Pwning the CI Workflow and How to Prevent It - Steve Giguere
Our journey to open source and GitOps heaven has exposed new security challenges as our CI platforms are exposed to the outside world. The soft underbelly of our development pipeline is visible as much to willing contributors as it is malicious subversives looking for the keys to the backdoor. In this talk, we'll look at some known potential exploits to GitHub Actions workflows to show how simple misconfigurations or straight up bad practices can leave our supply chain wide open to attackers.
SPEAKER BIO:
Steve Giguere (@SteveGiguere)
Steve Giguere is a Developer Advocate with Bridgecrew by Prisma Cloud specialising in cloud and infrastructure security automation. Prior to this Steve was a Solution Architect for StackRox and Aqua Security specialising in container and kubernetes security and also previously spent several years at Synopsys establishing DevSecOps best practices for enterprise CI/CD pipelines. Steve runs DevSecOps London Gathering community and several security podcasts including CoSeCast - The Continuous Security Podcast, Twitch/KZitem show C9K, as well as a personal blog and podcast called Codifyre.
The slides of this talk can be downloaded here: github.com/OWA...
This talk was presented at the OWASP London Chapter Meeting on September 8th, 2022. This event was kindly sponsored and hosted by @thoughtmachine903
Негізгі бет Pwning the CI Workflow and How to Prevent It - Steve Giguere
Пікірлер