Interview of Henri Gomez
summary
Claims that CI/CD pipelines are now primary targets and that compromise is inevitable unless pipelines are hardened; attackers inject fake dependencies or compromised Docker images that become binary artifacts via dependency resolution. Recommends auditing origins (prefer Apache, Eclipse), generating provenance with Gradle build scans (also works for SBT/Bazel) and automating checks with JFrog Xray, allowing loose checks during development but enforcing stricter validation before production deployment.
AI-written summary · about
chapters (10)
- 0:00Welcome to Henri Gomez
- 1:11CI/CD focus on security
- 2:17Supply chain attacks and vectors
- 3:43Software bill of materials (SBOM)
- 5:09Trusting sources and dependencies
- 6:55Whitelisting dependencies challenges
- 8:00Security vs development speed
- 9:29Strict rules in production
- 10:30Exploitable vulnerabilities
- 11:15Supply chain security final thoughts
related talks
38mSecuring your CI/CD Pipeline
26mYour code might be secure, but what about your pipeline? ...
28mStandard Classification: Threat Modeling the CI/CD Pipeline to Improve Softwar...
37mA Secure Continuous Delivery Pipeline
18mContinuous Security - Building Security into your Pipelines
32mThreat Modelling in CI/CD environments
43mThe art of secure software: Zero-trust delivery pipelines
31mContinuous Security – integrating security into your pipelines