April 2022 Summaries

In the DevOps era, the responsibility for security has increasingly shifted to developers, necessitating supportive tools to design secure applications effectively. To facilitate this, a partnership with CircleCI has been established, enhancing the ability to automate secrets detection and remediation in development pipelines using the GitGuardian ggshield orb. CircleCI, a leading continuous integration and delivery platform, aids in automating build, test, and deployment processes, and its orbs, such as the ggshield orb, allow developers to incorporate predefined configurations easily. GitGuardian's ggshield orb integrates with CircleCI to detect hardcoded secrets in CI pipelines with a single command, leveraging a powerful secrets detection engine trained on a vast array of public GitHub commits. This collaboration aims to improve application security by providing developers with tools that seamlessly integrate into their existing workflows, ensuring code is free from vulnerabilities related to exposed secrets.

GitGuardian's secrets detection engine now includes a specific detector for Stripe webhook secrets, highlighting its commitment to preventing secrets sprawl, a significant issue for developers and security engineers. Stripe provides essential payment infrastructure for the internet, and its webhook secrets are crucial for verifying events sent to servers, ensuring their origin is authentic. GitGuardian alerts developers about exposed credentials, offering a library of over 350 detectors and sharing best practices for secrets management. When Stripe webhook secrets are detected, developers should understand the incident's implications, rotate and revoke the secret through Stripe's dashboard, and enhance their secrets management practices. GitGuardian's solution secures the development lifecycle, from developer workstations to CI environments, helping to prevent the exposure of over 350 types of secrets in source code.

The tutorial by Tiexin Guo provides a comprehensive guide on setting up Jenkins within a Kubernetes minikube cluster and integrating GitGuardian's ggshield for enhanced security in CI/CD pipelines. It explains how ggshield, a CLI tool, detects over 350 types of secrets and vulnerabilities by leveraging GitGuardian's API, which requires a service account available under a Business plan. The guide details the installation and configuration of Jenkins using Helm, setting up a persistent volume, and creating a service account for secure operations. Moreover, it demonstrates how to implement ggshield as a declarative pipeline step in Jenkins for scanning repositories and images for potential leaks and vulnerabilities. The tutorial emphasizes the benefits of using containerized Jenkins in Kubernetes for modern, manageable infrastructure and achieving DevSecOps through automated security checks, while also highlighting the ease of ggshield integration with GitHub Actions.

In the wake of recent Lapsus$ breaches, another significant supply chain attack has emerged involving stolen OAuth tokens used to access private GitHub repositories, affecting "dozens of organizations." These tokens, from Heroku and Travis CI third-party applications, have enabled attackers to download private source codes, highlighting a concerning trend where adversaries specifically target repositories due to the sensitive information they contain. GitHub has confirmed the tokens were compromised and used to exploit private repositories, with the goal of mining secrets to infiltrate other systems. In response, Heroku has revoked all OAuth keys to prevent further unauthorized access, though this has caused deployment issues for customers. Organizations are advised to implement OAuth App access restrictions and regularly review OAuth authorization activity to mitigate risks, while ensuring private repositories are devoid of sensitive information to prevent exploitation in current and future breaches.

Edouard has had a long-standing fascination with computers, starting with an Amstrad CPC, which led him to pursue cybersecurity after studying at Epitech in France. His early career involved establishing a security R&D department and working as a product manager for SkyRecon Systems, now Stormshield, and later at Rohde & Schwarz Cybersecurity on web application firewalls. His expertise in application security (AppSec) and interest in digital transformation made him recognize the potential of addressing secrets sprawl, prompting his move to GitGuardian. Impressed by the company's ambition and culture, he appreciates their focus on detail, asynchronous work culture, and diverse backgrounds of employees. Outside of work, Edouard enjoys a balanced lifestyle between his home in the countryside and Paris, engaging in activities like drone piloting and cooking.

Organizations frequently face the issue of exposed secrets in their code repositories, which can pose serious security risks. Automated scanning tools like GitGuardian, Gitleaks, or TruffleHog can reveal a high number of these vulnerabilities across numerous repositories, often uncovering years of poor credential management. To address this, organizations need to prioritize incidents based on risk and impact by analyzing historical data and identifying leaky secrets. Effective remediation requires a collaborative approach involving both security engineers and developers, with developers playing a crucial role in addressing the vulnerabilities due to their larger numbers compared to security personnel. The process involves identifying incidents, collecting feedback, resolving issues, and verifying remediation, with special consideration given to "orphan" incidents where the original developer is no longer available. While remediating historical incidents can be daunting, using automation and structured workflows can make the task manageable. The ultimate aim is not only to address existing issues but to implement measures that prevent future exposures, thereby reducing the overall effort required for maintaining security in the long term.

Rohit Sehgal, a Staff Security Engineer at Gojek, highlights the potential risks associated with forgotten Jenkins credentials, which can lead to the complete compromise of a software supply chain. Through a case study in Security Zines, he explains the importance of understanding what a Jenkins pipeline and CI/CD are, discusses why credentials are necessary, and outlines the problems they can present. The article also provides insights into protecting software supply chains, referencing recent incidents like the Codecov breach, and emphasizes best practices for securing CI pipelines to prevent supply chain attacks. Additionally, it points readers to further resources on supply chain security and encourages sharing the information to raise awareness.

In this article, Tiexin Guo, a Senior DevOps Consultant at AWS, shares insights on best practices for writing Terraform code, emphasizing the importance of clean, readable, and manageable code for effectively utilizing Infrastructure as Code (IaC). Guo discusses the evolution of Terraform and the necessity of understanding both the infrastructure and configuration management aspects when using IaC tools. He advises against premature future-proofing and stresses the importance of idempotency and a declarative coding style to achieve consistent outcomes. The article also challenges the notion of cloud agnosticism, arguing that vendor lock-in is often inevitable and not as detrimental as commonly perceived, thus encouraging developers to focus on using the right tools for specific tasks. Overall, the article aims to guide readers in making informed decisions tailored to their unique situations, rather than adhering strictly to one-size-fits-all best practices.

In this blog post, the author explores the use of Seccomp-BPF, a Linux kernel feature, to enhance container security by restricting the system calls a process can make, thereby preventing unauthorized actions. The post discusses the challenges of integrating Seccomp-BPF into modern development practices due to its low-level nature and highlights a tool from Red Hat, oci-seccomp-bpf-hook, that assists in creating Seccomp filters by recording system calls during container runtime. To streamline this process, the author demonstrates how to automate the creation of Seccomp filters using a Continuous Integration (CI) workflow with GitHub Actions, specifically illustrating this with a Python Flask API application. The guide emphasizes the importance of comprehensive unit and functional testing to ensure all necessary system calls are captured, which is crucial for generating accurate Seccomp filters. By integrating this automated process, developers can maintain up-to-date Seccomp profiles, thereby significantly reducing the risk of exploitation. The post concludes by encouraging the adoption of this practice as a potential industry standard, given its powerful security benefits.