Protecting CI/CD from malicious deploys
summary
Shows concrete attack chains against GitHub Actions and build chains and demonstrates what actually goes wrong and how to fix it: GitHub Actions exploit: pipeline token can approve PRs and steal repo secrets, package registry publishing and poisoned dependencies, self hosted runners that share state, and overly broad deployment credentials that give full cloud access. Demonstrates mitigations that work today: enforce SSO and separate accounts, use GitHub environments and scoped tokens or OpenID Connect for tokenless roles, and monitor CI logs.
AI-written summary · about
chapters (22)
- 0:00Securing CI/CD pipelines
- 1:04Traditional production threats
- 3:13CI/CD as critical infrastructure
- 8:13Risk modeling in security
- 10:20Threat actor attack methods
- 13:28Attack paths in CI/CD workflows
- 16:54Securing the CI/CD system
- 20:06GitHub developer account risks
- 23:16Private vs work GitHub accounts
- 26:04Enforcing SSO for GitHub
- 27:50Separate vs shared accounts
- 29:14Finding secrets in code
- 31:39Preventing direct production pushes
- 33:24GitHub Actions token risks
- 34:51Why GitHub secrets aren't secret
- 36:15GitHub environments for secrets
- 37:00OpenID Connect for deployments
- 38:01Admin privilege risks in GitHub
- 38:22Self-hosted GitHub Runners risks
- 39:06Malicious package publishing
- 40:10Reducing impact of secrets compromise
- 40:51Summary and best practices
related talks
23mBreaking the Build: How Attackers Abuse GitHub Actions
55mBeyond the Commit: Weaponizing and Hardening GitHub Actions
15mGitHub Actions: a time bomb for supply chain security
57mGitHub Actions: A Cloudy Day for Security
28mPwning the CI (with GitHub Action Workflows)
56mHow to use GitHub Actions with Security in mind
44mAttacking & Defending Supply Chains. How we got Admin in your Cloud,...
42mProtecting Your GitHub from Supply Chain Attacks