|
| 1 | +# Lab 6 - Hands-on with Security Overview |
| 2 | + |
| 3 | +We've covered how to review alerts in a single repository, but how is your org or team doing? Next, we'll check out the Security Overview at the organizational level to see how we can get a high-level view of the security posture of our organization. |
| 4 | + |
| 5 | +This lab covers parts of the following exam domains: |
| 6 | + |
| 7 | +- Domain 6: Describe GitHub Advanced Security best practices |
| 8 | + |
| 9 | +## Exercise 1: Navigating to Security Overview |
| 10 | + |
| 11 | +The Security Overview can be used by anyone inside of an organization; it shows repositories that you have access to. If you are an org owner or a security manager, you would see all alerts. If you are a regular org member, you would only see alerts for repositories by default that you have write access to. |
| 12 | + |
| 13 | +> [!NOTE] |
| 14 | +> Security alerts for a repository are visible to people with write, maintain, or admin access to the repository and, when the repository is owned by an organization, organization owners. You can give additional teams and people access to the alerts. |
| 15 | +
|
| 16 | +1. Navigate to the organization. You can do so by **clicking on the org name** (`ghuwsec1953`) in the repository breadcrumbs in the upper left hand corner. |
| 17 | + - You can also navigate to your orgs by clicking on your profile picture and "**Your organizations**" |
| 18 | +2. Click on the **Security** tab. |
| 19 | +3. Review (and click on!) the different views on the left-hand side: |
| 20 | + - Overview: visualize trends in Detection, Remediation, and Prevention of security alerts ([docs](https://docs.github.com/en/enterprise-cloud@latest/code-security/security-overview/viewing-security-insights#about-security-insights)) |
| 21 | + - Risk: explore the risk from security alerts of all types or focus on a single alert type and identify your risk from specific vulnerable dependencies, code weaknesses, or leaked secrets ([docs](https://docs.github.com/en/enterprise-cloud@latest/code-security/security-overview/assessing-code-security-risk)) |
| 22 | + - Coverage: assess the adoption of code security features across repositories in the organization ([docs](https://docs.github.com/en/enterprise-cloud@latest/code-security/security-overview/assessing-adoption-code-security)) |
| 23 | + - Enablement trends: see how quickly different teams are adopting security features |
| 24 | + - CodeQL pull request alerts: assess the impact of running CodeQL on pull requests and how development teams are resolving code scanning alerts ([docs](https://docs.github.com/en/enterprise-cloud@latest/code-security/security-overview/viewing-metrics-for-pull-request-alerts)) |
| 25 | + - Secret scanning: find out which types of secret are blocked by push protection and which teams are bypassing push protection ([docs](https://docs.github.com/en/enterprise-cloud@latest/code-security/security-overview/viewing-metrics-for-secret-scanning-push-protection)) |
| 26 | + |
| 27 | +> [!TIP] |
| 28 | +> You can export a CSV of nearly from most of these views using the **Export CSV** button in the upper right. |
| 29 | +
|
| 30 | +4. Under the **Overview** view, navigate the sub-views, specifically **Detection** and **Remediation**. |
| 31 | + - Note the trends - this is useful information to evaluate the security posture of your organization. Are we getting better over time? |
| 32 | + - Being secure requires "constant vigilance" |
| 33 | +5. Navigate to the **Risk** view. |
| 34 | +6. On the right-hand side, click the **Teams ▾** button/dropdown. |
| 35 | +7. Click on the **all users** team - this team is only added to a different sample repo, so note how the total alerts changes. |
| 36 | + - This can be really useful for a manager, architect, or developer to see which repositories assigned to the teams have security features enabled and how many alerts they are generating. |
| 37 | +8. At the bottom of the options on the left, you will see **Security Campaigns**. |
| 38 | + - Security campaigns are a new feature designed to help administrators and security managers create targeted campaigns and track remediation progress effectively. |
| 39 | +9. ⚠️ Please don't create a new security campaign as to not introduce noise to your fellow attendees ⚠️, but click on the existing campaign here (**SQL injection (CWE-89)**) to check it out! |
| 40 | + - How are we doing on our goal? |
| 41 | + |
| 42 | +## Summary |
| 43 | + |
| 44 | +That's the security overview! Use these views to monitor and manage your security posture effectively. By leveraging the detailed insights provided in each section, you can identify potential threats, take proactive measures, and ensure your systems remain secure. |
| 45 | + |
| 46 | +If you want to learn more about the security overview or about what a particular view shows, check out the [docs](https://docs.github.com/en/enterprise-cloud@latest/code-security/security-overview/about-security-overview)! |
| 47 | + |
| 48 | +Congrats, you have finished all of the main labs! 🎉 If you have time or are up for a challenge, try out the extra credit labs! |
| 49 | + |
| 50 | +➡️ Head back to the [labs](README.md) page to try your hand at the extra credit labs. |
0 commit comments