Uhlaselo lwanamhlanje alusalindi de kube lixesha lokusebenza. Luqala kwizinto ozixhomekeke kuzo, lwakha izikripthi, kwaye pipelines.
Yiyo loo nto ukhuseleko lwe-malware kufuneka ludlulele ngaphaya kwezixhobo ze-antivirus kunye nezixhobo ze-endpoint.
Abaphuhlisi banamhlanje bajongene nomngeni omtsha: ukuqinisekisa ukhuseleko kwi-malware phambi kokuba Ikhowudi ikwahlanganiswa. Izixhobo zemveli zisabela emva kokosuleleka, kodwa ukhuselo lwe-malware olungcono lusebenza kwangethuba, ngaphakathi kwekhonkco lobonelelo lwesoftware.
Kutheni Ukukhuselwa kweMalware Kufuneka Kuvele
Kangangeminyaka, imibutho ibisoloko ithembela kwizisombululo ze-antivirus kunye ne-endpoint zokujongana ne-malware. Sekunjalo, ezi nkqubo zibona kuphela izoyikiso xa sele zingaphakathi.
Okwangoku, abahlaseli baye bafudukela phezulu. Bafaka ikhowudi enobungozi kwiipakethe zemithombo evulekileyo, bafihle imithwalo yemisebenzi kwizikripthi zokufaka kwangaphambili, baze bavumelane CI/CD pipelines.
Ngokutsho Ingxelo yoLwaphulo-mthetho lwe-intanethi ye-FBI ka-2024, ilahleko yolwaphulo-mthetho lwe-intanethi idlule kwi-$12.5 yeebhiliyoni kunyaka ophelileyo, kunye nohlaselo lweenkqubo zokubonelela ngesoftware olunyuka kakhulu. I-NCSC yase-UK ikwalumkisa ukuba isiganeko esinye kwezintathu ngoku siquka iqela lesithathu okanye ukuxhomekeka okubuthathaka.
La manani aqinisekisa oko abaphuhlisi abaninzi abasele bekukrokrela: ukhuseleko lwe-malware lwendabuko alukwazi ukuqhubeka.
Oko Ukukhuselwa KweMalware Yendabuko Kungalunganga
Izixhobo zokukhusela i-malware zakudala zixhomekeke kwiimpawu zotyikityo, ukufanisa iipateni, okanye uhlalutyo lokuziphatha kwiindawo zokugqibela. Nangona zisebenza kwi-malware esekelwe kwifayile, azinazo izoyikiso zenqanaba lekhowudi ezifihliweyo kwiinkqubo zokwakha kunye neerejista.
Umzekelo, i-npm kunye ne-PyPI zibona amawaka eepakeji ezintsha yonke imihla. Uninzi lwazo luqulathe i-obfuscated okanye imibhalo engalunganga zifihlwe njengezixhomekekileyo. Nje ukuba zifakwe, ezi skripti zinokuba iziqinisekiso, ziqhagamshele kwiiseva ezikude, okanye zifake iingcango zangasemva, ngaphambi kokuba zisetyenziswe.
Ke ngoko, ukuthembela kuphela ekufumaneni ixesha lokusebenza kunika ukhuseleko oluyinxenye kuphela kwi-malware.
Ngokwahlukileyo koko, ukhuseleko olungcono lwe-malware luqala kwangethuba, luhlalutya ukuxhomekeka ngaphambi kokuba zingene kwindawo okuyo.
Idatha Ebangela Usongelo Olukhulayo
Ukwanda kohlaselo lweenkqubo zesoftware kuyalinganiswa kwaye kunzima ukungayinaki.
Izifundo zamva nje zibonisa ukuba imeko-bume yomngcipheko ikhula ngokukhawuleza kangakanani kwiindawo eziphilayo ezivulelekileyo kunye nophuhliso pipelines.
- A I-650% yokunyuka konyaka-mali kwiiphakheji ezinobungozi ezilayishwe kwi-npm kunye ne-PyPI, ngokutsho kwe Uphando lwe-arXiv (2024).
- Phantse I-30% yazo zonke iinkcaso zedatha ngo-2024 amacandelo eqela lesithathu okanye abathengisi bangaphandle, ngokusekelwe kwi I-ENISA Threat Landscape 2024.
- The Isikhokelo seMITER ATT kunye neCK ichonga ngaphezulu kwe Iindlela ezili-100 ezahlukeneyo inxulumene nobudlelwane phakathi kokunikezelwa kwesoftware, ukusuka ekudidekeni kokuxhomekeka ukuya ekubiweni kweziqinisekiso.
Xa zizonke, ezi ziphumo zibonisa ukuba i-malware ayisajolisi kuphela kwiindawo zokugqibela.
Endaweni yoko, isasazeka ngokuxhomekeka okuthembekileyo, ukwakha pipeline, kwaye CI/CD indawo.
Yiyo loo nto imibutho ifuna ukhuseleko kwi-malware oko kuqala kumthombo, ngaphambi kokuba nayiphi na iphakheji esengozini ifikelele kwimveliso.
Ukhuseleko lweMalware yendabuko vs. Ukhuseleko lweMalware yeDevSecOps yanamhlanje
| umba | Ukhuseleko lweMalware yendabuko | Ukhuseleko lweMalware yeDevSecOps yanamhlanje |
|---|---|---|
| umda | Igxila kwiindawo zokugqibela kunye nezixhobo zomsebenzisi. | Ikhusela uthotho olupheleleyo lwesoftware, ukusuka kwikhowudi ukuya kwilifu. |
| Ixesha lokuFumana | I-Reactive — ichonga izoyikiso emva kokosuleleka okanye ukubulawa. | I-Proactive — ifumanisa kwaye ivale i-malware ngaphambi kokuba yakhe okanye ifakelwe. |
| Indlela yokufumanisa | Ixhomekeke kwiimpawu kunye neendlela ezaziwayo zokoyikisa. | Isebenzisa uhlalutyo oluqonda indlela yokuziphatha kunye noluqonda imeko yokuxhomekeka kunye nekhowudi. |
| Integration | Izixhobo ezizimeleyo, ezidla ngokuba ngaphandle kwemisebenzi yabaphuhlisi. | Idibanisa ngaphandle komthungo kunye CI/CD izixhobo ezifana neGitHub, iGitLab, iJenkins, kunye neAzure DevOps. |
| Umyinge | Ilinganiselwe kwi-malware eyaziwayo kwizixhobo nakwiifayile. | Iyandisa kwikhowudi yomthombo, iipakethe zemithombo evulekileyo, izikhongozeli, kunye pipelines. |
| Ixesha lokuphendula | Kuxhomekeke kuhlaziyo olwenziwa ngesandla kunye neesiginitsha ze-antivirus. | Ihambisa izilumkiso ngexesha langempela kunye nokuvala ngokuzenzekelayo iipakeji ezikrokrelekayo. |
| Izithuba zobuxoki | Iphezulu — idla ngokuvelisa izilumkiso ezinomsindo neziphindaphindayo. | Kuncitshiswa ngohlalutyo lokuxhaphazwa kunye nokufikeleleka. |
| into yokuZenzekelayo | Kufuneka uphando nokulungiswa ngesandla. | Ibandakanya ukulungiswa okuzenzakalelayo, izilumkiso zakuqala, kunye ne-firewall yokuxhomekeka. |
| Ukubonakala | Igxile kwiindawo zokugqibela, ayinakho ukulandeleka okwakhiweyo. | Ibonelela ngokulandeleka ngokupheleleyo nge SBOMs, iprovenance, kunye nobungqina. |
| Eyona iFinelayo | Ukuthintela emva kwesiganeko kunye nokuzikhusela kwinqanaba lesixhobo. | Ukhuseleko oluqhubekayo kwi-malware kulo lonke uphuhliso kunye nokuhanjiswa kwayo pipelines. |
Oko kufanele kuqukwe kukhuseleko lwe-malware olungcono
Amaqela ophuhliso lwanamhlanje adinga ukhuseleko lwe-malware olukumgangatho ophezulu ehambelana nendlela isoftware eyakhiwe ngayo namhlanje.
Ukuze uhlale ukhuselekile, ukhuselo kufuneka luqale kwangethuba kwaye luthintele ikhowudi enobungozi ukuba ingangeni pipeline kukonke.
Kufuphi, ukhuseleko olusebenzayo lwe-malware igxile ekuthinteleni kunokuba igxile ekuphenduleni.
Isisombululo esipheleleyo kufuneka siquke iileya ezininzi zokhuselo ezidityanisiweyo:
- Ukuskena ngexesha lokwenyani iirejista zemithombo evulekileyo ezifana ne-npm, i-PyPI, i-Maven, kunye ne-NuGet, zigcina izoyikiso zingasasazeki.
- Inkqubo yesilumkiso kwangethuba ehlala ijonga ezo rejista kwaye ifumanise i-malware engenasuku lonke kwangoko xa ivele, ilumkisa amaqela ngaphambi kokuba iipakeji ezinentsholongwane zifikelele kwiindawo ezikuzo.
- Umlilo wokuxhomekeka ezivala okanye zivale ngokuzenzekelayo izinto ezikrokrelekayo, nto leyo enciphisa isidingo sokuhlolwa ngesandla.
- Ukufunyanwa kwe-Anomaly ngaphesheya CI/CD kwaye SCM iinkqubo, ezinceda ekuchongeni ukuziphatha okungaqhelekanga okanye utshintsho olungalindelekanga lwefayile ngexesha lokwakha.
- Uhlalutyo loMququzeleli kunye noMpapashi ukubona utshintsho olukhawulezileyo lomlondolozi okanye iiakhawunti ezibiweyo ezinokufaka ikhowudi enobungozi.
- Ukunyanzeliswa koMgaqo-nkqubo Okuqhubekayo ukugcina ukuthobela imithetho kunye nokuhambelana ngaphandle kokucothisa uphuhliso.
Inani elikhulayo leengxaki libonisa ukuba kutheni ezi khuselo zibalulekile.
Ngokutsho Isiseko seNkcukacha seSizwe (NVD), engaphezulu kwe Ii-CVE ezintsha ezingama-29,000 zaxelwa ngo-2024, eli liphezulu kunangaphambili.
Olu lwando luqhubekayo lubonisa indlela ezitshintsha ngokukhawuleza ngayo izisongelo kunye nesizathu sokuba abaphuhlisi befuna ukhuselo olunemigangatho olwakhelwe ngqo kumsebenzi wabo.
Xa zizonke, ezi zakhono ziqinisekisa ukuba ukhuseleko lwe-malware lugubungela onke amanqanaba, ukusuka kwikhowudi ukuya kwilifu, ukunciphisa ukubonakaliswa, ukuphucula ukubonakala, kunye nokugcina pipelineicocekile.
Indlela kaXygeni: Ukhuseleko lweMalware olusebenzayo kwiDevOps
I-Xygeni izisa ukhuseleko lwe-malware lwanamhlanje ngqo kwinkqubo yophuhliso.
Endaweni yokulinda izilumkiso emva kokwakhiwa, ifumanisa kwaye ivale izoyikiso ngexesha langempela kwikhowudi yomthombo, ukuxhomekeka, kunye CI/CD pipelines.
Olu yilo olusebenzayo lunceda amaqela agcine iindawo zawo zicocekile ngaphandle kokucothisa ukuhanjiswa.
Nantsi indlela iXygeni egcina ngayo eyakho pipelineikhuselekile:
- Uhlolo oluqhubekayo: Ilandelela amawaka eepakeji ezintsha yonke imihla kwaye ibonisa indlela yokuziphatha ekrokrisayo ngaphambi kokuba ifikelele kwimveliso.
- Inkqubo yesilumkiso kwangethuba: Ibonelela ngezilumkiso zakwangoko malunga ne-malware engenazo iintsuku ezipapashwe kwiirejista ezivulelekileyo, inika amaqela ixesha lokuphendula ngoko nangoko.
- Ukhuselo Oluzenzekelayo: Zivalela okanye zivale ukuxhomekeka okunobungozi ngokuzenzekelayo ukuthintela ungcoliseko lokwakheka.
- Ukufunyanwa kwe-Anomaly: Ijonga utshintsho olungalindelekanga lwefayile, izikripthi ezifihliweyo, okanye imizamo yokuphumeza imiyalelo ekude ngaphakathi kwemisebenzi yakho.
- Ukulandelela Udumo Lomdibanisi: Ijonga ubuwena bomgcini kunye neepatheni zokukhupha ukuze ibone iiakhawunti zomshicileli zobuxoki okanye ezibiweyo.
Kuba iXygeni idibana kakuhle namaqonga afana GitHub, GitLab, uJenkins, kunye Bitbucket, amaqela afumana ukhuseleko oluqhubekayo kwi-malware ngaphandle kokuseta okongezelelweyo okanye uqwalaselo oluntsonkothileyo.
Iphatha ngokuzolileyo ukubhaqwa nokuvinjwa ngasemva, ukuze abaphuhlisi bakwazi ukuhlala begxile ekubhaleni ikhowudi.
Ngale ndlela, iXygeni ayizisi nje kuphela ukhuselo lwexesha langempela kodwa ikwabonelela ngokhuseleko olungcono lwe-malware oluyilelwe indlela eyakhiwe ngayo isoftware yanamhlanje.
Indlela Abaphuhlisi Abazuza Ngayo Kukhuseleko Olusebenzayo
Kubaphuhlisi, umahluko ucacile. Izixhobo zemveli zihlala zicothisa ukwakhiwa okanye zigcwala dashboards ngezilumkiso zobuxoki. Nangona kunjalo, iXygeni kugcina izinto zilula kwaye inika iinkcukacha ezibaluleke kakhulu.
- Zimbalwa izilumkiso zobuxoki kunye neengxelo ezicocekileyo.
- Impendulo ekhawulezileyo ngaphakathi pull requests.
- Ukubonakala okuqhubekayo kuyo yonke ikhonkco lobonelelo lwesoftware.
- Ukhuseleko lwe-malware oluzenzekelayo ngaphandle kokuhlolwa ngesandla.
Ukongeza, olu hambo lomsebenzi lwakha ukuzithemba kuyo yonke into ekhutshwayo.
Abaphuhlisi bahlala begxile kwikhowudi, ngelixa amaqela okhuseleko efumana ukugubungela okupheleleyo kunye nengxolo encinci.
Iindlela ezilungileyo zokuqinisa ukhuseleko lwe-Malware
Kwanokhuselo lwe-malware olungcono lusebenza ngcono xa ludityaniswe neendlela eziqinileyo zeDevSecOps.
Umzekelo, la manyathelo angenza indawo ohlala kuyo ikhuseleke kwaye ithembeke ngakumbi:
- Gcina ukuxhomekeka kuhlaziyiwe kwaye kuqhotyoshelwe kwiinguqulelo ezithembekileyo.
- Skena zonke izinto zakudala kunye nezikhongozeli ngaphambi kokuba zisetyenziswe.
- Sebenzisa umgaqo welungelo elincinci kwishishini lakho CI/CD pipelines.
- ukusebenzisa SBOMs (Software Bill of Materials) ukuze kubonakale ngokupheleleyo.
- Watch commit imbali kunye nomsebenzi womshicileli ukuze kubekho utshintsho.
- Qeqesha amaqela ukuba aqaphele iingozi zekhonkco lokubonelela ngeenkonzo kwangethuba.
Okwangoku, ukudibanisa izixhobo ezifana neXygeni kunceda ukuguqula ezi ndlela zibalaseleyo zibe zezenzekelayo guardrails endaweni yemisebenzi yezandla.
Ngamafutshane, yenza lula ukhuseleko ngelixa iqinisa ukhuselo lwakho.
Iingcamango Zokugqibela: Ukwakha Uthotho Lokubonelela Ngesoftware Ekwaziyo Ukumelana Neengxaki ZeMalware
I-Malware iyaqhubeka nokutshintsha, ngoko ke, ukuzikhusela kwakho kufuneka kuguquke nako.
Ukukhusela ii-endpoints kuphela akusanele. Endaweni yoko, amaqela afuna ukhuseleko lwe-malware oluqala kwangethuba, ngaphakathi kwekhowudi, ukuxhomekeka, kunye pipelineapho isoftware iqala khona ngokwenene.
Ukugxila kukhuseleko kweli nqanaba kunika abaphuhlisi ukubonakala okungcono kunye nempendulo ekhawulezayo. Ngenxa yoko, iingozi ziyancipha ixesha elide ngaphambi kokuba zifikelele kwimveliso okanye kubasebenzisi.
Ngokudibanisa ukuskena ngexesha langempela, izilumkiso zangaphambi kwexesha, kunye nokuthintela ngokuzenzekelayo, i-Xygeni inika ukhuseleko oluqhubekayo kwi-malware ngaphandle kokucothisa uphuhliso.
Le ndlela yokuzikhusela igcina amaqela egxile ekwakheni ngelixa ehlala ekhuselekile kwiingozi ezifihlakeleyo kuyo yonke indawo yokugcina izinto kunye nokwakha. pipeline.
Ngamafutshane, ukhuselo olungcono lwe-malware lolo lusebenza ngaphambi kokuba uhlaselo luqale, lukunceda usuke ekukhuselekeni okusebenzayo uye kukhuseleko olusebenzayo kwaye ugcine uthotho lwakho lwesoftware luphambili.
Ngaba unemibuzo malunga nokhuseleko lwe-Azure?
