Securing your CI/CD Pipeline
summary
Claim: secure the CI/CD pipeline as if it is production, because build servers get compromised (CCleaner supply‑chain example). Practical steps: treat CI/CD as production with monitoring, alerting and write‑once signed logs (journalbeat/auditbeat/filebeat → SIEM, CloudTrail); start manual scans then automate using tools like retire, OWASP Dependency‑Check, ZAP and Nessus and track findings in DefectDojo. Secrets get rotated and consumed via a vault, IAM is centralized with MFA, immutable infrastructure removes SSH, and threat modeling plus small iterative fixes keep pipelines usable.
AI-written summary · about
chapters (10)
- 0:00Start
- 4:49Your application in a container...
- 8:02General issues
- 12:41Every production environment should h
- 23:19Identity & Access Management
- 27:53The pipeline (App) - start with depende
- 31:28The pipeline (App) -Static Code analysis
- 33:18The pipeline (App) - Dynamic analysis
- 34:39The pipeline (infra)
- 36:43Recomendations
related talks
40mBest Practices for Securing CI/CD Pipelines or How to Get Security Right
26mYour code might be secure, but what about your pipeline? ...
43mThe art of secure software: Zero-trust delivery pipelines
32mAre your CI/CD Pipelines Secure
40mAre your CI/CD Pipelines Secure?
37mA Secure Continuous Delivery Pipeline
29mSecuring Your Web Application Pipeline From Intruders
33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines