Full transcript
0:00hey everyone thanks for joining us for
0:01the next session of our Spotlight on
0:03GitHub Advanced security series GitHub
0:06Advanced security overview for
0:082025 my name is Anna I'm an event
0:11planner for reactor joining you from
0:12renman
0:13Washington before we start I do have
0:15some quick housekeeping please take a
0:18moment to read our code of
0:19conduct we seek to provide a respectful
0:22environment for both our audience and
0:24presenters while we absolutely encourage
0:27engagement in the chat we ask that you
0:29please be mindful of your commentary
0:30remain professional and on topic keep an
0:33eye on that chat we'll be dropping
0:35helpful links and checking for questions
0:36for our presenter to
0:38answer our session is being recorded it
0:40will be available to view on demand
0:42within 24 to 48 hours right here on the
0:44Microsoft reactor YouTube channel with
0:47that I'd love to turn it over to our
0:48speaker today Leonardo thank you for
0:50joining us cool yeah thanks for having
0:53me this is I think the third Microsoft
0:56reactor um session I've done so I very
1:00excited to be here do you want to like
1:02just jump right in and
1:04start all right that is absolutely what
1:07we're doing so uh for today what I'm
1:10going to be talking about is GitHub
1:12Advanced security and so I'm going to
1:13walk you all through a demo from
1:15endtoend what sort of features come
1:18along with Advanced security what sort
1:19of things can we do with Advanced
1:21security and what does it look like from
1:22a developer perspective as well as from
1:24a security person's perspective since
1:26everyone's working together in order to
1:28make sure that we have a much much
1:30better application security program in
1:33our environments
1:34here uh but before that just a little
1:37bit about me so my name is linaya I am a
1:40field security specialist here at GitHub
1:43and so my role here is really to help
1:45with the sales and Adoption of GitHub
1:48Advanced security from a technical
1:49perspective so as someone would say like
1:51I'm the demo monkey and I do the monkey
1:53things with the demos and that's what
1:56I'm going do for you all today so let's
2:00begin with just a really quick primer on
2:02like what sort of things you do get with
2:04Advanced security so you can see here on
2:07the left side navigation I have you know
2:09three specific sections so I have
2:11dependabot I have code scanning and I
2:13have secret scanning when you have
2:16advanced security licenses or you're
2:18going to be using Advanced security as a
2:20as in a metered basis as in you you you
2:23sort of pay by the as as in terms of
2:27usage like how much usage you get is you
2:30pay for and what you're essentially
2:32getting is going to be three these
2:34specific things our SCA so it's going to
2:37be dependent bot dependency review
2:38dependency graph and insights it's going
2:41to be code scanning which is sort of an
2:43umbrella where we have our own static
2:46analysis tool called code ql that
2:47uploads data to that and then we also
2:51have uh the ability for other tools to
2:53integrate into GitHub to be able to
2:55share that information inside of code
2:57scanning so those types of alerts and
2:59those typ types of issues that you want
3:01to bring up to your developers whether
3:03that might be through linters or other
3:04static analysis tool sets container
3:06scanners and even like thirdparty tools
3:09like endoor labs for example they have a
3:11really good integration with us jfrog is
3:13another partner of ours and they have
3:15some really good Integrations that they
3:16upload into code scanning for developers
3:18to sort of see that information all in
3:20sort of one place we have a number of
3:23different partners that we work with
3:24that all sort of use this particular
3:26method in order to get the most relevant
3:29security information as well as code
3:31information to developers where they're
3:33already working on the code itself and
3:36then lastly secret
3:37scanning and for secret scanning it's
3:39essentially we are looking for specific
3:42um patterns within your environments
3:44that are what we call like partnered
3:46patterns so AWS Azure Google Cloud
3:50Stripes Salesforce slack it runs a whole
3:55list of different partners that have
3:57specific patterns for their tokens so
3:59we're ble to identify those we're also
4:02able to prevent developers from pushing
4:04more secrets to the repositories via
4:07push protection but we also look for
4:10other things such as what we call
4:11non-partnered tokens in this case like
4:14Bearer token HTTP Bearer tokens RSA Keys
4:18things of that nature that they do have
4:20a particular pattern but they are not
4:23owned by any particular company or
4:26service and they don't give access to
4:28any particular company or service it's
4:31more of a general use type of
4:33token and then there's also this concept
4:36of what we call generic Secrets which we
4:38use co-pilot to help us identify what
4:42those secrets are so they could be you
4:44know what you commonly associate with
4:46passwords you know upper lowercase
4:49letters numbers special characters
4:51things of that nature and so we'll use
4:54AI to help identify some of those
4:55patterns that would be more difficult to
4:57find VIA like a regular expression and
5:00that will gives us uh the ability to
5:02provide those results to you so you can
5:03see what those would look like in your
5:05repositories or at least the alerts in
5:07their repositories and then you can work
5:09to remove them afterwards and then we
5:11also have the concept of custom secrets
5:13so you can create your own reix patterns
5:16to find the specific things you want to
5:18find so if you want to find like pii or
5:20social security numbers or uh you have
5:23your own patterns for secrets for
5:25example you can create those with custom
5:27patterns and then have those be
5:29identified in your repositories and also
5:33have Push protection for those patterns
5:35as
5:36well so really quickly throughout this
5:39entire presentation if there is an
5:41audience here that's great if there's
5:42not that's also great uh but if you do
5:45have comments you know please feel free
5:46to to drop them in the chat and then
5:48once to get to a good stopping point
5:49I'll be go ahead and uh respond to
5:52them so we've talked about what are the
5:55elements of GitHub Advanced security
5:57from our software composition analysis
5:59from our code scanning as well as our
6:01secret scanning so all of that sort of
6:04bubbles up into what we call our
6:06security overview and that's what we
6:08have here so the security overview is
6:10going to give us an idea of what the our
6:13risk profile is for our organization in
6:15this case and if you look at uh things
6:20from a GitHub perspective you have your
6:22GitHub Enterprise which is your top
6:23level and then under your Enterprise you
6:26have multiple organizations and then in
6:28each organization you have multiple
6:32repositories and so some of our
6:33customers they'll have the lowest amount
6:36of organizations possible to make things
6:38really easy to uh control and to manage
6:42whereas other customers will use a lot
6:45of organizations like every team has an
6:47organization or other customers are more
6:49methodical on the separation so like
6:52this is this business unit has this
6:54organization all repositories under that
6:56organization are within uh that
6:59particular uh business unit so it's
7:02pretty flexible so if I'm going to be
7:04looking at security issues I can see
7:06security issues from a repository level
7:09I can see them from a organization level
7:12to see all repositories that go
7:13underneath and then if I'm an Enterprise
7:15admin I can see everything in the entire
7:18Enterprise every organization every
7:21repository so that gives me an idea of
7:24how things are going over time so you
7:26can see open alerts over time obviously
7:29we want this not to be going to shooting
7:31up to the right we want it to be going
7:33down to the right in this case so we're
7:35actually remediating and removing these
7:38types of issues from our code
7:40bases but we also get other types of
7:42information like you know what is the
7:45the average age for the alerts within
7:48this particular space or you know how
7:50many alerts actually get reopened and
7:52how many secrets are actually getting
7:54bypassed via push protection like we get
7:56push protected a developer says this is
7:58a false positive like this is not
8:00something that is an actual secret I
8:02want this to be in the repository you
8:04can have that be reviewed by somebody
8:06else and then that secret can be
8:08bypassed but we also want to make sure
8:10that we're keeping track of that we
8:12don't necessarily want that to go wild
8:14and have a bunch of Secrets and
8:15repositories that we actually don't want
8:17to be in
8:19there and of course if we're looking at
8:21like where the most risk is coming from
8:23you know we have these three
8:24repositories in this organization and
8:26you can see that Java 1 has a lot more
8:28issues than my JavaScript one is and my
8:31python
8:33one I can also take a look at excuse me
8:37I can also take a look at all of the
8:38different um CV advisories um that we
8:42have or we have identified via the
8:44different types of scans that we
8:47provide and then of course static
8:49analysis vulnerabilities we have we kind
8:51of uh what's the word um correlate them
8:55and put them all into one specific space
8:57so you can see that here we have 16 open
8:59alert for this particular type of
9:02vulnerability that's found via code ql
9:04in this case then obviously what cwe is
9:07associated with that particular
9:09issue so we see the detection piece now
9:13let's talk about remediation like how
9:15many of these are we closing over time
9:17how long does it take us to close them
9:19you know what is the net resolve rate
9:21and like what is the alert activity like
9:23are we seeing a lot of new ones being
9:25added are we seeing a lot of things
9:26being closed or are we seeing like a
9:29uh a stagnation like we're not really
9:31adding new things but we're not really
9:32fixing anything we're just kind of
9:34moving along as you know as a as a boat
9:37down the river like it's not really
9:39we're not really directing where the the
9:41flow is
9:42going and then obviously we want to care
9:45about prevention so in this case we want
9:48to see what sort of things we can catch
9:50at the polar Quest level so if you're
9:52not familiar with what a polar request
9:54is it is a space where a developer can
9:56go ahead and suggest new changes for a
10:00particular code base and so if I have my
10:03copy of my code and there's already a
10:05copy of code that already exists uh and
10:08I want to merge those things together I
10:10do that via a pull Quest and in the pull
10:12Quest we can run a number of automations
10:16to check the code to test the code to
10:19make sure the code follows like our
10:21quality standards the code is not
10:23introducing new vulnerabilities all
10:25those types of things and it's also the
10:28place where other developers can review
10:29the code base and say oh these changes
10:31that you're making if you can make these
10:34changes to those changes that would make
10:36it more compliant or it would be make
10:38your code more readable or it would make
10:40things a little bit more efficient for
10:42what the the goal of what your intention
10:44is
10:45there so when we're looking at from a
10:48code ql perspective we can scan the
10:51codebase at the pull request and then
10:53tell you here's your vulnerabilities but
10:56on top of that we can also say of these
11:00vulnerabilities here's how you fix them
11:02and we will introduce these fixes in
11:05that pull request as well and that's
11:06what the autofix suggestions is
11:08referring to and I'll show you that as
11:11we get further down along this demo but
11:13I'm just kind of showing you things like
11:14how everything bubbles up to this point
11:16and then we'll kind of like break things
11:18down as we go along with this demo
11:23here now the key thing that a lot of
11:25people are going to want wonder about is
11:27well how are we actually using each of
11:30these different tools and are these
11:32tools actually being utilized so we want
11:34to see you know the enablement like how
11:36many repositories are turning these
11:38things on are we seeing a positive
11:40enablement or are we seeing like these
11:42things being turned off I also want to
11:44see you know what the metrics are in
11:46terms of pull requests so you know what
11:48sort of things are we seeing in terms of
11:50pull requests what sort of things are we
11:51fixing are is are the autofix
11:53suggestions actually being are working
11:56for our developers and are they actually
11:58accepting them so that way it kind of
11:59gives you a sense of like the return on
12:01investment for using code ql for
12:04example and then for secret scanning
12:06what sort of activities have happened
12:08with secret scanning over a period of
12:10time are we seeing that we're bypassing
12:13a lot of Secrets or a lot of people are
12:14requesting bypasses are we seeing that
12:18um some repositories have more secrets
12:22being pushed to them than others is that
12:24an opportunity for us as a security team
12:26to talk to that development team in
12:28particular and say hey we're seeing that
12:30you're doing this type of behavior maybe
12:32don't do that or this is a better way of
12:35doing things here's how you can use our
12:37internal Secrets Vault for example uh
12:40there's a number of different things
12:42that you can do with that but the idea
12:44is that you have to have the right
12:45information in order to make the right
12:47decision and so this is meant to help
12:49you get to that
12:52point next we have a number of places
12:55where we have different types of alerts
12:57and you do have the ability to you know
12:59sort the alerts and also uh you know
13:03focus in on more like severe type of uh
13:06critical alerts for example this is all
13:08going to be from a software composition
13:10analysis perspective or in this case a
13:12dependabot perspective and so I can see
13:15any of these different ones all uh but
13:17dependabot if you configure it this way
13:20can also push these particular uh fixes
13:24for these particular uh alerts so for
13:28example uh if I look at this one and I
13:31just kind of jump in here and I'm not
13:32sure if this one actually has a update
13:35but it does say I can go ahead and
13:36create the security update from here for
13:38the most part we do that automatically
13:40so it's not something that you would
13:41have to do normally but if you do want
13:43to specifically update a particular one
13:45you can uh make that from here the idea
13:49is if there is an upgrade path available
13:52we want to make sure that that is a made
13:54aware to the developer so they can go
13:56ahead and address those as quickly as
13:58possible
14:04next we have code scanning and so as I
14:07said before code scanning is that sort
14:09of like platform or umbrella where you
14:11can put a lot of other things into it in
14:14this case the only tool that I'm using
14:15right now is code ql but if I want to
14:18use jrog or endoor Labs or code secure
14:22or some other types of tools that do
14:25static code analysis in one way shape or
14:27form or provideed data on my codebase I
14:31can have that all be uploaded to
14:34here and so through here I can you know
14:37obviously sort things out kind of see
14:39like you know what repositories have
14:41these types of alerts and then just kind
14:43of see like you know hey I want to take
14:44a look at one of these alerts and say
14:46okay so this is what this is this
14:48resolving XML external entity in a user
14:50controlled data which isn't Grand but
14:55with autofix for code ql if I'm looking
14:58at this particular vulnerability I can
15:00click on this button and it'll go ahead
15:02and provide me a fix so I can go ahead
15:06and address that I don't want to do that
15:08just yet just in case it doesn't work uh
15:12which also kind of you know forget it
15:14I'm just going to do it this is what was
15:16that that phrase you only live once and
15:18you only demo once live in front of an
15:19audience of 40s something people so
15:22let's make it work let's see what
15:23happens and if it doesn't work I have an
15:25explanation for that and if it
15:27does then it does hooray so what we've
15:31done here is we clicked the button and
15:33we said hey we want to be able to fix
15:35this give me a a
15:38um an a suggestion on how we can fix
15:41this and so we'll take this information
15:43the alert we're also take the code base
15:45that's associated with it and we'll use
15:47them as tokens to feed over to our model
15:50and to say hey how would you fix this
15:52with this
15:54information the output comes back to us
15:57but we're not just just going to give
15:58you the raw output put we're going to
15:59filter that down to make sure that the
16:01output actually makes sense that is in
16:03the language that is uh where this
16:06particular vulnerability was written and
16:08made available and we also want to make
16:10sure that there's no like other
16:12potential issues along with that so we
16:15can see here is that we're fixing it by
16:19changing the code from the the right and
16:21we're adding these things to the left
16:23and so what I can say is well if this
16:26works for me I can go ahead and Commit
16:28This to a new Branch if it doesn't work
16:31for me then I can still Commit This to a
16:33branch and make changes but the idea
16:36here is if a developer doesn't know how
16:38to address this in particular they can
16:41use the autofix as a jumping off point
16:43as a way for them to get a better idea
16:46of like well how do I fix this well this
16:48is an example of how I can fix this well
16:50let me just edit this a little bit for
16:52me to get to a a remediation faster and
16:56that's the whole point of us using AI
16:58within the GitHub platform as a whole
17:00like co-pilot this co-pilot that all of
17:03it is meant to help with developer
17:06acceleration in terms of accelerating
17:08their productivity and part of that
17:10productivity is also making sure that
17:12the software is secure so we're using AI
17:15to help us uh accelerate the remediation
17:19of the issues that we find
17:21here
17:23now this isn't necessarily limited
17:26to uh code ql right
17:29you know we have uh as I said other
17:32tools can go ahead and integrate into
17:34code scanning but we also have this
17:36concept of security
17:38campaigns so before I get into security
17:41campaigns I do want to touch on secret
17:43scanning a little bit and just kind of
17:45look at those alerts and just kind of
17:46show you like what this stuff would look
17:48like as you can see here you know we
17:50have a couple of you know access Keys
17:53IDs personal access tokens and so we
17:56also are able to sort of highlight if
17:58these things have been publicly leaked
17:59as and they have been seen in some
18:02public form one shape or another and so
18:05if that's the case that's a bad thing we
18:08want to make sure that you know we don't
18:09have any sort of secrets that have been
18:11leaked but we also want to know is this
18:15an active secret yes or no so with
18:19GitHub we have made Partnerships with
18:21other some uh those uh some of the
18:24different partners that we've had for
18:25those partnered uh patterns and we B
18:28basically have a secure API endpoint
18:30that says hey is this an active token
18:33yes or no and if it is well that helps
18:36with prioritization because if it's
18:37active I need to make sure I rotate that
18:39as soon as possible but if it's
18:42inactive then you know I can kind of put
18:45that on the back burner a little bit
18:46because it doesn't necessarily have any
18:48connection to anything it's not like a
18:50key that will fit in any sort of
18:53lock but if it's publicly
18:56leaked to me that also means like okay
18:59we need to make sure this is you know
19:01this is removed out like for the token
19:03that this was meant to represent have we
19:06rotated that and if so or if not rotate
19:09it as soon as
19:11possible so the idea is to sort of
19:14ignite a process internally to make sure
19:17these tokens are taken care
19:19of and then if we look at the
19:22experimental ones you can see here that
19:24there's a number of different types of
19:27sort of password combination that we
19:29have here and we used AI to help detect
19:32a lot of these and there's going to be
19:35others like you can see here the HTTP
19:37you know Bearer tokens that we see over
19:39here uh we also those are what we call
19:41those non-provider patterns whereas
19:44these are what we call our generic
19:46secrets so these are the the things that
19:48uh are a little bit harder to identify
19:50with a regular expression but
19:53contextually they are able to be found
19:56easier with u co-pilot in this case
20:01Cas next let's talk about security
20:04campaigns so what a security campaign is
20:07it's meant to help uh tackle the problem
20:11of technical debt so if I have a ton of
20:15different
20:16vulnerabilities and what I want to do is
20:19I want to be able to have my developers
20:22work on a certain set of them that I
20:25deem as more important as to have a
20:27higher party to
20:30fixed I cannot expect developers to work
20:33on 1,000 2,000 3,000 5,000 whatever sort
20:38of um issues that's daunting that's a
20:41lot they have other things that they
20:42have to worry about but if I'm able to
20:45narrow things down to a a critical level
20:49or to narrow things down to specific
20:51repositories that have a higher business
20:53criticality for organization uh if I'm
20:56able to narrow it down to known
20:58exploited
21:00vulnerabilities then I can say well of
21:02these thousand 5,000 however many it is
21:05I care about this smaller chunk and I
21:07want this smaller chunk to be fixed by a
21:10particular date so I'm just going to
21:13create a new campaign so you can kind of
21:15see what that looks like and so you can
21:17see here we have a couple of templates
21:19where we say if you want to see critical
21:21code ql alerts or the miner top 10 known
21:24exploited vulnerabilities SQL injections
21:26crossy scripting or you can create your
21:28own fil
21:29filters and there's a number of
21:31different filters that you can use to
21:33help sort of narrow down the types of
21:35vulnerabilities that you'd want to be
21:36able to get fixed uh so I'm just going
21:38to say SQL injections for example I want
21:41to get those fixed and I can get them
21:44fixed by March 31st next month the end
21:47of next month as a campaign manager I
21:50can review this I can make the changes
21:53and if anyone needs to contact me about
21:55anything they have within this campaign
21:57I can provide a link on how to contact
21:59me once that's done I'll look at
22:03something similar to this since I've
22:04already created this campaign and you'll
22:07see that we have 12 different
22:09vulnerabilities in two different
22:11repositories most of them are coming
22:13from my Java
22:14one and you'll also see that of the 12
22:1812 of them are supported alerts with
22:20co-pilot autofix so here's the cool
22:23thing with security
22:24campaigns earlier you saw me look at a
22:27code ql alert and then have to click a
22:29button that says generate fix and it
22:30gave me the fix there with security
22:33campaigns we automatically start
22:36applying those fixes to the alerts here
22:40I don't mean like applying them as an
22:42adding them to the code base I mean
22:44applying them in the alert that for that
22:46to be reviewed so for
22:49example if I look at this
22:51one this one is a uh this is actually an
22:55AI generated as of yesterday because
22:57that's when I created this entire
22:58environment
23:00yesterday but what you can see here is I
23:02have my alert I can see you know the
23:05data flow for this particular alert so I
23:07can review that and understand okay
23:09where does the data come in and where
23:11does the data come out what is the
23:12source and what is the sync and then
23:14here is my potential fix I can go ahead
23:19and say hey I'm going to actually use
23:22this this this can actually work for us
23:24or I can say you know what I'll take
23:27this but I'll make some changes to it
23:29and so again it's supposed to be a way
23:32to help accelerate remediation of these
23:35particular
23:38issues now once these things start
23:41happening like these types of actions
23:43you're actually going to be able to
23:44track that as like icons over here so if
23:48there's a current uh pquest open you'll
23:51have like a green sort of pquest Icon if
23:54the pquest has been merged it'll be a
23:56purple one and then if it's uh once it's
23:59merged and we've done another code ql
24:01scan and we've identified that this
24:02issue no longer exists then we can say
24:05that is one alert completed and so as
24:08the security manager or in this case the
24:11the owner of this particular uh campaign
24:14I can see this progress bar go up and up
24:16and up as these things are worked on and
24:18the things that aren't worked on that as
24:20we're getting closer to the end of it I
24:22can go to the developers and say what
24:23sort of help do you need from me in
24:25order to help fix these particular
24:27things like what can we internally do we
24:29need to you know rush to get more
24:32resources on this or is there something
24:33that I can do to assist anything like
24:35that at least it gives me a way to
24:37communicate with them and also have a
24:40deadline to help sort of uh Inspire that
24:42sort of
24:44activity I say Inspire I think it's more
24:46encourage motivate something like that
24:49uh light a fire under people's butts for
24:51example is is a phrase that I hear quite
24:54often um so yeah
24:58this is security campaigns it is a a a
25:01very strong tool that allows security
25:04people to help collect a chunk of alerts
25:09and have that feedback go back to the
25:11developers provide autof fixes for what
25:14we can autofix and then developers can
25:17go ahead take that information and then
25:19apply it and remediate it and now that
25:21issue is now uh we have less issues than
25:23we did
25:26before so this is all from the security
25:29tab in GitHub I don't expect developers
25:34to spend much if any time in this
25:37particular view this is more relevant
25:40for Security Professionals who are
25:42managing the application security and
25:44want visibility into what developers are
25:46doing what they're producing what
25:47they're remediating what they're fixing
25:49what they're addressing and also help
25:51guide them on how they can address these
25:54things how quickly they need to address
25:56them and What needs to get addressed at
25:58what
25:59time so let's actually talk about it
26:02from a developer perspective so if I'm
26:06going to be interacting with dependabot
26:08I'm going to be looking at the P
26:09requests that come from dependabot if
26:11I'm be re uh interacting with code ql
26:13it's going to all be in the polar Quest
26:15I'm to be interacting with secret
26:17scanning I'm going to be told where
26:19those secrets are and then I need to do
26:21something about that so let's actually
26:24look at things from a developer
26:25perspective by looking at a repository
26:29so I will go ahead and start our journey
26:32here and I'll go ahead and start with
26:34secret scanning since it's it's probably
26:36the most um the easiest one to sort of
26:39like showcase and also the easiest one
26:41for to turn on I mean it's very very
26:44fast to turn on it's very very fast to
26:46get information so it's very quick to
26:49Value but the key thing I want to
26:51showcase is like well if I'm a developer
26:53and I have a a token in my code that I'm
26:56adding to my code base here
26:59what happens so actually kind of let's
27:02go through that so I'm going to go into
27:04my settings here I hope you love that
27:06image it was generated with
27:08AI and we have uh we'll go into our
27:11developer settings what I'm going to do
27:13is I'm going to create a personal access
27:15token in this
27:17case so from here I'll go ahead and do
27:21all the security stuff I'll just call
27:24this one reactor
27:26token and all of you here on YouTube and
27:30Linkedin you're going to be able to see
27:32this token so you better copy it as soon
27:34as possible so that way you can get
27:36access to all the
27:38things I'm just kidding please don't do
27:41that for the love of God don't do it I'm
27:43gonna goe have this expired on
27:45Valentine's Day and I'm not going to
27:47give it any permissions because all of
27:49y'all are going to be able to see this
27:50so that sounds like a dangerous uh
27:54situation I'll go ahead and generate my
27:56token and I'm going to copy
27:58it now's your chance there it is all
28:02right so I'm going to go back to where I
28:04was
28:06before should have what's the word open
28:10that in a new
28:12tab here we are so I'm back into my
28:15repository I have my token in my
28:20clipboard and what I'm going to do is
28:21I'm just going to open up any sort of
28:22file here I'll go into my
28:24index.js I'm going to edit the file and
28:27I'm just going to type out let token
28:31equals that token there it is
28:34again all right so now what I want to do
28:37is I want to commit this so let's just
28:38say for example this is some new code
28:40that I'm introducing to this project and
28:42I want to see if you know push
28:44protection is actually going to stop me
28:47so I'm going to commit directly to the
28:48main branch because I'm a bad developer
28:50and I do bad things and I'm
28:53blocked so this type of messaging and
28:57this type of activity this obviously
28:58this isn't limited to the UI like I
29:01don't expect developers to actually
29:02write code in the browser I expect them
29:04to write code in their idees uh and if
29:07they're you know real hackers do
29:08everything in Vim or
29:10neovim
29:13uh whatever sort of git client that
29:15they're
29:16using this type of messaging is going to
29:18show up in that git client so whether
29:20that git client is on the CLI whether
29:22that git client's inside the IDE or
29:24they're using some sort of graphical
29:26user interface for git
29:28they will get a response so the way this
29:31happens is uh whenever a developer is
29:34pushing that code it hits GitHub and
29:37then we run G as a obviously as an
29:40event-driven type of tool and so we have
29:42a pre-receive hook that will go ahead
29:45and isolate the codebase run a secret
29:48scan on that codebase on that commit and
29:50then
29:51say what are the secrets that exist in
29:54there and if we find that a secret does
29:56exist in there then we respond
29:59with this type of response that we found
30:00a secret on this line in this location
30:04and it needs to be removed so please
30:06recommit this commit without the secret
30:09there that allows us to prevent that
30:12secret from being added to the get
30:16history another big question that people
30:18tend to ask is well if we're doing
30:19Secret scanning are we doing just secret
30:21scanning on
30:22the what's the word on just like the
30:25current Branch or like on the main
30:26branch the answer no we're doing a
30:28secret scan on the entire git history we
30:32are also doing a secret scan in places
30:34like issues and discussions in a lot of
30:37the places where developers are adding
30:40text to GitHub that's where we're
30:42performing a secret scan and so that way
30:46security can see like you know hey're
30:47we're seeing all these sort sorts of
30:49Secrets being found in these types of
30:50areas let's go ahead and prevent that
30:52from happening in this case we're
30:54preventing it using
30:56git so now that I can't use this anymore
31:00I'm go ahead and cancel
31:02changes and say okay and you know what
31:05just because I am like crazy paranoid
31:07right now because I just invited a whole
31:09bunch of people to take my token and
31:11just do crazy stuff with it I'm G to go
31:13ahead and delete it and this one too so
31:18that's done my anxiety has been reduced
31:21significantly and that's Secrets
31:22scanning push protection and as I said
31:24before you can create your own custom
31:26secrets and you can use that uh those
31:30custom secrets with push protection as
31:33well but for like the AI generated ones
31:36it's not supported for push protection
31:38and it's for a pretty good reason uh you
31:41don't want every commit uh to be blocked
31:44you don't want developers to have that
31:46sort of really negative uh and and high
31:50friction type of interaction with
31:52GitHub um because their job is to push
31:55code to create new features to fix
31:58things to get things moving as quickly
32:00as possible so that the business can
32:01continue to grow and function but if
32:03we're just stopping developers right and
32:05left it's not a good look it's it makes
32:08things more frustrating for them they're
32:09not able to meet their goals they get
32:11yelled at all this stuff so the the idea
32:15with like the AI stuff is like well we
32:16want to be able to catch those when
32:17they're in the repositories and we can
32:19go ahead and remediate after the fact
32:21but if we do that from
32:23a um a push protetion perspective we
32:27might hit a lot more false positives
32:29than we want and so we want to feel we
32:32want to make sure that we at least have
32:34a
32:3599% uh
32:37uh shity uh assurance that the whatever
32:42we're blocking is a true positive so
32:45that's why we work with these uh partner
32:47providers and a lot of those are the
32:49ones that can get blocked with push
32:52protection okay so that's going to be
32:55from a secret scanning perspective as a
32:59developer what about code ql then you
33:02know if I'm going to be pushing in new
33:04code to the
33:06repository uh what happens with that
33:09right
33:10um what sort of checks can we run what
33:12sort of activities can we see so I have
33:15all of that already done via a pull
33:18request in my python application here
33:21and so what I've done is I've updated a
33:23particular file and in that file it
33:26found a log injection vulnerability so
33:28this is the pull request so I've made
33:31changes to the code base and I've gone
33:33ahead and created a new Branch here
33:36called my username patch one and I want
33:39to merge that into the main one but
33:41beforehand I need to make sure that I
33:42pass certain
33:44checks and so over here you can say like
33:46you know hey we found a potential
33:48problem this is the problem you can go
33:50ahead and see the show paths here to see
33:52what that data flow looks
33:53like pretty pretty cool right
33:57now as a developer I'm like well what do
34:01I do about this like what do I how do I
34:05fix this and how do I do this quickly
34:08well here's autofix and autofix is
34:10basically saying like well to fix this
34:12type of injection vulnerability you
34:13would essentially you know remove some
34:15of those special characters out of there
34:18but I can say you know
34:20what this fixes part of it but I don't
34:25think we should be taking user input and
34:27then just directly putting it into a log
34:29like maybe we can log the event but not
34:32the actual input and the information so
34:34I can go ahead and say I'm going to edit
34:37this for example and from
34:40here I instead of like taking this
34:43example for uh for instance I can go
34:46ahead and add new code to say well I
34:48just want to say that this event had
34:50happened and then just have that be
34:52logged somewhere and that way we don't
34:55we can completely avoid the log
34:56injection vulnerability
34:59but to help me get to that point the
35:03co-pilot autofix is there to help me get
35:05over to that part that that location oh
35:07my goodness there we
35:11go and as you can see here you know code
35:14ql ran
35:15automatically um and I was able to get
35:18that information we got the autofix now
35:20I can collaborate I can make the edits
35:22then I can go ahead and say you know
35:23what let's commit that suggestion let's
35:26commit those changes and then once that
35:28happens you'll see a new commit here
35:31from both me and co-pilot and then we're
35:33going to run the code ql checks again to
35:36make sure that this fix actually
35:37addressed the
35:40issue all
35:42right
35:44so that's from a a code ql perspective
35:47on like what I expect developers to
35:49really sort of be working with and what
35:50sort of experience I expect them to have
35:54if I look at my Java application again
35:58and I want to see things from like a
36:00software composition analysis
36:02perspective what if I am
36:04introducing new vulnerabilities with my
36:07changes to my manifest file like if I'm
36:09trying to add a new open source
36:11component to my application you know is
36:13there a way for me to make sure that I'm
36:15not adding in something that could be
36:19problematic so I've done that already
36:21it's kind of like a one of those like
36:23those cooking shows where like they show
36:24you how to mix something and then like
36:26underneath it the counter is like oh and
36:28here's the cake like you don't have to
36:30bake it you don't have to sit here for
36:3140 minutes and watch me just stand
36:32around looking at a at an oven all day
36:35uh I've already done it that's the the
36:37magic of live streams I suppose but here
36:41is my pull request I'm updating my palm.
36:45XML and I've used a workflow called
36:49dependency review and dependency review
36:51is going to run at the poqu quest stage
36:54and what it's going to be looking for
36:56are instances where the Manifest file is
36:59changed and of those changes are we
37:01introducing additional risk to our
37:05application and in this case we can see
37:07you know hey does it are we introducing
37:09packages with unknown licenses or
37:12incompatible licenses licenses that our
37:14organization cannot use because of legal
37:18reasons right we don't want to get sued
37:20later on and and have to you know shut
37:21down our application until we can
37:23actually make this change I want to make
37:24sure that we are compliant from day one
37:26as opposed to day
37:29100 but from here we are adding in this
37:33uh log for J type of uh package and we
37:36can see that there's multiple
37:38vulnerabilities for this particular
37:39package and so we were blocked in this
37:42case from adding this because this in
37:46this case is not something that we
37:47should be adding to our application
37:49because it will be adding additional
37:50risk and additional problems that need
37:52to get remediated at a later
37:55time so you can see like from a
37:58developer's perspective a lot of this
38:00has to do with things that they're
38:02already doing they're already making PO
38:04requests they're already pushing commits
38:06they're already working on code the
38:09feedback that they get from this is
38:11meant to help them make better security
38:14decisions for the code that they are
38:16writing and it's a lot easier to have
38:19this centralized in one place via inside
38:22of GitHub where the code lives anyways
38:25in order for them to be able to get that
38:26information and make the right choices
38:30in a in the most efficient and effective
38:32way possible to prevent issues from
38:35being you know found later on and a much
38:38more expensive prospect on actually
38:40fixing and addressing those
38:46issues
38:48okay another thing we can look at are
38:51some of the dependabot you know changes
38:53that we've made here so I can just kind
38:55of like look at these it's it's pretty
38:57clear like what sort of things were
38:59happening here but in this type of
39:02dependabot alert we are essentially
39:04updating seven different packages and
39:07instead of having like one you know Pro
39:09request per package this allows us to
39:12group these updates together and send
39:15them over to our or update the the
39:18packages in our repository so we're
39:19reducing the amount of risk from an open
39:21source component
39:23perspective and as you can see here it
39:25kind of lets us know that uh there's two
39:28packages with open ssf scorecard issues
39:30and one has unknown issues so even with
39:33these dependabot PRS we still have
39:35dependency review Running letting us
39:38know that hey is dependent bot you know
39:39sending this stuff over to us and are
39:42these you know potentially adding
39:43additional risk well in this case in
39:45terms from a vulnerability perspective
39:48it's not something that we are adding we
39:49are actually fixing these issues and
39:51reducing that risk level managing the
39:54risk I should say
39:58Okay so we've talked about dependency
40:00review we've talked about dependabot
40:02we've talked about PO requests we've
40:04talked about code ql and autofix we've
40:06talked about secret scanning and we've
40:08talked about uh push protection with
40:11secret
40:12scanning I think
40:15ultimately what we are really here to
40:18set out to do with GitHub Advanced
40:20security is since the code already lives
40:24here and it's already being worked on
40:27it's already being collaborated on
40:29everything is already happening within
40:31this space what we want to be able to
40:33help accomplish is how can we help
40:36developers be more efficient and help
40:39take less time sort of like fixing these
40:41issues automate as much as possible and
40:44use AI specifically from co-pilot to
40:47help fix some of these issues so we can
40:49actually get this stuff done quickly and
40:51so developers can get back to doing what
40:53they do best which is building which is
40:55solving problems which is making the
40:59world a better place with
41:01software I don't want to debate whether
41:03or not you know the internet was a
41:05mistake but since we have it we want to
41:07make sure that we're trying to be as
41:08secure as
41:12possible okay so for now that pretty
41:15much concludes the demo portion of
41:18GitHub Advanced security as usual if you
41:20do have more questions you know please
41:22feel free to drop them in the chat I'll
41:23go ahead and answer some of the
41:24questions that I see now and you if you
41:27do want to reach out please reach out to
41:29us at GitHub you know we're more than
41:31happy to you know help out
41:34there all right so let me see what sort
41:37of questions we have
41:41here so we have one does this uh does
41:44this scanning available in Azure repos
41:47or Azure devops repos or or um yeah
41:52Azure devops and the repos within there
41:55we there is a feature called GitHub
41:58Advanced security for Azure devops um
42:01and some of the tools are a little bit
42:04different and some of the tools are
42:05pretty much the same so from a code
42:07scanning perspective or at least from a
42:09code ql perspective you would be using
42:11Code ql inside of Gazo what we call
42:13gazor GitHub Advanced security for Azure
42:17devops uh in terms of the dependencies
42:21they use something called dependency
42:22tracker and we use dependabot and
42:25dependency graph and all those things um
42:27so it's a very it's a similar sort of
42:30approach and then for secret scanning
42:31they also have a a little bit different
42:34type of secret scanning tool but it
42:35functions virtually the same thing so
42:38you'll be able to see these types of
42:40alerts inside of GitHub Advanced
42:42security for Azure devops or
42:44specifically you can see these things in
42:45Azure devops and get some of that value
42:50there I think that was the only question
42:52that we had today
43:01so cool well I appreciate you all being
43:05here again if you have more questions
43:07please feel free to let us know I will
43:09give it back to Anna to help wrap this
43:11up so back to you
43:26Anna thank you all for joining and thank
43:28you to our
43:29speakers this session is a part of a
43:31series to register for future shows and
43:34watch past episodes on demand you can
43:36follow the link on the screen or in the
43:39chat we're always looking to improve our
43:41sessions and your experience if you have
43:44any feedback for us we would love to
43:46hear what you have to say you can find
43:48that link on the screen or in the
43:51chat we'll see you at the next one