Machine-Readable Compliance Evidence: NIST SSDF and Patch Controls as Code for Federal Cloud Authorization

A cryptographically verified approach to secure Docker container updates in CI/CD pipelines

SMT: SBOM and Merkle Tree Based Integrity Verification for Serverless Environments

Serverless computing environments are vulnerable to software supply chain attacks due to their heavy reliance on external libraries. However, existing integrity verification methods are centered on runtime execution logs, which limits their ability to directly detect tampering with function code and dependencies. In this paper, we propose an integrity verification framework that combines a Software Bill of Materials (SBOM) with a Merkle Tree, hereafter referred to as an SMT scheme. By utilizing SBOMs within the CI/CD (Continuous Integration/Continuous Delivery) pipeline, the SMT scheme establishes a trusted baseline at deployment time. Furthermore, it verifies both code and runtime integrity by correlating runtime execution logs with corresponding SBOM hash values. Experimental results demonstrate that the SMT scheme effectively detects code and dependency tampering attacks while incurring only a modest overhead of approximately 5–10% relative to existing method.

Analyzing Wazuh-Based File Integrity Monitoring for Layered Academic Server Security

The proposed system demonstrates the potential to serve as an effective and practical host-level security layer for strengthening cybersecurity resilience in academic server environments, although the evaluation was limited to three monitored servers and did not include advanced adversarial attack scenarios.

Mathematical model and software architecture of verifiable audit of compliance with information security policy based on blockchain anchoring

Improving the Security of Containerized Workloads using Transparency and Traceability Services

Containerized workloads are commonly built via CI/CD pipelines, stored in registries, and executed across heterogeneous infrastructures, including cloud and edge environments. A single compromised build step or credential can turn routine automation into large-scale distribution of malicious artifacts, motivating integrity, transparency, and enforceable deployment-time checks. In this paper, we present an architecture for verifiable container image distribution that addresses key-management challenges and enables policy-enforced admission-time verification. A transparency service generates one-time signing keys bound to authenticated identities, records signing events in an append-only transparency registry, and returns cryptographically verifiable proofs of inclusion. These proofs and identity attributes are attached to image metadata and evaluated by policy-as-code at admission time, so only compliant artifacts are deployed. We implement a proof-of-concept integrated with GitHub Actions and GitLab Runners and evaluate how the resulting pipeline mitigates common supply-chain attacks under a realistic threat model.

Securing CI/CD Pipelines: A DevSecOps Framework for Preventing Credential Leaks and Misconfigurations

Continuous Integration and Continuous Deployment (CI/CD) pipelines have become fundamental to modern software engineering, enabling rapid and reliable delivery of applications. However, their automation introduces critical vulnerabilities, particularly credential leaks and misconfigurations, which undermine the security of development and deployment environments. This study investigates security risks in Dock-er-based GitHub Actions workflows and proposes a tailored, DevSecOps-aligned security checklist to mitigate these threats. A systematic literature review was combined with hands-on experiments, in which controlled credential exposures and workflow misconfigurations were deliberately introduced and analyzed. Security controls such as secret scanning with GitGuardian and TruffleHog, configuration validation with GHAST, and access control enforcement were tested in a CI/CD testbed. The findings demonstrate that these integrated methods significantly reduce the risk of credential leakage and pipeline hijacking, while maintaining minimal performance overhead. The novelty of this work lies in consolidating fragmented best practices into a work-flow-specific model that is immediately applicable to real-world projects. This contrib-utes actionable guidance for secure-by-design CI/CD pipelines, offering practical protection against supply-chain threats while preserving delivery speed and scalability.