How GitLab's application security dashboard helps AppSec engineers
Jul 7, 2020Fernando Diaz
Summary
This post details how GitLab's security scanning capabilities (SAST, DAST, Container Scanning, Dependency Scanning, License Scanning) and the Security Dashboard aid AppSec engineers. It explains how scans populate MRs with vulnerability data, how the dashboard provides a high-level overview and drill-down capabilities for vulnerability management and auditing, and how license management can block MRs with unacceptable licenses. It also mentions integration with third-party scanners and the creation of confidential issues.
More from the Security Control Framework trail
- Track organization-wide security risk in one dashboard
- Dependency Firewall: Block risky packages before the build
- Two front doors: Module-level access in a Django GRC app
- How GitLab tracks vulnerabilities through refactors and reformatting
- Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting