WEBVTT 00:00:00.940 --> 00:00:03.240 Welcome to File Analysis using TruffleHog. 00:00:03.710 --> 00:00:07.050 My name is Tim Coakley, and I'll be your instructor for this course. 00:00:07.640 --> 00:00:09.860 I'm really happy you've chosen to take this course. 00:00:10.160 --> 00:00:13.450 So let's get started with some of the background information about TruffleHog. 00:00:14.840 --> 00:00:18.460 TruffleHog was originally created by Dylan Ayrey, and has been actively 00:00:18.460 --> 00:00:22.530 maintained for many years, and is publicly available on GitHub. 00:00:22.530 --> 00:00:27.450 TruffleHog complements existing blue team security strategies by allowing 00:00:27.450 --> 00:00:32.290 you to automatically assess and audit for secrets and credentials that may 00:00:32.290 --> 00:00:34.160 be stored within source code repositories. 00:00:35.240 --> 00:00:38.080 This is a unique feature that addresses a potentially 00:00:38.080 --> 00:00:40.360 serious security gap in many environments. 00:00:40.940 --> 00:00:43.910 TruffleHog uses the command line to operate and is 00:00:43.910 --> 00:00:46.550 relatively simple to configure, use, and learn. 00:00:46.940 --> 00:00:50.190 This tool can be used to assess multiple or single repositories, 00:00:50.330 --> 00:00:52.840 as well as be configured to meet broad or specific 00:00:52.840 --> 00:00:54.860 security requirements that you may need. 00:00:55.240 --> 00:00:59.240 It's available currently as open source and is free to download from GitHub. 00:00:59.240 --> 00:01:02.200 There are two key areas of interest when using TruffleHog. 00:01:02.200 --> 00:01:05.200 First is performing an assessment or audit of a repo. 00:01:06.040 --> 00:01:08.160 I will use the term repo a lot in this course, 00:01:08.420 --> 00:01:11.180 and when I do, I'm referring to a source code repository, 00:01:11.190 --> 00:01:12.380 such as GitHub. 00:01:12.380 --> 00:01:16.290 TruffleHog can perform a search using the default configuration settings, 00:01:16.670 --> 00:01:20.530 so with minimal changes, can quickly audit your repo environments. 00:01:21.040 --> 00:01:24.490 This first option is great for first‑time use when you want to get an 00:01:24.490 --> 00:01:28.280 idea of the TruffleHog search capabilities and as a way to perform a 00:01:28.280 --> 00:01:30.990 quick assessment of a repo in your organization. 00:01:31.370 --> 00:01:33.640 Secondly, is the customized assessments. 00:01:33.910 --> 00:01:35.980 TruffleHog can provide a lot of output, 00:01:36.110 --> 00:01:38.370 which could be overwhelming to a security team, 00:01:38.370 --> 00:01:41.280 so you may only want to locate specific information. 00:01:41.540 --> 00:01:44.530 Maybe you're only concerned about specific types of credentials 00:01:44.540 --> 00:01:47.260 and want to control the output and gradually increasing the 00:01:47.260 --> 00:01:49.850 search criteria and output as you mature. 00:01:50.000 --> 00:01:53.300 Customizing and configuring an instance of TruffleHog to meet 00:01:53.300 --> 00:01:56.200 specific use cases is a very powerful feature. 00:01:56.400 --> 00:01:58.970 It's also worth mentioning that you can always run different 00:01:58.970 --> 00:02:01.760 instances of TruffleHog in different environments, 00:02:01.840 --> 00:02:03.840 each with their own custom settings. 00:02:03.840 --> 00:02:07.050 How you choose to operate each instance will vary, 00:02:07.190 --> 00:02:07.770 for example, 00:02:07.770 --> 00:02:12.080 looking for high entropy strings indicative of secrets or tokens through to 00:02:12.080 --> 00:02:16.550 performing custom regular expression searches, reporting can be displayed on 00:02:16.550 --> 00:02:20.210 screen or sent to a file or other automation process. 00:02:20.840 --> 00:02:24.380 Before I cover the details of TruffleHog and the technical commands, 00:02:24.670 --> 00:02:28.190 it's worth covering and understanding cybersecurity frameworks. 00:02:28.190 --> 00:02:30.940 There are several frameworks available, 00:02:31.190 --> 00:02:35.030 and the choice depends on your organization to decide the most appropriate. 00:02:35.340 --> 00:02:38.980 NIST is one organization that produces cybersecurity frameworks, 00:02:39.280 --> 00:02:41.810 and these encompass a set of standards, guidelines, 00:02:41.810 --> 00:02:44.460 and best practice to achieve a suitable level of 00:02:44.460 --> 00:02:46.380 improved cybersecurity maturity, 00:02:46.740 --> 00:02:50.440 which you can see here are covered under the categories identify, 00:02:50.440 --> 00:02:53.160 protect, detect, respond, and recover. 00:02:53.840 --> 00:02:56.840 Each category contains subcategories that are linked to 00:02:56.840 --> 00:03:00.630 specific activities an organization needs to perform to 00:03:00.630 --> 00:03:02.620 improve its cybersecurity maturity. 00:03:02.760 --> 00:03:05.810 TruffleHog is a tool that helps an organization with 00:03:05.810 --> 00:03:07.620 the anomalies and events category. 00:03:07.900 --> 00:03:10.540 We can further narrow down the subcategories that link this 00:03:10.540 --> 00:03:13.660 technology to specific technical activities. 00:03:13.840 --> 00:03:16.900 TruffleHog can detect threats in the form of sensitive data 00:03:16.900 --> 00:03:20.760 leakage and enable security professionals to analyze findings 00:03:20.770 --> 00:03:22.530 and understand the targets at risk. 00:03:22.800 --> 00:03:25.170 This can lead to understanding the methods used, 00:03:25.220 --> 00:03:27.320 as well as the potential future impact. 00:03:27.520 --> 00:03:28.040 Overall, 00:03:28.040 --> 00:03:30.870 this helps to better inform an organization to help 00:03:30.870 --> 00:03:34.390 prepare for future security strategies, to improve security, 00:03:34.440 --> 00:03:35.910 and further mitigate risk. 00:03:35.920 --> 00:03:39.420 TruffleHog forms part of the event data and correlation process. 00:03:39.420 --> 00:03:43.560 The output from the tool can determine what impact malicious events may have. 00:03:43.800 --> 00:03:46.750 The output from TruffleHog can also help determine 00:03:46.750 --> 00:03:49.070 suitable thresholds for security alerts. 00:03:49.540 --> 00:03:52.700 This course will demonstrate how to use TruffleHog and link 00:03:52.700 --> 00:03:54.460 to the concepts being discussed here. 00:03:55.640 --> 00:03:57.410 We also have the MITRE ATT&CK, 00:03:57.510 --> 00:03:59.820 which provides different techniques a threat actor 00:03:59.820 --> 00:04:01.760 may use against your organization. 00:04:02.260 --> 00:04:04.730 In this course, we will look at unsecured credentials. 00:04:04.730 --> 00:04:08.140 We want to identify and know which repos deployed in your 00:04:08.140 --> 00:04:10.960 environment contain sensitive data leakage, 00:04:11.050 --> 00:04:12.930 such as secrets and credentials. 00:04:13.320 --> 00:04:16.459 We are going to look at how to identify unsecured credentials in 00:04:16.459 --> 00:04:20.209 repos and how common it is for potential attackers to conduct 00:04:20.209 --> 00:04:24.180 reconnaissance of your environment, potentially a precursor to an attack. 00:04:24.180 --> 00:04:26.600 With the prevalence of software development and 00:04:26.600 --> 00:04:28.640 open‑source management in organizations, 00:04:28.640 --> 00:04:32.660 it's more important than ever to know what is being committed to repos. 00:04:33.140 --> 00:04:33.720 Finally, 00:04:33.720 --> 00:04:37.820 MITRE Shield is one framework that covers attack techniques and how you 00:04:37.820 --> 00:04:39.980 can defend your environments against the attacks. 00:04:40.080 --> 00:04:40.870 Using this, 00:04:40.880 --> 00:04:44.550 we can link the attack techniques with the methods of defense, such 00:04:44.550 --> 00:04:49.430 as DTE00012 ‑ Decoy Credentials, and creating user credentials that 00:04:49.430 --> 00:04:51.420 are used for active defense purposes. 00:04:51.540 --> 00:04:53.740 We will look at one method of committing unsecured 00:04:53.740 --> 00:04:56.710 credentials to a repo which could be deployed to help 00:04:56.710 --> 00:04:59.460 identify attackers targeting your organization. 00:05:00.840 --> 00:05:03.420 So where does TruffleHog sit within your organization? 00:05:03.640 --> 00:05:06.890 And the answer depends on your organization and its culture. 00:05:06.940 --> 00:05:09.730 Since the results of TruffleHog may identify unsecured 00:05:09.730 --> 00:05:12.300 credentials within your organization's repos, 00:05:12.510 --> 00:05:15.730 these results may generate high‑priority security incidents, 00:05:15.750 --> 00:05:18.720 as such may sit close with the security department, 00:05:18.790 --> 00:05:21.090 monitored by the security operations team. 00:05:21.160 --> 00:05:23.170 In addition to central security monitoring, 00:05:23.310 --> 00:05:27.600 TruffleHog could be operated by software developers within your organization, 00:05:27.730 --> 00:05:31.590 identifying credential leakage within each repo they are responsible 00:05:31.590 --> 00:05:35.080 for, and this creates a layered approach to monitoring and improved 00:05:35.080 --> 00:05:37.460 security awareness at the developer level. 00:05:38.540 --> 00:05:41.650 TruffleHog could be run on a regular basis manually by an 00:05:41.650 --> 00:05:45.270 analyst and the result reviewed each month. Equally, TruffleHog 00:05:45.280 --> 00:05:48.490 could be scheduled to run automatically every day with a report 00:05:48.490 --> 00:05:50.110 saved to a central location. 00:05:50.200 --> 00:05:52.310 Whatever the configuration you decide, 00:05:52.430 --> 00:05:56.150 TruffleHog will need to be configured to include all the repos under 00:05:56.150 --> 00:05:59.930 your responsibility, to maximize the benefit of the tool, and reduce 00:05:59.930 --> 00:06:01.910 the chance of missing important alerts. 00:06:02.040 --> 00:06:05.440 This course will not cover installation steps as this is covered in 00:06:05.440 --> 00:06:09.000 the TruffleHog GitHub page. As you follow along, 00:06:09.000 --> 00:06:12.680 you'll be able to take away the ability to detect unsecured 00:06:12.690 --> 00:06:14.600 credentials and why it's important to do so. 00:06:14.600 --> 00:06:18.140 This also includes how persistent and opportunistic attackers can be 00:06:18.140 --> 00:06:21.730 when trying to find vulnerabilities to then exploit and gain access 00:06:21.730 --> 00:06:24.460 to your organization's environment. 00:06:24.460 --> 00:06:27.390 Cybersecurity, in general, is a challenging, but exciting 00:06:27.400 --> 00:06:29.010 area for the security professional, 00:06:29.010 --> 00:06:31.470 and TruffleHog is one of the many useful tools that will 00:06:31.470 --> 00:06:33.810 help you to defend your organization. 00:06:33.810 --> 00:06:34.700 Okay, with that, 00:06:34.700 --> 00:06:37.500 let's get into learning the benefits of TruffleHog and how to 00:06:37.500 --> 00:06:39.070 use to help to secure your environments.