{"id":13679059,"url":"https://github.com/rung/threat-matrix-cicd","last_synced_at":"2026-01-26T19:57:44.400Z","repository":{"id":37414214,"uuid":"418565888","full_name":"rung/threat-matrix-cicd","owner":"rung","description":"Threat matrix for CI/CD Pipeline","archived":false,"fork":false,"pushed_at":"2024-07-08T17:29:31.000Z","size":1225,"stargazers_count":739,"open_issues_count":2,"forks_count":90,"subscribers_count":25,"default_branch":"main","last_synced_at":"2024-11-11T21:38:11.635Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rung.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-10-18T15:41:19.000Z","updated_at":"2024-11-05T18:27:10.000Z","dependencies_parsed_at":"2024-11-11T21:32:32.384Z","dependency_job_id":"bac7809c-1e37-421b-a659-05442c17e5d6","html_url":"https://github.com/rung/threat-matrix-cicd","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rung%2Fthreat-matrix-cicd","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rung%2Fthreat-matrix-cicd/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rung%2Fthreat-matrix-cicd/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rung%2Fthreat-matrix-cicd/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rung","download_url":"https://codeload.github.com/rung/threat-matrix-cicd/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251540061,"owners_count":21605835,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-02T13:01:01.458Z","updated_at":"2026-01-26T19:57:39.349Z","avatar_url":"https://github.com/rung.png","language":null,"funding_links":[],"categories":["Others","Tutorials and Blogs","工具与代码库","Repositories","Similar Projects"],"sub_categories":["Paid","平台与工具安全专题","ArgoCD","Defense Evasion"],"readme":"# Common Threat Matrix for CI/CD Pipeline\nThis is an ATT\u0026CK-like matrix focus on CI/CD Pipeline specific risk.  \n[MITRE ATT\u0026CK®](https://attack.mitre.org/) is a knowledge base of adversary tactics and techniques.  \nTo map the threat of CI/CD Pipeline, I use the same classification as the framework.  \n(Feedback is welcome)  \n\n## Table of Contents\n- [Background](#background)\n- [Threat Matrix](#threat-matrix)\n- [Components of CI/CD](#components-of-cicd)\n- [Techniques and Mitigation](#techniques-and-mitigation)\n    - [Initial Access](#initial-access)\n    - [Execution](#execution)\n    - [Execution (Production)](#execution-production)\n    - [Persistence](#persistence)\n    - [Privilege Escalation](#privilege-escalation)\n    - [Defense Evasion](#defense-evasion)\n    - [Credential Access](#credential-access)\n    - [Lateral Movement](#lateral-movement)\n    - [Exfiltration](#exfiltration)\n    - [Impact](#impact)\n- [Common Question](#common-question)\n    - [Supply-chain attacks are the only risk of CI/CD pipeline, correct?](#supply-chain-attacks-are-the-only-risk-of-cicd-pipeline-correct)\n\n## Background\nThis threat map is published in conjunction to the presentation “[Attacking and Securing CI/CD Pipeline](https://speakerdeck.com/rung/cd-pipeline)” at CODE BLUE 2021 Opentalks.  \nThe purpose of this matrix is to share knowledge on securing CI/CD environments with Cybersecurity community.  \nThis matrix was created by Mercari Security Team, and reviewed by Platform Team.  \n\n\n## Threat Matrix\n![threat matrix](images/matrix.png \"threat matrix\")\n\n\n## Components of CI/CD\n![components](images/components.png \"components\")\n\n| Name                   | Tools                                                                                                                               |\n|------------------------|-------------------------------------------------------------------------------------------------------------------------------------|\n| Device                 | - Developer Workstation: Mac/Win/Cloud-based                                                                                        |\n| Git Repository Service | - GitHub, GitLab                                                                                                                    |\n| CI                     | - CI/CD Services (e.g. CircleCI, Cloud Build, Codebuild, GitHub Actions)                                                            |\n| CD                     | - CI/CD Services (e.g. CircleCI, Cloud Build, Codebuild, GitHub Actions) \u003cbr\u003e- CD Services (e.g. Spinnaker, ArgoCD)                 |\n| Secret Management      | - Secret Management Services (e.g. AWS Secret Manager, GCP Secret Manager, HashiCorp Vault)                                         |\n| Production environment | - Cloud Services (e.g AWS, Google Cloud, Microsoft Azure) \u003cbr\u003e- Other Resources (e.g. Container Registry, Linux Server, Kubernetes) |\n\n\n## Techniques and Mitigation\n### Initial Access\n\n\n\u003ctable\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eTechniques\n   \u003c/td\u003e\n   \u003ctd\u003eDescription\n   \u003c/td\u003e\n   \u003ctd\u003eMitigation\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eSupply Chain Compromise on CI/CD\n   \u003c/td\u003e\n   \u003ctd\u003eSupply Chain Attacks to Application Library, Tools, Container Images in CI/CD Pipelines.\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(CI, CD) Limit egress connection via Proxy or IP Restriction\n\n\u003cli\u003e(CI, CD) Audit Logging of the activities\n\n\u003cli\u003e(CI, CD) Security Monitoring using IDS/IPS, and EDR\n\n\u003cli\u003e(CI, CD) Check each tool’s Integrity\n\n\u003cli\u003e(CI, CD) Doesn’t allow untrusted libraries, tools\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eValid Account of Git Repository\n\u003cp\u003e\n(Personal Token, SSH key, Login password, Browser Cookie)\n   \u003c/td\u003e\n   \u003ctd\u003eUse developer’s credentials to access to Git Repository Service \\\n(Personal token, SSH key, browser cookie, or login password is stolen)\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(Device) Device security is out of scope\n\n\u003cli\u003e(Git Repository) Network Restriction\n\n\u003cli\u003e(Git Repository) Limit access permission of each developer (e.g. no write permission, limited read permission)\n\n\u003cli\u003e(CI, CD) Use GitHub App and enable IP restriction\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eValid Account of CI/CD Service\n\u003cp\u003e\n(Personal Token, Login password, Browser Cookie)\n   \u003c/td\u003e\n   \u003ctd\u003eUse SSH key or Tokens to access to CI/CD Service Servers directly\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(CI, CD) Strict access control to CI/CD pipeline servers\n\n\u003cli\u003e(CI, CD) Hardening CI/CD pipeline servers\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eValid Admin account of Server hosting Git Repository\n   \u003c/td\u003e\n   \u003ctd\u003eUse SSH key, Tokens to access to Server hosting Git Repository\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(Git Repository) Strict access control to server hosting Git Repository\n\n\u003cli\u003e(Git Repository) Hardening git repository servers\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n\u003c/table\u003e\n\n\n\n### Execution\n\n\n\u003ctable\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eTechniques\n   \u003c/td\u003e\n   \u003ctd\u003eDescription\n   \u003c/td\u003e\n   \u003ctd\u003eMitigation\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eModify CI/CD Configuration\n   \u003c/td\u003e\n   \u003ctd\u003eModify CI/CD Configuration on Git Repository\n\u003cp\u003e\n(CircleCI: .circleci/config.yml, CodeBuild: buildspec.yml, CloudBuild: cloudbuild.yaml, GitHub Actions: .github/workflows/*.yaml)\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(Git Repository) Only allow pushing of signed commits\n\n\u003cli\u003e(CI, CD) Disallow CI/CD config modification without review (CI/CD must not follow changes of a branch without review)\n\n\u003cli\u003e(CI, CD) Add signature to CI/CD config and verify it\n\n\u003cli\u003e(CI, CD) Limit egress connections via Proxy and IP restrictions\n\n\u003cli\u003e(CI, CD) Audit Logging of activities\n\n\u003cli\u003e(CI, CD) Security Monitoring using IDS/IPS, and EDR\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eInject code to IaC configuration\n   \u003c/td\u003e\n   \u003ctd\u003eFor example, Terraform allows code execution and file inclusion. The code is executed during CI(plan stage)\n\u003cp\u003e\nCode Execution: Provider installation(put provider binary with .tf), Use External provider \u003cbr\u003e\nFile inclusion: file Function\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(Git Repository) Only allow pushing of signed commits\n\n\u003cli\u003e(CI, CD) Restrict dangerous code through Policy as Code\n\n\u003cli\u003e(CI, CD) Restrict untrusted providers\n\n\u003cli\u003e(CI, CD) Limit egress connections via Proxy and IP restrictions\n\n\u003cli\u003e(CI, CD) Audit Logging of activities\n\n\u003cli\u003e(CI, CD) Security Monitoring using IDS/IPS, and EDR\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eInject code to source code\n   \u003c/td\u003e\n   \u003ctd\u003eApplication executes test code during CI\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(CI, CD) Restrict dangerous code through Policy as Code\n\n\u003cli\u003e(CI, CD) Limit egress connections via Proxy and IP restrictions\n\n\u003cli\u003e(CI, CD) Audit Logging of the activities\n\n\u003cli\u003e(CI, CD) Security Monitoring using IDS/IPS, and EDR\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eSupply Chain Compromise on CI/CD\n   \u003c/td\u003e\n   \u003ctd\u003e(Repeated)\n   \u003c/td\u003e\n   \u003ctd\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eInject bad dependency\n   \u003c/td\u003e\n   \u003ctd\u003eInject bad dependency\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(CI, CD) Code checks by SCA(Software composition analysis)\n\n\u003cli\u003e(CI, CD) Restrict untrusted libraries, and tools\n\n\u003cli\u003e(CI, CD) Limit egress connections via Proxy and IP restrictions\n\n\u003cli\u003e(CI, CD) Audit Logging of activities\n\n\u003cli\u003e(CI, CD) Security Monitoring using IDS/IPS, and EDR\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eSSH to CI/CD pipelines\n   \u003c/td\u003e\n   \u003ctd\u003eConnect to CI/CD pipeline servers via SSH or Valid Token\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(CI, CD) Implement strict access control to CI/CD pipeline servers\n\n\u003cli\u003e(CI, CD) Disallow SSH access\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n\u003c/table\u003e\n\n### Execution (Production)\n\n\n\u003ctable\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eTechniques\n   \u003c/td\u003e\n   \u003ctd\u003eDescription\n   \u003c/td\u003e\n   \u003ctd\u003eMitigation\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eModify the configuration of Production environment\n   \u003c/td\u003e\n   \u003ctd\u003eModify the configuration of Production environment via stolen credentials\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(Secret Manager) Rotate credentials regularly or issue temporary tokens only\n\n\u003cli\u003e(Production environment) Network Restriction to Cloud API\n\n\u003cli\u003e(Production environment) Enable Audit Logging\n\n\u003cli\u003e(Production environment) Security Monitoring of data access\n\n\u003cli\u003e(Production environment) Enforce principle of least privilege to issued credentials\n\n\u003cli\u003e(Production environment) Rate limiting\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eDeploy modified applications or server images to production environment\n   \u003c/td\u003e\n   \u003ctd\u003eDeploy modified applications or server images (e.g. container image, function, VM image) to production environment via stolen credentials\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(Secret Manager) Rotate credentials regularly or issue temporary tokens only\n\n\u003cli\u003e(Git Repository) Require multi-party approval(peer review)\n\n\u003cli\u003e(Production environment) Verify signature of artifacts\n\n\u003cli\u003e(Production environment) Network Restriction to Cloud API\n\n\u003cli\u003e(Production environment) Enable Audit Logging\n\n\u003cli\u003e(Production environment) Security Monitoring of deployment\n\n\u003cli\u003e(Production environment) Enforce principle of least privilege to issued credentials\n\n\u003cli\u003e(Production environment) Rate limiting\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n\u003c/table\u003e\n\n\n\n### Persistence\n\n\n\u003ctable\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eTechniques\n   \u003c/td\u003e\n   \u003ctd\u003eDescription\n   \u003c/td\u003e\n   \u003ctd\u003eMitigation\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eCompromise CI/CD Server\n   \u003c/td\u003e\n   \u003ctd\u003eCompromise CI/CD Server from pipeline\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(CI, CD) Clean environment created on every pipeline run\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eImplant CI/CD runner images\n   \u003c/td\u003e\n   \u003ctd\u003eImplant container images for CI/CD with malicious code to establish persistence\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003eUse signed/trusted CI runners only\n\n\u003cli\u003eImplement strict access controls to container registry\n\n\u003cli\u003e(CI, CD) Audit Logging of activities\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003e(Modify CI/CD Configuration)\n   \u003c/td\u003e\n   \u003ctd\u003e(Repeated)\n   \u003c/td\u003e\n   \u003ctd\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003e(Inject code to IaC configuration)\n   \u003c/td\u003e\n   \u003ctd\u003e(Repeated)\n   \u003c/td\u003e\n   \u003ctd\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003e(Inject code to source code)\n   \u003c/td\u003e\n   \u003ctd\u003e(Repeated)\n   \u003c/td\u003e\n   \u003ctd\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003e(Inject bad dependency)\n   \u003c/td\u003e\n   \u003ctd\u003e(Repeated)\n   \u003c/td\u003e\n   \u003ctd\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n\u003c/table\u003e\n\n\n\n### Privilege Escalation\n\n\n\u003ctable\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eTechniques\n   \u003c/td\u003e\n   \u003ctd\u003eDescription\n   \u003c/td\u003e\n   \u003ctd\u003eMitigation\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eGet credential for Deployment(CD) on CI stage\n   \u003c/td\u003e\n   \u003ctd\u003eGet high privilege credential in CI stage (not CD)\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(CI, CD) Limit the scope of credentials in each step.\n\n\u003cli\u003e(CI) Always enforce Least Privilege. CI(not CD) must not have credentials for deployment\n\n\u003cli\u003e(CI, CD) Use different Identities between CI and CD\n\n\u003cli\u003e(CI, CD) Maintain strong isolation between CI and CD\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003ePrivileged Escalation and compromise other CI/CD pipeline\n   \u003c/td\u003e\n   \u003ctd\u003ePrivilege Escalation from CI/CD Environment to other components\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(CI, CD) Hardening of CI/CD pipeline servers \n\n\u003cli\u003e(CI, CD) Isolate CI/CD pipeline from other systems.\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n\u003c/table\u003e\n\n\n\n### Defense Evasion\n\n\n\u003ctable\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eTechniques\n   \u003c/td\u003e\n   \u003ctd\u003eDescription\n   \u003c/td\u003e\n   \u003ctd\u003eMitigation\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eAdd Approver using Admin permission\n   \u003c/td\u003e\n   \u003ctd\u003eChange Approver using Git Repository Service Admin permission\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(Git Repository) Limit admin users\n\n\u003cli\u003e(Git Repository) Require multi-party approval(peer review)\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eBypass Review\n   \u003c/td\u003e\n   \u003ctd\u003eBypass Peer Review of Git Repository\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(Git Repository) Restrict repository admin from pushing to main branch without a review\n\n\u003cli\u003e(CD) Require additional approval from reviewer to kick CD\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eAccess to Secret Manager from CI/CD kicked by different repository\n   \u003c/td\u003e\n   \u003ctd\u003eUse a CI/CD system in a different repository to leverage stolen credentials to access secret manager\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(Secret Manager) Restrict and separate access from different workloads\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eModify Caches of CI/CD\n   \u003c/td\u003e\n   \u003ctd\u003eImplant bad code to caches of CI/CD pipeline\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(CI, CD) Clean environment on every pipeline run\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eImplant CI/CD runner images\n   \u003c/td\u003e\n   \u003ctd\u003e(Repeated)\n   \u003c/td\u003e\n   \u003ctd\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n\u003c/table\u003e\n\n\n\n### Credential Access\n\n\n\u003ctable\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eTechniques\n   \u003c/td\u003e\n   \u003ctd\u003eDescription\n   \u003c/td\u003e\n   \u003ctd\u003eMitigation\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eDumping Env Variables in CI/CD\n   \u003c/td\u003e\n   \u003ctd\u003eDump Environment Variables in CI/CD\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(CI, CD) Don’t use environment variables for storing credentials\n\n\u003cli\u003e(Secret Manager) Use secret manager which has network restriction\n\n\u003cli\u003e(Secret Manager) Enable Audit Logging\n\n\u003cli\u003e(Secret Manager) Security Monitoring to detect malicious activity\n\n\u003cli\u003e(Secret Manager) Rotate credentials regularly or issue temporary tokens only\n\n\u003cli\u003e(CI, CD) Enable Audit Logging\n\n\u003cli\u003e(CI, CD) Security Monitoring using IDS/IPS, and EDR\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eAccess to Cloud Metadata\n   \u003c/td\u003e\n   \u003ctd\u003eAccess to Cloud Metadata to get access token of Cloud resources\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(CI, CD) Restrict metadata access from suspicious processes\n\n\u003cli\u003e(Secret Manager) Use secret manager which has network restriction\n\n\u003cli\u003e(Secret Manager) Enable Audit Logging\n\n\u003cli\u003e(Secret Manager) Security Monitoring to detect malicious activity\n\n\u003cli\u003e(Secret Manager) Rotate credentials regularly or issue temporary tokens only\n\n\u003cli\u003e(CI, CD) Enable Audit Logging\n\n\u003cli\u003e(CI, CD) Security Monitoring using IDS/IPS, and EDR\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eRead credentials file\n   \u003c/td\u003e\n   \u003ctd\u003eRead credentials file mounted in CI/CD pipeline\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(CI, CD) Disable or mask contents of files in results of CI/CD\n\n\u003cli\u003e(Secret Manager) Use secret manager which has network restriction\n\n\u003cli\u003e(Secret Manager) Enable Audit Logging\n\n\u003cli\u003e(Secret Manager) Security Monitoring to detect malicious activity\n\n\u003cli\u003e(Secret Manager) Rotate credentials regularly or issue temporary tokens only\n\n\u003cli\u003e(CI, CD) Enable Audit Logging\n\n\u003cli\u003e(CI, CD) Security Monitoring using IDS/IPS, and EDR\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eGet credential from CI/CD Admin Console\n   \u003c/td\u003e\n   \u003ctd\u003eSee credential from CI/CD admin console\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(CI, CD) Doesn’t use CI/CD services that expose credentials from the system console\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n\u003c/table\u003e\n\n\n\n### Lateral Movement\n\n\n\u003ctable\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eTechniques\n   \u003c/td\u003e\n   \u003ctd\u003eDescription\n   \u003c/td\u003e\n   \u003ctd\u003eMitigation\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eExploitation of Remote Services\n   \u003c/td\u003e\n   \u003ctd\u003eExploit services from CI/CD Pipeline\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(CI, CD) Isolate CI/CD pipeline systems from other services\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003e(Monorepo) Get credential of different folder's context\n   \u003c/td\u003e\n   \u003ctd\u003eIn monorepo architecture of Git Repository, there are many approvers.\n\u003cp\u003e\nNeed to set access controls carefully\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(Git Repository) Set approver for each folder\n\n\u003cli\u003e(CI, CD, Secret Manager) Avoid sharing CI/CD environment and credentials between different folders. \n\n\u003cli\u003e(CI, CD) should be isolated by environment folder or context\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003ePrivileged Escalation and compromise other CI/CD pipeline\n\u003cp\u003e\n(Repeated)\n   \u003c/td\u003e\n   \u003ctd\u003e\n   \u003c/td\u003e\n   \u003ctd\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n\u003c/table\u003e\n\n\n\n### Exfiltration\n\n\n\u003ctable\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eTechniques\n   \u003c/td\u003e\n   \u003ctd\u003eDescription\n   \u003c/td\u003e\n   \u003ctd\u003eMitigation\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eExfiltrate data in Production environment\n   \u003c/td\u003e\n   \u003ctd\u003eExfiltrate data in Production environment via stolen credentials\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(CI/CD) Doesn’t put data access credential in CI/CD\n\n\u003cli\u003e(Production environment) Network Restriction to Cloud API\n\n\u003cli\u003e(Production environment) Enable Audit Logging\n\n\u003cli\u003e(Production environment) Security Monitoring of data access\n\n\u003cli\u003e(Production environment) Enforce principle of least privilege to issued credentials\n\n\u003cli\u003e(Production environment) Rate limiting\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eClone Git Repositories\n   \u003c/td\u003e\n   \u003ctd\u003eExfiltrate data from Git Repositories\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(Git Repository) Network Restriction\n\n\u003cli\u003e(Git Repository) Use temporary tokens instead of long life static tokens\n\n\u003cli\u003e(Git Repository) Limit access permission of each developer (e.g. no write permission, limited read permission)\n\n\u003cli\u003e(Git Repository) Enable Audit Logging\n\n\u003cli\u003e(Git Repository) Security Monitoring of data access\n\n\u003cli\u003e(Git Repository) Rate limiting\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n\u003c/table\u003e\n\n\n\n### Impact\n\n\n\u003ctable\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eTechniques\n   \u003c/td\u003e\n   \u003ctd\u003eDescription\n   \u003c/td\u003e\n   \u003ctd\u003eMitigation\n   \u003c/td\u003e\n  \u003c/tr\u003e\n  \u003ctr\u003e\n   \u003ctd\u003eDenial of Services\n   \u003c/td\u003e\n   \u003ctd\u003eDenial of Services of CI/CD pipeline\n   \u003c/td\u003e\n   \u003ctd\u003e\n\u003col\u003e\n\n\u003cli\u003e(CI, CD) Scalable Infrastructure\n\u003c/li\u003e\n\u003c/ol\u003e\n   \u003c/td\u003e\n  \u003c/tr\u003e\n\u003c/table\u003e\n\n  \n## Common Question\n### Supply-chain attacks are the only risk of CI/CD pipeline, correct?\n\nSupply-chain attacks are one of the most serious risks. But it is not the only risk for CI/CD Pipelines. The entire attack surface need to be considered. You can check my slide: “[Attacking and Securing CI/CD Pipeline](https://speakerdeck.com/rung/cd-pipeline)” to know risks of CI/CD pipeline\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frung%2Fthreat-matrix-cicd","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frung%2Fthreat-matrix-cicd","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frung%2Fthreat-matrix-cicd/lists"}