The Cyber Defense eMagazine February Edition for 2024

More documents

Recommendations

Info

- Auth0 Keys - Azure Active Directory API Keys - Database credentials for providers such as MongoDB, MySQL, and PostgreSQL. - Dropbox Keys. - Coinbase Credentials - GitHub OAuth App Keys. - SSH Credentials While it is tempting to focus on the larger numbers of total occurrences found, the secrets found to be valid pose the most immediate and critical threat. The researchers used ggshield, the GitGuardian CLI, for their research, which looks for over 400 types of secrets, both specific detectors and generic patterns, with a built validation process. Not all secrets can be checked for validity, but at the time the research was conducted in October 2023, over 190 specific types of credentials could be validated. It is important to note that just because a credential can not be validated does not mean it should be considered invalid. Some systems, such as Hashicorp Vault, Kubernetes clusters, Okta, or Splunk, do not yet offer a non-intrusive way to test if a credential is valid. Rather, you should think of these findings as divided into 'valid' and 'yet to be validated.' Work safely Here are some tips on how to avoid accidentally including secrets in your PyPI, or any other projects. *Avoid plaintext credentials in code If you never add a secret to your code, then there is no way for it to end up in your PyPI package. Easier said than done, we admit, but this is a skill just as valuable as avoiding infinite loops or stack overflows in your code. There are multiple tools that make it easy to programmatically call read-only values from files outside of version control, such as `python-dotenv`. While a well-managed `.env` file is a practical solution, you can stay even safer by leveraging Cloud Secrets Managers, such as Azure Key Vault or AWS Secrets Manager. These secrets managers can be used to create and use secrets across cloud infrastructure, come standard with most modern cloud providers, and are very well documented. *Scan before you release Removing a secret from an uncommitted file is easy and very inexpensive. Removing that same secret from shared code is practically impossible and a time drain. We always want to 'shift left' and test early and often, especially when secrets are involved. Performing a secrets scan before you release, or before you even make a commit is the most cost-effective way to ensure a secret does not get leaked. Cyber Defense eMagazine – February 2024 Edition 72 Copyright © 2024, Cyber Defense Magazine. All rights reserved worldwide.
There are multiple tools that will let you automate the scanning process, such as ggshield, which you can use in a pre-commit Git hook. Aside from just finding the secret, any good scanner will also provide information such as type, number of occurrences, and if the secret is valid. *PyPI secrets sprawl is solvable Unique secrets added over time The research ultimately reveals the disturbing trend that the number of secrets being added to PyPI is growing steadily over time. In the last year alone, the research shows over 1,000 unique secrets have been added via new projects and commits on PyPI. While this might sound discouraging, this is a challenge we believe can be addressed through raising awareness, education and ever-improving developer tooling. We hope the findings of this report help you with raising the issue within your organizations and projects. The Python community continues to innovate and work to make all developers' lives better. Donating useful code back to the community is something we hope to see more people do, but we want to see it done safely. GitGuardian can help you work safely and keep your projects free of secrets. The GitGuardian Secrets Detection platform is free for open source contributions and teams with 25 or fewer developers. We want to make sure your shared code contains only the intended logic and not your valid secrets. > Hear directly from Tom Forbes about his PyPI research in his appearance on The Security Repo Podcast. EMBED: https://www.youtube.com/watch?v=AhH0aGFPoO4 Cyber Defense eMagazine – February 2024 Edition 73 Copyright © 2024, Cyber Defense Magazine. All rights reserved worldwide.
Page 1 and 2:
How One Industry Exemplifies the Im
Page 3 and 4:
Data Breach Search Engines --------
Page 5 and 6:
@MILIEFSKY From the Publisher… De
Page 7 and 8:
Welcome to CDM’s February 2024 Is
Page 9 and 10:
Cyber Defense eMagazine - February
Page 11 and 12:
Page 13 and 14:
Page 15 and 16:
2001 2024 Cyber Defense eMagazine -
Page 17 and 18:
Page 19 and 20:
How One Industry Exemplifies the Im
Page 21 and 22: That is where things stand in my in
Page 23 and 24: current on the mission and values o
Page 25 and 26: So, monitoring and managing vendor
Page 27 and 28: About the Author Caroline McCaffery
Page 29 and 30: How so? Businesses can make things
Page 31 and 32: Using Cmmc 2.0 To Transform Your Cy
Page 33 and 34: equire the implementation of additi
Page 35 and 36: for the Department of Energy’s Cy
Page 37 and 38: • IT no longer controls where and
Page 39 and 40: For example, the Cloudbrink service
Page 41 and 42: 5 Cybersecurity Resolutions for The
Page 43 and 44: The Importance of Cyber Hygiene for
Page 45 and 46: The key steps to improve your cyber
Page 47 and 48: Connecting Tech to Black America By
Page 49 and 50: Establish partnerships with HBCUs E
Page 51 and 52: Perhaps the most obvious example of
Page 53 and 54: Crafting AI’s Future: Decoding th
Page 55 and 56: The implementation of regulations c
Page 57 and 58: AI Is Revolutionizing Phishing for
Page 59 and 60: That’s why security awareness tra
Page 61 and 62: culmination of this race will revea
Page 63 and 64: Traditionally, DBSEs would only inf
Page 65 and 66: Enhancing Cybersecurity Defenses: T
Page 67 and 68: Social engineering testing In the e
Page 69 and 70: GitGuardian Researchers Find Thousa
Page 71: *Emergent trends While everything f
Page 75 and 76: Good Security Is About Iteration, N
Page 77 and 78: to incorporate architectural and de
Page 79 and 80: Hacking and Cybersecurity Trends to
Page 81 and 82: detect attacks as they are occurrin
Page 83 and 84: Legacy solutions hinder an organiza
Page 85 and 86: About the Author Thomas Müller-Mar
Page 87 and 88: Having worked closely with financia
Page 89 and 90: device is emitting its signal the t
Page 91 and 92: Navigating the API Security Landsca
Page 93 and 94: that entities (users, services, or
Page 95 and 96: examine financial transactions, net
Page 97 and 98: Offensive Awakening: The 2024 Shift
Page 99 and 100: Not only are legislators pushing fo
Page 101 and 102: Let’s dive into how security lead
Page 103 and 104: Overcoming Common Data Security Cha
Page 105 and 106: The Risks of Over-Privilege Alongsi
Page 107 and 108: Quishing Campaign Exploits Microsof
Page 109 and 110: After inserting their email address
Page 111 and 112: more expensive and time consuming.
Page 113 and 114: Cotton Sandstorm or Static Kitten h
Page 115 and 116: Spike in Layoffs Pose Serious Cyber
Page 117 and 118: About the Author Adam Gavish is the
Page 119 and 120: The Crucial Role of Data Categoriza
Page 121 and 122: The Next Generation of Endpoint Sec
Page 123 and 124:
Next-Generation Endpoint Security:
Page 125 and 126:
As I reflect back on the past few m
Page 127 and 128:
Why Is Hardware More Secure than So
Page 129 and 130:
can achieve throughput levels of up
Page 131 and 132:
ecome more secure. By the end of 20
Page 133 and 134:
Zero Trust Matures, Insider Threat
Page 135 and 136:
of the risk of insider threats and
Page 137 and 138:
Zero Trust: Navigating the Labyrint
Page 139 and 140:
• Enhanced Security: Zero trust b
Page 141 and 142:
Page 143 and 144:
Page 145 and 146:
Page 147 and 148:
Page 149 and 150:
CyberDefense.TV now has 200 hotseat
Page 151 and 152:
Books by our Publisher: Amazon.com:
Page 153 and 154:
Page 155:
i https://www.whitehouse.gov/briefi
show all

The Cyber Defense eMagazine February Edition for 2024

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?