GitLab Enablement, 21 Jun 2023

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: Compliance pipelines and Scan execution policies | CSM/CSE Enablement

Description

CSM/CSE enablement around the following topics:

- [Docs] Compliance pipelines: https://docs.gitlab.com/ee/user/group/compliance_frameworks.html#compliance-pipelines

- [Docs] Scan execution policies: https://docs.gitlab.com/ee/user/application_security/policies/scan-execution-policies.html

A

Hi everyone today we're going to be going over an enablement on compliance pipelines and scan execution policies on the agenda, we'll be going over number one. Compliance pipelines we'll be looking at what is a compliance framework and compliance pipeline? Why do you need a compliance pipeline? How do you implement a compliance pipeline? Number two we'll look at scan execution policies. What are scan execution policies? Why do you need scan execution policies and how do you implement scan execution policies?

A

Overall, key goals and guiding principles include scalability allows organizations with large numbers of projects essentially manage and enforce when scans are run. Ease of use lowers the knowledge requirement to use gitlab scanners. Appropriate permissions limit, who can make policy changes, support auditing and approvals unified experience provides a consistent way to manage policies regardless of scanner or technology type. Flexibility allows users to work in either GUI or code based on their preferences.

A

First, we'll go over compliance Pipelines.

A

What is a compliance framework? A compliance framework is a label that identifies that a project has certain compliance requirements or needs additional oversight.

A

What is a compliance pipeline? Compliance pipelines ensure specific compliance. Related jobs are run on pipelines for all projects in the group and are applied to projects through compliance Frameworks.

A

Why developers, use compliance Pipelines, simplify compliance, gitlabs compliance pipelines enable developers to seamlessly integrate compliance checks into their development process, ensuring Regulatory and security compliance, automated audit auditing compliance pipelines, automate security and compliance tests, saving developers, time and effort, while ensuring code adheres to predefined policies and standards.

A

Policy enforcement developers enforce specific policies within pipelines guaranteeing code gold undergoes necessary compliance checks before deployment compliance pipelines, provide clear visibility into Code Compliance, generating detailed reports to identify and address issues promptly. Collaboration and governance compliance pipeline, centralized compliance management, facilitating collaboration among teams and ensuring governance throughout the development life cycle.

A

Compliance pipelines are recommended when scanned execution enforcement is required for any scanner that uses a gitlab template such as SAS IAC, dased dependency scanning license compliance API, fuzzing or coverage, guided fuzzing or scanners external to gitlab or for custom jobs other than security scans.

A

So how do you set up compliance pipelines in gitlab.

A

In this scenario, Tanuki Financial is looking to implement security, best practices and today, we'll start with the proof of concept for compliance pipelines, we'll Begin by creating a compliance pipeline project within Snooki, Financial, Security Group.

A

Within the security group, we'll click on new project create blank project and we'll name it TF compliance we'll leave the remaining options. Blank or in default, and click on create project.

A

From this point, we'll go ahead and add a compliance pipeline configuration to our newly created project we'll do that by clicking on build pipeline editor configure pipeline and in the pipeline editor we're going to D we're going to actually replace this default configuration with a generic compliance. Job.

A

We'll leave the rest of the defaults and click on Commit changes after committing the changes, we'll go ahead and take note of the URL for the actual gitlab CI yaml file, which we'll need on the next step.

A

So we'll go back to TF compliance copy the URL since the URLs is the location of the ciml file and next we'll go ahead and configure the compliance framework within Tanuki Financial, we'll click on snoogie Financial settings, General, we'll scroll down to compliance Frameworks and hit expand.

A

As you can see, there are existing Frameworks here. So this will give you an idea of how it looks whenever you're actually going through multiple Frameworks, but from here we'll actually go ahead and click on ADD framework, we'll name our framework, give it a description and using the URL we'll be able to derive the actual pipeline configuration here so we'll paste the URL after the gitlab CI yaml at but will remove the Remain the beginning portion.

A

That's that has the gitlab.com so it'd be the dot CI gitlab CI ammo at in the URL minus getlab.com as you'll see here. This actual field will allow you to debug the entry that you put in after I, complete that entry you'll see that the error is removed. So you can use that as a way to debug go ahead and select the color and we'll click on ADD framework.

A

Now we have our new TF compliance framework added, we'll, go ahead and select options and hit set default.

A

So the compliance framework is now ready and we can. We can now create projects in the group and they'll automatically run the compliance configuration within their Pipelines, so go back to Tanuki Financial.

A

So we're going to go ahead and create a new project within Tanuki Financial for a new advanced calculator, Advanced financial calculator being developed, so click on new project create blank project, we're going to name it fincalc for financial calculator, we'll leave the remaining options default and click on create project.

A

On the project page that we just created we'll see that the TF compliance framework was automatically applied.

A

Without any other pipeline configuration defend, calc project can now automatically run the jobs that are defined in the compliance pipeline. Configuration in the TF compliance project so go to build Pipelines and we'll click on run pipeline and within the Run pipeline page. We'll click run pipeline again.

A

You'll notice that the pipeline runs a job called compliance job in the test stage, so Tanuki financially has Financial has successfully run its first compliance pipeline. The fincalc application will also have its own pipeline, so we can go ahead and combine the compliance pipeline configuration with the regular pipeline configuration of this project so we'll go ahead and Define a regular pipeline configuration for fincalc and then update the compliance pipeline configuration to refer back to it we'll do that by going to build pipeline editor.

A

Configure pipeline and in this pipeline editor we're going to go ahead and replace the default configuration with a generic job.

A

We'll leave the rest as default and click on Commit changes.

A

Once again, after committing those changes, we'll actually go back to fincalc and take note of the URL for the location of the CI ammo file in question. Foreign.

A

So now we'll go ahead and combine the new project pipeline configuration with the compliance pipeline, configuration by editing, TF compliance, configuration yaml, so we'll go back to Tanuki Financial within the security group, we'll click on TF compliance we'll go to build pipeline editor and using the URL that we copied before we'll go ahead and derive an include statement that includes the URL minus the https gitlab.com portion, which includes the actual file and the project.

A

We'll leave the rest as default and click on Commit changes.

A

Now, to confirm that the regular fincalc pipeline configuration is now combined with the compliance pipeline, configuration we'll go ahead and go back to the fincalc project.

A

We'll go to build Pipelines and we'll click run pipeline again and within the Run pipeline page. We'll click on run pipeline once more.

A

Now we'll see that the pipeline runs two jobs in the test stage, the compliance job as well as the project job, so we've successfully created and configured a compliance pipeline proof of concept for Tanuki Financial to use on new and existing projects. We can also add that compliance pipeline to existing projects by following similar steps as before So within Tanuki Financial, we'll go ahead and go to one of the existing applications. The Ledger manager.

A

We'll go to settings General, we'll scroll down to compliance framework, hit, expand and we'll select the newly created compliance framework that we made earlier TF compliance framework and we'll click on Save changes, and once we go back to snooky, Financial you'll see that we have two different projects with compliance. Frameworks applied an existing project as well as a newly created project that pulled it by default.

A

Next, we'll go over scan execution policies.

A

What are policies?

A

Policies in gitlab provide security teams a way to require scans of their choice, to be run whenever project pipeline runs according to the configuration specified, gitlab supports the following security policies, scan execution policy which we'll go over here shortly, as well as scan result policy order, scan execution policies, scan execution policies, allow owners of groups subgroups or projects to enforce, scheduled or pipeline based security scans by defining the policy at the group or subgroup level. The required scans are automatically integrated into the CI pipeline as new jobs, ensuring comprehensive Security checks across multiple project Pipelines.

A

Why developers use scan execution policies, streamline compliance, allows developers to leverage scan execution policies to seamlessly integrate compliance scans into the development workflow, ensuring adherence to Regulatory and security requirements, automated audits status, scan execution policies, automate security and compliance tests, saving developers, time and effort, while ensuring code meets predefined policies and standards.

A

Policy enforcement developers enforce specific policies within pipelines, ensuring mandatory compliance checks are performed before code deployment.

A

Enhanced visibility and Reporting scan execution policies provide comprehensive visibility into Code Compliance, generating detail reports for timely issue, identification and resolution collaborative governance, scan execution policies, centralized compliance management, promoting collaboration among teams and maintaining governance throughout the development life cycle.

A

So how do we actually? How do scan execution policies work in gitlab.

A

So, let's go back to Tanuki financial and take a look at scan execution policies we'll go ahead and create one at the top level group for Tanuki Financial that automatically checks for Secrets across all branches, we'll click on secure policies and from here we'll click on new policy underneath scan execution policy, we'll click on select policy we'll go ahead and name. The policy check for secrets check for secrets across the board.

A

You'll notice that the yaml pre preview here will automatically fill in as we fill out the actual GUI we'll leave the policy status as enabled we'll select Secrets detection to run on scan running your scan on Runners that are selected automatically.

A

Underneath conditions will leave the default of triggering every time a pipeline runs for any branch using the wildcard from here, we'll go ahead and click on configure with the merge request.

A

However, please take note that the yaml preview file is automatically generated based on what's input into the actual Fields, but you can also go to yaml mode and directly edit. The yaml file here with your preference so we'll go ahead and click on configure with the merge request.

A

Within the merge request, go ahead and click on merge.

A

Going back to Tanuki Financial you'll notice that a new project was automatically created, since this was the first security policy.

A

The project is called Tanuki Financial security policy project. If we kind of Click into it here, we'll notice that there's a folder in here dot get lab security policies and within the policy yaml is the actual yaml file that was created through the GUI earlier.

A

Now, if we run a pipeline for fincalc.

A

We'll go to fincalc click on build Pipelines and we'll click on run pipeline and run pipeline again.

A

You'll notice that the secrets detection has been added, even though it was not specifically specified within the pipeline configuration of fincalc.

A

Compliance pipelines and scan execution policies are only available on gitlab Ultimate.

A

As a quick recap, we went over what is compliance Pipeline and scan execution policy? Why is compliance Pipeline and scan execution Policy important? How are compliance pipelines and scan execution policies implemented?

A