•  
  •  
 

Abstract

This study examines whether integrating structured DevSec- Ops security controls into CI/CD pipelines can reduce software supply chain risk by preventing vulnerable components from progressing through the software development lifecycle. Software supply chain attacks frequently originate from weaknesses or compromises within dependencies, build environments, and trusted development stages, making early detection essential. A controlled sandbox experiment compared two pipeline configurations: a baseline CI/CD pipeline with no automated security enforcement and a secure DevSecOps pipeline integrating automated vulnerability scanning, SBOM generation, and artifact integrity verification. A known vulnerable dependency, the Python requests package (version 2.19.0) associated with CVE-2018-18074, was intentionally introduced into the pipeline to evaluate detection capability and pipeline response. The results demonstrate that the baseline pipeline allowed the vulnerable dependency to pass undetected, whereas the secure pipeline identified and rejected the vulnerable build during the vulnerability scanning stage. These findings demonstrate that automated security controls can identify known vulnerable components before they progress through the development pipeline. This study provides a practical proof of concept demonstrating how integrating threat modeling with DevSecOps pipeline enforcement can shift software security from reactive response toward proactive prevention within the software development lifecycle.

DOI

https://doi.org/10.5038/2378-0789.9.1.1160

Download

Share

COinS