A Guide to Securing GitHub Based on Lessons Learned
Talkat OSPOCon @ Open Source Summit Europe 2023 · on Wednesday, 2023-09-20· at 11:25· Room 3H (3JAUREGIA - Floor 3), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
F5 standardizes GitHub orgs after acquisitions, publishes a source-management guide with OpenSSF, and uses automated checks to harden repos. Practical steps include enabling branch protection, requiring PR reviews, setting workflow token permissions equal to read, turning on dependabot and running scorecard and legitify scans. A demo repo moves from about a 3.x baseline to 7.1 after these changes; scripts, templates and org-level rule sets automate scale and reporting.
AI-written summary · about
chapters (7)
- 0:00Introduction
- 4:36GitHub security importance
- 11:56Software supply chain threats
- 19:42GitHub security tools
- 25:21Demo of security improvements
- 33:53Scaling security practices
- 36:43Lessons learned
related talks
39mA Guide to Securing GitHub Based on Lessons Learned
40mA Guide to Securing GitHub Based on Lessons Learned
48mAdvanced Security with GitHub without GitHub Advanced Security
17mNo More Walled Gardens: Removing Barriers with SCM...
38mFortifying Your Codebase with GitHub
27mBuilding a Secure Open Source Project on GitHub
49mProtect Your Code with GitHub Security Features
58mProtect your code with GitHub security features