DEVOURED
CI/CD security: threat modeling using a MITRE-style threat matrix
CI/CD systems, from SCM to deployment, present a broad attack surface where misconfigurations or compromised credentials can let attackers modify pipelines, access secrets, and exfiltrate data, as detailed in a new MITRE-style threat matrix.
What: Datadog introduced a MITRE ATT&CK-style threat matrix specifically for CI/CD systems, covering SCM, CI, and CD. It outlines attack paths where adversaries can exploit vulnerabilities like overly permissive SCM access or third-party integrations to inject malicious code, exfiltrate data, or deploy cryptomining workloads.
Why it matters: As software supply chain attacks become more prevalent, developers need a structured approach to understand and mitigate risks within their automated delivery pipelines, moving beyond general security frameworks to CI/CD-specific threat intelligence.
Takeaway: Review your organization's CI/CD configurations, especially SCM access policies and third-party integrations, using a structured threat modeling approach to identify potential attack vectors.
Deep dive
- CI/CD security involves integrating security practices into the pipeline to prevent, detect, and respond to attacks targeting trust boundaries.
- The CI/CD trust boundary encompasses Source Code Management (SCM) tools (e.g., GitHub), Continuous Integration (CI) tools (e.g., Jenkins, GitHub Actions), and Continuous Deployment (CD) tools (e.g., AWS CodeDeploy).
- Modern CI/CD systems often define pipelines using configuration files stored in SCM, making SCM a critical entry point for attackers.
- Attackers can gain access through compromised developer credentials or vulnerable third-party integrations, leading to supply chain attacks.
- Datadog compiled a CI/CD-specific threat matrix, inspired by MITRE ATT&CK, that categorizes adversarial tactics like Reconnaissance, Initial Access, Execution, Persistence, Credential Access, Exfiltration, and Impact.
- An example attack path includes scanning public repos, exploiting vulnerable permissions to execute code via a pull request, modifying pipeline config, reading sensitive environment variables (e.g., GitHub token, AWS keys), exfiltrating data, and then deploying cryptomining.
- Threat modeling involves understanding the system, potential threats, and how the system responds, helping identify weak trust boundaries and security gaps.
- A simplified detection-based threat model involves identifying inputs/personas/infrastructure, assessing risks, mapping attack paths using the matrix, identifying log sources, and ideating detection workflows.
Decoder
- MITRE ATT&CK framework: A globally-accessible knowledge base of adversary tactics and techniques based on real-world observations, used as a foundation for the development of specific threat models and methodologies.
- SCM (Source Code Management): Systems for managing changes to source code over time, such as Git, GitHub, GitLab, and Bitbucket.
- CI/CD (Continuous Integration/Continuous Delivery): A methodology and set of practices that automate the stages of software delivery, from code integration to deployment.
- Threat modeling: A structured process for identifying potential threats, vulnerabilities, and attack vectors in a system or application, and then defining countermeasures to prevent or mitigate them.
Original article
Full article content is not available for inline reading.
Explore all 68 articles in today's digest
Fresh dev news, AI-digested daily. Never miss a trend at devoured.fyi