Protect code while promoting user experience
The Developer spoke with Mathew Payne, Senior Field Security Specialist at GitHubto discuss the platform’s security strategies and how they aim to strike a balance between robustness and a seamless user experience.
At the heart of GitHub’s security philosophy is a commitment to protecting user code. Payne emphasized that the focus is on securing the code created by both users and developers.
“The first thing we focus on at GitHub is the security of our users,” Payne says. “My goal has always been to secure the code written by my users and my customers. »
Balancing security features with user experience is a challenge recognized by GitHub. Payne stressed the importance of reducing false positives, which can discourage developers from using security tools.
“If I produce too many (false) results with my tool, my developers will start to really react,” Payne explains. “And we want to be partners with these developers, not against them.”
GitHub’s integration of security processes into developers’ daily activities helps streamline the experience. This includes automatically detecting vulnerabilities during pull requests and quickly communicating potential issues before they reach production.
Amid emerging security threats, GitHub recognizes the growing concern about the software supply chain. Payne gives the example of the Moq library, which drew criticism earlier this month for including the data collection “SponsorLink” in its latest release.
GitHub remains vigilant against unauthorized access to repositories and inadvertent exposure of sensitive data. By the end of this year, GitHub will require all developers to enable one or more forms of 2FA after compromised accounts lead to package buyouts.
“You want to make sure that you don’t have any hardcoded secrets in your repository, because let’s say your repository do are compromised, you want to make sure they don’t have your access keys to your Azure or AWS instances,” advises Payne.
When it comes to incident response and recovery, GitHub relies on a range of tools, including, of course, their internal tools. CodeQL And Dependbot. Last year, GitHub announced that it would begin automatically sending Dependabot alerts when it detects a vulnerability. GitHub Actions.
“For CodeQL, let’s say we have a new attack – maybe it’s an XSS or SQL injection or something like that – we want to detect it with this tool,” says Payne. “Make sure we’re not also running regressions so we don’t reintroduce this vulnerability.”
“This is an important issue for some of my clients: they want to detect this vulnerability while ensuring that it does not recur. There may be a reason why the developer added this XSS, so we want to make sure that next week they don’t accidentally reintroduce it.
GitHub’s participation in the next Cybersecurity and Cloud Expo Europe will focus on the topic of simplifying security for developers. GitHub aims to share information about the adoption and processes of security tools, addressing the challenges faced by their users.
You can watch the full interview with Mathew Payne below:
GitHub is a key sponsor this year European Cybersecurity and Cloud Exhibitionwhich will be held in Amsterdam from September 26 to 27, 2023. Check out Mathew Payne’s first day opening speech and stop by the GitHub booth at Booth #96 to hear more directly from platform experts.
