Gartner Research

Best Practices for Securing Continuous Delivery Systems and Artifacts

Published: 09 May 2019

ID: G00386385

Analyst(s): Frank Catucci , Michael Isbitski


Security and risk management technical professionals must account for heterogeneous environments and technology stacks when securing continuous delivery. Here, we cover best practices for securing the continuous delivery systems and artifacts inherent in DevOps and modern application development.

Table Of Contents

Problem Statement

The Gartner Approach

Best-Practice Framework

  • Prework
    • Inventory the Existing Developer Toolchains
    • Determine the Directional Application and Container Platforms
    • Formalize Your Version Control Processes and Systems
    • Standardize Binary Repositories and Registries
    • Implement Secrets Management Mechanisms
  • Best-Practice Set 1: Ensure the Integrity of Your Application Source Code
    • 1.1 Enable the Security Features of Your Version Control Systems
    • 1.2 Secure Your Container Registries, Package Managers and Binary Repositories
    • 1.3 Audit Your Source Code Continuously for the Presence of Embedded Secrets
  • Best-Practice Set 2: Provision Secure Operating Environments for Your Compiled Code
    • 2.1 Use Hardened Baselines When Generating Infrastructure as Code
    • 2.2 Create or Use Images From Vetted Sources, and Manage Centrally
    • 2.3 Continuously Audit Images and IaC Artifacts for Secrets and Misconfigurations
  • Best-Practice Set 3: Deliver Applications Securely Within Your Build Pipeline
    • 3.1 Enable the Security Features of Your CI/CD Systems and Development Tooling
    • 3.2 Limit Pipeline Definitions to Use Only Trusted Sources and Delivery Targets
    • 3.3 Implement Delivery-Time Mechanisms That Verify Compliance During Infrastructure Instantiation

Risks and Pitfalls

Gartner Recommended Reading

©2021 Gartner, Inc. and/or its affiliates. All rights reserved. Gartner is a registered trademark of Gartner, Inc. and its affiliates. This publication may not be reproduced or distributed in any form without Gartner’s prior written permission. It consists of the opinions of Gartner’s research organization, which should not be construed as statements of fact. While the information contained in this publication has been obtained from sources believed to be reliable, Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information. Although Gartner research may address legal and financial issues, Gartner does not provide legal or investment advice and its research should not be construed or used as such. Your access and use of this publication are governed by Gartner’s Usage Policy. Gartner prides itself on its reputation for independence and objectivity. Its research is produced independently by its research organization without input or influence from any third party. For further information, see Guiding Principles on Independence and Objectivity.

Already have a Gartner Account?

Become a client

Learn how to access this content as a Gartner client.