Azure DevOps security - Lessons learned
summary
Azure DevOps shows concrete attack paths and fixes: allow public projects literally exposes every API endpoint (including undocumented ones) to an anonymous user, research finds roughly 40% insecure Marketplace tasks and old runtimes like Node 6 remain in use, the default verify pipeline pre-merge behavior lets someone with read access run code in CI and inject persistence, mounting build jobs in containers read-only prevents test-driven destruction, use VM scale sets with managed identities and PIM for least‑privilege service connections, never check “grant access to all pipelines,” and forward audit logs beyond the three‑month retention.
AI-written summary · about
chapters (11)
- 0:00Azure DevOps security risks
- 1:47Initial access via public projects
- 5:37Dependency tampering in tasks
- 8:03Poisoned pipeline execution
- 17:41Separating code and pipelines
- 25:33Test destruction with containers
- 31:56Privilege escalation and PIM
- 38:27Managed identities and secrets
- 41:37Lateral movement risks
- 45:37Logging and audit events
- 47:45Summary and lessons
related talks
42mAzure DevOps security - Lessons learned
44mAzure DevSecOps
56mSeamlessly integrate security throughout your code to cloud workflow
25mSecuring Your DevOps Transformation
39mHow to steal Azure DevOps secrets
50mBest Practices for Securing CI/CD Pipelines
38mHiding in the Clouds: Abusing Azure DevOps Services to Bypass Microsoft Sentinel Analytic Rules
55mAzure Attacks Unpacked: Real-World Threats & Lessons