Securing Your Secrets
A secret is anything that can harm you and/or your customers if it falls into the wrong hands, if exposed. When developers or security experts talk about secrets, they’re discussing API keys, access tokens and codes, cryptographic certificates and salts, passwords (and sometimes the usernames that go with them), and more.
In modern software, secrets have a special role—they ensure secure communications and control access to resources. This is particularly important due to the growth of microservice architectures. Now, many pieces need to “talk” to each other to create one apparent whole and they need to do so securely.
This chapter will discuss the following topics:
- How secrets get used in the development process
- How they can accidentally be divulged to the wrong parties and how that can be exploited
- How to manage secrets securely in different use cases (code, tools, and artifacts)
