Secure CI/CD Pipelines

Info

ID: MS-M7008
MITRE mitigation: M1045

Protect continuous integration and continuous deployment pipelines with access controls, branch protection rules, mandatory code reviews, and secret scanning. Secure pipelines prevent unauthorized code from being deployed to production environments.

Techniques Addressed by Mitigation

ID	Name	Use
MS-TA7007	Using deployment credentials	Restrict access to CI/CD systems, enforce code review for pipeline changes, and use secret scanning tools to prevent credential leaks.
MS-TA7003	Code injection in connected repository	Protect build and deployment systems with access controls, branch protection, and mandatory code review requirements.
MS-TA7014	Source code modification	Protect build and deployment workflows from unauthorized changes with access controls and approval gates.
MS-TA7029	Defacement	Protect deployment workflows from unauthorized modifications that could alter application content.
MS-TA7004	Compromised image in registry	Placing gates in the CI/CD process can block pushing unsecured code to container images.