{"id":27556,"date":"2025-09-16T09:49:14","date_gmt":"2025-09-16T08:49:14","guid":{"rendered":"https:\/\/www.riskinsight-wavestone.com\/?p=27556"},"modified":"2026-04-29T13:44:50","modified_gmt":"2026-04-29T12:44:50","slug":"ci-cd-the-new-cornerstone-of-the-information-system","status":"publish","type":"post","link":"https:\/\/www.riskinsight-wavestone.com\/en\/2025\/09\/ci-cd-the-new-cornerstone-of-the-information-system\/","title":{"rendered":"CI\/CD: the new cornerstone of the Information system?\u00a0"},"content":{"rendered":"\n

Since the massive rise of DevOps, <\/span>continuous integration<\/span><\/b> and <\/span>deployment<\/span><\/b> (CI\/CD) pipelines have become essential to automate application development cycles. <\/span>Continuous Integration<\/span><\/b> (CI) involves merging and testing code automatically, while <\/span>Continuous Deployment<\/span><\/b> (CD) automates the entire process of releasing that code into production, ensuring it runs properly in its target environment.<\/span>\u00a0<\/span><\/p>\n

Attacks targeting these supply chains have opened a new perimeter of risk in information systems. Breaches can lead to intellectual property theft, tampering with source code, service disruption, and privilege escalation into more critical parts of the IT landscape.<\/span>\u00a0<\/span><\/p>\n

What are the <\/span>new<\/span><\/b> attack<\/span><\/b> vectors<\/span><\/b> in CI\/CD pipelines, and how can they be <\/span>contained<\/span><\/b>? This article reviews real-world compromise scenarios and provides recommendations to defend against them.<\/span>\u00a0<\/span><\/p>\n

\u00a0<\/h1>\n

What risks for CI\/CD pipelines?<\/span><\/b>\u00a0<\/span><\/h1>\n

\u00a0<\/p>\n

The 2020 <\/span>SolarWinds<\/span><\/b> breach is very often cited as CI\/CD compromise, as it revealed the true scale of that such an attack can cause. After supposedly stealing FTP credentials left in plaintext in an old GitHub repository, attackers poisoned SolarWinds\u2019 supply chain by inserting a C2 beacon into Orion, its network management software, before the signing process.<\/span>\u00a0<\/span><\/p>\n

This backdoor gave adversaries <\/span>months<\/span><\/b> of <\/span>undetected<\/span><\/b> access<\/span><\/b> to the internal networks of U.S. government agencies and private companies.<\/span>\u00a0<\/span><\/p>\n

Incidents like this, along with more recent ones such as Log4Shell, Codecov, and XZ Utils, highlight not only the need for stronger CI\/CD security but also for a more adaptive incident response. OWASP published a dedicated overview for CI\/CD Security in their <\/span>Top 10<\/span><\/a>, mapping out the most common areas of risk.<\/span>\u00a0<\/span><\/p>\n

\"Fig<\/span><\/p>\n

Figure 1 \u2013 Top 10 OWASP CICD-Sec<\/span><\/i>\u00a0<\/span><\/p>\n

\u00a0<\/h1>\n

Field insights @ Wavestone<\/span><\/b><\/h1>\n

\u00a0<\/span><\/h1>\n

Audits<\/span><\/b> and <\/span>penetration tests<\/span><\/b> help identify vulnerabilities proactively before attackers can exploit them. By simulating real-world attacks, these assessments provide concrete visibility into how systems can be compromised.<\/span>\u00a0<\/span><\/p>\n

Our recent client engagements have led to clear findings:<\/span>\u00a0<\/span><\/p>\n