Ensure dependencies are monitored between open-source components

Trung bìnhCấp 1Xem xét thủ cônggitlab

Mô tả

Monitor, or ask software suppliers to monitor, dependencies between open-source components in use. Monitoring dependencies between open-source components helps to detect if software has fallen victim to attack on a common open-source component. Swift detection can aid in quick application of a fix. It also helps find potential compliance problems with components usage. Some dependencies might not be compatible with the organization's policies, and other dependencies might have a license that is not compatible with how the organization uses this specific dependency. If dependencies are monitored, such situations can be detected and mitigated sooner, potentially deterring malicious attacks.

Cách kiểm tra

Phương pháp kiểm tra: Xem xét thủ công

Khuyến nghị này không thể kiểm tra tự động. Lần quét sẽ liệt kê mục này kèm hướng dẫn khi bạn truyền cờ --include-manual.

For each project, ensure that dependency scanning and container scanning are enabled in order to monitor dependencies. 1. On GitLab, navigate to the main page of the repository. 2. Review the CI pipeline configuration to verify that Dependency Scanning and that Container Scanning have been configured to run on this project.

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

For every repository that is in use, set a dependency scanning and container scanning tools to detect, prevent, and monitor vulnerabilities in project packages and container images by performing the following: 1. On GitLab, navigate to the main page of the repository. 2. Configure Dependency Scanning and Container Scanning to run on this project

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: devsecopsgitlabmonitoring
Tham chiếu: CIS GitLab Benchmark v1.0.1 - 3.1.4 Ensure dependencies are monitored between open-source components