Misplaced Trust: The Security Flaw in Modern Code Signing Process

Modern code signing systems are foundational building blocks to securing our software supply chain. Therefore, ensuring the security of these code signing systems and Continuous Integration and Continuous Deployment (CI/CD) pipelines is paramount. This paper highlights the security risks with current code signing systems with a relevant case study of the Solarwinds attack and recommends best practices to mitigate such risks.