JANUARY - FEBRUARY 2025ENTERPRISE SECURITY| | 9PROTECTING YOUR SECRETSaccess to internal networks or keep competitors from accessing proprietary information.Many US states have passed laws used to define and protect sensitive information from exposure. Breach notification laws have been passed to protect private citizens from misuse of their data. While this is a step in the right direction for many, a fundamental issue still remains. Regardless of the controls in place, organizations are still losing their data on a regular basis. SECURING YOUR SECRETSHow do we protect our sensitive, otherwise proprietary data from misuse? First, we must protect the secrets being used; however, it is easier said than done in many instances. Information technology or more specifically, software development must be assessed to see how the organizations' secrets are being used. How many of us utilize the same credential to authenticate to a database that is hard coded in a script or application or utilizes API keys for applications such as Terraform? We then turn around and commit that secret to our code base in Git or other version control system (VCS)?Sure, we can scan our code with static application security testing (SAST) and dynamic application security testing (DAST) tools to pull out coding mistakes. We can use software composition analysis (SCA) to analyze vulnerabilities in open source libraries or better understand the licensing being used in our code. However, if we commit our code base to a VCS with the secrets in it, that could lead to a breach of our confidential or restricted information.This has come to be such a significant issue that a whole new market in information security has emerged. Cloud based VCS' such as GitHub have started scanning public repositories and alerting their maintainers that a secret has been identified. Software companies like GitGuardian or open source projects such as Truffle Hog can be leveraged to scan private or local repositories. Once notified, the maintainer can then perform the necessary steps of removing the secret from the repository. It is also necessary to rotate the secret or private key from being used to ensure that it cannot be misused elsewhere. It may also be necessary to remove the secret from previous commits, though depending on how far back it goes, it may not be possible to fully remove the secret. Once cleaned up, next step is to ensure that it does not happen again.Services such as AWS Secrets Manager allow you to write scripts and applications that utilize secrets without having to embed the credential or key in the code. While this does not mean that you are completely free of sensitive data being in your code, it does allow you to rid yourself of worrying about password and key management in the software that is developed.IMPORTANCE OF SECRETS MANAGEMENTIn 2022, Toyota disclosed a potential breach of sensitive information. It was discovered that an access key had been committed to their GitHub repository and had been there for almost five years. While the mistake was blamed on a subcontractor who carelessly committed the access key, it was Toyota who had to disclose the issue.AstraZeneca also fell victim to mishandling of secrets. They too left credentials in code that was committed to GitHub. The credentials allowed access to a SalesForce test account containing some production data. This put their patients in jeopardy by allowing someone to discover the credential and access the data. Hours after its discovery, the repository was taken offline potentially removing further access to the account.While these are just two examples, incidents like these are far too common. As a developer or head of information security for your organization, you must ensure that you do not fall victim to the same issue. Using the tools previously mentioned is one way to help protect your organization against a compromise of confidential or sensitive information.Lastly, investing time and effort into a secrets management tool is just one key piece in the overall software development life cycle. You must ensure that your developers are using the tools properly and that comes through training. Spend time training your teams in proper secrets management and the importance of not embedding secrets in code. ESINVESTING TIME AND EFFORT INTO A SECRETS MANAGEMENT TOOL IS JUST ONE KEY PIECE IN THE OVERALL SOFTWARE DEVELOPMENT LIFE CYCLE
< Page 8 | Page 10 >