Threat Modelling in CI/CD environments
summary
Argues STRIDE from 1999 still maps to modern CI/CD by walking a concrete dataflow: GitHub/GitLab/Bitbucket → Jenkins pipelines → SonarQube/Aqua security scans → Docker images in Artifactory → Ansible/SSH deployment into containers. Calls out specific risks like Jenkins as formalized RCE, tampering of build artifacts, IPR leakage from storage, and container escape risk and prescribes mitigations such as central immutable logging and least privilege plus iterating the model every six months.
AI-written summary · about
chapters (19)
- 0:00Threat modelling intro
- 2:00What is threat modelling
- 3:44Threat modelling in any env
- 4:48Understanding STRIDE
- 8:24Data flow and trust boundaries
- 10:35Trust boundaries
- 15:10CI/CD data flow
- 17:42Trust boundaries in CI/CD
- 18:48STRIDE for source code
- 21:36STRIDE for pipelines
- 23:41In-pipeline security tools
- 25:04STRIDE for binary storage
- 26:07Installation interface threats
- 26:29Container boundary risks
- 26:50Communications interface threats
- 27:52STRIDE limitations
- 28:35Internal threats and STRIDE
- 30:20Iterative threat modelling
- 31:26Next steps and conclusion
related talks
28mStandard Classification: Threat Modeling the CI/CD Pipeline to Improve Softwar...
48mStrong Foundations: Insightful learning vs trial-and-error in CI/CD
38mSecuring your CI/CD Pipeline
12mInterview of Henri Gomez
37mA Secure Continuous Delivery Pipeline
39mContinuous Security at the Next Level
43mThe art of secure software: Zero-trust delivery pipelines
36mBuilding Security Frameworks Into Your CI/CD Pipelines