10 docs tagged with "pipeline"

Validations of the pipeline's own code (YAML, scripts, linters), including control of logic, permissions and the use of external components.

Organisational policy that defines the requirements, execution criteria, findings management and responsibilities for dynamic security testing (DAST) and fuzzing, proportional to the application's risk level.

Automated execution of security tests as part of CI/CD pipelines, with traceability and thresholds.

Technical and operational indicators for assessing the effectiveness of security controls in continuous integration and delivery pipelines, with thresholds by risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Complete example of a CI/CD pipeline with execution of *containers* in a secure and validated environment

Identification and mitigation of the risks introduced by automation in the chain of building, validation and execution of container images

Organisational policy that defines the requirements for the storage, injection, rotation, audit and revocation of secrets (keys, tokens, credentials, certificates) in applications, CI/CD pipelines, containers and infrastructure, proportional to the criticality level (L1, L2, L3).

Organisational policy that defines the security requirements for continuous integration and delivery pipelines, including mandatory gates, integrated scanners, environment separation, artefact signing, secrets management in the pipeline and promotion approvals, proportional to the criticality level (L1, L2, L3).

Canonical catalogue of security requirements for continuous integration and delivery pipelines (CIC-001 to CIC-010), with applicability by risk level and acceptance criteria for pipeline design, secrets management, runner isolation, artefact integrity and security gates.

Cross-cutting organisational policy that defines the traceability requirements between requirements, controls, validation evidence, build artefacts and operational events, ensuring that the security posture is auditable continuously and in proportion to the application's risk level.