How do you handle sensitive data and credentials in your code base?

API keys, or other sensitive data directly in your code. If your code is ever compromised, this data could be exposed to unauthorised users.

Encryption is a powerful tool however can not used as a strong control unless strong authorization and access rights are defined. A lot goes into key management, access policies, key revocation and expiry and so on. Secret mgmt in code base has been a challenge. Its not unusual to find encryption keys, SSL cert, tokens, passwords in code base. Encryption may be effective when used in conjuction with vault or encryption as a service. Hashing should be deployed regardless as its an integrity control. Its a strong checksum to ensure values haven't altered and build the necessary trust in any transaction.

Modern cryptographic systems should ensure that salting and secret salting ("peppering") are used as an additional protection mechanism. This extra data makes it harder for threat actors to crack entire sets of hashed data in the event that the cryptographic hashes are stolen.

Encryption should be a baseline default in all platforms - there should be no exceptions of use case to require unencrypted storage. Modern practices support integration with encrypted subsystems, and monitoring of systems should alert when anything not encrypted is provisioned. Don't forget to encrypt while in motion - TLS and SSH are your go to technologies.

we only use environmental variables for non-secrets. API keys and passwords should be stored only in vaults. Environment variables should be used instead of hard coded constant values whenever possible to minimize code changes when an environment or its variables change.

From the perspective of a UI application, instead of directly calling the API Gateway, we built a Backend for the Frontend Layer which leverages Kubernetes Secrets and Configmaps to store secrets and environment variables respectively. The Authentication and Authorization requirements are fulfilled at this layer and the API layer is freed from the burden of managing those aspects for each of their consumers.

Environment variables are a safe way to store sensitive data that needs to be accessible to your code. You can define environment variables in your operating system or in a configuration file. Secret management services provide a more secure way to store sensitive data. These services typically encrypt your data and store it in a secure location.

If you need to transmit sensitive data over a network, you should encrypt it. This will help to protect the data from being intercepted by unauthorized users. You can also encrypt sensitive data that is stored on your computer or in a database.

I either use a cloud secret manager like Azure KeyVault or Gcloud Secret Manager, or in on premise compute clouds I use CyberArk which can be accessed in from any programming language but is most popular with Java shops.

Be careful about who has access to your code. Only give access to your code to people who need it. You should also make sure that your code is stored in a secure location.

use least access necessary in github repositories, run code scanners to identify vulnerabilities and make sure to require multiple approvals on pull requests before merging code in main branch.

Here are some additional tips for handling sensitive data and credentials in your code base: Use a consistent naming convention for your environment variables and secret keys. This will make it easier to manage and track your sensitive data. Use a password manager to store your passwords and other sensitive data. This will help you to keep your passwords secure and organised. Rotate your passwords and other sensitive data on a regular basis. This will help to mitigate the risk of a security breach. Educate your team members about the importance of handling sensitive data securely. This will help to ensure that everyone is aware of the risks and how to protect sensitive data.

While it’s important to ensure that secrets are not present in the code base, however this is bound to happen during the development. So one other critical aspect is about being able to monitor the existence of secrets in real time so an immediate action can be taken to minimize the risk. Our product FlyingDuck monitors for 100+ types of secrets in the code base and in real time and the best part is that the platform do not store your code or secrets. In addition to that we show where exactly the secret is along with commit id info. www.FlyingDuck.io