Ukuhlasela kwanamuhla akusalindi kuze kube yisikhathi sokusebenza. Kuqala ekuthembekeni kwakho, kwakha izikripthi, futhi pipelines.
Yingakho ukuvikelwa kwe-malware kumele kuguqukele ngale kwamathuluzi e-antivirus kanye ne-endpoint.
Abathuthukisi banamuhla babhekene nenselele entsha: ukuqinisekisa ukuvikelwa ku-malware ngaphambi ikhodi iyahlanganiswa. Amathuluzi endabuko asabela ngemva kokutheleleka, kodwa ukuvikelwa kwe-malware okungcono kakhulu kusebenza kusenesikhathi, ngaphakathi kwe-software supply chain.
Kungani Ukuvikelwa Kwe-Malware Kumelwe Kuguquke
Sekuyiminyaka izinhlangano zithembela ku-antivirus kanye nezixazululo ze-endpoint zokusingatha i-malware. Kodwa-ke, lezi zinhlelo zibona kuphela izinsongo uma sezivele zingaphakathi.
Okwamanje, abahlaseli sebenyukele phezulu. Bafaka ikhodi enonya kumaphakheji omthombo ovulekile, bafihle imithwalo ekhokhelwayo kumaskripthi angaphambi kokufakwa, futhi bayekethise CI/CD pipelines.
Ngokusho the Umbiko Wobugebengu Be-inthanethi we-FBI ka-2024, ukulahlekelwa kobugebengu be-inthanethi kudlule amaRandi ayizigidi eziyizinkulungwane eziyi-12.5 ngonyaka odlule, kanti ukuhlaselwa kochungechunge lokuhlinzekwa kwesofthiwe kwanda kakhulu. I-NCSC yase-UK iphinde ixwayise ngokuthi isehlakalo esisodwa kwezintathu manje sihilela ingxenye yesithathu noma ukuthembela okusengozini.
Lezi zinombolo ziqinisekisa lokho onjiniyela abaningi asebekusola kakade: ukuvikelwa kwe-malware yendabuko akukwazi ukuqhubeka.
Lokho Ukuvikelwa Kwe-Malware Yendabuko Okungalungile
Amathuluzi okuvikela i-malware ajwayelekile athembele ekusayinweni, ukufanisa amaphethini, noma ukuhlaziywa kokuziphatha kuma-endpoints. Nakuba esebenza kahle kwi-malware esekelwe kumafayela, awakwazi ukuphuthelwa izinsongo ezingeni lekhodi ezifihliwe ezinhlelweni zokwakha kanye nokubhaliswa.
Isibonelo, i-npm ne-PyPI zibona izinkulungwane zamaphakheji amasha nsuku zonke. Amaningi aqukethe i-obfuscated noma izikripthi ezinonya zifihliwe njengezixhomeke. Uma sezifakiwe, lezi zikripthi zingantshontsha iziqinisekiso, zixhumeke kumaseva akude, noma zifake iminyango yangemuva, ngaphambi kokusetshenziswa.
Ngakho-ke, ukuthembela kuphela ekutholakaleni kwesikhathi sokusebenza kunikeza isivikelo esiyingxenye kuphela ku-malware.
Ngokuphambene nalokho, ukuvikelwa okungcono kakhulu kwe-malware kuqala kusenesikhathi, kuhlaziywa ukuncika ngaphambi kokuba zingene endaweni yakho.
Idatha Ebangela Usongo Olukhulayo
Ukwanda kokuhlaselwa kwezinhlelo zokusebenza zesofthiwe kuyalinganiswa futhi kunzima ukukushalazela.
Izifundo zakamuva zembula ukuthi isimo sengozi sikhula ngokushesha kangakanani kuzo zonke izindawo zemvelo ezivulekile kanye nentuthuko pipelines.
- A Ukwanda kwama-650% unyaka nonyaka kumaphakheji anonya alayishwe ku-npm kanye ne-PyPI, ngokusho kwe- Ucwaningo lwe-arXiv (2024).
- Cishe Ama-30% azo zonke izehlakalo zokwephulwa kwedatha ngo-2024 izingxenye zeqembu lesithathu noma abathengisi bangaphandle abahilelekile, ngokusekelwe ku- I-ENISA Threat Landscape 2024.
- The Uhlaka lweMITER ATT & CK ikhomba okungaphezu kwalokho Amasu ayi-100 ahlukene kuhlobene nokuyekethisa kochungechunge lokuhlinzekwa kwesofthiwe, kusukela ekudidekeni kokuthembela kuye ekwebiweni kweziqinisekiso.
Ndawonye, lezi zitholelo zibonisa ukuthi i-malware ayisaqondisi kuphela ama-endpoints.
Kunalokho, isakazeka ngokuthembela okuthembekile, ukwakha pipelines, futhi CI/CD izindawo.
Yingakho izinhlangano zidinga ukuvikelwa ku-malware lokho kuqala emthonjeni, ngaphambi kokuba noma yiliphi iphakheji elisengozini lifinyelele ekukhiqizweni.
Ukuvikelwa Kwe-Malware Yendabuko vs. Ukuvikelwa Kwe-Malware Yesimanje ye-DevSecOps
| aspect | Ukuvikelwa Kwe-Malware Yendabuko | Ukuvikelwa Kwe-Malware Yesimanje ye-DevSecOps |
|---|---|---|
| Scope | Igxila kuma-endpoints kanye namadivayisi abasebenzisi. | Ivikela uchungechunge oluphelele lokuhlinzekwa kwesofthiwe, kusukela kukhodi kuya efwini. |
| Isikhathi Sokuthola | I-Reactive — ikhomba izinsongo ngemva kokutheleleka noma ukubulawa. | I-Proactive — ithola futhi ivimbele i-malware ngaphambi kokwakha noma ukusabalalisa. |
| Indlela Yokuthola | Ithembela ezimpawini kanye nasezindleleni ezaziwayo zosongo. | Isebenzisa ukuhlaziywa kokuziphatha kanye nokuqonda umongo kokuxhomekeka kanye nekhodi. |
| Ukuhlanganisa | Amathuluzi azimele, ngokuvamile angaphandle kwemisebenzi yonjiniyela. | Ihlanganisa ngaphandle komthungo ne CI/CD amathuluzi afana ne-GitHub, i-GitLab, i-Jenkins, kanye ne-Azure DevOps. |
| Ukuhlanganisa | Kukhawulelwe ku-malware eyaziwayo kumadivayisi namafayela. | Kunwebeka kukhodi yomthombo, amaphakheji omthombo ovulekile, iziqukathi, kanye pipelines. |
| Isikhathi sempendulo | Kuncike kuzibuyekezo ezenziwe ngesandla kanye nezisayini ze-antivirus. | Iletha izexwayiso zesikhathi sangempela kanye nokuvimba ngokuzenzakalelayo amaphakheji asolisayo. |
| Amathuba Amanga | Okuphezulu — kuvame ukudala izexwayiso ezinomsindo neziphindaphindayo. | Kuncishiswe ngokuhlaziywa kokusebenziseka kanye nokufinyeleleka. |
| Ukuzenzekelayo | Kudingeka uphenyo nokulungiswa ngesandla. | Kufaka phakathi ukulungiswa okuzenzakalelayo, izexwayiso zakuqala, kanye ne-firewall yokuxhomekeka. |
| Ukubonakala | Igxile emaphethelweni, ayinakho ukulandelela okwakhiwe. | Inikeza ukulandeleka okugcwele nge SBOMs, i-provenance, kanye nobufakazi. |
| I-Fit Engcono Kakhulu | Ukuvimbela ngemuva kwesigameko kanye nokuvikela izinga ledivayisi. | Ukuvikelwa okuqhubekayo ku-malware kuyo yonke intuthuko kanye nokulethwa pipelines. |
Okufanele Kufakwe Ukuvikelwa Kwe-Malware Okuhle Kakhulu
Amaqembu okuthuthukisa anamuhla adinga ukuvikelwa kwe-malware okungcono kakhulu lokho kuvumelana nendlela isofthiwe eyakhiwe ngayo namuhla.
Ukuze uhlale uphephile, ukuzivikela kumele kuqale kusenesikhathi futhi kuvimbele ikhodi enonya ukuthi ingangeni pipeline kube bonke.
Kafushane, ukuvikelwa okusebenzayo kwe-malware igxile ekuvimbeleni kunokusabela.
Isixazululo esiphelele kufanele sifake izendlalelo eziningana ezixhunyiwe zokuzivikela:
- Ukuskena Kwesikhathi Sangempela amarejista omthombo ovulekile njenge-npm, i-PyPI, i-Maven, ne-NuGet, egcina izinsongo zingasabalali.
- Isistimu Yesexwayiso Yangaphambi kwesikhathi eqapha njalo lawo marejista futhi ithole i-malware engenalo usuku ngesikhathi ivela, ixwayisa amaqembu ngaphambi kokuba amaphakheji athelelekile afinyelele ezindaweni zawo.
- I-Firewall Yokuthembela okuvimba noma ukuvalela ngokuzenzakalelayo izingxenye ezisolisayo, okunciphisa isidingo sokuhlolwa ngesandla.
- Ukutholwa kwe-Anomaly yonkana CI/CD futhi SCM izinhlelo, ezisiza ekuboneni ukuziphatha okungajwayelekile noma izinguquko zefayela ezingalindelekile ngesikhathi sokwakha.
- Ukuhlaziywa Komhlanganyeli Nomshicileli ukuthola izinguquko ezisheshayo zomgcini noma ama-akhawunti antshontshiwe angafaka ikhodi enonya.
- Ukuqiniswa Kwenqubomgomo Okuqhubekayo ukugcina ukuhambisana nokuhambisana ngaphandle kokunciphisa intuthuko.
Inani elikhulayo lobuthakathaka libonisa ukuthi kungani lokhu kuvikelwa kubalulekile.
Ngokusho the I-National Vulnerability Database (NVD), Ngaphezu kwe Kwabikwa ama-CVE amasha angu-29,000 ngo-2024, okuyisibalo esiphezulu kunawo wonke.
Lokhu kwanda okuqhubekayo kugqamisa indlela izinsongo ezishintsha ngokushesha ngayo nokuthi kungani onjiniyela bedinga izivikelo ezihlanganisiwe ezakhelwe ngqo emsebenzini wabo wokusebenza.
Ngokubambisana, la makhono aqinisekisa ukuthi ukuvikelwa kwe-malware kuhlanganisa zonke izigaba, kusukela kukhodi kuya efwini, kunciphisa ukuvezwa, ukuthuthukisa ukubonakala, kanye nokugcina pipelinekuhlanzekile.
Indlela ka-Xygeni: Ukuvikelwa kwe-Proactive Malware kwe-DevOps
I-Xygeni iletha ukuvikelwa kwe-malware yesimanje ngqo enqubweni yokuthuthukiswa.
Esikhundleni sokulinda izexwayiso ngemva kokwakhiwa, ithola futhi ivimbele izinsongo ngesikhathi sangempela kukhodi yomthombo, ukuncika, kanye CI/CD pipelines.
Lo mklamo osebenzayo usiza amaqembu ukugcina izindawo zawo zihlanzekile ngaphandle kokunciphisa ijubane lokulethwa.
Nansi indlela i-Xygeni egcina ngayo pipelinekuphephile:
- Ukuqapha okuqhubekayo: Ilandelela izinkulungwane zamaphakheji amasha nsuku zonke futhi iveze ukuziphatha okusolisayo ngaphambi kokuba kufinyelele ekukhiqizweni.
- Isistimu Yesexwayiso Yangaphambi kwesikhathi: Inikeza izexwayiso zakuqala mayelana ne-malware engenazo izinsuku ezishicilelwe kumarejista omthombo ovulekile, okunikeza amaqembu isikhathi sokuphendula ngokushesha.
- Ukuzivikela Okuzenzakalelayo: Uhlukanisa noma uvimbele ukuncika okuyingozi ngokuzenzakalelayo ukuze kuvinjelwe ukungcola kokwakheka.
- Ukutholwa kwe-Anomaly: Ibuka izinguquko zefayela ezingalindelekile, izikripthi ezifihliwe, noma imizamo yokusebenzisa imiyalo ekude ngaphakathi kwemisebenzi yakho yokusebenza.
- Ukulandelela Idumela Lomhlanganyeli: Iqapha ubunikazi bomnakekeli futhi ikhiphe amaphethini ukuze ithole ama-akhawunti omshicileli mbumbulu noma antshontshiwe.
Ngoba i-Xygeni ihlangana kahle namapulatifomu afana GitHub, I-GitLab, uJenkins, kanye bitbucket, amaqembu athola ukuvikelwa okuqhubekayo ku-malware ngaphandle kokusethwa okwengeziwe noma ukucushwa okuyinkimbinkimbi.
Iphatha ngokuthula ukutholwa nokuvinjelwa ngemuva, ukuze abathuthukisi bahlale begxile ekubhaleni ikhodi.
Ngale ndlela, i-Xygeni ayinikezi nje kuphela ukuzivikela kwesikhathi sangempela kodwa futhi nezinga lokuvikelwa kwe-malware okungcono kakhulu okwenzelwe indlela isofthiwe yesimanje eyakhiwe ngayo ngempela.
Indlela Onjiniyela Abazuza Ngayo Ekuvikeleni Okusebenzayo
Kwabathuthukisi, umehluko ucacile. Amathuluzi endabuko avame ukubambezela ukwakhiwa noma ukukhukhula dashboards ngezexwayiso ezingamanga. Kodwa-ke, i-Xygeni kugcina izinto zilula futhi inikeza imininingwane ebaluleke kakhulu.
- Izexwayiso zamanga ezimbalwa kanye nemibiko ehlanzekile.
- Impendulo esheshayo ngaphakathi pull requests.
- Ukubonakala okuqhubekayo kulo lonke uchungechunge lokuhlinzekwa kwesofthiwe.
- Ukuvikelwa kwe-malware okuzenzakalelayo ngaphandle kokuhlolwa ngesandla.
Ngaphezu kwalokho, lo msebenzi wokusebenza wakha ukuzethemba kukho konke ukukhishwa.
Abathuthukisi bahlala begxile kukhodi, kuyilapho amaqembu okuphepha ethola ukumbozwa okugcwele nomsindo omncane.
Imikhuba Emihle Yokuqinisa Ukuvikelwa Kwe-Malware
Ngisho nokuvikelwa kwe-malware okungcono kakhulu kusebenza kangcono uma kuhlanganiswa nemikhuba eqinile ye-DevSecOps.
Isibonelo, lezi zinyathelo zingenza indawo yakho iphephe futhi ithembeke kakhudlwana:
- Gcina ukuncika kubuyekeziwe futhi kunamathiselwe ezinguqulweni ezithembekile.
- Skena zonke izinto zobuciko neziqukathi ngaphambi kokusebenzisa.
- Sebenzisa isimiso samalungelo aphansi kakhulu empilweni yakho CI/CD pipelines.
- Sebenzisa SBOMs (Software Bill of Materials) ukuze kubonakale ngokugcwele.
- Buka commit umlando kanye nomsebenzi womshicileli wezinguquko.
- Qeqesha amaqembu ukuthi aqaphele izingozi zochungechunge lokuhlinzeka ngempahla kusenesikhathi.
Okwamanje, ukuhlanganisa amathuluzi afana ne-Xygeni kusiza ukuguqula le mikhuba emihle ibe okuzenzakalelayo guardrails esikhundleni semisebenzi yezandla.
Ngamafuphi, kwenza kube lula ukuvikela ngenkathi kuqinisa ukuzivikela kwakho.
Imicabango Yokugcina: Ukwakha Uchungechunge Lokunikezwa Kwesofthiwe Elwa Ne-Malware
I-Malware iyaqhubeka nokukhula, ngakho-ke, izivikelo zakho nazo kufanele zikhule.
Ukuvikela ama-endpoints kuphela akusanele. Esikhundleni salokho, amaqembu adinga ukuvikelwa kwe-malware okuqala kusenesikhathi, ngaphakathi kwekhodi, ukuncika, kanye pipelineyilapho isofthiwe iqala khona ngempela.
Ukugxila ekuphepheni kulesi sigaba kunikeza onjiniyela ukubonakala okungcono kanye nempendulo esheshayo. Ngenxa yalokho, izingozi ziyancipha isikhathi eside ngaphambi kokuba zifinyelele ekukhiqizeni noma kubasebenzisi.
Ngokuhlanganisa ukuskena kwesikhathi sangempela, izixwayiso zakuqala, kanye nokuvimba okuzenzakalelayo, i-Xygeni inikeza ukuvikelwa okuqhubekayo ku-malware ngaphandle kokunciphisa ijubane lokuthuthukiswa.
Le ndlela yokuqapha igcina amaqembu egxile ekwakheni ngenkathi ehlala ephephile ezinsongweni ezifihliwe kuzo zonke izindawo zokugcina kanye nokwakha. pipeline.
Ngamafuphi, isivikelo se-malware esingcono kakhulu yilesi esisebenza ngaphambi kokuba kuqale ukuhlaselwa, okukusiza ukuthi usuke ekuvikeleni okusebenzayo uye ekuvikelekeni okusebenzayo futhi ugcine uchungechunge lwakho lokuhlinzeka ngesofthiwe luhamba phambili ngesinyathelo esisodwa.
Unemibuzo mayelana nokuphepha kwe-Azure?
