Best Practices for Securing CI/CD Pipelines or How to Get Security Right
summary
A practical guide to securing CI/CD pipelines by integrating security checks throughout the flow: use infrastructure-as-code scanning before deployment, container image scanning in the registry, dependency and license checks to block risky libraries, and ensure IAM/production credentials never enter source repositories. Also use cloud provider security centers and automated smoke/security acceptance tests for continuous feedback, while recognizing full penetration tests remain later and expensive.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 2:06DevOps to security in CI/CD
- 5:01Security is everyone's job
- 6:25Security checklists & automation
- 8:36Threat modeling for CI/CD
- 10:21Security tools integration
- 13:55Dependency security
- 16:45Infrastructure security in pipelines
- 18:11Automated security scanning
- 20:00Security acceptance testing
- 21:46Penetration testing in CI/CD
- 22:52Monitoring security feedback
- 23:36Security intelligence & cloud
- 25:28Post-mortem & improvement
- 26:50Incident response lessons
- 27:51Real-world security examples
- 29:58Open-source security tools
- 31:46Credential security
- 32:52Security in every step
- 34:41Container security hardening
- 36:05Cloud security practices
- 37:10Dedicated security roles
- 38:36Q&A
related talks
38mSecuring your CI/CD Pipeline
48mCI/CD Security
34mContinuous Security - Integrating Pipeline Security
50mBest Practices for Securing CI/CD Pipelines
50mBest practices for securing CI/CD pipeline
30mDevSecOps: How Secure Is Your Pipeline?
31mContinuous Security – integrating security into your pipelines
20mA Practical Guide to CI/CD Security Gating