close
The Wayback Machine - https://web.archive.org/web/20220404232011/https://docs.github.com/en/code-security/supply-chain-security/end-to-end-supply-chain/securing-accounts
Skip to main content
Free, Pro, & Team
English
Sign up
 
Code security
Free, Pro, & Team
English
Sign up

 

Best practices for securing accounts

In this article

Guidance on how to protect accounts with access to your software supply chain.

About this guide

This guide describes the highest impact changes you can make to increase account security. Each section outlines a change you can make to your processes to improve the security. The highest impact changes are listed first.

What's the risk?

Account security is fundamental to the security of your supply chain. If an attacker can take over your account on GitHub, they can then make malicious changes to your code or build process. So your first goal should be to make it difficult for someone to take over your account and the accounts of other members of your organization.

Configure two-factor authentication

The best way to improve the security of your personal account is to configure two-factor authentication (2FA). Passwords by themselves can be compromised by being guessable, by being reused on another site that's been compromised, or by social engineering, like phishing. 2FA makes it much more difficult for your accounts to be compromised, even if an attacker has your password.

If you're an organization owner, then you can require that all members of the organization enable 2FA.

Configure your personal account

GitHub supports several options for 2FA, and while any of them is better than nothing, the most secure option is WebAuthn. WebAuthn requires either a hardware security key or a device that supports it through things like Windows Hello or Mac TouchID. It's possible, although difficult, to phish other forms of 2FA (for example, someone asking you to read them your 6 digit one-time password). However WebAuthn isn't phishable, because domain scoping is built into the protocol, which prevents credentials from a website impersonating a login page from being used on GitHub.

When you set up 2FA, you should always download the recovery codes and set up more than one factor. This ensures that access to your account doesn't depend on a single device. For more information, see "Configuring two-factor authentication," "Configuring two-factor authentication recovery methods," and GitHub Branded hardware security keys in the GitHub shop.

Configure your organization account

If you're an organization owner, you can see which users don't have 2FA enabled, help them get set up, and then require 2FA for your organization. To guide you through that process, see:

  1. "Viewing whether users in your organization have 2FA enabled"
  2. "Preparing to require two-factor authentication in your organization"
  3. "Requiring two-factor authentication in your organization"

Connect to GitHub using SSH keys

There are other ways to interact with GitHub beyond signing into the website. Many people authorize the code they push to GitHub with an SSH private key. For more information, see "About SSH."

Just like your account password, if an attacker were able to get your SSH private key, they could impersonate you and push malicious code to any repository you have write access for. If you store your SSH private key on a disk drive, it's a good idea to protect it with a passphrase. For more information, see "Working with SSH key passphrases."

Another option is to generate SSH keys on a hardware security key. You could use the same key you're using for 2FA. Hardware security keys are very difficult to compromise remotely, because the private SSH key remains on the hardware, and is not directly accessible from software. For more information, see "Generating a new SSH key for a hardware security key."

Next steps