English
Menu

Cyber Attacks and Defense in Practice

A developer accidentally committed a configuration file containing an API key for a cloud service to a public Git repository. On noticing, the developer immediately committed a change deleting the file. Which of the following is the most appropriate response after this?

  1. AA deletion has been committed, so nobody can see the key any more and nothing further needs to be done
  2. BIt remains in the history and may already have been harvested, so revoke the key at once, replace it with a new one and check the usage records for misuse
  3. CRenaming the repository makes the old contents published under the previous name inaccessible, so the leaked key can continue to be used as it is
Show answer and explanation

Answer: B. It remains in the history and may already have been harvested, so revoke the key at once, replace it with a new one and check the usage records for misuse

In Git, even after a change deleting a file is committed, earlier versions remain in the history and anyone can retrieve them. Public repositories are scanned automatically within a short time by programs looking for credentials, so a key should be treated as leaked from the moment it was published. The most important step is to revoke the key and replace it with a new one; after that, the usage records are checked and, if necessary, the key is also removed from the history. To prevent recurrence, credentials are kept in a secrets management service and a mechanism that detects secrets before committing (secret scanning) is used.

  • A. Old versions remain in the history, and the key may already have been harvested while it was public.
  • B. Correct. First revoke and replace the key, then check whether it has been misused.
  • C. Renaming does not erase contents that have already been copied, and it does not change the fact that the key leaked.
Practice this topic Back to topic

Books on Cyber Attacks and Defense in Practice Ad

As an Amazon Associate I earn from qualifying purchases.

More Cyber Attacks and Defense in Practice questions

  1. For four incidents at an organization, the time from occurrence to detection and the time from detection to containment were 10 hours and 4 hours for incident 1, 30 hours and 2 hours for incident 2, 2 hours and 6 hours for incident 3, and 6 hours and 4 hours for incident 4. Which of the following is the correct combination of the mean time from occurrence to detection (MTTD) and the mean time from detection to containment (MTTC)?
  2. For ransomware damage, the loss per incident (SLE) is estimated at 40 million yen and the annual number of occurrences (ARO) at 0.5. Control A costs 6 million yen a year and reduces occurrences to 0.2 per year. Control B costs 3 million yen a year and does not change the number of occurrences but speeds up recovery, reducing the loss per incident to 24 million yen. With the annualized loss expectancy ALE = SLE × ARO and ROSI = (reduction in ALE − annual cost of the control) ÷ annual cost of the control, which of the following correctly gives the control with the larger ROSI and its value?
  3. An IDS examines 1 million connections a day, of which 100 are actual attacks. The IDS detects 99% of attacks and wrongly judges 0.1% of non-attack connections to be attacks. Which of the following is closest to the proportion of the alerts raised by the IDS that are actual attacks?
  4. At a SOC, the SIEM raises 1440 alerts a day, occurring evenly throughout the day. SOAR's automated processing handles 75% of the alerts without analyst review, and each remaining alert needs an average of 10 minutes of analyst work. Assuming analysts can work without breaks, which of the following is the minimum number of analysts who must be on duty at all times to keep up with the rate at which alerts occur?
  5. The Cyber Kill Chain presented by Lockheed Martin in 2011 divides the flow of a targeted attack into seven stages. Which of the following gives the stages in the correct order?

Comparisons in this topic