Security and compliance scanning strategy
Design a strategy for security and compliance scanning
Four scan types answer different questions:
| Scan | Asks | Typical control |
|---|---|---|
| Dependency | Are our third-party components vulnerable? | Dependabot, dependency review |
| Code (SAST) | Does our own code contain vulnerable patterns? | Code scanning |
| Secret | Are supported credentials being pushed or already exposed? | Push protection and secret scanning |
| Licensing | Do dependency licences comply with policy? | Dependency-review license allow/deny controls |
Where each belongs
Push protection can block a supported secret before the push reaches the repository. Dependency review and code scanning operate on pull-request changes that already exist on a head branch; required results can prevent those changes from merging into the protected or default branch.
The two ends also matter:
- Secret response: once an active credential is committed, treat it as compromised and revoke or rotate it first. Public automated scanners can find exposed secrets in minutes. History can be rewritten, but sensitive commits may remain accessible through clones, forks, cached views, or pull-request references.
- Continuous dependency alerting: Dependabot can alert when a new advisory is added or when the dependency graph changes. A quiet repository can therefore receive an alert without a new commit. An Azure scheduled scanning pipeline intended to run despite no source or pipeline-settings changes uses
always: true.
Configuring enforcement
Scanning gates are policy choices, not one universal threshold. Code-scanning merge protection selects required tools and a security-severity threshold from None through All. Dependency review supports configurable failure severities and mutually exclusive license allow or deny lists.
Choose the required tools and thresholds through the repository's risk and compliance policy, then make those results required where they should prevent merge.
Primary sources
- https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-400
- https://docs.github.com/en/code-security/concepts/secret-security/push-protection
- https://docs.github.com/en/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/resolving-alerts
- https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository
- https://docs.github.com/en/code-security/tutorials/remediate-leaked-secrets/remediating-a-leaked-secret
- https://docs.github.com/en/code-security/concepts/supply-chain-security/dependency-review
- https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-dependency-review-action?apiVersion=2022-11-28
- https://docs.github.com/en/code-security/concepts/supply-chain-security/dependabot-alerts
- https://docs.github.com/en/code-security/concepts/code-scanning/setup-types
- https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/set-merge-protection
- https://learn.microsoft.com/en-us/azure/devops/pipelines/yaml-schema/schedules-cron?view=azure-pipelines