M6 - GitHub Security & Administration

Account Security

Two-Factor Authentication (2FA)

Two-Factor Authentication (2FA) adds an extra layer of security to your GitHub account by requiring not only a password but also a second factor for verification. This second factor can be a code sent to your mobile device or generated by an authentication app. To enable 2FA on GitHub, navigate to your account settings, select 'Security', and then click on 'Two-factor authentication'. You can choose between SMS or an authentication app like Google Authenticator or Authy.

Key Points:

• Enhanced Security: 2FA significantly reduces the risk of unauthorized access.
• Backup Codes: When enabling 2FA, GitHub provides backup codes that can be used if you lose access to your second factor. Store these codes securely.
• Device Management: Regularly review and manage devices that have access to your account through the 'Security' settings.

Example Scenario: Imagine a scenario where a malicious actor gains access to your password through a phishing attack. With 2FA enabled, they would still need the second factor to access your account, thereby protecting your repositories and sensitive data.

Passkeys

Passkeys are a modern authentication method that simplifies the login process while enhancing security. Unlike traditional passwords, passkeys use cryptographic keys stored on your device, making them resistant to phishing attacks. When you log into GitHub using a passkey, the authentication happens through a secure connection between your device and GitHub, eliminating the need to enter a password.

Key Points:

• User-Friendly: Passkeys streamline the login process, making it easier for users to access their accounts without remembering complex passwords.
• Phishing Resistance: Since passkeys do not rely on shared secrets, they are inherently more secure against phishing attempts.
• Cross-Platform Compatibility: Passkeys can be used across different devices and platforms, making them a versatile option for authentication.

Example Scenario: Consider a developer who frequently switches between devices. By using passkeys, they can easily access their GitHub account on any device without the hassle of remembering or entering a password, while still maintaining a high level of security.

Identity Management

User Identity and Access Management

User Identity and Access Management (IAM) in GitHub involves controlling who can access your repositories and what actions they can perform. GitHub provides various roles and permissions that can be assigned to users, ensuring that only authorized individuals can make changes to your projects.

Key Points:

• Roles and Permissions: GitHub allows you to assign roles such as 'Owner', 'Admin', 'Maintainer', and 'Read' to manage access effectively.
• Teams: Organizing users into teams can simplify the management of permissions across multiple repositories.
• Audit Logs: Regularly review audit logs to monitor access and changes made by users, enhancing accountability.

Example Scenario: In a collaborative project, you may want to give developers write access while restricting testers to read-only access. By utilizing IAM features, you can ensure that each team member has the appropriate level of access based on their role.

User Authentication

User Authentication in GitHub is the process of verifying the identity of users before granting them access to repositories and other resources. GitHub supports multiple authentication methods, including passwords, OAuth tokens, and SSH keys.

Key Points:

• Password Authentication: While common, it is less secure than other methods. Always encourage the use of 2FA alongside passwords.
• OAuth Tokens: These tokens allow third-party applications to access your GitHub account securely without sharing your password.
• SSH Keys: SSH keys provide a secure way to authenticate to GitHub without using a password, especially useful for developers who frequently push code.

Example Scenario: A developer working on a private repository can use an SSH key to authenticate their local machine with GitHub, allowing them to push changes without entering a password each time, streamlining their workflow.

User Authorization

User Authorization in GitHub determines what actions authenticated users can perform within a repository. This is crucial for maintaining the integrity of your projects and ensuring that only authorized users can make significant changes. GitHub uses a role-based access control model to manage user permissions effectively.

Key Points:

• Branch Protection Rules: Implementing branch protection rules can prevent unauthorized users from pushing directly to critical branches, such as 'main' or 'production'.
• Pull Request Reviews: Require reviews for pull requests to ensure that changes are vetted before being merged into the main codebase.
• Fine-Grained Permissions: GitHub allows you to set specific permissions for different actions, such as read, write, or admin access, tailored to the needs of your team.

Example Scenario: In a software development team, you may want to ensure that only senior developers can merge pull requests into the 'main' branch. By setting up appropriate authorization rules, you can enforce this policy, maintaining code quality and stability.