Securing your CICD Pipeline
summary
CircleCI’s January breach exposes how CI/CD pipelines hold high-privilege deploy keys, forcing teams to rotate secrets for a week to six weeks and in one case two weeks to rotate a single credential. Concrete mitigations include using one-time secrets, scoping pipeline credentials to specific runners and resources, replacing long-lived keys with OIDC temporary tokens, signing commits/images with OpenPubKey/sigstore, and keeping logs; BastionZero open-sources the key-certification component and Docker adopts it for official images.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 3:00CircleCI breach impact
- 7:15Self-hosted vs SaaS CICD
- 10:09Zero trust for CICD
- 15:17OpenID Connect in CICD
- 19:49Securing CICD pipelines
- 20:57Supply chain security
- 23:12OpenPubkey for public key certification
- 28:51Q&A
related talks
32mAre your CI/CD Pipelines Secure
17mOIDC and CICD: Why Your CI Pipeline Is Your Greatest Security Threat
33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines
40mAre your CI/CD Pipelines Secure?
49mEnhancing CI/CD Secrets Security: The 3Rs Approach- 33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines
38mSecuring your CI/CD Pipeline
05mBreaking Up with Long-lived Secrets: Secure Automation in the Mode...