Top Gun's unsung hero - a surprising lesson for CI/CD security

The talk opens in 1968, when the U.S. Navy's losses over Vietnam had mounted to nearly a thousand aircraft. An investigation traced the problem to flawed missile procurement and to pilots who relied on rigid tactics that the enemy had learned to predict. The speaker highlights the officer who was tasked with setting up the fighter weapons school, who chose to train pilots to expect failure and adapt quickly. The speaker then ties that lesson to securing software delivery.

Applying this to CI/CD, the speaker walks through a pipeline from source code to production and lists core properties to control: branch protection and code review, pipeline-as-code, curated package sources, and policy checks at deploy time. Cross-system bypasses are the main example, such as a feature branch publishing packages to a production location, or a main-branch build pulling dependencies straight from the internet. Because no single system's logs reveal these flows, the speaker recommends collecting build, source control, and package logs in one place, enriching them with lookup data such as which branches are protected, and building alerts with playbooks. Direct commits to protected branches and freestyle Jenkins jobs are offered as easy starting detections.

The closing argument separates quick tactical fixes from strategic root-cause investigations, which are worth doing when events repeat. The speaker also argues that encouraging engineers to report pipeline weaknesses turns them into useful alert sources. In the Q&A, the speaker favors guardrails, such as avoiding unsupported or vulnerable build tool versions, over strict tool standardization.