Entrepreneur, Investor, Advisor | 🇮🇱 | Co-Founder & CTO @ Cider Security
Joined September 2013
- Tweets51
- Following145
- Followers158
- Likes56
Term Shit -
כש- @YoavVilner ואני החלטנו להיכנס לעומק של הנושאים החשובים *באמת* באקוסיסטם של הטק בישראל.
הסרטון המלא בתגובות.
הפרויקט החדש של @YoavVilner ושלי
אחרי שנים שבהן סיפרנו בדיחות של גיקים במחתרת, החלטנו לצאת עם זה החוצה..
youtu.be/FoEIWp9MQg8
יזמים ישראליים בדקו כמה משחקי מילים על הייטק וטכנולוגיה אפשר לדחוס לסרטון אחד
geektime.co.il/israeli-entre…
Daniel Krivelevich retweeted
יזמים ישראליים בדקו כמה משחקי מילים על הייטק וטכנולוגיה אפשר לדחוס לסרטון אחד
geektime.co.il/israeli-entre…
Daniel Krivelevich retweeted
1/13 כשאנחנו נאבקים על הזמנת רכב חדש או פלייסטיישן, התירוץ על ״בעיות בשרשרת האספקה״ נזרק לאויר. יזם סייבר שמע את התירוץ ורץ להקים חברה. הקרב העמוס על הגנת סייבר לשרשרת האספקה🥊
Daniel Krivelevich retweeted
New research: How we abused repository webhooks to access internal CI systems at scale.
cidersecurity.io/blog/resear…
1/
Daniel Krivelevich retweeted
⚠️ GitHub Org Identity Management Risks
When not using SSO
* User personal emails could be compromised
* IdP removal does not remove from GH org
Deactivating user in IdP prevents GitHub website auth- PATs & SSH keys still work
@omer_gil @yaronavital
cidersecurity.io/blog/resear…
Daniel Krivelevich retweeted
🛡️ CI/CD Credential Hygiene
@TupleType examines 3 common issues:
1. Unrotated static credentials
2. Overly accessible credentials
3. Credentials exposed in console logs
And strengths/weaknesses of:
* Jenkins
* GitHub Actions
* CircleCI
* GitLab CI/CD
cidersecurity.io/blog/resear…
Daniel Krivelevich retweeted
This doesn't push my agenda of hating on Jankins but it's a good in-depth analysis of a few CI tools and how they handle creds.
cidersecurity.io/blog/resear…
Daniel Krivelevich retweeted
Great blog post by @TupleType about credential hygiene risks in engineering environments, with comparison of the different security solutions offered by the main vendors - GitHub Actions, CircleCI, Jenkins and GitLab CI/CD.
cidersecurity.io/blog/resear…
Daniel Krivelevich retweeted
. @Owasp_DevSlop is going live tomorrow with Omer Gil & Daniel Krivelevich from @cider_sec to discuss the "Top 10 CI/CD Security Risks" initiative.
SET YOUR REMINDER! ⏰ youtu.be/i1SO8AH4AxI
Episode sponsor: @datadoghq
Daniel Krivelevich retweeted
I re-read CI/CD top10, I would like to introduce their new term. It's the PBAC(Pipeline-Based Access Controls). Source code management like GitHub and CI/CD has different security aspects to each branch and step. [🧵1/2] cidersecurity.io/top-10-cicd… #Top10CICD
Daniel Krivelevich retweeted
We are airing our eighth and final Episode in Season 3, this season is dedicated to #applicationsecurity, our guest for the show is @Dkrivelev Co-Founder and CTO of @cider_sec
security-architecture.org/ep…
The "CI/CD Top 10 Risks" project is out!
Amazing effort together with some of best of the industry's AppSec experts 👇
cidersecurity.io/top-10-cicd…
@omer_gil and I are were really fortunate to collaborate with such an amazing group on this one:
@iiamit
@claudijd
@_mwc
@travismcpeak
@tysbano
@astha_singhal
@rung
@TupleType
Looking forward to some fruitful followup collaborations with the industry on this
#Top10CICD
Daniel Krivelevich retweeted
🗡️ Exploiting Jenkins build authorization
Jenkins default settings assign every build to “run as SYSTEM" 😱
To harden, use the “Authorize Project” and “Role-Based Authorization Strategy” plugins
By @TupleType
medium.com/cider-sec/exploit…
Daniel Krivelevich retweeted
Exploiting Jenkins build authorization.
A default configuration we often see unchanged in production environments causes all jobs to run with the highest privileges
medium.com/cider-sec/exploit…
Daniel Krivelevich retweeted
PPE — Poisoned Pipeline Execution by @omer_gil and @Dkrivelev link.medium.com/mMXVqEjeunb #CICD #cybersecurity
