{"id":100532,"date":"2021-06-17T22:23:06","date_gmt":"2021-06-17T20:23:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/google-predlozhil-slsa-dlya-zashhity-ot-vredonosnyh-izmenenij-v-proczesse-razrabotki"},"modified":"2021-06-17T22:23:06","modified_gmt":"2021-06-17T20:23:08","slug":"google-predlozhil-slsa-dlya-zashhity-ot-vredonosnyh-izmenenij-v-proczesse-razrabotki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/google-predlozhil-slsa-dlya-zashhity-ot-vredonosnyh-izmenenij-v-proczesse-razrabotki","title":{"rendered":"Google pakkus v\u00e4lja SLSA, et kaitsta arendusprotsessi pahatahtlike muudatuste eest","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Google esitles SLSA (Supply-chain Levels for Software Artifacts) raamistikku, mis \u00fcldistab olemasolevaid kogemusi arendusinfrastruktuuri kaitsmisel r\u00fcnnakute eest, mis toimuvad koodi kirjutamise, testimise, koostamise ja toote levitamise etappidel.     <\/p>\n<p>\u041f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f \u0432\u0441\u0451  \u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u043c\u0438 \u0438 \u0437\u0430\u0432\u0438\u0441\u044f\u0449\u0438\u043c\u0438 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432, \u0447\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u0431\u043b\u0430\u0433\u043e\u043f\u0440\u0438\u044f\u0442\u043d\u044b\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u0434\u043b\u044f \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043d\u0435 \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0435, \u0430 \u0441 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0435\u0439 \u0441\u0430\u043c\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 (\u0430\u0442\u0430\u043a\u0438 &#171;supply chain&#187;, \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u043f\u043e\u0434\u043c\u0435\u043d\u0443 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0438 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439).       <\/p>\n<p>Raamistik arvestab 8 t\u00fc\u00fcpi r\u00fcnnakutega, mis on seotud pahatahtlike muudatuste tegemise ohtudega koodi arendamise, koostamise, testimise ja toote levitamise etappidel.      <center><img decoding=\"async\" alt=\"Google pakkus v\u00e4lja SLSA, et kaitsta arendusprotsessi pahatahtlike muudatuste eest\" src=\"\/wp-content\/uploads\/2021\/06\/d99f0d7ebc6009bcecf21f65f77dcf65.png\" style=\"display:block;margin: 0 auto;\" \/><\/center>    <\/p>\n<ul>\n<li class=\"l\"> A. Muudatuste lisamine l\u00e4htekoodile, mis sisaldavad tagavarasid v\u00f5i varjatud vigu, mis viivad haavatavusteni.\n<p>\u041f\u0440\u0438\u043c\u0435\u0440 \u0430\u0442\u0430\u043a\u0438: &#171;Hypocrite Commits&#187; &#8212; \u043f\u043e\u043f\u044b\u0442\u043a\u0430 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0432 \u044f\u0434\u0440\u043e Linux \u043f\u0430\u0442\u0447\u0435\u0439 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438.   <\/p>\n<p>Pakutav kaitsemeetod: iga muudatuse s\u00f5ltumatu \u00fclevaatus kahe arendaja poolt.    <\/p>\n<li class=\"l\"> B. Allika koodihalduse platformi kompromiteerimine.\n<p>R\u00fcnnakute n\u00e4ide: pahatahtlike commit'ide sisestamine PHP projekti Git-repositooriumisse tagauksega p\u00e4rast arendajate paroolide leket.  <\/p>\n<p>Pakutav kaitsemeetod: koodihalduse platvormi kaitse suurendamine (PHP puhul toimus r\u00fcnnak v\u00e4he kasutatud HTTPS-liidese kaudu, mis lubas muudatusi saata parooliga sisselogimisel ilma SSH-v\u00f5tme kontrollita, samas kui paroolide hash'imiseks kasutati usaldusv\u00e4\u00e4rset MD5-d).    <\/p>\n<li class=\"l\">C. Muudatuste tegemine koodi edastamisel koostamis- v\u00f5i pideva integreerimise s\u00fcsteemi (t\u00e4idab koodi, mis ei vasta repositooriumi koodile).\n<p>R\u00fcnnakute n\u00e4ide: tagaukse sisestamine Webmin'i, tehes muudatusi koostamisstruktuuris, mis viis sisse failide kasutamiseni, mis erinevad repositooriumi failidest.     <\/p>\n<p>Pakutav kaitsemeetod: Koodi terviklikkuse kontrollimine ja allika tuvastamine, kust kood on saadud koostamise k\u00e4igus. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/dts-dronten\/\"   title=\"serveril\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2636\">serveril<\/a>.      <\/p>\n<li class=\"l\"> D. Koostamisplatvormi kompromiteerimine.\n<p>R\u00fcnnaku n\u00e4ide: SolarWinds'i r\u00fcnnak, mille k\u00e4igus tagati r\u00fcnde ajal tagaukse sisestamine tootes SolarWinds Orion.  <\/p>\n<p>Ettepanek kaitsemeetod: t\u00e4iustatud turvameetmete rakendamine ehitusplatvormil.    <\/p>\n<li class=\"l\"> E. Kahjuliku koodi levitamine halva kvaliteediga s\u00f5ltuvuste kaudu.\n<p>R\u00fcnnaku n\u00e4ide: tagaukse sisestamine populaarsetesse event-stream teekidesse, lisades kahjutuna n\u00e4iva s\u00f5ltuvuse, mis sisaldas hiljem selle s\u00f5ltuvuse \u00fches uuenduses kahjulikku koodi (kahjulik muudatus ei kajastunud git-repositooriumis ning oli olemas vaid valmis MNP-pakendis).    <\/p>\n<p>Ettepanek kaitsemeetod: SLSA n\u00f5uete retsidiivne rakendamine k\u00f5ikidele s\u00f5ltuvustele (event-stream'i puhul oleks kontroll tuvastanud, et koodi ehitus ei vasta p\u00f5higiti-repositooriumi sisule).    \t  <\/p>\n<li class=\"l\"> F. Artefaktide laadimine, mida ei ole loodud CI\/CD s\u00fcsteemis.\n<p>R\u00fcnnaku n\u00e4ide: kahjuliku koodi lisamine CodeCov skripti, mis v\u00f5imaldas r\u00fcndajatel hankida teavet, mis on salvestatud klientide pideva integratsiooni keskkondades.    <\/p>\n<p>Pakutud kaitsemeetod: allika ja artefaktide terviklikkuse kontroll (CodeCov puhul v\u00f5ib olla avastatud, et codecov.io veebisaidilt edastatav Bash Uploader skript ei vasta projekti hoidla koodile).    <\/p>\n<li class=\"l\"> G. Paki hoidla kompromiteerimine.\n<p>R\u00fcnnakute n\u00e4ide: teadlased suutsid v\u00e4lja tuua peegeldusi m\u00f5nest populaarsemast pakihoidlast, et levitada nende kaudu pahavara pakette.    <\/p>\n<p>Pakutud kaitsemeetod: kontroll, et levitatavad artefaktid on kokku pandud deklareeritud l\u00e4htekoodidest.    <\/p>\n<li class=\"l\"> H. Kasutaja segadusse ajamine vale paketi installimiseks.\n<p>R\u00fcnnakute n\u00e4ide: t\u00fc\u00fcpide naljakas kirjutamine (NPM, RubyGems, PyPI) pakihoidlates, et paigutada sinna paketid, mis sarnanevad kirjutamise poolest populaarsetele rakendustele (n\u00e4iteks coffe-script asemel coffee-script).      <\/ul>\n<p>Ahnub SLSA pakub soovituste komplekti ja t\u00f6\u00f6riistu, et automatiseerida auditiks vajalike metaandmete loomist, et blokeerida tuvastatud ohud. SLSA kogub kokku r\u00fcndeviisid ja tutvustab kaitsetasemeid. Iga tase esitab kindlad n\u00f5uded infrastruktuurile, mis tagab arendusprotsessis kasutatavate artefaktide terviklikkuse. Mida k\u00f5rgem on toetatav SLSA tase, seda rohkem kaitsemeetmeid on rakendatud ja seda paremini on infrastruktuur kaitstud t\u00fc\u00fcpiliste r\u00fcnnakute eest.     <\/p>\n<ul>\n<li class=\"l\"> SLSA 1 &#8212; \u0442\u0440\u0435\u0431\u0443\u0435\u0442, \u0447\u0442\u043e\u0431\u044b \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0431\u044b\u043b \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d \u0438 \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043b \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0435 (&#171;provenance&#187;) \u043e  \u0442\u043e\u043c, \u043a\u0430\u043a \u0430\u0440\u0442\u0435\u0444\u0430\u043a\u0442\u044b \u0441\u043e\u0431\u0440\u0430\u043d\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0445 \u0442\u0435\u043a\u0441\u0442\u0430\u0445, \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0441\u0431\u043e\u0440\u043a\u0438 (\u0434\u043b\u044f GitHub Actions \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u043f\u0440\u0438\u043c\u0435\u0440 \u0433\u0435\u043d\u0435\u0440\u0430\u0442\u043e\u0440\u0430 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f \u0430\u0443\u0434\u0438\u0442\u0430). SLSA 1 \u043d\u0435 \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439, \u0430 \u043b\u0438\u0448\u044c \u043f\u0440\u043e\u0441\u0442\u0435\u0439\u0448\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442 \u043a\u043e\u0434 \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0440\u0438\u0441\u043a\u043e\u0432.\n<li class=\"l\"> SLSA 2 &#8212; \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u0435\u0442 \u043f\u0435\u0440\u0432\u044b\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438 \u0438 \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432, \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0435. \u041f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 SLSA 2 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0442\u0441\u043b\u0435\u0434\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u0435 \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043a\u043e\u0434, \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432.\n<li class=\"l\"> SLSA 3  &#8212; \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u0438 \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u0430\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f\u043c \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043e\u0432, \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0434\u0438\u0442\u0430 \u043a\u043e\u0434\u0430 \u0438 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0430\u0443\u0434\u0438\u0442\u043e\u0440\u044b \u043c\u043e\u0433\u0443\u0442 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u044f \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f\u043c \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043e\u0432.\n<li class=\"l\"> SLSA 4 &#8212; \u043d\u0430\u0438\u0432\u044b\u0441\u0448\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c, \u0434\u043e\u043f\u043e\u043b\u043d\u044f\u044e\u0449\u0438\u0439 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0435 \u0443\u0440\u043e\u0432\u043d\u0438 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c\u0438 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f\u043c\u0438:\n<ul>\n<li class=\"l\"> K\u00f5igi muudatuste kohustuslik \u00fclevaatus kahe erineva arendaja poolt.\n<li class=\"l\"> K\u00f5ik ehitusetapid, kood ja s\u00f5ltuvused peavad olema t\u00e4ielikult deklareeritud, k\u00f5ik s\u00f5ltuvused peavad olema eraldi v\u00e4lja t\u00f5mmatud ja kontrollitud, ning ehitusprotsess peab toimuma ilma v\u00f5rgu ligip\u00e4\u00e4suta.\n<li class=\"l\"> \u041f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u0435\u043c\u043e\u0439 \u0441\u0431\u043e\u0440\u043a\u0438  &#8212; \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0441\u0431\u043e\u0440\u043a\u0438 \u0441\u0432\u043e\u0438\u043c\u0438 \u0441\u0438\u043b\u0430\u043c\u0438 \u0438 \u0443\u0431\u0435\u0434\u0438\u0442\u044c\u0441\u044f, \u0447\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b \u0441\u043e\u0431\u0440\u0430\u043d \u0438\u0437 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0445 \u0442\u0435\u043a\u0441\u0442\u043e\u0432.        <\/ul>\n<p>      <center><img decoding=\"async\" alt=\"Google pakkus v\u00e4lja SLSA, et kaitsta arendusprotsessi pahatahtlike muudatuste eest\" src=\"\/wp-content\/uploads\/2021\/06\/3f0bdd24afeec562582d8410b490e705.png\" style=\"display:block;margin: 0 auto;\" \/><\/center><br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=55345\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a SLSA (Supply-chain Levels for Software Artifacts), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043e\u0431\u043e\u0431\u0449\u0451\u043d \u0438\u043c\u0435\u044e\u0449\u0438\u0439\u0441\u044f \u043e\u043f\u044b\u0442 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0442 \u0430\u0442\u0430\u043a, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0441\u0431\u043e\u0440\u043a\u0438 \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430. \u041f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f \u0432\u0441\u0451 \u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u043c\u0438 \u0438 \u0437\u0430\u0432\u0438\u0441\u044f\u0449\u0438\u043c\u0438 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432, \u0447\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u0431\u043b\u0430\u0433\u043e\u043f\u0440\u0438\u044f\u0442\u043d\u044b\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u0434\u043b\u044f \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043d\u0435 \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":100533,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100532","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-novosti-interneta"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a SLSA (Supply-chain Levels for Software Artifacts), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043e\u0431\u043e\u0431\u0449\u0451\u043d \u0438\u043c\u0435\u044e\u0449\u0438\u0439\u0441\u044f \u043e\u043f\u044b\u0442 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0442 \u0430\u0442\u0430\u043a, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0441\u0431\u043e\u0440\u043a\u0438 \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430. \u041f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f \u0432\u0441\u0451 \u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u043c\u0438 \u0438 \u0437\u0430\u0432\u0438\u0441\u044f\u0449\u0438\u043c\u0438 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432, \u0447\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u0431\u043b\u0430\u0433\u043e\u043f\u0440\u0438\u044f\u0442\u043d\u044b\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u0434\u043b\u044f \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043d\u0435 \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/google-predlozhil-slsa-dlya-zashhity-ot-vredonosnyh-izmenenij-v-proczesse-razrabotki\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Google \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b SLSA \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a SLSA (Supply-chain Levels for Software Artifacts), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043e\u0431\u043e\u0431\u0449\u0451\u043d \u0438\u043c\u0435\u044e\u0449\u0438\u0439\u0441\u044f \u043e\u043f\u044b\u0442 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0442 \u0430\u0442\u0430\u043a, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0441\u0431\u043e\u0440\u043a\u0438 \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430. \u041f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f \u0432\u0441\u0451 \u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u043c\u0438 \u0438 \u0437\u0430\u0432\u0438\u0441\u044f\u0449\u0438\u043c\u0438 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432, \u0447\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u0431\u043b\u0430\u0433\u043e\u043f\u0440\u0438\u044f\u0442\u043d\u044b\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u0434\u043b\u044f \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043d\u0435 \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/google-predlozhil-slsa-dlya-zashhity-ot-vredonosnyh-izmenenij-v-proczesse-razrabotki\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-06-17T20:23:08+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-06-17T20:23:08+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Google pakkus SLSA kahjustuste muutuste kaitseks arenduse protsessis | ProHoster","description":"Ettev\u00f5te Google tutvustas SLSA (Supply-chain Levels for Software Artifacts) raamistikku, mis koondab olemasoleva kogemuse arenduste infrastruktuuri kaitsmiseks r\u00fcnnakute vastu, mis toimuvad koodi kirjutamise, testimise, koostamise ja toote levitamise etappidel. Arendusprotsessid muutuvad \u00fcha keerukamaks ja s\u00f5ltuvamaks kolmandate osapoolte t\u00f6\u00f6riistadest, luues soodsa pinnase r\u00fcnnakute edendamiseks, mis ei seondu avastamise ja \u00e4rakasutamisega.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/google-predlozhil-slsa-dlya-zashhity-ot-vredonosnyh-izmenenij-v-proczesse-razrabotki","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Google \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b SLSA \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a SLSA (Supply-chain Levels for Software Artifacts), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043e\u0431\u043e\u0431\u0449\u0451\u043d \u0438\u043c\u0435\u044e\u0449\u0438\u0439\u0441\u044f \u043e\u043f\u044b\u0442 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0442 \u0430\u0442\u0430\u043a, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0441\u0431\u043e\u0440\u043a\u0438 \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430. \u041f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f \u0432\u0441\u0451 \u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u043c\u0438 \u0438 \u0437\u0430\u0432\u0438\u0441\u044f\u0449\u0438\u043c\u0438 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432, \u0447\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u0431\u043b\u0430\u0433\u043e\u043f\u0440\u0438\u044f\u0442\u043d\u044b\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u0434\u043b\u044f \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043d\u0435 \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439","og:url":"https:\/\/prohoster.info\/et\/blog\/novosti-interneta\/google-predlozhil-slsa-dlya-zashhity-ot-vredonosnyh-izmenenij-v-proczesse-razrabotki","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-06-17T20:23:08+00:00","article:modified_time":"2021-06-17T20:23:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100532","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-06-17 20:37:49","updated":"2026-02-09 21:38:12"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100532","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=100532"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100532\/revisions"}],"predecessor-version":[{"id":159918,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100532\/revisions\/159918"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/100533"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=100532"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=100532"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=100532"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}