The original post: /r/cybersecurity by /u/Inevitable-Mouse9060 on 2024-11-22 12:00:24.

I think i already know the answer.

I consult for a very very large financial firm - its one of the top 5 financial companies in america.

Internally the staff seem a little - and im trying to be delicate - mentally challenged. They dont understand technology and they really dont understand security.

I’ve stuck my neck out and suggested that just passing client_secret around in email, sharepoint and what not is really bad form - esp when we have a few million customers who now have all their data and personal PII in the cloud - these google credentials are the “keys to the castle”

I’ve strongly suggested the client secret go into a vault - and the pushback has been incredible.

“You dont know what you are talking about Mouse…”

Has anyone else dealt with this?

Im pretty sure google has TOS that say you are violating their terms if you dont protect this sensitive data (client secret and client id). And i’ve also pointed out their Terms Of Service - to no avail.

I believe the client secret must be in a vault.

Have any of you experienced anything like this?

What would you do in my shoes?

I have all email chains and photos of the same to make sure i’ve recorded that i have let management know, who was notified and the date and time.

This is an OCC regulated financial firm as well and i have contacts but im just holding back from making that phone call…