Threat Modeling the CI/CD Pipeline to Improve Software Supply Chain Security

Explore threat modeling techniques for CI/CD pipelines to enhance software supply chain security in this 28-minute OWASP conference talk. Delve into notable incidents, fundamental disconnects in modern software development, and the importance of threat modeling. Examine confidentiality and availability impacts, supporting infrastructure, and perimeter-related challenges. Analyze a sample CI/CD pipeline dataflow, following code changes through various stages. Address general concerns, source repository management, open source component risks, build management, security testing, and software packaging and distribution. Learn how to apply threat modeling insights to improve vendor management and engage in potential argument discussions. Gain valuable knowledge to strengthen your organization's software supply chain security posture.