Ziad Ghalleb, Founder of GitGuardian, talks about their free tool 'HasMySecretLeaked' to check if your secret was exposed on GitHub. They discuss the perception of secrets and security among developers, the importance of addressing leaked secrets, and the need to avoid repeating mistakes. The podcast also explores challenges with shadow code and personal emails on GitHub and highlights resources for increasing awareness and ensuring secret security.
Expand secret management programs beyond AWS and consider the range of services and platforms in use.
Utilize the Has My Secret Leaked tool by GitGuardian to check if secrets have been exposed on GitHub.
Deep dives
The Importance of Secret Management Programs
In this podcast episode, the speaker highlights the significance of secret management programs, particularly in relation to cloud-based environments. They emphasize the need to expand existing secret management programs beyond just AWS secrets and consider the range of services and platforms in use. The speaker suggests that a discovery phase is essential to identify the architecture and types of services utilized. They stress the importance of going back to first principles and threat modeling to ensure comprehensive coverage. By focusing on observability, continuous monitoring, and an outcome-based approach, organizations can aim for minimal secret leaks and a zero-heartcoded secrets policy.
Understanding Secrets and Categories
The podcast delves into the concept of secrets and the different categories they can fall into. It mentions data storage secrets, such as database credentials, cloud provider secrets for accessing cloud infrastructure, messaging system secrets, and secrets used by developer tools. The speaker highlights the importance of recognizing patterns and using regular expressions to identify secrets with specific patterns, as well as acknowledging high-entropy secrets with random and complex structures. The conversation emphasizes the need for a multi-layered approach to secret security, combining central storage systems with continuous monitoring.
Has My Secret Leaked: A Forensic Tool
The podcast introduces a free tool called Has My Secret Leaked, developed by GitGuardian. This tool is inspired by 'haveibeenpwned.com' and allows users to check whether their secrets have been leaked on GitHub. The tool employs a privacy-focused approach where users' secrets are hashed locally in the browser before being sent for verification. The response received contains encrypted matches, indicating potential leaks, without revealing specific details. This tool serves as a post-incident forensic solution to investigate and respond to secret leaks.
The Maturity of Secret Management
The conversation explores the maturity of secret management programs and suggests a capability-based model rather than a traditional maturity model. It emphasizes the need for continuous improvement and reduction in secret leaks over time. The speaker recommends starting with secret scanning as a foundational capability, as it is easily understood by all team members. They also discuss the importance of scaling secret management across different cloud platforms and expanding coverage to account for shadow development and personal accounts. The goal is to achieve an outcome where leaks are minimized, and secrets are managed effectively throughout the organization.
You know that feeling when you are unsure if you AWS secret that leaked is still available for use. There is no easy way to check this apart from looking in AWS to see if anyone used it. Turns out there could be another way.We have Ziad Ghalleb from GitGuardian to share free tool they released to help people look up if their secret was exposed on Github