Open Source Summit North America 2023

As an Open Source Program Office (or OSPO) you typically have projects hosted on a platform like GitHub or GitLab. The key question is, how do you manage the organizations, members and repositories in a way that is secure and encourages collaboration? F5's fledgling OSPO took on a project to standardize how their GitHub assets were organized. This was important given many recent acquisitions with open source organizations and repositories that were often configured differently. Sharing the lessons learned from that standardization work is the focus of Christine's talk. Christine will cover common security risks and mitigation strategies available through access and permission controls at the GitHub organization, team, and membership level. Additional topics will include code review best practices, dependency management, code scanning, and vulnerability reporting. Christine will share some open source tools that she found helpful in this work. Whilst this talk centers on GitHub, many concepts can be extended to other source code management platforms. Attendees will leave with a deeper understanding of the importance of secure code management and a set of actionable steps they can take to secure their own GitHub repositories.