Threat Models for Delivery Systems

Why this matters

An attacker pushes a malicious commit through a stolen token, the pipeline builds it faithfully, signs it, and deploys it to production with full ceremony. Every control worked; the threat model never considered token theft against a pressing need for speed. Controls without models protect the imagined attack while the real one walks the delivery path like a customer. Modeling first is how the pipeline's defenses face the actual adversary instead of the audit checklist.

Concepts

The model answers four questions. Assets: source code, build infrastructure, signing keys, registries, deploy credentials, and the production they reach. Actors: external attackers, malicious dependencies, careless insiders, compromised third-party services. Paths: stolen credentials, poisoned dependencies, tampered build steps, registry confusion, unreviewed automation with broad rights. Mitigations: branch protection with required review, short-lived scoped credentials, pinned dependencies, hermetic builds, signatures with verification, least-privilege automation throughout.

Prioritize by expected harm, not by headline. A likely path with moderate impact (dependency confusion in an unpinned manifest) beats a cinematic path with tiny likelihood for attention this quarter. The model ranks, the roadmap follows, and the ranking revisits when the path changes: new registry, new build vendor, new deploy target all reopen the model before they go live.

Scope the model to the delivery path, not the universe. Application threats live in their own model; this one covers source to production. The boundary keeps the exercise completable and the mitigations deployable. Review triggers are events (path changes, incidents, new tooling), with a calendar backstop so drift cannot silence it.

Worked example

A fictional pipeline is modeled end to end: assets listed, three actors with plausible paths each, mitigations ranked by expected harm. The top mitigation (scoped short-lived build credentials replacing a shared long-lived key) ships first with the incident it would have contained described. The model fits two pages; the ranking drives the quarter.

Common wrong move

Modeling once for compliance and filing it. Paths change monthly, dependencies weekly; a filed model describes a system that no longer exists. Living triggers or the model is decoration.