I-AppSec yesimanje ayisakwazi ukuthembela emisebenzini yokusebenza eyenziwa ngesandla. Ukuzenzakalela kokuphathwa kobungozi manje kuyinto edingekayo, akuyona inketho. Muva nje sithole ithuba lokujoyina i- Ama-DevSecOps Asebenzayo i-podcast, lapho i-CTO yethu Luis Rodriguez babelane ngemibono esimisweni "Ukuvikela Izixhumanisi Ezibuthakathaka Kakhulu: Ukuvimbela Ukuhlaselwa Kwe-Supply Chain Ngaphambi Kokuthi Kujikeleze." Kule nkulumo, uLuis uchaze ukuthi kanjani I-DevSecOps Amaqembu angahlala phambili ezinsongweni ezinkulu zanamuhla. Ngaphezu kwakho konke, ukhombisile ukuthi impumelelo incike ekuhlanganiseni okuzenzakalelayo kanye ukubeka phambili okusekelwe engcupheni nokwakha izivikelo eziqinile ngokumelene amaphakheji we-npm anonya.
Isifundo 1: Nciphisa Umsindo Ngokubeka Izinto Ezibalulekile Ezisekelwe Engozini
Okokuqala, uLuis uchaze ukuthi ingxenye enzima kakhulu akukhona ukuthola ubuthakathaka, ukuthola ukuthi yikuphi okubaluleke ngempela. Amathuluzi endabuko aletha izexwayiso ezingapheli, futhi amaningi aphenduka abe amaqiniso angamanga. Ngenxa yalokho, onjiniyela balahlekelwa isikhathi belandela izinkinga ezingabangeli ingozi yangempela.
Ukubeka phambili okusekelwe engcupheni ixazulula lokhu. Ibheka ukuxhashazwa, ukudalulwa, kanye nomthelela webhizinisi ukuze igqamise izinkinga abahlaseli abangase bazisebenzise kakhulu. Ngaphezu kwalokho, i-Xygeni's Application Security Posture Management kunciphisa izexwayiso ngamaphesenti afinyelela ku-90, okwenza umsebenzi wokuphepha ucace futhi ungaphazamisi kakhulu.
Ukuthatha ukhiye: Eqinisweni, ukuzenzakalela akukhona ukuskena okuningi, kodwa mayelana nokubonisa imiphumela embalwa, kuphela izinkinga ezibaluleke ngempela.
Isifundo 2: Amaphakheji e-npm anonya asevele esesezandleni zakho Pipeline
Okwesibili, uLuis waqokomisa iqiniso elingenakunakwa: amaphakheji we-npm anonya zigcwele imvelo evulekile. Eqinisweni, iphakheji eyodwa kweziyishumi ezintsha ze-npm noma ze-PyPI ezanyatheliswa ngo-2024 yayine-malware. Ngenxa yalokho, ukuhlaselwa kwe-supply chain kwasakazeka ngokushesha kunokuba amaqembu amaningi angasabela.
Thatha icala le- Impethu yeShai-Hulud: iphakheji eyodwa enonya yathelela amakhulu amaphrojekthi ngamahora. Lokhu akugcini nje ngokuphazamisa kakhulu, kodwa futhi kwabonisa indlela abahlaseli abasebenzisa ngayo ukuthembela okungaphiniwe kanye CI/CD amamodeli okuthembela.
I-Xygeni ikhuluma ngalokhu ngokuthi:
- Ukuqapha okuqhubekayo kwamarejista ukuze kufakwe amamaki kumaphakheji anonya.
- Guardrails okwakha ukuma lapho kutholwa ukuxhomekeka okuvalelwe.
- Izexwayiso zangaphambi kwesikhathi ezixwayisa amaqembu ngokushesha lapho kuvela izinsongo ezintsha.
Ukuthatha ukhiye: uma sibheka la maphuzu, sithembele kuphela kulokho okujwayelekile SCA akwanele, ukuzenzakalela kumele kuvimbele i-malware ngesikhathi sangempela.
Isifundo 3: Vikela Ifektri Ngokuzenzakalela Kokuphathwa Kokuhlukumezeka
Okwesithathu, uLuis wasikhumbuza ukuthi abahlaseli abasabhekisi nje izicelo, bahlasela pipeline ngokwayoIzenzo ze-GitHub ezibuthakathaka, imisebenzi engaphiniwe, kanye namathokheni anelungelo elingaphezu kwamandla kuyizindawo zokungena ezilula. Ngamanye amazwi, i- CI/CD uhlelo "luyimboni" yesofthiwe yesimanje. Uma ifektri isengozini, yonke into yobuciko engezansi isengozini.
Lapha ukuzenzekela kokuphathwa kobungozi kukhanye ngempela. Isibonelo, ngokufaka amasheke azenzakalelayo, izinto ezisayiniwe, kanye nokutholwa kwe-anomaly ngqo ku- CI/CD, amaqembu angenza lokhu:
- Vimbela ukusebenza kwemisebenzi engavikelekile.
- Qinisekisa yonke into eyakhiwe ngezitifiketi ze-cryptographic.
- Thola izenzo ezingavamile, ukukhushulwa kwamalungelo, noma ama-plugin angalungile ngokushesha.
Ukuthatha ukhiye: Ekuphetheni, ukuvikela ifektri kudinga ukuphoqelelwa okuqhubekayo, okuzenzakalelayo, ukubuyekezwa ngesandla kukodwa akusoze kwanda.
Lokhu Kusho Ukuthini Kumaqembu E-DevSecOps
Sekukonke, isifundo esivela enkulumweni kaLuis sicacile: i-AppSec yesimanje kumele ihlanganise ukuzenzekela kokuphathwa kobuthakathaka, ukuvikela iphakheji ye-npm enonya, kanye nokubeka phambili okusekelwe engcupheni. Ngaphandle kwalokho, amaqembu asengozini yokucwila emsindweni ngenkathi abahlaseli besebenzisa izikhala.
Nge-Xygeni, izinhlangano zithola:
- Ukutholwa kwempahla okuzenzakalelayo kanye nempahla eqoqwe.
- Ama-funnel anamandla e- ukubekwa phambili kobungozi obusekelwe engcupheni.
- Ukutholwa kwe-malware kanye nezimfihlo ngesikhathi sangempela kuhlanganiswe ku CI/CD.
Ngakho-ke, ukuzenzakalela akukhona nje ukusebenza kahle; kuyindlela kuphela yokuhlala uqine ekuhlaselweni kwe-supply chain okuguqukayo.
Bukela Ingxoxo Egcwele noLuis Rodríguez
Bona iseshini ephelele "Ukuvikela Izixhumanisi Ezibuthakathaka Kakhulu: Ukuvimbela Ukuhlaselwa Kwe-Supply Chain Ngaphambi Kokuthi Kujikeleze" futhi ufunde ukuthi ungazenzakalela kanjani ukuphathwa kobuthakathaka ku-DevSecOps yakho pipeline.
Ukulungele Ukusebenzisa Lezi Zifundo?
Ukulawula ubungozi ngokuzenzakalelayo nokuvikela amaphakheji e-npm anonya akuyona nje inkolelo-mbono, kuyinto ongayiqala namuhla. Nge-Xygeni, uzothola ukubekwa phambili okusekelwe engcupheni, ukutholwa kwe-malware ngesikhathi sangempela, kanye CI/CD guardrails leso silinganiso nethimba lakho.
Qala isilingo sakho samahhala futhi ubone ukuthi ukuzenzekela kokuphathwa kobungozi kuhambisana kanjani ngqo ne-akhawunti yakho pipeline.
