{"id":4850,"date":"2022-12-12T08:30:38","date_gmt":"2022-12-12T13:30:38","guid":{"rendered":"https:\/\/solutionsreview.com\/network-monitoring\/?p=4850"},"modified":"2022-12-12T10:48:07","modified_gmt":"2022-12-12T15:48:07","slug":"software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/network-monitoring\/software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines\/","title":{"rendered":"Software Supply Chains are Only as Secure as Their CI\/CD Pipelines"},"content":{"rendered":"

\"CI\/CD\"<\/p>\n

As part of Solutions Review\u2019s Premium Content Series\u2014a collection of contributed columns written by industry experts in maturing software categories\u2014 Taylor Smith of Palo Alto Networks<\/a> barrels into CI\/CD pipelines, software supply chains, and why you need to equally secure both.<\/strong><\/em><\/p>\n

\"SRAs part of the rapid shift to the public cloud, organizations have worked diligently to enable engineers to develop and enhance their applications through continuous integration and continuous development (CI\/CD) infrastructure and processes. And as we\u2019ve seen with Log4j, attackers have recognized this as an opportunity to exploit common pipeline weaknesses and instigate widespread attacks. With the rise of open-source software, thanks to the increased efficiency and time savings organizations benefit from leveraging open source, much of the focus has rightfully shifted to where code comes from and how to secure it. But another, equally critical component is often overlooked: securing all the applications and third-party tools used in the software development pipeline.<\/p>\n

Before exploring ways to mitigate attacks on the CI\/CD pipeline, we must first understand how these environments are built and where the most common weaknesses are. Modern cloud-native applications are constructed in CI\/CD pipelines consisting of many repos, registries, frameworks, languages, third-party components, and dependencies. This gives organizations the ability to build smaller, more modular components that interact with one another, ultimately forming a larger and more robust application ecosystem. Building in this fashion, in tandem with using the CI\/CD pipeline workflow, allows the engineering teams to quickly create, update, and patch singular components instead of having to start completely from scratch. With this process, the finished product is offered to customers as a set of containerized entities made up of an application\u2019s supporting infrastructures.<\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/p>\n

The CI\/CD Infrastructure and Software Supply Chain Connection<\/strong><\/h2>\n
\n

This is where threat actors come into play. Some attackers will deliberately target the CI\/CD pipeline by inserting malicious code into the application\u2019s containerized ecosystem. In many cases, the attacker will leverage the CI\/CD pipeline to send poisoned plugins or applications to downstream organizations. This results in exponential growth of compromised environments. While this type of CI\/CD pipeline exploit can be devastating, there are ways to protect against it.<\/p>\n

Limiting Access<\/strong><\/h3>\n

Access should be granted to internal CI repositories only to the developers working within those specific CI repositories, and all changes should be reviewed, version controlled, and audited. While this is a best practice across most systems within an organization, it\u2019s especially critical here. Oftentimes attackers will take advantage of security keys hardcoded in repositories or leverage code injection to exfiltrate the secret, especially if access is granted too generously within a repository. Since these are literally the keys to critical environments like production cloud accounts, access to them must be safeguarded– especially if they correspond to privileged roles. Additionally, access should be limited to the CI\/CD pipeline itself to a select group of system admins for emergencies and maintenance only. Once in place, organizations should also lock down access to, and the permissions of secrets used to deploy code in the continuous deployment phase of CI\/CD pipelines. Limiting access to only the repositories required for a particular job helps prevent leaks of sensitive data.<\/p>\n

Ensure secure posture of CI\/CD pipelines<\/strong><\/h3>\n

CI\/CD pipelines and version control systems (VCS) can be the target of attacks. Insecure configurations of these critical tools, such as allowing code injections in pipelines or allowing force pushes to repositories, leave you open to code injection for malware or sensitive data exfiltration. Make sure that the configuration of your systems has proper branch protection rules and configurations to prevent these attacks.<\/p>\n

Regularly Scan for Vulnerabilities and Misconfigurations<\/strong><\/h3>\n

Scanning containers and infrastructure as code (IaC) templates for both misconfigurations and vulnerabilities should be done throughout the development cycle, not just as a one-and-done exercise. Typically, bad actors attempt to gain access to a vendor\u2019s cloud infrastructure by leveraging weaknesses in the cloud resource configurations and known vulnerabilities running in applications. Initial access usually involves taking advantage of a combination of vulnerabilities and misconfigurations within a vendor\u2019s cloud-hosted applications. By regularly scanning your repositories, containers, and IaC templates, organizations can identify, block, and patch vulnerabilities quickly and often, which ultimately prevents malicious actors from finding footholds in their environment.<\/p>\n

Implement Drift Detection<\/strong><\/h3>\n

The process of alerting security teams to the modification of containers or cloud resources without the matching update for the underlying code is known as drift detection. Implementing drift detection functionality across all IaC, container images, and more provides organizations with centralized visibility and policy controls. Engineering teams can follow secure GitOps processes to secure their full stack from code to cloud.<\/p>\n

Monitor for Behavior Changes<\/strong><\/h3>\n

It\u2019s a best practice to keep a close eye on CI\/CD infrastructure for changes from developers and network traffic patterns, particularly for anomalies. This can help identify a poisoned CI pipeline, which could be leveraged in an attack, such as by building backdoor functionality into an application\u2019s components. Monitoring should be ongoing, and suspicious activity should be reported and responded to promptly.<\/p>\n

Conclusion<\/strong><\/h3>\n

As we have seen, attacks that have made major headlines can have profound impacts \u2014 these even brought about an unprecedented presidential Executive Order and guidance from government officials and agencies for how organizations need to improve their security posture. There is a clear call for everyone involved \u2014 from individual developers to large organizations \u2014 to take proactive action to protect their software supply chains. It\u2019s critical to take the proper steps to ensure that software is secured at every point of the development process.<\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/p>\n","protected":false},"excerpt":{"rendered":"

As part of Solutions Review\u2019s Premium Content Series\u2014a collection of contributed columns written by industry experts in maturing software categories\u2014 Taylor Smith of Palo Alto Networks barrels into CI\/CD pipelines, software supply chains, and why you need to equally secure both. As part of the rapid shift to the public cloud, organizations have worked diligently […]<\/p>\n","protected":false},"author":438,"featured_media":4851,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1,21],"tags":[1796,84,217,744,1507,1944,1945],"acf":[],"yoast_head":"\nSoftware Supply Chains are Only as Secure as Their CI\/CD Pipelines<\/title>\n<meta name=\"description\" content=\"Taylor Smith of Palo Alto Networks barrels into CI\/CD pipelines, software supply chains, and why you need to equally secure both.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/network-monitoring\/software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Software Supply Chains are Only as Secure as Their CI\/CD Pipelines\" \/>\n<meta property=\"og:description\" content=\"Taylor Smith of Palo Alto Networks barrels into CI\/CD pipelines, software supply chains, and why you need to equally secure both.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/network-monitoring\/software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines\/\" \/>\n<meta property=\"og:site_name\" content=\"Best Network Monitoring Vendors, Software, Tools and Performance Solutions\" \/>\n<meta property=\"article:published_time\" content=\"2022-12-12T13:30:38+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-12-12T15:48:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2022\/12\/Organizations-Software-Supply-Chains-are-Only-as-Secure-as-their-CI-CD-Pipelines.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Taylor Smith\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Taylor Smith\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines\/\",\"url\":\"https:\/\/solutionsreview.com\/network-monitoring\/software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines\/\",\"name\":\"Software Supply Chains are Only as Secure as Their CI\/CD Pipelines\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2022\/12\/Organizations-Software-Supply-Chains-are-Only-as-Secure-as-their-CI-CD-Pipelines.jpg\",\"datePublished\":\"2022-12-12T13:30:38+00:00\",\"dateModified\":\"2022-12-12T15:48:07+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/4496df7390dec85e046c48c489c4474c\"},\"description\":\"Taylor Smith of Palo Alto Networks barrels into CI\/CD pipelines, software supply chains, and why you need to equally secure both.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/network-monitoring\/software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2022\/12\/Organizations-Software-Supply-Chains-are-Only-as-Secure-as-their-CI-CD-Pipelines.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/network-monitoring\/files\/2022\/12\/Organizations-Software-Supply-Chains-are-Only-as-Secure-as-their-CI-CD-Pipelines.jpg\",\"width\":800,\"height\":400,\"caption\":\"CI\/CD\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/network-monitoring\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Software Supply Chains are Only as Secure as Their CI\/CD Pipelines\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#website\",\"url\":\"https:\/\/solutionsreview.com\/network-monitoring\/\",\"name\":\"Best Network Monitoring Vendors, Software, Tools and Performance Solutions\",\"description\":\"Solutions Review Network Monitoring\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/network-monitoring\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/4496df7390dec85e046c48c489c4474c\",\"name\":\"Taylor Smith\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/eed6d709956b3c1eba5f6259bcb05d23?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/eed6d709956b3c1eba5f6259bcb05d23?s=96&d=mm&r=g\",\"caption\":\"Taylor Smith\"},\"description\":\"Taylor Smith is a senior product manager for Prisma Cloud at Palo Alto Networks, covering code security. He helps customers integrate security into DevOps practices to secure the entire cloud-native stack. Previously, he held product and strategy positions at Gremlin, Cisco and NetApp.\",\"url\":\"https:\/\/solutionsreview.com\/network-monitoring\/author\/tsmith\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Software Supply Chains are Only as Secure as Their CI\/CD Pipelines","description":"Taylor Smith of Palo Alto Networks barrels into CI\/CD pipelines, software supply chains, and why you need to equally secure both.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/network-monitoring\/software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines\/","og_locale":"en_US","og_type":"article","og_title":"Software Supply Chains are Only as Secure as Their CI\/CD Pipelines","og_description":"Taylor Smith of Palo Alto Networks barrels into CI\/CD pipelines, software supply chains, and why you need to equally secure both.","og_url":"https:\/\/solutionsreview.com\/network-monitoring\/software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines\/","og_site_name":"Best Network Monitoring Vendors, Software, Tools and Performance Solutions","article_published_time":"2022-12-12T13:30:38+00:00","article_modified_time":"2022-12-12T15:48:07+00:00","og_image":[{"width":800,"height":400,"url":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2022\/12\/Organizations-Software-Supply-Chains-are-Only-as-Secure-as-their-CI-CD-Pipelines.jpg","type":"image\/jpeg"}],"author":"Taylor Smith","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Taylor Smith","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/network-monitoring\/software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines\/","url":"https:\/\/solutionsreview.com\/network-monitoring\/software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines\/","name":"Software Supply Chains are Only as Secure as Their CI\/CD Pipelines","isPartOf":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2022\/12\/Organizations-Software-Supply-Chains-are-Only-as-Secure-as-their-CI-CD-Pipelines.jpg","datePublished":"2022-12-12T13:30:38+00:00","dateModified":"2022-12-12T15:48:07+00:00","author":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/4496df7390dec85e046c48c489c4474c"},"description":"Taylor Smith of Palo Alto Networks barrels into CI\/CD pipelines, software supply chains, and why you need to equally secure both.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/network-monitoring\/software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/network-monitoring\/software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/network-monitoring\/software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines\/#primaryimage","url":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2022\/12\/Organizations-Software-Supply-Chains-are-Only-as-Secure-as-their-CI-CD-Pipelines.jpg","contentUrl":"https:\/\/solutionsreview.com\/network-monitoring\/files\/2022\/12\/Organizations-Software-Supply-Chains-are-Only-as-Secure-as-their-CI-CD-Pipelines.jpg","width":800,"height":400,"caption":"CI\/CD"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/network-monitoring\/software-supply-chains-are-only-as-secure-as-their-ci-cd-pipelines\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/network-monitoring\/"},{"@type":"ListItem","position":2,"name":"Software Supply Chains are Only as Secure as Their CI\/CD Pipelines"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/network-monitoring\/#website","url":"https:\/\/solutionsreview.com\/network-monitoring\/","name":"Best Network Monitoring Vendors, Software, Tools and Performance Solutions","description":"Solutions Review Network Monitoring","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/network-monitoring\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/4496df7390dec85e046c48c489c4474c","name":"Taylor Smith","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/network-monitoring\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/eed6d709956b3c1eba5f6259bcb05d23?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/eed6d709956b3c1eba5f6259bcb05d23?s=96&d=mm&r=g","caption":"Taylor Smith"},"description":"Taylor Smith is a senior product manager for Prisma Cloud at Palo Alto Networks, covering code security. He helps customers integrate security into DevOps practices to secure the entire cloud-native stack. Previously, he held product and strategy positions at Gremlin, Cisco and NetApp.","url":"https:\/\/solutionsreview.com\/network-monitoring\/author\/tsmith\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/posts\/4850"}],"collection":[{"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/users\/438"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/comments?post=4850"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/posts\/4850\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/media\/4851"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/media?parent=4850"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/categories?post=4850"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/network-monitoring\/wp-json\/wp\/v2\/tags?post=4850"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}