Full Report
Attackers are targeting CI/CD pipelines and developer tools instead of application code, requiring total SDLC visibility and strict security controls The post Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain appeared first on Unit 42.
Analysis Summary
# Best Practices: Securing the SDLC Supply Chain
## Overview
These practices address the shift in the threat landscape where attackers target the "plumbing" of software development—CI/CD pipelines, build tools, and developer environments—rather than just the final application code. The goal is to establish total visibility and integrity across the entire Software Development Lifecycle (SDLC).
## Key Recommendations
### Immediate Actions
1. **Enable Multi-Factor Authentication (MFA):** Enforce hardware-based or push-based MFA for all Version Control Systems (VCS) and CI/CD platform access.
2. **Audit Personal Access Tokens (PATs):** Identify and revoke over-privileged or indefinite PATs; transition to short-lived tokens where possible.
3. **Implement Branch Protection:** Require at least one independent code review and successful status checks (passing tests) before merging to main branches.
4. **Rotate Secrets:** Identify hardcoded secrets in repositories using automated scanners and rotate them immediately.
### Short-term Improvements (1-3 months)
1. **Enforce Principle of Least Privilege (PoLP):** Transition from "Admin" or "Owner" roles to granular permissions for both human users and Service Accounts.
2. **Infrastructure as Code (IaC) Scanning:** Integrate security scanning for Terraform, CloudFormation, or Kubernetes manifests directly into the CI/CD pipeline to catch misconfigurations before deployment.
3. **Pipeline Integrity Checks:** Use signed commits and verify the integrity of third-party actions/runners used in the build process.
4. **Establish a Software Bill of Materials (SBOM):** Begin generating SBOMs for every production build to track third-party dependencies.
### Long-term Strategy (3+ months)
1. **Adopt "Pipeline as Code":** Standardize pipeline definitions and store them in version control to allow for auditing and preventing "shadow" pipelines.
2. **Zero Trust for Build Runners:** Move to ephemeral, isolated build runners that are destroyed after every job to prevent lateral movement or persistence.
3. **Continuous Supply Chain Monitoring:** Implement tooling that provides real-time visibility from the moment a developer commits code to the point of production deployment.
## Implementation Guidance
### For Small Organizations
- Focus on native security features provided by platforms like GitHub, GitLab, or Bitbucket.
- Prioritize MFA and basic branch protection rules.
- Use free/open-source SCA (Software Composition Analysis) tools to track dependencies.
### For Medium Organizations
- Implement centralized secret management (e.g., HashiCorp Vault or Cloud-native secret managers).
- Automate IaC scanning and SCA within every pull request.
- Define a standard "Golden Pipeline" that all teams must use for production deployments.
### For Large Enterprises
- Deploy a unified security platform that "connects the dots" across multiple VCS providers and cloud environments.
- Implement automated policy enforcement (Policy as Code) to block non-compliant builds.
- Conduct regular red-team exercises specifically targeting the CI/CD infrastructure.
## Configuration Examples
**GitHub Branch Protection Rule (Example):**
- **Require a pull request before merging:** Enabled
- **Required number of approvals:** 1+
- **Dismiss stale pull request approvals when new commits are pushed:** Enabled
- **Require status checks to pass before merging:** Enabled (e.g., `unit-tests`, `security-scan`)
**Example Secret Masking (CI Config):**
- Ensure all CI logs are configured to mask environment variables labeled `SECRET_*` or `TOKEN_*` to prevent accidental exposure in build output.
## Compliance Alignment
- **NIST SP 800-218:** Secure Software Development Framework (SSDF).
- **SLSA (Supply-chain Levels for Software Artifacts):** Levels 1–4 for artifact integrity.
- **CIS Benchmarks:** For GitHub/GitLab and Kubernetes security configurations.
- **ISO/IEC 27001:** Controls for secure system engineering and development.
## Common Pitfalls to Avoid
- **Hardcoding Credentials:** Storing API keys or DB passwords in `.env` files or CI config files.
- **Over-privileged Build Agents:** Giving CI/CD runners `Administrator` access to the entire cloud environment.
- **Ignoring "Internal" Tools:** Assuming that because a Jenkins server or VCS is behind a VPN, it does not need strict access controls.
- **Dependency Confusion:** Failing to pin dependencies to specific versions or hashes, allowing attackers to inject malicious packages.
## Resources
- **SLSA Framework:** hxxps[://]slsa[.]dev
- **OWASP Top 10 CI/CD Security Risks:** hxxps[://]owasp[.]org/www-project-top-10-ci-cd-security-risks/
- **NIST SSDF:** hxxps[://]csrc[.]nist[.]gov/Projects/ssdf
- **Unit 42 Supply Chain Research:** hxxps[://]unit42[.]paloaltonetworks[.]com/