Daniel Krivelevich

Entrepreneur, Investor, Advisor | 🇮🇱 | Co-Founder & CTO @ Cider Security

[Daniel Krivelevich @Dkrivelev]

https://t.co/mI1yO4ysOb - Term Shit - הסרט המלא

[Daniel Krivelevich @Dkrivelev]

Term Shit -
כש- @YoavVilner ואני החלטנו להיכנס לעומק של הנושאים החשובים *באמת* באקוסיסטם של הטק בישראל.
הסרטון המלא בתגובות.

[Daniel Krivelevich @Dkrivelev]

הפרויקט החדש של @YoavVilner ושלי
אחרי שנים שבהן סיפרנו בדיחות של גיקים במחתרת, החלטנו לצאת עם זה החוצה..
https://t.co/3JCUWqCqNL

[Geektime - גיקטיים @geektimecoil]

יזמים ישראליים בדקו כמה משחקי מילים על הייטק וטכנולוגיה אפשר לדחוס לסרטון אחד
https://t.co/kNJV6WraUs

[Geektime - גיקטיים @geektimecoil]

יזמים ישראליים בדקו כמה משחקי מילים על הייטק וטכנולוגיה אפשר לדחוס לסרטון אחד
https://t.co/kNJV6WraUs

[Daniel Krivelevich @Dkrivelev]

@geektimecoil @YoavVilner

[Ehud Ben-Gera @EBGera]

1/13 כשאנחנו נאבקים על הזמנת רכב חדש או פלייסטיישן, התירוץ על ״בעיות בשרשרת האספקה״ נזרק לאויר. יזם סייבר שמע את התירוץ ורץ להקים חברה. הקרב העמוס על הגנת סייבר לשרשרת האספקה🥊

[Omer Gil @omer_gil]

New research: How we abused repository webhooks to access internal CI systems at scale.

https://t.co/YLdFQDzmSb
1/

[Omer Gil @omer_gil]

Playing with some PPE attack vectors in my CI/CD env 👀

[Clint Gibler @clintgibler]

⚠️ GitHub Org Identity Management Risks

When not using SSO
* User personal emails could be compromised
* IdP removal does not remove from GH org

Deactivating user in IdP prevents GitHub website auth- PATs & SSH keys still work

@omer_gil @yaronavital

https://t.co/IaaeVUuofn

[Clint Gibler @clintgibler]

🛡️ CI/CD Credential Hygiene

@TupleType examines 3 common issues:

1. Unrotated static credentials
2. Overly accessible credentials
3. Credentials exposed in console logs

And strengths/weaknesses of:
* Jenkins
* GitHub Actions
* CircleCI
* GitLab CI/CD

https://t.co/HiZu5wKUGU

[Mark Manning @antitree]

This doesn't push my agenda of hating on Jankins but it's a good in-depth analysis of a few CI tools and how they handle creds.

https://t.co/OEoOZiYjO4

[Omer Gil @omer_gil]

Great blog post by @TupleType about credential hygiene risks in engineering environments, with comparison of the different security solutions offered by the main vendors - GitHub Actions, CircleCI, Jenkins and GitLab CI/CD.
https://t.co/s0Q21aqdFr

[OWASP® Foundation @owasp]

. @Owasp_DevSlop is going live tomorrow with Omer Gil & Daniel Krivelevich from @cider_sec to discuss the "Top 10 CI/CD Security Risks" initiative.
SET YOUR REMINDER! ⏰ https://t.co/6vRSg9ILYf
Episode sponsor: @datadoghq

[Hiroki SUEZAWA (@rung) @rung]

I re-read CI/CD top10, I would like to introduce their new term. It's the PBAC(Pipeline-Based Access Controls). Source code management like GitHub and CI/CD has different security aspects to each branch and step. [🧵1/2] https://t.co/T5fGLqM2Qj #Top10CICD

[Security Architecture Podcast @secarchpodcast]

We are airing our eighth and final Episode in Season 3, this season is dedicated to #applicationsecurity, our guest for the show is @Dkrivelev Co-Founder and CTO of @cider_sec
https://t.co/ih0p36ZOEM

[Daniel Krivelevich @Dkrivelev]

Looking forward to some fruitful followup collaborations with the industry on this
#Top10CICD

[Daniel Krivelevich @Dkrivelev]

The "CI/CD Top 10 Risks" project is out!
Amazing effort together with some of best of the industry's AppSec experts 👇
https://t.co/tVN8mRJfOA

[Daniel Krivelevich @Dkrivelev]

@omer_gil and I are were really fortunate to collaborate with such an amazing group on this one:
@iiamit
@claudijd
@_mwc
@travismcpeak
@tysbano
@astha_singhal
@rung
@TupleType

[Clint Gibler @clintgibler]

🗡️ Exploiting Jenkins build authorization

Jenkins default settings assign every build to “run as SYSTEM" 😱

To harden, use the “Authorize Project” and “Role-Based Authorization Strategy” plugins

By @TupleType

https://t.co/cjo7NxX9Te

[Asi Greenholts @TupleType]

Exploiting Jenkins build authorization.
A default configuration we often see unchanged in production environments causes all jobs to run with the highest privileges
https://t.co/rxUcE0ix5T