It may come as a surprise, but secrets management has become a key component of AppSec rooms. Security vulnerabilities such as Common Vulnerabilities and Exposures (CVEs) are a hot topic in the cybersecurity world, yet confidentiality management remains an overlooked issue that can have an immediate impact on a company’s safety. .
A recent study by GitGuardian found that 75% of IT decision makers in the US and UK reported that their applications exposed at least one secret, and 60% caused problems for their company or employees. . Surprisingly, less than half (48%) of respondents were confident in their ability to protect their application secrets to a “substantial degree”.
The research Practitioner’s Voice: The State of AppSec Secrets (available for free download here) offers a new perspective on managing secrets, often reduced to boilerplate that doesn’t reflect the operational realities of engineering departments.
Despite the prevalence of secrecy in modern cloud and development practices, secrecy remains a thorny issue for even the most mature organizations. As the number of secrets used concurrently within a development cycle increases, it becomes very easy for them to “leak” outside the control of sound security practices.
Protecting application secrets
When a secret is leaked, it is no longer a secret and can be accessed by unauthorized systems and users for a period of time. Leaks mostly occur internally. This is because secrets are copied and pasted into configuration files, source code files, emails, messaging apps, etc. The point is, if a developer hardcodes secrets into code or config files and that code is pushed to his GitHub repository, those secrets are pushed too. Another worst-case scenario is when malicious actors tap into leaked credentials after initial access, similar to what happened with Uber last year.
The “Voice of Practioners” survey shows that the danger of secrets being exposed is perceived by the majority of respondents. Seventy-five percent of respondents said a security breach had occurred within their organization in the past, and 60% admitted it caused significant problems for their company, their employees, or both.
When asked about key risk points within their software supply chain, 58% cited “source code and repositories” as their core risk area, 53% said “open source dependencies” and 47% said “hard-coded It was a secret.
Nonetheless, the responses indicate significant gaps in maturity. Specifically, less than half (48%) of respondents are confident in their ability to significantly protect application secrets.
 |
| Voice of the Practitioner: The Secret State of AppSec |
Additionally, more than a quarter (27%) of respondents admitted to relying on manual code reviews to prevent secret exposure, which is significantly more effective at detecting hard-coded secrets. there is not.
Finally, the survey also found that 53% of senior executives (CSOs, CISOs, VPs of cybersecurity, etc.) believe secrets are shared in plaintext through messaging apps.
Although there are challenges, there is room for improvement. The survey reveals that 94% of his respondents plan to strengthen security controls in the next 12-18 months, which is a positive move towards improving security controls and company security. It will be a step. Note, however, that secret discovery and repair, and secret management should be prioritized from an investment perspective compared to other tools such as runtime protection tools. While 38% of respondents plan to invest in runtime application protection tools, only 26% and 25% plan to allocate funds to secret discovery and remediation and secret management, respectively. was.
Comprehensive Security Management Program
Every year more and more secrets are leaked. GitGuardian monitors the annual number of breaches on his #1 code-sharing platform, GitHub, and publishes the results in its annual Confidential Information Sprawl Report. Again, this number is alarming. In 2021, the number of secrets detected was 3 million, and in 2022 that number will increase by 67% to reach 10 million. And this is just the tip of the iceberg. Global numbers are very difficult to estimate, as most breaches occur within corporate boundaries.
To address this growing risk, businesses must strengthen confidentiality controls as a priority to strengthen their defenses.
In a recent interview with GitGuardian, former Ubisoft CISO Jason Haddix explained how the importance of confidentiality controls became apparent after the company was targeted by the Laspsus$ hacker gang in March 2022. I explained whether After talking with his CISO of his 40 other people who were affected, he came up with his four axes. Programs to develop a comprehensive security management program:
- detection: Finding all past breaches requires automated tools and is an important step in gaining visibility into a company’s actual security posture.
- prevent: Use safe guardrails like pre-commit hooks to prevent leaks as much as possible and save time in the future.
- response: The secret is leaked because it must be shared. Having tools to store, share, and rotate these secrets, as well as fine-grained access control, is also important.
- educate: Continuing learning sessions on secrets for all employees, not just developers, ensures they understand the risks and best practices associated with hardcoding secrets and passwords.
Conclusion
The Voice of Practitioners research highlights the importance of a holistic secrets strategy in AppSec and provides valuable insight into best practices for mitigating the risks associated with secrets proliferation. Secret management can seem like a liability that grows over time. If you wait too long, the elephant in the room will eventually become too large to ignore, putting your organization at risk of serious consequences.
If you want to improve your confidentiality management program, a simple step you can take now is to request GitGuardian for a free audit of your company’s confidential exposures on GitHub. The automated report you receive shows the number of active developers on GitHub, the number of secrets (categories) that were found to be published in repositories on GitHub, and the percentage of those secrets that are active.
This will help you accurately determine your developer boundaries on GitHub, assess the amount of risk your company faces, and take the first steps towards a comprehensive confidentiality management program.
