Analyzing scripts to create and enforce security policies in dynamic development pipelines
Disclosed embodiments relate to systems and methods for enforcing security policies in dynamic development pipelines. Techniques include accessing a build script, including a set of instructions for a software build process, parsing the build script to identify a set of scripted build instructions, determining a set of expected build actions based on the scripted build instructions, and constructing a representation of the set of expected build actions. The techniques may further include automatically generating a tiered security policy based on the representation of the set of expected build actions, monitoring a dynamic pipeline running the build script, and enforcing the security policy for the dynamic pipeline environment.
1 . A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for enforcing security policies in dynamic development pipelines, the operations comprising:
accessing a build script including a set of instructions for a software build process;
parsing the build script to identify a set of scripted build instructions;
determining a set of expected build actions based on the set of scripted build instructions;
constructing a representation of the set of expected build actions;
automatically generating a tiered security policy based on the representation of the set of expected build actions;
monitoring a dynamic development pipeline environment running the build script; and
enforcing the security policy for the dynamic development pipeline environment.
2 . The non-transitory computer readable medium of claim 1 , wherein monitoring the dynamic development pipeline environment further includes the use of additional software components preinstalled on the dynamic development pipeline environment.
3 . The non-transitory computer readable medium of claim 1 , wherein monitoring the dynamic development pipeline environment further includes collecting automated messages, commands, and API calls.
4 . The non-transitory computer readable medium of claim 3 , wherein the automated messages include HTTP messages sent to a predefined URL.
5 . The non-transitory computer readable medium of claim 3 , wherein collecting automated messages, commands and API calls includes collecting Command Line Interface (CLI) commands.
6 . The non-transitory computer readable medium of claim 2 , wherein monitoring the dynamic development pipeline environment includes collecting information associated with one or more build events.
7 . The non-transitory computer readable medium of claim 2 , wherein at least one of the additional software components is a ptrace tracing tool.
8 . The non-transitory computer readable medium of claim 2 , wherein at least one of the additional software components is an extended Berkeley Packet Filter (eBPF) tracing tool.
9 . The non-transitory computer readable medium of claim 1 , wherein monitoring the dynamic development pipeline environment includes tracking network traffic between a build machine and a source code manager or a repository.
10 . The non-transitory computer readable medium of claim 1 , wherein enforcing the security policy includes terminating a build process running on a build machine.
11 . The non-transitory computer readable medium of claim 1 , wherein enforcing the security policy includes blocking deployment of source code from a repository to a build machine.
12 . The non-transitory computer readable medium of claim 1 , wherein enforcing the security policy includes blocking deployment of an artifact to a production environment.
13 . The non-transitory computer readable medium of claim 1 , wherein enforcing the security policy includes interfering with at least one event within the dynamic development pipeline environment.
14 . The non-transitory computer readable medium of claim 1 , wherein the operations further comprise:
determining a set of expected sub-actions based on the build actions; and wherein:
the representation includes the set of expected build actions and sub-actions; and
the tiered security policy is based on the representation of the set of expected build actions and sub-actions.
15 . The non-transitory computer readable medium of claim 1 , wherein constructing the representation of the set of expected build actions includes identifying specific command executions contained in the set of scripted build instructions.
16 . The non-transitory computer readable medium of claim 1 , wherein:
the set of scripted build instructions include accessing an external file; and
the set of expected build actions include connecting to a repository containing the external file.
17 . The non-transitory computer readable medium of claim 1 , wherein:
the set of scripted build instructions includes building, tagging, and pushing an image to a container registry;
the set of expected build actions includes connecting to the container registry; and
the operations further comprise generating a set of system call commands.
18 . The non-transitory computer readable medium of claim 1 , wherein the tiered security policy is based on dependencies between expected build actions.
19 . A computer-implemented method for enforcing security policies in dynamic development pipelines, comprising:
accessing a build script including a set of instructions for a software build process;
parsing the build script to identify a set of scripted build instructions;
determining a set of expected build actions based on the set of scripted build instructions;
constructing a representation of the set of expected build actions;
automatically generating a tiered security policy based on the representation of the set of expected build actions;
monitoring a dynamic development pipeline environment running the build script; and
enforcing the security policy for the dynamic development pipeline environment.
20 . The computer implemented method of claim 19 , wherein monitoring the dynamic development pipeline environment includes collecting information associated with one or more build events using software components preinstalled on the dynamic development pipeline environment; and
wherein monitoring the dynamic development pipeline environment further includes receiving automated HTTP messages sent to a predefined URL.