SDLC - Repositories without exploitable vulnerabilities

Description

The percentage of code repositories free from known security flaws, ensuring that development efforts prioritize secure coding practices, reduce the risk of breaches, and maintain the integrity of the software development lifecycle. This metric is important as it directly impacts the organization's ability to deliver secure products and protect against potential cyber threats.

How we measure it

Query the code repository management system to identify all repositories with exploitable vulnerabilities. Calculate the percentage of repositories without exploitable vulnerabilities against the total number of repositories.

Meta Data

Attribute	Value
Metric id	sd_vulnerabilities
Category	Software Development
SLO	98.00% - 99.00%
Weight	0.8
Type

References

Framework	Ref	Domain	Control
ISO 27001:2022	A.8.25	8 Technological controls	Secure development life cycle
CIS 8.1	16.12	Application Software Security	Implement Code-Level Security Checks
NIST CSF v2.0	PR.PS-06	Platform Security (PR.PS)	PR.PS-06: Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle

Code

SELECT
    projects.name AS resource,
    'snyk' as resource_type,
    CASE
        WHEN count(issues.id) = 0 THEN 1
        ELSE 0
    END AS compliance,
    CAST(count(issues.id) AS text) || ' open critical/high issues' AS detail
FROM
    {{ ref('snyk_projects') }} AS projects
LEFT JOIN
    {{ ref('snyk_issues') }} AS issues
ON
    projects.id = issues.project_id
    AND issues.status = 'open'
    AND issues.effective_severity_level IN ('critical', 'high')
GROUP BY
    projects.id,
    projects.name

SELECT
  repos.full_name AS resource,
  'repository' AS resource_type,
  CASE WHEN count(alerts.number) = 0 THEN 1 ELSE 0 END AS compliance,
  CAST(count(alerts.number) AS VARCHAR) || ' open critical/high Dependabot alerts' AS detail
FROM {{ ref('github_repositories') }} AS repos
LEFT JOIN {{ ref('github_dependabot_alerts') }} AS alerts
  ON alerts.org = repos.org
  AND alerts.repo = repos.name
  AND alerts.state = 'open'
  AND alerts.severity IN ('critical', 'high')
WHERE NOT repos.archived
GROUP BY repos.full_name