Onsdag – 1 · Frimurerlosjen, rom 1
Security Engineer, Norges Bank Investment Management
As a Security Engineer at Norges Bank Investment Management (NBIM), Stian works on operationalizing a cyber security strategy for the world's largest sovereign wealth fund. He primarily focuses on architecting and implementing new initiatives within cloud security and operations, while continuously adapting security controls and defensive strategies to address the evolving cyber threat landscape.
Modern software delivery chains create a class of indirect privilege that most security teams don't model. A reusable workflow shared across teams, where the repository that defines it has weaker access controls than the ones that call it. A pipeline that runs on every pull request, including ones from contributors who have no other access to the environment it deploys to. An infrastructure-as-code provider that was silently updated by a third party between two pipeline runs. None of these look dangerous in isolation. They look like normal engineering decisions. Together, they form a path to arbitrary code execution in production.
This talk presents an approach to modeling your CI/CD infrastructure as an attack graph. We model repositories, pipelines, deployment targets, identity groups, and external dependencies as nodes and edges in a queryable graph. Suddenly, you can ask questions that span system boundaries:
- "Who can modify this workflow, and what can that workflow reach?"
- "Which external dependencies, if compromised, would give an attacker a path to a production environment?"
- "How many steps separate a standard developer identity from production deployment access - and what are those steps?"
We walk through the graph schema, how we map identities across platforms, and what this reveals that traditional access reviews miss.
Programmet er oppdatert.