What is a CI/CD pipeline?
The purpose of CI/CD is to automate and streamline the software development process by making small changes and additions incrementally. It helps in pushing out features faster while preventing issues that could cause release delays — or worse, that could result in an application release being rolled back.
One domain that has a reputation for slowing things down is security. Taking care of security as early as possible (aka shifting security left) helps DevOps teams maintain the speed of their releases. As such, to preserve the value of CI/CD, the ideal security steps will not slow it down.
Why secure your CI/CD pipeline?
CI/CD is a vital part of developing and deploying cloud-native applications. It is both a conduit and a repository of assets that are critical to your organization. This makes it an attractive attack surface.
Some of the points that can be exploited by attackers are use of open source third party code. They can also come from using automation tools like GitHub actions and Jenkins. Even an image pulled from a well established registry can be a source of misconfigurations and vulnerabilities. Developers may also fail to follow best practices for code security, which increases the attack surface.
The goal is to detect issues as they arise, at a stage they can be easily fixed. When security, performance, and availability issues are detected after the product is complete or released, remediation can turn into a time-consuming and expensive process. Which is the direct opposite of what CI/CD seeks to achieve. Oftentimes, these issues are only discovered in production, which in the case of severe security flaws, can be catastrophic.
