TMA-GITLAB-2.2.6
Ensure build workers are automatically scanned for vulnerabilities
說明
Scan build workers for vulnerabilities. It is recommended that this be done automatically. Automatic scanning for vulnerabilities detects known weaknesses in environmental sources in use, such as docker images or kernel versions. Such vulnerabilities can lead to a massive breach if these environments are not replaced as fast as possible, since attackers also know about these vulnerabilities and often try to take advantage of them. Setting automatic scanning which scans environmental sources ensures that if any new vulnerability is revealed, it can be replaced quickly and easily. This protects the worker from being exposed to attacks.
檢查方式
稽核方法: 人工審核
此項建議無法自動檢查。當您傳入 --include-manual 時，掃描結果會列出此項目並附帶這些說明。
If you are using a static host for a runner, whether bare-metal or virtual machine, you should implement security best practices for the host operating system. Malicious code executed in the context of a CI job could compromise the host, so security protocols can help mitigate the impact. Other points to keep in mind include securing or removing files such as SSH keys from the host system that may enable an attacker to access other endpoints in the environment.
修補方式
修補方法: 操作指南或基礎設施修補檔
For each build worker, automatically scan its environmental sources, such as docker image, for vulnerabilities. - Create a new project. - Add a Dockerfile file to the project. This Dockerfile contains minimal configuration required to create a Docker image. - Create pipeline configuration for the new project to create a Docker image from the Dockerfile, build and push a Docker image to the container registry, and then scan the Docker image for vulnerabilities. - Check for reported vulnerabilities. - Update the Docker image and scan the updated image.
屬性
- 作業系統
- 不限
- 標籤
- devsecopsgitlab
- 參考資料
- CIS GitLab Benchmark v1.0.1 - 2.2.6 Ensure build workers are automatically scanned for vulnerabilities