On: Continuous Intrusion – Why CI tools are an attacker's best friends (2015) [pdf]

[joncampbelldev]

My CI server is inside an amazon VPC, accessible via an ssh tunnel. Only certain people can access the production VPC and everyone's keys have a strong passphrase ... why trust your CI tool's security when you can rely on much more robust things like SSH?

[grhmc → joncampbelldev]

It is very important to have defense in depth, and having good perimeter (your VPC) security as well as internal security (CI config.)

[pquerna → joncampbelldev]

In any larger environment or company, assertions like "everyone's keys have a strong passphrase" are basically impossible to make.

Multi-Factor into the VPN or SSH bastion is a good idea to look at.