1

My manager is asking me to create a new, separate GitHub personal account for work, using my company email address. This comes with setup complications for me.

I have worked with big, governmental organizations in past which followed security procedures to a "T" and never had to create a new GitHub for their dev work.

Is there anything that changed recently that would require me to create a new GitHub account for work projects when the company wants to get SOC 2 Type II compliance?

0

1 Answer 1

1

One of the core, basic, controls in SOC 2 is:

CC6.1: The entity implements logical access security software, infrastructure, and architectures over protected information assets to protect them from security events to meet the entity's objectives.

There are quite a few controls in that section.

How your company chooses to exert that control is up to them. And they might have trouble explaining to internal and external assessors how using someone's existing personal account to access the company's Intellectual Property is showing due care and control over providing access.

For instance, can your company enforce and check that your personal account uses MFA when you log into GitHub? Can your company trigger password changes on your personal GitHub account if there was a suspected compromise of your account?

If I was the CISO of your company, I wouldn't allow personal accounts either. The control of your account would belong with me not with you since you are working with company assets.


However, from the clarification in the comments, they want you to set up a new personal account that they don't control either. So, it could come down to the fact that all GitHub emails about notifications, etc. go to a company email inbox and not your personal email.

As a CISO, I'd still want more control than that.

6
  • Thank you for the thorough answer! Really appreciate the insight. Just to clarify, it is not a company provided GitHub account. They are merely asking me to create a new account with my company email. I would still manage myself and have full control over the account. Since they wouldn't have any more control over the account than me using my personal one, I don't understand the importance of using a separate "work" account.
    – Matyas
    Commented Feb 3, 2023 at 15:59
  • So, they want you to use a new personal account? Well, I'm confused, too.
    – schroeder
    Commented Feb 3, 2023 at 16:58
  • Yes, they are asking me to create a new account (free, individual one), only with the company email. That account will then be associated with the company’s GitHub organization account. This is the way it is done currently with my existing GitHub account, which I have created using a personal email address. The thing is, GitHub itself recommends using one account for both personal and professional repositories.
    – Matyas
    Commented Feb 4, 2023 at 15:50
  • Please correct me if I'm wrong here but I don't think GitHub supports managed accounts. Accounts are personal by definition. You can ask people to sign up with a new account that uses their company email, but as an organization owner you still can't control those accounts. Commented Jul 2, 2023 at 14:47
  • @StefanArentz I never said "managed accounts". The company should at least set up access to a Github account that is connected to the company email, not personal addresses. But, on the other hand, yes, Github offers managed accounts. A 3-word google search would have uncovered that for you.
    – schroeder
    Commented Jul 3, 2023 at 10:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .