Skip to content
Playbook

Getting started

Just became a Security Champion? Congratulations! 🎉

You may be wondering what it means in practice. Here are some tasks to get you started. You don’t have to do them all at once or in this order.

Get an overview of the team’s systems

Section titled “Get an overview of the team’s systems”

You can’t secure what you don’t know about. Start by finding out what the team is responsible for.

Task: map the team’s systems

  1. Find the team’s systems in Backstage.
  2. Compare with the repositories the team owns on GitHub and what is actually running on Vercel, Azure and Dokku.
  3. Add anything that’s missing to Backstage, or ask the person who knows the system to do it. See Backstage.

Check for vulnerable dependencies

Section titled “Check for vulnerable dependencies”

Most of the code in a typical application is written by someone else, so the security of third-party code matters at least as much as our own. Read more in Dependency Management.

Task: GitHub security settings

  1. Check that Dependabot alerts and version updates are enabled on every repository the team owns, with a dependabot.yml that has a cooldown.
  2. Go through open Dependabot alerts in the Security tab of each repository.
  3. Fix vulnerable dependencies, or agree with the team on when they will be fixed. 🥷

Harden the repositories

Section titled “Harden the repositories”

Task: check the team’s repositories against the GitHub guideline

  1. Check that the default branch is protected, as described in GitHub.
  2. Run zizmor against each repository’s .github/workflows and fix what it finds.
  3. Check that private repositories are covered by secret scanning with gitleaks. See GitHub Advanced Security.

Read through the playbook

Section titled “Read through the playbook”

This playbook collects what’s useful and relevant for everyday security work in our teams.

Task: read the guidelines

  1. Read the Golden Path and the Guidelines.
  2. See whether you learn something new.
  3. Think about whether something is missing. 💭

Contribute to the playbook

Section titled “Contribute to the playbook”

The playbook should be driven by the people using it. Everyone should feel they can contribute, and changes shouldn’t need a long, heavy process.

Task: update the playbook

  1. Go to tryhuset/trydig-playbook on GitHub.
  2. Find one thing you can improve under src/content/docs (or more!).
  3. Open a pull request. 🥳

Review the team’s logging

Section titled “Review the team’s logging”

Logging is extremely useful, but it can also leak sensitive information if you don’t think it through. Logs should be detailed enough to investigate an incident, without containing secrets, tokens or personal data.

Task: find out what the team logs

  1. Find out how the team’s applications log, and where the logs end up (see try.no/log-drain in Backstage).
  2. Look for places where too little or too much is logged, such as missing logging of failed logins, or full request bodies with personal data.
  3. Fix the code. 🎖

Shut down old services

Section titled “Shut down old services”

Old services are often the ones forgotten when it comes to security. A service that is still running, but that nobody looks after anymore, is a ticking time bomb. 💣

Task: remove old services

  1. Find out what the team has running on each hosting platform.
  2. Check whether anything is no longer in use and can be shut down. Agree with the project owner and Customer Support first, in case it’s covered by an agreement with a client.
  3. Shut it down, and mark it as deprecated or remove it from Backstage. 🪦 (Celebrate with cake! 🍰)

Archive abandoned repositories

Section titled “Archive abandoned repositories”

It’s easy to forget the GitHub repository when retiring an application or a code experiment. If it isn’t archived, Dependabot keeps reporting vulnerable dependencies, and it looks like we’re further behind than we actually are.

Task: archive old repositories

  1. Go through the team’s repositories and find the ones that aren’t deployed anywhere and haven’t been changed in a long time.
  2. Archive them under Settings → General → Danger Zone → Archive this repository. Archiving is not the same as deleting. An archived repository can easily be brought back later.

Have a coffee with another Security Champion ☕️

Section titled “Have a coffee with another Security Champion ☕️”

One of the best ways to learn is from each other. Find a Security Champion from another team you haven’t talked to before, and invite them for a coffee chat.

Learn more about security 📚

Section titled “Learn more about security 📚”

Take a course, read a book or listen to a podcast.

Task: learn something new

Inspired by Nav’s security playbook.