Secure a CI/CD process by protecting the whole path from source code to deployment—not just by adding a scanner. Map the system and its trust boundaries, restrict who can change or run privileged stages, isolate and enforce build policies, control dependencies and integrations, and verify an artifact’s origin and security evidence before deployment.
What does CI/CD security need to protect?
A CI/CD pipeline connects source repositories, automation servers, build workers, tools, dependencies, integrations, artifacts and deployment procedures. A weakness in any part can affect what reaches production. OWASP’s CI CD Security Cheat Sheet describes this connected system as an attractive target because its people, processes and technology widen the attack surface.
Start by mapping the route a change takes: who can submit or approve it, what automation processes it, which external components it uses, where its output is stored, and what authorizes deployment. Mark the points where trust changes—for example, when code enters a build worker, when packages are downloaded, or when an artifact is handed to a deployment process. That map shows where a compromised identity, unsafe change or untrusted component could cross into the next stage.
How should a team prioritize improvements?
Work from the boundaries that can change or authorize a release. For each control, identify who can modify it, whether it can be bypassed, what evidence it leaves, and who must respond to that evidence. This keeps a written policy from being mistaken for an enforced safeguard.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
#1 Best Overall
- Map assets and authority. List the repositories, pipeline definitions, build platforms, tools, dependencies, integrations, artifact stores and deployment mechanisms involved. Record which identities can change, approve, administer or execute each one.
- Reduce high-impact access. Treat source changes, pipeline configuration, secrets, build administration and deployment rights as distinct permissions. Limit privileged actions to the identities that need them, and make clear who may approve or execute sensitive stages.
- Set and enforce build policy. Define requirements for an isolated build platform, approved build tools, and authentication and authorization for people involved in builds. Enforce those requirements through an agent or other mechanism and a policy enforcement engine, as described in NIST SP 800-204D.
- Control external inputs. Pin package versions, check downloaded package integrity against a known-good hash or checksum, review dependency vulnerability details before merge, and assess the permissions and exposure of third-party integrations and plug-ins.
- Gate deployment on evidence. Require evidence that the artifact was produced by the established secure build process, along with vulnerability-scan evidence and attestations, before deployment.
- Assign ownership of findings. Decide who evaluates a finding’s severity, who can stop or approve a release, and who tracks remediation. A scan produces information; it does not resolve a vulnerability by itself.
Which risks call for different controls?
| Pipeline area | Risk to address | Control and evidence |
|---|---|---|
| Source and pipeline changes | An unauthorized or unsafe change can influence what the pipeline builds or deploys. | Define and narrow change, approval and execution permissions. Make privileged identities and stage approvals explicit. |
| Build platform and tools | A build can be affected by an inadequately contained environment or an unapproved tool. | Specify an isolated platform and approved tools; enforce the build policy. Evidence should show whether the build met that policy. |
| Dependencies and integrations | Package resolution or third-party code can introduce vulnerable or attacker-controlled behavior. | Pin versions, validate package integrity against a known-good hash or checksum, review dependency details before merge, and assess integration permissions. |
| Artifact and deployment | A deployment may accept an artifact whose origin or security status is unknown. | Require build-origin evidence, vulnerability-scan evidence and attestations before allowing deployment. |
How do you protect dependencies and integrations?
Third-party packages, plug-ins and integrations are part of the pipeline’s trust boundary. OWASP warns that dependency resolution can be abused to cause attacker-controlled code to execute. Pinning a package version makes the intended version explicit; checking its downloaded contents against a known-good hash or checksum helps establish that the received package matches the expected one. Neither check replaces review of whether the dependency is appropriate or vulnerable.
Before merge, make dependency vulnerability details available to reviewers, as NIST SP 800-204D recommends. Review the permissions an integration receives and what part of the pipeline it can affect. A security check on a package or integration is meaningful only if a team member can see its result and knows what action to take.
What is the difference between a vulnerability scan and provenance?
They answer different questions. A vulnerability scan reports what vulnerabilities were observed in an artifact or its components. Provenance evidence concerns how and where the artifact was produced, and whether it came from the established build process. Attestations can contribute evidence about the build and artifact. A scan result alone does not establish an artifact’s origin; origin evidence alone does not show that the artifact is free of known vulnerabilities.
Before deployment, use both kinds of evidence as gates: require that the artifact came from the approved build process and that the expected scan evidence and attestations are present. Specify who can override a failed or missing check, and make that decision visible rather than treating a successful pipeline status as proof of every security property.
Rank #3
What should a deployment gate check?
- Is the artifact the one produced by the established secure build process?
- Is the expected vulnerability-scan evidence available for that artifact?
- Are the required attestations present?
- Do the evidence and artifact correspond to the release being deployed?
- Who reviews a failed, missing or inconclusive check, and who is authorized to approve an exception?
NIST SP 800-204D describes requirements such as verifying that a container image was generated by the established secure build process and checking for vulnerability-scan evidence and attestations. The exact gate a team needs depends on its pipeline and deployment policy; the important distinction is to verify the artifact being deployed, not merely that some earlier job completed.
How do NIST’s secure-development publications fit?
NIST SP 800-204D, Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines, was published in February 2024. It outlines ways to integrate security measures into pipeline stages and maps recommended tasks to high-level practices in the Secure Software Development Framework (SSDF).
NIST’s final SP 800-218, Secure Software Development Framework (SSDF) Version 1.1, is dated February 2022. The NIST publications listing identifies SP 800-218 Rev. 1 / SSDF Version 1.2 as a draft released December 17, 2025; that listing does not make Version 1.2 a final standard. Check NIST’s publication record for the status applicable when adopting a standard.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.“Few software development life cycle (SDLC) models explicitly address software security in detail, so secure software development practices usually need to be added to each SDLC model to ensure that the software being developed is well secured.”
Recommended: PC Feels Slow? A Free Scan Shows What's Dragging Windows Down →Recommended: Update Every Outdated Driver on Your PC in One Scan - Free →Recommended: Fix Windows Errors and Clear Junk Files in Minutes - Free Scan →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.Best Value
How can a team tell whether its controls are working?
For each control, check whether it covers the intended boundary, is enforced, can be bypassed, produces usable evidence, and has an accountable responder. For example, a dependency scan that reports a vulnerable package but has no reviewer or remediation owner is detection without a response process. A documented build policy that the pipeline does not enforce is not an effective build gate.
OWASP’s CI CD Security Cheat Sheet supports a broad view of pipeline risk, including repositories, automation, deployment procedures, pipeline nodes and third-party code. NIST SP 800-204D adds pipeline-specific guidance on build policy, dependency review and artifact verification. Together, they point to a layered approach: limit who can alter the process, control what enters it, enforce how builds run, and verify what leaves it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
