Are your CI/CD Pipelines Secure
summary
CICD pipelines require two concrete controls: run static analysis and container vulnerability scans on every commit and integrate a dedicated secrets manager so credentials are not baked into jobs. Secrets stay encrypted at rest and in flight but become plaintext at runtime, so use a manager that can generate strong random secrets, auto rotate them on a policy cadence (start with weekly then move to daily or hourly), enforce granular access/audit trails, and plug into platforms like CircleCI dashboard to revoke and reissue immediately. Unexpected data point: some orgs keep secrets for five years.
AI-written summary · about
chapters (7)
- 0:00Secure CI/CD pipelines
- 2:21Software development history
- 7:13Agile to DevOps to CI/CD
- 14:09What is DevSecOps
- 19:27Securing pipelines with secrets
- 27:35CI/CD and DevSecOps best practices
- 31:29Q&A
related talks
40mAre your CI/CD Pipelines Secure?
33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines- 33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines
34mSecuring your CICD Pipeline
38mSecuring your CI/CD Pipeline
40mBest Practices for Securing CI/CD Pipelines or How to Get Security Right
26mYour code might be secure, but what about your pipeline? ...
18mContinuous Security - Building Security into your Pipelines