►
Description
Securing your code doesn’t have to be cumbersome. But is it an aspiration, or actually an achievable goal? If you’re interested in learning more about DevSecOps and why your business needs embedded security, this conversation is for you. You’ll hear from Hashicorp’s Director of Product Security, Jamie Finnegan, and GitHub’s Code Scanning Architect, Keith Hoodlet, on how Hashicorp started their DevSecOps journey and the steps they’re taking towards an efficient setup.
As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub
Thanks!
Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github
About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com
A
Back
all
right,
we're
gonna
do
window
share
this.
One
click
share
cool,
so
everybody
thank
you
for
joining
us.
I
am
your
host
keith
hoodlett.
Today
we
are
going
to
be
speaking
with
jamie
finnegan,
about
insights
from
hashicorp
on
how
they
secure
the
software
that
they
ship.
It's
really
cool
software.
Honestly,
I'm
sure
many
of
you
know
it
and
if
you
don't
you'll,
get
to
learn
a
little
bit
about
it
today,
of
course,
as
always,
I
am
your
host
for
this
particular
session.
It'd
be
weird.
A
If
I
wasn't
so,
if
you
do
want
to
engage
with
us,
though
there
is
the
chat
available,
so
please
go
ahead
and
engage
with
us
there.
We
are
happy
to
answer
questions.
Of
course,
if
you
have
any
sort
of
commentary
as
well,
we'd
love
to
hear
it,
and
then
you
can
certainly
request
a
demo
of
some
of
the
things
that
we're
going
to
discuss
today.
So
just
that's
available
use
it
and
we'd
love
to
hear
from
you
with
that.
A
I
am
joined
today
by
jamie
finnegan,
who
is
the
director
of
product
security
at
hashicorp
hashicorp.
I
know
them
for
some
of
the
work
that
they
do
on
secrets,
management
with
vault,
as
well
as
several
other
tools
such
as
terraform,
that
are
very
popular,
but
there
are
many
more
worth
discussing,
and
so
jamie
welcome
to
in
focus
with
github
really
glad
to
have
you
here.
B
A
Nice
to
be
here
thanks
for
having
me
yeah,
absolutely
so
jamie
for
the
audience
I
mean
you
and
I
have
had
a
chance
to
get
to
know
each
other
over
the
last
couple
of
years
as
being
members
of
the
customer
advisory
board
before
I
joined
github.
So
tell
us,
though,
for
the
rest
of
the
audience
listening
today.
How
did
you
get
started
in
security
how'd,
you
end
up
at
hashicorp
and
what
does
the
director
of
product
security
do
at
hashicorp?
A
B
Well,
origin
stories
are
always
interesting,
like
I
won't
get
into
my
teenage
years
growing
up
in
new
zealand
and
the
the
things
that
security
related
that
that
we
got
up
to
there.
But
my
security
industry
entry
was
an
interesting
one.
This
was,
I
was
working
as
a
unix,
a
bsd
cis
admin.
You
know
relatively
boring
job
and
I
was
reading
the
newspaper
at
lunchtime
one
day.
You
know
those
things
they
used
to
print
and
would
like
to
take
room
at
the
offices
we
used
to
go
to.
A
A
B
I
was
sitting
there
reading
a
newspaper
looking
at
the
job
post
job
listings,
and
I
saw
a
a
list,
a
posting
from
deloitte
saying:
hey,
we're
looking
for
people
who
want
to
be
like
early
stage
security
consultants
all
right.
Well,
I
don't
know
much
about
security,
but
you
know
I'll
give
it
a
go.
So
I
wrote
them
an
actual
letter
sent
it
in,
and
I
was
actually
looking
at
this.
B
In
my
the
other
day,
I
still
have
the
physical
copy
of
the
clipped
out
newspaper
ad
and
the
the
letter
I
sent
them,
which
was
my
my
job
application
and
my
yeah.
I
ended
up
joining
as
a
as
a
security
consultant
to
do
kind
of
app
second
network
pen
test
type
type
engagement,
so
that
was
my
entry
from
deloitte.
B
A
oh
deloitte
was
actually
the
employer
that
took
me
from
wellington,
new
zealand
to
the
bay
area,
where
I
spent
a
couple
of
years
or
a
year
and
then
moved
up
to
seattle,
and
I've
been
in
kind
of
working
in
security
here
ever
since,
across
a
range
of
consulting
consulting
roles,
working
with
a
variety
wide
variety
of
companies,
as
well
as
more
recently
industry
roles,
doing
a
kind
of
some
startup
and
some
bigger
enterprise
gigs.
A
couple
of
standouts
would
be.
I
spent
some
time
at
zynga
kind
of
protecting
people's
farmville
cash.
B
I
spent
some
time
at
hp
working
on
openstack,
so
that
was
a
very
kind
of
open
source,
centric
role,
one
of
the
things
we
did
there
was
actually,
if
anybody's
used,
python's
bandit
code
scanner
that
began
its
life
as
a
single
python
script.
On
my
laptop,
which
very
rapidly
got
several
other
people
involved
and
has
ended
up
being
a
project
that
lives
on
to
this
day.
B
A
Director
of
product
security,
so
so,
first
of
all,
what
are
what
are
the
products
and
what
they
do
and
sort
of
tell
us
about.
You
know,
especially
your
experience
there
right.
Most
people
know
hashicorp
from
some
of
the
work
that
they
did
in
the
open
source
space
and,
of
course,
now
they're
a
publicly
listed
global
technology
company.
So
so
tell
me
a
little
bit
about
that
as
well.
B
Yeah,
this
is
kind
of
an
interesting
thing
about
security
careers.
I
guess
is
you
at
least
an
interesting
thing
about
my
security
career
is
that
this
is
my,
I
believe,
the
first
role,
I've
taken
where
I've
stepped
straight
into
a
management
role.
Previously
I've
always
joined
a
company
as
an
ic,
worked
into
a
management
role
and
then
gone
back
to
an
ic
role
elsewhere.
So
this
one
I
joined
three
years
ago
as
as
with
director
in
my
title
at
the
time
it
was
me
tr
and
and
well
tell
her.
B
I
see
you
so
I
was
his
first
hire,
so
it
was
tell
her
and
myself
trying
to
kind
of
wrap
our
heads
around
what
needed
to
be
done
since
that
time
the
the
security
organization
has
grown
significantly.
I've
got
a
team
of
engineers
working
for
me
now
doing
product
security,
things
and
the
security
organization.
Here
it
looks
like
you're
kind
of
fairly
typical
modern
security
company.
B
We
have
a
kind
of
security
engineering
team
that
looks
after
our
operational
footprint,
threat,
detection
and
response
that
does
cloud
security
work
as
well
kind
of
managing
risk
around
our
operating
footprint.
Essentially,
we
have
a
grc
compliance
team.
We
have
a
red
team,
we
have
a
corporate
security
team,
so
yeah
we
do
do
all
the
security
things
for
the
company,
but
product
security
in
particular.
We
are
focused
the
way
I
kind
of
tell
the
story
stories.
B
We
basically
look
at
the
design
of
our
products
and
then
the
code
bases
associated
with
those
products,
the
various
dependencies
associated
with
those
code
bases
and
the
supply
chain
that
is
used
to
build
and
deploy
those
products
and
then
yeah
from
there.
We
there's
there's
work
to
be
done,
so
that's
essentially
our
scope.
That's
our
role,
it's
generally
a
fairly
technical
role,
but
I
personally
spend
quite
a
lot
of
time
in
zoom
and
then
google
docs,
as
do
a
lot
of
people
these
days
so
yeah.
That's
pretty
much
me.
B
B
A
Yeah
yeah,
so
it's
kind
of
you
to
remember
so
yeah.
At
the
time
I
was
at
thermo
fisher,
scientific
building,
the
devsecops
program
there,
which
I
know
that
we're
going
to
have
some
words
about
here
in
a
moment
but
to
say
built
the
program
there
from
the
ground
up
in
sort
of
a
similar
way.
I
think
to
what
you
are
doing
or
and
continue
to
do
at
hashicorp.
A
When
I
brought
github
and
code
scanning
and
some
of
their
tool
sets
for
static
analysis
into
thermo
fisher,
I
got
really
excited
about
the
technology
and
for
like
two
ish
years,
I
was
just
trying
to
find
any
opportunity
that
made
the
most
sense
where
I
could
play
with
codeql
and
write
some
interesting
queries
and
help.
Customers
understand,
you
know,
static
analysis
and
how
that
differentiates
from
other
forms
of
tools
that
are
out
there
over
the
last
two
decades.
A
So
that's
what
got
me
interested,
I
would
say
it's
sort
of
serendipitous
that
right
role
right
opportunity
right
time
after
having
been
at
thermo
fisher
for
over
three
years
myself
and
building
that
program,
sort
of
felt
like
the
right
move
and
you
know
sort
of
like
your
your
past
career
history,
I
was
in
leadership
and
then
you
know,
I
see
leadership
back
into
ic
roles,
so
it
is.
It
is
sort
of
takes
you
three
to
five
months
to
sort
of
be
like.
Can
I.
B
A
B
B
A
You
know
it's
funny
when
I
used
to
run
the
application
security
weekly
podcast
back
in
2018.
I
think
one
of
the
early
episodes
I
said
more
or
less
the
same
thing
that
I
think
you
you
said
in
your
blog,
which
is
devsecops,
doesn't
exist.
You
know
it's
literally
it's
it's
part
of
part,
six
of
the
devops
handbook
right,
it's
right
in
here
it's
branded
as
part
of
devops.
A
Well
now
I
need
to
embrace
it
in
some
respects,
because
it's
now
in
my
title
for
the
job
that
I
have,
but
I
need
to
figure
out
what
devsecops
should
be
and
to
the
point
that
you
made.
I
feel
like
over
these
last
few
years,
we've
really
seen
that
shift
of
tools
that
really
do
engender
a
devsecops
mindset
that
sort
of
fast
flow,
rapid
feedback,
continuous
learning,
devops
cycle,
but
inclusive
of
security
and
sort
of
constantly
present.
As
part
of
that,
without
needing
to
think
about
it,
it's
the
analogy
I
like
to
use
is.
A
Now
I
actually
want
to
turn
sort
of
to
the
the
next
topic,
which
is
all
the
different
solutions
that
hashicorp
provides
that
I
think
plug
into
what
I
would
consider
the
devsecops
process
in
a
number
of
different
ways,
I'm
most
familiar
with
the
secrets,
management
platform,
vault
and
also
vagrant
and
terraform.
But
there
are
a
lot
of
other
products
that
you're
responsible
for
securing.
B
Yeah,
let
me
put
my
marketing
hat
on
for
a
moment
and
kind
of
take
the
top
top-down
approach
so
kind
of
at
a
high
level
how
she
caught
like
what
one
of
the
taglines
we
use
is
infrastructure
enables
innovation,
so
that's
kind
of
the
company
mission
in
many
ways.
If
I
drill
down
one
level
in
our
marketing
content,
we
have
this
thing.
B
We
call
the
cloud
operating
model
which
is
kind
of
the
abstract
representation
of
how
we,
how
we
talk
about
our
products
and
what
we
lay
out
there
is
kind
of
a
provision,
secure,
connect
and
run
order
of
operation
that
we
provide
solutions
in
each
of
those
categories.
For
now,
if
I
go
further
to
our
individual
products,
the
two
kind
of
most
well-known,
perhaps
are
probably
at
this
point
vault,
for
which
we
use
the
secret
secret
management.
B
It
also
provides
encryption
as
a
service
and
various
other
kind
of
security
related
features.
We
also
terraform
is
our
infrastructure
as
code
solution
for
managing
cloud
and
other
it
environments.
In
a
standard
workflow
we
have
console,
which
is
a
kind
of
cloud
or
service
networking
solution.
It
does
service
discovery
service
mesh.
B
B
B
A
What
is
the
journey
of
securing
that,
like,
though
I
mean
you,
know,
securing
an
open
source
project
where
you
know
you
have
a
lot
of
possible
exposure
there
versus
then
moving
into
sort
of
the
on-premise,
and
also
then,
in
the
cloud
customer
like
paid
for
products?
How
does
it
differentiate?
What
is
that
like
from
I
mean
you've,
seen
it
from
the
beginning
with
with
the
product
security
team?
B
Yeah
side
note
here,
one
of
my
pet
peeves
about
listening
to
podcasts
is
when
people
say
that's
a
great
question
as
filler,
while
they
think
about
what
they're
going
to
say
so
sure.
That's
that's
a
great
question
case
like
seriously
open
source
is
an
interesting
place
to
start.
Obviously
like
one
of
the
things
you
talk
about
when
you
talk
about
security
is
just
how
much
information
are
you
going
to
disclose
about
the
thing
you're
securing
right
information?
Disclosure
is
a
real
thing.
B
It
exposes
and
exposes
more
of
your
footprint
and
gives
attackers
kind
of
a
place
to
learn
and
figure
out
how
they
might
target
you.
So
by
default,
when,
when
you
are
open
source,
there
are
pros
and
cons
of
that
from
a
security
perspective.
The
the
cons
I
mean
our
code
bases
are
out
there
in
public
for
for
anybody
to
look
at
and
find
security
flaws
in
and
the
pros
our
code
is
out
there
in
public
for
anybody
to
look
at
and
find
security
flaws
in
right.
It's
kind
of.
B
B
So
we
we
go
from
being
a
provider
of
software
where
we
we
focus
on
securing
that
software
and
securing
the
pipeline.
We
use
to
produce
it
to
being
a
provider
of
services,
and
customers
are
trusting
us
with
with
their
data.
So
we
need
to
put
appropriate
security
investment
to
protect
that
data,
because
that's
that's
a
core
part
of
the
service
we
offer
so
yeah.
It's
it's
a,
I
guess,
an
expan,
an
expansion
of
security,
thinking,
expansion
of
security
model
expansion,
of
the
challenges
that
we
are
facing
on
a
day-to-day
basis,
so
yeah
all
good
things.
A
And
so
when
it
comes
to
sort
of
the
organizational
elements
associated
with
that,
tell
us
about
your
journey
about
building
the
product
security
program
at
hashicorp
right,
so
you've
got
these
challenges.
You're
sort
of
growing
with
the
company
as
the
company
is
becoming
commercialized.
What
was
that
like
tell
talk
me
through?
You
know
the
building,
the
team,
the
sort
of
things
you
focused
on
process
tooling.
We
can
certainly
talk
about
here
in
a
moment,
but
I'm
curious
to
know
the
people
on
the
process
side.
B
Absolutely
so
yeah
I
was
the
the
kind
of
first
project
oriented
team
member.
The
couple
of
things
I
guess
so
when
when
we
joined
there
were
there
was
already
significant,
significant
velocity,
so
there
was
catch-up
work
to
be
done.
A
couple
of
just
kind
of
key
tenants,
kind
of
start,
small
extinguish
fires
get
quick
wins
some
of
the
kind
of
rules
of
thumb
that
we
live
by
at
first
there
always
always
be.
Learning
really
is.
Is
the
start,
so
you
don't
just
join
and
then
start
enforcing
security
mandates.
B
You
you
join
and
you
learn
like
you,
listen.
You
learn
you
figure
out.
What
is
this
place
that
I've
joined?
What
is
this
suite
of
products
that
I'm
now
responsible
for?
What
are
the
risks
associated
with
them,
and
then
you
start
figuring
out?
Okay.
What
does
the
road
map
look
like?
Where
is
it
that
we
want
to?
How
do
we
design
our
program?
How
what
are
our
priorities?
What
are
the
the
the
key
things
we
need
to
go,
get
done
to
reduce
risk
and
and
support
the
business
and
being
successful
here.
B
We,
like,
like
I
said,
we're
basically
an
infrastructure
company
in
many
ways
and
those
are
an
interesting
kind
of
product
and
that
we're
not
just
building
like
os
top
10
is
a
good
list
of
security
risks
to
think
about.
But
we
think
about
much
more
than
just
that
when
we're,
when
we're
looking
at
infrastructure
products
that
are
being
deployed
in
a
wide
variety
of
ways
in
a
wide
variety
of
environments,
and
we
I
needed
to
find
people
who
were
willing
to
jump
into
that
challenging
space
and
bring
a
range
of
skill.
B
A
A
Sort
of
talent
did
you
have
to
do
a
lot
of
training
as
well
of
of
like
talent
that
specialized
in
one
area
but
help
make
them
more
broad,
because
I
could
see
that
being
a
real
you're.
Looking
for
a
level
of
talent
that
there's
a
very
small
pool
of
people
and
a
very
large
amount
of
competition
to
bring
those
people
into
an
organization.
B
B
I
think
one
of
the
benefits
of
being
open
source
is
that
there
is
our
products
are
already
out
there
and
are
accessible
to
practitioners
everywhere,
so
that
that
often,
when
I'm
hiring
I'm
looking
for
people
who
have
at
least
tried
using
some
of
our
open
source
projects
and
maybe
had
a
look
at
the
code
or
maybe
committed
a
pr
to
to
submit
a
pr
to
fix
something
or
to
improve
something.
So
that's
always
a
nice
starting
point
as
a
when
we're
looking
for
for
people
who
know
our
products.
A
A
B
It
does
help
yeah
yeah,
that's
works,
it's
not
always
easy
too,
though,
so
we
have
brought
in
folks
just
with
good
kind
of
modern
security
experience.
Cloud
security
experience
go
laying
experience
and
they
are
all
kind
of
jumping
in
and
contributing
and
yeah
kind
of
building
up
the
the
program
for
us,
which
is
great.
A
Good
good,
and
so
I
wanted
to
move
on
to
another
question
around
you
know
what
does
a
product
security
program
look
like
at
scale
right,
so
you
talked
a
lot
about
being
there,
starting
focusing
on
making
sure
you're
learning
things
starting
small
and
getting
quick
wins.
But
what
does
achieving
product
security
at
scale?
Look
like
at
hashicorp.
B
B
So
an
individual
will
work
specifically
on
terraform
or
specifically
on
vault
or
specifically
on
the
cloud
platform
that
we're
building
so
there's
their
product
depth,
and
then
individuals
will
also
have
program
level
focuses
where
there's
more
the
breadth
across
the
portfolio,
so
one
or
two
people
might
be
working
on
how
we
do
threat
modeling
across
all
of
the
products.
Another
few
might
be
working
on
how
we
do
security
scanning
or
some
kind
of
github
advanced
security
product
adoption,
how
we're
deploying
that
across
the
portfolio.
A
B
A
Of
like,
as
they
say,
like
the
t,
f
and
e
shaped
people,
it's
like
you
sort
of
start
at
the
t
where
they
go
really
deep
on
something,
and
maybe
at
that
broad
level,
but
you're
trying
to
get
them
toward
that
f
or
that
e,
where
it's
like.
Okay,
they
have
a
product
level,
knowledge
of
security.
That's
really
important
at
that
deep
level.
A
They
have
some
higher
level
program
level,
responsibilities
that
might
cover
more
than
one
product,
and
then
it
sounds
like
they
have
sort
of
broader
visibility
at
the
top
layer
of
understanding
how
the
pieces
fit
together
and
who
to
work
with,
and
collaborate
with
to
get
the
things
that
their
product
needs.
If.
A
B
Yeah,
exactly
the
more
time
you
spend
here,
the
more
kind
of
you
probably
are
going
to
learn
about
another
product
and
you're,
probably
going
to
learn
about
another
program
level
component.
So
you
you
may
start
as
an
eye
or
you
may
start
as
a
yeah.
These
shapes
you
kind
of
just
slowly
expand
into
this
all-encompassing
tree
right.
A
Yeah
yeah
yeah,
so
I
also
got
to
ask
we
had
a
question
in
the
q
a
that
I
wanted
to
sort
of
go
to
quickly
as
well,
because
there
was
question
around
how
would
people
compare
vault
to
github
secrets
and
I
think
that
what
people
mean
is
github
secrets
in
terms
of
probably
like
our
secret
scanning.
So
I
know
that
there
is
of
course,
the
encrypted
secrets
that
we
have,
but
vault
is
different.
B
Maybe
maybe
for
that
I
can
talk
about
another
hashicorp
tenant.
We
have,
or
it's
called
the
tower
of
hashicorp,
which
is
workflows.
Not
technology
is
kind
of
one
of
the
core
things
that
we
talk
about
as
a
as
we've
designed
and
developed
our
product,
the
like
one
of
the
core
ideas
behind
each
one
of
our
products
is
we're.
Not
we
want
to
be
technology
agnostic
to
the
point
that
we
can.
We
want
to
be
provider,
we
want
to
be
multi-cloud
right.
We
want
to
be
essentially
provider
agnostic.
B
We
want
to
support
multiple
cloud
providers.
We
want
to
support
your
on-prem
platform
and
what
we
want
to
do
is
bring
a
common
shared
workflow
to
you
that
your
employees,
your
developers,
your
systems,
can
use
regardless
of
the
technology
that
is
sitting
behind
it
or
that
is
sitting
in
front
of
it.
So
what
volt
does
is
it
provides
you
with
that
common
secret
storage
solution?
B
It
has
a
standard
set
of
apis,
has
a
standard
set
of
a
standard
ui
and
then
the
workflow
for
adding
secrets
for
accessing
secrets
for
removing
secrets
for
auditing
access
to
those
secrets
is
the
same
regardless
of
the
type
of
secret
or
the
various
technologies
that
those
secrets
are
associated
with.
So
that's
kind
of
the,
I
guess
the
intent
behind
vault.
B
I
think
github
secrets
in
this
case
are
probably
talking
about
the
the
secrets
you
populate
to
the
in
yeah
within
like
a
github
actions
workflow,
and
that
is
a
different
kind
of
workflow
right,
so
you're
thinking
about
workflows
at
different
levels.
I
would
say
github
secrets:
it
makes
sense
to
use
them
if
that's
the
workflow
that
you're
focused
on
and
that's
the.
B
Yeah,
that's
how
you
the
level
of
abstraction
that
you
want
to
present.
Alternatively,
you
can
use
vault
from
within
github
actions.
That
may
be
one
one
approach
you
take
and
that
may
because
of
the
workflow
that
that
supports
and
exposes
more
broadly
across
your
environment.
That
may
be
a
viable
solution
or
a
solution
that
you
want
to
take
on
so
yeah.
I
think
these
technologies
both
have
the
uses,
depending
on
what
workflow
you
want
to
be
able
to
to
utilize.
A
If
you
are
calling
to
a
service
that
your
application
relies
on
having
that
secret
involved
is
a
great
way
to
make
sure
that
you
can
sort
of
manage
and
maintain
it
somewhat
easily
and
rotate
it
as
you
need
to.
But
secrets
in
that
case
as
well
are
also
useful.
If
maybe
you
don't
have
or
want
that
overhead
or
you
don't
necessarily
want
to
be
dependent
on
a
third-party
system,
you
sort
of
want
to
provide
it
in
a
safe
way
to
the
code
base.
A
So
to
your
point,
I
think
that
they,
both
you
know
they
live
in
the
same
space
somewhat,
but
they
play
well
with
one
another,
and
so
it's
it's
to
the
point
that
you've
made
it's
really
depending
on
the
workflow
you're
trying
to
accomplish
in
the
way
that
your
application
is
sort
of
architected
and
intended
to
function.
So
great
question
great
question
from
the
audience,
so
I.
B
Want
to
keep
moving
something
there,
which
is
great
just
the
rotation
concept
that
vault
supports
is
useful,
like
if
I
step
back
from
vault,
particularly
ephemeral
secrets,
a
huge
part
of
today's
security
environment.
Like
you
see
the
impact
of
passwords
tokens
etc,
being
leaked
and
when
those
are
long
lived,
things
that
don't
expire
or
have
very
long
lifetimes,
the
the
blast
radius
is
so
much
more
significant
than
if
it's
a
secret
an
api
token.
B
A
Absolutely
absolutely
so
you
know
talking
about
tools.
Tell
me
a
little
bit
about
you
know:
what
sort
of
tools
are
you
bringing
into
the
environment
at
hashicorp
because,
of
course,
there's
a
lot
of
things
that
are
available
open
source
there's
a
lot
of
things
that
are
available
commercially?
How
do
you
think
about
that
problem?
A
B
I'm
kind
of
I
guess
this
is
my
experience.
Speaking
but
I've
lived
through
the
stage
where
static
analysis
tools
were
out
there,
that
you
would
fire
off
at
a
code
base,
it
would
run
for
a
long
time
and
it
would
give
you
back
a
long
laundry
list
of
issues
that
may
or
may
not
be
actual
security
exposures,
but
that's
yes,
I
mean
false
positives
are
the
bane
of
any
security
person's
existence.
B
I
think
if
you've
lived
through
that
so
yeah
when
it
comes
to
buying
tools
and
building
tools
like
for
low
false
positive
rate,
is
an
absolutely
huge
deciding
point
for
us.
The
other
big
deciding
point
for
us
is
the
user
experience
or
the
developer
experience
I
mentioned
earlier.
The
whole
idea
of
workflows
not
technologies
right
and
for
us
the
workflow
is
how
does
the
user
interface
with
the
system,
and
is
it
a
pleasant
experience
or
not
like
that?
That
is.
That
is
a
big
part
of
this
from
a
security
perspective.
B
If
you
want
people
to
use
your
security
tool,
you
need
to
make
sure
that
the
experience
that
they
have
as
they
do
it
is
is
not
a
bad
one
right
you
want.
You
want
to
make
this
thing
yeah.
We
want
to
buy
tools
that
are
usable
and
that
are
not
something
that
you
dread.
Opening
the
browser
window
to
and
having
to
having
to
deal
with
on
a
daily
basis.
B
Yeah,
so
maybe
I
can
talk
briefly
to
how
we're
kind
of
how
we
view
github
in
general
at
the
moment,
because
I
think
that
kind
of
informs
my
answer
to
this
question.
So
github
is
essentially
where,
where
our
source
code
lives
like
that's,
we
have
a
large
number
of
public
and
private
repositories
in
our
various
github
organizations.
B
We
you
so
github
itself
gets
heavy
use
on
a
day-to-day
basis
by
our
entire
engineering
organization
and
and
other
teams
across
the
company.
We
use
github
actions
as
well
for
a
kind
of
the
kind
of
common
ci
use
case,
as
well
as
a
range
of
other
kind
of
automation
pieces.
It's
a
it's
a
nice
place
to
land
recurring
tasks,
scheduled
tasks,
ad
hoc
things
that
we
need
to
get
done
and
from
a
product
security
perspective.
We
look
at
github
and
we
say:
okay,
that's
where
our
engineers
live.
B
B
Provided
to
them
within
the
context,
they're
working
on
a
day-to-day
basis,
basically,
so
it
might
be
within
pull
requests,
it
might
be
in
that
security
tab,
but
it's
basically
bringing
the
security
information
they
need
to
them
in
the
interface
they're.
Already
working
in
would
be
kind
of
the
main
principle
there.
B
A
You've
done
what
you
know.
I
tell
a
lot
of
people.
Security
teams
should
be
doing,
which
is
you've,
made
security,
a
wing
in
the
hospital,
and
now
you
are
not
only
that
specialist
that
yes,
a
critical
event
has
occurred
and
you
get
pulled
in
to
you
know,
help
with
identifying
and
remediating
that
issue,
but
you're
sort
of
responsible
for
the
long-term
health
of
the
applications,
not
just
those
moments
where
things
are
going
bad,
which
is
in
a
lot
of
ways.
I
think
the
right
way
to
think
about
it,
especially
in
this
new
paradigm.
A
B
Me
run
through
a
few
secret
scanning
is
probably
yeah.
That's,
I
think,
that's
really
the
first
piece
of
advanced
security.
We
started
using
so
there's
two
ways:
we
we
interface
with
that
part
of
the
product
we
we
are
a
partner
from
a
github
of
the
security
scanning
program,
so
in
in
that
case
we
have
a
particular
token
format
that
one
of
our
products,
terraform
cloud
users
registered
with
github
and
as
github
identifies
commits
that
contain
data.
Matching
this
token
format.
B
You
provide
us
with
alerts
and
then
we
receive
those
alerts
and
action
on
them.
So
as
a
as
a
partner,
that's
valuable
to
us
as
it
allows
us
to
better
protect
our
our
own
customers.
We
also
use
secret
scanning
as
a
as
a
customer,
so
we
have
it
turned
on
across
our
public.
Oh
it's
it's
on
for
our
public
repo
and
for
our
private
repost.
B
Two
recent
advancements
there
that
I
have
appreciated
are
the
support
of
custom
rejects,
is
basically
for
alerting
up
for
for
secret
detection.
That's
a
great
new
addition
that
we're
using
the
other
thing
that
we
haven't
got
turned
on
broadly
yet,
but
are
very
close
to
doing.
Is
the
pre-commit
secret
scanning.
So
that's
a
huge
feature:
that's
gonna
yeah!
If
you're
talking
about
workflow
and
kind
of
trying
to
inject
security
and
and
stop
bad
things
from
happening,
that's
that's
a
great
new
feature
for
us.
B
In
the
token,
your
various
token
formats,
where
you
wrote,
move
to
a
more
uniquely
identifiable
or
more
github
associated
format
and
we've
recently
done
the
same
thing
with
our
vault
1.10
release
where
we
we
have
done
that
kind
of
adjust
the
prefixes
slightly
to
make
it
so
that
a
regex
looking
for
that
format
is
going
to
be
more
likely
to
be
a
true
positive.
Going
back
to
my
point
earlier
so
yeah.
B
Yeah
absolutely
next
thing
we're
using
is,
is
code
scanning
so
yeah.
This
was
code
scanning
is
such
an
interesting
space
to
me,
I
alluded
to
earlier
like
living
through
that
you
know
just
hundreds
and
thousands
of
findings
being
generated
by
static
analysis
that
end
up
being
for
the
most
part,
false
positives.
B
I
I
I
never
want
to
live
that
again,
so
code
scanning,
like
one
of
the
the
early
discussions
we
had
with
the
team,
was,
was
around
false,
positives
and
and
volume
and
and
the
the
principle
they
have
of
trying
very
hard
to
ensure
that
code
scanning
only
provides
like
real
value
is,
is
a
strong
principle
that
we
appreciate
and
like
code
scanning
is
interesting.
Static
analysis
is
an
interesting
one.
We
have
it
turned
on
for
a
large
number
of
our
repositories.
B
If
I
talk
about
my
program,
github
code
scanning
is
one
piece
of
the
static
analysis.
We
do.
We
have
a
second
piece,
which
is
our
own
custom
in-house
framework
that
is
golang
specific,
which
definitely
gives
us
a
little
more
ability
to
very
quickly
look
for
flaws
across
all
of
our
code
bases,
and
then
we
are
also
using
other
tools
like
there's
open
source
products
out
there
that
are
like
symbol,
for
example,
which
a
relatively
low
barrier
to
entry
and
also
have
their
purpose.
B
B
Here
is
the
the
prob
the
the
idea
that
the
pandabar
is
not
just
going
to
tell
us
when
vulnerable
vulnerable
dependencies
are
being
included
in
a
repository,
but
when
but
getting
dependable
to
the
point
where
it
can
tell
us,
this
vulnerable
dependency
is
being
used
and
the
code
path
in
question
is
actually
being
called
from
the
the
thing
that
imports
it.
Now
that
is
the
the
gold
at
the
end
of
the
rainbow
that
I'm
looking
forward
to
seeing
github
take
us
to
it's
the
the
questions
around
the
churn
that
gets
caused
around
okay.
B
B
A
Yeah
you're
talking
about
we
just
announced,
I
think,
on
the
14th
of
april
dependent
depend
about
vulnerability
exposure,
so
so
yeah,
that's
for
python.
I
think
today
I
believe
we're
gonna
go
after
javascript
next
and
then
of
course,
probably
java
and
others
at
that
point,
but
but
yeah.
It
is
to
your
point,
like
I,
I
suspect,
by
the
way
I
haven't
confirmed
this
internally,
so
rumor
mill
here,
but
from
what
I
saw
in
the
marketing
around
this
and
some
of
the
tooling
and
the
way
that
it
works.
A
I
suspect
it's
using
some.
Some
of
the
code
scanning
features
under
the
hood
to
help
identify
that
maybe,
but
I'd
have
to
go
back
and
confirm,
because
to
your
point,
code
scanning
is
one
of
those
interesting
technologies
and,
by
the
way,
the
reason
the
biggest
reason
why
you're
seeing
differences
in
false
positive
rates
from
other
tools
versus
with
code
scanning
is
the
treatment
of
remote
sources
versus
local
sources.
I
won't
go
into
it.
I've
got
a
blog
post
on
it
out
there.
A
B
A
A
B
So
if
you
talk
about
a
traditional
kind
of
I.t
environment,
we
have
this
concept
of
secret
sprawl
right,
where
just
secrets
are
everywhere:
they're
pervasive
across,
like
all
the
code
bases
all
the
systems,
you
have
hard-coded
secrets,
long-lived
secrets
just
distributed
broadly
across
the
environment,
because
that's
the
way
things
have
evolved.
Essentially
what,
as
I
mentioned
before,
what
what
vault
provides
you
with
is
a
kind
of
common,
a
system
that
supports
a
common
workflow
for
management
of
secrets.
B
It
allows
you
to
centralize
your
secrets.
It
adds
kind
of
auditability,
it
adds
that
concept
of
ephemeral
or
short-lived
secrets,
and
it
has
that
kind
of
common
set
of
ui
cli
http
api
access
that
you
can
have
to
get
to
those
secrets.
So
what
what
our
customers
are
using
is
essentially
taming
secret
sprawlers.
What
vault
helps
them?
Do
you
stand
up
a
vault
instance
and
then
you
just
slowly
over
time,
start
migrating
secrets
for
all
your
various
systems
into
vault,
and
then
you
have
this
common
workflow
that
people
can
use
to
access
it.
B
You
have
a
common
point
of
access
control
to
the
secrets,
every
common
point
where
you
can
rotate
and
manage
those
secrets.
So
it's
really
in
many
ways
it
just
helps.
You
gives
you
a
common
workflow
and
helps
instill
discipline
around
how
you
actually
manage
these
things,
because
they
are
essentially
the
keys
to
your
kingdom
right.
You
leak
kind
of
any
one
of
these
things
that
can
have
a
impact,
a
wide,
ranging
impact
to
your
business
overall,
so
that
that's
what
vault
is
intended
to
do.
B
I
think,
when
we
talk
about
secrets
like
it's,
not
just
passwords
and
tokens,
there's
certificates,
there's
encryption
keys,
there's
various
other
pieces,
that
of
sensitive
data
that
you
can
push
into
vault
and
use
it
for
storage,
so
yeah,
that's
kind
of
what
that
solution.
Does
I
guess
we?
We
have
encryption
as
a
service
as
part
of
that,
so
one
of
the
common
kind
of
phrases
is,
you
know,
don't.
A
B
Encryption
of
the
surface
you
basically
vault,
will
handle
the
key
management
and
the
actual
encryption
for
you.
So
you
you
push
you
push
sensitive
data
towards
vault.
It
will
provide
you
back
or
it
will
yeah
encrypt
and
provide
you
back
with
the
the
not
so
sensitive
blob
that
you
can
store
wherever
you
need
to,
like
that's
one
fairly
common
use
case
for
it
there.
B
It
also
recently
added
tokenization
as
well,
so
we
can
convert
a
sensitive
string
to
a
tokenized
version
of
that
string
and
it's
an
approach
that
can
be
used
for
credit
cards
and
email
addresses
and
various
other
data
like
that.
So
yeah,
it's
kind
of
a
bit
of
a
swiss
army
knife.
I
guess,
in
terms
of
here's,
a
common
workflow,
to
help
you
kind
of
standardize
how
you
deal
with
secrets
across
your
your
enterprise
and.
A
It
works,
well
is
the
most
important
part
from
every
every
time
I
talk
to
people,
and
it's
like
okay,
when
you
find
things
with
your
secret
scanning
here
on
the
github
side.
Go
look
at
vault
is
what
I
always
say
is
that's
the
pattern
that
they
should
be
using
like
just
go
there.
That's
always
my
default,
like
out
of
the
gate,
just
go
here.
A
Because
it's
it's
not
enough,
I
think
in
in
some
ways
from
a
security
practitioner's
perspective
to
simply
find
the
problem.
We
should
also
in
as
many
ways
as
possible
be
providing
solutions
which,
so
before
I
get
to
sort
of
the
fun
more
personal
questions
around
just
you
know,
like
things
you're
doing
outside
of
work
and
when
you're
not
looking
at
a
screen,
let's
jump
to
some
of
the
q,
a
questions
that
we
have
and
then
we'll
wrap
with
that.
A
A
You
know
a
lot
of
devs
that
are
doing
presentations
on
to
internal
audiences
for
the
benefit
of
devops
secrets,
management,
etc.
The
question
was:
do
we
have
any
sort
of
you
know,
repository
or
presentation
that
folks
can
use
to
spread
the
good
word?
I
would
suspect
that
maybe
offhand,
I
don't
have
a
ton
of
marketing
material
on
hand
that
I
could
say
like
go.
A
Read
this,
there
is,
of
course,
the
the
blog
that
we
have
for
for
github
and
I'm
sure
that
hashicorp
probably
has
something
very
similar
for
sort
of
pointing
people
in
that
direction.
So
I
don't
know
if
there's
anything
that
comes
to
mind
jamie,
that
you've,
seen
or
maybe
even
like
conference
talks
that
you've
you've
watched
or
you
know
experienced
that
are
out
on
youtube.
B
B
Yeah,
so
the
the
place
to
start
that
I
would
mention,
is
just
hushcorp.com.
If
you
head
over
there
there's
a
range
of
we
have
product
specific
information.
We
have
also
have
kind
of
a
solutions
lens
on
the
different
different
products
we
offer.
So
I
would
say:
go
over
to
hashicorp.com
hit
that
solutions.
Tab
at
the
top
and
it'll
give
you
a
wide
range
of
the
different
use
cases
or
workflows
that
that
we
can
solve
with
our
products.
So
it's
a
good
place
to
start.
B
We
also
have
a
very
well
well-populated
set
of
tutorials
and
the
like.
So
if
you
go
to
learn.hashicorp.com,
then
you
can
really
start
digging
into
the
individual
products
and
then
how
you
can
configure
them
for
some
very
specific
use
cases.
So
there's
some
yeah
good
places
to
get
information
to
dig
into
it
different
levels.
There.
A
I
want
to
ask
the
next
question
here,
which
is:
let's
see
oh
marcia
does
answered.
Let
me
go
back
and
pull
that
back
over
and
share
it.
Let's
see
here
here
we
go
so
given
that
ransomware
is
such
a
big
thing
these
days
in
security.
You
know,
how
do
you
recommend
or
how
does
hashicorp
make
secrets,
strategy
or
secrets
management
available,
both
say
in
the
cloud
and
is
there
an
on-premise
version
that
helps
with
some
of
that
from
a
disaster?
Recovery
perspective.
B
Yeah,
absolutely
so,
I
think
secrets
management.
Obviously,
vault
is
the
product
that
we
provide
there.
As
I
mentioned
earlier,
we
have
kind
of
the
open
source
and
then
the
on-prem
version.
We
also
have
the
hcp
managed
service
version
of
vault.
So
if
you,
if
you
want
a
cloud
offering
that
is
detached
or
isolated
from
your
enterprise
environment,
then
hcp
vault
could
well
be
the
place
to
think
about
there.
More
generally,
volt
is
a
a
flexible
solution.
Like
you
can
it's
distributed,
it
operates
as
a
cluster.
B
Essentially,
so
you
can
kind
of
architect
your
solution,
so
it
will
be
spread
across
multi
expanding
your
blast
radius.
Essentially,
so
you
can
spread
it
across
multiple
cloud
providers.
If
you
want
to
or
just
azs
within
one
cloud
provider,
there
are
various
ways
you
can
architect
this
thing
to
reduce
your
exposure
to
ransomware
for
sure,
there's
also
things
you
can
do
around,
maybe
not
like.
Well,
there
is
the
online
versus
offline
kind
of
binary.
A
B
B
Yeah
this
is
this
is
an
interesting.
So
this
comes
down
to
another
interesting
question
I
have
too,
which
is
around
just
the
whole
concept
of
shift
left
right,
common
catch
phrase.
At
the
moment
you
want
to
shift
security
left,
I
mean
it's.
It
makes
sense
in
many
ways
internally,
whenever
I'm
talking
to
people
about
this,
I
tell
people
you
want
to
ship.
We
want
to
shift
left.
B
Yes,
we
do
that's,
definitely
a
tenant
where
we
want
to
put
more
security
into
the
development
pipeline,
but
we
don't
want
to
shift
too
much
left
and
we
don't
want
to
slow
down,
develop
a
velocity.
So
whenever
I'm
looking
at
our
ci
pipeline
and
what,
where
what
security
tooling
we're
putting
into
that
we're
thinking
about
how
long
does
it
take
to
run
a
scan?
What
is
the
value
of
the
issues
that
the
scan
will
find
and
then
is
there
like?
What
is
the?
B
How
is
our
ability
to
respond
to
those
issues
in
the
timeline
that
a
developer
would
want
to?
So,
yes,
shift
left
but
be
cautious,
as
you
do
so
think
about
what
is
yeah
all
those
things
I
just
mentioned.
What
we're
doing
with
tooling
is
we're
taking
a
split
approach,
so
we
have
some
pieces
of
our
tooling
that
we
do
push
into
the
ci
pipeline,
run
it
per
pr
or
run
it
as
builds
are
generated.
There
are
various
point,
various
points
within
the
pipeline
where
things
may
be
more
or
less
addressable.
B
The
other
thing
that
we
do
is
we
have
a
separate
workflow
where
we
run
out
of
pipeline.
So
we
have
these.
We
call
them
async
or
out-of-band
scans,
where
we'll
run
a
set
of
scans
every
every
night
or
once
a
week
or
once
a
month
whatever.
It
is
often
we're
using
github
actions
to
drive
those
aggregating,
the
results
and
using
serif
and
various
other
methods.
So
yes,
I
mean
that's
a
broad
beginning
to
the
answer
and
then
the
answer
around.
Do
you
start
with
sas?
B
A
It's
a
great
way
to
think
about
it,
so
in
the
last
minute
I
wish
I
could
have
given
you
more
time
on
this
one,
but
I
always
love
to
ask
when
you're
not
thinking
about
the
holy
wars
of
vim
or
emacs
or
tabs
versus
spaces.
What
are
you
doing
when
you're
not
in
front
of
your
screen
on
a
zoom
call,
or
you
know,
hands-on
keyboard?
What
are
you
doing
in
your
free
time
when
you're
away
from
your
computer?
Oh.
B
Man,
time
away
from
zoom
is
such
a
luxury.
These
days
we
live
just
outside
of
seattle,
up
in
the
foothills
of
the
cascades,
so
I
am
a
I'm
an
outdoorsy
type
like
trail
running,
hiking,
mountain
biking,
skiing
snowboarding,
just
generally
getting
outside
either
with
myself
friends,
family
kind
of
whatever
it
is
it's
time
out
in
the
the
blue.
The
blue
skies
of
the
seattle
region,
sometimes
few
and
far
between,
is
probably
yeah
where
I
like
to
be
how
about.
A
You
love
it
for
me,
it's
sort
of
the
same
if
it's
not
playing
video
games
or
you
know
flying
my
drone.
It's
reading
a
book
is
usually
where
you'll
find
me
or
writing
I've
recently
taken
to
that
as
well.
So
with
that
jamie,
thank
you
so
much
for
being
here.
I
do
want
to
just
make
sure
to
remind
our
audience
here
that
please
please,
please
give
us
your
feedback.
Let
us
know
what
you
think.
There
is
a
qr
code,
if
you're
too
afraid
to
scan
the
qr
code.
A
There's
some
documents
in
the
docs
section
that
you
can
go
and
download.
I
mean
I'll.
Let
your
threat
model
be
what
it
is.
Some
people
don't
like
qrs,
some
people,
don't
like
docs,
understandable,
given
some
of
the
questions
we
had
but
we'd
love
to
hear
what
you
think
and
we'd
love
to
get
your
feedback
so
that
we
can
do
more
of
these
and,
of
course,
coming
up
next
at
11
pm
or
to
me
11
a.m:
pacific
2
p.m!
Eastern
is
security
at
the
speed
of
github,
so
we've
got
derek
collin
and
nick.
A
Who
will
talk
more
specifically
about
the
features
that
we
bring
to
bear
here
at
github
and
the
advanced
security
tool
set
with
that
once
again?
Jamie?
Thank
you
so
much
for
being
here
and
audience
as
well.
Thank
you
all
for
joining
us
today
really
did
appreciate.
It
hope
you
all
have
a
wonderful
day
and
remember
to
stay
classy.