Pwning the CI Workflow and How to Prevent It - Steve Giguere
Channel: OWASP London
Date: 2022-09-10

Pwning the CI Workflow and How to Prevent It - Steve Giguere

Our journey to open source and GitOps heaven has exposed new security challenges as our CI platforms are exposed to the outside world. The soft underbelly of our development pipeline is visible as much to willing contributors as it is malicious subversives looking for the keys to the backdoor. In this talk, we'll look at some known potential exploits to GitHub Actions workflows to show how simple misconfigurations or straight up bad practices can leave our supply chain wide open to attackers.

SPEAKER BIO:

Steve Giguere (@SteveGiguere)

Steve Giguere is a Developer Advocate with Bridgecrew by Prisma Cloud specialising in cloud and infrastructure security automation. Prior to this Steve was a Solution Architect for StackRox and Aqua Security specialising in container and kubernetes security and also previously spent several years at Synopsys establishing DevSecOps best practices for enterprise CI/CD pipelines. Steve runs DevSecOps London Gathering community and several security podcasts including CoSeCast - The Continuous Security Podcast, Twitch/YouTube show C9K, as well as a personal blog and podcast called Codifyre.

The slides of this talk can be downloaded here: https://github.com/OWASP/www-chapter-london/raw/master/assets/slides/OWASPLondon20220908_PwningtheCI-Steve_Giguere.pdf

This talk was presented at the OWASP London Chapter Meeting on September 8th, 2022. This event was kindly sponsored and hosted by  @thoughtmachine903