WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
WeAreDevelopers LIVE • Oct 12, 2020

Securing Your Web Application Pipeline From Intruders

Milecia Mcgregor

Is your CI/CD pipeline an open door for attackers? Embed automated security testing directly into your deployments to stop threats without sacrificing release velocity.

Pause
Mute Enter Fullscreen
#1 about 4 min

Introduction to securing web application deployment pipelines

Mitigating the escalating risks of data breaches requires implementing proactive security measures directly inside deployment workflows.

#2 about 5 min

Establishing best practices for efficient deployment pipelines

Small build sizes and parity between staging and production environments prioritize fast and reliable code deployments.

#3 about 5 min

Why continuous integration security is often overlooked

The shift left movement imposes time constraints and unfamiliar configurations that delay pipeline security integration.

#4 about 5 min

Tactics and tools used by external malicious actors

External attackers leverage automated suites, misconfigurations, leaked secrets, and outdated dependencies to compromise existing software.

#5 about 4 min

Integrating static security scanning in the build phase

Software composition analysis scanners identify vulnerable dependencies before compiled artifacts reach subsequent deployment stages.

#6 about 3 min

Dynamic application security testing during the test phase

Dynamic and interactive application scanners actively detect runtime vulnerabilities like cross-site scripting and authentication failures.

#7 about 3 min

Running compliance and security audits in pre-production delivery

Specialized pre-production checks enforce regulatory compliance and prevent destructive database queries before production deployment.

#8 about 3 min

Managing vulnerabilities in production environments through bug bounties

Crowdsourced human testing uncovers deeply hidden logic flaws that automated tools miss in production systems.

#9 about 7 min

Implementing manual security practices and pipeline configuration management

Routine management of user access permissions and deployment controls prevents unauthorized pipeline usage and data leaks.

#10 about 4 min

Embedding automated vulnerability analysis within CircleCI workflows

Utilizing dedicated security orbs within YAML configurations surfaces critical dependency risks dynamically during scheduled builds.

#11 about 3 min

Constructing secure Python deployment sequences using Conductor

Structuring continuous delivery flows through Python rather than YAML streamlines dependency testing and containerized node execution.

#12 about 2 min

Configuring open source dependency tests in Travis CI

Adding security commands to standard open source build configurations blocks known vulnerabilities from entering public codebases.

#13 about 3 min

Reviewing core strategies for robust pipeline security

Committing to proactive credential scanning and routine pipeline audits blocks attackers from discovering easily explorable backdoors.

Matching moments

1:07 min

Evaluating current trends in CI/CD pipelines

Dominik Kress · LIVE

1:00 min

Encouraging broader team adoption of security automation practices

Ramona Schwering Ramona Schwering · WWC 2024

3:30 min

Integrating security into initial continuous integration deployment pipelines

Thomas Fuchs +3 · LIVE

3:05 min

Injecting automated security into mobile CI/CD pipelines

Moataz Nabil Moataz Nabil · LIVE

1:53 min

Transitioning toward DevSecOps with dynamic scanning and secrets management

Christoph Ruggenthaler · LIVE

5:25 min

Shifting left and creating internal security champion programs

Vandana Verma Sehgal · LIVE

More from WeAreDevelopers LIVE

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz thumbnail
5:43
5 days ago

Aliens in Quarantine, Python Deprecates Loops, and AI Buys Old Books - Zbyszek Tenerowicz

Chris Heilmann, Daniel Cranney

WeAreDevelopers LIVE - Node and Package Security thumbnail
1:08:30
6 days ago

WeAreDevelopers LIVE - Node and Package Security

Chris Heilmann, Daniel Cranney, Zbyszek Tenerowicz

WeAreDevelopers LIVE - Streaming HTML thumbnail
1:10:26
13 days ago

WeAreDevelopers LIVE - Streaming HTML

Chris Heilmann, Daniel Cranney, Jad Joubran

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe thumbnail
1:02:34
20 days ago

WeAreDevelopers LIVE - CODE100 at WeAreDevelopers Europe

Chris Heilmann, Daniel Cranney, Justin Halsall, Werner Jeschko, Nicole Jeschko, Mirco Tomić

WeAreDevelopers LIVE - Web Performance in an AI World thumbnail
1:07:59
27 days ago

WeAreDevelopers LIVE - Web Performance in an AI World

Chris Heilmann, Daniel Cranney

FIFA Hack, Midjourney Does Ultrasounds, and Trampoline Traffic Lights - Nicole Jeschko and Werner Jeschko thumbnail
5:55
about 2 months ago

FIFA Hack, Midjourney Does Ultrasounds, and Trampoline Traffic Lights - Nicole Jeschko and Werner Jeschko

Chris Heilmann, Daniel Cranney

Upcoming sessions on this topic

Open session

World Congress 2026 North America

Stop Running Mystery Meat in Production

Jeroen van Erp

Technical Advocate @ SUSE

Jeroen van Erp
Open session

World Congress 2026 North America

SecurePrompt: Building a Pre-Flight Security Layer for Agentic AI

Ravi Sastry Kadali

AI/ML Engineer at General Motors

Ravi Sastry Kadali
Open session

World Congress 2026 North America

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

Don’t kill my Vibes - Simple Steps to Stay Secure when Vibe Coding

Isaac Evans

Co-founder & CEO of Semgrep

Isaac Evans
Open session

World Congress 2026 North America

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

Securing AI Agent Infrastructure: Identity, Attestation, and Trust at Scale

Abdel Fane

Founder of OpenA2A

Abdel Fane

Related videos

Enabling automated 1-click customer deployments with built-in quality and security thumbnail
44:40
LIVE • over 5 years ago

Enabling automated 1-click customer deployments with built-in quality and security

Christoph Ruggenthaler

DevSecOps: Injecting Security into Mobile CI/CD Pipelines thumbnail
45:08
LIVE • almost 5 years ago

DevSecOps: Injecting Security into Mobile CI/CD Pipelines

Moataz Nabil

Security Pitfalls for Software Engineers thumbnail
27:32
WWC 2023 • almost 3 years ago

Security Pitfalls for Software Engineers

Jasmin Azemović

DevSecOps culture thumbnail
16:00
WWC 2023 • almost 3 years ago

DevSecOps culture

Ali Yazdani

Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together thumbnail
23:34
WWC 2022 • about 4 years ago

Secure Code Superstars: Empowering Developers and Surpassing Security Challenges Together

Stefania Chaplin

You can’t hack what you can’t see thumbnail
29:34
LIVE • almost 6 years ago

You can’t hack what you can’t see

Reto Kaeser

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.