Bet Your Jenkins Isn't Configured Securely?
summary
The talk examines common Jenkins security misconfigurations and demonstrates how typical installations are left vulnerable. It reviews specific Jenkins settings and plugins that often lack proper hardening and outlines practical configuration steps and checks to make Jenkins installations more secure.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 3:04Jenkins security settings
- 7:50Arbitrary code on master
- 14:17User database risks
- 15:21Shared build nodes issues
- 21:58Credential theft from memory
- 26:07Global secrets storage flaws
- 30:30Groovy script security limits
- 35:23Script approval dangers
- 39:09DSL script threats
- 41:00Read build logs without rights
- 41:22Q&A
related talks
51mJenkins or: How I learned to stop worrying and love automation
05mSecuring Jenkins with Pod Security Policies
39mContinuous Security at the Next Level
20mAI-Driven Security as Code in Jenkins
43mSecurity in DevOps Strategies
26mMistakes Made Integrating Security Scanning into CI/CD
26mYour code might be secure, but what about your pipeline? ...
11mIdentifying Security Vulnerabilities at Scale: Venture Inside a Pipeline