{"id":54213,"date":"2024-04-10T14:30:23","date_gmt":"2024-04-10T18:30:23","guid":{"rendered":"https:\/\/sdtimes.com\/?p=54213"},"modified":"2024-05-29T13:06:57","modified_gmt":"2024-05-29T17:06:57","slug":"implement-secrets-management-to-reduce-your-security-risk","status":"publish","type":"post","link":"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/","title":{"rendered":"Implement a good secrets management practice to reduce your security risk"},"content":{"rendered":"

Supply chain security has been a big topic of conversation over the past several years, and while many of the conversations have revolved around insecure third-party components in codebases, there\u2019s another part of the supply chain that could have a negative impact if not secured properly: secrets.\u00a0<\/span><\/p>\n

Max Power, product lead for <\/span>Bitwarden<\/span><\/a> Secrets Manager, said that from a development perspective, secrets include things like API keys, certificates, and SSH keys.\u00a0<\/span><\/p>\n

\u201cAny chain is only as secure as the weakest link,\u201d said Power. \u201cThe same applies to organizations. We have seen in the past multiple examples of massive data breaches as a result of accidentally leaked secrets, particularly secrets that were either hard-coded or pushed in Git repos.\u201d<\/span><\/p>\n

According to GitGuardian\u2019s <\/span>2024 State of Secrets Sprawl Report<\/span><\/a>, 12.7 million secrets were detected in public GitHub commits in 2023, which was a 28% increase from the previous year. Over the past four years, the problem of secrets sprawl has gotten four times worse, as in 2020 only 3 million secrets were detected.\u00a0<\/span><\/p>\n

Power says that when it comes to security, it\u2019s important that everyone take responsibility for the codebase, from development to production to deployment, and ensure that secrets aren\u2019t being hard-coded.\u00a0<\/span><\/p>\n

According to Brian Vallelunga, founder and CEO of the secrets management company <\/span>Doppler<\/span><\/a>, there are many ways developers share and store secrets, and some are better than others. The least secure method is storing them in files on their computer. Unfortunately, Bitwarden\u2019s Power says this is one of the most common ways secrets are stored.\u00a0<\/span><\/p>\n

A step up from that are the people storing secrets in their cloud provider tools or building their own tools, Vallelunga explained. Developers may be storing secrets in the built-in AWS tooling, for example, but that becomes tricky because it means your secrets are all tied up in one tool. And then there are companies out there building their own internal tools for this purpose, but then start running into scalability issues eventually, he said.<\/span><\/p>\n

The most secure method would be to use a dedicated secrets management provider that is designed for this specific purpose. Vallelunga explained that some of the added benefits of using these tools are that it makes it easier to share across teams and also offers things like access controls, auditing, and automated synchronization.\u00a0<\/span><\/p>\n

To put this into a real-life example, say you’re integrating with a service like Stripe, which requires you to have an API key that is needed throughout the development life cycle, explained Nic Manoogian, engineering manager at Doppler.\u00a0\u00a0<\/span><\/p>\n

\u201cSo local developers, if I’m integrating with this new service, I need a test environment to try this stuff out,\u201d he said.<\/span><\/p>\n

He said that secrets tend to be more secure in production environments for companies with a mature security practice, but then less so in local dev environments. \u201cMaybe your company has a really mature process for managing secrets in these upper environments and these deployments, but in the local development environments, it’s kind of like, well, I don’t know, call your manager and ask for the .env file, or we’ll just check it into code. And that comes with a whole bunch of other issues,\u201d said Manoogian.<\/span><\/p>\n

Vallelunga believes that in order to successfully implement good secrets management practices, teams should put up as many safeguards as possible and make it work with their workflows so that it\u2019s as easy as possible for developers.\u00a0<\/span><\/p>\n

When developers feel that they need to start taking shortcuts in order to get things done quicker, that is when security incidents happen, he explained.\u00a0<\/span><\/p>\n

Vallelunga believes that as organizations begin to grow and mature, they tend to take a closer look at risk and thus address their problems with managing secrets.\u00a0<\/span><\/p>\n

\u201cI think companies kind of go into two modes, the first mode is to build something that is valuable,\u201d he said. \u201cAnd then once they reach that point, then it’s to protect the thing that is valuable as it’s growing. And when they get into that protect mode, they start looking at all the areas of risks. And when you’re looking at the keys to your digital kingdom, that’s probably one of the biggest areas of risks you can have. And that’s when companies really start to think about that.\u201d<\/span><\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Supply chain security has been a big topic of conversation over the past several years, and while many of the conversations have revolved around insecure third-party components in codebases, there\u2019s another part of the supply chain that could have a negative impact if not secured properly: secrets.\u00a0 Max Power, product lead for Bitwarden Secrets Manager, … continue reading<\/a><\/p>\n","protected":false},"author":752,"featured_media":54214,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"cybocfi_hide_featured_image":"","footnotes":"","_links_to":"","_links_to_target":""},"categories":[1],"tags":[16924,45,1141],"coauthors":[11687],"acf":[],"yoast_head":"\nImplement a good secrets management practice to reduce your security risk - SD Times<\/title>\n<meta name=\"description\" content=\"From a development perspective, secrets include things like API keys, certificates, and SSH keys.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Implement a good secrets management practice to reduce your security risk - SD Times\" \/>\n<meta property=\"og:description\" content=\"From a development perspective, secrets include things like API keys, certificates, and SSH keys.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/\" \/>\n<meta property=\"og:site_name\" content=\"SD Times\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/SDTimesD2\" \/>\n<meta property=\"article:published_time\" content=\"2024-04-10T18:30:23+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-05-29T17:06:57+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/sdtimes.com\/wp-content\/uploads\/2024\/04\/pexels-pixabay-39624.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"1280\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Jenna Barron\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@sdtimes\" \/>\n<meta name=\"twitter:site\" content=\"@sdtimes\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jenna Barron\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/\"},\"author\":{\"name\":\"Jenna Barron\",\"@id\":\"https:\/\/sdtimes.com\/#\/schema\/person\/f2524e55ae19da07ea3613577da9f786\"},\"headline\":\"Implement a good secrets management practice to reduce your security risk\",\"datePublished\":\"2024-04-10T18:30:23+00:00\",\"dateModified\":\"2024-05-29T17:06:57+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/\"},\"wordCount\":722,\"publisher\":{\"@id\":\"https:\/\/sdtimes.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/sdtimes.com\/wp-content\/uploads\/2024\/04\/pexels-pixabay-39624.jpg\",\"keywords\":[\"secrets management\",\"security\",\"software development\"],\"articleSection\":[\"Latest News\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/\",\"url\":\"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/\",\"name\":\"Implement a good secrets management practice to reduce your security risk - SD Times\",\"isPartOf\":{\"@id\":\"https:\/\/sdtimes.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/sdtimes.com\/wp-content\/uploads\/2024\/04\/pexels-pixabay-39624.jpg\",\"datePublished\":\"2024-04-10T18:30:23+00:00\",\"dateModified\":\"2024-05-29T17:06:57+00:00\",\"description\":\"From a development perspective, secrets include things like API keys, certificates, and SSH keys.\",\"breadcrumb\":{\"@id\":\"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/#primaryimage\",\"url\":\"https:\/\/sdtimes.com\/wp-content\/uploads\/2024\/04\/pexels-pixabay-39624.jpg\",\"contentUrl\":\"https:\/\/sdtimes.com\/wp-content\/uploads\/2024\/04\/pexels-pixabay-39624.jpg\",\"width\":1920,\"height\":1280},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/sdtimes.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Implement a good secrets management practice to reduce your security risk\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/sdtimes.com\/#website\",\"url\":\"https:\/\/sdtimes.com\/\",\"name\":\"SD Times\",\"description\":\"Software Development News\",\"publisher\":{\"@id\":\"https:\/\/sdtimes.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/sdtimes.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/sdtimes.com\/#organization\",\"name\":\"SD Times\",\"url\":\"https:\/\/sdtimes.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/sdtimes.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/sdtimes.com\/wp-content\/uploads\/2014\/05\/deafaultlogo.png\",\"contentUrl\":\"https:\/\/sdtimes.com\/wp-content\/uploads\/2014\/05\/deafaultlogo.png\",\"width\":225,\"height\":90,\"caption\":\"SD Times\"},\"image\":{\"@id\":\"https:\/\/sdtimes.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/SDTimesD2\",\"https:\/\/x.com\/sdtimes\",\"https:\/\/www.linkedin.com\/company\/sdtimes\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/sdtimes.com\/#\/schema\/person\/f2524e55ae19da07ea3613577da9f786\",\"name\":\"Jenna Barron\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/sdtimes.com\/#\/schema\/person\/image\/b4be3423b187642936e62f121111345e\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/b128943929626cdcafccbac86bd306f9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/b128943929626cdcafccbac86bd306f9?s=96&d=mm&r=g\",\"caption\":\"Jenna Barron\"},\"description\":\"Jenna Barron is News Editor of SD Times.\",\"url\":\"https:\/\/sdtimes.com\/author\/jennifer-sargent\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Implement a good secrets management practice to reduce your security risk - SD Times","description":"From a development perspective, secrets include things like API keys, certificates, and SSH keys.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/","og_locale":"en_US","og_type":"article","og_title":"Implement a good secrets management practice to reduce your security risk - SD Times","og_description":"From a development perspective, secrets include things like API keys, certificates, and SSH keys.","og_url":"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/","og_site_name":"SD Times","article_publisher":"https:\/\/www.facebook.com\/SDTimesD2","article_published_time":"2024-04-10T18:30:23+00:00","article_modified_time":"2024-05-29T17:06:57+00:00","og_image":[{"width":1920,"height":1280,"url":"https:\/\/sdtimes.com\/wp-content\/uploads\/2024\/04\/pexels-pixabay-39624.jpg","type":"image\/jpeg"}],"author":"Jenna Barron","twitter_card":"summary_large_image","twitter_creator":"@sdtimes","twitter_site":"@sdtimes","twitter_misc":{"Written by":"Jenna Barron","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/#article","isPartOf":{"@id":"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/"},"author":{"name":"Jenna Barron","@id":"https:\/\/sdtimes.com\/#\/schema\/person\/f2524e55ae19da07ea3613577da9f786"},"headline":"Implement a good secrets management practice to reduce your security risk","datePublished":"2024-04-10T18:30:23+00:00","dateModified":"2024-05-29T17:06:57+00:00","mainEntityOfPage":{"@id":"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/"},"wordCount":722,"publisher":{"@id":"https:\/\/sdtimes.com\/#organization"},"image":{"@id":"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/#primaryimage"},"thumbnailUrl":"https:\/\/sdtimes.com\/wp-content\/uploads\/2024\/04\/pexels-pixabay-39624.jpg","keywords":["secrets management","security","software development"],"articleSection":["Latest News"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/","url":"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/","name":"Implement a good secrets management practice to reduce your security risk - SD Times","isPartOf":{"@id":"https:\/\/sdtimes.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/#primaryimage"},"image":{"@id":"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/#primaryimage"},"thumbnailUrl":"https:\/\/sdtimes.com\/wp-content\/uploads\/2024\/04\/pexels-pixabay-39624.jpg","datePublished":"2024-04-10T18:30:23+00:00","dateModified":"2024-05-29T17:06:57+00:00","description":"From a development perspective, secrets include things like API keys, certificates, and SSH keys.","breadcrumb":{"@id":"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/#primaryimage","url":"https:\/\/sdtimes.com\/wp-content\/uploads\/2024\/04\/pexels-pixabay-39624.jpg","contentUrl":"https:\/\/sdtimes.com\/wp-content\/uploads\/2024\/04\/pexels-pixabay-39624.jpg","width":1920,"height":1280},{"@type":"BreadcrumbList","@id":"https:\/\/sdtimes.com\/security\/implement-secrets-management-to-reduce-your-security-risk\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/sdtimes.com\/"},{"@type":"ListItem","position":2,"name":"Implement a good secrets management practice to reduce your security risk"}]},{"@type":"WebSite","@id":"https:\/\/sdtimes.com\/#website","url":"https:\/\/sdtimes.com\/","name":"SD Times","description":"Software Development News","publisher":{"@id":"https:\/\/sdtimes.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/sdtimes.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/sdtimes.com\/#organization","name":"SD Times","url":"https:\/\/sdtimes.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/sdtimes.com\/#\/schema\/logo\/image\/","url":"https:\/\/sdtimes.com\/wp-content\/uploads\/2014\/05\/deafaultlogo.png","contentUrl":"https:\/\/sdtimes.com\/wp-content\/uploads\/2014\/05\/deafaultlogo.png","width":225,"height":90,"caption":"SD Times"},"image":{"@id":"https:\/\/sdtimes.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/SDTimesD2","https:\/\/x.com\/sdtimes","https:\/\/www.linkedin.com\/company\/sdtimes\/"]},{"@type":"Person","@id":"https:\/\/sdtimes.com\/#\/schema\/person\/f2524e55ae19da07ea3613577da9f786","name":"Jenna Barron","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/sdtimes.com\/#\/schema\/person\/image\/b4be3423b187642936e62f121111345e","url":"https:\/\/secure.gravatar.com\/avatar\/b128943929626cdcafccbac86bd306f9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/b128943929626cdcafccbac86bd306f9?s=96&d=mm&r=g","caption":"Jenna Barron"},"description":"Jenna Barron is News Editor of SD Times.","url":"https:\/\/sdtimes.com\/author\/jennifer-sargent\/"}]}},"_links":{"self":[{"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/posts\/54213"}],"collection":[{"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/users\/752"}],"replies":[{"embeddable":true,"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/comments?post=54213"}],"version-history":[{"count":3,"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/posts\/54213\/revisions"}],"predecessor-version":[{"id":54258,"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/posts\/54213\/revisions\/54258"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/media\/54214"}],"wp:attachment":[{"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/media?parent=54213"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/categories?post=54213"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/tags?post=54213"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/sdtimes.com\/wp-json\/wp\/v2\/coauthors?post=54213"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}