TMA-GITLAB-1.2.7
Ensure inactive repositories are reviewed and archived periodically
Descripción
Track inactive repositories and remove them periodically. Inactive repositories (i.e., no new changes introduced for a long period of time) can enlarge the surface of a potential attack or data leak. These repositories are more likely to be improperly managed, and thus could possibly be accessed by a large number of users in an organization.
Cómo se verifica
Método de auditoría: Revisión manual
Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.
Perform the following to ensure that all the projects in the organization are active. For each group: - Navigate to the group homepage. - Expand any sub-groups. - For each project, review the updated date and ensure it has been updated within the last 6 months.
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Perform the following to remediate the presence of inactive projects. For each inactive project identified during the audit: - Navigate to the project homepage. - In the sidebar, select Settings > General. - In the 'Advanced' section, select 'Expand'. - Select 'Archive project'. - Read the warning. - Select 'Archive project'. To automate the deletion of inactive projects, perform the following steps as an Administrator: - On the left sidebar, at the bottom, select Admin Area. - Select Settings > Repository. - Expand Repository maintenance. - In the Inactive project deletion section, select Delete inactive projects. - Configure the settings. o The warning email is sent to users who have the Owner and Maintainer role for the inactive project. o The email duration must be less than the Delete project after duration. - Select Save changes.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- devsecopsgitlab
- Referencia
- CIS GitLab Benchmark v1.0.1 - 1.2.7 Ensure inactive repositories are reviewed and archived periodically