Level Up Your CI/CD: Building a secure pipeline with OSS
What does the "perfect" CI/CD pipeline look like, especially one built with security at its core? This hands-on workshop explores that ideal using readily available open-source tools. We'll dissect the essential stages of a modern pipeline, demonstrating how to integrate security seamlessly throughout the development lifecycle (DevSecOps).
Through practical, step-by-step guidance, we'll implement key security checks like Static Application Security Testing (SAST), Software Composition Analysis (SCA), infrastructure vulnerability scanning, and secrets detection using popular OSS tools within a functional pipeline. While we'll showcase specific tools and configurations, the goal is not just replication, but understanding how and why these security controls work.
Discover the underlying principles of secure pipeline design and leave with actionable techniques to start building your own hardened, practical CI/CD pipeline.
Workshop repository: https://github.com/unicrons/secure-pipeline-workshop
Prerequisites
- A laptop with a GitHub account and a code editor.
- Basic familiarity with Git and CI/CD concepts (no prior security tooling experience required).
- All tooling used is free and open source.
Outline
1. Introduction & Welcome
- Brief presenter introduction.
- Setting the stage: The need for secure CI/CD pipelines.
2. Scope & Learning Objectives
- Workshop Focus: Demonstrate building a "perfect" (secure and practical) CI/CD pipeline using open-source tools (OSS).
- Key Goal: Inspirational, not prescriptive. Attendees should understand principles and identify modular components for adaptation.
- Learning Outcomes: Understand key stages of a secure pipeline, relevant OSS tools, and principles for building/improving their own secure CI/CD.
- Out of Scope (What this workshop is NOT):
- Deep dives into specific development workflows.
- Focus on a specific application technology stack.
- A definitive statement on the "best" tools.
3. "CI/CD/CS" Fundamentals Recap
- Quick overview: What is Continuous Integration (CI) / Continuous Delivery/Deployment (CD) / Continuous Security (CS)?
4. The "Perfect" Secure Pipeline Overview
- Visual representation of target pipeline stages.
- Explanation: Steps presented sequentially for learning, but in practice:
- Not all steps run on every trigger.
- Some steps can run in parallel.
5. Secure Pipeline Step-by-Step Breakdown (Hands-On)
For each key security stage (SAST, Secrets Detection, SCA, Container Scanning, IaC Scan, etc):
- Goal: What security risk are we mitigating?
- OSS Tool Demo: How we implement this using a chosen OSS tool (e.g., Semgrep for SAST, Trivy for container scanning, Trufflehog for secrets). Briefly mention 1-2 alternatives.
- Hands-On - Break & Fix:
- Show pipeline without check, demonstrating failure.
- Attendees integrate the OSS security tool in their own fork.
- Trigger pipeline, show failure due to security issue.
- Fix the code/configuration.
- Re-run pipeline to show successful (secure) pass.
6. Conclusion & Key Takeaways
- Recap of demonstrated secure pipeline principles and stages.
- Reiteration of the modular/inspirational approach.
- Pointer to resources (slides, code repository, list of alternative tools).
- Q&A.
Co-creator of unicrons.cloud, sharing cloud security knowledge with the community. Started as a sysadmin, evolved into SRE, and a few years ago crossed over to Security. Running and playing padel when I'm out of tokens.
My day-to-day involves helping organizations keep their cloud environments secure and compliant with whatever regulations apply to them. It’s a field that never stops changing, and that’s part of what keeps me hooked.
Outside of work, I like hiking in the mountains, flying drones, and tinkering with open source projects when I have the time.