{"id":92519,"date":"2020-08-28T07:42:26","date_gmt":"2020-08-28T05:42:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya"},"modified":"2020-08-28T07:42:26","modified_gmt":"2020-08-28T05:42:26","slug":"devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya","title":{"rendered":"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

R\u00ebnd\u00ebsia e analiz\u00ebs s\u00eb komponent\u00ebve t\u00eb jasht\u00ebm t\u00eb softuerit (angl. Software Composition Analysis \u2014 SCA) n\u00eb procesin e zhvillimit po rritet me daljen e raporteve vjetore mbi dob\u00ebsit\u00eb e biblioteka open source, t\u00eb cilat publikohen nga kompanit\u00eb Synopsys, Sonatype, Snyk, White Source. Sipas raportit Gjendja e Dob\u00ebsive t\u00eb Siguris\u00eb n\u00eb Open Source 2020<\/a><\/noindex> numri i dob\u00ebsive t\u00eb identifikuara n\u00eb open source n\u00eb 2019 u rrit pothuajse 1.5 her\u00eb krahasuar me vitin e kaluar, nd\u00ebrsa komponent\u00ebt me kod t\u00eb hapur p\u00ebrdoren nga 60% deri n\u00eb 80% t\u00eb projekteve. N\u00ebse i referohemi mendimeve t\u00eb pavarura, proceset SCA jan\u00eb nj\u00eb praktik\u00eb t\u00eb ve\u00e7ant\u00eb t\u00eb OWASP SAMM dhe BSIMM si nj\u00eb tregues i pjekuris\u00eb, nd\u00ebrsa n\u00eb gjysm\u00ebn e par\u00eb t\u00eb vitit 2020 OWASP publikoi nj\u00eb standard t\u00eb ri OWASP Software Component Verification Standard (SCVS), i cili ofron praktikat m\u00eb t\u00eb mira p\u00ebr verifikimin e komponent\u00ebve t\u00eb jasht\u00ebm n\u00eb zinxhirin e furnizimit t\u00eb softuerit.<\/p>\n

\"DevSecOps:
\n<\/a><\/noindex>
\nNj\u00eb nga rastet m\u00eb treguese ndodhi<\/a><\/noindex> me kompanin\u00eb Equifax n\u00eb maj 2017. Haker\u00eb t\u00eb panjohur mor\u00ebn informacionin e 143 milion amerikan\u00ebve, p\u00ebrfshir\u00eb emrat e plot\u00eb, adresat, numrat e sigurimit shoq\u00ebror dhe licencat e drejtimit. N\u00eb 209,000 raste, dokumentet p\u00ebrfshin gjithashtu informacionin mbi kartat e bankave t\u00eb t\u00eb prekurve. Kjo rrjedhje ndodhi si rezultat i shfryt\u00ebzimit t\u00eb nj\u00eb dob\u00ebsie kritike n\u00eb Apache Struts 2 (CVE-2017-5638), ndon\u00ebse nj\u00eb rregullim ishte l\u00ebshuar q\u00eb n\u00eb mars 2017. Kompania kishte dy muaj p\u00ebr t\u00eb instaluar p\u00ebrdit\u00ebsimin, por askush nuk u shqet\u00ebsua p\u00ebr k\u00ebt\u00eb.<\/p>\n

N\u00eb k\u00ebt\u00eb artikull do t\u00eb diskutohet \u00e7\u00ebshtja e zgjedhjes s\u00eb nj\u00eb instrumenti p\u00ebr kryerjen e SCA nga pik\u00ebpamja e cil\u00ebsis\u00eb s\u00eb rezultateve t\u00eb analiz\u00ebs. Do t\u00eb b\u00ebhet gjithashtu nj\u00eb krahasim funksional i instrumenteve. Procesi i integrimit n\u00eb CI\/CD dhe mund\u00ebsit\u00eb e integrimit do t'i l\u00ebm\u00eb p\u00ebr publikime t\u00eb tjera. Nj\u00eb list\u00eb e gjer\u00eb e instrumenteve \u00ebsht\u00eb paraqitur nga OWASP n\u00eb faqen e saj<\/a><\/noindex>, por n\u00eb k\u00ebt\u00eb shkrim, do t\u00eb trajtojm\u00eb vet\u00ebm mjetin m\u00eb t\u00eb njohur open source, Dependency Check, platform\u00ebn pak m\u00eb pak t\u00eb njohur open source Dependency Track dhe zgjidhjen Enterprise Sonatype Nexus IQ. Gjithashtu, do t\u00eb shqyrtojm\u00eb se si funksionojn\u00eb k\u00ebto zgjidhje dhe do t\u00eb krahasojm\u00eb rezultatet p\u00ebr p\u00ebrjashtime t\u00eb gabuara.<\/p>\n

\"DevSecOps:
\n<\/p>\n

Parimi i funksionimit<\/h3>\n

\nDependency Check<\/a><\/noindex> \u00ebsht\u00eb nj\u00eb mjet (CLI, maven, modul jenkins, ant) q\u00eb analizon skedar\u00ebt e projektit, mbledh fragmente informacioni p\u00ebr var\u00ebsit\u00eb (emri i paket\u00ebs, groupid, titulli i specifikimit, versioni...), nd\u00ebrton nj\u00eb varg CPE \u2014 (Common Platform Enumeration), Package URL (PURL) dhe identifikon p\u00ebr CPE\/PURL vulnerabilitete nga bazat e t\u00eb dh\u00ebnave (NVD, Sonatype OSS Index, NPM Audit API...), pas s\u00eb cil\u00ebs ndalon nj\u00eb raport t\u00eb p\u00ebr nj\u00eb her\u00eb n\u00eb formatin HTML, JSON, XML...<\/p>\n

Le t\u00eb shohim si duket CPE:<\/p>\n

cpe:2.3:part:vendor:product:version:update:edition:language:sw_edition:target_sw:target_hw:other<\/code><\/pre>\n
<\/p>\n