GitLab GitLab Group Kickoffs - Secure: Static Analysis, 19 Jan 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: GitLab 13.9 Kickoff - Secure: Static Analysis

Description

GitLab Secure: Static Analysis Product Manager, Taylor McCaslin, provides an Overview of 13.9 release plans.

Content from the video:
- 13.9 Planning Issue: https://gitlab.com/gitlab-org/gitlab/-/issues/299140
- Static Analysis Team Development Process: https://about.gitlab.com/handbook/engineering/development/secure/static-analysis/
- Security and compliance page for Core users: https://gitlab.com/groups/gitlab-org/-/epics/4787
- Replacing SAST Analyzers with Semgrep: https://gitlab.com/gitlab-org/gitlab/-/issues/262068
- 14.0 Removals and Deprecations: https://gitlab.com/gitlab-org/gitlab/-/issues/273620#static-analysis
- Improved Vulnerability Tracking - https://gitlab.com/groups/gitlab-org/-/epics/5144

A

Hi, my name is taylor mccaslin and I'm a principal product manager at gitlab, working with our static analysis team. Today, I'm going to give you a quick update on our plans for 13.9 releasing february 22nd.

A

First, I want to point you to a new page about how the get lab static analysis, team works and prioritizes you'll find details about our process and can view workboards we use daily. You can find this link and all the other issue links we discuss in this video in the video description below moving on to product features.

A

We continue to work to make our security configuration page available to all users, making it easy to understand what gitlab security tools you have access to as well as quickly enabling them via a merge request. This builds on our previous release, making it easy for all customers to interact with security scanner artifacts within merge requests.

A

Next, one of our major focuses is to replace one of our linter sast analyzers, with semgrep a popular open source tool that has flexible rules and easy to write syntax for customizing or writing your own code detection rules. Our ambition is to greatly simplify the gitlab sas analyzers around syndra, to make it easier to maintain and add more consistent flexibility for writing rules in a consistent manner, we'll likely start with bandit our python analyzer or eslint our javascript and typescript analyzer.

A

We encourage anyone interested in simgrep to express interest on the issue as we'll be looking for beta testers. Should the adoption of simgrep be successful, we'll deprecate our old sas analyzers in a future release. However, there's no immediate change we'll also be announcing details for multiple sas variable deprecations coming in 13.10 and being removed in 14.0 later this year.

A

Finally, we're experimenting with improving the accuracy of our sassed and secret detection findings through a new vulnerability tracking method. Our vulnerability research team has a proof of concept method for improved tracking of vulnerable code as it moves locations during a project's life cycle. We'll put this new method to the test, with real world data before potentially rolling out this new tracking method in a future release.

A

Overall, that's a quick look at our 13.9 static analysis plans. I think it's going to be a great release and thanks for taking the time to watch this, video have a great one.