GitHub GitHub Universe 2020 - Workshops, 18 Dec 2020

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Security: Workshop 1 - DevSecOps automation with GHAS

Description

This Workshop is designed to get you familiar with GitHub Advanced Security (GHAS) so that you can better understand how to use it in your own repositories. You'll use GitHub Advanced Security features like code scanning and secret scanning to detect vulnerabilities, and see how to use automation to detect these issues before they reach production. Difficulty level = Intermediate (200)

For more from GitHub Universe 2020, visit https://githubuniverse.com

As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub

Thanks!

Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github

About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com

A

All right, hi everyone- my name is chelsea bowling um good morning afternoon evening, wherever you are happy friday to all um welcome to the devsecops automation with github advanced security, aka gas- I'm your presenter today, I'm a part of the professional services team here at github and I'm an implementation engineer for advanced security all right.

A

So let me change the slide, all right cool. um So, along with myself, um I have my colleagues here, john lupton, one of our lead security solutions, architects on the team and my other awesome colleague, mario campos, who is also an implementation engineer and who is also moderating this workshop. So we're very glad you've taken this time to be with us and to take this workshop all right. So, let's begin okay.

A

So what is advanced security um before we even dive into github advanced security? Let's discuss what devsecops is and the importance of it in the software development lifecycle right. So it's pretty simple. It includes all the best practices of devsecops and so devsecops brings security into development and operations teams to ensure that security is a top priority at every stop of the software development lifecycle.

A

So to drive down the number of vulnerabilities in production code, we should make sure that security is a part of everyone's daily work instead of testing our security concerns at the end of the process, so putting developers front and center for application security is the most effective way to shift security left and succeed against the mounting technical debt that can overwhelm even the best teams.

A

So this means integrating security, testing and controls into the daily work of development, qa and operations, and ideally we want to automate this process and that's what we're going to do in this workshop automating devstock ups by using gas all right. So, as you can see in the slide I mentioned, you know, using devsecops using that kind of process lowers the security costs, less technical debt for the developers and help your teammates right, and everybody would like that all right.

A

So with that being said, I have a diagram here. That kind of shows you, like you know why not be more developer centric uh when in our current process that we've seen now is that we're using security tools around this stage of deployment, and we kind of just want to strip that left, because we want to take care of security vulnerabilities um earlier in the process right so testing just before deployment. Why do that um static? Testing and dynamic testing happen at the end of the delivery cycle? I think we can shift that left right.

A

So so, let's talk about advanced security, um our product um here at github, so advanced security is a suite of security tools used to enable developers to identify security vulnerabilities in their code bases.

A

So, as you can see, that includes code scanning secret scanning, depend-abot security, advisories security policies and dependency insights, and let's pretend that we have dependency reviews squeezed into this list as well. um I'm sure you guys heard about this um during the universe talks, so um this product dependency view is another fantastic tool that offers tighter integration of security by helping contributors, understand, dependency changes and their security impact at every pull request right.

A

So, furthermore, we want to bring a native and automated experience when it comes to securing your code on github and it's very important that when we talk about application security, uh perhaps part of the challenge with application security today, as I mentioned before, um is that it's pretty much like a security teams. Experience and what we want to do at github um and to share around the world is to make this experience to be more deaf-centric right.

A

So the developers who are the ones that are responsible for remediating and fixing these issues, we want developers to come to a single point to utilize security tools, alongside all the other software development initiatives that they're running inside their pipeline.

A

So in this particular workshop, we're going to focus on exploring code scanning secret scanning and dependable and when you know dependable, is um two applications that we're gonna explore the security alerts and the security updates. So there you go and another diagram here to show uh to show you. So here is a basic application security scenario here again in this scenario and some developer work workflows that I've seen myself and other team teammates as well. um The usage of security analysis happens right before we're about to ship. Okay.

A

So once again, why not use these security security tools earlier in the software development workflow, which could be alongside securing coding practice and quality code checks right? So I've improved it right here, all right, so here we are shifting it left, um here's how it couldn't be better instead of software dev teams and it operations and security teams working independently.

A

Why not commit to sharing this responsibility of security and follow security guidelines in all lines of work right, so this is where we want to be to shift security left and have security integrated at the pr level.

A

So just a little recap of what's going to happen during the workshop, so some questions that you should have in your head right now. How are we going to shift left with these advanced security features on our hands and what we're going to do next in the next hour is enable these features, as mentioned previously.

A

Okay, so getting started just want to make sure that uh everyone's all good. This is just like a health check slide. um Are you logged into github right now?

A

Have you accepted an invitation to be a collaborator of the universe, workshop organization, um so just taking like a small breather right here to get everyone um settled and if you have any questions at all, please utilize the slack channel right so I'll. Just pause for like 30 seconds right.

A

A

A

Alrighty so hopefully everyone got like a chance to sip their coffee or their water or tea, and let's get started on talking about our demo application. So if you have your repository and you're, seeing it there's like a couple of folders in there, you kind of see like oh it's a dumb application. It has like many languages, um so it's a simple gallery application with a handful of services.

A

um So, as you can see, if you look in the front end folder, all of that is written in javascript we have a couple of back-end services written in java, go and python, and just to note, it's not required that you try to spin this up.

A

Most of what we're doing will be in the browser enabling secret scanning dependable and code scanning in the ui, and we're going to modify a couple of files to see some of the alerts and just a little hint there's a script folder, which contains a python script that generates secrets, which will be handy in one of our exercises, so I'll be sure to mention that again, once we're doing a deep dive with secret scanning all right.

A

So change the slide so what's an easy way to um do to improve uh team security. So if you have a moment, um I'd like to get your thoughts on this question, please post, like any thoughts you may have about uh about this question, love to get your feedback and, let's just start off by um giving a nice introduction to secrets, uh sorry secret scanning, um so some self-reflection questions for introspection.

A

um Have you pushed something to a repo? And you know you shouldn't have or who has seen someone commit or expose secrets to a repository, um so who's ever been in this situation where you're working too fast? Maybe you have three features to do and someone like your tech lead, ask you to rotate the keys. You do so, but accidentally commit these credentials to production.

A

So we all make mistakes. Things happen, love to give your love to share, um see your share of stories in the slack channel if you have any um so this is where secret scanning comes in. We use secret scanning to scan for known types of secrets to prevent fraudulent deceitful use of accidentally committed secrets.

A

So when you push through a public repository in github, github scans the content of the commits for secrets, if you switch a private repository to public github scans, the entire repository for secrets, if you check a secret into repository, anyone who has read access to the repository can use the secret to access the external service with your privileges.

A

So for safety measures we recommend storing secrets in a dedicated, secure location outside of the repository for your project and personally for me in past previous experiences. I've worked with assistant engineers that could, like you know, push those secrets to like a sandbox like a secret sandbox and make sure that it's safe, um so making sure that you have like secure practices is like a really good thing to have.

A

So, when secret scanning detects a set of credentials, github notifies the service provider who issued the secret, so the service provider validates the credential credentials and then decides whether they should revoke the secret issue, a new secret or reach out to you directly, depending what the risk is. So um I've listed a resource in our in a repository.

A

It's a long list of providers which can be found in our github documentation. So, for instance, um one of our service providers is aws, a strip atlassian azure to name a few okay, so depend about so dependable.

A

For the purpose of this workshop, we're going to go over depend about alerts and security updates. So now that we talked about secret scanning, um what about the dependencies that our projects rely on? Can you think of a time when you worked on a project that had a handful of vulnerable dependencies? So again, if you have any thoughts about this we'd love to hear your story um so depend about security updates, make it easier for you to fix vulnerable dependencies in your repository.

A

So when you enable this feature during this workshop, when a dependable alert is raised for a vulnerable dependency in the dependency graph of your repository depend about what automatically trigger a pull request, which is pretty cool to do since this isn't done natively and there's no need to integrate this functionality into your ci pipeline all right.

A

So let's take a look at secret scanning and depend upon actions we're going to go through the practical exercise at the very first one. So let me handle this maneuver of transferring the keynote to the to my browser. So let me do a new share of this.

A

Can everyone see my screen thumbs up we're good.

A

A

B

It looks like that's a yes, that's.

A

A yes, okay, I couldn't see like the green like highlight over the monitor. So all right, I get very insecure about that. When I don't see it all right, so um I made my own copy of our workshop right, devsecops, automation, gas.

A

um So, as you can see, there's a pattern like you'll find a repository with devsecop's gas with like your handle. So that's the repository that you should be using and you should be an admin to your own repository all right. So what I'm going to do is I'm going to go into the exercises right here.

A

Our very first exercise is going to be with secret scanning, um and so just to give you like a little overview if we start with secret scanning all the way towards the bottom, we'll find like our next link to go to the next like section. So um this section here is the pindabot. You go all the way to the bottom over here at code scanning and then all the way to the bottom. We have some additional references that you can look at after the workshop.

A

Alright, so let me go back to secret scouting all right and I have a towel manager. So uh hopefully this would look great to you guys, so I'm going to have the instructions right here and then I'm going to follow those instructions in this other window right here all right, so let me go to the root all right so for practical exercise, 1a we're going to enable secret scanning.

A

So let's go to the settings page right here and in the settings page you'll see a bunch of um tabs over here. The one that we're mainly concerned about is like going to the security and analysis section so right here and here you'll see the configure security and analysis features and, as you can see, obviously like we have um four options: to enable secret scanning depend about security updates depend upon alerts and dependency graph. I knew I read that backwards so for this section, let's enable our secret scanning right.

A

There awesome so as soon as you click that button it'll go to disable, which we won't do. Okay. So let me read through these instructions. After a few minutes, the security tab in the repository will indicate that there are new secret uh new security alerts. So let me refresh my browser for you, so if it doesn't happen um automatically, you could like commit something simple to the readme to trigger it all right, so it looks up for me.

A

I need to trigger it, so I'm going to put like a test.

A

um Text right here and hopefully that'll- do it and it's okay for in this case, to commit to the main branch of your repository.

A

A

Secret scanning alerts, okay,.

A

All right, so this might take some time. I've actually created a solution repository. So this is something that I'd like to share with you all after the workshop. But what you're supposed to see at this point is you know a couple of secret scanning alerts over here, so the ones that it'll find are the amazon aws access, key ids all right, so I'm going to pause right here, get everyone to try and see if you can get those alerts to show so I'll pause for a minute.

A

If you have any questions, please post your questions on.

A

C

hmm So I guess we can just respond to some of the questions on slack.

A

Okay, cool cool.

C

um So so mike asked, if, if secret scanning is an extra, an extra sku, um all of the advanced security stuff for open source is, is going to be available to everyone, and I think, with one tiny exception, um uh it should all be available to open source today. So if you've got public open source, repos um you'll just have it uh for enterprise customers um yeah.

C

It's part of the advanced security sku, uh which includes secret scanning code scanning um and a few other bits that were on chelsea's earlier slide that we are not going to cover today. But I would encourage you to to look into if you're interested in that kind of thing.

A

All right sounds sounds good.

A

um Let's see I'm going to refresh my page and see if we have anything um so, as indicated by this little reminder once like github finds like those secrets, they'll send an email to you if you are signed up for notifications of your own repository you'll get that notification um describing like all the key secrets that I found all right. So it looks like I might have like a little trouble here with my own repository. um It's a good thing. I have my solution uh repository to show you guys.

A

um So, let's just move on to to the next section right here, which is to introduce a test secret.

A

So when developing test cases, it might be the case that secrets are introduced that cannot be abused when disclosed secret scanning will detect an alert on these secrets.

A

So um so, let's head over to the service which is written in java, the storage service so in the source, folder we're going to go to the resources and commit a file for the development environment.

A

Okay, so here we're going to um generate some secrets. Let me not go. Let me go step above and create application.dev properties, properties.

A

Okay, so um you can either like copy and paste uh this key id in secret key, but make sure to like probably um modify like the sixth to last like character in there. Otherwise uh you can go into the scripts folder that I talked about and generate a new set of key ids right. So I have my terminal open and I pointed to the scripts folder and what we can do is um run this script.

A

Okay, and if you do plan to run this script, uh make sure that you have like the random stream package installed so make sure you pimp, install it pip install it and um yeah make sure you have python 3 installed as well, so those would be the key ids and secret keys that I commit and looks like. I see in the chat that someone's secret scanning completed, which is awesome.

A

I wish I could say the same for myself I'll check on that later. So right now, I'm about to commit this application.dev properties file.

A

So, if you're familiar with properties, there might be like a stage one and a production one. So um I'm going to commit this right now and let's determine if this secret pops up in our alerts. Okay,.

A

Hopefully it goes. Okay, awesome, I'm happy, so it detected the ones that I expected earlier. So I'm going to wait for the one I just committed for about 20 seconds, all right. If it doesn't show, then we know that we, you know committed it to some dev properties file. So it's all good, um so I'll give everyone about 30 seconds to work on this step, all right that zero got the first four awesome.

A

A

So if yours only picked up, two um one thing that you can do is um use that python script to like generate a new one, just to like uh play around with it. Some more.

C

Have a look in that repo and see if I can figure out why it's only good too yeah.

A

A

Right all right, yeah, so yeah, I didn't get a good look at this, but yeah application.properties. It picked up those um two and then the one from application.properties. So um my bad on that, uh let's move on to um excluding files from secret screening secret scanning. Sorry can't say that I don't know why. um So, while we can close a detective secret as being used in the test, we can also configure secret scanning to exclude files from being scanned.

A

So, as you can see, if we go back to our oops repository in the root, let's go into the github folder and, as you can see, we've already created the secret scanning yaml right.

A

So what you can do in here is exclude uh files from secret scanning so um already by default or what I've added um a couple of days ago or probably yesterday, I um added the readme, since we don't really need to scan secrets in there. It's pretty obvious that we're not to do that in there, but I mean, if you do like commit a secret in there, it'll detect it. uh If you remove this from the patrick patrick's, nor, along with the exercises as well.

A

So if you're familiar with the filters that are being used, um then this is something uh that you can do. You can use the star, which means like hey anything under this folder we're not gonna, look into right so as with the application.dev properties that we've um committed. um If you look into the solution or if you don't want to look at this solution, uh what we can do is um you know, exclude that path right.

A

So that's what I'm going to do, I'm going to copy and paste this, so I don't make a mistake when I type um so let me do that and you can also exclude the test folder. So let's go ahead and do that as well. Right.

A

Commit that to my secret scanning animal.

A

A

Okay, so it managed to um ignore the application.dev properties file, which is uh what we expected right and for the third step test, the pattern by adding another secret or to the file application.properties um so, for example, changing changing the secret create by manipulating a character in the existing one or using the python script. um I'm going to leave this step to you guys, um I'm just going to ignore this piece since I'd like to move on, um but I would love to like get your feedback on this little exercise right here, all right.

A

So, let's move on to the last the last step, which is managing access to alerts. So due to the nature of secrets, the alerts are only visible to your organization and repository admins access to other members and teams can be given in the security analysis setting.

A

So if we go to the security analysis settings again, we should see this access to alert section right here. So this pertains to dependable and secret scanning and, as mentioned by default, admins have this visibility.

A

But if you want to um enable this for someone else, they need to have right access in order to see those dependent, bot and security secret scanning alerts as well. So if you have a buddy with you during this workshop, um go ahead and give this a try um by adding them to your repository, and then you know finding their name in this section right here where it says: search for people or teams.

A

Okay, so I'll give about probably 40 seconds for this 40 seconds to a minute on this, just in case anyone has a buddy so and a chance for me to drink water.

A

All right, so, let's move on to the next section, which is the pandabot. So let's see I have a couple of slides that I'd love to share with you all. So let me go back here and.

A

um Oops I touched.

A

So um can everyone see my slides okay get the thumbs up. If you see it. Mario john sounds good all right cool. Yes, all right all right, so that was practical exercise one with secret scanning, and I have a cool recap slide for you. Just do a health check all right, so great job on the first exercise, if you're able to complete it.

A

um So in this case like we were able to enable secret scanning we're able to view and manage the results, um modify its respective configuration file, which is the secret scanning enamel that we discovered um so there's some stretch goals and if you look into the additional references, markdown you'll be able to see um the graphql api and some other apis that we have listed there, such as code scanning.

A

um So all right.

A

So let me let me get settled here all right, so how do we? How do we find vulnerabilities in the code that we write? I think I've I've jumped ahead in my in my slide for a second yeah. I jumped way ahead. Oops.

A

Okay, so actually I did a mess up right here, we're supposed to go over to pentabot uh after this, instead of showing you this recap side, my bad, um it's in the I'm, it's like eight o'clock here. So still, I guess trying to wake up my bad. um So let me exit out of this and let's just jump into the next section, sorry y'all.

A

huh How did that make that mistake all right? Sorry, so, let's just jump ahead with the pentabot um all right, so let's go through there, um so enabling depend about alerts. So if you're already on the security analysis section already, the settings I mean, uh then you can enable um depend. Dependency graph depend about alerts and security updates. So let's do that right now, that's an easy step to do so. Let's do that.

A

Okay, awesome sauce, so.

A

Okay, so as soon as you enable these features, you should already see like a bump and like your security alerts already. So, let's look into there.

A

So right now you should see um six about alerts and it found each in each of these services so the front end service, the authentic, authentic authentication service and the gallery service and storage service right here all right and what you can do is see the dependency graph in the insights tab. So if you take a look, um you go to the dependency graph and you'll, see like all your dependencies listed here, which is pretty awesome right.

A

Okay, so I'll give about 30 seconds to everyone get on the same page right.

A

A

Okay, so um in this section viewing and managing results. So after a few minutes, as I said, you should be able to be able to see like some of those security alerts. um So we have a note right here. If you're not able to see it, um you can trigger um an alert by modifying the requirements text file. So if you're not familiar with requirements that is used to use for python projects, so you can put your dependencies in that list and pip install it right. So let's go into the authentication service.

A

So if you want to do it, you can modify any of these um dependency versions to a vulnerable version. So, let's see, if I can find django django is not in here.

A

I think maybe django 2.2 0.13 is one, so I'm going to put that in there all right.

A

A

So if you want to do a little bit of research to find like a vulnerability version, you can do so right now.

A

A

So when that is done um head over to the next section, enabling dependent box security updates, so as mentioned in our slides dependable, can automatically create prs to upgrade vulnerable dependencies to a non-vulnerable version. So I've already enabled this for myself, but if you haven't already take the time to enable dependent bot security updates in the security analysis settings all right, so, as you can see, um you should be able to see um a couple of pr's in your pull request tab that kind of bump up the version which is awesome.

A

So here, as you can see, we have a pr to bump up axios from 0.18.0 to 0.18.1.

A

A

So I'll pause right here for a couple of.

A

A

A

Okay, so right now, um if you're able to see prs for your dependencies awesome, the next thing that we want to do is configure the dependable security updates, so um so to just successfully integrate the security updates into the software development lifecycle. It is possible to configure various aspects such as when security aprs are created, what labels are assigned to enable filtering options who is assigned to the pr who should review it and specifying which dependencies are updated and how they're updated.

A

So what we can do right now is go to the hidden, github folder um and create a dependable ammo.

A

So let's do that awesome. So what we want to do here is look for dependency information in the directory authentication service and then a list of steps right here, too scheduling daily security updates prefix to commit message with the package manager, pip assign the pr to yourself or a buddy of yours. That is in a workshop with you as a reviewer.

A

Add the custom label triage required to enable filtering of the prs and make sure the label exists by adding it to the labels section of your repository.

A

So um so, let's go ahead and do that I'm going to just like skip ahead at the risk of like typing mistyping, some things. So um in my solutions repository, let me find that open up a new tab.

A

What you're dependent by ammo should look like is something like this.

A

So um as a part of the workshop instructions, we want to prefix the commit message with the package manager pip. um We want to look into the dependency information and directory authentication service. um We want to schedule this daily to look at dependency vulnerabilities. If any, we want to put these put the labels triage required.

A

If you want to you, can create your own label as well, I'm going to assign it to myself, but if a buddy with you assign it to them, we have also a reviewers key right here I put non-existing and then the commit message prefix it with pip right.

A

So your solution to this um part of the exercise exercise should look like this.

A

And, let's see, I don't think for this repository of mine, I have any labels, so if you don't have any labels, it's possible that it could throw like an error or it doesn't show oops. Let me just test out this. One put security labels in there.

A

Okay- and that is because we're in the wrong organization- sorry about that, so make sure for this step that um if you are trying to create levels, that you don't immediately copy and paste that that's a typo that you put github universe workshops, so my bad on that.

A

um But this is where you would create the new labels right here. It's simple and easy. So, let's see I had here triage required. So let me make a label for that here.

A

And then you can pick the color, your favorite color or generate a random color and create that label.

A

Okay, so I'm going to pause here for a couple of seconds for everyone to catch up and get the label situated and creating the dependent body ammo. So.

A

A

And there's also solution in the workshop markdown as well.

A

A

C

There's a question in the channel about what time it runs at and I think that this is actually a little bit subtle.

C

So I believe that it will run more frequently than that, so it will provide you updates for things that are out of date uh as soon as it can and the time that you put in that config file tells it. When, should it check the registry to see if there's new versions available, so you should, even if you set it to 5, am you should start getting pr's and alerts now?

C

But if uh let's say that, you know uh in in two hours someone releases a new version of of django with um some security vulnerabilities fixed, uh then that time says when's the next time that we'll actually check the registry, and so that will happen uh overnight.

C

um So I guess, if you have like a known schedule where things are published internally, you may want to set that or if you just want most of your updates to come in in the middle of the.

A

A

Cool awesome I'm going to wait for a couple of seconds until we hit the 45 mark and then I'll begin like the next section, or this.

C

Do people have dependable alerts? Have they got through the uh do? You have pull requests, let's see.

A

Awesome all right, some people all right, awesome, cool.

A

Cool someone plus the during yaml, um looks like it's assigned to me. I have things to fix, awesome all right, so I'm going to start the next section, I'm actually just going to refer back to the recap that I showed earlier. So this would be the proper time to show it. So let's do a new screen share.

A

Of can y'all see it john. Are we good thumbs up? Yes,.

B

A

Sweet all right so now it's the actual recapping. So if you're able to um modify the secret scanning ammo the dependent by ammo and they're, able to see the secret alerts and the dependable alerts then awesome. So um this is like the awesome, like automated native experience that we want developers to have. This is something that you can do in probably not in five minutes, but probably like 15 to 20 minutes of like your time to have like a really big impact on security. So it's like very easy and awesome.

A

So um so how do we define vulnerabilities and the code that we write so I'm alluring to the code scanning part of this? So let's go to the next section right here so code scanning, so we've gone over how to scan secrets. We've found uh vulnerable dependencies along the way. um So what about our code so suppose you're in a sprint, and you have three features to develop for how many features you want to develop.

A

You develop these features and submit prs with code scanning enabled you can actually scan your code and your pull request and see any securities introduced, rather than seeing those securities introduced later on.

A

So it's awesome to have code scanning integrated into github, because developers like yourself can quickly and automatically analyze the code in the github repository to find security, vulnerabilities and coding errors. So, in addition to the native experience, codeql is a key ingredient in the secret sauce behind code scanning that makes the tool truly unique and powerful.

A

So you can use code scanning to find triage and prioritize fixes for existing problems in your code. You can schedule scans for specific days and times or you can trigger scans when a specific event occurs in a repository such as a push so we'll get to explore all of that in our exercise soon.

A

So, if code scanning finds a potential vulnerability or an error in your code, github displays an alert in the repository so as you've seen like in this screenshot, we have depended by alerts and then code scanning alerts and then secret scanning alerts. So we have a section for each as you've seen already so after you fix the code that trigger the alert. Github closes the alert and we have more information in the resource resources section of the readme um to find out more about code scanning um on your own time.

A

There's like really good documentation um on how what code scanning is all about configuring code scanning and all that jazz. um So we get to explore all that in this workshop now. So, let's enable code scanning all right. So let me get out of this keynote again and I'm gonna share my other screen.

A

A

So let's go to the next section here.

A

All the way in the bottom you'll find that click here link to navigate you to the code scanning section and I'm going to use my.

A

Personal repository again and not the solutions one, so um this will be practical exercise too, and basically, what we're going to do is go into the security tab and in the security tab, you'll see the security overview section, um which lists all the gas features here, along with code scanning alerts. um Here you'll see setup code scanning. We want to click that button okay.

A

So when you click that button you'll be introduced to this screen here called get started with code scanning. We have our very own coil analysis, but we also have like security analysis tools um from the marketplace. So not only do we have like our very own clinical analysis tool, um you can choose like other ones right. We have codacity security security scan. We have the cxs tool from check marks, so um we're very flexible in terms of like you know the um security tools that you want to push into your workflow right.

A

So, for the purposes of this workshop, though we're gonna go with this cochlear analysis, we're going to set up the workflow for that, and so by default we have a workflow populated with some values already, um which is kind of cool right, so you don't have to like type and make mistakes in the yaml.

A

Like me, so the first thing that you'll notice is um the name of your workflow. It's you know simply called coql. You can easily modify this. It's a string. um The next section here um are the events.

A

So so, in the events we have the push event. We have the pull request event and we even have a schedule.

A

So the neat thing about this cron job is that um when you commit a cochlear analysis file like here in the ui, if you do it again in a different repository, this cron job is randomly generated so you'll see um for mine. uh The schedule will be 10, 19 utc on a sunday. So when you see this on your own, it's probably different from micron schedule right, okay. So what we're going to do by default is enable code scanning on push pull request and on this schedule.

A

Okay, so the next section here is the jobs section, so we've defined a job called analyze. We named it analyze here so for this particular job. When we're doing cultural analysis by default, we have here uh ubuntu. You can run this workflow file, for instance on windows. If you're dealing with like a c sharp project, um you can also modify this to be using mac, um so we have options here by default. In this case, it would be ubuntu.

A

We have a strategy key right here, a fast option, a matrix.language option. So the neat thing about this is that github automatically detects like the languages that are being used in your repository. So in this case um it's go java, javascript and python, and in this section these are the steps.

A

So in order to perform cochlear analysis, it's a serious steps that we need to take. First, we need to check out the repository right after that step. We want to initialize the code, ql runner, so here we're using like the cultural action with these languages that are defined in our matrix language, which was right here right and then, after that we have like an auto build step.

A

So um this step is like meant for like compiled languages like c c c, sharp and java. um We don't really need this stuff for, like the dynamic languages such as like javascript and python, since we're going to um how to install like those dependencies that are defined in a repository.

A

So we don't need that um and then the last step right here is to perform the clinical analysis right. So what you'll notice like after we commit this workflow file you'll see like um the jobs running in parallel for each language. So let me commit this file and I'll pause for a couple of seconds to get everyone on the same page.

A

Okay. So when you commit that file, it will direct you to um the path in which that file was created. So I'll give everyone a minute to do that.

C

A

All right, so, let's head into the actions tab right here.

A

So as you can see, when we committed that file, um it automatically triggered to run an action and that's because we pushed right and as you can see, it ran those jobs for each of go java, javascript and python in parallel.

A

So if you go through these logs you'll be able to see like the steps that we defined right, checking out the repository initializing code, ql the auto build step, even if it's necessary right and you can go through these and look at the logs.

A

So if you look into performance analysis, you'll see like the series of steps inside like the runner itself going through these steps, such as um you know, extracting go finalizing, go doing the analysis of the database, that's going on in the back end right and then, after that happens, doing the normal, like post checkout and completing the job okay.

A

So um I'm going to so it kind of depends on like where everyone's at mine will complete, probably in about a minute from now. So once everyone's like workflow kind of finishes I'll go on to the next section.

A

But as you can see, um something went wrong with the java build right um and we're going to explore that. So in java, you'll see like the auto, build step, failed um and javascript seems fine and then python. It's still running performing click on analysis.

A

So I'll give like another minute or two for um you to explore like the logs and getting this action to.

A

A

All right I'll give a couple of seconds more at the top of the hour I'll start um working through the next section here, which is customizing the build process in the coil.

A

A

Okay, so it seems like for one person like the python analysis is taking um a long time.

A

So let's try to move on to the next section, which is um configuring the build, I'm sure it will complete within the next minute or so. So, um let's move on to this section here so um as you can already tell the java um workflow kind of failed right, so what we're going to do is modify the workflow so that we can resolve this problem.

A

Okay. So if you look into the logs for it, let's see if it gives us the information all right. So it says it's trying to pick up the java two options and then we reach like some error right.

A

We need the correct uh java jdk. So let's go back into the workflow file and modify that okay.

A

Okay, so what you can do now, so the solution to this is to actually set up the java jdk right and we have an action for that called setup java. At this version right java version, 11.

A

So um you can either type it or, if you don't want to type it, you can just you know, copy and paste okay. So what we're going to do we're going to add that stuff right after initializing code ql so and if you want you can remove some of these comments. If you think it's just clouding up your space I'll try to remove some of these okay remove this. So it's all clean and.

A

Let's add that jdk step right here all right and make the spacing okay.

A

Cool all right and go ahead and commit that file and see how the action runs again so commit to the main branch, and so when you start this commit um or submit it, um another action will run again.

A

So I'll give a couple more minutes for everyone to complete that step and then have like this action complete as well.

A

And if you haven't noticed, if you look into the security tab, you can see already that we've found some vulnerabilities when it comes to code scanning.

A

All right so at this point we're going to make sure that the java build actually is successful and then, after that, we're going to explore some of these results right here. So I'll give a few.

A

A

All right, so it seems like my java, build passed. um I like to know how everyone's doing just a small small health check looks, like my analysis, for python is still running.

A

A

A

A

Okay, okay, so let's have that still running for a couple of minutes, um let's just dive into the security alerts that we have okay, so so far. For me, I have six of them.

A

So, let's look into the first one right here and let me expand my screen okay, so this one right here is a disabled spring, csrf protection. It detected that from the java class web security config. So, as you can see here, um it highlighted where it found that vulnerability right.

A

We also have, in this section here like a little help file our q help file, as it's called in the back end, where it kind of describes like the recommendation um like what to do when it detects like a csrf um vulnerability like this.

A

So part of the exercise is if you're familiar with like um csrf or you kind of know like based on like what this application is doing. We rely on the bear tokens to like authenticate, so um in your own thoughts like do you think that this is a false, positive or you think it's a true positive. So this is something um that we can discuss in the slack channel like whether or not this is something that um we should fix, or uh something that we should just dismiss right.

A

So hopefully that's enough of a hint to give you about this particular vulnerability.

A

um Let's look at another one so in each of these it'll highlight like the vulnerability and it'll give you like some explanation of it and the recommended path to go about it right and which is really neat because you don't have to like you know, search on google like what is this or anything you can just like look at it here, natively in github, and look an example of that vulnerability, which is cool and along with that, we have like a bunch of references too.

A

So it saves you the trouble of like searching for these things right, um so you can look more into like the cwe, um the owasp guidance files and all that and yeah, just a bunch of other things that are useful in determining um whether or not to fix this vulnerability right.

A

So hopefully, by now um the second action has completed it has and it took as you can see, it took five minutes in one second, um yes, awesome.

A

Hopefully it's completed for you guys as well, so trudging a result in the pr all right. So let's look into this step right here. um The default workflow configuration enables code scanning on pr's, follow the next steps to see it in action so um right here we want to introduce an alert. Okay. This is a simple one. Where we're using the eval on the javascript and we're going to evaluate this code now this code, um it could be anything right, it could be like some xss.

A

So let's get started on that. um You want to create a pr out of this too. So I have one ready.

A

A

Basically, you want to add, like this snippet of code to this, that has code and this dot has state in the authorization callback view. um You can also add this eval anywhere in the file. That makes sense right, so you can add it to the mounted method.

A

A

So I'll give you a couple of seconds to commit that and if you've noticed already, um we have like a stretch exercise which is like a bonus exercise um if you're really ahead of the game- and you want to like complete these- that's awesome. um This one right here talks about like uh using the context and expressions to modify the the jdk step that we have. So how would you modify the build such that the jdk step runs only for java, so this one gives you I'll give.

A

You has something to do with the context and expressions we have documentation on that, I believe in our resources. So if you know how to use that in actions, then you can simplify this workflow file, all right, I'll pause for about a minute or.

A

A

All right, so, when you make that change and make a pull request, another action will spin up because in the work profile, if you remember, we've um added the pull request event so that we can trigger an action right. So once again, we have all these um languages running in parallel, all the analysis for it and I'll give a couple of seconds for everyone to um have their actions run so another three to five minutes.

A

But what you should see is um another alert popping up in your security tab and if you were able to complete this um stretch, exercise um what you should see is. uh If you look into the solution, you should only see like the setup jdk step run only for java, so right now like I didn't, modify that and hopefully and the set of jdk steps shows for go javascript and python.

A

So if you use context, expressions like this, if matrix that language equals java, then only that step only shows for the java run.

A

Okay, those are really long logs. So I'll pause right here for a couple of minutes.

C

If, if you're only setting up the jdk, it's probably not a big deal if this runs for all of the steps. um But if you have a lot of different languages and some of your builds take a long time, um it can be a really big savings to turn off steps that that you just don't need for some of the.

C

A

All right so looks like for me. The python analysis is completed, therefore, like the entire action is completed. um So let's look into our pr.

A

So, as you can see, let's go back. You can see like um the analysis for each of the languages have completed right, but then over here in code scanning results. We get the big x right. So if you click on details- and let me expand my screen- we see that we have an error right here and it says it's a good injection. So that's basically what we did. We added that eval on the code, this dot code and we can show more details.

A

And it'll, once again, it'll show you like, like the highlighted code right here, what we just added and then some explanation about it: okay, so.

A

This is pretty cool because we can see all the alerts that are introduced in a pr and it's a very simple ui in here and let's see, show more details. Did I go through that already alright? So it points to the same file, um and then we also have the option here to say: hey. Is it a false positive? Is it used in tests or you won't fix it right? So usually, if this happened in the test, folder right, I find that you can. Just you know, use this option right here.

A

Obviously, um or you won't fix it, it's not like a huge deal in your repository, so you have the option to like do something about this alert at this page. Okay. So here this is the path. So it says this is some source in which it started.

A

It starts here when we're declaring params to this url search params and it has window.location as a parameter and it goes through the steps and how it got to like eval.desktop code. So this is the dataflow shown here in the ui and, as you can see, we've labeled this first step as the source and we labeled the last step here as to sync all right- and it even says here: it's a user provided value close to here and it's interpreted as code so yeah.

A

This is a pretty neat tool if you want to like dig into like how do we find that you can just like go through these paths right here, all right, so hopefully, everyone has completed this exercise.

A

um We're gonna move on to um the recap slide that I have for you and then we're going to go to the last exercise for of this workshop. So let me switch gears for a moment.

A

Talking about troubles.

A

All right all right, let me play this, can everyone see my screen or is it gray?

A

I think it might be gray.

A

It's gray, okay, all right! That was a fail. Let me go.

A

Back, okay, good we're good here all right: oh the two.

C

Yeah, I think we've got presented. You.

A

C

There you go good.

A

Awesome all right, keynote's, not my thing, I'm more of like a google slides person, so bear with me all right. So this is the recap slide for exercise two hope you're able to enable code scanning and all that jazz fixing the build, introducing an alert and a pr finding any false positives right, so enabling code scanning. This is something that you can do easily right.

A

This is something that you can do quickly to have an impact on security, and, let's see, can I change slides from here, not sure if I can okay, so a common question that we get is, should we block merges right. So the idea with using advanced security is to enable you the developer, to take the best approach when it comes to securing your code. So this isn't this isn't a tool. That's meant to slow you down in your development workflow.

A

Rather it's a tool that should help you resolve vulnerabilities, the earliest it comes up which usually can be prevented in the pr so as we've seen previously. So knowing that, doesn't it sound better? Knowing you have the security tools at your disposal and it's you that can make a good choice, having a great impact on securing your code right. So if you think it's a good idea to block the mergers, because you want to like fix those vulnerabilities- that's awesome, but we're not making you know forcing you to do that.

A

We want to be more developer centric. um We want to see um more developers communicating with the security teams, security teams communicate communicating with their developers.

A

We want to see that collaboration going on making this, like you, know a responsible thing to do when it comes to like securing code right. So with that being said, um let's move on to the next section. How do we refine clinical analysis to address false positives or catch more vulnerabilities?

A

So, let's modify our clinical analysis configuration. This is the last practical exercise of the workshop, so let's get on with it all right out of keynote mode, and I'm going to share my screen exercise again, all right so down to practical exercise. Three, and let me open up a different workshop.

A

Hold on I'm just gonna copy, this thing.

A

Have two windows open for you like this all right, so by default, cocobell uses a selection of queries that provide high quality security results. However, you can change this behavior by defining a custom, ql config right.

A

So um so what you can do is one thing that you can do easily is: if you don't want to have that custom, cocoa config, now you can modify your existing one. Your colloquial analysis, yaml and add in a queries, queries key. um That kind of tells the analysis to hey like I want to run the security and quality query suite. So there's two available: there's security extended right and security and quality, which is security extended, plus some other reliability and maintainability queries. So these query sets that um are optional.

A

They just like pinpoint like the low severity alerts. So so what you can do is.

A

A

Under here and define like those query, suites right yeah, so you can do that, but the option here in the workshop instructions- let's do it this way. So what we're going to do is create this file called control config in the github folder.

A

Okay, so you can go to add file create a new file. You can create a new folder like that and then putting a forward slash and that creates that new folder and then let's create that gamble.

A

Okay, so what you're gonna do is basically.

A

You're gonna add like the query, suites here right, so I'm just gonna copy this.

A

And I'm gonna add the security and quality um suite in the query section of this yaml okay. So that is another way of using that suite.

A

Alrighty, so that's the first thing that we want to do is creating this file.

A

And then what we want to do is tell our main configuration here that we're going to use that file right.

A

So let's do that.

A

A

So uses language we're going to put it right there.

A

So, let's see we're going to put this key value called config file and then we're going to put that path to the configuration the custom configuration that we just made into that as the value okay, cool beans. So once you have that go ahead and commit that file commit those changes.

A

Okay, so your yaml at this point should look something like.

A

A

Okay, I'm just gonna make sure that yeah all right that looks good.

A

Okay, so I'll give everyone about 30 to 40 seconds to get that done and I'll move on.

A

A

A

Okay, so let's see what's going on, we have a new action, so what you can do is, since you know we created that custom config file, and then we modified the cocoa analysis file. You can cancel an action so that we're waiting on the latest one instead right also time to like save some minutes right in organization, so not killing any more minutes and um let's see where this is at all right. So when it's completed, um let me know if you all found like a new security alert that was introduced.

A

Let's move on to the next section, since we have like you, know less than 30 minutes of our workshop, and I want to get around to any questions that you may have towards the end. So, let's jump into um creating you know our own custom queries file our folder. So in this section we want to target languages and like some of the query, suites of a language right.

A

So yes, we can exclude the rule that caused the false positives in our java project. By doing this, so what you want to do is you want to create a code scanning query suite under a folder called custom queries or something a different name if you want, and what we want to do is remove the or exclude that id that caused that false positive in our java project or java class.

A

So um to save some time, I'm going to open up the solutions, repo that I have instead gas user doing this in the most inefficient way.

A

So right here I have a custom, queries folder and in that folder you first want to create this code scanning query suite that has these um values here all right, so we're pinpointing the code scanning suite for each of these languages that we have in a repository, and we also want to use the exclude key right here, and so um the id that we want to exclude is called spring disabled csrf protection right.

C

So well, I will say quickly that the query suites are more of an advance. Excuse me advanced option. um Usually the default ones uh are pretty good, um but if you have, uh let's say that you've got a particular rule and it's just not applicable for the threat model of whatever your project is or your code base um and everything you're getting through. It is a false positive and you can say well. I can see why some people might care about this, but we don't.

C

um This is this is a good way to turn it off rather than having to go through and hit dismiss a bunch of.

A

A

Sweet so once you define this code screen query suite file, you want to make sure that we actually utilize um this code scanning file by going back into that custom code called config.

A

So let me show that to you real quickly like this, so once you have that defined, you can define the path for it in this queries key and then later on. um If you want to complete like the stretch exercise, four um you'll do a similar thing where you um add in a custom query.

A

So that is something that um you can do after this workshop. So um this will set you up for like the next security workshop. So um hopefully you can get a feel for it now before you enter that workshop. So yes.

A

So the key thing here is: you can create a custom codequal file right here and then you can reference like a folder that has, like those custom, queries right so in mine. In my hot repository, let's go back my custom queries. Folder, looks something like this oops excuse me so yeah the code scanning suite suite and then, if you complete, that uh stretch exercise for um two things that you need, you need to define like the custom query, and then you need to define the ql pack. So we listed those steps here.

A

If you want to try that out.

A

All right so I'll give everyone until the 40 mark to complete these.

A

A

A

All right, so I hope everyone had a chance to um complete those last steps for exercise three and if you made it to the stretch, stretch exercise four, um that's pretty amazing um that would set you up for success for the next security workshop. um I just want to share this recap slide. um As I said. Hopefully, you completed all these steps. um So the point of configuring or making a custom configuration file for code coil analysis is so that you can tune your results um that better fit your needs for your repository right.

A

It's a good way to exclude ids. If you want to um remove false positives, so you can you can handle it that way or you can actually make like a code change to that and remove like that line and we'll call it a day. That's awesome, um but yeah, no one size fits all with security. We just want to be able to give you the option to fine tune. Your results and you know, add any additional queries uh once you become familiar with, like the code, cool analysis runner.

A

So with that being said, we have a couple more slides until I want to get into the qa section so which checks should we run? So this is another common question that we that we get so so I know that we've introduced other query suites such as security extended or security and quality, which should search for those low severity alerts such as hey did I define a variable and I didn't use it. Did I define or create like an import import, some package and I didn't use it right, so those types of alerts.

A

So when it comes to this question, which checks should we run, um the bigger picture is to focus on the rules that matter at large. So what are the checks that have the greatest impact? So once again, this isn't you know a tool to slow you down. It isn't a tool that should create fatigue or rather alert fatigue, because we, we all know that we're trying to survive this pandemic. We don't want to experience any more fatigue already than we have so so do what matters most is the bigger picture?

A

Try to be more deaf-centric um talk to your community about these security alerts right.

A

So what have we learned so far? So within an hour we remediated secrets and vulnerabilities, we reviewed code scanning alerts, we've enabled additional queries and tried to filter false positives. So with that being said, I love to give your get your feedback um on this workshop. So how do you feel about secret scanning dependenbot and code skating so far and a call to action? So I hope you learned a lot during this workshop.

A

I'd love for you to try these gas features on your own repository.

A

Another thing that you can do is to collaborate with security. You know make the most out of collaborating with security teams, publishing your own security advice, advisories to notify users of your own open source project um reach out to us. If you want to codequel is an open source and any contributions you make helps secure. The software we rely on. um We have like, in our documentation, you'll, find like how to contribute to codewell itself and then, lastly, um consider shifting left right embrace catching vulnerabilities earlier in your development, workflow and yeah.

A

I hope everyone got a chance to like learn something new today and with that. If you have any questions, I'd love to hear them in the slack channel, we got, let's see, 15 to 16 minutes of q, a.

A

B

Hey chelsea, someone just asked a question uh darren asked: if I'm the admin for an enterprise account, is there a way to get a summary of alerts for all the repos in the account.

A

Yes, so one thing that we're coming out with is called security center. This is the feature that will come out sometime next year, where you get to view all the alerts for all the repos, in your account.

C

So your security center is is currently in alpha, so there's a couple of people have been given access um and I will I'll drop the public roadmap item uh in the chat, so you can all keep track of progress on it.

B

uh Someone asked: can we get access to the security center.

A

Alpha john, you want to take on that one. I don't know like the the full process of getting that enabled for somebody.

C

uh So if you're on enterprise cloud then speak to you have a sales or services uh rep reach out to them, and they they may be able to help you out there. I think they are limiting access a little bit at the moment, but um reach out and do their.

C

C

A

One thing that I can do after this workshop is make the solutions repository public so that um you can make sure that we're on the same page when it comes to like all the files that we modified so I'll, make that repository public after after this workshop is done.

B

B

uh Magnologen asked any recommendations on creating assertive custom queries with code ql, and how does it compare to semgrap any plans to have that added into the workflow as well.

C

uh Could you clarify what you mean by assertive, I'm not familiar with it context.

C

C

C

um So the uh the the default security set that we have um should be pretty low false positives.

C

um We monitor fix rates for uh all of the queries in that set on open source and if stuff is not getting addressed by developers, then it's flagged to the teams and they reduce it um once you once you go on to the security and extended and security and quality, um those are, by definition, a little bit more noisy.

C

um Some of them are things that we just haven't been able to figure out a really good way of doing without a bit of noise, um often because it's so dependent on that on the project in question.

C

um We have a number of different um research type efforts um to do things, to try and look at like the quality of results, um we're looking at a lot of like machine learning stuff and that kind of thing, um but that is all uh very much like uh a little bit of a way out.

C

um Yeah, the the the best way I've I've seen of of managing this um is to basically start with a small security focus set and then add additional rules with the buy-in from the dev team.

C

um So if everyone agrees that we're going to follow a particular coding standard um and there's certain things I mean like use of eval uh is a is a good, um a good one. um A lot of teams will just say we're. Never gonna use that, and um it's very easy to enforce, like a more concrete standard like that um doing all of the analysis to see is this definitely wired up to user input uh creates a little bit more uh more of an analysis challenge.

C

So we say um so if you can get the buy-in on these kinds of standards, um that's really effective, um but yeah start with start with the small set and go from.

C

C

C

uh So there's a question from chris uh is the pr page the only place to see the execution path? um uh No, uh you should be able to see it. If you go to the security tab as well and navigate to any of the alerts. There's an option to see the path there.

C

Not every query has a path so most of the the security related ones. uh Obviously like user, controlled value or user inputs are a big part of those vulnerabilities, and so they generally have a path there's a few um and especially if you turn on the quality ones, uh where it's it's a more local check, and so it just shows you the the single location.

C

Yeah, that's a simple way of putting it.

A

Yeah, let me share my screen for a moment, so if I click on this client-side cross-scripting alert, then you should be able to find that path here in this section, so yeah and usually from the pr it will direct you to this. So.

A

A

Yes, the slides will be available later in the.

A

A

All right, so it looks like we have five more minutes. um If you want to post like any questions or feedback you may have, um you can do so now. um If you have any thoughts about like any of the features that you've seen today, it'd be really nice to like get more feedback from you. I know a couple of people say that it's really cool.

A

um Thank you for being here once again glad to have shown you um some parts of github, advanced security.

B

It looks like there's another question here: um net zero is asking if I am an open source project that forks other people's projects and scans them with code coil. When will I start getting bottlenecked.

C

um Yeah, I think, as long as your forks are public um it'll, just be your um your regular uh actions limitations. So I think that there may be a per per-org concurrent actions limit.

C

um If you do 6000 with a script, you will probably hit some some alarms and you you may get throttled. um I think we're generally happy to raise that for people who have a have a sensible use case. So if that, if that does happen, then um reach out to the people in security lab, um and they are always happy to help with uh anyone who wants to to use any of this to improve security on open source.

C

um But yeah it it, it should be, uh it should be doable. I think.

C

um In general, forks work a little bit differently for actions um to try and avoid you from uh accidentally running them. When you didn't realize you had workflows and stuff like that, so I think you may also have to have to click and enable workflows for this fork, depending on whether they have an existing conflict or.

B

B

uh Yeah, I think vanessa is also asking about graphql, um which I don't think is uh in the scope of this talk.

C

um So we have uh so we do have some apis for for code scanning, I'm not sure if they have a graphql api for code scanning. Yet um let me double check on that. I know we definitely have one for dependencies uh and in one of the extensions um there's a there's, a stretch goal to try and use that to get some dependency information back with the api.

C

Let me look at the code scanning.

C

A

It looks like we might not have that yet, but if we figure out more information about it we'll be sure to post that into the slack channel. um So I think we're coming up to time.

A

It's just 10 more seconds, so.

C

So in general, our approach with apis for for new products is to start with them being pretty minimal. um We know that it's, it's really difficult. If we give people features in an api and then they change or are removed so they're starting small and they are being actively worked on by the team and so they'll continue to to grow with new releases.

A

Alrighty sweet so we're up to time it's a wrap um once again, thank you for joining us. um The videos will be available later, as well as the slides, so we'll have that you guys right ready for you to use um in view so yeah happy friday and hope you have a good rest of the day today.

A

A

A