Fireblocks Presentation on Securing Build Pipelines Against Nation-State Cyber Threats

The presentation by Ben and Mayaan from Fireblocks, a digital asset infrastructure provider, focuses on securing build pipelines and production deployments against nation-state actors like North Korea, Russia, and China. They highlight real-world attacks such as the 2020 SolarWinds incident (linked to Russia’s CozyBear) and TeamCity remote code execution vulnerabilities exploited by North Korea in 2023–2024, emphasizing the irreversible nature of blockchain transactions once private keys are compromised. The speakers propose a chain of trust modeled after DNSSEC’s root signing ceremony, leveraging confidential computing technologies like Intel SGX, AWS Nitro Enclaves, and AMD SEV to create isolated enclaves with remote attestation for secure code building. Fireblocks’ solution involves an air-gapped build machine for initial image signing, a 'builder service' running in enclaves to automate builds, and a 'secret service' (using long-term hardware keys) to securely distribute signing keys only after attestation verification. The system requires multiple verifiers to sign commit hashes via YubiKeys, enforcing intent-based builds and reducing friction while maintaining security. The implementation integrates with GitLab, ensuring fresh enclave instances per build job and enabling rapid, auditable deployments without sacrificing isolation guarantees.