P.K. SHARMA

Cyber security intelligence, AI governance, practitioner analysis

Cloud and subscribed services

Source code repository (repo): what it is and how it is attacked

Where the organisation's own code and configuration is kept and changed.

Also known as

  • repo
  • repository
  • GitHub
  • GitLab
  • Bitbucket
  • Azure DevOps
  • source control
  • version control
  • git

Typing any of them into the editor finds this object.

Why it matters on a security diagram

It holds the code that becomes production, the history of everything ever committed to it, and very often a credential somebody pasted once and removed later. Deleting a secret does not remove it from the history.

How it gets attacked, and what reduces it

How it gets attacked

  • Credentials committed by accident, which stay in the history after they are taken out of the file
  • A token belonging to a person or an automation, which is access without a sign-in
  • A change merged into the branch that deploys, which reaches production without touching production

What reduces it

  • Scan the whole history, not the current files, and treat anything found as already disclosed
  • Require review on the branches that deploy, and protect them from being rewritten
  • Give automation short-lived credentials tied to the repository rather than a long-lived token

Where it sits

Group
Cloud and subscribed services · Things that only exist because somebody else runs the platform underneath them.
Whose side, by default
Ours · Belongs to the organisation the diagram is about.
Catalogue identifier
code-repository

Reviewed . CC BY 4.0.

Others in cloud and subscribed services

The cloud and subscribed services group lists all 14 of them side by side.

Source code repository on your own diagram

Open the editor, press N, and type repo. The object is placed and connected to whatever was selected, and Tab adds the next one already joined to it. Nothing is uploaded: the page is served with a Content Security Policy that forbids the browser from making any outbound request at all.

Open the diagram maker