CI/CD Pipeline Security
Cloud SecurityDefinition
Security controls applied to continuous integration and deployment pipelines to prevent unauthorized code injection, credential theft, secrets exposure, and distribution of malicious build artifacts.
Technical Details
CI/CD pipelines are high-value targets because compromising them grants code signing authority and deployment access. Key controls include: pipeline-as-code review, secret scanning in commits, ephemeral build environments, least-privilege service accounts, signed artifact provenance (SLSA), branch protection rules, and runtime integrity verification of build tools. OWASP's CI/CD Security Top 10 provides a structured risk framework.
Practical Usage
Security teams should audit CI/CD configuration files (GitHub Actions workflows, Jenkinsfiles) for hardcoded credentials, over-privileged tokens, and use of third-party actions without pinned SHAs. Implementing required code review, artifact signing, and deployment approval gates significantly reduces pipeline attack surface.
Examples
- An attacker compromises a widely-used GitHub Action to steal GITHUB_TOKEN credentials from downstream pipelines.
- A developer accidentally commits AWS credentials to a public repository; automated secret scanning detects and revokes them within minutes.
- A build server's SolarWinds-style compromise injects a backdoor into every software package built and distributed from it.