How Can CI/CD Go Horribly Wrong?
Source: YouTube · John Hammond · published May 31, 2023 · 18:06
CI/CD pipelines pose significant security risks when misconfigured, allowing attackers to compromise entire systems through simple vulnerabilities 4:19-5:27.
Key Takeaways:
• CI refers to continuous integration (building and testing software), while CD can mean continuous delivery or deployment 1:49-2:46
• GitHub Actions pipelines often store sensitive credentials as environment variables, creating security risks 8:24-8:53
• OIDC (OpenID Connect) provides a more secure alternative by eliminating long-lived credentials 9:03-9:38
• Pipeline poisoning attacks allow attackers to inject malicious commands and exfiltrate secrets 12:52-15:28
Proper CI/CD security requires moving beyond basic environment variable protection to more robust authentication methods like OIDC.
Sources:
- 1:49-2:46 Definition of CI/CD concepts
- 4:19-5:27 Security risks in CI/CD pipelines
- 8:24-8:53 Environment variables and secrets
- 9:03-9:38 OIDC as secure alternative
- 12:52-15:28 Pipeline poisoning attack demonstration
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
over in that GitHub workflows upload yaml file I know that's sort of the hey the configuration for GitHub actions as you mentioned and those Secrets those are the juicy things here that are attractive for us hackers and and Pen testers here now those are staged as environment variables are there any downfalls as drawbacks is the environment variables just the way to go and then it's a matter of somehow making sure they are protected it depends a lot on what you're trying to do if you're trying to access AWS this is insecure there's better ways to do it alrighty hey this is super duper cool I'm super stoked to be hanging out with two of my great friends uh Ignacio and Carlos over at halborn and man it's spent a little bit of time since I seen you both I think we were hanging out at rooted c…