CI/CD security: threat modeling using a MITRE-style threat matrix

This article highlights the critical need to secure CI/CD pipelines, which are increasingly vulnerable to attacks allowing malicious code injection, access to secrets, and permission manipulation. It introduces a CI/CD-specific threat matrix based on the MITRE ATT&CK framework to help identify potential attack paths and proactively model threats. The authors will demonstrate threat modeling with GitHub in a follow-up, emphasizing the importance of treating the SCM tool as part of the CI/CD security boundary.