Using data-driven metrics to anticipate and prevent security incidents
summary
A new PSIRT Engineering team at GitHub claims it prevents future incidents and reduces pressure on incident response by capturing every incident into issues via Slack bots, scoring them with an internal calculator, and running variant analysis. Concrete results: seven CVEs in an early incident, routine bi‑weekly discussions, automated flags when a product area gets over two bugs, tooling that includes Python and pandas, CodeQL, Breakman and code search, and a one‑person team that reports measurable prevention and improved mitigations.
AI-written summary · about
chapters (13)
- 0:00Data-driven security metrics
- 6:50Incident response to prevention
- 11:20Peer Engineering at GitHub
- 13:07Trend analysis for security
- 15:40Custom incident scoring system
- 17:02Automating data capture
- 20:16Cross-team collaboration
- 23:52Blameless investigations
- 26:42Variant analysis for bugs
- 29:09Variant analysis outcomes
- 31:58Variant analysis testing
- 32:19Peer Engineering results
- 34:49Team challenges and future
related talks
19mFlipping the script on application security
29mFrom NIST to FIRST: How GitHub’s Product Security Response Organization Transitioned
37mLearning from Incidents at Scale; Actually Doing Cross-Incident Analysis
17mIncident Response @ Scale-Building a Next Generation SOC
25mAutomating Cyber Threat Intelligence: A Practical Approach to Managing Emerging Vulnerabilities
17mGamify security best practices to scalably improve engineering culture
55mCyber Security vs. Statistics
45mRunning an efficient bug bounty program and PSIRT... (Garrett McNamara, Jeff Guerra)