The Shyft Group

Jason Brown, Information Technology Security Manager, The Shyft Group

Data. Its the lifeblood of every organization. Organizations produce, use, and store different types of information. Without data, what else would there be? As the data is collected, we apply labels to it to determine its sensitivity. The US government use labels such as secret or top secret whereas businesses may use confidential or restricted. We also have data laws and regulations in place to protect intellectual property or personally identifiable information.

Secrets, used  to protect our sensitive data is also an important aspect of any business. Secrets are used to restrict access to the sensitive information we are bound to protect. These can come in the form of credentials or encryption keys used to define who can or cannot access the sensitive data. Secrets become just as important, if not more important than the data we are supposed to protect.

We often think of secrets as the common username and password, a set of credentials used to protect data from others. Secrets can also come in the form of API keys and private encryption keys. We use secrets to protect access to our email, online photos, even banking and online shopping. Businesses use secrets to protect access to internal networks or keep competitors from accessing proprietary information.

Many US states have passed laws used to define and protect sensitive information from exposure. Breach notification laws have been passed to protect private citizens from misuse of their data. While this is a step in the right direction for many, a fundamental issue still remains. Regardless of the controls in place, organizations are still losing their data on a regular basis.

Securing your secrets

How do we protect our sensitive otherwise proprietary data from misuse? First, we must protect the secrets being used, however it is easier said than done in many instances. Information technology, or more specifically, software development must be assessed to see how the organizations secrets are being used. How many of us utilize the same credential to authenticate to a database that is hard coded in a script or application or utilize API keys for applications such as Terraform? We then turn around and commit that secret to our code base in Git or other version control system (VCS)?

Sure, we can scan our code with static application security testing (SAST) and dynamic application security testing (DAST) tools to pull out coding mistakes. We can use software composition analysis (SCA) to analyze vulnerabilities in open source libraries or better understand the licensing being used in our code. However, if we commit our code base to a VCS with the secrets in it, that could lead to a breach of our confidential or restricted information.

"Businesses use Secrets to Protect Access to Internal Networks or Keep Competitors from accessing Proprietary Information"

This has come to be such a significant issue that a whole new market in information security has emerged. Cloud based VCS’ such as GitHub have started scanning public repositories and alerting their maintainers that a secret has been identified. Software companies like GitGuardian or open source projects such as Truffle Hog can be leveraged to scan private or local repositories.

Once notified, the maintainer can then perform the necessary steps of removing the secret from the repository. It is also necessary to rotate the secret or private key from being used to ensure that it cannot be misused elsewhere. It may also be necessary to remove the secret from previous commits, though depending on how far back it goes, it may not be possible to fully remove the secret. Once cleaned up, next step is to ensure that it does not happen again.

Services such as AWS SecretsManager allow you to write scripts and applications that utilize secrets without having to embed the credential or key in the code. While this does not mean that you are completely free of sensitive data being in your code, it does allow you to rid yourself of worrying about password and key management in the software that is developed.

Importance of secrets management

In 2022, Toyota disclosed a potential breach of sensitive information. It was discovered that an access key had been committed to their GitHub repository and had been there for almost five years. While the mistake was blamed on a subcontractor who carelessly committed the access key, it was Toyota who had to disclose the issue.

AstraZeneca also fell victim of mishandling secrets. They too left credentials in code that was committed to GitHub. The credentials allowed access to a SalesForce test account containing some production data. This put their patients in jeopardy by allowing someone to discover the credential and access the data. Hours after its discovery, the repository was taken offline potentially removing further access to the account.

While these are just two examples, incidents like these are far too common. As a developer or head of information security for your organization, you must ensure that you do not fall victim to the same issue. Using the tools previously mentioned is one way to help protect your organization against a compromise of confidential or sensitive information.

Lastly, by investing time and effort into a secrets management tool is just one key piece in the overall software development life cycle. You must ensure that your developers are using the tools properly and that comes through training. Spend time training your teams in proper secrets management and the importance of not embedding secrets in code.