Owasp Cicd

title: 'CICD-SEC-10: Insufficient Logging and Visibility' description: OWASP CI/CD Top 10 reference for insufficient logging and visibility vulnerabilities including blind spots and inadequate audit trails

10 Insufficient Logging and Visibility

Identifier: CICD-SEC-10:2025 Category: Logging and Visibility

Description

Insufficient logging and visibility risks allow an adversary to carry out malicious activities within the CI/CD environment without being detected during any phase of the attack kill chain, including identifying the attacker's TTPs (Techniques, Tactics, and Procedures) as part of any post-incident investigation.

The existence of strong logging and visibility capabilities is essential for an organization's ability to prepare for, detect, and investigate a security-related incident. While workstations, servers, network devices, and key IT and business applications are typically covered in depth within an organization's logging and visibility programs, it is often not the case with systems and processes in engineering environments.

Given the amount of potential attack vectors leveraging engineering environments and processes, it is imperative that security teams build the appropriate capabilities to detect these attacks as soon as they happen. As many of these vectors involve leveraging programmatic access against the different systems, a key aspect is to create strong levels of visibility around both human and programmatic access.

Both audit logs (user access, user creation, permission modification) and applicative logs (push events, build executions, artifact uploads) are equally important for maintaining sufficient visibility.

Risk

• Organizations that do not ensure appropriate logging and visibility around engineering environments may fail to detect a breach entirely.

• Minimal investigative capabilities create great difficulties in mitigation and remediation after a breach.

• Time and data are the most valuable commodities during incident response, and the absence of all relevant data sources in a centralized location can be the difference between a successful and devastating outcome.

• Attackers can operate undetected for extended periods within CI/CD systems.

• Post-incident analysis is severely hampered without comprehensive audit trails across all CI/CD systems.

• Inability to correlate events across SCM, CI, artifact repositories, and deployment systems prevents detection of multi-stage attacks.

Vulnerability checklist

• No complete inventory exists of all CI/CD systems, including all instances of self-managed systems.

• Audit logs are not enabled on all CI/CD systems, or are not enabled to their full extent.

• Applicative logs (pipeline execution, artifact operations, code operations) are not captured.

• Logs from CI/CD systems are not shipped to a centralized location such as a SIEM.

• No alerts exist to detect anomalies or potential malicious activity in CI/CD systems.

• Programmatic access to CI/CD systems is not logged or monitored to the same degree as human access.

• No correlation rules exist to detect anomalies across the code shipping process involving multiple systems.

• Log retention periods are insufficient for investigation of incidents discovered with a delay.

Prevention controls

1. Build and maintain a comprehensive inventory of all CI/CD systems in use, including every instance of self-managed systems.

2. Identify and enable all relevant log sources across every CI/CD system, covering both human and programmatic access through all available methods.

3. Enable both audit log sources (user access, user creation, permission changes) and applicative log sources (push events, build executions, artifact operations).

4. Ship all CI/CD logs to a centralized location such as a SIEM to support aggregation and correlation across systems.

5. Create alerts to detect anomalies and potential malicious activity within each system as well as across the code shipping process spanning multiple systems.

6. Ensure log retention periods are sufficient for post-incident investigation requirements.

7. Monitor programmatic access with the same rigor as human access.

Example attack scenarios

Scenario A — Undetected credential exfiltration

An attacker compromises a CI pipeline through a poisoned dependency and exfiltrates credentials stored as environment variables. Because no logging exists for outbound network connections from build nodes and pipeline execution events are not shipped to a centralized monitoring system, the credential theft goes undetected. The attacker uses the stolen credentials for months, laterally moving across production environments, before the breach is discovered through an unrelated investigation.

Scenario B — Delayed incident response due to missing logs

A build server is compromised and used to inject a backdoor into production artifacts. When the compromise is eventually discovered, the incident response team attempts to reconstruct the attack timeline. However, audit logs were not enabled on the CI system, and execution logs were retained for only seven days. The team cannot determine when the compromise began, what credentials were accessed, or which artifacts were affected, leading to a full rebuild of all production infrastructure.

Detection guidance

• Verify that all CI/CD systems have audit and applicative logging enabled and configured.

• Confirm that logs from all CI/CD systems are being shipped to and received by the centralized SIEM.

• Test alert rules by simulating anomalous activities across CI/CD systems.

• Periodically review log coverage to identify CI/CD systems or event types that are not being captured.

• Validate that programmatic access events (API calls, token usage, webhook invocations) are logged.

• Confirm log retention periods meet investigation requirements.

Remediation

• Conduct a comprehensive inventory of all CI/CD systems and instances, identifying gaps in log coverage.

• Enable all audit and applicative log sources on every CI/CD system.

• Configure log shipping from all CI/CD systems to the centralized SIEM or logging platform.

• Develop and deploy detection rules and alerts for anomalous activity across CI/CD systems, including multi-system correlation rules.

• Extend log retention periods to meet organizational incident investigation requirements.

• Ensure programmatic access is logged and monitored at parity with human access.

• Conduct periodic log coverage reviews to catch newly-added systems or configuration drifts.