This week's episode of Defense in Depth
Access this link to listen: https://cisoseries.com/defense-in-depth-leaked-secrets-in-code-repositories/
Tags 🏷
#cybersecurity #cso #ciso #infosec #hacker #ciberseguranca #cyberattacks #threats #malware #cibercrime #exploit #hackers #databreach #pentesting #cloudsecurity #cyberwar #datasecurity #hacking #cloud #phishing #securitymanagement #infosec #ransomware #datasecurity #encrytption #malware
Leaked Secrets in Code Repositories
This week's episode is hosted by me, David Spark, producer of CISO Series and Allan Alford. Our sponsored guest is Jérémy Thomas, CEO, GitGuardian. All three of us discussed:
Putting passwords and other credential information inside of code simply happens. It is done by developers for purposes of efficiency, laziness, or simply forgot to take it out.
Given that exposing secrets is done by developers, these secrets appear in code everywhere, most notably in public code repositories like GitHub.
Exposed credentials can appear in SIEMS as it's being exported from the developers' code.
There is a shared responsibility model and cloud providers do have some ability to scan code, but ultimately code you put in your programs is your responsibility.
Scanning public code repositories should be your first step. You don't want to be adding code that has known issues.
Next step is to scan your own code and get alerts if your developers are adding secrets (wittingly or unwittingly) in their code. If you alert in real-time, it fits naturally within the DevOps pipeline and they will improve their secure coding skills.
Another option to deal with exposed secrets is to sidestep the problem completely and put in additional layers of security, most notably multi-factor authentication (MFA). A great idea, and yes, you should definitely include this very secure step, but it doesn't eliminate the problem. There are far too many authentication layers (many automated) for you to put MFA on everything. There will always be many moments of exposure.
This week's episode is hosted by me, David Spark, producer of CISO Series and Allan Alford. Our sponsored guest is Jérémy Thomas, CEO, GitGuardian. All three of us discussed:
Putting passwords and other credential information inside of code simply happens. It is done by developers for purposes of efficiency, laziness, or simply forgot to take it out.
Given that exposing secrets is done by developers, these secrets appear in code everywhere, most notably in public code repositories like GitHub.
Exposed credentials can appear in SIEMS as it's being exported from the developers' code.
There is a shared responsibility model and cloud providers do have some ability to scan code, but ultimately code you put in your programs is your responsibility.
Scanning public code repositories should be your first step. You don't want to be adding code that has known issues.
Next step is to scan your own code and get alerts if your developers are adding secrets (wittingly or unwittingly) in their code. If you alert in real-time, it fits naturally within the DevOps pipeline and they will improve their secure coding skills.
Another option to deal with exposed secrets is to sidestep the problem completely and put in additional layers of security, most notably multi-factor authentication (MFA). A great idea, and yes, you should definitely include this very secure step, but it doesn't eliminate the problem. There are far too many authentication layers (many automated) for you to put MFA on everything. There will always be many moments of exposure.
Access this link to listen: https://cisoseries.com/defense-in-depth-leaked-secrets-in-code-repositories/
Tags 🏷
#cybersecurity #cso #ciso #infosec #hacker #ciberseguranca #cyberattacks #threats #malware #cibercrime #exploit #hackers #databreach #pentesting #cloudsecurity #cyberwar #datasecurity #hacking #cloud #phishing #securitymanagement #infosec #ransomware #datasecurity #encrytption #malware
Comentários
Postar um comentário