Security is Hard. Let’s Make It Harder.

We all know that data breaches are horribly expensive for enterprises, whether due to direct costs of remediation, or from collateral costs due to lost customers, excessive support tickets, etc. This report from McAfee estimates that the global cost resulting from cybercrime will reach $600 billion in 2018. What you might not have known is that the majority of cybercrime stems from compromised passwords, with estimates ranging from 63% to 81%. And another alarming statistic is that 24% of data breaches are insider attacks. So yes, keeping passwords safe, even from co-workers, can save companies millions of dollars a year.

Keep Your Data Safe From Cybercrime

To keep cyber criminals at bay, we have recently introduced a feature that hardens the security of database connection passwords used by JFrog Artifactory, JFrog Xray and JFrog Distribution. It’s not like these passwords were ever available to anyone in plaintext; they were always encrypted, but we decided to take it further than that.

If It Ain’t There, It Can’t Be Hacked

Any sensitive information such as database connection strings that needs to be loaded into Artifactory, Xray or Distribution, can now be placed in a corresponding temporary configuration file. When each of these services starts up, it loads the temporary file and reads the configuration parameters from it, specifically, the database connection strings which contain the encrypted connection parameters. Now here’s the thing. Once connection to the database is established, the service deletes the temporary configuration file from the host machine. This means that those credentials are not available to malicious attackers; not in a file, not in environment variables, and not in system parameters, and there’s no chance they’ll inadvertently be reported in any log files.

Clearly, “not available” is better than “available but encrypted”.

Of course, this mechanism isn’t restricted to database connection strings. You can put any sensitive parameter used by Artifactory, Xray or Distribution into its corresponding temporary configuration file before starting up and it will magically disappear from the system once the service is running.

With Security Comes Responsibility

Since your “secrets” are gone from your systems once the service starts, you need to keep a copy of the corresponding temporary configuration file somewhere safe, deep in your company’s vaults, perhaps completely disconnected from the network and off the grid. This is because if you need to start up a new instance of one of these services, you will have to retrieve the secrets from their safe location and provide them for the application to start up. Without the required database connection strings, the application will fail with a corresponding error message in the log file. Keep that in mind if you’ve installed Artifactory, Xray or Distribution on Kubernetes, and the pod in which the service runs crashes. Kubernetes will not automatically restart the pod; only the failed container. You will have to restart the pod and bootstrap it with the temporary configuration file it needs from that super safe location and provide it with the secrets it needs to connect to the database.

Have a Safe, Secure and Happy New Year

As you reflect on what your New Year’s resolutions should be, maybe you could consider making one of them, “In 2019, I will be vigilant against cybercrime and will make sure my data is more secure using the hardened security feature in Artifactory, Xray and Distribution.” If you upgrade to the latest version of these apps before 2018 ends, you can enjoy your eggnog and revel in the holiday merry-making with the knowledge that your Artifactory, Xray and Distribution databases are safe.