Kutheni Yonke CISO Ifuna Umgaqo-nkqubo Oqinileyo Wolawulo Lokungakwazi Ukuzikhusela
Njenge CISO, ukudala isicwangciso solawulo lobuthathaka esisebenzayo kubalulekile ekunciphiseni iingozi zokhuseleko kulo lonke umbutho wakho. Isantya esikhawulezayo seDevOps, kunye nobunzima beziseko zanamhlanje, kwenza kube yimfuneko ukuba nesakhelo esiqinileyo solawulo lobuthathaka. Esi sakhelo sikuvumela ukuba ulawule kwaye ulungise ubuthathaka ngaphambi kokuba abahlaseli babusebenzise. Inkqubo eyilwe kakuhle ayincedi nje kuphela ekuthinteleni ukwaphulwa kwemithetho kodwa ikwaqinisekisa ukuthotyelwa kwemigaqo efana ne-NIST kunye ne-ISO/IEC 27001, kunye noshishino. standardnjenge-OWASP.
Ukuhlola indlela yokwenza yila inkqubo yolawulo lobuthathaka ehambelana neemfuno zombutho wakho, jonga ulwazi lwethu olunzulu ngeposi blog.
Yintoni iSakhelo soLawulo loBundlobongela?
Isakhelo solawulo lobuthathaka sibonelela ngenkqubo ecacileyo necwangcisiweyo yokufumana nokujongana nemingcipheko yokhuseleko. Ukulandela ubomi bolawulo lobuthathaka lwe-NIST, inkqubo yakho kufuneka ibandakanye amanyathelo amane aphambili:
- Uchonga: Okokuqala, khangela ubuthathaka kwizicelo, iziseko zophuhliso, kunye nezinto zomntu wesithathu.
- U vavanyoOkulandelayo, beka phambili ubuthathaka ngokwendlela obunzima ngayo, indlela obunokusetyenziswa ngayo lula, kunye nefuthe obunokubakho kwishishini lakho.
- UkukhutshwaEmva koko, sebenzisa izilungiso—ezifana namaphetshi okanye uhlengahlengiso—ukususa iingozi.
- esweniOkokugqibela, hlala ujonge iinkqubo zakho ukuze ufumane ubuthathaka obutsha kwangethuba.
Ngokulandela la manyathelo, umbutho wakho unokunciphisa kakhulu amathuba awo okuba lixhoba lokuhlaselwa nge-intanethi kwaye ugcine izinto ezibalulekileyo zikhuselekile. Ekugqibeleni, ukudala isicwangciso solawulo lobuthathaka esisebenzayo kuqinisekisa ukuba unokujongana neengozi ngokukhawuleza nangokufanelekileyo.
isitshixo StandardUkuyila iNkqubo yoLawulo loBunzima
Ku yila inkqubo yolawulo lobuthathaka, kubalulekile ukuhambelana nezikhokelo zokhuseleko ezaziwayo ngokubanzi. Ezi zikhokelo zibonelela ngeendlela ezilungileyo, kwaye iXygeni inceda ukuzenzekela nokuzisebenzisa ezi standards ngokufanelekileyo
1. Isakhelo soLawulo loBundlongondlongo be-NIST
The I-NIST SP 800-40 izikhokelo zibonelela ngesicwangciso esipheleleyo solawulo lobuthathaka. I-NIST igxile ekubekeni esweni okuqhubekayo, ukufunyanwa ngokuzenzekelayo, kunye nokulungiswa ngokukhawuleza. I-Xygeni ikunceda uhlale uhambelana ne-NIST ngokunikezela ngokuskena ngexesha langempela, ukutshintshwa okuzenzakalelayo, kunye nokubeka phambili ubuthathaka ngokusekelwe kumngcipheko wokwenyani ngokusebenzisa Inkqubo yokuQwalasela ukuQwalasela (i-EPSS).
2. I-OWASP Top 10
The OWASP Top 10 Igxininisa iingozi zokhuseleko eziqhelekileyo nezinzima kwizicelo zewebhu, ezinje ngokuhlaselwa ngenaliti kunye nokuqinisekiswa okwaphukileyo. I-Xygeni inceda imibutho ukuba ihlale ithobela i-OWASP ngokubona ngokuzenzekelayo kwaye ilungise ezi ngxaki zombini kwikhowudi evulekileyo kunye neyomnini.
3. Ulawulo oluQhubekekayo lwe-SANS lokuVuselelwa
The I-SANS CIS Ulawulo lugxininisa imfuneko yokulawulwa kobuthathaka okuqhubekayo. Ulawulo 7 lucebisa ukuba kusetyenziswe iiskena zobuthathaka ngokuzenzekelayo kunye nokusebenzisa iipatches ngokukhawuleza ukunciphisa umsebenzi wesandla. Izixhobo ze-Xygeni zokuskena ngokuzenzekelayo kunye nezixhobo zokulungisa ezakhelwe ngaphakathi zenza kube lula le nkqubo kwaye ziqinisekise ukuba umbutho wakho uyayithobela imigaqo emihle ye-SANS.
4. I-ISO / IEC 27001
The ISO / IEC 27001 standard imisela umlinganiselo wehlabathi jikelele wokulawula ukhuseleko lolwazi. Ifuna uvavanyo oluqhelekileyo lobuthathaka kunye namanyathelo acacileyo okunciphisa iingozi. I-Xygeni ixhasa ukuthotyelwa kwe-ISO 27001 ngokufumanisa ngokuzenzekelayo, ukubeka phambili umngcipheko, kunye nokwenza iingxelo ukuze kube lula uphicotho-zincwadi.
Ezinye iindlela zoLawulo loBunzima ekufuneka ziqwalaselwe:
- ITIL: Esi sikhokelo sibonelela ngeendlela ezilungileyo zolawulo lweenkonzo ze-IT, kuquka nokulawula ubuthathaka. I-Xygeni iqinisekisa ukuba ubuthathaka buyaphathwa ngokukhawuleza ukunciphisa nayiphi na impembelelo kwiinkonzo ze-IT kunye nemisebenzi yeshishini.
- CIS Ulawulo: IZiko loKhuseleko lwe-Intanethi (CIS) inika uluhlu lweendlela zokulawula ukunceda imibutho ilawule izoyikiso ze-intanethi. I-Xygeni izenzekela ukuskena kunye nokulungisa ubuthathaka, ikunceda uhlangabezane nazo CIS Ilawula kwaye iphucule indlela ohlala ngayo ukhuseleko.
Njengoko ubona, ukudala isicwangciso solawulo lobuthathaka esisebenzayo akuyonto inzima kangako. Ngokuhambelana nezi zikhokelo, uqinisekisa inkqubo epheleleyo nesebenzayo yolawulo lobuthathaka elula ukuyigcina ngeXygeni.
Iindlela ezilungileyo zoLawulo loBunzima oluSebenzayo
Ukuze udale isicwangciso solawulo lobuthathaka esisebenzayo, kufuneka ulandele le migaqo ilungileyo:
1. Yenza ukuskena koBungozi kube ngokuzenzekelayo
Iinkqubo ezenziwe ngesandla zicothisa impendulo yakho kwizisongelo. Yenza ukuskena kobuthathaka kube ngokuzenzekelayo nge I-Securit yoMthombo oVulekileyo kaXygeniy, ekunceda ufumane iingozi ngokukhawuleza kwaye usebenzise izilungiso ngaphandle kokuphazamisa indlela yokusebenza kweqela lakho.
2. Sebenzisa ukubekwa phambili okusekelwe kumngcipheko
Ayizizo zonke iziphene ezilinganayo. Gxila kwezo zixhaphakileyo nezinokuchaphazela kakhulu ishishini lakho. Ukubeka phambili izinto zeXygeni kuqinisekisa ukuba iqela lakho lisebenza kwezona ziphene zibalulekileyo kuqala.
3. Qhubeka ujonge ukuba kukho izinto ezintsha ezinobungozi
Ukuskena rhoqo akwanelanga. Ukubeka esweni rhoqo kukuvumela ukuba ubambe ubuthathaka obutsha njengoko buvela. Ukuskena kweXygeni ngexesha langempela kukhusela uthotho lwakho lobonelelo lwesoftware, kuchonga iingozi ngaphambi kokuba zibe ziingxaki ezinkulu.
4. Lungelelanisa noShishino Standards
Qinisekisa ukuba inkqubo yakho yolawulo lobuthathaka ilandela standards ukusuka NIST, I-SANS, I-OWASP, yaye ISO / IEC 27001. I-Xygeni idibana nezi nkqubo, inceda umbutho wakho uhlale uthobela imithetho kwaye uphucule ukhuseleko.
5. Khuthaza iNtsebenziswano kwiindawo zeDevSecOps
Ulawulo oluphumelelayo lobuthathaka lufuna intsebenziswano eqinileyo phakathi kwamaqela ophuhliso, ukhuseleko, kunye nemisebenzi. I-Xygeni idityaniswe kwimisebenzi ye-DevSecOps, okwenza kube lula kumaqela akho ukubona nokulungisa ubuthathaka ngaphandle kokucothisa imveliso.
Ukujongana Neengxaki Ezithile Ze-Intanethi Ngokusebenzisa Ulawulo Lokungakwazi Ukuzikhusela
Ezinye iingxaki zobuthathaka zibangela iingozi ezinkulu. Isicwangciso solawulo lobuthathaka esicwangciswe kakuhle sinokukunceda ujongane nezi ngxaki zithile. izinsongelo.
1. Uhlaselo lwe-Injection (umz., i-SQL Injection)
Ukuhlaselwa ngenaliti kwenzeka xa abahlaseli besebenzisa ubuthathaka ekunxibelelaneni kwedathabheyisi. Ngokulandela izikhokelo ze-OWASP Top 10 kunye nokusebenzisa i-Xygeni's Application Security Posture Management (ASPM) izixhobo, unokubona ngokuzenzekelayo kwaye ulungise ubuthathaka bokujova.
2. Intlawulelo
Uhlaselo lweRansomware olufana neWannaCry lusebenzise iinkqubo ezingakhange zilungiswe. Ngokusebenzisa ulawulo lwe-patch oluqhubekayo njengoko kucetyisiwe yi-NIST, iqela lakho linokuqinisekisa ukuba ubuthathaka obubalulekileyo buyalungiswa ngoko nangoko. I-Xygeni iyazilungisa ii-patches, inciphisa umngcipheko we-ransomware.
3. Ukuxhomekeka kwi-Open-Source
Uninzi lwezicelo zixhomekeke kwisoftware evulelekileyo, kodwa oku kunokungenisa ubuthathaka obufihlakeleyo. Open Source Security isoloko ijonga indlela yakho ukuxhomekeka kumthombo ovulekileyo ukuqinisekisa ukuba zihlaziyiwe kwaye zikhuselekile.
Indlela Yokoyisa CISO Imingeni: Uhlahlo-lwabiwo mali, Izixhobo, kunye nokuThotyelwa kweMithetho
wonke CISU-O ujongene nemingeni efana nemida yohlahlo-lwabiwo mali kunye nezixhobo ezinqongopheleyo. Nantsi indlela iXygeni ekunceda ngayo ukoyisa le miqobo.
1. Yenza ukuskena koBungozi kube ngokuzenzekelayo
NgeXygeni, ungenza ukuskena kunye nokulungisa ngokuzenzekelayo kuyo yonke indawo yakho CI/CD pipelineOku konga ixesha leqela lakho kwaye kuqinisekisa ukuba akukho ziphene ezibalulekileyo ezijongwayo, nokuba kukho iqela elincinci.
2. Lawula imida yezixhobo
Nokuba unezixhobo ezimbalwa, ungazilawula ngokufanelekileyo iingxaki zobuthathaka ngokugxila kwezona zisongelo zibalulekileyo. Ukubeka phambili izinto zeXygeni kunceda iqela lakho lilungise iingxaki zobuthathaka eziyingozi kuqala.
3. Ukuqinisekisa ukuThotyelwa kweMimiselo
Ukuthobela imithetho efana ne-ISO/IEC 27001, i-GDPR, kunye ne-CMMC kubalulekile. I-Xygeni izenzekela iinkqubo zokuskena kunye nokulungisa ngelixa inika iingxelo ezineenkcukacha ukuze ilungelelanise uphicotho-zincwadi kwaye inciphise izohlwayo.
Indlela iXygeni enokukunceda ngayo ukwakha inkqubo yakho yokulawula ubuthathaka
Iqonga leXygeni liphucula lonke inyathelo lesakhelo sakho solawulo lobuthathaka, lenza lula inkqubo kwaye lincede iqela lakho ligxile kwisicwangciso sokhuseleko esikumgangatho ophezulu:
- Ukuskena okuzenzakalelayo kuzo zonke isoftware yakho kunye neziseko zayo ziqinisekisa ukuba akukho mingcipheko engabonwayo.
- Ukubeka phambili izinto ezisekelwe kumngcipheko Inceda iqela lakho ligxile kwiingxaki ezibaluleke kakhulu ngokuvavanya ukuxhaphazwa kunye nefuthe leshishini.
- Ukulungiswa kwexesha langempela ivumela iqela lakho ukuba lijongane neengxaki ezibalulekileyo ngokukhawuleza nje ukuba zifunyanwe.
- Uvavanyo rhoqo inceda ekubambeni izoyikiso ezivelayo ngaphambi kokuba zibe ziziganeko ezinkulu.
Ngokuzenzekela ezi nkqubo, I-Xygeni ivumela iqela lakho lokhuseleko ukuba lichithe ixesha elincinci kwimisebenzi yezandla kunye nexesha elingakumbi kwimizamo yokhuseleko olucwangcisiweyo.
Qinisa icebo lakho lokulawula ubuthathaka namhlanje
Ngokwenza isicwangciso esisebenzayo solawulo lobuthathaka, uqinisekisa ukuba umbutho wakho unokuchonga, ubeke phambili, kwaye ulungise ubuthathaka ngaphambi kokuba bukhokelele kwiziganeko zokhuseleko ezinzulu. Ukulandela iindlela ezilungileyo ezivela kwi-NIST, SANS, OWASP, kunye ne-ISO/IEC 27001, kunye nokwenza iinkqubo zakho zibe zezona zizenzekelayo, kubalulekile ekwakheni ukhuselo oluqinileyo. Yila inkqubo yolawulo lobuthathaka ngoku.
Izixhobo zeXygeni zenza kube lula ukuzifumana, ukulungisa, kunye nokuthobela ubuthathaka ngokuzenzekelayo, zinceda iqela lakho lisebenze ngokufanelekileyo kwaye lihlale liphambi kwezoyikiso. NgeXygeni, umbutho wakho unokufezekisa icebo lolawulo lobuthathaka elikhuselekileyo nelicwangcisiweyo.
Ngaba ukulungele ukuthatha inyathelo elilandelayo? Jonga idemo namhlanje okanye fumana uvavanyo lwasimahla kwaye ubone indlela iXygeni enokuyiphucula ngayo inkqubo yakho yolawulo lobuthathaka.
