August 2024: Key Rotation and 2FA Limits

August 2024 was about moving from response to resilience. The CosmicSting incident in June highlighted weak spots in secret hygiene and access controls. In August, the emphasis turned to disciplined key rotation, practical 2FA, and removing long-lived credentials across the stack - from Adobe Commerce admin to Git providers and CI/CD.

Keys and tokens: automate rotation for API keys, webhooks and service accounts. Store secrets in a managed vault and eliminate static credentials in repositories. Prefer short-lived tokens with explicit scopes over broad, indefinite keys. For CI, adopt OIDC-based federation where supported so runners request short-lived credentials dynamically instead of storing tokens.

2FA in practice: enforce WebAuthn (hardware keys or platform authenticators) for privileged admin and developer accounts. Pair with SSO so deprovisioning is centralised. Where 2FA disrupts service-to-service automation, replace with signed, short-lived tokens and strong audit trails rather than bypassing controls entirely.

Developer supply chain: disable personal access tokens (PATs) for automation, restrict repo secrets to the minimum, require code reviews on protected branches and enable signing (Sigstore or GPG) for releases. Run software composition analysis (SCA) and image scanning on every build, and generate SBOMs to speed up response when advisories land.

Recommended steps:

• Automate secret rotation; migrate secrets to a vault; remove credentials from code and config.
• Adopt OIDC for CI/CD where available; otherwise use scoped tokens with short TTLs.
• Mandate WebAuthn-based 2FA for admins and developers; enforce SSO with least-privilege roles.
• Tighten repository controls: disable PATs for bots, restrict secrets, require reviews and signed releases.
• Continuously scan dependencies and container images; publish SBOMs with each release.

These changes reduce the blast radius of credential leaks and make incidents easier to contain. The earlier you institutionalise them, the safer peak season will be.