GitHub GitHub Universe 2022 - Security, 21 Nov 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Demystifying end-to-end supply chain security - Universe 2022

Description

Presented by: Zach Steindler

Security can be a daunting topic. From user accounts to code security and building security, this session will give administrators of GitHub organizations– small or large–concrete next steps to improve the security of their software development process.

As always, feel free to leave us a comment below and don't forget to subscribe: http://bit.ly/subgithub

Thanks!

Connect with us.
Facebook: http://fb.com/github
Twitter: http://twitter.com/github
LinkedIn: http://linkedin.com/company/github

About GitHub
GitHub is the best place to share code with friends, co-workers, classmates, and complete strangers. Millions of people use GitHub to build amazing things together. For more info, go to http://github.com

A

A

Hello today we're going to talk about how to improve the security of your software development process end to end over time, we've seen attackers get increasingly creative in how they attack software. They might try to compromise user accounts, find a bug in dependencies you use or the code you write or even attack your build system directly, we'll talk about ways to get started, improving your security in each area. If you want to Deep dive into a more comprehensive framework for supply chain, Security check out slsa.dev. Let's talk briefly about how to approach security.

A

Securing your end-to-end supply chain is a big project. So, instead of trying to tackle it all at once, it's best to think about. What's going to have the highest impact for what you do and start there, we sometimes joke about chocolate and peanut butter projects where we do a project that both increases security and makes life easier for our team. At the same time, don't feel like you have to go through the start, to finish, feel free to start with what makes the most sense for you or your team.

A

That said, we'll start with what is hands down the most impactful thing you can do to improve your security setting up 2fa for your user accounts, passwords just aren't very user friendly and people tend to reuse them across sites, making it easier for hackers to go from one system to another.

A

There are several options for 2fa and using a security. Key is the most secure option, as it prevents phishing from a look-alike domain, but any 2fa is better than no 2fa and you can also set up apps that generate a six digit code. It's a good idea to set up more than one 2fa option and don't forget to download your recovery codes. So you can log into your account if you lose access to your 2fa devices.

A

Another way to minimize password use is to use a SSH key for git authentication, just remember to protect your SSH private key as it could be used to impersonate you these days. Many security keys that you use for 2fa can also protect SSH keys, and your computer can also protect your private Key by only making it accessible when you log in. But if your private key is sitting in a directory, you should at least protect it with a passphrase.

A

Our last Topic in securing user accounts is a perfect example of Security Plus usability setting up single sign-on for your organization or Enterprise users will be able to log in to get Hub through the same identity provider they use for other services and you'll have an easier time managing access to your organization's GitHub resources. Next up securing code. The most impactful thing you can do here is to set up a vulnerability, Management program to probably be a whole talk by itself.

A

But briefly, you want to inventory your dependencies be notified of when there's a vulnerability in those dependencies and then assess that vulnerability and decide what action to take github's dependency graph looks at the dependencies specified in your repository to generate an inventory for you, then dependabot can notify you when there are security vulnerabilities in those dependencies and if you'd like, create pull requests to update your dependencies to the new version. It's up to you to review, merge and deploy these pull requests.

A

So it's a good idea to have some automated testing to ensure that everything's working as expected a common way attackers gain additional access, is by looking for secrets in your source code. Github works with many partner organizations to detect when secrets are committed to public repositories and ensures their access is disabled before they can be exploited. So where should your secrets go in your repository settings? You can set up secrets to be securely stored for use in various GitHub products.

A

What about protecting the code you write a great place to get started is to use Branch protection which lets you require. Pull requests code, reviews or automated tests to pass before code is merged into your chosen branches.

A

Every part of the supply chain is important, but recently attackers have been targeting build systems as the weakest link in the chain for a secure build system. We want the build process to be clear and repeatable to know exactly what runs during the build and a fresh environment per build. So a compromise build won't persist into the future. Github actions can help you meet these capabilities. Build instructions are stored in your repository.

A

Alongside your code, you choose what environment your build runs on, including Windows, Mac, Linux or Runners that you host yourself each build starts with a fresh Runner image, making it difficult for an attack to persist in your build environment once the build is done. How do you ensure it won't be tampered with before deploy a common practice is to sign your builds, and if the build is altered, the signature will no longer verify to do this. You need to securely store a signing key, be sure to use the Secret store. We talked about earlier.

A

Your GitHub actions. Workflow can then easily sign the build to verify before deploy. Sometimes your build will need to talk to other cloud services like a hosting provider or an externally hosted Secret store. You could generate a shared secret and store it securely, but in a large team this can present challenges. How often do you change the secret as your team changes? Github actions now includes an oidc provider which lets you configure your cloud provider to trust. Github action runs that come from specific organizations, repositories or even specific workflows.

A

Admittedly, this is more of an advanced topic, but one worth checking out if you're looking for a more advanced technique of protecting your build system, and that's it if you take one thing away from this presentation- do set up 2fa on your account check out a documentation for more detailed explanations, search for end to end and remember you don't have to go through things top to bottom. You can adopt and adapt the parts of the sky that make the most sense for your organization. We wish you luck on your security, Journey.