Discovery Finder Release 23.12 Security Acceptance Criteria

[kelaja]

Release Security 23.12

Source in Catena-X Confluence and Expert Contacts here(Source only accessible for Catena-X Consortia members in current transition phase).

• [x] Threat Modelling Analysis results Analysis completed (operations excluded):

  • List of risks generated or updated, rated & actions defined
  • Risks accepted or mitigation actions implemented and tested
  • no high threats acceptable

  Artifact Repository:

  • risk register (decentral on Catena-X confluence)

  Prime Contacts:

  • Security Team: SEC0

• [x] Static Application Security Testing (SAST)

  • code must be scanned weekly with Veracode tool
  • medium risks require mitigation statement
  • high and above not accepted

  Best Practise:

  • Confirm relevant repository as early as possible to SEC team to enable regular, automated scans. Evidence required for Gate approval.

  Artifact Repository:

  • Veracode UI
  • (+ GitHub Action)

  Prime Contacts:

  • Security Team: SEC1

• [x] Dynamic Application Security Testing (DAST) incl API testing (if applicable)

  • all findings assessed
  • high & very high findings mitigated
  • evidence by re-scan

  Best Practise:

  • Confirm relevant repository as early as possible to SEC team to enable regular, automated scans. Evidence required for Gate approval.

  Artifact Repository:

  • INVICTI tool

  Prime Contacts:

  • Security Team: SEC3 SEC4

• [x] Secret scanning Scan executed centrally by SEC team and ZERO valid findings

  Artifact Repository:

  • Veracode or alternative tool
  • GitHub Secret Scanning
  • GitGuardian

  Best Practise:

  • Confirm relevant repository as early as possible to SEC team to enable regular, automated scans. Evidence required for Gate approval.

  Prime Contact:

  • Security Team: SEC1

• [x] Software Composition Analysis (SCA) Dependencies must be scanned with Veracode tool with regards to vulnerability

  • high and above not accepted
  • FOSS whitelist policy has to be passed

  Best Practise:

  • Confirm relevant repository as early as possible to SEC team to enable regular, automated scans. Evidence required for Gate approval.

  Artifact Repository:

  • Veracode UI
  • (& GitHub Action)

  Prime Contacts:

  • Security Team: SEC1

• [x] Container Scan conducted All containers in GitHub Packages must be scanned

  • High / Critical findings not accepted

  Best Practise:

  • Confirm relevant repository as early as possible to SEC team to enable regular, automated scans. Evidence required for Gate approval.

  Artifact Repository:

  • Trivy
  • via nightly GitHub Action

  Prime Contacts:

  • Security Team: SEC2

• [x] Infrastructure as Code IaC code must be scanned.

  • Error findings not accepted

  Best Practise:

  • Confirm relevant repository as early as possible to SEC team to enable regular, automated scans. Evidence required for Gate approval.

  Artifact Repository:

  • KICS or alternative tool
  • via nightly GitHub Action

  Prime Contacts:

  • Security Team: SEC2

[bs-sili]

Security Team: SEC0

Threat Modelling Analysis results: risk Discovery Finder Security Assessment - Discovery Finder (Source only accessible for Catena-X Consortia members in current transition phase)

[bs-sili]

Security Team: SEC1

Secret scanning: Secret Scanning (gitleaks) is activated and available: https://github.com/eclipse-tractusx/sldt-discovery-finder/actions/workflows/gitleaks.yml

[bs-sili]

@Security Team: SEC1 Static Application Security Testing (SAST):

Please see the results here: https://analysiscenter.veracode.com/auth/index.jsp#ReviewResultsAllFlaws:47240:1739409:30762590:30732804:30748454::5382776

One medium risk which is mitigated.

[bs-sili]

Security Team: SEC1 Software Composition Analysis (SCA): Please have a look at https://analysiscenter.veracode.com/auth/index.jsp#ReviewResultsSCA:47240:1739409:30762590:30732804:30748454:::::5382776:

[bs-sili]

@Security Team: SEC3 SEC4 Dynamic Application Security Testing (DAST): Invicti scan made - the results can be seen here: https://www.netsparkercloud.com/scans/report/04af2d3bf4a54d696122b0c002e0d9d2/

[bs-sili]

@Security Team: SEC2 Container Scan conducted: currently under clarification as Trivy scan is marking some findings which cannot solved at the moment.

Update (24.11.2023) : As disscussed at the DevSecops meeting this Friday, the finding cannot be mitigated at the moment cause of license check. But as agreed the finding will not be a blocker for QG.

[klaudiaZF]

Hi All,

SCA Passed

https://analysiscenter.veracode.com/auth/index.jsp#ReviewResultsSCA:47240:1739409:30932940:30903117:30918767:::::5382776:

[PiotrStys]

Hello,

No high/critical findings reported by Invicti.

DAST Passed

Regards, Piotr

[DnlZF]

Hi, there are no open GitGuardian findings:

-> Secret scanning approved

Best regards Daniel

[bs-sili]

@kelaja @guenterban Hi together,

I had a quick check in front of the upcoming QG meeting at Monday. There still some checks open:

• Threat Modelling Analysis results
• Static Application Security Testing (SAST)
• Infrastructure as Code
• Container Scan conducted

Please have a look at that open points.

Many thanks in advance!

Best regards Simone

[guenterban]

Threat Modelling Analysis results: no changes since last released Threat Modelling Analysis results - passed

Static Application Security Testing (SAST) - no high or very high findings in Veracode Static Application Security Testing (SAST) - passed

[scherersebastian]

@Security Team: SEC2 Container Scan conducted: currently under clarification as Trivy scan is marking some findings which cannot solved at the moment.

Update (24.11.2023) : As disscussed at the DevSecops meeting this Friday, the finding cannot be mitigated at the moment cause of license check. But as agreed the finding will not be a blocker for QG.

as stated. KICS passed