Github Security

[ramimac]

Posture:

• https://www.googlecloudcommunity.com/gc/Community-Blog/Monitoring-for-Suspicious-GitHub-Activity-with-Google-Security/ba-p/763610
• https://sharpletters.net/2023/02/26/examining-github-security/
• Detection Engineering Demystified: Building Custom Detections for GitHub Enterprise
• https://www.rezonate.io/blog/github-security-guide-how-to-defend-your-organization-and-repositories-from-supply-chain-attacks/
• https://alsmola.medium.com/securing-github-organizations-9c33c850638
• https://wiki.mozilla.org/GitHub/Repository_Security

Actions:

• https://openssf.org/blog/2024/08/12/mitigating-attack-vectors-in-github-workflows/
• https://engineering.salesforce.com/github-actions-security-best-practices-b8f9df5c75f5/
• https://media.defense.gov/2023/Jun/28/2003249466/-1/-1/0/CSI_DEFENDING_CI_CD_ENVIRONMENTS.PDF

[ramimac]

Tools for Github Posture Management:

• https://github.com/reposaur/reposaur
• https://github.com/crashappsec/github-analyzer
• https://github.com/Legit-Labs/legitify
• https://github.com/ossf/allstar

Tools for Github Actions Auditing:

• https://github.com/boostsecurityio/poutine
• https://github.com/AdnaneKhan/Gato-X
• https://github.com/woodruffw/zizmor

Tools for securing Github Actions:

• https://github.com/step-security/secure-repo
• https://github.com/step-security/harden-runner