GitHub GitHub Universe 2022 - Security, 21 Nov 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Managing your enterprise security risk with GitHub - Universe 2022

Description

Presented by: Kelly Arwine

Discover how security overview can help you manage your enterprise security risk. This session will teach you how to use the security tab to help you roll out security features across your enterprise, assess your level of risk, and manage your software security posture. We’re also giving you a sneak peek into some new security overview functionality coming your way.

As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub

Thanks!

Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github

About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com

A

A

Hi everyone I'm Kelly the product manager for security overview as a former accountant I'm, a total nerd when it comes to reporting and data. This makes me the perfect fit for the security overview team. Today, I'm excited to be sharing with you, how you can use security overview to manage risk and assess your security posture in just a few moments, we'll be diving into security overview who can use it and what you can see at both the Enterprise and the organization levels and also I've got an exciting announcement to share.

A

So, let's get started, as you know, GitHub is where the world builds software. The power of GitHub for many users lies in collaboration. Rarely will you build anything alone, so, both in public and private repos, you may have dozens or even thousands of team members working alongside you to reach your goals for many of our Enterprise customers, it's common for them to have hundreds, if not thousands, of repos under their watch. That's why, with GitHub code security tools, we're building security into the developers workflow at the repo level.

A

So what happens when you need to track security amongst all these repositories in your organization? This is where organization and Enterprise level security, tabs home to security overview can help security overview gives you the power to do two things. First, it enables you to visualize what security features you have enabled across all repos in your organization and second, it allows you to see a holistic view of security findings, so you can make meaningful and informed decisions on your security posture.

A

This combination of visibility and embedded security tools provides you Clarity across your organization, which, in turn will help. You manage risk to scale this impact. Earlier. This year we expanded access to security overview for our Enterprise Cloud users. We made security overview available to all GitHub Enterprise users, not just GitHub Advanced security users and second, while organization owners and security manager continue to enjoy the same experience. We now allow Enterprise members to see code scanning depend about, and secret scanning alert and enablement details where they have the appropriate repository permissions and for our Enterprise users.

A

I'm excited to share with you that you'll see this same functionality in version 3.7. That's releasing this week now to show you what your organization can do with the power of security overview, let's dive into a demo of how you can leverage this tool across your teams.

A

Now here on my screen, I'm on the Enterprise page for my GitHub Enterprise octo demo in the left, navigation I can click on the code security menu to see the Enterprise level security overview page. This page gives me a top-down view of all of my repositories across my Enterprise all 1600 repositories and over here on. The right. I can see a count of dependabot code scanning and secret scanning alerts, grouped by Repository.

A

Now, if I click on these buttons over on the right, like team or type I, can filter my list of repositories. For instance, clicking public gives me a list of only public repositories and up here, I have a search bar to allow for even more advanced filtering and last but not least, clicking sort gives me the ability to sort my repos by option such as number of code scanning alerts, which will return as sorted list of repositories with the largest number of code scanning alerts.

A

At the top of the page now since an Enterprise can have many organizations if I want to move one level down in my Enterprise, there will be a page just like this for each of the 211 organizations in the octodemo GitHub Enterprise now, hopefully, this page looks familiar similar to the Enterprise level view, as I showed you a few moments ago. This page offers a top-down view of my repositories, but these repositories are all within this one organization.

A

One major difference between this page and the Enterprise level page is that this page provides you with a summary here at the top to help you manage enablement and security alerts. Okay, so now that I've walked you through the Enterprise and organization level security overview pages I want to let you in on a little secret. Well, maybe a big secret.

A

For the past few months, the security overview team has been working on splitting the security overview page into two new pages, a coverage page and a risk page and in a moment, I'm going to walk you through both of these pages and give you a sneak peek as to what we've been working on. But first I'm excited to tell you that later today, we'll be releasing both the coverage and the risk page at the organization level, as a beta to all of our Enterprise customers.

A

Now the Enterprise view hasn't been updated. Yet once we move those new organization level, Pages out of beta, we'll start working on the Enterprise page. Next, we designed the coverage page to help you roll out github's code security tools across your Enterprise more easily front and center. You have these percentage indicators that act as a signal, letting you know how you're progressing or rolling out security features.

A

Now, on the Legacy version of this page, we helped you track. Only three security features depend about code scanning and secret scanning alerts, but with this new page, we're showing you more detailed information on exactly how well repositories are protected like here or push protection for secret scanning is enabled, and here whether code scanning is configured to protect repositories by surfacing potential security alerts on pull requests right above those percentages.

A

You have a search bar here we've, given you the ability to build sophisticated filter, queries to help you target the subset of repos you're, most concerned with, for instance, the most popular filter. Our users run is to check on how individual teams are faring with turning on a particular feature and notice as I filter those protected percentages recalculate.

A

This is going to help you drive security feature enablement on the group of repos you're. Targeting now best of all that search bar is built into every single page in the entire security overview experience and my favorite part is I. Don't have to remember the query syntax, it's all right here in the drop down. So with a few clicks. I can quickly build the queries, I need and, for my final reveal, I'm going to switch to a test organization to show you some new functionality, we're putting the final touches on now say.

A

For instance, my organization has a goal to roll out secret scanning to 100 of my repositories. This quarter I can come to my coverage page and see that we're within inches of our goal. Secret scanning is turned on for almost all of my repositories and if I filter for repos, where secret scanning is disabled, I can see that we only have 21 left to go now to track how the team has progressed towards this goal. We've built a new graph that shows enablement Trends.

A

So if I reset my filters here so that I'm looking at my entire repo population I, can click on this chart icon here for secret scanning to better understand how we're progressing to meeting our goal. For instance, here we had almost 2200 repos only eight of those the secret scanning disabled, whereas today I have almost 40 additional repos and significantly more of those have secret scanning disabled.

A

So, let's enable secret scanning for one of the remaining repos dxp 365 and refresh our graph to see if we can close this Gap a bit more so I'm going to switch tabs and come over here to the security tab. For my dxp repo and yep I, see it right here: secret scanning is disabled to enable I'm going to click the enable in settings, link, scroll down to secret scanning and click enable and now, if I switch tabs and go back to my organization level, security overview page and then click the graph icon.

A

One more time, I can see that I've gone from 21 disabled repos to 20. or one step closer. One final point to note is that we have enablement trends for both code scanning and depend about alerts too. We know that for some of our Enterprise users you roll out security features and stages, and it can take a while. First, you enable depend about features and then maybe code scanning alerts.

A

This trend graph is great for illustrating to your organization how your rollout is progressing and keeping everyone on the same page now I know you're all excited for the beta of the coverage page and we'll release that later today, this enablement graph, though it's going to take us a few more weeks of active development.

A

You can expect that to be added to the beta in the first few months of next year, and now that we've talked about the new organization level coverage page and enabling security features, let's dive into the new risk page and we'll talk about security alerts, the risk page, Aggregates security alerts at the repo level. This allows you a bird's eye view of criticality, so you can identify which repos have the largest areas of risk across all security features.

A

Now, just like the coverage page, there's percentage indicators front and center on this page to Signal what portion of your repos have vulnerabilities present, for instance this 41 percent. It tells me that out of my 1604 unarchived, repos, 29 of those or 479 have code scanning alerts to view those repos I can click on repositories affected, and it will update my list of repos at the bottom of the page. Giving me quick access to alert numbers clicking on a second link, such as secret scanning repositories, affected, apply second filter in this case I'm.

A

Now, looking at all repos that have both code scanning and secret scanning vulnerabilities now similar to the coverage page, there's a search bar at the top of the page notice that, as I click, each link, both the search bar and the URL, are updated. Updating the search bar with the filter criteria allows you to more easily manipulate the query to suit your needs and updating the URL means that you can bookmark the page. So now you have easy access to track risk for the group of repositories you're most concerned with.

A

Last but not least, you can filter by teams our most popular filter. This gives you a list of repos administered by a particular GitHub team and even better you can track by one team or multiple teams.

A

So moving on from the risk page, where you have the ability to see security alerts aggregated by repo I next want to talk about the three alert, Centric views and security overview. These three views can be found under the vulnerability alerts header in the left navigation. We built the alert centered view so that you can filter and sort alerts by specific criteria.

A

Each view also gives you the ability to click into specific alerts for more details. They look and function similar to repository alert lists that aggregate at the organization level. Let's walk through some examples where these views would be beneficial, say you want an organization goal to remediate all depend about critical alerts within 72 hours filtering by severity. You can see that today there's a list of potential risk as you're, starting with a pull of more than 3 400 critical alerts.

A

Taking this one step further, when you click on the repository drop down, you can see an aggregated view of those critical alerts by repo. This helps you know which teams you need to work with to meet your remediation goal. Once engineering teams agree to tackle the alerts they can search for specific alerts or prioritize alerts based on the default most important sort.

A

This sort is github's best guess at which alerts to focus on first, where, for example, alerts to vulnerable calls are ranked higher, while those alerts at the tail end of the list are the lowest priority. In this case, the alerts at the tail end of the list here are development dependencies. All the while the dependabot page and security overview can help. You and your engineering teams keep track of the progress your organization is making towards meeting your goal.

A

One other example where this page comes in handy is when researching a specific CBE say, for instance, someone contacts you about this particular CBE.

A

If I use the Dependable page to search for the cve ID I can see, this vulnerability has resulted in three Dependable alerts across my code base once I know, this I can quickly follow up with the engineering teams that own each of these repos and use this page to track. When they resolve the alerts, so that concludes our session on managing your Enterprise security risk. Thank you so much for spending your time with us and remember.

A

If you're, managing, 100 or even thousands of repositories, you can use security overview to help you manage enablement and get a holistic view of your security alerts, so you can make meaningful and informed decisions on your security.

A

Posture security overview is newly available for everyone in your Enterprise, no matter whether you're, an organization owner security manager or Enterprise member and as a reminder we'll be releasing the two new security overview Pages later today, as a beta, you can check the GitHub change log for details on the release and there will be a link to leave feedback there as well. Thanks for watching.