Hands-on workshop GitHub Code to Cloud

In this Hands-on workshop we will teach you how to use all the great features GitHub has to offer. We will start with an overview how to come from Idea to Code by using GitHub Discussions, Issues, Pages and Wiki. Next we will move the idea's to code and start using the Git features. From here we dive in to the use of Branch Protection Rules, Code Owners, Actions for CI, CD and Deployments to the Azure Cloud. We will also have a look at how GitHub can help you in your Secure Development Lifecycle with Credential scanning, Package Vulnerability Scanning and Code Scanning to expose programming mistakes that might lead to vulnerabilities in the future. After this Hands-on workshop, you know what GitHub has to offer to you and your organization to implement Secure and Compliant DevOps with ease.

Protect your code with GitHub security features

Creating modern software has a lot of moving parts. We all build on top of the shoulders of giants by leveraging closed/open source packages or containers that other people have shared. That makes securing our software a lot more complex as well!

In this session you'll learn what possible attack vectors you need to look for, how to protect yourself against them and how to leverage GitHub's features to make your life easier!

Topics:
- Signed Commits
- Dependabot updates
- Dependency scanning for known vulnerabilities
- Secret scanning (and revoking) out of the box
- Using CodeQL

How to use GitHub Actions with security in mind

When working in the real world with continuous integration / continuous deployment, you have to take care of your pipelines and the things they have access to.

- Who can push code into to an environment?
- Who could read and change the connection strings to the database?
- Who can create new resources in your cloud environment?
- Do you trust your third party extensions?
- What part of the network does your pipeline have access to?

I'll go over each of these aspects of your GitHub Actions Workflows and show you what to look for and how to improve your security stance without locking every DevOps engineer out.

Target audience: DevOps engineers on GitHub

Protect yourself against supply chain attacks

As an industry, we are using third party packages and building components for lots of things. In this supply chain, there are lots of places for vulnerabilities. They can then be used to attack your DevOps pipelines!

In this session, I will go over some common attack examples and show you a way to prevent them from happening. There are frameworks available in the industry that guide you through the process of becoming more mature in protecting not only your source code and application but also the packages you use and the pipelines you build them with. I'll demo some of GitHub's features that help preventing these types of attacks

Given at NDC Security in Oslo - April 2022

GitHub Actions: beyond CI/CD

With GitHub Actions you can do so much more then just CI/CD! I’ve validated the links on my blogposts, automated my issue management and provided easy configuration of my trainings that sets up entire environments for the attendees!

Join this session for more examples how you can use GitHub Actions to make your life easier!

Brand new session!