I-OWASP Top 10 ingenye yezinkomba zokuphepha kwezinhlelo zokusebenza ezisetshenziswa kakhulu ukuhlonza nokunciphisa izingozi zokuphepha kwezinhlelo zokusebenza zewebhu ezibaluleke kakhulu. Lo mhlahlandlela uchaza izingozi ze-OWASP Top 10, izibonelo zangempela, imikhuba emihle yokulungisa, kanye nendlela i-AppSec yesimanje kanye ne- software supply chain security izixazululo zisiza izinhlangano ukunciphisa ubungozi kulo lonke SDLC.
Iphrojekthi Yokuphepha Kwesicelo Sewebhu Esivulekile (i-OWASP)
Iphrojekthi Yokuphepha Kwezinhlelo Zokusebenza Zewebhu Ezivulekile (OWASP) yinhlangano engenzi nzuzo ehamba phambili ezinikele ekuthuthukiseni ukuphepha kwesofthiwe. I-OWASP yaziwa ngokusobala kwayo kanye commitIzixazululo eziqhutshwa ngumphakathi, okuye kwenza kwaba umthombo osetshenziswa kakhulu ngabathuthukisi, ochwepheshe bezokuphepha, kanye nezinhlangano ezifuna ukusebenzisa imikhuba emihle kakhulu yezokuphepha. Phakathi kweminikelo yayo eminingi, enye ebaluleke kakhulu yi-OWASP Top 10, uhlu oluvuselelwa njalo lwezingozi zokuphepha kwezinhlelo zokusebenza zewebhu ezibaluleke kakhulu ezithinta izinhlelo zokusebenza zanamuhla. Igqamisa ubuthakathaka obukhulu kakhulu ezinhlelweni zokusebenza zewebhu, ngokusekelwe kudatha yangempela kanye nokuqonda kochwepheshe.
Umsebenzi we-OWASP ukwenza ukuphepha kufinyeleleke futhi kuqondakale, ukuhlinzeka ngamathuluzi, izinhlaka, nolwazi ukusiza ukuvikela izinhlelo zokusebenza kusukela phansi kuya phezulu. I-OWASP Top 10 isebenza njengohlaka olusebenzayo lokusiza abathuthukisi bagxile ebuthakathakeni obubaluleke kakhulu, ukuqinisekisa ukuthi bangakwazi ukusebenzisa izixazululo ezidingekayo ngempumelelo.
I-OWASP Top 10
I-OWASP Top 10 iyisisetshenziswa esiyisisekelo sokuphepha kwezinhlelo zokusebenza zezinhlangano ezivikela izinhlelo zokusebenza zewebhu zesimanje. Kunoma iyiphi inhlangano esebenza ukuvikela izinhlelo zokusebenza zewebhu. Iveza izinsongo zokuphepha ezibaluleke kakhulu, inikeza ukuqonda ngezindlela ezivamile izinhlelo zokusebenza ezisengozini ngazo. Ubuthakathaka be-OWASP Top 10 buqokomisa lezi zingozi eziphezulu, bunikeza izincomo ezisebenzayo zokunciphisa. Ukubhekana nalezi zinkinga ngqo kubalulekile ekuqiniseni ukuphepha kwanoma yiluphi uhlelo lokusebenza.
Iyini i-OWASP Top 10 kanye nezindlela zayo zokwelapha?
I-OWASP Top 10 iwumbhalo wokuqwashisa owaziwa emhlabeni wonke oshicilelwe yi-Open Web Application Security Project (OWASP). Ikhomba izingozi zokuphepha ezibaluleke kakhulu ezithinta izinhlelo zokusebenza zewebhu zanamuhla ngokusekelwe kudatha yokuhlasela yangempela, ucwaningo lomphakathi, kanye nokuhlaziywa kwemboni. Uhlu lusiza onjiniyela, amaqembu e-AppSec, onjiniyela be-DevSecOps, kanye nabaholi bezokuphepha ukuthi babeke phambili ubuthakathaka obubeka ingozi enkulu kuzinhlelo zokusebenza, ama-API, kanye nezintambo zokuhlinzeka ngesofthiwe.
I-OWASP Top 10 yamanje ifaka phakathi izigaba zokuphepha ezifana ne-Broken Access Control, i-Injection, i-Security Misconfiguration, i-Vulnerable and Outdated Components, i-Software and Data Integrity Failures, kanye ne-Server-Side Request Forgery (SSRF). Ukuqonda lezi zingozi nokusebenzisa amasu okulungisa afanele kubalulekile ekwakheni izinhlelo zokusebenza eziphephile, ukunciphisa ukuvezwa kokuphepha kwesofthiwe, kanye nokuvikela izinhlangano ezinsongweni zesimanje ze-cyber.
Izigaba Eziyi-10 Eziphezulu ze-OWASP
Izinkinga Eziphezulu Eziyi-10 ze-OWASP Ngokubuka
| Isigaba se-OWASP | Ingozi Eyinhloko | Umthelela Ojwayelekile |
|---|---|---|
| Ukulawula Ukufinyelela Okuphukile | Ukufinyelela okungagunyaziwe | Ukuchayeka kwedatha |
| Ukwehluleka kwe-Cryptographic | Ukubethela okubuthakathaka | Ukwebiwa kwedatha okubucayi |
| Injection | Ukufakwa kokufaka okunonya | Isivumelwano sedathabheyisi |
| Umklamo Ongavikelekile | Ubuthakathaka bezakhiwo | Ubuthakathaka bohlelo lonke |
| Ukulungiswa okungalungile kokuvikela | Ukusethwa okungalungile | Ukufinyelela okungagunyaziwe |
| Izingxenye Ezisengozini | Ukuthembela okuphelelwe yisikhathi | Isivumelwano sochungechunge lokuphakelwa kwempahla |
| Ukufakazela Ukwehluleka | Izilawuli zobunikazi ezibuthakathaka | Ukuthathwa kwe-akhawunti |
| Ukwehluleka Kobuqotho Besofthiwe | Ukuphazamiseka kwesakhiwo/ukuthembela | Ukufakwa kwe-Malware |
| Ukwehluleka Kokuqopha Nokuqapha | Ukutholwa okubambezelekile | Isikhathi eside sokuhlala komhlaseli |
| I-SSRF | Ukuhlukunyezwa kwesicelo sangaphakathi | Isivumelwano senkonzo yangaphakathi |
1. Ukulawulwa Kokufinyelela Okuphukile (A01:2021)
Kuyini Ukulawulwa Kokufinyelela Okuphukile?
Ukulawulwa Kokufinyelela Okuphukile kwenzeka lapho abasebenzisi bethola ukufinyelela okungagunyaziwe kudatha noma izenzo. Isibonelo, umhlaseli angase ashintshe i-URL ukuze athole ukufinyelela komlawuli. I-OWASP ithole le nkinga ku-94% wezinhlelo zokusebenza ezihloliwe, okwenza kube enye yezinkinga zokuphepha ezivame kakhulu ze-OWASP Top 10.
Izindlela Zokulungisa Ukulawulwa Kokufinyelela Okuphukile
Ukuze kuncishiswe le ngozi, kuphoqelelwe ukufinyelela okuncishisiwe, kusetshenziswe ukuqinisekiswa kwezinto eziningi (i-MFA) kwemisebenzi ebucayi, futhi kuhlolwe njalo izimvume zomsebenzisi.
Ukuphepha Kwezimfihlo Zika-Xygeni kusiza ukuvikela ulwazi olubucayi njengokhiye be-API namathokheni, kunciphisa ingozi yokwephulwa kokulawulwa kokufinyelela. Ukuqapha okuqhubekayo kuqinisekisa ubuqotho besistimu yakho.
Isibonelo sikaRael-World
In 2019, I-First American Financial Corp kuvezwe ngaphezulu Amarekhodi abucayi ayizigidi ezingu-850 ngenxa yokulawulwa kokufinyelela okungafanele. Abahlaseli bangase bashintshe i-URL ukuze bafinyelele amadokhumenti ayimfihlo. Ngokunganaki ukuvikela izindawo zokufinyelela ngendlela efanele, inkampani ishiye idatha ebucayi isengozini. Lesi sigameko sigcizelela isidingo sokuqinisekisa izindima zabasebenzisi nokuqinisekisa ukuthi abantu abagunyaziwe kuphela abangafinyelela ulwazi oluyimfihlo.
Kungani kubalulekile namuhla? Izinhlelo zokusebenza zesimanje zidalula ama-API, izinsizakalo zamafu, kanye nezindima zabasebenzisi abasatshalalisiwe, okwenza ukufinyelela okungagunyaziwe kube ngenye yezingozi zokuphepha ezivame kakhulu nezilimazayo ezithinta idatha yebhizinisi ebucayi.
2. Ukwehluleka Kwe-Cryptographic (A02:2021)
Kuyini Ukwehluleka Kwe-Cryptographic?
Ukwehluleka kwe-Cryptographic kwenzeka lapho izinhlelo zehluleka ukubhala ngemfihlo idatha ebucayi ngendlela efanele, okuvumela abahlaseli ukuthi bayibambe futhi bayisebenzise kabi. Ukubethela okuqinile kubalulekile ekuvikeleni idatha ebucayi.
Izindlela Zokulungisa Ukwehluleka Kwe-Cryptographic
Bethela idatha egciniwe nge-AES-256 bese usebenzisa i-TLS 1.2 noma ngaphezulu ukuze uthole idatha edluliswayo. Jikelezisa okhiye bokubethela njalo bese ubavikela ngezilawuli zokufinyelela ezifanele.
Ingqalasizinda kaXygeni njengeKhodi (IaC) Ukuphepha ihlola izilungiselelo zokubethela ngesikhathi sokusetshenziswa ukuze kuvinjelwe ubuthakathaka ezinqubweni zokubethela.
Isibonelo Somhlaba Wangempela
Ngo 2017, I-Exactis, inkampani yokuhlanganisa idatha, kwembulwe amarekhodi abantu abayizigidi ezingu-340 ngenxa yokubethela okungafanele. Abahlaseli bafinyelele ulwazi lomuntu siqu olufana namagama, amakheli, nezinombolo zocingo ngoba idatha yayigcinwe kumbhalo ocacile. Lokhu kwephulwa kwemithetho kubonisa izingozi zokwehluleka ukubethela idatha ebucayi. Ngokusebenzisa ukubethela okufanele standardnjenge-AES-256 yedatha ephumulile kanye ne-TLS yedatha edluliswayo, izinhlangano zingavikela idatha yazo ekufinyeleleni okungagunyaziwe.
Kungani kubalulekile namuhla? Izinhlangano zigcina futhi zidlulisa idatha yamakhasimende ebucayi, yezezimali, kanye neyokuqinisekisa kuzo zonke izindawo zamafu, okwenza ukubethela okuqinile kubalulekile ekuvikeleni ubumfihlo kanye nokuthobela imithetho.
3. Umjovo (A03:2021)
Kuyini Ukuhlaselwa Ngomjovo?
Ubuthakathaka bokufaka, njenge-SQL Injection, buvumela abahlaseli ukuthi bafake ikhodi enonya ohlelweni lwakho, okubenza bakwazi ukulawula noma ukweba idatha. Ukuhlaselwa kokufaka kusalokhu kungenye yezingozi zokuphepha kohlelo lokusebenza ezivame kakhulu nezithinta kakhulu izinhlelo zokusebenza zewebhu zanamuhla.
Izixazululo ze Ukuhlaselwa Ngomjovo
Sebenzisa imibuzo ehlukaniswe ngamapharamitha bese uqinisekisa okufakwayo komsebenzisi. Gwema imibuzo eguquguqukayo noma nini lapho kungenzeka khona ukuze unciphise izingozi.
Ukutholwa Kwe-Anomaly ka-Xygeni abaqaphi CI/CD pipelines ngokuziphatha okungavamile, okubamba imizamo engaba khona yokujova ngesikhathi sangempela.
Isibonelo Somhlaba Wangempela
In 2017, I-Equifax wahlupheka a ukwephulwa kwedatha okukhulu okwadalula ulwazi lomuntu siqu lwe- Amakhasimende ayizigidi ezingu-147. Ukwephulwa kwale mithetho kwabangelwa Ubuthakathaka bokufakwa kwe-SQL, okuvumela abahlaseli ukuthi balawule iwebhusayithi yenkampani futhi bafinyelele idatha ebucayi egcinwe kusizindalwazi. Izinhlangano kumele ziqinisekise ukuthi izinhlelo zazo zihlanza kahle okokufaka kwabasebenzisi. Ukulungisa njalo nokuvikela imibuzo ye-SQL bekungavimbela lobu buthakathaka.
Kungani kubalulekile namuhla? Ubuthakathaka bokujova buyaqhubeka nokuthinta izinhlelo zokusebenza zewebhu, ama-API, kanye nemisebenzi yokuthuthukiswa okusizwa yi-AI lapho okufakwayo okungagunyaziwe kufinyelela kubahumushi, izizindalwazi, noma izinhlelo ze-backend.
4. Umklamo Ongavikelekile (A04:2021)
Kuyini Umklamo Ongavikelekile?
Umklamo Ongavikelekile kwenzeka lapho abathuthukisi behluleka ukuhlanganisa ukuphepha esigabeni sokuqala sokuklama, okudala ubuthakathaka okunzima ukubulungisa kamuva. Lobu buthakathaka kunzima ukubulungisa uma izinhlelo zokusebenza zifika ezindaweni zokukhiqiza.
Izixazululo ze Umklamo Ongavikelekile
Faka izimiso zokuklama ezivikelekile kanye nokulingisa okusongelayo ekuqaleni komjikelezo wokuphila kwentuthuko. Hlola njalo umklamo wakho ukuze uthole ubuthakathaka obungaba khona bese ubulungisa ngaphambi kokuba bube yizinkinga ezibucayi.
I-Xygeni's Application Security Posture Management (ASPM) ikhomba amaphutha okuklama angaba khona ngaphambi kokuba abahlaseli bakwazi ukuwasebenzisa kabi, iqinisekisa ukuthi onjiniyela bafaka ukuphepha kumkhiqizo wabo kusukela ekuqaleni.
Isibonelo Somhlaba Wangempela
Isibonelo sakamuva sezwe langempela se Umklamo Ongavikelekile iyona Ubuthakathaka be-Microsoft Exchange ProxyShell ngo-2021Abahlaseli basebenzise amaphutha okuklama ezindleleni zokuqinisekisa nokulawula ukufinyelela ze-Microsoft Exchange, okubavumela ukuthi basebenzise ikhodi kude kumaseva asengozini. Lokhu kukhubazeka kwakungewona amaphutha okusebenzisa, kodwa kwakuwubuthakathaka bokuklama obuyisisekelo obenze ukusetshenziswa kabi ngisho nangemva kokusetshenziswa kabi kwama-patches. Lokhu kwephulwa kugcizelela ukubaluleka kokuhlanganisa ukuphepha esigabeni sokuklama ukuvimbela ubuthakathaka ukuthi bungene ohlelweni.
Kungani kubalulekile namuhla? Ubuthakathaka bokuphepha obethulwe ngesikhathi sesigaba sokuklama kunzima futhi kuyabiza ukukulungisa kamuva, ikakhulukazi ezindaweni zokuthuthukiswa ezitholakala efwini nezishintsha ngokushesha.
5. Ukungalungiselelwa kahle kwezokuphepha (A05:2021)
Kuyini Ukungalungiselelwa Kahle Kokuphepha?
Ukuphepha Ukungalungiselelwa kahle kwenzeka lapho abahlaseli besebenzisa izinhlelo ezingalungiselelwe kahle, njengalezo ezisebenzisa izilungiselelo ezizenzakalelayo noma ezishiya amachweba angadingekile evulekile. Ukungalungiselelwa kahle kuhlala kungenye yezimbangela eziphambili zezehlakalo zokuphepha kwamafu kanye nohlelo lokusebenza.
Izixazululo ze Ukulungiswa okungalungile kokuvikela
Yenza ngokuzenzakalelayo ukuhlola ukucushwa usebenzisa Ingqalasizinda njengekhodi (IaC) futhi wenze ukuhlolwa kwezokuphepha njalo. Gcina zonke izinhlelo zivuselelwa ngama-patches akamuva.
I-Xygeni's IaC Security Iskena ukuze ithole ukulungiselelwa okungalungile ngaphambi kokusetshenziswa futhi iqinisekisa izinqubomgomo zokuphepha ngokuqhubekayo kuzo zonke izindawo.
Isibonelo Somhlaba Wangempela
Ngo 2018, NASA ngithole ukwephulwa kwemithetho ngoba izilungiselelo ezilungiselelwe kabi in I-Atlassian JIRA kudalulwe idatha yephrojekthi ebucayi kanye neyabasebenzi. Abahlaseli bathole ulwazi ngenxa yokucushwa okuvulekile. Ukuhlolwa kokuphepha okuzenzakalelayo kanye nokuphoqelelwa kwezinqubomgomo zokucushwa ezifanele bekungavimbela lokhu kwephulwa. Ukuhlolwa okuvamile bekuzobona ubuthakathaka ngaphambi kokuba abahlaseli balusebenzise kabi.
Kungani kubalulekile namuhla? Izinsizakalo zamafu ezingalungiselelwe kahle, CI/CD pipelineama-s, ama-container, kanye nezindawo zokuphatha eziveziwe kusalokhu kungenye yezimbangela eziphambili zokwephulwa kwezokuphepha kwanamuhla.
6. Izingxenye Ezisengozini Neziphelelwe Yisikhathi (A06:2021)
Yiziphi Izingxenye Ezisengozini Neziphelelwe Yisikhathi?
Izingxenye ezisengozini neziphelelwe yisikhathi zenzeka uma usebenzisa imitapo yolwazi noma izinhlaka zezinkampani zangaphandle ezinamaphutha okuphepha aziwayo. Abahlaseli bangasebenzisa lobu buthakathaka ukuze babeke engcupheni uhlelo lwakho lokusebenza. Lokhu kuyingozi kakhulu, njengoba kufikela ku-60% wezinhlelo zokusebenza zanamuhla zakhiwe ngezingxenye zezinkampani zangaphandle.
Izixazululo ze Izingxenye Ezisengozini Neziphelelwe Yisikhathi
Buyekeza njalo imitapo yolwazi kanye nokuncika kwezinkampani zangaphandle, bese usebenzisa i-Software Composition Analysis (SCA) amathuluzi okuthola nokulungisa ubuthakathaka.
I-Xygeni's Open Source Security ihlola ukuncika kwakho ukuze ivimbele ukusebenzisa izingxenye eziphelelwe yisikhathi noma ezinonya, okukusiza ukuthi ugcine uhlelo lokusebenza luphephile.
Isibonelo Somhlaba Wangempela
In 2017, Ama-Apache Struts babe sengozini engakalungiswa eyaholela ekutheni Ukwephulwa kwe-Equifax, kuthinta izigidi zabasebenzisi. Ubuthakathaka babukhona Ama-Apache Struts 2, uhlaka olusetshenziswa kabanzi, futhi i-Equifax yehluleka ukusebenzisa i-patch ngesikhathi. Lokhu kwashiya izinhlelo zabo zisengozini yokuxhashazwa. Ukubuyekezwa ngesikhathi kanye nokuskena njalo kobungozi bekungavimbela lokhu kwephulwa.
Kungani kubalulekile namuhla? Izinhlelo zokusebenza zesimanje zincike kakhulu kumaphakheji omthombo ovulekile kanye nemitapo yolwazi evela eceleni, okwenza ukuhlaselwa kochungechunge lokuhlinzekwa kwesofthiwe kanye nokuthembela okusengozini kube yinto ekhulayo ekhathazayo nge-AppSec.
7. Ukwehluleka Kokuqinisekisa (A07:2021)
Kuyini Ukwehluleka Kokuhlonza Nokuqinisekisa?
Lokhu buthakathaka kwenzeka lapho izindlela zokuqinisekisa zibuthakathaka noma zingasetshenziswanga kahle, okuvumela abahlaseli ukuthi badlule izilawuli zokuphepha.
Izixazululo ze Ukwehluleka Kokuhlonza Nokuqinisekisa
Sebenzisa izinqubomgomo zephasiwedi eziqinile, sebenzisa ukuqinisekiswa kwezinto eziningi (i-MFA), kanye namalogi okuqinisekisa ukuhlola ukuze uvimbele ukufinyelela okungagunyaziwe.
I-Xygeni's Secrets Security isiza ekuvikeleni iziqinisekiso zakho, inciphise ubungozi bokuvuza ngesikhathi senqubo yokuqinisekisa.
Isibonelo Somhlaba Wangempela
In 2020, lo Khalisa ikhamera yokuvikela ukwephulwa kwabangelwa amaphasiwedi abuthakathaka. Abahlaseli basebenzise amaphasiwedi alula futhi bathola ukufinyelela kokuphakelayo kwamavidiyo abukhoma kusuka ku- amakhamera abasebenzisi abayizinkulungwaneLokhu kwephulwa kwemithetho kugqamisa isidingo esibalulekile semikhuba eqinile yokuqinisekisa. Ngakho-ke, ukusebenzisa ukuqinisekiswa kwezinto eziningi (MFA) nokuphoqelela izinqubomgomo zephasiwedi eziqinile ngabe kuvimbele kalula ukufinyelela okungagunyaziwe.
Kungani kubalulekile namuhla? Izindlela zokuqinisekisa ezibuthakathaka ziyaqhubeka nokwenza kube lula ukuthathwa kwama-akhawunti, ukuhlaselwa kokugcwalisa iziqinisekiso, kanye nokufinyelela okungagunyaziwe ku-SaaS, ifu, kanye enterprise izicelo.
8. Ukwehluleka Kobuqotho Besofthiwe Nedatha (A08:2021)
Kuyini Ukwehluleka Kwesofthiwe Nobuqotho Bedatha?
Lokhu kukhubazeka kwenzeka lapho ikhodi noma ingqalasizinda ingavikeli ekuphazamisekeni. Abahlaseli bangafaka engozini ukwakheka pipelines, ukuncika, noma izinqubo zokuthunyelwa, ukufaka ikhodi enonya kuzibuyekezo ezithembekile. Lolu hlobo lwephutha selube yinto ekhathazayo enkulu ngenxa yokwanda kokuhlaselwa kweketanga lokuhlinzeka, lapho ngisho nezingxenye zenkampani yangaphandle ezithembekile zihloselwe ukungena kumanethiwekhi.
Izixazululo ze Ukwehluleka Kobuqotho Besofthiwe Nedatha
Ukuze unciphise lokhu, sebenzisa ukusayina ikhodi, sebenzisa izinqubo zokwakha eziphephile, futhi uqinisekise ubuqotho bazo zonke izingxenye zenkampani yangaphandle.
I-Xygeni's CI/CD Security iqinisekisa ukuthi yakho pipelineAma-s aphephile futhi aqashwe ukuze kutholakale ama-anomaly. I-Xygeni's Anomaly Detection ingakhomba imisebenzi esolisayo engase ibonise ukuphazamiseka.
Isibonelo Somhlaba Wangempela
In 2024, ukuhlaselwa okukhulu kochungechunge lokunikezwa kwempahla okuqondiswe Izinsiza ze-XZ, umtapo wolwazi wokucindezela osetshenziswa kabanzi ezinhlelweni ze-Linux. I-XZ Utils iyithuluzi elibalulekile elisetshenziselwa ukucindezela amafayela, elithenjwe izinkulungwane zezinhlangano. Kodwa-ke, abahlaseli baphumelele ekuphazamiseni inqubo yokwakha yephrojekthi ngokufaka umnyango wangemuva kukhodi.
Abahlaseli abazange baqapheleke isikhathi esithile, okusho ukuthi izinhlelo ezithembele kulabhulali eyonakele zazisengozini yokusetshenziswa kwekhodi kude kanye nokuxhashazwa okuqhubekayo. Ngenxa yalokho, laba bahlaseli bathola ukulawula izinhlelo ezithintekile, okwaholela ekuphulweni kwedatha kanye nokuphazamiseka kolwazi oluyimfihlo.
Lesi sigameko sisebenza njengesikhumbuzo esicacile sezingozi ezibangelwa yi- ukuhlaselwa kochungechunge lokunikezwa kwempahla. Ngisho nomtapo wolwazi othembeke kakhulu ungashintshwa ukuze uphazamise izinhlelo eziningi. Ngokuqinisekisa izinqubo zokwakha eziphephile, kusetshenziswa amasu okusayina ikhodi, kanye nokuqapha njalo izingxenye zezinkampani zangaphandle, izinhlangano zingavimbela ubuthakathaka obunjalo ekungeneni kwezinhlelo zazo.
Kungani kubalulekile namuhla? Ukuhlaselwa kochungechunge lokuhlinzekwa kwesofthiwe okuqondiswe ekwakheni pipelines, ukubhaliswa kwamaphakheji, ukuncika, kanye CI/CD izinhlelo sezibe yingozi enkulu ekuthuthukisweni kwesofthiwe yesimanje.
9. Ukwehluleka Kokuqopha Nokuqapha Ezokuphepha (A09:2021)
Kuyini Ukwehluleka Kokuqopha Nokuqapha Ezokuphepha?
Lokhu kwehluleka kwenzeka lapho izinhlelo zokusebenza zingabhalisi kahle imicimbi yokuphepha noma zingenazo izindlela zokuqapha. Ngaphandle kwama-log anemininingwane, ukuthola nokuphendula ekuhlaselweni kuba nzima. Lobu buthakathaka buvame ukulibazisa ukutholwa kokwephulwa, okuvumela abahlaseli ukuthi basebenzise izinhlelo isikhathi eside.
Izixazululo ze Ukwehluleka Kokuqopha Nokuqapha Ezokuphepha
Nika amandla ukuloba okuphelele kwazo zonke izenzo ezibalulekile, gcina amalogi ngokuphephile, futhi uqinisekise ukuthi aqashwe ngezenzo ezisolisayo. Ngaphezu kwalokho, sebenzisa amathuluzi azenzakalelayo ukukuxwayisa ngezinsongo ezingaba khona.
Ukutholwa Kwe-Anomaly ka-Xygeni kusiza ukuhlonza imisebenzi engavamile ngesikhathi sangempela. Ngaphezu kwalokho, CI/CD Ukuphepha kuqinisekisa ukuthi ukuqopha nokuqapha ukucushwa kusetshenziswa njalo kuzo zonke izindawo.
Isibonelo Somhlaba Wangempela
In 2023, Uber ngithole ukwephulwa kwedatha oku kwaphazamisa ulwazi lomuntu siqu lwezinkulungwane zabashayeli. Ukwephulwa kwemithetho kwenzeke lapho inkampani yabameli yangaphandle, I-Genova Burns, uhlangabezane nesigameko sokuphepha, edalula idatha. Naphezu kokuthi izexwayiso zibangelwe, izinhlelo zokuqapha ze-Uber zehlulekile ukubona nokuphendula ngokushesha ekuhlaselweni.
Abahlaseli bathole ukufinyelela kolwazi olubucayi, okuhlanganisa amagama, izinombolo zocingo, kanye namarekhodi okushayela. Lokhu kubambezeleka kwakubangelwa kakhulu ukuntuleka kokubhaliswa okuphelele kanye nezinhlelo zokuqapha ezinganele.
Ukube i-Uber yayiqaphe kahle ukufinyelela ezinhlelweni zayo futhi yasebenzisa izindlela ezingcono zokuloba, ngabe ithole ukwephulwa kwemithetho ngokushesha okukhulu. Ngenxa yalokho, inkampani ngabe inciphise umonakalo odabeni kanye nokulahlekelwa yimali. Lokhu kwephulwa kwemithetho kugcizelela ukubaluleka okubalulekile kokugcina izinhlelo zokuloba kanye nokuqapha ezisebenzayo ukuze kutholakale futhi kuncishiswe izinsongo kusenesikhathi.
Kungani kubalulekile namuhla? Ngaphandle kokubonakala kahle nokuqapha, izinhlangano ziyahluleka ukubona ukuhlaselwa kusenesikhathi, okuvumela abahlaseli ukuba bahlale bengatholakali isikhathi eside.
10. Isicelo Sokukhohlisa Esivela Kuhlangothi Lweseva (SSRF) (A10:2021)
Kuyini ukukhwabanisa kwesicelo se-Server-Side?
I-SSRF yenzeka lapho abahlaseli bekhohlisa iseva ukuthi yenze izicelo ezindaweni ezingahlosiwe, ngokuvamile befinyelela izinsizakalo zangaphakathi okufanele zivinjelwe. Lokhu kuba sengozini kuvumela abahlaseli ukufinyelela idatha ebucayi noma ukwenza imiyalo ezinhlelweni zangaphakathi.
Izixazululo ze-SSRF
Ukuze uvimbele i-SSRF, qinisekisa konke okufakwayo komsebenzisi futhi ukhawulele ikhono leseva lokwenza izicelo eziphumayo. Ngaphezu kwalokho, sebenzisa uhlu lwabavunyelwe ukulawula ukuthi yimaphi ama-URL iseva engawafinyelela.
I-Xygeni's CI/CD Ukuphepha kusiza ukuqapha pipelines ngenxa yobuthakathaka obungaba khona be-SSRF. Ngaphezu kwalokho, i-Xygeni's Anomaly Detection ingabamba amaphethini esicelo angalindelekile noma asolisayo.
Isibonelo Somhlaba Wangempela
In 2022, ubuthakathaka obukhulu ku I-Microsoft Exchange (CVE-2022-41040) yasetshenziswa abahlaseli besebenzisa amasu e-SSRF. Abahlaseli bakwazile ukuthumela izicelo ezinonya kuseva ye-Exchange, bedlula izivikelo zokuphepha zangaphakathi.
Lapho sebengaphakathi, abahlaseli bafinyelele izinhlelo zangaphakathi futhi balimaza idatha ebucayi. Ngokusebenzisa i-SSRF, bathole ukufinyelela okungagunyaziwe ezinsizeni zangaphakathi ezivinjelwe, okwaholela ekuphulweni okukhulu kwezokuphepha.
Ubuthakathaka be-SSRF buyingozi kakhulu ngoba bunikeza abahlaseli ukufinyelela ezinhlelweni zangaphakathi okungafanele zivezwe emphakathini. Ukube iMicrosoft isebenzise ukuqinisekiswa kokufaka okuqinile kanye nemikhawulo yesicelo esiphumayo, ngabe ivimbele imizamo yabahlaseli yokusebenzisa lobu buthakathaka. Lokhu kwephulwa kwemithetho kubonisa ukubaluleka kokulawula izicelo zeseva ezinsizeni zangaphakathi ezibucayi nokuqinisekisa ukuthi imithombo ethembekile neqinisekisiwe kuphela engasebenzisana nayo.
Kungani kubalulekile namuhla? Ukwakhiwa kwezakhiwo okusekelwe emafwini kanye nama-API angaphakathi kwandisa umthelela wobuthakathaka be-SSRF, obusetshenziswa abahlaseli ukufinyelela izinsizakalo zangaphakathi ezibucayi kanye nezinhlelo ze-metadata.
Kungani i-OWASP Top 10 isabalulekile
The Ubuthakathaka obuphezulu obuyi-10 be-OWASP zibalulekile ezinhlanganweni ezihlose ukuvikela izinhlelo zazo zokusebenza ezinsongweni ezivame kakhulu neziyingozi. Lezi zingozi azizona izinkolelo-mbono; zimele izingozi zangempela ezingaholela ekuphulweni kwedatha, ekulahlekelweni kwezimali, kanye nokulimala kwedumela. Ngokubhekana nalezi zimo ezibucayi ngendlela ephumelelayo, izinhlangano zinganciphisa kakhulu ingozi yokuhlaselwa okuphumelelayo futhi ziqinisekise ukuthi izinhlelo zazo ziyakwazi ukumelana nezinsongo ezishintshashintshayo.
Ngaphezu kwalokho, ukusebenzisa izindlela zokwelapha ezinconyiwe ohlwini lwezinkinga ze-OWASP Top 10 kusiza izinhlangano ukuthi zithathe indlela ehlakaniphile yokuphepha. Isibonelo, ukuqinisa ukulawula ukufinyelela, ukuvikela imikhuba yokubethela, kanye nokunciphisa izingozi zeketanga lokuhlinzeka konke kudlala indima ebalulekile ekubhekaneni nalezi zinkinga. Ngenxa yalokho, izinhlangano zinciphisa indawo yokuhlasela, okwenza kube nzima kakhulu ngabahlaseli ukusebenzisa ubuthakathaka ohlelweni.
Njengoba izinsongo ze-cyber zishintsha, kubalulekile ukuthi izinhlangano zihlale ziphambi kobuthakathaka obungaba khona. Ngokuthatha isinyathelo kusenesikhathi, izinhlangano ziqinisekisa ukuvikelwa kwesikhathi eside kwezinhlelo zazo zokusebenza futhi zilondoloze ukwethenjwa kwabasebenzisi bazo.
Ngale kobuthakathaka bendabuko be-OWASP Top 10, izinhlangano ziya ngokuya zibhekana namaphakheji omthombo ovulekile ononya, ukuhlaselwa kokudideka kokuthembela, imikhankaso yokubhala amagama, ikhodi ekhiqizwe yi-AI engavikelekile, CI/CD pipeline ukuyekethisa, ukudalulwa kwezimfihlo, kanye ne-malware yochungechunge lokuhlinzekwa kwesofthiwe.
Izinhlelo zesimanje ze-AppSec zihlanganisa ngokwengeziwe isiqondiso se-OWASP kanye software supply chain security, ukuphepha kwe-AI, kanye nokuhlaziywa kwengozi yesikhathi sokusebenza ukuze kuxazululwe izindawo zokuhlasela ezishintshashintshayo.
Indlela i-Xygeni Esekela Ngayo Imizamo ye-OWASP kanye ne-OWASP SAMM
Ekhuluma ne Ubuthakathaka obuphezulu obuyi-10 be-OWASP kubalulekile ekuvikeleni izinhlelo zokusebenza zewebhu. Nokho, ukuvikela isicelo sakho akugcini lapho. Imodeli Yokuvuthwa Kwesiqinisekiso Sesofthiwe ye-OWASP (i-SAMM) inikeza uhlaka lokuhlola nokuthuthukisa ukuvuthwa kwakho kokuphepha kulo lonke umjikelezo wokuthuthukiswa kwesofthiwe (SDLC). Ngokuhlanganisa Amathuluzi okuphepha aphelele e-Xygeni, izinhlangano azikwazi nje ukunciphisa Ubuthakathaka obuphezulu bezokuphepha obuyi-10 be-OWASP kodwa futhi kuthuthukise ukuvuthwa kwazo kokuphepha okuphelele, njengoba kuchaziwe yi-OWASP SAMM.
Ukuqinisa Ukuphepha Kwesicelo nge-Xygeni
I-Xygeni inika amandla izinhlangano ukubhekana nalokhu uhlu lwezinkinga eziyi-10 eziphezulu ze-OWASP ngenkathi kusheshiswa ukwamukelwa kwe-OWASP SAMM, kusiza izinhlangano ukuthi zithuthuke ngokuqhubekayo ekuvuthweni kokuphepha kwesofthiwe. Ngokuzenzakalela izilawuli zokuphepha, ukuvumela ukubeka phambili okusekelwe engcupheni, kanye nokuqinisa ukuphathwa kwezigameko, i-Xygeni isiza izinhlangano ukuthi zakhe isofthiwe ephephile neqinile, okunciphisa ngempumelelo ingozi yokwephulwa kokuphepha.
Ngokuqapha ngesikhathi sangempela, ukutholwa kobuthakathaka okuzenzakalelayo, kanye nokuqiniswa kwenqubomgomo kulo lonke SDLC, I-Xygeni yenza kube lula imizamo yokuphepha kanye nokuthobela imithetho, ihambisana nemikhuba emihle kakhulu ye-OWASP SAMM. Lokhu kuvumela izinhlangano ukuthi zikhule kancane kancane ukuvuthwa kwazo kokuphepha, ngohlelo olucacile lokuthuthukiswa okuqhubekayo.
Thatha Isinyathelo Manje Ukuze Uvikele Izicelo Zakho
The Ubuthakathaka obuphezulu obuyi-10 be-OWASP qokomisa izingozi zokuphepha eziphuthumayo kakhulu ezibhekene nezinhlelo zokusebenza zesimanje. Ngokulandela Iziqondiso ze-OWASP kanye nokusebenzisa imikhuba emihle kakhulu echazwe lapha, ungakwazi vikela inhlangano yakho kulezi zinsongo futhi wakhe izinhlelo zokusebenza ezimelana nokuhlaselwa okuyinkimbinkimbi.
Qinisa Ukuphepha Kwesicelo Sakho kanye Software Supply Chain Security.
Izinhlelo zokusebenza zesimanje zidinga okungaphezu kokuskena kobungozi bendabuko. I-Xygeni kusiza izinhlangano ukuhlonza, ukubeka phambili, nokulungisa izingozi eziyi-10 eziphezulu ze-OWASP kuwo wonke amakhodi omthombo, ukuncika komthombo ovulekile, CI/CD pipelines, ingqalasizinda yamafu, kanye nemisebenzi yokuthuthukiswa okusizwa yi-AI.
Thola ukuthi i-Xygeni isiza kanjani amaqembu e-AppSec kanye ne-DevSecOps ukunciphisa ubungozi kuzo zonke izinqubo zesimanje SDLC!
