Poisoned Pipeline / Mitigations / M1860

M1860

Implement strong authentication mechanisms

Authentication is the process of verifying the identity of a user or entity accessing the SCM system.
Strong authentication typically involves using multiple factors to verify the user's identity, beyond just a username and password.
This may include factors such as something the user knows (e.g., password), something the user has (e.g., smart card or token), and something the user is (e.g., biometric data like fingerprint or facial recognition).
Multi-factor authentication (MFA) can significantly enhance the security of SCM systems by adding an additional layer of protection against unauthorized access.

Applies to

• T0199 Secret leak
• T0208 Compromise code-signing identity
• T0135 Vulnerable CICD system
• T0140 Harvest tokens from environment variables
• T0143 External user accounts
• T0149 Delete repositories
• T0134 Add user
• T0139 Resource hijacking
• T0173 Auto merge rules in SCM
• T0184 Harvesting sensitive information from files
• T0137 Weak authentication methods
• T0186 Source code leak
• T0121 Compromised legitimate artifact
• T0201 Customers compromised
• T0200 Proprietary data stolen

References

• https://docs.gitlab.com/ee/topics/authentication/
• https://docs.github.com/en/authentication
• https://about.gitlab.com/blog/2022/03/21/security-hygiene-best-practices-for-gitlab-users/