Enhancing CI/CD Secrets Security: The 3Rs Approach - Bobby Lin

Description
This year, our industry encountered a security incident where the CI provider was compromised and their master private key was stolen. The threat actor was able to decrypt the customer's CI secrets with the stolen master private key. This incident makes me think about the current state of our CI/CD secret practices and how we can further improve these practices. In this talk, I am going to summarise some of my thoughts and experiments done into three principles (which …

actor compromised current customer decrypt incident industry key master private private key secrets secrets security security security incident state stolen threat threat actor