GitHub
TMA-GITHUB-1.2.7
Ensure inactive repositories are reviewed and archived periodically
Описание
Track inactive repositories and remove them periodically. Inactive repositories (i.e., no new changes introduced for a long period of time) can enlarge the surface of a potential attack or data leak. Reported as a manual review item: no reliable read-only gh api check exists for this control.
Как проверяется
Метод проверки: Ручная проверка
Perform the following to ensure that all the repositories in the organization are active, and those that are not reviewed or archived: 1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations. 2. Click on your organization name and then on repositories. 3. Ensure every repository listed has been active in the last 3 to 6 months. If it's not, then ensure it is archived or reviewed regularly.
Как исправляется
Метод исправления: Рекомендация или патч инфраструктуры
Perform the following to review all inactive repositories and archive them periodically: 1. In the top right corner of GitHub.com, click your profile photo, then click Your organizations. 2. Click on your organization name and then on repositories. 3. Ensure every repository listed has been active in the last 3 to 6 months. Every repository that isn't active you should either review or archive by performing the next steps: 1. On GitHub.com, navigate to the main page of the repository. 2. Under your repository name, click Settings. 3. Under "Danger Zone", click Archive this repository. 4. Read the warnings. 5. Type the name of the repository you want to archive. 6.
Свойства
- Операционные системы
- Любая
- Теги
- githubsource-code
- Источник
- CIS GitHub Benchmark v1.2.0 - 1.2.7 Ensure inactive repositories are reviewed and archived periodically