Category Direction - Security Policy Management

Security Policies

Security policies allow users to use a single, simple UI to define rules and actions that are then enforced. Two types of policies are currently supported: scan execution policies and scan result policies. Security policies themselves are fully audited and can be configured to go through a two-step approval process before any changes are made. All policies are supported at the group, sub-group, and project levels.

Scan Execution Policies allow users to require vulnerability scans to be run, either on a specified schedule or as part of a pipeline job. Currently we support requiring the execution of SAST, Secret Detection, Container Scanning, Dependency Scanning, and DAST scans. We do not plan on adding support for License Compliance as its functionality is planned to be merged into Dependency Scanning (now supported for SaaS behind feature flag). We do intend to add support for Fuzzing; however, this is not on our near-term roadmap.

Scan Result Policies allow users to enforce approval on a merge request when policy conditions are violated. Currently criteria related to both security and license scanners are supported. For example, users can require approval on merge requests that introduce newly-detected, critical vulnerabilities into their application.

Learn more

Security Approvals

Security approvals allow users to select the conditions that must be met to trigger the security approval rule, including which branches, scanners, vulnerability count, and vulnerability severity levels must be present in the MR. If all conditions are met, then the merge request is blocked unless an eligible user approves the MR. This extra layer of oversight can serve as an enforcement mechanism as part of a strong security compliance program.

Security approvals are a type of Scan Result Security Policy and can be configured in the Security & Compliance > Policies page.

Learn more

License Approvals

License approvals allow users to select the conditions that must be met to trigger the license approval rule, including which licenses are expressly allowed or prohibited from being present in the MR. If all conditions are met, then the merge request is blocked unless an eligible user approves the MR. This extra layer of oversight can serve as an enforcement mechanism as part of a strong legal compliance program.

License approvals are a type of Scan Result Security Policy and can be configured in the Security & Compliance > Policies page.

Learn more

• The points between Dev and Sec are critical and underserved in our market today. Efficiently managing risk and collaborating between these two domains to delicately balance business requirements is an area that can provide immense value for our customers, especially those in highly regulated industries. These overlapping concerns include controlling what code is merged into production, identifying vulnerabilities and risk, and determining when this impacts how production code is developed and deployed.
• The coordination between Sec and Ops is also lacking. Ops may manage golden images, automate deployment through IaC, and have complex steps to ensure software products are delivered to customers in a way that is stable and reliable and aligns with current legal and compliance requirements. Security and compliance teams must be acutely aware of CVEs, CWEs, and other common vulnerability exposures to ensure deployment processes that directly impact business revenue are not impacted. This, too, requires overlapping concerns and collaboration between approved code being merged to production, and the deployment pipelines that manage building images, pulling in packages and deploying SaaS containers cutting packaged software releases.

• Security Policies aligns with our efforts in driving adoption of GitLab Ultimate, as we're satisfying a market need that truly differentiates GitLab as a DevSecOps platform.
• Security Policies is core to one of our FY24 Product Investment themes,"Advanced security and compliance".
• Investment in Security Policies is strategic as we focus on depth over breadth in the Security section and Govern stage to provide robust solutions that address DevSecOps adoption challenges (internal) (also highlighted as one of our FY24 Yearlies). Security Policies and the greater Security section vision will help reduce churn/contraction by delivering predictable high value to customers.

GitLab's Security and Compliance Policy Management covers the many touch points across the DevSecOps platform to reduce risk and allow the business to operate efficiently. The top-level themes that will help our customers succeed are:

• Robustness of Scan Result Policies and Scan Execution Policies, which ensure scanners run when and where they must and that code is reviewed thoroughly to reduce the risk of introducing new vulnerabilities
• Global and fine-grained management of policies, which will allow Organizations to manage policies at an Organization level, with enforcement flowing down through groups, subgroups, and projects.
• Efficient and intelligent security orchestration will automate the steps required to configure and enforce scanners while also making pipelines more efficient, reducing CI minutes, and increasing developer productivity
• Broader policy enforcement that better serves our diverse customers and satisfies diverse security and compliance requirements
• Elegant cross-functional security, compliance, and developer workflows that encourage collaboration across domains
• Tighter controls that mitigate circumvention without blocking developers
• More customizable policy rules that support use cases across scanners, such as enabling support for Custom CI Variables in our UI Rule mode and Custom SAST/Secret Detection rulesets.
• UX Improvements to eliminate or abstract away Security Policy Projects to provide more customized workflows for Security and Compliance professionals

Security Policy Management enables global control of settings across an organizations technology assets and can extend to the processes and procedures used to enforce particular policies.

For GitLab, our focus is on supporting DevSecOps personas, which specifically involves AppSec, Security Operations, Compliance, and InfraSec personas. Each of these users is tasked with ensuring a business' applications are secure and compliant by preventing or reducing the risk of introducing vulnerabilities into production code and live applications. This involves securing each step of the SDLC as well as ensuring proper access and compliance within GitLab itself.

The most critical capabilities for a best-in-class DevSecOps Policy Management solution are as follows:

• The ability to easily manage and enforce policies globally across all relevant development projects.
• Two person approval of code changes, or change management workflows to reduce risk of introducing vulnerabilities.
• Complete assurance that policies cannot be circumvented.
• Audit capabilities to record and produce proof of any policy changes.
• Granular configuration of policies to allow businesses to filter out false positives, non-material findings, or irrelevant changes.
• Thorough alerting and notification capabilities to communicate high-risk changes, violations, or other policy related data into the communication tool of choice.
• Enforcement of security scanning in development projects.
• Risk-based Vulnerability Management workflows.
• Insider threat policies to identify and protect against potential attacks.
• Pipeline health policies that identify malicious or anomalous network/system calls.

1. Additional filters for scan result policies
2. Compliance enforcement of security policies

Security Policy Management at GitLab is in a category of its own. It's not currently possible to fully orchestrate the enforcement of security policies across the entire Software Development Lifecycle in the way you can with GitLab. Often, enforcing security and compliance requirements requires identifying endpoints across many tools in your software toolchain and creating custom solutions to instantiate controls that you must maintain.

With GitLab Security Policy Management, we offer global enforcement of policies across the groups, subgroups, and projects in your GitLab instance (or namespace in the case of GitLab.com). GitLab is responsible for maintaining the UI and YAML editor that can be leveraged to create and enforce policies, and we continue to build more capabilities to optimize and simplify management for diverse use cases, which mitigates further development efforts to manage customization of policy logic.

While we offer a competitive solution that reduces toolchain complexity and eases global enforcement, some of our competitors have offerings with comparable functionality.

GitHub

We have a very competitive position against GitHub regarding policy management. We offer a UI for intuitively defining custom policies, in addition to YAML mode for advanced users. We're expanding to make group and organization-level management of policies a breeze across large organizations while increasing the accuracy and confidence in the enforcement of policies. GitHub offers a very basic solution for checking vulnerabilities and blocking the merge of a PR but lacks the depth as well as the strategic investment to solve this holistically for Enterprise customers.

GitHub includes the following capabilities today:

• Code scanning results check can be used to find problems in code by severity.
• Users can override default behaviors.
• CodeQL can be integrated to require approval based on vulnerabilities found. If the code scanning results check finds any problems with the severity of the error, critical or high, the check fails, and the error is reported in the check results. If all the results found by code scanning have lower severities, the alerts are treated as warnings or notes, and the check succeeds.

There are prerequisites to utilizing GitHub, however:

• Many types of scanning require integration with external scanners
• It lacks the visual editor and native management of policy as code
• The ability to intuitively manage policies across groups is limited or requires manual configuration and maintenance using CodeQL
• It lacks the ability to limit who can give approval for failed code scanning checks. When critical or high vulnerabilities are found, anyone who is eligible to approve the PR can approve and allow the code to be merged in.

Synopsys

Synopsys offers Intelligent Orchestration, which allows users to optimize pipeline usage, in turn reducing pipeline costs and potentially impacting developer velocity due to optimizing pipeline duration.

However, leveraging Synopsys requires integration with your CI/CD and maintaining enforcement across the toolchain.