This talk was recorded at NDC Security in Oslo, Norway. #ndcsecurity  #ndcconferences  #security  #developer   #softwaredeveloper    

Attend the next NDC conference near you: 
https://ndcconferences.com
https://ndc-security.com/

Subscribe to our YouTube channel and learn every day:  @NDC 

Follow our Social Media!

https://www.facebook.com/ndcconferences
https://twitter.com/NDC_Conferences
https://www.instagram.com/ndc_conferences

#applicationsecurity #cloudsecurity #hacker #supplychain #cicdpipeline #devsecops 

With CI/CD pipelines driving modern DevSecOps, ensuring they don't become attack vectors is a shared concern across enterprises. This talk introduces a new perspective focusing on provable CI/CD security, while steering away from securing pipelines directly.

What exactly is a pipeline? What systems and resources does it interact with? And most importantly, how can we ensure that no pipeline becomes a pivot point for an attacker to compromise our most valuable systems? Can we be confident pipelines are running what we expect and providing the necessary evidence supporting engineering quality requirements?

These questions point to a (perhaps overlooked) concept: Protected Resources. In this talk, we will explore how shifting to a new mindset can promote visibility into pipelines, ensure adherence to security protocols, and prevent pipelines from becoming attack vectors. We'll delve into practical strategies to gain observability, improve compliance, and better secure your CI/CD system in the age of automation.

Is Your Approach to Pipeline Security Flawed? Rethinking CI/CD Security - Patricia Rodrigues