Understanding pipeline security – what you have to consider to secure your CI/CD pipelines
Assuming the platform team does have influence or jurisdiction over GitHub or other source control repositories leveraged by the company, then the security of the CI/CD pipelines end to end becomes a major part of the IDP security posture.
Securing your repo
The security of the code repository is an excellent example of security to the left. By enforcing security norms early and baking them into the way of working on a project, an organization can prevent issues from arising down the line. A secured repository leverages several best practices:
- Write protect main branches
- You can use private Git repositories and self-hosted Git if you need extra security
- Require signed commits
- This validates the identity of the commit author
- Pre-commit webhooks
- Used to validate that no secrets are accidentally committed
- Mandatory peer review
- Including signoff by code owners
- Automated...
