Follow me      Share me

Tags: security application software defense evasion techniques security misconfiguration devops opensource cyber hygiene checklist authentication

Developing and using cloud-based tools now allows previously siloed teams to share and work together easily, but they also pose a new type of security threat. In pivoting to CI/CD pipelines, organizations create a new attack vector that can expose their networks, IT infrastructure, and even source code to bad actors. Now, more than ever, an integrated and continuous approach to security is essential. Three components are essential to securing CI/CD pipelines and software release processes: 1. Humans 2. Security Process 3. Tools and Technologies These three aspects together, make up the only defense that will keep you vigilant. • Humans The process of building, testing, deploying, and securing your products is still very much a human process. The development teams must be trained on security awareness and procedures in order to secure their development environments. Teams within DevOps and Security must now work more closely together and establish collabrative practices. To achieve effective security solutions and processes, developers need to take more responsibility for security. People make the difference in the outcome of a misconfiguration mistake. The source code leak in this example resulted from leaving the default admin credentials in place due to a common misconfiguration. The incident shows how important and impactful developers are to a CI/CD pipeline's security posture. Code for Nissan leaked after a Git repository misconfiguration. During an interview with the Swiss tech news site, Tillie Kottmann said Nissan North America's misconfiguration of a BitbucketGit server resulted in the exposure of its mobile applications and internal tools. As part of the setup of Nissan's system, the developer should have modified the BitbucketGit credentials from the default admin/admin. Ideally, security teams should engage with DevOps and developers in order to understand the tool's vulnerabilities and have them contribute to the security process. While this a level of cooperation may take some time to develop, we are already seeing some results. • Security Process DevOps processes and CI/CD pipelines work quickly and change constantly, so security must be integrated by design, and move at the same pace. CI/CD's test-fast, fail-fast mantra must be applied to security processes. Integrating security into the DevOps process at the right time will maximize its effectiveness and create the cooperative environment required to make it successful. The attackers use the GitHub Actions automation workflow tool to mine cryptocurrencies on GitHub's servers in an automated attack on its servers. An attacker uses GitHub's own infrastructure to launch the attack, and the pull request instructs GitHub's servers to retrieve and run a crypto miner, mining cryptocurrency on the servers. For security to be effective and not delay development, security enforcement must be built into the DevOps process. CI/CD needs to incorporate security into its core and provide actionable information which is influenced by the understanding of the process and its outcomes. As a result, the development activities are enabled rather than blocked, increasing the development team's participation and adoption. • Tools & Technologies These tools and technologies are largely point solutions that offer limited security capabilities and do not interact with each other. In the most recent attack linked to Dependency confusion supply chains, a researcher has managed to breach the internal networks of over 35 major companies, including Microsoft, Apple, and many more. In addition to PyPI, npm, and RubyGems, the attackers uploaded malware to open-source repositories which were then automatically installed into internal applications. The researcher found an issue where an application's dependency package exists both in a public open-source repository and in a private build, however when the latter is available, the public package will get priority and is pulled instead - without any action required from the developer. Conclusion As shown in the above examples, the only way to create a strong security posture for development environments is to combine strong security measures with the right technology embedded into DevOps processes and to involve the development teams in enforcing them. It may be difficult to do, but there is a devOps-friendly security solution that can be set up quickly and seamlessly, engages the developers and has no additional work requirements. With the Argon CI/CD security solution, you can ensure the security of your DevOps pipelines from end to end, eliminating vulnerabilities and misconfigurations in your DevOps environment, as well as attacks within the supply chain. This software connects seamlessly with your development environment and enables an overview of the entire development process, including real-time alerts and auto-remediation to minimize your exposure.