Ensure dependencies are validated before being used

SrednjaNivo 1Ručni pregledgitlab

Opis

Validate every dependency of the pipeline before use. To ensure that a dependency used in a pipeline is trusted and has not been infected by malicious actor (for example, the codecov incident), validate dependencies before using them. This can be accomplished by comparing the checksum of the dependency to its checksum in a trusted source. If a difference arises, this is a sign that an unknown actor has interfered and may have added malevolent code. If this dependency is used, it will infect the environment, which could end in a massive breach and leave the organization exposed to data leaks, etc.

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

For every dependency used in every pipeline, ensure it has been validated. - On the left sidebar, select Code > Repository. - Check if a .gitlab-ci.yml file is at the root of your repository - Verify the following job is included in your .gitlab-ci.yml file: include: - template: Jobs/Dependency-Scanning.gitlab-ci.yml - Go to Build > Pipelines and confirm that the latest pipeline completed successfully.

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

For every dependency used in every pipeline, validate each one. - On the left sidebar, select Code > Repository. - Check if a .gitlab-ci.yml file is at the root of your repository - Include the following job is included in your .gitlab-ci.yml file: include: - template: Jobs/Dependency-Scanning.gitlab-ci.yml - Go to Build > Pipelines and confirm that the latest pipeline completed successfully. In the pipeline, dependency scanning runs and the vulnerabilities are detected automatically. - Go to Secure > Vulnerability report. - Select each of the vulnerabilities by selecting the checkbox in each row. - Review the recommended solution for each vulnerability and investigate further if needed. - From the Set status dropdown list select the relevant option and select Change status.

Svojstva

Operativni sistemi: Bilo koji
Oznake: devsecopsgitlab
Referenca: CIS GitLab Benchmark v1.0.1 - 2.4.3 Ensure dependencies are validated before being used