This series of articles aims to identify the best practices to implement in order to secure your delivery process and your CI/CD pipelines:
0. DevSecOps & CI/CD Pipelines: understand the fundamentals.
1. Version Control System Security
2. Secure Continuous Integration (CI) Pipelines
3. Secure Continuous Delivery (CD) Pipelines
By Gologic with the collaboration of Alexandre Couëdelo.
Are you struggling to grasp the intricacies of DevSecOps CI/CD pipelines? Seeking comprehensive insights on how to balance speed and security in your software development journey? Look no further. They are the key DevOps capability used to achieve fast and reliable software delivery. However, they also introduce security issues that must be addressed to:
- safeguard sensitive information
- prevent unauthorized access
- mitigate potential security vulnerabilities
Through its DevOps services, Gologic offers you the opportunity to benefit from its expertise in developing and deploying CI/CD delivery pipelines, allowing you to establish robust security practices throughout your software development cycle.
This article is the first in our series on secure software development, in which you will learn how to secure your delivery process and CI/CD pipelines. Get ready to discover the 7 crucial security points in the CI/CD process that require attention.
What are the key security features to
consider for CI/CD pipelines?
The diagrams below illustrate a typical software delivery system and locate with numbers 1 to 7 the security pain point discussed below. In future articles, we will tackle one or more of those elements in more detail, considering their impact on the overall architecture.
1. Developer Identity
A secure CI/CD process begins with verifying developers’ identities contributing to the codebase. The typical username/password authentication offers rather limited protection, there are several other methods to verify the identity of a developer, such as:
- commit signing
- SSH keys
- SSO
It is essential to ensure that the developer’s workflow includes gates (validation steps) to prevent code to be shipped to production without human approbation and security requirements.
2. CI/CD Workload Identity
CI/ CD systems play an important role in software development and often have broad access to various environments, repositories, and infrastructure components. Upholding the principle that security is paramount, if attackers compromise these systems, they can manipulate code, and artefacts, and infiltrate other systems and resources, which could have serious consequences.
There are several methods to limit permissions to only what’s necessary for the CI/CD processes. Avoid granting excessive access that isn’t required.
3. Supply Chain Vulnerability from External-Source
The extensive use of open-source software components within the software and CI/CD pipeline introduces the risk of supply chain vulnerabilities. Ensuring the open-source components are up-to-date and free from known vulnerabilities is crucial.
Employing automated tools to continuously scan and monitor dependencies helps mitigate this risk, enabling timely identification and remediation of vulnerabilities.
4. Artifact Store Vulnerability
Artefacts generated in the CI/CD process are valuable and must be protected. Artefact stores can be vulnerable to impersonation attacks, where attackers try masquerading as legitimate systems to gain unauthorized access.
Artefact signing adds an extra layer of security by digitally signing artefacts, enabling verification of their integrity and authenticity before deployment.
5. Outdated Artefacts and Latent vulnerabilities
It’s not because artefacts passed the initial scanning process that it is safe. New vulnerabilities are discovered every day. Attackers could use known vulnerabilities to attack the integrity of your released or DevOps pipelines.
To keep your system store secure, it’s crucial to:
- have a good strategy for versioning artefacts
- keeping dependencies up-to-date
- always watching out for outdated dependencies
6. Secret Store and Configuration Store
Secrets, such as passwords, API keys, and certificates, must be treated with care and securely stored. The secret store should be where all the variables needed to run the application are securely stored and secured, and access to these stores must be restricted only to the necessary roles.
7. Configuration Store
In modern GitOps approaches, configuration files in Git repositories are used to manage infrastructure and applications. By using Git as a single source of truth, GitOps enables developers to manage their infrastructure better. However, this comes with security concerns since changes to that configuration can directly impact live environments.
Conclusion
CI/ CD pipelines are essential for software development but they also come with security risks. We have just gone over the seven fundamental security measures around the CI/CD process that require attention. At this point, you should critically evaluate your system and evaluate its security risk.
Don’t leave your software’s security to chance; take the necessary steps now to protect your data and your business. In the upcoming articles, we will dive deeper into each of those elements and prove best DevOps practices to mitigate them.
By Gologic with the collaboration of Alexandre Couëdelo.
