> For the complete documentation index, see [llms.txt](https://docs.docontrol.io/docontrol-user-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/encryption-key-sharing.md). # Encryption key sharing **SaaS security problem** As part of ongoing work processes, developers might share encryption codes or AWS keys via SaaS apps, such as public Slack channels and Microsoft Team chats. It’s impossible to prevent this kind of sharing using only the controls native to each SaaS app, and DEV teams often use these channels for convenience even if it's strongly discouraged. Individual SaaS apps offer no solution for insider risk management to target these privileged credentials for removal. This creates opportunities for unauthorized personnel to find them and access the production environment. **DoControl solution** DoControl addresses the threat model of encryption key sharing by providing your organization with the tools to monitor, mitigate, and remediate the associated risks: * [Inventory](#docontrol-inventory-of-encryption-key-files) * [Assets](#assets-with-encryption-keys) * [Alerts](#alerts-for-encryption-key-sharing) * [Regex scanning](#regex-scans-for-encryption-key-sharing) * [Playbooks](#playbooks-for-encryption-key-sharing) ## What are encryption keys? Encryption keys are a form of privileged credentials, so they should only be exposed to select individuals or teams. Typical file extensions of encryption keys include: * .ca-bundle * .cer * .crt * .csr * .der * .key * .p7b * .p7c * .p7s ## What's the risk? Publicly sharing encryption keys means they are accessible to anyone on the web. This increases the risk of data exfiltration, since anyone can see these keys and potentially use them to access sensitive data in your organization. Encryption keys should be handled with care, with governance policies in place, to make sure that internal or sensitive data from the production environment is not exposed. ## DoControl inventory of encryption keys and certificates DoControl displays your organizational posture to highlight snapshot data, including the distribution of encryption keys and certificates in Google Drive, OneDrive, and SharePoint. Leaving encryption keys and certificates accessible increases the risk of data exfiltration.

#### To remediate the risk of exposed encryption keys in SharePoint, OneDrive, and Google Drive: 1. From the Organizational Posture page, select the relevant site: * Google Drive * Microsoft 365 2. Click the relevant encryption key link. 3. Select the assets you wish to remediate. 4. Use the **Change owner** inventory action to move the assets to an appropriate location or remove them altogether from Google Drive, OneDrive or SharePoint. ## Assets with encryption keys DoControl gives you a consolidated view of all Slack files that include encryption keys. 1. Go to **Assets > Slack**. 2. Select **Files** and **Sensitive file types**.\ **Sensitive file types** include code or certificates of the following types: SQL, JSON, scripts, and binary (mainly encryption keys). 3. Click the **Filters** button to add or remove file types:

Filtering Slack files for sensitive file types with code

4. After you filter Slack assets, you can activate [on-demand remediation actions](/docontrol-user-guide/workflows/inventory-actions-quick-actions.md). {% hint style="info" %} To investigate and remediate alerts that are triggered when encryption keys are shared in public Slack channels, see [Remediate alerts](/docontrol-user-guide/risk-management/alerts/remediate-alerts.md). {% endhint %} ## Alerts for encryption key sharing DoControl alerts automatically notify your organization when anomalous user behavior occurs. Alert types for external sharing indicate excess permission privileges that were granted to external users outside your organization. To mitigate the risk of exposed data as a result of sharing encryption keys in Slack, DoControl provides these alerts:

Alert type	DoControl alert name	Alert description
DC80	Encryption keys uploaded to public channels	This alert will trigger when a user uploads an encryption key (for example, a PEM or CRT file) to a public Slack channel.
DC81	Public sharing of encryption keys	This alert will trigger when a user creates a public link to an encryption key (for example, a PEM or CRT file) in a public Slack channel.

{% hint style="info" %} For details about DoControl alerts, go to **Help > DoControl Alert Specifications**. {% endhint %} ### How to remediate alerts? If your organization receives alerts notifying you of public encryption key sharing, you can delete the relevant files on-demand using the **Delete file** inventory action. You can also set up a workflow that will trigger file deletion whenever an encryption key is uploaded to a public channel (immediately or after a given time frame). ## Regex scans for encryption key sharing DoControl supports Regex scanning for Google Drive and Slack assets, including Microsoft files and general formats, such as .txt and .pdf. A Regex scan uses a deterministic scanning algorithm to detect a specific expression, string or pattern in a file. {% hint style="info" %} See all [supported file types](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/query/regex-scan.md#supported-file-types) for Regex scanning. {% endhint %} You can use the predefined **cryptographic private key** regex pattern in your regex scan. This regex pattern is a private encryption key containing a private key reference. #### To define a workflow to run a Regex scan for cryptographic private keys: 1. From the Event dropdown, select **a Google Drive** or **Slack** trigger. 2. Define the [conditions](/docontrol-user-guide/workflows/define-workflow-settings/trigger-settings.md#condition-values). 3. Select **Query > Regex scan**. 4. Select **Flow control > Conditional** to add a conditional step to determine if the asset contains the regex expression, using the `Has regex matches` macro. 5. For asset ID, enter the **Get asset ID** macro from the event patterns or strings. 6. Select the `cryptographic private key` [regex pattern](#regex-patterns) from the dropdown. You can insert multiple patterns. 7. If regex results are found, link the YES branch of the conditional step to the relevant action you would like to take. 8. If the regex expression is found, select **Notify > in Slack** or **by email** to send an automatic notification. 9. You can choose to remediate with any relevant remediation action for [Google Drive](/docontrol-user-guide/workflows/define-workflow-settings/action-settings/remediate/google-drive-remediation.md) or Slack, such as delete file or remove public sharing. ## Playbooks for encryption key sharing With DoControl playbooks, your organization can easily and automatically remediate any risk associated with shared encryption key files before they see the light of day. Define automated workflows with DoControl's out-of-the-box playbooks to: * Notify your security team any time someone inside or outside your organization uploads an encryption file to your SaaS instance * Delete any shared encryption key files or sensitive files uploaded to public Slack channels

Select a predefined DoControl playbook to remediate encryption key sharing

{% hint style="success" %} * DoControl provides out-of-the-box pre-populated workflows. You need to define the condition to get the file extension from the Encryption file [keyword list](/docontrol-user-guide/system-management/settings/lexical-lists.md#edit-default-lexical-lists), or from your own custom keyword list. * To customize playbooks, see [Define workflow settings](/docontrol-user-guide/workflows/define-workflow-settings.md). {% endhint %}

Playbook name	SaaS app	Playbook description
Notify on ransomware encryption file upload	Box	When someone uploads a ransomware encryption file to Box, the security team is notified by Slack.
Notify on encryption key upload	Dropbox	When someone adds files or folders containing an encryption key to Dropbox, the security team is notified by Slack.
Notify on encryption key upload	Google Drive	When an external actor who isn't in your trusted domains uploads encryption keys to Google Drive, your security team is immediately notified by Slack.
Notify on uploading ransomware	OneDrive	When someone uploads a suspected ransomware file to OneDrive, the security team is notified by email.
Notify on encryption key upload	SharePoint	When someone uploads an encryption file to SharePoint, the security team is notified by Slack.
Delete Slack file on-demand	Slack	When a user triggers a DoControl inventory action to delete a Slack file, the file is automatically deleted.
Remediate encryption key sharing	Slack	If encryption key files are uploaded in a Slack message, DoControl deletes the files, and both the SecOps team and user are notified by Slack.
Remediate encryption key sharing in Slack files	Slack	When multiple files are uploaded in a Slack message, DoControl scans the content for encryption keys. If an encryption key is found, the file is deleted, and both the SecOps team and user are notified by Slack.
Remediate uploading of sensitive files to public channels	Slack	When someone uploads a sensitive file containing code to Slack, the security team is notified by Slack and the file is deleted.
Remediate encryption key sharing in Slack Enterprise files	Slack Enterprise	When a file is uploaded in a Slack message, DoControl scans the content for encryption keys. If an encryption key is found, the file is deleted, and both the SecOps team and user are notified by Slack.
Quarantine shared encryption key before deleting	Slack Enterprise	When files are uploaded in a Slack message and an encryption key is detected, DoControl automatically quarantines all files. If the SecOps team approves/rejects the file sharing, all quarantined files are restored/deleted from the Slack conversation.

{% hint style="info" %} To learn how to customize a playbook to mitigate the DLP risk from encryption key uploads in SharePoint, see DoControl [videos](/docontrol-user-guide/help/videos.md#notify-on-encryption-key-uploads-in-sharepoint). {% endhint %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.docontrol.io/docontrol-user-guide/risk-management/threat-model-coverage/encryption-key-sharing.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.