Poisoned Pipeline / Mitigations
Mitigations
126 controls referenced from technique pages. Some are technical (pinning, egress restriction, signing); some are process controls for living with a supplier compromise (notification clauses, supplier playbooks, tested fallback routes).
M1000Limit Publicly Available InformationM1001Avoid Predictable Naming ConventionsM1090Implement code and image signingM1110Implement contributor validationM1120Store credentials in vaultM1121Enable git hooks to find source code related issues earlyM1122Implement token management best practicesM1123Implement token access control and permissionsM1124Use token encryption and obfuscationM1130Implement password rotationM1131Disable or lock compromised accountsM1132Enable MFA for user accountsM1170Use parameterized queriesM1171Use stored proceduresM1172Use allow-list input validationM1173Escape all user supplied inputM1180Avoid calling OS commands directlyM1181Use parametrization with input validationM1182Implement least privilegeM1190Use framework security mechanismsM1191Escape all user supplied inputM1192Encode data outputM1193Use HTML sanitizationM1194Use content security policyM1200Verify package authenticityM1201Restrict egress traffic in CI/CDM1220Use only trusted third-party Github actions from reputable sourcesM1221Review the Github action source codeM1222Limit the permissions granted to third-party Github actionsM1230Secure API access controlM1231Implement Proper API documentationM1232Implement API endpoint hardeningM1240Enable data encryption at restM1241Use strong encryption algorithmsM1250Enable data encryption in transitM1260Implement least privilege accessM1261Implement proper access control for cloud storagesM1270Implement proper access control for databasesM1271Protect database credentialsM1272Audit server configurationM1280Implement least privilege network accessM1281Configure network security groupM1282Secure default configurationsM1290Double-checking package or container namesM1291Verify package or container sourcesM1300Implement log sanitizationM1301Implement log sanitizationM1302Implement strict access controls for logsM1310Implement least privilege principleM1311Implement multi-factor authenticationM1320Implement least privilege principle for containersM1321Container or runner hardeningM1322Container or runner agent runtime securityM1330Implement regular plugin updatesM1331Conduct plugin security reviewM1332Implement least privilege principle for pluginsM1340Implement regular account reviewM1440Review logging settingsM1441Implement centralized loggingM1450Implement zero trustM1451Use network segmentationM1480Limit the privileges of the runnerM1481Avoid using self-hosted runners for public repositoriesM1490Restrict the ability to delete repositoriesM1491Implement backup and recoveryM1500Verify third-party artifacts and open-source librariesM1501Require SBOM from all third-party suppliersM1502Define trusted package managers and repositoriesM1503Implement SCA analysisM1520Use security scanning toolsM1521Use containerizationM1530Use multi-factor authenticationM1531Implement endpoint security solutionsM1532Implement least privilege access controlsM1540Use trusted sourcesM1541Read reviews and ratingsM1542Check extension permissionsM1543Update extensions regularlyM1550Implement strict access control for cloudsM1551Use built-in security controlsM1560Regularly audit webhooksM1561Monitor outbound trafficM1562Implement access controls for webhooksM1563Use data encryption for webhooksM1580Restrict access to templatesM1581Template validationM1590Implement artifact signing and verificationM1591Validate dependenciesM1630Implement runtime encryptionM1660Isolate pipeline for unreviewed codeM1661Revoke user permissionsM1662Evaluate pipeline execution permissionsM1680Limit access to code repositoriesM1720Implement regular patches and updatesM1730Implement code reviewsM1731Implement verification of signed commitsM1732Implement code scanning for security risksM1740Establish guidelines for the use of SaaS applicationM1741Implement access controls and permissions for SaaS applicationsM1750Implement proper resource taggingM1751Implement resource management policiesM1752Regularly review and audit cloud resourcesM1760Regularly review and update security configurationsM1761Implement automated security toolsM1770Implement least privilege principle for serverless workloadsM1771Regularly review and update permissionsM1780Restrict access to machines with deploy keysM1781Use dedicated machines for deploy keysM1782Securely store private keysM1783Rotate deploy keys regularlyM1790Limit access to webhooksM1791Use secure communication channelsM1792Implement secure WebHook configurationsM1830Restrict token accessM1860Implement strong authentication mechanismsM1861Implement strong authorization mechanismsM1880Implement Anti-CSRF tokenM1881Enable SameSite cookiesM1882Implement Strict Referer PolicyM1883Implement Web Application FirewallM1890Encrypt secretsM1930Avoid storing sensitive information in environment variablesM1931Use a secure secrets management systemM1932Contract a supplier incident-notification clause with a reporting template and SLAM1933Keep a supplier-specific incident playbook with standing risk and access detailM1934Plan and test a fallback route for each critical supplier service