GitGuardian CEO advises security leaders on briefing executives about leaked credentials and revocation
In a Help Net Security interview, GitGuardian CEO Eric Fourrier argues that leaked credentials should be handled as an accountability and response problem, not a blame problem. He warns that deleting an exposed commit or making a repository private does not revoke the credential, so the underlying risk remains. He says a security leader should be able to show that the company monitors public code for its credentials, knows which exposed credentials are still valid, and knows who must act. Fourrier cites GitGuardian's own research that more than 90% of credentials tied to notified exposures were still unrevoked days later. The interview is opinion and guidance rather than a report on a specific intrusion, so no CVE, exploitation or attribution is reported.
Remediação
- Revoke an exposed credential first; deleting the commit or making the repository private does not revoke it (helpnetsecurity.com).
- Publish a way for outsiders to report exposed credentials, with a named person who reads reports and a test of that channel each quarter (helpnetsecurity.com).
- Measure the time from report to revocation and track the slowest cases, not only the median (helpnetsecurity.com).
- Monitor for corporate credentials outside controlled systems, including developers' personal public repositories and AI-assisted workflows (helpnetsecurity.com).
Linha do tempo
-
GitGuardian CEO advises security leaders on briefing executives about leaked credentials and revocation
ler a análise desta fonte ocultar
In a Help Net Security interview, GitGuardian CEO Eric Fourrier argues that leaked credentials should be handled as an accountability and response problem, not a blame problem. He warns that deleting an exposed commit or making a repository private does not revoke the credential, so the underlying risk remains. He says a security leader should be able to show that the company monitors public code for its credentials, knows which exposed credentials are still valid, and knows who must act. Fourrier cites GitGuardian's own research that more than 90% of credentials tied to notified exposures were still unrevoked days later. The interview is opinion and guidance rather than a report on a specific intrusion, so no CVE, exploitation or attribution is reported.
Remediation
- Revoke an exposed credential first; deleting the commit or making the repository private does not revoke it (helpnetsecurity.com).
- Publish a way for outsiders to report exposed credentials, with a named person who reads reports and a test of that channel each quarter (helpnetsecurity.com).
- Measure the time from report to revocation and track the slowest cases, not only the median (helpnetsecurity.com).
- Monitor for corporate credentials outside controlled systems, including developers' personal public repositories and AI-assisted workflows (helpnetsecurity.com).