Ensure dependencies are monitored between open-source components

OrtaDüzey 1Manuel incelemegitlab

Açıklama

Monitor, or ask software suppliers to monitor, dependencies between open-source components in use. Monitoring dependencies between open-source components helps to detect if software has fallen victim to attack on a common open-source component. Swift detection can aid in quick application of a fix. It also helps find potential compliance problems with components usage. Some dependencies might not be compatible with the organization's policies, and other dependencies might have a license that is not compatible with how the organization uses this specific dependency. If dependencies are monitored, such situations can be detected and mitigated sooner, potentially deterring malicious attacks.

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

For each project, ensure that dependency scanning and container scanning are enabled in order to monitor dependencies. 1. On GitLab, navigate to the main page of the repository. 2. Review the CI pipeline configuration to verify that Dependency Scanning and that Container Scanning have been configured to run on this project.

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

For every repository that is in use, set a dependency scanning and container scanning tools to detect, prevent, and monitor vulnerabilities in project packages and container images by performing the following: 1. On GitLab, navigate to the main page of the repository. 2. Configure Dependency Scanning and Container Scanning to run on this project

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: devsecopsgitlabmonitoring
Referans: CIS GitLab Benchmark v1.0.1 - 3.1.4 Ensure dependencies are monitored between open-source components