Secrets Scanning

Application Security scan capability detects secrets in files within your version control system (VCS) repositories and CI/CD executions. This functionality is accessible through the Prisma Cloud console, IDE, CLI, or git hook, allowing you to address and fix the issues that led to the exposure of secrets, such as removing the secrets from configuration files and storing them in secure storage mechanisms. The results of Secrets scanning are displayed on the integration outputs and Projects page.

• A secret is a programmatic access key that provides systems with access to information, services or assets. Developers use secrets such as API keys, encryption keys, OAuth tokens, certificates, PEM files, passwords, and passphrases to enable their application to securely communicate with other cloud services.

Supported file types: Prisma Cloud scans any plaintext files that are not encrypted, not compressed (for example, not .zip files) and not-compiled (for example, not .jar files), for secrets. Additionally, entropy findings look for keywords to lower the noise, and those keywords must be inline with the high entropy string to be flagged.

Entropy Analysis: Prisma Cloud has signatures that analyze the randomness of strings within the file. Highly random strings, often referred to as "high entropy," can be indicative of a potential secret. To reduce false positives, Prisma Cloud also considers specific keywords that might be associated with secrets alongside the randomness of the data for better accuracy.

Limitation: Secrets scanning in integrated version control systems supports repositories up to 4GB in size.

Secrets Policies

• Default Policies: Prisma Cloud provides default policies designed to identify secrets that leverage both domain-specific and generic syntax. These policies match specific signatures and patterns to validate the likelihood or entropy of a string being a secret. For more information on Secrets policies refer to Secrets Policies
• Custom Policies: You can create custom Secrets policies tailored to your specific security posture and compliance requirements. For more information, refer to Custom Build Policies

Enable the Secrets Module

You must enable the Secrets module in order to scan for secrets: In Application Security, go to Settings > Application Security in the left menu under Configuration > enable Secrets Security.

For more information refer to Application Security License Types.

Advanced Secrets Scanner Configurations

In addition to the default settings for the Secrets scanner, you can configure the following advanced settings: Validate Secrets and Scan Git History for Secrets.

Validate Secrets

Prisma Cloud can validate detected secrets against public APIs to verify their current activity status. This enables you to prioritize and promptly address exposed secrets. “Secrets” validation scanning can be executed through the Prisma Cloud console and IDE by extension, or through your CLI.

By default, the Secrets validation functionality is disabled.

Enable Secrets Validation

1. On the console, in Application Security, select Settings.
2. Select Application Security in the left menu under Configuration > enable the Validate Secrets setting.

Filter Secrets by Validation Status

You can prioritize secrets scan findings for remediation through the console by filtering secrets based on their validation status: In Application Security, select Projects > click the Secrets tab > select a value in the Secrets Risk Factor filter.

Secrets risk factor menu options include:

• Valid: Filter by whether the API key is valid. The API key is sent to a public API, such as the STS (Security Token Service) endpoint for AWS Access Keys. Prisma Cloud evaluates the response from the API to determine its validity
• Invalid: Filter by whether the API key is invalid. The API key is forwarded to a public API, and the response received is typically a "400," indicating an invalid API key
• Unknown: Filter by whether the API key is unable to make the API call or there is no API endpoint available for validation
• Privileged: This filter is exclusively for AWS access keys. Filter by whether API keys are deemed privileged, possessing certain permissions that are considered privileged based on predefined criteria

There is no validation for custom secrets.

Validate Secrets though the CLI

1. Enable the Validate Secrets setting on the Prisma Cloud console - see Validate Secrets though the Prisma Cloud console above.
2. Add the environment variable CKV_VALIDATE_SECRETS=true.

   Usage: CKV_VALIDATE_SECRETS=true checkov -f secrets.txt.

In the following example, a valid secret has been identified in the repository after conducting a Checkov scan in the CLI terminal.

Scan Git History for Secrets

Prisma Cloud can scan through the git history of a repository to identify secrets that may have been deleted from a file but still exist in the historical records, and notify you about such secrets even if they are no longer present in the most recent commit. This helps to mitigate the risk of potential abuse of those credentials as they may still be compromised if found in history. This scan can be executed through the Prisma Cloud console and IDE by extension, or through your CLI.

By default, git history scanning is disabled.

Enable Git History Scanning on Prisma Cloud

1. In Application Security, select Settings.
2. Select Application Security in the left menu under Configuration > enable the Scan Git History for Secrets setting.

Enable Git History Scanning through the CLI

Scan your git history locally using Checkov CLI by executing the command with the --scan-secrets-history flag. By default, timeouts are not set, but you can specify one using the --secrets-history-timeout TIME flag.

Scans are performed in chunks and partial scans of chunks will not be saved. Additionally, results will not be saved on the Prisma Cloud platform.

Scan Options

Prisma Cloud provides the following options for scanning secrets in your files.

Automatic scans:

• Integration: Scans are automatically initiated as soon as you integrate your repositories through the Prisma Cloud console
• CI/CD runs: Event driven scans are performed during runs in your CI/CD pipeline
• IDE interaction: Opening or *saving files in your integrated IDE triggers an automatic scan
• Pull Requests: Submitting a pull request in your version control system prompts an automatic scan

Manual scans:

• IDE: You can trigger scans manually in your IDE. For more information refer to IDE
• CLI commands: By default, Checkov does not scan files for secrets. To enable Secrets scanning, execute the command with the --enable-secret-scan-all-files flag or set the CKV_SECRETS_SCAN_ENABLE_ALL environment variable. For more information on CLI based scanning, refer to the CLI documentation

Manage Scan Results

You can view, analyze and manage scan results, as well as prioritize remediation efforts, and implement effective fixes, or suppress findings, directly on the Prisma Cloud console, through your Checkov CLI, or directly within your IDE.

Secrets scanning does not support automatic fixes.

Console Scan Management

To access scan management in the console, in Application Security, select Projects and click the Secrets tab.

Prioritize Secrets Scan Findings using Filters

You can prioritize secrets scan findings for remediation by using the following filters to specifically target the secret issues that require attention:

• Severity: Select a severity level from the Severity filter. Values include Critical, High, Medium, Low and Informational
• Secrets Risk Factor: See Filter by Validation Status above
• Found in History: Identifies whether secrets may have been stored in past commits
• Issue Status: The status of the finding. Values include 'Error', 'Passed', 'Suppressed', 'Fix Pending'
• Repositories: Filter by repository
• Branch: Filter by repository branch
• Git Users: Filter by Git users
• File Types: Filter by file type

For information on fixing Secrets issues, refer to Fix Code Security Issues.

For information on suppressing Secrets issues, refer to Suppress Code Issues.

For more information on Secrets scan management on Prisma Cloud console, refer to Monitor and Manage Code Build Issues.

Scan Management through IDEs

For information on scan management through IDEs, refer to the IDE documentation.

Scan Management through the CLI

For information on scan management through the CLI, refer to the CLI documentation.