Sonke siyasikhumbula isimemezelo esinegama elibi lokuphulwa kwezokuphepha esenziwa yi-Yahoo lapho sathi ama-akhawunti wabasebenzisi abayizigidi eziyizinkulungwane ezintathu athinteka ekuhlaselweni yi-cyber ngo-3. Umbiko wafaka le nkampani esicongweni sohlu lokwephula okukhulu kwezokuphepha. Unyaka wezi-2013 ubhalwe ngezindaba ezinjalo ngendlela ebanzi. Ngo-Agasti, i-Equifax, i-ejensi yokulinganisa izikweletu, iveze ukwephulwa kwedatha okuthintekile abantu abayizigidi ezingu-143. Ngokusho kwenkampani yonogada, iGemalto, cishe amarekhodi ayizigidi eziyizinkulungwane ezimbili abiwa emhlabeni jikelele engxenyeni yokuqala yonyaka ka-2.
Ukuphulwa okunjalo kwezokuphepha kuzoqhubeka ukwenzeka ngoba muva nje amathuluzi wokugenca asetshenziswa nguhulumeni aputshuke online, okwenza kube lula kubaduni ukungenisa malware bese beba imininingwane ezinkampanini. Ngokombiko we-CyberSecurity ventures, umhlaba kuzodingeka ulahlekelwe yi $ 6 trillion minyaka yonke ngo-2021 ngenxa yobugebengu be-cyber, okungaphezulu kakhulu komonakalo odalwe ukuhwebelana kwezidakamizwa ezingekho emthethweni emhlabeni jikelele.
Lezi zibalo ezesabekayo zibonisa ukuthi kungani kubalulekile ukuvikela noma yiluphi uhlobo lwesoftware ngaphambi kokwethulwa. Nawa amathiphu amahlanu wokwakha isixazululo ngokucabanga kwengqondo:
1. Vimbela umjovo we-SQL
Umjovo we-SQL ungenye yezingcuphe eziphezulu zohlu lwe-OWASP Top 10 Web Application Vulnerabilities. I-OWASP Mobile Security Project yaqalwa ngenhloso yokunikeza onjiniyela izinto ezithile ezijwayelekile ezisongela ukuphepha kohlelo lokusebenza lwewebhu. Umjovo we-SQL ujwayelekile futhi kwenzeka lapho umthombo ongathembekile ufaka idatha kuhlelo lokusebenza. Izindawo zokungena ezivamile zifaka phakathi izinqola zokuthenga, amafomu okubhalisa, namafomu wokungena ngemvume.
Umjovo we-SQL uvamile ngoba i-SQL ilulimi jikelele olusetshenziswa yizo zonke izizinda zolwazi futhi aludingi ubuchwepheshe obuningi. Umjovo we-SQL uvumela abaduni ukuba bashintshe idatha ekhona. Isigenci singadalula futhi sonakalise yonke idatha noma okubi kakhulu singaba umphathi wesiphakeli. Abathuthukisi bangavimbela umjovo we-SQL ngokusebenzisa i-Query Parametrization, lapho iseva icubungula khona isicelo ngaphambi kokuyisebenzisa ukuze yazi ukuthi hlobo luni lombuzo.
2. Bethela konke
Ukubethela kuyisinyathelo esibucayi kakhulu ekuvikeleni uhlelo lokusebenza. Ngo-2014, kubaduni bahlasela i-eBay bantshontsha imininingwane kubasebenzi abayi-100 be-eBay. Ngale ndlela abaduni bathola ukufinyelela kunethiwekhi yangaphakathi yenkampani lapho bathathe khona imininingwane yamakhasimende angaba yizigidi eziyi-145. Okuthokozisayo ukuthi abaduni baphazamise amasistimu we-eBay izinsuku ezingama-229 ngaphandle kwenkampani ekubonile.
Izimo ezinjalo zenzeka esimweni sokubethela kwekhwalithi ephansi. Abahlaseli bangafaka izitifiketi ezebiwe ezibavumela ukuthi bacashe. Lezi zitifiketi ezinamandla azibonakali lapho izixazululo ze-HTTPS zingakwazi ukufinyelela kuzo zonke izinkinobho nezitifiketi.
I-LinkedIn iphinde yaneliseka ngohlelo lwayo lweselula. Ngenkathi inkampani yethula isici esisha sokuhlanganiswa kwekhalenda, idlulise idatha yekhalenda lendawo kumaseva we-LinkedIn ngokusobala ku-inthanethi, futhi yayitholakala kalula kunoma ngubani oyifunayo
Bona ukuthi uhlelo lwakho lokusebenza lubethelwe, qiniseka ukuthi konke ukuxhumana phakathi kwesoftware namaseva kwenziwa ngokuxhumeka kwe-HTTPS.
3. Qinisekisa ukuphepha kwephasiwedi
Ukuphepha kwephasiwedi kubaluleke kakhulu kunoma yikuphi ukuthuthukiswa kohlelo lokusebenza. Ukwephulwa kokuphepha kwedatha ye-Adobe 2013 kudumile ngoba inkampani ayizange igcine amaphasiwedi ngokuvikelekile. Imvamisa, izinhlelo zokusebenza zenza iphutha lokugcina amaphasiwedi engabhalwanga, okubenza babe sengozini yokuhlaselwa.
Ngakho-ke, kufanele uvikele amaphasiwedi ngendlela yokuthi angatholakali ku-database. Ukuvikela amaphasiwedi ngomqondo weqiniso, ungasebenzisa i-cryptographic hash, eyenzelwe ukumelana nanoma yimiphi imizamo ngokuxuba nokufaka okokufaka. Futhi, ungasebenzisa isu elibizwa ngokuthi 'i-hash nosawoti,' lapho i-hash evela kwiphasiwedi ngayinye ixutshwe nokufakwa okungahleliwe okubizwa ngosawoti.
4. Qalisa ukuqinisekiswa kwe-multifactor
Ukusebenzisa nje amaphasiwedi wokufakazela ubuqiniso sekuyinto engasasebenzi njengoba umhlaba usuya ekuqinisekisweni kwe-multifactor. Amawebhusayithi amaningi nezinhlelo zokusebenza ezifana nezinye ezivela ku-Google naku-Apple namuhla zinikeza ukuqinisekiswa kwe-multifactor. Ukubaluleka kokuqinisekiswa kwe-multifactor kwenziwa kwacaca ngohlelo lokusebenza lokukhokha, i-Venmo, kanye nesigameko sabo sokuphula umthetho. Iklayenti likaVenmo, i-akhawunti kaGriswold yathikamezeka, futhi wazi ukuthi kusele u- $ 3000 kuphela kuyo. Yize bekungacaci ukuthi umhlaseli uthole kanjani ukungena kwi-akhawunti yakhe, uVenmo wagxekwa ngoba akusekeli ukuqinisekiswa kwezinto ezimbili.
Indlela ejwayelekile yokuqinisekiswa kwezinto ezimbili ngezinhlelo zokusebenza. Noma kunjalo, ivikeleke kancane. Muva nje, i-Twitter ivuselele ukuphepha kwayo kwepulatifomu ngokuvumela abasebenzisi ukuthi basebenzise ubuqiniso benkampani yangaphandle. Abasebenzisi be-Twitter manje sebengasebenzisa izinhlelo zokusebenza ezivela eceleni njenge-Google Authenticator ukuqinisekisa.
5. Yenza ukuhlolwa kwezokuphepha
Ngakho-ke, ucabanga ukuthi ukwenzele konke vikela uhlelo lwakho lokusebenza, futhi livikelekile kunoma yikuphi ukuhlaselwa? Cabanga futhi. Kungenzeka ukuthi wake wahlola futhi wahlola isoftware yakho, kepha akuqinisekisi ukuthi ukuphepha kwakho akuvikelwa yizinhlamvu. Lokhu kungenxa yokuthi abathuthukisi bazibhalela le khodi ngokwabo, okwenza kube lula ngabo ukunganaki noma ukungazinaki izinto ezithile. Kungakho kudingekile ukuthi isixazululo sakho sibhekwe ngelinye iso.
Ukwenza ucwaningomabhuku oluyimpumelelo, okokuqala udinga ukuqinisekisa ukuthi yiziphi izidingo zakho. Futhi, udinga ukukhomba uhlobo lobungozi uhlelo lwakho lokusebenza olungaba sengozini yalo ukuze kwenziwe izivivinyo ezifanele. Ungasebenzisa futhi amathuluzi azenzakalelayo womsebenzi. Lawa mathuluzi anciphisa izindleko kakhulu futhi andise ububanzi bokusabalala.
Isifinyezo
Njengoba umhlaba uya ngokuya uxhuma futhi ukuthembela kwethu kwizisombululo zesoftware kuyanda, ukubaluleka kwezokuphepha akunakugcizelelwa ngokweqile. Ngaphezu kwalokho, ngenxa yokwanda kwamacala e-cyber, sekuye kwaba nzima ukuthi noma isiphi isicelo sewebhu sisinde, ikakhulukazi lezo ezibandakanya izinhlelo zokukhokha ezifana ne-PayPal, i-AliPay, noma i-Venmo. Ukuphepha kwe-Cybersecurity kuya ngokuya kuba yinselele usuku ngalunye oludlulayo ngoba abaduni baya ngokuhlakanipha futhi bayinkimbinkimbi ngokwengeziwe. IBlackhats ivame ukuba phambili kwezokuphepha iWhitehats.
Kuthatha kuphela isigebenga esinolwazi imizuzu eyi-10 ukuqhekeza iphasiwedi enezinhlamvu eziyisithupha, ngokuya ngobulukhuni bayo. Kuyethusa, akunjalo? Lokhu kwebiwa kwe-cyber kwenza imali eningi ngokwenza abakwenzayo futhi akumi noma kunini maduzane.
Ngenqwaba yezinketho ezitholakala emakethe nezindleko eziphansi ezihambisana nokushintsha, amakhasimende awanqikazi ngaphambi kokukhetha esinye isisombululo esikhundleni sakho. Lapho isithunzi sesonakele, kuba nzima ukubuyisa kulokho.
Lo mbhalo wezivakashi unikelwe ngu U-Ashley Rosa. Ungumbhali ozimele kanye ne-blogger. Njengoba ukubhala kuwuthando lwakhe lokuthi kungani ethanda ukubhala izindatshana ezihlobene nezitayela zakamuva kwezobuchwepheshe futhi kwesinye isikhathi naku-health-tech. Uyahlanya ama-chocolate.
Isikweletu sezithombe: UMark Hawkins / Imbewu Yokuthuthuka
Umthombo: Seena Gressin (FTC), I-cybersecurity Ventures, UGordon Kelly (Forbes)
