Build Security: Ukuqinisa iSoftware Yakho

Intshayelelo Build Security kwi SDLC

Umjikelo woBomi boPhuhliso lweSoftware oluKhuselekileyo (SDLC) ibonisa indlela ebanzi, ebandakanya iindlela zokhuseleko kunye nemigaqo kuzo zonke izigaba zokudalwa nokusasazwa kwesoftware. Phakathi kwezi, isigaba sokwakha sibaluleke kakhulu. Kulapho ikhowudi yomthombo iguqulwa ibe yikhowudi yebhinari, ibeka inqanaba lokuphunyezwa. Eli nqanaba libaluleke kakhulu ekufakeni ukhuseleko kwisoftware, kubandakanya ukuvavanywa kwekhowudi okungqongqo kobuthathaka, ukunyanzeliswa komgaqo-nkqubo wokhuseleko, kunye nokuqinisekisa ukuba izinto eziqwalaselweyo zokhuseleko zisisiseko, endaweni yeengcinga ezijonga emva.

Ukubaluleka kwe Build Security kuPhuhliso lweSoftware

Build security kubalulekile ekwenzeni isoftware ekhuselekileyo, esebenza njengokhuselo olusebenzayo nxamnye nobuthathaka obunokubakho, kunye nokuqinisekisa ukuthotyelwa standards. Eli nqanaba lenkqubo yophuhliso libeka umngcipheko omkhulu kwingqibelelo kunye nokugcinwa kwemfihlo kwekhowudi. Ukusilela kunokusasaza isoftware esengozini kuyo yonke indawo, nto leyo eyenza kube yimfuneko ukukhusela eli nqanaba ukukhusela abasebenzisi bokugqibela nokugcina ukuthembana nokuthobela imithetho. Ngaphezu koko, inqanaba lokwakha libalulekile ekunciphiseni iingozi ezinxulumene nothungelwano lobonelelo lwesoftware, apho ubuthathaka kuyo nayiphi na inxalenye bunokuba nefuthe elibanzi. build security ibeka isiseko sokuvelisa izinto ezintsha kwixesha elizayo, ivumela imibutho ukuba iphuhlise iindlela zayo zophuhliso ngokukhuselekileyo.

Ukugxininisa Imiphumo Yehlabathi Lokwenyani

Ukubaluleka kokuqina build security amanyathelo abonakaliswa ngokucacileyo ziziganeko ezifana nokwaphulwa kweSolarWinds Orion, isivumelwano seCodecov Bash Uploader, isiganeko se-Event-Stream, ukwaphulwa kwedatha ye-Equifax, kwaye ngokukodwa, i-Ledger Attack. Le mizekelo isebenza njengezikhumbuzo ezicacileyo zempembelelo enkulu yokujonga ukhuseleko ngexesha lesigaba sokwakha, ukusuka ekuququzeleleni ukuhlaselwa kwe-supply chain ukuya ekutyhileni idatha eyimfihlo ngomlinganiselo omkhulu.

Uhlaselo lweLedger

Uhlaselo lweLedger lubonisa ukusetyenziswa gwenxa kweenkqubo zobonelelo lwesoftware, nto leyo ephawula isiganeko esibalulekileyo kwicandelo lokhuseleko lwe-cyber. Olu hlaselo lwaqalwa nge-spear phishing eyayijolise kwiakhawunti ye-NPM yomsebenzi wangaphambili weLedger, abahlaseli bakwazile ukupapasha iinguqulelo ezinobungozi zesixhobo se-connect-kit sesoftware yeLedger. Olu lwaphulo-mthetho lubangele ukulahleka kwe-$600,000 ubuncinane kwiiwallets zehardware zabasebenzisi. Ngokungafaniyo nohlaselo oluthe ngqo kwinkqubo yokwakha, esi siganeko sasebenzisa ukuthembela okubekwe kuxhomekeko lomntu wesithathu kunye nenkqubo yobonelelo lwesoftware, sigxininisa izoyikiso ezijongene nophuhliso lwesoftware yanamhlanje. Ulwaphulo-mthetho aluzange lubonise kuphela ukubaluleka kokukhusela ukuxhomekeka kwesoftware kodwa lukwagxininise nesidingo solawulo lokufikelela olungqongqo, ulawulo lweziqinisekiso, kunye nokubeka esweni izinto zangaphandle. Isiganeko seLedger sisebenza njengesikhumbuzo esicacileyo semiphumo enokubakho yokungahoyi ukhuseleko kwinkqubo yobonelelo lwesoftware kunye nokubaluleka kokwamkela amanyathelo okhuseleko apheleleyo ukukhusela uhlaselo oluthe ngqo nolungathanga ngqo.

Uqhekeko lweSolarWinds Orion

Phakathi kwezona zifikeleleke kakhulu kwaye ziphucukileyo kutshanje, ukwaphulwa kweSolarWinds Orion kwazama ukusebenzisa ubuthathaka kwinkqubo yokwakha isoftware yeSolarWinds. Abahlaseli batyale ikhowudi embi ngenkqubo yokwakha ngaphakathi kwenkqubo yokuhlaziya isoftware baza bayithumela kubathengi abayi-18,000, kuquka iiarhente ezinkulu zikarhulumente kunye neenkampani. Igxininise indlela olu hlaselo olunjalo olunokuba yingozi kwaye lubanzi ngayo kwiindlela zokubonelela.

I-Codecov Bash Uploader Script Compromise

I-Codecov sisicelo sokuvavanya amanyathelo okugubungela ikhowudi aphuliweyo. Abahlaseli bakwazile ukutshintsha iskripthi sayo seBash Uploader kwaye baphumelela ekuhluzeni idatha kwiindawo ezinokuba ngamawaka zabathengi. Oku kuphulwa kwemigaqo kugxininisa indlela izixhobo zokwakha ezinokuba yingozi ngayo kwaye kungqina ukuba ukuthembeka kwezikripthi zokwakha kunye nezixhobo kufuneka kuqinisekiswe.

Isiganeko Sokusasazeka Kweziganeko

Kwimeko yesiganeko se-Event-Stream, iphakheji ye-NPM edumileyo kakhulu yachaphazeleka. Kule phakheji, umgcini wokuqala wanikezela ulawulo kumhlaseli owayezenza umgcini onomdla. Kamva, umhlaseli wafaka umthwalo kwiphakheji eneenjongo ezimbi, ejolise kwiqonga elithile le-cryptocurrency. Lo ngumzekelo ogqibeleleyo wesifundo setyala esibonisa iprofayili yomngcipheko wobuthathaka bokuxhomekeka kunye nenqanaba lokuvavanya eliyinyani elifanele lenziwe yinkampani kwiiphakheji zangaphandle kunye nabagcini.

Ukwaphulwa kweDatha ye-Equifax

Ukwaphulwa kwedatha ye-Equifax, nangona kungengomngcipheko kuphela kwinqanaba lokwakhiwa, kwenziwe kwaba mandundu ngakumbi ngokusilela ukuhlaziya ithala leencwadi lomntu wesithathu ebelifanele ukuba lihlaziyiwe kwaye lisengozini (kule meko, yi-Apache Struts). Oku kuchaphazele abantu abayi-147 yezigidi. Ukwaphulwa kwedatha ye-Equifax, ngandlela zonke, yingxelo yesilumkiso malunga nolawulo lokuxhomekeka.

Iingozi Ezivelayo Build Security: Umfanekiso omfutshane

Kwiwebhu entsonkothileyo yophuhliso lwesoftware yanamhlanje, inqanaba lokwakha limi njengenqaku elibalulekileyo apho ikhowudi yomthombo iguqulwa ibe yisoftware esebenzisekayo. Eli nqanaba alikho nje malunga nokuhlanganiswa kodwa likwamalunga nokuqinisekisa ukhuseleko kunye nokuthembeka kwemveliso yokugqibela. Ukuqonda izoyikiso eziqhelekileyo ezijongene nalo ngeli nqanaba kubaluleke kakhulu ekugcineni ukuqina. software supply chain securityUkuze uqonde ngakumbi ezi ngozi kunye namaqhinga apheleleyo okunciphisa umngcipheko, cinga ngokuphonononga ulwazi oluneenkcukacha malunga Iingozi zoNikezelo lweSoftware kwiSigaba soKwakha.

ukuba udluliselwe CI/CD Pipelines: Ukuthintela ukhuseleko lwe CI/CD iinkqubo zivumela abahlaseli ukuba bafake ikhowudi enobungozi ngqo kwisakhiwo, bedlula iitshekhi zokhuseleko ezibalulekileyo.
Ukutshintsha iKhowudi yoLawulo lweMvelaphi emva koMthombo: Utshintsho olwenziwe kwikhowudi yomthombo emva kokuba commitUkulawulwa kwemithombo kunokubangela utshintsho olungagunyaziswanga, nto leyo eyonakalisa ukuthembeka kwesoftware.
Ukubeka ecaleni inkqubo yokwakha: Ukuyilawula ngokuthe ngqo inkqubo yokwakha kunokukhokelela ekufakweni kwekhowudi enobungozi, ukuphazamisa imvelaphi yesakhiwo okanye ukuphazamisa inkqubo ngokupheleleyo.
Iindawo zokugcina izinto ezisetyenzisiweyo ezivumelanayo: Ukufikelela okungagunyaziswanga, okanye ukuguqulwa kweendawo zokugcina izinto zakudala kunokuphazamisa inkqubo yokusasazwa kwaye kungenise isoftware esengozini kwikhonkco lokubonelela.

Ityhefu Pipeline Ukubulawa (PPE): Usongelo Olunzulu

Ityhefu Pipeline Ubuthathaka bokusebenza (PPE) buyabonakala xa abahlaseli belawula inkqubo yokwakha, nokuba ngokutshintsha CI/CD pipeline uqwalaselo ngqo (i-PPE ethe ngqo, okanye i-D-PPE) okanye ngokuguqula iifayile pipeline iireferensi (i-PPE engathanga ngqo, okanye i-I-PPE). Olu hlaselo lunokonakalisa kakhulu ukuthembeka kwesoftware, nto leyo eyenza ukuba iindlela zokufumanisa nokukhusela kwangethuba zibe zibalulekile.

Ukuqonda ii-PPE Variants

I-PPE ethe ngqo (D-PPE) kwenzeka xa abahlaseli betshintsha ifayile yoqwalaselo lwe-CI ukuze basebenzise imiyalelo enobungozi ngaphakathi kwendawo yokwakha, bedlula standard iiprothokholi zokhuseleko.
I-PPE engathanga ngqo (I-PPE) ivuleka ngotshintsho kwiifayile zangaphandle pipeline i-configures, ezifana nezikripthi, ivumela abahlaseli ukuba bafake ikhowudi enobungozi ngokungathanga ngqo.

Ukuphumeza Okusebenzayo Build Security Amanyathelo

Ukuze kuliwe nezi zisongelo kunye nobuthathaka kwinqanaba lokwakha, kufuneka kusetyenziswe isakhelo esisetyenziswa ngokufanelekileyo kunye nokuthobela iindlela ezilungileyo njengoko zichazwe ziigunya ezifana ne-NIST. Zonke ezi zinto zingasentla zingaphuculwa ngokusebenzisa isicelo kunye nokuthobela Isikhokelo soPhuhliso lweSoftware oluKhuselekileyo lwe-NIST (SSDF)), phakathi kwezinye izixhobo, ukuphucula ukuma kwakho ngeendlela ezilandelayo.

Kubalulekile Build Security Ezona ndlela zibalaseleyo:

Ukubhala iikhowudi ngokukhuselekileyo: nyanzelisa iindlela zokhuseleko zokubhala iikhowudi ezilungileyo kulo lonke uphuhliso. Chonga ubuthathaka obunokubakho ngokusebenzisa izixhobo zohlalutyo lweekhowudi ezingashukumiyo ezisele zilungele inkqubo yokwakha njengoko zinokuba luncedo.
Uhlalutyo loBume beSoftware (SCA): Dibanisa SCA izixhobo kunye neyakho CI/CD pipeline ukufumanisa ukuxhomekeka kwemithombo evulekileyo esetyenziswa kwisoftware eneengxaki ezaziwayo kunye nokugcina ulwazi lwangoku Umqulu wezixhobo zeSoftware (SBOM).
Indawo Yokwakha Ekhuselekileyo: Sebenzisa ulawulo lokufikelela olunamandla olunokunciphisa iindawo zokungena ezingagunyaziswanga kwiiseva zokwakha kunye neendawo zokugcina idatha.
Izixhobo zokubeka iliso eziqhubekayo ngokwenyani, kuya kuthetha ukufumanisa naluphi na uhlobo lwemisebenzi ekrokrisayo eyenzekayo kwindawo yokwakha. Oku kuya kuqinisekiswa kwaye kudluliselwe ngokukhuselekileyo kwi pipeline ngokusayinwa ngesiginitsha yedijithali. Kufuneka kusekwe iindlela ezahlukeneyo zokuqinisekisa ukuqinisekisa ubunyani bale nto yenziweyo ngaphambi kokuba isetyenziswe.

Amandla Build Attestations

Iindlela ezilungileyo ezilungileyo ezifana nokubhala ikhowudi ekhuselekileyo kunye neendawo zokwakha ezikhuselekileyo zibaluleke kakhulu, kodwa xa Xygeni Build Security Isisombululo, benza kanye loo nto. Isisombululo sethu sidibana neendlela zakho zokusebenza ukuze sikunike indlela epheleleyo yokwenza build security oko kuquka amandla obungqina.

Cinga ngesiqinisekiso sokwakha njengoxwebhu olusayiniweyo oluqinisekisa ubunyani kunye nokuthembeka kwesakhiwo. Yiyo kanye loo nto isiqinisekiso sokwakha siyiyo—ingqokelela ye-cryptographically signed metadata ebhala iinkcukacha zenkqubo yokwakha. Ezi luhlobo lwabalindi kwinkqubo yokwakha kwaye zijongana neenzuzo ezininzi ezivela kwezi zilandelayo.

Ukungafihli okuphuculweyo: Ubungqina Bokwakha buqinisekisa ukuba kukho ukuzithemba ekubeni nokubonakala ngokucacileyo kwindawo yokwakha, izixhobo, uqwalaselo, kunye nokuxhomekeka okusetyenzisiweyo ekwakheni iSakhi. Indawo enjalo ecacileyo iya kukhuthaza ukuthembana mhlawumbi nentsebenziswano.
Ukuqinisekiswa Kuyo yonke i- Pipeline: Iingqinisiso ziqinisekisa ukuba kuzo zonke izigaba ezikhoyo CI/CD pipeline, ukusuka kwikhowudi yomthombo ukuya kwizinto zakudala ezakhiweyo, ubunyani bunokuqinisekiswa. Ijonga ukuba akukho tshintsho lungekho mthethweni olwenzekileyo kwinkqubo yokwakha.
Isiseko Esiqinileyo Sokubeka Iliso NokuHlola Iincwadi: Idatha eneenkcukacha ngaphakathi kobungqina yakha isiseko sokuqhubeka nohlalutyo lokhuseleko ngexesha lomjikelo wophuhliso, nto leyo evumela umntu ukuba abone ngokukhawuleza naluphi na ubuthathaka obunokwenzeka ekufuneka buncitshiswe.

Njani Xygeni Build Security Iimvume zoBungqina

Kulapho Build Security Isisombululo sithatha ingcamango yokuba Build Attestations inyathelo elinye phambili kunye nokusebenza ngokuzenzekelayo, kwaye iXygeni ithatha elinye inyathelo elikhulu ngakumbi ngendlela ebanzi.

Ukwenziwa kweZenzo zoBungqina: I-Xygeni, apho ukuveliswa kobungqina kufuneka kwenziwe ngokuzenzekelayo, ukuze kwenziwe ubungqina obucacileyo ngaphandle kwesidingo sokungenelela ngesandla, nangendlela ebonelela ubungqina obuhambelanayo kuzo zonke izakhiwo.
Ukuqokelelwa nokugcinwa kobungqina obukhuselekileyo: I-Xygeni inika ukhuseleko lwendlela eqokelelwa kwaye igcinwa ngayo ubungqina. Iqokelela ubungqina ngononophelo olukhulu kuzo zonke iindawo zenkqubo yokwakha. Igcina ingqokelela kwiziseko zethu zokugcina ezikhuselekileyo, iqinisekisa ukuba ubungqina buthembekile.
Ulawulo loQinisekiso lweGranular: Isisombululo sethu silawula ukuqinisekiswa, okulandela ngokungakhethiyo. Sibonelela ngeseti yemigaqo-nkqubo enokulungiswa; iitshekhi zingabandakanywa okanye zingafakwa kwinkqubo, zilungelelanise ezi zilandelayo ukuze zihambelane neemfuno zomntu.
Ukufumanisa Usongelo Ngexesha Langempela Oluqondakalayo: Iseti epheleleyo yengxelo evela kwiXygeni idlula izaziso ezilula zokudlula/ukusilela. Inkqubo yethu inika ulwazi olusebenzayo kwinkqubo yakho yokwakha ukukunceda wazi kwaye ulungise ubuthathaka obunokubakho kwangethuba.

Inzuzo yeXygeni: Iingenelo onokuzithemba

Ngokuhambisa Xygeni Build Security, ufumana iingenelo ezininzi:

Ukuphucula ukuthembana nokungafihlisi nto: Ubungqina bokwakha buqinisekisa ukuba bonke abachaphazelekayo baboniswa umfanekiso ocacileyo wenkqubo yokwakha, kwaye kule nkqubo, ukuthembana kunye nentsebenziswano kuyakhula.
Ukunciphisa Umngcipheko Weempazamo kunye Nokuchaphazeleka: Ukwenziwa nokuqinisekiswa kobungqina ngokuzenzekelayo kunciphisa umngcipheko wempazamo kunye nokuba sesichengeni okuncinci ngokobuntu, ngaloo ndlela kubonelela ngokhuseleko oluqhubekayo kulo lonke ulwakhiwo. pipeline.
Umgangatho weSoftware oPhuculweyo: Fumana ulwazi oluthe kratya malunga nosongelo kunye nolwazi olunzulu ukuqinisekisa ukuba unokubonelela ngeemveliso zesoftware ezikumgangatho ophezulu nezikhuselekileyo.
Ukuthobela lula: Ukuhambelana kweXygeni neengcebiso zeNIST SP 800-204D kwenza kube lula ukuthobela imithetho.

Ukulungele ukufunda ngakumbi? Nxibelelana neXygeni namhlanje ukuze ubone indlela yethu Build Security isisombululo sinokunika amandla amaqela akho ophuhliso.

Build Security Izinto ezibalulekileyo: Ukuqinisa iSoftware yakho ukususela ekuqaleni

Isiqulatho

Izithuba ekufuneka zifundwe

Izithuba zamva nje ezinomdla