All tabletop exercises
DevSecOps / supply chain·Intermediate·Technical audience
A poisoned open-source package ran in your builds for three days
The prompt — read this to the room
A public advisory says a popular open-source logging package was hijacked: version 4.8.2, published three days ago, runs a post-install script that reads environment variables and sends them to a remote server. Your dependency manifests allow minor updates. A quick search shows 14 of your repositories pulled 4.8.2, and your CI runners, which hold cloud deploy credentials, package registry tokens and a signing key in their environment, built every one of them, many times. Two developers also installed it on their laptops. What do you assume was taken?
Total duration
1 h 45 min
People to involve
5
Best fit
Saas
Who to involve
Most important first.
- Developer / DevOps
- Incident response lead
- SOC analyst
- Cloud engineer
- CISO / Head of security
What it tests
- Find every place the bad version ran, including CI, laptops and production images.
- Decide which secrets to treat as stolen and rotate them in a safe order.
- Check whether stolen credentials were used, rather than only rotating them.
- Agree dependency pinning, install-script and egress controls for build systems.
Outline of activities
- 1The advisory: is it us, and where did it run
- 2Inventory: repositories, builds, images and laptops
- 3Secrets: what each environment held and the rotation order
- 4Hunting: was anything used before rotation
- 5Hardening the build: pinning, lockfiles, egress and review
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…