Yintoni iSecret Leakage?
Ukuvuza okuyimfihlo, okwaziwa ngokuba yi "leak secret"s" okanye "ukutyhilwa ngasese," kukutyhilwa okungagunyaziswanga kolwazi oluyimfihlo, olufana nezitshixo ze-API, amagama ayimfihlo, kunye nezatifikethi zabucala. Oku kungenzeka ngeendlela ezahlukeneyo, kubandakanya iimpazamo zabantu, iinkqubo ezingacwangciswanga kakuhle, kunye nohlaselo olubi.
Ingcamango yokuvuza okuyimfihlo yaqala kwiintsuku zokuqala ze-cryptography xa abaphandi baqala ukufunda indlela ulwazi oluyimfihlo olunokuvezwa ngayo ngengozi okanye ngabom. Nangona kunjalo, igama elithi "ukuvuza okuyimfihlo" alizange lisetyenziswe kakhulu de kwaba sekupheleni kwenkulungwane yama-20, xa laqala ukusetyenziswa ukuchaza iingozi zokhuseleko ezinxulumene nokusetyenziswa okwandayo kolwazi lwedijithali kunye nobuchwepheshe bonxibelelwano.
Uhlaselo lokuqala olwaziwayo yenzeka ngonyaka ka-1982 xa iqela labaphangi leba izitshixo zokubethela ezisetyenziselwa ukukhusela idatha karhulumente wase-US eyimfihlo. Olu hlaselo, Olu hlaselo, olwaziwa ngokuba yiVENONA, kukhokelele ekuhlengahlengisweni okukhulu kwemigaqo-nkqubo kunye neenkqubo zokhuseleko zikarhulumente, kwaye kukwancede ekukhuliseni ulwazi ngokubaluleka kokukhusela ulwazi oluyimfihlo.
Ukwandiswa kweenkonzo zelifu, ukuhlanganiswa okuqhubekayo, kunye nokuhanjiswa (CI/CD) iindlela zokusebenza, kunye nokwanda kwekhowudi evulelekileyo yomthombo kwandisa amathuba okuba iimfihlo zifakwe kwi-hardcode ngengozi kwiindawo zokugcina ulwazi zikawonke-wonke. Ngoku masiqale ngezizathu eziqhelekileyo ezibangela ukuvuza kweemfihlo. Qhubeka ufunda!
Izizathu zohlaselo lokuvuza kwemfihlo
Zininzi izizathu ezinokubangela leak secret uhlaselo, kuquka:
- Impazamo yomntu: Impazamo yomntu yeyona nto ixhaphakileyo yokuvuza okuyimfihlo. Umzekelo, umphuhlisi angenza ngempazamo commit ulwazi oluyimfihlo kwindawo yokugcina ikhowudi kawonkewonke.
- Iinkqubo ezingacwangciswanga kakuhle: Iinkqubo ezingalungiselelwanga kakuhle zinokutyhila iimfihlo, ezifana nezitshixo ze-API kunye namagama ayimfihlo, kubasebenzisi abangagunyaziswanga. Umzekelo, iseva yewebhu engalungiselelwanga kakuhle inokuvumela abahlaseli ukuba bajonge umxholo weefayile zayo zoqwalaselo, ezinokuba neemfihlo.
- Uhlaselo olubi: Abenzi bobubi banokusebenzisa iindlela ezahlukeneyo zokuba iimfihlo, ezinje ngokuhlaselwa kobunjineli bezentlalo, ukuhlaselwa kwe-phishing, kunye nokuhlaselwa kwe-malware. Umzekelo, umhlaseli angathumela i-imeyile kumqeshwa ezenza ummeli osemthethweni wenkxaso ye-IT aze akhohlise umqeshwa ukuba atyhile iziqinisekiso zakhe. Enyanisweni, i-83% yokwaphulwa kwedatha ngo-2022 yayibandakanya abantu ababandakanyeka ngaphakathi malunga Verizon uphando.
- Imigaqo-nkqubo kunye neenkqubo zokhuseleko ezibuthathaka: Imibutho isenokungabi namigaqo-nkqubo yokhuseleko eqinileyo kunye neenkqubo zokukhusela iimfihlo. Umzekelo, umbutho usenokungafuni abasebenzi ukuba basebenzise amagama ayimfihlo aqinileyo okanye bavumele ukuqinisekiswa kwezinto ezininzi. Umzekelo, 81% ulwaphulo-mthetho oluqinisekisiweyo lubangelwe ziiphasiwedi ezibuthathaka, ezisetyenziswe kwakhona, okanye ezibiweyo ngo-2022, emva kokuba LastPass ingxelo.
- Ukungahoyi: Imibutho isenokungakhathali ukukhusela iinkqubo zayo kunye nedatha ngokufanelekileyo, nto leyo eyenza kube lula kubahlaseli ukuba babe iimfihlo. Umzekelo, umbutho usenokungakwazi ukufaka iipatches zokhuseleko okanye ukugcina iinkqubo zawo zihlaziywa.
- Ukunqongophala kolwazi: Abasebenzi basenokungazi ngengozi yokutyhila iimfihlo, okanye basenokungazi ukuba bangazikhusela njani ngokufanelekileyo. Umzekelo, i-90% yohlaselo lwe-cyber lubandakanya amaqhinga obunjineli bentlalo.
Impembelelo yohlaselo oluyimfihlo lokuvuza
Uhlaselo oluyimfihlo lokuvuza lunokuba nempembelelo enkulu nefikelela kude kwimibutho. Imibutho efumana uhlaselo oluyimfihlo lokuvuza inokujamelana neziphumo ezimbi ezilandelayo:
- Ukuvumelana kwezixhobo zophuhliso lwesoftware kunye neziseko zophuhliso: Abahlaseli banokubeka emngciphekweni izixhobo zophuhliso lwesoftware kunye neziseko zophuhliso, ezifana neendawo zokugcina ikhowudi yomthombo, ukwakha iinkqubo, kunye CI/CD pipelines, ukufaka ikhowudi enobungozi kwiimveliso zesoftware ngaphandle kokubhaqwa. Le khowudi ingathunyelwa kwiinkqubo zabathengi, inike abahlaseli ithuba lokungena kwiinethiwekhi zabo.
- Ityhefu Pipeline: Abahlaseli banokubeka emngciphekweni uthotho lwesoftware yomthengisi ukuze batyhefe iimveliso zombutho ngekhowudi enobungozi. Le khowudi ingafakwa ngokungazi ngabathengi bomthengisi, inike abahlaseli ukufikelela kwiinkqubo zabo.
- Ukwaphulwa kwedatha: Ukuhlaselwa ngokufihlakeleyo kokuvuza kunokukhokelela ekuvezweni kwedatha eyimfihlo, efana neerekhodi zabathengi, ulwazi lwezemali, kunye nepropathi yengqondo. Le datha inokubiwa kwaye isetyenziswe ngeenjongo zobuqhetseba, okanye ingakhutshwa esidlangalaleni, nto leyo eyonakalisa udumo lombutho.
- Ukuphazamiseka kwemisebenzi: Abahlaseli banokufikelela kwiinkqubo ezibalulekileyo, ezinje ngeeseva zemveliso okanye iidathabheyisi, ukuze baphazamise okanye bavale imisebenzi. Oku kunokukhokelela ekulahlekelweni okukhulu kwemali kunye nomonakalo wodumo.
- Ubusela bempahla yengqondo kunye nolwazi lwabucala: Abahlaseli banokuba iimfihlo, ezifana nekhowudi yomthombo okanye iimfihlo zorhwebo, ukuze baphuhlise iimveliso ezikhuphisanayo okanye babe inzuzo yokukhuphisana yenkampani. Oku kuphulwa komthetho kunokuba nemiphumo emikhulu ukuba umhlaseli uphumelela ukuba ulwazi oluyimfihlo, olufana neethokheni zokufikelela okanye izitshixo ze-API, luthathwe kwi SCMNgezi ziqinisekiso zibiweyo, abahlaseli banokufumana ukufikelela okungagunyaziswanga kwiinkqubo zemveliso, okunokukhokelela kwiziganeko zokhuseleko ezinzulu ngakumbi. Banokufikelela kwidatha yabucala, balawule imisebenzi yenkqubo, okanye bakhuphe ulwazi oluyimfihlo, nto leyo ebeka emngciphekweni kungekuphela nje ukuthembeka kwenkqubo kodwa kunye nobumfihlo kunye nokuthenjwa kwabasebenzisi.
- Ilahleko yemali: Ukwaphulwa kwedatha, kuquka nezo zivela kuhlaselo oluyimfihlo lokuvuza, kunokukhokelela ekulahlekelweni okukhulu kwemali kwimibutho. Iindleko zokuphendula kuhlaselo oluyimfihlo lokuvuza ziquka ukuphanda isiganeko, ukulungisa ubuthathaka, kunye nokwazisa abantu abachaphazelekayo. Imibutho inokujongana nezohlwayo nezinye izohlwayo ezivela kubalawuli ukuba bayasilela ukukhusela ngokwaneleyo iimfihlo zabo. Umzekelo, phantsi komthetho we-GDPR kwi-EU, imibutho inokuhlawuliswa ukuya kuthi ga kwi-20 yezigidi zeerandi okanye i-4% yengeniso yayo yehlabathi, nokuba yeyiphi na ephezulu, ngenxa yokwaphulwa komthetho okukhulu. E-US, imithetho emininzi yobumfihlo kumanqanaba karhulumente kunye nawaseburhulumenteni imisela iindlela zokulungisa okanye izohlwayo zoluntu zokungathobeli imithetho ezinokuqala kwi-$100 ukuya kwi-$50,000 ngokwaphulwa komthetho, kunye ne-$25,000 ukuya kwi-$1.5 yezigidi kuzo zonke ukwaphulwa komthetho omnye kunyaka wekhalenda.
- Umonakalo wodumo: Uhlaselo oluyimfihlo lokuvuza lungonakalisa udumo lombutho. Abathengi kunye nabatyali-mali banokulahlekelwa yintembelo kumandla ombutho okukhusela idatha kunye nobumfihlo babo. Oku kunokukhokelela ekulahlekelweni lishishini kwaye kwenze kube nzima ukutsala abathengi abatsha kunye nabatyali-mali.
- Ukuhlolwa kwemithetho: Ukungazikhuseli iingozi ezinokubakho, kuquka umngcipheko wokuhlaselwa ngokufihlakeleyo, kunokutsala ingqalelo yabalawuli abanokuphanda ngesiganeko baze bahlawulise imibutho imali kunye nezinye izohlwayo. Oku kunokukhokelela ekwandeni kweendleko kunye nomthwalo wokuthobela imithetho. Umzekelo, iKhomishini yeSecurities and Exchange (SEC) kutshanje iphande ngohlaselo lwe-cyberattack lweSolarWinds kwaye yatyhola iSolarWinds Corporation ngobuqhetseba kunye nokusilela kolawulo lwangaphakathi olunxulumene neengozi kunye neengozi zokhuseleko lwe-cyber ezaziwayo.
Imizekelo yokwenyani ye Leak Secrets Ukuhlaselwa
Ukwaphulwa kwedatha okubangelwa ziinkcukacha ezibiweyo lolona hlobo luqhelekileyo lokwaphulwa kwedatha, kwaye oku bekusenzeka ukusukela ngo-2021, ngokutsho kwe- Iindleko ze-IBM zeNgxelo yoLwaphulo-mthetho lweDatha ka-2022Uhlaselo oluyimfihlo lokuvuza lunokuba nefuthe elibi kwimibutho, apho ixabiso eliphakathi lehlabathi lokwaphulwa kwedatha lifikelela kwi-$4.35 yezigidi ngo-2022, malunga Ingxelo yeVerizon's 2022 Data Breach (I-DBIR):
Nantsi isishwankathelo esifutshane sezinye zeziganeko ezifihlakeleyo zokuvuza ezirekhodiweyo kwiminyaka yakutshanje:
- NgoJanuwari 2023, I-GitHub ityhile ukwaphulwa kwedatha apho abahlaseli baphumelele khona ukubamba izatifikethi zokusayina ikhowudi kwiinguqulelo ezininzi zeGitHub Desktop kunye neAtom. Uphando lutyhile ukuba umenzi wobubi (abenzi bobubi) bafikelele kwinkqubo yangaphakathi yeGitHub, nto leyo ebavumela ukuba bakwazi ukuqokelela iindawo ezithile zokugcina ulwazi baze bafumane izatifikethi zokusayina ikhowudi ngokungekho mthethweni. Esi siganeko sigxininisa ukubaluleka okubalulekileyo kweenkqubo zokhuseleko eziqinileyo zokukhusela izatifikethi zokusayina ikhowudi kwaye sigxininisa imfuneko yokuba abaphuhlisi banamathele kwiindlela ezilungileyo zokhuseleko oluyimfihlo ukunciphisa umngcipheko weziganeko ezifanayo ezizayo.
- Ngo-Matshi 2023, IGitHub ifumene uhlaselo olukhulu lwekhonkco lokubonelela ngempahla. Impazamo eyenziwe esidlangalaleni commit ityhile isitshixo se-SSH sabucala senkonzo yeGitHub. Esi siganeko sinike ithuba lokuba umhlaseli axelise iGitHub ngendlela ekholisayo, ebonisa inkohliso enkulu kwaye ebeka umngcipheko omkhulu wokhuseleko. Nangona kunjalo, iGitHub yajongana nale meko ngokukhawuleza yaza yatshintsha isitshixo sayo njengenyathelo lokhuseleko.
Indlela Yokuthintela Leak Secret Ukuhlaselwa
Kukho amanyathelo aliqela anokuthathwa yimibutho ukuze thintela ezo zihlaselo, Kubandakanywa:
- Fundisa abasebenzi malunga neengozi zokuvuza okuyimfihlo kunye nendlela yokukhusela iimfihloAbasebenzi kufuneka bazi ngeentlobo ezahlukeneyo zokuhlaselwa ngokufihlakeleyo kunye nendlela yokuzibona nokuziphepha. Kufuneka baqeqeshwe kwindlela yokugcina nokulawula iimfihlo ngokufanelekileyo.
- Sebenzisa ulawulo oluqinileyo lokhuseleko. Imibutho kufuneka isebenzise ulawulo oluqinileyo lokhuseleko, olufana nee-firewalls, iinkqubo zokufumanisa ukungena, kunye noluhlu lokulawula ukufikelela, ukukhusela iinkqubo zabo kunye nedatha ekufikeleleni okungagunyaziswanga. Kufuneka basebenzise nesixhobo solawulo oluyimfihlo ukugcina nokulawula iimfihlo ngokukhuselekileyo.
- Sebenzisa isixhobo sokuskena ukuze ufumane iimfihlo phambi kokuba commitukubathumela kwiindawo zokugcina izinto okanye ukubathumela kwiindawo CI/CD pipelineokanye IaC uqwalaselo. Oku kunika abaphuhlisi kunye neDevOps impendulo ekhawulezileyo, okuthintela iimfihlo ukuba zingangeni kwimbali yenguqulelo okanye kwiziseko zophuhliso lwemveliso.
- Jonga iinkqubo kunye neenethiwekhi ukuze ubone imisebenzi ekrokrisayo. Imibutho kufuneka ihlole iinkqubo zayo kunye neenethiwekhi ukuze ibone imisebenzi erhanelekayo enokubonisa uhlaselo oluyimfihlo lokuvuza.
- Yiba nesicwangciso sokusabela kwiintlaselo ezifihlakeleyo zokuvuza. Ukuba kufunyenwe uhlaselo oluyimfihlo lokuvuza, imibutho kufuneka ibe nesicwangciso sokusabela ngokukhawuleza nangokufanelekileyo. Esi sicwangciso kufuneka siquke amanyathelo okulawula umonakalo, ukunciphisa impembelelo, kunye nokuphanda ngesiganeko.
Indlela iXygeni Enceda Ngayo Ukuphepha Ukuvuza Okuyimfihlo
Xygeni Secrets Security sisisombululo esibanzi esidlula nje ekukhuseleni iimfihlo ukuqinisekisa ukuqhubeka, ukhuseleko, kunye nokuqina kweSoftware Supply Chain yanamhlanje. Asisisixhobo sokufumanisa nje kuphela, kodwa sisixhobo commitumgaqo-nkqubo ongenazo iimfihlo eziqinileyo, ofezekiswe ngothotho lweempawu ezibalaseleyo ezikhusela umjikelo wobomi bophuhliso lwesoftware.
IiNzuzo eziPhambili kunye neMiba Xygeni Secrets Security
Xygeni Secrets Security Inika inani leenzuzo eziphambili kunye neempawu, kuquka:
- Ukufunyanwa kwexesha lokwenyani kunye nokuthintela: I-Xygeni idibana ne-Git hooks ukuskena nokufumanisa iimfihlo ngaphambi kokuba commitibekwe kwiindawo zokugcina ulwazi. Oku kunika abaphuhlisi ingxelo ekhawulezileyo kwaye kuthintela iimfihlo ekungeneni kwimbali yenguqulelo.
- Ukuskena ngokubanzi: Amandla okuskena eXygeni adlula ngaphaya kokulinganisa iipateni eziqhelekileyo ukuze aqaphele kwaye aqinisekise uluhlu olubanzi lweefomathi eziyimfihlo, nokuba loluphi ulwimi, ithala leencwadi, okanye iqonga.
- Ukuqinisekiswa okukrelekrele: Inkqubo yokuqinisekisa ekrelekrele yeXygeni inciphisa iziphumo ezingezizo ezilungileyo, iqinisekisa ukuba abaphuhlisi bafumana izaziso kuphela zobuthathaka obuqinisekisiweyo.
- Amava omphuhlisi angenamthungo: Isisombululo seXygeni esingaphazamisiyo siphucula amava omphuhlisi ngeWebUI enika ulwazi olusebenzayo kwaye ivumela abaphuhlisi ukuba bafunde kwaye bamkele iindlela ezilungileyo zokhuseleko ngexesha langempela.
- Ukunyanzeliswa komgaqo-nkqubo kunye nokubeka esweni rhoqo: Uyilo lokuzikhusela lweXygeni luvumela imibutho ukuba inyanzelise imigaqo-nkqubo yokhuseleko engqongqo kulo lonke ixesha lophuhliso kwaye ichonge ngokukhawuleza kwaye ilungise naziphi na izinto ezingalunganga.
Ngokujongana nezizathu eziphambili zokuvuza okuyimfihlo nokubonelela ngesisombululo esibanzi esidibanisa ukhuseleko kwinkqubo yophuhliso, iXygeni inceda imibutho ukukhusela iimfihlo zayo ekufikeleleni okungagunyaziswanga.
Nantsi eminye imizekelo ethile yendlela iXygeni enokunceda ngayo imibutho ukuthintela ukuvuza okuyimfihlo:
- umbhekisi commitIzitshixo ze-API eziya kwindawo yokugcina ikhowudi kawonkewonke: Ukuhlanganiswa kwe-Git hook yeXygeni kufumanisa izitshixo ze-API ngaphambi kokuba zibe commityaza yamisa commit, ukuthintela ukutyhilwa kweemfihlo.
- Umhlaseli usebenzisa ubuthathaka ukuze afikelele kwiifayile zoqwalaselo: Ukuskena okubanzi kweXygeni kufumanisa idatha eyimfihlo kwiifayile zoqwalaselo kwaye kwazisa umbutho, okuwenza ukwazi ukulungisa ubuthathaka kunye nokuthintela umhlaseli ekubeni abe idatha xa kuthe kwasetyenziswa kakubi.
Indlela yeXygeni yokufumanisa imfihlo eyimfihlo sisixhobo esibalulekileyo kuyo nayiphi na intlangano efuna ukukhusela iimfihlo zayo ekufikeleleni okungagunyaziswanga. Ngokusebenzisa iXygeni, imibutho inokunciphisa umngcipheko wayo wokufumana uhlaselo oluyimfihlo lokuvuza kwaye ikhusele idatha yayo ekubiweni.
Ukuba ufuna ulwazi oluninzi malunga Leak Secret Uhlaselo kunye nendlela yokuluthintela, cela ukudibana neqela lethu kwaye baya kusombulula onke amathandabuzo akho.
