Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle Supply Chain

Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle Supply Chain

CI/CD pipeline and developer tool vulnerabilities can lead to significant data breaches and intellectual property theft.

Bottom line: CI/CD pipeline and developer tool vulnerabilities can lead to significant data breaches and intellectual property theft.

What's happening: Attackers are targeting the Jenkins, GitLab, and CircleCI CI/CD pipelines, as well as the developer tool, GitHub, for exploitation, with an estimated 20% of organizations using unpatched Jenkins versions (CVE-2021-20015) and a 10% increase in GitHub code repositories containing exposed credentials.

What to do: Implement a robust SDLC security posture by regularly scanning and monitoring Jenkins, GitLab, and CircleCI pipelines, and ensure GitHub repositories are secure by using a code review tool like Black Duck or CodeScene.

Source: Unit 42