Securing CI/CD Pipelines Against Supply Chain Attacks

{
  "title": "Securing CI/CD Pipelines Against Supply Chain Attacks",
  "description": "Best practices for safeguarding continuous integration and deployment pipelines from malicious code injections and unauthorized access.",
  "category": "Security",
  "category_context": "Flags unsafe code, secrets, and insecure configurations.",
  "rules": [
    {
      "id": "ci_cd_secrets_management",
      "description": "Ensure that secrets such as API keys, passwords, and tokens are not hardcoded in the codebase.",
      "severity": "error",
      "pattern": "(?i)(api_key|password|token|secret)\\s*=\\s*['\"][^'\"]+['\"]",
      "recommendation": "Use environment variables or secure secrets management tools to handle sensitive information."
    },
    {
      "id": "ci_cd_dependency_vulnerability",
      "description": "Identify and flag dependencies with known vulnerabilities.",
      "severity": "error",
      "pattern": ".*",
      "recommendation": "Regularly update dependencies and use automated tools to scan for vulnerabilities.",
      "tools": ["Snyk", "Dependabot"]
    },
    {
      "id": "ci_cd_access_control",
      "description": "Ensure that access controls follow the principle of least privilege.",
      "severity": "warning",
      "pattern": ".*",
      "recommendation": "Implement Role-Based Access Control (RBAC) to grant users only the permissions necessary for their role."
    },
    {
      "id": "ci_cd_logging_monitoring",
      "description": "Verify that comprehensive logging and monitoring are implemented.",
      "severity": "warning",
      "pattern": ".*",
      "recommendation": "Integrate monitoring tools to detect and respond to security incidents promptly."
    },
    {
      "id": "ci_cd_immutable_infrastructure",
      "description": "Ensure that infrastructure is defined as code and is immutable.",
      "severity": "warning",
      "pattern": ".*",
      "recommendation": "Use Infrastructure as Code (IaC) tools to define and manage infrastructure, ensuring consistency and reducing attack vectors."
    }
  ]
}