Vulnerability Management¶
Vulnerability management means finding weaknesses before an attacker does, and fixing them within an agreed time. For this platform, weaknesses come from four places: infrastructure code, dependencies, running resources, and secrets committed by mistake.
Status: partly in place
Infrastructure code is scanned in CI (checkov, tflint). Scanning of running resources depends on Defender plans, which are mostly off. Dependency and secret scanning are not yet standard across repositories.
Sources¶
| Source | Tool | Where it runs | Status |
|---|---|---|---|
| Terraform misconfiguration | checkov, tflint |
Every module and deployment pipeline, in the security stage | In place |
| Cloud misconfiguration | Defender for Cloud recommendations | Continuously, on every subscription | In place, through Foundational CSPM |
| VM and OS vulnerabilities | Defender for Servers (Microsoft Defender Vulnerability Management) | VMs and Arc servers | Not enabled. No VMs today. |
| Container images | Defender for Containers | Registries and AKS | Not enabled. No containers today. |
| Dependencies | GitLab dependency scanning, or Renovate for provider and module updates | Repository pipelines | Planned |
| Secrets in code | GitLab secret detection or gitleaks |
Repository pipelines and pre-commit | Planned. Some repositories already use gitleaks allow-list comments. |
How quickly to fix¶
| Severity | Internet-facing or Tier 0 | Everything else |
|---|---|---|
| Critical | 7 days | 14 days |
| High | 14 days | 30 days |
| Medium | 60 days | 90 days |
| Low | Next planned change | Next planned change |
If a finding can't be fixed in time, raise a time-limited policy exemption, or add it to the Exceptions Register, with a named owner.
Rules for CI scanning¶
- Don't silence findings globally. Suppress a specific check on a specific resource, with a reason in the comment. For example, the modules use
checkov:skip=CKV_TF_1with a justification for pinned internal module tags. - Block merges on new High or Critical findings once the existing backlog is clear.
- Scan pipeline templates too. A compromised
ci-templatesinclude runs in every pipeline (see Platform Service Principal Vending).