In the realm of Continuous Integration and Continuous Deployment (CI/CD), security is paramount. However, as organizations rapidly adopt CI/CD practices, several security risks emerge. Understanding and mitigating these risks is crucial to maintaining a secure and resilient software delivery pipeline. Below is a detailed exploration of the top 10 CI/CD security risks.

A few weeks ago, CDK Global, a software provider with 15,000 North American car dealership customers, faced back-to-back cyberattacks, effectively taking down scheduling, records, and more for their thousands of customers for days. The CDK Global attack is also the latest cyber incident to spur larger industry-wide conversations around the supply chain risks posed by increasingly ruthless and aggressive bad actors.

Dynamic Application Security Testing (DAST) is a type of security testing that actively exercises and inspects a web application for security vulnerabilities. A DAST scanner sends an assortment of payloads to the target application, typically through HTTP requests for web applications, then analyzes the responses and behavior to detect vulnerabilities. DAST is language and framework agnostic, allowing for security scans against any web application with careful configuration.

Did you know CFEngine has Macros? They were first introduced in CFEngine 3.7 (back in 2015), and more have been introduced since then. Macros are convenient for preventing the parsing of a section of the policy. It is handy for protecting older binaries from getting tripped up on newer syntax the agent does not understand. Let’s take a look. Currently there are 8 macros. You can find examples of use within the Masterfiles Policy Framework.

The faulty Rapid Response Content CrowdStrike update that disabled millions of Windows machines across the globe on 7/19/2024 was any IT professional’s nightmare. Having to manually visit and restore each affected machine (further complicated by BitLocker) severely limited the recovery speed, especially for businesses with remote locations, TVs, kiosks, etc.