A global survey of 1,000 IT leaders from organizations with more than 500 employees published today finds that 79% have experienced or are aware of secrets leaking within their organization. Nevertheless, three-quarters (75%) expressed moderate to high confidence in their organization’s ability to detect and prevent hardcoded secrets in source code.
Conducted by GitGuardian in collaboration with CyberArk, the survey finds on the plus side that 77% of respondents work for organizations that are currently investing in or planning to invest in secrets management tools by 2025, with 75% focusing on secrets detection and remediation tools.
Overall, the survey finds that 74% of respondents have implemented at least a partially mature strategy to prevent secret leaks. However, 23% still rely on manual reviews or lack a defined strategy, the survey finds.
Thomas Segura, a technical engineer for GitGuardian, said the biggest issue organizations encounter when it comes to managing and securing secrets is they can be found everywhere. Cybercriminals, meanwhile, have become more adept at scanning for them so the number of incidents where application environments are being compromised using stolen credentials is increasing, he noted.
Chris Smith, director of product marketing for Cyber Ark, a provider of privileged access management (PAM) platform, added that there are also now many types of human and machine identities that once compromised can provide access to a wide range of applications and services as cybercriminals continue to steadily escalate the privileges they have stealthily gained. In some cases, cybercriminals are observing IT environments for months to determine how to inflict the most amount of damage possible.
The best way to combat those potential threats is to first ensure secrets are encrypted in a vault, and then have a set of processes in place to ensure those secrets are regularly rotated in case they might have been previously compromised, said Smith.
Overall, the survey finds respondents said they rotate 36% of their secrets on an annual basis. That pace of rotation, however, might not be frequent enough and, of course, means that 64% of respondents are not nearly as diligent.
In total, just under a third of respondents (32%) admitted that hardcoded secrets represent a risk to their software supply chain.
Additionally, 43% of respondents are concerned about the potential of increased leaks in codebases as cybercriminals begin to employ artificial intelligence (AI) to identify and reproduce patterns in the way secrets are being created, configured and stored.
In the meantime, when there is a breach the survey finds the average time to remediate a leaked secret is 27 days, so even after it is discovered there is still a significant opportunity for cybercriminals to wreak havoc.
Hopefully, as organizations invest more in DevSecOps tools and platforms the overall state of API security will improve. A Techstrong Research survey finds less than half (47%) of respondents work for organizations that regularly employ best DevSecOps practices. On the plus side, a full 59% of respondents said they are also making further investments in application security, with 19% describing their investment level as high.
The challenge, as always, is making sure those investments are applied in a way that ensures the maximum application security benefit for all concerned.
