12 Ways to Get a Handle on Secrets Management

Organizations in all industries have secrets that need to be protected. The modern identity landscape is filled with secrets — passwords, encryption keys, cryptocurrency wallets, SQL connection strings, storage account keys, API tokens — yet organizations are challenged with storing, managing, and protecting them.

Let’s define “secrets” as some knowledge or a piece of data that should be hidden from others – such as unapproved employees, unrelated business units, competitors or adversaries. Secrets are often used to protect, move and expose data that only protected processes like a website then displays to a user. The data “behind” the web server needs to be protected from access by any other process. If secrets aren’t managed correctly, they can expose sensitive information that could wreak havoc on an organization, its network, and its data. Currently, 87% of executives lack confidence in their organization’s level of cybersecurity, according to EY. Knowing where secrets are kept is the first step, which is easier said than done. They are likely fragmented and scattered everywhere across the organization and beyond: on premises, in the cloud, on servers, on devices, on clients, and even in code. A centralized approach to secrets management is vital for companies to protect their data and assets, while a poorly managed security approach could lead to breach, noncompliance, or outage.

12 Ways to Get a Handle on Secrets Management

1. Learn where your company’s secrets are kept and inventory them. This is easier said than done, since secrets are often scattered everywhere: on premise, on servers, devices, and clients, in the cloud, and even in code. Develop a checklist to discover which systems are using keys and collect information on their secret requirements and integration points.
2. Set your goals for security robustness. The more robust your security, the more complex the implementation. You will need to have guidelines and practices in place for your extended security team to include user access policies, automated systems updates, and secure code deployment. There are two approaches. One: create security requirements based on existing system capabilities. This will be the lowest security model, but easiest to enforce. Two: create a security requirement to be phased in over a period of years (perhaps five years). Those requirements then become the baseline for evaluating new systems, renewals, upgrades and long-term planning until the goal is implemented and enforced.
3. Centralize your approach. Place secrets in a private repository with restricted access. Leverage vaulting systems (CyberArk or Password Managers) with access management. Leverage systems such as PKI to utilize keys requiring lower management of keys.
4. Separate data from the secrets. You can use location to your advantage and keep the secrets on premise, and data in the cloud.
5. Define your implementation. Evaluate administration vs. technology solutions. Determine if you will use policy and custom processes or will leverage an existing vendor solution to achieve your goal
6. Control access. Consider security around any centralized repository. Manage control of access, authorizations, permissions, and privileges.
7. Remove the human factor, if possible. Limit employees’ access to the secrets, leverage escrow services when passwords are involved, and consider alternate identity solutions in lieu of passwords.
8. Check permissions: users, machines, applications. Determine where secrets are being created and stored and enforce restrictions that prevent unapproved creation and storage in unmanaged places.
9. Log use and look for patterns. Anomaly detection will help you better understand and assess data and user behavior.
10. Rotate encryption and identity keys. Define lifetimes and rotation strategies so encryption keys are removed from use before their cryptographic lifetimes are exceeded.  
11. Have an incident response plan ready. With threats and errors occurring with increased regularity, an incident response plan will reduce your risks (and stress) if you are faced with a security incident, requiring urgent incident response.
12. Plan ahead for data breach to reduce the impact. Having your breach response plan always updated will help, should there be any type of account or network compromise.

Once secrets are located by performing an assessment and inventory, it’s crucial to separate data from the secrets. For example, make sure the encryption keys that protect the data are separate from the secrets in a central, private repository with restricted access — such as a key management server with limited access to the public and by your employees. One recommendation is to use location to your advantage: secrets on-premises, data in the cloud. Be sure to keep data encrypted using keys and ensure keys are encrypted at rest.

Levels of Security

Depending on your resources, there are different levels of security to consider when protecting your organization’s secrets:

• Limited access: Secrets are stored in a repository/server with limited access to the public. Examples include password vaults, hardware security modules, and private Git repositories.
• Encrypted secrets: Before being stored, the secrets are encrypted. Security through obscurity is not acceptable.
• Management: An application that allows high-level control of the secrets. Examples include symmetric key management systems and password escrow services (CyberArk, for example).

Administration vs. Technology Solutions

The human element will always be the weakest link in any security protocol. Consider this: 80% of data breaches are caused by silly mistakes made by those responsible for managing secrets, according to Rashmi Jha, senior program manager at Microsoft. Here are some recommendations and principles for tightening up your security:

1. Leverage escrow services when passwords are involved.
2. Consider alternate identity solutions in lieu of passwords.
3. Key management solutions are only part of the equation.
4. Audit, compliance, and remediation are critical.
5. Consider security around any centralized repository.

The Pitfalls of Poor Secrets Management

What happens if organizations have poor secrets management? It can lead to account and network compromise, information leaks, outages, compliance issues, data breach, loss of reputation — and even business shutting down. Secrets management is an ongoing effort and it’s important to follow the “trust but verify” approach.

PKI Solutions will soon be offering its in-demand PKI training courses online. These self-paced courses are a deep dive into PKI. PKIs are the core of the IT backbone for enterprises, supporting network authentication, data encryption, code signing and secure email. The online courses will cover all of the same topics and lessons as the highly popular, in-person courses that the company has provided for many years. The course will feature video, audio, and slide-based content, taught by Mark B. Cooper, president and founder of PKI Solutions and known as The PKI Guy. He has been working with PKIs for two decades and has led hundreds of PKI trainings around the world. For more information and to sign up now for online courses, please visit https://pkisolutions.com/online-courses/.

This edited article was published on Dark Reading. View article.