Azure DevOps security - Lessons learned

on YouTube ↗42m

" summary

Azure DevOps often exposes real attack surfaces: allow public projects makes org APIs discoverable, forks plus pull requests let readers inject YAML that runs on internal runners, and about 40% of older tasks have known security issues or bad dependencies. Fixes shown include separating pipeline YAML into its own repo, using containers with read‑only mounts, converting service connections to workload identity federation and managed identities, disabling grant access to all pipelines, and turning on audit logging.

AI-written summary · about

" chapters (16)

1. 0:00Azure DevOps security intro
2. 1:34Dev and Ops security gap
3. 2:38Public project API risks
4. 6:35Deprecated pipeline tasks
5. 9:09Unsupported Node versions
6. 11:13Pipeline template risks
7. 11:54Branch policy vulnerabilities
8. 17:20Code injection via YAML
9. 21:33Container isolation for injection
10. 24:55Privilege escalation pitfalls
11. 27:05Entra ID privileged access
12. 29:59Service credentials federation
13. 32:07Managed DevOps pools
14. 36:21Pipeline resource lateral movement
15. 38:34Audit logging defense
16. 40:46CI/CD security best practices

" related talks

• 49mAzure DevOps security - Lessons learnedBjörn Sundling · PowerShell + DevOps Global Summit 2023
• 44mAzure DevSecOpsPeter De Tender · PowerShell + DevOps Global Summit 2022
• 25mSecuring Your DevOps TransformationApril Edwards · devopsdays Amsterdam 2020
• 56mSeamlessly integrate security throughout your code to cloud workflowBrendan Burns, Steven Murawski, Rita Zhang, Bryan Sullivan, Levent Besik, Ankur Patel, Paige Boggie, Adria Martin, Joseph Christianson, Nicolas Couraud, Collin Davis, Santosh Kumar Panchapakesan, David Trigano · Microsoft Build 2023
• 55mWhat you need to know about security for cloud DevOpsMohamed Radwan · AzConf 2020
• 20mDeliver Secure Software with Azure Devops & GithubVidya Narasimhan · Developers Summit 2021
• 50mBest Practices for Securing CI/CD PipelinesVictoria Almazova · NDC London 2020
• 39mHow to steal Azure DevOps secretsBjörn Weström · NDC London 2023