Google Threat Intelligence • Mandiant Blueprint SDLC Defense-in-Depth

Proactive Defense: Hardening Code Pipelines & CI/CD Infrastructure

Threat Vectors
1. Tooling AbuseCompromising high-privilege scanners, utility libraries & AI dev tools
2. Workstation / IDE TheftMalicious extensions, typosquatted local dependencies
3. Pipeline ManipulationCache poisoning, OIDC token extraction & mutable tag subversion
1 Workstation & IDE

Endpoint Security

Lock down local engineering hosts, IDEs, and AI coding assistants.

Local Secret Scanning
Pre-commit hooks & IDE scanners to block secrets in commit; replace classic PATs with short-TTL fine-grained tokens.
EDR + UEM Integration
Monitor dev software integrations & enforce continuous device posture checks; auto-revoke SCM & pipeline access upon failure.
IDE Standardization
Approved IDEs, browser integrations, & version-pinned extensions only; block unverified marketplaces.
AI-Assisted Guardrails
Approved LLMs & AI agents only; vet MCP packages; exclude .env from context; maintain human-in-the-loop.
Isolated Dev Sandboxes
Containerized workspaces or network-isolated, golden-image VMs; block sensitive host mounts.
2 Source of Truth

Code Repositories

Enforce identity governance, immutable history, and strict dependency pinning.

Universal Identity & FIDO2
Company Managed Users (CMU) or SSO with phishing-resistant FIDO2 keys / passkeys; conditional access policies.
Strict Branch Protection
No direct-to-main; isolated feature branches; mandatory peer review & CI gates; disable admin bypass & force-push.
Credential Lifecycle
Hardware-backed SSH keys, JIT credential retrieval & short-lived, highly-scoped GitHub App tokens.
Dependency Security
Ban dynamic version ranges (^, ~, *); require verified lockfiles, & block curl | bash scripts.
SLSA Level 2+ Provenance
Generate Software Bill of Materials (SBOMs), enforce SLSA provenance checks & pair SCA with reachability.
3 Supply Chain Boundary

Artifact Management

Gate upstream packages and verify cryptographic integrity before ingestion.

Dependency Cooldowns
Enforce a 7-day release-age buffer (minimumReleaseAge) so upstream detects and pulls poisoned releases.
Registry Proxies & Quarantines
Route all public dependencies through an artifact registry proxy with quarantine screening & policy-driven approvals.
Vulnerability Scanning
Continuous artifact registry scanning prioritized via CISA KEV & reachability analysis; filter noise with VEX statements.
Identity-Bound Provenance
Cryptographic artifact signing bound to workflow OIDC identity & recorded in a transparency log; enforced at admission.
Immutable SHA-256 Referencing
Pin all container images (base, sidecars, init) & CI actions to immutable SHA-256 digests, never mutable tags.
4 Build & Automation

CI/CD Infrastructure

Eliminate runner persistence, isolate caches, and enforce least-privilege.

Ephemeral, Single-Use Runners
Destroy build VMs/containers after every job; restrict outbound egress to approved registries & repository APIs.
Pipeline & Cache Isolation
Block untrusted pull requests from secrets/runners without manual approval; isolate build caches by branch.
Least Privilege CI/CD
Federated ephemeral OIDC identities; no persistent secrets; read-only/null runner scopes; block credential inheritance.
Scanning Gates & Attestation
Automated quality control via early CI/CD scanning gates; halt deployments if defined criteria unmet.
Signed SBOM Attestations
Emit signed CycloneDX / SPDX SBOMs tied to artifact digest during build for tamper-evident attestations.
5 Production Runtime

Deployment & Live Infra

Enforce admission gates, immutable workloads, and active defense.

Admission Guardrails
Reject unsigned containers, unneeded root privileges, or images from untrusted registries at admission.
Immutable Workload Posture
Build workloads from distroless/hardened base images, read-only root filesystems, and zero SSH capabilities.
Active Application Protection
Block runtime exploits; shield AI workloads from prompt attacks; identity-aware network policies.
Just-In-Time (JIT) Access
Eliminate standing admin privileges; inject time-bound, task-scoped access credentials only at runtime.
Live Infrastructure Protection
Edge WAF/API gateways & load balancers, active posture scanning & continuous monitoring to revert IaC drift.

Automated Scanning Gates Across the Delivery Pipeline (Halt Deployment on Failure)

Shift-Left: Earliest Gate First →
GATE 1
Secret Scanning
Commit / PR: Block pushes with hardcoded API keys, passwords etc.
GATE 2
SAST Analysis
PR / Peer Review: Flag logic flaws & dangerous functions pre-merge
GATE 3
SCA Scanning
Build Phase: Scan lockfiles against vuln DBs; fail builds on known CVEs
GATE 4
Container Scan
Registry / Push: Reject critical OS vulns & default root access
GATE 5
DAST Simulation
Isolated Staging: Simulate SQLi / XSS against a temporary instance
GATE 6
CSPM & IaC Policy
Pre / Post-Deploy: Policy-as-Code IaC scan; block overprivileged IAM & SSH
Source: Google Threat Intelligence & Mandiant: Proactive Defense: Hardening Code Pipelines and CI/CD Infrastructure
Key Standards: OIDC / FIDO2 • SBOM • SLSA Level 2+ • CycloneDX / SPDX • CISA KEV • VEX • OSV