+4.2 General Security Recommendations
|
4.2 General Security Recommendations
Security controls should be applied end-to-end across the SBOM CI/CD pipeline to protect the main principles of confidentiality, integrity, availability, authenticity and non-repudiation. Table 7 presents indicative security controls to be taken into consideration when building the CI/CD pipelines and their purpose. | Lifecycle Phase | | Security control | Purpose | | All Phases | | Role-based Access Control (RBAC) | | Restrict access to repositories, CI/CD |
workflows, signing service and SBOM repositories based on least privilege. | Multi-factor Authentication (MFA) | Protect developer, administrator and CI/CD platform accounts from credential compromise. | | | Least Privilege | | Minimize permissions to users, service |
accounts and automation. | Secure Transport Layer | Protect communications between pipeline components using TLS 1.3 with certificate validation. | | | Audit Logging | | Record all pipeline activities, including |
generation, validation, signing events etc. | Security Event Alerting | Generate alerts for failed validations, signature failures and unauthorized access. | | Pipeline Integrity Protection | Protect CI/CD workflows from unauthorized modification through code review and branch protection. | | Configuration Management | Maintain version-controlled and approved configurations for pipeline components and security policies. | | Tool stack verification | Verify the integrity and provenance of SBOM generators, validators and supporting tools before execution. | | Generation | Trusted repositories | Retrieve dependencies only from authenticated and trusted registries or mirrors. |
| | Provenance Generation | | Generate verifiable build provenance linking source, build process, SBOM and software artifact. | | | Validation, Signing, | | Secure Secrets | | Store signing keys, API tokens and repository | | Store | | Management | | credentials in secure vaults where applicable. | | Signing, Store | | Artifact Binding | | | Cryptographically associate the SBOM with |
the software artifact it describes. | Store | Tamper-Evident Storage | | Store SBOMs and artifacts in immutable or version-controlled repositories with integrity protection. | | | | Repository Integrity | | Detect unauthorized changes to source code, | | | Monitoring | | artifacts or SBOM repositories. | | Store, Maintenance & Update | Version control | | | Maintain version history of software artifacts |
and associated SBOMs. | Backup and Recovery | Ensure SBOM repositories, signing material |
and audit logs can be recovered. Table 7 - Security Recommendations
1. Översikt
1.1 Referenser
1.2 Identifierade krav
1.3 Relaterade regleringar
2. Identifierade krav
3. Relaterade regleringar
Regleringar
| Källa |
Reglering |
- ENISA -
EN: Publications of the European Union Agency for Cybersecurity (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Unless otherwise noted, licensed under CC BY 4.0. Changes: divided into sections, converted into the GRCA format and linked to the EU legal acts they refer to; images and material of third parties are not reproduced. Only the versions published by ENISA are authoritative.
DE: Veröffentlichungen der Agentur der Europäischen Union für Cybersicherheit (ENISA), https://www.enisa.europa.eu/. © European Union Agency for Cybersecurity (ENISA). Soweit nicht anders vermerkt, lizenziert unter CC BY 4.0. Änderungen: in Abschnitte aufgeteilt, in das GRCA-Format umgewandelt und mit den EU-Rechtsakten verknüpft, auf die sie sich beziehen; Bilder und Material Dritter werden nicht wiedergegeben. Maßgeblich sind allein die von der ENISA veröffentlichten Fassungen.
|