Is Your Approach to Pipeline Security Flawed? Rethinking CI/CD Security
summary
Shows concrete CI/CD failures and fixes: pipelines gain privileges via pipeline resources as credentials, branches run different pipeline configs so main-branch protections are bypassed by running feature-branch executions, and Terraform’s null_resource and local-exec can exfiltrate environment variables when run in CI. Demonstrations include self-hosted agent crontab persistence across jobs, Checkov external checks that steal code and delete evidence, and recommendations to segment credentials, harden build agents, and apply allowlists and monitoring.
AI-written summary · about
chapters (14)
- 0:00CI/CD security flaws
- 1:55CI/CD system anatomy
- 3:19Pipeline permissions
- 9:59Bypassing approval gates
- 12:47Terraform pipeline exploits
- 16:23Over-privileged pipelines
- 18:08Build server security
- 22:23Build server compromise
- 24:54Shared build server risks
- 27:42Shared templates risks
- 29:54Build server security balance
- 33:03Managed build servers
- 35:32Pipeline and build security
- 36:34Conclusion
related talks
26mYour code might be secure, but what about your pipeline? ...
33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines
38mSecuring your CI/CD Pipeline
40mBest Practices for Securing CI/CD Pipelines or How to Get Security Right- 33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines
40mAre your CI/CD Pipelines Secure?
34mContinuous Security - Integrating Pipeline Security
48mCI/CD Security