I-OWASP Top 10 yenye yezona zikhokelo zokhuseleko lwezicelo ezisetyenziswa kakhulu ekuchongeni nasekunciphiseni iingozi zokhuseleko lwezicelo zewebhu ezibalulekileyo. Esi sikhokelo sichaza iingozi ze-OWASP Top 10, imizekelo yehlabathi lokwenyani, iindlela ezilungileyo zokulungisa, kunye nendlela i-AppSec yanamhlanje kunye ne- software supply chain security izisombululo zinceda imibutho ukunciphisa umngcipheko kulo lonke SDLC.
Iprojekthi yoKhuseleko lweZicelo zeWebhu eziVulekileyo (i-OWASP)
Iprojekthi yoKhuseleko lwe-Open Web Application (OWASP) yintlangano engenzi nzuzo ehamba phambili ezinikele ekuphuculeni ukhuseleko lwesoftware. I-OWASP yaziwa ngokucaca kwayo kunye commitI-OWASP inika izisombululo eziqhutywa luluntu, nto leyo eye yenza ukuba ibe sisixhobo esisetyenziswa kakhulu ngabaphuhlisi, iingcali zokhuseleko, kunye nemibutho efuna ukwamkela iindlela zokhuseleko ezilungileyo. Phakathi kweminikelo yayo emininzi, enye yezona zibalulekileyo yi-OWASP Top 10, uluhlu oluhlaziywa rhoqo lweengozi zokhuseleko lwezicelo zewebhu ezichaphazela usetyenziso lwanamhlanje. Igxininisa ubuthathaka obukhulu kwizicelo zewebhu, ngokusekelwe kwidatha yehlabathi lokwenyani kunye nokuqonda kweengcali.
Injongo ye-OWASP kukwenza ukhuseleko lufikeleleke kwaye luqondakale, ukubonelela ngezixhobo, izakhelo, kunye nolwazi ukunceda ukukhusela usetyenziso ukususela ekuqaleni. I-OWASP Top 10 isebenza njengesakhelo esisebenzayo sokunceda abaphuhlisi bagxile kwiingxaki ezibaluleke kakhulu, ukuqinisekisa ukuba banokusebenzisa izisombululo ezifunekayo ngokufanelekileyo.
Ii-OWASP Top 10
I-OWASP Top 10 sisixhobo sokhuseleko olusisiseko lwezicelo kwimibutho ekhusela usetyenziso lwewebhu lwanamhlanje. Kuyo nayiphi na intlangano esebenza ukukhusela usetyenziso lwewebhu. Ichaza ezona ngozi zibalulekileyo zokhuseleko, inika ulwazi ngeendlela eziqhelekileyo ezichaphazeleka ngazo usetyenziso. Ubuthathaka be-OWASP Top 10 bugxininisa ezi ngozi ziphambili, bunika iingcebiso ezisebenzayo zokunciphisa ezo ngxaki. Ukujongana nobuthathaka ngqo kubalulekile ekuqiniseni ukhuseleko lwalo naliphi na usetyenziso.
Yintoni i-OWASP Top 10 kunye neendlela zayo zokulungisa?
I-OWASP Top 10 luxwebhu lokwazisa olwaziwayo kwihlabathi liphela olupapashwe yi-Open Web Application Security Project (OWASP). Luchonga iingozi zokhuseleko ezibalulekileyo ezichaphazela usetyenziso lwewebhu lwanamhlanje ngokusekelwe kwidatha yokuhlasela yehlabathi lokwenyani, uphando loluntu, kunye nohlalutyo lweshishini. Olu luhlu lunceda abaphuhlisi, amaqela e-AppSec, iinjineli ze-DevSecOps, kunye neenkokheli zokhuseleko ukuba zibeke phambili ubuthathaka obubeka umngcipheko omkhulu kwizicelo, ii-API, kunye neekhonkco zobonelelo lwesoftware.
I-OWASP Top 10 yangoku ibandakanya iindidi zokhuseleko ezifana ne-Broken Access Control, i-Injection, i-Security Misconfiguration, i-Vulnerable and Outdated Components, i-Software and Data Integrity Failures, kunye ne-Server-Side Request Forgery (SSRF). Ukuqonda ezi ngozi kunye nokusebenzisa amaqhinga okulungisa afanelekileyo kubalulekile ekwakheni usetyenziso olukhuselekileyo, ukunciphisa ukuvezwa kokhuseleko lwesoftware, kunye nokukhusela imibutho kwimingcipheko yanamhlanje ye-cyber.
Iindidi ezili-10 eziphezulu ze-OWASP
Iingxaki ezili-10 eziphezulu ze-OWASP ngokujonga nje
| Udidi lwe-OWASP | Umngcipheko wokuqala | Impembelelo eqhelekileyo |
|---|---|---|
| Ulawulo loFikelelo olwaphukileyo | Ufikelelo olungagunyaziswanga | Ukuvezwa kwedatha |
| Ukusilela kwe-Cryptographic | Uguqulelo oluntsonkothileyo olubuthathaka | Ukubiwa kwedatha okubuthathaka |
| Injection | Ukuphunyezwa kokufaka okungalunganga | Isivumelwano sedathabheyisi |
| Uyilo olungakhuselekanga | Ubuthathaka bezakhiwo | Ubuthathaka benkqubo yonke |
| Ukulungiswa kokungalunganga | Ukuseta ngokungafanelekanga | Ufikelelo olungagunyaziswanga |
| Amalungu asesichengeni | Ukuxhomekeka okuphelelwe lixesha | Isivumelwano sobonelelo ngeenkonzo |
| Iintsilelo zokuqinisekisa | Ulawulo lobunikazi olubuthathaka | Ukuthathwa kweakhawunti |
| Ukusilela koBulungisa beSoftware | Ukuphazamisa ulwakhiwo/ukuxhomekeka | Ukufakwa kweMalware |
| Ukusilela kokugcina nokubeka esweni | Ukubhaqwa kulibazisekile | Ixesha elide lokuhlala komhlaseli |
| SSRF | Ukusetyenziswa gwenxa kwesicelo sangaphakathi | Isivumelwano senkonzo yangaphakathi |
1. Ulawulo lokufikelela oluphukileyo (A01:2021)
Yintoni i-Broken Access Control?
Ulawulo Lokufikelela Oluphukileyo lwenzeka xa abasebenzisi befumana ukufikelela okungagunyaziswanga kwidatha okanye kwizenzo. Umzekelo, umhlaseli angasebenzisa i-URL ukuze afumane ukufikelela kumlawuli. I-OWASP ifumene le ngxaki kwi-94% yezicelo ezivavanyiweyo, nto leyo eyenza ukuba ibe yenye yezona ngxaki zokhuseleko zixhaphakileyo ze-OWASP Top 10.
Unyango loLawulo loFikelelo oluPhukileyo
Ukunciphisa lo mngcipheko, nyanzelisa ukufikelela okuncinci kwamalungelo, qalisa ukuqinisekiswa kwezinto ezininzi (i-MFA) kwimisebenzi ebucayi, kwaye uhlole rhoqo iimvume zomsebenzisi.
Ukhuseleko lweeMfihlo zikaXygeni Inceda ekukhuseleni ulwazi oluyimfihlo olufana nezitshixo ze-API kunye neethokheni, inciphisa umngcipheko wokwaphulwa kolawulo lokufikelela. Ukubeka iliso rhoqo kuqinisekisa ukuthembeka kwenkqubo yakho.
Umzekelo weRael-World
In 2019, I-First American Financial Corp ivezwe ngaphezulu Iirekhodi eziyimfihlo ezingama-850 ezigidi ngenxa yokulawulwa kokufikelela okungafanelekanga. Abahlaseli banokutshintsha nje i-URL ukuze bafikelele kumaxwebhu ayimfihlo. Ngokungahoyi ukukhusela iindawo zokufikelela ngokufanelekileyo, inkampani ishiye idatha eyimfihlo isengozini. Esi siganeko sigxininisa imfuneko yokuqinisekisa iindima zabasebenzisi kunye nokuqinisekisa ukuba ngabantu abagunyazisiweyo kuphela abanokufikelela kulwazi oluyimfihlo.
Kutheni kubalulekile namhlanje? Ii-aplikeshini zanamhlanje ziveza ii-API, iinkonzo zelifu, kunye neendima zabasebenzisi abasasazekileyo, okwenza ukufikelela okungagunyaziswanga kube yenye yezona ngozi zixhaphakileyo nezinobungozi zokhuseleko ezichaphazela idatha yeshishini eyimfihlo.
2. Ukusilela kwe-Cryptographic (A02:2021)
Zithini ii-Cryptographic Failures?
Ukusilela kwe-Cryptographic kwenzeka xa iinkqubo zingayifihli kakuhle idatha eyimfihlo, nto leyo evumela abahlaseli ukuba bayithintele baze bayisebenzise kakubi. Ukufihlwa okuqinileyo kubalulekile ekukhuseleni idatha eyimfihlo.
Iindlela zokulungisa ukungaphumeleli kwe-Cryptographic
Bhala idatha egciniweyo nge-AES-256 kwaye usebenzise i-TLS 1.2 okanye ngaphezulu kwidatha ehanjiswayo. Jikelezisa rhoqo amaqhosha okubethela kwaye uwakhusele ngolawulo olufanelekileyo lokufikelela.
Iziseko zophuhliso zeXygeni njengeKhowudi (IaCUkhuseleko ijonga useto lokubethela ngexesha lokusetyenziswa ukuze kuthintelwe ubuthathaka kwimigaqo-nkqubo yokubethela.
Umzekelo wehlabathi lokwenyani
In 2017, Exactis, inkampani yokuqokelela idatha, ityhile iirekhodi zabantu abazizigidi ezingama-340 ngenxa yokubethela ngendlela engafanelekanga. Abahlaseli bafikelele kulwazi lomntu siqu olufana namagama, iidilesi, kunye neenombolo zefowuni kuba idatha yayigcinwe kumbhalo ocacileyo. Olu lwaphulo-mthetho lubonisa iingozi zokungaphumeleli ukubethela idatha eyimfihlo. Ngokusebenzisa ukubethela ngendlela efanelekileyo standards ezifana ne-AES-256 yedatha ephumlileyo kunye ne-TLS yedatha ehanjiswayo, imibutho inokukhusela idatha yayo ekufikeleleni okungagunyaziswanga.
Kutheni kubalulekile namhlanje? Imibutho igcina kwaye idlulisela idatha yabathengi, yezemali, kunye neyokuqinisekisa ulwazi oluyimfihlo kwiindawo ezikude, nto leyo eyenza ukuba ukubethela okuqinileyo kubaluleke kakhulu ekukhuseleni ubumfihlo kunye nokuthobela imithetho.
3. Inaliti (A03:2021)
Zithini ii-Injection Attacks?
Ubuthathaka bokujova, njenge-SQL Injection, buvumela abahlaseli ukuba bafake ikhowudi enobungozi kwinkqubo yakho, nto leyo ebavumela ukuba balawule okanye babe idatha. Uhlaselo lokujova luhlala lungomnye wemingcipheko eqhelekileyo nenempembelelo kukhuseleko lwezicelo ezichaphazela usetyenziso lwewebhu lwanamhlanje.
Amayeza okulungisa Uhlaselo lwesitofu
Sebenzisa imibuzo esekwe kwiparameter kwaye uqinisekise igalelo labasebenzisi. Ziphephe imibuzo eguquguqukayo nanini na xa kunokwenzeka ukuze unciphise umngcipheko.
Ukufunyanwa kwe-Anomaly kaXygeni Ubeka esweni CI/CD pipelines yokuziphatha okungaqhelekanga, ukubamba imizamo yokujova ngexesha langempela.
Umzekelo wehlabathi lokwenyani
In 2017, Equifax wabandezeleka a ukophulwa kwedatha okukhulu eyatyhila ulwazi lomntu siqu Abathengi abazizigidi ezili-147. Ukwaphulwa kwemithetho kubangelwe yi Ubuthathaka bokufakwa kwe-SQL, okuvumela abahlaseli ukuba balawule iwebhusayithi yenkampani kwaye bafikelele kwidatha eyimfihlo egcinwe kwisiseko sedatha. Imibutho kufuneka iqinisekise ukuba iinkqubo zayo zicoca ngokufanelekileyo izinto ezifakwa ngabasebenzisi. Ukulungisa rhoqo kunye nokukhusela imibuzo ye-SQL bekunokuthintela obu buthathaka.
Kutheni kubalulekile namhlanje? Ubuthathaka bokujova buyaqhubeka nokuchaphazela usetyenziso lwewebhu, ii-API, kunye nemisebenzi yophuhliso encediswa yi-AI apho igalelo elingaqinisekiswanga lifikelela kubatoliki, kwiidathabheyisi, okanye kwiinkqubo zasemva.
4. Uyilo olungakhuselekanga (A04:2021)
Yintoni uYilo oluNgakhuselekanga?
Uyilo olungakhuselekanga lwenzeka xa abaphuhlisi bengaphumeleli ukudibanisa ukhuseleko kwisigaba sokuqala soyilo, nto leyo edala ubuthathaka okunzima ukululungisa kamva. Obu buthathaka kunzima ukululungisa xa usetyenziso lufikelela kwiindawo zemveliso.
Amayeza okulungisa Uyilo olungakhuselekanga
Faka imigaqo yoyilo ekhuselekileyo kunye nomzekelo wengozi kwasekuqaleni komjikelo wophuhliso. Hlola rhoqo uyilo lwakho ukuze ubone ubuthathaka obunokubakho kwaye ubulungise ngaphambi kokuba bube yingxaki ebalulekileyo.
IXygeni's Application Security Posture Management (ASPM) ichonga iziphene ezinokubakho kuyilo ngaphambi kokuba abahlaseli bazisebenzise kakubi, iqinisekisa ukuba abaphuhlisi bafaka ukhuseleko kwimveliso yabo kwasekuqaleni.
Umzekelo wehlabathi lokwenyani
Umzekelo wamva nje wokwenyani Uyilo olungakhuselekanga Ingaba i Ubuthathaka beMicrosoft Exchange ProxyShell ngo-2021Abahlaseli basebenzise iimpazamo zoyilo kwiinkqubo zokuqinisekisa nokufikelela zeMicrosoft Exchange, nto leyo ebavumela ukuba basebenzise ikhowudi kude kwiiseva ezibuthathaka. Ezi ngxaki zazingezizo iimpazamo zokuphunyezwa, kodwa yayiziziphene zoyilo ezisisiseko ezenza ukuba ukusetyenziswa kube nokwenzeka nasemva kokuba iipatches zisetyenziswe gwenxa. Oku kwaphulwa kugxininisa ukubaluleka kokudibanisa ukhuseleko kwinqanaba loyilo ukuthintela ukungabikho kobuthathaka kwinkqubo.
Kutheni kubalulekile namhlanje? Ubuthathaka bokhuseleko obuvezwe ngexesha lesigaba soyilo kunzima kwaye kuyabiza ukululungisa kamva, ingakumbi kwiindawo zophuhliso ezihlala kwilifu nezitshintsha ngokukhawuleza.
5. Ulungelelwaniso olungalunganga loKhuseleko (A05:2021)
Yintoni i-Security Misconfiguration?
Ukhuseleko Ulungelelwaniso olungalunganga lwenzeka xa abahlaseli besebenzisa iinkqubo ezingacwangciswanga kakuhle, njengalezo zisebenzisa useto olumiselweyo okanye zishiya amazibuko angafunekiyo evulekile. Ulungelelwaniso olungalunganga luhlala lungomnye wezizathu eziphambili zezehlo zokhuseleko lwelifu kunye nezicelo.
Amayeza okulungisa Ukulungiswa kokungalunganga
Zenzekela iitshekhi zoqwalaselo usebenzisa Iziseko zophuhliso njengeKhowudi (IaC) kwaye wenze uhlolo lokhuseleko rhoqo. Gcina zonke iinkqubo zihlaziywa ngeepatches zamva nje.
IXygeni's IaC Security Iskena uqwalaselo olungalunganga ngaphambi kokuba isetyenziswe kwaye inyanzelisa imigaqo-nkqubo yokhuseleko rhoqo kuzo zonke iindawo.
Umzekelo wehlabathi lokwenyani
In 2018, NASA ndafumana ukwaphulwa kwemigaqo ngenxa yokuba imimiselo engafanelekanga in I-Atlassian JIRA iveze idatha eyimfihlo yeprojekthi kunye neyabasebenzi. Abahlaseli bafikelele kulwazi ngenxa yoqwalaselo oluvulekileyo. Ukuhlolwa kokhuseleko okuzenzakalelayo kunye nokunyanzeliswa kwemigaqo-nkqubo yoqwalaselo olufanelekileyo bekunokuthintela oku kwaphulwa. Ukuhlolwa rhoqo bekuya kubona ubuthathaka ngaphambi kokuba abahlaseli balusebenzise kakubi.
Kutheni kubalulekile namhlanje? Iinkonzo zelifu ezingacwangciswanga kakuhle, CI/CD pipelineiikhonteyina, kunye neendlela zokulawula eziveziweyo zihlala zizezona zizathu ziphambili zokwaphulwa kokhuseleko lwanamhlanje.
6. Izinto Ezisesichengeni Neziphelelwe Yixesha (A06:2021)
Zithini Izinto Ezisesichengeni Neziphelelwe Yixesha?
Izinto ezisengozini neziphelelwe lixesha zenzeka xa usebenzisa iilayibrari okanye iifreyimu zomntu wesithathu ezineziphene zokhuseleko ezaziwayo. Abahlaseli banokusebenzisa ezi ngxaki ukuze babeke esichengeni usetyenziso lwakho. Olu lusongelo oluyingozi kakhulu, njengoko ukuya kuthi ga kwi-60% yezicelo zanamhlanje zakhiwe ngezinto zomntu wesithathu.
Amayeza okulungisa Izinto Ezisengozini Neziphelelwe Yixesha
Hlaziya rhoqo iilayibrari kunye nokuxhomekeka komntu wesithathu, kwaye usebenzise uHlalutyo lweSoftware Composition (SCA) izixhobo zokufumanisa nokulungisa ubuthathaka.
IXygeni's Open Source Security Iskena izinto ozixhomekeke kuzo ukuze ithintele ukusebenzisa izinto ezindala okanye ezinobungozi, ikunceda ugcine usetyenziso olukhuselekileyo.
Umzekelo wehlabathi lokwenyani
In 2017, I-Apache Struts yayinobuthathaka obungacwangciswanga obakhokelela ekubeni Ukophulwa kwe-Equifax, ichaphazela izigidi zabasebenzisi. Ubuthathaka babukwi Ii-Apache Struts 2, isakhelo esisetyenziswa kakhulu, kwaye i-Equifax yasilela ukusebenzisa i-patch ngexesha. Oku kushiye iinkqubo zabo zisengozini yokusetyenziswa. Uhlaziyo olufike ngexesha kunye nokuskena rhoqo kobuthathaka bekuya kuthintela oku kwaphulwa.
Kutheni kubalulekile namhlanje? Ii-aplikeshini zanamhlanje zixhomekeke kakhulu kwiipakeji ze-open source kunye neelayibrari zabanye abantu, nto leyo eyenza ukuhlaselwa kweenkqubo zokubonelela ngesoftware kunye nokuxhomekeka okubuthathaka kube yingxaki ekhulayo ye-AppSec.
7. Ukusilela koQinisekiso (A07:2021)
Zithini iiSiphene zokuChonga kunye nokuQinisekisa?
Ezi ngxaki zenzeka xa iindlela zokuqinisekisa zibuthathaka okanye zingasetyenziswanga kakuhle, nto leyo evumela abahlaseli ukuba badlule kulawulo lokhuseleko.
Amayeza okulungisa Ukusilela kokuchonga kunye nokuqinisekiswa
Sebenzisa imigaqo-nkqubo eqinileyo yephasiwedi, sebenzisa ukuqinisekiswa kwezinto ezininzi (i-MFA), kunye neengxelo zokuqinisekiswa kokuhlolwa ukuze uthintele ukufikelela okungagunyaziswanga.
Ukhuseleko lweemfihlo zeXygeni lunceda ekukhuseleni iziqinisekiso zakho, lunciphisa umngcipheko wokuvuza ngexesha lenkqubo yokuqinisekisa.
Umzekelo wehlabathi lokwenyani
In 2020, i Ikhamera yokhuseleko yeringi Ukwaphulwa kwamalungelo okugqitha kubangelwe ziiphasiwedi ezibuthathaka. Abahlaseli basebenzise iiphasiwedi ezilula baza bafumana ukufikelela kwiividiyo ezibukhoma ezivela amawaka eekhamera zabasebenzisiOku kwaphulwa komthetho kubonisa imfuneko ebalulekileyo yeendlela zokuqinisekisa eziqinileyo. Ke ngoko, ukuphumeza uqinisekiso lwezinto ezininzi (MFA) kunye nokunyanzelisa imigaqo-nkqubo eyomeleleyo yokugqitha ngebengayi kuthintela ngokulula ukufikelela okungagunyaziswanga.
Kutheni kubalulekile namhlanje? Iindlela zokuqinisekisa ezibuthathaka ziyaqhubeka nokwenza kube lula ukuthathwa kweeakhawunti, ukuhlaselwa kokufakwa kweziqinisekiso, kunye nokufikelela okungagunyaziswanga kwi-SaaS, kwi-cloud, nakwi-intanethi. enterprise zicelo.
8. Ukusilela kweSoftware kunye noBulungisa beDatha (A08:2021)
Zithini iiNtlekele zeSoftware kunye neData?
Ezi ngxaki zenzeka xa ikhowudi okanye iziseko zingakhuseli ekuphazamisekeni. Abahlaseli banokubeka emngciphekweni ulwakhiwo pipelines, ukuxhomekeka, okanye iinkqubo zokusasazwa, ukufaka ikhowudi enobungozi kuhlaziyo oluthembekileyo. Olu hlobo lwesiphene lube yingxaki enkulu ngenxa yokwanda kohlaselo lwe-supply chain, apho kwanezixhobo ezithembekileyo zomntu wesithathu zijoliswe ekungeneni kwiinethiwekhi.
Amayeza okulungisa Ukusilela koBulungisa beSoftware kunye neDatha
Ukuze unciphise oku, sebenzisa ukutyikitya ikhowudi, sebenzisa iinkqubo zokwakha ezikhuselekileyo, kwaye uqinisekise ukuthembeka kwazo zonke izinto zomntu wesithathu.
IXygeni's CI/CD ukhuseleko iqinisekisa ukuba eyakho pipelinezikhuselekile kwaye zijongiwe ukuba azikho izinto ezingaqhelekanga. I-Xygeni's Anomaly Detection inokuchonga imisebenzi ekrokrisayo enokubonisa ukuphazamiseka.
Umzekelo wehlabathi lokwenyani
In 2024, kujoliswe kuhlaselo olukhulu lwe-supply chain Izixhobo ze-XZ, ilayibrari yokucinezela esetyenziswa kakhulu kwiinkqubo zeLinux. I-XZ Utils sisixhobo esibalulekileyo esisetyenziselwa ukucinezela iifayile, esithembeke ngamawaka emibutho. Nangona kunjalo, abahlaseli baphumelele ekuphazamiseni inkqubo yokwakha yeprojekthi ngokufaka umnyango ongasemva kwikhowudi.
Abahlaseli abazange baqapheleke okwethutyana, nto leyo ethetha ukuba iinkqubo ezixhomekeke kwithala leencwadi elichaphazelekileyo zazisengozini yokusetyenziswa kwekhowudi ekude kunye nokusetyenziswa kakubi ngakumbi. Ngenxa yoko, aba bahlaseli bafumana ulawulo kwiinkqubo ezichaphazelekileyo, nto leyo eyakhokelela ekwaphulweni kwedatha nasekuthintelweni kolwazi oluyimfihlo.
Esi siganeko sisebenza njengesikhumbuzo esicacileyo seengozi ezibangelwa yi uhlaselo lwekhonkco lokubonelela. Kwanethala leencwadi elithembekileyo kakhulu linokusetyenziswa ukuze lichaphazele iinkqubo ezininzi. Ngokuqinisekisa iinkqubo zokwakha ezikhuselekileyo, kusetyenziswa iindlela zokutyikitya ikhowudi, kunye nokubeka esweni rhoqo izinto zangaphandle, imibutho inokuthintela ubuthathaka obunjalo ekungeneni kwiinkqubo zayo.
Kutheni kubalulekile namhlanje? Uhlaselo lwenkqubo yokubonelela ngesoftware lujolise ekwakheni pipelines, iirejista zeepakeji, ukuxhomekeka, kunye CI/CD iinkqubo ziye zaba yingozi enkulu kuphuhliso lwesoftware yanamhlanje.
9. Ukusilela koGcino loKhuseleko kunye nokuBeka esweni (A09:2021)
Zithini iintsilelo zokuGcina nokubeka esweni uKhuseleko?
Ezi ntsilelo zenzeka xa usetyenziso lungabhalisi kakuhle imicimbi yokhuseleko okanye lungenazo iindlela zokubeka esweni. Ngaphandle kweengxelo ezineenkcukacha, ukufumana nokuphendula kuhlaselo kuba nzima. Ezi ntsilelo zihlala zilibazisa ukufunyanwa kokwaphulwa kwemigaqo, nto leyo evumela abahlaseli ukuba basebenzise iinkqubo ixesha elide.
Amayeza okulungisa Ukusilela kokugcina nokubeka esweni ukhuseleko
Vumela ukugcinwa kweenkcukacha ezipheleleyo kuzo zonke izenzo ezibalulekileyo, gcina ii-log ngokukhuselekileyo, kwaye uqinisekise ukuba zijongwa kwimisebenzi ekrokrisayo. Ngaphezu koko, sebenzisa izixhobo ezizenzekelayo ukukwazisa ngeengozi ezinokubakho.
Ukufunyanwa kwe-Anomaly kaXygeni inceda ekuchongeni imisebenzi engaqhelekanga ngexesha langempela. Ukongeza, CI/CD Ukhuseleko luqinisekisa ukuba ukugawulwa kweenkcukacha kunye nokubekwa esweni kweenkcukacha kusetyenziswa rhoqo kuzo zonke iindawo.
Umzekelo wehlabathi lokwenyani
In 2023, Uber ndifumene ukwaphulwa kwedatha yenze ingozi kulwazi lomntu lwamawaka abaqhubiUkwaphulwa komthetho kwenzeke xa inkampani yabameli beqela lesithathu, UGenova Burns, ifumene isiganeko sokhuseleko, yatyhila idatha. Nangona izilumkiso ziqalisiwe, iinkqubo zokubeka esweni ze-Uber azikwazanga ukubona nokuphendula ngokukhawuleza kuhlaselo.
Abahlaseli bafumana ukufikelela kulwazi oluyimfihlo, kuquka amagama, iinombolo zefowuni, kunye neerekhodi zokuqhuba. Oku kulibaziseka kwakubangelwa kukunqongophala kolwazi olupheleleyo kunye neenkqubo zokubeka esweni ezingaphelelanga.
Ukuba i-Uber yayijonge ngokufanelekileyo ukufikelela kwiinkqubo zayo kwaye isebenzise iindlela ezingcono zokurekhoda, ngebabeyibonile loo nto iphosakeleyo kwangethuba. Ngenxa yoko, inkampani ngeyayinciphise umonakalo obangelwe ludumo kunye nokulahlekelwa yimali. Oku kuphula umthetho kugxininisa ukubaluleka kokugcina iinkqubo zokurekhoda ezisebenzayo kunye nokubeka esweni ukuze kufunyanwe kwaye kuncitshiswe izoyikiso kwangethuba.
Kutheni kubalulekile namhlanje? Ngaphandle kokubonakala nokugadwa ngokufanelekileyo, imibutho iyasokola ukubona uhlaselo kwangethuba, nto leyo evumela abahlaseli ukuba bahlale bengabonwa ixesha elide.
10. Isicelo sobuxoki esikwicala leseva (SSRF) (A10:2021)
Yintoni iServer-Side Request Forgery?
I-SSRF yenzeka xa abahlaseli bekhohlisa iseva ukuba yenze izicelo kwiindawo ezingafunekiyo, bedla ngokufikelela kwiinkonzo zangaphakathi ekufuneka zithintelwe. Olu buthathaka luvumela abahlaseli ukuba bafikelele kwidatha eyimfihlo okanye baphumeze imiyalelo kwiinkqubo zangaphakathi.
Unyango lwe-SSRF
Ukuze uthintele i-SSRF, qinisekisa zonke iingeniso zomsebenzisi kwaye uthintele amandla eseva okwenza izicelo eziphumayo. Ukongeza, sebenzisa uluhlu lwabavunyelweyo ukulawula ukuba zeziphi ii-URL iseva enokufikelela kuzo.
IXygeni's CI/CD Ukhuseleko lunceda ekujongeni pipelines malunga nobuthathaka obunokubakho be-SSRF. Ngaphezu koko, i-Xygeni's Anomaly Detection inokubamba iipateni zesicelo ezingalindelekanga okanye ezikrokrisayo.
Umzekelo wehlabathi lokwenyani
In 2022, ubuthathaka obukhulu kwi I-Microsoft Exchange (CVE-2022-41040) yasetyenziswa ngabahlaseli besebenzisa iindlela ze-SSRF. Abahlaseli bakwazile ukuthumela izicelo ezinobuthi kwiseva ye-Exchange, bedlula ukhuseleko lwangaphakathi.
Bakuba bengaphakathi, abahlaseli bafikelela kwiinkqubo zangaphakathi baze bafaka idatha eyimfihlo engozini. Ngokusebenzisa i-SSRF, bafumana ukufikelela okungagunyaziswanga kwizixhobo zangaphakathi ezithintelweyo, nto leyo ekhokelele ekwaphulweni okukhulu kokhuseleko.
Ubuthathaka be-SSRF buyingozi kakhulu kuba bunika abahlaseli ukufikelela kwiinkqubo zangaphakathi ezingafanele zibonakaliswe kuluntu. Ukuba iMicrosoft isebenzise ukuqinisekiswa okungqongqo kokufaka kunye nemiqathango yesicelo esiphumayo, ngebabeyithintele imizamo yabahlaseli yokusebenzisa obu buthathaka. Oku kwaphulwa komthetho kubonisa ukubaluleka kokulawula izicelo zeseva kwizixhobo zangaphakathi ezibuthathaka kunye nokuqinisekisa ukuba yimithombo ethembekileyo neqinisekisiweyo kuphela enokunxibelelana nayo.
Kutheni kubalulekile namhlanje? Uyilo lwendalo oluvela kwilifu kunye nee-API zangaphakathi zonyuse impembelelo yobuthathaka be-SSRF, obusetyenziswa ngabahlaseli ukufikelela kwiinkonzo zangaphakathi ezibuthathaka kunye neenkqubo ze-metadata.
Kutheni i-OWASP Top 10 isabalulekile
The Iingxaki ezili-10 eziphezulu ze-OWASP zibalulekile kwimibutho ejonge ukukhusela usetyenziso lwayo kwiingozi eziqhelekileyo neziyingozi. Ezi ngozi aziyonto ithethwayo; zimele iingozi zokwenyani ezinokukhokelela ekwaphulweni kwedatha, ekulahlekelweni yimali, nasekonakaleni kodumo. Ngokujongana nale mingcipheko ngokukhawuleza, imibutho inokunciphisa kakhulu umngcipheko wokuhlaselwa ngempumelelo kwaye iqinisekise ukuba iinkqubo zayo ziyakwazi ukumelana neengozi ezitshintshayo.
Ngaphezu koko, ukusebenzisa iindlela ezicetyiswayo kuluhlu lwe-OWASP Top 10 buthathaka kunceda imibutho ukuba ithathe indlela enobuchule yokhuseleko. Umzekelo, ukuqinisa ulawulo lokufikelela, ukukhusela iindlela zokubethela, kunye nokunciphisa iingozi zekhonkco lokubonelela ngeenkonzo zonke zidlala indima ebalulekileyo ekusombululeni ezi buthathaka. Ngenxa yoko, imibutho inciphisa umphezulu wohlaselo, okwenza kube nzima ngakumbi kubahlaseli ukusebenzisa ubuthathaka kwinkqubo.
Njengoko izisongelo ze-intanethi zisanda, kubalulekile ukuba imibutho ihlale iphambili kwiingxaki ezinokubakho. Ngokuthatha inyathelo kwangethuba, imibutho iqinisekisa ukhuseleko lwexesha elide lwezicelo zayo kwaye igcina ukuthembana kwabasebenzisi bayo.
Ngaphaya kobuthathaka bendabuko be-OWASP Top 10, imibutho ijongene ngakumbi neepakeji zemithombo evulekileyo enobuqhetseba, ukuhlaselwa kokudideka kokuxhomekeka, iiphulo zokubhala amagama, ikhowudi eveliswe yi-AI engakhuselekanga, CI/CD pipeline ulwalamano, ukutyhilwa kwiimfihlo, kunye ne-malware yenkqubo yokubonelela ngesoftware.
Iinkqubo ze-AppSec zanamhlanje ziya zidibanisa ulwalathiso lwe-OWASP kunye software supply chain security, ukhuseleko lwe-AI, kunye nohlalutyo lomngcipheko wexesha lokusebenza ukujongana nemiphezulu yohlaselo eguqukayo.
Indlela iXygeni exhasa ngayo amanyathelo e-OWASP kunye ne-OWASP SAMM
Ithetha ne Iingxaki ezili-10 eziphezulu ze-OWASP Kubalulekile ukukhusela usetyenziso lwewebhu. kunjalo, ukukhusela isicelo sakho akupheleli apho. Imodeli yoBuchule boQinisekiso lweSoftware ye-OWASP (i-SAMM) ibonelela ngesakhelo sokuvavanya nokuphucula ukukhula kokhuseleko lwakho kulo lonke ixesha lophuhliso lwesoftware (SDLC). Ngokudibanisa Izixhobo zokhuseleko ezipheleleyo zeXygeni, imibutho ayinakukwazi nje ukunciphisa I-OWASP Iingxaki zokhuseleko ezili-10 eziphezulu kodwa ikwaphucula nokuvuthwa kwazo ngokupheleleyo kokhuseleko, njengoko kuchaziwe yi-OWASP SAMM.
Ukuqinisa uKhuseleko lweSicelo ngeXygeni
I-Xygeni inika amandla imibutho ukuba ijongane uluhlu lwezona ngxaki ziphezulu ezili-10 ze-OWASP ngelixa kukhawuleziswa ukwamkelwa kwe-OWASP SAMM, kunceda imibutho ukuba iphucule ngokuqhubekayo ukuvuthwa kokhuseleko lwesoftware. Ngokuzenzekela ulawulo lokhuseleko, ukuvumela ukubeka phambili umngcipheko, kunye nokuqinisa ulawulo lweziganeko, i-Xygeni inceda imibutho ukuba yakhe isoftware ekhuselekileyo neyomeleleyo, inciphisa ngempumelelo umngcipheko wokwaphulwa kokhuseleko.
Ngokubeka esweni ngexesha langempela, ukufunyanwa kobuthathaka ngokuzenzekelayo, kunye nokunyanzeliswa kwemigaqo-nkqubo kulo lonke SDLC, I-Xygeni yenza lula imizamo yokhuseleko kunye nokuthobela imithetho, ihambelana neendlela ezilungileyo ze-OWASP SAMM. Oku kwenza imibutho ikwazi ukukhulisa ukukhula kwayo kokhuseleko ngokuthe ngcembe, kunye nemephu ecacileyo yokuphucula okuqhubekayo.
Thatha Inyathelo Ngoku Ukukhusela Izicelo Zakho
The Iingxaki ezili-10 eziphezulu ze-OWASP bonisa ezona ngozi zinzima zokhuseleko ezijongene nezicelo zanamhlanje. Ngokulandela le Izikhokelo ze-OWASP kunye nokusebenzisa iindlela ezilungileyo ezichazwe apha, ungenza khusela umbutho wakho kwezi zisongelo kwaye wakhe usetyenziso olumelana nohlaselo oluntsonkothileyo.
Qinisa uKhuseleko lweSicelo sakho kunye Software Supply Chain Security.
Izicelo zanamhlanje zifuna okungaphezulu kokuskena ubuthathaka bemveli. I-Xygeni inceda imibutho ichonge, ibeke phambili, kwaye ilungise iingozi ezili-10 eziphezulu ze-OWASP kwikhowudi yomthombo, ukuxhomekeka komthombo ovulekileyo, CI/CD pipelines, iziseko zophuhliso zelifu, kunye neendlela zokusebenza zophuhliso ezincediswa yi-AI.
Fumanisa indlela iXygeni enceda ngayo amaqela e-AppSec kunye ne-DevSecOps ukunciphisa umngcipheko kuzo zonke iinkqubo zanamhlanje SDLC!
