Leon Goldberg, Cider Security GraphSummit 2022

1. Leon Goldberg
Visualizing CI/CD
An attacker’s perspective

2. CI/CD in a Nutshell

3. Monthly executions of CI/CD
pipelines worldwide (Jenkins)
58m
34m
17m
8m
3m
0.9m
https://stats.jenkins.io/jenkins-stats/svg/svgs.html

5. Defenders think in lists.
Attackers think in graphs.
As long as this is true,
attackers win.”
– John Lambert, Distinguished Engineer and General Manager,
Microsoft Threat Intelligence Center
“

7. Who am I?
Leon Goldberg
Chief Architect
Cider Security

8. SCM
SCM

9. CI
SCM Integration

10. Artifact Management
SCM Integration
Artifact
Management

11. Deployment
SCM Integration
Artifact
Management Deployment

12. Live Environments
SCM Integration
Artifact
Management Deployment Production

13. Engineering Concepts & Considerations
1. Naive vs. intelligent relationships
2. Variance in graph resolution
3. User friendly vs. algorithmic nodes and edges
4. Vendor normalization

14. 1. Naive vs. Intelligent Relationships

15. 2. Variance in Graph Resolution

16. 3. User-Friendly vs.
Algorithmic Nodes & Edges

17. 4. Vendor Normalization

18. Customer Value
1. Enhanced visibility
2. Attack vector and blast radius discovery
3. Attack vector and blast radius simulations
4. Anomaly detection

19. 1. Enhanced visibility

20. 2. Attack Vector and Blast
Radius Discovery

21. 3. Attack Vector and
Blast Radius Simulations

22. 4. Anomaly detection

23. Main Takeaways
1. CI/CD is becoming increasingly popular,
yet it also is a vast and complex attack surface.
2. Attackers think in graphs – and this is indeed true
for the CI/CD attack surface as well.
3. For defenders to keep up, they need to adopt the
same mindset, and likewise think in graphs.
4. There are interesting challenges and considerations
in engineering and modeling CI/CD graphs…
5. …however, by successfully doing so, the attack
surface becomes significantly less intimidating!

24. Thank you!