Cybercrime is here to stay, but that doesn’t mean you can’t make it much harder for cybercriminals to steal your data and ransom your infrastructure. Learn how to prevent secret sprawl and protect yourself from being the next victim.
Ways to prevent secrets sprawl
As part of your efforts to shift left security, developers must remain in control of their secrets. But you cannot eliminate human error even with superb security awareness culture, and it doesn’t take much for a cybercriminal to gain access to sensitive data using privilege escalation. Stackoverflow was compromised when the attacker first gained access to private chat rooms. Every secret is crucial as they are all keys to doors that may be breached.
Cloud computing has made development cheaper and faster but brings new security risks. That’s because accessing cloud resources requires secrets, and each secret is a security risk. Moving to the cloud requires a better understanding of cybersecurity, and preventing secret sprawls is one of the main reasons why.
1. Don’t store secrets inside Git repositories
While public repositories are exposed to the public, storing secrets in private repositories is still ill-advised. Having your private repositories breached can be a disaster, but if you add secrets stolen along with the source code, it could be catastrophic.
Since Git stores the entire history of your repositories, any copies made include every revision; this means that even if you place a secret in a repository and then remove it later, there is still a record of it in the repository.
Storing secrets in Git is an unnecessary risk that you can avoid. One such method is employing a secret scanner like Spectral that will passively scan any code pushed to Git and alert you of any secrets that may be hiding inside.
2. Use a trusted Key Management System (KMS)
Key Management Systems ensure a healthy encryption and decryption lifecycle. Keys generally go through several stages, and a KMS will ensure you complete all the steps securely.
Every key needs to be generated with an adequately secure algorithm. Those keys must be securely delivered to where they need to go via secure channels such as TLS or SSH. Once applied to data, the key needs to be stored for decryption purposes; Otherwise, you may lose the encrypted data with the key. Once the key is no longer needed, it must be destroyed and disposed of without compromising the encrypted data. Encryption keys should naturally follow this lifecycle periodically to maintain security. A KMS makes this process easy, which ensures it happens frequently.
3. Rotate login handles frequently
Changing passwords and other credentials is an excellent way to prevent them from being used against you. After all, if you retract authorization, those login handles are useless. Security policies that ensure constant rotation of secrets reduce the risk of privilege escalation, as anyone who gains access with compromised credentials has a limited time to use them to escalate access. How often you rotate login handles depends on how much risk you’re willing to take and how much pain it is to rotate passwords.
4. Consider restricting API access to a minimal scope
It is tempting to grant developers access to everything. They are often security aware, and free reign allows them to get creative with resources. But developers aren’t impervious to human error. Restricting API access to the minimal necessary scope of daily operations is an easy way to reduce the risk of complete exposure in case of secrets leaking.
5. Automate secrets detection
Git repositories aren’t the only place where secrets may leak. Configuration files often hold secrets and may find themselves in public spaces. Chat rooms such as Slack may be a channel where secrets are passed insecurely. Given you cannot prevent human error, it’d be best to automate secret detection.
Automatic secret detection allows you to monitor against secret sprawl. With a good tool, human participation should be minimal and not delay any part of your SDLC. Seamless integration into a CI/CD pipeline is crucial for ease of use, effective secret detection, and leak prevention.
Stop the secret sprawl before it starts
While secret sprawl may be the easiest trap to fall into, it is also reasonably easy to avoid. Using a key management tool and built-in secret management systems such as Kubernetes Secrets or Azure Vault is a significant first step. However, tools such as these do not prevent human error and don’t stop keys from ending up in Git repositories or other public spaces.
Secret scanning is a critical component in your security stack and the only way to stop human error from causing secrets to leak. Spectral will alert you of any vulnerabilities and potential secrets leaking in any part of your SDLC and your cloud infrastructure. Monitor, catalog, and protect your assets from exposed secrets.
Spectral offers an automated and AI-driven solution for secret scanning that is part of your CI/CD pipeline and doesn’t burden your SDLC’s resources. There are no downsides to the high accuracy of secret recognition and a low number of false positives. See it for yourself by scheduling a demo.
