9 Best Practices for Secrets Management

Raw Text

Aqua Cloud Native Wiki

Cloud Native Applications Cloud Native Glossary Cloud Native Application Modernization Cloud Application Security Cloud Native Architecture Open Policy Agent Microservices Architecture Microservices Security Cloud Native Applications Cloud Native Infrastructure CNCF Landscape

Application Security Application Security Microsegmentation Python Security Node.JS Security PHP Security Zero Trust Security Fileless Attacks

Kubernetes Kubernetes Alternatives Kubernetes Kubernetes Namespace Kubernetes Architecture Kubernetes Cluster Kubernetes Nodes Kubernetes Pods Kubernetes Jobs Kubernetes Security KSPM Kubernetes on AWS Kubernetes on VMware Kubernetes Vulnerability Scanning K3s eBPF in Kubernetes Kubernetes Dashboard Kubernetes Operators Kubernetes Services Kubernetes Devops Kubernetes Networking Kubernetes Configmap Kubernetes Management Kubernetes Helm Kubernetes as a Service Kubernetes Serverless Kubernetes Benchmark Kubernetes Tutorials

Cloud Attacks Cloud Attacks Reverse Shell Attack Cryptojacking Malware Analysis Lateral Movement

Container Platforms Container Engines Container as a Service What are containers? Securing Production K8s Clusters in AKS  Container Platforms Azure Container Registry Azure Red Hat OpenShift containerd Container Deployment AWS Containers

Containerized Architecture Docker Secrets Container Runtime Interface Container Images Containerized Architecture Container Compliance Docker Security Best Practices Container Security ECS Security Network Segmentation Istio security runC Service Mesh Image Repository Container Runtime

Docker Container What Is a Container? Registry Scanning Docker CIS Benchmark Seccomp Docker Alpine Docker API Docker Tools 100 Best Docker Tutorials Docker Alternatives Docker Swarm Docker Containers vs. Virtual Machines (VMs) Docker Architecture Docker Networking Docker Registries Docker Orchestration OpenShift vs Docker Container Cloud Computing Container DevOps Docker in Production Container Monitoring Container Advantages Docker Hub

Serverless Architecture Serverless Architecture Serverless Containers Knative Serverless vs Containers

Supply Chain Security Supply Chain Compliance SolarWinds Attack Supply Chain Security Secure Software Development Lifecycle Software Supply Chain Attacks SLSA Software Composition Analysis Security Misconfigurations Privilege Escalation CI/CD Security SAST Security GitLab Security  GitHub Secret Scanning OWASP Dependency-Check Software Bill of Materials NPM Vulnerabilities Log4j Vulnerability Text4Shell Secrets Management Jenkins Security  Source Code Leaks Container Image Signing Open Source Licenses

Vulnerability Management Fileless Malware Vulnerability Management Tools Vulnerability Scanning Process Vulnerability Management Vulnerability Scanning Open Source Vulnerability Scanning Vulnerability Scanner MITRE ATT&CK Code Scanning Attack Surface What Are Indicators of Compromise (IoC)? Secure Code Configuration Drift Trivy

DevSecOps Cloud DevOps DevSecOps DevOps Tools GitOps vs DevOps DevOps Security Infrastructure as Code (IaC) Security Infrastructure as Code DevOps Executive Order 14028 (U.S. Cybersecurity Executive Order)  Shift Left Testing and Security SecDevOps DevSecOps Tools Rocky Linux Azure DevOps

Cloud Security Cloud Security Cloud Workloads Azure Cloud Security Azure Security Best Practices Cloud Security Solutions Cloud Workload Protection Platform (CWPP) Hybrid Cloud Security Multi-Cloud Strategy Cloud Infrastructure Security Gartner CSPM Cloud Security Scanner AWS CIS Benchmark CWPP Security Top 7 Risks of Cloud Computing Cloud Workload Security Cloud Vulnerabilities and Tools that Can Help Google Cloud Security AWS Cloud Security Multi Cloud Security

Kubernetes in Production Kubernetes Federation Kubernetes CIS Benchmark EKS Security Kubernetes in Production Kubernetes Security Best Practices KSPM: Kubernetes Security Posture Management Kubernetes Secrets

Secrets are non-human privileged credentials that are used to perform digital authentication when privileged users need to access sensitive applications or data.

Home

Supply Chain Security

Secrets Management

What is a secret?

Secrets are non-human privileged credentials that are used to perform digital authentication when privileged users need to access sensitive applications or data. They can take multiple forms.

In this article:

What is a secret?

What is secrets management?

6 Types of secrets

How to define best practices and what are the pitfalls of bad practices?

What is secrets management?

Secrets management involves securing the lifecycle of credentials, tokens, passwords, and other sensitive information by consistently enforcing security policies. It protects critical assets and resources across  tool stacks , platforms, and cloud environments from unauthorized access.

A recent Forrester report found that about 63% of IT leaders claim developers lack the understanding and ability to implement proper security controls. Additionally,  the same report  says that 57% of organizations suffered security incidents related to exposed secrets in DevOps.

Modern applications need to communicate with other external applications, and they require internal service-to-service communication. This means numerous privileged credentials, or secrets, are required to access any service, application and data. The number of secrets in a modern application can quickly scale. With greater scale and complexity, secrets are hard to keep. On top of leaked or compromised secrets, security teams don’t even know what to protect, thus making an already bad problem worse.

It is not enough to merely put in a few security practices to manage secrets. It is crucial to optimize these practices over time. Once secrets are compromised, even a novice cybercriminal can cause great damage.

6 Types of secrets

1. User credentials

These are usually username and password combinations used for verification of physical users and for granting access to  protected data , services, or  endpoints . They are bound to a particular user.

2. Database connection strings

Connection strings connect applications to a database server. So it would contain all the credentials (secrets) required to establish a connection to the target database or file.

3. Cryptographic keys

These ensure secure communication over risky mediums and help in identity verification and user authentication. Secrets contain both encryption and decryption keys.

4. Cloud service access credentials

Secrets required to access data, resources and servers provided by cloud service providers. They contain credentials required to  confirm authentication  of users accessing cloud resources.

5. Application programming interface (API) keys

Secrets required to  identify the source of an API request .

6. Access tokens

Secrets needed to make API requests in support of a user.

How to define best practices and what are the pitfalls of bad practices?

Secrets management best practices help minimize the risk of compromising sensitive data and eliminate the chances of unauthorized agents gaining access to critical resources. They help in ensuring complete protection at every phase of a secret’s lifecycle – from creation to deletion.

Managing and  securing  the integrity of secrets is a hard task with no room for failure. There are numerous factors that need to be taken into account. Therefore, it’s easy to give in to bad practices that lead up to major pitfalls.

Data breaches

Hardcoding or embedding credentials into the source code of an application is risky and can be used by malicious actors to grab access keys, escalate privileges, view secrets, and gain unrestricted access to cause all sorts of damage. A lack of revoking user credentials and periodic rotation of keys can also lead to intruders getting hold of sensitive data and breaching the security of an organization.

Secret sprawl

When secrets are scattered throughout a system in plain text, it can create several issues but the most significant ones are a lack of visibility, control, and an abundance of unknowability. If secrets are littered across an infrastructure, there is no way of finding out where a breach is and how to fix it.

Absence of secrets management policy

Organizations need to set clear rules of security policies to secure and control all stages of a secret’s lifecycle.

1. Differentiate between secrets and identifiers

Secrets are passwords, connection strings and any information that, if exposed, can put an organization at risk. It should only be known to an application and the authenticated users and services. Other information present in a system like identifiers need to be shared selectively which means although they are public, they shouldn’t be guessable by third parties.

Identifiers also need to be unique across all clients of an authorization server. Passwords and keys associated with identifiers usually classify as secrets.  Identifiers are at significantly lower risk than secrets and that is precisely why it’s important to have a clear differentiation between them. Secrets need to be managed better than information like identifiers are managed because they carry a bigger risk of causing significant damage to applications and enterprises if leaked.

2. Establish a circle of trust

A system has multiple parts – some that can be completely trusted, some that can be partially trusted and some that are so vulnerable that they cannot be trusted at all. It is important to identify these parts so that a circle of trust can be established. It is best to reveal secrets only to entities that can either be completely trusted (CPU, RAM etc.,) or partially trusted (employees with explicit privileges) and are a part of the circle of trust as this reduces the risk of a breach.

3. Gain visibility into the chain of trust

When secrets pass through a system, it goes through multiple steps and various entities. Each step is a link and all the links together form a chain.  It is crucial to have complete visibility across the entire chain . This helps eliminate blind spots that can be vulnerable to infiltration. It also helps have control over what trusted parts of the system have access to the secrets.

4. Encrypt data using a KMS

Ensure that all sensitive data is encrypted by a  key management service  (KMS) as it encrypts data at multiple levels making it extra secure. It helps encrypt entire files and individual pieces of data within that file with different encryption keys. This helps control what part of a data is shared and what is withheld.

5. Rotate secrets frequently

Once in use, a secret should be changed periodically. When secrets stay the same for a long time, multiple people get access to it and can end up compromising it. These compromised secrets can either be  unconsciously leaked  by employees or be hacked by malicious agents.

6. Automate password creation

Automated machine-generated passwords are random and unique which makes them less susceptible to hackers. Manually generated passwords can be easily cracked which is why they need to be ditched in favour of automated password generation.

7. Store secrets responsibly

Secrets management platforms are software applications that are designed to securely store secrets. They prevent secrets from being embedded in code or saved in any part of the system that is unnecessary and insecure.

8. Manage privileges

Users and applications that have high privileges also have access to sensitive and critical data and resources. So, this can become one of the key ways of leaking data, either consciously or unconsciously. This is precisely why it is important to follow the principle of least privilege wherein any user or application is given only those privileges that are needed to accomplish their task. If a user doesn’t require an access, they shouldn’t be given one.

Additionally, privilege elevation should be granted for a valid reason and should be limited in time. Privileged sessions should be closely monitored to improve oversight and accountability.

9. Detect unauthorized access

In spite of following best practices, some kind of compromise or infiltration is inevitable. When this happens, the most important part is being able to detect unauthorized access. The quicker it is detected, the easier it will be to resolve it with minimum damage.

Secrets management is no secret

Managing and storing secrets is a big challenge that requires surveillance from even the most experienced developer. This is why enforcing secrets management best practices helps organizations establish standard security rules and procedures that protect secrets at all stages of its lifecycle.

Get Demo

Aqua Security

Use Cases

Automate DevSecOps

Modernize Security

CNDR Cloud Native Detection & Response

Compliance and Auditing

Serverless Containers & Functions

Hybrid and Multi Cloud

Federal Cloud Native Security

Environments

Kubernetes Security

OpenShift Security

AWS Security

Azure Cloud Security

Google Cloud Security

Security for VMware Tanzu

Docker Security

Partners

Technology Partners

Partner With Us

Resources

Aqua Security Research

The Cloud Native Wiki

Kubernetes 101

AWS Cloud Security

Docker 101

The Cloud Native Channel

O’Reilly Book: Kubernetes Security

CNAPP 101

About Us

About Aqua

Newsroom

Careers

Brand Guidelines

Trust & Security

Aqua Cloud Native Protection FAQ

Get in Touch

Aqua Blog

Contact Us

Success Portal

Products

Cloud Native Security Platform

CSPM Cloud Security

Container Security

Kubernetes Security

Serverless Security

Cloud VM Security

Dynamic Threat Analysis (DTA)

Container Vulnerability Scanning

Open Source Container Security

Platform Integrations

Get Started

Privacy Policy

Terms of Use

Accessibility Tools

Normal text size

Medium text size

Large text size

Normal display

Black & White display

High contrast display

Stop transitions and animations

Underline Links

Single Line Text

Aqua Cloud Native Wiki. Cloud Native Applications Cloud Native Glossary Cloud Native Application Modernization Cloud Application Security Cloud Native Architecture Open Policy Agent Microservices Architecture Microservices Security Cloud Native Applications Cloud Native Infrastructure CNCF Landscape. Application Security Application Security Microsegmentation Python Security Node.JS Security PHP Security Zero Trust Security Fileless Attacks. Kubernetes Kubernetes Alternatives Kubernetes Kubernetes Namespace Kubernetes Architecture Kubernetes Cluster Kubernetes Nodes Kubernetes Pods Kubernetes Jobs Kubernetes Security KSPM Kubernetes on AWS Kubernetes on VMware Kubernetes Vulnerability Scanning K3s eBPF in Kubernetes Kubernetes Dashboard Kubernetes Operators Kubernetes Services Kubernetes Devops Kubernetes Networking Kubernetes Configmap Kubernetes Management Kubernetes Helm Kubernetes as a Service Kubernetes Serverless Kubernetes Benchmark Kubernetes Tutorials. Cloud Attacks Cloud Attacks Reverse Shell Attack Cryptojacking Malware Analysis Lateral Movement. Container Platforms Container Engines Container as a Service What are containers? Securing Production K8s Clusters in AKS  Container Platforms Azure Container Registry Azure Red Hat OpenShift containerd Container Deployment AWS Containers. Containerized Architecture Docker Secrets Container Runtime Interface Container Images Containerized Architecture Container Compliance Docker Security Best Practices Container Security ECS Security Network Segmentation Istio security runC Service Mesh Image Repository Container Runtime. Docker Container What Is a Container? Registry Scanning Docker CIS Benchmark Seccomp Docker Alpine Docker API Docker Tools 100 Best Docker Tutorials Docker Alternatives Docker Swarm Docker Containers vs. Virtual Machines (VMs) Docker Architecture Docker Networking Docker Registries Docker Orchestration OpenShift vs Docker Container Cloud Computing Container DevOps Docker in Production Container Monitoring Container Advantages Docker Hub. Serverless Architecture Serverless Architecture Serverless Containers Knative Serverless vs Containers. Supply Chain Security Supply Chain Compliance SolarWinds Attack Supply Chain Security Secure Software Development Lifecycle Software Supply Chain Attacks SLSA Software Composition Analysis Security Misconfigurations Privilege Escalation CI/CD Security SAST Security GitLab Security  GitHub Secret Scanning OWASP Dependency-Check Software Bill of Materials NPM Vulnerabilities Log4j Vulnerability Text4Shell Secrets Management Jenkins Security  Source Code Leaks Container Image Signing Open Source Licenses. Vulnerability Management Fileless Malware Vulnerability Management Tools Vulnerability Scanning Process Vulnerability Management Vulnerability Scanning Open Source Vulnerability Scanning Vulnerability Scanner MITRE ATT&CK Code Scanning Attack Surface What Are Indicators of Compromise (IoC)? Secure Code Configuration Drift Trivy. DevSecOps Cloud DevOps DevSecOps DevOps Tools GitOps vs DevOps DevOps Security Infrastructure as Code (IaC) Security Infrastructure as Code DevOps Executive Order 14028 (U.S. Cybersecurity Executive Order)  Shift Left Testing and Security SecDevOps DevSecOps Tools Rocky Linux Azure DevOps. Cloud Security Cloud Security Cloud Workloads Azure Cloud Security Azure Security Best Practices Cloud Security Solutions Cloud Workload Protection Platform (CWPP) Hybrid Cloud Security Multi-Cloud Strategy Cloud Infrastructure Security Gartner CSPM Cloud Security Scanner AWS CIS Benchmark CWPP Security Top 7 Risks of Cloud Computing Cloud Workload Security Cloud Vulnerabilities and Tools that Can Help Google Cloud Security AWS Cloud Security Multi Cloud Security. Kubernetes in Production Kubernetes Federation Kubernetes CIS Benchmark EKS Security Kubernetes in Production Kubernetes Security Best Practices KSPM: Kubernetes Security Posture Management Kubernetes Secrets. Secrets are non-human privileged credentials that are used to perform digital authentication when privileged users need to access sensitive applications or data. Home. Supply Chain Security. Secrets Management. What is a secret? Secrets are non-human privileged credentials that are used to perform digital authentication when privileged users need to access sensitive applications or data. They can take multiple forms. In this article: What is a secret? What is secrets management? 6 Types of secrets. How to define best practices and what are the pitfalls of bad practices? What is secrets management? Secrets management involves securing the lifecycle of credentials, tokens, passwords, and other sensitive information by consistently enforcing security policies. It protects critical assets and resources across  tool stacks , platforms, and cloud environments from unauthorized access. A recent Forrester report found that about 63% of IT leaders claim developers lack the understanding and ability to implement proper security controls. Additionally,  the same report  says that 57% of organizations suffered security incidents related to exposed secrets in DevOps. Modern applications need to communicate with other external applications, and they require internal service-to-service communication. This means numerous privileged credentials, or secrets, are required to access any service, application and data. The number of secrets in a modern application can quickly scale. With greater scale and complexity, secrets are hard to keep. On top of leaked or compromised secrets, security teams don’t even know what to protect, thus making an already bad problem worse. It is not enough to merely put in a few security practices to manage secrets. It is crucial to optimize these practices over time. Once secrets are compromised, even a novice cybercriminal can cause great damage. 6 Types of secrets. 1. User credentials. These are usually username and password combinations used for verification of physical users and for granting access to  protected data , services, or  endpoints . They are bound to a particular user. 2. Database connection strings. Connection strings connect applications to a database server. So it would contain all the credentials (secrets) required to establish a connection to the target database or file. 3. Cryptographic keys. These ensure secure communication over risky mediums and help in identity verification and user authentication. Secrets contain both encryption and decryption keys. 4. Cloud service access credentials. Secrets required to access data, resources and servers provided by cloud service providers. They contain credentials required to  confirm authentication  of users accessing cloud resources. 5. Application programming interface (API) keys. Secrets required to  identify the source of an API request . 6. Access tokens. Secrets needed to make API requests in support of a user. How to define best practices and what are the pitfalls of bad practices? Secrets management best practices help minimize the risk of compromising sensitive data and eliminate the chances of unauthorized agents gaining access to critical resources. They help in ensuring complete protection at every phase of a secret’s lifecycle – from creation to deletion. Managing and  securing  the integrity of secrets is a hard task with no room for failure. There are numerous factors that need to be taken into account. Therefore, it’s easy to give in to bad practices that lead up to major pitfalls. Data breaches. Hardcoding or embedding credentials into the source code of an application is risky and can be used by malicious actors to grab access keys, escalate privileges, view secrets, and gain unrestricted access to cause all sorts of damage. A lack of revoking user credentials and periodic rotation of keys can also lead to intruders getting hold of sensitive data and breaching the security of an organization. Secret sprawl. When secrets are scattered throughout a system in plain text, it can create several issues but the most significant ones are a lack of visibility, control, and an abundance of unknowability. If secrets are littered across an infrastructure, there is no way of finding out where a breach is and how to fix it. Absence of secrets management policy. Organizations need to set clear rules of security policies to secure and control all stages of a secret’s lifecycle. 1. Differentiate between secrets and identifiers. Secrets are passwords, connection strings and any information that, if exposed, can put an organization at risk. It should only be known to an application and the authenticated users and services. Other information present in a system like identifiers need to be shared selectively which means although they are public, they shouldn’t be guessable by third parties. Identifiers also need to be unique across all clients of an authorization server. Passwords and keys associated with identifiers usually classify as secrets.  Identifiers are at significantly lower risk than secrets and that is precisely why it’s important to have a clear differentiation between them. Secrets need to be managed better than information like identifiers are managed because they carry a bigger risk of causing significant damage to applications and enterprises if leaked. 2. Establish a circle of trust. A system has multiple parts – some that can be completely trusted, some that can be partially trusted and some that are so vulnerable that they cannot be trusted at all. It is important to identify these parts so that a circle of trust can be established. It is best to reveal secrets only to entities that can either be completely trusted (CPU, RAM etc.,) or partially trusted (employees with explicit privileges) and are a part of the circle of trust as this reduces the risk of a breach. 3. Gain visibility into the chain of trust. When secrets pass through a system, it goes through multiple steps and various entities. Each step is a link and all the links together form a chain.  It is crucial to have complete visibility across the entire chain . This helps eliminate blind spots that can be vulnerable to infiltration. It also helps have control over what trusted parts of the system have access to the secrets. 4. Encrypt data using a KMS. Ensure that all sensitive data is encrypted by a  key management service  (KMS) as it encrypts data at multiple levels making it extra secure. It helps encrypt entire files and individual pieces of data within that file with different encryption keys. This helps control what part of a data is shared and what is withheld. 5. Rotate secrets frequently. Once in use, a secret should be changed periodically. When secrets stay the same for a long time, multiple people get access to it and can end up compromising it. These compromised secrets can either be  unconsciously leaked  by employees or be hacked by malicious agents. 6. Automate password creation. Automated machine-generated passwords are random and unique which makes them less susceptible to hackers. Manually generated passwords can be easily cracked which is why they need to be ditched in favour of automated password generation. 7. Store secrets responsibly. Secrets management platforms are software applications that are designed to securely store secrets. They prevent secrets from being embedded in code or saved in any part of the system that is unnecessary and insecure. 8. Manage privileges. Users and applications that have high privileges also have access to sensitive and critical data and resources. So, this can become one of the key ways of leaking data, either consciously or unconsciously. This is precisely why it is important to follow the principle of least privilege wherein any user or application is given only those privileges that are needed to accomplish their task. If a user doesn’t require an access, they shouldn’t be given one. Additionally, privilege elevation should be granted for a valid reason and should be limited in time. Privileged sessions should be closely monitored to improve oversight and accountability. 9. Detect unauthorized access. In spite of following best practices, some kind of compromise or infiltration is inevitable. When this happens, the most important part is being able to detect unauthorized access. The quicker it is detected, the easier it will be to resolve it with minimum damage. Secrets management is no secret. Managing and storing secrets is a big challenge that requires surveillance from even the most experienced developer. This is why enforcing secrets management best practices helps organizations establish standard security rules and procedures that protect secrets at all stages of its lifecycle. . . Get Demo. Aqua Security. Use Cases. Automate DevSecOps. Modernize Security. CNDR Cloud Native Detection & Response. Compliance and Auditing. Serverless Containers & Functions. Hybrid and Multi Cloud. Federal Cloud Native Security. Environments. Kubernetes Security. OpenShift Security. AWS Security. Azure Cloud Security. Google Cloud Security. Security for VMware Tanzu. Docker Security. Partners. Technology Partners. Partner With Us. Resources. Aqua Security Research. The Cloud Native Wiki. Kubernetes 101. AWS Cloud Security. Docker 101. The Cloud Native Channel. O’Reilly Book: Kubernetes Security. CNAPP 101. About Us. About Aqua. Newsroom. Careers. Brand Guidelines. Trust & Security. Aqua Cloud Native Protection FAQ. Get in Touch. Aqua Blog. Contact Us. Success Portal. Products. Cloud Native Security Platform. CSPM Cloud Security. Container Security. Kubernetes Security. Serverless Security. Cloud VM Security. Dynamic Threat Analysis (DTA) Container Vulnerability Scanning. Open Source Container Security. Platform Integrations. Get Started. Privacy Policy. Terms of Use. Accessibility Tools. Normal text size. Medium text size. Large text size. Normal display. Black & White display. High contrast display. Stop transitions and animations. Underline Links.