The Old Ways Are Not Enough Anymore Izindlela ze-old are not enough anymore Ngingathanda isikhathi lapho ukucubungula isicelo ukuze izinzuzo zihambile njengomphumela. Ukulethwa izixhobo ezimbalwa okuzenzakalelayo, ukucubungula okuhlobene, ukucubungula konke ukuze kuhlobene, futhi uqhagamshelane. Kwangathi, lokhu ukucubungula kulindeleke ukuthi ukugcina ama-gate amaningi. Kodwa kulezi zinsuku, elinye ukucubungula kulindeleke isikhwama esifundeni esizayo ngokushesha lapho ubuchwepheshe isebenza. Izicelo namhlanje akukho kuphela ku-servers zendawo nge-perimeters ezibonakalayo. Zihlanganisa izimo ze-cloud, i-API, i-containers, ne-microservices ezivela up and down ngokufanele. Ukuhlolwa kwe-static, nangokuningi okuhlobene, ayikwazi ukuxhumana ne-speed kanye ne-complexity ye-moder systems. Futhi uma umugqa wokuphendula kuphela etholakalayo i-scan ye-vulnerability, asikwazi ukulawula ingozi – sinikeza nje. Why Scanning Alone Isn’t Security Yini ukucubungula kuphela ayikho ukhuseleko Ukubuyekezwa kwama-vulgarity kuyinto indawo yayo. It isebenza njenge-system yokubuyekeza okusheshayo. It ibonisa lapho izinto zihlukile ku-codebase yakho ebonakalayo, ibhayisikili ezidlulile, futhi ingathola iziphuzo zokhuseleko ezincinane. Kodwa ingcindezi kuyinto, ibheka lapho. It akunakusiza ukufumana isisindo esiyingqayizivele yayo. It ayikwazanga ukuthi kanjani isizukulwane esisodwa ingangena kwebhizinisi esikhulu kakhulu. Futhi kuncike akufinyelela i-strategy yokusebenza ne-risk ngaphandle kwe-limit ye-development team. Ngithanda ngesandla lokuqala ukuthi amabhizinisi angakwazi ukujabulela ngaphansi kwebhizinisi lwezimpendulo ezingenalutho noma iyiphi uhlobo lokuphendula. Abanikezela ukuhlangabezana nezinkinga ezisekelwe izinga lokuphendula ezisekelwe nge-exploits ezisebenzayo emangalisayo, kunokuba izimpendulo zangempela. Enye yezimo ezinzima kakhulu zihlanganisa zonke izinga okusezingeni eliphezulu zangaphakathi njengezimfuneko efanayo. Akukho. Isizukulwane esikhulu esithathwe ku-sandboxed component ingaba kunzima kakhulu kunzima kunzima-severity ibhizinisi e-core-customer-facing service. I-context ibhizinisi. Futhi okuyizinhlangano ngokuvamile ibhizinisi Understanding Risk in Real Business Terms Ukubuyekeza I-Risk In A Real Business Terms Imininingwane ye-application risk management kuyimfuneko ye-lens engaphezulu-one elihlanganisa kuphela ama-defects zobuchwepheshe kodwa futhi ama-operational realities, imiphumela yebhizinisi, kanye ne-user exposure. Ngokwesibonelo, ingxaki e-payments processing module ngexesha le-peak season inikeza ubuningi ahlukene kakhulu kunokuba ingxaki efanayo ku-sandbox yokuthuthukiswa. Ukwazi ukuthi ingxaki kuyinto lokuqala yokulawula ingozi enhle. Kukho futhi ilizwi lokugqibela ukuthi izixhobo zokufaka zibonisa. Kuyinto enhle ukholelwa ukuthi uxhumane zonke izifundo zakho kuphela ngenxa yokufaka kwenziwa okuhlobene. Kodwa izinzuzo akuyona njalo izimpendulo ezaziwa. Ngezinye izikhathi zihlanganisa izinketho zokufakelwa, izicelo ezihambayo, izimo ezinzima ezizayo ezivela ngesikhathi. Futhi akukho izixhobo ngeke zihlanganisa izixhobo zakho ngaphandle kokufakelwa ngokuvamile ukuhlola lezi zokusebenza - futhi ngisho nangokuthi, kufuneka isixhobo elifanelekayo ukuze kuyinto ephakeme. Moving From Periodic Reviews to Continuous Risk Awareness Ukushintsha kusuka ku-revision ye-periodic kuya ku-Risk Awareness Continuous Ukuthuthukiswa kwe-Risk Management kuhlanganisa ukwelashwa kwe-applications njenge-systems ezihlangeneyo. Lezi zindlela zithuthukisa ngokushesha. Nge-deployment, ukuhlanganiswa, ne-function release, indawo ye-risk iyahluka. Ngakho-ke, elandelayo yokulawula i-risk ye-applications kufanele yenzelwe ngokushesha, futhi akuyona ngokushesha. Ukubuyekezwa kwe-one-off ekupheleni kwe-sprint noma i-quarter akuyona akuyona. Izinzuzo zingatholakala futhi zihlukanise ngaphambi kwe-scan yakho elilandelayo. Futhi ingozi akuyona ingozi elithathwe ngokuphendula. Kufuneka amandla enhle ngokuvumelana – ukwakha ukucacisa ingozi ku-design kanye ne-development process. Uma amabhizinisi we-security kanye ne-risk zihlanganisa ngokushesha, kungasiza ukulawula izixazululo ze-architectural ngezindlela eziholela izilinganiso eziningi zangaphakathi ngaphambi kokufaka ku-codebase. Lokhu akuyona ukunciphisa ukuthuthukiswa. Ngokuthi, ivumela amabhizinisi ukufinyelela ngokukhawuleza ngokucophelela, ngokuvumelana nezakhiwo ezinzima. Vulnerabilities Evolve Faster Than You Ship — Monitor or Fall Behind Izinzuzo ezivela ngokukhawuleza kunazo - Ukuhlola noma ukujabulela I-Speed is not only your asset – it is your opponent, futhi. Ngosuku zonke, izinga ezintsha zithunyelwe. I-Exploit kits iyathunyelwe ngokushesha kunoma, futhi ama-attackers akuyona izilinganiso ze-patch. I-Real-time risk akuyona inqubo ye-theoretical – it is the battlefield. Ngiyazi okuphawulekayo: isivinini sokukhishwa kwamafutha iye yethula izindlela ezivamile zokhuseleko. Ukuphakama phakathi kwe-CVE esithunyelwe nokuthunyelwe ngokushesha kunamafutha esilinganiselwe emahoreni, noma amahora. Ngenxa yalokho ukubuyekezwa kwama-vulgarity e-real-time akuyona "ukubuyekezwa", kuyinto esiyingqayizivele. Ukubuyekezwa kwama-vulgarity ayikwazi ukuxhumana. Ungafuna i-telemetry ye-infrastructure yakho ne-application behavior, ama-threat intelligence feeds e-CI / CD pipeline yakho, ukuxhumana kwe-CVE okuzenzakalelayo ne-stack yakho yamanje, kanye nokuphathwa kwe-security remediation ngama-risk kanye ne-exploitability yebhizinisi. Futhi lapha i-kicker: Lezi zibonelelo kufanele zihlanganiswe ne-SLA emakethe kanye ne-uptime engagqwali. Ngenxa yintoni okufanayo inkqubo ebuthakathaka uma ifakwe ngaphansi kokuphendula komphakathi ngesikhathi kwesimo se-zero-day? I-Security ne-availability akuyona izidingo ezahlukile – zihlanganisa izindawo ezimbili ze-uptime promise yakho. Unemibuzo yokuthintela ngaphandle kokubonisa ukuthi unemibuzo ngokushesha, futhi akuyona ngoLwesihlanu. Yes, Some Risk Is Actually Healthy Yeah, ezinye risk kuyinto enhle ngokwenene Kodwa lokhu kuyinto engaziwa kakhulu: Akukho zonke izinzuzo zihlukile. Ngokuvamile, ezinye izinzuzo ezinzima kakhulu zihlukile amakhompyutha ezivamile ezihlangene izinzuzo ezithile ezihlangene. Hlola ukulungiselela imikhiqizo enikeza i-envelope noma ukuhlanganiswa kwe-platform enikeza amakethe ezintsha. Lezi zihlukile ezinzima ezinzima, kodwa zihlukile. I-mature risk management strategy ibonise lokhu futhi inikeza. Ngaphandle kokufinyelela zonke izimo, izidingo kufuneka kubalulekile ukuxhumana, ukulungiselela, nokufinyelela imiphumela yayo. Lokhu kubalulekile ukucacisa kuphela izinzuzo, kodwa futhi ukucacisa ukuthi izinga lokuphendula kungatholakala, ukuthi ama-indicators zihlanganisa isidingo sokuphendula, futhi indlela yokulawula ama-indicators e-real-time. Lokhu kubalulekile ukucacisa akuyona kuphela isisindo se-risk kodwa futhi ukucaciswa kokuphumelela kwezinto kanye nesifo se-system ngesikhathi eside. We Need Better Metrics—Not Just More of Them We need Better Metrics - Akukho kuphela ngaphezulu kubo I-Metrics inikeza umphumela eningi lapha – kodwa akuyona kuphela ama-basics efana ne-“number of vulnerabilities open.” Lezi zithathesho ezingenalutho, uma akufanele ku-resultats. Thina akufuneka ama-metric that tells a story. How fast are we solving our most critical issues? Abanikeza incidents ezivamile kwelinye indawo ye-code? Indlela thina usahlanganisa manje ku-quarter edlulile ngokuhambisana ne-risk exposure? Imibuzo yezi khosi inikeza ulwazi engaphezu kwe-flat severity score. Izinhlelo ezihlabathi ezintsha ziye ziye zihlanganisa ingozi njenge-responsibility esihlanganisa. Abacwaningi, abacwaningi be-product, abacwaningi, amabhizinisi be-security, futhi ngisho abacwaningi be-legal kanye ne-compliance zihlanganisa ingozi. Futhi okungenani ukulawula ingozi lihlanganiswe ku-workflows yosuku zonke, okungenani ingozi elihlanganisa. Kuyinto ingxenye yobudlelwane, futhi akuyona kuphela ingozi yokubhalisa ngaphambi kokubhalisa. The Real Shift Is Cultural, Not Just Technical I-Real Shift I-Cultural, Ayikho Kwezobuchwepheshe Kuhle Ngokuvamile, ukufinyelela lokhu uhlobo lokuxhumana akuyona kwelanga. Kuqala ngokuvumela indlela yokuxhumana umangalisayo. Akukho njengomthombo, kodwa njenge-signal. Akukho njengomthombo yokugcina ukwakhiwa, kodwa njenge-omthombo yokwakha okungenani. Futhi kufuneka izixhobo kanye nezinhlelo ezokutholela le philosophy – izixhobo ezinikezele ukufinyelela, isikhokelo, kanye nesithombe se-imeyure esizayo emkhakheni le-application. Okwangoku, elandelayo yokulawula ingozi isicelo akuyona ukuguqulwa ama-scanners – kuyinto ukwandisa ingozi. Kuyinto ukuguqulwa kusuka ku-vulgarity hunting kuya ku-decision-making strategic. It kuyinto ukuguqulwa ngaphezu kokuphendula futhi ku-space lapho ingozi ibhekwa ngokuvamile, ngokuvamile ukuguqulwa, futhi ngokuvamile kusetshenziselwa ukweseka ukuzinza. Thina siphila isikhathi lapho isivinini kanye nokuphepha akuyona ezimbonini ezivela. Umthamo owaziwa akuyona kanjani ngokushesha – kuyinto ukuthi ungayenza ngokushesha ngaphandle kokushintshwa. Futhi lokhu kuyinto umthamo owaziwa ukuhlangabezana, nge-strategy yokuxhumana okuzenzakalelayo efana ne-applications esizayo ukuvikelwa. 
 
 Lesi sihloko lithunyelwe njenge-release ka-Sanya Kapoor ngaphansi kwe-HackerNoon's Business Blogging Program. Lesi sihloko lithunyelwe njenge-release ka-Sanya Kapoor ngaphansi kwe-HackerNoon's Business Blogging Program.

The is an opinion piece based on the author’s POV and does not necessarily reflect the views of HackerNoon.

Read My Stories

Lo msindo ukhiqizwa ngolimi lokuqala lwendaba!

Ukubuyekezwa kwe-Application Risk Management: Ngaphandle kwe-Vulnerability Scanning

About Author

IMIBONO

HANG TAGS

LESI SIHLOKO SETHULWE NGAPHAKATHI

Related Stories

The Billionaires F*cked Up

Zulu Network: Moving The Bitcoin Economy Forward With a Two-Tiered Bitcoin Layer 2 Architecture

The Billionaires F*cked Up

Zulu Network: Moving The Bitcoin Economy Forward With a Two-Tiered Bitcoin Layer 2 Architecture

Light-Mode

Classic

Newspaper

Dark-Mode

Neon Noir

Minty

HN StartUps