{"id":100532,"date":"2021-06-17T22:23:06","date_gmt":"2021-06-17T20:23:08","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/google-predlozhil-slsa-dlya-zashhity-ot-vredonosnyh-izmenenij-v-proczesse-razrabotki"},"modified":"2021-06-17T22:23:06","modified_gmt":"2021-06-17T20:23:08","slug":"google-predlozhil-slsa-dlya-zashhity-ot-vredonosnyh-izmenenij-v-proczesse-razrabotki","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/google-predlozhil-slsa-dlya-zashhity-ot-vredonosnyh-izmenenij-v-proczesse-razrabotki","title":{"rendered":"Google ha proposto SLSA per proteggere da modifiche dannose nel processo di sviluppo","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>L'azienda Google ha presentato il framework SLSA (Supply-chain Levels for Software Artifacts), che riassume l'esperienza esistente nella protezione dell'infrastruttura di sviluppo contro gli attacchi, effettuati durante la scrittura del codice, testing, assemblaggio e distribuzione del prodotto.     <\/p>\n<p>\u041f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f \u0432\u0441\u0451  \u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u043c\u0438 \u0438 \u0437\u0430\u0432\u0438\u0441\u044f\u0449\u0438\u043c\u0438 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432, \u0447\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u0431\u043b\u0430\u0433\u043e\u043f\u0440\u0438\u044f\u0442\u043d\u044b\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u0434\u043b\u044f \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043d\u0435 \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u043c \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0435, \u0430 \u0441 \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0435\u0439 \u0441\u0430\u043c\u043e\u0433\u043e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 (\u0430\u0442\u0430\u043a\u0438 &#171;supply chain&#187;, \u043a\u0430\u043a \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u043d\u0430 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u043f\u043e\u0434\u043c\u0435\u043d\u0443 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u044b\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u0438 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0435\u0439).       <\/p>\n<p>Il framework tiene conto di 8 tipi di attacchi legati a minacce di inserimento di modifiche dannose nella fase di sviluppo del codice, assemblaggio, test e distribuzione del prodotto.      <center><img decoding=\"async\" alt=\"Google ha proposto SLSA per proteggere da modifiche dannose nel processo di sviluppo\" src=\"\/wp-content\/uploads\/2021\/06\/d99f0d7ebc6009bcecf21f65f77dcf65.png\" style=\"display:block;margin: 0 auto;\" \/><\/center>    <\/p>\n<ul>\n<li class=\"l\"> A. Inclusione nel codice sorgente di modifiche contenenti backdoor o errori nascosti che portano a vulnerabilit\u00e0.\n<p>\u041f\u0440\u0438\u043c\u0435\u0440 \u0430\u0442\u0430\u043a\u0438: &#171;Hypocrite Commits&#187; &#8212; \u043f\u043e\u043f\u044b\u0442\u043a\u0430 \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0432 \u044f\u0434\u0440\u043e Linux \u043f\u0430\u0442\u0447\u0435\u0439 \u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438.   <\/p>\n<p>Metodo di protezione proposto: revisione indipendente di ogni modifica da parte di due sviluppatori.    <\/p>\n<li class=\"l\"> B. Compromissione della piattaforma di gestione del codice sorgente.\n<p>Esempio di attacco: inserimento di commit dannosi con backdoor nel repository Git del progetto PHP dopo la fuga delle password degli sviluppatori.  <\/p>\n<p>Metodo di protezione proposto: potenziamento della sicurezza della piattaforma di gestione del codice (nel caso di PHP, l'attacco \u00e8 stato effettuato tramite un'interfaccia HTTPS poco utilizzata, che consentiva l'invio di modifiche all'accesso tramite password senza verifica della chiave SSH, e si utilizzava un MD5 poco affidabile per l'hashing delle password).    <\/p>\n<li class=\"l\">C. Inserimento di modifiche nella fase di trasferimento del codice al sistema di assemblaggio o integrazione continua (viene assemblato codice non corrispondente a quello del repository).\n<p>Esempio di attacco: inserimento di un backdoor in Webmin attraverso modifiche all'infrastruttura di assemblaggio, che hanno portato all'utilizzo di file con codice diversi dai file nel repository.     <\/p>\n<p>Metodo di protezione proposto: verifica dell'integrit\u00e0 e identificazione della sorgente di arrivo del codice nell'assemblaggio. <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/it\/server\/dts-dronten\/\"   title=\"server\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"2636\">server<\/a>.      <\/p>\n<li class=\"l\"> D. Compromissione della piattaforma di assemblaggio.\n<p>Esempio di attacco: attacco SolarWinds, durante il quale, nella fase di assemblaggio, \u00e8 stata assicurata l'inserzione di un backdoor nel prodotto SolarWinds Orion.  <\/p>\n<p>Metodo di protezione proposto: implementazione di misure di sicurezza avanzate per la piattaforma di assemblaggio.    <\/p>\n<li class=\"l\"> E. Promozione di codice dannoso attraverso dipendenze scadenti.\n<p>Esempio di attacco: inserimento di un backdoor in una popolare libreria event-stream, tramite l'aggiunta di una dipendenza innocua che ha successivamente incluso codice dannoso in uno degli aggiornamenti di tale dipendenza (la modifica dannosa non era riflessa nel repository git, ma era presente solo nel pacchetto MNP pronto).    <\/p>\n<p>Metodo di protezione proposto: applicazione ricorsiva dei requisiti SLSA a tutte le dipendenze (nel caso di event-stream, il controllo avrebbe rivelato una compilazione di codice non corrispondente al contenuto del repository Git principale).    \t  <\/p>\n<li class=\"l\"> F. Caricamento di artefatti non creati nel sistema CI\/CD.\n<p>Esempio di attacco: inserimento di codice dannoso nello script CodeCov, che consentiva agli aggressori di estrarre informazioni memorizzate negli ambienti dei sistemi di integrazione continua dei clienti.    <\/p>\n<p>Metodo di protezione proposto: controllo della fonte e dell'integrit\u00e0 degli artefatti (nel caso di CodeCov, potrebbe essere stata rivelata l'incongruenza del codice dello script Bash Uploader fornito dal sito codecov.io rispetto al codice del repository di progetto).    <\/p>\n<li class=\"l\"> G. Compromissione del repository di pacchetti.\n<p>Esempio di attacco: i ricercatori sono riusciti a distribuire specchi di alcuni popolari repository di pacchetti per diffondere pacchetti dannosi attraverso di essi.    <\/p>\n<p>Metodo di protezione proposto: verifica che gli artefatti distribuiti siano compilati dai codici sorgente dichiarati.    <\/p>\n<li class=\"l\"> H. Introduzione in confusione dell'utente per installare il pacchetto errato.\n<p>Esempio di attacco: utilizzo di typo-squatting (NPM, RubyGems, PyPI) per pubblicare nei repository pacchetti scritti in modo simile a applicazioni popolari (ad esempio, coffe-script invece di coffee-script).      <\/ul>\n<p>Per bloccare le minacce indicate, SLSA propone un insieme di raccomandazioni, cos\u00ec come strumenti per l'automazione della creazione di metadati per l'audit. SLSA generalizza le tecniche di attacco comuni e introduce il concetto di livelli di protezione. Ogni livello presenta requisiti specifici per l'infrastruttura, consentendo di garantire l'integrit\u00e0 degli artefatti utilizzati nello sviluppo. Maggiore \u00e8 il livello SLSA supportato, maggiori sono le misure di protezione implementate e migliore \u00e8 la protezione dell'infrastruttura contro attacchi comuni.     <\/p>\n<ul>\n<li class=\"l\"> SLSA 1 &#8212; \u0442\u0440\u0435\u0431\u0443\u0435\u0442, \u0447\u0442\u043e\u0431\u044b \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u0439 \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0431\u044b\u043b \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u043e\u0432\u0430\u043d \u0438 \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043b \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0435 (&#171;provenance&#187;) \u043e  \u0442\u043e\u043c, \u043a\u0430\u043a \u0430\u0440\u0442\u0435\u0444\u0430\u043a\u0442\u044b \u0441\u043e\u0431\u0440\u0430\u043d\u044b, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0441\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043e\u0431 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0445 \u0442\u0435\u043a\u0441\u0442\u0430\u0445, \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u0445 \u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0441\u0431\u043e\u0440\u043a\u0438 (\u0434\u043b\u044f GitHub Actions \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0435\u043d \u043f\u0440\u0438\u043c\u0435\u0440 \u0433\u0435\u043d\u0435\u0440\u0430\u0442\u043e\u0440\u0430 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043b\u044f \u0430\u0443\u0434\u0438\u0442\u0430). SLSA 1 \u043d\u0435 \u0432\u043a\u043b\u044e\u0447\u0430\u0435\u0442 \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u044b \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439, \u0430 \u043b\u0438\u0448\u044c \u043f\u0440\u043e\u0441\u0442\u0435\u0439\u0448\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u0435\u0442 \u043a\u043e\u0434 \u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 \u0438 \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0440\u0438\u0441\u043a\u043e\u0432.\n<li class=\"l\"> SLSA 2 &#8212; \u0440\u0430\u0441\u0448\u0438\u0440\u044f\u0435\u0442 \u043f\u0435\u0440\u0432\u044b\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438 \u0438 \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432, \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0435. \u041f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 SLSA 2 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0442\u0441\u043b\u0435\u0434\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u0432\u043d\u0435\u0441\u0435\u043d\u0438\u0435 \u043d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043a\u043e\u0434, \u0432 \u0441\u043b\u0443\u0447\u0430\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432.\n<li class=\"l\"> SLSA 3  &#8212; \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0435 \u0442\u0435\u043a\u0441\u0442\u044b \u0438 \u0441\u0431\u043e\u0440\u043e\u0447\u043d\u0430\u044f \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f\u043c \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043e\u0432, \u0433\u0430\u0440\u0430\u043d\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0434\u0438\u0442\u0430 \u043a\u043e\u0434\u0430 \u0438 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445. \u041f\u0440\u0435\u0434\u043f\u043e\u043b\u0430\u0433\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0430\u0443\u0434\u0438\u0442\u043e\u0440\u044b \u043c\u043e\u0433\u0443\u0442 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b \u043d\u0430 \u043f\u0440\u0435\u0434\u043c\u0435\u0442 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u044f \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f\u043c \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043e\u0432.\n<li class=\"l\"> SLSA 4 &#8212; \u043d\u0430\u0438\u0432\u044b\u0441\u0448\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c, \u0434\u043e\u043f\u043e\u043b\u043d\u044f\u044e\u0449\u0438\u0439 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0435 \u0443\u0440\u043e\u0432\u043d\u0438 \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u043c\u0438 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u043d\u0438\u044f\u043c\u0438:\n<ul>\n<li class=\"l\"> Revisione obbligatoria di tutte le modifiche da parte di due sviluppatori diversi.\n<li class=\"l\"> Tutti i passaggi della build, codice e dipendenze devono essere completamente dichiarati, tutte le dipendenze devono essere estratte e verificate separatamente, e il processo di build deve essere eseguito senza accesso alla rete.\n<li class=\"l\"> \u041f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u0435\u043c\u043e\u0439 \u0441\u0431\u043e\u0440\u043a\u0438  &#8212; \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c \u043f\u043e\u0432\u0442\u043e\u0440\u0438\u0442\u044c \u043f\u0440\u043e\u0446\u0435\u0441\u0441 \u0441\u0431\u043e\u0440\u043a\u0438 \u0441\u0432\u043e\u0438\u043c\u0438 \u0441\u0438\u043b\u0430\u043c\u0438 \u0438 \u0443\u0431\u0435\u0434\u0438\u0442\u044c\u0441\u044f, \u0447\u0442\u043e \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b \u0441\u043e\u0431\u0440\u0430\u043d \u0438\u0437 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0445\u043e\u0434\u043d\u044b\u0445 \u0442\u0435\u043a\u0441\u0442\u043e\u0432.        <\/ul>\n<p>      <center><img decoding=\"async\" alt=\"Google ha proposto SLSA per proteggere da modifiche dannose nel processo di sviluppo\" src=\"\/wp-content\/uploads\/2021\/06\/3f0bdd24afeec562582d8410b490e705.png\" style=\"display:block;margin: 0 auto;\" \/><\/center><br \/>\n<br \/>Fonte: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=55345\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a SLSA (Supply-chain Levels for Software Artifacts), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043e\u0431\u043e\u0431\u0449\u0451\u043d \u0438\u043c\u0435\u044e\u0449\u0438\u0439\u0441\u044f \u043e\u043f\u044b\u0442 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0442 \u0430\u0442\u0430\u043a, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u0442\u0435\u0441\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0441\u0431\u043e\u0440\u043a\u0438 \u0438 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430. \u041f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0441\u0442\u0430\u043d\u043e\u0432\u044f\u0442\u0441\u044f \u0432\u0441\u0451 \u0431\u043e\u043b\u0435\u0435 \u0441\u043b\u043e\u0436\u043d\u044b\u043c\u0438 \u0438 \u0437\u0430\u0432\u0438\u0441\u044f\u0449\u0438\u043c\u0438 \u043e\u0442 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0435\u0432, \u0447\u0442\u043e \u0441\u043e\u0437\u0434\u0430\u0451\u0442 \u0431\u043b\u0430\u0433\u043e\u043f\u0440\u0438\u044f\u0442\u043d\u044b\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f \u0434\u043b\u044f \u043f\u0440\u043e\u0434\u0432\u0438\u0436\u0435\u043d\u0438\u044f \u0430\u0442\u0430\u043a, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u043d\u0435 \u0441 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u0435\u043c \u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0435\u0439 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":100533,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100532","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a SLSA (Supply-chain Levels for Software Artifacts), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043e\u0431\u043e\u0431\u0449\u0451\u043d \u0438\u043c\u0435\u044e\u0449\u0438\u0439\u0441\u044f \u043e\u043f\u044b\u0442 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0442 \u0430\u0442\u0430\u043a, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/it\/blog\/news\/google-predlozhil-slsa-dlya-zashhity-ot-vredonosnyh-izmenenij-v-proczesse-razrabotki\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"it_IT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47Google \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b SLSA \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a SLSA (Supply-chain Levels for Software Artifacts), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043e\u0431\u043e\u0431\u0449\u0451\u043d \u0438\u043c\u0435\u044e\u0449\u0438\u0439\u0441\u044f \u043e\u043f\u044b\u0442 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0442 \u0430\u0442\u0430\u043a, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0438\u044f \u043a\u043e\u0434\u0430.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/it\/blog\/news\/google-predlozhil-slsa-dlya-zashhity-ot-vredonosnyh-izmenenij-v-proczesse-razrabotki\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-06-17T20:23:08+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-06-17T20:23:08+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Google ha proposto SLSA per proteggere da modifiche dannose nel processo di sviluppo | ProHoster","description":"Google ha presentato il framework SLSA (Supply-chain Levels for Software Artifacts), che riassume l'esperienza esistente nella protezione dell'infrastruttura di sviluppo da attacchi effettuati durante la scrittura del codice.","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/google-predlozhil-slsa-dlya-zashhity-ot-vredonosnyh-izmenenij-v-proczesse-razrabotki","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Google \u043f\u0440\u0435\u0434\u043b\u043e\u0436\u0438\u043b SLSA \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0439 \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 | ProHoster","og:description":"\u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Google \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a SLSA (Supply-chain Levels for Software Artifacts), \u0432 \u043a\u043e\u0442\u043e\u0440\u043e\u043c \u043e\u0431\u043e\u0431\u0449\u0451\u043d \u0438\u043c\u0435\u044e\u0449\u0438\u0439\u0441\u044f \u043e\u043f\u044b\u0442 \u043f\u043e \u0437\u0430\u0449\u0438\u0442\u0435 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u043e\u0442 \u0430\u0442\u0430\u043a, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u043d\u0430 \u0441\u0442\u0430\u0434\u0438\u0438 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u0438\u044f \u043a\u043e\u0434\u0430.","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/google-predlozhil-slsa-dlya-zashhity-ot-vredonosnyh-izmenenij-v-proczesse-razrabotki","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-06-17T20:23:08+00:00","article:modified_time":"2021-06-17T20:23:08+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100532","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-06-17 20:37:49","updated":"2026-02-09 21:38:12","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/100532","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=100532"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/100532\/revisions"}],"predecessor-version":[{"id":159918,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/100532\/revisions\/159918"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media\/100533"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=100532"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=100532"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=100532"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}