System, method, and computer program product for pipeline authentication

Abstract

The present disclosure relates to authentication of computer pipeline results. Technologies are provided for pipeline security compliance. For example, one or more embodiments described herein may include a system that may include a memory that may store computer-executable components. The system may also include a processor operably coupled to the memory and capable of executing the computer-executable components stored in the memory. The computer-executable components may include an authentication component that authenticates results from the execution of a pipeline of a computer application based on a comparison of an implemented security control profile associated with the pipeline and an applicable security control profile identified from source artifacts associated with the computer application.

Description

Technical Field

[0001] The present disclosure relates to authentication of results from one or more computer pipelines (e.g., development, security, and operations ("DevSecOps") pipelines), and more particularly to automated authentication of one or more pipeline results as conforming to applicable end-to-end security controls. Background Art

[0002] In computing, a pipeline comprises a series of data processing steps that facilitate the transfer of data between various locations (e.g., between a computer application, a computer application and a data warehouse, a data repository and an analytical database, etc.). A development and operations ("DevOps") pipeline can be a pipeline comprising a set of automated data processing steps that can enable developers and operations entities to collaborate on building and / or deploying computer applications in a production environment. A DevSecOps pipeline can further expand on the principles of a DevOps pipeline by enabling information technology ("IT") security entities to collaborate with developers and operations entities when building and / or deploying computer applications.

[0003] However, a pipeline (e.g., a DevSecOps pipeline) may be susceptible to one or more compliance deficiencies with respect to a target security control. For example, in a DevSecOps pipeline, multiple security controls (e.g., vulnerability scanners, SEQ scanners, license scanners, combinations thereof, and / or the like) may be implemented separately and assembled into a data pipeline. However, there may not be available security controls in the pipeline; thereby jeopardizing pipeline security compliance. In another example, the security controls included in the pipeline may have different configuration parameters that may determine the outcome of the resulting task. Incorrectly configured security control parameters may also compromise pipeline security compliance. In yet another example, the security controls included in the pipeline may be implemented for various types of static source artifacts from a code repository, where the corresponding security controls are associated with different source artifacts. Implementing security controls that are not ideal for the source artifacts of a given computer application may also jeopardize pipeline security compliance. Summary of the Invention

[0004] The following is an overview presented to provide a basic understanding of one or more embodiments of the present invention. This Summary is not intended to identify key or critical elements or to delineate any scope of the particular embodiments or any scope of the claims. Its sole purpose is to present concepts in a simplified form as a prelude to the more detailed description that is presented later. In one or more embodiments described herein, a system, computer-implemented method, apparatus, and / or computer program product is described that can consider the certification of one or more pipeline results with respect to security compliance.

[0005] According to an embodiment, a system is provided. The system may include a memory storing computer executable components. The system may also include a processor operably coupled to the memory and capable of executing the computer executable components stored in the memory. The computer executable components may include an authentication component that authenticates the results of the execution of a pipeline for a computer application based on a comparison of an implemented security control profile associated with the pipeline and an available (applicable) security control profile identified from a source artifact associated with the computer application. An advantage of such a system may be to enable automated security compliance analysis of one or more pipelines.

[0006] In some examples, the system may further include an artifact classification component that can scan static code assets from a code repository to classify source artifacts. Furthermore, the system may include an artifact mapping component that can generate an artifact mapping that associates the classified source artifacts with one or more security controls. Such a system may have the advantage of identifying applicable security controls based on the source artifacts.

[0007] According to an embodiment, a computer-implemented method is provided. The computer-implemented method may include validating, by a system operatively coupled to a processor, results from executing a pipeline for a computer application based on a comparison of an implemented security control profile associated with the pipeline and an applicable security control profile identified from a source artifact associated with the computer application. An advantage of this computer-implemented method may be determining whether one or more security controls are missing from the pipeline.

[0008] In some examples, the computer-implemented method may further include scanning, by the system, static code assets from a code repository to classify source artifacts. Furthermore, the computer-implemented method may include generating, by the system, an artifact mapping that associates the classified source artifacts with one or more security controls. Additionally, the computer-implemented method may include identifying, by the system, source artifacts associated with a computer application. Furthermore, the computer-implemented method may include generating, by the system, an applicable security control profile by identifying, via the artifact mapping, one or more security controls associated with the identified source artifacts. An advantage of this approach may be automatic determination of applicable security controls.

[0009] According to an embodiment, a computer program product for pipeline authentication is provided. The computer program product may include program instructions. The program instructions are executable by a processor to cause the processor to: authenticate, by the processor, a result of executing a pipeline of a computer application based on a comparison of an implemented security control profile associated with the pipeline and an applicable security control profile identified from source artifacts associated with the computer application. Such a computer program product may be advantageous in associating one or more security protocols with the development and / or operation of one or more computer applications via the pipeline.

[0010] In some examples, the program instructions may further cause the processor to generate a configuration map that associates pipeline parameter configurations with security controls. Furthermore, the program instructions may cause the processor to identify the pipeline parameter configurations. Furthermore, the program instructions may cause the processor to generate an implemented security control profile by identifying implemented security controls associated with the parameter configurations via the configuration map. An advantage of such a computer program product may be that implemented security controls are identified based on parsing of a pipeline definition and / or parameter configuration. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 A block diagram is shown of an example non-limiting system that can authenticate that the results of execution of one or more pipelines (e.g., DevSecOps pipelines, continuous integration / continuous delivery (“CI / CD”)) comply with one or more target security controls in accordance with one or more embodiments described herein.

[0012] Figure 2 A block diagram is shown of an example non-limiting system that can map source artifacts to one or more security controls according to one or more embodiments described herein.

[0013] Figure 3 A block diagram is shown of an example non-limiting system that can identify one or more source artifacts included in one or more computer applications developed and / or deployed via a pipeline according to one or more embodiments described herein.

[0014] Figure 4 A block diagram is shown of an example non-limiting system that can generate one or more configuration files of usable security controls for one or more computer applications developed and / or deployed via a pipeline according to one or more embodiments described herein.

[0015] Figure 5 A block diagram is shown of an example non-limiting system that can map pipeline definitions and / or parameter configurations to one or more safety controls, and / or identify one or more definitions and / or parameter configurations employed by one or more pipelines, according to one or more embodiments described herein.

[0016] Figure 6 A block diagram of an example non-limiting system is shown that can generate one or more profiles of security controls implemented by a pipeline and / or compare the implemented security controls with security controls applicable to one or more computer applications developed and / or deployed via one or more pipelines in accordance with one or more embodiments described herein.

[0017] Figure 7 A flow chart illustrating an example non-limiting computer-implemented method that can facilitate determining whether results of one or more pipelines comply with one or more safety criteria in accordance with one or more embodiments described herein.

[0018] Figure 8 A flow chart illustrating an example non-limiting computer-implemented method that can facilitate determining whether results of one or more pipelines comply with one or more safety criteria in accordance with one or more embodiments described herein.

[0019] Figure 9 A flow chart illustrating an example non-limiting computer-implemented method that can facilitate determining whether results of one or more pipelines comply with one or more safety criteria in accordance with one or more embodiments described herein.

[0020] Figure 10 A flow chart illustrating an example non-limiting computer-implemented method that can facilitate determining whether results of one or more pipelines comply with one or more safety criteria in accordance with one or more embodiments described herein.

[0021] Figure 11 A cloud computing environment is depicted according to one or more embodiments described herein.

[0022] Figure 12 Depicted are abstract model layers according to one or more embodiments described herein.

[0023] Figure 13 Block diagram illustrating an example non-limiting operating environment in which one or more embodiments described herein may be facilitated. DETAILED DESCRIPTION

[0024] The following detailed description is illustrative only and is not intended to limit the embodiments and / or the application or uses of the embodiments. Furthermore, there is no intention to be bound by any explicit or implicit information presented in the previous background or summary sections or detailed description sections.

[0025] One or more embodiments will now be described with reference to the accompanying drawings, wherein like reference numerals are used throughout to refer to like elements. In the following description, for purposes of explanation, numerous specific details are set forth in order to provide a more thorough understanding of one or more embodiments. However, it will be apparent that, in various circumstances, one or more embodiments may be practiced without these specific details.

[0026] Issues with security compliance of other implementations of a given pipeline (e.g., a DevSecOps pipeline, a CI / CD pipeline, and / or the like); the present disclosure may be implemented to produce solutions to one or more of these issues by autonomously authenticating results from the execution of a pipeline (e.g., a DevSecOps pipeline, a CI / CD pipeline, and / or the like). Advantageously, one or more embodiments described herein may discover security controls applicable to a given pipeline, identify the security controls implemented by the pipeline, and determine whether the implemented security controls comply with the applicable security controls. Thus, one or more embodiments described herein may determine whether a given pipeline (e.g., a DevSecOps pipeline, a CI / CD pipeline, etc.) includes missing security controls, inapplicable security controls, and / or misconfigurations of security control parameters.

[0027] Various embodiments of the present invention may relate to computer processing systems, computer-implemented methods, apparatuses, and / or computer program products that facilitate efficient, effective, and autonomous (e.g., without direct human guidance) certification of security-compliant pipelines (e.g., DevSecOps pipelines, CI / CD pipelines). For example, one or more embodiments described herein may classify computer code artifacts originating from a code repository and map the classified artifacts to one or more security controls. Additionally, one or more embodiments may analyze the source artifacts of a given computer application being developed and / or deployed by a pipeline to generate a profile of applicable security controls. Further, the various embodiments described herein may map one or more pipeline definitions and / or configurations to one or more security controls based on, for example, tasks associated with the definitions and / or configurations. Additionally, one or more embodiments may analyze the definitions and / or configurations of a given pipeline (e.g., DevSecOps pipelines, CI / CD pipelines) to generate a profile of implemented security controls. Thus, one or more embodiments described herein may determine whether execution of a given pipeline (e.g., a DevSecOps pipeline, a CI / CD pipeline) of a given computer application meets security compliance via comparison of available security control profiles and implemented security control profiles.

[0028] Computer processing systems, computer-implemented methods, apparatus, and / or computer program products employ hardware and / or software to solve problems that are inherently highly technical (e.g., pipeline result authentication), non-abstract, and not performable by humans as a set of mental activities. For example, according to various embodiments described herein, an individual or multiple individuals may not be able to easily map classified source artifacts and / or parsed pipeline configurations to security controls.

[0029] Furthermore, one or more embodiments described herein may constitute a technical improvement over typical pipeline executions by autonomously certifying that the results of a pipeline's execution comply with one or more target security controls. Furthermore, one or more embodiments described herein may have practical applications by establishing automated security compliance checks of pipeline results for development and / or deployment of one or more computer applications. For example, various embodiments described herein may determine whether a given pipeline's execution includes applicable security controls.

[0030] Figure 1 A block diagram of an example non-limiting system 100 that can authenticate the execution of one or more pipelines (e.g., a DevSecOps pipeline, a CI / CD pipeline, etc.) is shown. For the sake of brevity, repeated descriptions of similar elements employed in other embodiments described herein are omitted. Aspects of the systems (e.g., system 100, etc.), devices, or processes in various embodiments of the present invention can constitute one or more machine-executable components embodied in one or more machines (e.g., embodied in one or more computer-readable media (or media) associated with one or more machines). Such components, when executed by one or more machines (e.g., computers, computing devices, virtual machines, combinations thereof, and / or the like), can cause the machines to perform the described operations.

[0031] like Figure 1 As shown, system 100 may include one or more servers 102, one or more networks 104, input devices 106, and / or code repositories 108. Server 102 may include an authentication component 110. Authentication component 110 may also include a communication component 112 and / or an artifact classification component 114. Additionally, server 102 may include or otherwise be associated with at least one memory 116. Server 102 may also include a system bus 118 that may couple to various components, such as, but not limited to, authentication component 110 and associated components, memory 116, and / or processor 120. While in Figure 1 The server 102 is shown in FIG, but in other embodiments, multiple devices of various types may be connected to Figure 1 The features shown in are associated with or include Figure 1Furthermore, the server 102 may be in communication with one or more cloud computing environments.

[0032] The one or more networks 104 may include wired and wireless networks, including but not limited to cellular networks, wide area networks (WANs) (e.g., the Internet), or local area networks (LANs). For example, the server 102 may communicate with the one or more input devices 106 and / or the code repository 108 (or vice versa) using virtually any desired wired or wireless technology, including, for example, but not limited to, cellular, WANs, Wireless Fidelity (Wi-Fi), Wi-Max, WLANs, Bluetooth technologies, combinations thereof, and / or the like. Further, while in the illustrated embodiment, the communication component 112 may be provided on one or more servers 102, it should be understood that the architecture of the system 100 is not limited thereto. For example, the communication component 112 or one or more components of the communication component 112 may be located at another computer device (such as another server device, a client device, etc.).

[0033] The one or more input devices 106 may include one or more computerized devices, which may include, but are not limited to, a personal computer, a desktop computer, a laptop computer, a cellular phone (e.g., a smartphone), a computerized tablet (e.g., including a processor), a smartwatch, a keyboard, a touch screen, a mouse, combinations thereof, and / or the like. The one or more input devices 106 may be used to input one or more computer applications into the system 100, thereby sharing data with the server 102 (e.g., via a direct connection and / or via one or more networks 104). For example, the one or more input devices 106 may send data to the communication component 112 (e.g., via a direct connection and / or via one or more networks 104). Additionally, the one or more input devices 106 may include one or more displays that may present one or more outputs generated by the system 100 to a user. For example, the one or more displays may include, but are not limited to, a cathode ray tube display ("CRT"), a light emitting diode display ("LED"), an electroluminescent display ("ELD"), a plasma display panel ("PDP"), a liquid crystal display ("LCD"), an organic light emitting diode display ("OLED"), combinations thereof, and the like.

[0034] In various embodiments, one or more input devices 106 and / or one or more networks 104 may be employed to input one or more settings and / or commands into the system 100. For example, in various embodiments described herein, one or more input devices 106 may be used to operate and / or manipulate the server 102 and / or associated components. Additionally, one or more input devices 106 may be used to display one or more outputs (e.g., displays, data, visualizations, etc.) generated by the server 102 and / or associated components. Further, in one or more embodiments, one or more input devices 106 may be included within and / or operably coupled to a cloud computing environment.

[0035] In one or more embodiments, one or more code repositories 108 can be software archives of computer programming source code. Source code can be computer program code previously developed for one or more functions and stored in one or more code repositories 108 for later use. For example, source code can be retrieved from one or more code repositories 108 to perform the original function of the code and / or modified to perform a different function. Building new programming code by modifying existing source code can speed up the program development process. In various embodiments, one or more code repositories 108 can include one or more source code archives, hosting facilities for managing and / or accessing archives, technical archives, web pages, snippets, patches, combinations thereof, and / or the like.

[0036] In various embodiments, the communication component 112 can receive input data from one or more input devices 106 and share the input data with one or more associated components of the authentication component 110. The input data can include, for example, pipelines; pipeline definitions, parameters, and / or configurations, combinations thereof, and / or the like. Furthermore, the communication component 112 can receive computer code data from one or more code repositories 108 and share the computer code data with one or more associated components of the authentication component 110. The computer code data can include, for example, one or more source code and / or source artifacts that can be implemented in one or more pipelines to facilitate the development and / or deployment of one or more computer applications.

[0037] In one or more embodiments, the artifact classification component 114 can scan static code assets from one or more code repositories 108 to categorize source artifacts. For example, the artifact classification component 114 can assign source artifacts from the code repositories 108 to one or more categories based on one or more characteristics of the source artifacts. For example, source artifacts assigned to the same category can exhibit similar characteristics. In various embodiments, the artifact classification component 114 can employ one or more machine learning algorithms to categorize the one or more source artifacts. For example, the artifact classification component 114 can employ one or more neural networks to perform one or more classification tasks with respect to the source artifacts from the one or more code repositories 108.

[0038] Figure 2 A diagram illustrates an example non-limiting system 100 according to one or more embodiments described herein, further comprising an artifact mapping component 202. For the sake of brevity, repeated descriptions of similar elements employed in other embodiments described herein are omitted. In various embodiments, the artifact mapping component 202 can generate one or more artifact mappings that can associate classified source artifacts with one or more security controls.

[0039] For example, the artifact mapping component 202 can map one or more security controls to source artifact categories. For example, each category of source artifacts can be associated with one or more security controls. In various embodiments, security controls can include safeguards and / or countermeasures for avoiding, minimizing, detecting, and / or counteracting security risks of computer applications and / or data developed and / or deployed via a given pipeline (e.g., a DevSecOps pipeline, a CI / CD pipeline, etc.). Example types of security controls can include, but are not limited to, preventive controls, detection controls, corrective controls, access controls, procedural controls, technical controls, compliance controls, combinations thereof, and / or the like. For example, example security controls can include, but are not limited to, vulnerability scanners, license scanners, CIS controls, configuration analysis, risk analysis, combinations thereof, and / or the like.

[0040] In various embodiments, each task in a pipeline may be responsible for one or more security controls. When included in a pipeline (e.g., as part of such registration), a task may be defined with all available security controls. For example, the available security controls associated with a given task may be defined based on including the task in a pipeline. For example, where a given pipeline includes a task, the security controls associated with the task may be defined as available security controls (e.g., available security controls that can be implemented by the pipeline so that the certification component 110 certifies the results of the pipeline). The mapping may be performed manually and / or via one or more machine learning models (e.g., performing one or more machine learning tasks through supervised learning).

[0041] In various embodiments, one or more characteristics shared by source artifacts of a given category can be associated with the use of one or more security controls assigned to the given category. For example, where the artifacts are characterized as deployment files, the artifacts can be subject to Center for Internet Security ("CIS") inspection and / or configuration analysis. In another example, where the artifacts are characterized as build artifacts, the artifacts can be subject to vulnerability scanning and / or licensing audits. Where a computer application includes one or more source artifacts, the one or more security controls mapped to one or more categories associated with the source artifacts can be security controls applicable to the execution of one or more pipelines of the computer application.

[0042] Figure 3 A diagram illustrates an example, non-limiting system 100 that also includes an artifact identification component 302, according to one or more embodiments described herein. For the sake of brevity, repeated descriptions of similar elements employed in other embodiments described herein are omitted. In various embodiments, the artifact identification component 302 can identify one or more source artifacts associated with a computer application being developed and / or deployed via a pipeline being analyzed by the certification component 110.

[0043] In one or more examples, artifact identification component 302 can analyze one or more computer applications being developed and / or deployed by execution of a pipeline being analyzed by certification component 110. Example types of source artifacts that can be identified by artifact identification component 302 can include, but are not limited to, code artifacts (e.g., test suites, setup scripts, compiled code, test output), documentation artifacts (e.g., diagrams, end-user agreements, internal documentation), project management artifacts, combinations thereof, and / or the like.

[0044] In various embodiments, source artifacts can be identified and categorized by their extensions, naming practices, parsed content, and / or a combination thereof. For example, deployment artifacts can be identified by their extension format (e.g., .vaml and / or .vml extensions). Similarly, build artifacts can include Dockerfile package manifests, such as requirements.text, package-lock.json, and / or Terraform files with a .tf extension. In other examples, artifacts can be identified by established practices and / or standards around file naming that can be used for classification.

[0045] Figure 4A diagram of an example non-limiting system 100 according to one or more embodiments described herein is shown, the system 100 further comprising an available security control component 402. For the sake of brevity, repeated descriptions of similar elements employed in other embodiments described herein are omitted. In various embodiments, the available security control component 402 can generate an available security control profile by identifying one or more security controls associated with an identified source artifact via one or more artifact mappings generated by the artifact mapping component 202.

[0046] For example, available security control component 402 can compare the source artifact identified by artifact identification component 302 with one or more artifact mappings generated by artifact mapping component 202. For example, for an identified source artifact of a first type, available security control component 402 can reference one or more artifact mappings to identify which category includes the source artifact of the first type. Further, available security control component 402 can reference one or more artifact mappings to identify one or more security controls associated with the category of the identified source artifact. Thus, available security control component 402 can identify one or more security controls applicable to a given source artifact identified from a computer application.

[0047] In addition, the available security control component 402 can identify available security controls associated with each source artifact identified from the computer application. Further, the available security control component 402 can compile all identified available security controls to generate one or more available security control profiles. In various embodiments, the one or more available security control profiles can include a list of available security controls associated with identified source artifacts from the computer application being developed and / or deployed via the pipeline being analyzed by the certification component 110 (e.g., based on one or more artifact mappings).

[0048] Figure 5 A diagram of an example non-limiting system 100 according to one or more embodiments described herein is shown, the system 100 further comprising a configuration mapping component 502 and / or a configuration identification component 504. For the sake of brevity, repeated descriptions of similar elements employed in other embodiments described herein are omitted. In various embodiments, the configuration mapping component 502 can generate one or more configuration maps that can associate one or more pipeline definitions and / or configurations with one or more security controls.

[0049] For example, the configuration mapping component 502 can discover one or more previously implemented pipelines from one or more code repositories 108 (e.g., each code repository 108 can be configured with one or more pipelines). In addition, the configuration mapping component 502 can identify security controls implemented by the discovered one or more pipelines. In addition, the configuration mapping component 502 can determine which definitions and / or parameter configurations of the discovered pipelines are associated with the identified security controls. For example, tasks in a pipeline can be statically defined to cover certain security controls (e.g., tasks for vulnerability scanning from a third-party vendor can be associated with RA-5 security controls). The mapping of pipeline tasks to security controls can be performed manually and / or via one or more machine learning models (e.g., performing one or more machine learning tasks through supervised learning). Thus, the configuration mapping component 502 can generate one or more configuration mappings that associate pipeline definitions and / or parameter configurations with security controls. In one or more embodiments, the configuration mapping component 502 can identify one or more tasks performed by the discovered one or more pipelines and the security controls implemented during the execution of the tasks. Thus, one or more configuration mappings can also associate computing tasks with one or more security controls. Thus, in various embodiments, the configuration mapping component 502 can map possible security controls to pipeline definitions and / or parameter configurations employed by previous pipelines to generate one or more configuration maps, which can then be used by the authentication component 110 to identify the security controls implemented by a given pipeline based on the definitions and / or parameter configurations included in the given pipeline.

[0050] In various embodiments, the configuration identification component 504 can identify one or more definitions and / or configurations of a pipeline being analyzed by the authentication component 110. For example, the configuration identification component 504 can parse one or more definitions and / or parameter configurations of a pipeline being executed for one or more computer applications analyzed by the artifact identification component 302. The pipeline definition can follow one or more standardized schemas, thereby enabling parsing of the pipeline definition by scanning the corresponding files and / or data of the pipeline definition. For example, a semantic parser can be employed that parses the content and semantically discovers the different components and / or configurations of the pipeline. In one or more embodiments, the configuration identification component 504 can determine one or more computing tasks performed by the pipeline based on the one or more parsed definitions and / or parameter configurations. For example, the configuration identification component 504 can employ one or more machine learning models trained on one or more discovered pipelines to cluster pipeline definitions and / or parameter configurations using computing tasks. In another example, the configuration identification component 504 can reference one or more databases of known correlations between pipeline definitions and / or parameter configurations of computing tasks.

[0051] Figure 6 A diagram of an example non-limiting system 100 according to one or more embodiments described herein is shown, further comprising an implemented security control component 602, a dynamic parameter component 604, a comparison component 606, and / or an evidence reporting component 608. For the sake of brevity, repetitive descriptions of similar elements employed in other embodiments described herein are omitted. In various embodiments, the implemented security control component 602 can generate one or more implemented security control profiles by identifying one or more implemented security controls associated with one or more identified definitions and / or configurations via one or more configuration maps. For example, the implemented security control component 602 can reference one or more configuration maps (e.g., generated by the configuration mapping component 502) to associate one or more security controls with one or more identified pipeline definitions and / or parameter configurations. For example, the implemented security control component 602 can associate each identified pipeline definition and / or parameter configuration with one or more security controls using one or more configuration maps. Thus, the implemented security control component 602 can ascertain which security controls are being implemented by the pipeline based on the pipeline's definition and / or parameter configuration. For example, one or more identified pipeline definitions and / or parameter configurations can be associated with one or more computing tasks (e.g., via configuration identification component 504), which in turn can be associated with one or more security controls (e.g., via implemented security control component 602) via one or more configuration maps (e.g., generated by configuration map component 502). Thus, in various embodiments, implemented security control component 602 can generate one or more implemented security control profiles by correlating definitions and / or parameter configurations identified as included in a given pipeline with possible security controls via one or more configuration maps. The one or more implemented security control profiles can describe the security controls implemented by a given pipeline analyzed by authentication component 110.

[0052] In one or more embodiments, the dynamic parameter component 604 may modify one or more available security control profiles (e.g., generated by the available security control component 402) based on one or more dynamic parameters regarding the execution of one or more pipelines. For example, one or more dynamic parameters regarding the execution of one or more pipelines may be defined via one or more input devices 106. The dynamic parameters may define one or more operations and / or security control exceptions to be employed during the execution of the pipeline. Example operations and / or security control exceptions defined by the one or more dynamic parameters may include, but are not limited to: license requirement exceptions, a list of ignored vulnerabilities, a list of allowed and / or approved package dependencies, authorized signers, combinations thereof, and / or the like. For example, in situations where an available security control requiring a valid license for one or more computer applications is required, one or more input devices 106 may be used to exempt the security control from the available security control profile (e.g., thereby rendering the security control inapplicable to the execution of the pipeline).

[0053] The dynamic parameter component 604 can analyze one or more available security control profiles to determine whether one or more dynamic parameters (e.g., input via one or more input devices 106) consider one or more available security controls. For example, the one or more dynamic parameters can define a security control of interest, and the dynamic parameter component 604 can search for the security control of interest against the one or more available security control profiles. In the event that the one or more dynamic parameters define an exception to one or more available security controls included in the one or more available security control profiles, the dynamic parameter component 604 can remove and / or modify the subject available security controls from the available security control profiles to facilitate the exception.

[0054] In one or more embodiments, the dynamic parameter component 604 can determine whether one or more dynamic parameters are allowable before modifying one or more available security control profiles. For example, one or more dynamic parameters may be defined and / or desired, but not permitted with respect to the computer environment in which the pipeline is executing. For example, the dynamic parameter component 604 can reference one or more lists of disallowed dynamic parameters (e.g., stored in one or more memories 116) and compare one or more input dynamic parameters to the list of disallowed dynamic parameters. If the dynamic parameter component 604 determines that one or more input dynamic parameters are not allowable (e.g., one or more input dynamic parameters are found on the list of disallowed dynamic parameters), the dynamic parameter component 604 can refrain from modifying the one or more available security control profiles. If the dynamic parameter component 604 determines that one or more input dynamic parameters are allowable (e.g., one or more input dynamic parameters are found not to be included in the list of disallowed dynamic parameters), the dynamic parameter component 704 can modify the one or more available security control profiles (e.g., remove one or more available security controls to facilitate a defined security control exception).

[0055] In various embodiments, the comparison component 606 can compare one or more available security control profiles (e.g., generated by the available security control component 402 and / or modified by the dynamic parameter component 604) with one or more implemented security control profiles to determine security compliance of a given pipeline for developing and / or deploying a given computing application. For example, the comparison component 606 can compare the implemented security control profile with the available security control profile to determine whether the pipeline is implementing a sufficient number of security controls applicable to the execution of the pipeline. In one or more embodiments, the certification component 110 (e.g., via the comparison component 606) can certify the execution of the pipeline for the computer application based on an implemented security control profile that matches the available security control profile through a defined threshold. For example, the certification component 110 can certify the execution of the data pipeline based on an implemented security control profile that includes all available security controls (e.g., as defined by the available security control profile). In another example, the certification component 110 can certify the execution of the pipeline based on an implemented security control profile that includes a defined percentage of available security controls (e.g., defined via one or more input devices 106), such as 80%.

[0056] In one or more embodiments, the comparison component 606 can further compare the available security controls in the available security control profiles with the security control parameters of the implemented security controls in the implemented security control profiles. For example, the comparison component 606 can reference one or more databases that depict acceptable configurations of security control parameters for each security control included in one or more artifact mappings. When the comparison component 606 determines that the available security controls are being implemented by the pipeline, the comparison component 606 can further compare the configuration of the security control parameters employed by the implemented security controls with the acceptable configurations associated with the security controls. If the employed configuration of the security control parameters matches one or more of the acceptable configurations of the security control parameters, the comparison component 606 can determine that the given implemented security control is properly configured (e.g., and thus, the results from the pipeline can be authenticated). If the employed configuration of the security control parameters fails to match one or more of the acceptable configurations of the security control parameters, the comparison component 606 can determine that the given implemented security control is misconfigured (e.g., and thus, the results from the pipeline will not be authenticated).

[0057] In one or more embodiments, the evidence reporting component 608 can generate one or more evidence reports that can characterize the comparison performed by the comparison component 606. For example, the one or more evidence reports can include text, graphics, videos, diagrams, graphs, charts, graphs, combinations thereof, and / or the like. Further, the one or more evidence reports can include, for example: a description of available security controls (e.g., as defined by one or more available security control profiles) associated with a given execution of the pipeline; a description of implemented security controls (e.g., as defined by one or more implemented security control profiles) associated with a given execution of the pipeline; modifications to available security control profiles performed according to one or more dynamic parameters; dynamic parameters entered but found to be disallowed; security control misconfigurations; combinations thereof, and / or the like.

[0058] Figure 7 A flowchart illustrating an example non-limiting computer-implemented method 700 that can facilitate determining whether one or more pipelines comply with one or more safety standards according to one or more embodiments described herein is shown. For the sake of brevity, repeated descriptions of similar elements employed in other embodiments described herein are omitted.

[0059] At 702, the computer-implemented method 700 may include receiving (e.g., via the communication component 112) by the system 100 operatively coupled to the processor 120 one or more pipelines for development and / or deployment of a computer application. For example, one or more entities may enter the one or more pipelines into the system 100 via the one or more input devices 106. At 704, the computer-implemented method 800 may include authenticating (e.g., via the authentication component 110) by the system 100 for execution of the one or more pipelines for the computer application based on a comparison of one or more implemented security control profiles associated with the one or more pipelines and one or more available security control profiles identified from one or more source artifacts associated with the computer application.

[0060] For example, according to one or more embodiments described herein, one or more available security control profiles can be generated by the system 100 (e.g., via the available security control component 402) based on correlations between one or more source artifacts and security controls. Further, according to one or more embodiments described herein, one or more implemented security control profiles can be generated by the system 100 (e.g., via the implemented security control component 602) based on correlations between pipeline definitions and / or parameter configurations and security controls. In various embodiments, according to one or more embodiments described herein, one or more pipelines can be authenticated by the system 100 when the available security control profiles match or substantially match the implemented security control profiles.

[0061] Figure 8 A flowchart illustrating an exemplary, non-limiting computer-implemented method 800 that can facilitate generating one or more usable security control profiles according to one or more embodiments described herein is shown. For the sake of brevity, repeated descriptions of similar elements employed in other embodiments described herein are omitted. In various embodiments, computer-implemented method 800 can be employed to facilitate authentication performed in computer-implemented method 700.

[0062] At 802, the computer-implemented method 800 may include scanning (e.g., via the artifact classification component 114) by the system 100 operatively coupled to the processor 120 static code assets from one or more code repositories 108 to classify source artifacts. At 804, the computer-implemented method 800 may include generating (e.g., via the artifact mapping component 202) by the system 100 one or more artifact mappings that can associate the classified source artifacts with one or more security controls. At 806, the computer-implemented method 800 may include identifying (e.g., via the artifact identification component 302) by the system 100 one or more source artifacts associated with a computer application developed and / or deployed via a pipeline (e.g., a DevSecOps pipeline, a CI / CD pipeline, etc.). At 808, the computer-implemented method 800 may include generating (e.g., via the available security controls component 402) by the system 100 one or more available security control profiles by identifying available security controls associated with the one or more identified source artifacts via the one or more artifact mappings.

[0063] Figure 9 A flowchart illustrating an example non-limiting computer-implemented method 900 that can facilitate processing one or more dynamic parameters when executing one or more pipelines according to one or more embodiments described herein. For the sake of brevity, repeated descriptions of similar elements employed in other embodiments described herein are omitted. In various embodiments, computer-implemented method 900 can be employed to facilitate authentication performed in computer-implemented method 700.

[0064] At 902, the computer-implemented method 900 may include receiving (e.g., via the communication component 112) by the system 100 operatively coupled to the processor 120 one or more dynamic parameters regarding the execution of one or more pipelines. For example, the one or more dynamic parameters may be input into the system 100 via one or more input devices 106. Further, the one or more dynamic parameters may define one or more desired security compliance exceptions. For example, the one or more dynamic parameters may define one or more exceptions to otherwise available security controls.

[0065] At 904, the computer-implemented method 900 can include determining, by the system 100 (e.g., via the dynamic parameter component 604), whether the one or more dynamic parameters are allowable. For example, the one or more received dynamic parameters (e.g., via the dynamic parameter component 604) can be compared to a list of disallowed dynamic parameters. In another example, the one or more received dynamic parameters (e.g., via the dynamic parameter component 604) can be compared to a list of allowed dynamic parameters. If the received dynamic parameters are found to be disallowed, the computer-implemented method 900 can end at 906. If the received dynamic parameters are found to be allowable, the computer-implemented method 900 can proceed to 908.

[0066] At 908, the computer-implemented method 900 may include determining, by the system 100 (e.g., via the dynamic parameter component 604), whether the received dynamic parameters are associated with one or more available security controls. For example, the one or more dynamic parameters may define one or more security controls that are exempted during execution of a given pipeline. In one or more embodiments, the one or more security controls defined by the received dynamic parameters may be compared to one or more available security control profiles generated via the computer-implemented method 800 (e.g., via the dynamic parameter component 604). In the event that the one or more received dynamic parameters do not define a security control included in the one or more available security control profiles, the computer-implemented method 900 may end at 910. In the event that the one or more received dynamic parameters do define a security control included in the one or more available security control profiles, the computer-implemented method 900 may proceed to 912.

[0067] At 912, the computer-implemented method 900 can modify (e.g., via the dynamic parameter component 604) one or more available security control profiles (e.g., generated according to the computer-implemented method 800 via the available security control component 402) by the system 100, including one or more available security controls associated with the dynamic parameters. For example, the modification at 912 can remove one or more security controls from the available security control profiles based on one or more security compliance anomalies depicted by the one or more dynamic parameters. Thus, one or more security controls that would otherwise be available for a given execution of the pipeline can be removed from the available security profiles based on the received, allowed dynamic parameters.

[0068] Figure 10A flowchart illustrating an example non-limiting computer-implemented method 1000 that can facilitate generating one or more implemented security control profiles and / or pipeline authentication according to one or more embodiments described herein is provided. For the sake of brevity, repeated descriptions of similar elements employed in other embodiments described herein are omitted. In various embodiments, the computer-implemented method 1000 can be employed to facilitate authentication performed in the computer-implemented method 700.

[0069] At 1004, the computer-implemented method 1000 may include generating, by the system 100 (e.g., via the configuration mapping component 502), one or more configuration maps that may associate a pipeline definition and / or parameter configuration with one or more security controls. At 1006, the computer-implemented method 1000 may include identifying, by the system 100 (e.g., via the configuration identification component 504), one or more definitions and / or parameter configurations of the pipeline. At 1008, the computer-implemented method 1000 may include generating (e.g., by the implemented security control component 602), by the system 100, one or more implemented security control profiles by identifying, via the one or more configuration maps, one or more implemented security controls associated with the definitions and / or parameter configurations. At 1010, the computer-implemented method 1000 may include performing, by the system 100 (e.g., via the comparison component 606), a comparison of the one or more implemented security control profiles with one or more available security control profiles (e.g., generated according to the computer-implemented method 800 and / or modified according to the computer-implemented method 900) to determine whether the pipeline complies with defined security standards.

[0070] For example, where one or more available security control profiles match one or more implemented security control profiles, the results from the pipeline may be determined to be compliant with the security standard and certified at 1010. In another example, where one or more available security control profiles match one or more implemented security control profiles by a defined threshold (e.g., a match greater than 80%), the results from the pipeline may be determined to be compliant with the security standard and certified at 1010. In a further example, where one or more available security control profiles do not match one or more implemented security control profiles (e.g., completely or by a defined threshold), the results from the pipeline may be determined to be non-compliant with the security standard and not certified at 1010.

[0071] At 1012, computer-implemented method 1000 can include generating, by system 100 (e.g., via evidence reporting component 608), one or more evidence reports that characterize at least the comparison at 1010. Further, evidence reporting component 608 can characterize one or more of the other operations performed during computer-implemented methods 700, 800, 900, and / or 1000.

[0072] It should be understood that although the present disclosure includes detailed descriptions about cloud computing, the implementation of the teachings cited herein is not limited to cloud computing environments. Instead, embodiments of the present invention can be implemented in conjunction with any other type of computing environment now known or later developed.

[0073] Cloud computing is a service delivery model that enables convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services). Configurable computing resources can be quickly provisioned and released with minimal management effort or interaction with the service provider. The cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0074] Features are as follows:

[0075] On-demand self-service: Cloud consumers can unilaterally and automatically provision computing capabilities, such as server time and network storage, as needed, without requiring human interaction with the service provider.

[0076] Broad Network Access: Capabilities are available over the network and accessed through standard mechanisms that facilitate the use of heterogeneous thin-client or thick-client platforms (e.g., mobile phones, laptops, and PDAs).

[0077] Resource pooling: A provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, where different physical and virtual resources are dynamically assigned and reassigned as needed. There is a sense of location independence, as consumers typically do not have control or knowledge of the exact location of the provided resources, but may be able to specify the location at a higher level of abstraction (e.g., country, state, or data center).

[0078] Rapid elasticity: The ability to quickly and elastically provision capacity, in some cases automatically scaling down and releasing capacity to scale up quickly. To the consumer, the capacity available for provisioning typically appears unlimited and can be purchased in any quantity at any time.

[0079] Metered Services: Cloud systems automatically control and optimize resource usage by leveraging metering capabilities at a level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency to both providers and consumers of the utilized services.

[0080] The service model is as follows:

[0081] Software as a Service (SaaS): The ability provided to consumers is to use the provider's applications running on a cloud infrastructure. Applications are accessible from various client devices through a thin client interface such as a web browser (e.g., web-based email). Consumers do not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0082] Platform as a Service (PaaS): The capability provided to consumers is to deploy applications created or acquired using programming languages ​​and tools supported by the provider onto the cloud infrastructure. Consumers do not manage or control the underlying cloud infrastructure, including networks, servers, operating systems, or storage, but do have control over the deployed applications and the configuration of the application hosting environment.

[0083] Infrastructure as a Service (IaaS): The capabilities provided to consumers are processing, storage, networking, and other basic computing resources on which consumers can deploy and run arbitrary software, which can include operating systems and applications. Consumers do not manage or control the underlying cloud infrastructure, but rather have control over the operating system, storage, deployed applications, and potentially limited control over selected networking components (e.g., host firewalls).

[0084] The deployment model is as follows:

[0085] Private cloud: Cloud infrastructure is operated solely for an organization. It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0086] Community cloud: A cloud infrastructure is shared by several organizations and supports a specific community with shared concerns (e.g., mission, security requirements, policies, and compliance considerations). It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0087] Public cloud: Cloud infrastructure is made available to the public or large industry groups and is owned by the organization that sells cloud services.

[0088] Hybrid cloud: A cloud infrastructure is a combination of two or more clouds (private, community, or public) that remain distinct entities but are bound together by standardized or proprietary technologies that enable data and application portability (e.g., cloud bursting for load balancing between clouds).

[0089] Cloud computing environments are service-oriented and focus on statelessness, low coupling, modularity, and semantic interoperability. The core of cloud computing is the infrastructure that consists of a network of interconnected nodes.

[0090] Now see Figure 11 , describes an illustrative cloud computing environment 1100. As shown, the cloud computing environment 1100 includes one or more cloud computing nodes 1102, with which local computing devices used by cloud consumers (such as, for example, personal digital assistants (PDAs) or cellular phones 1104, desktop computers 1106, laptop computers 1108, and / or automobile computer systems 1110) can communicate. The nodes 1102 can communicate with each other. They can be physically or virtually grouped (not shown) in one or more networks, such as private clouds, community clouds, public clouds, or hybrid clouds, or a combination thereof, as described above. This allows the cloud computing environment 1100 to provide infrastructure, platforms, and / or software as services for which cloud consumers do not need to maintain resources on local computing devices. It should be understood that Figure 11 The types of computing devices 1104-1110 shown in are intended to be illustrative only, and computing node 1102 and cloud computing environment 1100 may communicate with any type of computerized device (e.g., using a web browser) over any type of network and / or network-addressable connection.

[0091] Now see Figure 12 , showing a cloud computing environment 1100 ( Figure 11 ) provides a set of functional abstraction layers. For the sake of brevity, repeated descriptions of similar elements used in other embodiments described herein are omitted. First, it should be understood that Figure 12 The components, layers, and functions shown in are intended to be illustrative only, and embodiments of the present invention are not limited thereto. As described, the following layers and corresponding functions are provided.

[0092] Hardware and software layer 1202 includes hardware and software components. Examples of hardware components include: mainframe 1204; servers based on RISC (Reduced Instruction Set Computer) architecture 1206; servers 1208; blade servers 1210; storage devices 1212; and networks and network components 1214. In some embodiments, software components include network application server software 1216 and database software 1218.

[0093] The virtualization layer 1220 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers 1222 ; virtual storage 1224 ; virtual networks 1226 , including virtual private networks; virtual applications and operating systems 1228 ; and virtual clients 1230 .

[0094] In one example, the management layer 1232 may provide the functionality described below. Resource provisioning 1234 provides dynamic procurement of computing resources and other resources for performing tasks within the cloud computing environment. Metering and pricing 1236 tracks the cost of resource usage within the cloud computing environment and provides billing and invoicing for this purpose. In one example, these resources may include application software licenses. Security provides authentication for cloud consumers and tasks, as well as protection for data and other resources. User portal 1238 provides access to the cloud computing environment for consumers and system administrators. Service level management 1240 provides allocation and management of cloud computing resources to meet required service levels. Service level agreement (SLA) planning and fulfillment 1242 provides pre-scheduling and provisioning of future demand for cloud computing resources based on SLA forecasts.

[0095] The workload layer 1244 provides examples of functions that can utilize a cloud computing environment. Examples of workloads and functions that can be provided from this layer include: mapping and navigation 1246; software development and lifecycle management 1248; virtual classroom instruction provision 1250; data analysis processing 1252; transaction processing 1254; and pipeline certification 1256. Various embodiments of the present invention can utilize reference Figure 11 and 12 The described cloud computing environment automatically analyzes one or more pipelines for security compliance.

[0096] The present invention can be a system, method and / or computer program product of any possible degree of technical detail integration. The computer program product may include a computer-readable storage medium having computer-readable program instructions for causing a processor to execute various aspects of the present invention. The computer-readable storage medium may be a tangible device that can retain and store instructions for use by an instruction execution device. The computer-readable storage medium may be, for example but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer-readable storage media includes the following: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disc (DVD), a memory stick, a floppy disk, a mechanical encoding device (e.g., a punch card or a raised structure in a groove having instructions stored thereon), and any suitable combination thereof. Computer-readable storage media as used herein should not be construed as transient signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0097] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing / processing device, or downloaded to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in a computer-readable storage medium within the corresponding computing / processing device.

[0098] The computer-readable program instructions for performing the operation of the present invention can be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, configuration data of integrated circuits or source code or object code written in any combination of one or more programming languages, these programming languages ​​include object-oriented programming languages ​​(such as Smalltalk, C++ etc.) and process programming languages ​​(such as " C " programming languages ​​or similar programming languages). The computer-readable program instructions can be performed completely on the user's computer, partly on the user's computer, performed as an independent software package, partly on the user's computer and partly on a remote computer, or performed completely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer by any type of network (including local area network (LAN) or wide area network (WAN)), or can be connected to an external computer (for example, utilizing an internet service provider to connect to the internet). In certain embodiments, by utilizing the state information of computer-readable program instructions to personalize electronic circuits, for example programmable logic circuits, field programmable gate arrays (FPGAs) or programmable logic arrays (PLA), this electronic circuit can perform computer-readable program instructions, to perform various aspects of the present invention.

[0099] Various aspects of the present invention are described herein with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each block of the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer-readable program instructions.

[0100] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device to produce a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device is generated that implements the functions / actions specified in one or more blocks in the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, which can direct the computer, programmable data processing device, and / or other equipment to operate in a specific manner, so that the computer-readable storage medium storing the instructions comprises an article of manufacture that includes instructions for implementing various aspects of the functions / actions specified in one or more blocks in the flowchart and / or block diagram.

[0101] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, so that a series of operational steps are performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process, so that the instructions executed on the computer, other programmable apparatus, or other device implement the functions / actions specified in or in multiple blocks in the flowchart and / or block diagram.

[0102] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functions and operations of possible implementations of systems, methods and computer program products according to different embodiments of the present invention. In this regard, each box in the flowchart or block diagram may represent a module, segment or portion of an instruction, which includes one or more executable instructions for implementing a specified logical function. In some optional implementations, the functions marked in the box may not occur in the order marked in the figure. For example, depending on the functions involved, two blocks shown in succession may actually be executed substantially simultaneously, or the blocks may sometimes be executed in the opposite order. It will also be noted that each box in the block diagram and / or flowchart and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0103] To provide additional context for the various embodiments described herein, Figure 13 The following discussion is intended to provide a general description of a suitable computing environment 1300 in which various embodiments described herein may be implemented. Although the embodiments have been described above in the general context of computer-executable instructions that may be executed on one or more computers, those skilled in the art will appreciate that the embodiments may also be implemented in conjunction with other program modules and / or as a combination of hardware and software.

[0104] Generally, program modules include routines, programs, components, data structures, etc. that perform particular tasks or implement particular abstract data types. Moreover, those skilled in the art will appreciate that the methods of the present invention can be practiced with other computer system configurations, including single-processor or multi-processor computer systems, minicomputers, mainframe computers, Internet of Things ("IoT") devices, distributed computing systems, as well as personal computers, handheld computing devices, microprocessor-based or programmable consumer electronics, etc., each of which can be operably coupled to one or more related devices.

[0105] The illustrated embodiments of the embodiments herein may also be implemented in a distributed computing environment, where certain tasks are performed by remote processing devices linked through a communication network. In a distributed computing environment, program modules may be located in both local and remote memory storage devices. For example, in one or more embodiments, a computer executable component may be executed from a memory that may include one or more distributed memory units. As used herein, the terms "memory" and "memory unit" are interchangeable. Further, one or more embodiments described herein may be capable of executing the code of a computer executable component in a distributed manner, for example, a plurality of processors may combine or collaborate to execute code from one or more distributed storage units. As used herein, the term "memory" may include a single memory or memory unit at one location or a plurality of memories or memory units at one or more locations.

[0106] Computing devices typically include various media, which may include computer-readable storage media, machine-readable storage media, and / or communication media, the two terms being used differently herein as follows. A computer-readable storage medium or machine-readable storage medium can be any available storage medium that can be accessed by a computer, and includes both volatile and non-volatile media, removable and non-removable media. By way of example and not limitation, a computer-readable storage medium or machine-readable storage medium can be implemented in conjunction with any method or technology for storing information such as computer-readable or machine-readable instructions, program modules, structured data, or unstructured data.

[0107] Computer-readable storage media may include, but are not limited to, random access memory ("RAM"), read-only memory ("ROM"), electrically erasable programmable read-only memory ("EEPROM"), flash memory or other memory technology, compact disk read-only memory ("CDROM"), digital versatile disk ("DVD"), Blu-ray disc ("BD") or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, solid-state drives or other solid-state storage devices, or other tangible and / or non-transitory media that may be used to store the desired information. In this regard, the terms "tangible" or "non-transitory" as used herein for storage, memory, or computer-readable media should be understood as excluding only propagating transient signals per se as a modifier and not as a disclaimer of all standard storage, memory, or computer-readable media that are not merely propagating transient signals per se.

[0108] Computer-readable storage media can be accessed by one or more local or remote computing devices, eg, via access requests, queries, or other data retrieval protocols, for various operations relative to the information stored on the media.

[0109] Communication media typically embodies computer-readable instructions, data structures, program modules, or other structured or unstructured data as a data signal, such as a modulated data signal (e.g., a carrier wave or other transport mechanism), and includes any information delivery or transmission media. The term "modulated data signal" refers to a signal that has one or more characteristics set or changed in such a manner as to encode information in the signal or signals. By way of example, and not limitation, communication media include wired media, such as a wired network or direct-wired connection, and wireless media, such as acoustic, RF, infrared, and other wireless media.

[0110] Reference again Figure 13 , an exemplary environment 1300 for implementing various embodiments of the aspects described herein includes a computer 1302, which includes a processing unit 1304, a system memory 1306, and a system bus 1308. The system bus 1308 couples system components including, but not limited to, the system memory 1306 to the processing unit 1304. The processing unit 1304 can be any of various commercially available processors. Dual microprocessors and other multi-processor architectures can also be used as the processing unit 1304.

[0111] The system bus 1308 may be any of several types of bus structures capable of further interconnecting to a memory bus (with or without a memory controller), a peripheral bus, and a local bus using any of a variety of commercially available bus architectures. The system memory 1306 includes ROM 1310 and RAM 1312. A basic input / output system ("BIOS") containing the basic routines that help transfer information between elements within the computer 1302, such as during startup, may be stored in a nonvolatile memory such as ROM, erasable programmable read-only memory ("EPROM"), or EEPROM. RAM 1312 may also include high-speed RAM, such as static RAM for caching data.

[0112] The computer 1302 further includes an internal hard disk drive ("HDD") 1314 (e.g., EIDE, SATA), one or more external storage devices 1316 (e.g., a magnetic floppy disk drive ("FDD") 1316, a memory stick or flash drive reader, a memory card reader, a combination thereof, etc.), and an optical drive 1320 (e.g., which can read from or write to a CD-ROM disk, a DVD, a BD, etc.). Although the internal HDD 1314 is illustrated as being located within the computer 1302, the internal HDD 1314 can also be configured for external use in a suitable enclosure (not shown). In addition, although not shown in the environment 1300, a solid-state drive ("SSD") can be used in addition to or in place of the HDD 1314. The HDD 1314, the external storage device 1316, and the optical drive 1320 can be connected to the system bus 1308 via an HDD interface 1324, an external storage interface 1326, and an optical drive interface 1328, respectively. The interface 1324 for external drive implementations may include at least one or both of Universal Serial Bus ("USB") and Institute of Electrical and Electronics Engineers ("IEEE") 1394 interface technologies. Other external drive connection technologies are within the contemplation of the embodiments described herein.

[0113] The drives and their associated computer-readable storage media provide non-volatile storage of data, data structures, computer-executable instructions, and the like. For the computer 1302, the drives and storage media accommodate the storage of any data in a suitable digital format. Although the above description of computer-readable storage media relates to corresponding types of storage devices, those skilled in the art will appreciate that other types of storage media (whether currently existing or developed in the future) that can be read by a computer can also be used in the example operating environment, and further, any such storage media can contain computer-executable instructions for performing the methods described herein.

[0114] A number of program modules may be stored in the drives and RAM 1312, including an operating system 1330, one or more application programs 1332, other program modules 1334, and program data 1336. All or portions of the operating system, application programs, modules, and / or data may also be cached in RAM 1312. The systems and methods described herein may be implemented using various commercially available operating systems or combinations of operating systems.

[0115] Computer 1302 may optionally include emulation technology. For example, a hypervisor (not shown) or other intermediary may emulate the hardware environment for operating system 1330, and the emulated hardware may optionally communicate with the operating system 1330. Figure 131302. In this embodiment, operating system 1330 may comprise one of a plurality of virtual machines ("VMs") hosted at computer 1302. Additionally, operating system 1330 may provide a runtime environment, such as a Java runtime environment or a .NET framework, for applications 1332. A runtime environment is a consistent execution environment that allows applications 1332 to run on any operating system that includes a runtime environment. Similarly, operating system 1330 may support containers, and applications 1332 may be in the form of containers, which are lightweight, standalone, executable software packages that include, for example, code, a runtime, system tools, system libraries, and settings for an application.

[0116] Furthermore, the computer 1302 may enable a security module, such as a Trusted Processing Module ("TPM"). For example, with a TPM, before loading the next boot component, the boot component hashes the time of the next boot component and waits for the result to match a security value. This process can be performed at any layer in the code execution stack of the computer 1302, for example, at the application execution level or at the operating system ("OS") kernel level, thereby achieving security at any code execution level.

[0117] A user may enter commands and information into the computer 1302 through one or more wired / wireless input devices (e.g., a keyboard 1338, a touch screen 1340, and a pointing device such as a mouse 1342). Other input devices (not shown) may include a microphone, an infrared ("IR") remote control, a radio frequency ("RF") remote control, or other remote control, a joystick, a virtual reality controller and / or a virtual reality headset, a game pad, a stylus, an image input device (e.g., a camera), a gesture sensor input device, a visual movement sensor input device, an emotion or facial detection device, a biometric input device (e.g., a fingerprint or iris scanner), and the like. These and other input devices are often connected to the processing unit 1304 through an input device interface 1344, which may be coupled to the system bus 1308, but may be connected through other interfaces such as a parallel port, an IEEE 1394 serial port, a game port, a USB port, an IR port, a memory card, a memory card, a fingerprint scanner, or the like. Interfaces, etc.

[0118] A display 1346 or other type of display device may also be connected to the system bus 1308 via an interface, such as a video adapter 1348. In addition to the display 1346, computers typically include other peripheral output devices (not shown) such as speakers, printers, combinations thereof, and / or the like.

[0119] Computer 1302 can operate in a networked environment using logical connections via wired and / or wireless communications to one or more remote computers, such as one or more remote computers 1350. Remote computers 1350 can be workstations, server computers, routers, personal computers, portable computers, microprocessor-based entertainment devices, peer devices, or other public network nodes, and typically include many or all of the elements described with respect to computer 1302, but for the sake of simplicity, only memory / storage device 1352 is shown. The depicted logical connections include wired / wireless connections to a local area network ("LAN") 1354 and / or a larger network, such as a wide area network ("WAN") 1356. Such LAN and WAN networking environments are common in offices and companies and facilitate enterprise-wide computer networks, such as intranets, all of which can be connected to a global communication network, such as the Internet.

[0120] When used in a LAN networking environment, the computer 1302 can be connected to the local network 1354 through a wired and / or wireless communication network interface or adapter 1358. The adapter 1358 can facilitate wired or wireless communication to the LAN 1354, which can also include a wireless access point ("AP") disposed thereon for communicating with the adapter 1358 in a wireless mode.

[0121] When used in a WAN networking environment, the computer 1302 may include a modem 1360 or may be connected to a communication server on the WAN 1356 via other means for establishing communications over the WAN 1356, such as through the Internet. The modem 1360, which may be internal or external and a wired or wireless device, may be connected to the system bus 1308 via the input device interface 1344. In a networked environment, program modules depicted relative to the computer 1302, or portions thereof, may be stored in the remote memory / storage device 1352. It will be appreciated that the network connections shown are examples and other means of establishing a communications link between the computers may be used.

[0122] When used in a LAN or WAN networking environment, computer 1302 can access a cloud storage system or other network-based storage system in addition to or in place of the external storage device 1316 described above. Typically, the connection between computer 1302 and the cloud storage system can be established, for example, via adapter 1358 or modem 1360 over LAN 1354 or WAN 1356, respectively. When computer 1302 is connected to an associated cloud storage system, external storage interface 1326 can manage the storage provided by the cloud storage system, similar to other types of external storage, via adapter 1358 and / or modem 1360. For example, external storage interface 1326 can be configured to provide access to cloud storage sources as if those sources were physically connected to computer 1302.

[0123] The computer 1302 may be operable to communicate with any wireless device or entity operatively arranged for wireless communication, such as a printer, scanner, desktop and / or portable computer, portable data assistant, communication satellite, any piece of equipment or location associated with a wirelessly detectable tag (e.g., a booth, kiosk, store shelf, etc.), and a telephone. This may include Wireless Fidelity ("Wi-Fi") and Wireless technology. Thus, the communication can be a predefined structure like a typical network, or simply an ad hoc communication between at least two devices.

[0124] What has been described above only includes examples of systems, computer program products, and computer-implemented methods. Of course, for the purposes of describing the present disclosure, it is not possible to describe every conceivable combination of components, products, and / or computer-implemented methods, but one of ordinary skill in the art will recognize that many further combinations and permutations of the present disclosure are possible. In addition, to the extent that the terms "including," "having," "having," and the like are used in the specification, claims, appendices, and drawings, these terms are intended to be inclusive in a manner similar to the term "including," as interpreted when "including" is used as a transitional word in the claims. Descriptions of different embodiments have been presented for illustrative purposes, but are not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to one of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terms used herein are selected to best explain the principles of the embodiments, practical applications, or technical improvements to technologies found in the marketplace, or to enable one of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A system for pipeline authentication, comprising: memory, storing computer executable components; as well as a processor operatively coupled to the memory and executing the computer-executable components stored in the memory, wherein the computer-executable components include: an artifact classification component that scans static code assets from a code repository to classify source artifacts; an artifact mapping component that generates an artifact mapping relating the classified source artifacts to one or more security controls; an artifact identification component that identifies a source artifact associated with the computer application, wherein the source artifact is one of a plurality of source artifacts associated with the computer application and identified by the artifact identification component; and an applicable security control component that generates an applicable security control profile by identifying the one or more security controls associated with the identified source artifacts via the artifact mapping, wherein the applicable security control profile includes a plurality of security controls mapped to the plurality of source artifacts; and An authentication component authenticates a result from execution of the pipeline of the computer application based on a comparison of an implemented security control profile associated with the pipeline and an applicable security control profile associated with the computer application.

2. The system according to claim 1, further comprising: A dynamic parameter component is configured to remove applicable security controls from the applicable security control profile based on dynamic parameters defining security compliance exceptions.

3. The system according to claim 1, further comprising: a configuration mapping component that generates a configuration mapping that relates pipeline parameter configuration to the one or more security controls; as well as A configuration identification component identifies parameter configurations of the pipeline.

4. The system according to claim 3, further comprising: An implemented security control component generates the implemented security control configuration file by identifying implemented security controls related to the parameter configuration via the configuration mapping.

5. The system according to claim 4, further comprising: a comparison component that performs a comparison of the implemented security control profile with the applicable security control profile to determine whether results from the pipeline meet defined security standards; as well as An evidence reporting component generates an evidence report characterizing the comparison.

6. A computer-implemented method for pipeline authentication, comprising: scanning, by a system operatively coupled to the processor, static code assets from a code repository to classify source artifacts; generating, by the system, an artifact mapping relating the classified source artifacts to one or more security controls; identifying, by the system identification component, a source artifact associated with the computer application; as well as generating, by the system, an applicable security control profile by identifying, via the artifact mapping, the one or more security controls associated with the identified source artifact; removing, by the system, applicable security controls from the applicable security control profile based on dynamic parameters defining security compliance exceptions; as well as Results from the execution of the pipeline for the computer application are validated by the system based on a comparison of the implemented security control profile associated with the pipeline and the applicable security control profile associated with the computer application.

7. The computer-implemented method of claim 6, further comprising: generating, by the system, a configuration map relating pipeline parameter configuration to the one or more safety controls; identifying, by the system, parameter configurations of the pipeline; as well as The implemented security control profile is generated by the system by identifying, via the configuration map, implemented security controls associated with the parameter configuration.

8. The computer-implemented method of claim 7, further comprising: A comparison of the implemented security control profile with the applicable security control profile is performed by the system to determine whether results from the pipeline meet defined security criteria.

9. A computer program product for pipeline authentication, the computer program product comprising program instructions executable by a processor to cause the processor to: scanning, by the processor, static code assets from a code repository to classify source artifacts; generating, by the processor, an artifact mapping relating the classified source artifacts to one or more security controls; identifying, by the processor identification component, a source artifact associated with the computer application, wherein the source artifact is one of a plurality of source artifacts associated with the computer application and identified by the artifact identification component; and generating, by the processor, an applicable security control profile by identifying, via the artifact mapping, the one or more security controls associated with the identified source artifacts, wherein the applicable security control profile includes a plurality of security controls mapped to the plurality of source artifacts; Results from the execution of the pipeline of the computer application are validated by the processor based on a comparison of an implemented security control profile associated with the pipeline and an applicable security control profile associated with the computer application.

10. The computer program product of claim 9, wherein: The program instructions further cause the processor to: generating, by the processor, a configuration map relating pipeline parameter configuration to the one or more safety controls; and The processor identifies parameter configuration of the pipeline.

11. The computer program product according to claim 10, wherein: The program instructions further cause the processor to: The implemented security control profile is generated by the processor by identifying, via the configuration map, implemented security controls associated with the parameter configuration.

12. The computer program product of claim 11, wherein: The program instructions further cause the processor to: A comparison of the implemented security control profile with the applicable security control profile is performed by the processor to determine whether results from the pipeline meet defined security criteria.

Images