►
Description
Presented by: Maya Ross
GitHub Enterprise is the foundation for keeping your company's source code secure. Whether you're using GitHub Enterprise Cloud or hosting GitHub Enterprise Server in the cloud, it's crucial to follow security best practices across access management, integrations, and threat detection. This session will provide a practical guide for securing GitHub Enterprise in the cloud, including how to get started with our newest enterprise security features.
As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub
Thanks!
Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github
About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com
A
A
I'm,
the
senior
director
for
Enterprise
at
GitHub
today
I'm
going
to
talk
about
some
best
practices
for
securing
GitHub
Enterprise
in
the
cloud,
whether
you're
on
GitHub
Enterprise
cloud
or
deploying
Enterprise
server
into
the
cloud
we're
building
the
tools.
You
need
to
unlock
that
cloud.
Migration,
I'm
going
to
go
through
three
best
practices
today:
centralizing
access,
control
with
zero
trust-based
policies,
adopting
less
privilege
for
both
your
users
and
Integrations
and
detecting
threats
in
real
time.
A
So,
let's
jump
in
our
first
best
practice
is
all
about
making
sure
that
the
right
people
have
it.
So,
let's
jump
in
our
first
best
practice
is
all
about
making
sure
that
the
right
people
have
access
to
the
right
things
from
the
right
places
right.
That
was
three
rights,
so
I
guess
the
right
makes
a
left
right
to
do
that.
A
Keeping
your
private
code,
private
and
unlocking
the
cloud
and
flexible
work
with
safe
conditional
access
policies.
Github
provides
a
whole
host
of
ways.
You
can
achieve
these
goals
for
those
looking
to
move
to
the
cloud
from
self-hosted
Solutions.
Increasingly,
the
easiest
way
to
do
so
is
with
Enterprise
managed
users.
Enterprise
managed
users
are
GitHub
accounts
that
you
create
from
your
identity
provider
just
for
work.
They
move
ever
increasing
levels
of
control
to
your
identity
provider
and
keep
all
of
your
code
private,
even
on
github.com,
launched
last
year.
A
Today,
almost
a
thousand
companies
have
adopted
these
new
accounts.
Companies
like
Home
Depot,
who
are
previously
using
server,
who
say
GitHub
Enterprise
cloud
with
Enterprise
managed
users
has
helped
our
team's
productivity
and
helps
them
focus
on
Building
Solutions
for
our
customers
and
Associates.
Now,
let's
talk
about
conditional
access
policies
because,
as
you
move
to
the
cloud
and
teams
are
increasingly
working
from
anywhere
on
any
device,
you
can't
rely
on
network
security
boundaries
anymore.
Instead,
we
need
to
make
real-time
access
decisions
based
on
who
are
user
is
their
device
and
their
location.
A
A
A
It
ensures
that
only
people
who
can
access
your
orgs
are
allowed
to
access
them
from
allowed.
Ip
addresses,
oh
and
you
know,
while
we're
here
quick
reminder
to
enforce
two-factor
authentication
across
your
Enterprise
too.
Even
if
you
use
single
sign-on
2fa
protects
all
of
your
users
accounts,
so
they're
much
less
susceptible
to
social
engineering
attacks
and
we're
going
to
be
requiring
all
GitHub
contributors
to
use
2fa
next
year,
as
we
try
to
keep
you
and
the
whole
software
ecosystem
secure.
A
But
if
you
have
thousands
of
IP
addresses,
you
need
to
manage
or
different
rules
to
apply
to
different
users.
You
might
want
to
centralize
those
IP
restrictions
to
your
identity
provider
too.
Customers
using
Enterprise,
managed
users
with
Azure
active
directory
can
do
so
and
in
fact,
setting
that
up
in
GitHub
is
almost
a
one-click
process.
It's
based
on
using
openid
connect
to
connect
GitHub
to
Azure
ID.
That
means
you
don't
have
to
copy
and
paste
Samuel
credentials
around
the
place
anymore.
A
I'm
going
to
do
that
just
download
my
recovery
code,
so
I
can
always
sign
in
at
any
time
in
case
of
problems,
and
there
you
go
with
one
click:
I
have
single
sign-on
enforced
across
my
Enterprise,
just
hop
over
to
the
Azure
80
app
gallery.
You
can
see
that
oidc
app
I
can
assign
users
and
groups
to
it.
Provision
accounts
with
skim
and
apply
those
conditional
access
policies
like
this
one,
which
is
going
to
block
access
for
bridge.
For
my
Enterprise
sorry,
fam
INE.
A
Our
next
best
practice
is
about
enforcing
the
principle
of
lease
privilege,
that's
giving
everyone
just
the
permissions.
They
need
to
do
their
job,
we're
constantly
working
on
an
ongoing
basis
to
bring
you
all
of
the
fine-grained
controls
that
you
need
to
achieve
that.
For
example,
at
Universe
last
year
we
launched
custom
repository
roles
which
are
now
also
available
on
ghes.
Those
are
user
roles
that
you
create
from
find
game
permissions
to
give
your
teams
just
the
permissions.
A
They
need
like
say
giving
your
devops
team
the
ability
to
override
Branch
protection
policies
during
incidents
without
having
to
make
them
repository
admins,
but
attackers
do
often
attack
apps
and
personal
access
tokens
to
extract
sensitive
information.
That's
why
we
recommend
applying
those
same
principles
of
least
privileged
programmatic
access
to
the
apps.
That
means
using
GitHub
apps
instead
of
oauth
apps
wherever
possible,
but
for
personal
access
tokens
it
hasn't
really
been
possible
to
finally
control
and
Target
access.
A
Until
now,
with
our
new
fine-grained
personal
access
tokens,
you
can
do
just
that.
I'll
take
over
the
demo
from
here
available
now
in
a
beta.
These
new
pets
can
be
set
to
expire,
targeted
to
a
specific
organizations
or
to
my
own
account
and
targeted,
even
as
specific
repositories
and
then
given
the
fine-grained
permissions,
you
need
I'm
going
to
give
this
one.
The
ability
to
access
my
repositories
have
discussions
and
down
here,
I'll
also
give
it.
A
The
ability
to
you
know
manage
my
custom
repository
roles,
just
like
with
GitHub
apps
administrators
can
control
access
of
these
new
pets
to
their
orgs,
putting
control
in
the
hands
of
those
who
should
really
have
it.
Admins
here
I'm
in
my
platform
organization
settings-
and
you
can
see-
we
have
a
few
policies
here,
including
a
choice
of
whether
I
want
to
approve
any
Pap
access
request.
If
I
choose
to
I
can
go
in
and
see
any
pending
requests
at
any
time,
and
you
can
see.
I
have
a
few
here
from
my
members.
A
A
A
So
with
our
Dev
teams
now
fevering
away,
let's
move
on
to
our
final
hot
tip,
listing
for
threats
in
real
time
with
the
GitHub
audit
log,
Gap,
security,
trust
and
safety
teams
doing
their
best
every
day
to
identify
and
disrupt
potential
threats
to
our
ecosystem.
You,
our
customers
and
our
platform.
We've
got
a
demonstrated
track
record
of
using
our
visibility
to
help
you,
our
customers,
respond
to
threats
and
protect
yourselves,
there's
only
so
much.
We
can
do
without
context
about
how
your
company
operates
and
what
represents
normal
for
you.
A
We
also
can't
protect
all
of
your
systems
to
better
protect
yourselves.
Then
you
can
utilize
the
audit
log
to
ingest,
monitor,
alert
on
and
investigate
any
unusual
activity.
For
last
year
we
announced
the
release
of
audit
log
streaming,
which
is
now
available
in
server
2..
It's
the
best
way
to
push
all
of
your
audit
log
events
to
your
preferred
event,
management
tools
and
cloud
storage
services
in
real
times.
A
It
means
you'll,
never
ever
lose
an
audit
log
event
again,
and
you
can
store
that
data
for
as
long
as
you
need
to
you
can
also
set
up
streaming
to
car
storage
accounts
using
openid
connect
short-lived
tokens
with
open
ID
connect.
You
don't
need
to
save
hard-coded
Long
Live
secrets
in
GitHub
to
push
data
to
your
Cloud
accounts
anymore.
Instead,
GitHub
will
just
request
a
short-lived
regularly
rotated
access
token
from
your
cloud
provider,
and
you
have
full
control
of
the
invisibility
over
those
from
that
storage.
A
Account
actions
support
openid
connect
to
so
every
workflow
can
be
run
with
a
unique
short-lived
token
I
mentioned
earlier
that
attackers
often
work
through
stolen
parts
or
hijack
apps
to
access
repository
data
and
secrets.
As
a
result,
we've
recently
enhanced
the
GitHub
audit
log
events
with
Pat
and
app
token
data,
so
you
can
fully
Trace
their
usage
throughout
your
organizations.
Let's
have
a
look.
Events
generated
with
one
of
those
tokens
now
contain
a
hashed
version
alongside
the
token
type.
A
So,
if
I
suspect
a
token
has
been
compromised,
I
can
find
everything
that
has
been
done
with
it.
All
of
this
data
is
now
available
in
your
stream
too,
and
here's
an
example
with
datadog
it's
one
of
our
newest
additions
for
streaming.
This
is
an
oauth
app
that
I
have
managing
my
repository
configuration
there.
You
can
see
that
token,
the
Scopes
it
has
the
permissions
it
has
and
who
owns
it
and
all
of
our
git
Activity
2.
A
So
there
we
have
it
three
best
practices
for
securing
GitHub
in
the
cloud
with
some
of
our
latest
additions,
centralizing
access,
control
and
zero
trust
policies,
enforcing
least
privilege
everywhere,
especially
for
parts
and
apps,
our
listening
app
for
threats
in
real
time
with
the
ever
more
powerful
audit
log.
We
also
looked
today
at
how
open
ID
connect
is
increasingly
becoming
a
recommended
standard
for
connecting
GitHub
securely
to
your
other
cloud
services,
whether
for
your
audit
log
or
for
your
actions
builds,
and
that's
it
from
me
from
us
thanks
and
stay
secure.
Goodbye.