TMA-GITHUB-1.2.7
Ensure inactive repositories are reviewed and archived periodically
Description
Track inactive repositories and remove them periodically. Inactive repositories (i.e., no new changes introduced for a long period of time) can enlarge the surface of a potential attack or data leak. Reported as a manual review item: no reliable read-only gh api check exists for this control.
Méthode de vérification
Méthode d'audit: Revue manuelle
Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.
Perform the following to ensure that all the repositories in the organization are active, and those that are not reviewed or archived: 1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations. 2. Click on your organization name and then on repositories. 3. Ensure every repository listed has been active in the last 3 to 6 months. If it's not, then ensure it is archived or reviewed regularly.
Méthode de correction
Méthode de correction: Recommandation ou correctif d'infrastructure
Perform the following to review all inactive repositories and archive them periodically: 1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations. 2. Click on your organization name and then on repositories. 3. Ensure every repository listed has been active in the last 3 to 6 months. Every repository that isn't active you should either review or archive by performing the next steps: 1. On GitHub.com, navigate to the main page of the repository. 2. Under your repository name, click Settings. 3. Under "Danger Zone", click Archive this repository. 4. Read the warnings. 5. Type the name of the repository you want to archive. 6.
Propriétés
- Systèmes d'exploitation
- Tous
- Étiquettes
- githubsource-code
- Référence
- CIS GitHub Benchmark v1.2.0 - 1.2.7 Ensure inactive repositories are reviewed and archived periodically