Challenges
Solution
Results
What is most valuable?
Key quote
What’s next
What is our primary use case?
We use it for detecting secrets in our code repositories.
How has it helped my organization?
Transferring code from another platform to GitGuardian enabled us to see open passwords in old repositories and enabled us to clean them well and create a barrier against security leaks.
It has also increased our secrets detection rate by 99 percent.
It has also helped to increase our security team's productivity. We have around 110 repositories and if we had to remove something one-by-one it would be very hard, but with this solution we can do so from all of them at the same time, which saves us months—not even days—but months.
Similarly, our mean time to remediation has gone from months to days.
What is most valuable?
The most valuable feature is the one that validates the secrets.
The accuracy of the solution is around 90 percent, which is a great rate.
If someone steals and posts your repository, GitGuardian tells you that there's a duplicate repository out there. It warns you to have a look at that. It also warns you about similar repositories. If you have five similar repos, it will warn you to check on them.
You can also assign tasks to specific teams or people to complete, such as assigning something to the "blue team" or saying that this person needs to do this, and that person needs to do that. That is a great feature because you can actually manage your team internally in GitGuardian.
There are also a lot of integrations.
Another useful feature is that GitGuardian sends us warning emails if anything goes wrong.
And you can filter on severity levels. That is helpful because you can choose what to look at based on if it's something critical. You can also filter on whether it's a test environment or a production environment. You can indicate that this script needs to be revoked and this one shouldn't be revoked so don't show it as a password.
It also warns you that it's dangerous to use certain things in the code because you have used them in 10 repositories.
And when it comes to CI/CD, where the code is built and sent to the area where it needs to be deployed, GitGuardian checks if anything is abnormal during the send, and if it is, the code won't be deployed. It then tells you to fix this issue by assigning a task to people in your team.
What needs improvement?
An area for improvement is the front end for incidents. The user experience in this area could be much better.
For how long have I used the solution?
We did the free trial of GitGuardian Internal Monitoring first, and then we went to the Business version. We've been using it since February of 2022, so it has been about six months.
What do I think about the stability of the solution?
What do I think about the scalability of the solution?
Our DevOps personnel use the solution as admins, and our developer team is using it as members. We have eight people using it at the moment, but we're planning to grow that to 10 to 15 people in the near future.
How are customer service and support?
We haven't had any issues with their support.
Which solution did I use previously and why did I switch?
We were using a platform called Beanstalk. It was our own platform but it was not cloud, so there were some repositories that we weren't monitoring. With GitGuardian actions, we were able to take all repos to the cloud, which is better.
We also weren't able to see the coding history before, such as who left a password in the code. With GitGuardian, you can see everything in the history. You can clean things well when you are able to see the historical changes in the code.
We also tried open-source tools, but the false positives made them a waste of time.
How was the initial setup?
We didn't really need to do anything to prepare to start using GitGuardian. It was really easy.
In terms of maintenance, the only thing that took time, about a month, was the CI/CD part, to integrate it with a pipeline.
What about the implementation team?
What was our ROI?
What's my experience with pricing, setup cost, and licensing?
Everything is included in the Business version, so there are no extra costs. You can't take some parts out and add other parts in and change the price.
Which other solutions did I evaluate?
What other advice do I have?
In response to a security colleague who said that secrets detection is not a priority, I would ask what service they are using and what the pros and cons are of that service. And I would also tell them to compare their service with GitGuardian.
Secrets detection is very important to security.
The biggest lesson we have used from using GitGuardian is that we should have started using it earlier.
