I want to install a Git server for my company. I'm able to get a Windows virtual machine. Now I've been asked to assess its security aspects. I'm lost on how to achieve this goal.
As it is a Windows virtual machine I'll be using this.
Is there a way of evaluating the security risk?
There are security risk frameworks (STRIDE, DREAD and others) that you can apply to get a systematic approach to assessing risks and threats.
TFS is a Microsoft solution that implements a sort of Git (from my experience, I don’t believe it’s a pure Git integration, but I may be wrong). They do offer valuable resources for security, so that’s worth checking out.
There are several things to consider when talking about security in Git, and you need to define the requirements for this aspect. For example, in Git, every person with access to a repository is allowed to download every file in that repository (this is independent of which tool you use to manage the repository). They get a full copy of everything in there. You may need to define several repositories, depending on the type of projects that you will be working with.
Backups may be easier to perform in a virtual machine, but perhaps you will need a backup policy to assert data integrity and availability.
You may also want to consider the authentication methods. It being a Windows environment, you may even choose to share the Git folder inside your domain and manage it with user permissions, but bear in mind that performance may suffer from this (Git creates a lot of objects). There seem to be Active Directories, LDAP and PAM for certain managers, too.
Side topic: The PenTestPartners post “Git Extraction – Abusing version control systems” is interesting because it shows an attack which steals Git objects. It offers some concerns about access to configuration files.
