Sloppy Secrets Management What Are The Costs?

Faced with the challenge of how to securely share sensitive configuration between engineers and keep it in sync across development, CI, staging, and production environments, you have... ignored the problem completely.

More precisely, you've left it up to your engineers to figure out on an ad-hoc basis. How are they actually handling this stuff? What do they do when a new hire needs a whole raft of API keys and the production database credentials so they can start getting some work done? Perhaps you'd rather not know the details?

It turns out this isn't a problem you can afford to ignore or solve in an ad-hoc way. Sloppy secrets management is one of the leading causes of security breaches at teams and organizations of all sizes, from all over the world. Single-developer hobby projects and million-line Fortune 500 mega-projects are compromised for the exact same reason: they didn't keep their secrets safe.

It's a security incident waiting to happen. Attackers know that many organizations are slow to address secrets management anti-patterns. It's one of the primary vectors they seek out and exploit.

It causes bugs and outages. Since you have no strategy for keeping config in sync, it's likely to get out-of-sync and cause problems, both in development environments and across your infrastructure.

It wastes time and generates interruptions.
The following is a re-enactment.
Dev 1 says in Slack: code won't build, no idea why.
Dev 2: Hmmm, no idea.
1 hour passes...
Dev 1: ahhh %@#$ think I'm missing the DB_REPLICA_PASSWORD env var, can someone paste it in here please?
Dev 3: oh sorry, forgot to tell everyone that I added that yesterday and that it's now required for the build. here you go:
criticalpasswordisnowinSlackforever

To reduce the chances of your secrets falling into the wrong hands, there are a few principles you should follow:

Keep the number of people, servers, and third parties that have access as small as possible.

Give each person, server, or third party only the lowest level of access that is needed.

Store secrets in one place and avoid duplication so that they can be quickly and easily rotated.

We built EnvKey to make it easy to follow these principles.

End-to-end encryption and fine-grained access control help minimize your organization's attack surface.

A cross-platform desktop application and CLI allow you to manage secrets without exposing them to web browsers, where browser extensions with overly broad permissions are an ever-present threat.

It's easier to share secrets with EnvKey than email or chat. Because EnvKey keeps every developer and server in sync automatically with the latest secrets, there's no longer a need to share secrets insecurely.

Secrets are stored in one place. If you need to rotate a secret, EnvKey allows you to update it once, in one place, even if it's used by many developers, applications, and servers.

EnvKey isn't your only option to solve this problem, but it does offer a quick, secure, and reliable solution that will speed up your pace of development rather than getting in the way.