The U.S. National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) have issued a comprehensive set of guidelines aimed at defending continuous integration/continuous delivery (CI/CD) environments. bottom.
This guideline addresses the growing threat of malicious cyber attackers (MCAs) exploiting vulnerabilities in CI/CD pipelines, especially through secret exposure.
A CI/CD pipeline is essential to modern software development, enabling a seamless and efficient integration and deployment process. However, their reliance on secrets such as private keys and passwords for authentication purposes makes them prime targets for cyberattacks.
“Virtual cloud environments rely on software, making development and delivery a critical part of delivering services in the cloud,” said Dr. Ethan Givens, NSA’s Technical Director of Critical and Emerging Technologies. I am commenting.
“The failure to effectively defend the CI/CD pipeline can provide an attack vector that circumvents security policies and products.”
For more information on these attacks, see Human Error Driving Industrial APT Attacks, Kaspersky report.
This guideline covers MCA obtaining developer credentials to access Git repository services, compromising the supply chain of application libraries or container images in the CI/CD pipeline, and CI/CD performing configuration changes or injections. It highlights three major threat scenarios of environmental supply chain compromise. malicious dependencies.
This document recommends corresponding mitigations for each. This includes minimizing the use of long-term credentials, implementing his two-person rule (2PR) for code updates, securing user accounts, enforcing least privilege policies for CI/CD access, etc. .
Additionally, the guidelines emphasize the importance of secure code signing, network segmentation, regular vulnerability scanning, and integration of security measures across the CI/CD pipeline.
By implementing these recommendations, organizations can significantly strengthen the security posture of their CI/CD environment and reduce the risk of unauthorized access, supply chain compromise, and code injection attacks.
The new guidelines come weeks after a new report from cybersecurity firm Kaspersky suggested that almost half of computers in the industrial sector will be affected by malware by 2022.
