NCSC: Defending software build pipelines from malicious attack
Syndicated By Iain Fraser Cybersecurity Journalist - Gibraltar
Compromise of software build pipeline can have wide-reaching impact; here's how to tackle the problem.
Security for software developers is something the NCSC is often asked about, but one area often overlooked is the software build process. This blog explains why your build pipeline is one of the foundations of your system security, and why you should give it particular attention. See our guidance for the other security aspects of build process security, like code reviews and secrets management.
The benefits of automation
Automated build pipelines, like those used in CI/CD (continuous integration/continuous delivery or deployment), can be a great way to secure the building and deployment of software.
The NCSC's (National Cyber Security Centre) https://www.ncsc.gov.uk/ Secure development and deployment guidance describes how automation can give much greater confidence in the consistency and repeatability of security controls, and produce detailed log and audit data. As we discuss in principle 6 of the guidance, it's crucial that the pipeline is well-defended, and that it protects each build from other builds in the pipeline. If an attacker compromises other systems, they may use lateral movement to target your build pipeline. If any builds are compromised, poor isolation between builds may lead to the compromise of more important builds.
It's also important to ensure that you have a clear chain of custody from source code to build artefact, so that you can be confident that all of the pipeline's checks have been applied, with nothing added or changed after the checks. Learn More/...
About NCSC
Helping to make the UK the safest place to live and work online.
We support the most critical organisations in the UK, the wider public sector, industry, SMEs as well as the general public. When incidents do occur, we provide effective incident response to minimise harm to the UK, help with recovery, and learn lessons for the future. Learn More/...
Image Credit: Brian Cantoni/Flickr
