<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.xxmsonormal, li.xxmsonormal, div.xxmsonormal
{mso-style-name:xxmsonormal;
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.contentpasted0
{mso-style-name:contentpasted0;}
span.xxcontentpasted0
{mso-style-name:xxcontentpasted0;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">FYSA<o:p></o:p></p>
<div>
<p class="xxmsonormal"><span class="contentpasted0"><span style="color:black"> </span></span><span style="color:black"> <o:p></o:p></span></p>
<p class="xxmsonormal"><span class="contentpasted0"><span style="color:black">Today, the Cybersecurity and Infrastructure Security Agency (CISA) and National Security Agency (NSA) published a
<a href="https://media.defense.gov/2023/Jun/28/2003249466/-1/-1/0/CSI_DEFENDING_CI_CD_ENVIRONMENTS.PDF">
joint Cybersecurity Information Sheet</a> (CSI) titled, “Defending Continuous Integration/Continuous Delivery Environment,” which can help organizations improve their defenses in cloud implementations of development, security, and operations (DevSecOps). Specifically,
this joint guide explains how to integrate security best practices into typical software development and operations (DevOps) CI/CD environments, without regard for the specific tools being adapted. </span></span><span style="color:black"> <o:p></o:p></span></p>
<p class="xxmsonormal"><span class="contentpasted0"><span style="color:black"> </span></span><span style="color:black"> <o:p></o:p></span></p>
<p class="xxmsonormal"><span class="contentpasted0"><span style="color:black">The CI/CD environment is a development process for quickly building and testing code changes that helps organizations maintain a consistent code base for their applications while
dynamically integrating code changes. Also, it is a key part of the development, security, and operations (DevSecOps) approach that integrates security and automation throughout the development lifecycle. </span></span><span style="color:black"> <o:p></o:p></span></p>
<p class="xxmsonormal"><span class="contentpasted0"><span style="color:black"> </span></span><span style="color:black"> <o:p></o:p></span></p>
<p class="xxmsonormal"><span class="contentpasted0"><span style="color:black">Recognizing the various types of security threats that could affect CI/CD operations and taking steps to defend against each one are both critical to securing a CI/CD environment.
Organizations will find in this guide a list of common risks found in CI/CD pipelines and attack surfaces that could be exploited and threaten network security.</span></span><span class="xxcontentpasted0"><span style="color:black"> </span></span><span class="contentpasted0"><span style="color:black"> </span></span><span style="color:black"> <o:p></o:p></span></p>
<p class="xxmsonormal"><span class="contentpasted0"><span style="color:black"> </span></span><span style="color:black"> <o:p></o:p></span></p>
<p class="xxmsonormal"><span class="contentpasted0"><span style="color:black">The recommended actions for securing CI/CD pipeline include applying mitigations into the development process, development environment, and authentication and access phases, which
are outlined in detail in this guide. Organizations should be aware that applying a zero trust approach, where no user, endpoint device, or process is fully trusted, will help detect and prevent successful compromise by a malicious cyber actor.</span></span><span class="xxcontentpasted0"><span style="color:black">
</span></span><span class="contentpasted0"><span style="color:black"> </span></span><span style="color:black"> <o:p></o:p></span></p>
<p class="xxmsonormal"><span class="contentpasted0"><span style="color:black"> </span></span><span style="color:black"> <o:p></o:p></span></p>
<p class="xxmsonormal"><span class="contentpasted0"><span style="color:black">Read the
<a href="https://media.defense.gov/2023/Jun/28/2003249466/-1/-1/0/CSI_DEFENDING_CI_CD_ENVIRONMENTS.PDF">
joint CSI</a> for a complete overview of the security risks, attack surface, as well as recommended mitigations to protect against this threat.</span></span><span class="xxcontentpasted0"><span style="color:black"> </span></span><span class="contentpasted0"><span style="color:black"> </span></span><span style="color:black"> <o:p></o:p></span></p>
<p class="xxmsonormal"><span class="contentpasted0"><span style="color:black"> </span></span><span style="color:black"> <o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span style="color:#1F497D">Theresa A. Masse<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cybersecurity State Coordinator/Advisor, Region 10 (Oregon)
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Cybersecurity and Infrastructure Security Agency<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Department of Homeland Security<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Phone: (503) 930-5671
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;color:#1F497D">Email:</span><span style="font-size:10.0pt;color:#777777">
</span><a href="mailto:theresa.masse@cisa.dhs.gov"><span style="font-size:10.0pt;color:#0563C1">theresa.masse@cisa.dhs.gov</span></a><u><span style="font-size:10.0pt;color:#0760C1"><o:p></o:p></span></u></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><img border="0" width="97" height="97" style="width:1.0138in;height:1.0138in" id="Picture_x0020_2" src="cid:image001.png@01D9A9AE.453364E0"><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
</body>
</html>