Continuous Integration and Continuous Delivery
Continuous Integration and Continuous Delivery (CI/CD), as covered in Chapter 20, Software Development Life Cycle Security, is a development, security, and operations (DevSecOps) process that integrates frequent code changes into a central repository. Deployments are automated and enable faster and more reliable updates, as shown in Figure 21.2. This agile practice includes collaboration with stakeholders, monitoring quality, and continuous feedback.
CI/CD can introduce automated scanning tools into the pipeline, uncovering vulnerabilities before applications make it into production. However, these integrated systems can introduce their own security concerns.
DevOps and DevSecOps make use of code repositories such as GitHub that open code to exploitation if not secured properly with techniques such as multi-factor authentication. Automated build scripts should also be properly managed to ensure no misconfigurations that open up vulnerabilities...
