{"id":4448,"date":"2024-03-18T19:50:14","date_gmt":"2024-03-18T18:50:14","guid":{"rendered":"https:\/\/gokhan-gokalp.com\/?p=4448"},"modified":"2024-03-18T21:07:25","modified_gmt":"2024-03-18T20:07:25","slug":"securing-the-supply-chain-of-containerized-applications-to-reduce-security-risks-security-scanning-sboms-signingverifying-artifacts-part-1","status":"publish","type":"post","link":"https:\/\/gokhan-gokalp.com\/tr\/securing-the-supply-chain-of-containerized-applications-to-reduce-security-risks-security-scanning-sboms-signingverifying-artifacts-part-1\/","title":{"rendered":"Containerized Uygulamalar\u0131n Supply Chain’ini G\u00fcvence Alt\u0131na Alarak G\u00fcvenlik Risklerini Azaltma (G\u00fcvenlik Taramas\u0131, SBOM’lar, Artifact’lerin \u0130mzalanmas\u0131 ve Do\u011frulanmas\u0131) – B\u00f6l\u00fcm 1"},"content":{"rendered":"

Bildi\u011fimiz gibi modern yaz\u0131l\u0131m geli\u015ftirme ortam\u0131nda containerization’\u0131n benimsenmesi, uygulamalar\u0131n olu\u015fturulma ve da\u011f\u0131t\u0131lma \u015fekillerini olduk\u00e7a de\u011fi\u015ftirdi. Container’lar\u0131n lightweight<\/strong> ve self-contained<\/strong> birimler olmas\u0131, uygulamalar\u0131m\u0131z\u0131 farkl\u0131 ortamlar aras\u0131nda consistent bir \u015fekilde kolayca ta\u015f\u0131yabilme ve h\u0131zl\u0131 bir \u015fekilde scale edebilme gibi bir \u00e7ok farkl\u0131 anlamda avantajlar ve esneklikler sa\u011flamaktad\u0131r.<\/p>\n

Ayr\u0131ca container’lar scalable microservice architecture’lar\u0131<\/strong> i\u00e7in de, en \u00f6nemli building block’lar\u0131ndan birisidir. Kubernetes gibi container orchestration ara\u00e7lar\u0131 ile birlikte de kaynaklar\u0131m\u0131z\u0131 daha efektif bir \u015fekilde kullanmam\u0131za olanak tan\u0131yarak, uygulamalar\u0131m\u0131z\u0131 esnek bir \u015fekilde scale edebilmemizi ve de\u011fi\u015fen ihtiya\u00e7lar kar\u015f\u0131s\u0131nda h\u0131zl\u0131 bir \u015fekilde hareket edebilmemizi de sa\u011flamaktad\u0131r.<\/p>\n

Elbette, container’lar\u0131n sundu\u011fu avantajlar\u0131n yan\u0131 s\u0131ra, maalesef g\u00fcvenlikle ilgili kapsaml\u0131 bir yakla\u015f\u0131m gerektiren karma\u015f\u0131kl\u0131klar\u0131 da beraberinde getirmektedir. Bir container’daki bir g\u00fcvenlik sorununun t\u00fcm sistemi tehlikeye atabilme olas\u0131l\u0131\u011f\u0131n\u0131n var olabilmesinden dolay\u0131, sahip oldu\u011fumuz t\u00fcm container ekosistemini u\u00e7tan uca kapsayacak d\u00fczg\u00fcn bir g\u00fcvenlik duru\u015funa sahip olmam\u0131z olduk\u00e7a \u00f6nem arz etmektedir. Bir ba\u015fka de\u011fi\u015fle containerized uygulamalar\u0131n g\u00fcvenlik risk’lerinin azalt\u0131lmas\u0131 ve gerekli \u00f6nlemlerin al\u0131nmas\u0131, bir best practice olmaktan \u00f6te art\u0131k organizasyonlar i\u00e7in stratejik bir zorunluluk <\/strong>haline gelmi\u015ftir.<\/p>\n

Ge\u00e7ti\u011fimiz y\u0131llarda ger\u00e7ekle\u015ftirilen SolarWinds, Log4j<\/em> (hat\u0131rlarsan\u0131z \u00f6zellikle Log4j<\/em> g\u00fcndemimizi baya me\u015fgul etmi\u015fti) gibi sald\u0131r\u0131lara dikkat etti\u011fimizde, \u00f6zellikle Software Supply Chain’in<\/strong> hedef al\u0131nd\u0131\u011f\u0131n\u0131 g\u00f6rebiliriz. Ayr\u0131ca uygulamalar\u0131m\u0131z\u0131 geli\u015ftirirken olduk\u00e7a fazla open-source k\u00fct\u00fcphanelerden yararland\u0131\u011f\u0131m\u0131z\u0131 da g\u00f6z \u00f6n\u00fcne ald\u0131\u011f\u0131m\u0131zda, uygulamalar\u0131m\u0131z\u0131n k\u00f6t\u00fc ama\u00e7l\u0131 kod enjeksiyonlar\u0131na ve g\u00fcvenliklerinin ihlal edilmesine ne kadar hassas ve savunmas\u0131z olduklar\u0131n\u0131 da fark edebiliriz.<\/p>\n

Genel anlamda software supply chain’i g\u00fc\u00e7lendirmek i\u00e7in SDLC<\/em> s\u00fcre\u00e7leri boyunca uygulayabilece\u011fimiz \u00e7e\u015fitli \u00f6nleyici kontroller ve yakla\u015f\u0131mlar mevcuttur. G\u00fcn\u00fcm\u00fczde farkl\u0131 organizasyonlar bu konuda best practice’lere sahip olabilmek ad\u0131na g\u00fcvenlik konusunda shifting-left<\/strong> yakla\u015f\u0131m\u0131n\u0131 benimseyerek, g\u00fcvenlik unsurlar\u0131n\u0131 olabildi\u011fince SDLC<\/em> s\u00fcre\u00e7lerinin erken a\u015famalar\u0131na entegre etmeye \u00e7al\u0131\u015fmaktad\u0131rlar. Bu kontroller ve yakla\u015f\u0131mlar, software supply chain s\u00fcre\u00e7lerindeki g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 en aza indirerek b\u00fct\u00fcnl\u00fc\u011f\u00fc sa\u011flamak, potansiyel g\u00fcvenlik risklerini minimize etmek ve h\u0131zl\u0131 hareket edebilmek ad\u0131na \u00f6nemli roller oynamaktad\u0131r.<\/p>\n

\u00d6rne\u011fin The National Institute of Standards and Technology<\/em> (NIST<\/em>) taraf\u0131ndan yay\u0131mlanan “Zero Trust Architecture<\/strong><\/a>” ve “Strategies for the Integration of Software Supply Chain Security in DevSecOps CI\/CD Pipelines<\/strong><\/a>” gibi kaynaklar, ekosistemde en az ayr\u0131cal\u0131k ilkesinin benimsenmesinden, CI\/CD<\/em> s\u00fcre\u00e7lerinde \u00e7e\u015fitli politikalar ile g\u00fcvenli build’lerin ger\u00e7ekle\u015ftirilmesine, software composition analysis (SCA<\/em>) ve static application security testing (SAST<\/em>) gibi \u00e7e\u015fitli ara\u00e7lar\u0131n erken a\u015famalarda kullan\u0131lmas\u0131na kadar \u00e7e\u015fitli \u00f6neriler sunmaktad\u0131r.<\/p>\n

Ayr\u0131ca Microsoft’un<\/em>\u00a0Containers Secure Supply Chain (CSSC) <\/em><\/a>framework’\u00fc ve Google<\/em> taraf\u0131ndan geli\u015ftirilen Supply-chain Levels for Software Artifacts<\/em> (SLSA)<\/em><\/a> g\u00fcvenlik framework’\u00fc, g\u00fcvenli bir software supply chain olu\u015fturmak i\u00e7in olduk\u00e7a kapsaml\u0131 y\u00f6nergeler sa\u011flamaktad\u0131r.<\/p>\n

Bu makale kapsam\u0131nda, CI\/CD<\/em> a\u015famalar\u0131 boyunca containerized<\/strong> uygulamalar\u0131n b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc sa\u011flamaya ve kayna\u011f\u0131n\u0131 izlemeye y\u00f6nelik yakla\u015f\u0131mlar\u0131 inceleyerek software supply chain g\u00fcvenli\u011fini sa\u011flamaya bir g\u00f6z ataca\u011f\u0131z. Ayr\u0131ca yukar\u0131da payla\u015ft\u0131\u011f\u0131m baz\u0131 y\u00f6nergeleri dikkate alarak g\u00fcvenlik risklerini azaltmaya y\u00f6nelik baz\u0131 \u00f6nlemlere de bakaca\u011f\u0131z.<\/p>\n

Bu ba\u011flamda s\u0131ras\u0131yla a\u015fa\u011f\u0131daki konulara de\u011finiyor olaca\u011f\u0131z.<\/strong><\/p>\n

\"\"<\/a><\/p>\n