{"id":29957,"date":"2019-10-31T21:32:53","date_gmt":"2019-10-31T18:32:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/skanirovanie-na-uyazvimosti-i-bezopasnaya-razrabotka-chast-1\/"},"modified":"2019-10-31T21:32:53","modified_gmt":"2019-10-31T18:32:53","slug":"skanirovanie-na-uyazvimosti-i-bezopasnaya-razrabotka-chast-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/skanirovanie-na-uyazvimosti-i-bezopasnaya-razrabotka-chast-1","title":{"rendered":"Skajimi p\u00ebr vulnerabilitete dhe zhvillimi i sigurt. Pjesa 1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Skajimi
\n
\nN\u00eb kuadrin e profesionit t\u00eb zhvilluesve, pentester\u00ebve, dhe ekspert\u00ebve t\u00eb siguris\u00eb, shpesh p\u00ebrballen me procese si menaxhimi i dob\u00ebsive (Vulnerability Management - VM) dhe (Secure) SDLC.
\nPas k\u00ebtyre shprehjeve q\u00ebndrojn\u00eb grupe t\u00eb ndryshme praktikash dhe veglash q\u00eb jan\u00eb t\u00eb lidhura mes vete, megjithat\u00eb p\u00ebrdoruesit e tyre ndryshojn\u00eb.<\/p>\n

Teknologjia ende nuk ka arritur q\u00eb nj\u00eb mjet t\u00eb z\u00ebvend\u00ebsoj\u00eb njeriun p\u00ebr analizimin e siguris\u00eb s\u00eb infrastruktur\u00ebs dhe softuerit.
\n\u00cbsht\u00eb interesante t\u00eb kuptosh pse \u00ebsht\u00eb k\u00ebshtu dhe me cilat probleme p\u00ebrballen.
\n<\/a><\/noindex><\/p>\n

Proceset<\/h2>\n

\nProcesi i Menaxhimit t\u00eb Dob\u00ebsive (\u2018Vulnerability Management\u2019) \u00ebsht\u00eb i destinuar p\u00ebr monitorimin e vazhduesh\u00ebm t\u00eb siguris\u00eb s\u00eb infrastruktur\u00ebs dhe menaxhimin e patches.
\nProcesi i SDLC t\u00eb Sigurt (\u2018Secure SDLC\u2019) \u00ebsht\u00eb dizajnuar p\u00ebr t\u00eb mb\u00ebshtetur sigurin\u00eb e aplikacioneve gjat\u00eb zhvillimit dhe operimit.<\/p>\n

Nj\u00eb pjes\u00eb e ngjashme e k\u00ebtyre proceseve \u00ebsht\u00eb procesi i Vler\u00ebsimit t\u00eb Dob\u00ebsive \u2013 skanimi p\u00ebr dob\u00ebsi.
\nDallimi kryesor n\u00eb skanimin brenda VM dhe SDLC \u00ebsht\u00eb se n\u00eb rastin e par\u00eb, q\u00ebllimi \u00ebsht\u00eb t\u00eb zbulohet dob\u00ebsit\u00eb e njohura n\u00eb softuerin e tret\u00eb apo n\u00eb konfigurim. P\u00ebr shembull, nj\u00eb version t\u00eb vjet\u00ebruar t\u00eb Windows ose nj\u00eb sting komunitare t\u00eb paracaktuar p\u00ebr SNMP.
\nN\u00eb rastin e dyt\u00eb, q\u00ebllimi \u00ebsht\u00eb t\u00eb zbulohet dob\u00ebsit\u00eb jo vet\u00ebm n\u00eb p\u00ebrb\u00ebr\u00ebsit e jasht\u00ebm (var\u00ebsit\u00eb), por kryesisht n\u00eb kodin e produktit t\u00eb ri.<\/p>\n

Kjo shkakton dallime n\u00eb veglat dhe qasjet. N\u00eb mendimin tim, detyra e gjetjes s\u00eb dob\u00ebsive t\u00eb reja n\u00eb nj\u00eb aplikacion \u00ebsht\u00eb shum\u00eb m\u00eb interesante, pasi nuk reduktohet n\u00eb p\u00ebrcaktimin e versioneve, grumbullimin e banners, kontrollin e fjal\u00ebkalimeve, etj.
\nP\u00ebr nj\u00eb skanimin cil\u00ebsor t\u00eb automatizuar t\u00eb dob\u00ebsive t\u00eb aplikacioneve nevojiten algoritme q\u00eb marrin parasysh semantik\u00ebn e aplikacionit, q\u00ebllimet e tij, dhe k\u00ebrc\u00ebnimet specifike.<\/p>\n

Nj\u00eb skaner infrastrukture shpesh mund t\u00eb z\u00ebvend\u00ebsohet nga nj\u00eb timer, si\u00e7 shprehet avleonov<\/a><\/noindex>. Sens \u00ebsht\u00eb se, statistikisht, mund t\u00eb konsideroni infrastruktur\u00ebn tuaj si t\u00eb prekur, n\u00ebse nuk e keni p\u00ebrdit\u00ebsuar, p\u00ebr shembull, p\u00ebr nj\u00eb muaj.<\/p>\n

Mjetet<\/h2>\n

\nSkanimi, si dhe analizimi i siguris\u00eb, mund t\u00eb realizohet si kuti e zez\u00eb, ashtu edhe kuti e bardh\u00eb.<\/p>\n

Black Box<\/h4>\n

\nN\u00eb skanimin e kutis\u00eb s\u00eb zez\u00eb, instrumenti duhet t\u00eb jet\u00eb n\u00eb gjendje t\u00eb punoj\u00eb me sh\u00ebrbimin p\u00ebrmes atyre interfeseve q\u00eb i p\u00ebrdorin p\u00ebrdoruesit.<\/p>\n

Skaner\u00ebt e infrastruktur\u00ebs (Tenable Nessus, Qualys, MaxPatrol, Rapid7 Nexpose, etj.) k\u00ebrkojn\u00eb porta t\u00eb hapura t\u00eb rrjetit, grumbullojn\u00eb \u2018banners\u2019, p\u00ebrcaktojn\u00eb versionet e softuerit t\u00eb instaluar dhe k\u00ebrkojn\u00eb n\u00eb baz\u00ebn e t\u00eb dh\u00ebnave p\u00ebr informacion mbi dob\u00ebsit\u00eb n\u00eb k\u00ebto versione. Gjithashtu, p\u00ebrpiqen t\u00eb zbulojn\u00eb gabimet e konfigurimit, si fjal\u00ebkalimet e paracaktuara apo aksesin e hapur n\u00eb t\u00eb dh\u00ebna, dhe algoritmet e dob\u00ebta SSL, etj.<\/p>\n

Skaner\u00ebt e aplikacioneve (Acunetix WVS, Netsparker, Burp Suite, OWASP ZAP, etj.) gjithashtu din\u00eb t\u00eb p\u00ebrcaktojn\u00eb p\u00ebrb\u00ebr\u00ebsit e njohur dhe versionet e tyre (p\u00ebr shembull, CMS, framework, biblioteka JS). Hapat kryesor\u00eb t\u00eb skanerit jan\u00eb crawling dhe fuzzing.
\nGjat\u00eb crawling, skaneri grumbullon informacion mbi interfesat ekzistuese t\u00eb aplikacionit, parametrat HTTP. Gjat\u00eb fuzzing, n\u00eb t\u00eb gjitha parametrat e zbuluar vendosen t\u00eb dh\u00ebna t\u00eb modifikuara ose t\u00eb gjeneruara me q\u00ebllim t\u00eb provokojn\u00eb nj\u00eb gabim dhe t\u00eb zbulojn\u00eb nj\u00eb dob\u00ebsi.<\/p>\n

K\u00ebta skaner\u00eb aplikacionesh i p\u00ebrkasin klasave DAST dhe IAST \u2014 p\u00ebrkat\u00ebsisht Dinamik dhe Interaktiv Testimi i Siguris\u00eb s\u00eb Aplikacioneve.<\/p>\n

White Box<\/h4>\n

\nN\u00eb skanimin e kutis\u00eb s\u00eb bardh\u00eb ka m\u00eb shum\u00eb dallime.
\nN\u00eb kuadrin e procesit VM, skaner\u00ebt (Vulners, Incsecurity Couch, Vuls, Tenable Nessus, etj.) shpesh u jepet qasje n\u00eb sistemet, duke kryer nj\u00eb skan t\u00eb autentifikuar. K\u00ebshtu, skaneri mund t\u00eb nxjerr\u00eb versionet e instaluara t\u00eb paketave dhe parametrat e konfigurimit direkt nga sistemi, pa iGuess-ing nga banners e sh\u00ebrbimeve rrjet.
\nSkanimi b\u00ebhet m\u00eb i sakt\u00eb dhe m\u00eb i plot\u00eb.<\/p>\n

N\u00ebse flasim p\u00ebr skanimin e kutis\u00eb s\u00eb bardh\u00eb (CheckMarx, HP Fortify, Coverity, RIPS, FindSecBugs, etj.) t\u00eb aplikacioneve, zakonisht b\u00ebhet fjal\u00eb p\u00ebr analiz\u00ebn statike t\u00eb kodit dhe p\u00ebrdorimin e veglave p\u00ebrkat\u00ebse t\u00eb klas\u00ebs SAST \u2014 Testimi Statik i Siguris\u00eb s\u00eb Aplikacioneve.<\/p>\n

Problemet<\/h2>\n

\nKa shum\u00eb probleme me skanimin! Me shumic\u00ebn e tyre, jam ballur personalisht n\u00eb kuad\u00ebr t\u00eb ofrimit t\u00eb sh\u00ebrbimit p\u00ebr nd\u00ebrtimin e proceseve t\u00eb skanimit dhe zhvillimit t\u00eb sigurt, si dhe gjat\u00eb proceseve t\u00eb analiz\u00ebs s\u00eb siguris\u00eb.<\/p>\n

P\u00ebrmend tre grupe kryesore problemesh, t\u00eb cilat konfirmohen nga bisedat me inxhinier\u00ebt dhe drejtuesit e sh\u00ebrbimeve t\u00eb siguris\u00eb n\u00eb nj\u00eb num\u00ebr t\u00eb ndrysh\u00ebm kompanish.<\/p>\n

Problemet e skanimit t\u00eb aplikacioneve n\u00eb web<\/h4>\n

<\/p>\n

    \n
  1. V\u00ebshtir\u00ebsia e implementimit.<\/b> Skaner\u00ebt duhet t\u00eb vendosen, konfigurohen, t\u00eb personalizohen p\u00ebr \u00e7do aplikacion, t\u00eb caktuara mjedise testimi p\u00ebr skanime dhe t\u00eb integrohen n\u00eb procesin CI\/CD n\u00eb m\u00ebnyr\u00eb q\u00eb t\u00eb jen\u00eb efektiv. Ndryshe, kjo do t\u00eb jet\u00eb nj\u00eb procedur\u00eb formale e padobishme, q\u00eb jep vet\u00ebm falsifikime.<\/li>\n
  2. Koh\u00ebzgjatja e skanimit.<\/b> Skener\u00ebt, edhe n\u00eb 2019, kan\u00eb probleme t\u00eb m\u00ebdha me dedupikimin e nd\u00ebrfaqeve dhe mund t\u00eb skanojn\u00eb p\u00ebr dit\u00eb t\u00eb t\u00ebra nj\u00eb mij\u00eb faqe me 10 parametra n\u00eb secil\u00ebn, duke i konsideruar ato t\u00eb ndryshme, ndon\u00ebse nj\u00ebsi e nj\u00ebjt\u00eb kodi \u00ebsht\u00eb p\u00ebrgjegj\u00ebse p\u00ebr to. N\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, vendimi p\u00ebr t\u00eb b\u00ebr\u00eb deploy n\u00eb prodhim brenda ciklit t\u00eb zhvillimit duhet t\u00eb merret shpejt.<\/li>\n
  3. Rekomandime t\u00eb kufizuara.<\/b> Skener\u00ebt ofrojn\u00eb rekomandime mjaft t\u00eb p\u00ebrgjithshme, dhe nuk \u00ebsht\u00eb gjithmon\u00eb e leht\u00eb p\u00ebr zhvilluesin t\u00eb kuptoj\u00eb shpejt se si t'i ulet niveli i rrezikut, dhe m\u00eb e r\u00ebnd\u00ebsishmja, n\u00ebse duhet ta b\u00ebj\u00eb k\u00ebt\u00eb tani, apo mund t\u00eb pres\u00eb.<\/li>\n
  4. Ndikim destruktiv n\u00eb aplikacion.<\/b> Skener\u00ebt mund t\u00eb kryejn\u00eb me leht\u00ebsi nj\u00eb sulm DoS ndaj aplikacionit, si dhe mund t\u00eb krijojn\u00eb shum\u00eb entitete ose t\u00eb ndryshojn\u00eb ato ekzistuese (p\u00ebr shembull, t\u00eb krijojn\u00eb dhjet\u00ebra mij\u00ebra komente n\u00eb nj\u00eb blog), prandaj nuk duhen nisur skanime n\u00eb prodhim pa menduar.<\/li>\n
  5. Cil\u00ebsi e ul\u00ebt n\u00eb zbulimin e dob\u00ebsive.<\/b> Skener\u00ebt zakonisht p\u00ebrdorin nj\u00eb grup t\u00eb caktuar ngarkesash (\u2018payloads\u2019) dhe mund t\u00eb humbin leht\u00ebsisht nj\u00eb dob\u00ebsi q\u00eb nuk p\u00ebrputhet me skenarin e njohur t\u00eb sjelljes s\u00eb aplikacionit.<\/li>\n
  6. Moskuptimi i funksioneve t\u00eb aplikacionit nga skeneri.<\/b> Skener\u00ebt vet\u00eb nuk e din\u00eb se \u00e7far\u00eb \u00ebsht\u00eb \u2018bank\u00eb online\u2019, \u2018pages\u00eb\u2019, \u2018koment\u2019. P\u00ebr ata ekzistojn\u00eb vet\u00ebm lidhje dhe parametra, k\u00ebshtu q\u00eb nj\u00eb pjes\u00eb e madhe e mund\u00ebsive p\u00ebr dob\u00ebsi t\u00eb logjik\u00ebs s\u00eb biznesit mbetet krejt\u00ebsisht jasht\u00eb mbulimit, ata nuk do t\u00eb mendojn\u00eb p\u00ebr dyfishimin e pagesave, p\u00ebr t\u00eb par\u00eb t\u00eb dh\u00ebnat e t\u00eb tjer\u00ebve sipas ID-s\u00eb ose p\u00ebr t\u00eb manipuluar bilancin p\u00ebrmes rrumbullakimit.<\/li>\n
  7. Moskuptimi i semantik\u00ebs s\u00eb faqeve nga skeneri.<\/b> Skener\u00ebt nuk din\u00eb t\u00eb lexojn\u00eb FAQ, nuk din\u00eb t\u00eb njohin CAPTCHA, vet\u00eb nuk do t\u00eb kuptojn\u00eb se si duhet t\u00eb regjistrohen, dhe se m\u00eb pas duhet t\u00eb ri-identifikohen, se nuk duhet t\u00eb klikojn\u00eb \u2018logout\u2019, dhe si duhet t\u00eb n\u00ebnshkruhen k\u00ebrkesat kur ndryshojn\u00eb vlerat e parametrave. Si rezultat, nj\u00eb pjes\u00eb e madhe e aplikacionit mund t\u00eb mbetet krejt\u00ebsisht e pa skanuar.<\/li>\n<\/ol>\n

    Problemet e skanimit t\u00eb kodit t\u00eb burimit<\/h4>\n

    <\/p>\n

      \n
    1. Alarmet e rreme.<\/b> Analiza statike \u00ebsht\u00eb nj\u00eb detyr\u00eb e v\u00ebshtir\u00eb, ku shpeshher\u00eb duhet t\u00eb b\u00ebhen shum\u00eb kompromise. Shum\u00eb her\u00eb duhet t\u00eb sakrifikosh sakt\u00ebsin\u00eb, dhe madje edhe skener\u00ebt e shtrenjta enterprise japin nj\u00eb num\u00ebr t\u00eb madh alarmesh t\u00eb rreme.<\/li>\n
    2. V\u00ebshtir\u00ebsia e implementimit.<\/b> P\u00ebr t\u00eb rritur sakt\u00ebsin\u00eb dhe plot\u00ebsin\u00eb e analiz\u00ebs statike, \u00ebsht\u00eb e nevojshme t\u00eb p\u00ebrmir\u00ebsohen rregullat e skanimit, dhe shkruajta e k\u00ebtyre rregullave mund t\u00eb rezultoj\u00eb shum\u00eb e pun\u00ebs.<\/li>\n
    3. Mungesa e mb\u00ebshtetjes p\u00ebr var\u00ebsit\u00eb.<\/b> Projektet e m\u00ebdha varen nga nj\u00eb num\u00ebr t\u00eb madh bibliotekash dhe frameworkesh, q\u00eb zgjasin mund\u00ebsit\u00eb e gjuh\u00ebs s\u00eb programimit. N\u00ebse n\u00eb baz\u00ebn e njohurive t\u00eb skenerit nuk ka informacion mbi vendet e rrezikshme (\u2018sinks\u2019) n\u00eb k\u00ebto frameworke, kjo do t\u00eb jet\u00eb nj\u00eb pik\u00eb e verb\u00ebr, dhe skeneri thjesht nuk do t\u00eb kuptoj\u00eb kodin.<\/li>\n
    4. Koh\u00ebzgjatja e skanimit.<\/b> Gjetja e dob\u00ebsive n\u00eb kod \u00ebsht\u00eb nj\u00eb detyr\u00eb e nd\u00ebrlikuar dhe n\u00eb terma algoritmike. K\u00ebshtu q\u00eb procesi mund t\u00eb zgjat dhe t\u00eb k\u00ebrkoj\u00eb burime t\u00eb konsiderueshme kompjuterike.<\/li>\n
    5. Mbulim i ul\u00ebt.<\/b> Pavar\u00ebsisht konsumit t\u00eb burimeve dhe koh\u00ebzgjatjes s\u00eb skanimit, zhvilluesit e mjeteve SAST p\u00ebrs\u00ebri duhet t\u00eb b\u00ebjn\u00eb kompromise dhe t\u00eb analizojn\u00eb jo t\u00eb gjitha shtetet q\u00eb mund t\u00eb ket\u00eb programi.<\/li>\n
    6. Riprodhueshm\u00ebria e gjetjeve.<\/b> T\u00eb tregosh nj\u00eb rresht t\u00eb ve\u00e7ant\u00eb dhe nj\u00eb grumbull thirrjesh q\u00eb \u00e7ojn\u00eb n\u00eb nj\u00eb dob\u00ebsi \u00ebsht\u00eb e shk\u00eblqyer, por n\u00eb t\u00eb v\u00ebrtet\u00eb shpesh skeneri nuk ofron mjaft informacion p\u00ebr t\u00eb verifikuar n\u00ebse ka nj\u00eb dob\u00ebsi nga jasht\u00eb. Mungesa mund t\u00eb jet\u00eb gjithashtu n\u00eb kodin e vdekur, q\u00eb \u00ebsht\u00eb i paarritsh\u00ebm p\u00ebr sulmuesin.<\/li>\n<\/ol>\n

      Problemet e skanimit t\u00eb infrastruktur\u00ebs<\/h4>\n

      <\/p>\n

        \n
      1. Inventarizim i pamjaftuesh\u00ebm.<\/b> N\u00eb infrastrukturat e m\u00ebdha, ve\u00e7an\u00ebrisht ato gjeografikisht t\u00eb ndara, shpesh \u00ebsht\u00eb m\u00eb e v\u00ebshtir\u00eb t\u00eb kuptohet se cilat hoste duhet t\u00eb skanohen. Me fjal\u00eb t\u00eb tjera, detyra e skanimit \u00ebsht\u00eb ngusht\u00eb e lidhur me detyr\u00ebn e menaxhimit t\u00eb aseteve.<\/li>\n
      2. Prioritizim i dob\u00ebt.<\/b> Skener\u00ebt rrjet\u00eb shpesh ofrojn\u00eb shum\u00eb rezultate me t\u00eb meta, q\u00eb n\u00eb praktik\u00eb nuk jan\u00eb t\u00eb shfryt\u00ebzueshme, por formalisht niveli i rrezikut \u00ebsht\u00eb i lart\u00eb. Konsumatori merr nj\u00eb raport q\u00eb \u00ebsht\u00eb e v\u00ebshtir\u00eb t\u00eb interpretohet, dhe nuk \u00ebsht\u00eb e qart\u00eb se \u00e7far\u00eb duhet t\u00eb rregullohet fillimisht.<\/li>\n
      3. Rekomandime t\u00eb kufizuara.<\/b> N\u00eb baz\u00ebn e njohurive t\u00eb skenerit shpesh ka vet\u00ebm informacion shum\u00eb t\u00eb p\u00ebrgjithsh\u00ebm mbi dob\u00ebsin\u00eb dhe m\u00ebnyrat e saj t\u00eb rregullimit, k\u00ebshtu q\u00eb administrator\u00ebt do t\u00eb duhet t\u00eb armatosen me Google. Situata \u00ebsht\u00eb pak m\u00eb e mir\u00eb me skener\u00ebt whitebox, t\u00eb cil\u00ebt mund t\u00eb japin nj\u00eb komand\u00eb t\u00eb sakt\u00eb p\u00ebr rregullimin.<\/li>\n
      4. Puna manuale.<\/b> N\u00eb infrastrukturat mund t\u00eb ket\u00eb shum\u00eb nyje, e k\u00ebshtu, potencialisht shum\u00eb t\u00eb meta, p\u00ebr raportet n\u00eb lidhje me t\u00eb cilat duhet t\u00eb b\u00ebhet analiza manuale n\u00eb \u00e7do iteracion.<\/li>\n
      5. Mbulim i dob\u00ebt.<\/b> Cil\u00ebsia e skanimit t\u00eb infrastruktur\u00ebs varet drejtp\u00ebrdrejt nga volumi i baz\u00ebs s\u00eb njohurive p\u00ebr dob\u00ebsit\u00eb dhe versionet e softuerit. Megjithat\u00eb, ndodh<\/a><\/noindex>, madje edhe lider\u00ebt e tregut nuk kan\u00eb nj\u00eb baz\u00eb njohurish t\u00eb plot\u00eb, dhe n\u00eb bazat e zgjidhjeve falas ka shum\u00eb informacion q\u00eb lider\u00ebt nuk e kan\u00eb.<\/li>\n
      6. Problemet me patching.<\/b> Shpeshher\u00eb, patching i dob\u00ebsive n\u00eb infrastruktur\u00eb \u00ebsht\u00eb nj\u00eb p\u00ebrdit\u00ebsim i paket\u00ebs ose ndryshim i skedarit t\u00eb konfigurimit. Nj\u00eb problem i madh k\u00ebtu \u00ebsht\u00eb se sistemi, ve\u00e7an\u00ebrisht ai legacy, mund t\u00eb sillet n\u00eb m\u00ebnyr\u00eb t\u00eb paparashikueshme si rezultat i p\u00ebrdit\u00ebsimit. N\u00eb thelb, do t\u00eb duhet t\u00eb b\u00ebhen teste integruese n\u00eb infrastruktur\u00ebn aktive n\u00eb prodhim.<\/li>\n<\/ol>\n

        Qasjet<\/h2>\n

        \n\u00c7far\u00eb t\u00eb b\u00ebjm\u00eb?
        \nM\u00eb shum\u00eb rreth shembujve dhe m\u00ebnyrave p\u00ebr t'u p\u00ebrballur me shumic\u00ebn e problemeve t\u00eb p\u00ebrmendura, do t\u00eb flas n\u00eb pjes\u00ebt e ardhshme, por p\u00ebr momentin do t\u00eb p\u00ebrmend drejtime t\u00eb tjera ku mund t\u00eb punohet:<\/p>\n

          \n
        1. Agregimi i instrumenteve t\u00eb ndryshme t\u00eb skanimit.<\/b> Me p\u00ebrdorimin e duhur t\u00eb disa skaner\u00ebve, mund t\u00eb arrihet nj\u00eb rritje e konsiderueshme e baz\u00ebs s\u00eb njohurive dhe cil\u00ebsis\u00eb s\u00eb detektimit. Mund t\u00eb gjenden madje edhe m\u00eb shum\u00eb dob\u00ebsi sesa n\u00eb total nga t\u00eb gjith\u00eb skaner\u00ebt e ekzekutuar ndaras, duke mund\u00ebsuar vler\u00ebsimin m\u00eb t\u00eb sakt\u00eb t\u00eb nivelit t\u00eb rrezikut dhe shpjegimin e rekomandimeve m\u00eb t\u00eb shumta.<\/li>\n
        2. Integrimi i SAST dhe DAST.<\/b> Mund t\u00eb rritet mbulimi i DAST dhe sakt\u00ebsia e SAST p\u00ebrmes shk\u00ebmbimit t\u00eb informacionit midis tyre. Nga burimet mund t\u00eb merret informacion mbi rrug\u00ebt ekzistuese, nd\u00ebrsa me DAST mund t\u00eb kontrollohet n\u00ebse dob\u00ebsia \u00ebsht\u00eb e dukshme nga jasht.<\/li>\n
        3. Machine Learning\u2122.<\/b> N\u00eb vitin 2015 un\u00eb kam folur<\/a><\/noindex> (dhe ende<\/a><\/noindex>) flisja p\u00ebr p\u00ebrdorimin e statistik\u00ebs p\u00ebr t\u00eb dh\u00ebn\u00eb skaner\u00ebve intuit\u00ebn e hackerit dhe p\u00ebr t'i p\u00ebrshpejtuar. Kjo \u00ebsht\u00eb pa dyshim ushqim p\u00ebr zhvillimin e analiz\u00ebs automatike t\u00eb siguris\u00eb n\u00eb t\u00eb ardhmen.<\/li>\n
        4. Integrimi i IAST me testet automatike dhe OpenAPI.<\/b> N\u00eb kuad\u00ebr t\u00eb CI\/CD-pipeline \u00ebsht\u00eb e mundur t\u00eb krijohet nj\u00eb proces skanimi bazuar n\u00eb instrumente q\u00eb funksionojn\u00eb si HTTP-proxy dhe teste funksionale q\u00eb punojn\u00eb p\u00ebrmes HTTP. Testet dhe kontratat OpenAPI\/Swagger do t'i ofrojn\u00eb skanerit informacionin e nevojsh\u00ebm mbi flukset e t\u00eb dh\u00ebnave, duke mund\u00ebsuar skanimin e aplikacionit n\u00eb gjendje t\u00eb ndryshme.<\/li>\n
        5. Konfigurimi i duhur.<\/b> P\u00ebr \u00e7do aplikacion dhe infrastruktur\u00eb duhet krijuar nj\u00eb profil skanimi adekuat, duke marr\u00eb parasysh numrin dhe natyr\u00ebn e nd\u00ebrfaqeve, teknologjit\u00eb e p\u00ebrdorura.<\/li>\n
        6. Personalizimi i skaner\u00ebve.<\/b> Shpeshher\u00eb, aplikacioni nuk mund t\u00eb skanohet pa p\u00ebrmir\u00ebsimin e skanerit. Nj\u00eb shembull \u00ebsht\u00eb porta e pagesave, n\u00eb t\u00eb cil\u00ebn \u00e7do k\u00ebrkes\u00eb duhet t\u00eb jet\u00eb e n\u00ebnshkruar. Pa shkruar nj\u00eb lidh\u00ebs p\u00ebr protokollin e port\u00ebs, skaner\u00ebt do t\u00eb zhvillojn\u00eb k\u00ebrkesa me n\u00ebnshkrime t\u00eb gabuara. Gjithashtu, \u00ebsht\u00eb e nevojshme t\u00eb shkruhen skaner\u00eb t\u00eb specializuar p\u00ebr llojin e ve\u00e7ant\u00eb t\u00eb dob\u00ebsive, si p.sh. Insecure Direct Object Reference<\/a><\/noindex><\/li>\n
        7. Menaxhimi i riskut.<\/b> P\u00ebrdorimi i skaner\u00ebve t\u00eb ndrysh\u00ebm dhe integrimi me sisteme t\u00eb jashtme, si Asset Management dhe Threat Management, do t\u00eb lejoj\u00eb p\u00ebrdorimin e shum\u00eb parametrave p\u00ebr vler\u00ebsimin e nivelit t\u00eb rrezikut, n\u00eb m\u00ebnyr\u00eb q\u00eb drejtuesit t\u00eb mund t\u00eb marrin nj\u00eb pasqyr\u00eb t\u00eb sakt\u00eb mbi gjendjen aktuale t\u00eb siguris\u00eb s\u00eb zhvillimit ose infrastruktur\u00ebs.<\/li>\n<\/ol>\n

          Q\u00ebndroni t\u00eb informuar dhe le t\u00eb disruptojm\u00eb skanimin e t\u00eb vulnerueshmeve!
          \n
          Burimi:           habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

          \u0412 \u0440\u0430\u043c\u043a\u0430\u0445 \u043f\u0440\u043e\u0444\u0435\u0441\u0441\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0439 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c, \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430\u043c, \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0441\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0441 \u0442\u0430\u043a\u0438\u043c\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c\u0438, \u043a\u0430\u043a Vulnerability Management (VM), (Secure) SDLC. \u041f\u043e\u0434 \u044d\u0442\u0438\u043c\u0438 \u0441\u043b\u043e\u0432\u043e\u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u044f\u043c\u0438 \u0441\u043a\u0440\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u043d\u0430\u0431\u043e\u0440\u044b \u043f\u0440\u0430\u043a\u0442\u0438\u043a \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0435\u0440\u0435\u043f\u043b\u0435\u0442\u0435\u043d\u044b \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439, \u0445\u043e\u0442\u044f \u0438\u0445 \u043f\u043e\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043b\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u0430\u044e\u0442\u0441\u044f. \u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043f\u0440\u043e\u0433\u0440\u0435\u0441\u0441 \u043f\u043e\u043a\u0430 \u043d\u0435 \u0434\u043e\u0448\u0451\u043b \u0434\u043e \u0442\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0434\u043d\u0438\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u043c \u0437\u0430\u043c\u0435\u043d\u0438\u0442\u044c \u0447\u0435\u043b\u043e\u0432\u0435\u043a\u0430 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u041f\u041e. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-29957","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Skanimi i dob\u00ebsive dhe zhvillimi i sigurt. Pjesa 1 | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/skanirovanie-na-uyazvimosti-i-bezopasnaya-razrabotka-chast-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0430. \u0427\u0430\u0441\u0442\u044c 1 | ProHoster","og:url":"https:\/\/prohoster.info\/sq\/blog\/skanirovanie-na-uyazvimosti-i-bezopasnaya-razrabotka-chast-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:32:53+00:00","article:modified_time":"2019-10-31T18:32:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"29957","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-20 23:11:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:45:24","updated":"2026-01-20 23:11:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/29957","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=29957"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/29957\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=29957"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=29957"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=29957"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}