[Yandex Cloud documentation](../../index.md) > [Security in Yandex Cloud](../index.md) > [Cloud infrastructure security standard, version 1.4.2](index.md) > Application protection

# Application security requirements

## 6. Application security {#app-security}

### Bot protection {#protecting-recommendations}

#### 6.1 Yandex SmartCaptcha is used {#use-smartcaptcha}

To mitigate the risks associated with automated attacks on applications, we recommend using [Yandex SmartCaptcha](https://yandex.cloud/en/services/smartcaptcha). SmartCaptcha runs user requests through its ML algorithms and challenges only users whose requests it finds suspicious. You do not have to place the **"I’m not a robot"** button on the page.

| Requirement ID | Severity |
| --- | --- |
| APPSEC1 | Informational |

{% list tabs group=instructions %}

- Performing a check in the management console {#console}

  1. In the [management console](https://console.yandex.cloud), select a folder.
  1. Select **Yandex SmartCaptcha**.
  1. Make sure at least one CAPTCHA is [created](../../smartcaptcha/operations/create-captcha.md) for your application.

{% endlist %}

**Guides and solutions to use**:

[Guide on creating a CAPTCHA in Yandex SmartCaptcha](../../smartcaptcha/operations/create-captcha.md).

### Building a secure pipeline {#pipeline-recommendations}

Yandex Cloud allows customers to achieve compliance of software they develop at all [Supply-chain Levels for Software Artifacts (SLSA)](https://slsa.dev/), provided that they follow the guidelines given in this section. When using [Yandex Managed Service for GitLab](../../managed-gitlab/index.md), a customer automatically achieves [SLSA Level 2 compliance](https://about.gitlab.com/blog/2022/11/30/achieve-slsa-level-2-compliance-with-gitlab/).

#### 6.2 When creating a registry in Yandex Container Registry, keep the safe registry settings by default {#keep-safe-cr-settings}

When creating a new [registry](../../container-registry/concepts/registry.md), use the default options to make sure it meets the Yandex Cloud security standard:

* Docker images are automatically scanned as they are uploaded to the registry.
* Docker images in the registry are regularly re-scanned, i.e., every 7 days with an option to switch to daily scanning in the settings.

| Requirement ID | Severity |
| --- | --- |
| APPSEC14 | Medium |

**Guides and solutions to use**:

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder where you want to create a registry.
  1. In the list of services, select **Container Registry**.
  1. Click **Create registry**.
  1. In the **Name** field, enter a name for the registry. The naming requirements are as follows:
      
      * Length: between 3 and 63 characters.
      * It can only contain lowercase Latin letters, numbers, and hyphens.
      * It must start with a letter and cannot end with a hyphen.
  1. Under **Automatic scanning**:

      * Keep **Scan Docker images on push** enabled to scan Docker images at their upload to the repository.
      * Keep **Scan all Docker images in the registry** enabled. Adjust the scanning frequency if you need to.

  1. Click **Create registry**.

- CLI {#cli}

  To create a registry with safe image scanning settings used by default, run this command:

  ```bash
  yc container registry create \
    --name <registry_name> \
    --secure
  ```

{% endlist %}

#### 6.3 Docker images are scanned when uploaded to Container Registry {#upload-policy}

[Auto scans](../../container-registry/operations/scanning-docker-image.md#automatically) of Docker images on push are critical for early detection and elimination of vulnerabilities to ensure secure deployment of containers. Reports on completed scans provide a brief description of detected vulnerabilities and issues and help you set priorities and eliminate security risks in containerized applications.

| Requirement ID | Severity |
| --- | --- |
| APPSEC2 | Medium |

{% list tabs group=instructions %}

- Performing a check in the management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder the registry with Docker images belongs to.
  1. Select the appropriate registry in **Container Registry**.
  1. Navigate to the **Vulnerability scanner** tab and click **Edit settings**.
  1. Make sure Docker image scans on push are enabled.

{% endlist %}

**Guides and solutions to use:**

[Guide on scanning Docker images on push](../../container-registry/operations/scanning-docker-image.md#automatically).

#### 6.4 Docker images stored in Container Registry are regularly scanned {#periodic-scan}

Scheduled scanning of Docker images is an automated process that checks containerized images for vulnerabilities and compliance with security standards. Such scans are regular and automatic to ensure the consistency of image checks for vulnerabilities and maintain a high security level in the long run. Reports on completed scans provide a brief description of detected vulnerabilities and issues and help you set priorities and eliminate security risks in containerized applications.

We recommend setting up a schedule for scans to be run at least once a week.

| Requirement ID | Severity |
| --- | --- |
| APPSEC3 | High |

{% list tabs group=instructions %}

- Performing a check in the management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the folder the registry with Docker images belongs to.
  1. Select the appropriate registry in **Container Registry**.
  1. Navigate to the **Vulnerability scanner** tab and click **Edit settings**.
  1. Make sure that scheduled Docker image scans are enabled with a frequency of at least once a week.

{% endlist %}

**Guides and solutions to use:**

[Guide on scheduled scanning of Docker images](../../container-registry/operations/scanning-docker-image.md#scheduled).

#### 6.5 Container images used in the production environment have the last scan date of one week ago or less {#last-scan-date}

Checking Docker images used in production environments with the last scan date not older than a week ensures that you continuously monitor and update security measures, eliminating potential vulnerabilities that might have occurred since the last scan. This also helps you make sure you are not deploying containers with recently detected vulnerabilities and enhance the security level. You can automate this process by [setting up a schedule](#periodic-scan) in the Vulnerability scanner.

| Requirement ID | Severity |
| --- | --- |
| APPSEC4 | Medium |

{% list tabs group=instructions %}

- Performing a check via the CLI {#cli}

  Run the command below to search for containerized images with the last scan date a week ago or less:

  ```bash
  export ORG_ID=<organization_ID>
  for CLOUD_ID in $(yc resource-manager cloud list --organization-id=${ORG_ID} --format=json | jq -r '.[].id');
  do for FOLDER_ID in $(yc resource-manager folder list --cloud-id=$CLOUD_ID --format=json | jq -r '.[].id'); 
  do for REGISTRY_ID in $(yc container registry list --folder-id $FOLDER_ID --format=json | jq -r '.[].id');
  do for IMAGE_ID in $(yc container image list --registry-id $REGISTRY_ID --format=json | jq -r '.[].id';)
  do LAST_SCAN_DATE=$(yc container image get-last-scan-result --image-id $IMAGE_ID --format=json 2>/dev/null | jq -r '.scanned_at');
  [ ! -z "$LAST_SCAN_DATE" ] && [ $(date --date "$LAST_SCAN_DATE" +'%s') -lt $(date --date '7 days ago' +'%s') ] && echo "Regitry ID - $REGISTRY_ID, Image ID - $IMAGE_ID, Last scan date - $LAST_SCAN_DATE"
  done;
  done;
  done;
  done
  ```

{% endlist %}

#### 6.6 Attestations are used when building artifacts {#provenance-attestation}

Attestations used when building software artifacts help ensure a secure and verifiable record of an artifact's origin, integrity, and SBOM compliance. This helps ensure the artifact reliability throughout its lifecycle. A software bill of materials (SBOM) is required to secure a supply chain, manage vulnerabilities, comply with requirements, assess risks, ensure transparency, and respond to incidents in an effective way.

With Managed Service for GitLab, attestations are easier to use, as the service has a feature for generating a [provenance attestation](https://about.gitlab.com/releases/2022/06/22/gitlab-15-1-released/#slsa-2-attestation-included-for-build-artifacts). An SBOM can be generated using [syft](https://github.com/anchore/syft), a third-party software tool.

| Requirement ID | Severity |
| --- | --- |
| APPSEC5 | High |

{% list tabs group=instructions %}

- Manual check {#manual}

  Make sure that artifact attestation is performed while building an application.

{% endlist %}

**Guides and solutions to use**:

[Gitlab guide for software artifact attestation](https://docs.gitlab.com/ee/ci/runners/configure_runners.html#artifact-attestation).

#### 6.7 Artifact integrity is ensured {#pipeline-artifacts-cosign}

Signing artifacts enhances security to ensure your software validity, integrity, reliability, and compliance with the requirements.

| Requirement ID | Severity |
| --- | --- |
| APPSEC6 | High |

{% list tabs group=instructions %}

- Manual check {#manual}

  Make sure that artifacts are signed while building an application.

{% endlist %}

**Guides and solutions to use:**

To sign artifacts within a pipeline, you can use [Cosign](https://github.com/sigstore/cosign), a third-party command line utility for signing [artifacts](https://docs.sigstore.dev/signing/quickstart/), images, and [in-to-to attestations](https://github.com/in-toto/attestation/tree/main/spec/predicates). Then you can upload these artifacts to Yandex Container Registry.

A special build of Cosign allows you to store the created [digital signature key pair](../../kms/concepts/asymmetric-signature-key.md) in [Yandex Key Management Service](../../kms/quickstart/index.md), sign files and artifacts with the private key of the pair, and verify a digital signature using its public key.

For more information, see [Signing and verifying Container Registry Docker images in Yandex Managed Service for Kubernetes](../../container-registry/tutorials/sign-cr-with-cosign.md).

#### 6.8 Artifacts are checked for authenticity on deployment {#artifacts-checked}

To ensure the reliability, security, and compatibility of applications in [Managed Service for Kubernetes](../../managed-kubernetes/index.md), a service for automatic scaling and deployment of applications, you need to minimize the risk of issues, vulnerabilities, and failures during your application deployment and runtime. To do this, use [signatures and signature verification](../../container-registry/tutorials/sign-cr-with-cosign.md) in Managed Service for Kubernetes with Cosign and [Kyverno](../../managed-kubernetes/operations/applications/kyverno.md).

| Requirement ID | Severity |
| --- | --- |
| APPSEC7 | Medium |

{% list tabs group=instructions %}

- Manual check {#manual}

  Make sure that artifacts are verified while building an application.

{% endlist %}

**Guides and solutions to use**:

[Guide on setting up the artifact signature](../../container-registry/tutorials/sign-cr-with-cosign.md).

#### 6.9 Protected secure pipeline templates are used {#pipeline-blocks}

When working with Managed Service for GitLab, make sure you use built-in GitLab security mechanisms to secure your pipeline. You can integrate a pipeline into your projects in the [following ways](../../managed-gitlab/concepts/security.md#security-pipeline-usage):

* Creating a pipeline in an individual project and connecting it to other projects using the [`include`](https://docs.gitlab.com/ee/ci/yaml/includes.html) function. This option is available for all license types.
* Using the [`Compliance framework and pipeline`](https://docs.gitlab.com/ee/user/project/settings/index.html#compliance-frameworks) mechanism that you can run in any group project. It is available for the `Ultimate` license.
* Copying pipeline sections to `.gitlab-ci.yml` files in your projects.

| Requirement ID | Severity |
| --- | --- |
| APPSEC8 | Informational |

#### 6.10 A Yandex Smart Web Security security profile is used {#use-sws}

[Yandex Smart Web Security](../../smartwebsecurity/quickstart.md) protects you against DDoS attacks, web attacks, and bots at application level L7 of the [OSI model](https://en.wikipedia.org/wiki/OSI_model). Smart Web Security [connects](../../smartwebsecurity/quickstart.md) to Yandex Application Load Balancer.

In a nutshell, the service checks the HTTP requests sent to the protected resource against the [rules](../../smartwebsecurity/concepts/rules.md) configured in the [security profile](../../smartwebsecurity/concepts/profiles.md). Depending on the results of the check, the requests are forwarded to the protected resource, blocked, or sent to [Yandex SmartCaptcha](../../smartcaptcha/index.md) for additional verification.

| Requirement ID | Severity |
| --- | --- |
| APPSEC9 | High |

{% list tabs group=instructions %}

- Performing a check in the management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to check the Smart Web Security status.
  1. In the list of services, select **Smart Web Security**.
  1. In the left-hand panel, select ![shield-check](../../_assets/console-icons/shield-check.svg) **Security profiles**.
  1. Make sure you have security profiles created.
  1. If you have security profiles, the recommendation is fulfilled. Otherwise, proceed to _Guides and solutions to use_.

- Performing a check via the CLI {#cli}

  Run this command:

  ```bash
  yc smartwebsecurity security-profile list
  ```

  If the command returns information about the existing security profiles, the recommendation is fulfilled. Otherwise, proceed to _Guides and solutions to use_.

{% endlist %}

**Guides and solutions to use**:

[Creating a security profile and connecting it to a virtual host of an L7 load balancer](../../smartwebsecurity/quickstart.md).

#### 6.11 A web application firewall is used {#use-waf}

To mitigate risks associated with web attacks, we recommend using the Yandex Smart Web Security web application firewall (WAF). A web application firewall analyzes HTTP requests to a web app according to pre-configured rules. Based on the analysis results, certain [actions](../../smartwebsecurity/concepts/rules.md#rule-action) are applied to HTTP requests.

You can manage the web application firewall using a [WAF profile](../../smartwebsecurity/concepts/waf.md) that connects to a [security profile](../../smartwebsecurity/concepts/profiles.md) in Smart Web Security as a separate [rule](../../smartwebsecurity/concepts/rules.md).

| Requirement ID | Severity |
| --- | --- |
| APPSEC10 | Medium |

{% list tabs group=instructions %}

- Performing a check in the management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) where you want to check a security profile for a WAF rule.
  1. In the list of services, select **Smart Web Security**.
  1. Make sure your security profile has a security rule of the **web application firewall** type.

{% endlist %}

**Guides and solutions to use**:

[Creating a WAF profile and connecting it to a security profile in Smart Web Security](../../smartwebsecurity/quickstart.md#waf).

#### 6.12 Advanced Rate Limiter is used {#use-arl}

[Advanced Rate Limiter (ARL)](../../smartwebsecurity/concepts/arl.md) is a Yandex Smart Web Security module used to monitor and limit web app loads. It allows you to set a limit on the number of HTTP requests over a certain period of time. All requests above the limit will get blocked. You can set a single limit for all traffic or configure specific limits to segment requests by certain parameters. For the purpose of limits, you can count requests one by one or group them together based on specified property.

You need to connect your ARL profile to the [security profile](../../smartwebsecurity/concepts/profiles.md) in Smart Web Security.

| Requirement ID | Severity |
| --- | --- |
| APPSEC11 | Medium |

{% list tabs group=instructions %}

- Performing a check in the management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) you want to check for ARL profiles.
  1. In the list of services, select **Smart Web Security**.
  1. In the left-hand panel, select ![image](../../_assets/smartwebsecurity/arl.svg) **ARL profiles** and make sure you have ARL profiles connected to your security profile.

{% endlist %}

**Guides and solutions to use**:

[Creating an ARL profile and connecting it to a security profile in Smart Web Security](../../smartwebsecurity/quickstart.md#arl).

#### 6.13 Approval rules are configured {#setup-code-review}

With [Yandex Managed Service for GitLab](../../managed-gitlab/index.md), you can flexibly set up required [approval rules](../../managed-gitlab/concepts/approval-rules.md) before the code can be added to the target project branch. This feature is an alternative to the GitLab Enterprise Edition’s [Approval Rules](https://docs.gitlab.com/ee/user/project/merge_requests/approvals/rules.html) tool and is available regardless of the GitLab [version](https://about.gitlab.com/pricing).

If a [GitLab instance](../../managed-gitlab/concepts/index.md#instance) has the approval rules enabled, Managed Service for GitLab analyzes approvals from reviewers for compliance with the specified rules. If there are not enough approvals, a thread is created in a merge request that blocks it from being merged to the target branch. When the merge request is updated, a comment with the current compliance status is created or updated in the thread. Once all required approvals are obtained, the thread is resolved.

If you manually resolve the thread, it will be recreated. If the merge request is approved regardless of the existing rules, users with the `Maintainer` role or higher will receive an email notification about the violated approval workflow.

| Requirement ID | Severity |
| --- | --- |
| APPSEC12 | Medium |

{% list tabs group=instructions %}

- Performing a check in the management console {#console}

  1. In the [management console](https://console.yandex.cloud), select the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) where your GitLab instance is located.
  1. In the list of services, select **Managed Service for&nbsp;GitLab**.
  1. Select the instance you need and click **Edit** in the top-right corner of the page.
  1. Make sure to select a configured approval rule [configuration](../../managed-gitlab/concepts/approval-rules.md#packages) in the **Approval rules** field.

{% endlist %}

**Guides and solutions to use**:

[Enabling approval rules in the GitLab instance](../../managed-gitlab/operations/approval-rules.md#enable)

#### 6.14 Trusted and unwanted IP addresses are grouped into lists {#app-sws-lists}

[Yandex Smart Web Security](../../smartwebsecurity/index.md) supports grouping IP addresses into [custom lists](../../smartwebsecurity/concepts/lists.md#user-rules). Add those lists as [conditions](../../smartwebsecurity/concepts/conditions.md) in [rules](../../smartwebsecurity/concepts/rules.md) to allow, block, or forward some traffic to [SmartCaptcha](../../smartcaptcha/index.md) during IP address verification.

| Requirement ID | Severity |
| --- | --- |
| APPSEC13 | Medium |

{% list tabs group=instructions %}

- Performing a check in the management console {#console}

  1. Open the Yandex Cloud console in your browser.
  1. Go to the appropriate folder.
  1. In the list of services, select **Smart Web Security**.
  1. Navigate to **Lists**.
  1. Check that the lists have been created.
  1. If there are such lists, the recommendation is fulfilled. Otherwise, proceed to "Guides and solutions to use".

- Manual check {#manual}

  Contact your account manager to make sure you have Smart Web Security lists.

{% endlist %}

**Guides and solutions to use**:

Whitelist and blacklist IP addresses to filter traffic. For more information, see [Managing lists](../../smartwebsecurity/operations/list-create.md).