What Executives Need to Know About CI/CD Pipelines and Supply Chain Security
summary
Explains how modern CI/CD developer pipelines create complex attack surfaces and what executives should know to assess related security risks. Covers evaluation techniques for both in-house build pipelines and questions to ask software suppliers to improve supply chain security.
AI-written summary · about
chapters (22)
- 0:00Start
- 4:42What is a CI/CD Pipeline?
- 5:33Answers The Question
- 5:47Example CI/CD Pipeline Dataflow
- 9:41Impact of Compromise
- 12:12The Fundamental Disconnect
- 15:54Follow a Code Change (continued)
- 18:05What an Executive Needs to Know
- 19:25General or Overarching Concerns
- 22:37Source Repository and Workflow Engine
- 24:02Executive Action: Source Code
- 24:33Open-Source Component Management
- 25:33Open-Source Backdoor Concerns
- 26:25Executive Action: Open-Source
- 28:11Executive Action: Build Management
- 29:54Automated Testing: Security Testing
- 32:04Security Testing and Backdoors
- 33:12Executive Action: Testing
- 33:34Software Packaging and Distribution
- 34:48Software Distribution
- 35:13Executive Action: Packaging and Distribution
- 44:03Questions
related talks
48mCI/CD Security
40mBest Practices for Securing CI/CD Pipelines or How to Get Security Right
38mSupply Chain Security & the Real World: Lessons From Incidents
30mDevSecOps: How Secure Is Your Pipeline?
38mSecuring your CI/CD Pipeline
16mTime for a Check-Up of Your CI/CD Pipelines!
45mDefending CI/CD against attacks
41mHow to protect your CI/CD from a Supply chain attack?