Security of the Pipeline: Introduction to Pipeline Automation

In this article, I will be writing the write-up for the walkthrough of security of the pipeline specifically the introduction to pipeline automation in DevOps.

According to TryHackMe introduction to this room, humans are always looking for simpler and more efficient ways to do things. Just as we started programming and developing software, we were looking for ways to automate some of the tasks. Today, automation is heavily ingrained in the Software Development Life Cycle (SDLC) and DevOps processes. While this is incredibly good for production, allowing for faster development and deployment, it does, however, introduce new security risks. When these processes are manual, an attacker would have to compromise the credentials or workstation of the individual that performed the relevant process. However, with automation, an attacker can now go after the pipeline itself.

Where in the pipeline is our end product deployed? Environments
Who is the largest online provider of Git? Github
What popular Git product is used to host your own Git server? Gitlab
What tool can be used to scan the commits of a repo for sensitive information? GittyLeaks
What do we call the type of dependency that was created by our organisation? (Internal/External) Internal
What type of dependency is JQuery? (Internal/External) External
What is the name of Python's public dependency repo? PyPi
What dependency 0day vulnerability set the world ablaze in 2021? Log4j
What type of tool scans code to look for potential vulnerabilities? SAST
What type of tool runs code and injects test cases to look for potential vulnerabilities? DAST
Can SAST and DAST be used as a replacement for penetration tests? (Yea,Nay) Nay
What does CI in CI/CD stand for? Continuous Integration
What does CD in CI/CD stand for? Continuous Delivery
What do we call the build infrastructure element that controls all builds? Build Orchestrator
What do we call the build infrastructure element that performs the build? Build Agent
Which environment usually has the weakest security configuration? DEV
Which environment is used to test the application? UAT
Which environment is similar to PROD but is used to verify that everything is working before it is pushed to PROD? PrePROD
What is a common class of vulnerabilities that is discovered in PROD due to insecure code creeping in from DEV? Developer Bypasses
What is the flag received after successfully building your pipeline?THM{Pipeline.Automation.Is.Fun}

Thank you for reading through my article. You can leave any questions or comments on how I can improve my learning journey and the THM challenges.

Security of the Pipeline: Introduction to Pipeline Automation

Comments

More from this blog

Modern Web Stacks (TryHackMe)

Broken Authentication (TryHackMe)

HealthGPT (TryHackMe)

Token City - AI Odyssey CTF (TryHackMe)

Linux Privilege Escalation: Automation (TryHackMe)

Command Palette

Comments

More from this blog