The summary.
WHOEVER CONTROLS THE PIPELINE CONTROLS PRODUCTION
Protect it as tightly as production itself, and never expose production secrets to builds of untrusted changes.
Give automation its own credentials, scoped to exactly what it does.
MINIMUM ACCESS, FOR THE SHORTEST TIME
Individual accounts with elevation when required, never shared administrative accounts — those are unattributable and never changed.
Log every use of elevated privilege.
SEPARATE PRODUCTION CREDENTIALS FROM EVERYTHING ELSE
Development environments are less protected and more widely accessible. Never connect one to production data.
HARDEN BY REMOVING
Only what is needed installed, unused services disabled, default accounts and sample files removed, default-deny firewall.
Never broaden permissions to clear an error — the error is replaced by a compromise.
THE FIRST VISIBLE SIGN OF COMPROMISE IS USUALLY OUTBOUND
A compromised system communicates outward, and is frequently used for someone else's computing, which shows as load.
DO NOT CLEAN AND CONTINUE
Without closing the entry point it returns. Prefer rebuilding from a known-good state, and check whether backups already contain the compromise.
