World's Fair 2024
GitHub's AI Powered Security Platform: Sarah Khalife
Overview
This talk focuses on how GitHub is integrating AI into its Advanced Security platform to enhance developer productivity and security. The core thesis is that AI can significantly improve the identification and remediation of security vulnerabilities and secrets, making security a more integrated and less burdensome part of the daily development workflow. By embedding AI capabilities directly into the platform, GitHub aims to bridge the gap between security teams and developers, fostering a shared responsibility for application security.
Who should watch
- AI Engineers
- Product Managers
- Developers looking to improve security practices
- Security Engineers
- Builders working with code and sensitive information
- Those interested in the application of AI in security tooling
Key takeaways
- GitHub is integrating AI across its platform, not just within Copilot, to enhance collaboration, productivity, and security.
- GitHub Advanced Security offers tools like code scanning (using CodeQL), secret scanning, and supply chain security (Dependabot).
- Secret scanning is highlighted as a critical feature, with AI being used to improve the detection of custom secrets and unstructured passwords, reducing false positives.
- AI is being introduced to automate fixes for detected vulnerabilities, providing suggestions directly within pull requests.
- Custom pattern generation for secret scanning is being enhanced by AI, allowing developers to more easily define and scan for specific types of secrets.
- AI analysis is being employed to identify true positives for unstructured passwords, making it easier to revoke or rotate exposed credentials.
- The platform provides visibility into security coverage across repositories, helping teams understand where scanning is active and where gaps exist.
- AI-powered auto-fix for code scanning is in public beta and has shown success in resolving a significant percentage of vulnerabilities.
Notable quotes
*Security I feel like hasn't been talked about as much in terms of how can we improve AppSec with AI rather than just how do we talk about security around AI.*
*Secret scanning is a lifesaver in many, many cases.*
*The faster you're able to fix vulnerabilities, the faster you're able to be a little more productive.*
Unofficial community note. Prefer the recording for nuance.