Evaluate pipeline security posture against OWASP CI/CD Top 10
Implementation Effort: Medium – Systematically reviewing workflows, identities, runners, and third-party integrations against all ten OWASP CI/CD risk categories is a structured assessment that draws on platform and security teams. User Impact: Low – The assessment is a review activity performed by security and platform teams; developers are not prompted or affected. Lifecycle Stage: Build
Overview
Evaluate your pipeline security posture against the OWASP CI/CD Top 10 by reviewing workflow definitions, identities, runner configurations, and third-party integrations.
CI/CD pipelines are high-value targets because they have privileged access to source code, secrets, cloud credentials, and production environments. The OWASP CI/CD Top 10 catalogs risks across flow control, identity and access management, dependency chain abuse, pipeline execution, pipeline-based access controls, credential hygiene, system configuration, third-party services, artifact integrity validation, and logging and visibility.
For practical assessment, group the official categories into three review areas: flow, identity, and supply chain controls (CICD-SEC-1, CICD-SEC-2, CICD-SEC-3, and CICD-SEC-5); execution environment and platform hardening (CICD-SEC-4, CICD-SEC-6, and CICD-SEC-7); and external integration, artifact, and monitoring controls (CICD-SEC-8, CICD-SEC-9, and CICD-SEC-10).
Evaluating pipeline security posture against this framework means systematically reviewing each risk category and mapping it to your organization's actual GitHub Actions workflows, Azure Pipelines definitions, service connections, runner configurations, and secret management practices.
Confirm that pipeline definitions can't be modified through pull requests without approval and that self-hosted runners are isolated from other workloads. Also verify that workflows triggered by forks or other untrusted pull requests cannot access secrets, write-enabled tokens, deployment environments, or reusable artifacts, and that privileged deployment workflows are isolated from untrusted build and test workflows.
Review whether service connections use federated credentials instead of stored secrets, whether third-party actions and tasks are pinned to immutable references, and whether audit logs capture all pipeline modifications.
For third-party integrations, inventory GitHub Apps, OAuth apps, webhooks, marketplace tasks, and other external CI/CD services. Require security review before adoption, validate least-privilege scopes, and periodically revalidate or decommission unused integrations. Microsoft Cloud Security Benchmark DevOps guidance and Azure Pipelines security guidance provide Microsoft-specific remediation patterns for these risks.
Organizations that do not perform this assessment operate with an unknown attack surface in the systems that have the most direct path to production. Without a systematic review, pipelines commonly accumulate permissions and trust relationships far beyond what their actual tasks require. By systematically reviewing pipeline identities, scopes, and trust relationships against a known risk catalog, this task supports Use least privilege access and Assume breach.
For security testing practices that complement this pipeline-focused assessment — including red team and blue team exercises, application penetration testing, and bug bounty programs — see the Security Operations pillar of the Zero Trust Workshop. Those practices operate at the application and platform level, but their findings should feed back into pipeline hardening priorities.