Page 155 - Cyber Defense eMagazine June 2024

One of the report's most alarming findings is that many of these credentials stay valid for a long time,
even if the code hosting them disappears from public exposure. A staggering 90% of valid secrets remain
active for at least five days after the author is notified, leaving organizations at risk of being vulnerable to
what the report calls "zombie leaks." These are lingering credentials that were erased but not invalidated.
Because they are still valid and exploitable, they represent an invisible but high-impact vulnerability that
could provide attackers with a stealthy way to infiltrate systems.

This critical security gap underscores the urgent need for organizations to implement robust secrets
management practices and automate the remediation process to minimize the impact of leaked secrets.

Lessons Learned from the XZ Utils Backdoor Incident

This story underscores a painful but critical truth: that open-source security is not just a concern for IT
departments or tech companies—it's a business imperative for all. Today, every organization, regardless
of its open-source activity, should prioritize the security of these shared codebases and consider
platforms like GitHub integral to their attack surface.

Implementing a comprehensive monitoring and auditing strategy can help organizations mitigate the risk
of seeing a key exploited by a malicious actor. For that, they need the ability to identify leaks outside of
the repositories over which the organization has control, such as personal or open-source repositories.
This can be achieved with regular scanning of repositories for exposed secrets, such as API keys,
database credentials, and access tokens, which can serve as entry points for attacks.

Investing in automated monitoring and auditing tools can significantly streamline the process and reduce
the burden on security teams. These tools can continuously scan repositories, provide real-time alerts,
and generate comprehensive reports, enabling organizations to maintain a strong security posture on
GitHub.

Moreover, auditing GitHub repositories can uncover hidden threats, such as malicious code injections,
backdoors, and supply chain attacks. By thoroughly reviewing code changes, commit histories and
contributor activities, organizations can detect suspicious patterns and take swift action to mitigate risks.

However, it is essential to note that monitoring and auditing alone are not sufficient. Organizations must
also establish clear policies and procedures for responding to identified risks and vulnerabilities. This
includes implementing efficient incident response plans, conducting regular security training for
developers, and fostering a culture of security awareness throughout the organization.

By prioritizing proactive monitoring and auditing of GitHub repositories, organizations can effectively
reduce their attack surface, protect their valuable assets, and ensure the integrity of their software supply
chain. In an era where supply chain attacks are becoming increasingly sophisticated and prevalent,
neglecting GitHub security is a risk no organization can afford to take.

Cyber Defense eMagazine – June 2024 Edition 155
Copyright © 2024, Cyber Defense Magazine. All rights reserved worldwide.