TMA-SSC-2.2.8
Ensure resource consumption of build workers is monitored
Descripción
Monitor the resource consumption of build workers and set alerts for high consumption that can lead to resource exhaustion. Resource exhaustion is when machine resources or services are highly consumed until exhausted. Resource exhaustion may lead to DOS (Denial of Service). When such a situation happens to build workers, it slows down and even stops the build process, which harms the production of artifacts and the organization’s ability to deliver software on schedule. To prevent that, it is recommended to monitor resource consumption in the build workers and set alerts to notify when they are highly consumed. That way, resource exhaustion can be acknowledged and prevented at an early stage.
Cómo se verifica
Método de auditoría: Revisión manual
Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.
Verify that there is monitoring of resource consumption for each build worker.
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Set resource consumption monitoring for each build worker. 2.3 Pipeline Instructions This section consists of security recommendations for pipeline instructions and commands. Pipeline instructions are dedicated to taking raw files of source code and running a series of tasks on them to achieve some final artifact as output. They are most of the time written by third-party developers so they should be treated carefully and can also be vulnerable to attack in certain situations. Pipeline instructions files are considered very sensitive, and it is important to secure all their aspects — instructions, access, etc.
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- devsecopsmonitoringsupply-chain
- Referencia
- CIS Software Supply Chain Security Guide Benchmark v1.0.0 - 2.2.8 Ensure resource consumption of build workers is monitored