What is the cost of a secret

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

What is the cost
of a secret?
Identifying secrets with Checkov
before public exposure
Steve Giguere
Developer Advocate - B...

Horror stories

What is a “secret”?
Passwords
90s : God, Sex, Love, and “Secret”
Now: 123456, 123456789, qwerty,
password and “solarwinds1...

What is a “secret”?
Passwords
90s : God, Sex, Love, and “Secret”
Now: 123456, 123456789, qwerty,
password and “solarwinds1...

Password

P@ssword

P@ssw0rd

P@ssw0rd1

P@ssw0rd1!

P@ssw0rd2!

P@ssw0rd3!

P@ssw0rd4!

P@ssw0rd5!

P@ssw0rd9!

P@ssw0rd1!

SHA-256 of P@ssw0rd1!:
3676ea22cb314e1c8ff8e4cb148d4f986b7f8e1a8f54f581053d853fbbb961a8

What is a “secret”?
● Passwords
● Database credentials
● Encryption keys (e.g., PGP keys)
● API keys and tokens
● SSH keys

Examples of how secrets get revealed publicly
● Forget to add variables ﬁle to .gitignore
● Coding database credentials to...

What is Infrastructure as Code (IaC)

What is Infrastructure as Code (IaC)
Procedural (eg. Ansible) Declarative (eg. Terraform)

What is Infrastructure as Code (IaC)
resource "cake" "birthday surprise"
{
Icing = “vanilla”
Fondant = false
Sponge = “Cho...

Examples of how secrets get revealed publicly
● Forget to add variables ﬁle to .gitignore
● Coding database credentials to...

What do you do if credentials are exposed?
1. Disable and revoke the key ASAP
2. Look for compromised services
3. Review l...

Best Practices
● Create your secrets supply chain before your automation
● Dev:
○ Add your sensitive variables to a ﬁle an...

Intro to Checkov
● Open source
● Analyze infrastructure as
code (IaC)
● Terraform,
CloudFormation,
Kubernetes, Helm, ARM
T...

=
/ detect-secrets
+

=
/ detect-secrets
+

Three types of identiﬁers
● Regular expressions
● Keywords
● Entropy

Three types of identiﬁers
● Regular expressions
● Keywords
● Entropy
● Artifactory credentials
● AWS access keys
● Azure s...

Three types of identiﬁers
● Regular expressions
● Keywords
● Entropy
password, pwd, api*_key
+

Let’s see it!

Key Takeaways:
● Keep secrets secret
● Be prepared for leaks in advance
● Create your secrets supply chain before your aut...

github.com/bridgecrewio/checkov

Share SlideShare

Facebook
Twitter
LinkedIn

Embed

Size (px)

Show related SlideShares at end

WordPress Shortcode

Link

LinkedIn
Facebook
Twitter
Email

Replay

Top clipped slide

1 of 33 Ad

1 of 33 Ad