3 Different Approaches to Secrets Management for Modern Enterprises

Given the increasing adoption of CI/CD methodologies and container orchestration approaches, today's enterprises face several challenges associated with cloud infrastructure sprawl.

For processes to run smoothly, CISOs and DevOps engineers need to ensure that machine identities can be verified on the fly, while credentials like keys, certificates and passwords are secure, with access privileges granted only as needed.

Indeed, safeguarding secrets has become more complex than ever.

Let's unpack the issues at hand by taking a closer look at three approaches to enterprise secrets management. Note that the best approach for your organization depends on its unique circumstances and the nature of your infrastructure.

1. Open source vaults

Open source secrets vaults like the one offered by HashiCorp are generally seen as the industry's go-to solution. HashiCorp Vault integrates with your existing infrastructure, and when configured properly across cloud environments, it's extremely useful as a centralized dashboard for managing your secrets. It can also scale as your enterprise grows, connecting and centralizing secrets from multi-cloud environments.

Linking infrastructure is, obviously, only one part of the picture. A robust security tool must back this up with the right functionalities. Solutions such as HashiCorp Vault incorporate zero trust or ZT security principles. At its core, ZT requires every entity to validate its identity before accessing information. This principle limits unauthorized usage and protects data from expired credentials, a critical issue in the enterprise.

Open source vaults help you design and monitor time-based access to secrets, a critical functionality given the machine-dominated environment at most enterprises. Modern infrastructure is dominated by microservices and containers, all operating in a fast-paced DevOps environment.

Making sure that your secrets are secure, but in a way that doesn't add too much friction to your development cycles, can be a major challenge, and this is where open source vaults shine. Despite these advantages, a few drawbacks exist.

First, open source vaults are time-consuming and complex to deploy and maintain. Upgrading to Hashicorp Vault's enterprise version is an option, but it can get extremely expensive. While the final cost depends on the degree of support an organization needs, costs frequently run higher than five figures per cluster. Add management complexity, and an open source vault might not suit smaller teams on a tight budget.

However, if you have the resources, they're a great way to secure secrets and upgrade to market best practices.

2. SaaS solutions

In response to the shortcomings of open source vaults, providers such as Akeyless offer subscription-based solutions for secrets management. These platforms work via a SaaS model, so they can offer secrets management tools across increasingly sprawling cloud environments, with limited friction when it comes to configuration and deployment.

Akeyless's SaaS vault operates in similar ways to its open source cousins – with a few critical differences. First, you do not have to spend resources installing and maintaining it across your infrastructure, saving time and money. Akeyless offers multi-tenancy, availability, and out-of-the-box backup as standard.

Another advantage SaaS vaults offer is automatic scaling and updates. Legacy vaults need constant operational handholding to function, making backups and updates a pain. While open source vaults offer the same functionality, they don't offer the operational flexibility that SaaS vaults do.

SaaS vaults also support both static and dynamic secrets storage and retrieval. While HashiCorp's solution is an exception, most open source vaults offer just static secrets, putting them at odds with the current state of cybersecurity. SaaS vaults go above and beyond in this regard, also supporting credential rotation, automatic renewal, and remote access management.

Akeyless integrates with dozens of other platforms, such as container orchestration solutions, browser extensions, and API-based runtime secret injection into code. The platform offers plenty of tools for identity and access management (IAM) as well, including just-in-time (JIT) credential generation.

And with its encryption model, which stores encrypted segments of each secret across several cloud servers, Akeyless eliminates the "secret zero" problem – a situation referring to one primary secret that guards all other secrets, which is problematic because once a hacker gets through the main gate, they can access the entire trove freely. Akeyless negates this critical flaw by storing all keys in encrypted fragments, distributed across its own cloud infrastructure, with some segments remaining on-prem on the user's side.

Add intuitive UI, full support, and cost-effectiveness to this mix, and SaaS vaults are perhaps the most accessible option for most enterprises. While they might not suit some companies with heavy customization demands, a SaaS secret management tool is often the best choice.

3. Cloud service provider vaults

Cloud service providers (CSPs) like Azure, Google Cloud and AWS offer secret vaults and managers out-of-the-box. These tools adhere to best practices and offer much of the same functionality you will find in the previous approaches. However, there are two key differences. Firstly, you do not have the same level of control over your secrets when using a CSP's solution, and there are fewer integrations with coding and DevOps platforms. And secondly, because they're cloud vendor-specific, they can't be used for multicloud infrastructure.

When setting up your CSP vault, you must share your master keys with the CSP to enable full integration, leaving yourself vulnerable to the CSP's security protocols. In case of a breach, your secrets are at risk for no fault of yours. In some cases, government entities may seize your data, since CSPs are obligated to hand them over to the authorities.

In contrast, SaaS vaults support cryptographic key generation that safeguards your master keys even from them. In short, no one has access to your complete keys except you.

These shortcomings make CSPs a poor option for most enterprises. However, they're easy to set up and get up and running. If this convenience is the most important aspect of your secrets management program, CSP vaults are the right choice for you.

Tried-and-tested approaches

The approaches highlighted in this article offer both positives and negatives for most enterprises. The right choice depends on the unique set of circumstances your company is experiencing. Whatever your choice, there is no doubt that secrets management solutions are critical to combating infrastructure sprawl that afflicts most organizations.