Why your CISO should care about Slack

In the digital realm, secrets (API keys, private keys, username/password combinations, etc.) are the keys to the kingdom. But what if those keys were accidentally left exposed in the very tools we use to collaborate every day?

A single secret can wreak havoc

Imagine this: it’s an ordinary Tuesday in June 2024. Your development team is knee-deep in sprints, Jira tickets are flying, and Slack is buzzing with the usual mix of cat memes and code snippets. What you don’t know is that there’s a ticking time bomb hidden in all this digital chatter – a public account that gives you unfettered access to your company’s assets.

Fast forward a few weeks and you’re in the middle of a CISO’s worst nightmare. Terabytes of customer data were stolen, including millions of bank account details. Your company is making headlines and new cases are popping up every day. Guilty? A secret inadvertently shared in a Jira comment.

This is not a far-fetched scenario. This recently happened to a $40 billion analytics firm. This event, like many others, is forcing us to rethink our approach to secret management and expand our vigilance beyond traditional code repositories.

The problem: secrets are everywhere, and they’re multiplying

Let’s face it: secrets are like dandelions on a spring breeze – they spread and multiply faster than we can keep track of them. These are not just ordinary passwords; we’re talking about the keys that allow our increasingly complex systems to interact securely. API keys, access tokens, encryption keys are the silent enablers of our interconnected digital ecosystem.

According to CyberArk, machine identities now outnumber human identities by a staggering 45 to 1. Let that sink in for a moment. For every person in your organization, there are 45 machine identities, each potentially holding their own set of secrets.

But here’s where it gets really interesting (or terrifying, depending on your perspective): those secrets don’t just hide in your source code. They’re scattered across a huge number of collaboration tools – Slack, Microsoft Teams, Jira, Confluence – you name it. Designed to improve productivity and facilitate collaboration, these platforms have inadvertently become the new frontier for classified information leaks.

Your collaboration tools are a goldmine for attackers

Now you might be thinking, “Sure, but our development team knows better than to insert sensitive information into Slack.” Well, I hate to break it to you, but the data suggests otherwise. In a a recent GitGuardian analysisa leading secret discovery company, they found something that should make every CISO sit up and take notice:

1. Hard-coded secrets in source code are common (more than 12 million secrets were exposed on GitHub in 2023 alone). However, people are even more likely to reveal secrets in collaboration tools!
2. The secrets found in these tools were often different from the secrets in the source code, effectively doubling the attack surface.
3. Most alarmingly, the secrets exposed in Slack and Jira were, on average, more severe compared to the secrets in the source code.

We’re not just talking about low-level API keys here. We’re talking about high-severity secrets that could potentially give widespread access to critical systems.

But wait, it gets worse. With over 65,000 companies relying on Jira Software for project management and hundreds of thousands of vulnerable Atlassian Confluence instances at risk of remote access, the scale of this problem is truly large swaying.

Solution: Extend the perimeter of the detection of secrets

So what’s a security-conscious organization to do? The answer is clear: it’s time to expand the perimeter of secret detection beyond source code and into the realm of collaboration tools.

But here’s the thing – it’s not just about casting a wider net. We are talking about an instant response. In the world of leaked secrets, every second counts. You need real-time detection and remediation capabilities that can keep up with the fast-paced nature of threat actors.

This is where platforms like GitGuardian come into play. With integrations with Slack workspaces, Microsoft Teams tenants, Jira sites, and Confluence, GitGuardian lets you extend your secure perimeter almost instantly. Here’s how it works:

1. Monitoring in real time: GitGuardian scans your collaboration tools in real-time, detecting secrets as soon as they are shared.
2. Summary notices: Multiple occurrences of the same secret across platforms are combined into a single incident, reducing alert fatigue.
3. Validation checks: The platform doesn’t just flag potential secrets; it checks if they are still valid and exist in the source code.
4. Quick fix: With real-time alerts, you can take quick action to revoke and rotate compromised secrets.

Remember, while you can never be too quick to be completely safe from all attackers, acting quickly can greatly reduce your window of exposure.

Cultivating a culture of awareness of secrets

While enhancing your detection capabilities is a critical cyber defense measure, it’s also important to foster a culture of privacy awareness within your organization. Here are some strategies to consider:

1. Continuously train your team about the importance of secret management and the risks associated with sharing sensitive information in collaboration tools.
2. Creating and communicating clear recommendations on how to handle secrets in different contexts.
3. Provide safe alternatives to share sensitive information as needed, such as encrypted channels or special secret management tools.
4. conduct regular audits of your collaboration tools to detect and eliminate any stored secrets (the GitGuardian platform provides all the KPIs you need for this).

The road ahead: to be ahead

As our digital ecosystems continue to evolve, so will the challenges of managing secrets. The main thing is to stay alert and adapt. Keep an eye out for new collaboration tools and be proactive in expanding your secrets discovery capabilities to cover new potential leak vectors.

In cybersecurity, what you don’t know can hurt you. By expanding the perimeter of secret discovery to include collaboration tools, you’re not just eliminating a leak—you’re strengthening your security posture.

Get started with GitGuardian scan and fix hard-coded secrets in your productivity tools. You won’t have to worry the next time someone in your company hits send on a Slack message or Jira comment without thinking.