26 docs tagged with "cicd"

Recommendations for organisations with greater maturity in continuous training, automation and behavioural security.

High-maturity practices for the protection of pipelines, with a focus on governance, simulated attack and Zero Trust

Techniques to generate, sign and validate artefacts with trustworthy provenance, ensuring traceability from build to production.

Formal rules for allowing exceptions in the pipeline, with registration, approval, expiry date and visibility by function.

Objective verification checklist of the adoption of security practices in CI/CD pipelines

Validations of the pipeline's own code (YAML, scripts, linters), including control of logic, permissions and the use of external components.

Principles, practices and controls for building, validating and running images in a secure, auditable and traceable way

Principles, practices and controls to guarantee secure dependency management, SBOM generation and automated software composition analysis

Responsibilities of DevOps/SRE in the SbD-ToE

Specifics of exception management in the context of CI/CD pipelines - bypass of gates, visibility and metrics

How to apply secure CI/CD practices throughout the application lifecycle, with proportionality by risk, normalised user stories and auditable evidence

Technical and operational indicators for assessing the effectiveness of security controls in continuous integration and delivery pipelines, with thresholds by risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Set of recommended policies to sustain and legitimise the CI/CD security practices described in the chapter

Definition of automated policies in the pipeline with security gates that vary according to the risk level of the application.

Complete example of a CI/CD pipeline with execution of *containers* in a secure and validated environment

Risks introduced by pervasive automation in the CI/CD pipeline and the corresponding control, validation and evidence measures

Identification and mitigation of the risks introduced by automation in the chain of building, validation and execution of container images

Measures to segregate runners by application, avoid persistence and ensure ephemeral, controlled execution environments.

Assurance of secure and controlled execution of containers in pipelines and shared environments

Security practices for continuous integration and delivery pipelines, with a focus on automation, traceability and control proportional to risk

Rules for the secure construction and review of pipelines as code, with controlled triggers and predictable environments.

Strategies to protect secrets in pipelines, avoid hardcoding and ensure secure injection via vaults or variables.

Practices to protect branches, control changes and ensure traceable versioning of the code used in pipelines.

Integration of security validators (SAST, secrets, IaC, containers) directly into the pipeline, with mandatory execution.

Formal rules for allowing exceptions in the pipeline, with registration, approval, expiry date and visibility by function.

Ensure that each pipeline execution and each artefact can be traced back to the associated commit, origin and person responsible.