Amaqembu ezokuphepha awavamile ukwehluleka ngoba antula idatha. Ngokuvamile, ayahluleka ngoba alungisa izinkinga ezingalungile kuqala. Yingakho i-Known-Exploit Intelligence, ukuphathwa kobuthakathaka okusekelwe engcupheni, i-Cyber Resilience Act, kanye ne- CISIkhathalogi Eyaziwayo Yokuxhashazwa Okuxhashazwayo manje ihlangana emisebenzini yesimanje ye-AppSec.
Njalo ngeviki, ama-scanner abika amakhulu ezingozi. Kodwa-ke, abahlaseli basebenzisa ingxenye encane yazo kuphela. Ngenxa yalokho, amaqembu abeka phambili ngaphandle kokuxhaphaza umongo achitha isikhathi ngenkathi izinsongo zangempela zidlula. I-Known-Exploit Intelligence ivala leso sikhala ngokubonisa ubuthakathaka obusetshenziswa abahlaseli, hhayi nje kuphela obubonakala bukhulu ephepheni.
Kuyini Okwaziwayo - Ukuhlakanipha Kokusebenzisa Kabi
Ubuhlakani obusetshenziswa ngendlela eyaziwayo bukhomba ubuthakathaka abahlaseli ababusebenzisa ngenkuthalo ezindaweni zangempela. Ngamanye amazwi, buhlukanisa ingozi yomqondo nokuziphatha kokuhlasela okuqinisekisiwe.
Esikhundleni sokubuza ukuthi ingabe ubuthakathaka ayengakwenza ukuxhashazwa, amaqembu angagcina ebuza:
Ingabe lokhu sekuvele kuyasetshenziswa, futhi ingabe kuyawuthinta umkhiqizo wami?
Lowo mehluko ubalulekile ngokusebenza futhi, ngokuya ngokusemthethweni.
Kungani Ukubekwa Kwezinto Ezibalulekile Kwendabuko Kuwohloka
Amaqembu amaningi asathembela ezimpawini ezimile ukuze abeke phambili ingozi.
Ngokuvamile, bahlela ubuthakathaka ngokuthi:
- Ubukhali be-CVSS
- Ukuzethemba kweskena
- Ukuthandwa kwephakheji
Nakuba lezi zimpawu zisiza ekunciphiseni umsindo, ziphuthelwa yisici esisodwa esibalulekile: ukuziphatha kwabahlaseli. Ngenxa yalokho, amaqembu avame ukushesha ukulungisa izinkinga ezinzima kakhulu ezingasetshenziswa kabi ngenkathi ephuthelwa amaphutha aphansi kakhulu abahlaseli abawahlaselayo.
Lesi sikhala sichaza ukuthi kungani ukubekwa phambili okungaguquki kungasakhuli.
Kungani Umthetho Wokumelana Ne-Cyber Ushintsha Imithetho
Ngaphansi I-Cyber Resilience Act, isofthiwe yokuthumela enezinkinga ezaziwayo ezingase zisetshenziswe iba yinkinga yokuthobela imithetho, hhayi nje inkinga yokuphepha.
Umthethonqubo udinga ukuthi:
- Imikhiqizo enezinto zedijithali akumele ingene emakethe ye-EU ngobuthakathaka obaziwayo obungasetshenziswa
- Abakhiqizi basebenzisa amasango okuphatha ubuthakathaka kanye nokuvula
- Ukuxhashazwa ezindaweni zangempela kunesisindo esikhulu kunobunzima obungokwemfundiso
Ngenxa yalokho, ukubekwa phambili kuyashintsha kusuka ekusebenzeni okuhle kakhulu kuya esibophweni esingokomthetho.
Yilapho kanye ubuhlakani bokusebenzisa kabi buqala khona ukuba yinto ebalulekile.
I-Cyber Resilience Act
The I-Cyber Resilience Act umthethonqubo we-European Union obeka izidingo zokuphepha kwe-inthanethi eziphoqelekile zemikhiqizo enezinto zedijithali ezithengiswa e-EU.
Kalula nje, kudinga abakhiqizi ukuthi baklame, bathuthukise, futhi balondoloze isofthiwe engenazo izithiyo ezaziwayo ezingase zisetshenziswe ngesikhathi sokukhishwa. Ngaphezu kwalokho, iphoqa izinkampani ukuthi ziqaphe ubuthakathaka ngemva kokukhishwa futhi zibike izinkinga ezisetshenziswe ngenkuthalo ngaphakathi kwezikhathi eziqinile.
Lo mthethonqubo waqala ukusebenza ngoDisemba 2024. Kodwa-ke, ukuqiniswa okugcwele kuqala ngoDisemba 2027. Kusukela ngo-2026, izinkampani kumele zibike ubuthakathaka obusetshenziswa ngenkuthalo eziphathimandleni ze-EU zingakapheli amahora angama-24 kusukela zitholwe.
Ngamanye amazwi, uMthetho Wokumelana Nezinkinga Ze-Cyber uguqula ukuphathwa kobuthakathaka kusuka ekubeni yindlela engcono kakhulu kube yisidingo sokufinyelela emakethe.
Kungani ama-KEV ehlala eSikhungweni Sokuthobela Imithetho ye-CRA
The CISIkhathalogi Eyaziwayo Yokuxhashazwa Okuxhashazwayo uhlu lwe-CVE abahlaseli asebevele beyisebenzisa kabi endle. Le khathalogi isusa ukungaqondakali.
Esikhundleni sokuxoxisana ngengozi, amaqembu angathembela kudatha yokuxhashazwa eqinisekisiwe. Ngenxa yalokho, ama-KEV aba yimbangela enamandla kakhulu yama-SLA okulungisa kanye nokuvimbela ukukhishwa.
Le ndlela ivumelana ngokwemvelo ukuphathwa kobuthakathaka okusekelwe engcupheni, ngoba igxila emzamweni lapho kwenzeka khona umonakalo wangempela.
Ama-CVSS, ama-EPSS, nama-KEV asebenza ngezinhloso ezahlukene
Ukubeka izinto phambili ngempumelelo kudinga ukuqonda ukuthi izimpawu zihluka kanjani.
- I-CVSS kukhombisa umthelela ongaba khona
- EPSS ilinganisela amathuba okuxhashazwa
- The CISIkhathalogi Eyaziwayo Yokuxhashazwa Okuxhashazwayo iqinisekisa ukuxhashazwa okusebenzayo
Uma isetshenziswa yodwa, isignali ngayinye iyadukisa. Uma isetshenziswa ndawonye, inikeza umongo. Leyo nhlanganisela yakha isisekelo sokuphathwa kobuthakathaka okusekelwe engcupheni yesimanje.
Indlela Ubuhlakani Obusetshenziswa Ngayo Emsebenzini Obusebenza Ngayo
Imodeli yokubeka izinto eziza kuqala ewusizo ilandela ukulandelana okucacile:
- Thola ubuthakathaka kuyo yonke ikhodi kanye nokuncika
- Imiphumela yokufanisa ngokumelene CISIkhathalogi Eyaziwayo Yokuxhashazwa Okuxhashazwayo
- Hlola amathuba okusebenzisa i-EPSS
- Qinisekisa ukuthi kufinyeleleka kuhlelo lokusebenza noma pipeline
- Sebenzisa imithetho yokulungisa ngokusekelwe ekuvezweni kanye nendima yomkhiqizo
Ngenxa yalokho, amaqembu ayayeka ukuphatha uhlu lwabantu abasengozini njengokusilela emuva futhi aqala ukuluphatha njengolungasebenzi kahle.cisions.
Indlela Esakha Ngayo Ubuhlakani Obuziwayo Nobusebenzisa Kahle eXygeni
Sakha lesi sici ngemva kokubona amaqembu elungisa izinkinga ze-CVSS ephezulu ngokuphindaphindiwe kuyilapho ubuthakathaka obaziwayo obusetshenziswa kabi bufinyelela ekukhiqizweni. Lokho okuhlangenwe nakho kwakha indlela esaklama ngayo uhlelo.
With v5.36, I-Xygeni ihlanganisa ubuhlakani bokusebenzisa obuqinisekisiwe ngqo enjinini yokubeka phambili.
Kwenzekani ngaphansi kwe-hood
- I-Xygeni iyaqhubeka nokudla amakhathalogi okuxhaphaza athembekile njenge-KEV kanye neminye imithombo yokuxhaphaza yomphakathi
- Ubuthakathaka ngabunye buthola imethadatha yokuba khona kwe-exploit
- I-funnel yokubeka phambili ihlanganisa:
- Isimo sokuxhashazwa esaziwayo
- Amathuba e-EPSS
- Umongo wokufinyeleleka
- Ukuvezwa kwekhodi kanye nokuncika
Ipulatifomu ibala amaphuzu obungozi obuhlanganisiwe emhlabeni wangempela
Esikhundleni sokushintsha izimpawu ezikhona, lo modeli uyawalungisa.
Ukutholwa → Ukufana Kokusebenzisa Kabi → Ukufinyeleleka → Ukulungiswa
Lokhu kugeleza kuqhuba yonke i-decisIon:
Onjiniyela babona umongo wokuxhaphaza ngqo ku- pull requests. PipelineI-block ye-s ihlangana kuphela uma ikhodi efinyelelekayo ifaka phakathi ubuthakathaka obaziwayo obuxhashaziwe. Ukulungiswa okuzenzakalelayo kusikisela ukuthuthukiswa okuphephile ngokushesha.
Akukho mihlangano. Akukho ukuqagela. Akukho ukuphazamiseka kokwethuka.
Kungani Lokhu Kubalulekile Ngale Kokuthobela Imithetho
Nakuba uMthetho Wokumelana Nezimo Eziphuthumayo We-Cyber wabangela lolu shintsho, izinzuzo ziyaqhubeka.
Amaqembu abeka phambili ukusebenzisa ubuhlakani bokusebenzisa:
- Nciphisa ukukhathala kokuqwashisa
- Nciphisa isikhathi sokulungisa
- Gwema imijikelezo yokulungisa ephuthumayo
- Thumela isofthiwe ephephile ngokuzethemba
Ukuthobela imithetho kuba umphumela ongemuhle wokwenza ukuphepha kahle.
Imicabango Yokugcina: I-CRA Yenza Ukuphathwa Okusekelwe Engozini Kube Yimpoqo
UMthetho Wokumelana Nezinkinga Zokuxhumana Nge-Cyber wenza kube semthethweni lokho amaqembu anolwazi asekufundile kakade. Akuwona wonke amaphutha abalulekile ngokulinganayo.
The CISIkhathalogi Eyaziwayo Yokuxhashazwa Okuxhashazwayo ikhombisa lokho abahlaseli abakusebenzisayo namuhla. Umongo kanye nokufinyeleleka kukhombisa ukuthi kuyakuthinta yini. Ndawonye, zichaza isimanje ukuphathwa kobuthakathaka okusekelwe engcupheni.
I-Xygeni isebenzisa le modeli njalo, ngokuzenzakalelayo, futhi lapho onjiniyela sebevele besebenza khona.
Mayelana Nombhali
Ibhalwe ngu Fatima Said, Umphathi Wokumaketha Okuqukethwe ogxile Ekuphepheni Kwezicelo kwa-Xygeni Security. Udala okuqukethwe okugxile kubathuthukisi, okuqhutshwa ucwaningo ku-AppSec, ASPM, kanye ne-DevSecOps, ehumusha izinselele zokuphepha zangempela zibe isiqondiso esicacile nesisebenzayo.
