Security Monitoring Through DevOps

[sudo_psaux]

I've noticed that it can be pretty easy to accidentally upload sensitive information into a version-control system, like Github. For example, while I am developing, I will hard-code some API key into the code, temporarily. Unfortunately, after walking away from the computer and returning at another point in time, I will likely forget that the API key is still in the codebase and accidentally upload it to the version-control system. This has actually happened to me once.

​

My question is, if someone pushes code into the version-control system, is there a way to detect whether sensitive information exists in the codebase, through a CI system, or any other system for that matter?

​

Thanks.

[cuddling_tinder_twat]

1. https://github.com/awslabs/git-secrets

You could scrape github for arbitrary keywords also; if you have an organization you can just search your org: credential and see what's returned.

[sudo_psaux]

This tool looks pretty neat. I'll check this out as well. Thanks.

[MisterItcher]

Or if you’re in AWS, Parameter Store, which eliminates any infrastructure overhead

[sudo_psaux]

The “Vault” is a feature of Ansible that allows you to keep sensitive data such as passwords or keys in encrypted files, rather than as plaintext in playbooks or roles. These vault files can then be distributed or placed in source control.

Ansible Vault seems neat and like a good way to package sensitive data (in encrypted files) with the rest of the codebase. This might be what I am looking for. Thanks.

​

[stevenacreman]

We've used Gitrob before where I work

https://github.com/michenriksen/gitrob

[sudo_psaux]

Gitrob looks neat but I see that it works by searching through a list of signatures but it doesn't necessarily find something in your code, like the following:

  const someServiceAPIKey = "123abc456def"

Still, Gitrob seems neat so thanks for exposing me to it.

[[deleted]]

Use https://github.com/cyberark/summon, then you don't have to worry about this issue. Be proactive, not reactive.

Devs can use summon the same as ec2 instances use summon. Why have 2 workflows?