Njengoko unyaka ka-2023 usondela esiphelweni, imeko yokhuseleko lwe-intanethi igcwele iingxelo kunye nohlalutyo. Phakathi kwazo, Uhlolo loNyaka woKhuseleko lwe-Intanethi lwe-NSA ka-2023 ifumene ingqalelo. I-Xygeni, kulo nyaka unzima, ijolise ekuncedeni ekuqondeni nasekunciphiseni izoyikiso kwikhonkco lobonelelo lwesoftware. Kwixesha apho ubunzima besoftware bunzima kakhulu, ukuthembela kwethu kumacandelo e-open-source kunye nophuhliso lwe-DevSecOps kunye neendlela ze-cloud-native zifikelele kwinqanaba elitsha. Olu luhlu lujonge kwi Ingxelo kaXygeni inika ulwazi ngemingeni ephambili ejongene nayo software supply chain security ngo-2023 kwaye inika amaqhinga okuzilungisa ngo-2024.
Isiqulatho
IWebhu eNxaxheba ye Software Supply Chain Security
Kwimeko yangoku ye SSCS, izoyikiso ze-cyber zibonakala zinkulu, zibangela iinkxalabo ezinkulu kwiinkampani nakubantu ngabanye ngokufanayo. Ukwanda komsebenzi okwenziwa kude kunye nokuxhomekeka okwandileyo kwiinkonzo ezisekelwe kwilifu kuye kwandisa umphezulu wohlaselo, okwenza ukhuseleko lwekhonkco lobonelelo lwesoftware lube ngumceli mngeni onzima nangakumbi. Ukuqonda ukuba ikhonkco lobonelelo libe yi-vector yohlaselo ngabom kuyaqala kancinci ukuvela kushishino lwesoftware. Imibuzo iyavela: Siyikhusela njani le web intsonkothileyo? Ngaba singayithemba isoftware evela kuluntu oluvulelekileyo kunye nababoneleli bezorhwebo? Imibutho ingayikhuthaza njani ukuzithemba kubathengi bayo besoftware malunga nokungabikho kobuthathaka okanye i-malware?
Oko Kuza Kutyhilwa Yingxelo KaXygeni
Ingxelo kaXygeni ijolise ekukhanyiseni iziganeko kunye neendlela ezichazwe software supply chain security ngo-2023 kwaye inika umbono wokuqala wento enokuziswa ngu-2024. Ingxelo iza kugubungela oku kulandelayo:
Iimbalasane: “Ngokweenombolo”
Ibizwa ngokuba ngunyaka we 'imililo yehlathi yedijithali,' Unyaka ka-2023 ubone iziganeko ezibangel’ umdla, kuquka ezo zichaphazela iPyTorch, i-3CX, kunye neMOVEit Transfer. Inyani ebuhlungu kukuba I-82% yemibutho okwangoku zisengozini yokuhlaselwa luhlaselo lweenkqubo zobonelelo lwesoftware, apho inani eliqhelekileyo lezinto ezibuthathaka kwienkqubo zobonelelo linyuka ngaphezulu kwama-50% ngonyaka. I-NTT Ltd ibika ukuba icandelo letekhnoloji lelona shishini lijoliswe kakhulu, libanga ama-28% azo zonke iintlobo zohlaselo lweenkqubo zobonelelo.
Isoftware yomthombo ovulekileyo, equka 70% ukuya kwi-90% yee-stacks zezicelo zanamhlanje, ijongene nokwanda kweepakethi ezinobungozi kwiirejista zikarhulumente - iimeko ezimangalisayo ezingama-245,032, ziphinda kabini amanani kwiminyaka edlulileyo.
Indawo yoHlaselo
Ngowama-2023, uhlaselo lwe-intanethi belusanda, kunye I-Arhente ye-EU yoKhuseleko lwe-Intanethi ukurekhoda iziganeko zokhuseleko ezingama-2,580, ezingama-220 kuzo zijolise ngokukodwa kumazwe amaninzi angamalungu. Uhlaselo lweRansomware kunye nolwamkelo lwenkonzo lwalawula, kodwa uhlaselo olujoliswe kwikhonkco lobonelelo lwesoftware nalo lwabonwa. Okuphawulekayo kukuba, ii-chatbots ze-AI zingene kwimeko yomngcipheko wokhuseleko lwe-cybersecurity, zizisa inkxalabo malunga 'nobuxoki obungabizi kakhulu' kunye nolawulo lolwazi olusebenzisa i-AI.
Iindlela zoHlaselo ngo-2023
Abahlaseli baqhubekile nokusebenzisa iindlela eziqhelekileyo ezifana ne-spear phishing kunye nobunjineli bezentlalo, iziqinisekiso ezibiweyo, kunye nokuhlaselwa kokuxhomekeka njengeepakethe ze-typosquat. Nangona kunjalo, u-2023 ubone ukwanda kweendlela ezintsonkothileyo, kuquka vishing (I-Voice Phishing) kusetyenziswa imiyalezo yokulinganisa ilizwi eyenziwe yi-AI. Iiphakheji ezinobungozi ezisasazwe kwiindawo zobhaliso zikarhulumente zifikelele kwiimeko ezixhalabisayo ezingama-245,032, zigxininisa isidingo samanyathelo okuthintela aqinileyo.
Abadlali Abasongelayo Abaphambili
I-geopolitics yachaphazela imisebenzi ye-intanethi, apho ii-APT ezixhaswa ngurhulumente zibandakanyeka kulwazi olungeyonyani, ubuntlola, kunye nokutshabalalisa. Imfazwe yase-Ukraine yaba yindawo ephambili, ibonisa imisebenzi ye-intanethi ngabadlali baseRashiya, base-Iran, nabaseMntla Korea. I-China yaqinisa isikhundla sayo njenge-CyberPower yehlabathi, ngelixa ulwaphulo-mthetho lwe-intanethi luqhubeka lukhula, umzekelo we-Evasive Panda yaseTshayina ejolise kwi-NGO yamazwe ngamazwe.
Sijika ingqwalasela yethu kwiingxabano zakutshanje, ingxabano ye-intanethi phakathi kweHamas ne-Israel yayibandakanya uhlaselo lwe-DDoS oluphindaphindeneyo. Abanye abahlalutyi badibanisa iHamas nomsebenzi wosongelo wase-Iran. I-APT Agrius enxulumene ne-Iran, eyaziwa ngokuba yi-"Agonizing Serpens," edume ngokususa kwayo izinto ezitshabalalisayo, ibijolise kakhulu kwimibutho yakwaSirayeli kumacandelo namazwe ahlukeneyo. Ngo-2023, imizamo ka-Agrius yayigxile kumacandelo emfundo netekhnoloji kwaSirayeli.
Impembelelo yoHlaselo
Impembelelo yedijithali yokuhlaselwa kwe-intanethi, njengeenkqubo ezonakeleyo, ukonakala kwedatha, kunye nokungenelela, idlule impembelelo yezemali nezentlalo. Uphando lukaSplunk bagxininise ixesha elininzi kunye nezixhobo ezichithwe ekucoceni, apho kuphela i-4% yabaphenduli abathi akukho miphumo ibalulekileyo.
Isishwankathelo soHlaselo oluNxulumeneyo ngo-2023
Kulo nyaka kubekho uhlaselo oluhambelana ne-paradigmatic, oluquka i-PyTorch nightly InfoStealer, isiganeko se-CircleCI, uhlaselo lwe-3CX multi-step, ukwaphulwa kwedatha ye-MOVEit Transfer, ukumiswa kwexesha le-PyPI, i-NPM Manifest Confusion, uhlaselo lwe-JumpCloud, kunye nephulo le-VMConnect. Isiganeko ngasinye sigxininise indlela ezahlukeneyo nezitshintsha ngayo uhlaselo lwe-SSC.
Ukuzivelela kwe Standardkunye neMimiselo
Isakhelo solawulo se-SSC siyakhiwa. Ngenxa yobukhulu obahlukeneyo kwimimandla, kubonakala ngathi i-US inesakhelo esivuthiweyo, kunye ne-European Union isemva. Ukupapashwa kwe- Icebo leSizwe loKhuseleko lweIntanethi kwaye i Imephu yendlela yoKhuseleko lweSoftware evulekileyo yayizezona ziganeko ziphambili e-US. Kwi-EU uMthetho woBuchule bokuSebenza kwi-Cyber wafikelela kwisivumelwano sezopolitiko, kodwa uninzi lwemibutho lwasebenza kumyalelo we-NIS2 kunye noMthetho woBuchule bokuSebenza kwiDijithali (DORA).
Mhlawumbi isiganeko esibalulekileyo kwihlabathi liphela yayisisikhokhelo esidibeneyo Ukutshintsha ibhalansi yoMngcipheko woKhuseleko lweCyber: Imigaqo kunye neendlela zoKhuseleko lweSoftware yoYilo khokelwa ngu CISA kwaye ijoyinwe ziingcali ezininzi ze-cybersec kwihlabathi liphela.
Jonga ngo-2024
Le ngxelo inika ezinye izibikezelo: Ngowama-2025, ama-45% emibutho kwihlabathi liphela aya kuba namava ohlaselo olunye lwe-SSC. Siza kubona amaqela olwaphulo-mthetho ahleliweyo ebandakanyeka kulwaphulo-mthetho lwe-intanethi, esebenzisa izibonelelo ezivuthiweyo zolwaphulo-mthetho lwe-intanethi njengeNkonzo. Imigaqo eqala ukusebenza phakathi konyaka iya kuphucula ukucaca kweziganeko zokhuseleko, kunye neenkcukacha ezingaphezulu zohlaselo kunye nezifundo ezifunyenweyo ezityhiliweyo. I-inshurensi yomngcipheko we-intanethi iya kubonisa imida kunye nokugqithisileyo. Kwaye uphuhliso lwetekhnoloji luya kuhambelana ukhuseleko-ngoyilo umkhwa, kunye nomthwalo ongakumbi kwicala labavelisi besoftware.
Igagasi le-AI litsale abathengisi abaninzi bokhuseleko ngo-2023 ukuba bongeze "i-AI touch" kwiimveliso zabo. Nangona kunjalo, i-AI imiselwe ukudlala indima ebalulekileyo kwixesha elizayo le software supply chain security. I-AI iza kudlala indima engakumbi kwiindawo ezifana nobukrelekrele bezoyikiso kunye novavanyo lomngcipheko, ukuchongwa kwezinto ezingaqhelekanga kwiindawo zokugcina iikhowudi, uvavanyo lobuthathaka kunye nokubekwa phambili, kunye ubuqhetseba ukuhlasela ukubona, kodwa ikakhulu kulungiso olukrelekrele kunye nohlaziyo lwekhowudi oluzenzekelayo.
Kodwa abadlali abangalunganga baqale ukusebenzisa i-AI njengesixhobo, kwaye siza kubona iindlela ezintsha ezifana nokuhlola okuqhutywa yi-AI, umkhonto okholisayo kakhulu ubuqhetseba, izixhobo ze-AI zokuqhekeza i-jailbreaking, okanye iinkonzo ze-CAPTCHA solver.
isiphelo
Njengoko iXygeni ilungiselela ukutyhila ingxelo yayo epheleleyo ngemeko ye software supply chain security Ngowama-2023, imingeni kunye nezoyikiso ezijongene neli shishini ziyabonakala. Uthungelwano lobonelelo lwesoftware olwalukhe lwajongwa njengenkqubo engasemva kweqonga, luye lwavela njengeyona nto iphambili kubachasi be-intanethi. Impendulo yeli shishini kwezi mingeni iya kuyila indlela yokhuseleko lwesoftware kwiminyaka ezayo. Hlala ubukele ingxelo epheleleyo njengoko sijonga iinkcukacha kwaye sinikezela ngengqiqo enokunceda ukuhamba kwindawo enzima ye software supply chain security.
