5 tips for embedding security into your workflows

Now, more than ever, the world needs innovation. From climate change to pandemics to food insecurity, we face many pressing realities that businesses can help us solve. Especially tech-related businesses. Technology can help drive progress on devastating conditions—like how Biorock can help restore coral reefs, or how implantable glucose sensors can change the lives of people with diabetes.

But there’s one weed that’s been creeping all over the innovation garden: cyberattacks. As cyberattacks increase and become more sophisticated, it has become harder for organizations to build and ship software quickly. From 2020 to 2021, vulnerabilities increased by a staggering 33%.¹ This chips away at businesses’ much-needed innovation superpowers.

Here at GitHub, we want to help your business thrive. We’re sharing five tips on how you can embed security into your developers’ workflows. This will empower you to gain the upper hand on cyberattacks, so you can ship quickly and innovate with ease.

#1 Keep your security tools close to your code

Research has shown that developers are more productive when their tools are where they code.² But these days, developers typically use disparate, third-party apps to test their code after the software’s already been built, which costs money and wastes time. You need a platform that provides all the necessary security tools right where the code is being created.

Thankfully, GitHub makes this easy. Our security suite for enterprises, GitHub Advanced Security (GHAS), enables developers to find and fix vulnerabilities in real time—as they’re coding. For instance, code scanning findings are shown directly in your VS Code or Codespaces so you can fix where you build.

#2 Replace a reactive security approach with a proactive one

A reactive security approach is when teams respond to past and present threats. A proactive approach prevents issues from happening in the first place. After all, it’s much more effective to prevent attacks instead of trying to undo damage after the fact. Today, most organizations approach security in a reactive way and the results aren’t pretty: security problems usually take longer than six months to remediate.³

GitHub makes proactive security simple. GHAS’ secret scanning tool prevents fraudulent use of accidentally committed secrets by scanning for partner patterns on public and private repositories. And now, you can proactively prevent leaks by scanning for secrets before a Git push is accepted. This action checks for high-confidence secrets and blocks the push if a secret is identified. Additionally, you can proactively hunt for vulnerabilities with GHAS’ code scanning CodeQL tool. View, triage, understand, and resolve any problems in your proprietary code. Together, these tools make it even easier to make security proactive and innovate with speed.

#3 Get your signal-to-noise ratio right

While security tools are needed, they often cause more headache than help. This is because the aforementioned third-party security apps most organizations use are slow, create noise, and may not be integrated into the native developer environment. These solutions hamper productivity and create frustration, and developers often end up turning them off.

But GitHub has your back. With GHAS’ secret scanning, you can create custom patterns that allow you to test the kind of noise you’ll receive before you make the alerts. This ensures that your developers only get security notifications that are helpful and important. Similarly, with Dependabot, the supply chain security tool for developers, you can prioritize vulnerable calls so you only receive the notifications that are important to you.

#4 Enable security feedback where you collaborate

Collaboration is super important for quality software. But equally important is being able to check for security issues before merging a teammate’s contribution. Especially when teams are large and many pieces of code are being proposed, you need the ability to easily scan new contributions and suggestions.

GitHub and GHAS allow for just this. When configured, code scanning can check your code in the pull request. You’ll be informed if merging changes will introduce new security issues to the target branch. The alerts are reported in multiple places, such as the conversation or files changed tabs of the pull request. This makes secure collaboration a breeze.

#5 Automate your security process

For developers, automation is the name of the game. As we’ve seen lately with the explosion of DevOps, automating processes and removing manual, tedious tasks enable developers to build and ship software quickly. Now, more than 80% of top-performing engineering teams deploy software multiple times per day.⁴Automating your process will empower you to play in the big league and accomplish your goals.

And lo and behold, GHAS can help. In GitHub, you can automate several common security and compliance tasks, in addition to automating the traditional build, test, and deploy CI/CD ones. For instance, you can automate tasks that demonstrate your resource compliance to auditors. You can also use the ghascompliance action to set alert policies for code scanning around license compliance. At the end of the day, automating your process will make your security efforts consistent and repeatable.

Wrap‐up

When it comes to innovation these days, having a robust security plan is key. We hope these ideas inspire you with ways that you can beef up your security—so your business can innovate and reach its full potential. The world is counting on you!

¹ IBM, X-Force Threat Intelligence Index 2022.
² GitHub, 2021 State of the Octoverse.
³ Security Magazine, Security leaders must proactively remediate vulnerabilities to combat modern threats, 2022.
⁴ Humanitec, DevOps Setups: A Benchmarking Study, 2021.