Skip to content

Commit 4734a78

Browse files
klaudiaZFscherersebastian
klaudiaZF
and
scherersebastian
authored
doc: Security TRG draft UPDATED (#681)
* Security TRG This PR brings enhancement to the existing TRG with a new addition of TRG 8.0 for Security specific topics. * Delete docs/release/trg-8 directory * Security TRG 8 This PR brings enhancement to the existing TRG with a new addition of TRG 8.0 for Security specific topics * Delete docs/release/trg-8/trg-8-07.md Removing Dependabot section because there is PR regarding it and Tomasz Barwicki is working on this * Update trg-8-00.md * Update trg-8-01.md * Delete docs/release/trg-8/trg-8-05.md After discussion about Owasp ZAP on security meeting, we decided that for now we won't add Owasp ZAP to TRG * Update trg-8-02.md * Update trg-8-03.md * Update trg-8-04.md * Update and rename trg-8-06.md to trg-8-05.md * Update trg-8-00.md * Update trg-8-01.md * Update trg-8-01.md * Update trg-8-01.md * Update trg-8-02.md * Update trg-8-04.md * Update trg-8-03.md * Update trg-8-05.md * Update trg-8-03.md * Update trg-8-00.md * Update trg-8-00.md * Update trg-8-00.md * Update trg-8-00.md * Update trg-8-00.md * Update trg-8-05.md * Update trg-8-03.md * Update trg-8-05.md * Update trg-8-03.md * Update trg-8-05.md * Update trg-8-03.md * Update trg-8-00.md * Update trg-8-01.md * Update trg-8-03.md * Update trg-8-01.md * Update trg-8-05.md * Update trg-8-05.md * docs: delete docs/release/trg-8/trg-8-00.md No value. * docs: delete docs/release/trg-8/trg-8-02.md Just overhead, no additional value * docs: create trg-8-01.md * docs: add codeql workflow description * docs: better why for codeql * docs: small textual adjustments * docs: add trg-8-03 on kics * docs: add paths ignore to codeql workflow * docs: emphasize code * docs: update codeql version * docs: fail / exit strategy for kics * docs: correct cron job * docs: correct schedule * docs: correct grammar * docs: correct grammar on comments * docs: codeql fail on error * docs: kics fail on error * docs: take care of error severity findings * docs: fix error and high severity findings * docs: kics failure condition * docs: failure condition codeql * docs: schedule kics * docs: update trg-8-01.md * docs: update trg-8-03.md * docs: update trg-8-01.md * docs: add trivy draft trg * docs: add gitguardian draft trg * Delete docs/release/trg-8/trg-8-05.md Releasing TRG 8 as draft * Delete docs/release/trg-8/trg-8-04.md Releasing TRG 8 as draft * Delete docs/release/trg-8/trg-8-03.md Releasing TRG 8 as draft * Delete docs/release/trg-8/trg-8-01.md Releasing TRG 8 as draft * Delete docs/release/trg-8/_category_.json Releasing TRG 8 as draft * adding caution Caution about passing QG * Update trg-8-05.md * Update trg-8-05.md * Caution about QG * Caution about QG * Caution about QG * grammar correction * docs: update trg-8-01.md * docs: update trg-8-03.md * docs: update trg-8-05.md * docs: update trg-8-04.md * docs: update trg-8-03.md * docs: wrong trg caution * docs: add statement about IP issues * docs: update trg-8-05.md --------- Co-authored-by: Sebastian Scherer <59142915+scherersebastian@users.noreply.github.com>
1 parent 2f5a041 commit 4734a78

File tree

4 files changed

+296
-0
lines changed

4 files changed

+296
-0
lines changed

‎docs/release/trg-0/trg-8-01.md

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
---
2+
title: TRG 8.01 - CodeQL
3+
---
4+
5+
| Status | Created | Post-History |
6+
|--------|-------------|--------------------------------------|
7+
| Draft | 01-Mar-2024 | Draft release |
8+
9+
## Why
10+
11+
Use CodeQL for deep, static code analysis to identify vulnerabilities and improve code quality across a wide range of programming languages.
12+
13+
## Description
14+
15+
Use CodeQL for all repos with classic code (e.g., C#, Java) without exception. Do not use it for documentation-only or pure IaC repos; it's intended solely for analyzing classic code vulnerabilities. Exclude files as necessary.
16+
17+
The GitHub Actions configuration must include the following triggers:
18+
19+
- `workflow_dispatch`: Manual workflow execution.
20+
- `schedule`: Schedule the workflow to run at least once a week with `0 0 * * 0`.
21+
- `push` and `pull_request`: Activate the workflow on both push and pull request events targeting the branch that contains the code for the currently supported version, which may not necessarily be the `main` branch. This is the branch from which new releases will be made.
22+
23+
Findings appear in the GitHub Advanced Security Dashboard. Dismiss high/error findings as non-exploitable or false positives with required justification in the vulnerability alert.
24+
25+
:::caution
26+
27+
Address high severity findings; it is recommended to also address medium severity findings.
28+
29+
:::
30+
31+
You can tailor the failure conditions (`fail-on`) for high severity issues in the workflow to suit your team's preferences.
32+
33+
Adjust your code's language and build settings as indicated within the workflow comments.
34+
35+
Example CodeQL workflow:
36+
37+
```yml
38+
name: "CodeQL"
39+
40+
on:
41+
push:
42+
branches: ["main"]
43+
paths-ignore:
44+
- "**/*.md"
45+
- "**/*.txt"
46+
pull_request:
47+
# The branches below must be a subset of the branches above
48+
branches: ["main"]
49+
paths-ignore:
50+
- "**/*.md"
51+
- "**/*.txt"
52+
schedule:
53+
- cron: "0 0 * * 0"
54+
workflow_dispatch:
55+
56+
jobs:
57+
analyze:
58+
name: Analyze
59+
runs-on: ubuntu-latest
60+
timeout-minutes: 360
61+
permissions:
62+
actions: read
63+
contents: read
64+
security-events: write
65+
66+
strategy:
67+
fail-fast: false
68+
matrix:
69+
language: ["java"] # Define languages here
70+
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'swift' ]
71+
# Use only 'java' to analyze code written in Java, Kotlin or both
72+
# Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
73+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
74+
75+
steps:
76+
- name: Checkout repository
77+
uses: actions/checkout@v3
78+
79+
# Initializes the CodeQL tools for scanning.
80+
- name: Initialize CodeQL
81+
uses: github/codeql-action/init@v2
82+
with:
83+
languages: ${{ matrix.language }}
84+
# If you wish to specify custom queries, you can do so here or in a config file
85+
# By default, queries listed here will override any specified in a config file
86+
# Prefix the list here with "+" to use these queries and those in the config file
87+
88+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
89+
# Use +security-extended,security-and-quality for wider security and better code quality
90+
queries: +security-extended,security-and-quality
91+
92+
# Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift)
93+
# Automates dependency installation for Python, Ruby, and JavaScript, optimizing the CodeQL analysis setup
94+
# If this step fails, then you should remove it and run the build manually (see below)
95+
- name: Autobuild
96+
uses: github/codeql-action/autobuild@v2
97+
98+
# ℹ️ Command-line programs to run using the OS shell.
99+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
100+
101+
# If the Autobuild fails above, remove it and uncomment the following three lines modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance
102+
103+
# - run: |
104+
# echo "Run, Build Application using script"
105+
# ./location_of_script_within_repo/buildscript.sh
106+
107+
- name: Perform CodeQL Analysis
108+
uses: github/codeql-action/analyze@v3
109+
with:
110+
category: "/language:${{matrix.language}}"
111+
fail-on: error
112+
```

‎docs/release/trg-0/trg-8-03.md

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
---
2+
title: TRG 8.03 - KICS
3+
---
4+
5+
| Status | Created | Post-History |
6+
|--------|-------------|--------------------------------------|
7+
| Draft | 01-Mar-2024 | Draft release |
8+
9+
## Why
10+
11+
KICS is deployed for comprehensive scanning of Infrastructure as Code (IaC) files, ensuring secure and best-practice configurations across various IaC frameworks.
12+
13+
## Description
14+
15+
KICS is essential for repositories exclusively containing Infrastructure as Code (IaC) files, such as Terraform, CloudFormation, Kubernetes, GitHub Actions, and Helm charts. It's not applicable to traditional programming languages or documentation-only repositories. Exclude non-IaC files as necessary.
16+
17+
Configure your GitHub Actions to include:
18+
19+
- `workflow_dispatch`: Manual workflow execution.
20+
- `schedule`: Schedule the workflow to run at least once a week with `0 0 * * 0`.
21+
- `push` and `pull_request`: Targets the branch that holds the IaC files intended for current deployments, which might not always be the `main` branch.
22+
23+
Findings appear in the GitHub Advanced Security Dashboard. Dismiss high/error findings as non-exploitable or false positives with required justification in the vulnerability alert.
24+
25+
:::caution
26+
27+
Address high severity findings; it is recommended to also address medium severity findings.
28+
29+
:::
30+
31+
You can tailor the failure conditions (`fail_on`) for high severity issues in the workflow to suit your team's preferences.
32+
33+
Example KICS workflow:
34+
35+
```yml
36+
name: KICS
37+
38+
on:
39+
push:
40+
branches: ["main"]
41+
paths-ignore:
42+
- "**/*.md"
43+
- "**/*.txt"
44+
pull_request:
45+
# The branches below must be a subset of the branches above
46+
branches: ["main"]
47+
paths-ignore:
48+
- "**/*.md"
49+
- "**/*.txt"
50+
schedule:
51+
- cron: "0 0 * * 0"
52+
workflow_dispatch:
53+
54+
jobs:
55+
analyze:
56+
name: Analyze
57+
runs-on: ubuntu-latest
58+
permissions:
59+
actions: read
60+
contents: read
61+
security-events: write
62+
63+
steps:
64+
- name: Checkout repo
65+
uses: actions/checkout@v3
66+
67+
- name: Run KICS Scan with SARIF result
68+
uses: checkmarx/kics-github-action@v1.7.0
69+
with:
70+
path: "." # Scanning directory .
71+
output_path: kicsResults/ # Output path for SARIF results
72+
output_formats: "sarif" # Output format
73+
# ignore_on_exit: results # Ignore the results and return exit status code 0 unless a KICS engine error happens
74+
fail_on: high # If you want your pipeline to fail only on high severity results and KICS engine execution errors
75+
# exclude_paths: "terraform/gcp/big_data.tf,terraform/azure" # Exclude paths or files from scan
76+
# exclude_queries: 0437633b-daa6-4bbc-8526-c0d2443b946e # Exclude accepted queries from the build
77+
disable_secrets: true # No secret scanning
78+
79+
- name: Upload SARIF file
80+
uses: github/codeql-action/upload-sarif@v2
81+
with:
82+
sarif_file: kicsResults/results.sarif
83+
```

‎docs/release/trg-0/trg-8-04.md

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
---
2+
title: TRG 8.04 - GitGuardian
3+
---
4+
5+
| Status | Created | Post-History |
6+
|--------|-------------|--------------------------------------|
7+
| Draft | 04-Mar-2024 | Draft release |
8+
9+
## Why
10+
11+
GitGuardian excels at detecting and preventing leaks of sensitive data in your code repositories, such as API keys, passwords, and other secrets. This can help you avoid security breaches and comply with data privacy regulations.
12+
13+
## Description
14+
15+
GitGuardian is integrated via its GitHub App, enabling automated secret scanning of our repositories. Each pull request undergoes a scan. If a potential secret is detected, the commit's author receives an immediate email notification.
16+
17+
If a secret is suspected, the pull request will be locked. Immediate action is required regarding the potential secret due to the high risk associated with exposing secrets.
18+
19+
:::caution
20+
21+
Address all findings.
22+
23+
:::
24+
25+
The email contains a _temporary **link**_, allowing the author to either **report** the detected secret or **mark it as a false positive**, streamlining the review process for software engineers.

‎docs/release/trg-0/trg-8-05.md

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
---
2+
title: TRG 8.05 - Trivy
3+
---
4+
5+
| Status | Created | Post-History |
6+
|--------|-------------|--------------------------------------|
7+
| Draft | 04-Mar-2024 | Draft release |
8+
9+
## Why
10+
11+
Trivy scans our Docker containers to accurately identify and remediate vulnerabilities in OS packages and application dependencies, ensuring our environment remains secure.
12+
13+
## Description
14+
15+
Trivy should be used if your project or repository builds containers and publishes them to Docker Hub.
16+
17+
Configure your GitHub Actions to include:
18+
19+
- `workflow_dispatch`: Manual workflow execution.
20+
- `schedule`: Schedule the workflow to run at least once a week with `0 0 * * 0`.
21+
22+
Because Trivy scans the published image on Docker Hub, running it on a `schedule` suffices, removing the necessity to execute it on every push and pull request. Optionally, the local build in the pipeline run can be scanned, using the `push` and `pull_request` triggers for these scans.
23+
24+
In the Trivy workflow, the Docker Hub image scanned must be the currently supported version, not necessarily the `latest` image.
25+
26+
If multiple Docker images, such as frontend and backend, are published from the repository, configure a scan for each image either by using the `matrix` option or by duplicating the necessary steps from the example workflow.
27+
28+
Findings appear in the GitHub Advanced Security Dashboard. Dismiss high/error findings as non-exploitable or false positives with required justification in the vulnerability alert.
29+
30+
:::caution
31+
32+
Address high severity findings; it is recommended to also address medium severity findings.
33+
34+
Due to IP considerations, base images with findings must not be updated arbitrarily, as outlined in [TRG4](https://eclipse-tractusx.github.io/docs/release/trg-4/trg-4-02).
35+
36+
:::
37+
38+
You can tailor the failure conditions (`exit-code`, `severity`) for high severity issues in the workflow to suit your team's preferences.
39+
40+
Example Trivy workflow:
41+
42+
```yml
43+
name: "Trivy"
44+
45+
on:
46+
schedule:
47+
- cron: "0 0 * * 0"
48+
workflow_dispatch:
49+
50+
51+
jobs:
52+
analyze:
53+
name: Analyze
54+
runs-on: ubuntu-latest
55+
permissions:
56+
actions: read
57+
contents: read
58+
security-events: write
59+
60+
steps:
61+
- name: Run Trivy vulnerability scanner
62+
uses: aquasecurity/trivy-action@0.18.0
63+
with:
64+
image-ref: "tractusx/<your-image>:<version>" # Pull image from Docker Hub and run Trivy vulnerability scanner
65+
format: "sarif"
66+
output: "trivy-results.sarif"
67+
exit-code: "1" # Trivy exits with code 1 if vulnerabilities are found, causing the workflow step to fail.
68+
severity: "CRITICAL,HIGH" # While vulnerabilities of all severities are reported in the SARIF output, the exit code and workflow failure are triggered only by these specified severities (CRITICAL or HIGH).
69+
hide-progress: false
70+
71+
- name: Upload Trivy scan results to GitHub Security tab
72+
uses: github/codeql-action/upload-sarif@v3
73+
if: always()
74+
with:
75+
sarif_file: "trivy-results.sarif"
76+
```

0 commit comments

Comments
 (0)