Security gates and findings management in the pipeline
You gather scanner results in one place, deduplicate findings, write rules for which findings stop a release and manage exceptions with expiry dates and approvals.
Level 301 · 15 lessons · 12 practice labs
Lessons
Gate design
- What a security gate is: warn, block, report
- Severity thresholds and the new-findings rule
- A gate developers can live with: speed and clarity
- Short task: write gate policies for three kinds of project
Collecting findings
- Merging results with SARIF
- Importing into a findings server: product, version, test
- Deduplication: seeing one finding once
- A finding’s life: open, verified, fixed, accepted
- Short task: merge four tools’ results into one product
Exceptions and tracking
- Risk acceptance: who approves and for how long
- Fix deadlines and overdue alerts
- Linking findings to the issue tracker
- Short task: re-assess an expiring exception
Measuring
- Metrics: blocked releases, time to fix, false alarm rate
- Capstone: set up gates and findings management for a product family
Practice labs
- Match gate types to sample situations: Choose warn, block or report for six situations.
- Write gate policies for three kinds of project: Set the severity threshold and new-findings rule for internet-facing, internal and experimental projects.
- Design by measurement a gate developers can live with: Measure the gate’s duration and false-block rate, move the slow check to a nightly run and rewrite the block message with the fix step.
- Import one scan result into the findings server: Create a product and version, upload the SARIF file and verify the finding count.
- Merge four tools’ results into one product: Import SAST, SCA, DAST and image scan results as separate tests and produce the product-level view.
- Tune deduplication and follow a finding’s lifecycle: Stop one flaw arriving twice from two tools with the deduplication setting and take a finding through open, verified and fixed.
- Open a risk acceptance record for a finding: Fill in the justification, approver and expiry date fields.
- Define fix deadlines and list the overdue findings: Set deadlines by severity, filter overdue findings and link them to the issue tracker.
- Re-assess an expiring exception: Test whether the exception’s justification still holds against the new scan and code state, renew or close it and record the decision.
- Extract the number of blocked releases and why: Count from a month of pipeline logs the releases the gate stopped and the finding type that triggered each.
- Calculate time to fix and the false alarm rate: Derive mean time to fix and the share closed as false alarms from the findings server data.
- Set up gates and findings management for a product family: Set up policy, import, deduplication, exceptions and a metrics board for three products and show a release stops at the gate and passes after a fix.
About this course
You gather scanner results in one place, deduplicate findings, write rules for which findings stop a release and manage exceptions with expiry dates and approvals.
What you will learn
- Gate design
- Collecting findings
- Exceptions and tracking
- Measuring
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.