Mitigating OWASP Top 10 CI/CD with AWS
summary
CI/CD pipelines get concrete controls: centralize identities and packages (use AWS Identity Center, AWS Organizations, CodeArtifact), move secrets into AWS Secrets Manager and rotate them, sign artifacts with AWS Signer and verify at deploy, scan images and functions with Amazon Inspector and feed findings to Security Hub. Follow a practical 4C model (centralize, control, cleanse, communicate), enforce permission boundaries on roles, automate cleanup with Lambda/EventBridge, and note the scale: 512,000 malicious packages with 156% growth; Spotify reports a 40% drop in incidents and 30% faster deployments.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:07OWASP Top 10 CI/CD risks
- 4:40Inadequate identity management
- 7:53Dependency change abuse
- 11:03Insufficient credential storage
- 14:15Insecure system configuration
- 17:31Pipeline permission risks
- 21:53IM permission boundaries
- 24:21Full secure CI/CD pipeline
- 26:55Key takeaways and conclusion
related talks
43mThe art of secure software: Zero-trust delivery pipelines
37mDevelop and implement a successful DevSecOps approach
38mSecuring your CI/CD Pipeline
07mCI/CD Evolution: Ensuring Security and Overview During Rapid Growth
40mBest Practices for Securing CI/CD Pipelines or How to Get Security Right
42mContinuous Security: Integrate security tools into your DevOps Pipeline
17mOIDC and CICD: Why Your CI Pipeline Is Your Greatest Security Threat
28mStandard Classification: Threat Modeling the CI/CD Pipeline to Improve Softwar...