https://github.com/aschmidt75/patterns-for-securing-software-delivery

Catalog of Patterns For Improving the Security of Software Delivery Systems
https://github.com/aschmidt75/patterns-for-securing-software-delivery

Last synced: 7 months ago
JSON representation

Catalog of Patterns For Improving the Security of Software Delivery Systems

• Host: GitHub
• URL: https://github.com/aschmidt75/patterns-for-securing-software-delivery
• Owner: aschmidt75
• Created: 2024-12-02T18:16:33.000Z (over 1 year ago)
• Default Branch: main
• Last Pushed: 2025-07-07T14:42:23.000Z (about 1 year ago)
• Last Synced: 2025-07-07T15:47:17.444Z (about 1 year ago)
• Size: 26.4 KB
• Stars: 0
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

README

          
# Patterns for Securing of Software Delivery

This repository aims to be catalog of patterns for improving the security of software delivery systems. Topics are around the Software Development Lifecycle (SDLC), DevSecOps and IT Security. 

It is based on *Common Weaknesses* of Mitre's Common Weakness Enumeration™, in particular [2024's CWE Top 25 Most Dangerous Software Weaknesses](https://cwe.mitre.org/top25/) as well as [CAPEC, the Common Attack Pattern Enumeration and Classification™](https://capec.mitre.org/index.html).

It also relates to [Supply-chain Levels for Software Artifacts, or SLSA](https://slsa.dev/), in particular to their specified [Supply Chain Threats](https://slsa.dev/spec/draft/threats-overview).

# Patterns

- [**01** - Separate Continuous Integration from Continuous Delivery Pipelines](./patterns/01%20CI%20CD%20Separation.md)

- [**02** - Review and Enforce proper Access Control and Least Privilege](./patterns/02%20Enforce%20Proper%20Access%20Control%20and%20Least%20Privilege%20in%20CICD%20Pipelines.md)

- [**03** - Consider Pull Model Deployments instead of Pushing Deployments](./patterns/03%20From%20Push%20to%20Pull%20model%20Deployment.md)

- [**04** - Secure Storage and Usage of Credentials in Pipelines](./patterns/04%20Secure%20Secrets%20Management.md)

- [**05** - Replace shell scripts by Pipeline extensions](./patterns/05%20Replace%20Shell%20Scripts%20by%20Extensions.md)

- [**06** - Harden Pipeline Code and Environments](./patterns/06%20Hardening%20Pipeline%20Code.md)

- [**07** - Manage Upstream Dependencies](./patterns/07%20Manage%20Upstream%20Dependencies.md)

# Supplementary Material

- [SDLC-related CAPEC entries](./supplementary/S01%20SDLC-related%20CAPEC.md)

# Additional References

- [bureado/awesome-software-supply-chain-security](https://github.com/bureado/awesome-software-supply-chain-security)

# License

(C)opyright 2024,2025 @aschmidt75

Licensed under [Creative Commons BY-SA 4.0](https://creativecommons.org/licenses/by-sa/4.0/)

 

CWE is a trademark of The MITRE Corporation. CAPEC is a trademark of The MITRE Corporation. SLSA is copyright by The Linux Foundation.