How to protect your CI/CD from a Supply chain attack?
summary
Shows concrete defenses against supply‑chain attacks in CI/CD: generate automated SBOMs (SPDX) during builds, run Trivy SCA and vuln scans with quality gates that block images with critical CVEs, sign images and promote builds through per‑environment registries rather than anonymous pulls. Also covers building minimal runtime images (multi‑stage builds, remove build tools), forbidding secrets in images and enforcing least‑privilege service accounts, using admission controllers and GitOps to validate deployments, and feeding Trivy results into an observability stack like Prometheus/Grafana for continuous monitoring.
AI-written summary · about
chapters (18)
- 0:00How to protect your CI/CD from a Supply chain attack?
- 1:00What is a supply chain attack?
- 5:25Recommendation #1
- 8:00Recommendation #2
- 10:44Recommendation #3
- 12:19Recommendation #4
- 14:44Recommendation #5
- 16:45Recommendation #6
- 18:56Recommendation #7
- 20:42Recommendation #8
- 23:31Recommendation #9
- 25:20Recommendation #10
- 26:46Recommendation #11
- 29:17Recommendation #12
- 31:23Recommendation #13
- 33:00Recommendation #14
- 34:51Recommendation #15
- 37:02Conclusion
related talks
38mSecuring your CI/CD Pipeline
35mPractical Guides for Enhancing Your Software Supply Chain Security
34mFrom development to release: Protecting the software supply chain
41mSupply Chain Armoring: Tools and Techniques for Open Source Projects
38mSupply Chain Security & the Real World: Lessons From Incidents
43mThe art of secure software: Zero-trust delivery pipelines
23mMastering Secure Software Supply Chains
37mSupply Chain Attacks and the Future of Software Delivery