From the course: Microservices Security Workshop: From Build to Production

Unlock this course with a free trial

Join today to access over 25,500 courses taught by industry experts.

Secrets management

Secrets management

From the course: Microservices Security Workshop: From Build to Production

Start my 1-month free trial Buy for my team

Secrets management

“

- [Narrator] Now let's move to a topic that tends to cross both security design and developer experience, managing secrets and scanning for them in the pipeline. This is a big subject to cover in one lesson, but we'll break it down to focus on the most practical patterns and trade-offs that come up in real environments. First, let's talk about how secrets are managed. In a perfect world, every application would retrieve its secrets directly from a secrets manager at runtime, use them only for a specific action and then discard them immediately from memory. That ideal model avoids storing secrets on disc or in environment variables entirely making it much harder for an attacker to even try to access them should they compromise a system. But this model is not widely used in practice. It's complex to implement, often requires deep application level changes, and usually doesn't provide enough benefit to justify the cost, especially when the risk can be mitigated in simpler ways. As a…

Contents