Quick Notes143 words
Security and compliance scanning strategy — quick notes
Scanning strategy — quick notes
| Scan | Question |
|---|---|
| Dependency | Are third-party components vulnerable? |
| Code (SAST) | Does our code contain vulnerable patterns? |
| Secret | Have credentials been committed? |
| Licensing | Do dependency licences comply? |
- Push protection can stop a supported secret before the push reaches the repository; required PR scans prevent merge after changes exist on a head branch.
- Dependabot alerts can react to a new advisory without a commit and also to dependency-graph changes; use Azure
always: truewhen a schedule must run without source/settings changes. - Configure gates with the required tools and the severity/license thresholds selected by the repository's risk policy.
Primary sources
- https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-400
- https://docs.github.com/en/code-security/concepts/secret-security/push-protection
- https://docs.github.com/en/code-security/how-tos/manage-security-alerts/manage-secret-scanning-alerts/resolving-alerts
- https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/removing-sensitive-data-from-a-repository
- https://docs.github.com/en/code-security/tutorials/remediate-leaked-secrets/remediating-a-leaked-secret
- https://docs.github.com/en/code-security/concepts/supply-chain-security/dependency-review
- https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain/manage-your-dependency-security/configure-dependency-review-action?apiVersion=2022-11-28
- https://docs.github.com/en/code-security/concepts/supply-chain-security/dependabot-alerts
- https://docs.github.com/en/code-security/concepts/code-scanning/setup-types
- https://docs.github.com/en/code-security/how-tos/find-and-fix-code-vulnerabilities/manage-your-configuration/set-merge-protection
- https://learn.microsoft.com/en-us/azure/devops/pipelines/yaml-schema/schedules-cron?view=azure-pipelines