Article citationsMore>>

Smart, I. and Gazdag, V. (2024) RCE-as-a-Service: Lessons Learned from 5 Years of Real-World CI/CD Pipeline Compromise.
https://www.blackhat.com/us-22/briefings/schedule/#rce-as-a-service-lessons-learned-from-5-years-of-real-world-cicd-pipeline-compromise-27541

has been cited by the following article:

• TITLE: Sher: A Secure Broker for DevSecOps and CI/CD Workflows

  AUTHORS: Pranau Kumar, Vijay K. Madisetti

  KEYWORDS: CI/CD Pipelines, GitHub, GitOps, DevSecOps, Isolation, Security, SAST

  JOURNAL NAME: Journal of Software Engineering and Applications, Vol.17 No.5, May 29, 2024

  ABSTRACT: GitHub Actions, a popular CI/CD platform, introduces significant security challenges due to its integration with GitHub’s open ecosystem and its use of flexible workflow configurations. This paper presents Sher, a Python-based tool that enhances the security of GitHub Actions by automating the detection and remediation of security issues in workflows. Self-Hosted Ephemeral Runner, or Sher, acts as a broker between GitHub’s APIs and a customizable, isolated environment, analyzing workflows through a static rules engine and automatically fixing identified issues. By providing a secure, ephemeral runner environment and a dynamic analysis tool, Sher addresses common misconfigurations and vulnerabilities, contributing to the resilience and integrity of DevSecOps practices within software development pipelines.