Skip to content
This repository was archived by the owner on Jan 20, 2025. It is now read-only.

Commit 5550e40

Browse files
committed
chore: update details
1 parent bec24b1 commit 5550e40

File tree

72 files changed

+648
-627
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

72 files changed

+648
-627
lines changed
+9-8
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,28 @@
11
---
2-
sidebar_position: 6
3-
id: MFAImpersonationDefense
2+
sidebar_position: 5
3+
id: 6
44
title: Use MFA against impersonation
55
slug: /details/MFAImpersonationDefense
66
---
77

88
# Use MFA against impersonation
99

1010
## Use Case
11-
12-
- Incubating: Expected
13-
- Active: Expected
14-
- Retiring: Expected
11+
- Incubating: expected
12+
- Active: expected
13+
- Retiring: expected
1514

1615
## Description
1716

1817
Use Multi Factor Authentication (MFA) Methods that Defend Against Impersonation when Available
1918

2019
## Details
21-
22-
- C-SCRM: Y
20+
- Implementation Status: pending
21+
- C-SCRM: true
2322
- Priority Group: P1
2423
- Mitre: [CWE-290](https://cwe.mitre.org/data/definitions/290.html)
2524
- Sources: [OpenSSF Best Practices Badge Gold Level [secure_2FA]](https://www.bestpractices.dev/en/criteria/2#2.secure_2FA)
2625
- How To: [Github Docs](https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa)
26+
- Created at 2024-12-07T23:06:38.197Z
27+
- Updated at 2024-12-07T23:06:38.197Z
2728

docs/details/PRsBeforeMerge.mdx

+9-8
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,28 @@
11
---
2-
sidebar_position: 62
3-
id: PRsBeforeMerge
2+
sidebar_position: 61
3+
id: 62
44
title: Require Pull Requests Before Merging
55
slug: /details/PRsBeforeMerge
66
---
77

88
# Require Pull Requests Before Merging
99

1010
## Use Case
11-
12-
- Incubating: Recommended
13-
- Active: Recommended
14-
- Retiring: Recommended
11+
- Incubating: recommended
12+
- Active: recommended
13+
- Retiring: recommended
1514

1615
## Description
1716

1817
Require Pull Requests before Merging
1918

2019
## Details
21-
22-
- C-SCRM: Y
20+
- Implementation Status: pending
21+
- C-SCRM: true
2322
- Priority Group: R4
2423
- Mitre: [CWE-778](https://cwe.mitre.org/data/definitions/778.html)
2524
- Sources: [OpenSSF Scorecard](https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection)
2625
- How To: [Github Docs](https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches#require-pull-request-reviews-before-merging)
26+
- Created at 2024-12-07T23:06:38.197Z
27+
- Updated at 2024-12-07T23:06:38.197Z
2728

docs/details/SSHKeysRequired.mdx

+9-8
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,28 @@
11
---
2-
sidebar_position: 11
3-
id: SSHKeysRequired
2+
sidebar_position: 10
3+
id: 11
44
title: Use SSH Keys with Passphrases for Repository Access
55
slug: /details/SSHKeysRequired
66
---
77

88
# Use SSH Keys with Passphrases for Repository Access
99

1010
## Use Case
11-
12-
- Incubating: Expected
13-
- Active: Expected
14-
- Retiring: Expected
11+
- Incubating: expected
12+
- Active: expected
13+
- Retiring: expected
1514

1615
## Description
1716

1817
Use SSH keys for developer access to source code repositories and use a passphrase
1918

2019
## Details
21-
22-
- C-SCRM: Y
20+
- Implementation Status: pending
21+
- C-SCRM: true
2322
- Priority Group: P3
2423
- Mitre: [CWE-309](https://cwe.mitre.org/data/definitions/309.html)
2524
- Sources: [CNCF SSCP v1.0 #192](https://github.com/cncf/tag-security/blob/main/supply-chain-security/supply-chain-security-paper/sscsp.md#use-ssh-keys-to-provide-developers-access-to-source-code-repositories)
2625
- How To: [Github Docs](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/about-ssh)
26+
- Created at 2024-12-07T23:06:38.197Z
27+
- Updated at 2024-12-07T23:06:38.197Z
2728

+9-9
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,27 @@
11
---
2-
sidebar_position: 60
3-
id: activeAdminsSixMonths
2+
sidebar_position: 59
3+
id: 60
44
title: Require Active Admins in GitHub Org (Activity in 6 Months)
55
slug: /details/activeAdminsSixMonths
66
---
77

88
# Require Active Admins in GitHub Org (Activity in 6 Months)
99

1010
## Use Case
11-
12-
- Incubating: Recommended
13-
- Active: Recommended
14-
- Retiring: N/A
11+
- Incubating: recommended
12+
- Active: recommended
13+
- Retiring: n/a
1514

1615
## Description
1716

1817
Github Organization Admins Should Have Activity In The Last 6 Months
1918

2019
## Details
21-
22-
- C-SCRM: Y
20+
- Implementation Status: pending
21+
- C-SCRM: true
2322
- Priority Group: R3
2423
- Mitre: [M1026](https://attack.mitre.org/mitigations/M1026/)
2524
- Sources: [OpenSSF SCM Best Practices](https://best.openssf.org/SCM-BestPractices/github/member/stale_admin_found.html)
26-
- How To:
25+
- Created at 2024-12-07T23:06:38.197Z
26+
- Updated at 2024-12-07T23:06:38.197Z
2727

+9-9
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,27 @@
11
---
2-
sidebar_position: 61
3-
id: activeWritersSixMonths
2+
sidebar_position: 60
3+
id: 61
44
title: Require Active Members with Write Access (Activity in 6 Months)
55
slug: /details/activeWritersSixMonths
66
---
77

88
# Require Active Members with Write Access (Activity in 6 Months)
99

1010
## Use Case
11-
12-
- Incubating: Recommended
13-
- Active: Recommended
14-
- Retiring: N/A
11+
- Incubating: recommended
12+
- Active: recommended
13+
- Retiring: n/a
1514

1615
## Description
1716

1817
Github Organization Members with Write Permissions Should Have Activity In The Last 6 Months
1918

2019
## Details
21-
22-
- C-SCRM: Y
20+
- Implementation Status: pending
21+
- C-SCRM: true
2322
- Priority Group: R3
2423
- Mitre: [M1026](https://attack.mitre.org/mitigations/M1026/)
2524
- Sources: [OpenSSF SCM Best Practices](https://best.openssf.org/SCM-BestPractices/github/member/stale_member_found.html)
26-
- How To:
25+
- Created at 2024-12-07T23:06:38.197Z
26+
- Updated at 2024-12-07T23:06:38.197Z
2727

+9-8
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,28 @@
11
---
2-
sidebar_position: 15
3-
id: adminRepoCreationOnly
2+
sidebar_position: 14
3+
id: 15
44
title: Allow Only Admins to Create Public Repositories
55
slug: /details/adminRepoCreationOnly
66
---
77

88
# Allow Only Admins to Create Public Repositories
99

1010
## Use Case
11-
12-
- Incubating: Expected
13-
- Active: Expected
14-
- Retiring: Expected
11+
- Incubating: expected
12+
- Active: expected
13+
- Retiring: expected
1514

1615
## Description
1716

1817
Only Admins Should Be Able To Create Public Repositories
1918

2019
## Details
21-
22-
- C-SCRM: Y
20+
- Implementation Status: pending
21+
- C-SCRM: true
2322
- Priority Group: P4
2423
- Mitre: [CAPEC-122](https://capec.mitre.org/data/definitions/122.html)
2524
- Sources: [OpenSSF SCM Best Practices](https://best.openssf.org/SCM-BestPractices/github/organization/non_admins_can_create_public_repositories.html)
2625
- How To: [Github Docs](https://docs.github.com/en/organizations/managing-organization-settings/restricting-repository-creation-in-your-organization)
26+
- Created at 2024-12-07T23:06:38.197Z
27+
- Updated at 2024-12-07T23:06:38.197Z
2728

+9-10
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,26 @@
11
---
2-
sidebar_position: 53
3-
id: annualDependencyRefresh
2+
sidebar_position: 52
3+
id: 53
44
title: Refresh Dependencies with Annual Releases
55
slug: /details/annualDependencyRefresh
66
---
77

88
# Refresh Dependencies with Annual Releases
99

1010
## Use Case
11-
12-
- Incubating: Expected
13-
- Active: Expected
14-
- Retiring: N/A
11+
- Incubating: expected
12+
- Active: expected
13+
- Retiring: n/a
1514

1615
## Description
1716

1817
A new release to refresh dependencies occurs at least annually
1918

2019
## Details
21-
22-
- C-SCRM: Y
20+
- Implementation Status: pending
21+
- C-SCRM: true
2322
- Priority Group: P14
24-
- Mitre:
2523
- Sources: [OpenSSF Best Practices Badge Passing Level [maintained]](https://www.bestpractices.dev/en/criteria?details=true&rationale=true#0.maintained)
26-
- How To:
24+
- Created at 2024-12-07T23:06:38.197Z
25+
- Updated at 2024-12-07T23:06:38.197Z
2726

+9-10
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,26 @@
11
---
2-
sidebar_position: 31
3-
id: assignCVEForKnownVulns
2+
sidebar_position: 30
3+
id: 31
44
title: Assign CVEs to All Known Security Vulnerabilities
55
slug: /details/assignCVEForKnownVulns
66
---
77

88
# Assign CVEs to All Known Security Vulnerabilities
99

1010
## Use Case
11-
12-
- Incubating: Expected
13-
- Active: Expected
14-
- Retiring: Expected
11+
- Incubating: expected
12+
- Active: expected
13+
- Retiring: expected
1514

1615
## Description
1716

1817
All Known Security Vulnerabilities are Issued a CVE
1918

2019
## Details
21-
22-
- C-SCRM: Y
20+
- Implementation Status: pending
21+
- C-SCRM: true
2322
- Priority Group: P7
24-
- Mitre:
2523
- Sources: [OpenSSF Best Practices Badge Passing Level [release_notes_vulns]](https://www.bestpractices.dev/en/criteria?details=true&rationale=true#0.release_notes_vulns)
26-
- How To:
24+
- Created at 2024-12-07T23:06:38.197Z
25+
- Updated at 2024-12-07T23:06:38.197Z
2726

Original file line numberDiff line numberDiff line change
@@ -1,27 +1,27 @@
11
---
2-
sidebar_position: 50
3-
id: automateDependencyManagement
2+
sidebar_position: 49
3+
id: 50
44
title: Automate Monitoring of Outdated Dependencies
55
slug: /details/automateDependencyManagement
66
---
77

88
# Automate Monitoring of Outdated Dependencies
99

1010
## Use Case
11-
12-
- Incubating: Expected
13-
- Active: Expected
14-
- Retiring: Expected
11+
- Incubating: expected
12+
- Active: expected
13+
- Retiring: expected
1514

1615
## Description
1716

1817
Automated Process is Used to Monitor for and Maintain a List of Out of Date Dependencies
1918

2019
## Details
21-
22-
- C-SCRM: Y
20+
- Implementation Status: pending
21+
- C-SCRM: true
2322
- Priority Group: P14
24-
- Mitre:
2523
- Sources: [OWASP SCVS L1 5.7](https://scvs.owasp.org/scvs/v5-component-analysis/)
2624
- How To: [Socket.Dev](https://socket.dev/)
25+
- Created at 2024-12-07T23:06:38.197Z
26+
- Updated at 2024-12-07T23:06:38.197Z
2727

+9-8
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,28 @@
11
---
2-
sidebar_position: 22
3-
id: automateVulnDetection
2+
sidebar_position: 21
3+
id: 22
44
title: Automate Dependency Vulnerability Identification
55
slug: /details/automateVulnDetection
66
---
77

88
# Automate Dependency Vulnerability Identification
99

1010
## Use Case
11-
12-
- Incubating: Expected
13-
- Active: Expected
14-
- Retiring: Expected
11+
- Incubating: expected
12+
- Active: expected
13+
- Retiring: expected
1514

1615
## Description
1716

1817
An automated process to identify dependencies with publicly disclosed vulnerabilities
1918

2019
## Details
21-
22-
- C-SCRM: Y
20+
- Implementation Status: pending
21+
- C-SCRM: true
2322
- Priority Group: P6
2423
- Mitre: [CWE-1395](https://cwe.mitre.org/data/definitions/1395.html)
2524
- Sources: [OWASP SCVS L1 5.4](https://scvs.owasp.org/scvs/v5-component-analysis/)
2625
- How To: [Github Docs](https://docs.github.com/en/code-security/dependabot/dependabot-security-updates/configuring-dependabot-security-updates#managing-dependabot-security-updates-for-your-repositories)
26+
- Created at 2024-12-07T23:06:38.197Z
27+
- Updated at 2024-12-07T23:06:38.197Z
2728

0 commit comments

Comments
 (0)