Critical CI/CD vulnerabilities that hardly anyone talks about.
What it’s about
CI/CD pipelines are the new target. Compromise the CI/CD and you compromise the whole company.
I go through the top 10 CI/CD vulnerabilities, attacks on Jenkins, GitLab CI, GitHub Actions and CircleCI, and supply chain attacks through CI/CD. I also cover stolen secrets and credentials and how to defend pipelines with defense in depth.
Why it’s relevant
CI/CD is the gateway to production. A compromised pipeline means malicious code in production and nobody noticing.
I’ve seen real attacks where the attacker compromised the CI/CD and spent months injecting backdoors into every deployment.
Impact
It was one of the most shared talks of RootedCON 2020. Many companies did a thorough review of their CI/CD security after watching it.
Later I presented an extended version at the Sonatype DevSecOps Leadership Forum 2020.