Skip to content

Commit 00eef30

Browse files
WritingPandaWritingPanda
authored
Merge pull request #5 from Ignite-GHAS-Workshop/public-to-private-ghas-enabled
Public to private ghas enabled
2 parents 5a3cf44 + b9d9aad commit 00eef30

6 files changed

Lines changed: 120 additions & 19 deletions

File tree

‎README.md‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,11 +59,28 @@ This lab will have you utilize Secret Scanning with Push Protection to prevent s
5959

6060
---
6161

62+
### Lab 6 - Hands-on with Security Overview
63+
64+
This lab will teach you how to effectively use the Security Overview to review and alerts and coverage in an organization.
65+
66+
- Get started here - [Lab 6](./_labs/lab6.md)
67+
68+
---
69+
70+
6271
### Extra Credit: Advanced CodeQL Setup
6372

6473
This open-ended extra credit lab will have you switch to the advanced CodeQL setup.
6574

66-
- Get started here - [Extra Credit Lab 1](./_labs/lab6-ec.md)
75+
- Get started here - [Extra Credit Lab 1](./_labs/lab7-ec.md)
76+
77+
---
78+
79+
### Extra Credit: Custom Patterns for Secret Scanning
80+
81+
This open-ended extra credit lab will have you create a custom secret scanning pattern.
82+
83+
- Get started here - [Extra Credit Lab 2](./_labs/lab8-ec.md)
6784

6885
---
6986

‎_labs/lab1.md‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,9 @@ Welcome! In this lab, you will be introduced to GitHub Advanced Security (GHAS)
77
> We recommend opening up two browser windows, one with the lab and one with the working copy of your repo!
88
-->
99

10-
## Forking the repository
10+
## Creating the repository
1111

12-
In this exercise, you will fork a repository with code from which you can work to test our the GHAS capabilities.
12+
In this exercise, you will create a repository with code from which you can work to test the GHAS capabilities.
1313

1414
1. Navigate to +++https://github.com/Ignite-GHAS-Workshop/ghas-workshop-repo+++ in your browser.
1515
2. Click the green **Use this template** button in the upper right corner of the page.
@@ -44,22 +44,29 @@ Although Dependabot isn't part of the GitHub Advanced Security product suite, it
4444
### Exercise 2: Enable Code Scanning
4545

4646
1. Next, let's enable **Code Scanning with CodeQL**. These settings are also under the **Code security** settings page.
47-
2. Underneath the Code Scanning heading, click the **Set up** button in the **CodeQL analysis** row.
48-
3. There are two options: **Default** and **Advanced**. Select the **Default** option and review the settings.
47+
2. Click the **Enable** button next to GitHub Advanced Security.
48+
3. A prompt will confirm that you want to **Enable GitHub Advanced Security for this repository** - click the button.
49+
- The prompt tells you how many GitHub Advanced Security licenses you would consume by enabling this feature - which is useful if you are an organization owner and want to ensure you have enough licenses for your organization.
50+
4. Underneath the **GitHub Advanced Security | Code scanning** heading, click the **Set up** button in the **CodeQL analysis** row.
51+
52+
> [!NOTE]
53+
> If you do not see the **Code scanning** heading on the **Code security** page after enabling **GitHub Advanced Security** - you have likely not created your repo in the proper Organization. Go back to the beginning of this lab and ensure you choose **Ignite24-Labs** value from the dropdown as the new repository **Owner** when you choose **Use this template** .
54+
55+
5. There are two options: **Default** and **Advanced**. Select the **Default** option and review the settings.
4956
- For this lab, we will use the **Default** setup which creates a managed Actions workflow (i.e. you will not see a file committed to the repo). You can use the Advanced option to manage your code scanning workflow as a GitHub Actions workflow YAML file committed to the repo. The **Default** option is a great option to get started quickly to enable code scanning in a repository without needing to commit any additional code.
5057
- By default, it will scan the JavaScript code, use the default CodeQL queries (for highest precision), and scan the default branch on push, pull request, and on a weekly schedule.
5158

5259
<details>
5360
![image](images/lab-1-2-1.png)
5461
</details>
5562

56-
4. Click the **Enable CodeQL** button to save the settings and enable Code Scanning.
63+
6. Click the **Enable CodeQL** button to save the settings and enable Code Scanning.
5764

5865
<details>
5966
![image](images/lab-1-2-2.png)
6067
</details>
6168

62-
5. Ensure that **Copilot Autofix** is enabled (in the **Code Scanning --> Tools** section).
69+
7. Ensure that **Copilot Autofix** is enabled (in the **Code Scanning --> Tools** section).
6370

6471
<details>
6572
![image](images/lab-1-2-3.png)
@@ -68,7 +75,7 @@ Although Dependabot isn't part of the GitHub Advanced Security product suite, it
6875
> [!NOTE]
6976
> You don't need a Copilot license in order to use the Copilot features with GitHub Advanced Security. However, Copilot can certainly be helpful in resolving issues in your IDE by using Copilot chat to explain the vulnerability and how to fix it.
7077
71-
6. Optionally, configure the **Check runs failure threshold** - by default, a pull request will be blocked if there are any high or higher security alerts.
78+
8. Optionally, configure the **Check runs failure threshold** - by default, a pull request will be blocked if there are any high or higher security alerts.
7279

7380
### Exercise 3: Enable Secret Scanning
7481

@@ -80,6 +87,7 @@ Although Dependabot isn't part of the GitHub Advanced Security product suite, it
8087
6. Optionally, configure **Who can bypass push protection for secret scanning**.
8188
- By default, as to not interrupt developers' workflows, anyone with write access to the repository can manually bypass a blocked push that contains secrets (administrators will be notified of this, and it is also captured in the audit logs).
8289
- In Private and internal repositories in organizations using GitHub Enterprise Cloud with GitHub Advanced Security enabled, you can change this to only allow select users/teams (or no one) to bypass secret scanning push protection.
90+
7. Note that you can define your own **Custom patterns** from this page to scan for secrets that don't correspond to a known provider pattern.
8391

8492
<details>
8593
![image](images/lab-1-3-1.png)

‎_labs/lab2.md‎

Lines changed: 16 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -143,31 +143,36 @@ Now that we have all of the security feature enabled, let's review the security
143143
144144
## Exercise 3: Reviewing Secret Scanning alerts
145145

146-
1. Since this is a brand new fork of a public repo, you will not have any secrets detected. The next few steps we will review what you would see if we had any secrets detected (optional steps in Lab 5.)
147-
148-
2. Under the **Security** tab in the repo, click on the **Secret scanning** view. This will show all of the secret scanning alerts. (This should be empty for you.)
149-
150-
<details>
151-
![image](images/lab-2-3-1.png)
152-
</details>
153-
154-
3. Viewing a secret scanning alert shows details about the leak
146+
1. Under the **Security** tab in the repo, click on the **Secret scanning** --> **Default** option. This will show all of the default secret scanning alerts.
147+
2. You should see a number of alerts. For example, there should be a **GitHub Personal Access token alert**. Click it.
155148
- This page shows where in the code the secret was discovered (if there were multiple locations, it would list them all).
156149
- If a secret is found in the code, we would want to revoke manually in the designated service.
157150
- It's recommended to revoke the secret instead of rewriting history because the secret was exposed and you don't know who may have seen it.
158151
- If you re-write history, the secret will still be valid and could be used by an attacker. Also, re-writing history modifies commit hashes and can make traceability more difficult.
159152

160153
<details>
161-
![image](images/lab-2-3-4.png)
154+
![image](images/lab-2-3-1.png)
162155
</details>
163156

164-
4. If you view an alert and choose **Verify secret** and this time, it says **secret inactive**. This is a good candidate to **Close as** --> **Revoked**.
157+
3. You can click on **Verify secret**. It will say it's not currently valid on `github.com`, but that doesn't mean it doesn't come from another GitHub instance (such as GitHub Enterprise Server).
158+
4. Go back to list of secret scanning alerts. Click on the **Google API key** alert.
159+
5. Click on **Verify secret** again. This time, it should say **secret inactive**. This is a good candidate to **Close as** --> **Revoked** (click the **Close as** button in the upper right to do so). Do this.
165160
- Unlike Dependabot alerts and Code Scanning alerts, secret scanning alerts are not automatically closed when the secret is removed from the code - whether by a new commit or by re-writing history. This is because the secret was exposed and you don't know who may have seen it. So, you have to manually close the alert once you revoke the token.
161+
6. Navigate back to the **Default** secret alerts list.
162+
7. We can click **1 Closed** to see the alert we just closed.
166163

167164
<details>
168165
![image](images/lab-2-3-2.png)
169166
</details>
170167

168+
8. Click on the **Experimental** secret scanning alerts option. This will show all of the alerts that are not high confidence, such as generic passwords, keys, and things such as HTTP bearer authentication header tokens found in the code.
169+
9. Let's click into one of the **Password** alerts.
170+
171+
<details>
172+
![image](images/lab-2-3-3.png)
173+
</details>
174+
175+
10. Just like high confidence secret scanning alerts, it shows where the secret was found in the code. The secret was found with AI, so it may or may not be a real secret or password. If it's not, we can close it manually and mark it as a false positive.
171176

172177
## Summary
173178

‎_labs/lab6.md‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
# Lab 6 - Hands-on with Security Overview
2+
3+
We've covered how to review alerts in a single repository, but how is your org or team doing? Next, we'll check out the Security Overview at the organizational level to see how we can get a high-level view of the security posture of our organization.
4+
5+
This lab covers parts of the following exam domains:
6+
7+
- Domain 6: Describe GitHub Advanced Security best practices
8+
9+
## Exercise 1: Navigating to Security Overview
10+
11+
The Security Overview can be used by anyone inside of an organization; it shows repositories that **you** have access to. If you are an org owner or a security manager, you would see all alerts. If you are a regular org member, you would only see alerts for repositories by default that you have write access to.
12+
13+
> [!NOTE]
14+
> Security alerts for a repository are visible to people with write, maintain, or admin access to the repository and, when the repository is owned by an organization, organization owners. You can give additional teams and people access to the alerts.
15+
1. Navigate to the organization. You can do so by **clicking on the org name** (`Ignite24-Labs`) in the repository breadcrumbs in the upper left hand corner.
16+
- You can also navigate to your orgs by clicking on your profile picture and "**Your organizations**"
17+
2. Click on the **Security** tab.
18+
3. Review (and click on!) the different views on the left-hand side:
19+
- Overview: visualize trends in Detection, Remediation, and Prevention of security alerts ([docs](https://docs.github.com/en/enterprise-cloud@latest/code-security/security-overview/viewing-security-insights#about-security-insights))
20+
- Risk: explore the risk from security alerts of all types or focus on a single alert type and identify your risk from specific vulnerable dependencies, code weaknesses, or leaked secrets ([docs](https://docs.github.com/en/enterprise-cloud@latest/code-security/security-overview/assessing-code-security-risk))
21+
- Coverage: assess the adoption of code security features across repositories in the organization ([docs](https://docs.github.com/en/enterprise-cloud@latest/code-security/security-overview/assessing-adoption-code-security))
22+
- Enablement trends: see how quickly different teams are adopting security features
23+
- CodeQL pull request alerts: assess the impact of running CodeQL on pull requests and how development teams are resolving code scanning alerts ([docs](https://docs.github.com/en/enterprise-cloud@latest/code-security/security-overview/viewing-metrics-for-pull-request-alerts))
24+
- Secret scanning: find out which types of secret are blocked by push protection and which teams are bypassing push protection ([docs](https://docs.github.com/en/enterprise-cloud@latest/code-security/security-overview/viewing-metrics-for-secret-scanning-push-protection))
25+
26+
> [!TIP]
27+
> You can export a CSV of nearly from most of these views using the **Export CSV** button in the upper right.
28+
4. Under the **Overview** view, navigate the sub-views, specifically **Detection** and **Remediation**.
29+
- Note the trends - this is useful information to evaluate the security posture of your organization. Are we getting better over time?
30+
- Being secure requires "constant vigilance"
31+
5. Navigate to the **Risk** view.
32+
6. On the right-hand side, click the **Teams ▾** button/dropdown.
33+
7. Click on the **all users** team - this team is only added to a different sample repo, so note how the total alerts changes.
34+
- This can be really useful for a manager, architect, or developer to see which repositories assigned to the teams have security features enabled and how many alerts they are generating.
35+
8. At the bottom of the options on the left, you will see **Security Campaigns**.
36+
- Security campaigns are a new feature designed to help administrators and security managers create targeted campaigns and track remediation progress effectively.
37+
9. ⚠️ Please don't create a new security campaign as to not introduce noise to your fellow attendees ⚠️, but click on the existing campaign here (**SQL injection (CWE-89)**) to check it out!
38+
- How are we doing on our goal?
39+
40+
## Summary
41+
42+
That's the security overview! Use these views to monitor and manage your security posture effectively. By leveraging the detailed insights provided in each section, you can identify potential threats, take proactive measures, and ensure your systems remain secure.
43+
44+
If you want to learn more about the security overview or about what a particular view shows, check out the [docs](https://docs.github.com/en/enterprise-cloud@latest/code-security/security-overview/about-security-overview)!
45+
46+
Congrats, you have finished all of the main labs! 🎉 If you have time or are up for a challenge, try out the extra credit labs!
47+
48+
➡️ Head back to the [labs](README.md) page to try your hand at the extra credit labs.

_labs/lab6-ec.md renamed to _labs/lab7-ec.md

File renamed without changes.

‎_labs/lab8-ec.md‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Extra Credit - Lab 8 - Custom Patterns for Secret Scanning
2+
3+
We are just using the out of the box secret scanning settings. Perhaps you are interested in finding other patterns, such as credit card patterns, committed in the code.
4+
5+
6+
## Exercise
7+
8+
Your assignment here is to implement a secret scanning custom pattern. You can start under the **Settings** --> **Code Security and Analysis** page.
9+
10+
If you are looking for an example of what to search for, we suggest creating a pattern for finding a credit card! A developer may or may not have accidentally committed customer credit card numbers to the repository and we need to alert on this.
11+
12+
Create a pattern, run a dry-run, and hopefully you find the pattern! If so, save the custom secret scanning pattern to implement.
13+
14+
15+
> [!TIP]
16+
> AI can help you get started generating those pesky regular expressions using natural language. Look for the **Generate with AI** button in the top right corner.
17+
> For increased precision, you can check out [examples for custom patterns for secret scanning](https://github.com/advanced-security/secret-scanning-custom-patterns/tree/main?tab=readme-ov-file#personally-identifiable-information-pii), including a credit card example (under PII), in the [advanced-security/secret-scanning-custom-patterns](https://github.com/advanced-security/secret-scanning-custom-patterns/tree/main?tab=readme-ov-file#personally-identifiable-information-pii) repo!
18+
19+
## Summary
20+
21+
In this lab, you should have identified the credit card number that was accidentally committed. Custom secret scanning patterns offer an excellent way to implement additional scanning patterns that are crucial for your organization!
22+
23+
➡️ Head back to the [labs](README.md) page.

0 commit comments

Comments
 (0)