Inadequate Identity and Access Management

Incidents (7)

Attack path techniques used

• Push directly, without review (Submit malicious code)
• Use a trusted colleague's account (Submit malicious code)
• Delete branches and workflow runs (Delete code or cover tracks)
• Push a release tag to an unreviewed commit (Point a release tag at a bad commit)
• Add a workflow that dumps secrets (Steal CI secrets and tokens)
• Steal a session and read secrets from a CI vendor (Steal CI secrets and tokens)
• Publish a malicious version with a stolen token (Poison the build or published package)
• Clone private repos with a stolen token (Read or expose private code)
• Flip private repos to public (Read or expose private code)
• Get an agent to copy private code into public (Read or expose private code)
• Add a guest collaborator or new app (Keep access)
• Forge a login (Take over the GHES appliance)

Checklist items

The fixes for those techniques, plus the items ghtier tags with this risk.

• Branch protection on default/release branches: required reviews + required status checks
• Rulesets applied: push restriction, tag protection, sensitive file-path protection
• Enforce MFA for every member (prefer hardware/FIDO2 keys over SMS or app codes)
• Require signed commits on the default branch of sensitive repos
• Enable audit logging and export it to a SIEM for retention and detection
• CODEOWNERS in place, required on sensitive paths
• Inventory every Actions secret and its visibility/scope; the results are usually surprising
• Cloud credentials migrated from static keys to OIDC federation, scoped to repo + branch
• Enforce an IP allow list for Git and web UI access from trusted ranges
• Write and rehearse a credential-rotation runbook before you need it
• Adopt artifact attestations for build provenance on published binaries/images
• Publish packages with trusted publishing (OIDC) instead of long-lived registry tokens
• Put production secrets in environments with required reviewers
• Set an organization-wide maximum PAT lifetime (90 days is a reasonable default)
• Disable classic PATs organization-wide, forcing migration to fine-grained PATs
• Audit and revoke stale PATs, unused SSH keys, and inactive accounts
• Restrict public repo creation, visibility changes, repo deletion, private forks and outside collaborator invites to owners
• Limit the number of organization owners to the minimum needed
• Review every currently installed GitHub App / OAuth App and its granted scope
• Keep OAuth app access restrictions on and require security/IT approval for new apps
• Run a quarterly access review of owners, repo admins, team membership and outside collaborators
• Disable password-based Git authentication (Enterprise Server only)
• Require MFA on bot/service accounts, not just human ones
• Migrate to SAML SSO / Enterprise Managed Users for centralized identity control
• Manage team membership from identity provider groups instead of by hand
• Set the organization's base repository permission to None or Read, not Write or Admin
• Use custom organization and repository roles instead of handing out Owner or Admin
• Service-account automation migrated from PATs to GitHub Apps

Permissions involved

The GitHub permissions those incidents abused.