What's a key component in today's CI/CD landscape with (broad) access to your environment?
Execution agents. These are your build servers, where your pipelines run. They have a few gotchas:
(1) They have direct access to the environments you are deploying to;
(2) They are complex, with plenty of layers that make attestation, detection and attribution hard;
(3) They are less scrutinized and their criticality is often underestimated, compared to classic compute workloads.
So what? you ask. Isn't this "just" an insider threat scenario? How would someone even get onto the machine, especially when in an organization with multiple layers of defense. Direct access to the build agent is needed - OR is it? (that was slightly sarcastic - it's not needed; let me show you).
By the end, build server security will be top of mind and (hopefully) on someone's @TODO list.
