Selelekela ho CVSS #
Sistimi ea ho fumana lintlha tsa maemo a tšohanyetso (CVSS) ke standardmoralo o hlophisitsoeng bakeng sa ho lekola le ho fumana lintlha tse tebileng tsa bofokoli ba software. CVSS e fana ka lintlha tsa lipalo pakeng tsa 0.0 le 10.0, moo lintlha tse phahameng li bontšang bofokoli bo tebileng haholoanyane. Ka ho utloisisa CVSS ke eng, mekhatlo e ka beha boiteko ba eona ba tokiso pele ka katleho. Ho feta moo, Sistimi ea Common Vulnerability Scoring e fana ka mokhoa o tsitsitseng oa tlhahlobo ea likotsi. Ka lebaka leo, lihlopha tsa tšireletso li ka tsepamisa maikutlo litšokelong tse bohlokoa ka ho fetisisa, tsa ntlafatsa boemo ba ts'ireletso ka kakaretso.
Tlhaloso:
CVSS ke eng? #
Sistimi ea ho Fumana Lintlha Tse Tloaelehileng tsa ho ba Kotsing, e ntlafalitsoeng ke Foramo ea Lihlopha tsa Karabelo ea Liketsahalo le Tšireletso (FIRST), e fana ka mokhoa o hlophisehileng oa ho lekanya boima ba ho ba kotsing. Ha e le hantle, CVSS e fana ka mokhoa oa ho fumana lintlha o sebelisoang haholo ts'ireletsong ea inthanete le ts'ireletsong ea ts'ebeliso (AppSec). Ho feta moo, ho tseba hore na CVSS ke eng ho thusa lihlopha tsa ts'ireletso. standardetsa tlhahlobo ea kotsi. Ka hona, bankakarolo bohle ba ka utloisisa boima le tšusumetso ea bofokoli. Ka lebaka leo, ho kopanya Sistimi ea Maemo a Tloaelehileng a ho Hlasela Mekhoeng ea Ts'ireletso ho ntlafatsa ho hlaka le bokhoni
Mokhoa oa ho Sebetsa ha Sistimi ea ho Fumana Lintlha Tse Tloaelehileng tsa ho ba Kotsing #
The CVSS e lekola bofokodi bo sebedisa dihlopha tse tharo tsa mantlha tsa metric. Ka ho khetheha, dihlopha tsena ke:
1. Litekanyo tsa Motheo #
Tsena di emela dibopeho tsa motheo tsa bofokodi. Haholo-holo, CVSS di kenyeletsa:
- Vekthara ea Tlhaselo (AV) – Kamoo bofokodi bo ka sebediswang hampe (mohlala, marangrang, sebakeng seo).
- Ho rarahana ha Tlhaselo (AC) – Boemo ba bothata ba ho sebelisoa hampe.
- Litokelo tse Hlokahalang (PR) – Boemo ba phihlello bo hlokahalang bakeng sa ts'ebeliso e mpe.
- Tšebelisano ea Basebelisi (UI) – Hore na ketso ea mosebelisi ea hlokahala.
- Metrics ea Tšusumetso – Phello ho Lekunutu (C), Botšepehi (I), 'me Ho fumaneha (A).
2. Litekanyo tsa Nakoana #
Tsena di bontsha dintho tse fetohang ha nako e ntse e ya. Mohlala:
- Khoutu ea Tšebeliso e Mpe – Ho fumaneha ha khoutu ea ts'ebeliso.
- Boemo ba Pholiso – Hore na ho na le dipetjhe kapa dithibelo tse fumanehang.
- Tlaleha Kholiseho – Ho tšepahala ha tlaleho ea bofokoli.
3. Melemo ea Tikoloho #
Litekanyo tsena li fetola Sephetho sa Motheo ho latela tikoloho e itseng ea mokhatlo. Mohlala:
- Litlhoko tsa Tšireletso – Bohlokoa ba lekunutu, botšepehi le ho fumaneha ha lintho.
- Litekanyo tsa Motheo tse Fetotsoeng – Liphetoho tse bonts'ang moelelo oa mokhatlo.
Hobaneng CVSS e le ea Bohlokoa #
kutlwisiso CVSS ke eng ke ea bohlokoa bakeng sa CISBatsamaisi ba Tsamaiso ea Likhoebo tsa Sechaba (CIOs), le litsebi tsa ts'ireletso. Ka ho khetheha, Sistimi ea ho Bala Maemo a Tloaelehileng ea Kotsi e thusa hobane e:
- E Beha Bofokoli Pele: Ka holim'a tsohle, e netefatsa hore litaba tsa bohlokoa ka ho fetisisa li rarolloa pele.
- StandardPuisano: Ka mantsoe a mang, e Sistimi e Tloaelehileng ea ho Fumana Lintlha tsa Kotsi e fana ka puo e akaretsang bakeng sa ho buisana ka botebo ba bofokoli.
- E Tšehetsa ho Latela Melao: Ho feta moo, melao e mengata e laela ho sebelisa CVSS bakeng sa taolo ea likotsi.
- E Ntlafatsa TshebetsoKa lebaka leo, ka ho e sebelisa, lihlopha tsa tšireletso li ka nolofatsa ts'ebetso ea taolo ea bofokoli.
Ka hona, ho kopanya CVSS ho thusa mekhatlo ho laola kotsi ka katleho le ho aba mehlodi ka bohlale.
Mekhahlelo ea Lintlha tsa CVSS #
CVSS lintlha li oela likarolong tse 'ne:
- E tlase: 0.1 - 3.9
- mecha ea litaba: 4.0 - 6.9
- Phahameng: 7.0 - 8.9
- Mahlonoko: 9.0 - 10.0
Kahoo, ho tseba CVSS ke eng 'me mekhahlelo ena ea lintlha e thusa lihlopha ho beha bofokoli pele ka nepo.
Liphephetso tse nang le Sistimi e Tloaelehileng ea ho Fumana Lintlha tsa Kotsi #
- Ho Hloka TengMohlala, lintlha tsa CVSS ha se kamehla li bonts'ang litlamorao tse itseng tsa khoebo.
- Lintlha tsa Motheo o sa FetohengHo phaella moo, lintlha li kanna tsa se fetohe joalo ka ha litšokelo lia hlaha.
- Tlhokomeliso Mokhathala: Ka lehlakoreng le leng, litemoso tse ngata tse matla haholo li ka sithabetsa lihlopha.
Ho hlola liphephetso tsena, ho kopanya CVSS Ka bohlale ba tšokelo ea nako ea sebele hoa hlokahala. Shebella puisano ea rona ho Bofokoli bo sa Feleng, Litšireletso tse Bohlale ho YouTube.
Kamoo Xygeni e Ntlafatsang Tsamaiso ea Bofokoli bo Thehiloeng ho CVSS #
Xygeni's Tlhahlobo ea Sebopeho sa Software (SCA) tharollo, karolo ea Open Source Security nyehelo, e sebelisa Sistimi e Tloaelehileng ea ho Fumana Lintlha tsa Kotsi. Ho feta moo, kutloisiso CVSS ke eng e thusa mekhatlo ho lemoha, ho beha lintho pele, le ho lokisa bofokoli ba ho itšetleha ka mohloli o bulehileng.
Xygeni's SCA Lintlafatso tsa Tharollo #
- Tlhahlobo ea Kotsi e Fetohang: E hokahana le bohlale ba tšokelo ba nako ea sebele.
- Ho fokotsa bono: Ka ho khetheha, e sefa dipolelo tse fosahetseng ho totobatsa ditshoso tsa nnete.
- Khokahano e se nang selallo: Ho feta moo, e kenya tlhahlobo ea bofokoli ho CI/CD pipelineka.
Ka kakaretso, ka ho tseba CVSS ke eng le ho sebelisa Xygeni's SCA tharollo, mekhatlo e ka ntlafatsa haholo lits'ebetso tsa eona tsa taolo ea bofokoli.
Sireletsa Litšekamelo tsa Hao tsa Mohloli o Bulehileng ka Xygeni #
Ho theha Sistimi e Tloaelehileng ea ho Fumana Lintlha tsa Kotsi ho dula pele ho bofokodi.
Kopa Demo Kajeno! Sibolla hore na Xygeni's e sebetsa joang SCA Tharollo e ntlafatsa taolo ea hau ea bofokoli.
Lipotso Tse Ling Tse Botsoang Khafetsa Mabapi le CVSS #
Sistimi e Tloaelehileng ea ho Fumana Lintlha tsa Kotsi, ke standardmokhoa o hlophisitsoeng o sebelisoang ho lekanya botebo ba bofokoli ba software. O thusa mekhatlo ho beha pele boiteko ba tokiso.
Sephetho sa 9.8 se oela ho mahlonoko tseo ho leng mefuta e fapaneng (9.0–10.0), e bontšang bofokoli bo boholo bo lokelang ho rarolloa hang-hang.
E ntlafalitsoe ke Foramo ea Lihlopha tsa Karabelo ea Liketsahalo le Tšireletso (FIRST).
