Njengoba amabhizinisi ethembela kakhulu kusofthiwe ukuze asebenze, ukuphepha kochungechunge lokuhlinzekwa kwesofthiwe kuba yinto ebaluleke kakhulu. Uchungechunge lokuhlinzekwa kwesofthiwe luyinqubo yokudala nokuletha isofthiwe, kusukela ekuthuthukisweni kuya ekusetshenzisweni. Isofthiwe engavikelekile ingaholela ekuphulweni kwedatha okukhulu, ukulahlekelwa yizimali, kanye nomonakalo wedumela. Ngakho-ke, ukuvikela uchungechunge lokuhlinzekwa kwesofthiwe kubalulekile emabhizinisini ukuvikela idatha yawo kanye nedatha yamakhasimende awo. Ngezansi, sizokwabelana ngamathiphu amahlanu abalulekile okuvikela uchungechunge lwakho lokuhlinzekwa kwesofthiwe.
Yenza ukuhlolwa kobungozi
Ngaphambi kokuvikela uchungechunge lwakho lokuhlinzeka ngesofthiwe, kufanele uqonde izingozi ezihilelekile. Ukuhlolwa kwengozi kuzokusiza ukuthi ubone ubuthakathaka obungaba khona kuchungechunge lwakho lokuhlinzeka ngesofthiwe. Ukuqonda izingozi kukuvumela ukuthi ubeke phambili imizamo yakho yokuphepha futhi wabe izinsiza zakho ngempumelelo. Ukuhlolwa kwengozi kufanele kuqale ngokuhlonza isofthiwe oyisebenzisayo kanye nedatha eyicubungulayo. Kufanele futhi ukhombe izingxenye zenkampani yangaphandle, njengemitapo yolwazi noma ama-API, asetshenziswa kuchungechunge lwakho lokuhlinzeka ngesofthiwe. Amathuluzi azenzakalelayo anjenge I-Xygeni ingakusekela kule ndlela.
Uma usuzitholile izimpahla kanye nezingxenye ze-software supply chain yakho, udinga ukukhomba izinsongo ezingaba khona kanye nobuthakathaka. Izinsongo zingavela emithonjeni yangaphandle, njengabaduni noma i-malware, noma imithombo yangaphakathi, njengabasebenzi abanganelisekile. Ubuthakathaka bungafaka phakathi amaphutha kusofthiwe yakho, ihadiwe, noma izinqubo abahlaseli abangazisebenzisa.
Ngemva kokuthola izinsongo kanye nobuthakathaka, udinga ukuhlola amathuba kanye nomthelela wengozi ngayinye ukuze uthuthukise amasu okunciphisa ubungozi. Amasu okunciphisa ubungozi kufanele abhekane nezingozi ezibaluleke kakhulu kuqalaZingafaka phakathi ukusebenzisa izilawuli zokuphepha, ukuthuthukisa izinqubo zokuthuthukisa isofthiwe, noma ukushintsha ubudlelwano nabathengisi.
Khumbula ukuqapha nokubuyekeza ukuhlolwa kwakho kwengozi njalo ukuqinisekisa ukuthi kuhlala kusesikhathini. Kufanele futhi uhlole amasu akho okunciphisa ingozi ukuqinisekisa ukuthi ayasebenza futhi wenze izinguquko njengoba kudingeka.
Phatha abathengisi bakho
Abathengisi badlala indima ebalulekile ochungechungeni lwakho lokuhlinzeka ngesofthiwe. Lapho ukhetha umthengisi, kufanele ucabangele imikhuba yabo yokuphepha, idumela, kanye nomlando wabo. Kufanele futhi ube nenkontileka nezidingo zokuphepha kanye nokulindelekile. Okokugcina, kufanele uqaphe njalo ukusebenza komthengisi ukuqinisekisa ukuthi bahlangabezana nokuphepha okuvunyelwene ngakho. standards.
An SBOM uhlu olunemininingwane lwezingxenye ezisetshenziswa kuhlelo lokusebenza lwesofthiwe, okuhlanganisa izinombolo zenguqulo, ukuncika, kanye nobuthakathaka obaziwayo. Ngokusebenzisa i- SBOM, ungalandelela izingxenye ezisetshenziswa ngumthengisi wakho kusofthiwe yakhe bese uhlola ikhwalithi yalezo zingxenye. Lokhu kungasiza uhlola ukuphepha kwesofthiwe yomthengisi bese ubona ubuthakathaka obungaba khona.
Ungasebenzisa futhi i- SBOM ukulandelela ukusebenza komthengisi ngokuhamba kwesikhathi. Ngokuqhathanisa SBOMKusukela ezinguqulweni ezahlukene zesofthiwe yomthengisi, ungakwazi ukulandelela izinguquko zezingxenye futhi uthole noma yiziphi izinkinga ezintsha noma izinkinga zokuphepha.
Ngaphezu kwalokho, i SBOM kungakusiza ukulandelela ukuhambisana nezimfuneko zomthetho. Isibonelo, ezinye imithethonqubo zidinga izinkampani ukuthi zigcine uhlu lwezingxenye zesofthiwe yazo futhi zilandelele izinguquko ngokuhamba kwesikhathi.
Sebenzisa izindlela zokufaka amakhodi eziphephile
Imikhuba yokubhala ikhodi evikelekile isiza ukunciphisa ingozi yokuba sengozini kusofthiwe yakho. Isibonelo, ibalulekile ukuze ugweme izimfihlo enqubweni yakho yokuthuthukisa isofthiwe. Ezinye izinyathelo ongazithatha yilezi:
- Sebenzisa a uhlelo lokuphatha oluyimfihlo ukugcina nokuphatha izimfihlo ngokuphephile, ukuqinisekisa ukuthi zonke izimfihlo zibethelwe futhi zivikelwe.
- Landela umgomo welungelo elincane ukuqinisekisa ukufinyelela ezimfihlweni kulabo abazidingayo ukuze benze imisebenzi yabo yemisebenzi kuphela.
- Gwema izimfihlo zokubhala ikhodi kusetshenziswa iziguquguquko zemvelo, amafayela okucushwa, noma izinhlelo zokuphatha eziyimfihlo ukuze zigcinwe.
- Sebenzisa imikhuba yokubhala ikhodi evikelekile, njengokuqinisekiswa kokufakwayo, ukuphathwa kwamaphutha, kanye nokuhlolwa kokuphepha, ukuvikela ikhodi yakho nezimfihlo.
- Okokugcina kodwa okungabalulekile, hlinzeka ukuqeqeshwa kanye nezinsiza kubathuthukisi bakho ukubasiza baqonde ukubaluleka kwemikhuba yokubhala ikhodi evikelekile kanye nezingozi ezihlobene nezimfihlo.
Kufanele futhi usebenzise amathuluzi afana I-Xygeni izosiza ekuboneni ubuthakathaka bokuphepha kukhodi yakho. Khumbula, Ukunikeza izigebengu izihluthulelo zendlu yakho akuyona into engcono kakhuluKodwa yilokho okuvame ukuba khona kwenzeka ezinhlanganweni eziningi ukuthuthukisa isofthiwe yesimanje.
Sebenzisa ukusayina kwesofthiwe
Ukusayina isofthiwe kuyinqubo evumela abasebenzisi ukuqinisekisa ubuqiniso besofthiwe abayisebenzisayo. Uma isofthiwe isayiniwe, isiginesha yedijithali iyangezwa kukhodi, engasetshenziswa ukuqinisekisa ubuqiniso bayo. Ukusebenzisa ukusayina isofthiwe, ungavimbela abahlaseli ukuthi bashintshe futhi basabalalise isofthiwe yakho njengenguqulo esemthethweni.
Amathuluzi e-SSC kufanele asebenzise ukuqinisekiswa kwesitifiketi ukuqinisekisa ubuqiniso besiginesha yedijithali. Ukuqinisekiswa kwesitifiketi kuhilela ukuqinisekisa ukuthi isitifiketi sedijithali somthengisi sikhishwe yiSitifiketi Esigunyaziwe (CA) esithembekile futhi asikasuswa.
Ngenxa yezinhlelo ze-PKI, ungaqinisekisa ubuqiniso nobuqotho besofthiwe esatshalaliswa kuchungechunge lokuhlinzeka. Ivimbela ukuphazamiseka futhi iqinisekisa ukuthi isofthiwe isemthethweni futhi iphephile.
Ngokungafani nezinye izixazululo, amathuluzi okuqapha e-Xygeni ahlala eskena ikhodi ukuze athole izinguquko futhi athumele izexwayiso ezisheshayo uma kwenzeka izigameko ezingase ziphazamise ikhodi. Ikhono le-Xygeni lokubona nokuvimbela ukuphazamiseka kwekhodi ngesikhathi sangempela linciphisa ingozi yokulimala kwamabhizinisi.
Ngaphezu kwalokho, amathuluzi ethu okufihla ikhodi axakeka kakhulu ngekhodi, okwenza kube nzima ngabahlaseli ukuyiqonda nokuyishintsha. Ngesikhathi esifanayo, amasu okuvimbela ukuphazamiseka asiza ukuqinisekisa ukuthi ikhodi isebenza ngendlela ehlosiwe, noma ngabe kwenzeke ukuphazamiseka.
Gada uchungechunge lwakho lokuhlinzekwa kwesofthiwe
Ukuqapha njalo uchungechunge lwakho lokuhlinzekwa kwesofthiwe kubalulekile ukuze uthole izinkinga zokuphepha kusenesikhathi. Kufanele ulandelele ukugeleza kwesofthiwe kusukela ekuthuthukisweni kuya ekusetshenzisweni futhi uqaphe, okungenani, ukuthi:
- Ukuqapha Ubuqotho Befayela ukuthola izinguquko kumafayela abalulekile, njengamafayela okucushwa, ikhodi yomthombo, kanye nama-binary. Uma kutholwa ushintsho, ithuluzi likhiqiza isexwayiso, okuvumela ithimba le-DevSecOps ukuthi liphenye kabanzi.
- Ukutholwa kwe-Anomaly ukuhlonza ukuziphatha okungajwayelekile kuchungechunge lokuhlinzekwa kwesofthiwe, njengokuhluleka login imizamo, izinguquko kumafayela esistimu, izinqubo ezisebenza ngezikhathi ezingavamile, ezingalindelekile commits ezindaweni zokugcina 'eziqandisiwe', njll. Zingase zibonise ukwephulwa kokuphepha.
Ekuphetheni
Ukuvikela uchungechunge lwakho lokuhlinzekwa kwesofthiwe kubalulekile ekuvikeleni idatha yebhizinisi lakho kanye neyamakhasimende. ukwanda kokuhlaselwa kwe-cyber kanye nokwephulwa kwedatha, kubaluleke kakhulu kunanini ngaphambili ukuthatha indlela yokubhekana nokuphepha.
Unganciphisa kakhulu ingozi yezehlakalo zokuphepha ngokwenza ukuhlolwa kwengozi, ukuphatha abathengisi bakho, ukusebenzisa imikhuba yokubhala ikhodi evikelekile, ukusebenzisa ukusayina isofthiwe, kanye nokuqapha uchungechunge lwakho lokuhlinzeka ngesofthiwe.
Ukuthatha indlela yokubhekana nokuphepha ngokusekelwa ithuluzi elifana neli I-Xygeni ukuzenzakalela lezi zinyathelo ezinhlanu ezibalulekile kuzonciphisa ingozi yezehlakalo zokuphepha futhi kuvikele ibhizinisi lakho emiphumeleni engaba mibi yokuhlaselwa kwe-cyber noma ukwephulwa kwedatha.
Xhumana nathi namuhla noma cela i-demo ukuze ufunde kabanzi ngezixazululo zethu nokuthi singakusiza kanjani ukuthuthukisa ukuvikelwa kwe-software yakho yokunikezela nge-supply chain.
