Riba:
- Ability don fahimtar DevSecOps da ka'idodin zinariya na sarrafa asirin (ba ya shigar da lambar, ana kiyaye shi a cikin vault, ana allura a lokacin gudu, an dawo da shi, mafi ƙarancin gata)
- Ikon yin amfani da hankali na wucin gadi don ba da fifikon abubuwan binciken tsaro (SCA, SAST, hoto, IaC, sirri) da lambar tantancewa don dalilai na tsaro.
- Sanin cewa matakin farko a cikin ɓoyayyen ɓoye shine sokewa / juyewa da yin amfani da hankali na wucin gadi kawai a cikin tsarin izini, don dalilai na tsaro, cikin iyakokin doka.
Yadda ake tura tsarin da sauri ba yana nufin komai ba ranar da aka lalata shi. Yayin da DevOps ke mai da hankali kan saurin gudu, wani lokacin ana barin tsaro zuwa ƙarshe - kuma tsaro da aka bari zuwa ƙarshe galibi baya zuwa kwata-kwata. DevSecOps shine tsarin da ke sanya tsaro a farkon kuma a kowane mataki na kwararar DevOps: "canza tsaro hagu" - wato, kama wani rauni a cikin bututun, yayin da ake rubuta lambar, maimakon a cikin samfurin. Ga ƙwararrun DevSecOps, tsaro ba aikin ƙungiyar daban ba ne, amma wani ɓangare ne na kowane sadaukarwa, kowane hoto, kowane bayyananne.
Akwai manyan gatari guda biyu a cikin wannan rukunin. Na farko shine sarrafa sirri: amintaccen tsarawa, ajiya, rarrabawa da jujjuya bayanan sirri kamar kalmomin shiga, maɓalli, takaddun shaida. Na biyu shine binciken tsaro da taurare: gano lahani a cikin abubuwan dogaro, hotuna, daidaitawa. AI shine mataimaki mai ƙarfi a duka biyun - yana bayyana rashin ƙarfi, yana ba da fifikon abubuwan dubawa, yana ba da shawarar gyarawa. Amma mafi mahimmanci caveat ya shafi a nan: AI shine don tsaro; Samun damar shiga tsarin wani mara izini, dubawa mara izini, ko ƙirƙirar kayan aikin hari haramun ne kuma shine ƙaƙƙarfan iyaka na wannan dandamali.
Golden Dokokin Gudanar da Asirin
- Asirin baya sanya shi cikin lambar tushe. Ba Dockerfile ba, ba YAML, ba rubutun ba, ba Git ba. Da zarar an shiga cikin Git, asirin ya ci gaba a baya.
- Ana adana sirrin a cikin rumbun tsakiya. HashiCorp Vault, Manajan Sirrin AWS, Azure Key Vault, GCP Sirrin Manajan - waɗannan bayanan sirrin da aka ɓoye, sarrafa damar shiga, da kiyaye su.
- Ana yin allurar a lokacin aiki. Aikace-aikacen yana dawo da sirri daga rumbun ajiya ko canjin yanayi yayin aiki, ba daga faifai ba.
- Yana juyawa akai-akai. Yayin da sirrin ya daɗe yana rayuwa, haɗarin yayyo zai fi girma. Auto-spin ya dace.
- Karamin iko. Sabis ɗin da ke buƙatar sa kawai zai iya samun damar kowane sirri.
Tukwici: Hanya mafi inganci mafi inganci ita ce sanya na'urar daukar hoto ta sirri (kamar git-asirin, gitleaks, trufflehog) a cikin bututun: yana dakatar da aikatawa idan aka yi ƙoƙarin aikata wani sirri da gangan. Wannan yana dakatar da zubewar a tushen. AI yana taimakawa rubuta haɗin bututun waɗannan masu binciken.
Mataki-mataki: mayar da martani ga yabo a asirce
Idan wani sirri ya tonu, kada ku firgita, tsari yana da mahimmanci:
- Soke kuma juya nan da nan. Rushe maɓallin leaks, samar da sabo. Kawai share shi bai isa ba - ya kasance a baya.
- Yi la'akari da tasirin. A ina wannan maɓalli ya shiga? An zage ta? Yi nazarin rajistan ayyukan.
- Kashe tushen. Yaya ya zubo? Share code, tarihi; Amma ku tuna: sokewa yana zuwa kafin sharewa.
- Hana Ƙara mai binciken sirri zuwa bututun don kada ya sake maimaitawa.
Hankali: Fare mafi tsada shine kar a mayar da sirrin da aka fallasa kawai saboda "babu wanda ya gan shi". Maɓallin da aka jefa a cikin ma'ajiyar jama'a ana duba ta ta hanyar bots cikin daƙiƙa guda. Lokacin da shakka, juya - farashin jujjuya yana da ƙasa, farashin ɗigon ruwa yana da bala'i.
Nau'in binciken tsaro
DevSecOps yana amfani da yadudduka na dubawa; AI yana taimakawa wajen fassara fitowar kowane:
- SCA (Binciken Haɗin Haɗin Software): Yana Nemo sanannun lahani (CVE) a cikin buɗaɗɗen abubuwan dogaro da kuke amfani da su.
- SAST (Gwajin Tsaro na Aikace-aikacen Static): Yana bincika lambar tushe don raunin rauni ba tare da gudanar da shi ba.
- DAST (Gwajin Tsaro na Aikace-aikacen Mai Sauƙi): Yana gwada aikace-aikacen da ke gudana a waje.
- Duban hoto: Nemo lahani a cikin hoton kwantena (trivy, docker scout).
- Binciken IaC: Yana gano ɓarna a cikin Terraform/bayyanai (tfsec, checkov).
Tsanaki: Na'urar daukar hoto tana zubar da ɗaruruwan binciken; Ba shi yiwuwa a gyara su duka a lokaci guda. Yi amfani da AI don ba da fifiko ga binciken: waɗanne da gaske ake amfani da su, waɗanda a bayyane suke a ka'idar amma ba za a iya samun su a aikace? Amma tabbatar da fifikon ƙarshe tare da mahallin ku.
Tebur na raster yadudduka
Layer
Me yake duba?
abin hawa samfurin
yaushe
SCA
Lalacewar Dogaro (CVE)
Dependabot, Snyk
kowane gini
SAST
Lalacewar lambar tushe
Semgrep, CodeQL
Kowane PR
duba hoto
Lalacewar kwantena
Trivy, Scout
Bayan ginawa
IaC scan
Rashin tsari
tfsec, checkov
Farashin PR
duban sirri
Sirri da aka fallasa
gitleaks
Kowane alkawari
uku mini lokuta
Case 1 - 300 CVEs, 12 haxari na gaske. Wani hoton hoto ya ba da rahoton lahani 300; Tawagar ta shanye. Ba da fitar da sikanin ga AI kuma ka tambayi "waɗanne ne za a iya amfani da su daga nesa kuma ana iya samun su?" Sun ba shi fifiko. AI ta ba da haske 12 ainihin binciken haɗari. Tawagar ta farko ta rufe su; Ya dauki sauran a kan tsari. Ba da fifiko kan firgici.
Case 2 - juyawa ya dakile wani hari. Mai haɓakawa da gangan ya tura maɓallin gajimare zuwa wurin ajiyar jama'a. Ƙararrawar ta tashi; Kungiyar ta soke kuma ta mayar da maɓallin a cikin mintuna 4. Mabuɗin sun nuna cewa an riga an nemi maɓalli daga bot - amma yanzu ba shi da inganci. Saurin juyowa ya hana yuwuwar bala'in lissafin kuɗi da zubewar bayanai.
Case 3 - IaC scan ya kama buɗaɗɗen guga. Scan IaC mai taimakon AI ya kama bokitin ajiya a cikin lambar Terraform yana da izinin "karanta jama'a" ba tare da zuwa samarwa ba. Mai haɓakawa ya buɗe shi "don gwaji" kuma ya manta ya rufe shi. Bututun ya dakatar da aikin; bude bai taba sanya shi zuwa prod. Wannan shine ainihin ma'anar karkatar da hagu.
Samfura huɗu masu kwafi
1) Bada fifikon kayan aikin dubawa:
Ba da fifikon kayan aikin duba tsaro a ƙasa. Ga kowane binciken: (1) shin da gaske ana amfani da shi (na nesa/marasa inganci?), (2) ana iya samunsa a mahallin mu, (3) ƙoƙarin gyarawa, (4) fifikon fifiko (mafi mahimmanci / babba / matsakaici / ƙasa). Haskaka 5 mafi gaggawa. Yi magana a fili; nuna cewa ina buƙatar tabbatar da kowane fifiko tare da mahallin nawa. Fitowa: [SCAN]
2) Tsarin sarrafa sirri:
Ba da shawarar tsarin sarrafa asirin don [APPLICATION/INFRstructure]: wanne vault, yadda ake allurar sirri a lokacin aiki, yadda ake jujjuyawa ta atomatik, ta yaya ake aiwatar da gata kaɗan? Yi bayanin ƙwanƙolin ƙaƙƙarfan ƙaƙƙarfan ƙaƙƙarfan ƙaƙƙarfan ƙaƙƙarfan ƙaƙƙarfan ƙaƙƙarfan ƙaƙƙarfan ƙaƙƙarfan ƙaƙƙarfar ƙaƙƙarfar ƙaƙƙarfar ƙaƙƙarfar ƙaƙƙarfar ƙaƙƙarfar ƙaƙƙarfar ƙaƙƙarfar da ba ta taɓa ɓoye sirrin a cikin lambar ba.
3) Neman rauni a cikin lambar (kare):
Bincika lambar NAWA ta ƙasa don tsaro (Ina da izini): akwai wata allura, sirrin da aka saka, rashin tsaro, shigarwar da ba ta da inganci? Ba kowane gano mahimmancinsa da gyara. Manufar ita ce tsaro da ƙarfafawa. Lambar: [CODE]
4) Shirin mayar da martani a asirce:
Wani [SIRRIN TYPE] na iya shiga cikin bazata [LOCATION]. Ka ba ni odar shiga tsakani mataki-mataki: menene zan fara yi (sokewa / dawowa), yadda za a kimanta tasirin, yadda za a hana sake dawowa? Hakanan bayyana dalilin da yasa kawai share bai isa ba.
Rauni mai ƙarfi / Ƙarfi mai ƙarfi
Rauni: "Ta yaya zan yi hack wannan tsarin / amfani da wannan rauni?"
Wannan buƙatar duka biyun rashin ɗa'a ce kuma ba ta wuce iyakokin wannan dandali ba. Ba bisa ka'ida ba don amfani da AI don kai hari.
Ƙarfafa: "Ba da izinin lambar aikace-aikacena don tsaro: nemo sirrin da aka haɗa, haɗarin allura da rashin tsaro, gyara kowannensu. Manufar ita ce ta taurara tsarin."
Bambanci: buƙatu na biyu don dalilai na tsaro ne, a cikin iyakokin iko da kuma ƙarfafawa. Wannan shine daidai amfani da AI a cikin DevSecOps.
Kuskuren gama gari
- Shigar da Sirrin cikin lamba/tarihi. Mafi na kowa da kuma nacewa rashin lahani.
- Ba a dawo da sirrin da aka fallasa ba. "Ba wanda ya gan shi" shine fare mafi tsada.
- Ganin duk abubuwan da aka gano daidai suke. Kasancewa gurgunta ta hanyar fifiko ko rasa haƙƙin gaske.
- Barin tsaro ya dore. Tazarar da ke cikin kayan samarwa ya ninka tazarar bututun tsada sau da yawa.
- Ketare ƙaramin iko. Sirrin / rawar da ke da damar yin amfani da komai yana sa zubar guda ɗaya bala'i.
- Ƙoƙarin amfani da AI don kai hari. Ba bisa doka ba kuma a waje.
a takaice
DevSecOps yana sanya tsaro a farkon kuma a kowane mataki na kwararar DevOps - kama lahani a cikin lamba da bututun mai, ba cikin samarwa ba. Dokokin zinare na sarrafa asirin: sirrin baya shigar da lambar, ana adana shi a cikin babban gida, ana allura a lokacin aiki, ana dawo da shi akai-akai, kuma ana samun dama tare da ƙaramin gata. Mataki na farko na zubar da ciki shine koyaushe zubar da ciki/dawowa. AI yana da ƙarfi wajen ba da fifikon fitar da sikandire, ƙira ɓoyayyiyar sirri, da kuma bincika lambar tsaro - amma ana amfani da ita kawai ta hanyar tsaro kuma cikin iyakokin doka akan tsarin da kuke da iko.
Aikin aikace-aikace
Ɗauki aikin kanku (wanda kuke da iko akansa). (1) A duba sirrin da ke ciki da rashin tsaro tare da samfurin "Neman lahani a lamba". (2) Tsara fitowar sikanin tsaro (ainihin ko samfurin) ta hanyar samfurin "triage" kuma gano abubuwan binciken 3 mafi gaggawa. (3) Samar da daftarin aiki don aikinku tare da samfurin "tsarin sarrafa sirri" wanda ke kawar da sirri gaba daya daga lambar.
jerin abubuwan dubawa
- [ ] Na tabbatar da cewa babu wani sirrin da aka saka a cikin lambara, hoto da bayyanannina.
- [ ] Ina adana sirrin a cikin rumbun tsakiya kuma in yi musu allura a lokacin aiki.
- [ ] Na san cewa mataki na farko a cikin yanayin yabo shine zubar da ciki/dawowa.
- [ ] Na ba da fifikon binciken binciken bisa ga amfani da mahallin nawa.
- [ ] Na matsar da sikanin tsaro zuwa farkon matakan bututun (zuwa hagu).
- [ ] Na yi amfani da AI kawai don dalilai na tsaro akan tsarin da nake da iko.