Full Report
Wiz SPM for version control systems helps you find and fix risks in your GitHub instance.
Analysis Summary
This analysis summarizes the security capabilities and context surrounding Version Control System (VCS) security, specifically focusing on GitHub, as highlighted by the introduction of new capabilities by Wiz.
# Tool/Technique: Wiz Security Posture Management for VCS (GitHub Focus)
## Overview
This describes a security feature extension by Wiz that focuses on securing the Software Development Lifecycle (SDLC), specifically targeting Version Control Systems (VCS) like GitHub. Its purpose is to identify and mitigate risks such as misconfigurations, exposed secrets, and improper access controls within VCS environments to prevent software supply chain attacks and unauthorized access to cloud resources.
## Technical Details
- Type: Tool/Security Posture Management Capability
- Platform: GitHub (VCS)
- Capabilities: Assessment against OpenSSF SCM Best Practices, evaluation of misconfigurations, identity/access risks, and secrets exposure, visualization of cloud attack paths originating from VCS issues.
- First Seen: Context implies a recent release/extension of Wiz Code capabilities.
## MITRE ATT&CK Mapping
The primary focus is on initial access through the development ecosystem and subsequent impact on infrastructure confidentiality and integrity.
- **TA0001 - Initial Access**
- T1190 - Exploit Public-Facing Application (If public source code repositories are misconfigured, they can be exploited).
- **TA0002 - Execution**
- T1059 - Command and Scripting Interpreter (If malicious code is injected via compromised PRs/workflows).
- **TA0003 - Persistence**
- T1547 - Boot or Logon Autostart Execution (Less direct, but compromised systems grant persistence potential).
- **TA0006 - Credential Access**
- T1552 - Unsecured Credentials
- T1552.002 - Credentials in Files (Detection of hardcoded secrets in code/repositories).
- **TA0010 - Exfiltration**
- T1041 - Exfiltration Over C2 Channel (If source code is stolen via compromised developer accounts).
- **TA0011 - Command and Control**
- T1071 - Application Layer Protocol (Indirectly involves C2 if secrets lead to cloud takeover).
## Functionality
### Core Capabilities
- **VCS Posture Assessment:** Checks GitHub organizations, repositories, and branches against 30+ configuration rules derived partly from the OpenSSF Source Code Management Best Practices Guide.
- **Risk Factor Evaluation:** Assesses misconfigurations, identity/access issues, and secrets exposure within the VCS.
- **Attack Path Prioritization:** Correlates VCS findings (e.g., leaked secrets) with cloud context to prioritize attack paths that could impact deployed cloud environments.
### Advanced Features
- **Contextual Secret Analysis:** Determines the impact of a leaked secret by checking if the associated repository is publicly exposed and what privileges the secret grants in the connected cloud environment, providing visualization of the resulting attack path.
- **Supply Chain Risk Mitigation:** Identifies configurations (like automatic PR approval without branch protection) that could allow attackers to inject malicious code, leading to supply chain attacks.
- **Ownership and Change Tracking:** Considers metadata like who made changes and team ownership when assessing risk.
## Indicators of Compromise
The context describes *vulnerabilities* leading to compromise, rather than specific malware IOCs.
- File Hashes: N/A (Focus is on configuration auditing)
- File Names: N/A
- Registry Keys: N/A
- Network Indicators: N/A (Focus is on internal application security posture)
- Behavioral Indicators:
- Unprotected or public source code repositories containing hardcoded cloud credentials.
- GitHub workflows configured to automatically approve Pull Requests without mandatory human review.
- Overprivileged developer accounts accessing sensitive repositories.
## Associated Threat Actors
While not naming specific actors using this *tool*, the context references **recent high-profile attacks** (such as the breach involving Okta's source code) highlighting that attackers are actively targeting developer tooling and VCS systems. Attackers target "overprivileged" developer accounts to exfiltrate code or steal secrets for lateral movement into the cloud.
## Detection Methods
The tool itself is a detection and posture management method.
- Signature-based detection: N/A (Not applicable for configuration auditing)
- Behavioral detection: Focuses on monitoring VCS configuration drift and unauthorized changes relative to established security baselines (OpenSSF Guide).
- YARA rules: N/A
## Mitigation Strategies
Mitigations are derived directly from the posture alignment the tool enforces:
- **Configuration Hardening:** Implement strong branch protection rules and disable automatic PR approvals unless strict checks are enforced.
- **Secrets Management:** Proactively scan and remediate hardcoded secrets (API keys, tokens) found within repositories.
- **Access Control:** Review and restrict developer roles to adhere to the principle of least privilege, preventing overprivilege exploitation.
- **Benchmarking:** Align repository and organization settings with the OpenSSF Source Code Management Best Practices Guide.
## Related Tools/Techniques
- Secure SDLC practices.
- Cloud Security Posture Management (CSPM) tools that may now integrate VCS posture assessment.
- Tools focused on static analysis (SAST) and secret scanning within the CI/CD pipeline.