TechPrufer
Get started
GitLab
GitLab logoGitLab · Feature trail

Custom Compliance Frameworks

40 posts · Apr 2019 – Sep 2026

What this trail covers

GitLab's DevSecOps platform integrates with HackerOne to streamline vulnerability management. Security researchers' findings are automatically converted into GitLab issues, enabling development teams to address them within their existing workflow. This bi-directional sync improves alignment between development and security teams, accelerates remediation, and enhances security visibility. GitLab also offers built-in security scanning tools like SAST, DAST, and dependency scanning, which can be in

All GitLab trails
  1. Prepare for the Cyber Resilience Act's 24-hour reporting deadlineThis post details how GitLab's existing security capabilities (continuous dependency scanning, operational container scanning, group-level dependency lists, vulnerability activity logs, auto-remediation, merge request approval policies, and compliance frameworks) can be used to meet the Cyber Resilience Act's (CRA) 24-hour reporting deadline for actively exploited vulnerabilities. It outlines four key questions organizations should ask to prepare for the CRA and how GitLab helps answer them. It also previews the upcoming Dependency Firewall for preventative supply chain security.
  2. GitLab compliance frameworks: Adhere to SOC 2 in minutesThis post details the implementation and usage of custom compliance frameworks in GitLab, focusing on adhering to SOC 2. It explains how to create frameworks from templates (e.g., SOC 2 JSON), apply them to groups and projects, and leverage the compliance status report for continuous monitoring. It also describes how security policies can be scoped to compliance frameworks for enforcement. The post highlights specific controls mapped to SOC 2 criteria, such as SAST, dependency scanning, secret detection, default branch protection, and approval rules.
  3. Reduce supply chain risk with SBOM-based dependency scanningIntroduces SBOM-based dependency scanning as a generally available feature, enhancing existing dependency scanning capabilities. This new approach inventories all direct and transitive dependencies, generates CycloneDX SBOMs, and matches components against the GitLab Advisory Database. Key improvements include tracing transitive dependencies, identifying reachable vulnerabilities (distinguishing from unused transitive dependencies), and continuous scanning. It also introduces security configuration profiles and scan execution policies for centralized management and enforcement of dependency scanning across projects.
  4. Automate embedded systems compliance with GitLab and CodeSonarThis post details the integration of GitLab CI/CD with CodeSonar for automating compliance workflows in embedded systems development. It describes how CodeSonar performs deep control flow and data flow analysis for C/C++ code, identifying vulnerabilities and ensuring adherence to standards like ISO 26262 and MISRA C/C++. The integration surfaces SARIF-formatted results in merge requests, feeding into GitLab Ultimate's SAST, Security Dashboard, Vulnerability Management, and Compliance Frameworks. An example workflow for ISO 26262 ASIL-D compliance is provided, showcasing automated pipeline halting on policy violations and the use of GitLab Duo AI for vulnerability explanation and remediation. Benefits include efficiency gains through early issue detection and automated evidence collection, and improved compliance maturity via continuous verification.
  5. Delivering faster and smarter scans with Advanced SASTIntroduced custom detection rules for Advanced SAST, allowing users to define pattern-based rules in TOML files to catch organization-specific issues. Implemented performance enhancements for SAST scans: multi-core scanning to leverage multiple CPU cores, diff-based scanning to scan only changed code in merge requests, and ongoing algorithmic optimizations. These improvements aim to reduce scan times by up to 50% with multi-core scanning, and significantly reduce MR scan times (e.g., under 10 minutes for large repos previously over 20 minutes) with diff-based scanning. Algorithmic optimizations cut scan times by up to 71% on large open-source codebases.
  7. How to transform compliance observation management with GitLabThis post details how the GitLab Security Team uses GitLab issues and issue boards to manage compliance observations, moving from a dedicated GRC tool to a more integrated approach. It outlines a five-stage observation lifecycle (Identification, Validation, In-progress, Remediated, Resolution) and describes the use of labels (e.g., `~workflow::identified`, `~risk::critical`, `~program::soc2`) and issue boards for organization and transparency. Automation through the `gitlab-triage` gem is highlighted for managing issue hygiene, and key metrics for measuring success are presented, including resolution efficiency, real-time risk assessment, and accountability tracking. Advanced strategies like integrating with security tools and applying predictive analytics are also discussed.
  8. Why now is the time for embedded DevSecOpsThis post introduces the concept of 'embedded DevSecOps' and advocates for its adoption in embedded systems development. It outlines the market forces driving this shift, including the rise of software-defined products, hardware virtualization enabling CI/HIL testing, and the talent war favoring modern tools. Key transformation areas discussed are automating compliance and security governance through integrated CI/CD pipelines and specialized tools, and enabling collaborative innovation via shared code visibility. It specifically mentions GitLab's On-Premises Device Cloud as a CI/CD component for orchestrating firmware tests on virtual and real hardware, and highlights an example of an EV manufacturer executing 120,000 CI/CD jobs daily with GitLab for compliance checks.
  9. How to use GitLab's Custom Compliance Frameworks in your DevSecOps environmentThis post introduces and details the creation and application of GitLab's Custom Compliance Frameworks. It explains how to define compliance requirements, create frameworks from scratch by selecting out-of-the-box controls (e.g., SAST running, Auth SSO enabled, at least two approvals), and apply them to projects. It also demonstrates how to integrate these frameworks with security policies, such as Scan Execution Policies, to enforce compliance criteria like running SAST scans. A real-world example for SOC2 compliance is provided, along with best practices for implementation.
  10. Introducing Custom Compliance Frameworks in GitLabIntroduces Custom Compliance Frameworks and 50 out-of-the-box (OOTB) controls for various compliance standards (ISO 27001, CIS Benchmark, SOC 2). Enables mapping of multiple, overlapping controls into a single framework. Automates compliance enforcement directly within CI/CD pipelines. As of GitLab 18.0, Custom Compliance Frameworks are enabled by default, and "Standards" are removed from the Compliance Center, with existing controls converted to framework labels and checks to controls. Only GitLab Ultimate customers can define requirements, map controls, and enforce frameworks.
  11. Enhance application security with GitLab + HackerOneThis post details the integration between HackerOne and GitLab, enabling automated conversion of HackerOne vulnerability reports into GitLab issues. It outlines the configuration steps, including OAuth setup and field mapping, and describes the bi-directional data syncing capabilities. The post also highlights HackerOne's bug bounty program model and GitLab's built-in security scanning tools (SAST, DAST, etc.) as complementary solutions for enhancing application security.
  12. How GitLab measures Red Team impact: The adoption rate metricThis post introduces a new metric for measuring Red Team impact: the adoption rate of recommendations. It details the process of creating GitLab issues for each recommendation, classifying them with specific labels (RTRec::* and RecOutcome::*), and tracking their lifecycle. The post highlights the use of GitLab Query Language (GLQL) to create dynamic dashboards for monitoring recommendation status and trends. It also shares lessons learned about starting with metrics early and avoiding operational silos, and outlines plans to measure threat resilience.
  13. Guide to fulfilling SOC 2 security requirements with GitLabThis post details how GitLab features can be leveraged to meet SOC 2 security requirements. It maps specific GitLab security and compliance features (Confidential Issues, Custom Roles, Security Policies, Verified Commits, Vulnerability Scanning, Audit Events, Security Dashboard) to the security, availability, process integrity, confidentiality, and privacy criteria of SOC 2. It also provides best practices for SOC 2 compliance, emphasizing automation and documentation.
  14. Tutorial: Advanced use case for GitLab Pipeline Execution PoliciesThis post introduces a practical implementation of GitLab Pipeline Execution Policies for enforcing CI/CD job adherence. It details a bash script that uses the GitLab Projects API to retrieve pipeline jobs and compare them against approved stages and jobs defined in injected YAML. The script includes logic for authentication using group access tokens and error handling for API calls. The YAML injection mechanism is demonstrated with variables for API URLs, project/pipeline IDs, and approved stages/jobs, highlighting the use of the reserved `.pipeline-policy-pre` stage. The post also touches on storing policies in a dedicated Security Policy Project for restricted access.
  15. Introducing GitLab Advanced Vulnerability TrackingThis post introduces the Advanced Vulnerability Tracking feature, which leverages contextual information from generated syntax trees to scope vulnerabilities and generates location fingerprints that are less fragile across code changes. It demonstrates a 30% improvement in effectiveness compared to traditional line-based tracking and suggests the positive effect increases over time. The study underpinning this feature will be presented at the 47th International Conference on Software Engineering.
  16. Streamline the path to CMMC Level 2 compliance with GitLabThis post details how GitLab's existing features, including role-based access control (RBAC), custom roles, audit events, session duration limits, IP address restrictions, and AWS PrivateLink, can be leveraged to meet CMMC Level 2 requirements for Access Control (3.1.1, 3.1.2, 3.1.4 - 3.1.8, 3.1.11 - 3.1.13, 3.1.15). It also highlights how immutable audit events and audit event streaming support Audit and Accountability (3.3.1, 3.3.2, 3.3.8, 3.3.9). Configuration Management (3.4.1 - 3.4.3, 3.4.5) is addressed through Infrastructure as Code features and merge request approval rules. Identification and Authentication (3.5.1 - 3.5.3) are supported by SAML SSO, SCIM, and multi-factor authentication. Risk Assessment (3.11.2 - 3.11.3) is covered by SAST, IaC scanning, DAST, Container Scanning, Dependency Scanning, Vulnerability Reports, and GitLab Duo's Vulnerability Explanation, with an integration of Amazon Q for code scanning. System and Information Integrity (3.14.1) is supported by scan execution policies and linking vulnerabilities to issues.
  17. 3 signs your team is ready to uplevel security controls in GitLabThis post introduces three signs that indicate a team is ready to uplevel their security controls in GitLab: the need for advanced access controls due to manual permission management becoming tedious and error-prone, the emergence of security reviews as development bottlenecks, and the difficulty in definitively tracking who changed what and when, leading to compliance adherence challenges. It highlights how GitLab Premium features like organizational hierarchies, Protected Branches, Multiple Approvers, push rules, and Audit Events can address these growing pains by automating permission management, enhancing review processes, and strengthening compliance tracking.
  18. Transform code quality and compliance with automated processesThis post details how enhanced code review processes, integrated security testing, and advanced compliance controls contribute to faster release times and improved code quality. Features like Multiple Approvers for Merge Requests, Code Quality checks, and Protected Branches are highlighted as key enablers for faster, more secure development. The post also emphasizes the importance of audit logs and access controls for accountability.
  19. New CIS GitLab Benchmark scanner boosts security and complianceThis post introduces the open-source `gitlabcis` scanner, a Python CLI tool that audits GitLab projects against the CIS GitLab Benchmark. It details the installation process using pip, command-line usage with options for output format and file location, and explains the scanner's architecture, including how recommendations are implemented as code in YAML and dedicated functions for each control. It highlights current limitations, such as project-level scanning only, and outlines the roadmap for instance/group scanning and integration into the GitLab product's Compliance Adherence Report. It also mentions two product features contributed back: showing crosslinked/related issues in merge requests via API and restricting group access by domain.
  20. GitLab moves from compliance pipelines to security policiesThis post announces the deprecation of GitLab's compliance pipelines and the introduction of pipeline execution policies. It details the rationale behind this change, emphasizing the distinction between compliance management (visibility) and policy management (enforcement). A timeline for deprecation and removal is provided, along with a step-by-step guide for migrating existing compliance pipelines to the new policy type. The post also explains the 'override' and 'inject' modes for pipeline execution policies.
  21. How to choose the right security scanning approachThis post details how to integrate security scanning into CI/CD pipelines using pipeline includes (templates and components) and introduces compliance frameworks as a mechanism for enforcement. It contrasts the ease of use, customization, and enforcement capabilities of project pipelines with includes versus compliance frameworks. The post explains how to use templates and components for security scanning, including examples of modifying container scanning behavior and pinning component versions. It highlights that while includes are easy for developers, they lack enforcement for security teams, leading to the need for compliance frameworks for regulated industries.
  22. FinServ: How to implement GitLab's separation of duties featuresThis post details how to implement separation of duties (SoD) in GitLab for financial services by leveraging merge request approval policies, protected features (branches, tags, environments, packages), user permissions (roles and custom roles), and compliance frameworks. It emphasizes the importance of SoD for risk mitigation, accountability, and regulatory compliance. Specific configurations like 'prevent approval by author', 'prevent approvals by users who add commits', and 'require user password to approve' are highlighted. The post also discusses the role of audit events and the Compliance Center for monitoring and auditing these implementations.
  23. How GitLab supports the FedRAMP authorization journeyThis post details how GitLab can support organizations in their FedRAMP authorization journey. It outlines the key steps of the FedRAMP certification process, highlights GitLab's role in supporting FedRAMP requirements, and provides best practices for configuration and compliance. Specific GitLab features discussed include security scanning tools (container, dependency, SAST, IaC, secret detection, DAST, API fuzzing, coverage-guided fuzzing), access control and authentication configurations, audit event streaming to SIEM solutions, incident response tools, configuration management via CI/CD and MRs, FIPS compliance support, and a NIST 800-53 R5 security and privacy controls management project template. It also touches upon the importance of using FedRAMP-authorized identity providers.
  24. Migration guide: GitHub Advanced Security to GitLab UltimateThis post provides a technical guide for migrating from GitHub Advanced Security to GitLab Ultimate. It details the feature-by-feature comparison, focusing on SAST, secret scanning, and dependency scanning. It includes specific `.gitlab-ci.yml` configurations for enabling SAST and Secret Detection in GitLab, along with explanations of how to customize SAST scanners and rulesets. It also covers migrating repositories using GitLab's built-in importer and discusses the broader security capabilities of GitLab Ultimate, such as DAST and granular security guardrails.
  25. Integrate external security scanners into your DevSecOps workflowThis post details how to integrate external security scanners (specifically Snyk) into GitLab's DevSecOps workflow. It provides concrete examples of modifying `.gitlab-ci.yml` to run Snyk scans, outputting results to JSON or SARIF formats, and using a Python script or a SARIF converter to transform these results into GitLab's expected artifact format (`gl-dependency-scanning-report.json` or `sast: snyk.json`). This enables the display of external scanner findings directly within GitLab's merge request widgets and vulnerability reports, enhancing the shift-left security posture.
  26. Building GitLab with GitLab: Expanding our security certification portfolioThis post details how GitLab's Security Compliance team used Agile planning features (Epics, issues, labels, recurring issues, issue boards) and security features (Merge request approval settings, Protected branch settings, Code owners, SAST/DAST, Audit events) to achieve TISAX and SOC 2 Type 2 certifications. It highlights the practical application of these features for compliance audits and demonstrates how the GitLab DevSecOps Platform can be used to scale compliance efforts.
  27. How to integrate custom security scanners into GitLabThis post details how to integrate custom security scanners into GitLab. It explains how custom scanners can populate the merge request security widget, Pipeline Security section, Vulnerability Report, vulnerability pages, Security dashboard, and Scan Result Policies. It provides a tutorial on creating a custom scanner (Fern Pattern Scanner) and integrating it by emitting a JSON report following the Secret Detection schema, containerizing it, and providing a template for CI/CD integration. It also outlines the requirements for a custom scanner to be fully integrated with GitLab.
  28. How GitLab supports NSA and CISA CI/CD security guidanceThis post details how GitLab's features align with the NSA and CISA's CI/CD security guidance. It maps specific GitLab capabilities to recommendations for authentication (TLS, SAML SSO, SCIM, 2FA), access control (RBAC, roles), code signing (SSH, GPG, x.509 certificates, push rules), two-person rules (MR approvals, code owners), least privilege (RBAC), secret management (secret detection, automatic responses), and integrating security scanning (SAST, DAST, container scanning, dependency scanning, license compliance).
  29. How to export vulnerability reports to HTML/PDF and JiraThis post provides scripts and instructions for exporting GitLab vulnerability reports to HTML/PDF and Jira. It details how to fork and configure a project with CI/CD variables to query the GitLab API (GraphQL) and generate reports or create Jira tickets. The scripts are provided for educational purposes and are not officially supported by GitLab.
  30. How GitLab can support your ISO 27001 compliance journeyThis post details how GitLab's existing features can be leveraged to support ISO 27001 compliance. It maps specific ISO 27001 controls to GitLab functionalities such as user roles, SAML SSO, SCIM, planning tools (epics, issues, tasks), description templates, checklists, labels, scoped labels, issue boards, infrastructure-as-code scanning, compliance frameworks, compliance pipelines, Compliance Center, audit events, audit event streaming, SAST, DAST, code quality scanning, container scanning, dependency scanning, secret detection, and policies. The post emphasizes the integration of these features into the DevSecOps lifecycle for enhanced security and compliance.
  31. Meet regulatory standards with GitLab security and complianceThis post details how to meet regulatory standards with GitLab compliance and security policy management. It covers common IT compliance standards (HIPAA, GDPR, NIST SSDF, PCI DSS, ISO 27000), global and regional regulations (SOX, PIPEDA, PDPA, APPI, LGPD, FISMA, POPI Act, NDPR, DIFC Data Protection Law, PDPA, Privacy Act, KVKK), and industry-specific standards (PCI DSS, ISO 27001, GAMP 5). It explains the importance of continuous compliance, regulatory compliance vs. self-imposed standards, and compliance management with GitLab, including compliance frameworks and pipelines, security policy management (scan execution policies, scan result policies, license approval policies), and audit management (preparing for audits, using audit logs effectively, audit events streaming).
  32. Security features now free with expanded Registration ProgramThis post announces the expansion of the Registration Features Program for self-managed GitLab Enterprise Edition users. Five new features are now available for free upon registration and sending Service Ping data: Password complexity requirements, Track description changes in issues, Configurable issue boards, Coverage-guided fuzz testing, and Maintenance Mode. These join previously available features: Email from GitLab, Repository size limit, and Restrict access by IP address.
  33. Getting started with GitLab application securityThis post introduces the integration of various security scanning tools (SAST, Secret Detection, Container Scanning, IaC Scanning, Dependency Scanning, DAST, Coverage-guided fuzz testing, Web API fuzz testing) into GitLab CI/CD pipelines. It details how to add scan templates to `.gitlab-ci.yml` files, enabling users to perform security scans with different license tiers. The post specifically demonstrates enabling dependency scanning via the UI and viewing scan results in merge requests and the vulnerability report.
  34. The feature you wanted - Expanded Guest capabilities in GitLab UltimateThis post introduces the initial implementation of customizable roles, starting with the ability to grant the 'view code' permission to Guest users. This is achieved by creating a custom role based on the existing 'Guest' role and assigning it to users. The technical implementation involves backend changes to support custom role creation and usage, with a focus on scalability and performance. The MVC allows Ultimate tier customers to create a 'Guest+1' role by adding the 'view code' permission to the Guest role, which can then be assigned via API. This functionality is available on both GitLab.com and Self-Managed instances, regardless of project visibility.
  35. Achieve SLSA Level 2 compliance with GitLabThis post introduces GitLab's support for SLSA Levels 1 and 2 by enabling the generation of artifact metadata directly from the GitLab Runner. By setting `RUNNER_GENERATE_ARTIFACTS_METADATA: true` in `.gitlab-ci.yml`, users can produce a `data.txt` file and an accompanying `.json` metadata file that details the build process, including input parameters, SHA hashes of the file and repository, and provenance information. This allows for the verification of artifact origin and integrity. Future plans include integrating code signing and enhancing upstream dependency validation for higher SLSA levels.
  36. Meet the demand for SBOMs with GitLab and RezilionThis post details the integration of GitLab's dependency scanning and vulnerability management capabilities with Rezilion. It explains how to implement security scanners (SAST, DAST, IaC, Container, Dependency, Fuzzing, Secret Detection) via CI/CD templates, manage vulnerabilities in the MR view and vulnerability report, and generate SBOMs using GitLab's Dependency List and Rezilion's dynamic SBOM. The integration with Rezilion specifically focuses on identifying and triaging only exploitable vulnerabilities, marking unexploitable ones as false positives.
  37. Introducing the infrastructure bill of materialsIntroduces the concept of an Infrastructure Bill of Materials (IBoM) to extend software supply chain security to cloud infrastructure. Details the partnership with Firefly to discover cloud assets, generate IaC, and integrate infrastructure management into the DevOps workflow via GitOps, including drift detection and automated merge requests for infrastructure changes.
  38. What you need to know about DevOps auditsThis post explains how DevOps processes, through automation and traceability of commits and merge requests, inherently support auditability. It highlights the importance of signed commits, regular code reviews with multiple signoffs, and comprehensive logging tools as key components for demonstrating compliance. It also notes that developers are not auditors and operations professionals may face information overload.
  39. Top 5 compliance features to leverage in GitLabThis post outlines five key compliance features within GitLab: Multi-Factor Authentication (MFA), privileged access review, protected branches, merge request approval settings, and audit events. It details how each feature contributes to security and compliance, providing links to relevant documentation and compliance standards. For MFA, it emphasizes enforcement and provides illustrative controls. For privileged access, it breaks down the access security structure (roles) and offers best practices for restricting access and deprovisioning. Protected branches are explained with best practices for securing default branches and monitoring changes. Merge request approvals are detailed with various settings to enforce segregation of duties and prevent unauthorized merges. Finally, audit events are highlighted as a monitoring control for changes to protected branch settings.
  40. Managing risk with GitLab's plan of actions & milestonesThis post details how GitLab can be used to manage the Plan of Actions and Milestones (POA&M) process for risk management, particularly in the context of NIST RMF. It explains how GitLab's security scanners identify vulnerabilities, how Vulnerability Reports can be used for triage and management, and how vulnerabilities can be converted into GitLab Issues for tracking remediation with due dates and milestones. It also highlights the use of Epics, Labels, and Issue Boards for managing these work items and the benefits of having a single system for continuous monitoring and mitigation.
  41. GitLab's Commitment to Enhanced AppSec in Modern DevOpsThis post details enhancements to GitLab's application security features in GitLab 15, building upon the existing Custom Compliance Frameworks. New features include a global rule registry for policy customization, a browser-based DAST scanner for modern APIs and SPAs, expanded Semgrep support for SAST, and new vulnerability management capabilities. It also highlights the migration of SAST, Container Scanning, and Secret Detection to the Free tier. For Ultimate users, it introduces DAST, Operational Container Scanning, Dependency Scanning, IaC Scanning, Coverage-Guided Fuzzing, and Web-API Fuzzing. Enhancements to the developer lifecycle include a security widget in merge requests and the ability to create confidential issues for collaboration. The security team benefits from improved Vulnerability Reports, Security Dashboards, and the enforcement of separation of duties via Compliance Frameworks and Security Policies.
  42. GitLab Heroes Unmasked: How I am elevating my company using GitLabThis post details the migration of a bespoke helpdesk platform to GitLab for issue tracking, including custom migration tools, API usage for data transfer (groups, issues, notes, attachments, time logs, labels), and the implementation of a workflow process using scoped labels and issue boards. It also leverages GitLab Triage RubyGem and Triage Ops for automation. Additionally, it describes the development of a Customer Relations Management (CRM) feature, reporting using Google Data Studio, and the migration to Linux/Docker for CI/CD pipelines with custom images for .NET and Android/Gradle builds. The post also covers using GitLab Pages with Hugo for an internal intranet and the challenges of instance-level functionality.
  43. One DevOps platform can help you achieve DevSecOpsThis post details how GitLab integrates Application Security Testing (AST) into the CI pipeline, providing developers with immediate feedback on security flaws upon committing code. It highlights the use of SAST, DAST, dependency scanning, and container scanning within the CI process, and introduces just-in-time education for vulnerabilities and fixes through partnerships with Kontra and Secure Code Warrior. The post also reiterates the focus on shifting compliance left and embedding it deep into the software development lifecycle, enabling organizations to create and enforce policies throughout the application development workflow.
  44. How to ensure separation of duties and enforce compliance with GitLabThis post details the implementation of three new policy types for enforcing security and compliance: Scan Execution Policies (requiring specific scans like SAST), Merge Request Approval Policies (acting on scan results to require approvals), and Pipeline Execution Policies (enforcing CI/CD jobs). It also introduces Audit Events for tracking actions and the Standards Adherence report within the Compliance Center for an overview of merge request activity.
  45. Comply with NIST's secure software supply chain framework with GitLabThis post details how GitLab addresses the specific practices within the NIST SSDF: Prepare the organization (policy management, role-based permissions, security dashboards, zero-trust), Protect software (SCM, commit signatures, code reviews, hardened containers, MR approvals, SBOM, offline scanning), Produce well-secured software (credential management, vulnerability reports, integrated security scanning, continuous compliance enforcement), and Respond to vulnerabilities (CVE updates, vulnerability disclosure, Auto DevOps, vulnerability reports, integrated learning tools, on-demand scanning).
  46. GitLab strengthens supply chain with compliance featuresThis post introduces new capabilities for securing the software supply chain and enhancing compliance. New features include Infrastructure as Code (IaC) scanning for configuration files (YAML, Kubernetes, CloudFormation, Terraform), improved container scanning using Trivy, and API security testing with fuzzing technology and a beta DAST scanner. Future plans include production container scanning, general availability of the DAST API scanner, and API Discovery. For security governance, continuous compliance is enhanced with automated enforcement of scans and controls, and a policy editor for fine-grained risk management. Future plans include compliance checks in merge requests and group-level governance. The benefits of a single DevOps platform are highlighted with unified vulnerability management and reporting, and the adoption of Semgrep as a proprietary SAST scanner. Future plans include securing the full software supply chain, inline security training, and intelligent code security.
  47. Three things you might not know about GitLab securityThis post introduces the use of the GraphQL API for vulnerability management, including creating vulnerability records directly on projects. It also details the use of security approvals in merge requests as a mechanism to prevent new vulnerabilities from being merged, and elaborates on compliance pipelines and frameworks for enforcing security hygiene.
  48. How a new integration helps GitLab customers secure their codeThis post introduces the integration of GrammaTech's CodeSonar SAST solution with GitLab Ultimate. It details how CodeSonar scans code for defects within CI/CD pipelines, providing native SAST capabilities. The integration allows for continuous code assessment, with vulnerabilities displayed directly in the GitLab UI, including vulnerability reports and detailed warning views. Prerequisites for using the integration are also outlined.
  49. How to secure your container images with GitLab and GrypeThis post introduces the integration of Grype, an advanced vulnerability scanner, into GitLab's Container Scanning feature. It details how to configure Grype via a CI/CD template snippet, explains the importance of container image security, and highlights Grype's ability to provide detailed vulnerability analysis, including the exact image layer and file path where a package is installed, the source of vulnerability data, and available patches. It also notes the deprecation of Grype support in favor of Trivy in future GitLab versions.
  50. Are you ready for the newest era of DevSecOps?This post discusses the evolution of DevSecOps and the importance of a platform-driven approach with embedded security. It highlights how GitLab simplifies DevSecOps by integrating security capabilities into a single platform, enabling developers to find and fix vulnerabilities earlier in their workflow. It also mentions customer testimonials and upcoming presentations at GitLab Commit, focusing on vulnerability management and securing IaC.
  51. GitLab is setting the standard for DevSecOpsThis post details GitLab's evolution in DevSecOps, emphasizing the integration of security testing within the CI pipeline, unified tools for security and CI, and improved remediation workflows. It highlights new features like compliant pipeline configurations, Security Alert Dashboard, bulk vulnerability status updates, Admin Mode, Semgrep for custom detection rules, custom certificates, email alerts for key expirations, SAML enforcement for Git activity, on-demand DAST, and a new browser-based crawler for DAST. It also mentions the acquisition of Peach Tech and Fuzzit, and the addition of ML technology for scanning. Professional Services for security training, migration, and advisory services are also noted.
  52. Bug found and resolved in Dependency ScanningThis post details a bug in the Dependency Scanning analyzer (gemnasium) where the vulnerability database was not updating itself at scan time, leading to outdated scan results. The bug affected versions between v2.8.1 and v2.28.0 for gemnasium, v2.11.0 to v2.17.2 for gemnasium-python, and v2.13.0 to v2.20.3 for gemnasium-maven. Updates are available for each analyzer type.
  53. Secure Composition Analysis 14.0 deprecations and removalsThis post announces the removal of the License-Management CI template in version 14.0 and the deprecation of `DS_DEFAULT_ANALYZERS` in favor of `DS_EXCLUDED_ANALYZERS` for Dependency Scanning, requiring users to update their CI/CD configurations.
  54. Why (Continuous) FuzzingThis post details the challenges and solutions for integrating continuous fuzzing into CI/CD pipelines. It addresses the long-running nature of fuzzing jobs by proposing asynchronous execution on platforms like GitLab, the need to strategically select versions to fuzz (master + stable branches), and the implementation of regression fuzz tests for MRs using aggregated test cases. It highlights GitLab's role in managing corpora, reporting vulnerabilities to the Security Dashboard, and failing CI for MRs with new bugs.
  55. DevSecOps basics: 5 steps to standardize (and then scale) securityThis post outlines five steps to standardize security in DevOps: Educate (provide training), Coordinate (define requirements in pipelines), Authenticate (monitor access controls), Integrate (embed scan/test tools), and Automate (use automation for scale and consistency). It also stresses the importance of continuous re-evaluation of security programs.
  56. Automated security testing for DevSecOpsThis post introduces the concept of automating security testing within the DevSecOps lifecycle. It highlights the need for security automation due to the increasing frequency of cyber-attacks and the use of automation by attackers. It outlines four key ways to automate security in software development: running SAST scans for every code change, initiating work tickets or stopping builds based on scan results, applying policies automatically upon code commit, and using DAST scans for running web applications. It also discusses the benefits of automated security testing, such as reduced human error, early security intervention, streamlined vulnerability triage, repeatable security checks, and clarified responsibility. The post differentiates between security automation and orchestration and lists common security automation tools like SIEM, SOAR, and XDR. It emphasizes the symbiotic relationship between security automation and human analysts.
  57. How to build a compliance program with easeThis post details how GitLab can be used to build a compliance program by leveraging granular user roles and permissions for segregation of duties, integrating application security testing into pipelines, defining custom projects for compliance frameworks (e.g., HIPAA, SOX), utilizing audit events for traceability of user actions, and consolidating compliance signals in a compliance dashboard. It highlights the administrative overhead of traditional compliance programs and positions GitLab as a single application to automate these processes.
  58. How we manage open source security softwareThis post discusses GitLab's approach to managing open source security software, focusing on the "supply chain" of external packages used within the GitLab product. It highlights the importance of dedicated security personnel for analyzing internal and external code flaws, managing bug submissions, and proactively identifying vulnerabilities in open source dependencies. The article emphasizes GitLab's transparent and open-core model as a benefit for security disclosure and discusses the role of DevSecOps in rapid development with a security focus. Key takeaways for improving open source security include having dedicated, empowered security staff, strong upper management buy-in, fostering a culture that avoids shame and punishment for security issues, and making security a "muscle memory" practice.
  59. Why implementing security as code is important for DevSecOpsThis post introduces the concept of 'security as code' as a key practice for DevSecOps. It defines security as code as integrating security policies, tests, and scans into DevOps tools and workflows. It highlights six capabilities to prioritize: automating security scans and tests within the pipeline, building a continuous feedback loop, evaluating and monitoring automated security policies, automating complex manual tests, testing new code in staging environments, and creating logs for review dashboards. It positions security as code as a best practice for the larger goal of integrating security throughout the SDLC.
  60. Make tracking agreements simple with our new Compliance DashboardIntroduces the Compliance Dashboard as a new feature in GitLab 12.8. The initial iteration provides an aggregate view of approved merge requests across projects and groups, showing title, approver, and approval time. It also allows for visualization and export of data for audit trails and compliance reporting. Future iterations are planned to include merge request approval settings, security scanning data with each deploy, specific test results with each deploy, pipeline results, and an overview of compliance policies.
  61. How to ensure security at the speed of DevOpsThis post outlines six strategies to integrate security into the DevOps lifecycle, emphasizing small, frequent changes, developer education, failing fast, prioritizing risks based on severity and likelihood of exploitation, automating security processes, and continuous testing. It advocates for a security-first mindset and the use of integrated tools like GitLab to achieve this.
  62. 5 Security testing principles every developer should knowThis post outlines five principles for integrating security testing into the development lifecycle: evangelizing security efforts, testing early and often (mentioning SAST, DAST, and dependency scanning), verifying changes with code reviews (requiring approvers in merge requests), maintaining a log of deployments and dependencies, and diversifying security testing portfolios (mentioning SCA, SAST, and bug bounty programs). It emphasizes the shift towards a DevSecOps model where developers are responsible for security.
  63. Don’t let your dependency-laden software become the next monolithThis post discusses the risks associated with accumulating software dependencies, drawing parallels to monolithic architectures. It highlights the 'LeftPad incident' as an example of dependency-related catastrophe. The post introduces dependency scanning as a tool for identifying vulnerabilities and redundancies, and auto-remediation tools for automatically fixing identified issues. It advocates for intentional dependency management to reduce complexity and attack surface.
  64. 4 Ways developers can write secure code with GitLabThis post details the integration of several security testing tools within GitLab's CI/CD pipelines: Static Application Security Testing (SAST) for source code analysis, Secret Detection for unintentional credential pushes, Dynamic Application Security Testing (DAST) for runtime web application vulnerabilities, Dependency Scanning for external library vulnerabilities, Container Scanning for Docker image vulnerabilities, License Management for policy compliance, and Code Quality analysis. It also highlights the Project and Group Security Dashboards for vulnerability overview and management, and mentions upcoming features like Interactive Application Security Testing (IAST) and Fuzzing.
  65. Why building compliance as code in DevOps will benefit your entire companyThis post introduces the concept of 'compliance as code' and its benefits for integrating compliance into the DevOps lifecycle. It outlines how to implement compliance as code through peer reviews, static application security testing, subject matter expert reviews for high-risk code, and regulated access controls. It also discusses the importance of culture alignment and the need for FOSS compliance programs. The post briefly touches on GitLab's own formalized compliance program, choosing an aggregate route leveraging Adobe's CCF.
  66. Python 3 becomes default for license compliance scanningThis post announces that Python 3 will become the default version for the Secure stage License Compliance feature in GitLab 12.2. For self-managed users still using Python 2, a CI variable `LM_PYTHON_VERSION` needs to be set to "2". For GitLab.com users, this change will occur at the beginning of August. The post also clarifies that License Compliance, formerly License Management, tracks third-party component licenses and checks compatibility with organizational licensing models.
  67. Adobe CCF becomes GitLab's open source control frameworkThis post details the implementation and adaptation of the Adobe open source compliance framework (CCF) to create the GitLab Control Framework (GCF). It describes converting the CCF controls PDF to CSV, making control statements specific to GitLab's needs while maintaining mapping to underlying regulatory requirements (e.g., PCI DSS). It introduces a prefix-based numbering system for controls (e.g., AM.1.01) and prioritizes controls relevant to SOC2 certification, resulting in 63 prioritized controls. For each control, additional content is built out, including Control Statement, Context, Scope, Ownership, Implementation Guidance, Reference Links, Examples of evidence, and Framework Mapping. The last steps involved identifying responsible teams (RACI) and performing a gap analysis. A public repo with the adapted CSV and a view-only Google Sheet are provided to aid adoption. Future plans include scripts to turn controls into GitLab issues and CSV-to-JSON tools.
  68. Forrester names GitLab challenger in software compositionThis post details GitLab's entry into the Software Composition Analysis (SCA) market, highlighting its integrated approach to application security testing within the CI/CD pipeline. It discusses the inclusion of security capabilities in December 2017, the requirements for participating in the Forrester Wave™: Software Composition Analysis, Q2 2019, and GitLab's positioning as a new challenger. Key differentiators identified by Forrester include remediation advice, policy management, and reporting. The post also outlines updates since the evaluation, such as improvements to the security dashboard, SAST scanning for additional languages, and secrets detection, and emphasizes GitLab's strategy of focusing equally on developers and security professionals. It highlights the ability to create merge requests for vulnerability remediation with one click and the potential for automated remediation in future releases. The post also touches on the use of review apps for dynamic scanning and performance testing.