Secrets lie at the core of every application. These credentials enable both human-to-machine and machine-to-machine interactions. With machine identities outnumbering human identities by a staggering 45-to-1 ratio, they constitute the majority of secrets we need to safeguard. CyberArk's recent research reveals that 93% of organizations experienced two or more identity-related breaches in the past year. This highlights the urgent need to tackle this escalating issue. Many organizations, however, mistakenly believe that using plaintext credentials in private repositories is safe. Unfortunately, poor security practices in private code often lead to public leaks, as frequently reported in the news. Given the magnitude of this problem, what steps can we take?
The solution lies in revamping our processes, particularly in creating, storing, and handling machine identities. Thankfully, there is a clear path forward by integrating existing secrets management solutions with secret detection and remediation tools, all tailored to developers' workflows.
Formulating a Comprehensive Secrets Security Plan
To address the issue of machine identity management, also known as secrets sprawl, we need a concise problem statement:
"We have an unspecified number of valid, long-lived plaintext secrets dispersed across our code, configurations, CI pipelines, project management systems, and other sources. These secrets lack proper accounting and rotation strategies. Meanwhile, developers continue to use plaintext secrets as a reliable, albeit insecure, method to ensure application functionality."
Based on this definition, we can devise a multi-step plan to tackle each aspect:
- Secrets Detection - Scan code and systems involved in the software development lifecycle to identify existing plaintext credentials, collecting comprehensive information about each.
- Secrets Management - Centralize known secrets in a vault platform for better accountability.
- Developer Workflows - Modify processes and tools to facilitate the secure creation, storage, and usage of secrets.
- Secrets Scanning - Continuously monitor for any new plaintext secrets.
- Automatic Rotation - Regularly replace valid secrets to minimize their potential exploitation by malicious actors.
This phased approach allows for incremental progress towards eliminating secrets sprawl and securing all machine identities.
Identifying Your Secrets
The initial challenge teams face in managing secret sprawl is identifying existing secrets. Manual searches would quickly overwhelm any team, but fortunately, secrets scanning tools like GitGuardian can automate this process and provide critical insights. Establish a communication path to collaborate with developers on remediation efforts.
Implementing a Centralized Secrets Vault
Effective secrets management hinges on how secrets are stored and utilized. Enterprise vaults provide transparent accounting for all known secrets, encrypting them both at rest and in transit. Solutions like CyberArk's Conjur and HashiCorp Vault Enterprise are excellent options. If your infrastructure is from a single provider, such as AWS or GCP, their vault solutions are also highly effective.
Securing Developer Workflows
Historically, developers have managed secrets independently, leading to diverse solutions like .env files and, regrettably, hardcoded secrets. A centralized vault solution offers a consistent, secure method for invoking credentials across all environments. By providing a standardized approach that is as easy to implement as current practices, developers are more likely to adopt it, ensuring deployments are not hindered by security concerns.
Additionally, consider shifting security measures left. Tools like ggshield allow developers to add automatic Git hooks to scan for plaintext credentials before any commit is made. Preventing secrets from ever being committed is the most cost-effective point in the software development lifecycle to address this issue.
Continuous Secret Scanning
Accidents happen, making ongoing monitoring essential to detect any new issues from existing developers or new teams unfamiliar with your processes. Platforms that consolidate information into coherent incidents enable rapid response. For instance, GitGuardian integrates at the code repository level to catch new plaintext credentials instantly, at every push or comment.
Automating Secret Rotation
If an attacker finds a valid secret, they can easily exploit it. However, invalid secrets are useless to them. With a centralized vault, you can implement auto-rotation strategies. Modern platforms and services often provide APIs to generate new credentials and invalidate old ones. By following guides from providers like AWS or CyberArk, you can script the automatic replacement of credentials on a regular, even daily, basis.
Comprehensive Secrets Security Requires a Plan
The optimal time to address end-to-end secrets security is now. If you lack a strategy, start by asking questions like "What secrets do we have?" or "Do we have a vault in place?" Empowering developers with secure workflows and guardrails that don't disrupt their productivity is crucial.
Maintaining vigilance in discovering and addressing new secrets is an ongoing process. It requires effort, raising awareness, and adopting the right processes and technologies. However, any organization can improve its management of machine identities and secrets, end-to-end, across the entire enterprise.
