Azure DevOps Privilege Escalation: Pipeline Shenanigans - Anniek van der Peijl

Description

Azure DevOps privilege escalation: Pipeline shenanigans CI/CD pipelines are the standard way of deploying not just applications but infrastructure as well. To do all that, they usually have some juicy privileges. Privileges that I want. In this talk we're going to have a look at Azure DevOps pipelines, their permission settings, and all the ways in which you think you may have secured your pipeline that actually aren't watertight. With live demos (fingers crossed!) to show every problem and every fix. Anniek van der Peijl Anniek is a security tester and general devsecops nerd. More info: https://wiccon.nl/ https://womenofwicca.nl/ https://www.linkedin.com/company/wicca-nl/ https://www.meetup.com/wiccanl/ https://bsky.app/profile/womenofwicca.bsky.social https://infosec.exchange/@wicca