Secrets Management

The term ‘secrets’ in IT refers to protected credentials like passwords, keys, tokens, and certificates. The most common cause of unauthorized system access is account takeovers, worsened by poor password management, hardcoded credentials, and unprotected database passwords. In multi-cloud environments, adopting ‘secrets management’ technology helps mitigate these risks. Secrets Management encompasses the secure handling of various types of authentication credentials needed by people, systems, or devices. Passwords, although still in use, are being phased out for more secure mechanisms like tokens and keys. Tokens serve different purposes including providing complex passwords, one-time passwords, or API tokens for service authentication. Keys are critical for tasks like user authentication, session protection, and data encryption. Effective secrets management requires a secure storage facility with controlled access, lifecycle management, and the ability to manage secrets as they expire or become obsolete.

The secrets management market includes products like secret storage vaults, credential lifecycle managers, and key management tools. Password management combines secure storage with lifecycle governance, often as part of Privileged Access Management (PAM) solutions. Token management involves securely storing and using different software tokens, often in DevOps environments. Key management, involving both synchronous and asynchronous keys, secures communications and validates software identities.

The market is varied, including on-premises and cloud solutions, and is used for managing IDs, machine authentication, software development environments, and IoT device communication. Effective secrets management strategies should evaluate organizational secrets usage, determine process shortcomings, and plan for secure, scalable future implementations.

Overall, vendors are diversified in their offerings, with leaders identified across product, innovation, and market categories. Best practice selection includes detailed analysis and pilot testing tailored to specific organizational needs.

• Secrets Management in IT now encompasses a range of protected credentials.
• Account takeovers are the most common form of unauthorized system access.
• Tokens offer an additional layer of security for authentication, replacing complex passwords.
• Keys are used extensively for encryption and secure communication.
• Secure storage facilities are essential in managing access to protected secrets.
• The industry is moving towards stronger authentication mechanisms like multi-factor authentication.
• Private Access Tokens simplify user access to websites, substituting for CAPTCHAs.
• PKI certificates, although not 'secrets,' require mechanisms to ensure their validity.
• Secure communication methods like TLS and SSH are crucial for modern infrastructures.
• FIDO2 specifications significantly enhance password-less authentication ease.

• "The term ‘secrets’ has recently been seconded into the IT lexicon."
• "Account takeovers remain the most common mechanism for unauthorized intrusion."
• "Secrets management requires a secure storage facility with the capability for approved persons to manage access rights."
• "Passwords are a perennial problem and are slowly being replaced by other authentication mechanisms."
• "Software tokens can be a passphrase stored on a system that is substituted for a password."
• "PKI certificates, although not ‘secrets,’ require mechanisms to ensure validity and currency."
• "Managing certificates, and ensuring key pairs are generated in a secure infrastructure, provides the highest level of security."
• "The increasing support for FIDO2 and the decreasing costs of USB storage devices means there is potential for a lower overall cost environment."
• "One of the drawbacks of a hardware storage delivery model is the necessity to manage the issuance of the devices themselves."
• "The environment consists of a SPIRE server for registering workload Ids and an API to a relying Node."