Skip to content
Snippets Groups Projects

Secure Composition Analysis Priorities 2020

    • Closed Issue created by Nicole Schwartz @NicoleSchwartz

    Priorities

    Complete

    :white_check_mark: Remove Docker and Docker

    :white_check_mark: Support Offline Security Scanning (Offline / Limited Connectivity / Air-gapped vulnerability analysis and license compliance for on-prem instances) MVC

    :white_check_mark: Support Offline Security Scanning (Offline / Limited Connectivity / Air-gapped vulnerability analysis and license compliance for on-prem instances) post-mvc

    :white_check_mark: MVC - *MAU Usage Data product metrics

    We need to know more about how our users use the product and what our product is doing to better prioritize bugs, requests and work.

    AST Leadership

    We wish to become recognized as a leader in Application Security Testing (AST)

    AST Leadership

    Dependency Scanning - Viable to Complete

    Many customers make buying decisions based on the Gartner magic quadrant, so we want to focus on ~"Category:Dependency Scanning" primarily as that is a key factor in the AST MQ. We would like to move this to Complete Maturity in 2020.

    5 - GitLab on GitLab Dogfooding Dependency Scanning

    6 - Azure / OpenShift

    Will not have time

    7 - .Net Core and Framework support

    8 - Stability and Reliability

    This includes preventing technical debt (keeping components up to date), as well as bugs and addressing technical debt)

    This means to me - ~performance ~availability Application Limits ~P1 ~S1 ~bug UX Dev Team

    We'll need to continue to hit ~"technical debt" that is blocking us from moving forward on our big goals.

    We need to be careful to add relevant test as we go forward, and take some time to add missed historic tests.

    9 - Enterprise Ready

    The company has a goal to be enterprise ready. This will be partially addressed by items above, but calling it out below:

    11 - License Compliance

    • ~"Category:License Compliance" research on group settings will continue as this research is applicable for all scanners as we want each to have group options
    • urgent ~p1 ~s1 ~bug will be addressed

    anything else will be %Backlog for now

    12 - dependency list aka Software Bill of Materials or SBoM

    • Anything deemed required as part of getting ~"Category:Dependency Scanning" to complete will be covered
    • urgent ~p1 ~s1 ~bug

    anything not directly related to that effort will be %Backlog

    14 Languages

    Check the coverage of languages in secure, for Dogfooding, and against utilization found here

    15 OSS Scanners to Core

    Epic: Move selected security features to Core

    Support Offline Security Scanning (Offline / Limited Connectivity / Air-gapped vulnerability analysis and license compliance for on-prem instances) usability improvements

    Support Offline Security Scanning (Offline / Limited Connectivity / Air-gapped vulnerability analysis and license compliance for on-prem instances) License Compliance backlog

    Post-MVC Usage Data product metrics

    References

    Edited by Nicole Schwartz

    Designs

    Child items ...

    • Activity

    Please register or sign in to reply