Red Hat SummitOverview
CI/CD security is used to safeguard code pipelines with automated checks and testing to prevent vulnerabilities in software delivery. Incorporating security into your pipeline helps to protect code from attack, prevent data leaks, comply with policies, and ensure quality assurance.
What is CI/CD?
CI/CD (continuous integration, continuous delivery, and continuous deployment) is a series of steps, often visualized as a pipeline, that must be performed in order to deliver a new version of software. CI/CD introduces automation and continuous monitoring to app development with the goal of minimizing human error and maintaining a process for developing high quality code, faster.
Typically, the core stages of the CI/CD pipeline do not include security measures, which means that additional steps should be taken to safeguard the development process.
What are common CI/CD security challenges?
The rapid nature of development and deployment without proper security can expose the pipeline to risks, such as:
- Exposure of sensitive data to outside sources
- Use of insecure code or third party components
- Unauthorized access to source code repositories or build tools
Identifying and mitigating vulnerabilities throughout the development cycle assures that code changes are thoroughly tested and adhere to security standards before being deployed to production.
Why is CI/CD important to DevSecOps?
DevSecOps (development, security, and operations) is an approach to culture, automation, and platform design that integrates security as a shared responsibility throughout the entire IT lifecycle. A key component of DevSecOps is the introduction of a secure CI/CD pipeline.
CI/CD is critical to DevSecOps because it automates and embeds security checks early in the development process, ensuring rapid feedback regarding potential vulnerabilities, thus facilitating a proactive approach to security throughout the lifecycle of the application.
The concept of “shifting left” is a fundamental principle in CI/CD and DevSecOps that involves moving certain security-oriented tasks and activities earlier in the software development process. This practice of implementing security early on includes automating testing processes that scan for security vulnerabilities, reviewing code changes as soon as they’re committed, and fostering an overall culture of proactive security awareness among developers and operations teams.
How to secure a CI/CD pipeline
Planning phase: It’s important to include security checks at each phase of the pipeline to ensure that your code is secure and compliant with security standards. The first step is to develop a product roadmap, which will help identify potential security threats. This is known as threat modeling. In threat modeling, potential vulnerabilities are identified and countermeasures are set in place to mitigate those risks.
Coding: As developers begin writing code, take measures to make sure that the code is written in accordance with predefined standards and design guidelines. Use source code scanners to detect pieces of code that might be vulnerable to security threats.
Building: As developers begin committing their source code to a shared repository, make sure that automated tests are triggered to verify that the builds comply with requirements.
Testing: Once a build is successful, test the software for bugs. If new features are added on, more automated testing is performed.
How Red Hat can help
Red Hat® OpenShift® allows organizations to employ CI/CD to automate the build, test, and deployment stages of applications across on-premises and public cloud platforms. Red Hat OpenShift and Red Hat Ansible® Automation Platform, together with partner technologies, create a foundation for DevSecOps and help you address security challenges across your container application life cycle, including development, deployment, and runtime.
To keep your business running smoothly, it’s crucial to protect the software supply chain from potential vulnerabilities. However, software supply chain security for cloud-native applications can require months of effort by large teams of engineers and developers. Red Hat Trusted Software Supply Chain is a suite of security solutions that focuses on the security of software components and dependencies early in the software development lifecycle, and well into the build and release pipelines to audit and act on security issues. We use DevSecOps practices to integrate security guardrails for faster time to value at every phase of the software factory--moving from inconsistent, manual processes to consistent, repeatable, and automated operations. When businesses increase their resiliency in the software supply chain, they keep and grow their user trust.
Red Hat Advanced Cluster Security (ACS) for Kubernetes is the pioneering Kubernetes-native security platform, equipping organizations to more securely build, deploy, and run cloud-native applications. The solution helps protect containerized Kubernetes workloads in all major clouds and hybrid platforms, including Red Hat OpenShift, Amazon Elastic Kubernetes Service (EKS), Microsoft Azure Kubernetes Service (AKS), and Google Kubernetes Engine (GKE).
Red Hat Trusted Application Pipeline (in service preview) provides default pipeline definitions and automated security checks to generate Supply chain Levels for Software Artifacts (SLSA) Level 3 build images from application code across a variety of programming languages. The build includes creating an attested, immutable Software Bill of Materials (SBOM) that automatically creates a chain of trust for your open source components and transitive dependencies.
