►
Description
Presented by Nickolas Means, Director of Engineering, Supply Chain Security @ GitHub
As security is becoming increasingly critical to software, secure development and “shifting-left” is also becoming more important. In this session, Nickolas Means of GitHub will walk you through best practices of secure development. He'll also discuss how GitHub’s code-scanning, secret-scanning, and advanced security can help you build more secure software.
As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub
Thanks!
Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github
About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com
B
Hey
good
morning,
everyone,
it
is
an
absolute
pleasure
to
be
with
you
this
morning
at
github,
satellite
india,
like
divya,
said
my
name
is
nicholas
means
I'm
director
of
engineering
for
supply
chain
security
at
github.
I'm
joining
you
this
morning
from
austin
texas
in
the
united
states,
where
it's
about
30
minutes
past
midnight,
so
I'm
doing
my
best
to
bring
that
late
night
energy
for
y'all.
B
I
I
hate
to
be
this
obvious,
but
a
talk
about
software
security
in
2021
almost
has
to
start
by
talking
about
solar
gate.
The
breach
of
secure
systems
worldwide
through
a
supply
chain
attack
malicious
actors,
inserted
code
into
a
legitimate
solarwinds
library
and
used
as
a
backdoor
into
systems
around
the
world,
as
the
vulnerable
library
was
installed
via
software
update.
Now
this
was
a
huge
incident.
It
got
a
ton
of
media
coverage,
but
the
reality
is
that
most
software
vulnerability
incidents
aren't
nearly
this
visible.
B
B
B
So
if
you're
not
doing
something
to
find
those
security,
vulnerabilities
and
mitigate
them,
you're
putting
your
users
at
risk,
and
it
turns
out
that
developers
introduce
security
vulnerabilities
at
a
fairly
consistent
rate
relative
to
the
number
of
lines
of
code
we
create
now
to
be
clear.
This
doesn't
mean
that
you're
a
bad
developer.
B
It
just
shows
that
creating
secure
software
is
hard.
I
mean
think
about
it.
To
create
perfectly
secure
software.
You
have
to
be
right,
100
of
the
time
to
introduce
a
vulnerability.
You
only
have
to
be
wrong
once
multiply
these
odds
across
an
entire
software
development
team,
and
you
start
to
see
the
scope
of
the
problem.
B
Now,
if
we
operate
with
the
assumption
that
we're
going
to
introduce
security
vulnerabilities
into
our
code,
because
they're
almost
impossible
to
avoid,
then
this
metric
mean
time
to
remediate
becomes
the
one
that
we
care
about.
If
we're
going
to
inadvertently
introduce
vulnerabilities,
then
the
important
thing
is
finding
and
fixing
them
quickly.
B
B
Well,
let's
take
a
look
at
a
fairly
typical
feature:
development
timeline
for
a
software
team.
You
kick
off
a
feature
with
some
planning
and
some
design
work.
You
build
it.
You
test
it
and
then,
if
you
have
a
security
team,
look
at
your
feature
at
all.
It
happens
right
before
launch
after
the
feature
is
already
built
and
when
it's
extremely
expensive
to
make
a
change,
because
it's
so
expensive
to
make
a
change,
only
the
biggest
problems
get
fixed
before
launch,
which
means,
inevitably,
you
find
vulnerabilities
after
your
feature
has
already
been
deployed.
B
So
what's
different
when
we
shift
left
well.
First,
you
need
to
give
your
development
teams
tools
to
help
them
spot
security
problems
early
in
the
development
process,
github
has
focused
on
building
security
tools,
to
empower
developers
to
discover
issues
early
in
the
development
process
and
I'll
talk
more
about
how
you
can
leverage
those
tools
in
just
a
moment.
B
Now
I
mentioned
earlier
that
github
is
focused
on
building
tooling
around
empowering
developers
to
fix
security
issues
early
in
the
development
process.
So
let's
talk
a
bit
about
those
tools
now
github
advanced
security
is
our
suite
of
developer-focused
security
tools.
These
tools
are
all
designed
to
help.
You
write
more
secure
code
by
identifying
security
issues
earlier
in
the
development
process
within
advanced
security.
We
have
three
main
product
feature
areas.
B
The
first
is
secure.
Dependencies
features
focused
on
helping
you
understand
what
dependencies
you're
using
and
how
you're
using
them.
These
are:
classic
software
composition,
analysis
tools,
but
with
a
developer
focused
bent.
Second,
is
secure
code.
These
features
are
focused
on
helping.
You
ensure
the
code
that
your
team
writes
is
secure
through
static
analysis
scanning
and
finally,
secure
secrets.
B
So,
let's
start
by
talking
about
secure
dependencies,
making
sure
the
code
that
you're
importing
into
your
project
is
secure
and
safe
to
use.
First,
I'm
going
to
talk
about
a
few
tools
within
secure
dependencies.
First,
our
friendly
dependency
updating
robot
depend
the
bot
which
helps
you
keep
your
dependencies
up
to
date
with
alerts
and
automated
pull
requests.
B
B
Dependabot
will,
let
you
know
in
most
cases,
dependable,
can
generate
a
pull
request
for
you
automatically
to
update
your
project
to
a
safe
version
of
that
dependency,
and,
if
dependable,
can't
update
your
code,
for
you
say,
because
the
vulnerable
version
is
directly
specified
as
a
dependency
of
another
dependency
in
your
project.
Dependebot
will
send
you
an
alert
to
notify
you
and
to
give
you
steps
on
how
steps
you
can
take
to
resolve
the
problem.
B
This
keeps
you
from
being
exposed
to
a
vulnerability
discovered
in
an
older
version
of
a
dependency
or
worse,
getting
stuck
in
a
situation
where
it's
difficult
to
migrate
off
of
an
old
version
of
a
dependency
because
you're
so
many
versions
behind
now.
The
key
thing
that
I
can
tell
you
about
dependable
is
that
repositories
that
have
dependable
security
updates
enabled
fix
vulnerabilities
on
average
1.4
times
faster
than
repositories
that
aren't
using
dependable.
B
So
if
you're
focused
on
mean
time
to
resolution
for
security
vulnerabilities,
this
is
one
of
the
key
ways
you
can
address
that
metric
next
dependency
review
is
a
relatively
new
feature
to
help
you
understand
what
dependency
changes
are
being
made
in
a
pull
request
for
each
dependency.
You
use,
you
can
see
how
old
the
version
you're
using
is
how
widely
used
that
dependency
is
and
what
license
it
was
released
under.
But
the
critical
feature
is
that
dependency
review
will
flag
any
vulnerable
dependencies
for
you.
You
can
see
in
this
screenshot.
B
The
dependency
review
has
flagged
a
critical
security
vulnerability
in
the
json
web
token
package.
By
reviewing
this
at
pr
time,
you
can
make
sure
that
it
never
gets
deployed
to
production
in
the
first
place
and,
finally,
the
github
dependency
graph
is
the
secret
sauce
of
our
dependency
security
features.
B
B
Okay,
so
we've
covered
code
that
other
people
are
writing
and
that
you're,
including
in
your
code
base,
let's
shift
gears
a
little
bit
and
talk
about
making
the
code
that
your
team
is
producing
more
secure
with
our
secure
code
features.
These
are
tools
to
help
you
spot
potential
security
problems
in
the
new
code.
You
and
your
team
produce
again
I'm
going
to
talk
about
a
few
features
within
secure
code.
B
Next
codeql
is
github's
advanced
semantic
code
analysis
engine,
it's
focused
on
helping
you
find
security
vulnerabilities
in
the
code.
Your
team
produces
displaying
the
results
in
code
scanning
and
finally,
support
for
third-party
analyzers,
which
let
you
extend
the
built-in
analysis
of
code
ql,
with
the
results
of
any
standards,
compliant
static,
analysis
tool.
B
So,
first,
let's
talk
about
code
scanning
code
scanning
is
a
rich
user
interface
that
allows
you
to
review
and
understand
the
results
from
security
scans
right
in
the
pr
flow.
It
brings
you
the
information
at
code,
review
time
when
you're
primed
to
act
on
it.
When
the
code
is
still
fresh
in
your
mind
in
this
screenshot,
you
can
see
a
code
ql
result
indicating
a
potential
denial
of
service
attack
because
of
missing
rate
limiting.
B
It
shows
you
the
line
of
code
where
it
found
the
problem,
and
it
gives
you
rich
data
about
what
exactly
is
going
on
and
the
steps
you
should
take
to
remediate
it.
You
can
review
results
from
third
party
static
analysis
tools
in
the
same
way,
and
our
code
scanning
interface
supports.
Displaying
results
from
github
actions
builds
as
well
as
third-party
cicd
tools,
so
you
don't
have
to
move
your
build
infrastructure
to
take
advantage
of
this
rich
feature
set.
B
B
Codeql
is
available
in
c
c,
plus
c
sharp
go
javascript,
java,
python
and
typescript,
and
it
can
detect
over
160
different
categories
of
vulnerabilities,
including
unvalidated
input,
cross-site,
scripting,
improper
escaping
integer,
overflow
and
denial
of
service
attacks
and
circling
back
to
where
we
started.
My
colleague
baz
the
director
of
product
for
code
scanning
just
published
this
blog
post
last
week
on
the
github
blog
detailing
how
you
can
use
codeql
and
code
scanning
to
detect
traces
of
solargate
in
your
build
infrastructure
where
it
could
be
used
to
infect
other
systems
in
your
network.
B
B
B
B
B
When
we
find
one,
we
notify
the
service
that
issued
that
credential
that
we
found
it
disclosed
publicly
so
that
they
can
remediate
it.
According
to
their
standard
procedures
for
accidentally
disclosed
tokens,
this
usually
takes
the
form
of
their
revoking
the
token
and
letting
you
know
that
it
needs
to
be
rotated
and
replaced
with
a
new
token.
B
Next
secret
scanning
for
private
repositories,
when
you
enable
this
for
repository
github
scans,
the
full
history
of
that
repository
to
find
any
secrets
and
old
commits
so
that
you
can
get
clean
and
it
alerts
you
if
any
new
ones
are
committed
so
that
you
can
stay
clean
now.
These
are
credentials
that
have
been
disclosed
privately
inside
of
your
organization,
so
instead
of
reporting
them
to
partner
service
providers
for
revocation,
we
report
them
to
you
so
that
you
can
decide
what
to
do
about
them.
B
B
It's
our
new
org
level,
security
overview
and
it's
launching
in
beta
for
github
enterprise
cloud
customers.
Security
overview
does
exactly
what
the
name
says.
It
gives
you
an
overview
of
security,
feature
enablement
and
alert
counts
across
secure
dependencies,
secure
code
and
secure
secrets,
as
well
as
a
risk
determination
based
on
the
number
of
unresolved
alerts.
B
B
What
should
you
do
next?
Well,
if
you
want
to
shift
left,
you
need
to
make
sure
that
everyone
on
your
team
has
the
tools
and
the
information
to
spot
potential
security
issues
before
they
become
a
problem.
You
need
to
involve
your
security
team
early
in
the
development
life
cycle
to
design
secure
features
from
the
start.
B
If
you'd
like
to
learn
more
about
the
security
tools
that
github
offers,
please
visit,
github.com
features
security.
All
right-
that's
all
I've
got
this
evening.
Thank
you.
So
much
for
being
here,
for
my
talk,
I'll,
definitely
be
in
the
discussion
later
to
answer
any
questions
you
might
have,
but
please
stick
around
for
a
few
minutes
here
for
q,
a
with
our
hosts
first
again.
Thank
you.
So
much
for
being
here.
C
A
B
B
It's
very
much
they're
seeking
to
come
alongside
and
provide
pragmatic
recommendations
to
address
things
that
are
part
of
the
the
threat
model
of
that
feature,
rather
than
resolve
everything
possible
a
good
example.
My
group
recently
commit
completed
a
hack
week
and
there
were
a
couple
of
projects
coming
out
of
that
hack
week.
That
engineers
I
mean
these
are.
B
These
are
small
features
that
we
were
able
to
complete
in
the
span
of
a
week,
but
still
engineers
on
the
team
reached
out
to
our
application
security
team
for
consultation
on
them
to
make
sure
that
we
were
considering
all
the
angles
that
we
needed
to
be
so
it's
it's.
This
rich
consultative
relationship,
not
the
gacha
culture
that
I've
seen
sometimes
in
previous
companies,
I've
worked
at
and
if,
if
security
team
creates
that
kind
of
environment
that
makes
engineers
really
eager
to
engage
with
them
and
seek
their
help.
C
B
Well,
I
think
I
think
it's
all
tied
in
with
how
we
build
software
now
you
know,
if
you
think
about
how
software
was
built
20
years
ago
code
reuse
was
mostly
an
academic
pursuit.
It
wasn't
really
a
practical
thing
that
anybody
did
now
we've
kind
of
gotten
to
this
place,
where
we
reuse
software
all
the
time
by
bringing
open
source
dependencies
into
our
projects,
and
when
we
do
that,
we're
inviting
people
that
we
don't
know
under
our
code
base
by
way
of
the
libraries
that
they
maintain.
B
B
You
know
we're
trying
to
figure
out.
How
can
you
invite
other
people
into
your
code
base
but
make
sure
that
the
code
that
you're
bringing
in
is
safe,
because
you
know
if
you're
bringing
in
a
library
that's
got
40
000
lines
of
code,
it's
pretty
impractical
to
go
and
read
all
of
that
code.
There
has
to
be
some
component
of
trust
built
in.
B
At
the
same
time,
we're
kind
of
far
far
enough
along
the
adoption
path
of
open
source.
Now,
there's
enough
companies
using
it
there's
enough
rich
targets
using
open
source
software
that
it
makes
a
pretty
rich
attack
surface
so
we're
starting
to
see
the
pace
of
those
attacks
pick
up
and
this
is
going
to
be.
You
know,
we're
we're
seeing
it
in
the
news
a
lot
now.
I
expect
that
to
continue.
I
don't
I
don't
think
supply
chain
attacks
are
going
to
go
away
anytime
soon,.
A
B
C
B
Oh,
that's
a
good
one!
You're
right,
I
have
been
working
in
the
space
at
github
for
a
while
and-
and
I
don't
know
I
have-
I
have
a
real
fondness
for
just
vulnerable
dependency
alerts
because
it's
where
we
started
it
was
the
first
security
feature
that
we
wrote
the
first
security
product
feature
that
we
rolled
out
the
emails
that
we
sent
you
to
tell
you
that
you
had
a
vulnerable
dependency
in
your
repository
we've
iterated
over
those
alerts
a
lot
over
the
last
couple
of
years.
B
It
used
to
be
that
you
would
get
one
email
for
every
repository
that
you
had
a
vulnerable
dependency
in
and
now
we're
to
the
point
that
we
roll
that
up
to
when
there's
a
vulnerability
published,
we
send
you
one
email
about
that
vulnerability
that
contains
all
of
the
repositories
that
that
have
that
vulnerability
in
it.
So
we've
tried
to
reduce
the
noise.
We've
tried
to
make
those
alerts
more
useful,
but
it's
still
it's
still
sort
of
the
meat
and
potatoes
of
keeping
your
application
secure.
A
B
C
Yes,
it's
gonna
be
an
industry-wide
game
changer.
Thank
you
nicholas
again
for
joining
us.
So
late
at
your
night
and
answering
all
the
questions.
Folks
remember
nicholas
is
continuing
to
be
staying
with
us.
He
will
be
at
discussion
so
send
all
your
good
questions
to
him.
Then
thank
you
again,
nicholas
bye,
yep.