{"id":29957,"date":"2019-10-31T21:32:53","date_gmt":"2019-10-31T18:32:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/skanirovanie-na-uyazvimosti-i-bezopasnaya-razrabotka-chast-1\/"},"modified":"2019-10-31T21:32:53","modified_gmt":"2019-10-31T18:32:53","slug":"skanirovanie-na-uyazvimosti-i-bezopasnaya-razrabotka-chast-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/skanirovanie-na-uyazvimosti-i-bezopasnaya-razrabotka-chast-1","title":{"rendered":"Skonimi p\u00ebr cenueshm\u00ebri dhe zhvillim i sigurt. Pjesa 1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Skonimi
\n
\nN\u00eb kuad\u00ebr t\u00eb aktivitetit profesional, zhvilluesit, p\u00ebntester-at dhe ekspert\u00ebt e siguris\u00eb p\u00ebrballen shpesh me procese si Management i Vulnerabiliteteve (VM) dhe SDLC-i (i sigurt).
\nPas k\u00ebtyre shprehjeve q\u00ebndrojn\u00eb grupe t\u00eb ndryshme praktikash dhe mjeteve t\u00eb p\u00ebrdorura, t\u00eb cilat jan\u00eb t\u00eb nd\u00ebrlidhura me nj\u00ebra-tjetr\u00ebn, ndon\u00ebse p\u00ebrdoruesit e tyre dallojn\u00eb.<\/p>\n

Progresi teknik ende nuk ka arritur q\u00eb nj\u00eb mjet t\u00eb z\u00ebvend\u00ebsoj\u00eb njeriun n\u00eb analizimin e siguris\u00eb s\u00eb infrastruktur\u00ebs dhe softuerit.
\n\u00cbsht\u00eb e interesante t\u00eb kuptohet pse ndodh k\u00ebshtu dhe me cilat probleme p\u00ebrballen.
\n<\/a><\/noindex><\/p>\n

Proceset<\/h2>\n

\nProcesi i Management-it t\u00eb Vulnerabiliteteve ('vulnerabiliteteve') ka p\u00ebr q\u00ebllim monitorimin e vazhduesh\u00ebm t\u00eb mbrojtjes s\u00eb infrastruktur\u00ebs dhe menaxhimin e patch-\u00ebve.
\nProcesi i Secure SDLC (' cikli i zhvillimit t\u00eb sigurt') \u00ebsht\u00eb i destinuar p\u00ebr t\u00eb mb\u00ebshtetur sigurin\u00eb e aplikacionit gjat\u00eb zhvillimit dhe operimit.<\/p>\n

Nj\u00eb pjes\u00eb e ngjashme e k\u00ebtyre proceseve \u00ebsht\u00eb procesi i Vler\u00ebsimit t\u00eb Vulnerabiliteteve \u2014 skanimi p\u00ebr vulnerabilitete.
\nDallimi kryesor n\u00eb skanimin brenda VM dhe SDLC \u00ebsht\u00eb se n\u00eb rastin e par\u00eb, q\u00ebllimi \u00ebsht\u00eb t\u00eb zbulohet vulnerabilitetet e njohura n\u00eb softuerin e jasht\u00ebm ose n\u00eb konfiguracion. P\u00ebr shembull, nj\u00eb version t\u00eb vjet\u00ebr t\u00eb Windows-it ose nj\u00eb string komuniteti n\u00eb m\u00ebnyr\u00eb t\u00eb paracaktuar p\u00ebr SNMP.
\nN\u00eb rastin e dyt\u00eb, q\u00ebllimi \u00ebsht\u00eb t\u00eb zbulohet vulnerabilitetet jo vet\u00ebm n\u00eb komponent\u00ebt e jasht\u00ebm (var\u00ebsive), por m\u00eb s\u00eb pari n\u00eb kodin e produktit t\u00eb ri.<\/p>\n

Kjo krijon dallime n\u00eb mjete dhe qasje. Sipas mendimit tim, detyra e gjetjes s\u00eb vulnerabiliteteve t\u00eb reja n\u00eb aplikacion \u00ebsht\u00eb shum\u00eb m\u00eb interesante, pasi nuk kufizohet n\u00eb fingerprinting t\u00eb versioneve, mbledhjen e bannerave, dhe provimin e fjal\u00ebkalimeve.
\nP\u00ebr skanimin cil\u00ebsor t\u00eb automatizuar t\u00eb vulnerabiliteteve t\u00eb aplikacioneve, jan\u00eb t\u00eb nevojshme algoritme q\u00eb marrin n\u00eb konsiderat\u00eb semantik\u00ebn e aplikacionit, q\u00ebllimet e tij dhe k\u00ebrc\u00ebnimet specifike.<\/p>\n

Nj\u00eb skaner i infrastruktur\u00ebs mund t\u00eb z\u00ebvend\u00ebsohet shpesh me nj\u00eb timer, si\u00e7 shprehet ai avleonov.<\/a><\/noindex>Kuptimi \u00ebsht\u00eb se statistikat tregojn\u00eb se mund ta konsideroni infrastruktur\u00ebn tuaj t\u00eb vulnerueshme n\u00ebse nuk e keni p\u00ebrdit\u00ebsuar, le t\u00eb themi, p\u00ebr nj\u00eb muaj.<\/p>\n

Mjetet<\/h2>\n

\nSkanimi, si dhe analiza e siguris\u00eb, mund t\u00eb kryhet si me kutin\u00eb e zez\u00eb, ashtu edhe me kutin\u00eb e bardh\u00eb.<\/p>\n

Black Box<\/h4>\n

\nMe skanimin blackbox, mjeti duhet t\u00eb jet\u00eb n\u00eb gjendje t\u00eb punoj\u00eb me sh\u00ebrbimin p\u00ebrmes atyre nd\u00ebrfaqeve, me t\u00eb cilat punojn\u00eb p\u00ebrdoruesit.<\/p>\n

Skener\u00ebt e infrastruktur\u00ebs (Tenable Nessus, Qualys, MaxPatrol, Rapid7 Nexpose etj.) k\u00ebrkojn\u00eb porte t\u00eb hapura rrjeti, mbledhin \"banner-a\", p\u00ebrcaktojn\u00eb versionet e softuerit t\u00eb instaluar dhe k\u00ebrkojn\u00eb n\u00eb baz\u00ebn e tyre t\u00eb t\u00eb dh\u00ebnave informacione mbi dob\u00ebsit\u00eb n\u00eb k\u00ebto versione. Ato gjithashtu p\u00ebrpiqen t\u00eb zbulojn\u00eb gabime konfigurimi, si\u00e7 jan\u00eb fjal\u00ebkalimet standarde ose hyrje t\u00eb hapur n\u00eb t\u00eb dh\u00ebna, cifrime t\u00eb dob\u00ebta SSL etj.<\/p>\n

Skener\u00ebt e aplikacioneve web (Acunetix WVS, Netsparker, Burp Suite, OWASP ZAP etj.) gjithashtu din\u00eb t\u00eb identifikojn\u00eb komponent\u00ebt e njohur dhe versionet e tyre (p.sh., CMS, korniza, bibliotekat JS). Hapat kryesor\u00eb t\u00eb skenerit jan\u00eb crawling dhe fuzzing.
\nGjat\u00eb procesit t\u00eb crawling, skeneri mbledh informacion mbi nd\u00ebrfaqet ekzistuese t\u00eb aplikacionit, parametrat HTTP. Gjat\u00eb fuzzing, n\u00eb t\u00eb gjitha parametrat e zbuluar futen t\u00eb dh\u00ebna t\u00eb modifikuara ose t\u00eb gjeneruara me q\u00ebllim p\u00ebr t\u00eb provokuar nj\u00eb gabim dhe zbuluar nj\u00eb dob\u00ebsi.<\/p>\n

K\u00ebta skener\u00eb aplikacionesh i p\u00ebrkasin klasave DAST dhe IAST \u2014 p\u00ebrkat\u00ebsisht Dynamic dhe Interactive Application Security Testing.<\/p>\n

White Box<\/h4>\n

\nMe skanimin whitebox, dallimet jan\u00eb m\u00eb t\u00eb m\u00ebdha.
\nN\u00eb kuad\u00ebr t\u00eb procesit VM, skener\u00ebt (Vulners, Incsecurity Couch, Vuls, Tenable Nessus etj.) shpesh i jepet qasje n\u00eb sisteme, duke kryer nj\u00eb skan autentik. K\u00ebshtu, skeneri mund t\u00eb nxjerr\u00eb versionet e instaluara t\u00eb pakos dhe parametrat e konfigurimit direkt nga sistemi, pa i gjetur ato nga banner-at e sh\u00ebrbimeve rrjet\u00eb.
\nSkanimi b\u00ebhet m\u00eb i sakt\u00eb dhe m\u00eb i plot\u00eb.<\/p>\n

N\u00ebse flasim p\u00ebr skanimin whitebox (CheckMarx, HP Fortify, Coverity, RIPS, FindSecBugs etj.) t\u00eb aplikacioneve, zakonisht b\u00ebhet fjal\u00eb p\u00ebr analiz\u00ebn statike t\u00eb kodit dhe p\u00ebrdorimin e mjeteve p\u00ebrkat\u00ebse t\u00eb klas\u00ebs SAST \u2014 Static Application Security Testing.<\/p>\n

Problemet<\/h2>\n

\nKa shum\u00eb probleme gjat\u00eb skanimit! Me shumic\u00ebn e tyre p\u00ebrball\u00ebm personalisht n\u00eb kuad\u00ebr t\u00eb ofrimit t\u00eb sh\u00ebrbimit p\u00ebr nd\u00ebrtimin e proceseve t\u00eb skanimit dhe zhvillimit t\u00eb sigurt, si dhe gjat\u00eb analizave t\u00eb siguris\u00eb.<\/p>\n

Dua t\u00eb theksoj 3 grupe kryesore problemesh, t\u00eb cilat konfirmohen edhe nga bisedat me inxhinier\u00ebt dhe drejtuesit e sh\u00ebrbimeve t\u00eb siguris\u00eb n\u00eb kompani t\u00eb ndryshme.<\/p>\n

Problemet e skanimit t\u00eb aplikacioneve web<\/h4>\n

<\/p>\n

    \n
  1. V\u00ebshtir\u00ebsia e implementimit.<\/b> Skener\u00ebt duhet t\u00eb rregullohen, konfigurohen, dhe t\u00eb personalizohen p\u00ebr \u00e7do aplikacion, t\u00eb dedikohen mjedise testimi p\u00ebr skanime dhe t\u00eb integrohen n\u00eb procesin CI\/CD p\u00ebr ta b\u00ebr\u00eb k\u00ebt\u00eb efikas. N\u00eb t\u00eb kund\u00ebrt, do t\u00eb jet\u00eb nj\u00eb procedur\u00eb formale e pavler\u00eb, duke gjeneruar vet\u00ebm alarmet e rreme.<\/li>\n
  2. Koh\u00ebzgjatja e skanimit.<\/b> Skener\u00ebt edhe n\u00eb 2019 kan\u00eb v\u00ebshtir\u00ebsi n\u00eb deduplifikimin e nd\u00ebrfaqeve dhe mund t\u00eb skanojn\u00eb p\u00ebr dit\u00eb me radh\u00eb mij\u00ebra faqe me 10 parametra n\u00eb secil\u00ebn, duke i konsideruar ato t\u00eb ndryshme, edhe pse nj\u00eb kod i vet\u00ebm \u00ebsht\u00eb p\u00ebrgjegj\u00ebs p\u00ebr to. N\u00eb k\u00ebt\u00eb kuptim, vendimi p\u00ebr t\u00eb \u00e7uar n\u00eb prodhim gjat\u00eb ciklit t\u00eb zhvillimit duhet t\u00eb merret shpejt.<\/li>\n
  3. Rekomandime t\u00eb pakta.<\/b> Skener\u00ebt japin rekomandime tep\u00ebr t\u00eb p\u00ebrgjithshme, dhe nuk \u00ebsht\u00eb gjithmon\u00eb e mundur q\u00eb zhvilluesi t\u00eb kuptoj\u00eb shpejt se si t\u00eb zvog\u00ebloj\u00eb nivelin e rrezikut, dhe m\u00eb kryesorja, n\u00ebse duhet ta b\u00ebj\u00eb k\u00ebt\u00eb menj\u00ebher\u00eb, apo mund t\u00eb pres\u00eb.<\/li>\n
  4. D\u00ebmtim i mundsh\u00ebm i aplikacionit.<\/b> Skener\u00ebt mund t\u00eb realizojn\u00eb nj\u00eb sulm DoS mbi aplikacionin, dhe gjithashtu mund t\u00eb krijojn\u00eb nj\u00eb num\u00ebr t\u00eb madh entitetesh ose t\u00eb modifikojn\u00eb ato ekzistuese (p.sh., krijimi i dhjet\u00ebra mij\u00ebra komenteve n\u00eb nj\u00eb blog), prandaj nuk duhet ta nisim pa mend skanimin n\u00eb prodhim.<\/li>\n
  5. Cil\u00ebsi e ul\u00ebt plotesuese e dob\u00ebsive.<\/b> Skener\u00ebt zakonisht p\u00ebrdorin nj\u00eb grup t\u00eb caktuar payload-esh dhe mund t\u00eb humbasin leht\u00eb nj\u00eb dob\u00ebsi q\u00eb nuk p\u00ebrputhet me skenarin e njohur t\u00eb sjelljes s\u00eb aplikacionit.<\/li>\n
  6. Munges\u00eb kuptimi t\u00eb funksioneve t\u00eb aplikacionit nga skener\u00ebt.<\/b> Skener\u00ebt vet\u00eb nuk e din\u00eb \u00e7far\u00eb \u00ebsht\u00eb nj\u00eb 'internet-bank\u00eb', 'pages\u00eb', 'komentar'. P\u00ebr ta, ekzistojn\u00eb vet\u00ebm lidhje dhe parametra, k\u00ebshtu q\u00eb nj\u00eb pjes\u00eb e madhe e dob\u00ebsive t\u00eb mundshme t\u00eb logjik\u00ebs s\u00eb biznesit mbetet krejt\u00ebsisht e pab\u00ebrsh\u00ebm, ata nuk do t\u00eb mendojn\u00eb p\u00ebr dyfishimin e pages\u00ebs, p\u00ebr t\u00eb par\u00eb t\u00eb dh\u00ebnat e t\u00eb tjer\u00ebve p\u00ebrmes ID-s\u00eb, ose p\u00ebr t\u00eb manipuluar bilancin p\u00ebrmes rrethimit.<\/li>\n
  7. Munges\u00eb kuptimi t\u00eb semantik\u00ebs s\u00eb faqeve nga skener\u00ebt.<\/b> Skener\u00ebt nuk din\u00eb t\u00eb lexojn\u00eb FAQ, nuk jan\u00eb n\u00eb gjendje t\u00eb njohin captchat, vet\u00eb ata nuk do t\u00eb mendojn\u00eb se si duhet regjistruar, dhe q\u00eb m\u00eb pas duhet t\u00eb ri-ky\u00e7en, se nuk duhet t\u00eb klikojn\u00eb 'logout', dhe si duhet t\u00eb n\u00ebnshkruhen k\u00ebrkesat gjat\u00eb ndryshimit t\u00eb vlerave t\u00eb parametrave. Si rezultat, nj\u00eb pjes\u00eb e madhe e aplikacionit mund t\u00eb mbetet krejt\u00ebsisht e pa skanuar.<\/li>\n<\/ol>\n

    Probleme n\u00eb skanimin e kodit burimor.<\/h4>\n

    <\/p>\n

      \n
    1. Alarmet e rreme.<\/b> Analiza statike \u00ebsht\u00eb nj\u00eb detyr\u00eb e nd\u00ebrlikuar, n\u00eb zgjidhjen e s\u00eb cil\u00ebs shpesh duhet t\u00eb b\u00ebhen shum\u00eb kompromis. Shpesh duhet t\u00eb sakrifikohet sakt\u00ebsia, dhe madje skanerat e shtrenjt\u00eb enterprise japin nj\u00eb sasi t\u00eb madhe rasti false.<\/li>\n
    2. V\u00ebshtir\u00ebsia e implementimit.<\/b> P\u00ebr t\u00eb rritur sakt\u00ebsin\u00eb dhe plot\u00ebsin\u00eb e analiz\u00ebs statike, \u00ebsht\u00eb e nevojshme t\u00eb p\u00ebrmir\u00ebsohen rregullat e skanimit, dhe shkruajtja e k\u00ebtyre rregullave mund t\u00eb jet\u00eb shum\u00eb e pun\u00ebs. Ndonj\u00ebher\u00eb \u00ebsht\u00eb m\u00eb e leht\u00eb t\u00eb gjesh t\u00eb gjitha vendet n\u00eb kod me ndonj\u00eb defekt dhe t'i korigjosh ato, sesa t\u00eb shkruash nj\u00eb rregull p\u00ebr t\u00eb zbuluar k\u00ebto raste.<\/li>\n
    3. Mungesa e mb\u00ebshtetjes p\u00ebr var\u00ebsit\u00eb.<\/b> Projekte t\u00eb m\u00ebdha varen nga nj\u00eb num\u00ebr i madh bibliotekash dhe framework\u00ebsh q\u00eb zgjasin mund\u00ebsit\u00eb e gjuh\u00ebs s\u00eb programimit. N\u00ebse n\u00eb baz\u00ebn e t\u00eb dh\u00ebnave t\u00eb skanerit nuk ka informacion mbi vendet e rrezikshme (\u201csinks\u201d) n\u00eb k\u00ebto framework-e, kjo do t\u00eb b\u00ebhet nj\u00eb pik\u00eb e verb\u00ebr, dhe skaneri nuk do ta kuptoj\u00eb dashur<\/li>\n
    4. Koh\u00ebzgjatja e skanimit.<\/b> Gjetja e dob\u00ebsive n\u00eb kod \u00ebsht\u00eb nj\u00eb detyr\u00eb e nd\u00ebrlikuar si n\u00eb terma algoritmike. Prandaj, procesi mund t\u00eb zgjas\u00eb dhe t\u00eb k\u00ebrkoj\u00eb burime t\u00eb m\u00ebdha t\u00eb llogaritjes.<\/li>\n
    5. Mbulimi i ul\u00ebt.<\/b> Pavar\u00ebsisht konsumit t\u00eb burimeve dhe koh\u00ebs s\u00eb gjat\u00eb t\u00eb skanimit, zhvilluesit e mjeteve SAST shpesh duhet t\u00eb b\u00ebjn\u00eb kompromis dhe t\u00eb analizojn\u00eb jo t\u00eb gjitha gjendjet n\u00eb t\u00eb cilat mund t\u00eb ndodhet programi.<\/li>\n
    6. Riprodhueshm\u00ebria e gjetjeve.<\/b> T\u00eb dh\u00ebnat mbi rreshtin e sakt\u00eb dhe grumbullin e thirrjeve q\u00eb \u00e7ojn\u00eb n\u00eb dob\u00ebsi \u00ebsht\u00eb e shk\u00eblqyer, por n\u00eb t\u00eb v\u00ebrtet\u00eb shpesh skaneri nuk jep informacion t\u00eb mjaftuesh\u00ebm p\u00ebr t\u00eb verifikuar ekzistenc\u00ebn e dob\u00ebsis\u00eb nga jasht\u00eb. Pra, defekti mund t\u00eb jet\u00eb n\u00eb kodin e vdekur, i cili \u00ebsht\u00eb i pap\u00ebrshkuesh\u00ebm nga nj\u00eb sulmues.<\/li>\n<\/ol>\n

      Problemet e skanimit t\u00eb infrastruktur\u00ebs.<\/h4>\n

      <\/p>\n

        \n
      1. Inventarizimi i pamjaftuesh\u00ebm.<\/b> N\u00eb infrastrukturat e m\u00ebdha, ve\u00e7an\u00ebrisht ato gjeografikisht t\u00eb ndara, shpesh \u00ebsht\u00eb m\u00eb e v\u00ebshtir\u00eb t\u00eb kuptohet se cilat host-e duhet t\u00eb skanohet. Me fjal\u00eb t\u00eb tjera, detyra e skanimit \u00ebsht\u00eb ngusht\u00ebsisht e lidhur me detyr\u00ebn e menaxhimit t\u00eb aseteve.<\/li>\n
      2. Prioritizimi i dob\u00ebt.<\/b> Skaner\u00ebt e rrjetit shpesh japin shum\u00eb rezultate me dob\u00ebsi, t\u00eb cilat n\u00eb praktik\u00eb nuk jan\u00eb t\u00eb shfryt\u00ebzuara, por formalisht niveli i rrezikut t\u00eb tyre \u00ebsht\u00eb i lart\u00eb. Konsumatori merr nj\u00eb raport t\u00eb cilin \u00ebsht\u00eb e v\u00ebshtir\u00eb ta interpretoj\u00eb dhe nuk \u00ebsht\u00eb e qart\u00eb se \u00e7far\u00eb duhet t\u00eb rregullohet fillimisht.<\/li>\n
      3. Rekomandime t\u00eb pakta.<\/b> N\u00eb baz\u00ebn e njohurive t\u00eb skanerit shpeshher\u00eb ka vet\u00ebm informacion t\u00eb p\u00ebrgjithsh\u00ebm mbi dob\u00ebsit\u00eb dhe m\u00ebnyrat e rregullimit t\u00eb tyre, k\u00ebshtu q\u00eb administrator\u00ebt do t\u00eb duhet t\u00eb p\u00ebrgatiten p\u00ebr t\u00eb k\u00ebrkuar n\u00eb Google. Situata \u00ebsht\u00eb pak m\u00eb e mir\u00eb me skanerat whitebox, t\u00eb cil\u00ebt mund t\u00eb japin komand\u00ebn specifike p\u00ebr t\u00eb rregulluar.<\/li>\n
      4. Pun\u00eb manuale.<\/b> N\u00eb infrastrukturat e mund t\u00eb ket\u00eb shum\u00eb nyje, dhe, p\u00ebr pasoj\u00eb, shum\u00eb dob\u00ebsi potenciale, raportet e t\u00eb cilave duhet t\u00eb shqyrtohen dhe analizohen manualisht n\u00eb \u00e7do iteracion.<\/li>\n
      5. Mbules\u00eb e dob\u00ebt.<\/b> Cil\u00ebsia e skanimit t\u00eb infrastruktur\u00ebs varet drejtp\u00ebrdrejt nga volumi i baz\u00ebs s\u00eb njohurive mbi dob\u00ebsit\u00eb dhe versionet e softuerit. Megjithat\u00eb, rrethanat tregojn\u00eb<\/a><\/noindex>, madje edhe lider\u00ebt e tregut nuk kan\u00eb nj\u00eb baz\u00eb t\u00eb gjithanshme njohurish, dhe n\u00eb bazat e zgjidhjeve falas ka shum\u00eb informacion q\u00eb lider\u00ebt nuk e kan\u00eb.<\/li>\n
      6. Problemet me patchimin.<\/b> M\u00eb s\u00eb shpeshti patchimi i dob\u00ebsive n\u00eb infrastruktur\u00eb p\u00ebrfshin p\u00ebrdit\u00ebsimin e paketave ose ndryshimin e skedar\u00ebve t\u00eb konfiguracionit. Nj\u00eb problem i madh k\u00ebtu \u00ebsht\u00eb se sistemi, sidomos ai legacy, mund t\u00eb sillet n\u00eb m\u00ebnyr\u00eb t\u00eb paparashikueshme si rezultat i p\u00ebrdit\u00ebsimit. N\u00eb thelb, do t\u00eb duhet t\u00eb kryhen teste integruese n\u00eb infrastruktur\u00ebn aktive n\u00eb prodhim.<\/li>\n<\/ol>\n

        Qasje.<\/h2>\n

        \n\u00c7far\u00eb t\u00eb b\u00ebjm\u00eb?
        \nRreth m\u00ebnyrave p\u00ebr t\u00eb trajtuar shum\u00eb nga problemet e p\u00ebrmendura, do t\u00eb flas n\u00eb pjes\u00ebt e ardhshme, por p\u00ebr momentin do t\u00eb sh\u00ebnoj drejtimele q\u00eb mund t\u00eb punohet n\u00eb:<\/p>\n

          \n
        1. Agregimi i mjeteve t\u00eb ndryshme t\u00eb skanimit.<\/b> Me p\u00ebrdorimin e duhur t\u00eb disa skaner\u00ebve, mund t\u00eb arrijm\u00eb nj\u00eb rritje t\u00eb konsiderueshme t\u00eb baz\u00ebs s\u00eb njohurive dhe cil\u00ebsis\u00eb s\u00eb detektimit. Mund t\u00eb gjejm\u00eb edhe m\u00eb shum\u00eb dob\u00ebsi se sa gjithsej skaner\u00ebt e ekzekutuar ve\u00e7mas, duke vler\u00ebsuar n\u00eb m\u00ebnyr\u00eb m\u00eb t\u00eb sakt\u00eb nivelin e rrezikut dhe duke dh\u00ebn\u00eb m\u00eb shum\u00eb rekomandime.<\/li>\n
        2. Integrimi i SAST dhe DAST.<\/b> Mund t\u00eb rritet mbulimi DAST dhe sakt\u00ebsia SAST p\u00ebrmes shk\u00ebmbimit t\u00eb informacionit midis tyre. Nga burimet, mund t\u00eb merret informacion mbi rruget ekzistuese, dhe me ndihm\u00ebn e DAST mund t\u00eb kontrollohet n\u00ebse dob\u00ebsia \u00ebsht\u00eb e dukshme nga jasht\u00eb.<\/li>\n
        3. M\u00ebsimi Automatik\u2122.<\/b> N\u00eb vitin 2015 un\u00eb kam treguar<\/a><\/noindex> (dhe p\u00ebrgjigjesha<\/a><\/noindex>) p\u00ebr p\u00ebrdorimin e statistik\u00ebs p\u00ebr t\u2019i dh\u00ebn\u00eb skaner\u00ebve intuit\u00ebn e hakera, dhe p\u00ebr t\u2019i p\u00ebrshpejtuar. Ky \u00ebsht\u00eb patjet\u00ebr nj\u00eb ushqim p\u00ebr zhvillimin e analiz\u00ebs automatike t\u00eb siguris\u00eb n\u00eb t\u00eb ardhmen.<\/li>\n
        4. Integrimi i IAST me testet automatike dhe OpenAPI.<\/b> N\u00eb kuad\u00ebr t\u00eb pipeline-it CI\/CD \u00ebsht\u00eb e mundur t\u00eb krijohet nj\u00eb proces skanimi duke u bazuar n\u00eb mjete q\u00eb funksionojn\u00eb si HTTP-proxy, dhe teste funksionale q\u00eb jan\u00eb t\u00eb bazuara n\u00eb HTTP. Testet dhe kontratat OpenAPI\/Swagger do t'i japin skanerit informacionin e nevojsh\u00ebm p\u00ebr flukset e t\u00eb dh\u00ebnave dhe do t\u00eb mund\u00ebsojn\u00eb skanimin e aplikacionit n\u00eb gjendje t\u00eb ndryshme.<\/li>\n
        5. Konfigurimi i duhur.<\/b> P\u00ebr \u00e7do aplikacion dhe infrastruktur\u00eb duhet t\u00eb krijohet nj\u00eb profil skanimi i p\u00ebrshtatsh\u00ebm, i cili merr parasysh numrin dhe natyr\u00ebn e nd\u00ebrfaqeve, teknologjit\u00eb e p\u00ebrdorura.<\/li>\n
        6. Personalizimi i skanerve.<\/b> Shpesh aplikacioni nuk mund t\u00eb skanohet pa p\u00ebrmir\u00ebsime t\u00eb skanerit. Nj\u00eb shembull \u00ebsht\u00eb gateway i pagesave, ku \u00e7do k\u00ebrkes\u00eb duhet t\u00eb jet\u00eb e n\u00ebnshkruar. Pa shkruar nj\u00eb konnektor p\u00ebr protokollin e gateway-t, skaner\u00ebt do t\u00eb godisnin pa mend k\u00ebrkesat me n\u00ebnshkrim t\u00eb gabuar. Gjithashtu, \u00ebsht\u00eb e nevojshme t\u00eb shkruhen skanera t\u00eb specializuar p\u00ebr lloje specifike t\u00eb dob\u00ebsive, si\u00e7 \u00ebsht\u00eb Referenca e Drejtp\u00ebrdrejt\u00eb e Objektit t\u00eb Pasigurt.<\/a><\/noindex><\/li>\n
        7. Menaxhimi i rrezikut.<\/b> P\u00ebrdorimi i skanerve t\u00eb ndrysh\u00ebm dhe integrimi me sisteme t\u00eb jashtme, si Menaxhimi i Pasurive dhe Menaxhimi i K\u00ebrc\u00ebnimeve, do t\u00eb lejoj\u00eb p\u00ebrdorimin e shum\u00eb parametrave p\u00ebr t\u00eb vler\u00ebsuar nivelin e rrezikut, n\u00eb m\u00ebnyr\u00eb q\u00eb drejtoria t\u00eb mund t\u00eb marr\u00eb nj\u00eb pamje t\u00eb sakt\u00eb t\u00eb gjendjes aktuale t\u00eb siguris\u00eb s\u00eb zhvillimit ose infrastruktur\u00ebs.<\/li>\n<\/ol>\n

          Q\u00ebndroni t\u00eb informuar dhe le t\u00eb nd\u00ebrtojm\u00eb nj\u00eb revolution n\u00eb skanimin e dob\u00ebsive!
          \n
          Burimi:           habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

          \u0412 \u0440\u0430\u043c\u043a\u0430\u0445 \u043f\u0440\u043e\u0444\u0435\u0441\u0441\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0439 \u0434\u0435\u044f\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c, \u043f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440\u0430\u043c, \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0438\u043a\u0430\u043c \u043f\u0440\u0438\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0441\u0442\u0430\u043b\u043a\u0438\u0432\u0430\u0442\u044c\u0441\u044f \u0441 \u0442\u0430\u043a\u0438\u043c\u0438 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430\u043c\u0438, \u043a\u0430\u043a Vulnerability Management (VM), (Secure) SDLC. \u041f\u043e\u0434 \u044d\u0442\u0438\u043c\u0438 \u0441\u043b\u043e\u0432\u043e\u0441\u043e\u0447\u0435\u0442\u0430\u043d\u0438\u044f\u043c\u0438 \u0441\u043a\u0440\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u043d\u0430\u0431\u043e\u0440\u044b \u043f\u0440\u0430\u043a\u0442\u0438\u043a \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u044b\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0435\u0440\u0435\u043f\u043b\u0435\u0442\u0435\u043d\u044b \u043c\u0435\u0436\u0434\u0443 \u0441\u043e\u0431\u043e\u0439, \u0445\u043e\u0442\u044f \u0438\u0445 \u043f\u043e\u0442\u0440\u0435\u0431\u0438\u0442\u0435\u043b\u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u0430\u044e\u0442\u0441\u044f. \u0422\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u043f\u0440\u043e\u0433\u0440\u0435\u0441\u0441 \u043f\u043e\u043a\u0430 \u043d\u0435 \u0434\u043e\u0448\u0451\u043b \u0434\u043e \u0442\u043e\u0433\u043e, \u0447\u0442\u043e\u0431\u044b \u043e\u0434\u043d\u0438\u043c \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u043e\u043c \u0437\u0430\u043c\u0435\u043d\u0438\u0442\u044c \u0447\u0435\u043b\u043e\u0432\u0435\u043a\u0430 \u0434\u043b\u044f \u043f\u0440\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0437\u0430\u0449\u0438\u0449\u0451\u043d\u043d\u043e\u0441\u0442\u0438 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u0438 \u041f\u041e. […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-29957","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Skanimi i dob\u00ebsive dhe zhvillimi i sigurt. Pjesa 1 | ProHoster","description":"","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/skanirovanie-na-uyazvimosti-i-bezopasnaya-razrabotka-chast-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0421\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0430. \u0427\u0430\u0441\u0442\u044c 1 | ProHoster","og:url":"https:\/\/prohoster.info\/sq\/blog\/skanirovanie-na-uyazvimosti-i-bezopasnaya-razrabotka-chast-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:32:53+00:00","article:modified_time":"2019-10-31T18:32:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"29957","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-20 23:11:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:45:24","updated":"2026-01-20 23:11:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/29957","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=29957"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/29957\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=29957"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=29957"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=29957"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}