TMA-GITLAB-1.5.8
Ensure scanners are in place for API runtime security weaknesses
説明
Dynamic Application Security Testing (DAST) runs automated penetration tests to find vulnerabilities in your APIs as they are running. DAST automates a hacker’s approach and simulates real-world attacks for critical threats such as cross-site scripting (XSS), SQL injection (SQLi), and cross-site request forgery (CSRF) to uncover vulnerabilities and misconfigurations that other security tools cannot detect.
チェック方法
監査方法: 手動レビュー
この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。
Audit: Ensure a dynamic API scanning tool is set up to identify API-specific vulnerabilities and that every project that contains an APi is scanned by it. - The DAST-API template must be configured for your project. - A successful pipeline was run on the default branch. You should not change the default behavior of allowing the application security jobs to fail. - Review the output from the scan in Secure > Vulnerability Report
修正方法
修正方法: ガイダンスまたは IaC パッチ
1. Include the DAST-API.gitlab-ci.yml template in your .gitlab-ci.yml file. 2. The configuration file has several testing profiles defined with different checks enabled. Select a profile and provide it by adding the DAST_API_PROFILE CI/CD variable to your .gitlab-ci.yml file. 3. Provide the location of the OpenAPI Specification as either a file or URL. Specify the location by adding the DAST_API_OPENAPI variable. 4. The target API instance’s base URL is also required. Provide it by using the DAST_API_TARGET_URL variable or an environment_url.txt file. 5. After configuration, the analyzer will run in your pipeline. 6. View the results in the Vulnerability report and remediate the vulnerabilities.
プロパティ
- オペレーティングシステム
- すべて
- タグ
- devsecopsgitlab
- 参照
- CIS GitLab Benchmark v1.0.1 - 1.5.8 Ensure scanners are in place for API runtime security weaknesses