Table of Contents

1. Secure Access and Authentication
2. Managing SSH Keys
3. Enabling Two-Factor Authentication (2FA)
4. CI/CD Pipeline Security
5. Code Review and Merge Request Best Practices
6. Dependency and Secret Scanning
7. Regular Audits and Monitoring

1. Secure Access and Authentication

Start by ensuring that only authorized users can access your GitLab instance:

• Use UMD CAS: Always log in via the UMD CAS portal to maintain centralized authentication and control.
• Limit User Permissions: Follow the principle of least privilege—grant users only the access they need.
• Monitor Active Sessions: Regularly review active sessions and revoke access for inactive or unauthorized accounts.

2. Managing SSH Keys

SSH keys provide secure access to your repositories. Follow these best practices:

• Generate strong SSH keys using the ED25519 algorithm.
• Keep your private keys secure and use a passphrase for extra protection.
• Regularly review and remove unused SSH keys from your account.

3. Enabling Two-Factor Authentication (2FA)

Adding an extra layer of security via 2FA helps protect your account from unauthorized access:

• Navigate to your GitLab account settings and select the 2FA option.
• Use an authenticator app (such as Google Authenticator or Authy) to scan the provided QR code.
• Store backup codes securely in case you lose access to your authenticator device.

4. CI/CD Pipeline Security

Secure your CI/CD pipelines to prevent unauthorized code execution and data leakage:

• Configure GitLab Runners in a secure environment, preferably isolated in a dedicated network segment.
• Limit runner permissions to only what is necessary for the project.
• Use environment variables and secret management features to protect sensitive data.
• Regularly update your runners and dependencies to the latest security patches.

5. Code Review and Merge Request Best Practices

Proper code review processes reduce the risk of introducing vulnerabilities:

• Implement mandatory peer reviews for all merge requests.
• Use GitLab’s built-in tools to track issues and enforce merge request approvals.
• Configure branch protection rules to prevent direct pushes to critical branches.

6. Dependency and Secret Scanning

Use automated tools to scan for vulnerabilities in dependencies and to detect secrets accidentally committed to repositories:

• Dependency Scanning: Enable GitLab’s dependency scanning to detect vulnerable libraries and packages.
• Secret Detection: Use GitLab’s secret detection feature to automatically scan commits for exposed secrets.
• Regularly review scan reports and address any flagged issues promptly.

7. Regular Audits and Monitoring

Maintain a robust security posture with ongoing audits and monitoring:

• Conduct periodic audits of user access, project settings, and CI/CD configurations.
• Monitor logs and system alerts for suspicious activities.
• Review GitLab’s security documentation and update policies as new threats emerge.

Need Assistance?

If you encounter any security issues or need further guidance, please reach out to the Engineering Digital Service at eds@umd.edu.