GitHub suffered a third-party breach after a malicious threat actor was discovered smuggling data out of the repository using stolen OAuth tokens.
OAuth tokens are a standard method for automating cloud services, such as code repositories and DevOps pipelines, explains Ray Kelly, Fellow at NTT Application Security. “These tokens are considered secrets for a good reason and are often “masked” with stars or not shown at all to help protect connected business services.”
Educational Webinars, Videos & Podcasts: Receive cutting-edge insights and invaluable resources, empowering you to stay ahead in the dynamic world of security.
Empowering Content: At your computer or on-the-go, stay up-to-date when you receive our eNewsletters curated with the latest technology and services that address physical, logical, cyber and enterprise resilience.
Unlimited Article Access: Dive deep into the world of cybersecurity and risk management leadership with unlimited access to our library of online articles.