bakeng sa mokhatlo ofe kapa ofe o ikemiselitseng ho ntlafatsa mekhoa ea ts'ireletso ea software. Ho utloisisa hore na ke eng SBOM e ntlafatsa ponahalo ea ketane ea phepelo, e thusa lihlopha tsa tšireletso ho laola likotsi le ho netefatsa hore melao ea tsamaiso e lateloa ka katleho.
As SBOM Ha e ntse e tswela pele ho amohelwa, karolo ya yona ya bohlokwa ho sireletseng ditsamaiso tsa software e ntse e hlaka haholoanyane. Mekgatlo e amohelang SBOMHa ba laole bofokodi feela; ba tsetela bokamosong ba tshireletso ya software, ba netefatsa botshepehi bo sa thekeseleng le ho tiya ha meralo ya bona ya motheo ya dijithale. SBOMs ha se sesebelisoa feela; ke ntlha ea bohlokoa ea leano bakeng sa mekhatlo e batlang ho atleha lefatšeng le hokahaneng haholo, le tsamaisoang ke data.
