To sign up for our daily email newsletter, CLICK HERE
Today’s digital businesses rely on commercial, internal, and open source applications to run their businesses, but they also increasingly use automated IT infrastructure and DevOps methodologies to accelerate development and innovation. While application and IT environments vary widely across organizations, one thing remains constant: every application, script, automation tool, or other non-human entity relies on some form of privileged credential to access other tools, applications, and data. Automated secret management plays a critical role in securing these credentials by automatically storing, retrieving, and managing sensitive information like passwords, API keys, and tokens, ensuring that these secrets are handled securely without human intervention.
What is a secret?
These non-human privileged credentials are often referred to as “secrets” and refer to private information that serves as a key to access protected resources or sensitive information contained within tools, applications , containers, DevOps , and cloud environments .
Some of the most common types of secrets include:
- Privileged Account Identifiers
- Passwords
- Certificates
- SSH Keys
- API Keys
- Encryption keys
Key Issues in Secrets Management
Every non-human user with access to a secret automatically has the necessary permissions to access all resources belonging to the owner of the secret in real time. Cybercriminals know this and target secrets in order to gain access to other secrets and other hosts to accomplish their mission. A cyberattack targeting secrets can often extend well beyond the initial breach.
Secrets are widespread.
These include credentials encoded in containerized applications (e.g. Red Hat OpenShift, Kubernetes, or Pivotal); automation processes (e.g. Ansible Playbooks, Puppet, or Chef); critical business applications, including those developed in-house and commercial off-the-shelf (COTS) solutions ; security software, such as vulnerability scanning tools; application servers and IT management software, robotic process automation (RPA) platforms , and the CI/CD toolchain.
Automated processes are extremely powerful.
They can simultaneously access protected data, scale at unmatched speeds, use cloud resources, and execute business processes. However, as high-profile security breaches demonstrate, automated processes are vulnerable to sophisticated cyberattacks that can occur suddenly and spread quickly. Organizations must protect the secrets assigned to machine entities to protect against attacks and reduce risk.
What is Secrets Management?
A cybersecurity best practice for digital businesses, secrets management enables organizations to consistently apply security policies to machine identities. Secrets management provides assurance that resources from all tools, platforms, and cloud environments are only accessible to authenticated and authorized entities.
A secrets management initiative typically includes the following steps: Many of these approaches and techniques are also used to protect privileged access by human users.
- Authenticate all access requests that use non-human credentials.
- Apply the principle of least privilege .
- Enforce role-based access control and regularly renew secrets and credentials.
- Automate secrets management and enforce consistent access policies.
- Track all access and maintain a comprehensive audit trail.
- Remove secrets from code, configuration files and other unprotected areas.
What are some common use cases for secrets management?
Secrets management to protect CI/CD pipelines.
Popular CI/CD tools like Jenkins , Ansible , Puppet , and Chef are designed for efficiency and speed, but they introduce new security challenges. These automated configuration management tools require the use of secrets to access protected resources like databases, SSH servers, and HTTP services. Unfortunately, these secrets are often encoded or stored in configuration files or in the code of these tools (e.g., JenkinsFiles, Playbooks, scripts, or source code). Effective secrets management allows organizations to remove these secrets from DevOps tools within the CI/CD pipeline while providing comprehensive audit logs, role-based access control built into policies, and secret renewal.
Managing secrets to protect containers.
DevOps and engineering teams rely on containers to accelerate development and improve portability and productivity. Containers use secrets to access critical and sensitive information. However, because containers are ephemeral (or short-lived), they can be difficult to track, and access to specific resources can be difficult to manage and secure. Secrets management security measures allow teams to authenticate secret requests from containers using attributes native to container platforms and manage secrets using role-based access policy for granular control.
Secret management to manage elastic and scaling environments.
Cloud providers offer auto-scaling capabilities to support elastic (ephemeral) and pay-as-you-go business models. These capabilities improve efficiency, but they create new security management challenges, particularly around scalability. By implementing good secrets management practices, organizations can eliminate the need for human operators to manually apply policies to each new host: assign an identity to the host in real time and securely authenticate the requesting application based on a predefined security policy.
Secrets management to secure in-house developed and COTS applications
Homegrown applications and scripts, such as third-party tools and solutions like security, RPA, and IT management tools, often require high levels of privileged access across the enterprise infrastructure to perform their assigned tasks. Effective secrets management practices require removing hardcoded credentials from homegrown applications and scripts. It is also necessary to centralize the storage, management, and renewal of secrets to reduce risk.
