Securing CI/CD Pipelines
More notes from /NDC Copenhagen 2020/ regarding integrating security aspects into CI/CD pipelines; from best practices to build security into the pipelines as well mechanisms alike to control them.
Mechanisms can be placed in at different levels, from code to infrastructure to ensure the best outcome possible and according to our requirements.
To start with, some considerations:
- No credentials or secrets in application code
- Secure applications
- Secure containers
- Secure infrastructure
- No seceret or credentials in source
Securing Code Quality and Security
Looking after your code quality benefits the security of it too, some practices to conduct:
- No direct pushes to the stable/master branch
- Pull request and peer-reviews
- Branch Policies
- Build validation
- Respository Policies
Now, in terms in securing the pipelines:
- Access control mechanisms
- Access rights to the pipeline itself
- Access rights to the pipeline connections
- Who configures and runs the pipelines
- Store secrets in a safe place.
- Approval steps
The key here is to exercise proper access control mechanisms around the pipelines, factoring in the different actions we can take on them and who should be able to use them and to what extent.
Finally, some key takeaways:
- Introducing security early in the process.
- Security resources and people are limited, automation is the key!
- CI/CD Pipelines are the heart of Security
- Integrate Security into the CI/CD Pipelne
- Secure the CI/CD Pipelnes