Thank you.
Thanks for your warm welcome. Welcome to breaking
barriers. There are three game fights security training.
My name is Joseph. I'll tell you more about me at the end.
But what is more important so far is that I'm the creator and
the maintainer of the secure code game which is an open source
project that we are going to cover today.
I would like to focus on the impact that the free game
hat on a company on a university and how you can use it to
make the most proud of it so that you can make software security training
fun engaging and at the end of the day impactful for your goals.
I would like to start with a question. Who believes in the vision
that software security should start from developers.
So it should start from left and raise your hands.
Okay, that's good. And how satisfied are you with the training
that you know of or you have had in achieving that vision?
If you are very happy like from seven to ten out of ten raise your hands
and if you think something should be improved like one to six
let us know. Perfect. So you are in the right room.
We asked the same question to a lot of developers in our community
and these are the answers we have. Like it's a lesser realistic
when it's happening outside of a dev environment.
When it's a video it's full of theory and they click next next next next.
When they are inside an environment that is similar to who wants to be a millionaire
with a finite amount of options and answers.
It's not like the real world, right? Because in the real world you have no guarantee
that you are going to fix the problem. You might produce new problems.
A lack of personalization. And this is something I'm going to touch more
at the end how you can't focus the project and use it. And finally it's boring.
And when something's boring people just stop engaging, right?
So I'm going to start with showing you a case study with a probability technology
start up before going in a university use case and how you can have the project
in the form of a demo. What the hell is probability technology?
Like most people might ask imagine like a sauce company that is doing
centralized access management with these cards that you use to enter in rooms like this
university. And this company way before the game they just installed
GitHub advanced security which has code trail which is our code scanning
secret scanning and dependency management. And they found out the problematic security
poster they had. So here you can see that they had critical alerts in red, high
orange, medium lows. These are about secret vulnerabilities and dependencies.
And when they had their first scan in December 2022, they realized that they had
a big surface area of red, a load of orange in 180 alerts in total.
So someone can see what happened just after scanning in the beginning and
use some products to reduce the lows and the mediums you can't see the surface
area of the yellow has halft and the surface area of the light blue has halft
as well. But the red and the orange became as big as they were.
And I'm working you through this because I want you to understand the impact that
security training that was working, having this company. Now we are well before the
game base. While someone might say that this is good, someone can notice that
well, the red and the orange remained as it was. These alerts are straightforward
to resolve. They are using the security team and not devs. And you know, the chief
security officer wasn't happy because the vision was to use the developers of this
company to resolve security alerts in order to be a forced multiplier. If I give you
numbers, they had a hundred software engineers and three security people. And one of them
this person here. So this bad proportions remained, right? Then someone can notice
and again we are before the game base that they reduced this number to 18 in just a few
months. But this is not good and I'll explain why. While they have reduced the
red and the orange because they were detected by secret by by code scanning,
they have this code office hours. And they needed these office hours that we are
the elephant in the room because the nature of these alerts is complex.
They need design meetings. And here, these meetings started 30 minutes, one hour,
one and a half straight away went to two hours plus per week. They were spending
in security for plus hours per week. It made the company unproductive.
They are start up competition, start to be fierce. And you know, it's something unsustainable
and risky for security. Why? Because a company needs to defend all all
fronts when it comes to security. Not be amazing here in code security and
amazing here, for example, when it comes to malware, they have to defend
well enough in all fronts because attackers just need to succeed once. And again,
we are in a start up environment that companies increasing in size, the code lines
increase. Therefore, the attack surface increases as well. They have two options,
right? Keep what they do with the security time taking more time down the
death time. So you have a future that is uncertain. Or the other option is to do
something else. So they start investing in trainings, money, time.
They were not happy about that. They also started to invest in training for people to
become security champions. But what happened was that this security
champions had a lot of pressure on them just to be the people who solved the
problems. The chief security officer, the chief technology officer have put
what is called SLOs, service level objectives. For the amount of security
alerts that will be open and has pushed this down to the head of the
death teams. So they had so much problem because they wouldn't manage to
reduce those. So they used the free open source option. They wound up
full of open source principles, which is the game that we created.
And let me tell you how they used it. They brought together their engineers.
They formed teams of two people and they played the game in a competitive
fashion. But let's speak more and show a demo of this game.
I'm here today to speak about the secure code game, but someone can access
in this URL. It's an initiative of the GitHub security lab, which is the team
that I'm coming from. I'll tell you more at the end. And we provided an
email app learning experience. So the developers are in the code
editor. In order to support problems, fix them around them against
tests and understand their skills. Okay. So I hope you can't see
because of the sun. Then I will go through these with my mouse to
make it easier. So inside here, we are at this
report at the top. It's inside GitHub skills, which is a free organization
with different reports. The secure code game is one of the most popular
reports there. And it's a template report. That someone can
fork, can clone by touching, create new reports there. I will choose
myself to be the owner. I'll give you the name. You can choose
yourself here to be the owner. Give you the name. And you can have it as
public visibility or private visibility. We are going to see the
difference at the end is more than someone can see what I'm doing.
So you are going to generate a new report. Here I'm in my profile.
You see a fresh installation. And you just need to open this in
code spaces. And after two minutes, you are going to have
you ready. So code spaces for those that don't know come the access
by clicking on the code here. And then just clicking this button is
a virtual machine inside your browser. And we are doing so so that
you are not going to need to install anything on your local
machine. After two minutes, by the way, you have 60 hours of free
code space usage every month, which is more than enough to play the game.
You can play a go through in 50 or 20 hours. Unless you are really good,
maybe you need 10 hours, 8 hours. Okay. So we have this file structure
here. We have two seasons, season one and season two. Each season has five
levels, level one to five. The first season has four levels in
Python and one level in C. The reason is because I created
the first season and my skills are mainly in those languages. While the
second season that was community contribute that entirely has
JavaScript, GitHub actions, grow, and one more level in Python.
Okay. Every level has the exact same five structure. You get a code
file, a hack file, a hint, a model solution, and tests.
Let's click through. The code file includes functional
code that happens to be vulnerable. The tests are
unit tests that initially they pass. And then you get the
hack file that is exploiting the vulnerabilities in the code file,
which initially fails to show you that you fail to pass the level.
You can go to the next step when both the hack and the test pass.
You are given a hint and a model solution. Of course,
there are more than one solutions. Level one in season one is easy
and then the difficulty resets. Season two level one is as easy as
is a previous season. And here you also get a contribution guide for
those who want to start contributing on our third season.
We spoke before about the private versus public. If you
chose to have a public visibility project, you have an
resource project. And when you have our open source projects,
you get to have advanced security for free, cold pilot for free,
cold pilot, open for free, so that you can play around.
And we'll get to have advanced security for those that may need
a bit more hints. They can see some code scanning
alerts in later levels of the game so that they can play those
as well. Let's go back to this company. What happened?
First of all, the engineers had fun and they noticed an increased
sense of ownership among them with a willingness to learn.
The four plus hours per week have become less than 15 by
weekly. So the season believes that the vision is achieved.
This game is the ongoing training that every newcomer
does in the industry. They gave us some levels for season two
as well. And they have reduced the alerts from 188 to 7
today. And then the time needed from 4 hours to 15
by weekly. For me, this is the most nice start to see.
Back to the service level objectives. The developers feel that
they cannot achieve the objectives they have. They can feel that
they contribute to their team, not just code, but they
deserve the alert they create. And the company is starting to grow
more and more, going through different rounds of funding.
Let's now talk about the universities that play our game.
We have the university of Novisa in Serbia. Where the
associated professor, Erwin Varga, has pleaded the students in
teams of five before the computer science, security and
distributed systems. Lectures start. So that these students
try to solve the problem. They realize that they might know how
all the skills needed. And they fail by trial and error. And then
they are getting to the concepts. So they are learning that
security should be important from the beginning and not
come late at the very end, like on after thoughts.
I would like to touch on this final minutes on why
gamification works. And on the front that is everywhere around
us to motivate you even more to use gamification through this game,
or another one that you build by yourself. The gamification
market has more than three volts from the last five years.
And it's everywhere around us. You get stamps when you buy
some coffee. You get the likes after you post. You get points
after you spend. You get high in the little board after
you run or cycle. And you get like a language or cyber
security or something that is big and feels like an ocean.
And it's daunting to learn. Split it down into more
manageable sections and you get the reward for those. Okay,
but why does it work? It works because as students
we want to feel happy, intrigued, and excited through
the coming. So we want to feel in control.
Like, oh, I have control in this game. Like me, I like
GTA, ground theft. That number six is coming out.
I get a car. I'm in this map and I drive around and I feel
free. But in reality, I'm just in a finite map that
the Rockstar company gave, right? So as humans, we would like
to feel like that. We have a reward. A good behavior that
is very forth when we do things. And let's go here at
the end. I'm trying to show you why gamification works and why
in my view you can start experimenting with it. In our game,
there's a QR code game. We have deployed open source
principles. Like the game is open source. It's driven by
a community of people. It's developed first because it's in
your code editor, not in videos, not in who wants to be a
millionaire and so on. You're ready to synchronize with
code spaces. You can have your top spaces and whatever
you want to have. It's customizable because you can't
forget the project. You can't change the name. You cannot
do whatever you like. It's hands on and the end of it.
Back to this initial problem. We believe that we
targeted every single statement here. But this is my view.
You can, of course, play and you can, of course,
contribute. So don't miss that chance to try these
out because first of all, spotting a problem is not enough.
Fixing a cyber security issue is very often.
Because many people think that they fix something but they introduce
more problems after fixing it. And I see some notes there. Yes,
we've been there. You can try code scanning when you go for a
public visibility through code trail, which is our industry
leading semantic coding engine, but you can try other stuff as well.
That doesn't belong to GitHub. You can try code pilot. For
you can try to have code explains. I just then fixed for you.
And all these through code spaces, so that you can be in the browser.
You can't store resume the machine and so on without installing anything.
Finally, we welcome your contributions.
Then is from hash code now. Has contributed in the game
because he feels that it's his way to show to develop
around the world. What problems he was seeing as security engineer
in hash code and in general, when he was contributing,
so that he's the letters that he gave to us
where inspired by real life scenarios.
This was me, my name is Joseph. I'm a developer advocate for the GitHub
security lab. I do research on the intersection of software
security and AI now. And in my free time, I am speaking
in conferences and creating content for developers. I like to speak
in a developer friendly language, which is not like, oh, this is
how bad what you do was. I like to speak as a developer
because I was a developer. And we have the GitHub security lab,
a team of security experts with the mission to inspire and secure the
open source software that we all depend on. In the last four years that we exist,
we found more than a thousand security issues, 600
plus of which have been given CDs. In open source projects that
you know and you use, some of you here in the wider
conferences might work with us to secure their projects. So, thank you for
your time. We have five more minutes or more for questions.
And of course, you can't find me around in the conference, online,
and so on. Thanks for your time. And I'll be out for your questions.
Any questions? Did you understand all? I know the previous
talk with these guys that I was like more technical, more into those things,
but again, feel free to ask. And to find questions and
understand these concepts, you have to play with these concepts,
right? Security is something that is practical. Yes?
Can you play to share basically translate the
seasons to another language? Okay. Good question. I repeat for the
stream. The question was, how hard is to take the current
levels that exist in Python and translate them into another language?
Due to the fact that there are no Python developers, right?
In my view, it will be easy because on purpose,
the problems that we chose for Python are not Python specific.
Think about those problems that also exist in other languages.
So, in my view, you can take the spirit of the level,
the problem there, and translate it into another language that suffers from that.
Without really telling you more, some languages might not suffer from that.
That's for Python. We have some levels in JavaScript that are
JavaScript-focused, like imagine prototyping
injections and poisonings and stuff like that. In latest levels,
I don't think you can take those ones, but the Python ones, for sure,
thanks for the question, great on. Any other question?
Yes? How would you organize the training for like
100 developers? What are you doing?
Amazing.
Have a nice day for all of them.
Would you target some of that for you?
Let me put again for the stream. The question is, how would you go
by organizing a training based on the secure code game for 200 people?
Do you wonder in the same room? How do you imagine that?
Let's do different options.
Let's say, all of you here are going to open your laptop.
We have 100 people here, but you can have 500, it's not important.
The infrastructure is supposed to buy us from GitHub.
The only thing you will do is just open your laptop, go to skills.github.com,
or the URLs we see here, and you can't play. That's pretty much it.
You can go more extreme in the infrastructure as a company,
by different options. You can't afford this game.
You can say, welcome in this company, Hackathon, and so on.
You can have a main repo. That is your template repo.
You do all the changes there. You put all the production rules there.
You can create a YAML file where you take the Hack file
and test file that we have. You make auto grading approach,
so that every time that your developers push, these runs behind the scenes
and grades, they are set up.
I have a YAML file ready by the way, so you don't need to do anything.
I can give you 200 lines of code for that, so just let me know.
Then this developers, in this room, in that room,
they can be from their home, it doesn't matter.
They are going to go to your main repo. That is in your ABC company.
They are going to fork the template. They are going to play.
They might not have the test and the Hack file in order for them to be really challenged.
You can't even remove the hint. They will commit the code.
And when they commit the code, the YAML file that I'm going to give you for instance
is going around behind the scenes and it's going to give them feedback.
Like, if it's passing or not passing, maybe you don't want to show them anything
and you can have the results in a CSV file.
Another approach will be to give them everything.
And code space is free for public reports, so you don't need to pay anything.
If you want to go like private projects,
you can find the local installation guide in this repo here as well.
Could be paste that, just test it first.
And they can play in their local machines and everything is going to be private.
It's really easy and I'm very happy to help with the infrastructure side of the things.
Thanks for the question.
This is more of a suggestion than I said.
Sure.
Absolutely. Thanks for that question. I'd be pleased for the stream.
My understanding is that the question is,
did you think about basically hosting on a more attacking defensive CTF?
Like the simulations that you play online?
Yes, we did.
I think that we are intentionally going to have it inside the code editor
because the CTF is that I know of at least.
I'm giving like a website and I have to hack the website.
We intentionally want to have the code.
We don't want to have like an end product that they hack.
We are a plenty of those and we try to actively say that you can have a vast juice show.
And so on.
We want to have communities in the long term like the ones in first them.
For instance, saying, you know what? In our community,
this is the number one thing that people get wrong.
So we want this community to create a level here, put some code,
and tell to their developers.
This is the theory, but here's the practice.
So you can go in this level.
You can open a code space. You can have code there that they are a pattern
that people have it as vulnerable and you can't play.
And you can't secure it and you can understand what is wrong with that.
So we might really go into a front end in the future.
But for now, we believe that we want to be where developers are, which is the editor.
Thanks for that question.
So I think we have time for the last question.
Last question.
It doesn't seem to be, oh yes.
How would you come here that they have something like continuous learning?
So how do you explain the paper?
They've written for the levels.
What are you now?
Yeah, that's an amazing question, man.
So look, cyber security is a big thing, right?
You may have like forensics, penetration testing,
testing, risk, it's endless.
Personally, when it comes to software security,
my recommendation is to go and read open source code.
Try to spot problems there.
Bring your skills in the real world.
Try to see bugs that other other people found.
You can't go in a hacker wound to buck out.
So that you can't keep working with this muscle of spotting problems.
If you spend too much time in learning to find software problems,
you might not really bring your skills early in the real world.
In the race cases, and in those small details that make the difference.
So I will say, going the real world as much as they're last possible.
Okay, thank you.