1
10 steps
DevOps security extends beyond DevSecOps pipeline testing into the hardening of the delivery infrastructure itself. Compromised build agents, poisoned artifacts, or tampered deployment pipelines can silently ship malicious code to production. These steps help you secure the entire software delivery chain from commit to deployment.
Require pull request reviews, status checks, and signed commits on all production branches. Prevent force pushes and direct commits to main. Use GPG or SSH commit signing to verify author identity and prevent commit spoofing.
Use ephemeral, isolated build agents or containers that are provisioned fresh for each build and destroyed afterward. Never reuse build environments across projects or teams. This prevents cross-build contamination and limits the blast radius of a compromised build.
Sign all build artifacts (container images, binaries, packages) using cosign, Sigstore, or Notary. Verify artifact signatures in deployment pipelines before promoting to production. Implement SLSA (Supply-chain Levels for Software Artifacts) framework compliance.
Grant CI/CD service accounts only the minimum permissions required for their specific pipeline. Use short-lived, just-in-time credentials instead of long-lived tokens. Separate build, test, and deployment credentials with distinct permission scopes.
Treat pipeline configuration files (Jenkinsfile, .github/workflows, .gitlab-ci.yml) as production code. Require code review for all pipeline changes. Prevent pipeline modifications from untrusted sources and validate configuration integrity before execution.
Require manual approval or automated security gates before deploying to production environments. Implement canary deployments and automated rollback mechanisms. Separate staging and production deployment permissions to prevent unauthorized production changes.
Log all pipeline executions, credential usage, and artifact promotions. Alert on anomalous pipeline behavior such as unexpected secret access, unusual build times, or unauthorized configuration changes. Forward pipeline logs to SIEM for correlation with other security events.
Restrict artifact registry access to authenticated users and authorized pipelines only. Enable vulnerability scanning on all pushed artifacts. Implement retention policies to remove outdated or vulnerable artifacts. Use private registries for internal dependencies.
Apply the same security controls to IaC deployment pipelines as application code. Scan Terraform, CloudFormation, and Kubernetes manifests before deployment. Use plan/preview stages with manual approval for infrastructure changes. Track infrastructure drift and enforce state file security.
Reference third-party CI actions, orbs, and templates by full commit SHA instead of mutable tags. Maintain an allowlist of approved actions, use automated tools to propose pin updates, and set default workflow token permissions to read-only.