Profile Applicability:
Level 1
Description:
All build environments must be comprehensively logged, capturing details such as build server identifiers, operating system versions, installed software, environment variables, and configuration settings. Recording this information ensures that build processes are transparent, reproducible, and auditable.
Rationale:
Logging the build environment supports troubleshooting, forensic analysis, and compliance by providing a clear record of the conditions under which software artifacts were produced. It helps detect unauthorized changes or anomalies that could affect build integrity and security.
Impact:
Pros:
Enhances build process transparency and traceability.
Facilitates reproducibility and debugging.
Supports compliance with audit and regulatory requirements.
Aids in identifying and responding to build environment issues.
Cons:
May require additional storage and log management resources.
Needs secure handling to protect sensitive environment data.
Default value:
Build environments may not be logged in detail by default, limiting visibility.
Audit:
Review build logs and records to verify that environment details are captured consistently. Check log integrity and access controls.
Remediation:
Configure build systems and CI/CD pipelines to record environment metadata automatically. Integrate logs with centralized monitoring and secure storage solutions. Train teams on the importance of environment logging.
References:
OWASP Secure Build Processes: https://owasp.org/www-project-secure-build-processes/
CIS Controls v8, Control 6 - Maintenance, Monitoring, and Analysis of Audit Logs: https://www.cisecurity.org/controls/maintenance-monitoring-and-analysis-of-audit-logs/
NIST SP 800-53 - Audit and Accountability: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final