SDLC - Repositories without exploitable vulnerabilities remediated within SLO

Description

The percentage of code repositories in the development pipeline that have resolved critical security vulnerabilities within the established service level objective (SLO), ensuring that potential threats are mitigated in a timely manner to reduce exposure to security risks and maintain compliance with security standards.

How we measure it

Find all open critical and high Dependabot alerts in active (non-archived) GitHub repositories. Alerts are considered compliant while they are within their remediation SLO: 14 days for critical and 30 days for high. Only open alerts are collected, so alerts that have already been fixed are not measured.

Meta Data

Attribute	Value
Metric id	sd_vulnerabilities_performance
Category	Software Development
SLO	90.00% - 95.00%
Weight	0.5
Type

References

Framework	Ref	Domain	Control
CIS 8.1	16.12	Application Software Security	Implement Code-Level Security Checks
ISO 27001:2022	A.8.25	8 Technological controls	Secure development life cycle
NIST CSF v2.0	PR.PS-06	Platform Security (PR.PS)	PR.PS-06: Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle

Code

SELECT
  repos.full_name AS resource,
  'repository' AS resource_type,
  CASE
    WHEN alerts.severity = 'critical' AND CURRENT_DATE - CAST(alerts.created_at AS DATE) > 14 THEN 0
    WHEN alerts.severity = 'high' AND CURRENT_DATE - CAST(alerts.created_at AS DATE) > 30 THEN 0
    ELSE 1
  END AS compliance,
  coalesce(alerts.cve_id, alerts.ghsa_id) || ' in ' || alerts.package_name || ' (' || alerts.severity || ') open for '
    || CAST(CURRENT_DATE - CAST(alerts.created_at AS DATE) AS VARCHAR) || ' days' AS detail
FROM {{ ref('github_dependabot_alerts') }} AS alerts
JOIN {{ ref('github_repositories') }} AS repos
  ON repos.org = alerts.org
  AND repos.name = alerts.repo
WHERE NOT repos.archived
  AND alerts.state = 'open'
  AND alerts.severity IN ('critical', 'high')