Esinye isixhobo esibalulekileyo esifumana udumo ekuqiniseni ukhuseleko lwesoftware kukuba Ibhili yezinto zeSoftware okanye SBOM. Nakuba SBOMs bezisetyenziswa ixesha elide ngabaphuhlisi besoftware, ukubaluleka kwazo kuye kwanda ngokungathandabuzekiyo kutshanje, ingakumbi ngokukhutshwa kwe Umyalelo oLawulayo wokuphucula ukhuseleko lwe-intanethi lwesizwe. Kodwa yintoni na SBOM, kwaye kutheni ibaluleke kangaka kwicandelo lokhuseleko lwesoftware? Masityhile iimfihlakalo size sihlolisise ukubaluleka kwazo.
Isiqulatho
Yintoni i SBOM?
Uyazi ukuba yintoni i- SBOM"Njengoko iNTIA isitsho ngokucacileyo," i-An SBOM luluhlu lwezinto ezifakwe ngaphakathi, uluhlu lwezithako ezenza iinxalenye zesoftware. " Cinga ngayo njengoluhlu lwezithako zeresiphi. Njengokuba iresiphi idwelisa zonke izithako ezifunekayo ukwenza isidlo, SBOM ibala zonke izinto eziyinxalenye kunye nokuxhomekeka okwakha usetyenziso lwesoftware. Oku kuquka yonke into ukusuka kwiilayibrari ezivulelekileyo kunye nezinto eziyinxalenye yomntu wesithathu ukuya kwikhowudi kunye neelayisensi zobunini.
SBOM ukhuseleko lubonelela ngombono opheleleyo wezakhiwo zesoftware, ovumela imibutho ukuba iqonde kwaye ilawule iingozi zokhuseleko ezinokubakho ezinxulumene nenxalenye nganye. Oku kubonakala kunceda ekuvavanyeni ubuthathaka, ukulandelela uhlaziyo, kunye nokuchonga iindawo ezinokubakho zobuthathaka ngaphakathi kwekhonkco lobonelelo lwesoftware.
Iziganeko ezibalulekileyo Ukuqhuba SBOM Ukwamukelwa
Ukwamkela SBOM ukhuseleko luye lwafumana inkqubela enkulu kwiminyaka yakutshanje, luqhutywa ziziganeko ezibalulekileyo kunye nophuhliso:
- Umyalelo oLawulayo wokuphucula uKhuseleko lweIntanethi lweSizwe (EO 14028)NgoMeyi 2021, iNdlu eNkulu ikhuphe i-EO 14028, eyalela ukusetyenziswa SBOMs kwiinkqubo ezithile zesoftware ezibalulekileyo kurhulumente wobumbano kwaye ikhuthaza ukuba zisetyenziswe kumacandelo abucala.
- Iziko leSizwe le StandardUhlaziyo lweNkqubo yoKhuseleko lwe-Intanethi ye-S kunye neTekhnoloji (i-NIST)Ngowama-2022, i-NIST ihlaziye iNkqubo yayo yoKhuseleko lweCybersecurity ukuze ibandakanye njengolawulo oluphambili lokuphucula software supply chain security.
- Umbutho Wezizwe Ngezizwe we Standardukwenziwa (i-ISO) Standardukuhlaziywa: Ngo-2023, I-ISO ipapashe i-ISO/IEC 5280:2023 standard kuba SBOMs, ukunika a standardindlela ephucukileyo yokudala, ukulawula, kunye nokutshintshiselana ngedatha.
Loluphi ulwazi olufunekayo SBOM iqulethe?
SBOMIi-s zifumaneka kwiifomathi ezahlukeneyo, nganye ineengenelo kunye neengxaki zayo. I-SPDX kunye ne-CycloneDX zezinye zezona zisetyenziswa rhoqo SBOM iifomati.
Ngokwesiqhelo ibandakanya ezi zinto zilandelayo zibalulekileyo:
- Izixhobo zeSoftwareUluhlu oluneenkcukacha lwazo zonke izinto zesoftware ezisetyenzisiweyo kwimveliso, kuquka amathala eencwadi, iifreyimu, kunye neebinaries.
- Amanani eenguqulelo: Izihlonzi zenguqulelo ezithile zecandelo ngalinye lesoftware, nto leyo evumela ukulandelelwa kunye nokuchongwa kobuthathaka obunokubakho.
- UkuxhomekekaImephu yobudlelwane phakathi kwezinto zesoftware, ebonisa indlela ezisebenzisana ngayo nezixhomekeke ngayo enye kwenye.
- MetadataUlwazi olongezelelweyo olunxulumene nenxalenye nganye yesoftware, efana nelayisenisi, iinkcukacha zomthengisi, kunye nolwazi lwelungelo lokushicilela.
- Ukuba semngciphekweni koKhuselekoUkuba ikhona, ulwazi malunga nobuthathaka obaziwayo obunxulumene nezixhobo zesoftware.
Umzekelo weCycloneDX SBOM kwifomathi yeJSON
{ "bomFormat": "CycloneDX", "specVersion": "1.3", "serialNumber": "urn:uuid:6a77d60f-8711-4fb2-ba57-80a8a4a6d2a1", , "version": 1, "metadata": { "timestamp": "2023-10-30T12:30:00Z", "tools": [ { "vendor": "Xygeni.io", "name": "SBOM Generator", "version": "1.0" } ] }, "components": [ { "type": "library", "name": "nacl-library", "version": "1.0.0", "group": "com.example.security", "licenses": [ { "id": "Apache-2.0", "name": "Apache License 2.0", "url": "https://opensource.org/licenses/Apache-2.0" } ] }, { "type": "application", "name": "secure-app", "version": "2.5.1", "group": "com.example.apps", "licenses": [ { "id": "MIT", "name": "MIT License", "url": "https://opensource.org/licenses/MIT" } ], "components": [ { "type": "framework", "name": "Spring Boot", "version": "2.6.0", "licenses": [ { "id": "Apache-2.0", "name": "Apache License 2.0", "url": "https://opensource.org/licenses/Apache-2.0" } ] }, { "type": "library", "name": "log4j", "version": "2.14.1", "licenses": [ { "id": "Apache-2.0", "name": "Apache License 2.0", "url": "https://opensource.org/licenses/Apache-2.0" } ] } ] } ] } Ngoba SBOM Ukhuseleko lubalulekile kuKhuseleko lweSoftware
Ukuphuculwa kokuchongwa kunye nokulungiswa kobuNgcipheko
SBOMZidlala indima ebalulekileyo ekuchongeni nasekulungiseni ubuthathaka bokhuseleko kwizicelo zesoftware. Ngokubonelela ngoluhlu olupheleleyo lwazo zonke izixhobo zesoftware kunye nokuxhomekeka kwazo, zenza imibutho ikwazi:
- Landelela imvelaphi yezinto: SBOMs ityhila imvelaphi yeenxalenye zesoftware, ivumela imibutho ukuba ilandelele emva kwikhowudi yomthombo wokuqala okanye iphakheji ukuze kufunyanwe ukutyhilwa kobuthathaka kunye namaphetshi.
- Chonga ubuthathaka obaziwayo: SBOMIi-s zinokuskenwa kwiidathabheyisi zobuthathaka ukuze kufunyanwe ubuthathaka obaziwayo obunxulunyaniswa nezinto ezithile. Le ndlela yokuzikhusela inceda imibutho ukuba ibeke phambili ukusombulula ubuthathaka obubalulekileyo ngaphambi kokuba busetyenziswe ngabahlaseli.
- Yenza ukuskena kobuthathaka kube ngokuzenzekelayo: SBOMIi-s zingasetyenziselwa ukwenza iinkqubo zokuskena ubuthathaka zibe zezenzekelayo, zigcine ixesha kunye nomgudu kubaphuhlisi kunye namaqela okhuseleko. Olu zenzekelayo lunokuphucula kakhulu ukusebenza kakuhle kwemizamo yolawulo lobuthathaka.
Ukuthobela okuphuculweyo koKhuseleko Standards
Ukwamkela SBOM ukhuseleko luya lubaluleka ngakumbi kwimibutho ukuba ibonise ukuthobela ukhuseleko lwesoftware standardkunye nemigaqo. Imibutho emininzi yoshishino kunye neearhente zikarhulumente ziye zayalela ukusetyenziswa SBOMs, kuquka:
- ISebe lezoKhuselo laseMelika (iDoD): Igunyazisa ukusetyenziswa kwe SBOMs yazo zonke isoftware ezenzelwe okanye ezisetyenziswa yiDoD.
- I-Arhente yoKhuseleko lweSizwe (NSA): Icebisa ukusetyenziswa kwayo ukuphucula software supply chain security.
- Ulawulo lweSizwe loNxibelelwano noLwazi (NTIA)): Ikhuthaza uphuhliso kunye nokwamkelwa kwe SBOM standardkunye nezikhokelo.
- The OpenSSF Iqela elisebenzayo: Iphulo eliqhutywa luluntu elikhuthaza standardukwenziwa nokwamkelwa kwe SBOMs.
Ngokuthobela le miyalelo, imibutho ingabonisa commitbazimisele ukuxhasa ukhuseleko lwe-intanethi kwaye bazikhusele kwiintlawulo kunye nezohlwayo ezinokubakho.
Ukwandiswa kokuNgafihli kunye nokulandeleka
Zikhuthaza ukucaca nokulandeleka kuyo yonke ikhonkco lokubonelela ngesoftware. Ngokubonelela ngombono ocacileyo nopheleleyo wezinto zesoftware kunye nemvelaphi yazo, SBOMii-s zinokunceda uku:
- Chonga kwaye ukunciphisa uhlaselo lwekhonkco lokubonelela ngeenkonzo: SBOMIi-s zingasetyenziselwa ukuchonga ubuthathaka obunokubakho obuvezwa ngamacandelo okanye ababoneleli abachaphazelekileyo. Olu lwazi lungasetyenziselwa ukuthatha amanyathelo okulungisa ukukhusela ukuhlaselwa kwekhonkco lokubonelela.
- Ukuphucula intsebenziswano phakathi kwabachaphazelekayo: SBOMOku kunokunceda intsebenziswano phakathi kwabaphuhlisi, amaqela okhuseleko, kunye nabanye abachaphazelekayo kulo lonke uthotho lobonelelo lwesoftware. Oku kunokunceda ukuqinisekisa ukuba wonke umntu obandakanyekayo uyaqonda ngokucacileyo ukwakheka kwesoftware kunye nendlela emele ngayo ukhuseleko.
Impendulo Esebenzayo Yeziganeko
Zinokunceda ukunciphisa umngcipheko wempembelelo ekhokelela ekubuthathaka kokhuseleko ngokuthi:
- Ukuchonga kwangethuba kunye nokulungiswa: SBOMOku kuvumela imibutho ukuba ichonge kwaye ilungise ubuthathaka kwangethuba kwinkqubo yophuhliso ngaphambi kokuba ithunyelwe kwiindawo zemveliso. Oku kunokuthintela iimpembelelo ezisezantsi, ezinje ngokwaphulwa kwedatha kunye nokuphela kwayo.
- Ixesha elincitshisiweyo lokusombulula ingxaki: SBOMI-s ingakhawulezisa inkqubo yokulungisa iipatches ngokubonelela abaphuhlisi ngolwazi olucacileyo lwezinto ezichaphazelekayo kunye nokuxhomekeka kwazo. Oku kunokunciphisa ixesha elithathwayo ukuchonga nokusebenzisa iipatches, kunciphisa ithuba lokuba abahlaseli basebenzise ubuthathaka.
Iindlela ezisakhulayo kwi SBOM Ukwamkelwa koKhuseleko
Njengokwamkelwa kwe SBOMNjengoko iqhubeka ikhula, iindlela ezininzi ezintsha ziyayibumba imeko-bume:
- Standardukuhlanganiswa kunye nokusebenzisana: The standardUkwenziwa kweefomathi, ezifana neCycloneDX, kukhuthaza ukusebenzisana phakathi kwezixhobo ezahlukeneyo kunye namaqonga.
- Ukuhlanganiswa neDevOps kunye CI/CD Pipelines: SBOMs ziyadityaniswa kwiDevOps kwaye CI/CD pipelineukwenza, ukulawula, kunye nokusasazwa kwedatha ngokuzenzekelayo.
- Ngokusekwe kwilifu SBOM I zi mbululo: Lisekwe kwilifu SBOM izisombululo ziyavela, zibonelela imibutho ngeqonga elinokwandiswa nelikhuselekileyo lokulawula idatha yayo.
- Ukwanda kweNtsebenziswano kunye noKwakha uLuntu: The SBOM uluntu luyakhula, imibutho kunye nabantu ngabanye besebenzisana kwimizamo yokukhuthaza SBOM ukwamkelwa nokuphuhliswa kokhuseleko.
Ndiyifumana njani i SBOM & Ukuphucula ukhuseleko lweSoftware yam?
Ngoku ukuba uyazi ukuba yintoni i- SBOM uyaqonda ukuba ukuvelisa nokugcina SBOM ukhuseleko lunokuba ngumsebenzi onzima, ingakumbi kwimibutho enenkqubo enkulu neyinkimbinkimbi yokubonelela ngesoftware. Iqonga likaXygeni ingavelisa ngokuzenzekelayo SBOMs kwiindawo zokugcina isoftware yakho kwiifomathi zeSPDX kunye neCycloneDX ezisetyenziswa kakhulu. Ikwaqinisekisa ukuthotyelwa kwemithetho karhulumente wase-US kunye noshishino standards, njenge-Arhente yoKhuseleko lweCybersecurity kunye neZiseko zoPhuhliso (CISIimfuno ze-A).
Ukuguqula uKhuseleko lweSoftware kunye nokuqinisekisa uBulungisa beDijithali
SBOM ngamandla aguqula izinto kwihlabathi ledijithali, aguqula izinto software supply chain security kunye nokunika amandla imibutho ukuba ikwazi ukuhamba ngokuzithemba kwiindlela ezintsonkothileyo zeenkqubo zesoftware zanamhlanje. Ukukwazi kwabo ukuphucula ukungafihlisi, ukukhusela ingqibelelo, kunye nokulungelelanisa ukuthotyelwa kwemithetho kubenza babe sisixhobo esibalulekileyo kumaqela okhuseleko kwihlabathi liphela.
Ukwanga SBOM ukhuseleko lubalulekile kuyo nayiphi na intlangano ejonge ukuphucula iindlela zokhuseleko lwesoftware. Ukuqonda ukuba yintoni i- SBOM kuphucula ukubonakala kwekhonkco lokubonelela ngeenkonzo, kunceda amaqela okhuseleko ukuba alawule iingozi kwaye aqinisekise ukuthotyelwa kwemithetho ngokufanelekileyo.
As SBOM Njengoko ukwamkelwa kuqhubeka nokukhula, indima yayo ebalulekileyo ekukhuseleni iinkqubo zesoftware iya icaca ngakumbi. Imibutho eyamkelayo SBOMAbagcini nje ngokulawula ubuthathaka; batyala imali kwikamva lokhuseleko lwesoftware, beqinisekisa ukuthembeka okungagungqiyo kunye nokuqina kweziseko zabo zedijithali. SBOMIi-s azisisixhobo nje kuphela; ziyimfuneko ebalulekileyo kwimibutho efuna ukuphumelela kwihlabathi elinonxibelelwano oluphezulu, oluqhutywa yidatha.
