Closed kelaja closed 8 months ago
Static Application Security Testing (SAST):
Dynamic Application Security Testing (DAST)
Software Composition Analysis (SCA)
Artifacts: 1) Veracode Software Composition Analysis Backend 2) Veracode Software Composition Analysis Frontend
Container Scan conducted
Artifacts: 1) Trivy Frontend & Backend Scan Daily
Infrastructure as Code
Secret scanning
Threat Modelling Analysis results
Hi @kelaja would it be possible to already check the prepared results in my comments above? As the Threat Modelling Analysis will take some time until it is done, it would be great to already have some progress.
Thanks you very much.
@kelaja @guenterban PEN KeyCloak seems not to be working to successfully execute DAST tests. https://github.com/eclipse-tractusx/sig-infra/issues/346
Hi @kelaja / @guenterban https://github.com/eclipse-tractusx/sig-infra/issues/346 has been resolved and all results regarding security relevant scans can be found above. Thanks in advance.
@guenterban Alignment took place by telephone on 13.11.2023. As there have been no changes since release 3.2, it is not necessary to update the Threat Modelling Analysis results
Hi @ds-mwesener,
Regarding DAST, no high/critical findings reported by Invicti.
Speaking about the medium-level findings, please make sure you keep the SSL/TLS certificate updated as it has been reported to expire soon.
DAST Passed
Regards, Piotr
Hi, there are no open GitGuardian findings:
-> Secret scanning approved
Best regards Daniel
Hi All,
SCA Passed for Backend and Frontend, just please keep in mind that SAST did not pass, due to 2 high findings.
Please be also aware that we have few open medium findings.
Hello @klaudiaZF we have mitigated the SCA. Kindlya ask for an recheck?
Hi @mkanal ,
High findings in Veracode are mitigated.
Hi All,
SAST passed for backend and frontend, please keep in mind that the red color on backend screenshot is due to SCA
Keep in mind that we have few open medium findings.
Hi All, We have new high finding for SCA backend. Can someone mitigated high finding ? SCA for backend can't be passed now
HI @klaudiaZF the scans will be executed against the latest main of our code repository. As the release has been already completed is it okay for you to accept it here and create an issue on our repository to fix the high finding on our latest code base? Otherwise in my opinion it would be good to have a clear timeline how long we need to follow up on high findings regarding older releases. As this can always occur on all projects.
Thanks in advance!
Kind regards
Max
backend has container scanning findings https://github.com/eclipse-tractusx/traceability-foss/security/code-scanning kics passed
HI @scherersebastian this is a known issue. Please find explanation here: https://github.com/eclipse-tractusx/traceability-foss/issues/354 and here: https://eclipse-tractusx.github.io/docs/release/trg-4/trg-4-02/#description
@guenterban is this ok if we pass SCA based on previous scan that didn't had a high vulnerability and fix that new high finding by creating an issue on repository?
SCA passed We had done our snapshot with green light. The team has to fix it as a mainenance task.
Hello @guenterban thank you very much.
Release Security 23.12
Source in Catena-X Confluence and Expert Contacts here(Source only accessible for Catena-X Consortia members in current transition phase).
[x] Threat Modelling Analysis results Analysis completed (operations excluded):
Artifact Repository:
Prime Contacts:
[x] Static Application Security Testing (SAST)
Best Practise:
Artifact Repository:
Prime Contacts:
[x] Dynamic Application Security Testing (DAST) incl API testing (if applicable)
Best Practise:
Artifact Repository:
Prime Contacts:
[x] Secret scanning Scan executed centrally by SEC team and ZERO valid findings
Artifact Repository:
Best Practise:
Prime Contact:
[x] Software Composition Analysis (SCA) Dependencies must be scanned with Veracode tool with regards to vulnerability
Best Practise:
Artifact Repository:
Prime Contacts:
[x] Container Scan conducted All containers in GitHub Packages must be scanned
Best Practise:
Artifact Repository:
Prime Contacts:
[x] Infrastructure as Code IaC code must be scanned.
Best Practise:
Artifact Repository:
Prime Contacts: