Google Cloud and Mandiant outline safeguards for hardening CI/CD pipelines

Article Details

Defense Focus

Prevent, detect, and contain compromises across developer environments, repositories, dependencies, CI/CD pipelines, artifacts, and production deployments.

Detection Methods

• Monitor IDE process trees for anomalous file access, unexpected child processes, and unauthorized outbound connections.
• Scan local changes and repository pushes for exposed secrets; monitor repository API activity, force-pushes, and audit-history discrepancies.
• Screen new dependencies and container images at an internal proxy or registry, then continuously re-evaluate stored artifacts as vulnerabilities emerge.
• Use dependency reachability and known exploitation signals to prioritize vulnerability findings.
• Apply automated secret, application-code, dependency, container, dynamic-application, and cloud-posture scanning gates at the corresponding development and deployment stages.
• Verify artifact signatures, expected build identities, immutable digests, and signed software bills of materials before admission.
• Compare live cloud configuration with version-controlled infrastructure definitions and monitor runtime logs, metrics, and audit events.

Data Sources

• Developer endpoint and IDE process, file-access, and network telemetry
• Device compliance signals
• Repository API activity, branch history, and audit logs
• Package lockfiles and dependency inventories
• Package-registry and container-image scan results
• Build provenance, artifact signatures, digests, and signed software bills of materials
• CI/CD runner execution, cache-access, and network logs
• Cloud configuration, runtime logs, system metrics, and audit events

Rule Types

• Pre-commit and repository secret-scanning gates
• Static application security testing rules
• Software composition analysis and dependency-reachability checks
• Container and registry scanning policies
• Dynamic application security testing checks
• Infrastructure-as-Code and Policy-as-Code checks
• Artifact admission and signature-verification policies

Platforms

• Developer endpoints and isolated development environments
• Source-code repositories
• Internal package proxies and artifact registries
• CI/CD build runners
• Container and cloud production environments

Defensive Actions

• Restrict developer extensions to reviewed versions, scan for secrets before commits, and block repository access when device posture fails compliance checks.
• Require reviewed changes and automated checks before merging; restrict administrative bypasses and force-pushes.
• Replace persistent credentials with narrowly scoped, short-lived identities and protect developer authentication with hardware-backed credentials where possible.
• Pin dependencies, actions, and images to immutable versions, commits, or digests; enforce lockfile verification and a release-age cooldown for public packages.
• Route external components through an inspecting, quarantining internal proxy and separate internal repositories from public registries.
• Use single-use runners, restrict their outbound traffic, isolate build caches by branch privilege, and withhold secrets and deployment runners from unvetted pull-request code.
• Generate and sign build provenance and software bills of materials, and reject artifacts that fail identity, signature, or digest verification.
• Apply deployment admission checks, least-privilege runtime settings, network segmentation, and continuous configuration-integrity monitoring.