Divya Natesan

Technical Director at NCC Group

[Divya Natesan @divya_natesan]

I am excited to be speaking about Open Source Software and Supply Chain Security at the HTAP Summit 2023 tomorrow right after some amazing keynote speeches! 🙂Thanks, @NCCGroupplc and @PingCAP for the opportunity! #opensourcesecurity #supplychainsecurity

[Bill Mulligan 🐝🐝🐝 @breakawaybilly]

@pritianka @CloudNativeFdn @kelseyhightower @cra @KubeCon_ Newest @kubernetesio security audit, scan the random QR code to find out more about security 😀

[Divya Natesan @divya_natesan]

Psyched to be part of the team at NCC Group that performed the security audit of Kubernetes!😀

[CNCF @CloudNativeFdn]

[NEWS from #KubeCon] New #Kubernetes security audit complete and open sourced 🔐

https://t.co/SZRdp6mhKA

[Divya Natesan @divya_natesan]

@NCCGroupplc - Thanks for the opportunity to interview with @MariaKorolov for CSO Magazine, after our blog post on 10 real-world stories of how we have compromised CI-CD Pipelines! Congratulations @wucpi on being featured in the article https://t.co/lokhgW7cfe

[Divya Natesan @divya_natesan]

@kylekyle Thanks for mentioning the blog post, Kyle! Principle of Least Privilege is important to prevent these problems, right from developer checking in source code repositories to deployment in Clusters. CI-CD Pipelines can definitely be leveraged by attackers for MASSIVE impact.

[Divya Natesan @divya_natesan]

@CesarTalledo4 @nestybox Thanks! Can’t stress enough how many real-world stories of how I have compromised CI-CD Pipelines have privileged Containers as a major flaw. Sysbox container runtime seems promising, definitely.

[Clint Gibler @clintgibler]

🔥 10 real-world stories of how we’ve compromised CI/CD pipelines

Excellently detailed scenarios, including PrivEsc across:
* Jenkins
* GitLab
* Kubernetes
* Dev laptop access

By @NCCGroupInfosec's @0xZon1, @smarticu5, @wucpi, @divya_natesan, @enjenneer

https://t.co/kHLEojBMHF

[Divya Natesan @divya_natesan]

@davidmytton Yep, only needs 1 misconfiguration setting to get in. :) We have compromised CI-CD Pipelines in several engagements, roughly using these stories…

[Divya Natesan @divya_natesan]

@v18h4vd Yep, we have compromised CI-CD Pipelines in several engagements, roughly using these stories…

[NCC Group Research & Technology @NCCGroupInfosec]

10 real-world stories of how we've compromised CI/CD pipelines 🔥

by @0xZon1, with contributions from @smarticu5, @wucpi, @divya_natesan, & @enjenneer

https://t.co/smD3JarmvM

[Divya Natesan @divya_natesan]

@arjunumenon Amazing!

[Iain Smart @smarticu5]

There are still seats available for @NCCGroupInfosec's Mastering Container Security training at BlackHat next month. If you want to learn about attacking or defending Docker and K8s, consider signing up! https://t.co/i3E1IEXC8M

[Divya Natesan @divya_natesan]

I am co-presenting a training session along with the amazing @smarticu5 at BlackHat USA 2021. https://t.co/B2YpL3vrxp

[Mark Manning @antitree]

Woke up this morning and found a project I worked on is now public. 🤔💥 While with NCC Group I worked with a team (@0lsen_ @ChaosDatumz @divya_natesan) to do a security review the main components of Istio...it's from 8/2020 though. Don't expect 0days.

https://t.co/KOrsdrY5kh

[Divya Natesan @divya_natesan]

@antitree @0lsen_ @ChaosDatumz Wow! An announcement about the ‘istio’ report after so long!

[Divya Natesan @divya_natesan]

@poojasgada @joinClubhouse @Appyg99 @carlyhasredhair @elainewlin Great initiative @poojasgada @Appyg99 ! Sorry I missed it!

[India_AllSports @India_AllSports]

Sometimes we think about Olympics just in terms of medals; Some performances like Dipa Karmakar's here is more than that #Respect

[Scott Klein @kleinmatic]

Another old person tricked into buying AOL so they can connect to the Internet.

[Matthew Green @matthew_d_green]

Since key escrow is cool again, here are some classic posters from the Clipper era. Courtesy of Ron Rivest.