An ATT&CK-like threat matrix mapping adversary tactics and techniques specific to CI/CD pipeline security.
The Common Threat Matrix for CI/CD Pipeline is a security framework that maps adversary tactics and techniques specific to continuous integration and delivery environments. It provides a structured approach to identifying and mitigating risks across the entire CI/CD pipeline, from source code repositories to production deployments. The matrix helps organizations understand the full attack surface beyond just supply-chain attacks.
Security engineers, DevSecOps teams, platform engineers, and developers responsible for securing CI/CD pipelines in organizations using services like GitHub Actions, CircleCI, GitLab CI, and cloud deployments.
This project offers the first ATT&CK-like framework specifically tailored for CI/CD security, providing a comprehensive threat model that goes beyond typical supply-chain concerns. It delivers actionable mitigation strategies mapped to real CI/CD components, helping teams implement defense-in-depth for their software delivery pipelines.
Threat matrix for CI/CD Pipeline
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Adopts the MITRE ATT&CK classification framework, making it familiar and credible for security professionals. The README explicitly states it uses the same classification as ATT&CK.
Catalogs over 30 techniques across 10 categories like Initial Access and Exfiltration, ensuring a broad view of CI/CD threats. This is highlighted in the Key Features.
Each technique includes specific mitigation strategies mapped to CI/CD components such as Git Repository and Secret Manager. For example, mitigations for 'Modify CI/CD Configuration' include signed commits and audit logging.
Created and reviewed by Mercari's Security and Platform Teams based on practical experience, adding credibility. The Background section notes it was presented at CODE BLUE 2021.
It's a documentation framework without automation or integration capabilities, requiring manual effort to apply mitigations in real CI/CD systems. No tools or scripts are provided for implementation.
Primarily targets common cloud-based services like GitHub Actions and CircleCI, potentially overlooking on-premise or niche CI/CD tools. The Components table lists limited examples.
While mitigations are listed, there are no step-by-step instructions or code examples for implementing them, leaving teams to figure out the practical details on their own.