Cloud, Kubernetes and Infrastructure Security
Secrets and Key Management
We identify where the passwords, API keys and encryption keys used by your applications are stored. We determine who can access them and when they are rotated.
What it is
A secret is a confidential value that provides access to a system. Database passwords, API keys and cloud access keys are examples. Over time, these values spread into configuration files, environment variables and CI/CD definitions. The assessment checks if secrets are stored in a vault and compares the key lifecycle with NIST SP 800-57 recommendations.
Scope
- Secret vaults and access policies
- Cloud key management (KMS) policies and identities authorized to use each key
- Secrets remaining in environment variables, configuration files and CI/CD variables
- Key rotation periods and revocation process
- Customer-managed keys and HSM usage
- Short-lived credentials to replace long-lived access keys
The need
When organizations need it
- When a code repository or developer laptop is compromised and it is unclear which keys need to be rotated.
- When each team stores its keys differently and there is no central inventory.
- When you need to document key management for an audit. PCI DSS, for example, requires a defined cryptoperiod for each key type and immediate replacement of keys that are weakened or compromised.
Method
How we work
-
Discovery
We identify where secrets are located: in vaults, code, environment variables and CI/CD definitions.
-
Access analysis
We review logs to see which identities can access each secret and key, and who actually uses them.
-
Lifecycle
We compare creation, rotation and revocation processes with NIST SP 800-57 recommendations.
-
Target model
We prepare a transition plan to replace long-lived keys with short-lived credentials.
Outcome
What you have at the end
A single inventory shows where your secrets and keys are, who can access them and when they are rotated. In case of a leak, you know exactly which key to rotate and how.
Frequently asked questions
Is it a problem if our keys are managed by the cloud provider?
For many uses, provider-managed keys are sufficient. Some public sector and critical infrastructure regulations require organizations to manage their own encryption keys. In these cases, customer-managed key options are considered.
Is setting up a secrets vault sufficient?
Not by itself. If identities with broad privileges can access the vault, secrets can still be compromised. Vault access policies and the rotation process must be managed together.
Cloud, Kubernetes and Infrastructure Security
Other services in this area
Let's talk about this service.
Tell us briefly what you need. We will agree on the scope and timing together in the first meeting.
Schedule a Meeting