Ensure build workers are automatically scanned for vulnerabilities

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

If you are using a static host for a runner, whether bare-metal or virtual machine, you should implement security best practices for the host operating system. Malicious code executed in the context of a CI job could compromise the host, so security protocols can help mitigate the impact. Other points to keep in mind include securing or removing files such as SSH keys from the host system that may enable an attacker to access other endpoints in the environment.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

For each build worker, automatically scan its environmental sources, such as docker image, for vulnerabilities. - Create a new project. - Add a Dockerfile file to the project. This Dockerfile contains minimal configuration required to create a Docker image. - Create pipeline configuration for the new project to create a Docker image from the Dockerfile, build and push a Docker image to the container registry, and then scan the Docker image for vulnerabilities. - Check for reported vulnerabilities. - Update the Docker image and scan the updated image.