Integrating security initiatives at every stage of the SDLC is gaining momentum. That is, DevOps is fast evolving into a more holistic, security-first process, known as DevSecOps.
The DevSecOps approach has gained momentum recently, but teams have a long way to go when implementing its methods. A recent Ponemon study found that in 29% of organizations, security is integrated at every phase of the software development lifecycle, while at another 40%, security is integrated at some phases.
One major element that helps ensure security during all stages of development is proper secrets management. Securely storing, managing, and accessing sensitive information (such as passwords, API keys, certificates, and other authentication tokens) is pivotal. This involves using a combination of encryption, access controls, and other security measures to ensure that sensitive information remains secure and is only accessible to authorized machines and personnel.
In enterprise DevOps and DevSecOps, where developers work with security and other teams in a highly connected and collaborative environment, secrets management plays a crucial role in ensuring the security and integrity of your software throughout the SDLC. It’s pivotal in protecting confidential data from unauthorized access, theft, or misuse. Secrets management also lets you automate tasks like secrets rotation, dynamic injection of credentials into code, and compliance maintenance.
Conversely, ineffective secrets management can lead to serious data breaches that tarnish your company’s reputation and erode customer trust. It can also result in compliance violations which invite legal penalties, fines, or even criminal charges. Not to mention, recovering from a breach is expensive, both in terms of financial costs and the time and resources required to remediate the issue.
So, as a developer, here are five best practices you must know and incorporate with your DevOps team for airtight secrets management.
1. Enable JIT Credentials Whenever Possible
Just-in-Time (JIT) credentials are temporary credentials that are dynamically generated, based on the access requirements of the user or application, and automatically expire after a short period.
As JIT credentials are short-lived, there is less time for an attacker to exploit them if they are compromised. This reduces the overall attack surface and limits the damage that an attacker can cause.
In fast-paced DevOps environments where applications and infrastructure are frequently changed, long-lived credentials can create significant security risks. Issuing JIT credentials wherever possible reduces such risk to your systems and resources.
A great way to enable JIT credentials is to use Akeyless for secrets management. The tool allows DevOps teams to easily automate JIT credentials across your infrastructure, setting these secrets to expire as soon as they’re used once, or as soon as a given operation is completed. The platform supports access to ephemeral objects in the CI/CD pipeline and includes out-of-the-box integrations with all major DevOps tools, ultimately helping you create a fully Zero Trust environment.
2. Enforce Safe Password Standards
This is an obvious yet often overlooked aspect of secrets management because everyone thinks they’re exempt. Reminding teams about using strong passwords is one thing, but setting and enforcing standards for safe passwords is another.
Here are a few ways to do just that:
- Create a password policy: Define a password policy that includes minimum length requirements, complexity rules, and expiration periods. Communicate this policy to all your DevOps team members.
- Use password managers: Encourage using password managers to generate and store complex passwords. This eliminates the need to remember complex passwords and reduces the risk of password reuse.
- Implement multi-factor authentication: Use MFA wherever possible. This provides an additional layer of security by requiring users to provide multiple forms of authentication (such as by phone or email) before gaining access to critical systems.
- Monitor and audit: Use automated tools to monitor and audit password-related activities. This helps you detect and respond to security incidents quickly while reducing the risk of human error and ensuring that password standards are consistently enforced.
Consider encouraging your DevOps lead to bring a cloud-based identity and access management solution such as Okta. It’s a customizable, secure, and drop-in solution to add authentication and authorization services to your applications, enabling all of the above at the organizational level.
3. Make Sure Your Secrets Are Stored in an Encrypted Environment
Encryption converts plaintext into ciphertext, which can only be decrypted with a secret key or password. It provides added security from unauthorized access because even if encrypted data falls into the wrong hands, it remains unreadable and unusable without the key.
If your DevOps team uses Kubernetes for orchestration, it’s important to remember that the platform’s native “Secrets” repository is not encrypted as a default, but rather uses base64 encoding. Moreover, even encrypted vaults can be problematic regarding decryption key governance. This is why enterprise DevOps teams often prefer to use a key management service (KMS).
A KMS generates, stores, and manages keys and provides them automatically when you need to encrypt or decrypt data. It also enables you to encrypt each dataset or resource with a different encryption key to control access at a more granular level.
With Encryption as a Service, you can encrypt data in transit and at rest. While many cloud providers offer their own encrypted vault services, these can’t be used in multi-cloud DevOps environments, leading to secrets sprawl and added management workloads. Akeyless, the secrets management platform mentioned earlier, provides KMS and Encryption as a Service — which means automated encryption, rotation, and tokenization for all keys and credentials with a wide range of protocols — thus saving time and allowing your team to focus on building without compromising your security posture.
4. Monitor for Unauthorized Access
Enterprise DevOps environments comprise many moving parts: tools, teams, workflows, third-party services, etc. So, even when you follow all the best practices above, it’s still possible that a breach or compromise will occur at some point.
When things go south, and an unauthorized entity gains access, it’s vital to be able to monitor, detect, and respond to the incident as soon as possible to ensure minimum damage — in terms of system downtime, financial losses, and/or damage to the company’s reputation.
For this, a cloud-based endpoint security platform like CrowdStrike greatly helps. It allows DevOps teams to detect and prevent unauthorized access by continuously monitoring all endpoints and alerting you about potential threats in real-time.
It uses machine learning and behavioral analytics to enable threat intelligence, vulnerability management, rapid incident response, and forensic investigation, thus providing strong protection against unauthorized access for DevOps teams.
5. Audit Access Permissions Regularly
Finally, as your DevOps team and its cloud infrastructure evolve over time, it’s important to review who has access to which secrets regularly. This includes both human and machine identities, and the latter can often outnumber the former manyfold.
With dynamically generated credentials from your secrets management platform, it’s easy to track the various identities that have accessed your vault and see in the session logs when they were approved to retrieve secrets. You get a list of all generated (system administrators, developers, third-party partners, automated services, and so forth) and their access permissions.
Then, by following the principle of least privilege, ensure any unnecessary access permissions are revoked. Timely restriction and separation of access privileges help shrink the attack surface by limiting lateral movement in the event of a breach. Ultimately, such regular audits ensure identities have access restricted precisely to what they need and are authorized for.
Over to You
Put these five tips into practice to transition from DevOps to DevSecOps and tighten up your organization’s secrets management.
About the Author
Tim Ferguson is a tech writer and editor. He enjoys writing about SaaS, AI, machine learning, analytics, and Big Data. He spends his free time researching the most recent technological trends.
Disclaimer: The author is completely responsible for the content of this article. The opinions expressed are their own and do not represent IEEE’s position nor that of the Computer Society nor its Leadership.
