Ensure dependencies are monitored between open-source components

HochStufe 1Manuelle Prüfungsupply-chain

Beschreibung

Monitor, or ask software suppliers to monitor, dependencies between open-source components in use. Monitoring dependencies between open-source components helps to detect if software has fallen victim to attack on a common open-source component. Swift detection can aid in quick application of a fix. It also helps find potential compliance problems with components usage. Some dependencies might not be compatible with the organization’s policies, and other dependencies might have a license that is not compatible with how the organization uses this specific dependency. If dependencies are monitored, such situations can be detected and mitigated sooner, potentially deterring malicious attacks.

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

For each open-source component, ensure its dependencies are monitored.

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

For each open-source component, monitor its dependencies.

Eigenschaften

Betriebssysteme: Beliebig
Tags: devsecopsmonitoringsupply-chain
Referenz: CIS Software Supply Chain Security Guide Benchmark v1.0.0 - 3.1.4 Ensure dependencies are monitored between open-source components