Introduction

Last month, StepSecurity introduced Harden-Runner for self-hosted VM runners for enhanced CI/CD security. This month, StepSecurity raises the bar further with yet another enhancement of Harden-Runner. On popular demand, Harden-Runner, which is known to provide robust runtime security for GitHub Actions across GitHub-hosted and self-hosted runners, will now also detect anomalous outbound calls. This ML-powered feature will empower developers and security teams with real-time alerts during workflow runs, ensuring an additional layer of security without compromising usability. This feature uses traditional machine learning pattern recognition to empower developers and security teams with real-time alerts during workflow runs, ensuring an additional layer of security without compromising usability. What’s more? For self-hosted runners, this feature will enable all workflows to be automatically monitored without changing any of the workflow files.

Important Note: This feature does not use generative AI or Large Language Models (LLMs). Instead, it employs a straightforward pattern-based machine learning approach that learns and remembers the typical endpoints accessed by each job in your workflows. This model is implemented in our codebase and we do not use any external Machine Learning (ML) provider.

If you’re looking to enhance your GitHub Actions security, you've landed at the right place. Explore StepSecurity Harden-Runner to see how it helps to fortify your GitHub Actions.

Also Read: Celebrating 2,000+ GitHub Repositories Secured with Harden-Runner

Evolution of Harden-Runner: What’s Different?

Up until now, Harden-Runner offered two modes: an audit mode, providing visibility into outbound calls made during a GitHub Actions workflow run, and a block mode, enabling the specification of authorized outbound destinations while blocking unauthorized calls. As per the demand, we’re excited to introduce the anomaly detection feature in audit mode.

How It Works

The anomaly detection feature creates a machine learning model of outbound network calls by analyzing the historical data of the same workflow in previous runs.

Our Machine Learning Approach

To be clear about our technology:

• What we DO use: Traditional pattern recognition and statistical analysis to learn the normal behavior of each job
• What we DON'T use: Generative AI, Large Language Models (LLMs), or any form of AI text generation

The model works by:

1. Learning Phase: The StepSecurity platform observes and records which endpoints each specific job typically accesses during normal execution
2. Pattern Recognition: The system builds a baseline of expected network destinations for each job based on historical runs
3. Anomaly Detection: When a job makes an outbound call to a previously unseen endpoint, it's flagged as anomalous
4. Alerting: Real-time notifications are sent when unexpected network behavior is detected

This is essentially a memory-based system that remembers what endpoints are normal for each job - no complex AI or language models involved.

After the model is trained, real-time notifications are triggered if a new anomalous outbound call occurs in a future run. These notifications can be seamlessly delivered through email and Slack, allowing developers and security teams to promptly review and investigate the legitimacy of the newly detected endpoint.

Here is a sample email notification.

‍

You can also detect such anomalous calls in the insights page for the GitHub Actions workflow run.

‍

Enabling the Feature

Follow these simple steps to enable this feature:

1. Install the StepSecurity Actions Security GitHub App.

2. Access the organization dashboard through the provided link.

3. In the settings tab, under "Notification Settings," find the new setting for "Notify when an anomalous outbound call is discovered."

4. Enable this feature by selecting the checkbox and saving the settings.

‍

For GitHub-hosted runners, add the Harden-Runner GitHub Action to your workflows to receive notifications about anomalous outbound calls. If using self-hosted runners, no additional action is required – all workflows are automatically monitored.

See it in Action in GitHub Actions Goat

As an educational initiative, GitHub Actions Goat simulates common security attacks and vulnerabilities in a GitHub Actions CI/CD environment. We've incorporated the anomaly detection feature into GitHub Actions Goat. To witness it in action, explore the dedicated workflow running on a GitHub-hosted runner, utilizing Harden-Runner in audit mode.

Summary

StepSecurity is thrilled to enable enhanced GitHub Actions security with this new feature. The feature will allow DevOps teams and security teams to detect anomalies in real time and empower organizations to balance security and usability as per their requirements.

If you’re eager to explore the new anomaly detection feature, simply follow the steps above to enable it on the StepSecurity platform. Stay tuned for upcoming feature updates and if you have any questions, please feel free to contact our team.