Secrets - Protect the Information
Slide No. 1
What is Secret?
Generic Term: Secrets must be hidden, but they also must be stored somewhere. Examples: House keys, Vehicle Keys...
IT Term: a secret is a highly private piece of information that unlocks sensitive and protected resources. It is what grants access to your most sensitive systems, services, and data both in transit and at rest. Examples: database passwords, privileged account credentials, SSH keys, encryption keys, API keys, and private certificates for secure communication and data transmission.
Slide No. 2
Gartner says...
According to Gartner, by 2021, more than half of organizations using DevOps will be using PAM-based secrets management services and solutions. That’s a promising prediction, considering that today only about 10% of organizations use secrets management solutions. At the same time, secrets management is crucial for all organizations, whether they use DevOps or not, because all organizations use digital secrets to some extent.
Slide No. 3
Secrets Management
Secrets management is the process of securely and efficiently managing the creation, rotation, revocation, and storage of digital authorization credentials. In a way, secrets management can be seen as an enhanced version of password management. While the scope of managed credentials is larger, the goal is the same — to protect critical assets from unauthorized access.
With secrets management policy, organizations can prevent various cybersecurity issues, including unauthorized access to critical data and systems, data losses, and data breaches.
Slide No. 4
Secret's Lifecycle
Creation – Secrets can either be created manually by a user (a password to a personal account) or generated automatically (an encryption key for deciphering).
Storage – Secrets can be stored centrally or separately, using designated solutions (a PAM-based secrets management tool or password manager) or common approaches (in a text file, on a shared disk, etc.).
Rotation – Secrets can be changed or reset on a schedule, thus improving the overall protection of an organization’s infrastructure. Secrets rotation is one of the key requirements of many regulations and standards, including NIST and PCI DSS.
Revocation – Secrets can be revoked in the case of a cybersecurity incident. Organizations can prevent or limit the negative consequences of an incident and make sure that attackers can’t use compromised credentials for accessing your organization’s critical resources, systems, endpoints, or applications.
Slide No. 5
How to use Secret Securely
Authenticate
Authenticate all access requests made with non-human credentials.
Apply
Apply the principle of least privilege: ensure that each user is given the minimal access level and permissions to perform their job.
Use
Use role-based access control (RBAC) so that access is granted based on a person’s role in the organization.
Enforce
Enforce routine secret rotations. For example, you should change encryption keys frequently and re-encrypt the data accordingly.
Formulate
Formulate consistent access policies and enforce them with automated secret management tools.
Keep
Keep a thorough audit trail to track all access requests.
Remove
Remove secrets from unprotected locations, including code and configuration files.
Slide No. 6
Problems / Risk / Challenges
Weak passwords
Storing secrets in plain text
Sharing passwords
No secrets revocation (key NIST requirements)
No secrets rotation (PCI DSS recommends)
Reusing secrets
Slide No. 7
Secret Management Services
HashiCorp Vault
AWS Secrets Manager
Akeyless Vault
Square Keywhiz
Confidant
Strongbox
Azure Key Vault
Docker Secrets
Knox
GCP's Secret Manger
Slide No. 8
Best Practices & Solutions
Discover / identify all types of passwords
Eliminate hardcoded/embedded secrets
Enforce password security best practices
Apply privileged session monitoring to log, audit, and monitor
Extend secrets management to third-parties
Threat analytics (detect anomalies and potential threats)
DevSecOps: other security best practices, including the principle of least privilege (PoLP) and separation of privilege.
Slide No. 9
Conclusion
Secrets management is important for ensuring an organization’s cybersecurity. It covers all processes and tools related to the creation, storage, transmission, and management of digital credentials such as encryption keys, APIs, and passwords.
To manage secrets both securely and effectively, organizations should build a core secrets management policy that establishes standard rules and procedures for all phases of a secret’s lifecycle. To avoid human errors, it’s best to deploy a centralized secrets management solution.
PAM solutions enriched with secrets management capabilities allow organizations to tackle two main cybersecurity tasks:
Securely and effectively manage different types of secrets
Control, monitor, and audit privileged accounts
Slide No. 10
Resources & References.