Designing the CI/CD Security Maturity Model

Abstract

With the rise of DevOps, the automation of software development processes like CI/CD, particularly in integration and operation has increased significantly. Organizations are leveraging these advancements to accelerate development and increase the frequency of deployments. However, despite the emphasis on speed, the integration of security practices within CI/CD pipelines often lags, posing significant risks as exemplified by high-profile breaches like SolarWinds. The existing literature and industry tools lack comprehensive frameworks for adequately assessing the security posture of CI/CD pipelines. Although some frameworks exist, they often fail to thoroughly address all necessary security aspects in depth.

To address this gap, we have developed a model based on design science principles that allows organizations to assess the security of their CI/CD pipelines. This is achieved through a structured spreadsheet that converts responses into numerical scores, facilitating a bottomup assessment of security across various focus areas. This model enables the visualization of security levels through multiple layers of abstraction, each representing a different aspect of security.

Our research included three multivocal literature reviews (MLRs). The first MLR identified critical focus areas essential for a security-oriented maturity model. The second MLR mapped specific security practices to different maturity levels. The third MLR investigated whether any existing security-oriented maturity models could be adapted. Our model, the CI/CD Security Maturity Model (CICDSecMM), is grounded in these literature reviews and enriched by insights from numerous interviews and a case study. Through iterative cycles of building, evaluating, and refining the model based on interview feedback, we conducted a final case study to validate the model in a real-world setting.