Intshayelelo: Ulawulo Lokungakwazi Ukuzikhusela Olusekelwe Kumngcipheko Phantsi KoMthetho Wokumelana Neengxaki Ze-Intanethi
Amaqela anamhlanje sele esazi ukuba ukulungisa zonke iingxaki akunakwenzeka. Okubaluleke kakhulu kukulungisa ezo zifanelekileyo. Yiyo loo nto amaqela anamhlanje esazi ukuba angakwazi ukulungisa zonke iingxaki. ulawulo lobuthathaka olusekelwe kumngcipheko iye yaba yindlela ekhethwayo kumaqela eDevSecOps. Nangona kunjalo, kwiManyano yaseYurophu, oku akuseyona ndlela ilungileyo nje. UMthetho wokuZinzisa kwiCyber yazisa iimbopheleleko zomthetho ezicacileyo, ingakumbi xa isoftware ibandakanya imiba edweliswe kwi CISIkhathalogu eyaziwayo yokuxhatshazwa.
Kule meko intsha, ukubekwa phambili kobuthathaka kuyatshintsha ukusuka ekukhetheni ukhuseleko ukuya kwimfuneko yokuthobela imithetho. Amaqela kufuneka abonakalise ukuba ayaqonda ukuba zeziphi iingxaki ezisetyenziswa ngokukhutheleyo kunye nendlela agqiba ngayo ukuba alungise ntoni kuqala.
Ulawulo Lokuchaphazeleka Okusekelwe Kumngcipheko kunye Nokuchaphazeleka Okuziwayo Okuxhaphakileyo
Ulawulo lobuthathaka olusekelwe kumngcipheko lugxila ekubonakalisweni kokwenyani endaweni yobunzima obungacwangciswanga. Endaweni yokuphatha zonke ii-CVE ngokulinganayo, amaqela abeka phambili ngokusekelwe ekuxhaphazweni, ekufikelelekeni, nakwimpembelelo.
Kulapho ubuthathaka obaziwayo obuxhaphaziweyo badlala indima ephambili. Xa kuvela i-CVE kwi CISIkhathalogu eyaziwayo yokuxhatshazwa, iqinisekisa ukuba abahlaseli sele beyisebenzisa kwiindawo zokwenyani. Loo mqondiso unzima kakhulu kunamanqaku ethiyori.
Ukuba ufuna ingcaciso enzulu malunga nokuba ziintoni ii-KEV kunye nendlela yokuzichonga, ungafunda iposi yethu yangaphambili. Ubungozi Obuxhaphakileyo Obuziwayo: Yintoni Omele Uyilungise KuqalaKule nqaku, sigxila kwindlela ii-KEV ezihambelana ngayo neemodeli zokuthobela imithetho kunye nokubeka phambili izinto phantsi UMthetho wokuZinzisa kwiCyber.
Oko Kufunwa Yi-Cyber Resilience Act
The UMthetho wokuZinzisa kwiCyber imisela uxanduva oluyimfuneko lokhuseleko lwe-intanethi kwiimveliso ezinee-elementi zedijithali ezithengiswa kwi-EU. Ngokweengxelo ezisemthethweni ze-EU:
- https://www.european-cyber-resilience-act.com/
- https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act
Abavelisi kufuneka:
- Chonga kwaye uphathe ubuthathaka kuyo yonke inkqubela phambili yemveliso
- Thintela isoftware yokuthumela nge ubuthathaka obaziwayo obuxhaphaziweyo
- Faka isicelo sokulungisa ngexesha elifanelekileyo xa sele kwaziwa ukuba kukho ukuxhaphazwa
- Gcina ubungqina bokuphathwa kobuthathakacision
Ngamanye amazwi, xa kuvela ubuthathaka kwi CISIkhathalogu eyaziwayo yokuxhatshazwa, ukungayinaki kudala umngcipheko wokhuseleko kunye nowolawulo.
Yintoni uMthetho woKunyamezela kwiCyber (CRA)
The UMthetho wokuZinzisa kwiCyber ngumgaqo we-EU ochaza iimfuno zokhuseleko lwe-intanethi ezinyanzelekileyo kwisoftware kunye neemveliso zedijithali ezithengiswa eYurophu. Ifuna abathengisi ukuba balawule ubuthathaka kulo lonke ixesha lobomi bemveliso kwaye baphephe ukukhupha isoftware ene ubuthathaka obaziwayo obuxhaphaziweyo.
Uluhlu lokujonga ukubekwa phambili kwe-CRA Ready Vulnerability
| Imfuneko | Oko i-CRA ikulindeleyo | Eyona ndlela ilungileyo yoQeqesho lwamaqela |
|---|---|---|
| Sebenzisa ulwazi | Thintela isoftware yokuthumela ngezixhobo ezinobungozi ezaziwayo ezisetyenziswa kakubi | Qondanisa ngokuzenzekelayo iziphumo kunye CISIkhathalogu eyaziwayo yokuxhatshazwa |
| Ukubeka phambili izinto ezisekelwe kumngcipheko | Gxila kubuthathaka obudala umngcipheko wokhuseleko lokwenyani | Hlanganisa ii-KEV, ii-EPSS, ukufikelela lula, kunye nokuvezwa kwempahla |
| Ukulungiswa ngexesha elifanelekileyo | Sebenzisa izilungiso ngaphandle kokulibaziseka ngokungafanelekanga xa sele kwaziwa ukuba kukho ukuxhaphazwa | Chaza ukulungiswa ngoku kwee-SLA zee-KEV ezifikelelekayo kwaye uzisebenzise CI/CD |
| Uvavanyo rhoqo | Ukusingatha ubuthathaka kulo lonke ixesha lomjikelo wobomi bemveliso | Sebenzisa iiskeni eziqhubekayo kwikhowudi, ukuxhomekeka, kunye pipelines |
| Ulawulo lokukhulula | Kuphephe ukukhupha iimveliso ezineziphene ezisetyenziswa kakubi | Ukudibanisa okanye ukusasazwa kwe-block xa ii-KEV zichaphazela ikhowudi efikelelekayo |
| Decisukulandeleka kwee-ion | Bonisa indlela ubuthathaka ngayocisii-ion zenziwe | Gcina iirekhodi zophicotho ukuze kufunyanwe, kubekwe phambili, kwaye kulungiswe izinto ezifunekayo |
| Ukuhlanganiswa kwabaphuhlisi | Amanyathelo okhuseleko akufuneki aphule iindlela zophuhliso | Ukubekwa phambili komphezulu ngqo kwi pull requests kunye ne-CI pipelines |
| Uxanduva lomjikelo wobomi | Gcina ukhuseleko emva kokukhululwa | Landelela utshintsho lwe-KEV kunye ne-EPSS kwiinguqulelo ezithunyelweyo |
Kutheni ii-KEV zibalulekile ekuthobeleni imithetho ye-CRA
The CISIkhathalogu eyaziwayo yokuxhatshazwa idwelisa ii-CVE ezisetyenziswa ngabahlaseli endle. Ngamanye amazwi, isusa ukungacaci kokujongwa kwezinto ezibalulekileyo.
Endaweni yokubuza ukuba “Ngaba oku kungasetyenziswa gwenxa?”, amaqela ngoku kufuneka abuze umbuzo othe ngqo ngakumbi:
"Ingaba oku sele kuxhaphazwa, kwaye ngaba siyakuthumela?"
Phantsi koMthetho woBuchule bokuHlala kwiCyber, loo mahluko ubalulekile ngokusemthethweni. Ngenxa yoko, ii-KEV ziba sisizathu esinamandla sokulungisa ii-SLA kunye nokuthintela ukukhululwa. Kule meko, ulawulo lobuthathaka olusekelwe kumngcipheko luhambelana ngokwemvelo nolindelo olusemthethweni.
IiCVSS, iiEPSS, kunye neeKEV zisebenza ngeenjongo ezahlukeneyo
Ukuze kubekwe phambili izinto ngokuchanekileyo, amaqela kufuneka aqonde kuqala ukuba isignali nganye imele ntoni ngokwenene.
- CVSS ibonisa impembelelo enokubakho
- EPSS uqikelela amathuba okuxhatshazwa
- CISIkhathalogu eyaziwayo yokuxhatshazwa iqinisekisa ukuba ukuxhaphaza sele kusenzeka
Xa ijongwa yodwa, i-metric nganye inokulahlekisa. Nangona kunjalo, xa amaqela ezisebenzisa kunye, afumana umxholo ocacileyo ngakumbi. Ngenxa yesi sizathu, ukudibanisa ezi mpawu kwakha isiseko solawulo olusebenzayo lobuthathaka olusekelwe kumngcipheko.
Ulawulo Lokungakwazi Ukuzikhusela Olusekelwe Kumngcipheko Ngokusebenzayo
Enyanisweni, imodeli yokubeka phambili izinto ezijolise kumngcipheko ilandela indlela ecacileyo nephindaphindwayo.
- Fumanisa ubuthathaka kuyo yonke ikhowudi kunye nokuxhomekeka
- Jonga umdlalo ngokuchasene CISIkhathalogu eyaziwayo yokuxhatshazwa
- Vavanya amathuba okuxhaphaza usebenzisa i-EPSS
- Qinisekisa ukuba isicelo sakho siyafikeleleka okanye pipeline
- Sebenzisa imithetho yokulungisa imeko ngokusekelwe ekuvezweni kwayo kunye nendima yemveliso
Ngenxa yoko, amaqela ayeka ukuphatha uluhlu lwabantu abasengozini njengokusilela okungaguqukiyo aze aqale ukuluphatha njengokhuseleko oluqinileyo.cision.
Iimodeli ezahlukeneyo zokubeka phambili ezisetyenziswa ngamaqela namhlanje
Ayizizo zonke amaqela ezibeka phambili umngcipheko ngendlela efanayo. Nje, sibona iimodeli ezintathu eziqhelekileyo kwiindawo zokwenyani.
1. Imodeli Yokuqala Yobunzima
Amaqela alungisa iingxaki ngokusekelwe kwi-CVSS kuphela.
Le modeli kulula ukuyisebenzisa. Nangona kunjalo, idala ingxolo kwaye ayihlangabezani nolindelo lweCyber Resilience Act.
2. Imodeli eqhutywa ngamathuba
Amaqela axhomekeke kwi-EPSS ukuqikelela ukuba ngabahlaseli banokusebenzisa ntoni emva koko.
Le ndlela iphucula ukugxila. Nangona kunjalo, isaphoswa bubuthathaka obusetyenziswa ngabahlaseli.
3. Imodeli Yokuqonda Ukuxhatshazwa
Amaqela adibanisa i-EPSS ne- CISIkhathalogu eyaziwayo yokuxhatshazwa kunye nomxholo wobugcisa.
Ngokwahlukileyo koko, le modeli ixhasa ngcono ulawulo lobuthathaka olusekelwe kumngcipheko kwaye ihambelana ngqo neembopheleleko ze-CRA.
Indlela iXygeni Esebenza Ngayo Ukubekwa Phambili kweCRA
I-Xygeni inceda amaqela ukuba aguqule umgaqo ube ngumsebenzi wemihla ngemihla.
Ngaphandle kwe ukuthembela kuphela kwi dashboards, iXygeni inyanzelisa i-decisii-ions kanye apho utshintsho lwekhowudi lwenzeka khona. Nje ngeziphumo, ukubekwa phambili kwezinto kuqala kuba yinto ezenzekelayo nehambelanayo.
Izakhono eziphambili ziquka:
- Ulwalamano oluzenzekelayo kunye CISIkhathalogu eyaziwayo yokuxhatshazwa
- Amanqaku okufumana amathuba okusebenzisa i-EPSS
- Uhlalutyo lokufikelela ukuze kuqinisekiswe ukubonakaliswa kokwenyani
- Guardrails ezi bloko ziyadibana okanye ziyakhululwa xa ii-KEV zichaphazela ikhowudi efikelelekayo
- Ukulungiswa ngokuzenzekelayo ngokusebenzisa i-secure pull requests
- Iingxelo ezipheleleyo zophicotho-zincwadi ziya kuboniswa UMthetho wokuZinzisa kwiCyber ukuthobela
Ngamafutshane, amaqela awaboni nje umngcipheko, kodwa asebenza kuwo ngendlela ephindaphindwayo nenokuphicothwa.
Umzekelo weDev ukuya kwiDev: I-KEV ivimba ukukhutshwa
Khawucinge ngohlaziyo lokuxhomekeka oluzisa i-CVE.
- Ubuthathaka bubonakala kwi CISIkhathalogu eyaziwayo yokuxhatshazwa
- I-Xygeni iyayibona ngexesha pull request
- Uhlalutyo lokufikelela luqinisekisa ukuba indlela yekhowudi iyaphunyezwa
- Guardrails vimba ukudibana ngokuzenzekelayo
- I-bot icebisa ukuphuculwa okukhuselekileyo kwaye iqhuba iimvavanyo
Umphuhlisi ulungisa ingxaki ngendlela efanayo. Ukukhutshwa kwayo kuhlala kuhambelana nemithetho. Akukho ntlanganiso zifunekayo.
Ngamanye amazwi, olu lulawulo lobuthathaka olusekelwe kumngcipheko olusetyenziswa kanye apho abaphuhlisi sele besebenza khona.
Kutheni Oku Kubalulekile Ngaphaya Kokuthobela Imithetho
Nangona UMthetho wokuZinzisa kwiCyber okubangele olu tshintsho, iingenelo ziya phambili.
Amaqela abeka phambili ukusebenzisa ii-KEV, ii-EPSS, kunye nomxholo:
- Nciphisa ukudinwa kwesilumkiso
- Nciphisa ixesha lokulungisa
- Ziphephe iipatches ezingxamisekileyo
- Thumela isoftware ekhuselekileyo ngokuzithemba
Lilonke, ukuthobela imithetho kuba sisiphumo sendalo sokwenza ukhuseleko ngendlela eyiyo.
Iingcinga Zokugqibela: I-CRA Yenza Ulawulo Olusekelwe Kumngcipheko Lube Yimfuneko
The UMthetho wokuZinzisa kwiCyber icacisa ngokusemthethweni oko amaqela okhuseleko asele ekufundile ngendlela enzima. Ayizizo zonke iingxaki ezibaluleka ngokulinganayo.
The CISIkhathalogu eyaziwayo yokuxhatshazwa ichaza oko kusetyenziswa ngabahlaseli namhlanje. I-EPSS iqikelela oko baza kukusebenzisa ngokulandelayo. Umxholo ubonisa ukuba iyakuchaphazela na.
Xa bebonke, bakha i-modern ulawulo lobuthathaka olusekelwe kumngcipheko.
I-Xygeni inceda amaqela ukuba asebenzise le modeli rhoqo, ngokuzenzekelayo, nangendlela abaphuhlisi abayamkelayo ngokwenene.
Malunga uMbhali
Ibhalwe ngu UFatima Said, Umphathi weNtengiso yoMxholo okhethekileyo kuKhuseleko lweZicelo e Ukhuseleko lweXygeni.
I-Fátima idala umxholo osekelwe kuphando olusebenziseka lula kubaphuhlisi kwi-AppSec, ASPMkunye neDevSecOps. Uguqulela iingcamango zobugcisa ezintsonkothileyo zibe ziingcamango ezicacileyo nezisebenzayo ezidibanisa uphuhliso lwe-cybersecurity kunye nefuthe leshishini.
