Nov 2024
18 Mon
19 Tue
20 Wed
21 Thu
22 Fri 09:00 AM – 05:10 PM IST
23 Sat
24 Sun
Nov 2024
18 Mon
19 Tue
20 Wed
21 Thu
22 Fri 09:00 AM – 05:10 PM IST
23 Sat
24 Sun
Submitted Oct 11, 2024
Abstract:
CI systems are the security orchestration centre of the SDLC but CI itself has become an attack surface as Solarwinds and Codecov attacks have shown.
BOLT: https://github.com/koalalab-inc/bolt an OSS tool, secures CI runtime/build time from two attack vectors:
BOLT instruments an egress gateway and auditd rules. Egress gateway enables BOLT to filter outbound traffic. Auditd logs are used to monitor for any kind of source/build tampering.
Furthermore, egress-filter itself has many other nuances. The outbound traffic from the build system can go to multi-tenant systems like GitHub, DockerHub, JFrog etc. Ensuring only the trusted tenants are being called in egress calls is necessary to ensure security.
BOLT instruments eBPF probes to do deep SSL inspection of egress traffic. Applying destination aware rules on top of deep SSL inspection enables BOLT to trust tenants across multi-tenant systems like GitHub/DockerHub/JFrog.
Takeaways:
Audience:
Nov 2024
18 Mon
19 Tue
20 Wed
21 Thu
22 Fri 09:00 AM – 05:10 PM IST
23 Sat
24 Sun
Hosted by
Supported by
Platinum Sponsor
Platinum Sponsor
Community sponsor
Venue host - Rootconf workshops
Community Partner
Community Partner
Login to leave a comment
Abhimanyu Dhamija
@abhidhamija Submitter
Zainab & hasgeek team: Apologies for the delay: Here are the proposed slides. These are simple, single point slides, will run alongside the Demo of BOLT. Slides here: https://docs.google.com/presentation/d/1kXe0tqjsciafAqX4dBpXQOkr1SC3JdnoQu_h4iNWIlY/edit?usp=sharing & BOLT link here: https://github.com/koalalab-inc/bolt
Zainab Bawa
@zainabbawa Editor & Promoter
Hi Abhimanyu, your submission is accepted for Rootconf Mini. Congratulations!
The next step is to add draft slides
If you have a prepared deck, add a G-Drive (view/comment only) link in the comments.
Share slides by Sunday, 20 October. The editors will review and set up a call for discussing the flow and structure of the content + key takeaways.
If you have questions about the process, reply to this thread.