Anshumaan Singh

CI/CD Security Control Plane

• Multi-stage DevSecOps pipelines: build → scan → deploy → post-deploy validate.
• PR-only merges + CODEOWNERS + branch protections to eliminate bypass paths.
• Dependency ordering: verify → build → tag → scan → push → deploy → notify.
• Slack release telemetry with commit/build metadata + scan artifact retention.

Supply Chain Integrity + SBOM

• Immutable image versioning — removed latest tags to eliminate deployment drift.
• Build once → promote: Dev → UAT → Prod without rebuilds in production.
• Evidence chain: scan outputs + approvals + image digest tracking per release.
• Only scanned + approved digests via registry path enforcement.

Kubernetes Runtime Guardrails

• kubeaudit to detect risky workload patterns and enforce baseline hygiene.
• Secure deployment baseline: healthchecks, limits, safe defaults, namespace patterns.
• Prevented privileged workloads and unsafe configurations at admission time.

AppSec + Secrets Remediation

• Led response for hardcoded Azure storage keys, OAuth secrets, leaked tokens.
• Coordinated safe rotation workflows with zero production impact.
• Web / API / Mobile penetration testing with actionable remediation guidance.

Core Security Invariants

• Identity is the control plane — short-lived, least privilege.
• Verification is deterministic — non-bypassable CI gates + evidence.
• Artifacts are immutable — digests + controlled promotion paths.
• Runtime is constrained — policy + RBAC + secure contexts.
• Everything is auditable — logs + scan outputs + approvals.

Design Principles

• Guardrails over manual reviews — automate the safety net.
• Secure paved roads enable engineering velocity.
• Risk-based gating — severity + exploitability + probability.
• Policy as code, evidence as artifacts, everything traceable.
• Commit → build → digest → deployment end-to-end traceability.

Primary Threat Vectors

• Credential theft — tokens, OAuth secrets, cloud keys
• Pipeline compromise — runner persistence, secret exposure
• Dependency compromise — typosquatting, malicious packages
• Container base image vulnerabilities + drift via mutable tags
• Kubernetes privilege escalation — privileged pods, host mounts
• Lateral movement — east-west traffic abuse
• Data exfiltration — egress misuse, weak PII boundaries

Kill Chain Defense Mapping

• Recon → WAF + rate limiting + minimal exposure
• Initial Access → secrets scanning + SAST + admission deny
• Privilege Escalation → RBAC + securityContext hardening
• Lateral Movement → segmentation + NetworkPolicy + mTLS
• Exfiltration → egress restrictions + PII boundaries
• Impact → SIEM detections + IR containment playbooks

Evidence Pack Includes

• SAST, SCA, Secrets, IaC, Image scan, DAST reports per build
• Build metadata: workflow run ID, commit SHA, branch, actor
• Artifact metadata: image digest, tags, registry path
• Promotion approvals: QA gates / policy decisions per stage
• All artifacts retained per pipeline for compliance and RCA

SBOM Snapshot — Real Output

Real pipeline artifact attached to a release. Not mocked.

Risk Scoring Inputs

• CVSS → technical severity baseline
• EPSS → likelihood of exploitation in the wild
• Exploit maturity → public exploit availability
• Reachability → exposed surface + runtime path analysis
• Compensating controls → RBAC, WAF, egress restrictions

Policy Gate Outcomes

• Block — exploitable criticals or active policy violations
• Allow + evidence — low risk with full traceability
• Exception + expiry — tracked risk acceptance
• Auto-promote — clean evidence + approved digest