Close Encounters of the Vulnerable Kind: A DevSecOps Odyssey

The talk examines how CI/CD pipelines have widened the attack surface and whether security is keeping pace. It begins with the traditional model, where security reviews sit at the end of the pipeline and send findings back to developers, creating bottlenecks. The talk then turns to shifting security left, with checks such as pre-commit secret scanning and software composition analysis placed earlier in the workflow.

The middle section walks through recurring weak points: vulnerable third-party dependencies, with Log4j as a prominent example; static and dynamic analysis tools that bring false positives and blind spots; and infrastructure-as-code files that outsiders could modify. Persistent build servers are contrasted with ephemeral build containers, and the SolarWinds case illustrates how a compromised build server can inject code that then passes signing. Other risks include hard-coded secrets, excessive permissions, missing peer review, rare artifact signing and missing logging.

The closing part argues that culture matters as much as tooling. Suggestions include understanding developer constraints before proposing fixes, supplying concrete implementation examples alongside policy, and building security champion roles inside teams. Vendor claims should be checked critically, and the Cyber Defense Matrix can help map tool coverage and expose redundancy and gaps.