Secure Software Development Framework

Secure Software Development Framework and Code/Prebuild CI/CD Steps

1: Protect the Organization (PO)

2: Protect the Software (PS)

3: Produce Well-Secured Software (PW)

4: Respond to Vulnerabilites

Achieving Code and Prebuild Tasks of the Secure Software Development Framework

The Secure Software Development Framework, developed by the National Institute of Standards and Technology (NIST), provides a comprehensive approach to ensuring security across the software development process, from initial design through deployment and maintenance. The framework outlines key practices and guidelines that organizations can implement to secure their software development lifecycle (SDLC), with a particular emphasis on integrating security into automated processes. This chapter focuses specifically on DevSecOps tooling and practices related to Code and Prebuild actions of the CI/CD pipeline to achieve:


Prepare the Organization (PO)	Organizations should ensure that their people, processes, and technology are prepared to perform secure software development at the organization level. Many organizations will find some PO practices to also be applicable to subsets of their software development, like individual development groups or projects.
Protect the Software (PS)	Organizations should protect all components of their software from tampering and unauthorized access.
Produce Well-Secured Software (PW)	Organizations should produce well-secured software with minimal security vulnerabilities in its releases.
Respond to Vulnerabilities (RV)	Organizations should identify residual vulnerabilities in their software releases and respond appropriately to address those vulnerabilities and prevent similar ones from occurring in the future.

1 - Protect the Organization (PO)

Protect the Organization (PO) CI/CD Steps

Protect the Organization (PO)

PO.3 Implement Supporting Toolchains

Use automation to reduce human effort and improve the accuracy, reproducibility, usability, and comprehensiveness of security practices throughout the SDLC, as well as provide a way to document and demonstrate the use of these practices. Toolchains and tools may be used at different levels of the organization, such as organization-wide or project-specific, and may address a particular part of the SDLC, like a build pipeline.

Open-Source Tools to Achieve:

Workflow Framework

In-toto framework

2 - Protect the Software (PS)

Protect the Software (PS) CI/CD Steps

Protect the Software (PS)

PS.1.1 Store all forms of code

PS.1.1: Store all forms of code – including source code, executable code, and configuration-as-code – based on the principle of least privilege so that only authorized personnel, tools, services, etc. have access.

Open-Source Tools to Achieve:

Source Repositories

3 - Produce Well-Secured Software (PW)

Produce Well-Secured Software (PW) CI/CD Steps

Produce Well-Secured Software (PW)

PW.4.1 Acquire and Maintain Well-secured Software

Ensure safe use of components (e.g., software libraries, modules, middleware, frameworks) from commercial, open-source, and other third-party developers for use by the organization’s software. Implement a Software Bill of Materials (SBOM) scan to obtain provenance information for each software component. Establish one or more software repositories to host sanctioned and vetted open-source components.

Open-Source Tools to Achieve:

SBOM Generation and Attestation Tools:

Binary Repositories:

Git Commit Signing:

Repo Security Scanning

PW.7 Review and/or Analyze Human-Readable Code

Help identify vulnerabilities so that they can be corrected before the software is released to prevent exploitation. Using automated methods lowers the effort and resources needed to detect vulnerabilities. Human-readable code includes source code, scripts, and any other form of code that an organization deems human-readable.

Open-Source Tools to Achieve:

4 - Respond to Vulnerabilites

Respond to Vulnerabilities (RV) CI/CD Steps

Respond to Vulnerabilities (RV)

Task: Identify and Respond to Vulnerabilities How to Achieve: Organizations should identify residual vulnerabilities in their software releases and respond appropriately to address those vulnerabilities and prevent similar ones from occurring in the future.

RV.1 Identify and Confirm Vulnerabilities on an Ongoing Basis

Open-Source Tools to Achieve:

Identify Vulnerabilities

Static Application Security Testing (SAST):

Dynamic Application Security Testing (DAST):

Software Composition Analysis (SCA):

RV.2 Assess, Prioritize, and Remediate Vulnerabilities

RV.3 Identify Root Cause and help to reduce frequency of vulnerabilities in the future