Continuous Deployment

Automation is key to continuous deployment and security. Automate wherever you can automate. In addition, Jim Bird, author of “DevOpsSec: Securing Software Through Continuous Delivery,” recommends these activities:

• Do a threat model on the CI/CD pipeline. Look for weaknesses in the setup and controls, and gaps in auditing or logging.
• Harden the systems that host the source and build artifact repositories, the CI/CD servers, and the systems that host the configuration management, build, deployment, and release tools.
• Ensure that keys, credentials, and other secrets are protected. Get secrets out of scripts and source code and plaintext files, and use an audited, secure secrets manager.
• Secure access to the source and binary repos, and audit access to them.
• Implement access control across the entire toolchain.
• Change the build steps to sign binaries and other build artifacts to prevent tampering.
• Ensure that all systems are monitored as part of the production environment.