Secure softwaredevelopment
strategy essentials
Secure software development strategy essentials — 1

Table ofContents

2

INTRODUCTION

4SAFEGUARDING CUSTOMER DATA
Build a culture of security
Always encrypt data
Encryption in transit
Encryption at rest
Encryption with GitHub
Adopt strong identity management practices
Using GitHub with identity management systems
Prevent database attacks
Segregate sensitive data
Preventing sensitive data from reaching repositories with pre-receive hooks
Enforce protections on source code

10

SECURING THE ENTIRE DEVELOPMENT PROCESS
Include legacy core systems
Automate processes to prevent bugs and errors
Integrating CI/CD with GitHub
Enforce manual reviews with required code review
Move security all the way left
Creating a security culture

16

CUSTOMER STORY: ANAPLAN18

SUMMARY
We’re here to help

Secure software development strategy essentials — 2

Introduction
Trust is the foundation of the relationship between

The good news is secure development doesn’t have tosoftware companies and their customers. The

be a barrier to collaboration or innovation. Businesses

ability to prevent sensitive data from falling into

today are uniquely positioned to create impactful,

the wrong hands is a cornerstone of this trust.

forward-thinking user experiences, and many of them

Globally, governments have responded with a variety

are doing just that. Thousands of organizations areof regulatory frameworks obligating companies

using GitHub to free their workflows from insular

to protect sensitive customer data, with severe

development and build secure processes that givesanctions imposed on firms that fail to do so. Failureengineering teams the flexibility to do their best work.

to properly safeguard data can have profound andlasting impact on a company’s reputation and their

With consumer expectations higher than everbottom line.

and increased pressure to lower costs, efficient,collaborative, and secure workflows can help teams

To make matters more complex, software has

shift focus to where it matters most: Building the best,

become a central component of businesses

most innovative software for their customers.

everywhere and will continue to increase inimportance. However, strict regulatory andIn this guide, we’ll outline the unique regulatory andcompliance requirements can govern the way teams

technical challenges that software companies face,build software, from the processes they follow to

how to address them, and how GitHub can help.

the tools they use. These requirements are often
prohibitive enough to compromise performanceand stifle innovation, particularly for companies
in highly regulated industries, such as healthcare,government, and financial services.
GitHub: How people build software

Secure software development strategy essentials — 3

Safeguarding
customer data
Today, customers share some of their most sensitive

There is no single solution or approach that candata with companies in online transactions andguarantee security. Instead, effective security relies onother data exchanges. Security teams are engaged

a layered approach, enforcing checks and safeguards

in a constant arms race with those trying to obtainat multiple points across data paths and workflows.

this data for criminal purposes—from individualThis layered approach includes a combination of tools,

hackers to state actors deploying considerable skill

practices, and culture.

and resources in their efforts to undermine security.
Fortunately, there are best practices and toolsthat can help companies secure their development
processes and keep sensitive data safe.

GitHub: How people build software

Secure software development strategy essentials — 4

Build a culture of security
A corporate culture that places security at the center of everything is key toenforcing security policies at scale. Creating a security culture means building
processes that make everyone’s job. Examples include regular training on secure
practices, highlighting the danger of social paths to infiltration like phishingattacks, as well as technical means. Specific best practices include:

SPECIFIC BEST PRACTICES INCLUDE:
Enforcement of password policies, including complex passwords,

Education and training regarding the dangers of public networks,

regular password changes, and the use of password managers

as well as the physical protection of devices like laptops, tablets,and generators to enhance password security

and cell phones.

Use of two-factor authentication

Use of VPNs to secure access to internal corporate networks

GitHub: How people build software

Secure software development strategy essentials — 5

Always encrypt data
One of the best ways to avoid unauthorized access to data is encryption.

ENCRYPTION AT REST

Even if a bad actor obtains access to data transmission, strong encryption

Some applications provide encryption services at the software layer. This sort

can render that success of little or no value. Again, employing a layeredof encryption is better than none but can bring significant costs in terms ofapproach is most effective when implementing an encryption strategy.

complexity and reduced performance. Encryption solutions that run as close to theThis means:storage hardware as possible, such as filesystem encryption or hardware appliancelevel encryption can provide a transparent layer of encryption for all applications.
Encrypting data in transit when it’s being transmitted
between a permanent store and an end user

ENCRYPTION WITH GITHUB
All communication to and from our self-hosted solution GitHub EnterpriseServer is protected by TLS with the option to use LetsEncrypt for inexpensive

Encrypting data ‘at rest’ in the databases where it’s stored

and simple certificate maintenance. GitHub also secures communication
between Git clients used by developers and the server using SSH. Both arestrong cryptographic protocols that present robust barriers to unauthorizedinterception or leakage of sensitive data.

ENCRYPTION IN TRANSITAs a standard practice, any web-based effort should employ end-to-end
encryption using modern encryption protocols such as TLS. TLS helps securecommunication using strong, certificate-based encryption that can beessentially unbreakable in any practical sense. TLS also verifies each party ina network transaction, preventing ‘man-in-the-middle’ attacks, where a bad
actor poses as a trusted partner in a transaction. Services like LetsEncrypthave greatly reduced the cost and complexity of implementing effective TLS
and obtaining the required certificates.

GitHub: How people build software

Secure software development strategy essentials — 6

Adopt strong identity
management practices

arbitrary execution of this code, resulting in data being unintentionally
returned to the user. These attacks are particularly dangerous because they
may not cause an error or other event that might attract the attention of IT
administrators overseeing security.

The more passwords users have to remember, the more likely they are todefault to insecure practices like writing passwords down or reusing easy-to-

Again, a layered approach is most effective in ensuring that only valid data entersremember (and thus easy to crack) passwords. Using a centralized identity

your environment. This begins with the code in the user interface and extends

management system like LDAP coupled with a Single Sign On (SSO) solution

throughout the datapath through middleware to underlying data stores. Building

can greatly reduce the number of passwords users have to manage, making it

validation into the code at each step can dramatically reduce your vulnerability

easier for them to follow sound password management practices.

to these sorts of attacks. A combination of frequent manual and automatedreviews and tests are critical to supporting this effort.

USING GITHUB WITH IDENTITY MANAGEMENT SYSTEMS
GitHub Enterprise supports authentication and authorization using a variety
of identity management solutions like Active Directory and LDAP. GitHub
also supports SAML, which allows enterprises to provide a Single Sign On
experience for users.

Prevent database attacks
Data entering an organization can be a dangerous vector that bad actors use
to attempt to gain access to your systems. Many of these strategies rely on
passing dangerous payloads to poorly designed systems, exploiting flaws
to gain control. SQL injection is a classic example, occuring when a bad actor
intentionally appends SQL code to seemingly harmless data like a customer

Three ways you can prevent common
vulnerabilities:•

Only accept validated data into production systems•

Monitor systems for errors and edge cases•

Restrict access to data systems of records as much as
possible by adopting an identity management systemname in a web application. Flaws in the underlying software can result in

GitHub: How people build software

Secure software development strategy essentials — 7

Segregate sensitive data
The fewer places sensitive data exists, the fewer opportunities (or less

After examining code, pre-receive hooks return only one of two possible“surface area”) attackers have available to exploit. Reducing surface areavalues: success, or failure. If it fails, developers will see a message informing

means implementing practices like storing passwords in a password manager

them that their commit failed, along with any other useful information yourrather than entrusting them to individuals and never committing passwords,

team chooses to include. The code is committed to the repository only if theaccess/API tokens, encryption keys, and other sensitive data to publicly

pre-receive hooks succeeds. The result? No unwanted code makes it to youraccessible repositories.

repositories, protecting your company from violations, liability threats, andpotential regulatory penalties.

Sensitive data should never be used or stored in non-production systems.
Of course, teams might require large amounts of data that reliably mimic thereal thing for testing, tempting some engineers to ‘refresh’ development andtesting environments with production data. Instead of using production data,consider using a tool that allows you to configure and then generate large
sets of dummy data. These allow reliable, realistic testing without risking
sensitive information.

PREVENTING SENSITIVE DATA FROM REACHINGREPOSITORIES WITH PRE-RECEIVE HOOKSIn addition to storing sensitive data separately, you can prevent the
inadvertent (or deliberate) committing of protected data to repositories withpre-receive hooks—simple scripts that run in an isolated environment on
the GitHub appliance. These scripts are triggered _before_ code is pushed to
GitHub to examine commits, identify sensitive information, and prevent it frombeing added to your repositories.

GitHub: How people build software

Secure software development strategy essentials — 8

Enforce protections on source code
Effective security requires controlling access to sensitive information and the source code forthe software that manages it. Granular controls mean you can effectively protect this information
without creating a security-bound environment that denies access too comprehensively. GitHub
can support your access policies with protected branches. Protected branches help maintain the

Steps you can take toprotect your customer’s mostimportant information:

integrity of your code by limiting several features of Git on any branch an administrator chooses
to protect. For example, administrators can restrict who can post to a branch to specific users and•Use secure connections everywhere (noteams programmatically. They can also disable force pushes that might change or delete code on

excuses!) and only transfer data using

certain branches. Additional safeguards include:

protocols like SSH and SFTP•

ADDITIONAL SAFEGUARDS INCLUDE:

Never commit passwords, access/API
tokens, encryption keys, and more to
publicly accessible repositories.

Preventing deletion of a branch

Requiring manual, auditable•

reviews from one or more people

Use protected branches and pre-receive
hooks to account for human error andprotect sensitive data from making itto production

Preventing code which fails automatedSpecifying ‘codeowners’ for any

testing and Continuous Integration (CI)part of a codebase and requiring

access and make sure only the rightchecks from being merged

their review

people have access to sensitive data

GitHub: How people build software•

Use an identity solution to restrict

Secure software development strategy essentials — 9

Securing the entire
development processYour software codebase and the development

the cost of updating them against the potential risks ofprocesses that shape the way your team builds

causing a security breach. Replacing a legacy system

are at the center of a layered security strategy. As

may not seem cost-effective until the threat of fines indevelopers work together and contribute changes,

the billions of dollars or a devastating security breachit’s important to put certain safeguards in place

destroying public goodwill are included in the equation.

through a combination of best practices and GitHubfeatures that make sure the code that reaches

SELECTING A MAINFRAME SYSTEM

production is secure.

GitHub’s partner ecosystem includes many vendors
producing, selling, and maintaining mainframe systems.

Include legacy
core systems

For example, IBM recently announced extensionsfor Git, the technology underpinning GitHub, thatallow modern DevSecOps practices to be applied tomainframe development workflows. Find integrations
to power your GitHub.com workflow on GitHub

Tools like mainframes remain central to someMarketplace or learn more about which apps work withcompanies' operations more than 50 years after

our self-hosted solution GitHub Enterprise Server attheir initial introduction. These systems provide

github.com/works-with.

unparalleled capabilities but can also pose uniquechallenges to secure. Development teams should
periodically evaluate all legacy systems and balance
GitHub: How people build software

Secure software development strategy essentials — 10

Automate processes to prevent bugs and errors
Manual oversight is a critical component of an

Implementing automation isn’t difficult—and it

effective, layered security strategy. However,can yield immediate and measurable results. In aoverreliance on people can be dangerous. People get2017 study, the IEEE found that organizations that

tired, become distracted, or simply make mistakes. Put

implemented automated dependency management, forpeople to work where their skills are most important,example, had 60 percent fewer security vulnerabilities

and delegate repetitive, tedious, yet still critical tasks

in their delivered software than those which did not.

to machines. Your team can leverage fully automatedContinuous Integration and Delivery (CI/CD) in yourGitHub workflows.

organizations that
implemented automateddependency management,
for example, had 60 percent
fewer security vulnerabilities
in their delivered software
than those which did not.

GitHub: How people build software

CI/CD tools test and evaluate your code every single time
a commit is pushed to a repository. With CI/CD in place,
GitHub can test new code with existing production
code to ensure the proposed changes work as intended
and do not introduce security flaws into existing
systems. These tests can also extend to examining all
the code that your code depends on (its dependencies).

Secure software development strategy essentials — 11

INTEGRATING CI/CD WITH GITHUB
Integrating CI/CD is easy with GitHub, and it won’t affect developers’ existing
workflows unless an automated test result requires them to take action. The
less intrusive automation is for developers, the more likely it is to be widelyadopted and its benefits felt across an organization.
GitHub integrates with a variety of CI tools like Jenkins, Travis, and CircleCI. These
automatically fetch code from a GitHub repository every time code is pushed, run

Integrating security tools and workflows
Hundreds of tools integrate with GitHub—and many of them canhelp you keep your code and customer data safe.
•build and test code as you push it to GitHub, preventing bugs

tests, and return the results to GitHub with either a pass/fail status. They also

from being deployed to production

return notifications on the status of each test, so developers can see where
their code is failing. And with the Checks API, teams can build sophisticated•custom tools for CI that make feedback seamless and richly informative.
Learn more about the Checks API
You and your team can decide whether or not you’d like the results of CI tests to

CI: CI tools like Travis CI, CircleCI, and AppVeyor automatically

The Checks API: Teams can create sophisticated custom toolsthat report on exactly the data and feedback you need•Error reporting: Tools like Snyk, Sentry, and Dependabot help
your team find, fix, and prevent vulnerabilities•

Code quality: Code Climate and Codacy automate reviews

prevent code from getting merged into the code base or simply alert developers

with security and quality checks to prevent human error andwithout taking action. If CI statuses are required, the pull request can only be

streamline your team’s code review processes

merged when all required CI jobs complete. If you choose to prevent merging,
the pull request can’t be merged until the required tests return successfully.

Ready to see what kinds of tools are available to your team? Visit
GitHub Marketplace at github.com/marketplace or browse
github.com/works-with

GitHub: How people build software

Secure software development strategy essentials — 12

Enforce manual reviews with required code review
Automation is important, but manual review of code will always remain a critical component of your security
strategy. The more eyes on a given codebase, the more likely errors or vulnerabilities are likely to be detected.
Reviews also serve a valuable function beyond security, helping ensure that institutional knowledge is shared andproviding learning and mentoring opportunities for developers of all skill levels. The result of regular, organizationsanctioned reviews is a codebase that is not only more secure but also healthier and more consistent.

Three steps to take tohelp your team prevent
bugs and errors:
1.

GitHub provides a flexible framework for mandating code reviews. You can:

Build in automated security
scanning to reduce human error,
test for weaknesses that may not
be introduced otherwise, and save

Require reviews from one or more users

Empower reviewers to provide

with write access to the repository

detailed, line-by-line feedback on

containing the changes

any proposed changes

developers time
2. Integrate automation directly into
your team’s GitHub workflow withstatus checks

Require additional review and

Ensure that all reviews are logged

approval by one or more codeowners.

and auditable in the future

Codeowners can be any combinationof individual users or teams assigned

3. Ensure all of your team members
feel an equal and shared
responsibility for building andmaintaining secure software

specific responsibility for a section ofa codebase, a particular technology, or
any combination of the two

GitHub: How people build software

Secure software development strategy essentials — 13

Audit and compliance-proof your workflow
The regulatory standards under which some companies work today require a robust logging and auditing
capability. Not only do teams need to create an effective security strategy, they also have to prove they’vedone so to regulators. GitHub provides flexible and powerful logging, auditing, and reporting frameworks
to help ensure compliance and the ability to prove it.

AUDIT LOGGING:BLOCKING FORCE PUSHES:

GitHub Enterprise maintains comprehensive logs of user

Git allows developers to rewrite commit history by ‘force

and system activity. Audited activity includes every `git

pushing’ changes. While sometimes necessary in orderpush` operation, including who initiated the push, their IP

to fix mistakes, this capability presents a challenge

address, and repositories affected by the operation. Logs

when regulations require data to be immutable. GitHub

can be forwarded to an external system (like Logstash

Enterprise allows administrators to block force pushes

or Splunk) for analysis, reporting, and storage, ensuring

for individual repositories or for the entire appliance,compliance with regulatory requirements

ensuring commit history can never be rewritten

ARCHIVING REPOSITORIES:
Repositories that are no longer maintained can bearchived and set to ‘read-only’ mode. This ensures that no
new code can be committed to the repository while stillallowing users to view its content

GitHub: How people build software

PREVENTING USERS FROM DELETINGREPOSITORIES:The ability to delete repositories can be restricted
to administrators

Secure software development strategy essentials — 14

Move security all the way left
In the past, security was all too often an afterthought. In fact, the protocols

CREATING A SECURITY CULTURE

which run the internet were not designed with security in mind _at all_. Bolted-

DevSecOps is a way of thinking about security throughout the development

on aftermarket security is better than nothing, but far from sufficient in today’s

cycle and distributing it across teams and roles. It no longer makes sense forfrenzied threat environment. To be effective, security must be built into every

security teams to join the process after an application is built, only to discoversoftware project from its very inception. Moving security left means shifting

exploitable flaws. With security experts closely aligned from the start, teams cansecurity from the right-hand side of your timeline, near delivery, all the way tocreate collaborative processes that proactively support security as they build.

the left, at the beginning. This ensures that security remains front and center
throughout the entire product lifecycle.

DevSecOps principles may require organizations to shift their team culture in
addition to their infrastructure, but more reliable software and fewer surprises

Involving security teams early can also influence design, development, andare worthwhile results. Some companies even invite security specialists into

maintenance decisions before they become too difficult and expensive

scrum teams to make sure it’s a priority throughout the process.

to change. This advice is simple enough, but process means very little if
leadership and engineering teams aren’t on board. Secure development
requires everyone to adopt an effective security culture.

GitHub: How people build software

Secure software development strategy essentials — 15

Customer story:
AnaplanAnaplan helps businesses make smart, data-driven
decisions with advanced modeling software. Witha focus on speed, flexibility, and integrity, Anaplan
supports planning at more than 500 companies—
helping them stay nimble, discover opportunities, andplan for their futures.
Behind its smart platform is a huge amount of data.
Anaplan's 150+ developers need to create a platform
that’s both flexible enough to make that data
meaningful to businesses across industries, while“Compliance is a very big deal, and webuilt a lot of tooling to make sure we’rebulletproof. All commits are taggedwith JIRA IDs that link everything
together, including all of our developer
tools. GitHub has made a huge impact
on compliance, while helping us
become more transparent."
JON SANDLES,

Release Manager, Anaplan

ensuring that data is secure enough to keep it private.
Their customers trust Anaplan to store sensitive
financial plans in its own data centers. As a result,the company has rigorous compliance and security
requirements in place to ensure the safety and privacyof regulated financial data.
To help their teams build a flexible, forward-thinking
platform, Anaplan uses GitHub Enterprise Server.
GitHub: How people build software

Secure software development strategy essentials — 16

At the heart of the Anaplan’s build and deployment pipelines are a set of
automated tools that leverage the GitHub Enterprise API to regularly queryand poll, and produce reports and alerts across all repositories. These keep
the product team in tune with what's going on by emailing developers, creating
reports in Confluence, and updating JIRA and Slack channels.
Product Managers are informed if code is checked into the wrong repositories
against incorrect JIRA projects. Engineers are kept informed if pull requests
are left open for too long. Code is scanned continuously by tools like Sonar andFour key features convinced Anaplan that
GitHub offered the best solution:
1.

Protected branches: Developers can ensure codethat processes data comes from a known source andgets reviewed

2. Hard tokens: Developers can keep access tightly

Checkmarx; deployment appliances like Chef scripts get the same treatment.

controlled by using two-factor authentication with hard

Everything that goes to production follows the same pipelines.

tokens behind a VPN

At any point in time, especially near production deployment, the releaseand program management team are fully up to date on codebase complianceand readiness.

3. JIRA integration: Developers can attach all pull requests
and commit comments to JIRA IDs that document whether
changes are approved and tested
4. Documentation versioning: Programmers can create andhost documentation as close as possible to the applications
5. Security: the platform is hosted on internal servers;
Enterprise Server uses the enterprise directory to manage
authentication and logs all user and system activity

GitHub: How people build software

Secure software development strategy essentials — 17

Summary
Keeping data safe has never been more critical

Too much, on the other hand, can stifle creativity

to the success, even survival of your business.

or encourage people to avoid your security

Implementing effective security might seem

efforts altogether. Tools like GitHub provide

overwhelming, but it doesn’t have to be. One of theyou with the controls you need to help find that

advantages of a layered defense is to break up thebalance for your organization.

task of implementing security into multiple, lessdaunting sub-projects. The most important thing to

Ultimately our goal is to help you transform your

do is to start, or if you’ve started, continue to test,

perception of security beyond a threat and into

examine, question, and improve. Attackers neveran opportunity to build customer satisfaction,

rest, and neither can you.

attract new customers, and further differentiate
your business. Good security pays off in customer

Part of the challenge in implementing effective

trust—and partners like GitHub can help you on

security lies in balancing it with the freedom thatyour way to an effective security strategy.

software developers need to innovate, thrive, and be
productive. Too little security is simply ineffective.

GitHub: How people build software

Secure software development strategy essentials — 18

Key takeaways:
1.

Your data are under constant attack. A breach can have very serious

We’re here to help

consequences for your business and, increasingly, for you personally
2. There is no magic fix for security. Instead, a layered defense
comprised of multiple tools, processes, and practices is much more
resilient and effective
3. Effective security requires an effective security culture. Security
must be a stakeholder in every important initiative and decision
4. Encrypt everything—no exceptions
5. Use a multi-layered approach to vet and validate all data entering
your systems to prevent malicious attacks like SQL injection
6. Plan for and include older, but still mission-critical systems like
mainframes. Include the possible costs in terms of fines, civil liability,
and lost goodwill when evaluating and upgrading legacy tools
7. Leverage automation where you can, particularly for software testing

GitHub: How people build software

GitHub supports building robust, secure code. Ready to explore
how GitHub fits into your secure development process?

Ready to try GitHub?
Get started today.