Identity Security for Software Development

Chapter 6. Secrets Management

A Note for Early Release Readers

With Early Release ebooks, you get books in their earliest form—the author’s raw and unedited content as they write—so you can take advantage of these technologies long before the official release of these titles.

This will be the 8th chapter of the final book.

If you have comments about how we might improve the content and/or examples in this book, or if you notice missing material within this chapter, please reach out to the editor at [e-mail].

Up to this point, we have discussed the fundamental concepts and practices that apply to identity security as a whole. It’s important for you to understand these principles as they lay the foundation for any practical identity security exercise in your job. They also give us the necessary background as we move into the rest of this book: practical methods of implementing identity security.

Secrets management is the core activity behind securing non-human (machine) identities. While IT environments and use cases vary between groups and organizations, every app, script, automation tool, and other non-human identity relies on some form of privileged credential to access other apps, scripts, tools, and data. These secrets are essential for authenticating and authorizing users, services, and applications to protect data, communications, and business reputation.

The most common types of secrets are:

• Privileged account credentials

• Passwords

• Certificates

• SSH ...