Your code might be secure, but what about your pipeline? ...
summary
Claim: CI/CD components are the weak link — misconfigured CI, SCM or artifact stores let attackers bypass code review and inject artifacts. Evidence: common findings include exposed Jenkins with no auth, lack of MFA and patching, disabled branch protection, excessive admin rights, and shared workspaces leaking production secrets. Remedies actually used: enforce least privilege, segregate pipelines and secrets, enable branch protection, and adopt build provenance (SLSA/salsa) with signature verification so only tested artifacts deploy.
AI-written summary · about
chapters (7)
- 0:00Start
- 3:43Make Sure that Our Application Is Secure
- 9:01What Can Go Wrong
- 13:20Lack of Branch Protection Mechanism
- 16:58Why Are We Even Securing the Pipeline
- 17:17Artifact Management
- 21:58Lack of Integrity Checks
related talks
38mSecuring your CI/CD Pipeline
37mIs Your Approach to Pipeline Security Flawed? Rethinking CI/CD Security
33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines- 33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines
40mAre your CI/CD Pipelines Secure?
32mAre your CI/CD Pipelines Secure
43mThe art of secure software: Zero-trust delivery pipelines
18mContinuous Security - Building Security into your Pipelines