# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEP-CI-003
title: Limit network access of builds to approved registries
finding:
  title: Build environments can reach any host on the internet
status: draft
profiles: [hardened]
risk:
  severity: medium
assessment: partial
tags: [ci, network]
description: |
  Build and install steps can only reach the organization's registries and the services the build requires. Other outbound traffic is blocked and logged.
rationale: |
  Blocks malicious install code from exfiltrating secrets or downloading a second stage, and stops builds from silently fetching unvetted code.
impact: |
  Builds that download from the internet break until their sources are proxied.
audit:
  manual: |
    1. From a build environment, try to reach an arbitrary internet host: it must fail.
    2. Check that blocked attempts are logged.
  checks:
    - id: postmortem
      engine: postmortem
      description: "harden-runner egress policy; network-level egress is not visible"
      spec:
        command: postmortem harden --json
        control: CB-DEP-CI-003
        coverage: partial
remediation:
  manual: |
    1. Apply an egress allowlist to build environments, limited to approved registries and required services.
references:
  - title: SLSA specification v1.0
    url: https://slsa.dev/spec/v1.0/
    publisher: OpenSSF
    kind: standard
    accessed: 2026-10-16
  - title: OWASP Top 10 CI/CD Security Risks
    url: https://owasp.org/www-project-top-10-ci-cd-security-risks/
    publisher: OWASP
    kind: guide
    accessed: 2026-10-16
mappings:
  - framework: nist-800-53r5
    framework_version: 5.1.1
    id: SC-7
    relation: related
threats:
  - framework: mitre-attack
    id: T1041
related_controls:
  - id: CB-DEP-SRC-001
    type: related
authors:
  - name: Alice
    github: Sn0wAlice
introduced_in: 1.0.0
created: 2026-10-16
updated: 2026-10-16