Amaqela okhuseleko awasoloko ehluleka kuba engenazo iinkcukacha. Amaxesha amaninzi, ayasilela kuba alungisa imiba engafanelekanga kuqala. Yiyo loo nto kanye i-Known-Exploit Intelligence, ulawulo lobuthathaka olusekelwe kumngcipheko, uMthetho woBuchule bokuHlala kwi-Intanethi, kunye CISIkhathalogu eyaziwayo ye-Exploited Vulnerabilitys ngoku idibana kwiindlela zanamhlanje zokusebenza ze-AppSec.
Iveki nganye, ii-scanner zibika amakhulu eengxaki zobungozi. Nangona kunjalo, abahlaseli basebenzisa kuphela iqela elincinci labo. Ngenxa yoko, amaqela abeka phambili ngaphandle kokuxhaphaza umxholo achitha ixesha ngelixa izoyikiso zokwenyani zidlula. I-Known-Exploit Intelligence ivala loo msantsa ngokubonisa ubungozi obusetyenziswa ngabahlaseli, kungekuphela nje obo bubonakala bunzima ephepheni.
Yintoni eyaziwayo - Ubukrelekrele bokusebenzisa kakubi
Ubukrelekrele obusetyenziswa ngabantu abaziwayo buchonga ubuthathaka obusetyenziswa ngabahlaseli kwiindawo zokwenyani. Ngamanye amazwi, buhlukanisa umngcipheko wethiyori kwindlela yokuziphatha yohlaselo eqinisekisiweyo.
Endaweni yokubuza ukuba ingaba kukho ubuthathaka nako ukuba baxhatshazwe, amaqela ekugqibeleni angabuza:
Ingaba oku sele kusetyenzwa kakubi, kwaye ngaba kuyayichaphazela imveliso yam?
Loo mahluko ubalulekile ngokusebenza kwawo, kwaye ngokwandayo, ngokwasemthethweni.
Kutheni Ukubekwa Kwezinto Eziphambili Ngokwesiko Kungaphumeleli
Uninzi lwamaqela lusaxhomekeke kwiimpawu ezingashukumiyo ukuze lubeke phambili umngcipheko.
Ngokwesiqhelo, bahlela ubuthathaka ngolu hlobo:
- Ubunzima beCVSS
- Ukuzithemba kweskena
- Ukuthandwa kwephakheji
Nangona ezi mpawu zinceda ekunciphiseni ingxolo, ziyayiphosa into enye ebalulekileyo: indlela abaziphatha ngayo abahlaseli. Ngenxa yoko, amaqela adla ngokungxama ukulungisa imiba enzima kakhulu engaze ixhaphake ngelixa ephosa iimpazamo ezinzima eziphantsi ezijoliswa ngabahlaseli.
Esi sikhewu sichaza isizathu sokuba ukubekwa phambili kwezinto ngendlela engaguqukiyo kungasakhuli.
Kutheni uMthetho woBuchule bokuHlasela kwiCyber utshintsha imithetho
phantsi UMthetho wokuZinzisa kwiCyber, isoftware yokuthumela ngezithuthi eneengxaki ezaziwayo ezinokuthi zisetyenziswe iba yingxaki yokuthobela imithetho, kungekuphela nje inkxalabo yokhuseleko.
Lo mgaqo ufuna ukuba:
- Iimveliso ezinee-elementi zedijithali akufuneki zingene kwimarike ye-EU zinobuthathaka obaziwayo obunokuxhaphazwa
- Abavelisi basebenzisa amasango okuphatha ubuthathaka kunye nokuvula
- Ukuxhaphazwa kwiindawo zokwenyani kuneengxaki ezinzulu kunezo zinzulu.
Ngenxa yoko, ukubekwa phambili kuyatshintsha ukusuka kwindlela efanelekileyo ukuya kwimbopheleleko esemthethweni.
Kulapho kanye ubukrelekrele bokuxhaphaza buba yinto ebalulekileyo khona.
UMthetho wokuZinzisa kwiCyber
The UMthetho wokuZinzisa kwiCyber ngumgaqo we-European Union omisela iimfuno zokhuseleko lwe-intanethi ezinyanzelekileyo kwiimveliso ezinee-elementi zedijithali ezithengiswa kwi-EU.
Ngamazwi alula, ifuna abavelisi ukuba bayile, baphuhlise, kwaye bagcine isoftware engenazo iziphene ezaziwayo ezinokusetyenziswa ngexesha lokukhululwa. Ngaphezu koko, inyanzela iinkampani ukuba zijonge iziphene emva kokukhululwa kwaye zibike imiba esetyenziswa ngokukhutheleyo ngaphakathi kwexesha elimiselweyo.
Lo mthetho uqale ukusebenza ngoDisemba ka-2024. Nangona kunjalo, ukunyanzeliswa ngokupheleleyo kuqala ngoDisemba ka-2027. Ukususela ngo-2026, iinkampani kufuneka zixele ukuba zichaphazeleka kakubi kwiigunya ze-EU kwiiyure ezingama-24 emva kokufunyanwa kwazo.
Ngamanye amazwi, uMthetho woKunyamezela kwiCyber uguqula ulawulo lobuthathaka ukusuka ekubeni yindlela engcono yokwenza izinto lube yimfuno yokufikelela kwimarike.
Kutheni ii-KEVs Zikwindawo Ephambili Yokuthobela Imithetho ye-CRA
The CISIkhathalogu eyaziwayo yokuxhatshazwa Udwelisa ii-CVE ezisetyenziswa ngabahlaseli endle. Le khathalogu isusa ukungacaci.
Endaweni yokuxoxa ngomngcipheko, amaqela anokuthembela kwidatha yokusetyenziswa okuqinisekisiweyo. Ngenxa yoko, ii-KEVs ziba sisizathu esinamandla sokulungisa ii-SLA kunye nokuthintela ukukhululwa.
Le ndlela ihambelana ngokwendalo ulawulo lobuthathaka olusekelwe kumngcipheko, kuba igxila kwimizamo apho kwenzeka khona umonakalo wokwenene.
IiCVSS, iiEPSS, kunye neeKEV zisebenza ngeenjongo ezahlukeneyo
Ukubeka phambili okusebenzayo kufuna ukuqonda indlela iimpawu ezahluka ngayo.
- CVSS ibonisa impembelelo enokubakho
- EPSS uqikelela amathuba okuxhatshazwa
- The CISIkhathalogu eyaziwayo yokuxhatshazwa kwabantu abaxhatshazwayo iqinisekisa ukuxhaphazwa okusebenzayo
Xa isetyenziswa yodwa, isignali nganye iyalahlekisa. Xa isetyenziswa kunye, inika umxholo. Loo ndibaniselwano yakha isiseko solawulo lwanamhlanje olusekelwe kumngcipheko.
Indlela Ubukrelekrele Obusetyenziswa Ngayo Kwimisebenzi
Imodeli yokubeka phambili izinto ngokubaluleka ilandela ulandelelwano olucacileyo:
- Fumanisa ubuthathaka kuyo yonke ikhowudi kunye nokuxhomekeka
- Iziphumo zomdlalo ngokuchasene CISIkhathalogu eyaziwayo yokuxhatshazwa
- Vavanya amathuba okuxhaphaza usebenzisa i-EPSS
- Qinisekisa ukuba isicelo siyafikeleleka okanye pipeline
- Sebenzisa imithetho yokulungisa imeko ngokusekelwe ekuvezweni kwayo kunye nendima yemveliso
Ngenxa yoko, amaqela ayeka ukuphatha uluhlu lwabantu abasengozini njengokusilela kwaye aqala ukuluphatha njengento engafanelekanga.cision.
Indlela Esakha Ngayo Ubukrelekrele Obuziwayo Nobuxhaphazi eXygeni
Sakha olu phawu emva kokubona amaqela elungisa iingxaki ze-CVSS ephezulu ngelixa ubuthathaka obaziwayo obuxhaphakileyo bufikelela kwimveliso. Loo mava abumba indlela esiyila ngayo inkqubo.
kunye v5.36, I-Xygeni idibanisa ubukrelekrele bokusebenzisa obuqinisekisiweyo ngqo kwi-injini yokubeka phambili.
Kwenzeka ntoni phantsi kwehood
- I-Xygeni iqhubeka nokutya iikhathalogu zokuxhaphaza ezithembekileyo ezifana ne-KEV kunye neminye imithombo yokuxhaphaza kawonke-wonke
- Ubuthathaka ngabunye bufumana imethadatha yokusetyenziswa kwe-exploit-presence
- I-funnel yokubeka phambili izinto idibanisa:
- Imeko eyaziwayo yokuxhaphaza
- Amathuba e-EPSS
- Umxholo wokufikelela
- Ukuvezwa kwekhowudi kunye nokuxhomekeka
Eli qonga libala amanqaku omngcipheko odibeneyo kwihlabathi lokwenyani
Endaweni yokutshintsha iimpawu ezikhoyo, le modeli iyawaphucula.
Ukufunyanwa → Ukudibana Kokusebenzisa Kakubi → Ukufikeleleka → Ukulungiswa
Olu hambo luqhuba yonke i-decision:
Abaphuhlisi babona umxholo wokuxhaphaza ngqo kwi pull requests. PipelineI-block ye-s idibana kuphela xa ikhowudi enokufikeleleka iquka ubuthathaka obaziwayo obuxhaphakileyo. Ukulungiswa ngokuzenzekelayo kucebisa ukuphuculwa okukhuselekileyo ngoko nangoko.
Akukho ntlanganiso. Akukho qikelelo. Akukho ziphazamiso zoloyiko.
Kutheni Oku Kubalulekile Ngaphaya Kokuthobela Imithetho
Nangona uMthetho woBuchule bokuHlala kwiCyber wabangela olu tshintsho, izibonelelo ziyanda ngakumbi.
Amaqela abeka phambili ukusebenzisa ubukrelekrele bokuxhaphaza:
- Nciphisa ukudinwa kwesilumkiso
- Nciphisa ixesha lokulungisa
- Ziphephe iipatch zexesha likaxakeka
- Thumela isoftware ekhuselekileyo ngokuzithemba
Ukuthobela imithetho kuba yimpembelelo ecaleni yokwenza ukhuseleko ngendlela eyiyo.
Iingcinga Zokugqibela: I-CRA Yenza Ulawulo Olusekelwe Kumngcipheko Lube Yimfuneko
UMthetho woBuchule bokuHlala kwiCyber uqinisekisa ukuba oko sele kufundwe ngamaqela anamava. Ayizizo zonke iingxaki ezibaluleke ngokulinganayo.
The CISIkhathalogu eyaziwayo ye-Exploited Vulnerabilities ibonisa oko kusetyenziswa ngabahlaseli namhlanje. Umxholo kunye nokufikeleleka kubonisa ukuba kuyakuchaphazela na. Xa zidibene, zichaza izinto zanamhlanje ulawulo lobuthathaka olusekelwe kumngcipheko.
I-Xygeni isebenzisa le modeli rhoqo, ngokuzenzekelayo, kwaye apho abaphuhlisi sele besebenza khona.
Malunga uMbhali
Ibhalwe ngu UFatima Said, Umphathi weNtengiso yoMxholo ogxile kuKhuseleko lweZicelo kwiXygeni Security. Udala umxholo ogxile kubaphuhlisi, oqhutywa luphando kwi-AppSec, ASPM, kunye neDevSecOps, eguqulela imingeni yokhuseleko lwehlabathi lokwenyani ibe yisikhokelo esicacileyo nesisebenzayo.
