Hi All,
We are working with a vendor on a compliance project. One of their tools integrates with Bitbucket and checks for misconfigured settings/etc. I was wondering if anyone has come across this and could offer some advice as far as security risks regarding the integration? We obviously don't want to make something more secure by opening up another hole :)
From their website:
Overview
Automates the collection of evidence for your code repository configurations, pull request workflows, and security issue tracking.
Automation
Automates 11 tests and 7 controls
Permissions
Vanta requires read-only access to your account information, team membership, repositories, issues, pull requests.
We also request permission to administer your repositories to check branch protection. There is currently no read-only access for this.
Any insights are helpful. Thank you!
We are using Vanta and allowed them to access our Bitbucket Cloud workspace. It is obviously a security risk, but as @marc -Collabello--Phase Locked- noted these tools need access to check for misconfigured settings and such. We just accepted it and trust them.
Note that Vanta will ask for access to a lot of other possibly even more critical systems in your infrastructure, not only e.g. Jira Cloud, but even on the PaaS level (AWS)!
Yes, we are aware that they will have access to more critical systems. As far as Bitbucket goes, do you know if their integration actually has access to the code files?
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Obviously adding Vanta is an additional security risk. However maybe Vanta catches other security risks and implements required audit controls. This might be a net positive.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
Yep. We are trying to assess pros/cons of this integration. Thank you for your input.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.