19 docs tagged with "dependências"

Reinforced recommendations for critical contexts or environments with high maturity

Organisational policy that defines the requirements for operating automatic dependency update bots, including auto-merge criteria, impact analysis, human handoff and configuration proportional to the application's criticality level (L2, L3).

Binary verification of the application of the practices prescribed in Chapter 05

Policies for internal repositories, proxies, mirrors and provenance validation

Principles, practices and controls to guarantee secure dependency management, SBOM generation and automated software composition analysis

Generation and management of a Software Bill of Materials (SBOM) with traceability across the lifecycle

Organisational policy that defines the criteria for approving, pinning, blocking, auditing and updating external dependencies in software projects, proportional to the application's criticality level (L1, L2, L3), with a focus on reducing supply chain risk and ensuring traceability.

Practices for managing and validating external dependencies to ensure integrity, currency and security in the code

Practices for proactive updating, TTL, locking and secure version management

Specifics of exception management in the context of SCA/CVE findings

Practices for the control, approval and traceability of external libraries and third-party packages

Practical integration of the dependency management, SBOM generation and SCA execution prescriptions throughout the application lifecycle

Automated integration of SBOM, SCA and exception control into the build and release cycle

Technical and operational indicators for the assessment of the effectiveness of the controls for dependency management, SBOM generation and software composition analysis, with thresholds per risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Organisational policies that support the practical application of this chapter

Identification and mitigation of the risks inherent to the architectural decision process

Types of attack via dependencies and practices for detection and mitigation

Model linking SCA findings, SBOM, backlog and releases

Software Composition Analysis practices to detect, prioritise and mitigate known vulnerabilities