@@ -30,6 +30,7 @@ Test and Verification:
3030 comments : " "
3131 Test libyear :
3232 << : *Exclusion-of-source-code-duplicates
33+ uuid : 87b54313-fafd-4860-930f-5ef132b3e4ad
3334 risk : Vulnerabilities in running artifacts stay for long and might get exploited.
3435 measure : |-
3536 Test `libyear`, which provides a good insight how good patch management is.
@@ -49,6 +50,7 @@ Test and Verification:
4950 - patching
5051 Test for Time to Patch :
5152 << : *Exclusion-of-source-code-duplicates
53+ uuid : 13af1227-3dd1-4d4f-a9e9-53deb793c18f
5254 risk : Automatic PRs for dependencies are overlooked resulting in known vulnerabilities in production artifacts.
5355 measure : |-
5456 Test of the Time to Patch (e.g. based on Mean Time to Close automatic PRs)
@@ -70,6 +72,7 @@ Test and Verification:
7072 - patching
7173 Test for Patch Deployment Time :
7274 << : *Exclusion-of-source-code-duplicates
75+ uuid : 0cb2c39a-3cec-4353-b3ab-8d70daf4c9d2
7376 risk : Automatic PRs for dependencies are overlooked resulting in known vulnerabilities in production artifacts.
7477 measure : |
7578 Test of the Patch Deployment Time.
@@ -88,7 +91,7 @@ Test and Verification:
8891 - patching
8992 Dead code elimination :
9093 << : *Exclusion-of-source-code-duplicates
91- uuid : d17dbff0-1f10-492a-b4c7-17bb59a0a711
94+ uuid : a8d7d1f1-fc24-49ab-8fb6-f3a03da9c61d
9295 risk :
9396 Dead code increases the attack surface (use of hard coded credentials and
9497 variables, sensitive information)
0 commit comments