Enhancing CI/CD Secrets Security: The 3Rs Approach
summary
Describes concrete fixes: after a real incident where a CI provider’s master private key was stolen the talk lays out the 3Rs — inventory and remove high‑risk scopeless tokens, inject secrets at runtime via OIDC short-lived tokens, and stop leaks with pre‑commit/pre‑receive hooks plus custom SAST rules. Presents a built serverless on‑demand wrapper that enforces repo/branch and IP restrictions, recommends canary tokens, and shows short‑lived creds reduce urgent rotation and materially limit blast radius.
AI-written summary · about
chapters (19)
- 0:00CI/CD secrets security intro
- 1:07Current CI/CD secret practices
- 5:21CI/CD breach case studies
- 8:16Reduce CI/CD secrets stored
- 13:57Overly permissive secrets handling
- 17:51Canary tokens for intrusion detection
- 19:15Minimize long-lived secrets
- 21:50Short-lived secrets with OIDC
- 27:53Prevent CI/CD secret leakage
- 30:30Detect secrets in Git repos
- 34:07Prevent secrets in logs
- 36:36Mask secrets in CI/CD logs
- 40:00Key factors for securing secrets
- 41:05Q&A: Git hooks & secrets
- 42:36Q&A: Short-lived secrets
- 44:04Q&A: CI/CD security evolution
- 45:30Q&A: Tools for unnecessary secrets
- 46:55Q&A: Applying the 3Rs
- 48:45Closing remarks
related talks
34mSecuring your CICD Pipeline
38mSecuring your CI/CD Pipeline
32mAre your CI/CD Pipelines Secure
40mAre your CI/CD Pipelines Secure?
43mThe art of secure software: Zero-trust delivery pipelines
33mAre your Pipelines Secure? Lock-down unsecured CI/CD Pipelines
37mSecurity Doesn’t Have To Be a Nightmare
45mAttackers' Nightmare: An Infrastructure Without Secrets