GitHub
TMA-GITHUB-1.2.7
Ensure inactive repositories are reviewed and archived periodically
Descripción
Track inactive repositories and remove them periodically. Inactive repositories (i.e., no new changes introduced for a long period of time) can enlarge the surface of a potential attack or data leak. Reported as a manual review item: no reliable read-only gh api check exists for this control.
Cómo se verifica
Método de auditoría: Revisión manual
Perform the following to ensure that all the repositories in the organization are active, and those that are not reviewed or archived: 1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations. 2. Click on your organization name and then on repositories. 3. Ensure every repository listed has been active in the last 3 to 6 months. If it's not, then ensure it is archived or reviewed regularly.
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Perform the following to review all inactive repositories and archive them periodically: 1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations. 2. Click on your organization name and then on repositories. 3. Ensure every repository listed has been active in the last 3 to 6 months. Every repository that isn't active you should either review or archive by performing the next steps: 1. On GitHub.com, navigate to the main page of the repository. 2. Under your repository name, click Settings. 3. Under "Danger Zone", click Archive this repository. 4. Read the warnings. 5. Type the name of the repository you want to archive. 6.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- githubsource-code
- Referencia
- CIS GitHub Benchmark v1.2.0 - 1.2.7 Ensure inactive repositories are reviewed and archived periodically