Ukuphepha ekuthuthukisweni kwesofthiwe kanye ne-DevSecOps

Informatec Digital » Izinsiza » Ukuphepha ekuthuthukisweni kwesofthiwe kanye ne-DevSecOps

Ukuphepha kwesofthiwe akuseyona into eyengeziwe ongayikhetha ekugcineni kwephrojekthi, kodwa kuyisici esibalulekile kusukela kumdwebo wokuqala wohlelo lokusebenza. Ezweni lapho ikhodi isetshenziswa khona izikhathi eziningi ngosuku futhi lapho ukuhlaselwa kwe-cyber kuyinkimbinkimbi ngokwengeziwe, ukuqhubeka nokuthembela ekubuyekezweni kwesandla ngomzuzu wokugcina kuyindlela yokuletha inhlekelele.

Ukuhlanganisa ukuphepha kuyo yonke impilo yokuthuthukiswa (kusukela emcabangweni wokuqala kuya ekunakekelweni kokukhiqiza) kuyisisekelo sezindlela ezifana ne-DevSecOps, ukuphepha okugxile kunjiniyela, kanye namamodeli e-SDLC avikelekile avela kuzinhlaka ezifana ne-OWASP SAMM noma i-NIST SSDF. Umgomo ulula ukuwusho kodwa uyinkimbinkimbi ukuwufeza: ukudala isofthiwe evikelekile ngokuklama ngaphandle kokuphazamisa ukuguquguquka kwebhizinisi nokuvimbela ukuphepha ekubeni yisithiyo.

Kuyini ukuphepha ekuthuthukisweni kwesofthiwe futhi kungani kubalulekile?

Uma sikhuluma ngokuphepha kokuthuthukiswa kwesofthiwe, sibhekisela kuzo zonke izindlela, amathuluzi, kanye nezinqubo ezisetshenziswayo ukuqinisekisa ukuthi uhlelo lokusebenza lumelana nokuhlaselwa, lugcina ubuqotho bedatha, futhi lugcina ukutholakala kwesevisi kuyo yonke impilo yalo. Akukhona nje "ukufaka i-firewall" noma ukusebenzisa ukubethela, kodwa mayelana nokuklama nokuhlela isofthiwe ngendlela eyenza ubuthakathaka bokuphepha bungabi nokwenzeka.

Ukuhlaselwa kwe-malware kanye nobuthakathaka besofthiwe kungalimaza ubuqiniso, ukugunyazwa, ubuqotho, kanye nobumfihlo. Uma lezi zinsongo zixazululwa ngesikhathi sokuklama, eziningi zingancishiswa ngaphambi kokuba zibe yinkinga ekukhiqizeni, kuvinjelwe ama-patches aphuthumayo kanye nokwephulwa kwedatha.

Umqondo oyinhloko ukuthi yonke ingxenye yesofthiwe kufanele ihlolwe ngokuphepha ngaphambi kokufinyelela kumsebenzisi, nokuthi lokhu kuhlolwa akufanele kube "isihlungi" esizimele, kodwa kunalokho kube yingxenye evamile yazo zonke izinhlobo. Lokhu kuphumela kusofthiwe eqinile engadingi ukuqoqa ungqimba phezu kongqimba lokuphepha okwengeziwe njengoba kutholakala ubuthakathaka.

Umgomo oyinhloko ukufeza izinhlelo zokusebenza ezivikelekile ngokuklama , ezinezilawuli ezakhelwe ekwakhiweni kwazo, ukuhlolwa okuzenzakalelayo okuvamile, kanye nesiko lapho abathuthukisi, ezokuphepha, kanye nemisebenzi bonke besebenzisana. Lokhu kudinga umzamo oqondile ovela eqenjini lonke lobuchwepheshe, hhayi nje eqenjini elincane lochwepheshe bezokuphepha kwe-inthanethi.

I-DevSecOps kanye nokuphepha okugxile kunjiniyela

Igama elithi DevSecOps lavela ukuze libhekane nenkinga ethile kakhulu: amamodeli endabuko, lapho ithimba lezokuphepha lijoyina khona kuphela ekupheleni komjikelezo wokuthuthukiswa, elingasahambisani nokukhishwa okuvamile, izindlela ze-agile, kanye namapayipi e-CI/CD. Ngaphambilini, ukubuyekeza uhlelo lokusebenza kanye noma kabili ngonyaka kwakuvumela ukubuyekezwa okuphelele; manje, ngokusetshenziswa okuqhubekayo, leyo ndlela isibe yisithiyo esingamukeleki.

I-DevSecOps ikhuthaza ukuhlanganiswa okungenamthungo kokuphepha ku-Agile kanye ne-DevOps , ukuze ukuphepha kohlelo lokusebenza kanye nengqalasizinda kubhekwe kusukela ekuqaleni nangokuqhubekayo. Umqondo uwukuthola nokulungisa ubuthakathaka ngokushesha nje lapho buvela, lapho kusashibhile ukubulungisa, kunokuzithola ngaphambi nje kokusetshenziswa.

Ngaphezu kwalokho, i-DevSecOps ikhuthaza ukuphepha njengomthwalo wemfanelo ohlanganyelwe : ukuthuthukiswa, imisebenzi, kanye nokuphepha kubambisana eduze, kunokusebenza ezindaweni ezizimele ezixhumana ekugcineni kuphela. Isiqubulo sale ndlela sivame ukufingqwa ngokuthi "isofthiwe, iphephile, ngokushesha": ukuletha isofthiwe esheshayo nephephile ngokuzenzakalelayo izilawuli nokunciphisa ukungqubuzana emjikelezweni wokuphila kokuthuthukiswa.

Insika eyinhloko yale filosofi ukuphepha okugxile kubathuthukisi . Esikhundleni sokuthi ithimba lezokuphepha lisebenze "njengamaphoyisa" ekupheleni kwenqubo, amathuluzi okuphepha asondezwa eduze nendawo yokusebenza yabathuthukisi, isibonelo, ngokufaka amaskena ohlelweni lokulawula i-IDE noma inguqulo. Ngale ndlela, okunye ukuhlaziya, ukuhlola, kanye nokulungisa kwenziwa ngqo kusuka kukhibhodi yomthuthukisi.

Le ndlela "yokuletha ukuphepha eduze kwekhodi" ivumela ubuthakathaka ukuthi butholakale futhi bulungiswe cishe ngokushesha nje lapho bubhalwa, ngaphandle kokulinda ukuhlolwa okwenziwa njalo noma ukuhlolwa kokungena okukhulu. Ngenxa yalokho, amaqembu okuthuthukisa ayayeka ukubona ukuphepha njengento ephazamisayo ebambezela umsebenzi wawo futhi esikhundleni salokho ayamukela njengesici esiyinhloko sekhwalithi.

Ukuphepha kwakhelwe kuzo zonke izigaba ze-SDLC.

Ukuze ukuphepha kusebenze ngempela, kumele kuhlanganiswe kuzo zonke izigaba zomjikelezo wokuphila kwentuthuko (i-SDLC), kungaphathwa njengokuhlolwa kokugcina "kwekhwalithi." Ukuphatha ukuphepha njengento ekhathazayo kuphela lapho kuvalwa iphrojekthi kudala isithiyo eqenjini lezokuphepha, ikakhulukazi njengoba bengenakukwazi ukuba ochwepheshe kuzo zonke ubuchwepheshe kanye nezimo zamafu ezisetshenziswa namuhla.

Indlela yesimanje iphakamisa ukuphepha "okuthungwe" kuyo yonke i-SDLC: kusukela ekuchazeni izidingo, ngokuhlela nokuklama, kuya ekusetshenzisweni, ekuhlolweni, ekusetshenzisweni nasekugcinweni. Yonke inhlangano igcizelela ukuthi ukuphepha kuyingxenye ebalulekile yempumelelo yomkhiqizo , hhayi ukukhathazeka okuhlukile okungahlehliswa.

Ngaphambilini, ukubuyekezwa kokuphepha kwakuwukuhlola ngesandla kanye namathuluzi ahlukanisiwe ohlelo lokusebenza noma isevisi ngayinye, okuhlanganisa ama-spot scanners nokuhlola ukungena. Namuhla, amathuluzi aklanywe ngokuhlanganiswa kanye nokwenza ngokuzenzakalela engqondweni: axhumeka kumapayipi e-CI/CD, izinhlelo zokulandelela izigameko, kanye nama-code repository, okwenza kube lula ukuhamba komsebenzi.

Izikena zobungozi zihlanganiswe enkambisweni yokuhlanganisa eqhubekayo, ngakho-ke lonke ushintsho lwekhodi luhlaziywa ngokuzenzakalelayo ngaphambi kokudlulela esigabeni esilandelayo. Ngesikhathi esifanayo, okutholakele kubhalwa njengemisebenzi ejwayelekile, ebonakala eqenjini lonke, okwenza kube lula ukubeka phambili, ukulandelela, kanye nokukala izikhathi zokuxazulula.

Konke lokhu kusho ukuthi ukuphepha akuseyona into ecatshangelwa kamuva kodwa kuba yingxenye yesakhiwo se-SDLC . Esikhundleni sokumane "udlulise ukuhlolwa kokuphepha" ngaphambi nje kokuthunyelwa, inhlangano icabanga ukuthi konke ukuzibophezela, konke ukuhlanganiswa, kanye nokulethwa ngakunye kuyingxenye yochungechunge oluqhubekayo lokuhlolwa kokuphepha.

Imikhuba evamile yokuphepha kwesofthiwe

Ngaphakathi kwale ndlela yokusebenza, kunezinhlelo eziningi zokuphepha kwesofthiwe izinhlangano eziningi esezivele zizisebenzisa noma eseziqala ukuzisebenzisa. Akulona uhlu oluphelele, kodwa kuyasiza ukuqonda ukuthi yiziphi izinhlobo zemisebenzi okufanele sizihlanganise ku-SDLC ukuze siqinise ukuphepha.

Isinyathelo sokuqala esibalulekile ukuhlaziywa kwekhodi engaguquki (i-SAST). Lokhu kuhilela ukuhlaziya ikhodi yomthombo (kufaka phakathi ingqalasizinda njengekhodi) ukuthola amaphethini wokuhlela angaphephile noma ubuthakathaka obaziwayo. Ngokuvamile kuyinqubo ezenzakalelayo engasetshenziswa kukho konke ukuzibophezela noma ukusunduza, okunikeza onjiniyela impendulo eseduze nesikhathi sangempela.

Ngakolunye uhlangothi, ukuhlaziywa kokuphepha okuguquguqukayo (i-DAST nezinye izindlela ezifanayo) kuhlola lonke uhlelo lokusebenza kanye nengqalasizinda yalo eyisisekelo ngenkathi lusebenza. Lokhu kufaka phakathi, isibonelo, ukuskena kwamachweba, ukuhlolwa kokubhala izikripthi zesayithi elihlukile, ukubuyekezwa kokucushwa kwesitsha, kanye nokuhlaziywa kwezinsizakalo ezibhekene ne-inthanethi ukuze kutholakale ubuthakathaka obubonakala kuphela lapho uhlelo lusebenza.

Kanye namathuluzi azenzakalelayo, ukubuyekezwa kwekhodi ngesandla kusabalulekile. Nakuba imisebenzi eminingi isivele ibuyekeziwe ngamaphutha anengqondo, ukufaka umbono wokuphepha kulezi zibuyekezo zekhodi kuvumela ukutholakala kobuthakathaka obungabonakali obungase buphuthelwe yisikena. Kodwa-ke, lokhu kudinga ithimba ukuba liqeqeshwe ngamaphethini okuhlasela kanye nemikhuba emihle kakhulu.

Ukuhlolwa kokungena kuqhubekela phambili: ochwepheshe baqashwa ukuba basebenze njengabahlaseli futhi bazame ukulimaza ingqalasizinda noma izinhlelo zokusebenza. Bangasebenzisa noma yini kusukela ekuhlaziyweni okuzenzakalelayo kuya ekuxhashazweni kwangempela, futhi umphumela uvame ukuba umbiko ochaza ubuthakathaka obungaphuthelwanga yizivivinyo ezijwayelekile, kanye nezincomo ezithile zokunciphisa lokho.

Indlela ehlobene kodwa ehlukile izinhlelo ze-Bug Bounty . Lo modeli umema abacwaningi nabasebenzisi abathuthukile ukuthi babike ubuthakathaka ukuze bathole umvuzo wezezimali noma ukuqashelwa. Kuyindlela ephumelelayo yokudlulisela okutholakele okuvela eceleni nokuguqula abahlaseli abangaba khona babe abahlanganyeli.

Okokugcina, akumelwe sikhohlwe ukuqeqeshwa kwezokuphepha kwabasebenzi bezobuchwepheshe . Isimo sengozi sishintsha ngokushesha: lokho okwakunengqondo eminyakeni eyishumi edlule kungaba umkhuba omubi namuhla. Ukugcina abathuthukisi benolwazi lwakamuva nge-OWASP Top 10, ukuhlaselwa okuvelayo, kanye namaphethini okuklama aphephile kunciphisa kakhulu ingozi yamaphutha abantu, okuhlala kuyimbangela yengxenye enkulu yokwephulwa kwezokuphepha.

Umjikelezo Wokuphila Wokuthuthukiswa Kwesofthiwe Evikelekile (i-SDLC Evikelekile)

Ukuhlanganisa ukuphepha ku-SDLC akukhona ukwengeza "isigaba esengeziwe" ekugcineni, kodwa kumayelana nokuhlanganisa imikhuba nokulawula ezigabeni ezikhona. Lokhu kudala inqubo eqhubekayo eletha inani langempela ngaphandle kokuphazamisa amandla eqembu. I-SDLC evikelekile ivame ukufaka lezi zigaba ezilandelayo:

Isigaba sezimfuneko sichaza ngokucacile inkinga okufanele ixazululwe kanye nezinga lokuphepha elidingekayo. Lesi yisikhathi sokuguqula izehlakalo, izicelo zezici ezintsha, kanye nobuthakathaka obaziwayo bube amaphrojekthi aqondile, ukuhlola umthelela wazo engcupheni iyonke. Ukubandakanya ithimba lezokuphepha kulesi sigaba kusiza ukubeka phambili ngempumelelo nokuqonda imiphumela yoshintsho ngalunye.

Okulandelayo kuza isigaba sokuhlela , lapho kwenziwa khona izinqumo mayelana nokuthi kuzokwakhiwa ini nokuthi kuzofinyelelwa kanjani kuso. Kubalulekile ukuthi ezokuphepha nazo zihlanganyele kulesi sigaba, ziqinisekise ukuthi ikhambi elihleliwe alilethi izithasiselo ezintsha zokuhlasela nokuthi izinhloso zebhizinisi zihambisana nokuvikelwa kwedatha, ukuthobela imithetho, kanye nezidingo zokuqina.

Isigaba sokuklama isixazululo sigxile ekwakhiweni kwezakhiwo: ukuthi yiziphi izinhlelo ezisebenzisanayo, yiziphi izinsizakalo ezidalwayo, ukuthi zihlobene kanjani, nokuthi yikuphi ukugeleza kwedatha okusungulwayo. Imidwebo kufanele ibuyekezwe nethimba lezokuphepha ukuze kutholakale ubuthakathaka obungaba khona emingceleni yokwethenjwa, ezindaweni zokungena, izindlela zokuqinisekisa, ukubethela, njalo njalo. Ukuxhumana ngoketshezi kulezi zigaba zokuqala kuvimbela ukutholakala kwezinkinga ezinkulu uma konke sekuhleliwe kakade.

Okulandelayo kuza ukuqaliswa , isikhathi sokuhumusha umklamo ube ikhodi. Yilapho imikhuba efana nokuhlaziywa okungaguquki ku-commit ngayinye, ukuhlanganisa imithetho yokuphepha kumzila we-CI, kanye nokwenza ukubuyekezwa kwekhodi ngokugxila ekuphepheni kuba yinto ebalulekile. Uma iphutha litholakala ngokushesha kukhodi, izindleko zokulilungisa ziyancipha.

Uma ikhodi isilungile, iya esigabeni sokuhlola nokuqalisa . Ngaphezu kokuhlolwa kokusebenza, kuyalulekwa ukufaka ukuhlaziywa kokuphepha okuphelele lapha: Ukuskena kwe-DAST, ukuhlolwa kokuphepha ngesandla kwemisebenzi ebalulekile, futhi, uma izinsiza zivuma, ukuhlolwa kokungena kugxile ezinguqukweni ezinkulu. Okutholakele kulesi sigaba kufanele kusetshenziswe ukulungisa amathuluzi azenzakalelayo ukuvimbela ukubuyela emuva.

Ngemva kokusetshenziswa, ukulungiswa kokuvimbela kuqala . Ngisho noma isofthiwe ikhishwa ukuze ikhiqizwe "ngaphandle kobuthakathaka obaziwayo," imvelo nezinsongo ziyashintsha: kuvela ama-CVE amasha, kutholakala amaphutha okuncika, izidingo zomthetho ziyashintshwa, njalo njalo. Isigaba sokulungisa sihlanganisa ukuqapha ubuthakathaka obusha, ukubuyekeza izingxenye, ukubuyekeza amalogi okuphepha, kanye nokuphendula ezigamekweni.

Yonke inqubo iyindilinga: iphutha ngalinye elisha, ukuthuthukiswa, noma ubuthakathaka obutholakele bubuyela esigabeni sezimfuneko . Ngakho-ke i-SDLC evikelekile iyisiyingi sokuthuthuka okuqhubekayo, hhayi indlela eqondile. Lo mqondo usiza amaqembu ukuthi athuthukise izilawuli zawo namathuluzi ngokuphindaphindwa ngakunye, esikhundleni sokucabanga ukuthi "konke sekwenziwe" ngemva kokufakwa.

Izinhlaka zokubhekisela: i-OWASP SAMM kanye ne-NIST SSDF

Ezinhlanganweni ezifuna ukuya phambili, kuyasiza kakhulu ukuthembela kumamodeli okuvuthwa asevele ekhona kanye nezinhlaka zokuthuthukiswa ezivikelekile . Ezimbili zezona ezifanele kakhulu yimodeli ye-OWASP SAMM kanye nohlaka lwe-NIST SSDF, olunikeza isiqondiso esisebenzayo sokuhlanganisa ukuphepha ezinqubweni zokuthuthukiswa.

I -OWASP Software Assurance Maturity Model (SAMM) iwukuvela kwe-CLASP yangaphambili ye-OWASP. Iphakamisa isethi yemikhuba yokuphepha ehlelwe yizizinda (njengokubusa, ukwakha, ukuqinisekisa, kanye nokusabalalisa), ngamazinga ahlukene okuvuthwa. Umqondo uwukuthi inhlangano ngayinye ivumelanisa le mikhuba nephrofayili yayo yengozi, kunokuzama ukusebenzisa uhlu oluqinile lwezilawuli.

Uhlaka Lokuthuthukiswa Kwesofthiwe Evikelekile lwe-NIST (SSDF) luchaza imikhuba eyisisekelo yokuthuthukiswa okuvikelekile ngokusekelwe ezincomweni ezivela ezinhlanganweni eziningi zochwepheshe. Luhlukanisa i-SDLC evikelekile ibe yizigaba ezine eziyinhloko: ukulungiselela inhlangano, ukuvikela isofthiwe, ukukhiqiza isofthiwe evikelekile, kanye nokuphendula ezifweni. Isigaba ngasinye sihlanganisa imisebenzi ethile engasetshenziswa kancane kancane.

“Ukulungiselela inhlangano” kusho ukulungiselela abantu, izinqubo, kanye nobuchwepheshe ukuze intuthuko evikelekile ibe umkhuba ohlanganisa yonke indawo, kokubili ezingeni lenkampani kanye nangaphakathi kwethimba ngalinye. “Ukuvikela isofthiwe” kuhlanganisa izinyathelo zokuvimbela ukuphathwa kabi kwekhodi okungagunyaziwe, ukwakhiwa kwezinto zobuciko, kanye nochungechunge lokuhlinzeka.

Ibhulokhi "yokukhiqiza isofthiwe evikelekile" igxile ekunciphiseni ubuthakathaka kunguqulo ngayinye , ihlanganisa ukuhlaziywa okungaguquki, ukubuyekezwa kokuxhomekeka, ukuskena kwesitsha, kanye nezilawuli ezifanayo ekusebenzeni kwansuku zonke. Okokugcina, "ukuphendula ubuthakathaka" kubhekisela ekuboneni amaphutha anganakwa, ukuwalungisa ngokushesha, nokulungisa inqubo ukuze kuvinjelwe ukuphinda kwawo.

Ukuqeqeshwa, Ukumodela Okusongelayo kanye nesiko lokuphepha

Ukuze konke lokhu kusebenze, ukufaka nje amathuluzi akwanele; kudinga ukwakha isiko lokuphepha elihlanganyelwe ngaphakathi kwethimba. Lokhu kusho ukuthi abathuthukisi kumele baqonde ukuthi ukuvikela izinhlelo zokusebenza kuyingxenye yomsebenzi wabo nokuthi amaqembu okuphepha kumele ahlanganiswe emisebenzini yansuku zonke, hhayi nje lapho kwenzeka isigameko.

Ukuqeqeshwa okukhethekile kuyisiqalo esihle. Ukunika amandla onjiniyela ukuthi babone ubuthakathaka futhi babhale ikhodi ephephile kakhulu kunciphisa kakhulu ukwenzeka kwamaphutha ayisisekelo. Izinsizakusebenza ezifana ne-OWASP Top 10 zisiza ekuboneni ubuthakathaka obuvame kakhulu kuzinhlelo zokusebenza zewebhu futhi ziqonde ukuthi abahlaseli bacabanga kanjani.

Omunye umkhuba onomthelela omkhulu yi- Treat Modelling . Lokhu kuhilela ukuhlaziya uhlelo lokusebenza (noma isici esisha) ngokombono womhlaseli: ukuthi yiziphi izimpahla ezidinga ukuvikelwa, yiziphi izinto ezifakiwe, yikuphi ukugeleza kwedatha okubalulekile, nokuthi yiziphi izithiyo ezingase zisetshenziswe. Ngokusekelwe kulolu hlaziyo, izindlela zokunciphisa ziklanywa futhi zifakwe kumklamo wobuchwepheshe ngokwawo.

Uma kwenziwa ngesikhathi sesigaba sokuklama, ukumodela kokusongela kuthonya ukwakheka kusukela ekuqaleni , kuvimbele izixazululo ezingavikelekile ezizodinga ukubhalwa kabusha kamuva. Imidwebo yokugeleza kwedatha kanye namaphethini okuhlasela aziwayo ngokuvamile asetshenziselwa ukuhlela ukuhlaziywa, okubandakanya kokubili amaqembu okuthuthukisa kanye nawokuphepha.

Ngesikhathi esifanayo, kubalulekile ukukhuthaza amaqembu okuthuthukisa ukuthi afunde ukucabanga njengomhlaseli . Lokhu akusho ukuthi wonke umuntu kudingeka abe ngumhloli wokungena ochwepheshe, kodwa kunalokho ukuthi baqonde ukuthi ubuthakathaka obuncane buhlangana kanjani ukudala ukuhlasela okukhulu, ukuthi iziqinisekiso zebiwa kanjani, noma ukuthi ukucushwa kwamafu okubuthakathaka kusetshenziswa kanjani kabi.

Imikhawulo yokuhlolwa kokungena kwendabuko

Ukuhlolwa kokungena kwendabuko kusalokhu kuyithuluzi eliwusizo, kodwa kunemikhawulo uma kusetshenziswa ezindaweni ezinokusetshenziswa okuqhubekayo. Ngokwencazelo, i-pentest inikeza isithombe sokuphepha ngesikhathi esithile: ihlola isimo sesicelo kanye nengqalasizinda njengoba zinjalo ngalolo suku.

Lapho nje ithimba lisebenzisa izinguqulo ezintsha noma lishintsha ukucushwa, okunye okutholakele kungase kuphelelwe yisikhathi . Uma ukukhishwa kuvame ukwenzeka, ukugcina ukuhlolwa okugcwele kokungena ngemva koshintsho ngalunye kuba yinto engasebenzi ngokwesikhathi kanye nezindleko.

Ngaphezu kwalokho, lapho kwenziwa ukuhlolwa kokungena ezigabeni ezithuthukile kakhulu zomjikelezo wokuphila kwentuthuko, ubuthakathaka obutholakalayo buvame ukubiza kakhulu ukubulungisa , ngokuvamile kudinga izibuyekezo zokuphepha eziyinkimbinkimbi . Ngezinye izikhathi lokhu kuhilela ukuguqula izingxenye ezibalulekile noma ukubhala kabusha izingxenye eziphelele zohlelo lokusebenza, okuphumela ekuhleleni, kwisabelomali, kanye nasekukhuthazeni kweqembu.

Futhi ezinhlanganweni ezinezinsizakalo eziningi kanye nezinhlelo zokusebenza, kunzima ukukhulisa ukuhlolwa kokungena ngesandla kulo lonke ikhathalogi. Kunomkhuba wokubeka phambili izinhlelo ezibaluleke kakhulu kuphela, okushiya izikhala kwezinye izindawo ezingasetshenziswa futhi ngabahlaseli.

Ukuhlolwa kokuphepha okuqhubekayo kwamapayipi e-CI/CD

Ukuze kuvumelane nalesi sivinini soshintsho, kuvela amamodeli afana nokuhlolwa kokuphepha okuqhubekayo kuphayiphi ye-CI/CD, ahlanganisa ukuskena okuzenzakalelayo okungu-24/7 nokuhlolwa okuqondiwe kanye ngesandla. Umqondo uwukushintsha kusuka ekuhlolweni okungahleliwe uye ekugelezeni okuqhubekayo kokutholwa kobuthakathaka kanye nokulungiswa.

Le ndlela ihlanganisa ama-scanner azenzakalelayo ahlola izinhlelo zokusebenza, amafa ewebhu, ama-API, kanye nezindawo eziveziwe kanye nokungenelela kochwepheshe bokuhlola ukungena abaphenya okutholakele okuyinkimbinkimbi kakhulu futhi babheke ubuthakathaka obunengqondo amathuluzi angenakububona eyedwa.

Inzuzo enkulu ukuthi amaqembu athola ulwazi olusheshayo nolunemininingwane mayelana nezinkinga zokuphepha, noma ngabe ipayipi le-CI/CD lishesha kakhulu. Lokhu kunciphisa ithuba lokudalulwa ngoba ubuthakathaka buyahlonzwa futhi bulungiswe ngaphambi kokuba ikhodi ethintekile ifinyelele (noma ihlale) ekukhiqizweni isikhathi eside.

Enye inzuzo ukuthi ukuhlolwa okuqhubekayo kwenza kube lula ukuxhumana phakathi kokuphathwa kobuthakathaka kanye nokuphepha kohlelo lokusebenza . Imibiko evame ukwenzeka, enohlu olucacile lobuthakathaka kanye nokuvela kwabo ngokuhamba kwesikhathi, iyasiza ekwenzeni izinqumo zobungozi, ukubeka phambili ukulungiswa, kanye nokuthethelela ukutshalwa kwezimali ekuthuthukisweni kokuphepha.

Ezinye izinsizakalo zinikeza ngisho nokuhlolwa kabusha kwamahhala ngemva kokusebenzisa izilungiso, okukuvumela ukuthi uqinisekise ukuthi izixazululo ziyasebenza ngempela nokuthi akukho ukubuyela emuva okuye kwethulwa. Konke lokhu kuhambisana kahle nezimiso zokuthuthukiswa okuqhubekayo kwe-DevSecOps.

Izingxenye namathuluzi ajwayelekile e-DevSecOps

Empeleni, indawo ye-DevSecOps incike ezingxenyeni eziningana ezibalulekile zobuchwepheshe . Ukuhlanganiswa okuqhubekayo (i-CI) kuhlanganisa umsebenzi wabo bonke abathuthukisi futhi kusebenzisa ngokuzenzakalelayo ukuhlolwa kweyunithi, ukuhlanganiswa, kanye nokuphepha njalo lapho ikhodi entsha ihlanganiswa.

Ukulethwa okuqhubekayo (i-CD) kuqinisekisa ukuthi isofthiwe ihlala ilungele ukusetshenziswa ngokuqinisekisa nokuvuma isofthiwe ngokulandelana (kufaka phakathi ukuhlolwa kokuphepha) esigabeni ngasinye. Izinguqulo ezidlula zonke izilawuli ezichaziwe kuphela ezikhushulelwa ezindaweni eziphakeme.

Ukuzenzakalela kokuphepha kufezwa ngamathuluzi e-SAST ne-DAST, izikena zokuncika, ukuhlaziywa kwengqalasizinda njengekhodi, kanye nokubuyekezwa kweziqukathi. Lawa mathuluzi ahlanganiswe kuphayiphi ye-CI/CD, ezinhlelweni ezifana neJenkins, i-GitLab CI, noma ezifanayo, ngakho asebenza ngaphandle kokungenelela ngesandla.

Izixazululo zokuphathwa kobungozi zivame ukusetshenziswa ukuhlanganisa okutholakele, ukubeka phambili izingozi, nokulandelela ukuxazululwa kwazo. Kanye nalokhu, amathuluzi okuphatha izimfihlo (njenge-Vault) avimbela iziqinisekiso nezihluthulelo ukuthi zingadalulwa kukhodi noma ekucushweni kokusetshenziswa.

Okokugcina, ukuqapha okuqhubekayo nokuhlola kuncike ekuqapheleni kanye namapulatifomu e-SIEM (njenge-ELK noma i-Splunk) aqoqa izingodo, athole ukuziphatha okungavamile, futhi enze kube lula ukuhlolwa kokuhambisana nomthetho. Lolu ngqimba luqeda iluphu, okuvumela ukutholakala kwezigameko zokukhiqiza kanye nokuphendula ngesikhathi.

Ukusebenzisa i-DevSecOps ekuthuthukisweni kohlelo lokusebenza lweselula

Uma sikhuluma ngezinhlelo zokusebenza zeselula , indlela ye-DevSecOps kumele ivumelane nezici zayo ezithile. Isigaba sokuhlela nokuklama kumele sicabangele izingozi ezithile: ukuphathwa kwemvume yedivayisi, isitoreji esivikelekile seziqinisekiso, ukubethela kokuxhumana, kanye nokuhambisana nemithetho efana ne-GDPR.

Ngesikhathi sokuthuthukiswa, kusetshenziswa amaskena e-SAST ajwayele izilimi ezifana ne-Kotlin, i-Swift, ne-Java, futhi ukuncika kwangaphandle kanye nama-SDK kubuyekezwa ngokucophelela. Ubuthakathaka obuningi kuzinhlelo zokusebenza zeselula buvela ngqo emitatsheni yezinkampani zangaphandle enganakekelwa kahle noma kulezo ezinezimvume eziningi.

Esigabeni sokuhlola, ukuskena kwe-DAST kuhlanganiswa nokuhlolwa okuqondene neselula : ukulingiswa kokuhlasela komuntu ophakathi nendawo (i-MITM), ukuqinisekiswa kobuqotho be-binary, ukuhlaziywa kwesitoreji sendawo, kanye nokubuyekezwa kokusebenzisana kwe-backend API. Lokhu kusiza ukuhlonza amaphutha kokubili kuhlelo lokusebenza kanye nezinsizakalo ezisetshenziswayo.

Ukuhlanganiswa kwepayipi le-CI/CD kusho ukuthi yonke inkontileka ihlolwa ngokuzenzakalelayo ukuphepha , okuqinisekisa ukuthi ayikho inguqulo enamaphutha amakhulu efinyelela ezitolo zezinhlelo zokusebenza. Ngaphezu kwalokho, uhlelo lokuqapha ngemuva kokuthunyelwa luhlelwe ukuthola ukuziphatha okungavamile, ukwanda kwamaphutha, noma amaphethini angabonisa ukuhlaselwa.

Okokugcina, inqubo ecacile yokusabela ezigamekweni ichazwa ukuze kuvunyelwe ukukhishwa okusheshayo kwama-patches aphuthumayo uma kutholakala ubuthakathaka obukhulu ekukhiqizweni. Ikhono lokusabela nokuvuselela uhlelo lokusebenza ngokushesha liyisihluthulelo sokugcina ukwethenjwa komsebenzisi.

Uma zihlanganiswa, zonke lezi zindlela, izinhlaka, namathuluzi kuvumela ukuphepha ukuthi kuyeke ukuba yisithiyo futhi kube umngane wentuthuko esheshayo. Ngokubandakanya onjiniyela kusukela ekuqaleni, ngokuzenzakalelayo ukuhlola ngoshintsho ngalunye, kanye nokusebenzisa amazinga afana ne-OWASP SAMM noma i-NIST SSDF, izinhlangano zingakha isofthiwe eqinile, zinciphise izindleko zokulungiswa kwamaphutha, futhi zilungele kangcono indawo esongelayo ehlala ishintsha.