Skip to content

Commit 95fd687

Browse files
david-a-wheelerSecurityCRobctcpip
authored
Add secret scanning to SCM guide, fixes #488 (#489)
* Add secret scanning to SCM guide, fixes #488 Signed-off-by: David A. Wheeler <[email protected]> * Fix markdownlint issues Signed-off-by: David A. Wheeler <[email protected]> * Update docs/SCM-BestPractices/github/repository/secret_scanning.md fixes typo Co-authored-by: Chris de Almeida <[email protected]> Signed-off-by: CRob <[email protected]> * Update docs/SCM-BestPractices/github/repository/secret_scanning.md better word choice Co-authored-by: Chris de Almeida <[email protected]> Signed-off-by: CRob <[email protected]> * Update docs/SCM-BestPractices/github/repository/secret_scanning.md "quotes" Co-authored-by: Chris de Almeida <[email protected]> Signed-off-by: CRob <[email protected]> * Update docs/SCM-BestPractices/github/repository/secret_scanning.md "quotes" Co-authored-by: Chris de Almeida <[email protected]> Signed-off-by: CRob <[email protected]> * Update docs/SCM-BestPractices/github/repository/secret_scanning.md "quotes" Co-authored-by: Chris de Almeida <[email protected]> Signed-off-by: CRob <[email protected]> * Update docs/SCM-BestPractices/gitlab/project/secret_scanning.md better word choice Co-authored-by: Chris de Almeida <[email protected]> Signed-off-by: CRob <[email protected]> * Update docs/SCM-BestPractices/README.md Co-authored-by: Chris de Almeida <[email protected]> Signed-off-by: David A. Wheeler <[email protected]> --------- Signed-off-by: David A. Wheeler <[email protected]> Signed-off-by: CRob <[email protected]> Co-authored-by: CRob <[email protected]> Co-authored-by: Chris de Almeida <[email protected]>
1 parent 8b596c2 commit 95fd687

File tree

3 files changed

+145
-0
lines changed

3 files changed

+145
-0
lines changed

‎docs/SCM-BestPractices/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,7 @@ For recommendations only applicable to GitHub or GitLab visit one of the followi
126126
* Repository Should Not Allow Committer Approvals [<img src="https://user-images.githubusercontent.com/287526/230376963-ae9b8a47-4a74-4746-bc83-5b34cc520d40.svg" alt="GitLab" height="20" width="20">](gitlab/project/repository_allows_committer_approvals_policy.md) [GitLab](gitlab/project/repository_allows_committer_approvals_policy.md)
127127
* Webhook Configured Without SSL Verification [<img src="https://user-images.githubusercontent.com/287526/230376963-ae9b8a47-4a74-4746-bc83-5b34cc520d40.svg" alt="GitLab" height="20" width="20">](gitlab/project/project_webhook_doesnt_require_ssl.md) [GitLab](gitlab/project/project_webhook_doesnt_require_ssl.md)
128128
* Project Should Have Fewer Than Three Owners [<img src="https://user-images.githubusercontent.com/287526/230376963-ae9b8a47-4a74-4746-bc83-5b34cc520d40.svg" alt="GitLab" height="20" width="20">](gitlab/project/project_has_too_many_admins.md) [GitLab](gitlab/project/project_has_too_many_admins.md)
129+
* Secret Scanning Should be Enabled [<img src="https://user-images.githubusercontent.com/287526/230375178-2f1f8844-5609-4ef3-b9ac-141c20c43406.svg" alt="GitHub" height="20" width="20">](github/repository/secret_scanning.md) [GitHub](github/repository/secret_scanning.md)
129130

130131
### Operations
131132

‎docs/SCM-BestPractices/github/repository/secret_scanning.md‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# Secret Scanning
2+
3+
policy name: secret_scanning
4+
5+
severity: HIGH
6+
7+
## Description
8+
9+
This security control checks for secrets being checked into a repository
10+
and prevents it.
11+
Turning on secret scanning detects many kinds of secrets being checked
12+
into a repository and reports it.
13+
Push protection builds on secret scanning and prevents attempts to add such
14+
secrets (and creates an alert if that is overridden).
15+
16+
## Threat Example(s)
17+
18+
Inserting a secret into a source code repository is unfortunately an easy
19+
mistake to make. Instructions for various services often
20+
encourage putting secrets into a repository (as it's the "simple" way
21+
to do it, though not the secure way).
22+
Once secrets are in a repository, they become available for anyone who
23+
can view the repository (directly or via a copy).
24+
Inserting secrets into a source code repository is a mistake, since
25+
it interferes with the whole point of a secret: keeping it secret.
26+
This is such a common type of vulnerability that it is identified as
27+
the Common Weakness Enumeration (CWE)
28+
[CWE-540: Inclusion of Sensitive Information in Source Code](https://cwe.mitre.org/data/definitions/540.html).
29+
30+
## Remediation
31+
32+
Like practically all tools, secret scanning is subject to false positives
33+
and false negatives. That said, secret scanning can prevent significant
34+
vulnerabilities and should be enabled.
35+
36+
There are two different steps, scanning and enforcement:
37+
38+
* On a new project you should enable both scanning and enforcement.
39+
* On an existing project you should enable scanning, ensure it works
40+
well first, and *then* enable enforcement.
41+
42+
### Enabling Secret Scanning
43+
44+
[The GitHub documentation describes how to enable secret scanning](https://docs.github.com/en/code-security/secret-scanning/configuring-secret-scanning-for-your-repositories).
45+
46+
In short, to enable GitHub secret scanning on a repository:
47+
48+
1. Make sure you have admin permissions
49+
2. Go to the repo's settings page
50+
3. Enter "Security" section of the sidebar, click "Code security and analysis".
51+
4. Click "Enable for secret scanning"
52+
5. Click "Save changes"
53+
54+
You may also choose to enable other secret scanning tools.
55+
For example, those with access to the Linux Foundation's LFX tools should
56+
consider enabling its secret scanning tools as well.
57+
58+
### Enforcing Secret Scanning
59+
60+
In GitHub you can enable push protection on secret scanning
61+
for repositories and organizations.
62+
When this is enabled, secret scanning "blocks contributors
63+
from pushing secrets to a repository and generates an alert
64+
whenever a contributor bypasses the block."
65+
66+
[The GitHub documentation describes how to enable push protection with secret scanning](https://docs.github.com/en/code-security/secret-scanning/push-protection-for-repositories-and-organizations).
67+
68+
In short, to enforce GitHub secret scanning on a repository:
69+
70+
1. Make sure you have admin permissions
71+
2. Go to the repo's settings page
72+
3. Enter "Security" section of the sidebar, click "Code security and analysis".
73+
4. Under "Code security and analysis", find "GitHub Advanced Security."
74+
5. Under "Secret scanning", under "Push protection", click "Enable".

‎docs/SCM-BestPractices/gitlab/project/secret_scanning.md‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
# Secret Scanning
2+
3+
policy name: secret_scanning
4+
5+
severity: HIGH
6+
7+
## Description
8+
9+
This security control checks for secrets being checked into a repository.
10+
Turning on secret detection (also called secret scanning)
11+
detects many kinds of secrets being checked
12+
into a repository and reports it.
13+
At this time GitLab's mechanism for *preventing* this event is experimental.
14+
15+
## Threat Example(s)
16+
17+
Inserting a secret into a source code repository is unfortunately an easy
18+
mistake to make. Instructions for various services often
19+
encourage putting secrets into a repository (as it's the "simple" way
20+
to do it, though not the secure way).
21+
Once secrets are in a repository, they become available for anyone who
22+
can view the repository (directly or via a copy).
23+
Inserting secrets into a source code repository is a mistake, since
24+
it interferes with the whole point of a secret: keeping it secret.
25+
This is such a common type of vulnerability that it is identified as
26+
the Common Weakness Enumeration (CWE)
27+
[CWE-540: Inclusion of Sensitive Information in Source Code](https://cwe.mitre.org/data/definitions/540.html).
28+
29+
## Remediation
30+
31+
Like practically all tools, secret scanning is subject to false positives
32+
and false negatives. That said, secret scanning can prevent significant
33+
vulnerabilities and should be enabled.
34+
35+
GitLab includes
36+
[two different secret detection methods](https://docs.gitlab.com/ee/user/application_security/secret_detection/)
37+
which can be used simultaneously:
38+
39+
* The pipeline method "detects secrets during the project’s CI/CD pipeline.
40+
This method cannot reject pushes".
41+
* The pre-receive method "detects secrets when users push changes to
42+
the remote Git branch. This method can reject pushes if a secret is detected."
43+
44+
However, as of 2024-05-14, the pre-receive method is an
45+
experiment with limited availability. Thus, we focus on the pipeline method.
46+
The pipeline method is unfortunately unable to *prevent* this, but at least
47+
it quickly warns you of the event.
48+
49+
Note that secret scanning is automatically enabled if you enable
50+
[Auto DevOps](https://docs.gitlab.com/ee/topics/autodevops/index.html#enable-or-disable-auto-devops).
51+
52+
Those with more complex needs must
53+
edit the `.gitlab-ci.yml` file manually.
54+
To do this:
55+
56+
1. Make sure you can manage project merge requests permissions
57+
2. Go to the project's settings page
58+
3. Select "Build > Pipeline editor"
59+
4. Add the following to the end of the `.gitlab-ci.yml` file:
60+
61+
~~~~yml
62+
include:
63+
- template: Jobs/Secret-Detection.gitlab-ci.yml
64+
~~~~
65+
66+
5. Select the Validate tab, then select Validate pipeline.
67+
The message "Simulation completed successfully" indicates the file is valid.
68+
6. Select the Edit tab.
69+
7. In the Branch text box, enter the name of the default branch.
70+
8. Select Commit changes.

0 commit comments

Comments
 (0)