Guide

CI/CD security testing: is your CI/CD pipeline compliant?

Fact: software vendors have an obligation to release secure software yet only 30% of organizations fully implement strong DevSecOps. Failure to do so can result in reputational damage or worse; companies may face stiff regulatory penalties or class action lawsuits. CISOs are clearly on the hook for the software their company sells as exemplified by the first-ever charges laid by the SEC against the SolarWinds Chief Information Security Officer for misleading investors about the company's cybersecurity practices. 

The SolarWinds hack taught us another important lesson about software supply chain security; there is no stage of the software development process that is inherently secure. In the case of the SUNBURST hack, attackers could inject malicious code into the application at compile time and distribute it via the normal software update channel. The attackers had compromised the SolarWinds DevOps.

Furthermore, the responsibility placed on software vendors will increase going forward. The European Cyber Resilience Act is a legal framework of cybersecurity requirements for commercial hardware and software products sold in the EU. The time is now for commercial software vendors to look carefully at their cybersecurity programs to ensure that they are effectively mitigating risk in their Development Operations (DevOps). 

What is CI/CD Security Testing?

CI/CD stands for Continuous Integration/Continuous Deployment (or Continuous Delivery), and refers to a software development model designed to improve a software development team's ability to integrate changes and deliver them to production environments. While the CI/CD pipeline is a key technical aspect of DevOps it is not the entirety of the DevOps philosophy. The "CI" stands for "Continuous Integration" which aims to streamline the process of merging code from multiple developers, pertaining to multiple features, and the testing of those code changes. Continuous Deployment (or Continuous Delivery) refers to the process that takes place after testing; essentially releasing the software to production.

Security testing is absolutely critical in the Software Development Life Cycle (SDLC). CI/CD Security Testing is an implementation of Application Security Testing (AST) that focuses on integrating security controls into the CI/CD pipeline. The goal is to ensure that malicious or accidental vulnerabilities are identified and remediated before the vendor's software is pushed to production. CI/CD Security Testing should ideally involve both automated and manual forms of security review similar to other forms of AST.

Unlike traditional penetration testing, which might occur semi-annually, CI/CD Security Testing is continuous in the sense that it happens iteratively within the CI/CD process every time there is a change to the codebase — for example, when new code is committed or merged, or when a new build is prepared for release.

Key Activities In CI/CD Security Testing

Securing the CI/CD Pipeline involves a robust strategy to mitigate potential security risks at various stages of application development and deployment. 

Some activities that are typically incorporated into a CI/CD security program include:

• Use Source Composition Analysis To Identify Risky Dependencies: Using third-party components is a common practice in application development. Source Composition Analysis (SCA) is crucial in this context as it helps identify and assess the security of these components. SCA tools scan the application's dependencies for known vulnerabilities, essential for preventing the integration of vulnerable code that could lead to supply chain attacks. This should be part of the build process so that any risky dependencies are identified early

• Implement SAST To Identify Risky Code: To ensure the security of the application from the onset, Static Application Security Testing (SAST) tools are employed. These tools analyze the source code for vulnerabilities that could be exploited if left unaddressed. By integrating SAST into the CI/CD pipeline, DevOps teams can spot and rectify such issues early in the development process, significantly reducing the cost and complexity of remediation

• Implement SAST To Identify Run-Time Errors And Edge Cases: Dynamic Application Security Testing (DAST) comes into play during the testing phase of the SDLC. Unlike SAST, DAST tools test the application in its running state, identifying security weaknesses that only manifest during operation. This phase is integral as it uncovers vulnerabilities that static analysis may not detect, ensuring a more comprehensive security evaluation before deployment

• Implementing Runtime Security Measures: Even with thorough testing, some vulnerabilities may slip through or emerge post-deployment. Runtime security solutions, such as Runtime Application Self-Protection (RASP), offer a safety net for such scenarios. RASP tools provide continuous monitoring and protection for applications in production, with the capability to identify and respond to threats in real time

Application Security Testing is a Team Effort

A combination of individuals and teams with specific expertise and responsibilities within an organization should conduct CI/CD security testing. 

Here is a breakdown of the roles that are typically involved:

• DevOps Engineers: Responsible for integrating security tools and processes into the CI/CD pipeline. They ensure that automated tests are executed with each build and deployment and manage the remediation of any discovered vulnerabilities

• Software Developers: Developers are responsible for writing secure code from the outset. They fix the vulnerabilities identified during security testing and often participate in security training to improve their coding practices

• Application Security Specialists: These professionals work closely with the DevOps team to select appropriate security testing tools, configure security tests, and interpret results from automated scanning tools

• Quality Assurance (QA) Engineers: QA teams are responsible for implementing and overseeing the testing phase of the software development lifecycle, which includes managing security testing to identify defects and vulnerabilities

• Penetration Testers: Skilled ethical hackers conduct penetration testing to simulate cyberattacks on the software or system. They help uncover vulnerabilities that automated tools may miss and provide insight into the practical implications of potential security flaws

• Compliance Officers: These individuals ensure that the CI/CD process and the product comply with relevant industry standards and regulatory requirements by integrating compliance checks into the pipeline and producing reports showing evidence of security controls

• Cloud Security Engineers: In cloud-based CI/CD pipelines, these engineers focus on securing the cloud infrastructure and deployment services that are part of the DevOps processes

• Third-Party Security Consultants: Sometimes, external experts are brought in to provide an unbiased assessment of the security posture or to supplement the internal team’s capabilities

• Chief Information Security Officer (CISO): The CISO oversees the broader security strategy and ensures that security testing is aligned with organizational risk management and security policies

Conclusion

The take-home message is unequivocal: securing the CI/CD pipeline is a high-stakes, multifaceted, and continuous endeavor that demands a culture of security awareness and collaboration across all levels of the organization. We've seen firsthand from the SUNBURST hack how a DevOps process can be exploited and in a new first, a security chief is being held liable for cybersecurity fraud. Evolving security regulations will certainly continue to place more responsibility on software vendors to ensure their products are secure, exemplified by responses to the hostile cybersecurity landscape such as the European Cyber Resilience Act. 

Penetration testing within the CI/CD pipeline is set to become a fundamental part of the software development lifecycle and organizations need to be prepared. By automating security tests and integrating them into every phase of development and deployment, organizations can adopt a proactive and compliant stance on identifying and mitigating risks to themselves and their downstream clients.

Are you looking to transform your organization's security posture? Download our Buyer's Guide today or reach out to our team for your free, zero-obligation quote.