Secrets Management
Centralized storage, distribution, rotation, and audit of credentials used by applications and infrastructure. Modern secrets management issues short-lived dynamic credentials rather than long-lived static secrets.
The measure of a secrets program is not how many secrets are in the vault but how many exist outside it, and the winning move is issuing short-lived dynamic credentials so there is nothing durable to steal. Vaulting a static database password improves auditability; generating a 15-minute one on demand removes the asset. Most incidents still start with a credential in a repository, not in a vault.
See also: what is secrets management, secrets rotation, workload identity, secrets vendors
Related on Start with Identity
- GlossaryCertificate Lifecycle Management
Discovering, issuing, renewing, and revoking TLS and other certificates across an organization. Automation matters because expired or unmanaged certificates cau
- GlossaryConsent Management
Capturing, storing, and honoring user consent for data processing and communications, often to satisfy GDPR and similar laws. Central to customer identity and p
- CVEHashiCorp Vault LDAP auth username enumeration
Vault's LDAP auth method returned different errors for unknown and known users. Enumeration is how a lockout or MFA-bypass chain starts. Fixed in 1.14.1 and the
- CVEVault certificate-auth impersonation, public key not CN
Vault's cert auth method bound the entity to the validated public key, not the certificate CN. An attacker who can present a different cert with a reused key im
- CVEVault LDAP MFA enforcement bypass
Vault's LDAP auth method could be convinced to skip MFA enforcement. One of the VaultFault MFA-plane bugs. NVD CVSS was not confirmed at the time of the origina
- RankingBest Secrets Management Tools: Top 5
The top 5 secrets management tools (HashiCorp Vault, AWS Secrets Manager, CyberArk Conjur, Doppler, Infisical), scored on a 10-dimension rubric.