Sine-2 abahlalutyi bekhowudi, izixhobo zokuvavanya ezinamandla ezi-4, ubugcisa bethu kunye nemibhalo engama-250. Akunjalo ukuba konke oku kuyafuneka kwinkqubo yangoku, kodwa xa uqala ukusebenzisa i-DevSecOps, kufuneka uye ekupheleni.
. Abadali beempawu: Justin Roiland kunye noDan Harmon.
Yintoni iSecDevOps? Kuthekani ngeDevSecOps? Nguwuphi umahluko? Ukhuseleko lweSicelo - malunga nantoni? Kutheni le nto indlela yakudala ingasasebenzi? Uyazazi iimpendulo zayo yonke le mibuzo Yuri Shabalin ΠΈΠ· Ukhuseleko lweSwordfish. U-Yuri uya kuphendula yonke into ngokweenkcukacha kwaye ahlalutye iingxaki zenguqu ukusuka kwimodeli yoKhuseleko lweSicelo seklasi ukuya kwinkqubo ye-DevSecOps: indlela yokufikelela ngokufanelekileyo ukuhlanganiswa kwenkqubo yophuhliso olukhuselekileyo kwinkqubo ye-DevOps kwaye ungaphuli nantoni na, indlela yokuhamba ngezigaba eziphambili. yovavanyo lokhuseleko, zeziphi izixhobo ezinokusetyenziswa, kwaye yintoni eyahlukileyo kunye nendlela yokuyiqwalasela ngokuchanekileyo ukuphepha imigibe.
Malunga nesithethi: Yuri Shabalin - Umyili oyiNtloko woKhuseleko kwinkampani Ukhuseleko lweSwordfish. Inoxanduva lokuphunyezwa kwe-SSDL, yokuhlanganiswa ngokubanzi kwezixhobo zokuhlalutya izicelo kuphuhliso olumanyeneyo kunye novavanyo lwendalo. Iminyaka eyi-7 yamava kukhuseleko lolwazi. Usebenze eAlfa-Bank, Sberbank kunye nePositive Technologies, ephuhlisa isoftware kwaye ibonelela ngeenkonzo. Isithethi kwiinkomfa zamazwe ngamazwe ZerONights, PHDays, RISSPA, OWASP.
Ukhuseleko lweSicelo: malunga nantoni?
Ukhuseleko lweSicelo - Eli licandelo lokhuseleko elijongene nokhuseleko lwesicelo. Oku akusebenzi kwiziseko ezingundoqo okanye ukhuseleko lwenethiwekhi, kodwa kunokuba sibhala kwaye yintoni abaphuhlisi basebenza kuyo - ezi ziziphene kunye nobuthathaka besicelo ngokwaso.
Indawo - Umjikelo wophuhliso wokhuseleko -iphuhliswe nguMicrosoft. Umzobo ubonisa imodeli ye-SDLC ye-canonical, umsebenzi oyintloko wokuthatha inxaxheba kokhuseleko kuwo onke amanqanaba ophuhliso, ukusuka kwiimfuno zokukhululwa kunye nokuveliswa. UMicrosoft waqaphela ukuba zininzi kakhulu iibhugi kushishino, zininzi zazo kwaye kufuneka kwenziwe into malunga nalo, kwaye bacebisa le ndlela, eye yaba yicanonical.
Ukhuseleko lweSicelo kunye ne-SSDL azijolisanga ekuboneni ubuthathaka, njengoko kukholelwa ngokuqhelekileyo, kodwa ekuthinteleni ukwenzeka kwazo. Ngokuhamba kwexesha, iMicrosoft's canonical approach iye yaphuculwa, yaphuhliswa, kwaye yaziswa kwi-dive enzulu, eneenkcukacha ngakumbi.
I-canonical SDLC ichazwe kakhulu kwiindlela ezahlukeneyo-i-OpenSAMM, i-BSIMM, i-OWASP. Iindlela zokusebenza zahlukile, kodwa ziyafana ngokubanzi.
Ukwakha uKhuseleko kwiModeli yokuVula
Ndiyithanda kakhulu BSIMM - . Isiseko sendlela yokusebenza kukwahlulwa kwenkqubo yoKhuseleko lweSicelo kwimida ye-4: uLawulo, ubuNgqondo, i-SSDL Touchpoints kunye nokusasazwa. Ummandla ngamnye unemisebenzi ye-12, emelwe njengemisebenzi ye-112.
Umsebenzi ngamnye kwezi 112 unawo Amanqanaba ama-3 okukhula: abaqalayo, abaphakathi kunye nabaphambili. Unokufunda zonke izenzo ze-12 icandelo ngecandelo, khetha izinto ezibalulekileyo kuwe, jonga indlela yokuyiphumeza kwaye ngokuthe ngcembe ungeze izinto, umzekelo, uhlalutyo lwekhowudi olusisigxina kunye noluguquguqukayo okanye ukuhlaziywa kwekhowudi. Ubhala phantsi isicwangciso kwaye usebenze ngokuzolileyo ngokuhambelana nayo njengenxalenye yokuphunyezwa kwemisebenzi ekhethiweyo.
Kutheni i-DevSecOps
I-DevOps yinkqubo eqhelekileyo, enkulu apho ukhuseleko kufuneka luthathelwe ingqalelo.
Kwangoko ibandakanya iitshekhi zokhuseleko. Ngokwenza, inani lamaqela okhuseleko lalincinci kakhulu kunoko ngoku, kwaye abazange basebenze njengabathathi-nxaxheba kwinkqubo, kodwa njengombutho wokulawula kunye nokulawula obeka iimfuno kuwo kwaye uhlolisise umgangatho wemveliso ekupheleni kokukhululwa. Le yindlela yakudala apho amaqela okhuseleko ayesemva kodonga ukusuka kuphuhliso kwaye akazange athathe inxaxheba kwinkqubo.
Ingxaki enkulu kukuba ukhuseleko lolwazi lwahlukile kuphuhliso. Ngokuqhelekileyo olu luhlobo oluthile lwesekethe yokhuseleko lolwazi kwaye iqulethe i-2-3 enkulu kunye nezixhobo ezibizayo. Kanye kwiinyanga ezintandathu, ikhowudi yomthombo okanye isicelo ekufuneka sijongiwe sifika, kwaye kanye ngonyaka ziveliswa . Konke oku kukhokelela kwinto yokuba umhla wokukhutshwa kweshishini ulibazisekile, kwaye umphuhlisi ubonakaliswe kwinani elikhulu lobuthathaka kwizixhobo ezizenzekelayo. Akunakwenzeka ukuba udibanise kwaye ulungise konke oku, kuba iziphumo zeenyanga ezintandathu ezidlulileyo azizange zilungiswe, kodwa nantsi ibhetshi entsha.
Ngexesha lomsebenzi wenkampani yethu, sibona ukuba ukhuseleko kuzo zonke iindawo kunye namashishini ayaqonda ukuba lixesha lokubamba kunye nokujikeleza ngophuhliso kwivili elifanayo - . I-paradigm ye-DevSecOps ihambelana ngokugqibeleleyo nendlela yokuphuhlisa i-agile, ukuphunyezwa, inkxaso kunye nokuthatha inxaxheba kuyo yonke into ekhutshweyo kunye nokuphindaphinda.
Ukutshintshela kwi-DevSecOps
Elona gama libalulekileyo kuMjikelo woBomi woPhuhliso loKhuseleko ngu "inkqubo". Kuya kufuneka uqonde oku ngaphambi kokuba ucinge ngokuthenga izixhobo.
Ukudibanisa nje izixhobo kwinkqubo ye-DevOps akwanele-unxibelelwano kunye nokuqonda phakathi kwabathathi-nxaxheba benkqubo kubalulekile.
Abantu babaluleke ngakumbi, kungekhona izixhobo.
Ngokuqhelekileyo, ukucwangciswa kwenkqubo yophuhliso ekhuselekileyo kuqala ngokukhetha kunye nokuthenga isixhobo, kwaye iphetha ngeenzame zokudibanisa isixhobo kwinkqubo yangoku, ehlala izama. Oku kukhokelela kwimiphumo engathandekiyo, kuba zonke izixhobo zineempawu zazo kunye nemida.
Imeko eqhelekileyo kuxa isebe lokhuseleko likhethe isixhobo esilungileyo, esibiza kakhulu esinamandla amakhulu, kwaye seza kubaphuhlisi ukusidibanisa kwinkqubo. Kodwa ayisebenzi - inkqubo iqulunqwe ngendlela yokuba imida yesixhobo esele sithengiwe ayihambelani neparadigm yangoku.
Okokuqala, chaza ukuba yintoni umphumo oyifunayo kunye nokuba inkqubo iya kubonakala njani. Oku kuya kunceda ukuqonda iindima zesixhobo kunye nokhuseleko kwinkqubo.
Qala ngento esele isetyenziswa
Phambi kokuthenga izixhobo ezibizayo, jonga into osele unayo. Yonke inkampani ineemfuno zokhuseleko zophuhliso, kukho iitshekhi, iipentest - kutheni ungaguquli yonke le nto ibe yifomu eqondakalayo kwaye ilungele wonke umntu?
Ngokuqhelekileyo iimfuno yiTalmud yephepha elele kwishelufu. Kwakukho imeko xa sifika kwinkampani ukuba sijonge iinkqubo kwaye sacela ukubona iimfuno zokhuseleko zesofthiwe. Ingcali ebijongana noku ichithe ixesha elide ikhangela:
- Ngoku, kwindawo ethile kumanqaku kwakukho indlela apho olu xwebhu lulele khona.
Ngenxa yoko, salufumana olo xwebhu kwiveki kamva.
Kwiimfuno, iitshekhi kunye nezinye izinto, yenza iphepha umz. Ukuzolisa - ilungele wonke umntu.
Kulula ukufomatha kwakhona into osele unayo kwaye uyisebenzise ukuze uqalise.
Sebenzisa iiNtshatsheli zoKhuseleko
Ngokuqhelekileyo, kwinkampani ephakathi kunye nabaphuhlisi be-100-200, kukho enye ingcali yokhuseleko eyenza imisebenzi emininzi kwaye ayinalo ixesha lokujonga yonke into. Nokuba uzama konke okusemandleni akhe, yena yedwa akayi kukhangela yonke ikhowudi eyenziwa luphuhliso. Kwiimeko ezinjalo, ingcamango iye yaphuhliswa - .
Iintshatsheli zoKhuseleko ngabantu abangaphakathi kweqela lophuhliso abanomdla kukhuseleko lwemveliso yakho.
I-Security Champion yindawo yokungena kwiqela lophuhliso kunye nomvangeli wezokhuseleko ofakwe kwelinye.
Ngesiqhelo, xa ingcali yokhuseleko iza kwiqela lophuhliso kwaye iveze impazamo kwikhowudi, ifumana impendulo eyothusayo:
- Yaye ungubani na? Ndiyaqala ukubona. Yonke into ilungile kum-umhlobo wam omkhulu undinike "isicelo" kuphononongo lwekhowudi, siyaqhubeka!
Le yimeko eqhelekileyo, kuba kukho ukuthembela ngakumbi kubantu abadala okanye abalingane nje beqela apho umphuhlisi ahlala enxibelelana nabo emsebenzini kunye nophononongo lwekhowudi. Ukuba, esikhundleni segosa lezokhuseleko, i-Champion yezoKhuseleko ibonisa iphutha kunye nemiphumo, ngoko ilizwi lakhe liya kuba nobunzima obuninzi.
Kwakhona, abaphuhlisi bayazi ikhowudi yabo ngcono kunayo nayiphi na ingcali yokhuseleko. Kumntu oneeprojekthi ezi-5 ubuncinane kwisixhobo sokuhlalutya static, ngokuqhelekileyo kunzima ukukhumbula zonke iinuances. Iintshatsheli zoKhuseleko ziyayazi imveliso yazo: yintoni enxibelelana nento kwaye yintoni ekufuneka ijongwe kuqala - zisebenza ngakumbi.
Ke cinga ngokuphumeza iiNtshatsheli zoKhuseleko kunye nokwandisa impembelelo yeqela lakho lokhuseleko. Oku kuluncedo nakwintshatsheli ngokwayo: uphuhliso lobuchwephesha kwintsimi entsha, ukwandisa i-horizons yakhe yobugcisa, ukuphucula izakhono zobugcisa, ulawulo kunye nobunkokeli, ukwandisa ixabiso lemarike. Le yinto ethile yobunjineli bezentlalo, "amehlo" akho kwiqela lophuhliso.
Amanqanaba ovavanyo
ithi i-20% yemizamo ivelisa i-80% yeziphumo. Le 20% yimisebenzi yokuhlalutya isicelo enokuthi kwaye ifanele ibe ngokuzenzekelayo. Imizekelo yemisebenzi enjalo lucazululo olungagungqiyo - IXESHA, uhlalutyo oluguqukayo - DAST ΠΈ Ulawulo loMthombo ovulekileyo. Ndiza kukuxelela ngakumbi malunga nemisebenzi, kunye nezixhobo, zeziphi iimpawu esihlala sidibana nazo xa sizizisa kwinkqubo, kunye nendlela yokwenza ngokuchanekileyo.
Iingxaki eziphambili zezixhobo
Ndiza kugxininisa iingxaki ezifanelekileyo kuzo zonke izixhobo kwaye zifuna ingqalelo. Ndiza kuzihlalutya ngakumbi ukuze ndingaziphindi ngokubhekele phaya.
Ixesha elide lokuhlalutya. Ukuba ukusuka ekuzibopheleleni ukukhulula kuthatha imizuzu engama-30 kuzo zonke iimvavanyo kunye nokudibanisa, emva koko ukuhlolwa kokhuseleko lolwazi kuya kuthatha usuku. Ngoko akukho mntu uya kucothisa inkqubo. Lithathele ingqalelo eli nqaku uze wenze izigqibo.
Inqanaba eliphezulu Ubuxoki Negative okanye False Positive. Zonke iimveliso zahlukile, zonke zisebenzisa izakhelo ezahlukeneyo kunye nesimbo sabo sokubhala iikhowudi. Kwiikhowudi ezahlukeneyo kunye nobuchwepheshe, izixhobo zinokubonisa amanqanaba ahlukeneyo oBubuxoki obungalunganga kunye noBubuxoki obulungileyo. Ngoko jonga ukuba yintoni kanye kanye ekuyo yakho iinkampani kunye ne eyakho izicelo ziya kubonisa iziphumo ezilungileyo nezithembekileyo.
Akukho kudityaniswa nezixhobo ezikhoyo. Jonga izixhobo ngokumalunga nokudityaniswa noko sele usebenzisa. Ngokomzekelo, ukuba unayo i-Jenkins okanye i-TeamCity, jonga ukuhlanganiswa kwezixhobo kunye nale software, kwaye kungekhona nge-GitLab CI, ongayisebenzisiyo.
Ukunqongophala okanye ubunzima obugqithisileyo bokwenza ngokwezifiso. Ukuba isixhobo asinayo i-API, kutheni ifuneka? Yonke into enokwenziwa kwi-interface kufuneka ifumaneke nge-API. Ngokufanelekileyo, isixhobo kufuneka sibe namandla okwenza iitshekhi.
Akukho Imephu yoPhuhliso lweMveliso. Uphuhliso alumi ngxi, sisoloko sisebenzisa izikhokelo nemisebenzi emitsha, sibhala kwakhona ikhowudi endala kwiilwimi ezintsha. Sifuna ukuqiniseka ukuba isixhobo esisithengayo siya kuxhasa izikhokelo ezitsha kunye nobuchwepheshe. Ngoko ke, kubalulekile ukwazi ukuba imveliso inenyani kwaye ichanekile uphuhliso.
Iimpawu zeNkqubo
Ukongeza kwiimpawu zezixhobo, qwalasela iimpawu zenkqubo yophuhliso. Ngokomzekelo, ukuthintela uphuhliso yimpazamo eqhelekileyo. Makhe sijonge ukuba zeziphi ezinye iimpawu ekufuneka zithathelwe ingqalelo kwaye yintoni iqela lokhuseleko ekufuneka linikele ingqalelo kuyo.
Ukuze ungaphoswa kuphuhliso kwaye ukhulule imihla ebekiweyo, yenza imithetho eyahlukeneyo kwaye ezahlukeneyo bonisa izithinteli -iinqobo zokumisa inkqubo yokwakha xa kukho ubuthathaka - kwiindawo ezahlukeneyo. Umzekelo, siyaqonda ukuba isebe langoku liya kwindawo yophuhliso okanye i-UAT, oku kuthetha ukuba asiyeki kwaye sithi:
"Unobuthathaka apha, awuzukuya ndawo!"
Ngeli xesha, kubalulekile ukuxelela abaphuhlisi ukuba kukho imiba yokhuseleko efuna ukuqwalaselwa.
Ubukho bobuthathaka abungomqobo kuvavanyo olongezelelweyo: incwadi yesandla, yokudibanisa okanye yencwadana. Kwelinye icala, kufuneka ngandlela ithile sonyuse ukhuseleko lwemveliso, kwaye ukuze abaphuhlisi bangayihoyi into abayifumana ikhuselekile. Ke ngoko, ngamanye amaxesha siyakwenza oku: kwindawo yokuma, xa ikhutshelwa kwindawo yophuhliso, sazisa nje uphuhliso:
- Guys, uneengxaki, nceda ingqalelo kubo.
Kwinqanaba le-UAT siphinda sibonisa izilumkiso malunga nokuba sesichengeni, kwaye kwinqanaba lokukhululwa sithi:
- Guys, sikulumkisile amaxesha amaninzi, awenzanga nto - asizukunikhulula ngale nto.
Ukuba sithetha ngekhowudi kunye ne-dynamics, ngoko kuyimfuneko ukubonisa kwaye ulumkise malunga nobuthathaka kuphela kwezo mpawu kunye nekhowudi esanda kubhalwa kulo mboniso. Ukuba umphuhlisi uhambisa iqhosha ngeepixels ezi-3 kwaye simxelela ukuba unenaliti ye-SQL apho kwaye ke kufuneka ilungiswe ngokukhawuleza, oku akulunganga. Jonga kuphela oko kubhaliweyo ngoku kunye notshintsho oluza kwisicelo.
Masithi sinesiphako esithile esisebenzayo - indlela isicelo akufanele sisebenze ngayo: imali ayidluliswanga, xa ucofa iqhosha akukho tshintsho kwiphepha elilandelayo, okanye umkhiqizo awulayishi. Iziphene zoKhuseleko - ezi ziphene ezifanayo, kodwa kungekhona ngokwemigaqo yokusebenza kwesicelo, kodwa kukhuseleko.
Ayizizo zonke iingxaki zomgangatho wesoftware ziingxaki zokhuseleko. Kodwa zonke iingxaki zokhuseleko zinxulumene nomgangatho wesoftware. USherif Mansour, Expedia.
Kuba zonke iziphene ziziphene ezifanayo, kufuneka zibekwe kwindawo enye nazo zonke iziphene zophuhliso. Ke libala malunga neengxelo kunye neePDF ezoyikisayo ekungekho mntu uzifundayo.
Xa ndisebenza kwinkampani yophuhliso, ndafumana ingxelo evela kwizixhobo zokuhlalutya static. Ndayivula, ndoyika, ndenza ikofu, ndatyhila amaphepha angama-350, ndawavala ndaqhubeka nokusebenza. Iingxelo ezinkulu ziingxelo ezifileyo. Ngokuqhelekileyo abayi ndawo, iileta ziyacinywa, zilibalekile, zilahlekile, okanye ishishini lithi liyayamkela ingozi.
Kwenziwe ntoni? Sivele siguqule iziphene eziqinisekisiweyo esizifumeneyo zibe yifomu elungele uphuhliso, umzekelo, sizibeke kukusilela eJira. Sibeka phambili iziphene kwaye sizisuse ngokolandelelwano lweprayorithi, kunye neziphene zokusebenza kunye neziphene zovavanyo.
Uhlalutyo oluzinzileyo - SAST
Olu luhlalutyo lwekhowudi yobuthathaka., kodwa ayifani neSonarQube. Asijongi nje iipateni okanye isimbo. Inani leendlela ezisetyenziswayo kuhlalutyo: ngokomthi wobuthathaka, ngokutsho , ngokuhlalutya iifayile zoqwalaselo. Oku konke okuchaphazela ikhowudi ngokwayo.
IiPros zendlela: ukuchonga ubuthathaka kwikhowudi kwinqanaba lokuqala lophuhlisoxa kungekho mishini okanye izixhobo esele zenziwe, kwaye ukongezwa kokukwazi ukuskena: ukuskena icandelo lekhowudi elitshintshileyo, kwaye kuphela inqaku esilenzayo ngoku, elicutha ixesha lokuskena.
ΠΠΈΠ½ΡΡΡ - oku kukunqongophala kwenkxaso kwiilwimi eziyimfuneko.
Ukudibanisa okuyimfuneko, ekufuneka ibe kwizixhobo, ngokoluvo lwam oluzimeleyo:
- Isixhobo sokudibanisa: Jenkins, TeamCity kunye neGitlab CI.
- Ubume bophuhliso: Intellij IDEA, Visual Studio. Kulunge ngakumbi ukuba umphuhlisi angahambi ngendlela engaqondakaliyo esafuna ukunkqaya, kodwa abone konke ukudityaniswa okuyimfuneko kunye nobuthathaka athe wabufumana kanye kwindawo yokusebenza kwindawo yakhe yophuhliso.
- Uphononongo lwekhowudi: I-SonarQube kunye nokuphononongwa ngesandla.
- Abalandeleli abanesiphene: iJira kunye neBugzilla.
Umfanekiso ubonisa abanye abameli ababalaseleyo bohlalutyo lwe-static.
Ayizizo izixhobo ezibalulekileyo, kodwa yinkqubo, ngoko ke kukho izisombululo zoMthombo oVulekileyo nezilungele ukuvavanya inkqubo.
Umthombo ovulekileyo we-SAST awuyi kufumana inani elikhulu lobuthathaka okanye i-DataFlows enzima, kodwa inako kwaye kufuneka isetyenziswe xa kusakhiwa inkqubo. Banceda ukuqonda indlela inkqubo eya kwakhiwa ngayo, ngubani oza kuphendula kwiimpazamo, ngubani oza kunika ingxelo, kwaye ngubani oya kunika ingxelo. Ukuba ufuna ukwenza inqanaba lokuqala lokwakha ukhuseleko lwekhowudi yakho, sebenzisa izisombululo zoMthombo oVulekileyo.
Oku kungadityaniswa njani ukuba usekuqaleni kohambo lwakho kwaye ungenanto: akukho CI, akukho Jenkins, akukho TeamCity? Masiqwalasele ukudityaniswa kwinkqubo.
Ukuhlanganiswa kwenqanaba leCVS
Ukuba uneBitbucket okanye iGitLab, ungadibanisa kwinqanaba .
Ngomcimbi -ukutsala isicelo, ukuzibophelela. Uskena ikhowudi kwaye ubume bokwakha bubonisa ukuba ukhuseleko luphumelele okanye aluphumelelanga.
Ingxelo. Kakade ke, ingxelo isoloko ifuneka. Ukuba wenze nje ukhuseleko kwicala, uyibeke kwibhokisi kwaye akazange axelele nabani na malunga nayo, kwaye ekupheleni kwenyanga ulahle iqela leebhugi - oku akulungile kwaye akulungile.
Ukudityaniswa nenkqubo yokuphonononga ikhowudi
Kanye, siye sasebenza njengomhlalutyi ongagqibekanga kumsebenzisi we-AppSec yobugcisa kwiqela leeprojekthi ezibalulekileyo. Ngokuxhomekeke ekubeni iimpazamo zichongiwe kwikhowudi entsha okanye akukho ziphoso, umbuyekezi ubeka isimo kwisicelo sokutsalwa "ukwamkela" okanye "ukufuna umsebenzi" - nokuba yonke into ilungile, okanye izixhumanisi zeyona nto kufuneka iphuculwe. kufuneka kuphuculwe. Ukudityaniswa noguqulelo oluya kwimveliso, senze isalelo sokudibanisa ukuba uvavanyo lokhuseleko lolwazi aluphumelelanga. Sifake oku kuphononongo lwekhowudi yencwadana, kwaye abanye abathathi-nxaxheba kwinkqubo babone iimeko zokhuseleko zale nkqubo.
Ukudityaniswa ne-SonarQube
Abaninzi baye bakwenza oko ngokomgangatho wekhowudi. Kuyafana apha - unokwenza amasango afanayo kuphela kwizixhobo ze-SAST. Kuya kubakho ujongano olufanayo, isango elifanayo lomgangatho, kuphela liya kubizwa isango lokhuseleko. Kwaye kwakhona, ukuba unenkqubo usebenzisa iSonarQube, unokudibanisa ngokulula yonke into apho.
Ukudibanisa kwinqanaba leCI
Yonke into apha nayo ilula kakhulu:
- Ngokuhambelana novavanyo oluzenzekelayo, iimvavanyo zeeyunithi.
- Ukwahlula ngokwamanqanaba ophuhliso: dev, uvavanyo, imveliso. Iiseti ezahlukeneyo zemithetho okanye iimeko ezahlukeneyo zokungaphumeleli zingabandakanywa: ukumisa indibano, musa ukumisa indibano.
- Ukuqaliswa ngokulungelelanisiweyo/okungatshintshiyo. Silindele ukuphela kovavanyo lokhuseleko okanye hayi. Oko kukuthi, sisanda kuwasungula kwaye siqhubeke, kwaye emva koko sifumana iwonga lokuba yonke into ilungile okanye imbi.
Konke kukwilizwe elipinki eligqibeleleyo. Ayikho into enjalo ebomini bokwenyani, kodwa siyazama. Iziphumo zokujonga ukhuseleko kufuneka zifane neziphumo zovavanyo lweyunithi.
Umzekelo, sithathe iprojekthi enkulu kwaye sagqiba ekubeni ngoku siza kuyiskena nge-SAST - Kulungile. Siyityhalele le projekthi kwi-SAST, yasinika ubuthathaka abangama-20 kwaye ngesigqibo esinamandla sagqiba kwelokuba yonke into ilungile. 000 semngciphekweni lityala lethu lobugcisa. Siza kubeka ityala kwibhokisi, siya kuyicoca kancinane kwaye songeze iibugs kwiitraki ezineziphene. Masiqeshe inkampani, senze yonke into ngokwethu, okanye sibe neeNtshatsheli zoKhuseleko zisincede - kwaye amatyala obugcisa azakuhla.
Kwaye bonke ubuthathaka obutsha obuvelayo kwikhowudi entsha kufuneka bupheliswe ngendlela efanayo neempazamo kwiyunithi okanye kwii-autotests. Ukuthetha ngokulinganayo, indibano yaqala, sayiqhuba, iimvavanyo ezimbini kunye neemvavanyo ezimbini zokhuseleko aziphumelelanga. Kulungile-sahamba, sajonga okwenzekileyo, salungisa enye into, salungisa enye, sayiqhuba ngexesha elizayo - yonke into yayilungile, akukho buthathaka obutsha bubonakala, akukho vavanyo lwahluleka. Ukuba lo msebenzi unzulu kwaye kufuneka uqonde kakuhle, okanye ukulungisa ubuthathaka kuchaphazela iileya ezinkulu zento elele phantsi kwe-hood: i-bug yongezwa kwi-tracker yesiphene, ibekwe phambili kwaye ilungiswe. Ngelishwa, ihlabathi alifezekanga kwaye iimvavanyo ngamanye amaxesha ziyasilela.
Umzekelo wesango lokhuseleko yi-analogue yesango elisemgangathweni, ngokubhekiselele kubukho kunye nenani lobuthathaka kwikhowudi.
Sidibanisa neSonarQube - iplagin ifakiwe, yonke into ilungile kwaye ipholile.
Ukudityaniswa nemeko yophuhliso
Iinketho zokudityaniswa:
- Ukuqhuba iskena kwindawo yophuhliso phambi kokuba uzibophelele.
- Jonga iziphumo.
- Uhlalutyo lweziphumo.
- Ungqamaniso neseva.
Le yindlela ekhangeleka ngayo ukufumana iziphumo kumncedisi.
Kwimeko yethu yophuhliso into eyongezelelweyo ibonakala ikwazisa ukuba ubuthathaka obunjalo buchongiwe ngexesha lokuskena. Unokuhlela ngokukhawuleza ikhowudi, jonga iingcebiso kunye . Konke oku kubekwe kwindawo yokusebenzela yomphuhlisi, eluncedo kakhulu - akukho mfuneko yokulandela amanye amakhonkco kwaye ujonge into eyongezelelweyo.
Vula Umnikezi
Lo ngowona mxholo ndiwuthandayo. Wonke umntu usebenzisa amathala eencwadi oMthombo oVulekileyo - kutheni ubhala inqila yeentonga kunye neebhayisekile xa unokuthatha ithala leencwadi esele lilungisiwe apho yonke into sele iphunyeziwe?
Ewe, oku kuyinyani, kodwa amathala eencwadi nawo abhalwa ngabantu, aquka imingcipheko ethile kwaye kukwakho nokuba semngciphekweni okuxelwa ngamaxesha athile, okanye rhoqo. Ngoko ke, kukho inyathelo elilandelayo kuKhuseleko lweSicelo - olu luhlalutyo lwamacandelo oMthombo oVulekileyo.
Uhlalutyo lweMthombo oVulekileyo-OSA
Isixhobo sibandakanya izigaba ezintathu ezinkulu.
Ukukhangela ubuthathaka kumathala eencwadi. Umzekelo, isixhobo siyazi ukuba sisebenzisa ithala leencwadi elithile, kwaye singena okanye kukho ubuthathaka kwizilandeleli zebug eziyelelene nolu guqulelo lwethala leencwadi. Xa uzama ukuyisebenzisa, isixhobo siya kukhupha isilumkiso sokuba ithala leencwadi lisemngciphekweni kwaye likucebisa ukuba usebenzise olunye uguqulelo olungenabo ubuthathaka.
Uhlalutyo lokucoceka kwelayisensi. Oku ayikadumi ngokukodwa apha, kodwa ukuba usebenza phesheya, ngoko ngamaxesha athile ungafumana irhafu apho ngenxa yokusebenzisa icandelo lomthombo ovulekileyo elingenakusetyenziswa okanye lilungiswe. Ngokomgaqo-nkqubo wethala leencwadi elinelayisensi, asinakwenza oku. Okanye, ukuba siyilungisile kwaye siyisebenzise, ββkufuneka siyithumele ikhowudi yethu. Ngokuqinisekileyo, akukho mntu ufuna ukupapasha ikhowudi yeemveliso zabo, kodwa unokuzikhusela kule nto.
Uhlalutyo lwamacandelo asetyenziswa kwindawo yoshishino. Masicinge ngemeko yoqikelelo yokuba ekugqibeleni silugqibile uphuhliso kwaye sakhulula ukhupho lwamva nje lwenkonzo yethu encinci. Uhlala apho ngokumangalisayo - iveki, inyanga, unyaka. Asiyiqokeleli, asiqhubeki iitshekhi zokhuseleko, yonke into ibonakala ilungile. Kodwa ngequbuliso, kwiiveki ezimbini emva kokukhululwa, ubuthathaka obubalulekileyo buvela kwicandelo loMthombo oVulekileyo, esiwusebenzisa kolu lwakhiwo oluthile, kwindawo yoshishino. Ukuba asirekhodi ukuba yintoni kwaye siyisebenzisa phi, ngoko asiyi kububona obu buthathaka. Ezinye izixhobo zinesakhono sokubeka esweni ubuthathaka kumathala eencwadi asetyenziswa ngoku kushishino. Iluncedo kakhulu.
Amathuba:
- Imigaqo-nkqubo eyahlukeneyo yezigaba ezahlukeneyo zophuhliso.
- Amacandelo okubeka iliso kwindawo yoshishino.
- Ulawulo lwamathala eencwadi ngaphakathi kumbutho.
- Inkxaso yeendlela ezahlukeneyo zokwakha kunye neelwimi.
- Uhlalutyo lwemifanekiso yeDocker.
Imizekelo embalwa yeenkokeli zeshishini ezibandakanyeka kuhlalutyo loMthombo oVulekileyo.
Eyodwa yasimahla yile ukusuka kwi-OWASP. Unokuyivula kwizigaba zokuqala, ubone indlela esebenza ngayo kunye nento exhasayo. Ngokusisiseko, ezi zonke ziimveliso zelifu, okanye kwisiseko, kodwa emva kwesiseko sazo zisathunyelwa kwi-Intanethi. Abathumeli amathala eencwadi akho, kodwa i-hashes okanye amaxabiso abo, abawabalayo, kunye neminwe kumncedisi wabo ukufumana ulwazi malunga nobukho bobuthathaka.
Ukudityaniswa kwenkqubo
Ulawulo olujikelezayo lwamathala eencwadi, ezikhutshelwa kwimithombo yangaphandle. Sinoovimba bangaphandle nangaphakathi. Ngokomzekelo, i-Event Central iqhuba i-Nexus, kwaye sifuna ukuqinisekisa ukuba akukho buthathaka ngaphakathi kwendawo yethu yokugcina indawo "ebaluleke kakhulu" okanye "phezulu". Ungaqwalasela i-proxying usebenzisa isixhobo se-Nexus Firewall Lifecycle ukwenzela ukuba ubuthathaka obunjalo bunqunyulwe kwaye bungapheli kwindawo yokugcina yangaphakathi.
Ukudityaniswa kwi-CI. Kwinqanaba elifanayo kunye ne-autotests, iimvavanyo zeyunithi kunye nokwahlula kwizigaba zophuhliso: i-dev, uvavanyo, i-prod. Kwinqanaba ngalinye, unokukhuphela nawaphi na amathala eencwadi, sebenzisa nantoni na, kodwa ukuba kukho into enzima kunye nesimo "esibalulekileyo", mhlawumbi kuyafaneleka ukutsala ingqalelo yabaphuhlisi kule nto kwinqanaba lokukhululwa kwimveliso.
Ukudityaniswa nezinto zakudala: I-Nexus kunye neJFrog.
Ukuhlanganiswa kwindawo yophuhliso. Izixhobo ozikhethayo kufuneka zibe nokuhlanganiswa kunye neendawo zophuhliso. Umphuhlisi kufuneka abe nokufikelela kwiziphumo zokuskena kwindawo yakhe yokusebenza, okanye amandla okuskena kwaye ajonge ikhowudi ngokwakhe ngobuthathaka phambi kokuba azibophelele kwi-CVS.
Ukudityaniswa kweCD. Eli linqaku elipholileyo endilithanda kakhulu kwaye esele ndithethe ngalo - ukubeka esweni ukuvela kobuthathaka obutsha kwindawo yoshishino. Isebenza into enje.
Si Oovimba beCandelo loLuntu - ezinye izixhobo ngaphandle, kunye novimba wethu wangaphakathi. Sifuna iqulathe kuphela amalungu athembekileyo. Xa sisebenza njengommeli kwisicelo, sijonga ukuba ithala leencwadi elikhutshelweyo alinawo na ubuthathaka. Ukuba iwela phantsi kwemigaqo-nkqubo ethile esiyimiselayo kwaye ngokuyimfuneko siyilungelelanise nophuhliso, ngoko ke asiyilayishi kwaye siyalelwa ukuba sisebenzise enye inguqulelo. Ngokufanelekileyo, ukuba kukho into ebaluleke ngokwenene nembi kwithala leencwadi, ngoko ke umphuhlisi akayi kufumana ithala leencwadi kwinqanaba lofakelo - makasebenzise inguqulelo ephezulu okanye esezantsi.
- Xa kwakhiwa, sijonga ukuba akukho mntu utyibilike nantoni na embi, ukuba onke amacandelo akhuselekile kwaye akukho mntu uzise nantoni na eyingozi kwi-flash drive.
- Sinamacandelo athembekileyo kuphela kwindawo yokugcina.
- Xa sihambisa, siphinda sijonge ipakethe ngokwayo: imfazwe, ijagi, i-DL okanye umfanekiso weDocker ukuqinisekisa ukuba iyahambelana nepolisi.
- Xa singena kwishishini, sibeka iliso okwenzekayo kwindawo yoshishino: ubuthathaka obubalulekileyo bubonakala okanye bungabonakali.
Uhlalutyo olunamandla - DAST
Izixhobo zokuhlalutya ezinamandla zahluke kakhulu kuyo yonke into ebikhe yathethwa ngaphambili. Olu luhlobo lokuxelisa umsebenzi womsebenzisi kunye nesicelo. Ukuba esi sisicelo sewebhu, sithumela izicelo, silinganisa umsebenzi womxhasi, nqakraza kumaqhosha angaphambili, thumela idatha yokwenziwa kwifom: iikowuti, izibiyeli, abalinganiswa kwiikhowudi ezahlukeneyo, ukubona indlela isicelo esisebenza ngayo kunye neenkqubo. idatha yangaphandle.
Inkqubo efanayo ikuvumela ukuba ujonge ubuthathaka betemplate kuMthombo oVulekileyo. Kuba i-DAST ingazi ukuba ngowuphi uMthombo oVulekileyo esiwusebenzisayo, iphosa iipateni "ezikhohlakeleyo" kwaye ihlalutye iimpendulo zomncedisi:
- Ewe, kukho ingxaki ye-deserialization apha, kodwa hayi apha.
Kukho imingcipheko enkulu kule nto, kuba ukuba uqhuba olu vavanyo lokhuseleko kwibhentshi enye abavavanyi basebenza nayo, izinto ezingathandekiyo zingenzeka.
- Umthwalo ophezulu kwinethiwekhi yeseva yesicelo.
- Akukho kudityaniswa.
- Ukukwazi ukutshintsha izicwangciso zesicelo esihlalutyiweyo.
- Akukho nkxaso kwiiteknoloji eziyimfuneko.
- Ubunzima bokuseka.
Sasinemeko xa ekugqibeleni sasungula i-AppScan: sichithe ixesha elide sizama ukufikelela kwisicelo, safumana ii-akhawunti ezi-3 kwaye sonwabile-ekugqibeleni siza kujonga yonke into! Saqala ukuskena, kwaye into yokuqala eyenziwe yi-AppScan kukungena kwiphaneli yolawulo, yacofa onke amaqhosha, yatshintsha isiqingatha sedatha, emva koko ibulale ngokupheleleyo iseva nayo. -izicelo. Uphuhliso ngovavanyo uthe:
- Guys, ngaba udlala ngam?! Sikunike iiakhawunti, kwaye umise ukuma!
Cinga ngeengozi ezinokubakho. Ngokufanelekileyo, lungiselela indawo eyahlukileyo yokuvavanya ukhuseleko lolwazi, oluya kuba lodwa kwindawo yonke, ngandlela thile, kwaye ujonge ngokwemiqathango ipaneli yolawulo, ngokukhethekayo kwimo yezandla. Le yipentest - ezo pesenti ziseleyo zomzamo esingazithatheli ngqalelo ngoku.
Kufanelekile ukuqwalasela ukuba ungasebenzisa oku njenge-analogue yovavanyo lomthwalo. Kwinqanaba lokuqala, unokuvula iskena esiguqukayo esinemisonto eyi-10-15 kwaye ubone ukuba kwenzeka ntoni, kodwa ngokuqhelekileyo, njengoko uqheliselo lubonisa, akukho nto ilungileyo.
Izibonelelo ezimbalwa esiqhele ukuzisebenzisa.
Ukuqaqambisa okufanelekileyo "yimela yaseSwitzerland" kuyo nayiphi na ingcali yokhuseleko. Wonke umntu uyayisebenzisa kwaye iluncedo kakhulu. Idemo entsha yoshicilelo lweshishini ikhululiwe. Ukuba ngaphambili ibiyinto nje yokuma yodwa kunye neeplagi, ngoku abaphuhlisi ekugqibeleni benza iseva enkulu apho kuya kwenzeka ukulawula iiarhente ezininzi. Oku kupholile, ndincoma ukuba uzame.
Ukudityaniswa kwenkqubo
Ukudibanisa kwenzeka kakuhle kwaye ngokulula: qala ukuskena emva kofakelo oluyimpumelelo izicelo zokuma kunye ukuskena emva kovavanyo lokudibanisa ngempumelelo.
Ukuba udibaniso alusebenzi okanye kukho i-stubs kunye nemisebenzi ehlekisayo, akunamsebenzi kwaye akunamsebenzi - kungakhathaliseki ukuba yeyiphi iphethini esiyithumelayo, umncedisi uya kuphendula ngendlela efanayo.
- Ngokufanelekileyo, indawo yokuvavanya eyahlukileyo.
- Ngaphambi kokuvavanya, bhala phantsi ulandelelwano lokungena.
- Uvavanyo lwenkqubo yolawulo lwenziwa ngesandla kuphela.
Inkqubo
Okuncinci ngokubanzi malunga nenkqubo ngokubanzi kunye nomsebenzi wesixhobo ngasinye ngokukodwa. Zonke izicelo zahlukile-enye isebenza ngcono ngohlalutyo oluguquguqukayo, enye inocazululo olungagungqiyo, eyesithathu ngohlalutyo lwe-OpenSource, ipentest, okanye enye into ngokupheleleyo, umzekelo, iminyhadala ene-OpenSource. .
Yonke inkqubo idinga ulawulo.
Ukuqonda indlela inkqubo esebenza ngayo kunye nalapho ingaphuculwa khona, kufuneka uqokelele iimethrikhi kuyo yonke into onokuyifumana kuyo, kubandakanywa neemetrics zokuvelisa, iimethrikhi ezivela kwizixhobo, kunye nabalandeleli besiphako.
Naluphi na ulwazi luluncedo. Kuyimfuneko ukujonga kwii-angles ezahlukeneyo apho oku okanye eso sixhobo sisetyenziswe kangcono, apho inkqubo iyancipha ngokuthe ngqo. Kunokuba kufanelekile ukujonga amaxesha okuphendula kophuhliso ukubona apho unokuphucula khona inkqubo esekwe kwixesha. Idatha eninzi, amacandelo amaninzi anokwakhiwa ukusuka kwinqanaba eliphezulu ukuya kwiinkcukacha zenkqubo nganye.
Kuba bonke abahlalutyi be-static kunye nabaguquguqukayo bane-APIs yabo, iindlela zabo zokuqalisa, imigaqo, abanye banabacwangcisi, abanye abanalo-sibhala isixhobo. I-AppSec Orchestrator, ekuvumela ukuba wenze indawo yokungena enye kuyo yonke inkqubo esuka kwimveliso kwaye uyilawule ukusuka kwindawo enye.
Abaphathi, abaphuhlisi kunye neenjineli zokhuseleko banendawo enye yokungena apho banokubona ukuba yintoni esebenzayo, qwalasela kwaye uqhube iskena, ufumane iziphumo zokuskena, kwaye ungenise iimfuno. Sizama ukufuduka kumaphepha, ukuguqulela yonke into ibe ngumntu, esetyenziswa luphuhliso - amaphepha kwi-Confluence kunye nesimo kunye neemetrics, iziphene kwiJira okanye kwiitrackers ezahlukeneyo zesiphene, okanye ukudibanisa kwinkqubo ye-synchronous / asynchronous kwi-CI. /CD.
IItrakthi ezibalulekileyo
Izixhobo aziyona nto iphambili. Qala ucinge ngenkqubo - emva koko uphumeze izixhobo. Izixhobo zilungile kodwa zibiza, ngoko unokuqala ngenkqubo kunye nokwakha unxibelelwano kunye nokuqonda phakathi kophuhliso kunye nokhuseleko. Ukusuka kwindawo yokujonga ukhuseleko, akukho mfuneko "yokumisa" yonke into ukusuka kumbono wophuhliso, ukuba kukho into ephakamileyo ye-mega ebaluleke kakhulu, ngoko kufuneka isuswe, kwaye ungayiboni ingxaki.
Umgangatho wemveliso - injongo eqhelekileyo zombini ukhuseleko kunye nophuhliso. Senza into enye, sizama ukuqinisekisa ukuba yonke into isebenza ngokuchanekileyo kwaye akukho bungozi bodumo okanye ilahleko yemali. Yiyo loo nto sikhuthaza i-DevSecOps, indlela ye-SecDevOps yokuphucula unxibelelwano kunye nokuphucula umgangatho wemveliso.
Qala ngale nto sele unayo: iimfuno, ulwakhiwo, iitshekhi ezingaphelelanga, uqeqesho, izikhokelo. Akukho mfuneko yokusebenzisa ngokukhawuleza zonke iinkqubo kuzo zonke iiprojekthi - shukuma ngokuphindaphindiweyo. Akukho mgangatho omnye - umfuniselo kwaye uzame iindlela ezahlukeneyo kunye nezisombululo.
Kukho uphawu olulinganayo phakathi kweziphene zokhuseleko lolwazi kunye neziphene zokusebenza.
Yenza yonke into ngokuzenzekelayoiyashukuma. Nantoni na engahambiyo, yishukumise kwaye uzenzele. Ukuba into yenziwa ngesandla, ayiyonxalenye ilungileyo yenkqubo. Mhlawumbi kufanelekile ukuyiphonononga kwaye uzenzele nayo.
Ukuba ubungakanani beqela le-IS buncinci - sebenzisa iiNtshatsheli zoKhuseleko.
Mhlawumbi le nto bendithetha ngayo ayizukukufanela kwaye uya kuza nento eyakho-kwaye ilungile. Kodwa khetha izixhobo ezisekelwe kwiimfuno zenkqubo yakho. Musa ukujonga ukuba uluntu luthini, ukuba esi sixhobo sibi kwaye esi sihle. Mhlawumbi okuchaseneyo kuya kuba yinyani kwimveliso yakho.
Iimfuno zezixhobo.
- Inqanaba elisezantsi False Positive.
- Ixesha elaneleyo lokuhlalutya.
- Ukusetyenziswa kokusetyenziswa.
- Ubukho bokudityaniswa.
- Ukuqonda imephu yophuhliso lwemveliso.
- Ukubanakho kwezixhobo zokulungisa.
Ingxelo kaYuri ikhethwe njengenye yezona zibalaseleyo kwi-DevOpsConf 2018. Ukuqhelana neengcamango ezinomdla ngakumbi kunye namatyala asebenzayo, yiza eSkolkovo ngoMeyi 27 kunye no-28. ngaphakathi . Kungcono ke, ukuba ukulungele ukwabelana ngamava akho, ke ingxelo kude kube nguAprili 21.
umthombo: www.habr.com
