thesqlpro / security-strategy-essentials Goto Github PK

🎉 Welcome to security strategy essentials!

In this course, you'll learn how to build and host a secure repository in GitHub. A secure repository is important for many reasons, including:

• Prevents exposing sensitive data
• Enforces secure development best practices
• Guards against unintended access rights and permissions

In this course you will learn how to:

• Opt-in to security alerts for private repositories
  • Note: Vulnerability monitoring and security alerts are enabled by default for public repositories that are not forks.
• Fix vulnerable dependencies when notified by a security alert
• Automate security fixes with Dependabot
• Follow security best practices to protect sensitive data by using a .gitignore file
• Remove sensitive data and files committed to a repository

New to GitHub?

For this course, you'll need to be comfortable with the GitHub Flow. If you need a refresher on the GitHub flow, check out the the Introduction to GitHub course.

Step 1: Your project on GitHub Pages

This project is centered around a memory game that will be deployed with GitHub Pages.

⌨️ Activity: Enable GitHub Pages

1. Click the Settings tab in your repository.
2. Scroll down to GitHub Pages. Select master as a Source, and click Save.

Turning on GitHub Pages creates a deployment of your repository. I may take up to a minute to respond as I await the deployment.

---

Return to this issue for my next comment.

Sometimes I respond too fast for the page to update! If you perform an expected action and don't see a response from me, wait a few seconds. Then refresh the page for your next steps.

Finding vulnerable dependencies

Security vulnerabilities can cause a range of problems for your project or the people who use it. A vulnerability could affect the confidentiality, integrity, or availability of a project. Sometimes vulnerabilities aren't in the code you write, but in the code your project depends on. Staying up-to-date with the most recent versions is the best line of defense, but has the potential to cause integration issues, so GitHub alerts you of the safest next-version of a dependency.

This repository has some existing dependencies which will need updating to stay secure.

How can we identify dependencies and if they are vulnerable?

---

This repository is a Node.js project utilizing NPM. Because of that, package.json defines this repository's dependencies. For our time together, we'll be focusing on these JavaScript dependencies. Keep in mind that different programming languages may have different dependency manifests. You might work with a Gemfile, Gemfile.lock, *.gemspec, requirements.txt, pipfile.lock, or other files.

How can we know these dependencies are secure? GitHub monitors a number of reputable data sources to track vulnerabilities across projects.

---

GitHub's security alerts for vulnerable dependencies

You may notice some alerts from GitHub about this repository. You may get an email, or see a yellow bar warning you about the package.json file.

GitHub tracks vulnerabilities for a number of supported languages and their associated package managers, including RubyGems, NPM, Python PIP, Maven, and Nuget.

GitHub receives a notification of a newly-announced vulnerability. Next, we check for repositories that use the affected version of that dependency. We send security alerts to a set of people within those affected repositories. The owners are contacted by default and it's possible to configure specific teams or individuals to get these important notifications.

GitHub never publicly discloses identified vulnerabilities for any repository.

Step 2: Find this repository's vulnerable dependencies

Use GitHub's security alerts to identify a vulnerable NPM dependency.

⌨️ Activity: Identify the suggested version update

1. Click the Insights tab in your repository.
2. On the left hand navigation bar, click Dependency graph.
3. Scroll down until you see a yellow bar highlighting the dependency named debug, and click on the right hand side of the yellow debug section.
4. Take note of the suggested version.
5. Comment in this issue with the suggested update version.

GitHub Enterprise Server only: This is all possible on GitHub Enterprise through GitHub Connect. It may take up to an hour to refresh the alerts and make them visible. After waiting a reasonable amount of time, if you are still not seeing the yellow bar in the Dependency Graph, you may want to contact your administrator. In the mean time, to move along with the course, we'll give you a hint - the recommended upgraded version is 2.6.9.

---

Return to this issue for my next comment.

Adding a security policy

Just like most repositories have a README.md file to provide instructions on how to contribute to the repository, a SECURITY.md file highlights security related information and instructions on how to handle security related issues and best practices.

This gives collaborators the important security information they need, but it also documents a place where maintainers can think about how they should deal with security disclosures, updates, and general security practices within this repository.

What should I include in my security policy?

Just like a README.md file, it really depends on your repository and the requirements and workflows. Here are a few common topics that are documented in a security policy:

• Supported versions
• How to responsibly report a security vulnerability
• Security related configuration
• Known security gaps and future enhancements

Step 6: Add a SECURITY.md file

1. Navigate to the Security tab
2. Click on Policy located in the left sidebar
3. Click the Start Setup button
4. Commit the template security policy to the new branch as selected thesqlpro-patch-1
5. Commit the new file and create the pull request

---

I'll respond in your pull request with next steps.

Automated dependency updates with Dependabot

Manually going through your dependencies for alerts and outdated versions is tedious work. Let's automate this process!

Meet Dependabot

Dependabot creates pull requests to keep your dependencies secure and up-to-date!

How does Dependabot work?

Dependabot is the actor for GitHub's automated security fixes.

1. GitHub uses the dependency graph and security alerts to scan your repository and notify you of potential dependency updates
2. If any dependencies are out-of-date, Dependabot opens a pull request to update each one
3. If tests pass, and the updated version looks good, you simply merge the pull request

Configuring automated security fixes

You can enable automated security fixes for any repository that uses security alerts and the dependency graph. You can disable automated security fixes for an individual repository or for all repositories owned by your user account or organization. GitHub will automatically enable automated security fixes in every repository that uses security alerts and the dependency graph.

Here, we have a security alert on the debug dependency. Clicking on debug will show you the pull request created by Dependabot to update the dependency. We just updated to 2.6.9 but Dependabot noticed we are still outdated.

If you navigate to your pull requests, you'll notice Dependabot has done its job and is trying to bump, or update, the version of debug. Feel free to approve and merge the pull request.

How to Install Dependabot if not enabled through automated security fixes

• Navigate to Dependabot on the GitHub Marketplace
• Click the "Install it for free" button
• Follow on-screen instructions to add Dependabot to your GitHub profile
• When installing Dependabot, choose Only select repositories and choose this repository, https://github.com/thesqlpro/security-strategy-essentials
• On app.dependabot.com, under repos you want to add, select https://github.com/thesqlpro/security-strategy-essentials and click the Add selected button

Important Note!

Dependabot is owned and maintained by GitHub. Dependabot Preview is a public beta for functionality that we are integrating directly into GitHub. These automatic security fixes are in beta and are subject to change.

Close this issue when done

---

I'll respond below when you close the issue.