GitLab Security Essentials - Hands-On Lab: Enable and Scan Using a Scan Execution Policy

This Hands-On Guide walks you through enabling and using a Scan Execution Policy in a GitLab project.

Estimated time to complete: 15 minutes

Objectives

Compliance scans allow you to control merge requests and security scans in your instances, groups, and projects. This lab will demonstrate how to enable security and merge request policies at a group level.

Task A. Setting up a Security Policy

Navigate to your group.
In the left sidebar, select Secure > Policies.
Select New policy.
Under Security execution policy, select Select policy.
For the Name, enter Group security policy.
Ensure the Policy status is set to Enabled.
For Policy Scope, apply to all projects in this group without exceptions.
Under Actions, set the scan to run a SAST scan. Ensure that Runner Tags is set to selected automatically and Security job template is set to default.
Under Conditions, select Triggers. Have the policy run for all branches with No exceptions.
Select Configure with a merge request.
Select Merge to complete your configuration.

Task B. Security Policy Scans in Action

Navigate to your group.
Select New project.
Select Create blank project.
In the Project name field input Security Compliance Testing.
Leave all other options as default and select Create project.
In the project repository, select + > New file.
In the Filename, input main.py.
Add the following code to the file:
```
print("Testing scanners!")
```
Select Commit changes.
In the left sidebar, select Build > Pipelines.
Select the pipeline that was created from your commit.
Review the jobs in the pipeline. Notice how a SAST scan is run on this commit even though no .gitlab-ci.yml configuraiton exists.

Now, the projects in your group will always have security scans, even if they aren’t defined in the .gitlab-ci.yml file yet.

Task C. Merge Request Policies

With security scans in place, it would be ideal to be able to block merge requests that contain security vulnerabilities. In this section, you will create a merge request policy to achieve this goal.

Navigate to your group.
In the left sidebar, select Secure > Policies.
Select New policy.
Under Merge request approval policy, select Select policy.
In Name, enter the value Merge Request Security.
Under Policy status, ensure Enabled is selected.
For Policy Scope, apply the policy to all projects in this group, without exceptions.
Under Rules, set the scan type to Security Scan.
For the scanner, select All scanners.
Run the scan against all default branches.
Specify that the scan has No exceptions and finds Any vulnerabilites.
Set the severity level to All severity levels.
Set the status to New and All vulnerability states.
Under Actions, require 1 approval from the Owner role.
In Override project approval settings, make sure to uncheck the option Prevent approval by merge request’s author and Prevent approval by commit author.

We are only setting these options to off because we have one account in our group. For production environments, this is often toggled on.
Leave all other options as default and select Configure with a merge request.
Select Merge.

Task D. Merge Request Policies in Action

Return to your group.
Select your Security Compliance Testing project.
In the left sidebar, select Code > Branches.
Select New branch.
Name the branch test_policy, then select Create branch.
Select Create merge request.
Uncheck Mark as draft, then select Create merge request.
Select Code > Open in Web IDE.

Open your main.py file and add the following code to it:


in = input("Enter your server ip: ")
subprocess.run(["ping", in])

print("Attempting to connect to the server")
print("Application authentication was successful")

Select the branch icon, then select Commit and push to 'test_branch'.
Return to your MR.
Allow you pipeline to complete. Once it completes, take note of the comment stating This merge request has policy violations and errors.
To resolve these issues, select Code > Open in Web IDE.

Open your main.py file and edit your main.py code to the following:

print("Attempting to connect to the server")
print("Application authentication was successful")

Select the branch icon, then select Commit and push to 'test_branch'.
Return to your MR.
Allow your pipeline to complete. Once complete, take note of the comment stating Security policy violations have been resolved.

Last modified December 6, 2024: Merge branch 'compliance-security-labs' into 'main' (7798508a)

View page source - Edit this page - please contribute.