CI/CD Pipelines and Security Controls
Learn about security controls in CI/CD pipelines and how auditors evaluate automated deployment processes. Essential CISA exam knowledge.
Understanding CI/CD Pipelines
Continuous integration and continuous delivery (CI/CD) pipelines automate the process of building, testing, and deploying software. For CISA candidates, understanding CI/CD security is important because these pipelines are the backbone of modern software delivery and represent a critical control point for ensuring software quality and security.
Pipeline Architecture
A typical CI/CD pipeline consists of several stages:
- Source stage: Developers commit code to a version control system. This triggers the pipeline and creates an audit trail of all changes.
- Build stage: The application is compiled and packaged from source code. Build artifacts are versioned and stored for deployment.
- Test stage: Automated tests verify the application's functionality, security, and performance. Multiple test types may run including unit tests, integration tests, and security scans.
- Deploy stage: The tested application is deployed to target environments, progressing from development through staging to production.
Security Controls in CI/CD
Security must be embedded throughout the pipeline:
- Source code security: Branch protection rules prevent direct commits to main branches. Pull request reviews ensure multiple eyes examine every change. Secret scanning detects accidentally committed credentials.
- Build security: Build environments are isolated and ephemeral to prevent tampering. Dependencies are scanned for known vulnerabilities. Build artifacts are signed to ensure integrity.
- Testing security: Static application security testing (SAST) analyzes source code for vulnerabilities. Dynamic application security testing (DAST) tests running applications for exploitable weaknesses. Software composition analysis (SCA) identifies vulnerabilities in third-party libraries.
- Deployment security: Deployment approvals enforce segregation of duties. Environment configurations are managed through code and version controlled. Rollback procedures enable rapid recovery from failed deployments.
Pipeline Access Controls
Controlling who can modify the pipeline itself is critical. Pipeline-as-code configurations should be version controlled and reviewed with the same rigor as application code. Administrative access to the CI/CD platform should be restricted, and changes to pipeline configurations should generate alerts.
Supply Chain Security
CI/CD pipelines are vulnerable to supply chain attacks where malicious code is introduced through compromised dependencies or build tools. Controls include verifying dependency integrity through checksums, using private registries for approved packages, regularly updating dependencies to patch known vulnerabilities, and implementing software bill of materials (SBOM) practices.
Auditing CI/CD Pipelines
IS auditors should evaluate CI/CD pipelines by reviewing pipeline configurations and access controls, verifying that security testing is integrated and cannot be bypassed, confirming that deployment approvals are enforced, assessing artifact management and integrity controls, and validating that pipeline logs provide adequate audit trails.
CISA Exam Tips
For the CISA exam, understand the stages of a CI/CD pipeline, the security controls at each stage, and how automated pipelines address traditional change management requirements. Questions may present scenarios involving pipeline security gaps and ask what controls should be implemented.