The Stealth Code Conspiracy: Unmasking Hidden Threats in CI/CD Pipelines
Conference
C0c0n 2024
November 16, 2024
Abstract
We talk about hidden security risks in GitHub Actions, Workflows, and Apps. We’ll explore covert attack vectors, real-world vulnerabilities, and effective strategies to secure our CI/CD pipelines against these emerging threats.
Key Topics Covered
- Hidden CI/CD Threats - Understanding covert attack vectors
- GitHub Actions Security - Protecting automation workflows
- Real-world Vulnerabilities - Case studies of actual attacks
- Defense Strategies - Effective protection mechanisms
- Best Practices - Securing CI/CD pipelines
Technical Focus
- Workflow Security - Protecting GitHub Actions workflows
- App Security - Securing GitHub Apps and integrations
- Attack Vectors - Understanding sophisticated attack methods
- Detection Methods - Identifying hidden threats
Impact
This talk provided practical insights into CI/CD security, helping organizations understand and defend against sophisticated automation attacks.
Related Work
- ActionsGuardHub - AI-powered security scanning
- CI/CD Security - Comprehensive pipeline protection
- Automation Security - Protecting development workflows