Untapped Territory: Strengthening Defenses Against CI/CD Security Threats

The talk argues that CI/CD pipelines are an under-protected entry point into software systems. The speaker traces how development moved from waterfall to agile and then to DevOps, with automation widening what needs guarding. Several real incidents anchor the discussion, including SolarWinds, Codecov, Travis CI, a compromised PHP git server, dependency confusion and the Deep Source breach.

The core walks through the OWASP top 10 pipeline risks one at a time, describing how each is exploited and what damage follows. Examples cover missing review gates, build credentials with more access than needed, poisoned pipelines through direct edits or tampered scripts, and secrets leaking into logs. Suggested defenses include avoiding self-hosted git servers without hardening, resolving packages from internal repositories first, withholding secrets from fork pull requests, scoping permissions per pipeline step, limiting third-party tool access, centralizing tamper-resistant logs, and checking artifact integrity continuously.

The speaker closes by previewing an OWASP pipeline verification standard, modeled on ASVS, that aims to offer checkable controls. Key takeaways include reviewing past incidents with your team, layering controls, assuming compromise will eventually happen, and treating pipeline security as ongoing work. The Q&A extended the scope to developer workstations, especially for remote staff.