# General Lifecycle Best Practices

## Getting Started

### Identify your Primary Desired Outcome (PDO)

- Your Primary Desired Outcome is a strategic, achievable, specific goal your organization wants from their Sonatype Lifecycle subscription.
- A PDO communicates an organization's priorities with a timeframe and includes a measurement that will indicate success.

Examples include:

- Reduce the severity of security violations in our apps by 50% within 12 months
- Reduce unplanned or unscheduled developer work by 30% within 12 months
- Reduce reaction time to sudden vulnerability events by 90% within 12 months

### Align expectations from executive management with all stakeholders

- DevSecOps transformations are the intersection between people, processes, and technology.
- This requires a tactical plan to bring these together to meet your PDO.
- This plan will change over time but needs to include expectations from upper management and other stakeholders.
- Lifecycle is a powerful technology for automatic open-source governance but is only 1/3rd of the equation.
- You will need to bring the right people together on a shared plan to be successful.

### Document your open-source governance journey in a central location

- Establish channels of communication for documentation, training, support, and reporting.
- The Sonatype Definitive Guides can help you educate the basics to your team.
- The Sonatype self-guided Learning Portal is available for anyone from your organization and access is managed by your admins.
- Customer Success Engineers have tested reporting tools for generating executive business reviews.
- The Sonatype Developer Relationship team publishes regular articles to keep your teams informed about important trends.

## Integrate Lifecycle into your CI/CD system

### Make integration with your CI/CD system a goal in your journey with Lifecycle

- Regardless of how you start with Lifecycle, full integration with your CI/CD tools should be a goal for every deployment, regardless of your organization's size, business goals, and maturity.
- Good CI/CD integration produces the highest accuracy scans, enables automatic enforcement actions, and ensures that your in-development apps are scanned regularly.

### Budget adequate time for integration efforts

- The CI/CD process is the heart of modern software development, and its efficacy probably affects every part of your development process.
- Give your Operations team the time and budget necessary to make a stable, successful integration their priority.

## Configure Lifecycle for long-term success

### Set up LDAP/SAML for easy login

- Tools that are time-consuming to access will go unused, so it's in your best interests to make logging into Lifecycle quick and painless.
- Don't delay in setting up LDAP/SAML for IQ Server, and then test thoroughly.
- In the ideal scenario, IQ Server roles and permissions will map to your LDAP users and groups.

### Align Lifecycle role-based access to your organization’s directory service

- User access can most easily scale when aligned with your existing LDAP or Active Directory.
- Start with the inbuilt roles to follow the principle of least privilege.

### Turn on notifications, and send them someplace they'll be seen

- Notifications can alert stakeholders to new and severe risks in their apps.
- Your exact notification configuration will depend on your organization's needs and maturity, but at least turn on notifications for severity levels 9 and 10 violations.
- Avoid creating noise by only notifying the stakeholders who are responsible for addressing risk.
- And be sure that notifications are going someplace they'll be seen – if no one checks their email, then sending notifications by email won't be effective.

## Enforcement and remediation

### Block builds that contain critical vulnerabilities at the release stage

- Vulnerabilities with a CVSS score of 9 or 10 pose a serious risk and should be prioritized.

### Integrate remediation efforts into your issue-tracking tools

- Aggregate all the violations for one component into a single ticket.
- Often upgrading the component will remediate multiple issues at once.

### Avoid aggregating Lifecycle scan results with other scans

- Lifecycle results are precise and will not include false positives from other tools.
- Aggregating the results will create noise for your developers to filter or ignore.

## Monitoring your IQ Server

As a critical part of your build pipeline, you will want to monitor the performance and operation of the IQ Server. The following are models common with Lifecycle developments.

### IQ Server Health and Uptime

- Failover checks on the availability of the service using the health check API endpoint.
- Tracking user activity and server performance of the server using the metrics API endpoint.
- Monitor the performance of High Availability deployments.

### IQ Server Disk Usages and Data Retention

- Monitor the disk usage to avoid the critical issue of running out of space.
- Configure data retention policies to purge old scans and reports.
- Periodically delete the contents of the trash directory to reclaim used space.

### Logging and Activity

- Modify the log retention from the config.yml.
- Backup and archive server logs based on your retention policies.
- Audit access controls with the audit log.

## IQ Server data retention and maintenance

The IQ Server UI will display the latest scan for a given stage, however, every scan is retained as a separate report.

### Configure data purging for older scan reports

- Running daily scans on hundreds or thousands of applications can consume a significant amount of space.
- By default, IQ Server purges after 3 months for early scans and 10 years for scans that occur later in an app's lifetime.
- Continuous Monitoring scans can be cleaned up after 30 days.

### Use the purgeScanFiles property to keep scan files for scan promotion

- Scan files are deleted when the next scan for the same application happens.
- The latest files are retained for Continuous Monitoring however older scans may be needed for Scan Promotion.
- Setting the purgeScanFiles property to withReports will keep a copy until their corresponding reports are cleaned.

### Back up the IQ Server regularly

- We recommend backing up the IQ Server at least once a week up to daily.

There are 3 main components to consider when backing up

|  |  |
| --- | --- |
| #### Database: Internal<br>(default) | - in the [`data]` directory of the [`sonatype-work]` folder<br>  <br>- shut down the server to avoid catching the internal database in an inconsistent state |
| #### Database: External<br>(production recommended) | - external PostgreSQL managed by your database administrators<br>  <br>- PostgreSQL can be highly available and backed up while running |
| #### Reports and Logs | - in the `report` and `log` directories under the `sonatype-work` folder.<br>  <br>- files under the `report.cache` may contain proprietary data including license overrides and claimed components. |
| #### Server binaries and configuration | - `nexus-iq-server-[version].jar`<br>  <br>  <br>  <br>  - binary may be re-downloaded or kept with backup<br>    <br>- `config.yml`<br>  <br>  <br>  <br>  - keep when upgrading for configuration.<br>    <br>  - document changes in version control or in your server maintenance wiki<br>    <br>  - note: this configuration is migrating to the IQ Server database |

### Delete the contents of the trash directory to reclaim space

- The IQ Server data retention task will move scan reports to a trash directory.
- Clean this directory to recover server space.
- Include as a step in your regular backup process.

### Plan to upgrade your IQ Server at least once a quarter (90 days)

- Sonatype frequently releases new versions of the IQ Server as functionality becomes available.
- These include performance improvements as well as security and bug fixes.
- We recommend upgrading at a minimum of once a quarter (90 days).

### Upgrade your IQ Server to the latest version in your test environment and N-1 version in your production environment

- Using N-1 version in your production environment limits risk and ensures you're using a stable version of IQ Server.
- Using the latest in your test environment allows you to try out new features and identify better workflows.

### Upgrade your integrations with Lifecycle

- New releases of IQ Server depend on changes to our scanners embedded in your build environments.
- Review the Downloads and Compatibilities page for integration upgrades.
- Command Line Scanner (CLI) is found within the IQ Server download archive.