Root Cause

Credentials to the TIS Dev environment were published on a non HEE public GitHub repository.

Likely cause, ex-HEE employee, Kais Malique (DBA in the National Data Warehouse team) created a separate repository (referenced in the email sent to us) into which he put credentials to access both HEE Tableau and HEE TIS app. As a free GitHub repository, this was defaulted to 'Public'.

Trigger

Mark Baldwin (HEE IT Web Architect) found a public GitHub repository that looked like it had a HEE Tableau and HEE TIS Dev username and password in it. When the TIS team heard about the issue, we began our investigation.

Resolution

Ray has been able to contact Kais and he has now removed the content from the repository.

Determined that the script was written in PowerShell which we do not use in the project.

TIS team have checked all our HEE TIS repositorys and confirmed the script in the screenshot sent to us was not copied from them.

Determined that regardless of where the script was posted, the credentials listed in it could not be used to access confidential data. The credentials in the script for TIS gives access to the TIS app in the Dev environment. In this environment, data is obfuscated. The credentials do not give access to any of the other environments. So we are confident that no data breach has occurred.

From our investigation, we have, however used it as an opportunity to take some action items to further improve security:

Action Items

Timeline

Supporting Information

e.g. monitoring dashboards