Topics In Demand
Notification
New

No notification found.

DevOps and the art of keeping secrets
DevOps and the art of keeping secrets

February 14, 2022

201

0

A Forrester study showed that as many as 57% of IT security and business leaders experienced a security incident related to exposed secrets from insecure DevOps processes, and 71% of respondents wanted to centralize automated secrets management solutions into tools that developers can directly use.

DevOps services encourage automation in order to achieve scale, but security is traditionally manual, gate-driven, and process-heavy.

Enterprises want fast results. They need to make coding easier and faster, and towards this, some corners may be cut – often at the cost of security. One example is the hard-coding of credentials/passwords, which can make coding easier and faster at the cost of healthy secrets management.

What are secrets in Devops ?

Secrets in DevOps are essentially digital credentials such as usernames and passwords, SSH keys, encryption keys, or API tokens. These digital identifiers, if mismanaged, can result in data breaches and intellectual property theft.

As organizations move to cloud-based development environments, privileged secrets are shared across business ecosystems using automation tools. While this accelerates the pace and agility of computing environments, new security gaps are opened at the interconnections of these systems.

If adequate care is not taken, developers can accidentally leak confidential information through APIs or cryptographic keys on code repositories . In a report from a few years ago, a scan of billions of files from 13% percent of  public repositories over six months revealed that over 100,000 repos have leaked API tokens and cryptographic keys, with thousands of new repositories leaking new secrets daily.

The problem is not on code repositories alone, but an overall lack of security hygiene, especially when it comes to secrets which are key to the entire project. There is a risk of secrets sprawl and blind spots, where too many developers have privileged access to key secrets, and/or the DevOps team is not aware of who all have that privileged access.

The solution is to use user-friendly, inexpensive, and well-integrated secrets management tools – which, currently, are used by only 5% of Forrester respondents.

Best Practices to Manage Secrets in DevOps

  1. Using the right tools

First of all, use a secrets management automation tool. All major CSPs provide secret storage in their environment, for example Azure has Keyvault,  AWS has AWS secrets management and GCP has Secret Manager. Your secrets management tool should function as an extension of your Privileged Access Management (PAM). Ensure the tool is centrally managed and developers cannot opt out! Make it as low-effort as possible.

  1. Leverage automation for convenience and safety

Instead of using hard-coded credentials in a particular application code base, secret management within the CSPs environment allows you to call on the required credentials through an API which allows for convenient access to the credentials wherever necessary.  There is no risk of loss or corruption of these credentials as they are maintained and stored within the CSPs and following the security and encryption protocols, placing the responsibility of their safe storage with the CSP.

DevOps practices encourage automation in order to achieve scale, but security is traditionally manual, gate-driven and process-heavy. Hence, it is important to follow these practices for a secure secret management in DevOps.

 

 


That the contents of third-party articles/blogs published here on the website, and the interpretation of all information in the article/blogs such as data, maps, numbers, opinions etc. displayed in the article/blogs and views or the opinions expressed within the content are solely of the author's; and do not reflect the opinions and beliefs of NASSCOM or its affiliates in any manner. NASSCOM does not take any liability w.r.t. content in any manner and will not be liable in any manner whatsoever for any kind of liability arising out of any act, error or omission. The contents of third-party article/blogs published, are provided solely as convenience; and the presence of these articles/blogs should not, under any circumstances, be considered as an endorsement of the contents by NASSCOM in any manner; and if you chose to access these articles/blogs , you do so at your own risk.


CloudNow is a fast-growing technology firm focused on solving real-world business problems through smart, modern technology. CloudNow provides a host of services including cloud advisory, application development and modernization, DevOps and cloud managed services to help businesses achieve their goals using innovative, cost effective and agile technology.

© Copyright nasscom. All Rights Reserved.