{"id":"https://openalex.org/W4416178189","doi":"https://doi.org/10.1109/secdev66745.2025.00017","title":"SoK: Understanding CI/CD Security: A Comprehensive Review of Architecture, Attacks, and Defenses","display_name":"SoK: Understanding CI/CD Security: A Comprehensive Review of Architecture, Attacks, and Defenses","publication_year":2025,"publication_date":"2025-10-14","ids":{"openalex":"https://openalex.org/W4416178189","doi":"https://doi.org/10.1109/secdev66745.2025.00017"},"language":null,"primary_location":{"id":"doi:10.1109/secdev66745.2025.00017","is_oa":false,"landing_page_url":"https://doi.org/10.1109/secdev66745.2025.00017","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Secure Development Conference (SecDev)","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5120596354","display_name":"Ryan Zmuda","orcid":null},"institutions":[{"id":"https://openalex.org/I4210132419","display_name":"Riverside Research Institute","ror":"https://ror.org/02tvg0w73","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I4210132419"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ryan Zmuda","raw_affiliation_strings":["Riverside Research,Secure and Resilient Systems,Beavercreek,OH,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Riverside Research,Secure and Resilient Systems,Beavercreek,OH,USA","institution_ids":["https://openalex.org/I4210132419"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5003539297","display_name":"Russell Graves","orcid":null},"institutions":[{"id":"https://openalex.org/I4210132419","display_name":"Riverside Research Institute","ror":"https://ror.org/02tvg0w73","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I4210132419"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Russell Graves","raw_affiliation_strings":["Riverside Research,Secure and Resilient Systems,Beavercreek,OH,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Riverside Research,Secure and Resilient Systems,Beavercreek,OH,USA","institution_ids":["https://openalex.org/I4210132419"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5110211140","display_name":"Michael Shepherd","orcid":null},"institutions":[{"id":"https://openalex.org/I4210132419","display_name":"Riverside Research Institute","ror":"https://ror.org/02tvg0w73","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I4210132419"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Michael Shepherd","raw_affiliation_strings":["Riverside Research,Secure and Resilient Systems,Lexington,MA,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Riverside Research,Secure and Resilient Systems,Lexington,MA,USA","institution_ids":["https://openalex.org/I4210132419"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5058819110","display_name":"Scott Brookes","orcid":null},"institutions":[{"id":"https://openalex.org/I4210132419","display_name":"Riverside Research Institute","ror":"https://ror.org/02tvg0w73","country_code":"US","type":"nonprofit","lineage":["https://openalex.org/I4210132419"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Scott Brookes","raw_affiliation_strings":["Riverside Research,Secure and Resilient Systems,Lexington,MA,USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Riverside Research,Secure and Resilient Systems,Lexington,MA,USA","institution_ids":["https://openalex.org/I4210132419"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I4210132419"],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.31650954,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"58","last_page":"68"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.25130000710487366,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.25130000710487366,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12479","display_name":"Web Application Security Vulnerabilities","score":0.23199999332427979,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.16680000722408295,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/pipeline-transport","display_name":"Pipeline transport","score":0.47690001130104065},{"id":"https://openalex.org/keywords/simple","display_name":"Simple (philosophy)","score":0.4327000081539154},{"id":"https://openalex.org/keywords/categorization","display_name":"Categorization","score":0.4171000123023987},{"id":"https://openalex.org/keywords/open-source","display_name":"Open source","score":0.39100000262260437},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.2888999879360199},{"id":"https://openalex.org/keywords/architecture","display_name":"Architecture","score":0.2870999872684479}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7218000292778015},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.7067000269889832},{"id":"https://openalex.org/C175309249","wikidata":"https://www.wikidata.org/wiki/Q725864","display_name":"Pipeline transport","level":2,"score":0.47690001130104065},{"id":"https://openalex.org/C2780586882","wikidata":"https://www.wikidata.org/wiki/Q7520643","display_name":"Simple (philosophy)","level":2,"score":0.4327000081539154},{"id":"https://openalex.org/C94124525","wikidata":"https://www.wikidata.org/wiki/Q912550","display_name":"Categorization","level":2,"score":0.4171000123023987},{"id":"https://openalex.org/C3018397939","wikidata":"https://www.wikidata.org/wiki/Q3644502","display_name":"Open source","level":3,"score":0.39100000262260437},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.3255999982357025},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.2955999970436096},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2888999879360199},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.2870999872684479},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.2815999984741211},{"id":"https://openalex.org/C9395851","wikidata":"https://www.wikidata.org/wiki/Q177929","display_name":"Stack (abstract data type)","level":2,"score":0.28110000491142273},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.26820001006126404},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.2533000111579895}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/secdev66745.2025.00017","is_oa":false,"landing_page_url":"https://doi.org/10.1109/secdev66745.2025.00017","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"2025 IEEE Secure Development Conference (SecDev)","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Maintaining":[0],"the":[1,31,37,102],"confidentiality,":[2],"availability,":[3],"and":[4,25,57,76,81],"integrity":[5],"of":[6,33,41,101],"CI/CD":[7,46,59,71,93],"systems":[8],"against":[9],"attacks":[10,105],"which":[11,43],"target":[12],"their":[13],"pipelines":[14,47],"poses":[15],"a":[16,62],"significant":[17],"security":[18],"challenge.":[19],"Attacks":[20],"like":[21],"Solarwinds's":[22],"Orion":[23],"Sunburst":[24],"CodeCov's":[26],"Secret":[27],"Exfiltration":[28],"demonstrate":[29],"that":[30,91],"abuse":[32],"simple":[34],"misconfigurations":[35],"spanning":[36],"vastly":[38],"complex":[39],"stack":[40],"services":[42],"make":[44],"up":[45],"can":[48],"have":[49],"devastating":[50],"consequences.":[51],"In":[52],"this":[53],"paper,":[54],"we":[55,106],"quantify":[56],"consolidate":[58],"terminology,":[60],"present":[61],"system":[63],"architecture":[64],"characterizing":[65],"CI/CD,":[66],"analyze":[67],"patterns":[68],"in":[69],"existing":[70,87],"attacks,":[72],"categorize":[73],"popular":[74],"free":[75],"open":[77],"source":[78],"defense":[79,94],"tools,":[80],"perform":[82],"gap":[83],"analysis":[84],"evaluation":[85,104],"on":[86],"tooling.":[88],"We":[89],"find":[90],"state-of-the-art":[92],"tools":[95],"fail":[96],"to":[97],"mitigate":[98],"5":[99],"out":[100],"7":[103],"created.":[107]},"counts_by_year":[],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2025-11-13T00:00:00"}