Daniel Krivelevich's guest appearances

Daniel Krivelevich

Security Weekly Podcast Network (Audio)

The Application Security Podcast

Security Weekly Podcast Network (Video)

Application Security Weekly (Video)

Application Security Weekly (Audio)

Resilient Cyber

OwlTail

CosMiss in Azure, $70k bounty for a Pixel Lock Screen bypass, finding path traversal with Raspberry Pi-based emulators, NSA guidance on moving to memory safe languages, implementing phishing-resistant MFA, egress filtering, and how to approach code reviews   Cider Security’s recently published research of the Top 10 CI/CD Security Risks acts to identify vulnerabilities to help defenders focus on areas to secure their CI/CD ecosystem. They created a free learning tool with a deliberately vulnerable environment to demonstrate these flaws -- “CI/CD Goat”. Like similar tools, this helps appsec and devops teams gain a better understanding of major CI/CD security risks and, importantly, their appropriate countermeasures. Segment Resources: - https://www.cidersecurity.io/top-10-cicd-security-risks/ -  https://github.com/cider-security-research/top-10-cicd-security-risks - https://www.cidersecurity.io/blog/research/ci-cd-goat/ - https://github.com/cider-security-research/cicd-goat   Visit https://www.securityweekly.com/asw for all the latest episodes! Follow us on Twitter: https://www.twitter.com/secweekly Like us on Facebook: https://www.facebook.com/secweekly   Show Notes: https://securityweekly.com/asw220

CosMiss in Azure, $70k bounty for a Pixel Lock Screen bypass, finding path traversal with Raspberry Pi-based emulators, NSA guidance on moving to memory safe languages, implementing phishing-resistant MFA, egress filtering, and how to approach code reviews Cider Security’s recently published research of the Top 10 CI/CD Security Risks acts to identify vulnerabilities to help defenders focus on areas to secure their CI/CD ecosystem. They created a free learning tool with a deliberately vulnerable environment to demonstrate these flaws -- “CI/CD Goat”. Like similar tools, this helps appsec and devops teams gain a better understanding of major CI/CD security risks and, importantly, their appropriate countermeasures. Segment Resources: - <a href="https://www.cidersecurity.io/top-10-cicd-security-risks/" rel="nofollow" target="_blank">https://www.cidersecurity.io/top-10-cicd-security-risks/</a> - <a href="https://github.com/cider-security-research/top-10-cicd-security-risks" rel="nofollow" target="_blank"> https://github.com/cider-security-research/top-10-cicd-security-risks</a> - <a href="https://www.cidersecurity.io/blog/research/ci-cd-goat/" rel="nofollow" target="_blank">https://www.cidersecurity.io/blog/research/ci-cd-goat/</a> - <a href="https://github.com/cider-security-research/cicd-goat" rel="nofollow" target="_blank">https://github.com/cider-security-research/cicd-goat</a> Visit <a href="https://www.securityweekly.com/asw" rel="nofollow" target="_blank">https://www.securityweekly.com/asw</a> for all the latest episodes! Follow us on Twitter: <a href="https://www.twitter.com/secweekly" rel="nofollow" target="_blank">https://www.twitter.com/secweekly</a> Like us on Facebook: <a href="https://www.facebook.com/secweekly" rel="nofollow" target="_blank">https://www.facebook.com/secweekly</a> Show Notes: <a href="https://securityweekly.com/asw220" rel="nofollow" target="_blank">https://securityweekly.com/asw220</a>

ASW #220 - Daniel Krivelevich

Cider Security’s recently published research of the Top 10 CI/CD Security Risks acts to identify vulnerabilities to help defenders focus on areas to secure their CI/CD ecosystem. They created a free learning tool with a deliberately vulnerable environment to demonstrate these flaws -- “CI/CD Goat”. Like similar tools, this helps appsec and devops teams gain a better understanding of major CI/CD security risks and, importantly, their appropriate countermeasures.   Segment Resources: - https://www.cidersecurity.io/top-10-cicd-security-risks/ -  https://github.com/cider-security-research/top-10-cicd-security-risks - https://www.cidersecurity.io/blog/research/ci-cd-goat/ - https://github.com/cider-security-research/cicd-goat   Visit https://www.securityweekly.com/asw for all the latest episodes! Show Notes: https://securityweekly.com/asw220

Cider Security’s recently published research of the Top 10 CI/CD Security Risks acts to identify vulnerabilities to help defenders focus on areas to secure their CI/CD ecosystem. They created a free learning tool with a deliberately vulnerable environment to demonstrate these flaws -- “CI/CD Goat”. Like similar tools, this helps appsec and devops teams gain a better understanding of major CI/CD security risks and, importantly, their appropriate countermeasures. Segment Resources: - <a href="https://www.cidersecurity.io/top-10-cicd-security-risks/" rel="nofollow" target="_blank">https://www.cidersecurity.io/top-10-cicd-security-risks/</a> - <a href="https://github.com/cider-security-research/top-10-cicd-security-risks" rel="nofollow" target="_blank"> https://github.com/cider-security-research/top-10-cicd-security-risks</a> - <a href="https://www.cidersecurity.io/blog/research/ci-cd-goat/" rel="nofollow" target="_blank">https://www.cidersecurity.io/blog/research/ci-cd-goat/</a> - <a href="https://github.com/cider-security-research/cicd-goat" rel="nofollow" target="_blank">https://github.com/cider-security-research/cicd-goat</a> Visit <a href="https://www.securityweekly.com/asw" rel="nofollow" target="_blank">https://www.securityweekly.com/asw</a> for all the latest episodes! Show Notes: <a href="https://securityweekly.com/asw220" rel="nofollow" target="_blank">https://securityweekly.com/asw220</a>

The Top 10 CI/CD Security Risks and CI/CD Goat - Daniel Krivelevich - ASW #220

- For folks that are familiar, what is a CI/CD pipeline and why is it becoming such a hot topic in modern software delivery?- Do you think earlier on in the pursuit of DevOps/DevSecOps organizations overlooked the pipeline as an attack vector?- Any thoughts are notable incidents such as SolarWinds, do you think they brought more attention to the build environment?- What are you thoughts on emerging guidance such as SLSA NIST SSDF or 800-161. Do you think these are helping bring attention to best practices on securing pipelines?- In the context of software supply chain security, why do you think pipelines are so critical?- Keeping on the theme of SBOM, what are your thoughts on the rising adoption and push for SBOM, and now VEX and how can pipelines help facilitate that?- Cider has produced some excellent resources such as articles and also CICD Goat - how do you all keep innovating on the knowledge and tooling front and how has it been received by the community?- One of those resources is the Top 10 CICD security risks. Do you want to touch on the list and maybe a couple of the leading risks from the list?- Any recommendations on learning resources for folks wanting to learn more about pipeline security, best practices and why it is important?

- For folks that are familiar, what is a CI/CD pipeline and why is it becoming such a hot topic in modern software delivery? - Do you think earlier on in the pursuit of DevOps/DevSecOps organizations overlooked the pipeline as an attack vector? - Any thoughts are notable incidents such as SolarWinds, do you think they brought more attention to the build environment? - What are you thoughts on emerging guidance such as SLSA NIST SSDF or 800-161. Do you think these are helping bring attention to best practices on securing pipelines? - In the context of software supply chain security, why do you think pipelines are so critical? - Keeping on the theme of SBOM, what are your thoughts on the rising adoption and push for SBOM, and now VEX and how can pipelines help facilitate that? - Cider has produced some excellent resources such as articles and also CICD Goat - how do you all keep innovating on the knowledge and tooling front and how has it been received by the community? - One of those resources is the Top 10 CICD security risks. Do you want to touch on the list and maybe a couple of the leading risks from the list? - Any recommendations on learning resources for folks wanting to learn more about pipeline security, best practices and why it is important?

S3E12: Daniel Krivelevich of Cider Security - CI/CD Pipeline Security

Omer Gil

Daniel Krivelevich is a cybersecurity expert and problem solver, with 15+ years of enterprise security experience with a proven track record working with 100+ enterprises across multiple industries, with a strong orientation to Application &amp; Cloud Security. Daniel co-Founded Cider Security as the company’s CTO. Cider is a startup focused on securing CI/CD pipelines, flows, and systems.Omer is a seasoned application and cloud security expert with over 13 years of experience across multiple security disciplines. An experienced researcher and public speaker, Omer discovered the Web Cache Deception attack vector in 2017. Omer leads research at Cider Security.We hope you enjoy this conversation with...Omer and Daniel. FOLLOW OUR SOCIAL MEDIA: ➜Twitter: @AppSecPodcast➜LinkedIn: The Application Security Podcast➜YouTube: https://www.youtube.com/@ApplicationSecurityPodcast Thanks for Listening! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Daniel Krivelevich is a cybersecurity expert and problem solver, with 15+ years of enterprise security experience with a proven track record working with 100+ enterprises across multiple industries, with a strong orientation to Application &amp; Cloud Security. Daniel co-Founded Cider Security as the company’s CTO. Cider is a startup focused on securing CI/CD pipelines, flows, and systems.Omer is a seasoned application and cloud security expert with over 13 years of experience across multiple security disciplines. An experienced researcher and public speaker, Omer discovered the Web Cache Deception attack vector in 2017. Omer leads research at Cider Security.We hope you enjoy this conversation with...Omer and Daniel. FOLLOW OUR SOCIAL MEDIA: ➜Twitter: <a href="https://twitter.com/AppSecPodcast" rel="nofollow" target="_blank">@AppSecPodcast</a> ➜LinkedIn:<a href="https://www.linkedin.com/showcase/83990241" rel="nofollow" target="_blank"> The Application Security Podcast</a> ➜YouTube: <a href="https://www.youtube.com/channel/UCfrTGqjSsFCQW4k6TueuY-A" rel="nofollow" target="_blank">https://www.youtube.com/@ApplicationSecurityPodcast</a> Thanks for Listening! ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~