Pipeline environment: enforce MFA in CI/CD systems
Enforce multi-factor authentication (MFA) where possible in CI/CD platforms to protect against credential compromise.
OWASP Cheat Sheets · all subjects
ci-cd/pipeline-execution
10 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.
Pipeline environment: isolate build nodes
Perform builds in appropriately isolated nodes to prevent cross-contamination between builds and limit the blast radius of compromises.
Pipeline environment: secure SCM to CI/CD communication
Ensure communication between the SCM and CI/CD platform is secured using widely accepted protocols such as TLS 1.2 or greater.
Pipeline environment: restrict CI/CD access by IP
Restrict access to CI/CD environments by IP address if possible to limit unauthorized access.
Pipeline environment: store CI config file outside repository
If feasible, store the CI config file outside the repository that is hosting the code being built. If the file is stored alongside the code, it is imperative that the file is reviewed before any merge request is approved.
Pipeline environment: enable appropriate logging
Enable an appropriate level of logging in the CI/CD platform to provide visibility into pipeline execution.
Pipeline environment: incorporate SAST, DAST, IaC scanning
Incorporate language appropriate SAST (Static Application Security Testing), DAST (Dynamic Application Security Testing), and Infrastructure as Code (IaC) vulnerability scanning tools into the pipeline.
Pipeline environment: require manual approval for production deployment
Require manual approval and review before triggering production deployment to prevent accidental or malicious deployments.
Pipeline environment: avoid Docker --privileged flag
If pipeline steps are executed in Docker images, avoid using the --privileged flag as it grants excessive capabilities to containers and increases security risk.
Pipeline environment: version control pipeline configuration
Ensure the pipeline configuration code is version controlled to maintain audit trails and enable rollback capabilities.