Isiqulatho
I-Zero Trust yindlela entsha echasa ingcamango endala yokuthembana okungagungqiyo, efuna ukuqinisekiswa okuqhubekayo nokuqinisekiswa. I-Zero Trust ivela njengesibane sethemba kwi-labyrinth ye Software Supply Chain Security (SSCS), apho ukuthembana kuyinto enqabileyo. Ukushiya iingcamango zakudala, kuphosa iliso elibukhali kumsebenzisi ngamnye, isixhobo, kunye nesicelo, ngakumbi ekuqinisekiseni ukuthembeka kwezinto zesoftware kunye neendawo zokugcina izinto zabo—izakhi zokwakha zesoftware ekhuselekileyoJoyina nathi kuhambo lokhuseleko olungagungqiyo njengoko singena kwihlabathi leZero Trust kunye SSCS, apho ukuthembana kufumaneka khona, kungekhona ukuthathwa njengento ecingelwayo.
Akukho themba kwi SSCS: Ukuphakamisa uKhuseleko ngoBulungisa obungagungqiyo
I-Zero Trust iye yaba yinkqubo yokhuseleko eyaziwayo ngokubanzi. Imibutho emininzi iye yamkela imigaqo yayo ukuphucula indlela ehlala ngayo ukhuseleko kwihlabathi ledijithali elidibeneyo nelintsonkothileyo. Ngokutsho kwe-an Uphando lukaArmis, Ama-33% eengcali ze-IT ayelindele ukuba imibutho yabo izamkele iimodeli zeZero Trust ngo-2023. Le ndlela yokucinga ibaluleke kakhulu kwicandelo le SSCS, apho ukuthembeka kwezinto zesoftware kunye neendawo zokugcina izinto zazo kubaluleke kakhulu.
Xa sijika ingqalelo yethu kwindawo Software Supply Chain Security (SSCS), ingqwalasela yethu incipha kwintembeko yezinto zesoftware kunye neendawo zokugcina ezizigcinayo. Kule meko, ukuthembana akunanto ithile; ngumphumo othe ngqo wentembeko engagungqiyo. Njengoko izinto zesoftware zihamba kwiindawo ezahlukeneyo zokugcina, ziqhubeka nokuguquka nokuhlanganiswa, zibumba imveliso yokugqibela kunye.
Kule nkqubo inzima, ukuqinisekisa ukuthembeka okugqibeleleyo kwezi zinto zobugcisa kunye neendawo zokugcina izinto kubaluleke kakhulu, njengoko lo kuthembeka kukhuthaza ukuthembana.
Imodeli yeZero Trust icinga ukuba izoyikiso zinokubakho ngaphandle, nangaphakathi kwenethiwekhi yombutho, igxininisa ukuba ukuthembana akufuneki kube yinto engacacanga.
Imigaqo ephambili yefilosofi yeZero Trust kumxholo wekhonkco lobonelelo lwesoftware ibandakanya:
- Qinisekisa yonke into, ungathembi nto. Lo mgaqo sisiseko seZero Trust kwaye usebenza nakwinkqubo yokubonelela ngesoftware. Zonke izinto ezenziwe ngesoftware, ukusuka kwikhowudi yomthombo ukuya kwi-binary esetyenzisiweyo, kufuneka ziqinisekiswe ukuba ziyinyani kwaye zithembekile ngaphambi kokuba zisetyenziswe.
- Ukufikelela okuncinci kwamalungelo. Nika abasebenzisi kunye neenkqubo kuphela ukufikelela abakudingayo ukuze benze imisebenzi yabo. Oku kunceda ukunciphisa umphezulu wohlaselo kunye nokuthintela abenzi bobubi ekufikeleleni kwizixhobo ezibuthathaka.
Ukubeka iliso nohlalutyo rhoqo. I-Zero Trust ayisiyondlela yokhuseleko ecwangcisiweyo. Ifuna ukujongwa rhoqo kunye nohlalutyo lwenkqubo yokubonelela ngesoftware ukuze kuchongwe kwaye kuphendulwe kwizisongelo.
Ingaphunyezwa njani iZero Trust kwikhonkco lobonelelo lwesoftware?
Inyathelo lokuzikhusela: Ukuqinisa inkqubo yokuvelisa isoftware
Ukuphumeza ngempumelelo iZero Trust kwi SSCS, iseti epheleleyo yamanyathelo okuzikhusela ibalulekile. Ukukhusela inkqubo yokuvelisa isoftware ekuphazamisekeni okunobungozi kunye nokuthintela ukungeniswa kohlaziyo lwekhowudi oluyingozi kufuna amaqhinga aphambili okuzikhusela:
ULawulo lokuFikelela:
- Sebenzisa ulawulo lokufikelela olusekelwe kwindima (RBAC) ukuze uthintele ukufikelela kwiindawo zokugcina iikhowudi kunye nokwakha iindawo ezisekelwe kwiindima zomsebenzisi kunye neemvume.
- Sebenzisa uqinisekiso lwezinto ezimbini (2FA) ukuze uqinise uqinisekiso kwaye wenze kube nzima ngakumbi kubahlaseli ukufumana ukufikelela okungagunyaziswanga.
- Sebenzisa ukufikelela okuncinci ukuze abasebenzisi kunye nezikripthi okanye ukuhlanganiswa kube nokufikelela kuphela kwizixhobo abazidingayo ukuze benze imisebenzi yabo.
Ukutyikitya kwezinto:
- Kufuneka kusayinwe zonke izinto zesoftware ezisetyenziswa kwimveliso.
- Sebenzisa igunya lokusayina elithembekileyo (CA) ukuqinisekisa ubunyani botyikityo ngalunye lwecandelo.
- Sebenzisa uqinisekiso lokusayina oluzenzekelayo ukuqinisekisa ukuba zonke izinto zesoftware zisayiniwe ngaphambi kokuba zisetyenziswe.
Ngokusebenzisa ukutyikitya, imibutho inokunciphisa umngcipheko wokungeniswa kwekhowudi enobungozi kwikhonkco lobonelelo lwesoftware.
Ukufunyanwa kweKhowudi enobungozi:
- Sebenzisa uhlalutyo oluzinzileyo ukuze ufumane ikhowudi enobungozi kwi pipelineizinto zesoftware kunye nezinto ezisetyenzisiweyo.
- Sebenzisa i-sandboxing kunye nezinye iindlela zokwahlula nokuhlalutya izinto zesoftware ngaphambi kokuba zisetyenziswe.
Ukuqinisekiswa koBulungisa: Ukugcina ubunyulu bezinto ezenziwe kwiSoftware
Akukho themba kwi SSCS idlulela ngaphaya kokuthintela uhlaselo olunonya ukuya ekuqinisekiseni ukuthembeka okungagungqiyo kwezinto zesoftware kuyo yonke inkqubela phambili yobomi, equka:
Ukulandelela Imvelaphi kunye noBungqina:
- Sebenzisa inkqubo yokulandelela imvelaphi kunye notshintsho lwazo zonke izinto zesoftware kulo lonke ixesha lophuhliso. Oku kungenziwa kusetyenziswa iindlela ezahlukeneyo, ezinje ngetekhnoloji ye-blockchain, i-watermarking yedijithali, kunye ne-hash-based signatures.
- Sebenzisa ukulandelela imvelaphi ukuze uchonge kwaye uphande imisebenzi ekrokrisayo kwikhonkco lokubonelela ngesoftware. Umzekelo, ukuba isoftware artifact iguqulwe ngendlela engagunyaziswanga, ukulandelela imvelaphi kungasetyenziselwa ukulandelela umthombo wotshintsho kwaye kuthathwe amanyathelo okulungisa.
Ngokulandela imvelaphi kunye notshintsho lwezinto ezisetyenzisiweyo kwisoftware, imibutho inokwenza kube nzima ngakumbi kubahlaseli ukufihla imisebenzi yabo enobungozi. Umzekelo, ukuba iSolarWinds ibisebenzise umkhondo wemvelaphi, bekuya kuba lula ukuchonga umthombo wekhowudi enobungozi efakwe kwi-Orion SDK.
Ukwakhiwa Okuphindaphindwayo:
- Sebenzisa iindawo zokwakha eziphinda zisetyenziswe ezivelisa izinto zesoftware ezifanayo rhoqo kwikhowudi yomthombo ofanayo. Oku kungenziwa ngokusebenzisa izixhobo ezifana neDocker kunye nePacker ukudala iindawo zokwakha ezingaguqukiyo.
- Sebenzisa izakhiwo eziphinda zisetyenziswe ukuqinisekisa ukuthembeka kwezinto zesoftware kwinqanaba ngalinye lomjikelo wophuhliso. Umzekelo, ungasebenzisa i-checksum ukuqinisekisa ukuba isoftware ayikaphazanyiswa ukususela oko yakhiwa.
Ngokusebenzisa ukwakhiwa okuphinda kuvele, imibutho inokunciphisa umngcipheko wokufakwa kwekhowudi enobungozi kwikhonkco lobonelelo lwesoftware ngexesha lenkqubo yokwakha. Umzekelo, Ngo-2020, isoftware yeSolarWinds Orion yachaphazeleka liqela laseRashiya elijongene nobuntlola kwi-intanethi. Abahlaseli bakwazile ukufaka ikhowudi enobungozi kwisoftware, eyathi emva koko yasasazwa kubathengi beSolarWinds kwihlabathi liphela. Olu hlaselo lube yimpumelelo kuba indawo yokwakha yeSolarWinds yayingenakuphindaphindwa.
Ukuba iSolarWinds ibisebenzise ukwakhiwa okuphindaphindwayo, abahlaseli bebengenakukwazi ukufaka ikhowudi enobungozi kwisoftware ngaphandle kokubhaqwa.
Ukuqinisekiswa koBulungisa bezinto ezenziweyo:
Sebenzisa iisignature zedijithali kunye nee-cryptographic hashes ukuqinisekisa ukuthembeka kwezinto zesoftware kwinqanaba ngalinye lomjikelo wophuhliso. Oku kungenziwa kusetyenziswa izixhobo ezifana Xygeni Build Security.
- Sebenzisa ukuqinisekiswa kobunyani bezinto zakudala ukuze ufumane utshintsho olungagunyaziswanga kwizinto zakudala zesoftware. Umzekelo, ukuba izinto zakudala zesoftware ziguqulwe ngendlela engagunyaziswanga, ukuqinisekiswa kobunyani bezinto zakudala kuya kufumanisa utshintsho kwaye kuvelise isilumkiso.
Ngokusebenzisa amanyathelo okuqinisekisa ukuthembeka kwezinto zakudala, imibutho inokunciphisa umngcipheko wokungeniswa kwekhowudi enobungozi kwikhonkco lobonelelo lwesoftware nakweliphi na inqanaba lenkqubo yophuhliso kunye nokuhanjiswa.
Apha ngezantsi ngumzekelo wendlela indibaniselwano yale milinganiselo enokuhlanganiswa ngayo CI/CD pipeline:
- 1. Uqinisekiso lomsebenzisiUmsebenzisi ungena kwinkqubo esebenzisa uqinisekiso lwezinto ezimbini (2FA) ukuze akhuseleke ngakumbi.
- 2. Uvavanyo loLawulo loFikelelo oluSekelwe kwiNdima (RBAC)Ulawulo lweKhowudi yoMthombo (SCM) inkqubo ijonga ukuba umsebenzisi unazo na iimvume ezifunekayo zoku commit utshintsho.
- 3. Ikhowudi CommitUmsebenzisi ogunyazisiweyo commitutshintsho olutsha lwekhowudi kwindawo yokugcina izinto, nto leyo ebangela ukuba CI/CD pipeline.
- 4. Uvavanyo lokuthobela imithetho kunye noQinisekiso loMgangatho: Le khowudi ivavanywa ukuze ihambelane nomthetho wokubhala ikhowudi standardkunye nokuqinisekiswa komgangatho ngokubanzi.
- 5. Imfihlo kunye IaC Ukuskena: The pipeline iskena iimfihlo eziyimfihlo, ezinje ngamagama ayimfihlo okanye amaqhosha e-API, ukuthintela ukwaphulwa kokhuseleko.
- 6. Ukufunyanwa kwekhowudi enobungoziIzixhobo zohlalutyo oluzinzileyo ziskena i-codebase ukuze zifumane iipatheni ezibonisa ikhowudi enobungozi, njengeengcango zangasemva okanye ezinye izoyikiso zokhuseleko, ukuqinisekisa ukuthembeka nokhuseleko lwekhowudi.
- 7. Ukuskena ukuba sesichengeni: The pipeline Iskena i-codebase kunye nokuxhomekeka kwayo ukuze ifumane naziphi na iingxaki ezaziwayo.
- 8. Ukuqinisekiswa koMsayino: Utyikityo lwazo zonke izinto ezisetyenzisiweyo ekudityanisweni luqinisekisiwe ukuqinisekisa ubunyani kunye nokuthenjwa.
- 9. Ukuveliswa koBungqina: Emva kokugqitywa ngempumelelo kwazo zonke iimvavanyo, kwenziwa ingxelo yobungqina, eqinisekisa ukhuseleko kunye nokuthembeka kwemveliso yokugqibela.
- 10. Ukulungiswa koSasazo lweMveliso: Imveliso eqinisekisiweyo ilungiselelwe ukusasazwa kubathengi bokugqibela, ukuqinisekisa ukuba bafumana imveliso ekhuselekileyo neqinisekisiweyo.
Ukuziqhelanisa nokuguquguquka: Isakhelo seNdawo ezahlukeneyo
Isakhelo seZero Trust se SSCS kufuneka ibe namandla kwaye ikwazi ukuguquguquka, ixhase iindawo ezahlukeneyo zophuhliso lwesoftware, ukusuka kwizakhiwo ze-microservices ezifumaneka kwilifu ukuya kwizakhiwo zemveli on-premiseiinkqubo. Ukunamathela standard izakhiwo zobungqina, ezifana ne-metadata kunye ne-digital signatures, zenza kube lula ukusebenzisana kwaye kuvumela ukuhlanganiswa okungenamthungo nezixhobo zokhuseleko ezikhoyo.
Kwixesha apho ukwaphulwa kokhuseleko kunye nobuthathaka kusanda khona, kwamkelwa indlela yeZero Trust kwimeko Software Supply Chain Security linyathelo elisebenzayo lokuqinisekisa ukuthembeka nokuthembeka kwesoftware yakho. Ngokudibanisa amanyathelo okuzikhusela nokuqinisekisa ukuthembeka kuyo yonke inqanaba, imibutho inokwakha iinkqubo zesoftware ezikhuselekileyo, eziqinileyo, nezithembekileyo, ikhusela izinto zayo zedijithali kwaye iqinise uthotho lweenkonzo zesoftware yayo kwiingozi ezinokubakho.
I-Zero Trust kunye SSCS ngokubambisana bakhe isiseko esomeleleyo sesicwangciso sokhuseleko kuqala kwixesha elizayo apho ukhuseleko lubaluleke kakhulu. Imibutho inokuhamba kwindlela etshintsha rhoqo yedijithali ngokuzithemba nangokuzinza ngokugxila kubulungisa nokuthembana.
