GitHub
TMA-GITHUB-4.3.3
Ensure changes in package registry configuration are audited
SedangLevel 1Tinjauan manualgithub
Deskripsi
Audit changes of the package registry configuration. The package registry is a crucial component in the software supply chain. It stores artifacts with potentially sensitive data that will eventually be deployed and used in production. Reported as a manual review item: no reliable read-only gh api check exists for this control.
Cara pemeriksaan
Metode audit: Tinjauan manual
Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.
Verify that all changes to the packages registry configuration are audited. Search the audit log with repo category actions Expected state: Audit the changes to the package registry configuration.
Cara perbaikan
Metode perbaikan: Panduan atau patch infrastruktur
Audit the changes to the package registry configuration.
Properti
- Sistem operasi
- Apa saja
- Tag
- githubartifacts
- Referensi
- CIS GitHub Benchmark v1.2.0 - 4.3.3 Ensure changes in package registry configuration are audited