Best Practices for Securing CI/CD Pipelines

on YouTube ↗50m

" summary

Shows an end-to-end Azure DevOps CI/CD pipeline that deploys infrastructure to Azure and enforces build-time security checks. It uses Azure DevOps with Azure Container Registry, runs parallel container image scans (Anchore or similar and Microsoft scanners), gates builds on license/vulnerability findings, validates IaC/templates against Microsoft security baselines, vaults secrets for pipeline agents, and reports scan results back to pull requests.

AI-written summary · about

" chapters (8)

1. 0:00Securing CI/CD pipelines
2. 5:00Shift security left
3. 14:13Pipeline security gates
4. 25:29Demo: Securing containers
5. 33:14Open source vs commercial tools
6. 39:42Access control and credentials
7. 43:11Proactive security automation
8. 45:33Q&A

" related talks

• 50mBest practices for securing CI/CD pipelineVictoria Almazova · NDC Oslo 2019
• 40mBest Practices for Securing CI/CD Pipelines or How to Get Security RightVictoria Almazova · DevOpsCon Spring 2019
• 44mAzure DevSecOpsPeter De Tender · PowerShell + DevOps Global Summit 2022
• 46mAutomating Infrastructure as Code with Azure DevOpsErick Moore · Indy Cloud Conf 2020
• 46mLet Azure control your DevOps PipelinesPeter De Tender · PowerShell + DevOps Global Summit 2022
• 52mImplement DevSecOps in AzureVictoria Almazova · NDC Porto 2019
• 55mWhat you need to know about security for cloud DevOpsMohamed Radwan · AzConf 2020
• 49mModern CI/CD Pipeline with Azure DevOpsSergey Abanichev · DevOps Fest 2020 Online