CI/CD Security Risks

Here are some references around the Security aspects on CI/CD -

GitHub link to OWASP Top 10 Security Risks standards : https://github.com/cider-security-research/top-10-cicd-security-risks

PHP Compromise : https://github.com/cncf/tag-security/blob/main/supply-chain-security/compromises/2021/php.md

Travis CI Vulnerability : https://www.openraven.com/blog/analyzing-the-travis-ci-attack-and-exposure-of-developer-secrets

Poisoned Pipeline Execution (PPE) : https://medium.com/cider-sec/ppe-poisoned-pipeline-execution-34f4e8d0d4e9

StackOverflow breach : https://stackoverflow.blog/2021/01/25/a-deeper-dive-into-our-may-2019-security-incident/

Codecov breach : https://blog.gitguardian.com/codecov-supply-chain-breach/

Dependency Confusion : https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

Credential Hygiene in CI/CD : https://www.cidersecurity.io/blog/research/optimizing-ci-cd-credential-hygiene-a-comparison-of-ci-cd-solutions/

CI/CD Goat (A repo that allows you to setup a mock environment to try out different attacks on CI/CD made as a deliberately vulnerable environment) : https://github.com/cider-security-research/cicd-goat

Security on Google Cloud Platform : https://cloud.google.com/blog/topics/developers-practitioners/google-cloud-security-overview