Software Security Code of Practice - Implementation Guidance
Page 4 of 7
Theme 2: Build environment security
The build environment is an enticing prospect for attackers. The build environment is typically where code is compiled, built, and packaged into a deployable form. This would ideally be a different environment from a development environment where developers would write and test their code before pushing that through to a build environment. Security in the build environment includes tools such as build servers, compilers, internal repositories, and data such as configurations and metadata.
Securing the build environment will not only mitigate loss of service and data exfiltration, but will also help secure the supply chain by reducing the risk that something within the build environment has been compromised (and then further distributed to customers).
Principle 2.1 Protect the build environment against unauthorised access
Poor identity and access management in the build environment can lead to unauthorised access by attackers. Controlling who has access to the build environment (and knowing the identities of those that do) allows you to mitigate the risks posed by unauthorised users. It also allows better monitoring of activity within the build environment, which will be useful to determine what happened in the event of an incident.
You should ensure that:
- You have a policy that defines who is allowed to access systems within the build environment.
- You have a policy for removing users from the build environment when they no longer need access.
- Monitoring of actions (such as accessing a system) is logged.
- Users have the appropriate level of privilege for their accounts (the least privilege necessary to perform their role).
- Your external-facing access management components are isolated from the rest of your systems.
- Credentials are securely stored, and no default credentials are issued.
Further reading
Principle 2.2 Control and log changes to the build environment
Logging enables you to gain visibility of activities in the build environment, so that you can develop security monitoring and situational awareness. Any unauthorised changes could lead to compromised systems and if not logged, could make issues harder to remediate.
To establish an effective logging capability, you will need to:
- choose which logs to generate or retain
- decide how to retain logs
- implement protected log storage and tooling for analysis
- validate your logging capability is working as intended
Logging enables you to react to a cyber incident more effectively by helping you to understand better what has happened, what the impact is and what is an effective remediation strategy. It also helps you to evaluate whether the security controls you have in place are working.
You should ensure that:
- any changes made to the build environment are appropriately logged and retained
- a policy is in place on who is allowed to make changes to the build environment, what access they have and how long that access is required
- a policy is in place to remove those privileges when they are no longer needed
Further reading
Additional good practice for: build environment security
Mandate strong authentication for developers
The build environment is not typically a monolithic structure, but rather a series of tools and data which make up the environment. Access to the build environment must be controlled so that it is prohibitively difficult for attackers to gain access. Strong authentication (such as MFA) must be mandated for all developers who access the build environment.
A compromised developer’s account may immediately impact the organisation (for example by denial of service or data exfiltration), but it may also have long-term impact such as changing software packages that lead to software supply chain attacks.
You should ensure that:
- MFA is mandated for all accounts that have access to the build environment, and anything that resides within it.
- You follow NCSC password guidance to enable all build environment users to set up a strong password for their accounts. Users should be required to provide an extra factor when they log in using a device they have not used before.
- There is adequate support in place for MFA so that build environment users are able to report lost or forgotten credentials and reset them securely. You will need to ensure that an attacker cannot use these processes to bypass MFA.