Secrets Management
What is Secrets Management?
Tools and practices for securely storing, distributing, and rotating sensitive credentials such as API keys, passwords, and certificates in cloud environments.
Terms that appear alongside secrets management
Each of these is named in at least one of the same controls as secrets management. The number is how many controls name both.
- vulnerability 6 shared controls
- remediation 5 shared controls
- authentication 5 shared controls
- cloud security 4 shared controls
- hardening 4 shared controls
- integrity 3 shared controls
- owasp 3 shared controls
- security posture 3 shared controls
Frameworks that govern secrets management
What the standards actually require on secrets management
Requirements naming secrets management across 6 standards, quoted from the control text.
Provide secrets to containers at runtime through a managed secrets system rather than environment variables or mounted files in plaintext. Rotate secrets on schedule and revoke them when a workload is decommissioned.
SP800-190-3.20 · Secrets Management at Runtime →Per OWASP DSOMM Build and Deployment + Infrastructure Hardening dimensions: secure the build + deployment + infrastructure stack. Requirements include (a) implement signed builds + artefact integrity + secure pipeline configuration + (b) operate vulnerability...
DSOMM-3 · Build, Deployment, Infrastructure Hardening, and Secrets Management →Secure runtime storage: encryption of data at rest, secrets management, volume access control and persistent-data protection.
CNCF-RT-STORAGE · Runtime Storage Security →ISMAP Cloud Infrastructure controls cover the underlying compute + network + storage + management plane. (1) Virtual Network Segmentation: VPC Virtual Private Cloud isolation + subnets + security groups + NACLs + microsegmentation + service mesh (Istio + Linke...
ISMAP-CloudInfrastructure-NetworkSegmentation-Container-Serverless-WorkloadProtection-Hardening-ConfigManagement · ISMAP Cloud Infrastructure - VPC Network Segmentation + Container/Serverless Security + Cloud Workload Protection (CWPP) + Image/Template Hardening + CIS Benchmarks + Configuration Management + IaC →Apply Section 7.3 identity and access in cloud including: federated identity (SAML 2.0 + OAuth 2.0 + OIDC + WS-Federation) with IdP (Azure AD + Okta + Auth0 + Ping + ForgeRock + AWS IAM Identity Center) + MFA (FIDO2 + WebAuthn + TOTP + biometric) + Single Sign...
NISTSP144-5 · Identity and Access in Cloud, Federation, and Privileged Access →Apply NIST SP 800-146 Chapter 6 PaaS operational recommendations to every PaaS service consumed. Coverage must include (a) application development standards aligned to PaaS-provided languages, runtimes, and libraries, (b) secure software development lifecycle...
NISTSP146-3 · PaaS Operational Recommendations and Application Portability →Questions people ask about secrets management
What is Secrets Management?
Why is Secrets Management important for compliance?
Which compliance frameworks address Secrets Management?
Where can I learn more about Secrets Management?
See how Secrets Management applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.