Isithwebuli sokuzivikela esisebenzayo kanye nobuthakathaka sama-API

Informatec Digital » Izinsiza » Isithwebuli sokuzivikela esisebenzayo kanye nobuthakathaka sama-API

Isimo samanje sokuphepha kwe-inthanethi siphawulwe yi- ukuqhuma kobuthakathaka kanye nokusetshenziswa okukhulu kwama-API ezixhuma cishe yonke into: izinhlelo zokusebenza zewebhu, ama-microservices, amaselula, i-SaaS, kanye nezinhlelo zangaphakathi. Ukwethula isici esisha ngoLwesihlanu nokuthola ngoMsombuluko ukuthi othile usebenzise i-endpoint engaqinisekisiwe noma i-bug yokufaka ubungozi akuseyona into yefilimu; kuyinto yansuku zonke ezinkampanini eziningi.

Kulo mongo, inhlanganisela ye Izikena zokuzivikela ezisebenzayo kanye nobuthakathaka zama-API Sekuyinto egxile kakhulu. Akusanele ukubuyekeza amalogi noma ukwenza isivivinyo esisodwa kanye ngonyaka; kufanele uthole wonke ama-API (kufaka phakathi "ayisithunzi"), uwahlole ngokuzenzakalelayo ngaphambi kokusetshenziswa, futhi uqaphe okwenzekayo ekukhiqizweni ngesikhathi sangempela. Futhi konke lokhu ngaphandle kokuqeda amandla amaqembu okuthuthukisa ngamaphutha angamanga noma ukusebenzisa amathuluzi okungenakwenzeka ukuwagcina.

Kungani ama-API engomunye wemithombo emikhulu yengozi namuhla

Izakhiwo eziningi zesimanje zithembele kuma-API afana nalawa isiteshi esiyinhloko sokudalula idatha kanye ne-logic yebhizinisiLokhu kwandisa indawo yokuhlasela: yonke indawo yokugcina, yonke ipharamitha, kanye nayo yonke indlela yokuqinisekisa kungaba umnyango ovulekile uma kungalawulwa kahle.

Imibiko yemboni ikhombisa ukwanda okunonya kwezigameko ezixhumene nama-API nezinhlelo zokusebenza zewebhukanye nemikhakha efana nezinsizakalo zezimali ethinteke kakhulu. Ngaphezu kwalokho, izinhlangano ezifana neGartner kanye ne-OWASP bezilokhu zixwayisa isikhathi esithile ukuthi ukuhlaselwa kwe-API akugcini nje ngokwanda, kodwa futhi kunomthelela, kuvuza idatha ephindwe kayishumi kunezinye izenzo zokwephulwa ezivamile.

Phakathi kwezinto ezandisa ingozi, okulandelayo kuyagqama: Ukusabalala kwe-API (ukwanda okungalawulwa kwama-API)Ukuntuleka kwempahla ebuyekeziwe, izinguqulo ezindala ezisatholakala kalula ("zombie"), kanye nama-endpoints angaphakathi adalulwe ngephutha konke kuyizinto ezibangela lokho. Uma kungekho muntu ocacile ngokuthi yimaphi ama-API akhona noma ukuthi angawasebenzisa kanjani, kuyindaba yesikhathi nje ngaphambi kokuba kuvele ubuthakathaka obukhulu.

Okungeziwe kulokhu ukwanda kwe Ikhodi ekhiqizwe yi-AI kanye nemikhuba efana "nokubhala ikhodi ye-vibe"Abathuthukisi kanye nabasebenzisi abangebona ochwepheshe bakhiqiza inani elikhulu lekhodi kanye nezindawo zokugcina besebenzisa iziyalezo zolimi lwemvelo. Ukukhiqiza kuyanda, kodwa futhi namathuba okuthola imikhuba emibi ngengozi, imitapo yolwazi esiphelelwe yisikhathi, noma amaphethini okuphepha aphansi.

Umphumela uba yisimo lapho ukutholakala kusenesikhathi kwamaphutha okuphepha kuma-API nezinhlelo zokusebenza kungaseyona into yokuzikhethela: Kungumbandela ophansi ukugwema ukuzithola usezindabeni ngenxa yokwephulwa kwemithetho.

Ukuphathwa kobungozi besimanje kwama-API nezinhlelo zokusebenza

Ukuphathwa kobungozi bokuphepha kohlelo lokusebenza akusagcini nje ngokuskena kwaminyaka yonke. Sikhuluma nge inqubo eqhubekayo nehlelekile ihlanganisa konke kusukela kukhodi yomthombo kuya ku-API evezwe ekukhiqizweni, kufaka phakathi iziqukathi, ingqalasizinda njengekhodi (IaC), kanye nezinsizakalo zamafu.

Le ndlela ihlanganisa izici eziningana: ukutholakala kwempahla, ukuhlaziywa kwe-static (SAST), ukuhlaziywa kwe-dynamic (DAST), ukuhlolwa kwe-API ethile, ukuphathwa kwe-patchUkubeka phambili okusekelwe engcupheni kanye nokuqapha okusebenzayo. Konke lokhu kuhambisana nemithetho efana ne-GDPR, i-PCI DSS, kanye nezinhlaka ze-NIST, esezidinga kakade izindlela zokubhala ikhodi eziphephile kanye nobufakazi bokuhlaziywa.

Ezingeni lesicelo, ubuthakathaka obujwayelekile buqala ku- Ukuhlasela kwe-SQL injection kanye ne-Cross-Site Scripting (XSS), ukuqinisekiswa okuphukile, ukuvezwa kwedatha ebucayi, noma ukusetshenziswa kwezingxenye eziphelelwe yisikhathiKuma-API, inkomba yi-OWASP API Security Top 10, ehlanganisa izingozi ezifana nalezi:

• I-BOLA (Ukugunyazwa Kwezinga Lezinto Eziphukile): ukufinyelela ezintweni zabanye abasebenzisi ngokushintsha i-ID.
• Ukuqinisekiswa okungalungile kanye nokugunyazwa okuvumela ukuzenza ongeyena abasebenzisi.
• Ukusetshenziswa kwezinsiza okungenamkhawulo, okuvula umnyango wokuhlaselwa kokwenqatshwa kwenkonzo.
• Ukucushwa okungavikelekile, ama-endpoints akhohliwe, noma izinguqulo ezindala zisatholakala.
• Ukusetshenziswa okungaphephile kwama-API ezinkampani zangaphandle, kuncike ezimpendulweni ngaphandle kokuqinisekiswa okuqinile.

Ukuphathwa okuhle kobuthakathaka kufanele kuhlonze lezi zinkinga kokubili izincazelo zekhodi kanye ne-API njengasekuziphatheni kwangempela kokusebenzisa izinhlelo zokusebenza, futhi wenze kanjalo ngendlela ephindaphindwayo, ezenzakalelayo, nelinganisekayo.

Ukuhlaziywa okuqinile nokuguquguqukayo kanye nokuhlolwa okuqondile kwama-API

Kuhlelo lokuvikela lwe-API olusebenzayo, ama-scanner obungozi awayona into eyengeziwe, ayi- injini evumela ukuthi amaphutha atholakale ngendlela ehlelekile ngaphambi kokuba abanye bawathole. Yilapho imindeni eminingana yamathuluzi ahambisanayo idlala khona indima.

Ukuhlaziywa kwe-Static (SAST) kuhlola ikhodi yomthombo noma i-binary ngaphandle kokuyisebenzisaIbheka amaphethini engozi afana nokujova, ukugcwala ngokweqile, ukusetshenziswa kwe-API okungaphephile, izimfihlo ezifakiwe, noma ukuncika okusengozini. Ihlangana nombhobho we-IDE kanye ne-CI ukuze onjiniyela bathole impendulo ngenkathi bebhala noma ngaphambi kokuhlanganisa.

Ukuhlaziywa kwe-Dynamic (DAST) kugxile ku- uhlelo lokusebenza luyasebenza, kuthunyelwa izicelo njengoba umhlaseli ebengenzaKuwusizo kakhulu ekutholeni ukungalungiselelwa kahle, ukuqinisekiswa okunganele, izinkinga zeseshini, noma imizila evela kuphela ngokusebenzisana kwangempela. Amathuluzi alolu hlobo alingisa ithrafikhi ye-HTTP/HTTPS futhi ahlole ukusabela okungavamile, amakhodi amaphutha asolisayo, noma izimpendulo ezinedatha eningi kunokulindelekile.

Endaweni ethile yama-API, kunezelwa izivivinyo ezizinikele, njenge:

• Ukungena ngaphakathi: ukuthumela ngobuningi idatha engahleliwe noma engahlelekile ukuze kubonwe ukuthi indawo yokugcina iphendula kanjani.
• Ukuhlolwa kokufakwa (i-SQL, imiyalo, i-LDAP, njll.) okwenzelwe inkontileka ye-API.
• Ukuguqulwa kwamapharamitha nama-ID ukuze kuhlolwe i-BOLA noma ukwenyuka kwamalungelo.
• Ukuqinisekiswa kwesabelo kanye nezilawuli zemikhawulo ukuvimbela ukusetshenziswa kabi okuzenzakalelayo kokuhamba kwebhizinisi.

Konke lokhu kugcwaliswa ngamathuluzi ahlola ingqalasizinda: izikena zenethiwekhi kanye nomsingathi (njenge-Nessus noma i-Qualys), izixazululo zeziqukathi kanye namapulatifomu e-IaC, kanye ne-CNAPP ezihlanganisa ukubonakala phakathi kwamafu, ama-Kubernetes, ama-microservices, nama-API.

Ukutholwa kwe-API kanye nokufakwa kwempahla: inkinga yalokho ongakuboni

Enye yezinto ezibangela ubuhlungu obukhulu ukwazi ukuthi yimaphi ama-API akhona ngempela enhlanganweniPhakathi kwamaphrojekthi amadala, ama-PoC, izinsizakalo zangaphakathi ezigcine ziveziwe, kanye nezinguqulo v1, v2, v3 ezihambisanayo, kulula ukulahlekelwa ukulawula.

Amapulatifomu okuphepha e-API yesimanje agxile ku- ukutholwa okuzenzakalelayoNgokusekelwe ekuhlaziyweni kwethrafikhi (ngokuhlanganiswa namasango, amaphroksi, noma ama-WAF), ama-code repository, izincazelo ze-OpenAPI/Swagger, noma ukuhlanganiswa nama-Kubernetes kanye nefu, bayakwazi ukwakha uhlu lwama-endpoints asetshenziswayo, ngolwazi olufana nalokhu:

• Umsingathi, indlela, indlela ye-HTTP, kanye namapharamitha amukelwe.
• Idatha ebucayi engase ivezwe emzileni ngamunye.
• Kungakhathaliseki ukuthi indawo yokugcina idinga ukuqinisekiswa noma ivumela ukufinyelela okungaziwa.
• Izinguqulo ezisebenzayo nezingokomlando ze-API ngayinye.

Kuma-API amasha anemininingwane ethile, amathuluzi afana I-Auto Swagger noma amapulatifomu afana ne-42Crunch Zivumela, kusukela ku-schema uqobo, ukuqaliswa kwama-test suites okuphepha ngaphandle kwesidingo sokuhlela ukuhlolwa ngakunye ngesandla. Ngale ndlela, ukumane unikeze inkontileka ye-API kwanele ukuthi iskena sikwazi ukuskena ngokuhlelekile zonke iziphetho kanye nezimo ezihleliwe.

Lokhu okutholiwe akusizi nje kuphela "ukuba nohlu oluhle"; kuyindawo yokuqala yokufaka isicelo Izinqubomgomo zokuzivikela ezisebenzayo: ukuvimba ama-endpoints aphelelwe yisikhathi, ukuqinisa ukuqinisekiswa lapho kungekho khona, kanye nokubeka phambili ukuhlolwa ezindleleni ezibucayi.

Ukuzivikela okusebenzayo: inhlanganisela yokuhlola kanye nokuqapha ngesikhathi sangempela

Uma kukhona okucacile eminyakeni yamuva nje, yilokho ukuphepha okusebenzayo kuphela kuyasilelaUkulinda ukuthola isigameko kuphela uma i-alamu ivuliwe ekukhiqizweni kufana nokufaka i-alamu yasekhaya ngemva kokugqekezwa kokuqala.

Ukuzivikela okusebenzayo kuma-API kusekelwe ku- imodeli enezingqimba okuhlanganisa:

• Ukuskena kwangaphambi kokukhiqiza okusebenzayo (i-SAST, i-DAST, ukuhlolwa kwe-API ethile).
• Ukuqapha ithrafikhi ngesikhathi sangempela ekukhiqizweni ukuze kutholakale ukuziphatha okungavamile.
• Amandla okuphendula okuzenzakalelayo noma okungahleliwe okuhlasela amaphethini.

Abahlinzeki abanjengo-F5, uSalt Security, u-Akamai, nabanye abadlali kulo mkhakha bebelokhu befaka amakhono Ukuhlolwa kwe-Contextual API, ukutholwa okusekelwe ekuziphatheni kanye nokuxhumana nobuhlakani bezingoziUmqondo uwukuqonda ukuqonda kwephuzu ngalinye lokugcina (lokho elikwenzayo, idatha eliyiphathayo, ukuthi ubani okufanele alibize) bese uvumelanisa ukuhlolwa kanye nemithetho yokuthola kulowo mongo, esikhundleni sokusebenzisa amathempulethi ajwayelekile.

Isibonelo, ikhambi lokuvikela elisebenzayo lama-API lingenza lokhu:

• Thola wonke ama-endpoints adaluliwe, kufaka phakathi nalawo angabhalisiwe.
• Hlola iphuzu ngalinye lokugcina ngaphambi kokukhiqiza ngamakesi okujova, ukuguqulwa kwamapharamitha, ukufiphaza, kanye nokuhlolwa kokuqinisekisa.
• Gada izicelo ezisolisayo ngesikhathi sangempela (ukwenyuka kwesilinganiso, izinguquko ezisheshayo kumaphethini okusetshenziswa, imizamo yokubala i-ID ezenzakalelayo).
• Vimba izicelo ezinonya, beka imingcele ngomsebenzisi ngamunye noma ithokheni, bese wazisa ithimba lezokuphepha ngemininingwane eyanele yokuphenya.

Lesi sendlalelo sesikhathi sokusebenza sibalulekile ngoba, Kungakhathaliseki ukuthi amaskeni akho amahle kangakanani, kuzohlala kukhona ubuthakathaka obungaziwa. noma izinguquko ebhizinisini eziletha izingozi ezintsha. Ukuqapha bukhoma kusebenza njengomugqa wokugcina wokuzivikela ekuhlaselweni okudlula ekuhlolweni kwangaphambilini.

Ukuqinisekiswa, ukugunyazwa, kanye nokulawulwa kokufinyelela kuma-API

Akukho sithwebuli esingathatha indawo yomklamo ofanele wezilawuli zokufinyelela. ukuqinisekiswa okuqinile kanye nokugunyazwa Zihlala zisenhliziyweni yokuphepha kwe-API, kokubili ezingeni lokwakhiwa kwesicelo kanye nasekucushweni kwamafu.

Namuhla, cishe wonke ama-API esimanje athembele enhlanganisweni ye- Amathokheni e-OAuth 2.0, i-OpenID Connect kanye ne-JWT ukuphatha ukuthi umsebenzisi ungubani nokuthi yini angayenza. Lawa mathokheni kumele abe nosuku lokuphelelwa yisikhathi olufanele, ama-scope achazwe kahle, ukujikeleza okuvamile, futhi, vele, adluliselwe njalo nge-HTTPS.

Ngaphezu kokuqinisekisa, kuyadingeka ukufaka isicelo izilawuli zokugunyazwa ezingeni lento nomsebenziAmamodeli afana ne-RBAC (ukulawula okusekelwe ezindimeni) kanye ne-ABAC (ukulawula okusekelwe ezimpawini) avumela ukumepha okuhlanganisiwe kwezimvume: umsebenzisi angabuza idatha yakhe, umqhubi angabuka ulwazi oluhlanganisiwe, umlawuli angadala noma asuse izinsiza, njll.

Izindawo zamafu zenza kube lula lokhu kubumbana nge Izinqubomgomo ze-IAM ku-AWS, Azure, kanye ne-Google CloudLezi zinqubomgomo zifinyelela kumasango e-API, imisebenzi engenaseva, kanye nezinsizakalo eziphethwe. Ukuhlela kahle lezi zinqubomgomo kuvimbela indawo yokugcina yokuphatha ukuthi ingafinyeleleki kunoma ubani onesicelo se-HTTP esilula.

Ama-API scanner ngokwawo angasiza ekuqinisekiseni lokho Izindlela okuthiwa zivikelekile empeleni zidinga amathokheni asebenzayoukuthi amathokheni aphelelwe yisikhathi awamukeleki, ukuthi amalungelo okukhulisa ngokushintsha insimu ye-JSON awavunyelwe, nokuthi umsebenzisi akanakufinyelela izinsiza zomunye umsebenzisi ngokushintsha isihlonzi.

Imikhuba emihle kakhulu kanye nomsebenzi wokutholwa okuqhubekayo

Ukuze ukuzivikela okusebenzayo kanye nokuskena kobungozi be-API kusebenze nsuku zonke, konke lokhu kudinga ukwenziwa ngendlela inqubo ephindaphindwayo ehlanganiswe nomjikelezo wokuthuthukiswaAkusizi ngalutho ukuba namathuluzi anamandla uma kungekho muntu owabukayo noma uma evimba umsebenzi wamaqembu.

Eminye imikhuba ebalulekile eqala ukusungulwa yile:

• ukushintsha kwangempela kwesobunxele: Faka ukubuyekezwa kokuphepha kusukela esigabeni sokuklama, usebenzisa amathempulethi e-API avikelekile, imithetho ye-linter, kanye nokuhlaziywa okuzinzile kukho konke ukuzibophezela.
• Ukuskena kwe-CI/CD okuzenzakalelayo: I-SAST esheshayo kuzo zonke izicelo zokudonsa, i-DAST kanye nokuhlolwa kwe-API okuphelele emagatsheni okuhlanganisa noma ezindaweni zokubeka izigaba.
• Imikhawulo yekhwalithi kanye namasango: chaza ukuthi yikuphi ubucayi bokungakwazi ukuzivikela okuvimbela ukuthunyelwa nokuthi yikuphi okwamukelwa okwesikhashana ngohlelo lokulungisa.
• Sula ama-KPI (i-MTTD, i-MTTR, isikweletu sobungozi esivulekile, ukumbozwa kokuskena) ukuze ulinganise ukusebenza kahle kohlelo.
• Imfundo eqhubekayo kanye nesiko lokuphepha: ukuthi onjiniyela bayaqonda izinkinga ezitholwa amathuluzi nokuthi bangazixazulula kanjani kahle.

Ezinhlanganweni ezinamaqembu amaningi noma ubuchwepheshe obuhlukahlukene kakhulu, kuvamile ukuhlanganisa izixazululo: isibonelo, izikena zezentengiselwano ezinamadeshibhodi athuthukile kanye nokubika kanye nohlelo lwamathuluzi omthombo ovulekile (i-Semgrep, i-CodeQL, i-OpenVAS, izikena eziyimfihlo njenge-GitGuardian noma i-Trufflehog, njll.) ukuze kulungiswe imithetho, kuhlanganiswe izilimi ezithile noma kuqinisekiswe imiphumela.

Amapulatifomu athuthukile njengeSentinelOne, Snyk, Aikido Security, F5 noma afanayo afunwa ngqo. Hlanganisa lezi zendlalelo: ukutholwa, ukuskena, ukuhambisana kwengozi, kanye nokuvikelwa kwesikhathi sokusebenzaKuhlanganiswe namathuluzi e-SIEM, i-SOAR kanye namathikithi, aguqula okutholakele kobuchwepheshe kube yimisebenzi esebenzisekayo.

Izinselele ezivamile lapho kusetshenziswa ukuzivikela okusebenzayo kanye nendlela yokuzilawula

Ukusebenzisa konke lokhu akuwona umsebenzi onzima. Izinhlangano eziningi zingena inqwaba yezexwayiso, ukuntuleka kwabasebenzi abangochwepheshe, kanye nezikweletu zobuchwepheshe eziqongelelekile ezinhlelweni ezindala ezingenakuvinjelwa noma zithintwe kalula.

Enye yezinkinga ezivame ukuvela njalo yi- ukukhathala okuqaphileAma-scanner akhiqiza amakhulu noma izinkulungwane "zobuthakathaka" okungenzeka, empeleni, zingasetshenziswa kabi noma zibe nomthelela ophansi kakhulu. Uma lokhu kwenzeka, amaqembu aqala ukunganaki imibiko, futhi ithuluzi liba umsindo wangemuva.

Ukuze ugweme lokhu, kubalulekile ukulungisa imithetho, ukwenza ngezifiso izinqubomgomo, nokuthembela ezixazululweni ezizokuvumela ukuthi wenze lokho. kakade zifaka izindlela zokunciphisa imiphumela emibi engamanga, ukubeka phambili ngomongo (isibonelo, uma i-API ivezwe kwi-inthanethi, uma iphatha idatha ebucayi, uma indawo yokugcina isetshenziswa ngempela) kanye, lapho kungenzeka khona, ukuqinisekiswa kokuxhashazwa okuzenzakalelayo.

Esinye isithiyo isivinini semijikelezo ye-DevOps. Uma ukuskena kuthatha isigamu sehora futhi kuvimbela yonke into eyakhiwe, abathuthukisi bazokwenza konke okusemandleni abo ukuyikhubaza. Isixazululo siku Sebenzisa ukuhlaziya okusheshayo okuqhubekayo ezinguqukweni ezincane futhi ubhukhele ukuskena okugcwele ngezikhathi ezithile (isibonelo, ukwakhiwa kwansuku zonke noma ngaphambi kokufakwa okukhulu).

Okokugcina, izinhlelo ezindala kanye nezikweletu zobuchwepheshe zidinga indlela ehlukaniswe ngezigaba: kuqala kuqala izimpahla ezibaluleke kakhulu, ezibonakala kakhulu kanye nenani lebhizinisiSebenzisa ama-patches noma izinyathelo zokubuyisela (i-WAF, ukuhlukaniswa kwenethiwekhi, ukuqinisa ubuqiniso) bese uhlela isikhathi esimaphakathi. ukulungiswa kwesimanje kusukela ezingxenyeni ezibuthakathaka kakhulu.

Njengoba kunikezwe konke lokhu, okwenza umehluko akukhona ukuba "nethuluzi eliphelele", kodwa ukufaka isethi yezixazululo ezinengqondo enqubweni ecacile, enezindima ezichaziwe kanye nokusekelwa kwabaphathiNgakho-ke ukuvikela ngenkuthalo ama-API nezinhlelo zokusebenza kuba umkhuba ojwayelekile ekuthuthukisweni nasekusebenzeni, hhayi ukwethuka ngomzuzu wokugcina njalo lapho umuntu ecela ukuhlolwa.

Uma kubhekwa izinga lapho inani lobuthakathaka likhula khona, izindleko zokwephulwa komthetho, kanye nokubaluleka kwama-API kunoma yiliphi ibhizinisi ledijithali, ukukhetha imodeli ye Ukuskena okuqhubekayo, ukuzivikela kwesikhathi sangempela, kanye nokuphathwa kobuthakathaka okuvuthiwe Akuseyona indaba "yokuba sezingeni eliphezulu," kodwa ukuqinisekisa ukuqhubeka kwenhlangano uqobo. Labo abakwazi ukuthola wonke ama-API abo, bawahlole ngokuzenzakalelayo, bawavikele ekuhlukunyezweni, futhi basabela ngokushesha lapho kukhona okungahambi kahle yibo abalala kamnandi kakhulu... futhi abangeke bavele ezindabeni ngezizathu ezingalungile.

I-athikili ehlobene:

Ukufakwa kwe-SQL Okubalulekile ku-Fortinet FortiClientEMS: Ukuhlaziywa Nokunciphisa