TMA-GITLAB-1.5.7
Ensure scanners are in place for web application runtime security weaknesses
Mô tả
Dynamic Application Security Testing (DAST) runs automated penetration tests to find vulnerabilities in your web applications as they are running. DAST automates a hacker’s approach and simulates real-world attacks for critical threats such as cross-site scripting (XSS), SQL injection (SQLi), and cross-site request forgery (CSRF) to uncover vulnerabilities and misconfigurations that other security tools cannot detect.
Cách kiểm tra
Phương pháp kiểm tra: Xem xét thủ công
Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.
Audit: Ensure Browser-based DAST is set up to identify dynamic vulnerabilities in web applications that cannot be detected by other tools earlier in the SDLC. Ensure that every project that contains a web application is scanned by DAST. - The DAST template must be configured for your project. - Review the output from the previous scan on your default branch in Secure > Vulnerability Report.
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
1. Include the DAST.gitlab-ci.yml template in your .gitlab-ci.yml file. 2. Add a dast stage to your GitLab CI/CD stages configuration. 3. Define the URL to be scanned by DAST by setting the DAST_WEBSITE CI/CD variable. 4. Add any additionally desired CI variables to customize the test. 5. After configuration, the analyzer will run in your pipeline. 6. View the results in the Vulnerability report and remediate the vulnerabilities.
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- devsecopsgitlab
- Tham chiếu
- CIS GitLab Benchmark v1.0.1 - 1.5.7 Ensure scanners are in place for web application runtime security weaknesses