Security-First beim Entwickeln von GitHub Copilot Skills. So erfüllen Sie Enterprise-Anforderungen und Compliance-Vorgaben.

Security-Grundlagen

Angriffsvektoren verstehen

Input Injection:

• Malicious Prompts
• Parameter Manipulation
• Code Injection

Data Leakage:

• Sensitive Daten in Responses
• Logging von Secrets
• Caching-Probleme

Authentication Bypass:

• Token-Diebstahl
• Session Hijacking
• Privilege Escalation

Authentication Best Practices

OAuth 2.0 Implementation

const authConfig = {
  authority: 'https://login.microsoftonline.com/{tenant}',
  clientId: process.env.CLIENT_ID,
  clientSecret: process.env.CLIENT_SECRET,
  scopes: ['api://copilot-skill/.default']
};

const tokenProvider = new ConfidentialClientApplication(authConfig);

Token Validation

const validateToken = async (token: string) => {
  const decoded = jwt.verify(token, publicKey, {
    algorithms: ['RS256'],
    issuer: 'https://copilot.github.com',
    audience: 'your-skill-id'
  });
  
  if (decoded.exp < Date.now() / 1000) {
    throw new Error('Token expired');
  }
  
  return decoded;
};

Managed Identity (Azure)

import { DefaultAzureCredential } from '@azure/identity';

const credential = new DefaultAzureCredential();
// Keine Secrets im Code

Authorization

Role-Based Access Control

const checkPermission = (user: User, action: string) => {
  const permissions = {
    'admin': ['read', 'write', 'delete', 'deploy'],
    'developer': ['read', 'write'],
    'viewer': ['read']
  };
  
  return permissions[user.role]?.includes(action);
};

Attribute-Based Access Control

const canAccessResource = (user: User, resource: Resource) => {
  // Prüfe Abteilung
  if (resource.department !== user.department) return false;
  
  // Prüfe Klassifizierung
  if (resource.classification > user.clearanceLevel) return false;
  
  return true;
};

Input Validation

Parameter Sanitization

import { z } from 'zod';

const querySchema = z.object({
  searchTerm: z.string()
    .max(200)
    .regex(/^[a-zA-Z0-9\s-]+$/),
  limit: z.number()
    .int()
    .min(1)
    .max(100)
});

const validateInput = (params: unknown) => {
  return querySchema.safeParse(params);
};

SQL Injection Prevention

// Nie so:
const query = `SELECT * FROM users WHERE name = '${userInput}'`;

// Immer so:
const result = await db.query(
  'SELECT * FROM users WHERE name = $1',
  [userInput]
);

Audit Logging

Was loggen?

interface AuditLog {
  timestamp: Date;
  userId: string;
  action: string;
  resource: string;
  parameters: object; // Ohne sensible Daten!
  result: 'success' | 'failure';
  duration: number;
  clientIp: string;
}

Wie loggen?

const auditLogger = async (log: AuditLog) => {
  // Sensible Daten entfernen
  const sanitized = removeSensitiveData(log);
  
  // An SIEM senden
  await siemClient.send(sanitized);
  
  // Lokale Retention
  await writeToSecureStorage(sanitized);
};

Compliance-Anforderungen

SOC 2

Trust Principles:

• Security – Zugriffsschutz
• Availability – Uptime-Monitoring
• Confidentiality – Datenverschlüsselung
• Processing Integrity – Input-Validation
• Privacy – Datenminimierung

GDPR / DSG

Anforderungen:

• Datenminimierung
• Zweckbindung
• Löschkonzept
• Auskunftsrecht

Implementation: ``typescript // Keine unnötigen Daten sammeln const minimalResponse = { id: user.id, name: user.displayName // Nicht: email, phone, address... }; ``

Secrets Management

Azure Key Vault

import { SecretClient } from '@azure/keyvault-secrets';

const client = new SecretClient(
  'https://my-vault.vault.azure.net/',
  new DefaultAzureCredential()
);

const apiKey = await client.getSecret('external-api-key');

GitHub Secrets

# In GitHub Actions
- name: Run Skill
  env:
    API_KEY: ${{ secrets.API_KEY }}

Security Testing

SAST

# Code-Analyse
npm run lint:security
snyk code test

DAST

# Runtime-Tests
npm run test:security
owasp-zap scan

Penetration Testing

• Jährliche externe Audits
• Bug Bounty-Programm
• Red Team-Übungen

Incident Response

Playbook

1. 1Detect – Anomalie erkannt
2. 2Contain – Skill deaktivieren
3. 3Investigate – Logs analysieren
4. 4Remediate – Fix deployen
5. 5Recover – Service wiederherstellen
6. 6Learn – Post-Mortem

CNEXT Security Services

Wir bieten:

1. 1Security Review – Skill-Audit
2. 2Compliance-Assessment – Gap-Analyse
3. 3Penetration Testing – Schwachstellen finden
4. 4Incident Response – Support bei Vorfällen

Fazit

Security ist kein Feature, sondern Grundlage. Mit diesen Praktiken entwickeln Sie Copilot Skills, die Enterprise-Anforderungen erfüllen.