No More Walled Gardens: Removing Barriers with SCM...
summary
Claims that GitHub default settings let anyone forge commits and that a recent incident exposed ~35,000 repos leaking secrets lead to concrete fixes: require signed commits, protect main branches, enforce MFA, and audit repo creation and forks. Recommends CI hardening by centralizing workflows, restricting build workers’ outbound network, and scanning builder images. Demonstrations use open tools: chain-bench (Aqua) shows no orgs score 100/100, step-security blocks outbound from runners, and the Terraform GitHub provider codifies least-privilege repo configuration.
AI-written summary · about
chapters (9)
- 0:00Introduction to SCM security
- 3:01GitHub commit spoofing risks
- 6:18Supply chain attack examples
- 7:23Protecting code changes
- 9:12Repository and user management
- 10:41Securing CI/CD pipelines
- 12:48Open-source security tools
- 15:19Infrastructure as Code for GitHub
- 16:45Q&A and product demo
related talks
48mAdvanced Security with GitHub without GitHub Advanced Security
39mA Guide to Securing GitHub Based on Lessons Learned
38mFortifying Your Codebase with GitHub- 39mA Guide to Securing GitHub Based on Lessons Learned
49mProtect Your Code with GitHub Security Features
52mGitHub Actions Security: From CI Nightmare to Supply Chain Sentinel
01h 02mDeveloping secure software with GitHub
40mA Guide to Securing GitHub Based on Lessons Learned