Crafting Secure Software E-Book

Greg Bulmash

• Herausgeber: Packt Publishing
• Kategorie: Fachliteratur
• Sprache: Englisch

Seitenzahl: 258

Veröffentlichungsjahr: 2024

Beschreibung

Drawing from GitGuardian's extensive experience in securing millions of lines of code for organizations worldwide, Crafting Secure Software takes you on an exhaustive journey through the complex world of software security and prepares you to face current and emerging security challenges confidently.
Authored by security experts, this book provides unique insights into the software development lifecycle (SDLC) and delivers actionable advice to help you mitigate and prevent risks. From securing code-writing tools and secrets to ensuring the integrity of the source code and delivery pipelines, you’ll get a good grasp on the threat landscape, uncover best practices for protecting your software, and craft recommendations for future-proofing against upcoming security regulations and legislation.
By the end of this book, you’ll have gained a clear vision of the improvements needed in your security posture, along with concrete steps to implement them, empowering you to make informed decisions and take decisive action in safeguarding your software assets.

Leseprobe

Crafting Secure Software

An engineering leader's guide to security by design

Greg Bulmash

Thomas Segura

Crafting Secure Software

Copyright © 2024 Packt Publishing

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the authors, nor Packt Publishing or its dealers and distributors, will be held liable for any damages caused or alleged to have been caused directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.

Publisher: Vishal Bodwani

Acquisition Editor: Sathya Mohan

Lead Development Editor: Rhea Gangavkar

Development Editors: Saba Umme Salma

Copy Editor: Safis Editing

Associate Project Manager: Yash Basil

Proofreader: Safis Editing

Production Designer: Deepak Chavan

Cover Art Designer: Daniele Brusca

First published: September 2024

Production reference: 1041024

ISBN 978-1-83588-506-2

Published by Packt Publishing Ltd.

Grosvenor House, 11 St Paul’s Square, Birmingham, B3 1RB, UK

www.packtpub.com

Contributors

About the authors

Greg Bulmash is a karaoke king who started blogging before “blog” was even a word. He’s picked up both developer certifications and press accreditations, been invited as a speaker to tech conferences on three continents, and led a CoderDojo chapter that put on around 150 free STEM education events for children in the Seattle area. At GitGuardian, Greg has produced expert-oriented company blogs, externally placed articles, and cartoons for content marketing and thought leadership on cybersecurity best practices, secrets management, software supply chain security, and cybersecurity legislation and regulation.

Thomas Segura is a seasoned technical writer and former DevOps engineer passionate about bridging the gap between security teams and developers. After developing microservices for smart grids at a major energy company, Thomas joined GitGuardian, a leading code security innovator, in 2021. As a technical content writer, he produces in-depth material on application and cloud security best practices. His notable works include the State of Secrets Sprawl report and the Secrets Management Maturity Model white paper. Thomas’ insights have been featured on Hacker News, DevOps.com, and HelpNetSecurity.com. Through his writing, he shapes the conversation around modern software security, emphasizing collaboration between development and security teams.

Table of Contents

Prefaceix

1

Introduction to the Security Landscape1

The evolving application security landscape

Security awareness

Regulatory compliance and legal considerations

Who are the threat actors?

Supply chain attack case: SolarWinds

Where GitGuardian stands in the landscape

Summary

2

The Software Supply Chain and the SDLC9

What is the software supply chain?

What is the software development life cycle?

The intersection of SDLC and SSC

SDLC stages and SSC considerations

Trustworthiness in the software supply chain

Common supply chain attack vectors and defenses

Compromise of third-party components

Supply chain poisoning via updates

Insufficient security practices in development and operations

Code repository tampering

Threat modeling

Decompose the application

Determine and rank threats

Risk assessment

Integrating risk assessment to rank the threats

Threat modeling and risk assessment: How do they differ?

Real-world SSC attacks

PHP: No harm, but foul

3CX: Compromised build servers deliver malware to hundreds of thousands

Log4j: The undependable dependency

left-pad: Many introduced to supply chain attacks

Summary

3

Securing Your Code-Writing Tools25

Securing your IDE

Issues with the IDE itself

Issues with IDE plugins

Use case: Hardening Visual Studio Code

Securing your VCS and SCM

Access and rights

Integrating security tools

Securing built-in CI/CD tools

Be sure and intentional about "which" does "what"

Use secrets management

Mask confidential information

Benefits and dangers of LLM-generated code

IP concerns and lack of provenance

Challenges and risks of using AI-generated code

Sensitive data leakage

Summary

4

Securing Your Secrets47

What are secrets?

One service, multiple secrets

Secrets in code

How do secrets end up in code?

How do you detect secrets in code?

How do you remediate a leaked secret?

Common mistakes in remediating leaked secrets

Considerations in the revoke and reissue workflow

How do you prevent secrets in code?

Secrets in tools

How do secrets end up in tools?

How do you detect secrets in tools?

How do you remediate a leaked secret?

How do you prevent secrets in tools?

Secrets in artifacts

How do secrets end up in artifacts?

How do you detect secrets in artifacts?

How do you remediate a leaked secret?

How do you prevent secrets in artifacts?

The importance of identity and access management (IAM)

Machine identities

Summary

5

Securing Your Source Code63

Package managers and repositories

How are they made vulnerable?

Testing SAST, DAST, and SCA

Why testing is important

Understanding SAST

Understanding DAST

Understanding SCA

Scanning for secrets

Creating and reading an SBOM

What is an SBOM, and why you need one

SBOM formats

How to use an SBOM from a supplier

How to create an SBOM for your customers

Think like a hacker: Ethical hacking

What makes ethical hacking “ethical"?

Offering a “bug bounty”

Summary

6

Securing Your Delivery79

What are build pipelines?

Why secure CI/CD pipelines?

Where are the threats to build pipelines?

Securing build pipelines

Stage 1: Git workflow

Stage 2: Build configuration

Securing containers and artifacts

Securing build steps

The SLSA framework

Artifact signing

Leveraging Sigstore in cloud pipelines

Securing your delivery

Project Spinnaker

Securing deployments

Infrastructure as code

Identity, secrets, and access management

Managing human and machine identities

Proactively detecting and rotating exposed secrets

Using honeytokens to detect intrusions and leaked secrets

Zero-trust networking

Summary

7

Security Compliance and Certification99

What are legislators and regulators concerned about?

Security

Data privacy

Transparency and control

What are they demanding, and how can you address it?

Protect your code and systems access

Monitor employee communications and activity

Observe best physical security practices

Encrypt everything

Disclosure, consent, and control

Transparency

Security frameworks

NIST CSF

NIST SSDF

OWASP

PCI DSS

SLSA

Proving you’re taking the right steps: Certification

Proving it to customers and partners

Proving it to regulators

Summary

8

Best Practices to Drive Security Buy-In113

Best practices to create a robust security defense

Get a clear picture of the current state

Don’t rely on compliance with security standards and regulations

Leverage real threats for strategic improvements

Understand and engage your stakeholders

Assess security awareness

Communicate effectively

Foster a security culture

Align security goals with business outcomes

ROI in cybersecurity

Annualized Loss Expectancy

Key takeaways

Success stories

A top US telecom provider reduced real-time secret incidents by 72%

An e-commerce company cut risk by 75% and boosted security team productivity by 50%

Summary

Appendix: Glossary of Acronyms and Abbreviations129

Index133

Other Books You May Enjoy140

Preface

Drawing from GitGuardian's extensive experience in securing millions of lines of code for organizations worldwide, Crafting Secure Software: An engineering leader's guide to security by design offers a comprehensive journey through the complex world of software security.

Authored by experts, this book provides unique insights into the Software Development Lifecycle (SDLC) and delivers actionable advice to mitigate and prevent risks. From securing code-writing tools and secrets to ensuring the integrity of the source code and delivery pipelines, readers will gain a solid understanding of the threat landscape, best practices for protecting their software, and recommendations for future-proofing against upcoming security regulations and legislation.

By the end of this book, you will have a clear vision of the improvements needed in your security posture and concrete steps to implement them. This knowledge will empower you to make informed decisions and take decisive action in safeguarding your software assets, preparing you to face current and emerging security challenges confidently.

Who this book is for

This book is essential reading for security and IT leaders navigating the complexities of modern software development. It's tailored for Chief Security Officers (CSOs) and Chief Information Security Officers (CISOs), Security Architects, and DevOps and IT Decision-Makers.

Ideal readers have a foundational understanding of software engineering, version control, build and delivery mechanisms. This guide will empower you to comprehend and mitigate threats in today's dynamic software factories, regardless of your technical depth.

What this book covers

Chapter 1, Introduction to the Security Landscape, explores the impact of DevOps and cloud computing on software security, highlighting new vulnerabilities. It discusses significant security incidents and their implications. Legislative impacts and strategies to mitigate risks are also covered. Understanding these challenges helps prepare for potential threats and regulatory changes.

Chapter 2, The Software Supply Chain and the SDLC, examines the role of the software supply chain in the SDLC, focusing on common attack vectors and defenses. It provides guidance on threat modeling tailored to organizational risk profiles. Real-world case studies, such as SolarWinds and Log4j, illustrate supply-chain attack impacts, which in turn helps build a robust security posture.

Chapter 3, Securing Your Code-Writing Tools, discusses securing integrated development environments(IDEs) and source code management (SCM) systems. It covers security considerations for IDE plugins and access controls, and details the risks of large language model (LLM)-generated code. This chapter also discusses strategies to integrate security tools within the development pipeline.

Chapter 4, Securing Your Secrets, highlights the risks of hardcoded secrets in code and other artifacts. It emphasizes best practices for secrets management and identity and access management (IAM). The chapter also discusses the role of automation in reducing human errors and strategies to secure potential attack surfaces, such as GitHub repositories.

Chapter 5, Securing Your Source Code, focuses on the security challenges related to source code and open source dependencies. It explains the importance of static application security testing (SAST) and software composition analysis (SCA). The creation of a software bill of materials (SBOM) for transparency is discussed.

Chapter 6, Securing Your Delivery, addresses the security aspects of build pipelines, containers, and deployment environments and details best practices to secure them. It also discusses the importance of securing configurations and monitoring tools and provides strategies for protecting infrastructure against attacks.

Chapter 7, Security Compliance and Certification, explores the legal responsibilities and regulatory frameworks for software security. It covers current and future legislation, compliance standards, and certification processes, along with practical guidance to achieve and maintain compliance. The chapter emphasizes demonstrating security measures to build trust with customers and regulators.

Chapter 8, Best Practices to Drive Security Buy-In, offers strategies to cultivate a security-conscious culture and secure stakeholder buy-in. It highlights the importance of risk assessments, effective communication, and showcasing the ROI of security initiatives. This chapter also includes real-world testimonials and success stories, and provides practical approaches to implement robust security measures.

Conventions used

There are a number of text conventions used throughout this book.

Code in text: Indicates code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter/X handles. Here is an example: “All you have to do is change the .vsix extension to .zip and use an unzipping tool to get access to the source code.”

A block of code is set as follows:

      Environment:         Variables:          DBUser: admin          DBPass: LetMeIn!2024

Bold: Indicates a new term, an important word, or words that you see onscreen. For instance, words in menus or dialog boxes appear in bold. Here is an example: “The effectiveness of these laws and regulations is regularly called into question, claiming people just click Yes and move on without reading the agreements and finding out how invasive they might be.”

Tips or important notes

Appear like this.

Get in touch

Feedback from our readers is always welcome.

General feedback: If you have questions about any aspect of this book, email us at [email protected] and mention the book title in the subject of your message.

Errata: Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you have found a mistake in this book, we would be grateful if you would report this to us. Please visit www.packtpub.com/support/errata and fill in the form.

Piracy: If you come across any illegal copies of our works in any form on the internet, we would be grateful if you would provide us with the location address or website name. Please contact us at [email protected] with a link to the material.

If you are interested in becoming an author: If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, please visit authors.packtpub.com.

Download a free PDF copy of this book

Thanks for purchasing this book!

Do you like to read on the go but are unable to carry your print books everywhere?

Is your eBook purchase not compatible with the device of your choice?

Don’t worry, now with every Packt book you get a DRM-free PDF version of that book at no cost.

Read anywhere, any place, on any device. Search, copy, and paste code from your favorite technical books directly into your application.

The perks don’t stop there, you can get exclusive access to discounts, newsletters, and great free content in your inbox daily

Follow these simple steps to get the benefits:

Scan the QR code or visit the link below

https://packt.link/free-ebook/9781835885062

Submit your proof of purchaseThat’s it! We’ll send your free PDF and other benefits to your email directly

1

Introduction to the Security Landscape

Production endpoints have long been seen as attack points and are thus defended with robust measures. In response, attackers have pivoted to compromise applications in development. Tools and components, from your code editors to your build and delivery processes, are now under attack.

That’s what we want to focus on in this book—exploring and detailing how to develop secure applications. It focuses on points in the software development life cycle (SDLC) where your products or procedures could be compromised before going live and discusses ways you can prevent or defend against such attacks.

This book also includes real-world hack incidents. These incidents are intended to help break down how a hack happened—how the attackers gained access to applications, what they did with the applications, and how it impacted the company and its customers—to arm you with the necessary facts to keep your applications secure.

These facts serve two purposes:

Help you evaluate the recommendations in this book and develop effective strategies and implementations for your companyProvide verifiable data points to drive buy-in across the spectrum of stakeholders you influence

Note

When mentioning the companies involved in these incidents, please understand that the intent is not to shame them or create a sense of sensationalism. All stories shared in this book were already reported in the press. By not anonymizing them, the goal is to maintain transparency, allowing you to verify the details if you wish, while also saving you the effort of doing so.

GitGuardian has been helping companies defend their applications and resources since 2017 and has over 500,000 customers using their software and services with both on-premises and cloud options available.

This book is designed to give software development managers, department heads, and C-level professionals an evidence-based overview of the threat landscape for application development and provide actionable insights that will help their teams develop securely throughout the SDLC, from ideation to monitoring in production.

The evolving application security landscape

In 2022, the U.S. Bureau of Labor Statistics estimated that over 2 million people in the U.S. worked as software and web developers, programmers, and testers (category 15-1250, formerly 15-1130).1 The following is a graph charting the population growth in the category over a decade of available statistics. The bars show the absolute growth while the trend line represents the year-over-year (YoY) growth percentages.

1 https://www.bls.gov/oes/tables.htm

Figure 1.1: Year-over-year growth percentage of developers in the US

Worldwide, the industry is expected to grow to over 28 million software developers in 2024.2 Thanks to complexity and specialization, a few of those developers work alone or create all the components of their software from scratch. They use software to build software, collaborate, deliver software, and provide backend services for their software, and monitor it all in production. All the software and services used by developers to create software are collectively called the software supply chain(SSC) and it has become more and more popular as an attack vector.

2 https://www.statista.com/statistics/627312/worldwide-developer-population/

The growth in software supply chain attacks is not just anecdotal—it’s being quantified. The non-profit Identity Theft Resource Center reported that between 2018 and 2023, supply chain attacks rose 2,600% to represent over 15% of reported identity data theft in 2023.3 A year earlier, Help Net Security noted that supply chain attacks had outpaced malware as a source of data breaches.4 The European Union Agency for Cybersecurity, in their Foresight Cybersecurity Threats for 2030 report, listed supply chain compromise of software dependencies as their #1 threat by the end of the decade, based on both likelihood and impact, scoring 44% higher than ransomware.

3 https://www.idtheftcenter.org/wp-content/uploads/2024/01/ITRC_2023-Annual-Data-Breach-Report.pdf

4 https://www.helpnetsecurity.com/2023/01/26/data-compromises-2022/

Regulatory pressures to address software supply chain security are increasing as well. In US President Joe Biden’s 2021 Executive Order on Improving the Nation’s Cybersecurity, over 25% of the document focused on improvements in software supply chain security, including requiring both internal federal agency developers and external software vendors to provide more transparency about their processes and the provenance of their software.

Developing securely isn’t simply about avoiding issues in the future. It is about taking the right steps, the right precautions, and being able to document that for stakeholders, customers, and regulators. For example, the U.S. Securities and Exchange Commission requires all annual reports for publicly traded companies to include a section on how the company is managing cyber risk for fiscal years starting after December 15, 2023.5

5 https://blog.gitguardian.com/secs-cybersecurity-risk-management-strategy-governance-and-incident-disclosure-rule-what-you-should-know/

Security awareness

The security culture of an organization is foundational to its ability to protect information, data, and employee and customer privacy. Companies are moving beyond reactive, episodic approaches to security and recognizing that effective enterprise-wide security requires a strategic, long-term approach, focusing more on reliable mechanisms, communication, and culture than lectures from IT and an ongoing stream of new policy mandates.

During the pandemic, industries and organizations saw their security cultures stagnate or decline. As many organizations transitioned to a work-from-home model, new security issues and concerns emerged, while the diaspora of knowledge workers made communication and education more challenging.

Threats such as ransomware can escape notice and do damage for months before detection, even in top-performing organizations. Ongoing awareness, understanding, and appropriate actions are required to ensure organizations’ data is safe and that employee and customer data is not compromised.

Security culture is a critical, must-have asset in the security toolbox. By assessing employees’ security awareness, behaviors, and culture, organizations can adapt their policies and training programs to the constantly changing threat landscape.

Regulatory compliance and legal considerations

While this will be addressed in greater detail in Chapter 7, Security Compliance and Certification, you should be aware that new legislation and regulations are being put in place at state, federal, and agency levels on multiple continents. Whether you make or simply use software, there's increasing pressure to ensure that not only the application but the information it processes is also secure.

These laws and regulations around reporting and compliance come on top of legal liability and reputational damage both for the institutions and their officers. The U.S. Securities and Exchange Commission has specifically gone after the CISO of one hacked company as part of its enforcement action. This will be discussed in detail later in the chapter. That comes on top of the company losing 64% of its market capitalization since the incident.

These laws and regulations are designed to prevent serious incidents with national or global impacts by ensuring that companies have effective strategies and practices in place.

Whether your company handles data or provides crucial services in banking and finance, transportation, utilities, or healthcare, you will face more scrutiny and responsibility from regulators and law enforcement. By adopting strong security measures, you can meet these challenges and ensure compliance, keeping your organization and its stakeholders safe.

Who are the threat actors?

Behind every cyber threat, there’s a threat actor: a person or group of people causing intentional harm by exploiting vulnerabilities in the cyber sphere. They are usually the perpetrators behind cyberattacks, and are often categorized by a variety of factors, including motive, type of attack, and targeted sector. As the frequency and sophistication of cyber threats continue to grow, so will the number of threat actors behind them.

Today, the cyber threat environment is arguably more dynamic than ever before, and threat actors are becoming more sophisticated. Understanding threat actors and their motives can help organizations better protect themselves from the damage these actors cause as they exploit vulnerabilities, compromise user identities with elevated privileges, evade security controls, damage or delete data, or manipulate sensitive information.

One of the larger developments in the security landscape over the years has been the rise of the advanced persistent threat (APT).

What is an APT?

According to the U.S. National Institute of Standards and Technology, an APT can be defined as follows:

“An adversary with sophisticated levels of expertise and significant resources, allowing it, through the use of multiple different attack vectors (e.g., cyber, physical, and deception), to generate opportunities to achieve its objectives, which are typically to establish and extend its presence within the information technology infrastructure of organizations for purposes of continually exfiltrating information and/or to undermine or impede critical aspects of a mission, program, or organization, or place itself in a position to do so in the future; moreover, the advanced persistent threat pursues its objectives repeatedly over an extended period of time, adapting to a defender’s efforts to resist it, and with determination to maintain the level of interaction needed to execute its objectives.”

While this is the textbook definition, to put it more simply, APT stands for:

Advanced: APTs have resources, skills, and organization. Contrary to the stereotypical image depicted in popular media, they are professionals, often trained by state agencies, and sometimes still employed (or sanctioned) by them.Persistent: APT actors typically set up camps, take measures to avoid detection, create backdoors to get back in if you detect and close their main entry point, and move laterally throughout compromised systems to find more things to steal or damage and more connected systems to infiltrate.Threat: Needs no explanation.

APTs include organized professionals that pull off data thefts, cryptocurrency thefts, ransomware, corporate espionage, state-sponsored espionage, and even terrorism. In many cases, it’s more than one motive and it’s profitable. As this book details hacks, it will discuss APT groups and their methods in more detail.

Chainalysis, in their 2024 Crypto Crime Report, claimed that ransomware became a billion-dollar business in 2023.6 This was an estimate of ransomware payments, exclusive of the damage done. Due to that damage, the cost of ransomware was even higher. For example, while the ransomware attack on MGM Resorts in 2023 did not result in a payment to the group that successfully infiltrated MGM’s systems, it’s estimated that the clean-up costs were around $100 million.

6 https://www.chainalysis.com/

While some of the access they gain is through deception and social engineering, APTs have increasingly used supply chain attacks to gain footholds or seed vulnerabilities in corporate and even government systems. In this regard, the SolarWinds case serves as a textbook example.

Supply chain attack case: SolarWinds

The SolarWinds supply chain attack is an example of the ability to use a successful incursion into a supply chain node to seed vulnerabilities well beyond the compromised system.

The company describes its Orion software as a “powerful, scalable infrastructure monitoring and management platform designed to simplify IT administration for on-premises, hybrid, and software as a service (SaaS) environments.”

In 2020, customers using that software were notified of an update offering the usual fare of bug fixes and feature updates. The update had been compromised by an APT believed to be affiliated with the Russian intelligence service (the SVR), and infected with malware.

In later interviews, the CEO estimated that 18,000 customers downloaded the adulterated update.7 This was just a trick to get the customers to download a bad update from a website with some deceptive variation on the company name that might escape cursory inspection by a harried office worker. The APT had compromised SolarWinds’ systems and inserted the malware in an official update package without being noticed.

7 https://www.npr.org/2021/04/16/985439655/a-worst-nightmare-cyberattack-the-untold-story-of-the-solarwinds-hack

In an attack staged over the course of seven months, the hackers obtained access to the SolarWinds network, tested that access to ensure they could execute their hack, injected malicious code into the software, and caused Orion customers to start receiving updates containing the malicious software.

Notable entities such as Microsoft, the U.S. Postal Service, the U.S. Department of Energy, and the U.S. Department of Homeland Security received and were impacted by the malicious code. Because of the privileges the software needed to perform its “infrastructure monitoring and management” duties, the hackers received backdoor access to not only the data and networks of the companies using Orion but many of their customers too.

It’s estimated that up to 30,000 entities were potentially vulnerable, though the actual exploitation of the vulnerability is believed to be significantly lower. According to security agency FireEye, even after being infected with the compromised update, “these compromises are not self-propagating; each of the attacks requires meticulous planning and manual interaction."8

8 https://www.axios.com/2020/12/14/russian-hack-cyber-emergency

As reinforcement of the accusation against Russia, the Biden administration tied its April 2021 package of sanctions against Russia, at least in part, to the SolarWinds supply chain attack.

Besides the immense reputational damage done to SolarWinds, the Securities and Exchange Commission (SEC) filed a lawsuit in October 2023 charging SolarWinds and their CISO with defrauding investors and failing to maintain adequate internal controls. Between the disclosure of the hack in 2020 and the filing of the SEC action in 2023, their stock fell by nearly 64% and the SEC action seeks to bar their CISO from being an officer or director of a public corporation for the rest of his life.

Not every hack is a hack

Along with real stories of hacks, the internet is littered with sensationalized stories of hacks.

For example, in 2021, many news outlets reported that the city of Oldsmar, Florida, had been hacked to poison its water system, which served approximately 15,000 people.9 In this case, systems that add lye to the water supply to reduce acidity in the water were altered to increase the amount by approximately 11,000 percent. The alteration was caught in time and reversed by an alert employee who prevented it from causing actual harm.

9 https://edition.cnn.com/2021/02/08/us/oldsmar-florida-hack-water-poison/index.html

No further details were released on who might be responsible or how they gained access to Oldsmar’s systems as the FBI and the Pinellas County Sheriff conducted their investigation. And that was the story until 2023. During a cybersecurity panel at a meeting of the American Society for Public Administration, the former city manager admitted that the FBI’s conclusion, after a four-month investigation, was that it wasn’t a hack. It was an employee error.10

10 https://www.wfla.com/8-on-your-side/employee-error-oldsmars-water-system-wasnt-hacked-former-city-manager-says/

While some of the hacks discussed in this book will be old enough at the time of writing to have been thoroughly covered and vetted, some more recent stories may appear simply because they provide the best illustration of a concept in the opinion of the authors. These facts have been vetted as thoroughly as possible before publication.

Where GitGuardian stands in the landscape

The proliferation of cloud services has expanded the attack surface for cybercriminals. According to IBM’s 2023 Cost of a Data Breach, 82% of breaches involved data stored in the cloud.11

11 https://www.ibm.com/reports/data-breach

One of those cloud storage services is well known to developers: GitHub. GitHub neither created nor owns Git, a popular tool for version control, source code management, and code collaboration. It is, however, the most popular Git service provider in the world.

In 2017, two French data scientists notes that their contemporaries often included plain-text credentials in the scripts and apps they wrote and they wanted to see how common it was. Since GitHub has one of the largest collections of publicly available source code in the world, they decided to scan it for credentials.

As they refined their algorithms to catch more and weed out false positives, the numbers grew more shocking. In their 2024 State of Secrets Sprawl report, GitGuardian found over 12.8 million new instances of secrets committed to GitHub repositories in 2023, an increase of over 28% from the prior year.

When the French scientists first discovered this in 2017, they started letting people know that their passwords, API keys, and other secret credentials were sitting in public view on GitHub and soon signed their first customer for a tool to detect and prevent secrets sprawl. That was how GitGuardian came into being and found its first client.

Since then, GitGuardian has built hundreds of specific detectors, provides free services to smaller developer teams, and helps clients ranging from SMBs to Fortune 500 companies find, remove, remediate, and prevent exposed credentials in their source code.

GitGuardian has expanded and improved its offering and services. It now provides the following:

Both cloud and on-premises solutions for detecting and remediating leaked secretsThe ability to scan multiple types of software artifacts and developer tools for secret leaksHoneypot credentials called honeytokens to help detect when/where hackers find your secrets

Summary

In this chapter, we’ve discussed the threat landscape, threat actors, and why your security is important to you, your customers, and governments around the world. We’ve shown how one company’s security incident became a threat to national security and how the government responded by punishing both the country responsible for the hack and the hacked company for its allegedly inadequate and deceptive response.

Jeff Bezos is famously credited with the following quote: “Good intentions don’t work, mechanisms do.”12 Alternatively “mechanisms > intentions” (mechanisms are greater than intentions) is used within Amazon’s culture.

12 https://www.cnbc.com/2022/10/06/how-this-popular-jeff-bezos-quote-drives-amazons-climate-goals.html

This is intended to mean that even the best intentions will not guarantee the best results. Corners get cut and steps get skipped by the best of us, not maliciously, but out of forgetfulness, distraction, or logic that seemed sound at the time. By creating mechanisms as a forcing function to keep those corners un-cut and those steps un-skipped, those intentions get realized more fully and more often.

As this book progresses and the different points at which the software supply chain is attacked are examined, you will explore strategies for implementing training, tools, and mechanisms across the SDLC to fortify your organization’s defenses and develop secure applications.