Are your Pipelines Secure? Lock-down unsecured CI/CD Pipelines
summary
Unsecured pipeline secrets let attackers access APIs, databases and cloud resources; the demo pipeline builds Docker images, runs tests in parallel and creates a GKE cluster so deployment only proceeds if tests pass. Concrete mitigations: add container scanning and static analysis early, stop committing cleartext creds, rotate secrets on a schedule and use a secrets manager such as HashiCorp Vault or cloud KMS. The payoff is fewer stale keys, auditable access and blocked deployments when vulnerabilities appear.
AI-written summary · about
chapters (25)
- 0:00Intro
- 2:19History : Software: Development
- 2:36Software : Development: Practices
- 2:54Waterfall: Development
- 5:14Agile : Development
- 7:29Continuous Integration : Continuous Delivery
- 11:35Automation
- 11:56CI/CD : Pipelines
- 14:35Pipeline : Integrations
- 14:47Integration : Types
- 15:51Dev: Sec: Ops
- 16:56Shift: Security: Left
- 19:26Pipeline : Vulnerability: Scans
- 19:42App: Scanning : Pipelines
- 20:01Container : Scanning : Pipelines
- 20:55Integration : Access
- 22:06CI/CD : Pipeline : Obstacles
- 22:40secrets: provide : access
- 22:58exposed : pipelines
- 23:17weak : stale : secrets
- 24:43inadequate : mechanisms
- 26:21secrets management
- 26:37tooling :protect : secrets
- 28:45auto: rotate : passwords
- 29:11granular : access: controls
related talks
33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines
40mAre your CI/CD Pipelines Secure?
32mAre your CI/CD Pipelines Secure
38mSecuring your CI/CD Pipeline
26mYour code might be secure, but what about your pipeline? ...
40mBest Practices for Securing CI/CD Pipelines or How to Get Security Right
18mContinuous Security - Building Security into your Pipelines
37mIs Your Approach to Pipeline Security Flawed? Rethinking CI/CD Security