Enhancing Organizational Security with GitHub Auditor
"Learn how GitHub Auditor provides CSOs and CTOs with valuable insights into GitHub organizations, enabling proactive security measures. Real-time alerts, API integrations, and advanced authentication mechanisms make this project valuable for managing multiple organizational accounts efficiently."
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Xenon Partners//UCSB CS-189 Capstone Proposal Organizational Security Dashboard Friday, 1 October 2021 donnie@xenon.io jason.gilmore@xenon.io
Donnie Hasseltine About About Donnie Hasseltine serves as CSO of Xenon Partners, and the General Manager of PackageCloud. Prior to joining Xenon Partners, he served as a Marine Corps officer for 22 years with combat service in Kosovo, Iraq, and Afghanistan. Donnie currently serves as the Information Technology Sector Chief for the Bay Area Chapter for InfraGard, a public-private partnership with the FBI to protect U.S. critical Infrastructure. He is a board member of the Marine Reconnaissance Foundation and the Athena Leadership Project, and is a team mentor for Stanford University's annual Hacking4Defense course. https://www.linkedin.com/in/george-d-hasseltine/
Jason Gilmore About Jason Gilmore serves as CTO of DreamFactory Software, and is a Principal at Xenon Partners. Prior to joining Xenon Partners, Jason led software teams in the telecom, publishing, environmental, and interior design industries. He's the author of nine books, including the bestselling "Beginning PHP and MySQL", "Easy Laravel 5", and "Easy E-Commerce with Laravel and Stripe". Jason is cofounder of the popular CodeMash Conference, a multi-disciplinary software conference held in one of the country's largest indoor water parks. Away from his keyboard he's probably thinking about software. https://www.linkedin.com/in/wjgilmore/
Project Proposal The Problem: CSOs, CTOs, and departmental managers do not possess sufficient insights into GitHub organizations, particularly when a company relies upon multiple organizations. Case Study: Xenon Partners manages a portfolio of 9 companies. Each company separately manages a GitHub organization. The CSO and portfolio company CTOs do not possess a simple means to audit and proactively respond to potential security issues due to a lack of easy insights into issues such as 2FA, pending subscription renewals, third-party contributions, etc.
Enter GitHub Auditor GitHub Auditor is an umbrella dashboard that presents insights into one or more organizational accounts, reporting on the following items such as: 2FA requirement Outside contributors Dependabot alerts Pull requests lacking an assigned reviewer Repositories contain sensitive information such as API keys or passwords Alerts can be configured to notify pertinent parties about potential issues.
Why is this Project Cool? Dashboards! API integrations! Real-time alerts sent to email and Slack! Text-processing (and possibly ML)! Security and advanced authentication (OAuth and API keys)! Popular developer platforms like GitHub and AWS!
Other Potential Integrations Depending on the progress and timeline, there are multiple other potential integrations that would be helpful for security oversight SSL/TLS/cipher verification checks Tie repository to deployment if a website or web application. Domain status Email Security (SPF/DMARC/DKIM) Google Workspace (MFA adoption, password policy)
Project Communications Dedicated Slack channel Periodic Zoom-based check-ins Asynchronous architectural and code reviews
Addendum: Implementation Ideas Web framework like Laravel or Ruby on Rails Database like MySQL Redis for job queues GitHub OAuth (or API key) GitHub API Mailgun or similar for transactional emails Something (Python) for text processing in order to audit code for API keys
