TMA-SSC-1.1.16
Ensure force push code to branches is denied
설명
The “force push” option allows users with “push” permissions to force their changes directly to the branch without a pull request, and thus should be disabled. The “force push” option allows users to override the existing code with their own code. This can lead to both intentional and unintentional data loss, as well as data infection with malicious code. Disabling the “force push” option prohibits users from forcing their changes to the main branch, which ultimately prevents malicious code from entering source code. Note Users cannot “force push” to protected branches.
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
For each repository in use, validate that no one can “force push” code.
조치 방법
조치 방식: 가이드 또는 인프라 패치
For each repository in use, block the option to “force push” code.
속성
- 운영 체제
- 모두
- 태그
- branch-protectiondevsecopssupply-chain
- 참고 자료
- CIS Software Supply Chain Security Guide Benchmark v1.0.0 - 1.1.16 Ensure force push code to branches is denied