Detection Engineering Demystified: Building Custom Detections for GitHub Enterprise

No ratings

Presented at BSidesLV 2024 by

David French

For many organizations, GitHub houses critical intellectual property and is a prime target for attackers seeking to steal valuable source code, disrupt software development operations, or carry out supply chain attacks. Security teams must proactively monitor their GitHub Enterprise environments and have the capability to detect and respond quickly to any suspicious activity. This presentation is for defensive practitioners curious about the world of Detection Engineering and how to build detections that are focused on identifying attacker behavior. As Detection Engineers, we’ll receive some intelligence on a threat group’s modus operandi for stealing intellectual property, analyze the attack technique, identify relevant data sources, and build & test a detection step-by-step. You’ll leave with practical Detection Engineering techniques that you can apply to other use cases to bolster your organization’s defenses against threats.