SecAppDev original
Break things, but not security: CI/CD done right
Video and handoutsSecAppDev 2025
-
Abstract
This session explores how to build fast, secure CI/CD pipelines without compromising on velocity. We dive into the dangers of over-automation, like supply chain attacks and secret leaks, and show how embedding security early mitigates these risks. Supported by real-world attack examples, we learn which tools are must-haves and which can wait. We will also examine the economics of security tooling: comparing built-in, open-source, and vendor solutions, so you can make smart, secure choices at scale.
Handouts available for this lecture
DownloadChapters
- Introduction and speaker background
- Why secure CI/CD matters
- OWASP CI/CD Top 10 and logging visibility
- Artifact integrity and the Codecov breach
- Risks of ungoverned third-party services
- Insecure system configuration and SolarWinds
- Credential hygiene and Travis CI secrets exposure
- Pipeline-based access controls
- Poisoned pipeline execution
- Dependency chain abuse
- Identity and access management
- Flow control mechanisms
- What is missing from the CI/CD Top 10
- Security tools and practical pipeline setup
- Questions and discussion
In-person course
Gijs Van Laer taught at a previous edition of SecAppDev
SecAppDev is an immersive course in secure application development, running annually since 2005. World-renowned faculty from industry and academia deliver in-depth 90-minute lectures and full-day workshops in an intimate setting, typically in early June.
More about SecAppDev